WebGL Fingerprinting: Tracking Online Users Through Graphics Rendering

WebGL fingerprinting is a method used to track users across the web. This article explains how WebGL fingerprinting works, why it matters, how it fits into the broader device fingerprinting ecosystem, its limits, and how it can be spoofed.

What is WebGL Fingerprinting?

WebGL (Web Graphics Library) fingerprinting is a technique that uses the WebGL JavaScript API to render graphics in a user’s web browser. The way those graphics are rendered can vary based on the user’s hardware and browser configuration. Those differences can then be used to create a unique identifier, or fingerprint, for the device.

How is WebGL Fingerprinting Done?

1. Accessing WebGL API: A script on the webpage accesses the WebGL API in the user’s browser.
2. Rendering Graphics: The script uses WebGL to render complex 3D graphics.
3. Extracting Rendering Data: Information about how the graphics were rendered is extracted. This can include data such as the shading language version, the renderer, and the available extensions.
4. Sending Data to the Server: The data is sent back to the server and used as an identifier for the user.

Value of WebGL Fingerprinting

WebGL fingerprinting is useful for several reasons:

• High Entropy: Rendering details can vary enough to provide a high degree of uniqueness.
• Passive Tracking: Users are usually not aware that their devices are being fingerprinted.
• Resistance to Traditional Countermeasures: Unlike cookies, WebGL fingerprints cannot be cleared through standard browser privacy settings.

Component for Fingerprinting

Like canvas fingerprinting, WebGL fingerprinting is usually not used on its own. It is one part of a larger device fingerprinting setup. When combined with other signals such as HTTP headers, JavaScript properties, and screen resolution, WebGL fingerprinting helps create a highly unique device fingerprint.

Put these checks into a decision flow

Create rules for credit, fraud or collections, then run them on live decisions.

Start free See pricing

Limitations of WebGL Fingerprinting

• Browser Updates: As browsers change, the way they render graphics can also change, which affects the fingerprint.
• Performance Issues: On devices with weak graphics capabilities, WebGL fingerprinting can cause performance issues.
• Uniformity in Mobile Devices: Like canvas fingerprinting, WebGL fingerprinting can be less effective on mobile devices because graphics rendering is often more standardized.

Spoofing WebGL Fingerprinting

There are several ways to mitigate or spoof WebGL fingerprinting:

• Using Browser Extensions: Extensions such as NoScript can prevent scripts from accessing the WebGL API.
• Using a Privacy-Focused Browser: Browsers such as Tor are designed to resist fingerprinting, including WebGL fingerprinting.
• Modifying WebGL Rendering: Advanced users can modify graphics card rendering settings to change the data returned by the WebGL fingerprinting script.

Why is WebGL Fingerprinting Unique?

WebGL fingerprinting stands out because it relies on the complexity of 3D graphics rendering. Even small differences in hardware or driver configuration can change the output. Those differences can then be used to create a distinct fingerprint. The WebGL API also exposes a large amount of hardware information that can strengthen the fingerprint.

Conclusion

WebGL fingerprinting is an advanced technique for tracking users online by exploiting differences in 3D graphics rendering. Like canvas fingerprinting, it shows how many ways users can be tracked online. Understanding these techniques and using countermeasures is important for protecting online privacy.

Frequently asked questions

Should a lender use a WebGL fingerprint as the sole basis for a fraud decision?

Use a WebGL fingerprint as one input in a broader fraud assessment, not as a standalone reason to block an application. Rendering can change after a browser or graphics driver update, and devices with similar configurations may produce similar results. Reserve stronger actions for cases where other evidence supports them.

What cutoff should trigger a fraud review based on a WebGL fingerprint?

Set the cutoff from your own labeled outcomes, and choose it separately for each action, such as monitoring, additional verification or referral for review. Check how often each cutoff catches confirmed fraud and how often it flags legitimate applicants. A universal score threshold is unlikely to transfer across devices, browsers and applicant populations.

How should we test whether WebGL fingerprinting adds useful fraud detection?

Compare decisions made with and without the WebGL input on a holdout set that includes confirmed fraud and legitimate applications. Measure the change in fraud detection alongside false positives, application completion and page performance. Break results out by browser and device type, then repeat the check after major browser or graphics updates.

When should a lender treat a missing or changed WebGL fingerprint as inconclusive?

Treat it as inconclusive when WebGL is unavailable, blocked by a browser extension or privacy setting, or changes after a browser or graphics update. Mobile devices may also offer less variation in rendering. Do not treat a missing or changed fingerprint as evidence of fraud on its own.

Put these checks into a decision flow

Create rules for credit, fraud or collections, then run them on live decisions.

Start free See pricing