Browser fingerprinting needs consent just like a cookie

Browser fingerprinting is legal only on the same terms as a tracking cookie. In the EU, Article 5(3) of the ePrivacy Directive covers reading information from a visitor's device, not just storing it, so a fingerprint used for analytics or advertising needs the visitor's consent first. The GDPR then treats the fingerprint as personal data. A fingerprint is a device identifier built from settings the browser already exposes, such as screen size, fonts and graphics hardware.

Many website owners assume that avoiding cookies means avoiding consent obligations. It does not, and the reasons sit in how fingerprinting works.

What browser fingerprinting actually does

Every time a browser loads a page, it exposes a collection of technical details: screen resolution, installed fonts, GPU model, operating system version, language settings and time zone. Individually, none of these data points identifies a person. Combined, they create a statistical profile so distinctive that it can single out a device among millions.

This is browser fingerprinting. Unlike HTTP cookies, fingerprinting does not store a file on the visitor's device. A script in the page reads these signals and combines them, in the browser or on the server, into a stable identifier.

Common fingerprinting techniques

Fingerprinting scripts probe a range of browser APIs. The most common techniques fall into several categories, each exploiting subtle hardware and software differences between devices.

Canvas fingerprinting

A script draws a hidden image using the HTML5 Canvas API, then reads the pixel data back. The way the browser renders that image varies depending on the GPU, graphics driver, operating system and font rendering engine. Two devices with different hardware will produce slightly different pixel values, even when drawing the same shape. The resulting hash acts as a device identifier.

WebGL fingerprinting

WebGL fingerprinting takes a similar approach but targets 3D rendering. By asking the GPU to render a hidden 3D scene, the script captures differences in shader precision, texture handling and rendering pipeline behaviour. The technique also reads the WEBGL_debug_renderer_info extension, which exposes the exact GPU model and driver version.

Font enumeration

Every operating system ships with a default set of fonts, but users and applications add more over time. A fingerprinting script measures how the browser renders text in hundreds of font families. If a font is installed, the rendered width differs from the fallback. The resulting list of installed fonts is highly distinctive.

Audio fingerprinting

The AudioContext API processes a short audio signal through the device's audio stack. Tiny differences in how the hardware and software handle floating-point arithmetic produce a distinctive waveform. The technique requires no microphone access and runs silently in the background.

Fingerprints survive the reset that clears cookies

Cookies can be deleted. Browser storage can be cleared. A visitor who resets their browser gets a fresh start, at least in theory. Fingerprinting undermines that reset because the identifier is derived from the device itself, not from stored data.

This creates several problems. Visitors cannot inspect or remove a fingerprint the way they can delete a _ga or _fbp cookie. There is no browser setting labelled "clear my fingerprint." The tracking is invisible, and that opacity conflicts with the transparency requirements built into the GDPR and the ePrivacy Directive.

The persistence of fingerprints also raises concerns about cross-site tracking. A fingerprinting service embedded on several websites can follow a visitor across those sites without any cookie synchronisation, building behavioural profiles that the visitor never agreed to.

What the ePrivacy Directive says about fingerprinting

Article 5(3) of the ePrivacy Directive does not mention cookies by name. It covers "the storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user." Fingerprinting reads information already present on the device: GPU characteristics, font lists, screen properties. European regulators interpret Article 5(3) as covering fingerprinting alongside cookies, local storage and session storage. The European Data Protection Board said so directly in its Guidelines 2/2023 on the technical scope of Article 5(3), adopted in October 2024, building on the Article 29 Working Party's 2014 opinion on device fingerprinting.

The consent requirement applies unless the information is strictly necessary for a service the user has requested. Fraud detection may qualify for an exemption in some circumstances. Advertising and analytics fingerprinting do not.

The GDPR treats a fingerprint as personal data

Under the GDPR, personal data means any information relating to an identified or identifiable natural person. Recital 30 explicitly references "cookie identifiers, internet protocol addresses and other identifiers such as radio frequency identification tags" as examples. A browser fingerprint that singles out a device, and by extension its user, meets this threshold.

