Richard Kahn
- A browser fingerprint is an identifier calculated from the settings and characteristics your browser and device share with every website. Nothing is stored on your device.
- Browser fingerprinting works by running a script that collects signals like fonts, screen size, time zone, and how your device renders graphics, then combines them into a hash.
- Unlike a cookie, a fingerprint can't be cleared or deleted. That makes it controversial for ad tracking and valuable for spotting bots and fraud.
- Privacy laws such as the GDPR can apply to fingerprinting, and no browser setting blocks it completely.
A browser fingerprint is a unique identifier built from the details your browser and device reveal every time you load a web page. Your browser has to tell websites things like your operating system, screen size, language, and time zone so pages display correctly. Individually, those details are common. Combined, they often form a pattern distinctive enough to recognize one browser on one device.
That's why browser fingerprinting draws attention from two very different groups: advertisers looking for alternatives to third-party cookies, and security teams trying to separate real visitors from bots. Below, we cover how it works, what goes into a fingerprint, how it compares to cookies, whether it's legal, and how it's used to fight ad fraud.
What is a Browser Fingerprint?
A browser fingerprint is a short string of characters, called a hash, generated from a combination of browser and device attributes. Because the same device tends to produce the same hash on repeat visits, a website can recognize a returning visitor without placing a cookie or any other file on their device.
A browser fingerprinting example: Two visitors both use Chrome on Windows. One has a large external monitor, a U.S. English keyboard, the Eastern time zone, and a design program that installed extra fonts. The other uses a laptop screen, a UK keyboard, and only the default fonts. Neither shared a name or email address, but their combined settings already tell them apart, and each will look the same on their next visit.
How Does Browser Fingerprinting Work?
Browser fingerprinting relies on the same browser features that make modern websites work. When a page loads, a fingerprinting script typically:
- Runs in the background. The visitor sees nothing on the page.
- Queries the browser. It reads values like screen size, language, and time zone, and calls standard interfaces such as the Canvas, WebGL, and Web Audio APIs.
- Combines the signals. Dozens of attributes are gathered into one profile.
- Hashes the result. The profile is run through an algorithm to produce a fingerprint that can be compared on later visits.
There's no dedicated browser fingerprinting API. The interfaces these scripts use exist so websites can draw graphics, play sound, and adapt to your screen. Fingerprinting scripts simply read what they return. So what is fingerprinting in browser terms? It's measurement, not storage. Three techniques do much of the work.
Canvas Fingerprinting
The script asks the browser to draw a hidden image or line of text using the HTML5 canvas element. Small differences in graphics hardware, drivers, and fonts change how the image renders, and those differences become part of the hash.
WebGL Fingerprinting
WebGL is the browser's interface for 3D graphics. A script asks it to render a scene and records how the device handles it, which can expose details about the graphics card and drivers.
Audio Fingerprinting
Using the Web Audio API, a script processes a short sound signal without playing it out loud. Tiny variations in how each device's audio stack handles that signal add another distinguishing value.
What Signals Make Up a Browser Fingerprint?
No single signal identifies a visitor. Distinctiveness comes from the combination, which is why hiding one signal rarely changes much. Here's how the common signals group together:
Signal group |
Examples |
Easy for a visitor to change? |
|---|---|---|
|
Browser and software |
User-agent string, browser version, extensions, installed fonts, language |
Partly. Some settings change easily; fonts and extensions take effort |
|
Device and hardware |
Screen resolution, operating system, graphics card details |
Rarely, short of switching devices |
|
Network and location |
IP address, HTTP headers, time zone |
Yes. A VPN or proxy changes the IP address in seconds |
|
Rendering behavior |
Canvas, WebGL, and audio results |
Hard. It depends on the hardware and drivers underneath |
That last column matters for security. A fraudster can swap an IP address instantly, but changing every signal in the table convincingly, and keeping them consistent with each other, is much harder.
Chrome Fingerprinting: Why Consistency Matters
Chrome is the most widely used browser, so Chrome fingerprinting is what most websites deal with in practice. That popularity also makes Chrome a natural disguise, because traffic that claims to be Chrome blends in with the crowd.
The key is consistency. In a real Chrome browser, the user-agent, supported features, and rendering behavior line up with each other. When a visitor claims to be a current version of Chrome on a phone, but its screen, rendering results, or supported features don't match that claim, the mismatch itself is a warning sign. Used this way, fingerprinting browser signals is less about identifying a person and more about checking whether the device is telling the truth.
