Canvas fingerprinting found on 12.7% of top sites, led by Akamai's bot-detection script
Canvas fingerprinting scripts run on 12.7 percent of the Tranco top 20,000 websites, more than double the 5.1 percent recorded among top-1,000 sites in the 2016 study by Steven Englehardt and Arvind Narayanan. The new figure comes from research presented at the ACM Internet Measurement Conference in October 2025 by Elisa Luo, Tom Ritter, Stefan Savage and Geoffrey Voelker, who crawled sites in May 2025 and counted an average of 3.31 fingerprintable canvases per site, with a maximum of 60. Akamai's bot-detection canvas had the widest reach among the top 20,000, appearing on 485 sites, 23 percent of every site running canvas fingerprinting. FingerprintJS appeared on 462 sites, and Shopify's storefront performance canvas led among lower-ranked sites at 457.
Google stopped prohibiting advertisers from using device fingerprinting on 18 December 2024, with the policy taking effect on 16 February 2025; the UK Information Commissioner's Office called the change irresponsible, noting that Google itself had argued in 2019 that fingerprinting subverts user choice. Consent requirements did not move with Google's policy: the European Data Protection Board's Guidelines 2/2023 and the Article 29 Working Party's Opinion 9/2014 both place fingerprinting inside Article 5(3) of the ePrivacy Directive, and IAB Europe has renamed TCF Special Feature 2 to 'Identify devices based on information actively requested,' with compliance due in web environments by mid-October 2026 and in app and connected television environments by mid-February 2027. Campaigns that lean on fingerprinting for attribution or frequency capping need consent records that match those obligations, whatever Chrome's ad policy now permits.