Browser fingerprinting: Recognition without cookies

In short: With fingerprinting a browser is recognised by the combination of many technical features, without any cookies being stored.

In more detail: Every browser reveals many peculiarities when visiting a page: version, language, time zone, screen size, installed fonts, graphics card, plugins. Harmless individually, together often unique, like a fingerprint. Ad networks and fraud detection use this because deleting cookies does not help against it.

In Depth

Typical features

• User agent, language, time zone, platform
• Screen resolution, colour depth, pixel density
• Installed fonts
• Canvas and WebGL fingerprint: the same drawing is rendered slightly differently depending on graphics hardware and drivers.
• Audio context, supported codecs, hardware concurrency
• Network properties such as TLS parameters (JA3)

Legal aspects

Reading device information on the terminal falls in Germany under § 25 TDDDG and usually requires consent, unless it is technically strictly necessary (for instance for fraud prevention in a narrow scope). The GDPR applies in addition, because a fingerprint can be personal data.

Protection

• Browsers with fingerprinting protection (Firefox “Strict” protection, Brave, Tor Browser): standardise or falsify values.
• Install few extensions: each makes the browser more conspicuous.
• Tracker blockers (uBlock Origin) block the scripts.
• Irony: too many customisations can make you more unique. Better: blend in with the crowd. Test: EFF “Cover Your Tracks” shows how unique your browser is.

For web developers

Refrain from fingerprinting for tracking users. If fraud prevention is necessary, minimise data, inform in the privacy policy and check the legal basis. Better alternatives for analytics are aggregated, cookieless statistics without personal reference.

See also: Cookies, Tracking, Cookie consent (TDDDG)