Browser fingerprinting identifies a browser — and through it a device and a person — from the configuration it exposes to JavaScript and to HTTP: fonts, canvas rendering, audio processing, screen geometry, installed extensions, GPU behaviour. Unlike cookies it is stateless: nothing is written to the client, so nothing can be cleared, and there is no browser API a user can use to say no. That is what makes it the tracking technique that outlives every storage-based countermeasure, and the one a measurement study is least well equipped to observe.

The canonical entry point outside this wiki is Laperdrix et al.'s survey [1Laperdrix, Pierre; Bielova, Nataliia; Baudry, Benoit; Avoine, Gildas (2020): "Browser Fingerprinting: A Survey", ACM Transactions on the Web 14(2). (DOI)], which covers the attribute space, the entropy literature and the defence taxonomy in a way this page does not attempt to duplicate. What this page adds is the measurement methodology: how the 83 papers in our corpus actually detected fingerprinting, why their prevalence numbers cannot be compared with one another, and what you have to instrument to produce a number of your own.

A fingerprint is a vector of attributes, each cheap to read and none identifying on its own. Three properties decide whether it works as an identifier, and every empirical paper on this page is measuring one of them:

1. Entropy — how much the attribute varies across the population. Eckersley's original study [2Eckersley, Peter (2010): "How Unique Is Your Web Browser?", in: Proceedings of the Privacy Enhancing Technologies Symposium, pp. 1-18. (DOI)] framed this as an information-theoretic question and it has stayed that way.
2. Stability — whether the same browser yields the same vector next week. A high-entropy attribute that changes daily is useless for tracking and is why linking algorithms exist at all.
3. Reachability — whether the attribute is readable from an ordinary third-party script, without permission and without user-visible effect.

The extension surface is worth separating out, because it is the one that grew fastest in the corpus and the one where the browser vendor has least control. Carnus [3Karami, Soroush; Ilia, Panagiotis; Solomos, Konstantinos; Polakis, Jason (2020): "Carnus: Exploring the Privacy Threats of Browser Extension Fingerprinting", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] enumerated four independent channels (web-accessible resources, DOM changes, intra-extension messaging, and outgoing HTTP requests); style-sheet injection [4Laperdrix, Pierre; Starov, Oleksii; Chen, Quan; Kapravelos, Alexandros; Nikiforakis, Nick (2021): "Fingerprinting in Style: Detecting Browser Extensions via Injected Style Sheets", in: Proceedings of the USENIX Security Symposium. (Link)] and page-visibility timing [5Agarwal, Shubham; Fass, Aurore; Stock, Ben (2024): "Peeking through the window: Fingerprinting Browser Extensions through Page-Visible Execution Traces and Interactions", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] added more. Two of these papers make the same uncomfortable point: extensions installed for privacy are themselves fingerprintable, and one study found that 82.5% of the extensions it detected remained detectable after their next update [4Laperdrix, Pierre; Starov, Oleksii; Chen, Quan; Kapravelos, Alexandros; Nikiforakis, Nick (2021): "Fingerprinting in Style: Detecting Browser Extensions via Injected Style Sheets", in: Proceedings of the USENIX Security Symposium. (Link)].

This section is the reason to read this page before doing a literature search. Every figure below comes from a structured extraction over 5,859 full-text papers from CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf and IEEE S&P, 2010–2026, in which each paper contributes one record with a verbatim evidence quote per claim. The 2025 and 2026 venue-years are provisional — CCS and IMC 2026 have not been held and two more 2026 venue-years are incompletely selected — so read any row that reaches them as a floor. The population here is the 280 papers whose detection.phenomenon field names a fingerprint — not the whole corpus, and not the 5,655 papers that detected something.

Those 280 papers produce 459 distinct free-text descriptions. That is the whole problem: the field is not a vocabulary, and no exact-string aggregation over it means anything. After folding (method at the end of this section):

Eighteen papers (6.4%) fall in more than one family, so shares exceed 100%. The practical consequences:

• A keyword search on “fingerprint” over a security corpus is about 30% precise for browser fingerprinting. If you are building a related-work section, “website fingerprinting” is the false-friend that will dominate your results.
• Both literatures are the same size and both are growing. Per 1,000 corpus papers, browser fingerprinting goes 5.9 → 13.0 → 16.0 → 14.8 → 15.2 across 2010–2013, 2014–2017, 2018–2021, 2022–2024 and the provisional 2025–2026; website fingerprinting goes 13.7 → 14.3 → 17.4 → 17.9 → 22.8. Neither is displacing the other, and in the last window traffic fingerprinting pulls ahead — on two incomplete venue-years, so do not lean on it.
• They do not cite each other and they do not share methods. One drives instrumented browsers over crawls; the other trains classifiers on packet traces. Reviewers from one side routinely read submissions from the other.

