> How the ClientJS fingerprinting library identifies devices without cookies, why that is personal data, GDPR and ePrivacy consent duties and compliant use. > > Canonical: https://www.flowconsent.com/en/services/framework/clientjs Frameworks # ClientJS Preferences · [Official website](https://clientjs.org) ClientJS is an open source JavaScript library that generates a browser fingerprint by reading device and browser attributes such as user agent, screen, fonts, plugins and canvas data. It combines these into a single identifier that can recognise a device without using cookies. Because fingerprinting accesses information on the user device and creates a persistent identifier, the GDPR and the ePrivacy Directive treat it as requiring prior consent. [Block ClientJS until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=framework) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Frameworks](https://www.flowconsent.com/en/services/framework) - Consent Preferences - Prior consent Required - Documented cookies 0 - Third-party domains 2 - Servers Runs client side in the visitor browser; the open source library is bundled with the website or loaded from a CDN, with no vendor servers Overview ## What does ClientJS do? ## **What is ClientJS?** ClientJS is a free, open source JavaScript library that creates a digital fingerprint of a visitor browser. Rather than storing an identifier in a cookie, it reads many properties of the browser and device and combines them into a single hashed value that is likely to be unique. Developers embed it to recognise returning devices for purposes such as fraud prevention, analytics or personalisation. ## **What data and signals does it collect?** ClientJS gathers attributes including the user agent, operating system, browser and version, language, screen resolution and colour depth, installed fonts and plugins, time zone, and canvas and WebGL rendering signatures. None of these on its own identifies a person, but their combination produces a fingerprint that can single out a device. The library itself does not set cookies and runs entirely in the browser. ## **GDPR and ePrivacy implications** A browser fingerprint is a persistent identifier that can distinguish one user from another, so it is personal data under the GDPR even when no name is attached. The act of reading device characteristics to build the fingerprint falls within Article 5(3) of the ePrivacy Directive, which European regulators interpret as covering fingerprinting and not only cookies. As a result, prior consent is generally required before ClientJS runs. ## **Consent requirements** Because fingerprinting is treated like a non essential cookie, you must obtain freely given, specific, informed and unambiguous consent before generating the fingerprint, unless it is strictly necessary for a service the user explicitly requested. Block the ClientJS code until consent is given through a Consent Management Platform, log that consent, and let users refuse or withdraw as easily as they accept. ## **Data transfers** ClientJS runs locally and does not send data to a library vendor, so transfers depend on what your own backend does with the fingerprint. If you transmit the fingerprint to servers outside the European Economic Area, for example a fraud or analytics provider in the United States, those transfers need a valid safeguard under Chapter V of the GDPR and a Transfer Impact Assessment. Keep a clear record of every recipient. ## **Practical compliance steps** Treat the fingerprint as a tracking identifier: disclose it in your cookie and privacy notices, gate it behind consent, and define a retention period after which it is deleted. Document the purpose and necessity of fingerprinting, prefer less intrusive alternatives where possible, and carry out a DPIA given the high risk nature of the technique. Review the implementation whenever you change how the fingerprint is used or shared. Compliance ## ClientJS and the GDPR ClientJS is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Consent (Art. 6(1)(a) GDPR) - Risk level high - Applicable regulations GDPR, ePrivacy Directive (Cookie Law) ### Impact assessment (DPIA) ClientJS reads a wide range of device and browser characteristics (user agent, language, screen resolution, colour depth, installed fonts, plugins, canvas and WebGL signatures, time zone) and hashes them into a probably unique fingerprint. Key DPIA considerations: (1) the fingerprint is a persistent identifier and therefore personal data even without a name; (2) fingerprinting is harder for users to detect, block or delete than cookies, which heightens the intrusion; (3) accessing device information falls under Article 5(3) of the ePrivacy Directive and requires consent; (4) combining the fingerprint with other data enables cross context tracking. A DPIA is strongly recommended because fingerprinting is a high risk, opaque form of identification. ### Sample text for your banner > We use ClientJS to recognise your device through a browser fingerprint, for example to support security or to remember your preferences. This reads characteristics of your browser and device and combines them into an identifier, without using cookies. You can withdraw your consent at any time through our cookie settings. Cookies and trackers ## What ClientJS sets and contacts - Tracking method Browser fingerprinting (JavaScript library, no cookies) - Server location Runs client side in the visitor browser; the open source library is bundled with the website or loaded from a CDN, with no vendor servers - Cookieless mode available Yes ### Third-party domains contacted (2) - `cdnjs.cloudflare.com` - `cdn.jsdelivr.net` Questions ## Frequently asked questions about ClientJS Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does ClientJS set? ClientJS does not set cookies. Instead it reads browser and device attributes and hashes them into a fingerprint, which is a cookieless identifier. Being cookieless does not make it exempt; the fingerprint is still a persistent identifier that the law treats much like a tracking cookie. ### Does ClientJS require consent? Yes, in most cases. Reading device characteristics to build a fingerprint falls under Article 5(3) of the ePrivacy