What Is Device Fingerprinting? Fraud Checks vs Privacy

What is device fingerprinting?

Device fingerprinting is a way to recognize a device by combining many of its ordinary characteristics, such as the browser version, screen size, installed fonts, language, time zone, and how the graphics hardware draws an image, into a single identifier. No cookie or advertising ID is stored on the device: the identifier is calculated again each time from what the device reveals. Browser fingerprinting is the same idea applied to a web browser, and it is used both for fraud prevention and for tracking people across sites, which is why regulators and platforms treat it with suspicion.

The UK Information Commissioner’s Office (ICO) defines it in its guidance on storage and access technologies as collecting pieces of information about a device’s software or hardware that can be combined to uniquely identify it. This page is general information, not legal advice.

How browser and mobile fingerprinting work

A fingerprinting script or SDK collects a set of attributes, normalizes them, and usually hashes them into a short ID. Your server then compares that ID, or the attributes behind it, with ones it has seen before. Signals fall into two groups.

Passive signals the device sends anyway

The IP address and its network, plus HTTP headers such as the user agent and accepted languages. No script is needed.

Active signals a script asks for (web)

• Screen: resolution, color depth, pixel ratio, available window size.
• Locale: time zone, language list, date and number formatting.
• Hardware hints: number of processor cores, memory class, touch support.
• Fonts: which fonts are installed, measured by how text renders.
• Canvas, WebGL, and audio: the script draws a hidden image or processes a short sound and reads back the result, which differs slightly between graphics cards, drivers, and systems.

The ICO’s own list of inputs is similar: configuration data, CSS information, JavaScript objects, HTTP headers, clock information, and installed fonts.

Signals inside a mobile app

An app can read more than a web page: device model, operating system version and build, language, time zone, screen size, and carrier. That extra access is why the app stores restrict it. Google’s Android guidance on user data identifiers tells developers to avoid hardware identifiers such as the IMEI, notes that Android 10 added restrictions on non-resettable identifiers, and says not to bridge advertising ID resets with another identifier or a fingerprint without the user’s consent. Apple goes further, as covered below. Advertising IDs are a separate topic, explained in What are GAID and IDFA?

How accurate and stable are fingerprints?

A fingerprint is a probability, not a name tag. Research shows why.

• Uniqueness depends on the crowd. A large study, “Hiding in the Crowd” (Gómez-Boix, Laperdrix and Baudry, WWW 2018), analyzed about 2 million fingerprints from a major French website and found only 33.6% were unique, far below the more than 80% reported by earlier studies. On mobile devices only 18.5% were unique, and about 59% of mobile fingerprints sat in groups of more than 50 identical ones, because many people own the same phone model.
• Fingerprints drift. The FP-STALKER study (IEEE Symposium on Security and Privacy, 2018) found browser fingerprints often change, from every few hours to every few days, because of software updates and configuration changes. Its linking algorithm still followed browsers for 54 days on average: the raw ID breaks, but smarter matching can reconnect it.

Browser countermeasures in 2026

• Safari. The WebKit announcement for Safari 26 says Safari prevents known fingerprinting scripts from reliably reading APIs that reveal device characteristics, such as screen dimensions, hardware concurrency, 2D canvas, and web audio readback, and stops them from writing long-lived cookies or local storage. Apple’s Safari guide also says its advanced tracking and fingerprinting protection setting is on by default in Private Browsing and can be turned on for all browsing.
• Firefox. Mozilla’s November 2025 post on Firefox 145 says new protections limit what sites learn about fonts, graphics, processor cores, touchscreen support, and taskbar size, and cut the share of users seen as unique by almost half. They started in Private Browsing and Strict tracking protection.
• Brave. Brave’s fingerprinting defenses slightly randomize (“farble”) values such as canvas, WebGL, and audio output, seeded per site and per session. The same browser therefore looks different on each site and in each new session.

The practical consequence: an honest privacy-minded user can look like a new device every day, while many honest phone users look identical. A system that bans on a fingerprint match alone will be wrong in both directions. Browser behavior checked on October 21, 2026.

Legitimate uses vs tracking

The technique is the same. What differs is the purpose, who receives the data, and whether it follows people across other companies’ sites and apps.

Uses most people would expect

• Account security. Asking for an extra check when a login comes from an unknown device.
• Fraud prevention. Spotting card testing, fake sign-ups, and promotion abuse.
• Multi-accounting. Linking accounts one person runs to farm bonuses, covered in Stop multi-accounting and VPN abuse.
• Bot detection. Headless browsers and automation tools often expose odd or inconsistent attributes. Ad fraud and bot traffic covers the wider picture, and Click injection and SDK spoofing covers the mobile tricks.

Uses regulators object to

• Cross-site ad tracking. Profiling one device across unrelated websites as a replacement for third-party cookies.
• Re-identifying people who opted out. Reconnecting users who cleared cookies or reset their advertising ID.
• Probabilistic ad attribution. Matching an ad click to an install by IP and device details when the user denied tracking. What is attribution? explains why the industry moved away from this on iOS.

