Category: Tracking Technologies
Canvas Fingerprinting
Also known as: HTML5 Canvas Fingerprinting
Simply put
Canvas fingerprinting is a technique that websites can use to identify and track visitors without relying on traditional cookies. It works by asking your browser to draw a hidden image using the HTML5 canvas element, and small differences in how each device and browser render that image produce a distinctive identifier that can single out a user. Because it does not store a file on your device in the way a cookie does, it is often less visible to users than conventional cookie-based tracking.
Formal definition
Canvas fingerprinting is a browser- and device-fingerprinting method that leverages the HTML5 canvas element to generate a persistent identifier for a user. A script instructs the browser to render text and/or graphics to an off-screen (typically invisible) canvas, then extracts the resulting pixel data; subtle variations arising from the device's GPU, graphics drivers, rendering engine, font rasterization, and anti-aliasing behavior yield an output that tends to be consistent for a given device/browser configuration and distinguishable across different ones. This hashed or encoded output serves as a fingerprint that can be used to recognize and track a user across sessions or sites. From a compliance standpoint, canvas fingerprinting is not a cookie but generally falls within the same regulatory scope as cookies: in most EU jurisdictions the ePrivacy Directive rules on gaining access to or storing information on a user's device may apply to such techniques, and any resulting processing of personal data would separately engage the GDPR, so prior consent may be required where it is used for non-essential purposes such as tracking. Requirements differ under other regimes, and the precise regulatory treatment can depend on facts and evolving authority guidance not addressed here.
Why it matters
Canvas fingerprinting matters because it enables tracking that is largely invisible to users and, unlike cookies, does not store an easily inspectable or deletable file on the device. This means common user controls, clearing cookies, using private browsing modes, or reviewing browser storage, may not reveal or remove the technique, making it harder for individuals to exercise meaningful choice over how they are tracked. For privacy officers and compliance teams, this reduced visibility raises the stakes: a tracking method users cannot easily detect or refuse sits uncomfortably with the transparency and control principles that underpin EU data protection law.
Who it's relevant to
Privacy officers and data protection professionals
Canvas fingerprinting used for non-essential purposes such as cross-site tracking generally falls within the same regulatory scope as cookies. In most EU jurisdictions, the ePrivacy Directive rules on gaining access to or storing information on a user's device may apply to such techniques, and any resulting processing of personal data would separately engage the GDPR, so prior consent may be required. Privacy teams should map where fingerprinting is deployed and assess the lawful basis and consent position for each use, recognizing that the precise regulatory treatment can depend on facts and evolving authority guidance.
Legal counsel and compliance teams
Because fingerprinting is not literally a cookie, teams should be careful not to assume it is exempt from consent obligations or that a general cookie banner covers it. Requirements differ across regimes, the EU and UK broadly rely on prior consent for non-essential tracking, while US state privacy frameworks often rely on opt-out mechanisms, so counsel should scope obligations to the relevant jurisdiction rather than applying one standard universally. Where interpretations are contested or authority guidance is still developing, that uncertainty should be documented rather than resolved by assumption.
Web developers and marketing technology teams
Developers and martech teams should be able to identify whether their sites, tags, SDKs, or third-party vendors use canvas fingerprinting, since it may be embedded within analytics, fraud-prevention, or advertising tools without being obvious. Where fingerprinting serves non-essential purposes, it should generally be gated behind valid consent in the same way as non-essential cookies in EU contexts. Consent management platforms can help govern when such scripts fire, but tools support compliance rather than guaranteeing it, and legal judgment remains necessary.
Inside Canvas Fingerprinting
Canvas API exploitation
A technique that instructs the browser to draw text or graphics using the HTML5 Canvas element, then reads back the rendered image data. Subtle differences in how each device renders the same drawing instructions produce a distinctive value.
Hardware and software variation
The uniqueness of a canvas fingerprint derives from differences in the user's GPU, graphics drivers, operating system, installed fonts, and browser version, which cause the same rendering instructions to yield slightly different output.
Stateless identification
Unlike cookies, canvas fingerprinting does not require storing a file on the device. It derives an identifier from device characteristics, which is why it is often described as a stateless or storage-independent tracking method.
Device or browser fingerprint
The output is typically hashed and combined with other signals to form a broader device fingerprint that can be used to recognise or distinguish a user across sessions or sites.
Legal characterisation
Because canvas fingerprinting involves gaining access to information stored on, or reading characteristics generated by, the user's device, it generally falls within the scope of the ePrivacy Directive's rules on access to terminal equipment in most EU jurisdictions, and any resulting personal data processing is separately governed by the GDPR.
Common questions
Answers to the questions practitioners most commonly ask about Canvas Fingerprinting.
Is canvas fingerprinting exempt from consent because it doesn't use cookies?
