What Sujan said (IP address), and also:
- Storing visits across the web on different sites that use 3rd-party Google/Facebook-hosted services against a shadow session. Google Analytics, Google Maps, Google Web Fonts, Google CDN / JSON APIs, share buttons.
- I presume you don't login with Facebook / Google on any websites? If you do, that would conclusively link the aforementioned shadow session with your actual account.
- Also, there are integrated browser services calling home to Google. Check about:config?filter=google
---
Edit: For an extra step to mitigate some of the above:
Install either uBlock Origin or uMatrix and painstakingly block all of the above-mentioned 3rd-party origins: analytics, web fonts, share URLs, login APIs, CDNs and JSON APIs. Blocking the last two will break some websites - e.g. Stackoverflow - but you can further mitigate this breakage by installing the Decentraleyes extension.