Browser fingerprinting: data protection without a cookie

„We do not use cookies“ sounds like a free pass. It applies only if nothing else is stored on the device or read from it. Browser fingerprinting is the best-known technique that manages without a cookie and still makes visitors recognisable. This article explains how it works, how the law classifies it and how it differs from a lookup on the server.

What fingerprinting is

With fingerprinting, a script combines many features of a device into a pattern that rarely occurs twice. Typical building blocks are browser version, operating system, screen resolution, time zone, language settings, installed fonts and peculiarities of graphics output. The pattern works like an ID that the visitor never issued. It cannot simply be deleted like a cookie, because it is not stored anywhere. It is created anew at every visit from the same features.

You should distinguish two kinds:

• Active. A script in the browser queries properties deliberately, for example via programming interfaces for the screen, fonts or graphics.
• Passive. The server only evaluates what the browser sends along with every page request anyway, for example the browser type in the request header and the IP address.

Why § 25 TDDDG can apply even without a cookie

The German rule applies not only to storing but also to „access to information that is already stored in the end device“. You will find the wording on gesetze-im-internet.de. Anyone who reads device features by script is accessing such information. That is why the rule is explained in detail in § 25 TDDDG: cookies and tracking in Germany.

The German Data Protection Conference has developed a line on this in its guidance for telemedia. According to it, access presupposes a deliberate transmission of the browser information that is not initiated solely by the end user. Active fingerprinting therefore falls under the consent requirement, while purely passive evaluation of what is sent anyway does not, on this reading. That is the view of the supervisory authorities, and the question is not answered the same way everywhere in legal scholarship.

At European level the line goes further. In its Guidelines 2/2023 on the scope of Art. 5(3) of the ePrivacy Directive, the European Data Protection Board stated that fingerprinting falls within its scope. Collecting information via request headers or caching mechanisms can also belong to it if it is used for fingerprinting or tracking (para. 43).

Austria and Switzerland

Austria. § 165 Abs. 3 TKG 2021 requires consent for the collection of data, with exceptions for what is technically necessary. The Data Protection Authority reads the provision broadly. How it is structured is explained in Cookies in Austria: § 165 TKG 2021 explained.

Switzerland. In its guide on cookies, the Federal Data Protection and Information Commissioner expressly names browser fingerprinting as an example of „similar technologies“ in which nothing is stored on the device. The same requirements for information and an option to refuse apply to them as for cookies. More on this in Website tracking in Switzerland: revDSG and FMG.

And the GDPR?

The GDPR also applies as soon as a person can be identified from the fingerprint. With a pattern meant to recognise visitors across several visits, that is usually the case. The fingerprint is then an online identifier within the meaning of Art. 4(1) GDPR. Anyone who uses it for tracking or advertising purposes needs a legal basis, in practice usually consent. When legitimate interest holds up instead is shown in Legitimate interest under the GDPR: the 3 steps of the test.

Distinction: looking up the network owner on the server

Company identification via the network owner of the IP address works differently. It reads no device properties and creates no identifier that would later find a visitor again. The server looks up in the public network registry who owns the network. Afterwards the IP address is discarded. How this works technically is described in How does company identification work? The technology in 6 steps.

Whether this is therefore safely outside § 25 TDDDG is still not a matter of course. In the guidelines mentioned (paras. 54 and 55), the European Data Protection Board states that Art. 5(3) can also apply to tracking based on the IP address alone, insofar as it originates from the user's end device. What is meant is following the navigation. According to the Board, the fact that an application touches the article does not mean that consent is always needed, as the exceptions must be examined individually. Out of caution, some providers, Whovisit among them, load the script only after consent to an analytics category.

Checklist for your website

1. List which scripts read device properties. This includes analytics, fraud protection and advertising tools.
2. Ask every provider whether it uses fingerprinting and for what purpose.
3. Check whether the purpose is „strictly necessary“ within the meaning of the exception. Fraud prevention is sometimes argued this way, but it must be interpreted narrowly and clarified with your data protection adviser.
4. Load everything that is not necessary only after consent.
5. Describe the technology clearly in the privacy policy. „We do not use cookies“ is not enough for that.

Frequently asked questions

Is fingerprinting prohibited? No. But as a rule it needs consent when it is used for tracking or advertising. For fraud prevention and security, an exception is sometimes argued, which is interpreted narrowly.

Is „Do Not Track“ or an ad blocker enough to protect visitors? That protects the individual but does not replace your obligations. The website operator remains responsible.

Does evaluating the user agent fall under § 25? Not under the line of the Data Protection Conference, if the server only uses what the browser sends anyway. If the value is combined into fingerprinting or tracking, the assessment can differ, as the guidelines of the European Data Protection Board show.