Canvas Fingerprinting: A Quiet Method for Tracking Online Users
Canvas fingerprinting is a common method for tracking online users without their consent. This technical article explains how it works, where it adds value, its role in browser fingerprinting, its limits, and how it can be spoofed.
What is Canvas Fingerprinting?
Canvas fingerprinting is a browser fingerprinting technique that uses the HTML5 canvas element. When a user visits a website, the site can run a script that makes the user’s browser draw a hidden image or graphic with the HTML5 canvas. Because different machines and browsers render images in slightly different ways, the result can act as a unique identifier, or "fingerprint," for the user’s device.
How is Canvas Fingerprinting Done?
- Creating a Canvas Element: The website embeds a script that creates an invisible HTML5 canvas element in the user’s browser.
- Drawing Graphics: The script tells the browser to draw complex shapes, text, and colors.
- Extracting Data: The script then converts the rendered image back into data, usually a Base64-encoded string, which can be unique to the device or browser.
- Sending Data to the Server: Finally, this string is sent back to the server and used as an identifier for the user.
Value of Canvas Fingerprinting
Canvas fingerprinting is useful for several reasons:
- Stealthy: Users are usually not aware that their browser is being used to create a fingerprint.
- Persistent: Unlike cookies, users cannot easily delete or block canvas fingerprints.
- Cross-site Tracking: It lets advertisers track a user’s behavior across different websites.
Component for Fingerprinting
Canvas fingerprinting is often one part of a broader device fingerprinting approach. When combined with other data such as user agent strings, screen resolutions, and installed fonts, canvas fingerprinting increases the entropy and uniqueness of the device fingerprint.
Limitations of Canvas Fingerprinting
- Browser Updates: Changes in browser rendering engines can change canvas fingerprints over time.
- Common Hardware: Devices with very common hardware and settings may generate similar fingerprints.
- Limited Efficacy on Mobile: Canvas fingerprinting is less effective on mobile browsers because rendering is more standardized.
Spoofing Canvas Fingerprinting
Canvas fingerprinting can be reduced or spoofed in several ways:
- Browser Extensions: Extensions like CanvasBlocker change the JavaScript that handles the canvas element, which prevents the script from reading the data.
- Using Tor Browser: Tor Browser is designed to resist fingerprinting, including canvas fingerprinting.
- Disabling JavaScript: Turning off JavaScript prevents the script from running, though this can break functionality on some websites.
Why is Canvas Fingerprinting Unique?
The uniqueness of canvas fingerprinting comes from small differences in how graphics are rendered across hardware and software configurations. Even minor details such as anti-aliasing, scaling, and rendering engines can create differences in the resulting image data.
Conclusion
Canvas fingerprinting is a powerful but hidden method for tracking users online. It has limits, but it shows how widespread online tracking has become. Users who want to protect their anonymity and privacy should understand the technique and use privacy-focused tools where needed.
Frequently asked questions
Should canvas fingerprinting influence a lender’s fraud decision?
Use a canvas fingerprint as a supporting fraud signal, not as proof of a person’s identity or a reason on its own to decline an application. It can help identify repeat device patterns when combined with stronger evidence, such as account history or inconsistent application details. Review the collection and use of the signal with your privacy and legal teams, since expectations and requirements vary by market.
What cutoff should we use for a canvas fingerprint match?
There is no reliable universal cutoff. Set the threshold against your own confirmed fraud and legitimate application outcomes, and choose it based on the cost of missed fraud compared with wrongly blocking a customer. Keep borderline matches in a lower-impact decision path, such as additional verification, rather than making a fingerprint similarity score a standalone decline rule.
How should we test whether canvas fingerprinting improves fraud decisions?
Compare decisions with and without the fingerprint signal on historical applications with known outcomes, then validate the result on a later time period. Measure fraud caught alongside legitimate applications incorrectly challenged or declined. Break results out by browser and device type, and repeat the checks after browser or operating-system changes because rendering differences can alter fingerprints.
What should happen when a browser blocks canvas fingerprinting?
Treat an unavailable fingerprint as missing information, not as evidence of fraud. Continue the decision using other signals, and request additional verification only when the remaining evidence warrants it. A common error is to treat privacy tools or standardized mobile rendering as suspicious by themselves, which can create avoidable friction for legitimate applicants.
