Device fingerprinting is a tracking technique that identifies a browser or device by combining many observable attributes, such as screen size, installed fonts, graphics rendering and time zone, into a value that is stable and close to unique. In privacy, it is regarded as one of the most intrusive forms of tracking because it requires no storage on the device and leaves nothing for the user to delete.
Unlike cookies or an advertising ID, a fingerprint is inferred rather than assigned. The user cannot see it, reset it or easily refuse it, which is why regulators and browser vendors treat it as a covert identifier.
How device fingerprinting builds an identifier
A fingerprinting script collects dozens of signals, normalizes them and passes them through a hash function to produce a compact identifier. Each signal alone is shared by many users, but the combination narrows the crowd until one device stands out.
Identifying power is measured in bits of entropy. Roughly 33 bits are enough to single out one person among the world’s population, and research projects have repeatedly shown that ordinary desktop browsers often reveal enough entropy to be unique among large sample sets.
The table lists common signal sources and what they reveal.
| Signal | Collected through | Why it differs between devices |
|---|---|---|
| User agent and client hints | HTTP headers, JavaScript | Browser, version and operating system |
| Canvas rendering | Drawing hidden text or shapes | GPU, drivers and font smoothing |
| WebGL parameters | Graphics API queries | Graphics hardware and renderer strings |
| Audio processing | Audio API signal output | Floating-point differences in audio stack |
| Installed fonts | Text width measurement | Software and language packs installed |
| Screen and window | Resolution, color depth, pixel ratio | Display hardware and zoom |
| Time zone and language | Intl API, Accept-Language header | Location and user settings |
| Hardware concurrency and memory | Navigator properties | Processor cores and device class |
Passive and active fingerprinting
Fingerprinting falls into two broad types. Passive fingerprinting uses only data the device sends anyway, such as headers and IP-level characteristics, so it is invisible to the client. Active fingerprinting runs code on the device to probe rendering, audio or hardware behavior, which makes it detectable but far more precise.
| Property | Passive | Active |
|---|---|---|
| Data source | Network traffic and headers | Scripts executed in the browser or app |
| Detectability | Very low | Moderate, visible in code |
| Uniqueness | Limited | High |
| Typical users | Network operators, bot detection | Ad tech, fraud prevention, analytics |
| Countermeasures | VPN, header standardization | Script blocking, randomization, uniformity |
Fingerprints also drift over time as browsers update and settings change. Trackers handle this with probabilistic matching, linking a new fingerprint to an old one when most attributes still agree, and often combine it with IP addresses or login events to reach higher confidence.
Device fingerprinting compared with other tracking methods
Within web tracking, fingerprinting is the method of choice where stored identifiers are blocked or deleted. The comparison shows why it is attractive to trackers and problematic for users.
| Method | Stored on device | User can reset | Visibility to user |
|---|---|---|---|
| Device fingerprinting | No | Practically no | None |
| Third-party cookie | Yes | Yes, by clearing cookies | Visible in browser settings |
| Advertising ID | Yes, by the operating system | Yes, or disable it | Visible in system settings |
| Tracking pixel | No, but often paired with cookies | Indirectly | Low |
Because fingerprinting survives cookie deletion and private browsing, it can also be used to recreate deleted identifiers, a practice sometimes called respawning. This is the clearest example of fingerprinting defeating an explicit user choice.
Legal status in privacy regulation
European authorities consider fingerprinting subject to the same consent rule as cookies. Article 5(3) of the ePrivacy Directive covers gaining access to information on terminal equipment, and reading device characteristics through scripts falls within that scope. Under the GDPR, a fingerprint linked to a person is personal data, so a legal basis, transparency and data subject rights apply.
The narrow exceptions are uses strictly necessary for a requested service, and security purposes such as fraud and bot detection are often argued under legitimate interests. Even then, the data should be limited to the security purpose and not reused for advertising.
Defenses and their limitations
Browsers fight fingerprinting with two strategies: making users look identical or making outputs noisy. Both reduce entropy but carry trade-offs in compatibility and usability.
- Uniformity: Tor Browser standardizes window sizes, fonts and responses so that all users share one fingerprint.
- Randomization: some browsers add small per-session noise to canvas and audio output, breaking stability.
- API restriction: limiting high-entropy APIs and reducing user agent detail through client hints.
- Script blocking: blocklists stop known fingerprinting scripts but miss first-party or new code.
A common misconception is that installing many privacy extensions helps. In practice, an unusual set of extensions and settings can make a browser more distinctive, not less.
Understanding it simply
Device fingerprinting is a way of recognizing your device by its details instead of by a label stored on it. Your browser reveals many small facts, such as your screen size, fonts and graphics card, and together they form a pattern that is often unique.
It is like recognizing a person on the street by their height, coat, walk and voice instead of by a name badge. You can take off a badge, just as you can delete cookies, but you cannot easily change everything about yourself at once. That is why fingerprinting is hard to avoid and why the law usually requires your permission for it.
Applied in practice
A payment provider sees a rise in account takeover attempts using stolen passwords. Its security team adds an active fingerprinting script to the login page that collects about twenty signals, including canvas output, time zone and hardware concurrency.
When a login comes from a fingerprint never seen for that account and from an unusual network, the system requests a second authentication factor. The fingerprint data is stored separately from marketing systems, kept for ninety days and documented under legitimate interests for fraud prevention.
Within a few weeks, most automated takeover attempts fail at the second factor, while regular customers on known devices log in as before. The team also confirms that the fingerprints are never shared with advertising partners, which keeps the processing within its security purpose.