The Era of Digital Fingerprinting | Cookieless Targeted Advertising

The trend is clear: As cookies vanish, fingerprinting fills the void. But what does this mean for the laws meant to shield us?

Privacy Laws in the Crosshairs

Europe’s privacy framework, anchored by the General Data Protection Regulation (GDPR) and the e-Privacy Directive, was built for a cookie-driven world. The GDPR, enacted in 2018, demands that companies get explicit consent before processing personal data—defined broadly as anything that can identify an individual. The e-Privacy Directive, often called the “cookie law,” zeroes in on electronic communications, requiring opt-in consent for tracking tools like cookies unless they’re strictly necessary (think login sessions, not ad targeting).

Fingerprinting, though, slips through the cracks. Because it doesn’t store data on your device like a cookie does, some argue it sidesteps the e-Privacy Directive’s scope. Others, including the French data protection authority (CNIL), disagree. In 2023, CNIL fined a mid-sized ad-tech firm €1.2 million for fingerprinting users without consent, ruling that the practice constituted “personal data processing” under GDPR. The firm’s defense—that no identifier was stored—fell flat. “If it identifies you, it’s personal data,” a CNIL spokesperson told me. “The method doesn’t matter.”

Across the Atlantic, the picture is murkier. The U.S. lacks a federal privacy law akin to GDPR, leaving a patchwork of state rules like California’s CCPA. Fingerprinting thrives here, largely unchecked. A 2024 lawsuit against Target, filed in California, alleges the retailer used fingerprinting to track users despite “Do Not Track” settings—a potential CCPA violation. The case is pending, but it’s a sign of battles to come.

Back in Europe, the proposed e-Privacy Regulation—meant to replace the 2002 Directive—has stalled since 2017, mired in debates over how to handle emerging tech. “Fingerprinting wasn’t on the radar when these laws were drafted,” says Marta Rossi, a Brussels-based privacy lawyer. “Regulators are playing catch-up, and companies know it.”

The Human Cost

For consumers, the stakes are personal. Consider Jamal, a 29-year-old nurse in London. After researching mental health resources online, he noticed ads for antidepressants shadowing him across the web. “I didn’t want anyone knowing that,” he says. “It’s not just about ads—it’s about what they assume about you.” Fingerprinting’s opacity makes it worse: Unlike cookies, there’s no pop-up asking for consent, no easy way to opt out.

Advocates argue the ad industry needs targeting to survive. “Free content isn’t free,” says Paul, a VP at an ad-tech startup. “If we can’t reach the right people, publishers collapse.” He’s got a point—digital ads fund much of the internet but the shift to fingerprinting feels like a bait-and-switch: Just as users gained tools to block cookies, the game changed.

Some companies are testing alternatives. Google’s Privacy Sandbox pitches “Federated Learning of Cohorts” (FLoC), grouping users by interest without individual tracking. It’s less invasive than fingerprinting, but uptake has been slow—advertisers crave precision. Apple’s SKAdNetwork offers another model, tying ads to anonymized device signals. Neither fully replaces the granular data fingerprinting provides.

Where Do We Go From Here With a Digital Fingerprinting World? What Are My Privacy Risks with Digital Fingerprinting?

The era of digital fingerprinting is here, and it’s not going anywhere soon. Regulators face a choice: Update laws to explicitly tackle it, or watch it erode the consent frameworks they’ve built and neither will move as fast as the tech companies do. The EU’s Data Protection Board hinted at action in a report last year, calling fingerprinting “a significant risk to fundamental rights.” Fines like CNIL’s may multiply, but enforcement lags behind innovation.

For now, users like Sarah and Jamal are left with unease—and few defenses. Browser extensions like uBlock Origin can help, but they’re not foolproof. “I just want to browse in peace,” Sarah says, sipping her latte. “Is that too much to ask?”

Maybe it is. The internet’s economics hinge on knowing us, and fingerprinting is the latest way to do it. As cookies fade into history, this cookieless future feels less like liberation and more like a new leash— subtler, stronger, and harder to shake. Lawmakers, technologists, and users alike will have to decide: Is this the privacy we’re willing to live with? The answer, like our fingerprints, may be uniquely ours.

If you want help with Fingerprinting compliance to ensure that your company and business is following data privacy requirements reach out for a demo below with one of our privacy and compliance superheroes.