Browser Fingerprinting Without Cookies: What GDPR Actually Permits

Most consent management platforms are architected around cookies. The consent banner fires, the user clicks, and the CMP sets or withholds document.cookie writes. This architecture creates a systematic blind spot: browser fingerprinting techniques that never touch cookie storage are routinely deployed before, during, and after consent interaction — and legal teams often have no visibility into them whatsoever.

The Technical Anatomy of Cookie-Free Fingerprinting

Three APIs dominate modern fingerprinting stacks precisely because they produce high-entropy identifiers with no storage footprint:

Canvas Fingerprinting

A script draws text or shapes to an off-screen <canvas> element via the Canvas 2D API, then reads back pixel data using canvas.toDataURL() or ctx.getImageData(). Variations in GPU drivers, anti-aliasing implementations, and font rendering produce a device-specific hash. The operation is silent — no Set-Cookie header, no localStorage write, nothing in the browser's storage inspector.

AudioContext Fingerprinting

The Web Audio API's OfflineAudioContext processes a synthetic audio signal (typically an oscillator through a compressor node). The output waveform, read via getChannelData(), differs fractionally across hardware and OS audio stack implementations. This delta, when hashed, provides a stable secondary entropy source that survives cookie clearing, private browsing, and VPN use.

WebGL Fingerprinting

WEBGL_debug_renderer_info exposes the GPU vendor string and renderer string directly via gl.getParameter(). Combined with WebGL shader execution outputs — which vary across driver versions — this yields one of the highest-entropy individual signals available in a browser context. Browsers like Firefox have begun returning spoofed strings here, but the majority of Chrome-based user agents still expose genuine values.

When combined with navigator properties (navigator.hardwareConcurrency, navigator.deviceMemory), screen geometry, timezone offset, and installed font enumeration via CSS or Canvas, these signals routinely achieve re-identification probabilities exceeding those of third-party cookies for non-VPN desktop users.

Why "No Cookie = No Consent Required" Is a Legal Myth

The critical GDPR provision is not one that mentions cookies at all. Article 5(1)(a) requires processing to be lawful, fair, and transparent. Article 6 requires a lawful basis for any processing of personal data — and a browser fingerprint that can re-identify a natural person is unambiguously personal data under Article 4(1).

The ePrivacy Directive (2002/58/EC), Article 5(3) — as implemented in national law — requires prior informed consent for storing information on, or accessing information from, a user's terminal equipment. The CJEU's ruling in C-673/17 (Planet49) confirmed that this obligation is not limited to cookies: the phrase "information already stored" in terminal equipment encompasses any reading of device state, including fingerprinting signals derived from hardware and software configuration.

The EDPB's Guidelines 05/2020 on consent reinforce this: consent must be specific, informed, unambiguous, and freely given. Fingerprinting that occurs before or independent of a consent signal fails all four criteria simultaneously.

One enforcement precedent worth noting: the French CNIL has explicitly addressed fingerprinting in its cookie guidelines, stating that reading device characteristics to construct an identifier falls under Article 5(3) ePrivacy and requires consent equivalent to that required for cookies. The ICO's position is materially identical.

The Legitimate Interest Dead End

Operators sometimes argue that fingerprinting for fraud detection or security purposes qualifies under Article 6(1)(f) — legitimate interests — without consent. This argument is narrower than it appears.

The CJEU's analysis in C-252/21 (Meta/Bundeskartellamt), while focused on behavioral profiling, established that the legitimate interest basis requires a genuine balancing test in which the data subject's reasonable expectations are weighed against the controller's interest. Users who have not been told that their GPU renderer string is being hashed to build a persistent identifier cannot reasonably be said to have expected it.

Critically, the scope of fingerprinting matters. Using a minimal device signal (e.g., IP address combined with User-Agent) for real-time fraud scoring during a transaction is defensible under legitimate interests. Constructing a persistent cross-session fingerprint hash that is stored server-side and used for behavioral analytics is a materially different operation — one that requires consent regardless of the technical method used to collect it.

What Is Actually Permissible Without Consent

There are narrow, operationally real use cases where signal reading from terminal equipment is lawful without consent:

• Strictly necessary security operations: Reading IP address, TLS fingerprint (JA3/JA4 hash generated server-side from the ClientHello), and HTTP headers including User-Agent for bot detection on a per-request basis, without persistence beyond the session, is defensible. The key constraint is no cross-session re-identification.
• Network-layer signals: DNS query patterns, TCP/IP stack fingerprinting, and TLS handshake analysis occur before any JavaScript executes and do not constitute "accessing information stored in terminal equipment" under ePrivacy Article 5(3). They fall solely under GDPR Article 6, and transient processing for security can be grounded in legitimate interests with a documented balancing test.
• Server-side signals only: If no JavaScript API is invoked on the client and identification relies purely on server-received headers, ePrivacy Article 5(3) does not apply. GDPR still applies, but the lawful basis analysis is cleaner.

Practical Audit Checklist for DPOs and Technical Leads

1. Intercept and inspect your own JavaScript: Use a browser with a Content Security Policy reporting endpoint and audit all scripts for calls to HTMLCanvasElement.toDataURL, OfflineAudioContext, WEBGL_debug_renderer_info, and navigator.hardwareConcurrency. Tools like fp-detective or a custom Puppeteer-based scanner can automate this at scale across your subdomain estate.
2. Audit third-party tag payloads: Tag managers load vendor scripts that controllers never audit. The fact that a fingerprinting call originates in an analytics SDK does not shift liability away from the controller under Article 28. Require your vendors to declare all terminal-equipment access in their DPA schedules.
3. Check for pre-consent execution: Network timing analysis should confirm that no fingerprinting script executes before a valid consent signal is received. This is distinct from CMP loading — the CMP JavaScript itself must not fingerprint prior to consent.
4. Document your balancing test: If you rely on legitimate interests for any device-signal processing, produce a written balancing test that names the specific signals, the processing purpose, the retention period, and the outcome of the balancing. A generic LIA covering "fraud prevention" is insufficient.
5. Include fingerprinting in your ROPA: Article 30 records must reflect actual processing activities. A ROPA that lists "cookies" but omits Canvas/WebGL-based re-identification is incomplete and creates regulatory exposure.

The Compliance Architecture Shift Required

The fundamental problem is that most consent architecture is storage-centric rather than processing-centric. GDPR is a processing law. The consent trigger must be tied to the act of collecting and processing identifying signals — not to the act of writing to cookie storage.

CMPs need to enforce JavaScript execution blocking at the API call level, not merely at the cookie-write level. This means using browser-native techniques such as overriding HTMLCanvasElement.prototype.toDataURL to return a neutral value before consent, or using service worker interception to suppress fingerprinting script loading entirely until a valid consent signal exists in localStorage or is communicated via a postMessage channel from the CMP iframe.

The operators who treat fingerprinting as a consent-free fallback when cookie consent is declined are not in a grey area. They are processing personal data without a lawful basis — and the technical sophistication of the method does not diminish the legal exposure; it amplifies it.

This article was produced with AI assistance and editorially reviewed. Legal questions should always be discussed with a qualified data protection expert.