Despite increased measures from browser developers and regulators, canvas fingerprinting continues to adapt and thrive, raising ongoing privacy concerns amid the shifting policy landscape.
Canvas fingerprinting is a browser identification method that profiles the way a machine renders content rather than storing data on it. A script tells the browser to draw text or graphics on an HTML canvas, reads back the pixels and turns the result into a short hash. Because the output varies with the graphics processor, drivers, operating system, fonts and display settings, the same page can generate different identifiers on different devices. The appeal for trackers is simple: the signal survives cookie deletion and does not depend on any visible storage on the user’s machine.
The mechanism relies on ordinary web features. The canvas element is part of HTML5 and is used legitimately for charts, games and image editing. Fingerprinting scripts, however, run the same interfaces in a hidden or off-screen canvas, often using text strings, emoji, gradients or overlapping shapes that stress the rendering pipeline. The result can be extracted through methods such as toDataURL or getImageData, then hashed to keep the stored identifier compact. Researchers have also described a WebGL variant that reads graphics behaviour at the GPU layer rather than measuring 2D text rendering.
The technique has been documented for more than a decade. Keaton Mowery and Hovav Shacham first described it in 2012, and researchers later showed that it had already reached the open web at scale. According to work cited in PPC Land’s coverage, canvas fingerprinting moved from early testing to widespread deployment as publishers and ad-tech firms looked for alternatives to cookies. In the 2014 study “The Web Never Forgets”, the technique was found on more than 5.5% of the top 100,000 homepages, with AddThis responsible for the overwhelming majority of scripts observed at the time.
Its modern use is broader, but also more fragmented. PPC Land reports that recent crawling found canvas fingerprinting on 12.7% of the top 20,000 sites and 9.9% of a random sample from lower in the rankings. The biggest reach came from anti-bot and fraud vendors such as Akamai, FingerprintJS, Signifyd, PerimeterX, Sift Science and Adscore, while advertising firms including MGID, AIdata and adskeeper were also identified. Roughly half of the canvases used on popular sites were delivered by scripts already listed on major blocklists, yet many ran first-party, which makes them harder for ad blockers to intercept.
The policy picture has moved at the same time. Google allowed advertiser use of device fingerprinting from February 2025, despite criticism from the UK Information Commissioner’s Office, while European regulators have continued to treat fingerprinting as falling within ePrivacy rules. PPC Land notes that the ICO published final guidance on storage and access technologies in April 2026, and that IAB Europe has renamed its device-identification language for the consent framework. The practical effect is that the debate is no longer about whether canvas fingerprinting exists, but whether its use is for security, analytics or marketing, because that distinction affects consent requirements even though the traffic itself looks the same.
Browser makers have responded with a mix of prompts, blocking and noise injection. Tor introduced a permission prompt in 2013, Firefox expanded anti-fingerprinting measures over several releases, and Apple has added canvas and WebGL defences that inject small amounts of noise or fix certain values. PPC Land says Brave began rolling out further graphics-signal protections in August 2026, while Google’s own security researchers have shown that some noise-based defences can be worked around. The result is a continuing technical contest: the signal remains useful to fraud teams and advertisers, but the same characteristics that make it attractive also keep it under sustained scrutiny from privacy engineers and regulators.
Disclaimer: This content is intended for informational purposes only. Readers are advised to exercise their own judgement, conduct due diligence, or consult a qualified expert before acting on any information provided.