PETS is the densest venue by a factor of two to three, which matches where the community sits — but the absolute numbers are small everywhere. This is an 83-paper literature across seventeen years and seven venues. It is small enough to read in full, and this page's report script prints the list.

detection.phenomenon is one of the three least reproducible fields in the extraction: two independent runs over identical text agree on roughly 20% of exact free-text strings. It can carry a ranking; it cannot carry a precise percentage. The fold used here is in scripts/fp_fold.mjs below and works in three passes:

1. Strong patterns, ordered, matching the subject of the fingerprint — a named web API, a Tor circuit, a biometric sensor, a TLS stack. First match wins, because the discriminating word is the qualifier and not the head noun: “website fingerprinting” and “canvas fingerprinting” share the noun and share nothing else. This resolved 441 of 544 tuples.
2. Property-only strings, resolved by paper context. 95 of the 544 strings name only a property — “fingerprint stability”, “fingerprint uniqueness”, “fingerprint comparison speed” — and are genuinely unresolvable in isolation: “fingerprint comparison speed” is a PGP key fingerprint, “font fingerprint uniqueness” is a browser. Such a tuple inherits the family of a strong tuple in the same paper. This resolved 76 more.
3. Hand verification of what was left, by reading each evidence.quote and the paper title. Nineteen assignments are recorded by hand in the script, each with its reason inline; seven tuples in six papers could not be assigned at all and are printed rather than dropped. All six are genuinely something else: malware feature hashing, textual PGP key-fingerprint representations, Tor relay identity keys, Zcash transaction values, and two memory side-channel papers that fingerprint which application is resident in a confidential VM.

The fold had to be extended for this corpus. On the 4,322-paper corpus the residue was 5 tuples in 4 papers; the 2025–2026 papers took it to 59 tuples in 31 papers before the patterns were widened. What arrived was mostly new subject matter rather than new phrasing — DPI-device fingerprinting, ad-blocker and filter-list fingerprintability, LLM identification, AR/VR app inference, mobile fingerprinting SDKs. fingerprinting lists every string and where it went.

Population for everything in this section: the 83 browser-fingerprinting papers identified above. Sentinel values (not-stated) are counted as what they are and never as answers.

Two of these are worth pausing on. 65.1% also propose a system, attack or defence — this is a literature where measuring and building are the same paper, so a “prevalence of fingerprinting” number is very often a by-product of evaluating a detector rather than the study's primary object. And 92.8% released an artifact link, well above the corpus-wide rate (66.2% for 2024, 76.9% for 2025), which is the single best practical fact on this page: the detectors are almost all available.

Ranked, not precise — searched across the phenomenon, technique, metric and prevalence text of each paper's fingerprint tuples, because a paper enumerating twenty APIs still writes only “browser fingerprinting” in a ten-word summary field.

The top two rows are the structural finding, and on the extended corpus they have swapped: uniqueness/entropy is now marginally ahead of script detection, 34 papers to 33, where on the 4,322-paper corpus they were tied at 25. The point is unchanged. One of the two most common things a browser-fingerprinting paper detects is not a fingerprint — it is a script that takes one. That is a different measurement problem with a different failure mode: you are classifying JavaScript, so your ground truth is a filter list or a hand-labelled sample, and your recall is bounded by which scripts your crawler happened to load. It is why this page's tooling section is mostly about JavaScript instrumentation and not about attribute collection.

