Case Study: Disclosure of Indirect Device Fingerprinting in Privacy Policies

Andrew Sellars; Ari Trachtenberg; Julissa Milligan; Mayank Varia; Sarah Scheffler; Trishita Tiwari

REVIEW 3 major objections 4 minor 23 references

Case Study: Disclosure of Indirect Device Fingerprinting in Privacy Policies

T0 review · 3 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read None of the 28 privacy policies in this case study discloses Canvas fingerprinting specifically enough for a visitor to detect and block it, although many of the same policies describe direct tracking methods in actionable detail.

desk verdict A modest, honest case study that shows a real gap in privacy-policy disclosure of Canvas fingerprinting; the main soft spot is the unvalidated 2014 detector, but the paper's careful scoping keeps the central claim intact. read the letter →

arxiv 1908.07965 v1 pith:GQCO3OYB submitted 2019-08-21 cs.CY

Julissa Milligan , Sarah Scheffler , Andrew Sellars , Trishita Tiwari , Ari Trachtenberg , Mayank Varia This is my paper · ORCID

classification cs.CY

keywords CanvasfingerprintingindirectdeviceprivacypoliciesonlinetrackingdirectconsumerdisclosurewebmeasurementFTC

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether privacy policies tell consumers enough about indirect device fingerprinting, a newer tracking approach that is harder to detect than direct methods. It focuses on Canvas fingerprinting, in which a website makes the browser render an image and reads back pixel-level differences that uniquely identify the device. Using an existing automated detector on Alexa Top 500 US-facing sites, the authors identified 28 sites that appear to use Canvas fingerprinting and then read every policy. None of the 28 policies named Canvas or described the technique specifically enough for a visitor to know it was in use, while many policies did give actionable detail about direct methods such as cookies, headers, and web beacons. If correct, the finding means the disclosure system that supports today's uneasy truce over direct tracking does not extend to indirect tracking, leaving users without the information needed to block it.

What carries the argument

The load-bearing mechanism is the direct-versus-indirect distinction, instantiated by Canvas fingerprinting. Canvas fingerprinting works by instructing the browser to draw a graphic through the HTML5 Canvas API and then reading back the rendered pixel data; subtle differences across hardware, fonts, and graphics libraries make the output a stable and highly distinguishing device identifier. Because the same API call can also be used for legitimate rendering, the technique is dual-use, so observing the call does not by itself reveal tracking. The paper's method comparison shows that privacy policies do not resolve this ambiguity, and the categories the authors develop for reading the policies are what allow them to compare disclosure specificity across sites.

What would settle it

Run an independent crawl of the same Alexa Top 500 with a detector that also catches obfuscated or modified Canvas scripts, read the privacy policies of every confirmed site, and check whether any policy names Canvas or describes image rendering well enough to identify the technique. A single such policy would undercut the paper's strongest claim that none of the detected sites discloses indirect fingerprinting at that granularity.

Watch

Extended reading notes

Core claim

The central discovery is a mismatch between how privacy policies treat direct and indirect fingerprinting. On the paper's own terms, the same websites that disclose direct fingerprinting techniques in ways a technically savvy reader can act on are silent at the method level about Canvas fingerprinting. All 28 policies in the sample put readers on notice that the site collects device-identifying information, but none identifies the indirect technique by name or description. The paper groups the policies into three categories: broad technology-agnostic language, specific disclosure of direct techniques only, and one policy that names 'device or browser fingerprints' without naming Canvas. The consequence the authors draw is that a privacy-aware visitor cannot turn the policy into a technical block or reset, because she cannot learn which indirect method is in use.

Load-bearing premise

The paper's results rest on the assumption that the automated detector from Acar et al. correctly and completely identifies sites that use Canvas fingerprinting; if sites obfuscate or vary their scripts, those sites fall out of the 28-policy sample and the measured disclosure gap could look different.

