Bookcicle Labs · Scoring Engine 2026-09-v2 · Device Identification
Browser & Canvas Fingerprinting
-20 pts Critical RiskBrowser fingerprinting is an invisible, stateless tracking technique that identifies your device by measuring subtle hardware and software configurations—such as GPU rendering differences, audio oscillator timing, and installed system fonts. Because it does not rely on cookies or local storage, clearing your browser data or opening an incognito window does not reset your fingerprint.
How the Technique Works
1. HTML5 Canvas Probing
Scripts render hidden geometric shapes, text strings, and color gradients onto an off-screen HTML5 canvas. Subtle variations in your operating system font rasterizer, anti-aliasing algorithms, and GPU graphics driver create microscopic pixel-level differences that produce a unique cryptographic hash.
2. WebGL & GPU Parameter Extraction
Scripts query the WebGL rendering context to extract unmasked GPU renderer strings (e.g. 'ANGLE (NVIDIA GeForce RTX 4070 Direct3D11)'), supported extension lists, shader precision formats, and floating-point rounding quirks.
3. AudioContext Oscillator Analysis
By creating an AudioContext and processing audio through dynamics compressors and FFT analyzers, scripts measure microscopic floating-point rounding differences in your device's audio hardware and mathematical libraries.
4. System Font & Hardware Enumeration
Webpages measure CSS font glyph metrics, screen resolution, device pixel ratio, CPU core concurrency (navigator.hardwareConcurrency), device memory, and battery status APIs to narrow down your device to a 1-in-a-million profile.
How Data Partners Use Fingerprints Across the Web
Fingerprinting scripts do not operate in isolation. When site A (e.g., an online shoe retailer) and site B (e.g., a healthcare forum) both embed a fingerprinting script or sell bidstream events to the same ad exchange, your calculated device hash matches on both sites.
Data brokers and ad exchanges syndicate this hash into unified "identity graphs". Over time, third-party data partners link your anonymous browsing history with your IP address, physical location, and commercial transactions. When you eventually log into any site that knows your real name or email address, data brokers permanently link that entire cross-web device history to your real-world identity.
Common Data Partners & Intermediaries
- Ad Exchanges & Supply-Side Platforms (SSPs) syndicating bidstreams
- Identity Resolution Providers (e.g., LiveRamp IdentityLink, ID5, UID2)
- Commercial data brokers combining online tracking with offline credit records
- Behavioral ad networks profiling purchasing intent and political leanings
The Direct Risk to You
- Bypasses private/incognito browsing windows and VPNs by identifying the underlying hardware.
- Persistent profiling without user consent, transparency, or easy opt-out mechanisms.
- Dynamic price discrimination on travel, insurance, and retail products based on perceived device wealth.
- Deanonymization of sensitive research, medical inquiries, and personal interests.
How Your Privacy Scores It
Your Privacy intercepts calls to HTML5 canvas data extraction methods (toDataURL, getImageData), WebGL parameter queries (WEBGL_debug_renderer_info), and AudioContext oscillators in real time. If script execution matches known fingerprinting signatures, Your Privacy deducts a flat -20 points under Engine 2026-09-v2.
Explore Other Penalized Vectors
Session Replay
Keystroke & mouse recording
-30 ptsPlatform Risk
Walled garden monopolies
-15 pts / trackerBehavioral Trackers
Ad network auctions
-8 pts / domainTracking Cookies
Cookie syncing & state
-5 pts / domainThird-Party Domains
IP & referrer leakage
-10 ptsTelemetry Beacons
Server-side proxies