Analytics
Also known as: device fingerprinting

Browser Fingerprinting

Identifying a visitor across visits by combining dozens of passively-observable browser and device signals — user agent, installed fonts, canvas rendering quirks, screen resolution, timezone — into a persistent identifier that does not require a cookie.

Fingerprinting exploits the accidental uniqueness of the configuration signals every browser leaks. Research at the Panopticlick project (now Cover Your Tracks, operated by the EFF) showed that most browsers are uniquely identifiable among millions based on a combination of plugins, fonts, screen dimensions, and WebGL rendering characteristics. Fingerprinting is used for fraud prevention, bot detection, rate limiting, and cross-site ad tracking. Privacy regulators treat fingerprinting hostile to the spirit of consent law because it creates a persistent identifier without the user's awareness. Safari and Firefox actively counter fingerprinting by reducing the entropy of the signals they expose (randomized User-Agent strings, blocked font enumeration, quantized hardware-concurrency values). Chrome has been slower to implement these protections but the Privacy Sandbox includes anti-fingerprinting proposals. Legitimate analytics teams should avoid fingerprinting entirely; the cookieless alternative (daily-rotating salted hashes) gives useful uniqueness signal without the cross-day persistence that triggers both user ire and regulatory pushback.

Examples

  • A fraud-prevention SDK combining canvas rendering, font list, and WebGL signals into a hash to catch repeat bot activity.
  • Firefox's `resistFingerprinting` mode quantizing clock precision and screen size to neutralize fingerprinting scripts.

Related terms

Reference

EFF — Cover Your Tracks