green gradient background, "The Future of Application Security Is Already Here." and a read the report button.

Category: Tracking Technologies

Browser Fingerprinting

Also known as: Device Fingerprinting, Fingerprinting

Simply put

Browser fingerprinting is a technique that identifies and tracks a particular browser, and by extension its user, by collecting and combining details about the device, its settings, and its configuration. Unlike cookies, it does not rely on storing a file on the user's device, which makes it harder to notice and to clear. Because it can operate without visible storage, it is often described as a hidden or persistent way for websites and third parties to recognize returning visitors.

Formal definition

Browser fingerprinting is the systematic collection and combination of attributes exposed by a remote device and its browser (for example device details, system information, and browser settings) to derive an identifier that distinguishes one browser or user from others. It functions as a tracking method that does not depend on cookies or other client-side storage, which distinguishes it from mechanisms increasingly blocked or cleared by browsers. From a compliance perspective, although fingerprinting is not literally a cookie, in most EU and UK jurisdictions it typically falls within the same rules governing access to or storage of information on a user's device under the ePrivacy Directive and its national implementations, and any resulting processing of personal data is generally subject to the GDPR; where used for tracking, it would generally require valid prior consent under EU law, subject to evolving regulatory guidance. Requirements and enforcement positions differ across jurisdictions, and this definition does not resolve contested questions about when specific fingerprinting techniques qualify as exempt.

Why it matters

Browser fingerprinting matters because it can recognize and track returning visitors without storing anything on their device, unlike cookies. As mainstream browsers increasingly block or clear third-party cookies by default, fingerprinting has drawn attention as an alternative tracking method that is harder for users to notice and harder to clear. This has direct compliance implications: even though fingerprinting is not literally a cookie, in most EU and UK jurisdictions it typically falls within the same rules that govern access to or storage of information on a user's device under the ePrivacy Directive and its national implementations, and any resulting processing of personal data is generally subject to the GDPR.

For privacy officers and compliance teams, the significance lies in the fact that the covert nature of fingerprinting does not exempt it from consent obligations. Where fingerprinting is used for tracking purposes in the EU, it would generally require valid prior consent, meaning consent that is freely given, specific, informed, and unambiguous through a clear affirmative action. Because the technique operates without visible storage, organizations may overlook it when scoping their consent management, leaving a gap between what a consent banner covers and what tracking technologies are actually deployed.

The legal treatment of specific fingerprinting techniques remains an area of evolving regulatory guidance, and reasonable questions persist about when, if ever, certain fingerprinting uses might qualify as exempt or as strictly necessary. Requirements and enforcement positions also differ across jurisdictions; approaches under US state privacy laws, for example, often rely on opt-out mechanisms rather than the opt-in model prevalent in the EU. Organizations should therefore treat fingerprinting as a tracking technology requiring the same scrutiny as cookies rather than assuming the absence of a stored file removes it from scope.

Who it's relevant to

Privacy officers and data protection professionals

Fingerprinting should be included when mapping the tracking technologies an organization deploys. Because it can operate without visible storage, it may be missed in audits focused solely on cookies. In most EU and UK jurisdictions it typically falls within the same device-access rules as cookies under the ePrivacy Directive and its national implementations, with any resulting personal data processing generally subject to the GDPR.

Legal counsel and compliance teams

Counsel should be aware that the covert nature of fingerprinting does not remove it from consent obligations, and that where it is used for tracking in the EU it would generally require valid prior consent. Several questions about when specific techniques qualify as exempt remain contested and subject to evolving regulatory guidance, and requirements differ across the EU, the UK, and individual US states.

Web developers and engineering teams

Developers implementing analytics, anti-fraud, or advertising functionality should identify whether any component derives an identifier from device, system, or browser attributes, since such techniques may constitute fingerprinting even where no cookie or client-side storage is used. This informs whether the functionality needs to be gated behind a consent mechanism.

Marketing and analytics compliance teams

Teams relying on tracking for measurement or targeting should treat fingerprinting with the same scrutiny as cookies rather than viewing it as a consent-free alternative to blocked cookies. Because enforcement positions and guidance continue to evolve, and differ by jurisdiction, its use should be assessed against the applicable consent framework rather than assumed lawful.

Inside Browser Fingerprinting

Device and browser attributes

Data points collected from a user's device and browser, such as screen resolution, installed fonts, browser version, operating system, language settings, and time zone. Individually these are often not identifying, but in combination they can form a distinctive profile.

Passive versus active collection

Fingerprinting may occur passively through information that a browser transmits by default (for example HTTP headers), or actively through scripts that probe the device for additional characteristics (for example canvas or WebGL rendering, audio processing, or enumeration of hardware features).

Fingerprint hash or identifier

The combined attributes are typically processed into a value or profile intended to recognize a returning device or user across sessions or sites, often without storing information on the device in the way a cookie would.

Regulatory characterization

In most EU jurisdictions, fingerprinting is treated similarly to cookies under the ePrivacy Directive where it involves gaining access to, or storing, information on a user's device, and any resulting personal data processing falls within the GDPR. It is a technology that is not literally a cookie but is generally subject to the same rules.

Common questions

Answers to the questions practitioners most commonly ask about Browser Fingerprinting.

Does browser fingerprinting fall outside cookie consent rules because it doesn't use cookies?