Four widely cited figures, each verbatim from the paper:

Every axis moves between rows: the rank cut (10K / 100K / 1M), the unit (site, script, provider), and the definition of fingerprinting (three named vendors / one API / any of several APIs / a learned classifier). Rizzo et al. [11Rizzo, Valentino; Traverso, Stefano; Mellia, Marco (2021): "Unveiling Web Fingerprinting in the Wild Via Code Mining and Machine Learning", in: Proceedings on Privacy Enhancing Technologies. (DOI)] report the same year as Iqbal et al. that “only 1.1% of scripts is classified as actual fingerprinting” — a number an order of magnitude apart from 10.18% and not in conflict with it, because one counts scripts and the other counts sites.

If you need a trend, the two studies that hold the method fixed and vary time are the ones to use: Lerner et al.'s archaeology of archived pages [12Lerner, Ada; Simpson, Anna Kornfeld; Kohno, Tadayoshi; Roesner, Franziska (2016): "Internet Jones and the Raiders of the Lost Trackers: An Archaeological Study of Web Tracking from 1996 to 2016", in: Proceedings of the USENIX Security Symposium. (Link)] and FP-Radar's longitudinal API-graph analysis [13Bahrami, Pouneh Nikkhah; Iqbal, Umar; Shafiq, Zubair (2022): "FP-Radar: Longitudinal Measurement and Early Detection of Browser Fingerprinting", in: Proceedings on Privacy Enhancing Technologies. (DOI)]. Both find growth; neither does it by comparing other people's percentages.

Uniqueness is the field's headline claim and its most fragile one, because it is a property of the population you sampled, not of the technique. The two studies that bracket the question:

• Eckersley's Panopticlick data [2Eckersley, Peter (2010): "How Unique Is Your Web Browser?", in: Proceedings of the Privacy Enhancing Technologies Symposium, pp. 1-18. (DOI)] found the great majority of participating browsers unique — from a self-selected, privacy-interested visitor population.
• Gulyás et al. [14Gulyás, Gábor György; Ács, Gergely; Castelluccia, Claude (2016): "Near-Optimal Fingerprinting with Constraints", in: Proceedings on Privacy Enhancing Technologies. (DOI)] formalised the other direction — given a budget of k attributes, which set identifies the most users — and reported that detecting just 10 fonts uniquely identified 13,155 users (30.13%) in their dataset.
• Gómez-Boix et al. [15Gómez-Boix, Alejandro; Laperdrix, Pierre; Baudry, Benoit (2018): "Hiding in the Crowd: an Analysis of the Effectiveness of Browser Fingerprinting at Large Scale", in: Proceedings of the ACM Web Conference. (DOI)] re-ran the measurement on 2 million fingerprints from a general-audience French website and found 33.6% unique overall — 35.7% on desktop and 18.5% on mobile. Mobile browsers are much more homogeneous: same OS build, same font set, no plugins.

That gap is a sampling artefact of the kind Biases is about, and it is the reason a uniqueness figure without its recruitment description is not usable. Berke et al.'s PoPETs 2025 study [16Berke, Alex; Calacci, Dan; Mahari, Robert; Yabe, Takahiro; Larson, Kent; Pentland, Sandy (2025): "How Unique is Whose Web Browser? The Role of Demographics in Browser Fingerprinting Among US Users", Proceedings on Privacy Enhancing Technologies 2025(1):720-758. (DOI)] extends the point to demographics, linking fingerprints to a consented US panel and showing that identifiability is not evenly distributed across users.

Stability closes the loop, because a unique fingerprint that changes is not an identifier. FP-Stalker [17Vastel, Antoine; Laperdrix, Pierre; Rudametkin, Walter; Rouvoy, Romain (2018): "FP-STALKER: Tracking Browser Fingerprint Evolutions", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] measured evolution directly: 50% of browser instances changed fingerprint in under 5 days, 80% in under 10 days — and then showed that a linking algorithm recovers the identity anyway, tracking for a median of 54.48 days. Pugliese et al. [18Pugliese, Gaston; Riess, Christian; Gassmann, Freya; Benenson, Zinaida (2020): "Long-Term Observation on Browser Fingerprinting: Users’ Trackability and Perspective", in: Proceedings on Privacy Enhancing Technologies. (DOI)] ran the longest observation, over years and with a participant survey attached. DRAWN APART [19Laor, Tomer; Mehanna, Naif; Durey, Antonin; Dyadyuk, Vitaly; Laperdrix, Pierre; Maurice, Clémentine; Oren, Yossi; Rouvoy, Romain; Rudametkin, Walter; Yarom, Yuval (2022): "DRAWN APART: A Device Identification Technique based on Remote GPU Fingerprinting", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] adds a hardware-level GPU signal specifically to attack the stability limit, raising median tracking time from 17.5 to 28 days when combined with FP-Stalker.

