Cookies can be deleted. Incognito mode resets sessions. Email addresses are free to create. These are the basic tools of multi-accounting fraud in promotions, and they all share the same weakness: they operate at the software layer, where users have full control.

Device fingerprinting operates one level deeper. It identifies devices by collecting a combination of browser and hardware attributes that, taken together, create a statistically unique identifier. A participant who clears their cookies, opens a private window, and signs in with a new email address still carries the same device fingerprint. That persistence is what makes fingerprinting effective for fraud detection — and what makes it controversial from a privacy perspective. But here is the reality: if you are relying on cookies and email addresses to detect multi-accounting, you are not detecting multi-accounting. You are detecting people who did not bother to clear their cookies.

This guide covers how device fingerprinting works, what it catches, where the privacy boundaries are, and how to deploy it responsibly in promotional contexts.

This article is for informational purposes only and does not constitute legal advice. Consult with a qualified attorney for guidance specific to your promotion.

What Is Device Fingerprinting?

Device fingerprinting is a technique that identifies unique devices by collecting a combination of browser and hardware attributes. No single attribute is unique on its own — millions of people have 1920x1080 screen resolution, or use Chrome on Windows. But the combination of 30-50 attributes creates a fingerprint that is statistically unique to each device.

The attributes typically collected span hardware and software. On the display side: screen resolution, color depth, canvas rendering (where the browser draws a hidden image and the pixel-level output varies across configurations), and WebGL capabilities that expose GPU and driver details. The GPU renderer itself differs by hardware model, making it a strong distinguishing signal.

On the software side: installed fonts (which vary by OS, installed software, and user customization), timezone and language settings, audio context characteristics, navigator properties (user agent, platform, CPU cores, device memory), browser plugins and extensions, and touch support. Each attribute is common on its own — millions of people share the same screen resolution. But the combination of 30-50 attributes is what creates the fingerprint.

Each attribute is a data point. Individually, they are common. Combined and hashed, they produce a fingerprint that uniquely identifies a device in most cases.

How It Works in Practice

When a participant loads an entry page, a JavaScript library runs in the browser and collects the attributes listed above. The collection happens in milliseconds — invisible to the user, no pop-ups, no permissions required (in most browsers).

The collected attributes are hashed into a single fingerprint identifier — a string like a3f8c92b1d4e7f6a. This identifier is sent to the server along with the entry submission.

On the server side, the fingerprint is compared against a database of previously seen fingerprints. If the same fingerprint appears across multiple entries with different email addresses, that is a strong signal that one person is submitting multiple times.

The critical property of device fingerprints is persistence. Unlike cookies, a fingerprint survives:

Cookie deletion. Clearing all browser cookies does not change any of the hardware or software attributes that compose the fingerprint.
Incognito/private browsing. Private windows prevent cookie persistence but do not alter the underlying device characteristics. The fingerprint in incognito mode is typically identical to (or very similar to) the fingerprint in normal mode.
Account switching. Logging out and creating a new account does not change the device. Three "different" users who all have the same device fingerprint are almost certainly the same person.
VPN usage. A VPN changes the IP address but not the device fingerprint. Combined with IP fraud detection, fingerprinting catches participants who use VPNs to disguise multi-accounting.

What Fingerprinting Catches

Multi-Accounting

The primary use case. A participant creates multiple email addresses and submits separate entries to increase their chances of winning, exceed entry limits, or claim multiple prizes. Without fingerprinting, each entry looks like a unique person. With fingerprinting, the repeated device identifier exposes the pattern.

This is the most common fraud pattern in sweepstakes. In promotions without device-level detection, multi-accounting can account for 5-15% of total entries, with individual actors sometimes responsible for dozens of submissions.

Bot Detection

Headless browsers — automated Chrome instances running without a visible interface — are the standard tool for bot-driven entry fraud. They can fill forms, solve basic CAPTCHAs, and submit entries at high speed.

But headless browsers have distinctive fingerprints. They lack certain plugins, produce unusual canvas renderings, report inconsistent navigator properties, and often have WebGL characteristics that do not match any real hardware. A well-implemented fingerprinting system detects headless browsers with high accuracy.

For a deeper look at bot detection techniques, see our bot detection guide.

Ban Evasion

When a fraudulent participant is blocked — by email, by IP, by account — they often create a new account and try again. If the original block was based on account-level identifiers, a new account bypasses it completely. A device-level block persists because the device has not changed.

Volume Abuse

Some promotions allow one entry per person per day. Without device-level tracking, a participant can submit one entry per email address per day across multiple accounts. Device fingerprinting enforces the per-person limit at the device level, which is a much closer proxy for "per person" than per email or per account.

