Device Fingerprinting

Device fingerprinting is the practice of identifying a device by combining its browser, hardware, and network attributes into a single identifier. No file is written to the device, which is why it is called stateless tracking. Each attribute is common on its own, but the combination is often unique enough to recognize the same visitor across sessions and sites.

Why Device Fingerprinting Matters

It survives the defenses most people rely on. Clearing cookies, opening a private window, or blocking third-party storage removes nothing, because there is nothing stored to remove. The fingerprint is recalculated from the device itself on every visit.

That property drives both of its uses. Fraud and risk teams use it to spot one device creating fifty accounts or reusing stolen cards. Advertisers use it for probabilistic attribution: when a click and a conversion carry no shared cookie or login, matching them on fingerprint plus timing is the fallback that keeps the campaign measurable.

The reach is not marginal. Peter Eckersley’s Panopticlick study for the Electronic Frontier Foundation tested roughly 470,000 browsers and found 94.2% of those running Flash or Java were uniquely identifiable.

What Signals a Fingerprint Uses

A fingerprint is built from dozens of small attributes, each contributing bits of entropy. Common inputs:

• User agent string: browser name, version, and operating system.
• Screen properties: resolution, color depth, and pixel ratio.
• Time zone and language: local offset plus accepted languages.
• Installed fonts: the specific font list is highly distinguishing.
• Hardware hints: CPU core count, device memory, touch support.
• Graphics stack: WebGL vendor and renderer strings naming the actual GPU.
• IP address: coarse location and network, though it changes often.

No single item identifies anyone, but thirty weak signals stacked together produce a value that few or no other devices match. You can measure your own with the EFF’s Cover Your Tracks tool, the successor to Panopticlick, or amiunique.org.

Types of Device Fingerprinting

The first split is how the data is gathered.

Passive fingerprinting reads what the device sends anyway: HTTP headers, the user agent, the IP address, and TLS handshake details. It runs invisibly and cannot be detected by the visitor.

Active fingerprinting runs JavaScript to probe the device for information it does not volunteer. Three techniques do most of the work:

• Canvas fingerprinting draws hidden text and shapes to an HTML canvas, then reads the pixels back as a hash. Differences in GPU, driver, and font rendering make the output stable per device and different across devices. Acar and colleagues documented it on more than 5% of the top 100,000 sites in their 2014 study.
• WebGL fingerprinting renders a 3D scene and hashes the result, capturing the graphics pipeline in more detail than canvas alone.
• Audio fingerprinting processes a waveform through the Web Audio API and hashes the output, exposing small differences in audio stack processing.

Browser fingerprinting is the web version of all this. Mobile app fingerprinting reads device attributes through the OS instead, though both Apple and Google now restrict it heavily.

Device Fingerprinting vs Cookies

The difference is where the identifier lives. A third-party cookie is stored on the device, so the user can inspect it, block it, or delete it, and the browser can expire it. A fingerprint is computed on the server or in script from attributes the device exposes, so the user has nothing to delete.

That makes fingerprinting more durable and less accurate at the same time. Cookies are exact until removed. Fingerprints are probabilistic: two identical laptops from the same corporate rollout can collide, and one device’s fingerprint drifts every time the browser updates or a font is installed.

The practical consequence for measurement is that fingerprint-based numbers are estimates. Declared, first-party identifiers avoid the problem entirely, which is why UTM tagging still works when every cookie is refused. Campaign source travels in the URL rather than in storage, so a UTM analytics dashboard reports on consented, first-party click data instead of inferred matches.

Is Device Fingerprinting Legal?

It depends on jurisdiction, and in the EU the answer is that it needs consent. Article 5(3) of the ePrivacy Directive covers gaining access to information stored in a user’s terminal equipment, not just cookies specifically. The Article 29 Working Party settled the question in Opinion 9/2014, confirming that device fingerprinting falls under the same consent requirement. Under GDPR, a fingerprint used to single out a person is personal data.

In the United States there is no federal prohibition. California’s CCPA includes probabilistic identifiers in its definition of a unique identifier, so a fingerprint counts as personal information and carries disclosure and opt-out duties.

Platform rules can be stricter than law. Apple’s App Store Review Guidelines forbid deriving data from a device to uniquely identify it for tracking, regardless of whether the user granted App Tracking Transparency permission. Google moved the other way: its advertising policy change effective February 16, 2025 permitted advertisers to use fingerprinting signals, a reversal the UK Information Commissioner’s Office publicly called irresponsible in December 2024.

Frequently Asked Questions

What is device fingerprinting?

Device fingerprinting identifies a device by combining attributes such as its user agent, screen resolution, time zone, installed fonts, and graphics hardware into one identifier. Nothing is saved to the device, so the identifier is recalculated on each visit rather than retrieved from storage. It is used for fraud detection, bot filtering, and probabilistic attribution.

What is browser fingerprinting?

Browser fingerprinting is device fingerprinting carried out in a web browser, using signals the browser exposes to JavaScript and HTTP headers. Canvas, WebGL, and audio fingerprinting are its most distinguishing techniques because they capture how a specific hardware and driver combination renders output. The terms are often used interchangeably, though device fingerprinting also covers native mobile apps.

Does clearing cookies or using incognito mode stop fingerprinting?

No. Fingerprinting stores nothing on the device, so there is nothing for a cookie clear or a private window to remove. Private browsing changes little because the same screen size, fonts, time zone, and GPU are still reported. Browsers that actively resist it, such as Tor Browser and Brave, work by normalizing or randomizing those signals instead.

How is fingerprinting different from cookie-based tracking?

Cookies are stateful and exact: an identifier is written to the device and read back until deleted. Fingerprinting is stateless and probabilistic: the identifier is inferred, so it cannot be deleted but it can collide between similar devices and drifts as software changes. See cross-device tracking for how the two methods compare in practice.

Is device fingerprinting legal?

In the EU it requires consent. The Article 29 Working Party’s Opinion 9/2014 confirmed that ePrivacy Article 5(3) applies to fingerprinting just as it does to cookies, and GDPR treats an identifying fingerprint as personal data. In the US it is permitted but regulated, with CCPA classing probabilistic identifiers as personal information. Apple bans it for tracking in App Store apps outright.

For campaign measurement that does not depend on inferred identity, tag your links with the free UTM builder at linkutm.