The 83 papers split into two research programmes that use the same instrumentation:

Detecting fingerprinting — the classifier lineage. Heuristic API-access counting (Acar et al., Englehardt & Narayanan) gave way to learned script classifiers: FP-Inspector [10Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair (2021): "Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] on syntactic and dynamic JS features, FP-Radar [13Bahrami, Pouneh Nikkhah; Iqbal, Umar; Shafiq, Zubair (2022): "FP-Radar: Longitudinal Measurement and Early Detection of Browser Fingerprinting", in: Proceedings on Privacy Enhancing Technologies. (DOI)] on the co-occurrence graph of API accesses over time, automatic discovery of emerging techniques [20Su, Junhua; Kapravelos, Alexandros (2023): "Automatic Discovery of Emerging Browser Fingerprinting Techniques", in: Proceedings of the ACM Web Conference. (DOI)], taint tracking with entropy thresholds in FP-Tracer [21Boussaha, Soumaya; Hock, Lukas; Bermejo, Miguel; Rumín, Rubén Cuevas; Rumín, Ángel Cuevas; Klein, David; Johns, Martin; Compagna, Luca; Antonioli, Daniele; Barber, Thomas (2024): "FP-tracer: Fine-grained Browser Fingerprinting Detection via Taint-tracking and Entropy-based Thresholds", in: Proceedings on Privacy Enhancing Technologies. (DOI)], and federated detection without centralising crawl data in FP-Fed [22Annamalai, Meenatchi Sundaram Muthu Selva; Bilogrevic, Igor; Cristofaro, Emiliano De (2024): "FP-Fed: Privacy-Preserving Federated Detection of Browser Fingerprinting", in: Proceedings of the Network and Distributed System Security Symposium. (Link)]. Rizzo et al. [11Rizzo, Valentino; Traverso, Stefano; Mellia, Marco (2021): "Unveiling Web Fingerprinting in the Wild Via Code Mining and Machine Learning", in: Proceedings on Privacy Enhancing Technologies. (DOI)] come at it from code mining instead.

Evaluating and building defences — PriVaricator [23Nikiforakis, Nick; Joosen, Wouter; Livshits, Benjamin (2015): "PriVaricator: Deceiving Fingerprinters with Little White Lies", in: Proceedings of the ACM Web Conference. (DOI)] introduced randomisation (“little white lies”) as an alternative to uniformity, and reported breaking four named commercial fingerprinters. FP-Scanner [24Vastel, Antoine; Laperdrix, Pierre; Rudametkin, Walter; Rouvoy, Romain (2018): "Fp-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies", in: Proceedings of the USENIX Security Symposium. (Link)] then attacked the defences: it detects inconsistencies introduced by spoofing extensions, reaching accuracy 1.0 on its test set — a browser lying badly about itself is more identifiable, not less. Datta et al. [25Datta, Amit; Lu, Jianan; Tschantz, Michael Carl (2019): "Evaluating Anti-Fingerprinting Privacy Enhancing Technologies", in: Proceedings of the ACM Web Conference. (DOI)] evaluated anti-fingerprinting PETs side by side and found Tor Browser most effective, under 3 bits of entropy remaining.

Three papers measure fingerprinting where it is used for security rather than tracking, which is a framing this page's readers should not lose: on phishing pages [26Sánchez-Rola, Iskander; Bilge, Leyla; Balzarotti, Davide; Buescher, Armin; Efstathopoulos, Petros (2023): "Rods with Laser Beams: Understanding Browser Fingerprinting on Phishing Pages", in: Proceedings of the USENIX Security Symposium. (Link)], in phishing-kit cloaking (96.52% of 2,933 kits used fingerprinting-based cloaking) [27Zhang, Penghui; Sun, Zhibo; Kyung, Sukwha; Behrens, Hans Walter; Basque, Zion Leonahenahe; Cho, Haehyun; Oest, Adam; Wang, Ruoyu; Bao, Tiffany; Shoshitaishvili, Yan; Ahn, Gail-Joon; Doupé, Adam (2022): "I'm SPARTACUS, No, I'm SPARTACUS: Proactively Protecting Users from Phishing by Intentionally Triggering Cloaking Behavior", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)], and in adversarial-versus-benign fingerprint populations at commercial scale, where only 1.6% of unique fingerprints were shared between the two [28Wu, Shujiang; Sun, Pengfei; Zhao, Yao; Cao, Yinzhi (2023): "Him of Many Faces: Characterizing Billion-scale Adversarial and Benign Browser Fingerprints on Commercial Websites", in: Proceedings of the Network and Distributed System Security Symposium. (Link)].

