Browser fingerprinting research: what recent papers found

Three studies are worth knowing if you build with browser fingerprinting, or defend against it: one that measured how widespread fingerprinting scripts are, one that tested whether fingerprints are used to track people, and a recent review of the techniques and their privacy cost.

FP-Inspector: how common is fingerprinting?

"Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors", Umar Iqbal, Steven Englehardt and Zubair Shafiq, IEEE Symposium on Security and Privacy 2021 (arXiv:2008.04480).

The authors built FP-Inspector, a machine-learning system that detects fingerprinting scripts by analyzing both their code and what they do when they run. It found 26% more fingerprinting scripts than earlier detection methods. Using it, they measured fingerprinting on more than 10% of the top 100,000 websites and over a quarter of the top 10,000, and found scripts using browser APIs in ways not reported before. They also proposed an API-level countermeasure, built on FP-Inspector, that reduces website breakage by a factor of two.

Why it matters: fingerprinting is widespread and detectable. Browsers and privacy tools increasingly look for it, which is one reason to use it transparently and only for clear purposes.

FPTrace: are fingerprints used for tracking?

"The First Early Evidence of the Use of Browser Fingerprinting for Online Tracking", Zengrui Liu, Jimmy Dani, Yinzhi Cao, Shujiang Wu and Nitesh Saxena, ACM Web Conference 2025 (arXiv:2409.15656).

Earlier work showed that fingerprinting scripts run on many sites, but not what they're used for; fraud and bot detection are legitimate uses too. FPTrace tested tracking directly. It built browsing profiles, then measured how advertisers' bids (through header bidding) and tracking-related HTTP traffic changed when the browser's fingerprint was altered. Bids changed significantly when the fingerprint changed, which is evidence that fingerprints are used to recognize people for ad targeting. The authors also found that this tracking can continue after users opt out under the GDPR or the CCPA.

Why it matters: regulators and browser makers now have measured evidence of fingerprinting used for ad tracking. Expect more scrutiny, and expect to have to explain your purpose clearly.

A review of techniques and their privacy cost

"Fingerprinting and Tracing Shadows: The Development and Impact of Browser Fingerprinting on Digital Privacy", Alexander Lawall, SECURWARE 2024 (arXiv:2411.12045).

This paper surveys the main fingerprinting techniques and analyzes how much identifying information the collected attributes carry. Its conclusion is that fingerprinting is hard to counter both technically and from a privacy standpoint, because people have little control over the collection and are often identified without knowing or agreeing to it.

Why it matters: the less visible a technique is, the more the burden falls on the site using it to be open about it.

What this means in practice

• Have a clear, defensible purpose. Security, fraud and abuse prevention are the uses regulators and users accept most readily.
• Be transparent. Say in your privacy policy that you fingerprint, what you read and why.
• Collect what you need, and no more. TraceTail's browser SDK reads 40+ signals and nothing behavioral; the signals post lists every one.
• Respect opt-outs and consent where the law requires them, including for fraud-adjacent uses.
• Expect change. Browsers keep adjusting what they expose, so check your system's accuracy on your own traffic over time.

Read the docs or try the live demo to see what TraceTail collects in your browser.