Editorial extensions

If this is right

Consumers who rely on ad blockers or cookie controls can no longer assume they have prevented tracking on sites that use indirect fingerprinting.
A technically sophisticated visitor cannot currently use a privacy policy to decide whether to block Canvas fingerprinting, because no policy in the sample provides the needed specificity.
The de facto armistice over direct tracking, in which sites disclose, privacy-aware users block, and sites tolerate the blockers, does not hold for indirect methods and may be disturbed as those methods spread.
Regulators and the lawyers who draft privacy policies may need to treat indirect fingerprinting as a distinct disclosure category rather than covering it with broad 'unique identifiers' language.
The sample shows no sign yet that GDPR-style pressure for greater technical detail has made indirect fingerprinting more transparent in these policies.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

An implication the authors leave implicit is that the disclosure gap could be narrowed without making policies longer: a single human-readable line naming the indirect technique, such as 'Canvas fingerprinting,' would give users the one missing fact needed to seek a targeted block.
The same asymmetry likely applies to the other inference-based methods the paper lists, such as font enumeration, GPU measurement, and sensor access, because they share the dual-use property that makes Canvas disclosures opaque; testing those techniques would show whether the finding generalizes.
A testable extension would be to give technically savvy users the list of detected Canvas sites and ask them to identify the practice from the privacy policies alone; the paper's claim predicts near-zero success.
Because the detector is conservative and the authors acknowledge it may miss obfuscated scripts, the 28 reviewed policies may be a best-case sample, meaning the true disclosure gap could be wider than measured.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

Read the Milligan et al. case study. The short version: it's a careful little paper that actually does something new. It takes 28 sites that appear to Canvas-fingerprint, reads their privacy policies line by line, and shows that none of them name Canvas or any indirect method, while many name direct methods like cookies and beacons. That asymmetry is a real, concrete finding, and I don't think any of the prior detection papers made the disclosure comparison.

The paper earns credit for its framing. It's explicitly a case study, the sample is small, and the legal/technical author mix makes the manual review more credible than a single-discipline reading would be. The writing is clean, and the limitations are acknowledged in the body. The 'armistice' metaphor is a useful way to think about the direct-tracking ecosystem.

Soft spots, in order of real weight. The 2014 Acar detector used on 2019 sites is the biggest one. They don't give false-positive or false-negative numbers for their corpus, and they don't manually confirm that all 49 detected sites actually Canvas-fingerprint. The stress-test note is right that false positives would blunt the 'none of the 28 policies mention Canvas' claim, because you'd be looking at policies of sites that maybe don't do it. That said, the authors do say 'It is possible we did not detect existing obfuscated fingerprinting techniques,' and they frame the study as a conservative detection exercise. So the weakness is real but the paper's conclusions are scoped tightly enough that it doesn't collapse.

Second: no released codebook and no inter-rater reliability numbers for the policy classification. Two people read each policy, but we only have their word that they categorized consistently. That's a minor-to-moderate transparency issue, fixable with an appendix.

Third, minor: the leap from 'these 28 policies' to 'indirect fingerprinting methods are often ... not identified with specificity' in the abstract is a bit of extrapolation. The body stays closer to the data.

Bottom line: the central claim holds up for the sites examined, the study is honest about its limits, and the finding has real value for privacy-law and tracking-research audiences. It deserves a serious referee; I'd recommend asking for detector robustness checks and a released coding protocol, but accept the paper's empirical contribution either way. Yes, bring it to reading group; I'd cite it if writing about disclosure policy.

Regards.

Referee Report

3 major / 4 minor

Summary. This paper presents a case study of whether privacy policies disclose indirect device fingerprinting, specifically Canvas fingerprinting. The authors used the Acar et al. (2014) detector on the Alexa Top 500 sites, identified 49 sites with Canvas fingerprinting, filtered to 28 English-language US-focused sites, and manually reviewed their privacy policies. They find that none of the 28 policies specifically mention Canvas fingerprinting, while many do disclose direct fingerprinting techniques. They conclude that indirect fingerprinting methods are often difficult to detect and are not identified with specificity in privacy policies, undermining users' ability to block them.

Significance. The paper addresses an important and understudied intersection of privacy law and technology. Its main contribution is a concrete, small-N empirical observation: on a sample of sites that appear to use Canvas fingerprinting, privacy policies provide insufficient technical granularity to allow technically savvy users to identify and block that technique. The use of a mixed legal-technical reviewing team is a strength, and the comparison between direct and indirect fingerprinting disclosures is instructive. If the finding holds, it has practical implications for FTC guidance and for privacy-enhancing tool design. However, the study is explicitly a case study, and its broader generalization should be read with caution; the conclusion is proportionally modest and the paper is transparent about its limitations.

major comments (3)

