Fingerprinting
Cookieless identification that builds a persistent device signature from browser and hardware traits: canvas, WebGL, audio and multi-attribute techniques visitors can’t easily block.
Tracking that rejecting cookies can’t stop.
Fingerprinting identifies a device without cookies, so clearing or rejecting them doesn’t stop it. That covert quality is what supports interception claims.
Purpose matters. Fraud prevention reads differently from advertising, and audio fingerprinting is rarely disclosed and among the highest-risk techniques.
Device or browser fingerprinting
Example finding. Vendor names are withheld.
What CyRisk tracks.
Severity and placement are CyRisk defaults. Your team can elevate, downgrade or drop any risk to context-only, per account.
| RISK | DEFAULT SEVERITY | DEFAULT PLACEMENT |
|---|---|---|
| Fingerprinting prior to consent | High | May Affect Coverage |
| Device or browser fingerprinting | High | May Affect Coverage |
| Canvas fingerprinting | High | May Affect Coverage |
| WebGL fingerprinting | High | May Affect Coverage |
| Audio fingerprinting | High | May Affect Coverage |
| Device-attribute entropy aggregation | High | May Affect Coverage |
| Font or plugin enumeration fingerprinting | Medium | May Affect Coverage |
Fingerprinting scripts are observed running before consent or after a visitor rejects tracking.
Disclose each fingerprinting technique by name with vendor and purpose, gate the scripts behind the consent signal, and offer an opt-out from advertising uses. Strongly consider removing audio fingerprinting.
Verified by rescan. The fix shows on the next scan.
Ready-to-use language.
“Which vendor runs device fingerprinting, and is it used for fraud prevention or advertising?”
“Gate fingerprinting scripts behind consent or document a fraud-prevention purpose, verified by CyRisk rescan.”
Consider a wrongful-collection sublimit where fingerprints feed advertising.
Keep exploring.
Laws this exposure can trigger
Related exposure families
Isn’t fingerprinting used for fraud prevention?
Often, yes, and that reads differently from advertising use. Ask which it is and whether it’s disclosed.
Why is audio fingerprinting called out?
It’s rarely disclosed and rarely needed for legitimate purposes, which makes it one of the highest-risk techniques.
Does rejecting cookies stop fingerprinting?
No. That’s what makes it hard for visitors to avoid.
See what’s fingerprinting your applicants’ visitors.
Send five past submissions you’ve already bound, conditioned or declined. We score them blind, then put our disposition next to the call you made.
Severity and placement shown are CyRisk defaults and can be tuned per account. A detected exposure indicates a fact pattern common to privacy litigation, not a confirmed violation. Litigation theories explain why a finding is tracked; they are not legal advice.