| Both sides previous revisionPrevious revisionNext revision | Previous revision |
| privacy:fingerprinting [2026/08/12 09:29] – Refresh all corpus figures for the extended 2010-2026 extraction (4,322 -> 5,859 papers; fingerprint-naming 201 -> 280, browser-FP subset 59 -> 83). fp_fold.mjs extended: residue had grown from 5 tuples to 59, now 7; new 'LLM / model identification' famil karel.kubicek.claude | privacy:fingerprinting [2026/08/21 14:50] (current) – Boxes: <wrap> renders a span, use uppercase <WRAP>; one box per list, not per bullet karel.kubicek.claude |
|---|
| //Browser fingerprinting// identifies a browser — and through it a device and a person — from the configuration it exposes to JavaScript and to HTTP: fonts, canvas rendering, audio processing, screen geometry, installed extensions, GPU behaviour. Unlike [[Privacy:Cookies|cookies]] it is **stateless**: nothing is written to the client, so nothing can be cleared, and there is no browser API a user can use to say no. That is what makes it the tracking technique that outlives every storage-based countermeasure, and the one a measurement study is least well equipped to observe. | //Browser fingerprinting// identifies a browser — and through it a device and a person — from the configuration it exposes to JavaScript and to HTTP: fonts, canvas rendering, audio processing, screen geometry, installed extensions, GPU behaviour. Unlike [[Privacy:Cookies|cookies]] it is **stateless**: nothing is written to the client, so nothing can be cleared, and there is no browser API a user can use to say no. That is what makes it the tracking technique that outlives every storage-based countermeasure, and the one a measurement study is least well equipped to observe. |
| |
| The canonical entry point outside this wiki is Laperdrix et al.'s survey {[laperdrix2020_survey]}, which covers the attribute space, the entropy literature and the defence taxonomy in a way this page does not attempt to duplicate. What this page adds is the **measurement methodology**: how the 59 papers in our corpus actually detected fingerprinting, why their prevalence numbers cannot be compared with one another, and what you have to instrument to produce a number of your own. | The canonical entry point outside this wiki is Laperdrix et al.'s survey {[laperdrix2020_survey]}, which covers the attribute space, the entropy literature and the defence taxonomy in a way this page does not attempt to duplicate. What this page adds is the **measurement methodology**: how the 83 papers in our corpus actually detected fingerprinting, why their prevalence numbers cannot be compared with one another, and what you have to instrument to produce a number of your own. |
| |
| <WRAP important> | <WRAP important> |
| **Before you search the literature for "fingerprinting", know that the word names at least six unrelated research areas.** In our corpus of seven security and privacy venues, 201 papers describe detecting something they call a fingerprint. Only 59 of them are about browsers. The largest single group — 71 papers — is **website fingerprinting**, an encrypted-traffic-analysis problem about inferring which page a victim loaded over Tor or a VPN. It shares the word and almost nothing else. See [[#What the Word Means in the Literature]]. | **Before you search the literature for "fingerprinting", know that the word names at least eight unrelated research areas.** In our corpus of seven security and privacy venues, 280 papers describe detecting something they call a fingerprint. Only 83 of them are about browsers. The largest single group — 105 papers — is **website fingerprinting**, an encrypted-traffic-analysis problem about inferring which page a victim loaded over Tor or a VPN. It shares the word and almost nothing else. See [[#What the Word Means in the Literature]]. |
| </WRAP> | </WRAP> |
| |
| ==== Detection in the wild versus defence ==== | ==== Detection in the wild versus defence ==== |
| |
| The 59 papers split into two research programmes that use the same instrumentation: | The 83 papers split into two research programmes that use the same instrumentation: |
| |
