Is Canvas Fingerprinting Legal Under GDPR? What You Need to Know

Yes, canvas fingerprinting is legal under GDPR, but only when you have a valid legal basis. Because a canvas fingerprint can identify a specific device or user, it qualifies as personal data. That means you need either explicit consent or a legitimate interest that outweighs the user's privacy rights. The key is to use it proportionately and transparently.

What is canvas fingerprinting?

Canvas fingerprinting is a technique that reads the HTML5 canvas element to generate a unique identifier for a browser. When a website draws an image or text on a hidden canvas, the rendering engine produces slightly different pixels depending on the device, graphics card, fonts, and operating system. Those differences create a fingerprint that can be used to recognize a returning visitor without cookies.

It's one of many browser fingerprinting methods. Others include WebGL, audio context, and font detection. Canvas fingerprinting is popular because it's hard to block and works across sessions.

How does canvas fingerprinting work?

A script draws a predefined shape or text on a canvas element. It then reads the pixel data and converts it into a hash. The hash is nearly unique to that browser and device. Even small changes in hardware or software produce different hashes.

For example, two users with the same phone model might still get different fingerprints because of GPU drivers or installed fonts. This makes canvas fingerprinting a powerful tracking tool.

Is canvas fingerprinting personal data under GDPR?

Yes. The GDPR defines personal data as any information relating to an identified or identifiable natural person. A canvas fingerprint can identify a device, and if that device is linked to a person, it becomes personal data. Even if you don't know the person's name, the fingerprint can single them out, which is enough.

The European Data Protection Board has clarified that online identifiers like IP addresses and cookies are personal data. Canvas fingerprints fall into the same category because they can be used to track a user across websites.

Legal bases for canvas fingerprinting under GDPR

You need a lawful basis under Article 6 of the GDPR. The two most relevant are consent and legitimate interest.

Consent

Consent must be freely given, specific, informed, and unambiguous. You need a clear opt-in, not a pre-ticked box. Users must understand what they're agreeing to, including the purpose of the fingerprinting. This is the safest route but can reduce user experience.

Legitimate interest

Legitimate interest can apply if you have a compelling reason to process the data, and your interest outweighs the user's rights. Bot detection is a strong candidate because it protects your website and users from fraud. However, you must conduct a legitimate interest assessment (LIA) and document it. You also need to offer an opt-out.

For bot detection, legitimate interest is often more practical than consent because consent banners can be ignored by bots. But you must minimize data collection and ensure the fingerprinting is necessary and proportionate.

How to use canvas fingerprinting compliantly

Follow these steps to stay on the right side of GDPR:

1. Conduct a legitimate interest assessment if you plan to rely on legitimate interest. Document why bot detection is necessary and how you minimize privacy impact.
2. Minimize data – only collect the fingerprint data you need. Don't combine it with other personal data unless necessary.
3. Be transparent – update your privacy policy to explain that you use canvas fingerprinting for security and fraud prevention.
4. Offer an opt-out – provide a way for users to disable fingerprinting, even if you rely on legitimate interest.
5. Use cross-checking – don't treat a single fingerprint as a verdict. Combine it with other signals to reduce false positives and avoid profiling users unnecessarily.

This approach aligns with the GDPR principle of data minimization and proportionality.

The role of bot detection tools

Tools like BotRefund use canvas fingerprinting as one of many checks. They don't rely on a single signal. Instead, they cross-check browser, network, device, and behavior data to build a reliable picture of whether a visit is human or automated.

This is important for GDPR compliance because it reduces the risk of misidentifying real users as bots. A single anomaly is not a bot verdict. Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people. By keeping each signal as evidence—not a verdict—and cross-checking it, you minimize the privacy impact.

BotRefund's empty font canvas check is one of 106 independent checks. It looks for mismatches that a real browsing session doesn't normally create. For example, a virtual machine might claim one device while its graphics, fonts, or audio tell another story. But BotRefund doesn't flag a user based on that alone. It sends the signal into a prediction AI that weighs the complete pattern.

This expert approach—using corroboration rather than a single browser tell—is both more accurate and more privacy-friendly. It helps you avoid collecting more data than necessary and reduces the chance of false positives that could harm user trust.

Key facts about bot detection and refunds

Limitations and exceptions

Canvas fingerprinting isn't always legal. Some jurisdictions have stricter rules. For example, under the ePrivacy Directive, storing or accessing information on a user's device requires consent. Canvas fingerprinting doesn't store anything, but it does access the canvas API, which some regulators treat as requiring consent.

Also, if you use canvas fingerprinting for advertising or profiling, legitimate interest is harder to justify. The GDPR gives stronger protection for data used for behavioral advertising. In those cases, consent is usually required.

Another limitation: canvas fingerprinting can be blocked by privacy browsers or extensions. That means it's not a perfect solution. It works best as part of a multi-layered detection system.

Frequently Asked Questions

Do I need consent for canvas fingerprinting?

It depends on your purpose. For bot detection, legitimate interest may be enough if you document it and offer an opt-out. For advertising or tracking, you likely need consent.

Can canvas fingerprinting identify a specific person?

It identifies a device, not a person directly. But if the device is linked to a user account or IP address, it can become personal data.

Is canvas fingerprinting banned under GDPR?

No, it's not banned. It's allowed if you have a lawful basis and follow the principles of data minimization and transparency.

What is the difference between canvas fingerprinting and cookies?

Cookies are stored on the user's device and can be deleted. Canvas fingerprints are generated on the fly and don't leave a trace. They're harder to block and more persistent.

How can I make canvas fingerprinting GDPR-compliant?

Use it only for security purposes, minimize data, be transparent in your privacy policy, offer an opt-out, and cross-check signals to avoid false positives.

What happens if I ignore GDPR rules for canvas fingerprinting?

You could face fines up to 4% of global annual turnover or €20 million, whichever is higher. Regulators can also order you to stop processing.

Can I use canvas fingerprinting without telling users?

No. Transparency is a core GDPR principle. You must inform users about the processing and its purpose.