The ICO’s view is blunt. In its December 19, 2024 response to Google’s policy change, it said fingerprinting is not a fair means of tracking users online, because it reduces people’s control over their information.

Is fingerprinting legal under GDPR and ePrivacy?

It is not banned in the EU or the UK, but it is regulated twice: for accessing the device, and for processing personal data.

Rule 1: access to the device (ePrivacy and PECR)

Article 5(3) of the ePrivacy Directive requires consent to store information on, or gain access to information from, a user’s device, unless the access is for transmitting a communication or is strictly necessary to provide a service the user explicitly requested. The EDPB’s Guidelines 2/2023 on the technical scope of Article 5(3), adopted in final form on October 7, 2024, confirm that fingerprinting falls within that scope, including when it relies on HTTP headers such as the user agent, and say IP-based tracking can too. They do not analyze the exemptions, and stress that Article 5(3) applying does not automatically mean consent is needed: each case must be assessed.

The UK is more explicit. The ICO’s page on the exceptions lists “preventing or detecting fraud” and “ensuring the security of terminal equipment” among PECR’s examples of strictly necessary purposes, warns that technology claimed as necessary for security must only be used for that purpose, and says you must get consent if you use device fingerprinting for online advertising.

Rule 2: personal data (GDPR)

A fingerprint that singles out a device is usually personal data. GDPR Recital 30 names online identifiers provided by devices, such as IP addresses and cookie identifiers, as traces that can be used to profile and identify people. So you need a lawful basis, a privacy notice, data minimization, and a retention limit. For fraud prevention, Recital 47 helps: processing strictly necessary for preventing fraud is a legitimate interest of the controller. “Strictly necessary” matters: the same data cannot quietly be reused for marketing.

Outside Europe the rules vary by country and US state. Check the ones that apply to your users, and see Offerwalls and GDPR for how consent, user IDs, and privacy notices work on an offerwall page. Rules checked on October 21, 2026.

Platform rules: Apple and Google

Apple: no fingerprinting in iOS apps

Apple’s User Privacy and Data Use page is direct: under the Apple Developer Program License Agreement, you may not derive data from a device for the purpose of uniquely identifying it, whether from browser properties, device configuration, location, or network connection. Apps that do this, or use SDKs that do, may be rejected.

The rule is not limited to advertising. For fraud checks in an iOS app, use Apple’s sanctioned tools such as App Attest and DeviceCheck, described in our multi-accounting guide. Can you put an offerwall in an iOS app? covers the other App Store rules for rewards features, and SKAdNetwork and ATT covers measurement without tracking.

Google: the ads policy changed in February 2025

Google’s platforms program policies update archive records a change effective February 16, 2025, which Google said reflects advances in privacy-enhancing technologies and new surfaces such as connected TVs. According to the ICO, Google told organizations that from that date it would no longer prohibit fingerprinting techniques. The current Platforms program policies still require partners to disclose their use of cookies, web beacons, IP addresses, or other identifiers. A platform allowing something does not make it lawful: the ICO said businesses do not have free rein to use fingerprinting as they please.

Fingerprinting use cases: allowed or not?

A summary of the sources above, checked on October 21, 2026. Not legal advice.

How rewards sites can fight multi-accounting with privacy in mind

Rewards sites, GPT sites, and apps with an offerwall have a real reason to recognize devices: one person running ten accounts collects ten sign-up bonuses and causes reversals that partners charge back. You can do this and still respect users. The detection layers are in Stop multi-accounting and VPN abuse; here is how to run the fingerprinting part responsibly.

1. Write down one purpose, such as preventing fraud, duplicate accounts, and account takeover, and keep the data out of analytics, marketing, and ad tools. Purpose limitation is what makes the legitimate interests argument hold.
2. Collect at decision points: sign-up, login, opening the earn page, and cashout, where abuse turns into money. Not every page view.
3. Collect the fewest signals that work, and keep raw attributes only long enough to calculate the ID and explain a decision.
4. Set a retention period, for example while the account is active plus a fixed review window, then delete. Payout records you must keep by law follow their own schedule.
5. Combine signals and score. A fingerprint match is one input next to payout destination, sign-up network, referral chain, and behavior.
6. Respect browser protections. If Safari, Firefox, or Brave blurs a value, record it as “unknown”, not suspicious, and never try to defeat it.
7. Use platform tools in apps: App Attest and DeviceCheck on iOS, Play Integrity on Android.
8. Prefer soft actions and offer an appeal. Hold a cashout or ask for verification first; Reward hold periods covers how long to hold.
9. Say it in your privacy policy. Plain wording works: “When you sign up, log in, or cash out, we collect technical details about your device and browser, such as browser type, screen size, language, and time zone, and combine them with your IP address to detect duplicate accounts and fraud. We do not use this information for advertising. We keep it while your account is active and for [period] after it closes.” Adapt it to what you actually do.

For tracking rewards themselves, rely on server-side signals you control rather than the device. Postback vs pixel tracking explains why a signed server-to-server postback is more reliable than anything in the browser.

Frequently asked questions