What a browser fingerprint is

The W3C Privacy Working Group note of 25 September 2025 defines a browser fingerprint as a site’s ability to recognize, or recognize again, a user, a program, or a device by its settings and other observable traits. Visits can be linked inside a session and across sessions, including across different sites, when another origin’s cookie policy does not hand the identifier over. How a bot differs from a human on a site is covered in how a bot differs from a human on a site. Here is what the note assembles a fingerprint from, and what it does not treat it as.

How a fingerprint is not a cookie

Unlike a cookie, collection often happens with no explicit sign, and a typical fingerprint cannot be cleared or reset. Clearing cookies and using a VPN do not stop a later link by fingerprint. The note considers it implausible to remove fingerprinting entirely, against an interested party, by widely deployed technical measures alone: mitigations are not a solution. The surface stretches across every capability of the program and onto other layers, for example differences in TCP connections.

This is guidance for specification authors, not a detector and not a definition of an antidetect browser. The note does not retell uniqueness figures from other articles on this page. “You are recognized with probability X” is not taken from here.

Passive and active collection

The same note splits collection into passive and active. Passive collection reads what is already in the request, with no code on the client: cookies, the set of HTTP headers, the address, and other network data. User-Agent is given as an example of a passive channel: it usually names the browser, the engine, the version, and the operating system.

Active collection runs JavaScript or other code on the client. The note says CSS techniques are already catching up with JavaScript. Examples of active collection include window size, enumerating fonts and connected devices, a performance measurement, sensors, and rendered patterns. Active collection is in principle visible on the client. Traits more often leave for the server in a batch, and the server combines them out of the page’s sight.

The list illustrates classes. It is not a list of fields on which a decision about a visit is made. Seeing window size in an example does not mean a visit is cut by screen width.

The User-Agent string

The HTTP User-Agent header is a string by which the server learns the application, the operating system, the vendor, and the client version. MDN writes that historically the string singled out a specific browser too well, so browsers send a reduced set: the platform version and the device model are frozen, and the minor Chrome version numbers are shown as zeros. The server can ask for details separately, through client hints. Example strings of specific browsers are not copied into the fact: they illustrate the format, they are not a sign of a bot.

RFC 9110 (June 2022) describes the header as information about the program that sent the request. Servers use it to narrow incompatibility reports, to work around a particular program’s limits, and to look at browser and system statistics. A client should send the header on every request unless it was specifically turned off. The value is one or more product identifiers with an optional version. A client should not put fine detail and other parties’ sub-products into the header without need: too detailed a string grows latency and the risk that the user is recognized against their will.

In the security section the RFC writes that the string theoretically makes it easier to aim at a known hole, and that in practice a search of holes goes on regardless of the stated version. Example strings in the RFC illustrate the grammar. They are not a sign of a bot.

Biometrics in the statute are not a browser trait

Article 11 calls biometric the information that characterizes a person’s physiological and biological features, by which the person can be identified, and which the operator uses specifically in order to identify the person. That processing is done with written consent, except for the cases in part 2: readmission, justice, mandatory fingerprint and genomic registration, and the branches of legislation listed in the part. Providing biometrics cannot be made mandatory outside those cases, and a refusal of service because someone refused to provide biometrics or consent is not allowed unless the law requires consent.

Technical browser traits, the address, and the client string are not named in the article. The article’s silence is not a conclusion that technical traits are never personal data: the definition of personal data is wider. The ConsultantPlus header edition is of 26 July 2026. Part 2 is given with the law of 23 May 2025, No. 121-FZ, taken into account.