Tools each paper used or produced (usedOrMentioned filtered, so a baseline someone compared against does not read as adoption), folded across spellings:

Read the top of that table carefully. The most-used resource in the browser-fingerprinting literature is an ad-blocking filter list, and the same holds for ground truth: of the classification resources these papers name, EasyList/EasyPrivacy (17 papers) and Disconnect (13) outrank every purpose-built fingerprinting resource. Filter lists were not built to label fingerprinting — EasyPrivacy blocks trackers, and fingerprinting scripts are a subset that overlaps imperfectly. Using one as ground truth caps your measurable recall at the list's coverage and imports its known bias against the long tail (see Requests on why up to 90% of EasyList resource rules provide no benefit in common browsing).

FingerprintJS at 16.9% is the mirror image: papers use the attacker's library as a positive control, checking whether a script contains its magic strings. OmniCrawl [29Cassel, Darion; Lin, Su-Chin; Buraggina, Alessio; Wang, William; Zhang, Andrew; Bauer, Lujo; Hsiao, Hsu-Chun; Jia, Limin; Libert, Timothy (2022): "OmniCrawl: Comprehensive Measurement of Web Tracking With Real Desktop and Mobile Browsers", in: Proceedings on Privacy Enhancing Technologies. (DOI)] found that 277 of 1,444 fingerprinting-matching scripts (14%) contained all the fingerprintjs2 magic strings — good for precision, useless for anything the library does not do.

Of the 83 papers, 57 ran a crawl and all 57 recorded a configuration. They report their setup better than the corpus average on every axis:

Browsers actually driven: Chrome/Chromium 29 papers, Firefox 17, then single papers using Internet Explorer, Opera, Brave, Tor Browser, DuckDuckGo, Ghostery, Android WebView and Spartacus. The privacy-browser tail is thin, which matters because a defence study needs the browser whose defence it is testing. Note also Stateful stateless: only 36.8% state statefulness, and for fingerprinting the choice is not neutral — a stateless crawl sees the script's first-visit behaviour only.

Only 10 of 83 papers (12.0%) assess a law, against 6.9% corpus-wide (402 of 5,859) — so not quite twice the corpus rate, and still an outlier practice. Folded, the laws are GDPR (9 papers) and the ePrivacy Directive (4 papers, appearing under three different spellings including “European directives 2002/58/CE and 2009/136/CE”), then CCPA (3), plus one each of the UK Digital Economy Act, Brazil's LGPD, COPPA and the DSA. The papers that do it are the ones joining fingerprinting to consent: cookie respawning with fingerprinting [30Fouad, Imane; Santos, Cristiana; Legout, Arnaud; Bielova, Nataliia (2022): "My Cookie is a phoenix: Detection, measurement, and lawfulness of cookie respawning with browser fingerprinting", in: PETS 2022-22nd Privacy Enhancing Technologies Symposium. (DOI) (Link)], and post-cookie tracking that bypasses a GDPR consent choice [31Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2021): "User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users", in: Proceedings of the ACM Web Conference. (DOI)].

This is a gap, not a finding about the law. Fingerprinting has no consent API, so the compliance question — can a technique that cannot be refused ever rest on consent? — is squarely open, and became sharper in 2025 (see below). See Consent and Legal enforcement.