[Section 3.1] The validity of the site selection rests on the Acar et al. (2014) detector, but the paper does not report any validation of that detector on a 2019 corpus, nor does it manually verify that the 28 sites actually engage in Canvas fingerprinting. Because the central finding is that policies of Canvas-fingerprinting sites do not mention the technique, false positives would weaken the link between the observed policy gap and the actual tracking practice. I recommend that the authors either manually confirm the presence of Canvas fingerprinting on the 28 sites or report the detector's expected error rates and discuss the sensitivity of the conclusion to those errors.
[Section 3.1, policy review] The paper does not provide a codebook, complete quoted language for all categorized statements, or inter-rater reliability measures. The classification of policies into three categories and the determination that no policy specifically mentions Canvas fingerprinting rely on the authors' judgment. To make the analysis auditable, the authors should provide a supplementary table listing, for each of the 28 sites, the policy language that supports the coding, and ideally have a second pair of coders independently apply the same rules.
[Abstract and Section 1] The conclusion that 'indirect fingerprinting methods are often difficult to detect and are not identified with specificity in privacy policies' goes beyond the evidence presented. The study examines one indirect technique (Canvas fingerprinting) on 28 sites, all selected because they are detected as using that technique. The sample is not representatively drawn from all indirect fingerprinting implementations, and the word 'often' is not directly supported without a broader sampling frame. Please soften the conclusion to apply to the sampled sites or to Canvas fingerprinting specifically, and avoid implying a general statistical claim about all indirect fingerprinting methods.

minor comments (4)

[Section 2.2] The claim that 'The most popular Firefox add-on for blocking Canvas fingerprinting has only about 46,000 average daily users as of August 2019' lacks a source; please provide a citation or link to the add-on statistics.
[Section 2.2] The claim that 'Adblock Plus, a common ad-blocker, has 11 million average daily users on Firefox' also lacks a citation; please add a reference for this statistic.
[Section 3.3] The GDPR discussion is framed as a conditional hypothesis ('If the GDPR requires attorneys to...'); consider labeling it explicitly as a hypothesis so that readers do not mistake it for a finding of the study.
[Section 4.1] The text uses the phrase 'd´ etente' with an odd accent; please ensure the spelling is standardized to 'détente' throughout.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper is an empirical policy review whose conclusion is an observational outcome, not a derivation from its inputs.

full rationale

The paper makes no mathematical derivation and fits no parameters. It uses an external detector from Acar et al. (2014) to find websites that appear to use Canvas fingerprinting, then manually inspects the corresponding privacy policies. The central claim—that none of the 28 policies describe indirect fingerprinting with enough specificity to know that Canvas fingerprinting is used—is an empirical finding about the policy texts, not something encoded in the detector or in the coding scheme. The detector tells the authors which sites plausibly fingerprint; it does not tell them what the policies say. The authors also explicitly acknowledge the detector's limitation in Section 2.2 ('It is possible we did not detect existing obfuscated fingerprinting techniques'), which is a scope caveat rather than a circular reduction. No load-bearing self-citation or ansatz-smuggling appears, and the external detector provides independent grounding for the sample selection.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper introduces no free parameters or invented entities. It relies on an external detector (Acar et al.) and on assumptions about the legal context and the reliability of manual policy review.

assumptions (3)

domain assumption The Acar et al. detector accurately distinguishes Canvas fingerprinting from non-fingerprinting Canvas use.
The entire sample is selected using this detector from prior work, so its accuracy determines which sites enter the study.
domain assumption U.S. FTC law requires privacy policies to be accurate and non-deceptive, and that standard is the relevant legal benchmark.
The paper evaluates whether disclosures are sufficient based on this legal framework.
domain assumption Manual reading of privacy policies by at least one legal scholar and one technologist captures whether a policy mentions fingerprinting.
The central classification of disclosures relies on subjective manual review without quantified inter-rater reliability.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Case Study: Disclosure of Indirect Device Fingerprinting in Privacy Policies." pith.science (2026). https://pith.science/paper/GQCO3OYB

