European data protection watchdogs publish guidance on web tracking using device fingerprinting that could result in more ‘I agree’ forms
The pan-European data regulator group Article 29 has issued new opinion on how websites and advertisers can track users and the permissions they require.
The new opinion dictates that “device fingerprinting” – a process of silently collecting information about a user – requires the same level of consent as cookies that are used to track users across the internet.
“Parties who wish to process device fingerprints which are generated through the gaining of access to, or the storing of, information on the user’s terminal device must first obtain the valid consent of the user (unless an exemption applies),” the Article 29 Working Party wrote.
“The Article 29 Working Party has made it clear that companies cannot bypass consent by using covert methods to track users through their devices,” said Jim Killock, executive director of the Open Rights Group. “Building profiles to deliver personalised content and adverts clearly falls under e-privacy and data protection law.”
Until now, device fingerprinting has been considered separate from the European legislation that covers cookies, which requires companies that store small bits of information on a users computer for storing settings and identity to explicitly ask for consent.
Since the consent for cookies legalisation was brought into play in 2012, internet firms have been working on a way to identify users without relying on cookies. Each device connected to the internet identifies itself in various ways to help websites and services deliver the requested information, be it the right sized website for a smartphone or the right video stream for a smart TV.
The small snippets of information aren’t able to uniquely identify a particular device on their own, but combined they provide a fingerprint of the device that, while not entirely unique in most cases, is able to identify a user in conjunction with other data such as their internet connection.
Companies, including Google, Microsoft and Facebook, use this information broadcast by almost anything that connects to the internet to track users as they play, browse, buy and watch primarily for advertising purposes.
The problem with device fingerprinting, and one of the advantages over cookies as far are the technology companies are concerned, is that it is very difficult for a user to stop it happening. With cookies a user can simply prevent them from being put on their system through browser settings.
To avoid device fingerprinting users have to go to much more complex lengths, including using anonymity tools such as Tor.
Now that Article 29 has published explicit opinion on device fingerprinting techniques it has laid the ground work for developing new legislation to govern their use and protect user privacy.
“Many companies have little interest in being transparent about their use of customers’ data,” said Killock. “Profiling technologies are likely to proliferate so Article 29 are doing a vital job in explaining the line between getting consent and surreptitious tracking. The UK’s Ico needs to act on this opinion.”
Ultimately the regulation of device fingerprinting will fall to the individual data regulators in each country.
“The Information commissioners’ office (Ico) has always been clear that the law around cookies also applies to similar technologies. The Article 29 opinion adopted this week, which the Ico played a key role in drafting, confirms that digital fingerprinting is such a technology,” a spokesperson from Ico, the UK’s data watchdog, told the Guardian. “Digital fingerprinting accesses information stored on a user’s machine in a similar way to a cookie, and provides organisations with similar benefits. With that in mind, it is sensible to consider that the law applies to digital fingerprinting in the same way it does to cookies.”
“It is also worth noting that digital fingerprinting would typically see an organisation collecting information to allow identification of an individual, which brings potential data protection implications,” he said.