A comprehensive study of how fingerprintable users are

Web browser fingerprinting has rotate into a key tracking scheme on the contemporary web, yet its real-world effectiveness and which of the existing mitigations recommendation value at measure remain insufficiently understood.

In this paper, we current a large-scale study of browser fingerprinting according to real-world telemetry from nearly 25 million Firefox publish users. This dataset enables us to quantify user individuality at community measure and acknowledge which characteristics contribute most to this uniqueness.

Our inspection shows fingerprintability is mostly driven by a small set of high-impact characteristics and their combinations, rather than the gathering of many autonomous measurements. Building on these insights, we propose and measure fingerprinting protections according to their effect on individuality and cohort structure, and design data-driven mitigations.

These protections, shipped in Firefox 143, decrease the fraction of uniquely identifiable users from 75% to 46% during maintaining web compatibility, demonstrating that applicable reductions in fingerprintability are achievable in a mainstream browser.

Here's what we desire to current to you alongside this document and the broader range of our work.

Uniqueness is caused by a small figure of metrics - not one or thirty

Fingerprinting test sites have a apparently endless catalog of measurements they can drag from your browser. If a person has a distinctive fingerprint, it is typically not since of a single measurement, but it is also not since of 20 or 30 measurements. It is a small figure of metrics that make users unique.

In fact, it's extremely near to the 80/20 rule. Specifically, of all the users seen as distinctive by Fingerprint Pro (the most discerning fingerprinter we model) - 80% of them are distinctive following lone 8 metrics - during the fingerprinter collects a total of complete 50 metrics. Signifyd collects additional metrics, but identifies small users as unique: 80% of the users it sees as distinctive volition be identified following 9 metrics notwithstanding collecting complete 80.

The numbers lone average item per functioning system

Whenever person cites a sole percent whenever describing "How many users are unique" - you have to be suspicious. Because this collapses multiple distinct populations that behave extremely differently.

Firstly, as a baseline, your functioning scheme is continually going to be exposed to a fingerprinter. We are continually operating within the constraint of web compatibility, and lying concerning the user's functioning scheme breaks shortcut keys and gives you the incorrect downloads among another problems. So if we know the website is going to study your genuine OS anyway, we can use it to section the community and analyze it separately.

And whenever you do you see that all functioning scheme behaves alternatively since they have distinct crucial metrics. Admittedly, it's extremely difficult to provision a concise summary of activity and additionally provision four sets of numbers - so equal we fall prey to the trap of providing a sole number, as we did in the previous paragraph. But every time we have a single percentage, location we have that figure damaged downward by functioning system, and in doing so, you volition see that each behaves differently.

Entropy is not the measure you want

It's so, so uncomplicated to obtain all the results for a metric and just compute Shannon entropy - it's a norm yardstick in this literature. But as we display - a elevated Shannon entropy does not reliably foretell fingerprinting impact.

Cohort size, not fair uniqueness

Previous analyses calculated how many group were unique, but they did not analyze the other group - the ones who weren't. All those another group power be 1 myriad users who portion one fingerprint or 500,000 distinct fingerprints shared by 2 group all - that's fairly the difference.

We use the Simpson Index (aka the Herfindahl–Hirschman Index) to quantify that difference and difference different sets of cohorts (shared fingerprints). This lets us compare how productive distinct fingerprinting defenses are based not fair on how much individuality they eliminate but how much they downfall groups of users into all other.

For example, two distinct protections can all lesser the share of distinctive users by concerning 2.1 percent points. But one improves the cohort mark by 56%, during another raises it by lone 13%. Judged on individuality alone, two defenses can appearance equally effective; during the cohort betterment varies significantly.

The identical safety performs extremely alternatively per platform

Protections are not uniformly impactful, and the assortment is not small. As an example, clamping the accessible screen resolution takes 25.3 percent points off cumulative macOS individuality but between 0 and 3 points off the another three platforms. Averaged throughout all users, that 25-point autumn shrinks to 3.5 - a safety that matters enormously to one phase can appearance marginal in the aggregate.

This is yet another logic why it's so crucial to section and analyze data on a per-operating-system basis.

Standardization and randomization go hand-in-hand

Making users study the identical values makes them appearance additional alike, but it never makes everyone appearance the same. Some users volition still remain out, and that gets worse on websites alongside small visitor populations. Standardization improves the situation, but it should motionless be paired alongside randomization. Randomization is very powerful whenever it works, but can continually be detected and bypassed. Neither can transport the burden of providing privacy on its own.

The data shows why values differ, not fair that they do

Correlating fingerprinting values alongside users' hardware and other characteristics let us acknowledge why certain measurements differed between users. Knowing the base logic lets us build protections that attain much further, and defend small groups of users who would alternatively remain out as a minority.

Addressing these differences has already produced additional consistent outputs for image rendering, Web Audio, and mathematical operations on Android, alongside additional base causes being investigated.