| **Detecting fingerprinting** — the classifier lineage. Heuristic API-access counting (Acar et al., Englehardt & Narayanan) gave way to learned script classifiers: FP-Inspector {[iqbal2021_fingerprinting]} on syntactic and dynamic JS features, FP-Radar {[bahrami2022_radar]} on the co-occurrence graph of API accesses over time, automatic discovery of //emerging// techniques {[su2023_automatic]}, taint tracking with entropy thresholds in FP-Tracer {[boussaha2024_tracer]}, and federated detection without centralising crawl data in FP-Fed {[annamalai2024_fpfed]}. Rizzo et al. {[rizzo2021_unveiling]} come at it from code mining instead. | **Detecting fingerprinting** — the classifier lineage. Heuristic API-access counting (Acar et al., Englehardt & Narayanan) gave way to learned script classifiers: FP-Inspector {[iqbal2021_fingerprinting]} on syntactic and dynamic JS features, FP-Radar {[bahrami2022_radar]} on the co-occurrence graph of API accesses over time, automatic discovery of //emerging// techniques {[su2023_automatic]}, taint tracking with entropy thresholds in FP-Tracer {[boussaha2024_tracer]}, and federated detection without centralising crawl data in FP-Fed {[annamalai2024_fpfed]}. Rizzo et al. {[rizzo2021_unveiling]} come at it from code mining instead. |
| ==== Methodology and limitations of these figures ==== | ==== Methodology and limitations of these figures ==== |
| |
| * **Seven venues only.** CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P, 2010–2026, with 2025 and 2026 provisional. **EuroS&P, ACSAC, RAID, AsiaCCS, CHI and SOUPS are absent entirely**, and for this topic that is a real hole — the usability side of fingerprinting defences publishes at CHI and SOUPS. Every claim here is a claim about those seven venues. | * **Seven venues only**, 2010–2026, with 2025 and 2026 provisional. Which venues, which years, what each stage of the selection funnel costs and which venue-years are empty are on [[literature:corpus]] and are not restated here. For //this// topic the absent venues are a real hole — the usability side of fingerprinting defences publishes at CHI and SOUPS. Every claim here is a claim about those seven venues. |
| * **One paper is double-counted.** DRAWN APART {[laor2022_drawn]} appears twice in the NDSS 2022 index, once under its title slug and once as ''auto-draft-242'', so the 83 is 82 distinct papers. Counts elsewhere on the page carry the same one-paper error. Two other papers in the corpus have the same problem, neither of them here. | * **One paper is double-counted.** DRAWN APART {[laor2022_drawn]} appears twice in the NDSS 2022 index, once under its title slug and once as ''auto-draft-242'', so the 83 is 82 distinct papers. Counts elsewhere on the page carry the same one-paper error. Two other papers in the corpus have the same problem, neither of them here. |
| * **Silence is not absence.** "Does not state whether it ran headless" means the paper did not say. These are reporting figures, not practice figures. | * **Silence is not absence.** "Does not state whether it ran headless" means the paper did not say. These are reporting figures, not practice figures. |
| |
| - **Uniformity and randomisation are measured differently.** Against a uniformity defence you measure //how many users share a bucket//; against farbling you measure //whether values are linkable across sessions//. A protocol written for one gives a meaningless answer against the other, and this is a common flaw in defence comparisons. | - **Uniformity and randomisation are measured differently.** Against a uniformity defence you measure //how many users share a bucket//; against farbling you measure //whether values are linkable across sessions//. A protocol written for one gives a meaningless answer against the other, and this is a common flaw in defence comparisons. |
| - **Your own crawler's browser is a defence configuration.** A 2026 Firefox with FPP on by default in Standard mode is not the browser that older papers measured with. State the browser, the version, and the fingerprinting-protection settings — the 19.5% of crawling papers in the corpus that state statefulness are ahead of the field, and fingerprinting-protection state is reported even less often than that. | - **Your own crawler's browser is a defence configuration.** A 2026 Firefox with FPP on by default in Standard mode is not the browser that older papers measured with. State the browser, the version, and the fingerprinting-protection settings — the 19.6% of crawling papers in the corpus that state statefulness are ahead of the field, and fingerprinting-protection state is reported even less often than that. |
| |
| ==== The 2025 policy reversal ==== | ==== The 2025 policy reversal ==== |
