undefined

points

[-]

Yep, and somehow there's always someone who thinks that the "Ah, but this is not a cookie!" is a loophole. It is not, he is just undereducated.

The fingerprinting comes from enumerating properties of the terminal equipment and their values, and to do that you have to read them, for which you need the explicit consent. (Except in some rare cases, but if you are that case, your workplace will also have a legal department.)

Additionally, as you said, GDPR adds a lot of additional restrictions, with provisions regarding creating profiles of persons (what is commonly refered as tracking).

by lesuorac21 hours ago|

prev|

[-]

Eh reads like a “civil war was about states rights not slavery” argument.

The thing the site is doing that isn’t “strictly necessary” is always tracking.

by buzer20 hours ago|

parent|

[-]

Point is that tracking isn't the only thing that's not "strictly necessary". And additionally that "strictly necessary" is tied to something specific: internet society service. That includes a very specific requirement: "Normally provided for remuneration". That's why e.g. public authorities should not (usually) be allowed to rely on it, public services are not often provided for remuneration in EU-law sense.

It also limits the exception in relation to e.g. employment.

by what20 hours ago|

parent|

prev|

[-]

Well now the thing that isn’t “strictly necessary” and they’re not allowed to do is remember my no cookie preference.

by troupo18 hours ago|

parent|

[-]

It's not a preference. It literally is the default requirement.

by stavrop16 hours ago|

prev|

[-]

Right, and that wording is why fingerprinting doesn't get around it. The EDPB's Guidelines 2/2023 on the technical scope of Art. 5(3) (final version adopted October 2024) say that when a site's JavaScript instructs the browser to send information back, that is "gaining access" just like reading a cookie (paras 32-34). WP29 had already said in Opinion 9/2014 that device fingerprinting is in scope.

So a canvas/font/WebGL fingerprint used for tracking needs the same consent as a tracking cookie. The guidelines even suggest passively collected protocol signals can fall under it (para 43), though that's where it gets argued.

The weak point is enforcement. A cookie shows up in devtools and in every cookie-scanner audit. A fingerprinting script looks like any other analytics JS, so it's much harder for a DPA to spot and prove.