📱 Mobile

Device Fingerprinting

device fingerprinting · fingerprinting · device fingerprint · probabilistic attribution · probabilistic matching · browser fingerprint

Definition

Device fingerprinting is a probabilistic method of identifying a device from a combination of indirect attributes, used as an alternative to deterministic advertising IDs when those are unavailable.

How device fingerprinting works

Fingerprinting collects several dozen device and browser attributes which together produce a
high-probability identification. A typical signal set:

IP address, device type, manufacturer
OS plus version, browser version
Language, time zone
Screen resolution, colour depth
Installed fonts (canvas fingerprint)
WebGL and audio fingerprint

The hash of that combination is the fingerprint. If the attribute set is distinctive enough, the
device is identified with high probability.

Why fingerprinting is used in mobile attribution

Before iOS 14.5 (2021), the advertising ecosystem leaned on IDFA, Apple’s deterministic identifier.
After ATT (App Tracking Transparency) arrived, most people stopped granting tracking permission and
IDFA became unavailable for more than 75% of the iOS audience.

In those conditions, MMPs (mobile measurement partners — AppsFlyer, Adjust, Branch) built
probabilistic attribution models. Formally Apple prohibits device fingerprinting, but MMPs use
privacy-aggregate models that work without binding to a particular device.

Limitations and risks

Limitation	Consequence
Unstable IP addresses on mobile networks	False matches behind NAT and CGNAT
Widespread VPN use	Lower accuracy
OS changes on update	Identification lost after an update
Apple’s prohibition	Risk of rejection from the App Store
GDPR and CCPA	User consent required

Important: fingerprinting is not a reliable foundation for long-term personalization. For that,
use deterministic identifiers — a signed-in user, an email address — combined with first-party
data.

Alternatives in a cookieless environment

A signed-in user — the most reliable identifier, independent of the device
SKAdNetwork (Apple) — aggregated attribution with no device-level binding
Privacy Sandbox (Android) — Google’s Topics API and Attribution Reporting API
First-party data matching — an email match between the ad platform and the CRM

Frequently asked questions

How does fingerprinting differ from IDFA?

IDFA (Identifier for Advertisers) is a deterministic identifier Apple assigns to a device explicitly. With consent, it is 100% accurate. Fingerprinting is a probabilistic method with no explicit ID: accuracy is 80–95%, and Apple treats it as a privacy policy violation.

Is device fingerprinting legal?

It depends on the jurisdiction and the platform. In the App Store, Apple explicitly prohibits fingerprinting. Google Play restricts it. On the web, GDPR requires consent for any tracking method, probabilistic ones included. Commercial MMPs such as AppsFlyer and Adjust offer privacy-compliant probabilistic models within the limits Apple sets.

What is the real accuracy of fingerprinting?

Under the best conditions — a distinctive combination of attributes and a stable IP — 90–95%. Under typical conditions — corporate Wi-Fi, mobile networks behind NAT, VPNs — 60–80%. For long-term identity resolution, fingerprinting is unreliable: device parameters change with every OS update.