Browser fingerprinting

Browser fingerprinting identifies or re-identifies a device by combining characteristics exposed by the browser — screen resolution, installed fonts, timezone, user-agent string, and rendering quirks in canvas or WebGL output — into a single, near-unique signature, without setting a cookie at all.

This differs from cookie-based tracking in an important way: a cookie is a value a site deliberately stores and that a user can see, clear, or block. A fingerprint is derived passively from information the browser already exposes for other purposes, so it is far harder for a visitor to detect or opt out of, and it can persist even after cookies, including third-party cookies, are deleted or blocked.

Fingerprinting has legitimate uses in fraud and bot detection, where a stable device signature helps flag abuse. As a substitute for cookies in advertising and analytics, however, it is treated with more suspicion than cookies by regulators: under frameworks like the EU's ePrivacy rules and General Data Protection Regulation, fingerprinting for tracking purposes generally requires the same kind of consent as a cookie would, and major browsers have been actively working to reduce the fingerprinting surface by randomizing or limiting the signals available. It is one option under the broader umbrella of cookieless tracking, not a loophole around cookie consent rules.