Fingerprinting, or how to track a user without cookies

"Browser fingerprinting" is a method that, as its name suggests, consists of generating a unique "fingerprint" based on the characteristics of your machine and your browser, all without ever storing anything.

How does it work?

Thanks to a piece of Javascript code present on the page, the website in question will try to retrieve as much information as possible made available by the browser.

But what information, you might ask?

Here is a non-exhaustive list:

• The default language
• The timezone
• The user-agent
• The list of installed fonts
• The installed plugins
• The screen resolution
• The pixel ratio
• etc...

Some libraries use dozens of different characteristics, and some sites also use information retrieved by the server such as the IP address, the MAC address, etc...

It is sometimes possible to achieve 99.5% identification accuracy in just a few milliseconds. You can, for example, test the fingerprintjs library in its version 2, available on Github: https://github.com/fingerprintjs/fingerprintjs2

For what purpose?

You are certainly familiar with the most common tracking method, which consists of dropping a cookie on the visitor's machine and retrieving its value between each visit.

Even better, it is possible to import a script from a particular domain (each cookie is linked to a domain) onto several sites to track the visitor's browsing between these sites, which is the principle behind Google Analytics.

But what happens if the user deletes this cookie? If they switch to private browsing or block the loading of third-party scripts like some AdBlockers do?

Tracking then becomes impossible.

At least, until fingerprinting gets involved, because thanks to (or because of) it, it is possible to identify a user without storing anything on their machine, completely discreetly, even if they change browsers or switch to private browsing. The fingerprinting algorithm simply has to recalculate the unique identifier, and can then compare it to previous sessions.

The two main uses of this method are advertising tracking (which I'll talk more about at the end of the article) and fraud detection.

For example, a platform that only wants to allow one account per user could compare a visitor's fingerprint when creating an account to verify that they aren't already registered with another email.

How to protect yourself

Protecting yourself from this tracking system is more complex than blocking cookies or third-party scripts, because all the code is local to the site, so it would require a complete analysis of the site's code in order to detect a fingerprinting algorithm.

Fortunately, some software publishers have managed to find partial solutions, such as this extension for the Firefox browser, supposedly designed to prevent fingerprinting: https://www.presse-citron.net/firefox-de-nouvelles-fonctionnalites-anti-fingerprinting-pour-proteger-votre-vie-privee/

There is also an initiative called "Am I Unique?" which lets you analyze your browser in order to discover how easily your browser can be tracked or not: https://amiunique.org

Is this practice allowed under the GDPR?

The purpose of a regulation like the GDPR is to remain valid for as many cases as possible despite the rapid evolution of technology.

That's why you won't find any mention of "fingerprinting" in the legal text, but rather, more broadly, of any personal information that allows a user to be tracked.

Yes, the characteristics of your browser can be considered personal data if they are cross-referenced with one another.

In summary, fingerprinting is allowed provided that there is explicit consent from the user, or that the result of the algorithm is not stored, using it solely for fraud detection purposes, for example.

In any case, in practice, nothing stops you from experimenting on your own to understand how it works!

For more information on fingerprinting and the GDPR, here's a link to an article from the Electronic Frontier Foundation (in English): https://www.eff.org/deeplinks/2018/06/gdpr-and-browser-fingerprinting-how-it-changes-game-sneakiest-web-trackers

I hope this article was useful to you, and see you soon on the blog!