@misc{pith2026190807965,
  author       = {Pith},
  title        = {Pith review of: Case Study: Disclosure of Indirect Device Fingerprinting in Privacy Policies},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/GQCO3OYB}},
  note         = {Machine review of arXiv:1908.07965}
}

read the original abstract

Recent developments in online tracking make it harder for individuals to detect and block trackers. Some sites have deployed indirect tracking methods, which attempt to uniquely identify a device by asking the browser to perform a seemingly-unrelated task. One type of indirect tracking, Canvas fingerprinting, causes the browser to render a graphic recording rendering statistics as a unique identifier. In this work, we observe how indirect device fingerprinting methods are disclosed in privacy policies, and consider whether the disclosures are sufficient to enable website visitors to block the tracking methods. We compare these disclosures to the disclosure of direct fingerprinting methods on the same websites. Our case study analyzes one indirect fingerprinting technique, Canvas fingerprinting. We use an existing automated detector of this fingerprinting technique to conservatively detect its use on Alexa Top 500 websites that cater to United States consumers, and we examine the privacy policies of the resulting 28 websites. Disclosures of indirect fingerprinting vary in specificity. None described the specific methods with enough granularity to know the website used Canvas fingerprinting. Conversely, many sites did provide enough detail about usage of direct fingerprinting methods to allow a website visitor to reliably detect and block those techniques. We conclude that indirect fingerprinting methods are often difficult to detect and are not identified with specificity in privacy policies. This makes indirect fingerprinting more difficult to block, and therefore risks disturbing the tentative armistice between individuals and websites currently in place for direct fingerprinting. This paper illustrates differences in fingerprinting approaches, and explains why technologists, technology lawyers, and policymakers need to appreciate the challenges of indirect fingerprinting.

Figures

Figures reproduced from arXiv: 1908.07965 by the authors.

**Figure 1.** Graphic sent to clients to draw in Canvas fingerprinting script within open-source fingerprinting script https://github.com/Valve/fingerprintjs2, commit 563dbde. The way in which the graphic is drawn can be used to fingerprint the client’s device. Unlike direct tracking techniques, there are relatively few tools available to detect or understand Canvas fingerprinting. To analyze whether a Canvas query is being used… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 22 canonical work pages

[1]

G. Acar, C. Eubank, S. Englehardt, M. Juarez, A. Narayanan, and C. Diaz. The web never forgets: Persistent tracking mechanisms in the wild. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , pages 674–689. ACM, 2014

work page 2014
[2]

Alaca and P

F. Alaca and P. C. van Oorschot. Device ﬁngerprinting for augmenting web authen- tication: classiﬁcation and analysis of methods. In Proceedings of the 32nd Annual Conference on Computer Security Applications , pages 289–301. ACM, 2016

work page 2016
[3]

Y. Cao, S. Li, and E. Wijmans. (Cross-)browser ﬁngerprinting via os and hardware level features. In Proceedings of Network & Distributed System Security Sympo- sium. The Internet Society, 2017

work page 2017
[4]

CBS Privacy Policy Highlights , 2019

CBS. CBS Privacy Policy Highlights , 2019. https://www.cbsinteractive.com/ legal/cbsi/privacy-policy/highlights (last accessed Jan 26, 2019)

work page 2019
[5]

Privacy and Cookie Policy , 2019

CoinMarketCap. Privacy and Cookie Policy , 2019. https://coinmarketcap.com/ privacy/ (last accessed July 9, 2019)

work page 2019
[6]

A. Das, G. Acar, N. Borisov, and A. Pradeep. The web’s sixth sense: A study of scripts accessing smartphone sensors. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , pages 1515–1532. ACM, 2018

work page 2018
[7]

Eckersley

P. Eckersley. How unique is your web browser? In International Symposium on Privacy Enhancing Technologies Symposium, pages 1–18. Springer, 2010

work page 2010
[8]

Englehardt and A

S. Englehardt and A. Narayanan. Online tracking: A 1-million-site measurement and analysis. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 1388–1401. ACM, 2016

work page 2016

Show all 23 references

[9]

General Data Protection Regulation, 2016

European Parliament and Council of the European Union. General Data Protection Regulation, 2016

2016
[10]

Fiﬁeld and S

D. Fiﬁeld and S. Egelman. Fingerprinting web users through font metrics. In International Conference on Financial Cryptography and Data Security, pages 107–
[11]

Forbes.com Privacy Statement , 2018

Forbes. Forbes.com Privacy Statement , 2018. https://www.forbes.com/privacy/ english/#5825f0013061 (last accessed Jan 26, 2019)

2018
[12]

