Browser fingerprinting is a technique used to identify and track web browsers and their underlying technologies. It involves collecting and analyzing data about the browser's configuration, plugins, and other features to create a unique identifier. This method is often used for analytics, ad targeting, and user tracking. However, it can also be exploited by attackers to track user behavior across different sites, potentially compromising user privacy and security. To defend against fingerprinting, developers can use techniques like browser sandboxing, implementing privacy policies, and deploying browser fingerprinting countermeasures.
Browser fingerprinting identifies a device by combining dozens of passively readable browser and hardware characteristics into a single, reasonably stable identifier. A script queries values such as the user-agent string, installed fonts, screen resolution, timezone, language, hardware concurrency, and the way the device renders graphics through the Canvas, WebGL, and AudioContext APIs. Individually these attributes are common, but the combination is often unique enough to recognise the same browser across visits without ever setting a cookie. Because the data is read rather than stored, fingerprinting keeps working even when a user clears cookies or opens a private window, which is what makes it both powerful for tracking and difficult to notice.
Fingerprinting sits on both sides of the security line. For privacy, it enables stateless tracking that survives cookie deletion, so advertisers and data brokers can follow a user across sites without consent, and regulations like GDPR increasingly treat a fingerprint as personal data. For defenders, the same signals help separate a real human browser from an automated one: bots and scripted agents often present impossible or inconsistent combinations, such as a desktop user-agent paired with a headless rendering stack. Attackers, in turn, try to forge convincing fingerprints to blend in, and use fingerprinting themselves to profile a victim's browser and plugins before delivering a targeted exploit.
For privacy-minded users, fingerprinting resistance and hardened browsers reduce exposure, though perfect resistance is hard to achieve. On the defensive side, cside's device intelligence uses fingerprinting signals for security rather than for tracking: it fingerprints incoming browsers to spot bots, automated agents, VPN or proxy use, and device mismatches that suggest a hijacked session. Rather than trusting a single value like the user-agent, it cross-checks many signals for internal consistency, so a spoofed attribute stands out against the rest of the fingerprint. This is distinct from cside's script-monitoring work, but it follows the same principle: judge a client by the full picture of what it actually presents, not by one claim it makes about itself.
Mostly no. Fingerprinting reads characteristics of the browser and device rather than storing an identifier, so clearing cookies or opening a private window does not change the underlying values. Incognito mode limits history and cookies, but it still exposes screen size, fonts, and rendering behaviour, so a determined tracker can often re-identify the same browser.
It depends on jurisdiction and purpose. In the EU and UK, a fingerprint used to track individuals is generally treated as personal data under GDPR and the ePrivacy rules, so it usually requires consent. Using fingerprint-style signals purely to detect fraud or bots is treated more leniently, but organisations should document the purpose and minimise the data they retain.
We answer client-side security questions every day. Bring yours.