FingerprintJS

What is FingerprintJS

FingerprintJS is a commercial browser identification platform offered by FingerprintJS, Inc. (Chicago, United States). It exposes a JavaScript SDK that collects a wide set of browser and device signals to produce a stable visitorId. The open source FingerprintJS library returns a fingerprint hash computed entirely in the browser, while the FingerprintJS Pro service uses server side processing to deliver higher accuracy and to deduplicate identifiers across sessions, devices and incognito windows. FingerprintJS is mainly used for fraud detection, account takeover prevention, payment risk scoring, bot mitigation and anti scraping.

What data and signals FingerprintJS collects

FingerprintJS reads a combination of stable browser signals: User Agent, installed fonts, canvas and WebGL rendering, audio context, screen resolution and color depth, time zone, language headers, platform, hardware concurrency, device memory, plugins, touch support, math and DOM features. FingerprintJS Pro also processes the visitor IP address, behavioural signals and persistence vectors (localStorage, IndexedDB, Service Worker storage) to maintain identity across cookie wipes. The resulting visitorId is a probabilistic identifier that is treated as personal data under the GDPR because it can single out a specific natural person.

GDPR and ePrivacy implications

Even though FingerprintJS does not strictly need cookies, it falls within the scope of Article 5(3) of the ePrivacy Directive: reading information from a user terminal for the purpose of identification requires prior informed consent, unless the access is strictly necessary to deliver a service explicitly requested by the user. EDPB Guidelines 2/2023 confirm that fingerprinting techniques are treated like cookies for consent purposes. Anti fraud use cases can sometimes rely on the strict necessity exemption, but the threshold is narrow: the identification must be limited to security, proportionate to the risk, and not used for marketing, analytics or profiling.

Consent requirements and legal basis

For most commercial deployments, the lawful basis is consent (Art. 6(1)(a) GDPR) combined with the ePrivacy consent requirement. For pure security use cases (fraud prevention on a login or checkout flow that the user has explicitly initiated), some controllers rely on legitimate interest (Art. 6(1)(f) GDPR) backed by a documented Legitimate Interest Assessment. Even in that scenario, transparency is mandatory: users must be informed in the privacy notice about device fingerprinting, the data collected, the retention period and their right to object.

Data transfers and hosting

By default, FingerprintJS Pro processes data in the United States. Customers based in the European Union should configure the EU region endpoint to keep visitor identification data within the EEA. Transfers to the United States are covered by Standard Contractual Clauses under Article 46(2)(c) GDPR and require a Transfer Impact Assessment that takes into account FISA 702 and Executive Order 14086. The Data Processing Addendum offered by FingerprintJS sets out the controller and processor obligations and references the SCCs.

How to deploy FingerprintJS compliantly

To deploy FingerprintJS in a GDPR friendly way: gate the SDK behind your consent management platform so the script only loads after consent is granted (or only on security sensitive flows when relying on legitimate interest); enable the EU region for FingerprintJS Pro; document the processing in your Record of Processing Activities; carry out a DPIA when fingerprinting is combined with automated decisions or large scale profiling; sign the FingerprintJS Data Processing Addendum and retain a copy of the SCCs; update your privacy policy with a clear description of the device fingerprinting technology, the retention period of the visitorId, and the user rights including the right to object and the right to erasure.