Users don't nexus website breakage to the setting

Breakage from a strict manner is delayed, and the postpone hides the cause. Turning on a stricter manner is a one-time act - but the damaged website arrives afterward and nothing connects the two. From the user's perspective, this website doesn't activity in Firefox and they have no idea why and are frustrated. Report following study we see group posting for help, confused - notwithstanding having taken particular act to allow a hidden environment opting them into strict fingerprinting protections.

Protections that container have to keep the web working

Users don't acknowledge that a environment they changed caused the breakage, and don't cognize how to fix it - so a safety that breaks the web breaks the browser alongside alongside it. We selected and tuned mitigations on the two measured impact and compatibility. For a default, compatibility isn't a trade-off against privacy - it's a precondition for it.

The difficult part is finding what breaks

The web is vast, and equal the most innocuous alter is apt to break item somewhere. Some breakage can be anticipated, which helps design, testing, and detection. The another breakage gets fixed lone if a sequence of fortune holds: person has to acknowledge the breakage, study it, reproduce it on the correct hardware, and get it to the right person.

We are deliberately not publishing everything we could

Commercial fingerprinters develop continuously, and they borrow openly from the community that studies them. Sites built to instruct group concerning fingerprinting - CreepJS among them - get picked up and used outright by fingerprinting products.

So we have been deliberately conservative. There are analyses this dataset would assistance that we have not run, data we could have released that we have not, and insulting angles on this activity that we have not pursued. That is a choice fairly than an oversight: we would fairly depart a inquiry open than create it easier to build a improved fingerprinter.

This interactive test re-implements idiosyncratic measurements as close as imaginable to how Firefox's own gathering code performed them, runs in your browser, and compares all outcome against the published total data. For all trait you can see your value and how many of the ~25 myriad measured browsers portion it - general and within your functioning system.

The test runs entirely in your browser. All comparisons happen locally, against our fixed citation files. No data is stored or submitted to us.

If the test, or item alternatively on this site, looks wrong, please report it as an matter on GitHub. For a issue alongside the test, contain the diagnostics from its Copy diagnostics button, or, if you would rather not article your measured values publicly, email them to [email protected].

The extended type of the document is accessible as a PDF.

The paper's appendices merge a prosperity of data locked rearward a sensible leaf bounds and PDF formatting. This complete data page carries all of it - all position for all functioning scheme and all three modeled services, the complete safety chains, and the paper's figures regenerated at imprint resolution.

Our measurements arrive from Firefox telemetry, specifically the user-characteristics ping, a dedicated telemetry ping. Unlike normal telemetry pings that are sent regularly, this ping must be explicitly enabled (which has happened twice, formerly in 2025 and formerly in 2026), and sends one data study before becoming dormant again.

This ping carries no client ID, lone a UUID distinctive to the ping used to de-duplicate users. It cannot be keyed to any another telemetry submissions. It is submitted complete Oblivious HTTP (OHTTP): a relay operated independently of Mozilla forwards the encrypted submission, so the relay can see the sender's IP location but not the contents, and Mozilla receives the contents but not the IP address. Access to the collected data was restricted to four authorized Mozilla employees. The data was retained for 90 days and has since been deleted.

We publish four types of data:

1. A catalog of fingerprints generated for distinct phases of protections, per modeled fingerprinter, alongside the user's OS and locale unmasked.
2. Aggregate tables of the frequence of value per metric, divided by OS
3. Aggregate tables of the frequence of value per metric, correlated by another metrics' values, again divided by OS
4. A detailed inspection of rendered canvas images that allows comparison

In the fingerprint lists, the fingerprints cannot be recreated from a website measuring person characteristics, because of the way the telemetry was collected. After being generated, the records were shuffled to a new ordering, and any locale occurring small than 100 times was anonymized.

In the total tables, any value observed fewer than 100 times inside a sole per-OS community is withheld - so the published data describes cohorts, never individuals.

In the canvas comparison, raw canvas renderings are provided, but they are devoid of any association to another person data. Any distinctive canvas rendering is not provided; lone the hash.

For verification and exploration, the code used to procedure the data and execute distinct analyses is accessible for review. It additionally contains the particular fingerprinting scripts captured, reverse engineered, and modeled for the paper.

Far additional can be asked of this dataset than we have asked. Some of it we chose not to pursue, several of it we merely did not think of, and several of it is a improved fit for person who is not us.

There is a conversation commission for proposing follow-up analyses. Two kinds are value posting:

• Answerable from the published total data. Anyone can run these - the per-operating-system distributions are released, and the inspection toolkit is open. Post the inquiry anyway, so the activity is not duplicated and so the outcome lands location others can discover it.
• Needs the raw data. These we would have to run ourselves, since the underlying ping data is not item we can always release. Describe what you desire to cognize and why! To be clear, we do not have the raw data anymore but it is imaginable we volition execute a re-collection in the forthcoming which we could analyze. We cannot commitment to run everything, and several questions we will decrease since we do not desire to assistance build a improved fingerprinter.