Become an affiliateStart your program

Technology and tracking

Fingerprinting

Also called browser fingerprinting, device fingerprinting, device fingerprint, canvas fingerprinting.

Short answer

Fingerprinting is identifying a visitor from the properties of their device – browser version, screen resolution, fonts, language and time zone – instead of a cookie. The user has nothing to delete, because nothing is stored on the device.

Definition of Fingerprinting.

Fingerprinting collects the information a browser gives away on its own and combines it into a value that is very likely to be unique. Each individual piece of information is shared by thousands of devices; it is the combination that singles one out. The method is also called browser fingerprinting or device fingerprinting.

Fingerprinting is used as a substitute for cookies precisely because it does not depend on anything being stored in the browser. That is also why the method is controversial: it is invisible to the user, cannot be cleared in the browser settings and does not disappear in a private window.

The law does not distinguish by technology. The Danish cookie order (cookiebekendtgørelsen) requires consent for any access to information on the user’s device – not just for cookies – so fingerprinting for tracking requires consent just like a tracking cookie. On top of that, the processing of the information itself needs a legal basis under the GDPR.

Why fingerprinting is fragile as tracking

The fingerprint changes. A browser update, a new screen, a newly installed font or a switch between Wi-Fi and mobile data can shift the value, and the user becomes a new person in the system’s eyes. The opposite error exists too: two identical devices with the same setup can end up with the same fingerprint and be merged into one user.

Browsers are also actively working against the method. Several browsers standardise the information they give away or block known fingerprinting scripts, and for years the trend has only gone one way. Tracking that rests on fingerprinting therefore becomes gradually less accurate, without anyone changing anything in the setup.

How it goes wrong

  • 01

    Fingerprinting sold as cookieless and therefore consent-free

    The fact that a method does not use cookies does not remove the consent requirement. The requirement is tied to accessing information on the user’s device, not to what the technique is called.

  • 02

    Nobody can verify a match

    A fingerprint can neither be seen nor deleted by the user. If attribution is built on it, neither the store nor the affiliate can explain afterwards why a particular sale was linked to a particular referral.

  • 03

    False merges on shared devices

    Company computers rolled out with an identical setup look alike. Tracking that relies on similarity rather than an ID then credits the sale to the wrong person.

At Affilyflow

Fingerprinting in practice

Affilyflow does not use fingerprinting. Attribution rests on the click ID, which the click carries with it in the URL, plus a cookie in the browser – there is no device fingerprint, no identity graph and no linking across devices. This is a choice, not a missing feature: the price is that a purchase on a different device from the click is not counted, and we would rather pay that price than track people who cannot see it.

Frequently asked questions

What is fingerprinting?

Fingerprinting is a tracking method that identifies a visitor from the combination of their device’s properties – browser version, screen resolution, language, time zone and fonts – instead of storing an ID in the browser. The user gives away the information without being able to see it.

Does fingerprinting require consent?

Yes, when it is used for tracking. The Danish cookie order requires consent for access to information on the user’s device regardless of technology, and the processing of the information also needs a legal basis under the GDPR. The fact that the method does not use cookies does not change the requirement.

Is fingerprinting more accurate than cookies?

Not over time. A fingerprint changes with browser updates, screen changes and network changes, and two identical devices can get the same fingerprint. Several browsers also standardise the information they give away precisely to make the method useless.

Does Affilyflow use fingerprinting?

No. Attribution is based on the click ID in the link and a cookie in the browser, not on the properties of the device. There is no fingerprinting, no identity graph and no cross-device tracking.

Read on