| On 18 December 2024 Google notified users of its advertising products that **from 16 February 2025 it would no longer prohibit them from employing fingerprinting techniques**. The UK Information Commissioner's Office responded the next day: //"We think this change is irresponsible"//, quoting Google's own 2019 position on fingerprinting back at it — //"We think this subverts user choice and is wrong."//((UK Information Commissioner's Office, [[https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/12/our-response-to-google-s-policy-change-on-fingerprinting/|"Our response to Google's policy change on fingerprinting"]], 19 December 2024. Verified against the ICO page directly on 2026-08-05.)) | On 18 December 2024 Google notified users of its advertising products that **from 16 February 2025 it would no longer prohibit them from employing fingerprinting techniques**. The UK Information Commissioner's Office responded the next day: //"We think this change is irresponsible"//, quoting Google's own 2019 position on fingerprinting back at it — //"We think this subverts user choice and is wrong."//((UK Information Commissioner's Office, [[https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/12/our-response-to-google-s-policy-change-on-fingerprinting/|"Our response to Google's policy change on fingerprinting"]], 19 December 2024. Verified against the ICO page directly on 2026-08-05.)) |
| |
| For a measurement researcher this is the most consequential change in the topic since GDPR. Prevalence figures from before February 2025 describe a web in which the largest ad platform contractually forbade the technique. Anything you measure after it does not, and the corpus behind this page ends in 2024 — so **there is currently no peer-reviewed measurement in these seven venues of the post-reversal web.** That is an open research question with a date on it. | For a measurement researcher this is the most consequential change in the topic since GDPR. Prevalence figures from before February 2025 describe a web in which the largest ad platform contractually forbade the technique; anything you measure after it does not. |
| | |
| | **The first post-reversal measurement in these seven venues has now landed.** Luo et al. {[luo2025_canvassing]} crawled the Tranco top 20K and a random tail sample **in May 2025**, three months after the change, and found canvas fingerprinting on **12.7% of 16,276 popular sites and 9.9% of 17,260 tail sites**. That is one technique on one crawl, and it is not a before/after comparison — nobody has run the same instrument on both sides of the date. But the page can no longer say the post-reversal web is unmeasured, and a pre/post study now has a published post-side baseline to work against. |
| </WRAP> | </WRAP> |
| |
| ==== Detecting fingerprinting in a crawl ==== | ==== Detecting fingerprinting in a crawl ==== |
| |
| * **[[https://github.com/openwpm/OpenWPM|OpenWPM]]** — the standard instrumented crawler; its JavaScript instrumentation records every access to a configured API surface, with call arguments and stack, which is the raw material every detector on this page consumes. 12 of the 59 papers use it. See [[Programming:Crawler:OpenWPM]]. | * **[[https://github.com/openwpm/OpenWPM|OpenWPM]]** — the standard instrumented crawler; its JavaScript instrumentation records every access to a configured API surface, with call arguments and stack, which is the raw material every detector on this page consumes. 15 of the 83 papers use it. See [[Programming:Crawler:OpenWPM]]. |
| * **[[https://github.com/uiowa-irl/FP-Inspector|FP-Inspector]]** {[iqbal2021_fingerprinting]} — the most-used purpose-built classifier in the corpus (4 papers). Treat it as a **research artifact frozen at its 2021 paper**, not a maintained tool: useful for its classifier, feature set and labelled script list; expect to port it. | * **[[https://github.com/uiowa-irl/FP-Inspector|FP-Inspector]]** {[iqbal2021_fingerprinting]} — the most-used purpose-built classifier in the corpus (4 papers). Treat it as a **research artifact frozen at its 2021 paper**, not a maintained tool: useful for its classifier, feature set and labelled script list; expect to port it. |
