Browser fingerprinting is a technique used to track and identify users online by collecting data about their device and browser configuration. Even without cookies or other tracking methods, browser fingerprinting allows websites and advertisers to create a unique "fingerprint" that can follow users across the web.
How Does Browser Fingerprinting Work?
When a user visits a website, the site can run JavaScript code that collects information about the user‘s device and browser. This may include data like:
- Screen size and resolution
- Operating system and version
- Browser type and version
- Installed plugins, fonts, and extensions
- Timezone and language settings
- Hardware such as CPU and GPU specs
- Browser preferences and configurations
By combining these attributes, websites can create a fingerprint that is likely unique to that specific device and browser configuration. Even small differences like having a particular font installed or using an unusual screen resolution can make a fingerprint distinct.
Research by the Electronic Frontier Foundation found that only 1 in 286,777 browsers share the same fingerprint. With so many potential data points, fingerprints tend to be highly individualized.
Methods of Browser Fingerprinting
There are a few main methods that sites use to gather data for browser fingerprinting:
Standard JavaScript APIs
Most browser fingerprinting relies on standard JavaScript APIs that are built into all major browsers. For example:
- The navigator object reveals details like browser version, user agent string, plugin details, and hardware concurrency
- Screen and window objects provide screen size, color depth, and other display attributes
- The timezone and language settings are accessible as well
By calling these APIs, sites can easily build extensive fingerprints without any special permissions.
Canvas Fingerprinting
Canvas fingerprinting utilizes the HTML5 canvas element supported in modern browsers. A site can render hidden shapes and test images then extract data about the browser‘s handling of graphics.
Even minute differences in how browsers render shapes can allow sites to detect unique configurations. Canvas fingerprinting provides over 100 data points from graphics driver and renderer information.
WebGL Fingerprinting
Similar to canvas fingerprinting, WebGL fingerprinting uses the 3D graphics API WebGL to gain data like texture units, vertex/fragment shader precision, and OpenGL extensions. Combined with canvas data, WebGL fingerprinting provides an extensive profile of a device‘s graphics capabilities.
Browser/Machine Benchmarking
Some advanced fingerprinting techniques go beyond interfaces to actually benchmark real browser performance. This can be achieved by testing JavaScript math capabilities or analyzing precision and skew of the browser‘s clock.
Performance benchmarks can identify not just the browser, but even specific hardware down to the CPU or GPU model. However, these intensive methods tend to be rare.
Uses of Browser Fingerprinting
Here are some of the main uses of browser fingerprints by websites and advertisers:
Cross-Site Tracking
Browser fingerprints allow sites to connect user activity across different domains. Without cookies, users expect their sessions to be isolated across sites. However, fingerprints provide a persistent identifier that can link behavior across the web.
Fraud Detection
Services like ad networks or social networks can leverage fingerprints to detect suspicious activity coming from multiple accounts or bots on the same device. Fingerprints give a consistent identifier even when other account information changes.
Security Enhancement
Some services use fingerprints as part of enhanced security protocols around account logins or high risk transactions. Fingerprint data adds an additional layer to help detect account takeovers or automated bots.
Personalization/Analytics
Like cookies, fingerprints allow sites to identify returning users in order to provide personalized site experiences or track user engagement. However, fingerprints work even after a user clears their cookies and site data.
Targeted Advertising
Browser fingerprints give advertisers a way to build rich profiles of user interests and behaviors across sites. Fingerprints persist identities in a way that cookies can not, enhancing targeting.
Is Browser Fingerprinting Bad? Ethical Concerns
While browser fingerprinting has valid use cases, there are also ethical concerns around transparency and user consent:
-
Most users are unaware of fingerprinting and do not knowingly consent to the data collection.
-
There are limited ways for users to block fingerprinting compared to cookies. It relies on built-in browser functions.
-
Extensive fingerprints can reveal sensitive information about a user‘s device.
-
Persistent tracking across sites violates consumer privacy expectations around "cross-site" separation.
-
Fingerprint data sets could theoretically help deanonymize users of privacy tools like VPNs or Tor if combined with other information.
Overall, many privacy advocates argue users should have more transparency and choice around browser fingerprinting given the sensitivity of the data collected. Services using fingerprints responsibly will be upfront about the techniques and provide robust opt-out options.
How to Limit Browser Fingerprinting
While blocking browser fingerprinting entirely is difficult, there are steps users can take to limit their exposure:
-
Use privacy-focused browsers like Tor or Brave that implement fingerprinting defenses.
-
Install browser extensions that spoof or block fingerprinting scripts (e.g. DuckDuckGo Extension, NoScript, CanvasBlocker).
-
Disable plugins, fonts, and extensions to reduce identifiable configurations.
-
Clear browser storage and reboot devices regularly to prevent persistent fingerprints.
-
Limit browser configurations that maximize anonymity at the cost of functionality.
-
Avoid JavaScript whenever possible, especially on sites with questionable tracking practices.
-
Mask timezone, language, and hardware details with generic values.
-
Leverage a trusted VPN service and block browser tracking/telemetry at the network level.
With care, users can balance fingerprinting protections with browsing functionality. But ultimately the tracking burden should not be solely on consumers. More responsible business practices around informed consent are needed industry-wide.
The Future of Browser Fingerprinting
Browser vendors continue working on technical defenses against fingerprinting. But the arms race around novel techniques and countermeasures is likely to persist.
Some potential advances around fingerprinting include:
-
Increased adoption of fingerprinting by advertisers as cookies decline.
-
Growth of fingerprinting on mobile as mobile browsing explodes.
-
More advanced machine learning to model fingerprints and evade protections.
-
Emergence of new device APIs that inadvertently enable new fingerprinting vectors.
-
Integration of biometrics like touch or motion gestures into enhanced fingerprints.
Overall, browser fingerprinting is unlikely to be eliminated given the online advertising industry‘s dependence on tracking. But with user advocacy, companies can pursue responsible practices that enhance transparency and choice. Users should remain vigilant of new methods and utilize tools that provide greater control over their online identities.