Browser Fingerprints vs. Cookies
People often search for "fingerprinting cookies" because the two are used for similar jobs. They work very differently:
|
|
Cookies |
Browser fingerprint |
|---|---|---|
|
Where it lives |
A small file stored in your browser |
Nowhere. It's recalculated on each visit |
|
Can you see or delete it? |
Yes, in your browser settings |
No |
|
Survives clearing browsing data? |
No |
Yes |
|
Changes when… |
It expires or is deleted |
You update your browser, operating system, or hardware |
|
Common uses |
Logins, preferences, ad tracking |
Bot and fraud detection, ad tracking |
That difference explains both the appeal and the controversy. As browsers limit third-party cookies, fingerprinting looks like a way to keep recognizing visitors. But visitors can't easily see or control a fingerprint, so using it for tracking can override choices people made when they cleared their cookies.
What Is Browser Fingerprinting Used For?
Browser fingerprinting has two main uses: recognizing visitors for advertising and analytics, and protecting websites from fraud and abuse. The technique is the same. The purpose is what changes how it's perceived and regulated.
What Is Fingerprinting in Cyber Security?
In cyber security, fingerprinting is a defensive technique for identifying devices and traffic that don't behave like real users. Security and fraud teams use it to:
- Spot bots and automated traffic posing as real visitors
- Recognize a device that comes back after being blocked
- Detect account takeover attempts and login abuse
- Identify click fraud and other invalid traffic in ad campaigns
- Catch tools built to hide a visitor's real device, such as headless browsers
Fingerprinting in cyber security is valuable because it sees through simple disguises. A VPN hides an IP address, but it doesn't change how a device renders graphics or which fonts it has installed.
How Anura Uses Device and Browser Signals to Stop Ad Fraud
For advertisers, every bot click and fake lead costs money twice: once in wasted spend, and again when that bad data skews bidding, attribution, and budget decisions.
Anura's ad fraud detection analyzes hundreds of individual visitor data points, including device and browser signals like the ones above, to determine whether a visitor is real. Each visitor receives a clear result: Good, Warning, or Bad. Anura only marks traffic as Bad when it's 100% confident the visitor isn't real, and guarantees 99.999% accuracy when identifying visitors as bad.
Is Browser Fingerprinting Legal?
Browser fingerprinting isn't banned outright, but privacy laws regulate how it's used. Under the GDPR, information that can identify a person, including online identifiers tied to their device, counts as personal data. In California, the CCPA/CPRA also covers identifiers that can be linked to a consumer or their device.
Regulators are paying close attention. Google changed its ad platform policies to allow advertisers to use fingerprinting starting February 16, 2025. In response, the UK's Information Commissioner's Office called the change "irresponsible" and said businesses must still give users fair choices and get consent where required.
Using fingerprinting to track people for advertising generally requires transparency and, often, consent or an opt-out. Using device signals to detect fraud and protect a website is a different purpose, but it still deserves careful handling. For a broader overview, see our GDPR compliance guide. Talk to your legal and privacy teams about your specific use. This article isn't legal advice.
Browser Fingerprinting Protection: How to Avoid It
Complete browser fingerprinting protection isn't realistic, because most fingerprinting signals are the same details websites need to display correctly. You can reduce how distinctive your browser looks, though:
- Use a browser with built-in protection. Firefox blocks scripts from known fingerprinting companies by default, and in private windows it also limits the device information it exposes to every site.
- Turn on strict tracking protection in your browser's privacy settings.
- Keep extensions to a minimum. Each unusual extension makes your browser stand out more.
- Don't rely on a VPN alone. It hides your IP address, but the rest of your fingerprint stays the same.
The takeaway is that complete browser fingerprinting protection is hard to achieve. Reducing how unique your browser looks helps, but it does not make a visitor invisible.
Is Browser Fingerprinting a Replacement for Cookies?
For marketing, fingerprinting has real strengths. It is easy to implement, can recognize returning visitors across sessions, and does not depend on stored identifiers. But it has drawbacks too. Fingerprints change when people update their browser or device, so the data can go stale. More users are adopting browsers that resist fingerprinting. And using it for tracking, against visitors' wishes, creates both a trust problem and a compliance risk.
For fraud detection, the picture is clearer. Using device and browser signals to tell real visitors from bots and fraudsters is one of the most effective protections available, and it works without relying on third-party cookies at all.
Stop Paying for Fake Traffic
Now that you know what a browser fingerprint is and how fingerprinting works, the next question is how much of your traffic is real. Anura helps advertisers and marketers identify bots, malicious humans, and fraud in their campaigns, leads, and websites, so every dollar and every data point counts.
Get a free traffic quality audit to see how much of your traffic is real.
