Browser Fingerprinting: Techniques, Use Cases, and Best Practices

Browser fingerprints, also known as online "fingerprints," are a tracking method used by websites to collect harmless data from visitors' IP addresses and are often used in web application development.

What Kind of Information Is Collected?

When you visit a website, your device sends a connection request to the target site to display its content. The target site can access and collect information about your device sent by the browser. Websites can collect a lot of information about the user's device using browser fingerprinting technology to tailor recommendations for their visitors. For example, a website can collect the following information about you without your consent depending on your browser type:

• Web browser (Chrome, Mozilla, Firefox, etc.)
• HTTP header (browser and operating system information)
• Preferred language
• Time zone
• Screen resolution
• Plugins and extensions

If the site you visit uses fingerprinting technology, it can detect and track your browser. On subsequent visits to the same site, it can remember your digital fingerprint and identify you as a returning visitor. You can find out what is included in a browser fingerprint and how unique it is at amiunique.org. As you can see, my fingerprint is unique in the amiunique.org database.
Scrolling down on amiunique.org, you can see how much data about you (e.g., your OS, browser version, etc.) your browser transmitted without your consent.

How Does Browser Fingerprinting Work?

With every connection request to a website, you provide the target website with information about your device. Suppose you are using a mobile phone to visit an e-commerce site. Your browser sends a connection request to the target web server when you click on a link to visit the e-commerce site. The web server then gains access to a small portion of data about your device, such as IP address, browser type, user agent, and more. In this case, the user agent tells the web server that the connection request is coming from a mobile phone using Safari. The website will display its content based on the provided user agent information.

The site tracks your behavior and actions as you navigate through pages to analyze site usage. With each visit to the e-commerce site, your device will be identified by the browser fingerprint.

What Are the Different Fingerprinting Methods?
1. Canvas Fingerprinting

Canvas fingerprinting is a type of browser fingerprinting used to track users online. The canvas fingerprinting method forces users' devices to draw a hidden image to obtain a digital fingerprint without their knowledge. This fingerprinting method primarily uses the HTML5 canvas element to reveal information about users' machines, such as operating systems, browser types, and more. When a user visits a web page, the browser automatically renders an image/text content on it. 

For example, if the site you visit uses canvas fingerprinting, the site will command the browser to draw an invisible image or text. In doing so, the HTML5 canvas element will reveal information about your computer, such as background color settings, font size/style, graphics card, and other distinguishing features. Since different devices render images differently, canvas fingerprinting will analyze how the device rendered the image/text to assign a unique identifier to each user device.

2. WebGL Fingerprinting

WebGL fingerprinting, like canvas fingerprinting, is used to reveal information about device graphics drivers and screen resolution by forcing the browser to output an image or text. This technique allows distinguishing users by their graphics drivers and screen resolution, creating unique fingerprints. 

3. Audio Fingerprinting

Audio fingerprinting checks how a device plays sound. Audio fingerprinting works similarly to canvas and WebGL fingerprinting. Since each device produces a unique set of sound waves, audio fingerprinting allows identifying users by the audio signals emitted by their devices, such as audio hardware and software.

Three Main Use Cases for Browser Fingerprinting
1. Online Fraud Detection

Using browser fingerprinting, websites can detect fraudulent user behavior. If a site detects fraudulent activity, it adds additional authentication steps to the login process to prevent unauthorized access and account theft for legitimate users.

Real-world example of browser fingerprinting: 
For instance, browser fingerprinting is used to authenticate users when logging into online banking. Wachovia, a financial services company, created unique fingerprints for their customers' devices to verify their identity using a unique identifier and block attackers.

2. Personalized Content Recommendations 

Web browsers have the ability to delete cookie history and block cookies. Browsers like Google, Firefox, Safari, and Microsoft Edge allow users to disable cookies. Unlike cookies, browser fingerprints are difficult to block. Therefore, browser fingerprinting is a more effective advertising method for tracking user behavior and actions online. 

Websites use fingerprints to track and analyze visitor actions and behavior in order to create personalized experiences based on their behavior and actions. For example, when you request a website to display its content, the website can determine your geographic location by tracking your IP address fingerprints. This allows e-commerce sites to recommend locally relevant content and nearby stores to their visitors. Using browser fingerprinting, websites can obtain the following information about their visitors:

• The user's current location.
• The type of device the user is using: desktop, tablet, or mobile phone.
• Traffic source, users may come to your site in various ways, such as direct traffic, social media traffic, referral, and paid traffic.

Real-world example of browser fingerprinting: 

Browser fingerprinting methods are used on 10%1 of sites in the Alexa top 100K to protect against ad fraud and potential cross-site tracking. The research team used FP-INSPECTOR to detect browser fingerprinting behavior on the top 100K Alexa sites.

3. Bot Detection

Websites use browser fingerprinting to protect against malicious bots. Browser fingerprinting examines HTTP headers sent by the browser to distinguish web bot traffic from normal browser traffic. 

Browser fingerprinting analyzes client-side signals to identify web bots based on indicators such as the number of requests, request frequency, unusually high page views, long session duration, etc. It collects the fingerprint of a suspicious browser and compares it with normal browsers to detect web bots based on fingerprint comparison. 

Is Browser Fingerprinting Legal?

Privacy regulations such as GDPR and CCPA do not directly address online fingerprinting. However, there are rules governing the tracking of internet user activities. Any information related to an identifiable natural person falls under GDPR. According to the EU General Data Protection Regulation (GDPR), companies must obtain user consent before tracking their online activities. Tracking and collecting information about users' online activity is not dangerous and is legal as long as you do not collect or process personal information that identifies the user without their consent. 

However,

• Websites not subject to CCPA or GDPR may collect this data without user consent.
• Sites subject to GDPR may collect some of this data under the "legitimate interests" provision if they claim that this data is necessary for the operation of the site. The legality of such action will depend on how critical this data is to the company's activities.

How to Avoid Browser Fingerprinting?

1. Anonymize Your Browser

The likelihood of being recognized and tracked by websites increases as the uniqueness of your browser increases. Avoiding browser fingerprinting is difficult. However, you can reduce the uniqueness level of your browser. 

For example, when connecting to a website, your machine sends a connection request to the web server with HTTP headers that include machine-specific information such as user agent (browser name, version, etc.), location, language, time zone, browser plugins, and other browser properties. We recommend anonymizing or reducing the uniqueness of your browser to avoid easy identification by websites. 

2. Use Proxy Servers

To ensure anonymity while browsing, you can use a proxy server or a headless browser, which is often used in automated software development. Shared proxy servers, for example, are a highly anonymous option to combat browser fingerprinting. Since multiple users simultaneously use the same IP address, it is very difficult for website servers to detect them. Your machine blends in with many other users' machines. Websites will find it difficult to identify your computer because you are using a less unique configuration.