19 papers (22.9%) recruited participants, which is how uniqueness gets measured at all: you cannot compute an anonymity set from a crawl. Recruitment is bimodal — Mechanical Turk and other crowd platforms for the attack-feasibility studies (n ≈ 1,000–2,300), professional networks and volunteer panels for the longitudinal ones (Pugliese et al. ran three waves of 2,315 / 1,275 / 243 [18Pugliese, Gaston; Riess, Christian; Gassmann, Freya; Benenson, Zinaida (2020): "Long-Term Observation on Browser Fingerprinting: Users’ Trackability and Perspective", in: Proceedings on Privacy Enhancing Technologies. (DOI)]), and one 52,000-user browser-telemetry study [32Zeber, David; Bird, Sarah; Oliveira, Camila; Rudametkin, Walter; Segall, Ilana; Wolls´en, Fredrik; Lopatka, Martin (2020): "The Representativeness of Automated Web Crawls as a Surrogate for Human Browsing", in: Proceedings of The Web Conference 2020, pp. 167–178. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)]. If you are planning a uniqueness measurement, read User studies and Ethics first: you are collecting a device identifier from participants, which is personal data under GDPR regardless of your intent.

The report script prints every number on this page with its denominator, the unmapped residue, and the full 83-paper list. The folding rules live in a separate module so they can be audited and reused.

fp_fold.mjs

// Folding rules for the word "fingerprint" in a free-text `phenomenon` field.
//
// Three passes, because one regex cannot do it:
//   1. STRONG  — ordered patterns naming the SUBJECT of the fingerprint
//                (a web API, a Tor circuit, a biometric sensor, a TLS stack).
//                First match wins: the qualifier discriminates, not the head
//                noun -- "website fingerprinting" and "canvas fingerprinting"
//                share the noun and share nothing else.
//   2. GENERIC — strings naming only a PROPERTY ("fingerprint stability",
//                "fingerprint uniqueness") are unresolvable in isolation, so
//                they inherit the family of a strong tuple in the same paper.
//   3. HAND    — the residue, resolved by reading each evidence quote, with
//                the reason recorded. Anything still unresolved is PRINTED.
//
// Excerpt; the full module and the per-page report are in the wiki repository.
 
export const STRONG = [
  // Human biometrics first: "fingerprint sensor/template/image" is a finger.
  ['biometric', /\b(biometric|minutia|fingerprint (sensor|template|image|reader|spoofing))/i],
  // Physical-object and hardware forensics.
  ['physical-forensic', /\b(prnu|paper speckle|clock[- ]skew|accelerometer|gyroscope|acoustic)/i],
  // Encrypted-traffic analysis: the OTHER fingerprinting literature.
  ['traffic-analysis', /\b(website|web ?page|traffic|packet|hidden.service|\btor\b|open-world)/i],
  // Remote host and network-stack identification.
  ['network-stack', /\b(tls|ja3|\bos fingerprint|middlebox|router|web-?server|protocol fingerprint)/i],
  // LLM / model identification. New in 2025; before browser-device so that
  // "LLM version fingerprinting" is not swallowed by a generic pattern.
  ['llm-model', /\b(llm (version )?fingerprint|large language model|known-llm)/i],
  // Browser fingerprinting: named web APIs or an explicit browser qualifier.
  ['browser-device', /\b(canvas|webgl|audiocontext|font|screen|navigator|browser|fingerprinting script|fingerprinter|extension)/i],
];
 
export const GENERIC =
  /^(?=.*fingerprint)(?!.*(?:website|canvas|browser)).*\b(stability|uniqueness|longevity|evolution|resistance|comparison)\b/i;
 
export function classifyPaper(phenomena, slug = '') {
  const first = phenomena.map((s) => ({ phenomenon: s, family: strongFamilyOf(s) }));
  // Majority strong family in this paper wins the generics; ties break by the
  // STRONG order above, which is the order of decreasing confidence.
  const votes = new Map();
  for (const t of first) if (t.family) votes.set(t.family, (votes.get(t.family) ?? 0) + 1);
  const order = STRONG.map(([n]) => n);
  const context = [...votes.entries()]
    .sort((a, b) => b[1] - a[1] || order.indexOf(a[0]) - order.indexOf(b[0]))[0]?.[0] ?? null;
  return first.map((t) => {
    if (t.family) return { ...t, resolvedBy: 'string' };
    if (context) return { phenomenon: t.phenomenon, family: context, resolvedBy: 'paper-context' };
    const hand = HAND.get(`${slug}|${t.phenomenon}`);
    if (hand) return { phenomenon: t.phenomenon, family: hand[0], resolvedBy: 'hand' };
    return { phenomenon: t.phenomenon, family: 'unmapped', resolvedBy: 'none' };
  });
}

Real output of the classification pass:

corpus                                        5859 papers
detection fired at all                        5655 papers
phenomenon names a fingerprint                280 papers
only the technique does (excluded)            103 papers

459 distinct free-text strings across 280 papers.

