Fingerprinting
Fingerprinting identifies a browser or device without storing anything on it, by combining dozens of observable attributes such as the user agent, screen size, fonts, time zone, hardware and canvas rendering into a signature that is stable enough to recognize the same visitor again.Each attribute a browser reveals is common; the combination is rare. Studies have shown that a few dozen signals (installed fonts, graphics card rendering of a hidden canvas, audio processing quirks, screen dimensions, language, plugins, and the IP address) single out most browsers. Fingerprinting needs no cookie and survives cookie deletion, which is why it is used both for fraud prevention and for tracking users who refuse cookies.
Regulators treat it as a tracker. The Article 29 Working Party's Opinion 9/2014 concluded that device fingerprinting falls under Article 5(3) of the ePrivacy Directive because it gains access to information stored on the device, and the EDPB's Guidelines 2/2023 (final version October 2024) confirm the analysis for modern techniques. Consent is therefore required unless the use is strictly necessary for a service the user asked for, such as securing a login. The CNIL and the ICO say the same in their cookie guidance; the ICO's guidance on storage and access technologies, finalized in April 2026, has a section on device fingerprinting.
Browsers fight fingerprinting by reducing the entropy they expose and by randomizing values (Safari, Firefox and Brave do this to different degrees). For a website, the rule is to avoid fingerprinting scripts for marketing and to treat the ones that are needed for security as a documented, strictly necessary exception in the cookie policy; see the ePrivacy Directive.