Google’s Return to Digital Fingerprinting Raises Privacy Concerns

Google recently announced it will resume tracking “digital fingerprints” by February 2025. This data collection combines hardware and software signals, such as IP addresses and browser information, to identify unique users and devices. Regulators warn that “fingerprinting” may be difficult to detect and block, raising concerns about transparency and user consent.

Google revealed its plan in a blog post earlier this month, arguing that advances in privacy-enhancing technologies (PETs) mitigate the looser rules surrounding how advertisers handle user data. “[The change in ads policies] clarify the activities that we prohibit to better protect the ads ecosystem from harmful activities while being less prescriptive with partners in how they target and measure ads,” the company stated.

However, data regulators and cybersecurity experts disagree. The UK’s Information Commissioner’s Office (ICO) condemned Google’s announcement as “irresponsible.”

“The ICO’s view is that fingerprinting is not a fair means of tracking users online because it is likely to reduce people’s choice and control over how their information is collected,” wrote Stephen Almond, the ICO’s executive director of regulatory risk, in a blog post.

The ICO argues that fingerprinting is much harder to detect and opt out of (even for security-minded users) than other methods, such as cookies. Last year, Google pledged to remove third-party cookies from Chrome and even started testing their removal before reversing its decision in September. Critics say Google’s decision to reintroduce fingerprinting could diminish the significance of earlier cookie-related announcements.

Google itself has previously criticized fingerprinting. “Unlike cookies, users cannot clear their fingerprints and, therefore, cannot control how their information is collected. We think this subverts user choice and is wrong,” wrote Google Chrome’s then-director of engineering in a 2019 blog post.

The ICO has warned it will pursue legal action if necessary: “Our response is clear: businesses do not have free rein to use fingerprinting as they please. Like all advertising technology, it must be lawfully and transparently deployed – and if it is not, the ICO will act.”

Google reportedly plans further discussions with the ICO about these changes, emphasizing its commitment to balancing user privacy with advertising interests.