Fingerprinting can be personal data even without cookies. Here is how consent rules apply in general terms, and where the honest uncertainty lies.
On this page
Not legal advice
This is general information about how the rules are usually understood. It is not legal advice, and the position differs between jurisdictions.
People often assume that fingerprinting is legal because it stores nothing — there is no cookie to consent to, so the rules about cookies cannot apply. That reading is too simple. Under the main privacy frameworks, legality turns on whether the technique collects personal data and whether the user agreed, and on both points the answer is less settled than either side would like.
Why storing nothing does not settle it
The rules governing cookies require consent for storing information on, or reading information from, a user’s device. Fingerprinting does neither in the obvious sense: it computes a value from characteristics the browser already exposes, without writing anything to your machine.
The difficulty is that the result is often still personal data. If a value can single out one person, or be combined with other information to do so, it functions as an identifier whether or not anything was stored. Some regulators have taken exactly this view, treating fingerprinting as falling within the same consent requirement that applies to cookies. So the storage question is a distraction. The question that matters is identifiability.
If fingerprinting requires a lawful basis, consent is the one most sites would reach for, and consent has conditions that fingerprinting sits awkwardly against. It must be freely given and specific, and a banner offering “accept all” with no meaningful alternative is not a strong basis. It must be informed, yet a visitor can hardly understand what they are agreeing to when the technique is invisible by design. It must be revocable, and that last point is one of the real practical difficulties: a fingerprint is not stored on the device, so there is nothing obvious to delete, and withdrawal means stopping the processing rather than clearing a file.
The signals that are meant to speak for you
Do Not Track is a request that a site should not track you. It relies on the site choosing to honour it, and support has always been uneven. It is a preference, not a rule. You can see what your browser sends with the Do Not Track test.
Global Privacy Control is a newer signal that some jurisdictions recognise as a valid way to exercise a right to opt out of sale or sharing, rather than merely a request. Where it is recognised in law it carries more weight than Do Not Track, but recognition depends on the jurisdiction. Check whether yours is being sent with the Global Privacy Control test.
Who is doing the fingerprinting matters
The distinction between a website and the companies it works with is often lost. A publisher collecting its own analytics is processing data for its own purposes and is directly responsible for the lawful basis. A third-party processor running the script acts on the publisher’s instructions, but the publisher’s duty to obtain a lawful basis does not disappear because the script arrived from elsewhere. A third party collecting for its own purposes is generally a controller in its own right, and the site carrying it may not have the consent that would justify that.
Where the honest uncertainty lies
Fingerprinting sits in a gap between what the rules say and what the technology does. The rules were written for a model where tracking involves placing something on a device that can be refused, listed and deleted. Fingerprinting offers none of those handles. Different regulators have taken different views, and enforcement has concentrated on the clearest cases.
What is reasonably clear is the direction of travel. The argument that fingerprinting escapes consent because it stores nothing is a weak one, and it is getting weaker. Our explainer on fingerprinting sets out why the technique is so hard to fit into the cookie-shaped model in the first place.
Whatever the legal position, the practical control you have is limited. You can send the signals, since Global Privacy Control in particular is treated as binding in certain jurisdictions. You can use a browser that resists, since randomisation or standardisation reduces the value of the fingerprint regardless of what the rules require — check yours with the browser fingerprint test. None of these changes the law, but they change what is possible against you.
The short version
Fingerprinting is hard to fit into the cookie-shaped model because it stores nothing a user can refuse, list or delete. The storage question is a distraction; identifiability is the question that matters, and on that the rules still leave real room for disagreement.
This article is general information and not legal advice; for a specific situation, consult a qualified professional in your jurisdiction.