Google’s Bold Shift: Rethinking Device Fingerprinting Strategies

Google has revealed a modification to its advertising Platforms program regulations. The present version of the regulations includes a ban on “utilizing device fingerprints“. However, this ban has been removed from the updated policy which will take effect from 16 February 2025.

For those unacquainted with device fingerprinting, a glance at the draft ICO guidance could suffice, which, coincidentally, was also made public in December (see our article here). The ICO’s guidance clarifies that device fingerprinting pertains to the gathering of various pieces of information regarding a device’s software or hardware (including device configuration, clock details, and browser specifics). These elements can be compiled to distinctly identify a specific device.

Fingerprinting is often promoted as an alternative to other types of user tracking, such as cookies or the utilization of user-resettable device advertising identifiers, which necessitate consent under the Privacy and Electronic Communications Regulations 2003 (PECR) and frequently under different industry guidelines.

Google’s announcement of its revised regulations positioned the overall update as having “privacy at the forefront“. There remains, however, a persistent discussion regarding device fingerprinting because of the ‘unseen’ nature of the data collection and a deficiency in user authority.

From a legal perspective, there are unanswered questions concerning how device fingerprinting will function as a valid alternative to other methods of user tracking (assuming compliance with the law in this domain). The ICO (and other regulatory bodies) perceive fingerprinting techniques as ‘storing information, or accessing information stored, on a device’; and consequently, technically, fingerprinting meets the PECR ‘cookie consent’ prerequisites. If user agreement is not secured, in theory, neither fingerprinting (nor other tracking methods) can be implemented.

The ICO states that it is collaborating with Google regarding this alteration, and it will be intriguing to observe how this narrative unfolds. In the meantime, the ICO has issued a caution to advertisers who might consider adjusting their strategies in response to Google’s updated stance.