| * **[[https://github.com/duckduckgo/tracker-radar-collector|DuckDuckGo Tracker Radar Collector]]** — a lighter Puppeteer-based collector with an API-access collector built in; 3 papers. See [[Programming:Crawler:Tracker radar collector]]. | * **[[https://github.com/duckduckgo/tracker-radar-collector|DuckDuckGo Tracker Radar Collector]]** — a lighter Puppeteer-based collector with an API-access collector built in; 6 papers. See [[Programming:Crawler:Tracker radar collector]]. |
| * **Filter lists** — EasyPrivacy and Disconnect are what most papers actually use for ground truth. Read the caveat above before you do the same, and see [[Privacy:Requests]] for how to apply them in post-processing rather than during the crawl. | * **Filter lists** — EasyPrivacy and Disconnect are what most papers actually use for ground truth. Read the caveat above before you do the same, and see [[Privacy:Requests]] for how to apply them in post-processing rather than during the crawl. |
| |
| * **[[https://abrahamjuliot.github.io/creepjs/|CreepJS]]** — aggressive detection of lies and inconsistencies: it is the closest public analogue to FP-Scanner {[vastel2018_scanner]} and the fastest way to discover that your stealth plugin is making you //more// identifiable. | * **[[https://abrahamjuliot.github.io/creepjs/|CreepJS]]** — aggressive detection of lies and inconsistencies: it is the closest public analogue to FP-Scanner {[vastel2018_scanner]} and the fastest way to discover that your stealth plugin is making you //more// identifiable. |
| * **[[https://fpmon.github.io/fingerprinting-monitor/|FPMON]]** — a browser extension that reports, in real time, which fingerprinting-relevant APIs the current page touched. Handy for a spot check on a site your pipeline flagged. | * **[[https://fpmon.github.io/fingerprinting-monitor/|FPMON]]** — a browser extension that reports, in real time, which fingerprinting-relevant APIs the current page touched. Handy for a spot check on a site your pipeline flagged. |
| * **[[https://github.com/fingerprintjs/fingerprintjs|FingerprintJS]]** — the open-source library, used as a positive control by 9 of the 59 papers. Licence history matters if you vendor it: MIT, then Business Source License 1.1 for the 4.x series, back to MIT from 5.0.0 (current npm release 5.2.0, MIT, checked 2026-08-05). The hosted **Fingerprint Pro** product is separate and proprietary. | * **[[https://github.com/fingerprintjs/fingerprintjs|FingerprintJS]]** — the open-source library, used as a positive control by 14 of the 83 papers. Licence history matters if you vendor it: MIT, then Business Source License 1.1 for the 4.x series, back to MIT from 5.0.0 (current npm release 5.2.0, MIT, checked 2026-08-05). The hosted **Fingerprint Pro** product is separate and proprietary. |
| |
| ==== A crawler self-check you should run ==== | ==== A crawler self-check you should run ==== |
| - Whether the fingerprinting scripts you detected are the same set a headful browser on the same page loads. FP-Fed {[annamalai2024_fpfed]} measures precisely this gap. | - Whether the fingerprinting scripts you detected are the same set a headful browser on the same page loads. FP-Fed {[annamalai2024_fpfed]} measures precisely this gap. |
| |
| ''puppeteer-extra-plugin-stealth'' patches many of the obvious tells and appears in one corpus paper. Do not treat it as a solution: CreepJS and FP-Scanner-style consistency checks defeat it, and a partially-patched browser occupies an anonymity set of one. If detectability matters to your result, **measure it and report it** rather than assuming it away. | ''puppeteer-extra-plugin-stealth'' patches many of the obvious tells and appears in two corpus papers. Do not treat it as a solution: CreepJS and FP-Scanner-style consistency checks defeat it, and a partially-patched browser occupies an anonymity set of one. If detectability matters to your result, **measure it and report it** rather than assuming it away. |
| |
| ===== Open Questions ===== | ===== Open Questions ===== |
| |
| * <wrap todo>No measurement in these seven venues of fingerprinting prevalence **after** Google's 16 February 2025 policy change. The pre/post comparison is the obvious study and the baseline data (FP-Radar, FP-Inspector) is public.</wrap> | <WRAP todo> |
| * <wrap todo>No study quantifies how much a **headless or containerised crawler** under-counts fingerprinting relative to a headful one on the same site list. FP-Fed {[annamalai2024_fpfed]} shows the gap exists; nobody has measured its size across a large crawl.</wrap> | * No **pre/post comparison** across Google's 16 February 2025 policy change. Luo et al. {[luo2025_canvassing]} now supply a post-reversal canvas-fingerprinting baseline (May 2025, 12.7% of the top 20K), so what is missing is the same instrument run on both sides of the date rather than any measurement at all. The pre-side baseline data (FP-Radar, FP-Inspector) is public. |