No. Although fingerprinting does not literally place a cookie, it is generally treated the same way as cookies under EU law. The ePrivacy Directive governs the storing of, or gaining access to, information on a user's device, and regulators in most EU jurisdictions consider that fingerprinting techniques, which typically involve accessing information such as browser and device characteristics, fall within this scope. As a result, consent is generally required before fingerprinting for non-essential purposes, and separately the GDPR may apply to any personal data processed as a result. The absence of a cookie does not exempt the technique.

Is fingerprinting a 'privacy-friendly' alternative to cookies since users can't easily delete it?

This framing is misleading. The fact that fingerprinting is harder for users to detect, block, or clear than cookies tends to make it more intrusive from a privacy perspective, not less. Because it can be more difficult for users to control, data protection authorities in the EU have generally treated it with at least the same level of scrutiny as cookies. It should not be adopted as a way to avoid consent obligations; where it is used for non-essential purposes it generally attracts the same consent requirements, and the reduced transparency to users can heighten regulatory and compliance concerns.

When do we need to obtain consent before using browser fingerprinting?

In most EU jurisdictions, prior consent is generally required before fingerprinting is used for non-essential purposes such as analytics, advertising, or cross-site tracking. Where a fingerprinting technique is strictly necessary to provide a service the user has explicitly requested, for example certain security or fraud-prevention functions, an exemption may apply, but this depends on the specific purpose and is assessed narrowly. Requirements differ by jurisdiction: the UK follows a broadly similar approach, while some US state frameworks rely on opt-out rather than opt-in. You should confirm the applicable rules for each market and treat purpose classification as a legal, fact-specific judgment rather than a purely technical one.

Can our consent management platform (CMP) handle fingerprinting the same way it handles cookies?

A CMP can be configured to include fingerprinting-based tools within its consent categories and to block or gate them until consent is obtained, but this is not automatic. Fingerprinting is often implemented through scripts, SDKs, or pixels that a CMP does not detect through cookie scanning alone, so relevant technologies may need to be identified and mapped manually. A CMP supports compliance but does not guarantee it; you still need accurate documentation of what each tool does and appropriate consent logging. Confirming that fingerprinting scripts are actually suppressed prior to consent typically requires testing beyond the CMP's standard configuration.

How should we document and log consent for fingerprinting activities?

Where consent is the legal basis, you generally need to maintain records demonstrating that valid consent was obtained, capturing what the user was told, what they agreed to, and when. Because fingerprinting may be less visible to users than cookies, clear and specific information about the technique and its purposes in your notices and consent interface supports the 'informed' element of valid consent. Retain consent records consistent with your broader record-keeping obligations. The specifics of what must be logged and for how long can depend on jurisdiction and internal accountability requirements, so align this with your organization's data protection documentation practices.

How can we tell whether a third-party tool or SDK we use relies on fingerprinting?

Cookie-scanning tools alone may not reveal fingerprinting, so identification usually requires reviewing vendor documentation, technical behavior, and network activity to see whether a tool collects and combines device or browser characteristics to identify or single out users. Vendor due diligence, including asking suppliers directly about their techniques and purposes, is often necessary. Once identified, fingerprinting tools should be categorized within your consent framework according to their purpose. Whether a given technique legally qualifies as fingerprinting requiring consent can be fact-specific and, in some cases, subject to differing interpretations, so involve legal or privacy review where the classification is unclear.

Common misconceptions

Because fingerprinting does not set a cookie, it does not require consent.

In most EU jurisdictions the ePrivacy Directive applies to gaining access to, or storing, information on a user's device regardless of the mechanism, so fingerprinting that reads or stores device information can trigger the same consent requirements as cookies. Where personal data is processed, the GDPR also applies. The precise application can depend on the specific technique and national implementation.

Fingerprinting is anonymous because it does not use names or account identifiers.

A fingerprint used to single out, recognize, or track a device or user may constitute personal data under the GDPR even without a name. Whether a given implementation results in personal data depends on the facts, but treating fingerprinting as automatically anonymous is not a safe assumption in the EU.

Consent rules for fingerprinting are the same everywhere.

Obligations vary by jurisdiction. EU and UK approaches generally rely on prior consent for non-essential access to device information, while some US state frameworks such as the CCPA and CPRA in California often rely on opt-out mechanisms. The applicable standard depends on the geographic and legal scope, and enforcement positions continue to evolve.

Best practices

Inventory whether your site or app uses fingerprinting techniques, including through third-party scripts and SDKs, since these may operate without setting a traditional cookie and can be overlooked in cookie-focused audits.

Classify each fingerprinting use case by purpose (for example security, analytics, or advertising) and assess consent obligations accordingly, keeping in mind that strictly necessary uses may be treated differently from tracking uses in most EU jurisdictions.

Where fingerprinting requires consent under applicable EU or UK rules, obtain it through a clear affirmative action before the technique runs, rather than relying on pre-ticked boxes, implied consent, or cookie walls, which are widely considered non-compliant in the EU.

Configure your consent management platform to control the loading of fingerprinting scripts, and confirm through testing that no such scripts fire before consent is given where consent is required.

Determine the geographic scope of your users and apply the relevant standard, recognizing that opt-in approaches may be needed in the EU and UK while some US state laws such as the CCPA and CPRA rely on opt-out, and honor applicable signals such as Global Privacy Control where required.

Maintain records of the fingerprinting technologies in use, their purposes, and the consent or legal basis relied upon, and revisit these assessments as regulatory guidance and enforcement positions evolve, treating tools as support for, not a replacement of, legal judgment.