Processing a fingerprint for tracking purposes therefore requires a lawful basis under Article 6. Consent is the only realistic option for advertising or analytics fingerprinting, since legitimate interest is difficult to argue when the processing is invisible to the data subject and no opt-out mechanism exists.

The CNIL, France's data protection authority, has been particularly clear on this point. Its page on what the law says about cookies and other trackers lists a unique device identifier calculated by fingerprinting among the trackers its rules cover, which means the same informed, specific consent as a cookie. The CNIL also considers that consent expressed through browser settings is neither specific nor informed enough to cover fingerprinting.

Enforcement has so far focused on cookies

Published fines for tracking without consent have, to date, concerned cookies rather than fingerprinting, and the recent enforcement actions follow that pattern. A regulator auditing cookie consent can open the browser's developer tools and see every cookie a site sets. Fingerprinting scripts are harder to detect and prove.

The clearest regulatory signal came from the UK. On 19 December 2024, Google told organisations using its advertising products that from 16 February 2025 it would no longer prohibit fingerprinting. The ICO's response to Google's policy change called it "irresponsible" and said businesses "do not have free rein to use fingerprinting as they please". The change is an advertising policy, not a Chrome feature: it lets advertisers fingerprint without breaching Google's rules, while the law on consent stays the same.

Tools such as the EFF's Cover Your Tracks (formerly Panopticlick) make fingerprinting easier to demonstrate, so the gap between cookie and fingerprint enforcement is narrower than it was.

How browsers are fighting back

Browser vendors have taken different approaches to fingerprinting protection, ranging from outright blocking to statistical noise. A browser that blocks invasive scripts automatically is an example of privacy by default, the principle that GDPR Article 25 calls data protection by design and by default.

Safari

Apple's Intelligent Tracking Prevention has grown to include anti-fingerprinting measures. According to WebKit's Safari 26.0 release notes, Safari now prevents known fingerprinting scripts from reliably reading APIs that reveal device characteristics, such as screen dimensions, web audio readback and 2D canvas. It also stops those scripts from setting long-lived cookies or local storage.

Firefox

Firefox ships with Enhanced Tracking Protection enabled by default. In strict mode, it blocks known fingerprinting scripts identified through the Disconnect list. Firefox also restricts certain APIs and standardises values that would otherwise leak identifying information.

Chrome

Chrome has historically offered the weakest fingerprinting protections among major browsers. Google condemned fingerprinting in 2019, then changed its advertising policy to allow it from 16 February 2025. In October 2025 Google retired most of its Privacy Sandbox technologies, including the planned IP Protection, so the Privacy Sandbox no longer carries a fingerprinting defence for Chrome. Chrome's approach remains permissive compared to Safari and Firefox.

Brave and Tor

Brave randomises fingerprinting values by default, generating different canvas and WebGL hashes across sessions. Tor Browser takes the most aggressive stance: it blocks canvas reads, disables WebGL by default, limits available fonts and standardises screen dimensions through letterboxing.

What this means for your website

If your site uses a fingerprinting service, or if a third-party script embedded on your site performs fingerprinting, the consent obligations apply to you. The fact that fingerprinting does not use cookies does not exempt it from Article 5(3) of the ePrivacy Directive or from the GDPR's rules on personal data processing.

A cookie scan is a useful first step, but a standard scan detects cookies and storage objects, not fingerprinting scripts. You should also check your third-party scripts for canvas, WebGL and AudioContext calls that have no visible purpose on the page. Ad-tech tags, fraud prevention tools and some analytics libraries include fingerprinting components that may not be obvious.

Once you know which script fingerprints, hold it back until consent. Kukie.io's script blocking keeps a script you tag with type="text/plain" and data-cc-category="analytics" (or another category) from running until the visitor accepts that category. Your cookie policy should disclose any fingerprinting alongside cookie usage, and a consent banner that only mentions cookies while a script fingerprints in the background fails the transparency test.

Questions about fingerprinting and consent

Find the scripts that fingerprint before visitors choose

A cookie list will not show a fingerprint, so start with the scripts. Kukie.io's Script audit shows the third-party scripts a page loads, so you know which ones to check for canvas, WebGL and audio reads before the visitor has made a choice.

Audit your scripts