What was being fingerprinted               Papers  Share of 280  Distinct strings
-----------------------------------------  ------  ------------  ----------------
Website / traffic fingerprinting           105     37.5%         136
Browser fingerprinting (the web platform)  83      29.6%         156
Remote host & network-stack ID             38      13.6%         53
Physical-object & hardware forensics       28      10.0%         54
Human biometrics                           16      5.7%          24
Off-web device identification              13      4.6%          18
Media content identification               8       2.9%          11
unmapped                                   6       2.1%          7
Analysis-environment evasion               2       0.7%          4
LLM / model identification                 1       0.4%          4

Shares exceed 100%: 18 papers (6.4%) fall in more than one family.

Tuples: 544 total — 441 resolved by the string, 76 by paper context
(property-only strings), 7 unresolved.
95 of 544 strings name only a property of a fingerprint, not its subject.

Unmapped residue (printed in full): 7 tuples, 6 papers
  CCS/2011/bitshred-feature-hashing-malware-for-scalable-triage-and-semantic-analysis
      Fingerprint similarity approximation
  USENIX/2016/an-empirical-study-of-textual-key-fingerprint-representations
      Fingerprint comparison speed
  USENIX/2016/identifying-and-characterizing-sybils-in-the-tor-network
      Fingerprint changes
  CCS/2019/privacy-aspects-and-subliminal-channels-in-zcash
      value fingerprinting
  CCS/2019/privacy-aspects-and-subliminal-channels-in-zcash
      fingerprint survival
  USENIX/2025/shadows-in-cipher-spaces-exploiting-tweak-repetition-in-hardware-memory-encrypti
      Application page fingerprints
  NDSS/2026/snpeek-side-channel-analysis-for-privacy-applications-on-confidential-vms
      PHH fingerprinting leakage

• Seven venues only. CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P, 2010–2026, with 2025 and 2026 provisional. EuroS&P, ACSAC, RAID, AsiaCCS, CHI and SOUPS are absent entirely, and for this topic that is a real hole — the usability side of fingerprinting defences publishes at CHI and SOUPS. Every claim here is a claim about those seven venues.
• One paper is double-counted. DRAWN APART [19Laor, Tomer; Mehanna, Naif; Durey, Antonin; Dyadyuk, Vitaly; Laperdrix, Pierre; Maurice, Clémentine; Oren, Yossi; Rouvoy, Romain; Rudametkin, Walter; Yarom, Yuval (2022): "DRAWN APART: A Device Identification Technique based on Remote GPU Fingerprinting", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] appears twice in the NDSS 2022 index, once under its title slug and once as auto-draft-242, so the 83 is 82 distinct papers. Counts elsewhere on the page carry the same one-paper error. Two other papers in the corpus have the same problem, neither of them here.
• Silence is not absence. “Does not state whether it ran headless” means the paper did not say. These are reporting figures, not practice figures.
• Field stability. Enum fields (platforms, crawlConfig.*, legal.law) reproduce to within a few points on a repeat extraction and carry percentages here. detection.phenomenon does not, which is what the whole folding exercise is for — the family table is a set of rankings with an honest residue, not a measurement.
• The 83 is a floor. A paper that studies fingerprinting without the extractor recording a fingerprint-named phenomenon is missing from it. 103 further papers name a fingerprint only in the technique field and were deliberately excluded, since “we detected X by fingerprinting the TLS stack” is a paper about X.
• Quotes were spot-checked. scripts/quote_check.mjs –detection fingerprint verifies the evidence quotes behind this page in bulk against paper.cols.txt; the results, and the ones that had to be read by hand, are on fingerprinting. The dataset's own “0.9% of quotes could not be located” figure was measured on the earlier 4,322-paper run and has not been re-measured.
• Every query behind this section, the report script and its unedited output are on fingerprinting; corpus-level caveats are on corpus.

Browser defences matter here twice: as the object of study, and as a confound in your own crawl. There are only two strategies, and they are incompatible.

