I can only think of a few things.. When you use the browser, the browser sends the user agent string which contains several pieces of unique information, enough to identify (or really guess) as its the same browser.
Also every Android device has an AndriodID and Apple devices do have a UDID. Changing the SIM card will not change these IDs. (But there is software to fake these).
Somehow there's a way to track these device IDs. I do remember many years ago, when my son was small, he used my credit card and there was a huge charge made by Apple Store. When queried, a guy from the US rang me and gave all the device details (including the UDID) for these downloads. So they confirmed that no one really hacked into the Apple account but it was someone using same the devices that was originally registered to the AppeID. To his defence, my son said some of the downloads were marked free, but these were really free with the purchase of another. I accused them of misleading advertising, eventually they took off nearly 75% off as a compromise. So the devices are trackable at least when using with the Apple store. But when using http or https, I cannot guarantee but could be. If you got the time do some reading and let us know too!