| * <wrap todo>Prevalence figures are incomparable across papers because unit, rank cut and definition all vary. A shared benchmark — a fixed site sample with hand-labelled ground truth — does not exist for fingerprinting the way EasyList serves ad-blocking research.</wrap> | * **Partly answered since this page was written.** Annamalai et al. {[annamalai2025_beyond]} compared real user sessions against an automated crawl of the same sites and found the crawl missed **211 of 471 fingerprinting websites (45%)** — the first published size for this gap. What is still open is the narrower question: how much of that 45% is //headless versus headful// as opposed to interaction depth, authentication and consent, which the paper attributes it to. |
| * <wrap todo>Consent and fingerprinting: only 7 of 59 papers touch a law, and none in the corpus tests whether a CMP's consent signal changes fingerprinting behaviour on the same site. Combining this page's detection tooling with [[Privacy:Consent]]'s CMP interaction is a well-defined study.</wrap> | * Prevalence figures are incomparable across papers because unit, rank cut and definition all vary. A shared benchmark — a fixed site sample with hand-labelled ground truth — does not exist for fingerprinting the way EasyList serves ad-blocking research. |
| * <wrap todo>Usability of fingerprinting defences is invisible here because CHI and SOUPS are outside the corpus. Someone with access should extend the [[#What the Word Means in the Literature]] analysis to those venues.</wrap> | * Consent and fingerprinting: only 10 of 83 papers touch a law, and none in the corpus tests whether a CMP's consent signal changes fingerprinting behaviour on the same site. Combining this page's detection tooling with [[Privacy:Consent]]'s CMP interaction is a well-defined study. |
| | * Usability of fingerprinting defences is invisible here because CHI and SOUPS are outside the corpus. Someone with access should extend the [[#What the Word Means in the Literature]] analysis to those venues. |
| | </WRAP> |
| |
| ===== Related Pages ===== | ===== Related Pages ===== |
| |
| * [[Privacy:Cookies]] — the stateful counterpart; fingerprinting and cookies are used together, and respawning links them directly {[fouad2022my]}. | * [[Privacy:Cookies]] — the stateful counterpart; fingerprinting and cookies are used together, and respawning links them directly {[fouad2022my]}. |
| * [[Privacy:JavaScript]] — classifying the scripts that 42.4% of these papers are actually detecting. | * [[Privacy:JavaScript]] — classifying the scripts that 39.8% of these papers are actually detecting. |
| * [[Privacy:Requests]] — the filter lists that most of this literature uses as ground truth, and why that is a compromise. | * [[Privacy:Requests]] — the filter lists that most of this literature uses as ground truth, and why that is a compromise. |
| * [[Privacy:Consent]] — the open compliance question: a technique with no refusal mechanism. | * [[Privacy:Consent]] — the open compliance question: a technique with no refusal mechanism. |
| * [[Design:Website classification]] — where fingerprinting sits in the wider classification taxonomy. | * [[Design:Website classification]] — where fingerprinting sits in the wider classification taxonomy. |
| * [[Programming:Crawler:OpenWPM]] and [[Programming:Crawler:Tracker radar collector]] — the two instrumented crawlers this page depends on. | * [[Programming:Crawler:OpenWPM]] and [[Programming:Crawler:Tracker radar collector]] — the two instrumented crawlers this page depends on. |
| * [[Programming:Stateful stateless]] — only 39.0% of these papers state it, and for fingerprinting it changes what you see. | * [[Programming:Stateful stateless]] — only 36.8% of these papers state it, and for fingerprinting it changes what you see. |
| * [[Design:Crawling location]] — the other axis a fingerprinting crawl is judged on. | * [[Design:Crawling location]] — the other axis a fingerprinting crawl is judged on. |
| * [[Statistics:Biases]] — why a uniqueness percentage is a property of your sample. | * [[Statistics:Biases]] — why a uniqueness percentage is a property of your sample. |
