What Is Device Fingerprinting and How It Differs From Browser Fingerprinting

Both are ways to recognize you without cookies. Browser fingerprinting identifies a particular browser from the details it reveals to websites. Device fingerprinting aims to identify the device itself, so it can recognize you across browsers and apps, and it's used heavily for fraud prevention and by apps.

Browser fingerprinting

A website runs scripts that collect what your browser exposes:

• browser and version, language and time zone;
• screen size and color depth;
• installed fonts;
• how your browser draws text and shapes (canvas and WebGL fingerprinting);
• how it processes audio.

Combined, these can be distinctive enough to recognize your browser on later visits and across sites. Switch to another browser on the same computer and the fingerprint changes.

Device fingerprinting

Device fingerprinting looks for signals that stay the same whichever browser or app you use:

• hardware details, such as the graphics card and CPU, partly visible through the browser;
• screen and system settings;
• in mobile apps, much more: device model, operating system build, sensors, and in some cases advertising IDs;
• network details, such as your IP address.

Researchers have shown that some techniques can link different browsers on the same computer by looking at the hardware underneath.

Who uses it and why

• Fraud and security: banks and stores flag logins from unfamiliar devices, and fingerprinting helps catch stolen accounts and card fraud.
• Bot detection: sites use it to tell real visitors from automated ones.
• Social networks: platforms use device signals to spot fake accounts, ban evasion and people running many accounts.
• Advertising: to recognize people when cookies are blocked, which is the part privacy laws and app store rules target.

What's being done about it

Apple's App Tracking Transparency requires apps to ask before tracking you across other companies' apps and sites, and Apple's rules forbid fingerprinting to get around that. In the EU, the GDPR and ePrivacy rules treat fingerprinting for tracking much like cookies, requiring consent.

How to reduce fingerprinting

• Browsers with protection: Brave randomizes fingerprinting details, Firefox blocks known fingerprinting scripts, and Safari limits what it reveals.
• Block trackers so fingerprinting scripts don't load in the first place.
• On phones, say no to tracking requests, reset or delete your advertising ID, and limit app permissions.
• Don't over-customize your browser with rare fonts and settings, which can make you stand out more.

For the bigger picture, see how sites track you without cookies.