Glossary entry

What is Device Fingerprinting?

Device fingerprinting works by pulling together a device’s unique mix of characteristics, things like browser type, operating system, installed fonts, screen resolution and IP address, to build a durable identifier. It’s often used to spot and block ad fraud by telling non-human traffic apart from real people.

How Device Fingerprinting Works

Device fingerprinting builds a tailored profile of a piece of hardware by scooping up dozens of data points from the browser or app environment. That includes HTTP headers such as user-agent and accept-language, JavaScript-readable properties like screen size, colour depth and timezone, plus installed plugins and fonts, canvas fingerprinting, the WebGL renderer and battery status. All these bits are hashed into a fingerprint ID that stays fairly stable, even when cookies get cleared or an IP address changes.

When it comes to catching ad fraud, fingerprinting helps single out devices that churn out invalid traffic, for example bots or click farms. By matching fingerprints across impressions and clicks, the system can spot patterns such as a single device firing off thousands of clicks from different IPs or pretending to be lots of different browsers.

Why It Matters for Ad Fraud Detection

Device fingerprinting is a vital weapon because it doesn’t rely on cookies. And cookies are getting blocked or deleted more and more often. Fingerprinting can tie fraudulent behaviour together across sessions and domains, which reveals botnets that keep switching IPs or user agents. For instance a click farm that uses only a few hundred devices to fake millions of users gets caught when the same fingerprints show up again and again with completely different IP addresses.

That said, fingerprinting isn’t perfect. Clever fraudsters can fake attributes or run headless browsers that look just like real equipment. What’s more, rules like GDPR and CCPA mean you have to be upfront and get permission for fingerprinting. And some browsers (Safari and Firefox, for instance) actively limit how much fingerprinting you can do.

Detection and Defence Strategies

To fight ad fraud with device fingerprinting, advertisers should team it up with other signals: things like behavioural analysis (mouse movements, scrolling patterns), IP reputation and timing-based heuristics. Managed third-party protection services often pair advanced fingerprinting with machine learning to catch oddities that the platform’s own IVT filters might let through.

Platforms like Google Ads and Meta give you basic IVT filtering, but they might not pick up clever fraud that acts like a real human. Third-party tools can plug that gap by keeping bigger fingerprint databases and cross-client comparisons. Advertisers should also think about server-side fingerprinting to cut down on client-side tampering.

Limitations and Privacy Considerations

Device fingerprinting isn’t a silver bullet. Fraudsters can use anti-detect browsers such as Multilogin or Indigo to randomise their fingerprints, or push traffic through residential proxies to hide the actual device. On top of that, fingerprinting raises privacy eyebrows, and plenty of countries now require user consent. Advertisers have to balance rooting out fraud with staying compliant, often by anonymising fingerprints or using privacy-preserving tricks like differential privacy.

How Unled Network helps

Unled’s managed click fraud protection blocks bots, click farms, and competitor fraud across Google, Meta and Microsoft Ads (including Performance Max) and recovers wasted spend through invalid-traffic refund disputes. Pair it with DDoS Protection for full edge defence.

Frequently asked

Related terms

• Click Fraud
• Invalid Traffic (IVT)
• General Invalid Traffic (GIVT)
• Sophisticated Invalid Traffic (SIVT)