Privacy Policy , 2018

Fox News. Privacy Policy , 2018. https://www.foxnews.com/privacy-policy (last accessed Jan 26, 2019)

2018
[13]

Mowery, D

K. Mowery, D. Bogenreif, S. Yilek, and H. Shacham. Fingerprinting information in JavaScript implementations. Proceedings of W2SP, 2(11), 2011

2011
[14]

Mowery and H

K. Mowery and H. Shacham. Pixel perfect: Fingerprinting canvas in HTML5. Proceedings of W2SP, pages 1–12, 2012

2012
[15]

Canvas API

Mozilla Developer Network Web Docs. Canvas API. https://developer.mozilla.org/en-US/docs/Web/API/Canvas API
[16]

Mulazzani, P

M. Mulazzani, P. Reschl, M. Huber, M. Leithner, S. Schrittwieser, E. Weippl, and F. Wien. Fast and reliable browser identiﬁcation with javascript engine ﬁngerprint- ing. In Web 2.0 Workshop on Security and Privacy (W2SP) , volume 5, 2013

2013
[17]

How canvas ﬁngerprint blockers make you easily trackable,

Multilogin. How canvas ﬁngerprint blockers make you easily trackable,
[18]

Nakibly, G

G. Nakibly, G. Shelef, and S. Yudilevich. Hardware ﬁngerprinting using HTML5. arXiv preprint arXiv:1503.01408 , 2015

2015 arXiv
[19]

Nikiforakis, A

N. Nikiforakis, A. Kapravelos, W. Joosen, C. Kruegel, F. Piessens, and G. Vigna. Cookieless monster: Exploring the ecosystem of web-based device ﬁngerprinting. In IEEE Symposium on Security and Privacy , pages 541–555. IEEE, 2013

2013
[20]

Perry, E

M. Perry, E. Clark, S. Murdoch, and G. Koppen. The De- sign and Implementation of the Tor Browser [DRAFT], 2018. https://www.torproject.org/projects/torbrowser/design/

2018
[21]

Privacy Policy , 2019

Udemy. Privacy Policy , 2019. https://www.udemy.com/terms/privacy/ (last ac- cessed July 9, 2019)

2019
[22]

Yelp Privacy Policy, 2018

Yelp. Yelp Privacy Policy, 2018. https://www.yelp.com/tos/privacy en us 20180525 (last accessed Jan 26, 2019)

2018
[2016]

https://multilogin.com/how-canvas-ﬁngerprint-blockers-make-you-easily- trackable

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [1]

G. Acar, C. Eubank, S. Englehardt, M. Juarez, A. Narayanan, and C. Diaz. The web never forgets: Persistent tracking mechanisms in the wild. In Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security , pages 674–689. ACM, 2014

work page 2014

[2] [2]

Alaca and P

F. Alaca and P. C. van Oorschot. Device ﬁngerprinting for augmenting web authen- tication: classiﬁcation and analysis of methods. In Proceedings of the 32nd Annual Conference on Computer Security Applications , pages 289–301. ACM, 2016

work page 2016

[3] [3]

Y. Cao, S. Li, and E. Wijmans. (Cross-)browser ﬁngerprinting via os and hardware level features. In Proceedings of Network & Distributed System Security Sympo- sium. The Internet Society, 2017

work page 2017

[4] [4]

CBS Privacy Policy Highlights , 2019

CBS. CBS Privacy Policy Highlights , 2019. https://www.cbsinteractive.com/ legal/cbsi/privacy-policy/highlights (last accessed Jan 26, 2019)

work page 2019

[5] [5]

Privacy and Cookie Policy , 2019

CoinMarketCap. Privacy and Cookie Policy , 2019. https://coinmarketcap.com/ privacy/ (last accessed July 9, 2019)

work page 2019

[6] [6]

A. Das, G. Acar, N. Borisov, and A. Pradeep. The web’s sixth sense: A study of scripts accessing smartphone sensors. In Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security , pages 1515–1532. ACM, 2018

work page 2018

[7] [7]

Eckersley

P. Eckersley. How unique is your web browser? In International Symposium on Privacy Enhancing Technologies Symposium, pages 1–18. Springer, 2010

work page 2010

[8] [8]

Englehardt and A

S. Englehardt and A. Narayanan. Online tracking: A 1-million-site measurement and analysis. In Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pages 1388–1401. ACM, 2016

work page 2016