Is device fingerprinting legal? Privacy, consent and GDPR.

Whether device fingerprinting is legal depends on where you operate, what you collect and why, and nothing in this article is legal advice. In general terms, European rules treat reading information from a visitor’s device as something that usually needs consent unless it is strictly necessary for a service the visitor asked for, and the personal data that results is also subject to GDPR.

#Is device fingerprinting legal?

There is no single answer that holds everywhere. The technique is not banned, but it is regulated by the same rules that cover other ways of accessing a device and processing personal data. Your obligations turn on your purpose, what you tell visitors, the lawful basis you rely on, and how long you keep the data. Laws outside Europe use different words, and several of them also address identifiers and profiling.

Fraud prevention and security are widely recognised as serious purposes, and regulators generally treat them differently from advertising. That helps, but it does not remove the need to think the use through.

#Does device fingerprinting need consent?

Often it does, and sometimes it may not. Under the ePrivacy Directive, reading information from a visitor’s device generally needs consent unless it is strictly necessary for a service the visitor requested. Whether fraud prevention qualifies for that exemption depends on your circumstances and on how the rules are applied where you operate. Many teams choose to ask for consent, others rely on another basis, and the right call is a legal question for your own use case.

Fingerly is built so either choice is possible. Every SDK takes a consent option that is granted, pending or denied, and it defaults to pending: an SDK loaded without it collects nothing and sends nothing. Where you already have consent or another lawful basis, you load it as granted.

#Is a device fingerprint personal data under GDPR?

Frequently, yes. An identifier that lets you single out a device, and through it a user, is generally treated as personal data, so the familiar principles apply: a lawful basis, a stated purpose, data minimisation, limited retention, and respect for requests such as erasure. Fraud prevention is commonly discussed under legitimate interests, which involves a balancing test that is for you to carry out and document.

Roles matter too. When you decide when and why visitors are identified, you are the controller, and Fingerly processes the data on your behalf as your processor.

#What does Fingerly collect, and what does it never do?

Fingerly reads characteristics of the device, operating system and browser or app within a strict time budget, plus the visitor’s IP address to determine an approximate location and network. On iOS and Android it also keeps a random install ID on the device. Coordinates are rounded to one decimal place, so the location is a city’s reference point and never the device’s position.

• It never collects page content, form fields, keystrokes, clipboard contents or session recordings.
• It never collects contacts, photos or precise location, and no SDK shows a permission prompt.
• It sets no cookies and keeps nothing in the visitor’s browser.
• It never links visitors across organizations: the same device has a different visitor ID for every customer.
• It never sells or shares visitor data, or uses it for advertising.

#What controls does Fingerly give you?

You can gate every SDK behind your consent tool, and loading an SDK never collects anything on its own. To erase a visitor, an owner or admin can use the dashboard or a server call, and the identity goes at once: a device that comes back is a new visitor, and its stored events and archived submissions are removed within the hour. In an app, deleteStoredIdentity() removes the install record on the device.

Retention is documented rather than open-ended. Identification events are kept for 30 days, and visitor identities are deleted 180 days after the device was last seen. If you need records for longer, such as chargeback evidence, you keep your own copy through webhooks or the events API.

Fingerly also scopes what it keeps. Per-visitor daily summaries are kept for 180 days, aggregated analytics are kept in aggregate form, and when an organization closes, its data is deleted thirty days later, apart from the billing records the law requires. Settings like these are the kind of detail your privacy notice and your own records of processing should reflect accurately.

#Where should you not use it?

Keep the purpose narrow. Device identification collected for fraud prevention is not a licence to reuse the data for advertising or profiling, and Fingerly does not use it that way. The Fingerly SDKs are not meant for apps directed at children, and the browser SDK must not run inside an app’s web view, where it deliberately collects nothing. If your product serves a sensitive audience, take legal advice before you add any identification at all.

#What should you tell your visitors?

Your privacy notice should say that you use device identification for fraud prevention and security, that a processor handles the data on your behalf, and how long it is kept. A banner that hides the use is a worse choice than a short, honest sentence. Fingerly’s documentation has a privacy and consent page with the wording points to cover.

General information, not legal advice. Fingerly does not guarantee that any particular use complies with the law.