A fingerprint is the output of fingerprinting. Individual signals are weak by themselves (tens of thousands of visitors share the same user agent) but their combination collapses to a unique match surprisingly fast: research from the Panopticlick project showed most visitors were uniquely identifiable across a sample of hundreds of thousands. Privacy-law treatment is strict. GDPR Recital 30 and the ePrivacy Directive both list device identifiers and fingerprints alongside cookies as forms of tracking that require the same consent basis. Modern browsers (Firefox, Safari, Tor Browser) ship anti-fingerprinting measures that quantize or normalize signals — randomizing timezone, returning generic font lists, adding noise to canvas rendering — to drop the entropy of the fingerprint below the uniqueness threshold. For analytics purposes, fingerprinting should be avoided: the legal exposure, the unreliability (as browsers push back, fingerprints drift), and the ethical posture all argue against it. The cookieless alternative (daily-rotating salted hash) provides enough signal for session attribution without the cross-day persistence that makes fingerprinting problematic.