Fingerprint

Overview

Fingerprint (formerly FingerprintJS Pro) is a browser identification service that generates a highly stable visitor identifier by collecting and hashing dozens of browser and hardware attributes. The resulting identifier persists across cookie clears and private browsing sessions, making it more durable than cookie-based tracking. Fingerprint is deployed across use cases ranging from fraud prevention and bot detection to analytics and account security.

What This Script Does

The Fingerprint Pro script (fpjscdn.net or a proxied first-party domain) collects the following signal categories to construct a visitor identifier:

Browser signals:

• User agent, browser version, installed plugins, and MIME types
• Canvas fingerprint (pixel-level rendering of a test canvas element)
• WebGL renderer and vendor strings
• Audio context fingerprint (AudioContext API signal processing output)
• Font enumeration and rendering characteristics

Hardware signals:

• Screen resolution, color depth, and device pixel ratio
• Hardware concurrency (CPU core count)
• Device memory size

Network signals:

• IP address (processed server-side)
• Timezone and language settings

The collected signals are transmitted to Fingerprint's servers (api.fpjs.io or a configured first-party proxy) and processed to produce a visitorId — a stable identifier returned to the implementing site. The visitorId can be stored in cookies, localStorage, or server-side session state by the implementing application.

Consent & Compliance

Fingerprint carries mixed consent categories: analytics and essential, depending on deployment purpose.

Under GDPR and ePrivacy, the consent requirement depends on how Fingerprint is used. For fraud prevention and account security (blocking credential stuffing, preventing payment fraud), processing can be justified under legitimate interest or contractual necessity — the essential use case. For visitor analytics, behavioral tracking, or ad attribution use cases, explicit opt-in consent is required before the script loads, as the identifier constitutes personal data processed for non-essential purposes.

Under CCPA, the visitorId constitutes a unique persistent identifier qualifying as personal information. The use case determines the appropriate CCPA framework (service provider vs. business in its own right).

Should You Block This Without Consent?

Conditional. If Fingerprint is used exclusively for fraud prevention, bot detection, or account security — and the visitorId is not shared with analytics or advertising platforms — it can be treated as essential and loaded without prior consent. If it is used for visitor analytics, session stitching across cookie clears, or ad attribution, block it until analytics consent is obtained. Document the purpose of use and the legal basis in your privacy notice.