TL;DR: identify devices across incognito and VPN
- If your fingerprint breaks the moment someone clears cookies, it is a session identifier with extra steps. Fraudsters clear cookies, open incognito, and rotate VPN exits between attempts. Your identifier has to survive all three or it is not a fingerprint.
- cside reads more than 100 device, network, and behavioral signals per session, so the hash comes from hardware state (GPU output, canvas entropy, WebGL) not stored files. No cookie is set, so no consent banner is needed, and legitimate interest under GDPR Article 6(1)(f) holds.
- Ask your vendor one thing: does the fingerprint stay identical across incognito plus cookie clear plus VPN, on the same laptop, in a live test. If they cannot show it in a demo session, you are buying tracking, not fraud evidence.
Device fingerprinting solutions identify a device by reading browser, hardware and network properties during a live session and combining them into a stable identifier. Because that identifier comes from the device itself rather than a stored cookie, it keeps working when a user clears cookies, opens an incognito window or routes through a VPN, which are the exact conditions fraudsters operate in. The main thing that separates one solution from another is how stable that identifier stays under those conditions.
Signal categories explained
Device fingerprinting solutions read signals across four categories. How deep the coverage goes in each category decides how stable and how unique the resulting fingerprint is.
Browser signals are the most commonly collected and the easiest to spoof when taken on their own. They include canvas rendering output (the result of drawing an identical image in an HTML canvas element), WebGL output from GPU-accelerated rendering, the audio-context fingerprint produced by the browser's audio pipeline, navigator properties such as language, platform and plugin list, and the set of fonts available for layout.
Hardware signals go deeper than the browser surface. GPU model and vendor, screen resolution, device memory, CPU core count and the battery API all reflect the physical device rather than its software configuration. They are harder to spoof consistently, because changing them means altering lower-level system behavior, not just browser properties.
Network signals include the TLS handshake fingerprint TLS fingerprint (a characteristic of how the browser negotiates TLS connections that stays stable per browser version and configuration), IP geolocation consistency (whether the claimed timezone and the IP-resolved location match) and connection type. A mismatch between network signals and browser or hardware signals is itself a fraud indicator.
Behavioral signals capture how a user interacts with a session rather than what their device reports. Session timing, the distribution of time between page events, interaction patterns such as scroll behavior and tap pressure on mobile, and the natural entropy in human behavior that automated tools struggle to replicate all add to the picture.
Accuracy across adversarial conditions
Signal coverage alone does not make a device fingerprinting solution reliable. The more important test is whether the fingerprint stays stable when fraudsters clear cookies, open incognito mode or rotate VPN exit nodes, which are the adversarial conditions real attackers use between sessions.
Cookie clearing resets traditional tracking identifiers on every session. Incognito mode suppresses browsing history and can alter certain navigator properties. VPN routing changes the IP address and can introduce geolocation inconsistency. A fraudster working between attacks will typically do all three.
This is where most fingerprinting solutions start to fail. A fingerprint that changes the moment cookies are cleared offers little protection between sessions, since clearing cookies is exactly what attackers do to reset their tracking. At that point it behaves like a session identifier with extra steps.
The comparison below shows how a hardware-derived device fingerprint holds up against cookie and IP tracking under the same conditions.
| Method | Persists in incognito | Persists after cookie clear | Works with VPN | GDPR-friendly |
|---|---|---|---|---|
| Device fingerprint (cside) | Yes | Yes | Yes | Yes |
| Cookie tracking | No | No | Varies | Yes |
| IP tracking | No | No | No | Yes |
That stability comes from reading signals derived from hardware state rather than stored identifiers. In cside's controlled testing, fingerprints stay consistent across all three conditions: incognito mode, VPN routing and cookie-cleared sessions.
Use cases powered by device fingerprinting
Device fingerprinting powers four high-value fraud prevention use cases: account takeover detection, multi-accounting detection, chargeback evidence and AI agent detection. Each one relies on the same stable device hash generated during a live session.
Account takeover detection. When a known account logs in from a device fingerprint that has never been tied to it, that is a strong signal of credential compromise. The login may use the correct password, but the device is unfamiliar. Real-time fingerprint matching at authentication can trigger a step-up challenge or a security review before the session proceeds. Account takeover remains one of the costliest fraud types in the US, with annual losses running into the tens of billions of dollars in Javelin's identity fraud research.
Multi-accounting detection. When the same device fingerprint shows up across multiple distinct registrations, it points to a fake-account ring. This matters most in iGaming (bonus abuse), marketplaces (seller manipulation) and fintech (synthetic identity farming). One fingerprint tied to many accounts is a clear multi-accounting pattern.
Chargeback evidence. A device ID captured at checkout creates a persistent record linking a specific device to a specific transaction. When a chargeback dispute is raised, that fingerprint corroborates the legitimate purchase and supports the merchant's case. cside packages this into chargeback evidence for dispute responses.
AI agent detection. Browser automation tools produce characteristic device environments: low-entropy canvas output, limited font sets and uniform WebGL results. Device fingerprinting feeds AI agent detection alongside session cadence and cursor-geometry signals, and it helps flag named automation such as OpenAI Operator, Claude for Chrome, Playwright, Puppeteer and Selenium.
GDPR, legality and cside device fingerprinting
Device fingerprinting for fraud prevention is lawful under GDPR when no personal data is stored and legitimate interest under Article 6(1)(f) is the legal basis. No cookie is set, no consent banner is required, and the fingerprint hash is not a personal identifier under the regulation.
cside stores a hash of device properties, not the raw values or any linked personal data. The fingerprint is a stable identifier for the device configuration, not for the person behind it. No name, email, IP address or other personal identifier is stored against it.
The legal basis is legitimate interest: fraud prevention is a recognized legitimate interest under Article 6(1)(f), and device fingerprinting for fraud detection meets the three-part legitimate-interest test. Because no cookie is set and no personal data is processed, no consent banner or opt-in is required.
cside device fingerprinting is SOC 2 Type II certified, which gives independent verification that the controls around data handling meet audited standards. That matters for enterprise procurement reviews and for showing due diligence in regulated sectors such as financial services and healthcare.
