When users “cannot clear” unique tracking identifiers and “cannot control how their information is collected,” Google has warned, “this subverts user choice and is wrong.” Awkwardly, that 2019 warning has just come back to haunt Google, given its decision to restore digital fingerprinting, the very tracking it was warning about.
Privacy-centric Proton has just released a new report, criticizing the “spectacular about-face” as Google gives “its advertisers the go-ahead to use digital fingerprinting to uniquely identify internet users and track their actions across the web.”
This “about-face” followed last year’s reversal on cookie deprecation, which has now morphed into a promised but as yet unscheduled global prompt for users to opt out. It also comes just as a new report warns Android phones are being “silently tracked.”
So what is digital fingerprinting? As the UK data regulator explains, “fingerprinting involves the collection of pieces of information about a device’s software or hardware, which, when combined, can uniquely identify a particular device and user,” warning that “even privacy-conscious users will find this difficult to stop.”
Most expect a global prompt will impact the ad industry as users ask not to be tracked, but Google accounts can be tracked separately and, as Proton explains, “fingerprinting is effective at identifying and tracking the wide variety of modern devices that access the internet outside the browser or app window (and thus without cookies).”
The data collected from smart devices such as TVs and consoles could include a device’s “operating system and hardware specifications,” as well as network identifiers and a user’s browsing behaviors. “And unlike cookies,” Proton says, “fingerprinting is difficult to detect and block, making it harder to manage your privacy online.”
So, how to stop it. Browser tracking can be stopped by ensuring cross-site tracking is disabled, even if tracking cookies themselves are not. You can also opt for browsers that are more privacy-centric out of the box and select private browsing. “In our tests,” Proton says, “Tor Browser and Brave were the best options for evading browser fingerprinting (although these browsers come with their own drawbacks).”
If you’re an Apple user then Safari is fine. Firefox has always been seen as a more private option, but its PR has taken a major hit in recent weeks. And if — like the majority of Android and Windows users — you’re using Chrome, then check your settings and opt for Incognito mode for anything sensitive. But beyond your browser, Proton warns, “preventing device fingerprinting is all but impossible.”
It seems the only way to stop fingerprinting will be regulation. The UK data regulator was first to warn that it’s “not a fair means of tracking users online because it is likely to reduce people’s choice and control over how their information is collected,” while its French counterpart cautions that “the use of fingerprinting for advertising purposes requires the consent of users who must be able to refuse as simply as accept.”
Per Proton’s report: “Despite being hard to detect or block, digital fingerprinting techniques are not exempt from laws designed to protect internet users’ privacy. Although not directly addressed in the EU’s ePrivacy Directive, fingerprinting probably violates the GDPR and is likely to come under increased legal scrutiny, especially with Google’s latest change of heart. Under the California Privacy Rights Act, fingerprinting is considered a form of cross-context behavioral advertising, meaning that Google will likely need to provide users with a way to opt-out if it’s to remain compliant.”
Google says that the reversal reflects a new device landscape, with smart devices enabling “a broader range of surfaces on which ads are served.” The company assures that “privacy-enhancing technologies offer new ways for our partners to succeed on emerging platforms… without compromising on user privacy.”
“The sneaky thing about fingerprinting,” Proton says, “is that it’s hard to detect and even harder to avoid,” adding that “browsers that offer add-ons designed to protect your privacy and prevent tracking actually make the browser more unique, meaning it’s more vulnerable to browser fingerprinting.”
I have reached out to Google for any response to Proton’s new report.
