3rd party cookies are not required for this. They make it easier but...

I used to work on a team that could match users between browsers. E.g. Do some browsing in Chrome. Switch to Firefox, or privacy mode, or whatever with NO shared cookies go browse some more sites, and we could match up the two sessions to the same human. And no, we didn't need IP address or browser fingerprinting or any of that. It just requires a sufficient amount of network visibility, a tiny bit of patience... and a lot of processing power and storage. ;)