Fingerprint Stability and Evasion

Device fingerprints are not perfectly stable. They can change due to normal activity:

Browser updates may alter the user agent string, WebGL capabilities, or canvas rendering behavior
OS updates can change installed fonts, audio processing, or display characteristics
Hardware changes — a new monitor, a new GPU, connecting an external display — alter screen resolution and GPU-related attributes
Browser extension changes modify the plugin list

Most fingerprinting systems account for this by using fuzzy matching rather than exact hash comparison. If 45 of 50 attributes match, the system recognizes the device as the same one, even if a few attributes changed after a browser update. The matching threshold is configurable — stricter matching reduces false positives but increases false negatives.

Deliberate Evasion

Sophisticated users can evade fingerprinting with purpose-built tools:

Anti-fingerprinting browsers. Brave and Firefox with resistFingerprinting enabled normalize many attributes — returning generic values for canvas, WebGL, fonts, and other distinguishing features. This makes many devices look identical, which defeats fingerprinting but also raises a flag (a fingerprint that matches thousands of other fingerprints is itself suspicious).
Browser profile managers. Tools like Multilogin and GoLogin create isolated browser environments, each with a unique set of spoofed attributes. Each profile produces a different fingerprint, making multi-accounting invisible to basic fingerprinting.
Virtual machines. Running entries from separate VMs, each with a different OS and browser configuration, produces genuinely different fingerprints. This is effective but resource-intensive.

These tools work. A determined attacker with Multilogin and a VPN can defeat fingerprinting. But every layer a fraudster has to bypass costs them time and money. The operative word is "determined" — these tools require technical knowledge, ongoing configuration, and often paid subscriptions. They raise the cost and effort of fraud from near-zero (create a new email address) to meaningful (maintain multiple browser profiles with realistic configurations).

For most promotions, the fraud that device fingerprinting stops — casual multi-accounting, basic bots, opportunistic ban evasion — accounts for the vast majority of fraudulent entries. The small percentage of attackers who use anti-fingerprinting tools are better addressed through layered detection combining fingerprinting with behavioral analysis, velocity checks, and cross-submission correlation.

Privacy Considerations

Device fingerprinting operates in a legal gray area that promotion operators must navigate carefully. Unlike cookies, which require explicit consent mechanisms in many jurisdictions, fingerprinting has less settled regulatory treatment — but that does not mean it is unregulated.

GDPR (EU/EEA)

The General Data Protection Regulation considers device fingerprints personal data because they can identify a specific device and, by extension, a specific person. This means:

A lawful basis for processing is required. For fraud prevention in promotions, legitimate interest (Article 6(1)(f)) is the most defensible basis. The legitimate interest is preventing fraud that harms both the promotion operator and legitimate participants.
A Data Protection Impact Assessment (DPIA) may be required if fingerprinting is deployed at scale.
The ePrivacy Directive may also apply, as fingerprinting involves accessing information stored on the user's device (similar to cookies). Some interpretations require consent; others consider fraud prevention an exception.
Transparency is required regardless of the lawful basis. The privacy policy must disclose that device fingerprinting is used and for what purpose.

CCPA/CPRA (California)

The California Consumer Privacy Act and its amendment treat device fingerprints as unique identifiers covered under the definition of personal information. Consumers have the right to:

Know that fingerprinting is being performed
Request disclosure of the specific data points collected
Request deletion of fingerprint data
Opt out of the sale or sharing of fingerprint data (though fraud-prevention use is not a "sale")

Best Practices for Privacy Compliance

Disclose fingerprinting in your privacy policy. State clearly that device attributes are collected for fraud prevention purposes. Describe the categories of data collected (browser attributes, hardware characteristics) without needing to enumerate every attribute.

Use fingerprinting for fraud prevention only. Do not use fingerprint data for advertising, tracking across sites, building marketing profiles, or any purpose other than protecting the integrity of the promotion. Limiting use to fraud prevention strengthens the legitimate interest basis under GDPR and reduces regulatory exposure.

Beyond that, three rules matter:

Minimize data retention. Retain fingerprint data only for the duration of the promotion plus a reasonable post-promotion period (for dispute resolution and compliance documentation). Delete fingerprint data after that window closes.
Do not share fingerprint data with third parties except as required for fraud prevention (e.g., the fingerprinting service provider). Fingerprint data should not flow to marketing partners, data brokers, or advertising platforms.
Consult legal counsel for promotions targeting EU/EEA participants, as the interaction between GDPR, the ePrivacy Directive, and device fingerprinting is jurisdiction-specific and still evolving.

Fingerprinting vs. Cookies

Both cookies and fingerprints are used to identify returning visitors, but they serve different purposes and have different characteristics.

Property	Cookies	Device Fingerprints
User control	Can be deleted, blocked	Difficult to alter without specialized tools
Persistence	Cleared by browser settings, private mode	Survives cookie deletion and private browsing
Privacy regulation	Well-defined consent requirements (ePrivacy, GDPR)	Less regulatory clarity, but still covered as personal data
Accuracy	Exact (unique cookie ID)	Statistical (high confidence, not guaranteed unique)
Fraud detection value	Low (trivially bypassed)	High (persistent, hard to spoof without dedicated tools)
Appropriate use	Session management, preferences, consent records	Fraud detection, device identification

In promotional contexts, cookies are useful for session management (keeping a participant logged in during a multi-step entry) and recording consent preferences. They are not useful for fraud detection because they are trivially cleared.

