Cookies are not the only way to recognise returning users. Analysing the digital fingerprint of a user's browser also makes tracking possible. Data protection law requires compliance with legal bases for this.
First of all: the term traffic data is meant purely technically here. Legally, it may have a different meaning. Instead of traffic data, one could more generally speak of metadata generated by network traffic.
When a user visits a website, details about the configuration of the browser and the device used to access the website are transmitted to the website's server. These include, among other things, the screen resolution, language settings, the type of screen (touch screen yes/no, etc.) and the browser version. In addition, connection data is transmitted, including the requested address and the address from which the user clicked a link (referrer).
Every time a website or file is retrieved from the internet, the requester's IP address is transmitted together with the other data about the requester's computer system mentioned above. This data is often referred to as a browser fingerprint, device fingerprint, traffic data or telemetry data.
If a website embeds a tool such as Google Maps, this user-related data is also passed on to Google as the service provider.
Here is an excerpt of such a fingerprint that every visitor to a website leaves behind:
- Requested page (URL): webseite4711.de/genauer/pfad/
- Page you came from (for example by clicking a link, also called the referrer): www.anderewebseite.de/ein/pfad
- Time of request: 25 November 2020, 07:33:20
- IP address: 22.33.44.55
- Internet service provider (ISP): <provider name>
- Language: German
- Platform: Windows 10
- Screen resolution: 1440 × 900 pixels
- Colour depth: 24 bit
- Time zone: -60 minutes
- Touch screen support: Yes
- Browser plugins: Shockwave Flash 32.0.0.169, …
- Browser: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/2010123 Firefox/82.0
Just like IP addresses, this fingerprint is also passed on to all services embedded on a website, such as Google Maps. This makes it possible to establish a personal reference and thus to track the user by the fingerprint alone.
Google Analytics uses some of this data to recognise users. Google uses this data for its own purposes (possibly also to sell advertising more effectively). Google prohibits others from using fingerprinting:
The statement refers to Google Analytics and shows that Google considers the ability of device fingerprinting to recognise users to be highly relevant. This is backed up by the patents mentioned below.
Tracking through digital fingerprints
With the help of the digital fingerprint, users can be identified and tracked. This is also referred to as tracking.
Google holds a patent that allows devices to be uniquely identified by their digital fingerprint: “The present invention is directed to methods and apparatus for uniquely identifying remote computing devices. More specifically, the invention is directed to fingerprinting a remote computing device in stages using information retrievable from a web browser.”
The patent also names the targeted delivery of advertising to users as a field of application:
In this patent, an installed Google plugin and its version are also included in the fingerprinting:
Information about the installation status of the Google tool called Gears on the user's device was captured by Google's device fingerprinting. Gears has since been discontinued. This example shows how Google tools can be used to increase the quality of digital fingerprints for identifying users.
The patent also describes how fingerprinting can be carried out incrementally. The fingerprint may initially be formed only partially and then completed with data from later sessions and/or other devices (p. 12 of the patent, from line 32).
Another Google patent uses fingerprinting to detect waves of attackers. A third Google patent coins the term device fingerprinting.
A scientific paper demonstrates how users can even be recognised across browsers, i.e. when using two or more different browsers, with an accuracy of over 90%.
Independently of this, users can also be tracked using cookies and device identifiers (such as AAID from Apple or IDFA from Google).
My name is Klaus Meffert. I have a doctorate in computer science and have been working professionally and practically with information technology for over 30 years. I also work as an expert in IT & data protection. I achieve my results by looking at technology and law. This seems absolutely essential to me when it comes to digital data protection. My company, IT Logic GmbH, also offers consulting and development of optimized and secure AI solutions.