No. Although canvas fingerprinting does not store an identifier in a cookie, EU rules on tracking technologies are not limited to cookies. In most EU jurisdictions, the ePrivacy Directive governs the storing of information on, or gaining of access to information already stored in, a user's device, and guidance from several data protection authorities treats fingerprinting techniques as falling within the same rules. Where canvas fingerprinting involves gaining access to information from the device to build an identifier, prior consent is generally required unless a specific exemption applies. The absence of a cookie does not by itself remove the consent obligation.
Since fingerprinting doesn't rely on a stored identifier tied to a name, does it avoid the GDPR?
Not necessarily. Two distinct legal regimes can apply. The ePrivacy Directive addresses the act of accessing information on the device, while the GDPR governs any subsequent processing of personal data. A canvas fingerprint used to single out, recognise, or track a user can constitute personal data under the GDPR even without a name attached, because identifiability includes the ability to distinguish one user from others. Where that is the case, GDPR principles and a valid lawful basis are generally engaged in addition to any ePrivacy consent requirement. Whether a given fingerprint amounts to personal data depends on the facts of the implementation.
How can we detect whether canvas fingerprinting is running on our own website?
Detection typically involves reviewing which scripts interact with the HTML canvas API, particularly calls that read rendered image data, and identifying whether any first-party or third-party code combines such outputs with other device signals to derive an identifier. This may require code review, network and script auditing, and questioning vendors and tag providers about the techniques their SDKs and pixels use. Automated scanning tools can flag suspected fingerprinting activity, but they do not always distinguish legitimate rendering from covert tracking, so their output generally needs technical interpretation. This answer describes an approach rather than a guaranteed method of finding every instance.
If canvas fingerprinting requires consent, when in the page lifecycle should it be triggered?
Where consent is required, the general principle in most EU jurisdictions is that the fingerprinting technique should not access device information or run before the user has given valid consent through a clear affirmative action. In practice this means gating the relevant scripts behind the consent decision rather than loading them on page load and deactivating them later. Pre-consent execution followed by later suppression may still involve the access to device information that triggers the requirement. The precise sequencing that satisfies a given authority's expectations depends on that authority's guidance and is not settled uniformly across jurisdictions.
How should canvas fingerprinting be categorised within a consent management platform?
A CMP typically groups technologies by purpose, such as analytics or advertising, rather than by whether they are cookies. Canvas fingerprinting is generally categorised according to the purpose it serves, and where it supports analytics, advertising, or other non-essential functions it would usually sit in a category that requires prior consent under EU law. It is important that the CMP's disclosures accurately describe fingerprinting to users rather than labelling everything as cookies, since the information provided must be sufficient for consent to be informed. A CMP supports this categorisation but does not by itself determine whether a given use is lawful.
How do opt-out signals such as Global Privacy Control interact with canvas fingerprinting?
Under several US state privacy frameworks that rely on an opt-out model, browser signals such as Global Privacy Control may need to be honoured for tracking activity, which can include fingerprinting used for targeted advertising or the sale or sharing of personal information. Where such a signal is received, the expectation under those frameworks is generally that the corresponding processing stops. This differs from the EU approach, which typically requires prior opt-in consent rather than an opt-out. Whether and how a specific opt-out signal must be applied to fingerprinting depends on the applicable state law and its scope, and requirements are not uniform across US states or between the US and the EU.
Common misconceptions
Because canvas fingerprinting does not set a cookie, it falls outside cookie consent rules.
In most EU jurisdictions the ePrivacy rules apply not only to cookies but to any storing of, or gaining access to, information on a user's device. Fingerprinting techniques are widely treated by data protection authorities as within that scope, so consent may be required even though no cookie is placed. The GDPR may also apply where personal data is processed.
Canvas fingerprinting is anonymous and therefore not subject to data protection law.
Where a fingerprint can be used to single out, recognise, or distinguish an individual, it can constitute personal data under the GDPR. Whether a given implementation processes personal data depends on the specific facts and how the identifier is used, which is out of scope for a general definition.
Obtaining consent for cookies automatically covers fingerprinting.
Valid consent must be specific and informed. Consent standards and disclosures framed only around cookies may not adequately cover fingerprinting techniques, which typically need to be identified and addressed on their own terms. Requirements also differ between the EU, the UK, and US state regimes.
Best practices
Inventory whether your site or its third-party tags, SDKs, or scripts use canvas or other fingerprinting techniques, since these are often introduced by vendors rather than deliberately deployed.
Treat fingerprinting under the same access-to-device analysis as cookies in EU jurisdictions, and obtain prior consent through your CMP unless a recognised exemption clearly applies to the specific purpose.
Disclose fingerprinting techniques explicitly in consent notices and privacy information rather than relying on generic references to cookies, so that any consent is specific and informed.
Assess separately whether the resulting identifier constitutes personal data under the GDPR and, if so, ensure a lawful basis, records, and data subject rights are addressed.
Map the geographic scope of your users and adjust your approach for differing regimes, recognising that EU and UK expectations generally favour prior opt-in while some US state laws rely on opt-out signals.
Consult legal counsel on contested or fact-specific questions, and remember that a CMP or consent tooling supports compliance but does not by itself make a fingerprinting practice lawful.