Fingerprints are useful for fraud detection precisely because they persist when cookies do not. They should not be used as a replacement for cookies in session management — fingerprints are probabilistic identifiers, not deterministic session tokens.

The two technologies complement each other. Cookies handle the session layer. Fingerprints handle the device identity layer.

Implementation Approaches

DIY Collection

Build your own JavaScript fingerprint collector by querying browser APIs (canvas, WebGL, navigator, screen) and hashing the results. This approach gives you full control over what is collected and how it is processed.

Drawbacks: significant development effort, ongoing maintenance as browsers change their APIs, no built-in anti-evasion capabilities, and lower accuracy than commercial solutions. Browser vendors actively work to limit fingerprinting surface area — APIs that worked last year may return less distinctive data today.

Open-Source Libraries

FingerprintJS (open-source version) is the most widely used library. It collects a standard set of attributes and produces a visitor identifier. It is free, well-maintained, and a reasonable starting point for promotions with moderate fraud risk.

Limitations: the open-source version has lower accuracy than commercial alternatives (roughly 60-70% unique identification vs. 95%+ for commercial), limited anti-evasion capabilities, and no server-side component for cross-session matching.

Commercial Services

FingerprintJS Pro (now Fingerprint), HUMAN (formerly White Ops), and similar services offer high-accuracy fingerprinting with server-side identification, anti-evasion technology, and bot detection integrated into the fingerprinting layer.

Advantages: 95%+ identification accuracy, detection of anti-fingerprinting tools and browser profile managers, server-side APIs for cross-session and cross-device matching, managed infrastructure, and ongoing updates as browsers evolve.

For promotions with meaningful prize value or high fraud risk, commercial fingerprinting services are usually worth the cost. The difference between 65% and 99% identification accuracy translates directly into caught fraud. A promotion with $50,000 in prizes and a 10% fraud rate is leaking $5,000 in prize value — a commercial fingerprinting service that recovers even half of that pays for itself many times over.

How Comprizant Handles Device Fingerprinting

Comprizant includes device fingerprinting as part of its enhanced and enterprise trust and safety tiers, integrated into the entry processing pipeline.

Fingerprint collection at entry time. A lightweight JavaScript snippet collects device attributes during the entry flow. No visible impact on page load or entry completion — the collection runs asynchronously and completes before form submission.
Cross-entry fingerprint matching. Every fingerprint is checked against a DynamoDB index of all fingerprints seen across the campaign. Matching fingerprints across different entries trigger a fraud signal that feeds into the composite risk score.
Fingerprint index in DynamoDB. A dedicated Global Secondary Index enables sub-millisecond fingerprint lookups, allowing real-time detection even at high entry volumes.
Combined signal scoring. Fingerprint matches are not treated as automatic rejections. They feed into a scoring engine alongside IP analysis, email reputation, phone verification, behavioral signals, and cross-submission correlation. A fingerprint match from a shared family computer is handled differently than a fingerprint match from a device with 50 entries across 30 email addresses.
Privacy-compliant implementation. Fingerprint data is used exclusively for fraud prevention. Retention is limited to the campaign period plus a configurable post-campaign window. Fingerprint data is not shared with marketing systems or third-party advertisers.

Key Takeaways

Device fingerprinting identifies devices by combining 30-50 browser and hardware attributes into a statistically unique identifier. No single attribute is distinctive, but the combination is.
Fingerprints persist when cookies do not. They survive cookie deletion, incognito mode, account switching, and VPN usage — making them effective against the most common multi-accounting techniques.
Fingerprinting catches multi-accounting, bots, ban evasion, and volume abuse — the fraud patterns that account for the majority of illegitimate entries in promotions.
Evasion is possible but expensive. Anti-fingerprinting browsers, profile managers, and VMs can defeat fingerprinting, but they require technical knowledge and ongoing effort that deters most fraudsters.
Privacy regulations apply. GDPR treats fingerprints as personal data. CCPA covers them as unique identifiers. Disclose fingerprinting in your privacy policy, limit use to fraud prevention, minimize retention, and consult legal counsel for EU-targeted promotions.
Commercial fingerprinting services are worth the investment for promotions with meaningful prize value. The accuracy gap between open-source and commercial solutions (65% vs. 99%) translates directly into caught fraud.

For the complete fraud prevention framework that combines fingerprinting with IP analysis, phone verification, and behavioral detection, see our sweepstakes fraud prevention guide. For a practical overview of layering multiple security measures, read our contest security best practices guide.

Ready to add device fingerprinting to your promotion's fraud detection pipeline? Get started with Comprizant and deploy fingerprinting alongside IP analysis, phone verification, and behavioral scoring — all configured from a single dashboard.