Fingerprinting

Every device used to browse the internet reveals, in passing, many small technical details. These include screen size, the configured language, the time zone, and the installed fonts. On its own, none of this information is particularly telling. But if you combine thirty or forty of them, the result is a combination that almost only occurs on a single device. That is exactly what fingerprinting is: many inconspicuous characteristics turn into an identifying feature. The name comes from the fingerprint, because the result is just as unique as one.

Why you can’t simply switch it off like cookies

The classic method for recognizing users is cookies. These are small text files that a website stores on the device. Cookies can be deleted, blocked, or rejected via a prompt. That is precisely why fingerprinting has become interesting for advertising companies. It doesn’t store anything on the device at all. It merely reads out what is already there.

This leads to an uncomfortable problem: you can’t simply click fingerprinting away. Anyone who deletes all cookies, uses the browser’s private mode, or employs an ad-blocking program often remains the same user as far as a fingerprinting script is concerned. Switching internet connections doesn’t help much either, because the device characteristics stay the same.

For data protection, this is a contentious issue. The European General Data Protection Regulation treats such an identification value as personal data, because it makes a person traceable across many sites. Companies argue, on the other hand, that they also use it to detect fraud. Both are true, and that is exactly where the difficulty of regulation lies.

How screen size and fonts turn into an identification number

When a website is loaded, a small program usually runs in the browser alongside it, known as a script. This script queries various properties one after another. Which operating system is running? How many processor cores does the device have? Which graphics card is installed? Which languages are set? The answers are strung together into one long string of characters.

From this string, the script calculates a short code, the fingerprint. If the same device later visits a different site, the same code results. This makes it possible to attribute the visit without knowing a name. A particularly effective trick is called canvas fingerprinting. Here, the site has the browser invisibly draw an image or a piece of text. Because the graphics card and drivers produce tiny differences in rendering, the result differs measurably from device to device.

A common misconception is that fingerprinting always works unambiguously. That is not true. Two freshly purchased iPhones of the same model with identical settings look very similar to each other. That is why these techniques work with probabilities and update the fingerprint whenever details change. The more unusual your own configuration is, the easier you are to recognize. Anyone who combines a great many protective measures sometimes stands out precisely because of that.

Ad networks, banks, and the dispute over cookie banners

Fingerprinting is encountered most often in online advertising. Advertising networks want to know which sites the same person visits in order to serve matching ads. Because browsers such as Safari and Firefox now heavily restrict third-party cookies, this business is shifting toward fingerprinting. In news reports, the term therefore often comes up in connection with fines imposed by data protection authorities.

There are, however, also applications that hardly anyone criticizes. Banks use fingerprinting to detect whether a login is coming from the usual device. If the fingerprint doesn’t match, an additional confirmation is required. Ticket shops also use the technology to detect automated buy-up programs.

Anyone wanting to protect themselves has limited options. The Tor Browser and the private mode of some browsers deliberately return standardized values, so that many users look alike. Apple and Mozilla deliberately obscure individual characteristics. This does not prevent fingerprinting entirely, but it significantly reduces its accuracy.