alt Hacker News> they have always been about the tracking itself!
Actually they are about reading from or writing to terminal equipment of user that is not done for "sole purpose of carrying out the transmission of a communication over an electronic communications network" or "strictly necessary in order for the provider of an information society service explicitly requested by the subscriber or user to provide the service". Some safety-related exceptions are possible via ePD Article 15, but those need to be separately added to the local law. That's why things like functional cookies require consent as well.
Of course there is also the GDPR layer on top of this.
Replies
Eh reads like a “civil war was about states rights not slavery” argument.
The thing the site is doing that isn’t “strictly necessary” is always tracking.
Right, and that wording is why fingerprinting doesn't get around it. The EDPB's Guidelines 2/2023 on the technical scope of Art. 5(3) (final version adopted October 2024) say that when a site's JavaScript instructs the browser to send information back, that is "gaining access" just like reading a cookie (paras 32-34). WP29 had already said in Opinion 9/2014 that device fingerprinting is in scope.
So a canvas/font/WebGL fingerprint used for tracking needs the same consent as a tracking cookie. The guidelines even suggest passively collected protocol signals can fall under it (para 43), though that's where it gets argued.
The weak point is enforcement. A cookie shows up in devtools and in every cookie-scanner audit. A fingerprinting script looks like any other analytics JS, so it's much harder for a DPA to spot and prove.
Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.
The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)
Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).