Directive, which regulators apply to fingerprinting as well as cookies, so prior consent is required unless the fingerprint is strictly necessary for a service the user requested. Block ClientJS until consent is given. ### What is the legal basis for fingerprinting with ClientJS? For non essential fingerprinting the basis is consent under Article 6(1)(a) GDPR, combined with Article 5(3) ePrivacy for accessing device information. A narrowly scoped security use that the user has requested might rely on legitimate interest or necessity, but general analytics or tracking fingerprints cannot. ### Does ClientJS transfer data outside the EU? ClientJS by itself does not transfer data, since it runs in the browser. Transfers arise only when your backend sends the fingerprint to a third party or to servers outside the EEA, in which case Standard Contractual Clauses or another Chapter V mechanism and a Transfer Impact Assessment apply. Map where the fingerprint travels. ### Do I need a DPIA for ClientJS? A DPIA is strongly recommended. Fingerprinting is an opaque, persistent and hard to refuse form of identification, which regulators consider high risk, so documenting the purpose, necessity, risks and safeguards is good practice and may be mandatory under Article 35 GDPR. ### How do I implement ClientJS compliantly? Load ClientJS only after consent through a CMP, disclose the fingerprint in your privacy and cookie notices, and define a retention and deletion policy. Limit the attributes you read to what you need, avoid combining the fingerprint with other identifiers without a basis, and complete a DPIA before going live. ### Are there alternatives to ClientJS? For analytics, privacy friendly tools that rely on aggregated or cookieless server side measurement avoid persistent identification. For security, risk based authentication using a narrowly scoped, consented signal or a first party session is less intrusive. Whatever the alternative, the key is to minimise persistent identification and to be transparent. ### How do I update my cookie policy for ClientJS? State in your privacy and cookie notices that you create a browser fingerprint, list the categories of device attributes read, explain the purpose and retention, and name any third parties that receive the fingerprint. Because no cookie is set, make clear that a cookieless identifier is used and how users can object. Same category ## More services: Frameworks [See the whole category](https://www.flowconsent.com/en/services/framework) ### [MasterkinG32 Framework](https://www.flowconsent.com/en/services/framework/masterking32-framework) [MasterkinG32 Framework is a development framework and toolkit providing developers with a structured foundation for building modern web applications. It offers reusable components, standardized architecture patterns, and comprehensive documentation. MasterkinG32 Framework accelerates development through code generation, testing utilities, and build optimization. With an active community and extensive ecosystem, MasterkinG32 Framework enables teams to build scalable, maintainable applications following.](https://www.flowconsent.com/en/services/framework/masterking32-framework) [Frameworks](https://www.flowconsent.com/en/services/framework/masterking32-framework) · ### [Python](https://www.flowconsent.com/en/services/framework/python) [Python is a backend web framework providing a structured environment for building robust server-side applications and APIs. It offers routing, database management, authentication, and middleware support. Python follows established design patterns and conventions promoting clean, maintainable code. With ORM integration, template engines, and security features, Python accelerates backend development and enables teams to deliver scalable web applications efficiently.](https://www.flowconsent.com/en/services/framework/python) [Frameworks](https://www.flowconsent.com/en/services/framework/python) · ### [PlusProComponents](https://www.flowconsent.com/en/services/framework/plusprocomponents) [PlusProComponents is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. PlusProComponents integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, PlusProComponents helps organizations maintain robust websites that meet user expectations and.](https://www.flowconsent.com/en/services/framework/plusprocomponents) [Frameworks](https://www.flowconsent.com/en/services/framework/plusprocomponents) · ### [PWA Studio](https://www.flowconsent.com/en/services/framework/pwa-studio) [PWA Studio is a comprehensive e-commerce platform that provides businesses with all the tools needed to build, manage, and grow an online store. From product catalog management and secure payment processing to inventory tracking and order fulfillment, PWA Studio delivers a complete commerce solution. It features responsive storefront themes, SEO-optimized product pages, and powerful marketing tools to help merchants increase visibility and drive sales across channels.](https://www.flowconsent.com/en/services/framework/pwa-studio) [Frameworks](https://www.flowconsent.com/en/services/framework/pwa-studio) · ### [Laravel Echo](https://www.flowconsent.com/en/services/framework/laravel-echo) [Laravel Echo is a backend web framework providing a structured environment for building robust server-side applications and APIs. It offers routing, database management, authentication, and middleware support. Laravel Echo follows established design patterns and conventions promoting clean, maintainable code. With ORM integration, template engines, and security features, Laravel Echo accelerates backend development and enables teams to deliver scalable web applications efficiently.](https://www.flowconsent.com/en/services/framework/laravel-echo) [Frameworks](https://www.flowconsent.com/en/services/framework/laravel-echo) · ### [Bokeh](https://www.flowconsent.com/en/services/framework/bokeh) [Bokeh is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Bokeh supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Bokeh ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/framework/bokeh) [Frameworks](https://www.flowconsent.com/en/services/framework/bokeh) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)