TL;DR: what is device fingerprinting
- 102+ browser, hardware, and network signals collected, with 40+ attributes hashed into a device identifier that survives cookie clears, incognito, and IP changes.
- Five signal categories: hardware (GPU, CPU), rendering (canvas, WebGL, fonts), environment (timezone, language), network (TLS, header order), behavior (mouse, typing).
- Its main job in 2026 fraud work: CE 3.0 evidence for chargeback disputes.
How device fingerprinting works
The whole process runs inside the user's browser, stores no cookie, and returns a risk verdict via API before a login or transaction completes. Here is how it works step by step.
-
A lightweight script runs inside the user's browser at the start of a session. It is typically delivered via a single script tag and adds no perceptible latency.
-
The script reads 100+ browser and hardware properties. These include canvas rendering output (the result of drawing a test image in an HTML canvas element using the device's GPU and graphics driver), WebGL behavior that reflects the GPU model and driver version, installed fonts that vary by operating system and software setup, the audio-context fingerprint produced by the browser's audio pipeline, screen resolution and color depth, GPU vendor and renderer string, CPU core count, device memory, and the TLS handshake fingerprint TLS signature, a characteristic of how the browser negotiates encrypted connections.
-
These properties are combined into a hash, a fixed-length string that represents that specific device configuration. Two devices with identical hardware and software produce identical hashes. Changing any meaningful property, such as upgrading the graphics driver or switching browser versions, produces a different hash, which cside uses to detect configuration changes that may signal fraud.
-
The hash is compared against the device's history on the platform. The system asks: has this device been seen before, is it associated with the account attempting to log in, has the same device appeared across multiple distinct accounts, has it appeared in prior fraud events?
-
A risk verdict is returned in real time via API, before any transaction or login completes. The verdict feeds directly into authentication, checkout and fraud review workflows.
What device fingerprinting catches
Device fingerprinting detects four distinct fraud types: account takeover, multi-accounting, new account fraud and chargeback fraud. Each relies on the same stable device hash generated at session start, which persists across incognito mode, VPN routing and cookie-clearing.
Account takeover. When a known account submits valid credentials but the device fingerprint is unfamiliar, it is a strong indicator that the credentials were compromised and are being used on the attacker's device. Correct password, wrong device. The fingerprint mismatch triggers a step-up challenge or blocks the session pending manual review. See how this maps to account takeover defenses.
Multi-accounting. When the same device fingerprint registers multiple accounts, it reveals a fake-account ring regardless of how the attacker varied email addresses, names or IP addresses. One device equals one actor. The pattern is especially damaging in iGaming bonus abuse, marketplace seller manipulation and fintech identity farming, all of which multi-accounting detection targets.
New account fraud. An unfamiliar device combined with high signup velocity, mismatched geolocation signals and synthetic personal data creates a composite risk picture. Device fingerprinting anchors that picture to a specific machine, making it possible to link attempted fraudulent registrations across sessions and days.
Chargeback fraud. A device ID captured at checkout creates a permanent record of which device completed the transaction. When a customer disputes a legitimate purchase, the device fingerprint is corroborating evidence that it was completed on their known device. cside packages this into chargeback evidence for dispute responses.
Account takeover is the most expensive of these. US account takeover losses run into the tens of billions of dollars annually in Javelin's identity fraud research, and device fingerprinting at authentication is one of the most direct controls against the credential stuffing campaigns behind those losses.
Why device fingerprinting beats cookies and IP tracking
Three tracking methods are commonly compared. Device fingerprinting is the only one that holds up under the conditions fraudsters routinely create.
Cookies are stored files on the user's device. A fraudster clears cookies between sessions and the tracking link is broken. Browsers in private or incognito mode also suppress cookie storage. For fraud detection, a cookie-based identifier resets on every attack session.
IP addresses are assigned by internet service providers and change frequently. More critically, residential proxy networks assign a fresh IP address for each request, making it impossible to link the same attacker across sessions by IP alone. IP reputation lists cannot keep pace with the scale of modern residential proxy infrastructure.
Device fingerprints are derived from hardware and software state, not from any stored identifier or network-level attribute. Canvas rendering output, GPU behavior and audio-context results do not change when a user clears cookies, opens an incognito tab or connects through a VPN. The underlying device is the same, and the fingerprint reflects that.
Is device fingerprinting legal? GDPR and privacy
Device fingerprinting for fraud prevention is lawful under GDPR, provided the implementation stores no personal data and uses an appropriate legal basis.
No personal data is stored in the cside fingerprinting pipeline. The fingerprint is a hash of device properties, not a personal identifier. It is not linked to a name, email address or IP address in the data store, and knowing a hash does not identify an individual.
The applicable legal basis under GDPR Article 6(1)(f) is legitimate interest. Fraud prevention is a recognized legitimate interest, and processing a non-personal device hash for the purpose of detecting fraud satisfies the three-part test: there is a legitimate purpose, the processing is necessary for that purpose, and the individual's fundamental rights are not overridden given the minimal data involved.
No cookie is set by the fingerprinting process. That means no cookie consent banner, opt-in mechanism or consent management platform update is required.
cside device fingerprinting holds SOC 2 Type II certification, providing independent auditor verification of the security controls around data handling. That certification matters for enterprise procurement due diligence and for regulated-sector deployments in financial services, gaming and healthcare.
