Fingerprints are the new cookies
Browser and device fingerprinting is emerging as a powerful replacement for tracking cookies, using subtle technical signals (from fonts and GPU details to behavior patterns) to recognize users even across private modes, VPNs, and changing IPs. Commenters weigh its benefits for fraud prevention and bot mitigation against the risks of pervasive, often invisible surveillance that existing consent banners and privacy laws struggle to meaningfully constrain. Many argue that technical defenses like anti-fingerprinting browsers are only partial fixes and that curbing data brokering and surveillance-based advertising at the legal and economic level is increasingly essential.
Cookies vs. Fingerprints
- Many note cookies themselves are benign state-keeping tools; the abuse is tracking and data resale.
- Fingerprinting is framed as the next step: harder to block than cookies, resilient to clearing storage, and already widely deployed.
- Several argue the whole “cookie” debate was a decoy; tracking was never limited to cookies.
Legal and Regulatory Framing
- Multiple comments say browser fingerprinting is already illegal in the EU without consent, under ePrivacy and GDPR, regardless of whether cookies are used.
- Others point out banners should be about tracking, not cookies, and that functional but non‑essential cookies also require consent.
- Some complain enforcement is weak and malicious compliance (huge, confusing consent dialogs; “legitimate interest” abuse) undermines the rules.
Effectiveness and Limits of Fingerprinting
- Demonstrations (fingerprint.com, CreepJS) impress many: they can correlate sessions across IPs, VPNs, and devices.
- Others emphasize commercial reality: most services still lean heavily on IP and stable identifiers (email, phone, login); fingerprints alone are noisy and change frequently.
- There’s debate over entropy: desktop/Android seen as high‑entropy; iOS thought more uniform, though native apps and OS‑level IDs still leak many bits.
- Fraud and abuse teams report device fingerprints don’t eliminate fraud but raise attacker cost and catch low‑effort abuse.
User Defenses and Trade-offs
- Techniques mentioned: Tor Browser, Mullvad/Brave with anti‑fingerprinting, JS off by default, VPNs, compartmentalizing activities across browsers/devices, extensions like JShelter, CanvasBlocker, Chameleon, uBlock, DNS-level blocking.
- Strong defenses often trigger captchas, Cloudflare checks, 2FA re-login on every visit, and sometimes outright bans.
- Some argue blending into a large crowd (“non‑unique fingerprint”) is better than obviously spoofed or highly unique setups.
Advertising, Data Brokering, and Society
- Big split: some see de‑identified pattern analysis and ad targeting as acceptable; others see it as surveillance capitalism affecting jobs, pricing, customer service, and offline life.
- Proposals range from banning third‑party or all advertising, to banning data brokerage, to strong privacy laws with real penalties.
- “Nothing to hide” arguments are challenged with examples of regime change, criminalization of behavior, chilling effects on journalism and activism.
Browser Design and Web APIs
- Many blame permissive web APIs (JS, WebGL/WebGPU, audio, fonts, timing, headers, CSS behavior) for enabling fingerprinting.
- Suggested mitigations: gate high‑entropy APIs behind permissions, reduce exposed information, standardize or randomize outputs, or even roll back reliance on client‑side scripting—though others think that ship has sailed.