Two implications for a study design:

1. Uniformity and randomisation are measured differently. Against a uniformity defence you measure how many users share a bucket; against farbling you measure whether values are linkable across sessions. A protocol written for one gives a meaningless answer against the other, and this is a common flaw in defence comparisons.
2. Your own crawler's browser is a defence configuration. A 2026 Firefox with FPP on by default in Standard mode is not the browser that older papers measured with. State the browser, the version, and the fingerprinting-protection settings — the 19.6% of crawling papers in the corpus that state statefulness are ahead of the field, and fingerprinting-protection state is reported even less often than that.

• OpenWPM — the standard instrumented crawler; its JavaScript instrumentation records every access to a configured API surface, with call arguments and stack, which is the raw material every detector on this page consumes. 15 of the 83 papers use it. See OpenWPM.
• FP-Inspector [10Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair (2021): "Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] — the most-used purpose-built classifier in the corpus (4 papers). Treat it as a research artifact frozen at its 2021 paper, not a maintained tool: useful for its classifier, feature set and labelled script list; expect to port it.
• DuckDuckGo Tracker Radar Collector — a lighter Puppeteer-based collector with an API-access collector built in; 6 papers. See Tracker radar collector.
• Filter lists — EasyPrivacy and Disconnect are what most papers actually use for ground truth. Read the caveat above before you do the same, and see Requests for how to apply them in post-processing rather than during the crawl.

Run these against your crawler before you trust it, not just against your laptop:

• EFF Cover Your Tracks — the successor to Panopticlick; reports bits of identifying information per attribute and whether your browser has a unique fingerprint among its sample.
• AmIUnique — the research platform behind several of the papers above (Univ. Lille); shows your attribute vector and its rarity in their dataset.
• BrowserLeaks — per-surface test pages (canvas, WebGL, fonts, WebRTC, TLS/JA3–JA4, IP). The most useful for isolating which surface changed after a configuration change.
• CreepJS — aggressive detection of lies and inconsistencies: it is the closest public analogue to FP-Scanner [24Vastel, Antoine; Laperdrix, Pierre; Rudametkin, Walter; Rouvoy, Romain (2018): "Fp-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies", in: Proceedings of the USENIX Security Symposium. (Link)] and the fastest way to discover that your stealth plugin is making you more identifiable.
• FPMON — a browser extension that reports, in real time, which fingerprinting-relevant APIs the current page touched. Handy for a spot check on a site your pipeline flagged.
• FingerprintJS — the open-source library, used as a positive control by 14 of the 83 papers. Licence history matters if you vendor it: MIT, then Business Source License 1.1 for the 4.x series, back to MIT from 5.0.0 (current npm release 5.2.0, MIT, checked 2026-08-05). The hosted Fingerprint Pro product is separate and proprietary.

Anything that makes your crawler distinguishable from a browser also makes it a target for cloaking. Check at minimum:

1. navigator.webdriver — true under Selenium and plain Playwright/Puppeteer; a two-line tell.
2. Headless-specific values: empty navigator.plugins, missing window.chrome, HeadlessChrome in the UA string, a Google/SwiftShader WebGL vendor string instead of the host GPU's.
3. Font set and canvas hash from inside the container, which is usually a Docker image with a minimal font list and software rendering — a highly distinctive combination.
4. Whether the fingerprinting scripts you detected are the same set a headful browser on the same page loads. FP-Fed [22Annamalai, Meenatchi Sundaram Muthu Selva; Bilogrevic, Igor; Cristofaro, Emiliano De (2024): "FP-Fed: Privacy-Preserving Federated Detection of Browser Fingerprinting", in: Proceedings of the Network and Distributed System Security Symposium. (Link)] measures precisely this gap.

puppeteer-extra-plugin-stealth patches many of the obvious tells and appears in two corpus papers. Do not treat it as a solution: CreepJS and FP-Scanner-style consistency checks defeat it, and a partially-patched browser occupies an anonymity set of one. If detectability matters to your result, measure it and report it rather than assuming it away.

• No pre/post comparison across Google's 16 February 2025 policy change. Luo et al. [33Luo, Elisa; Ritter, Tom; Savage, Stefan; Voelker, Geoffrey M. (2025): "Canvassing the Fingerprinters: Characterizing Canvas Fingerprinting Use Across the Web", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] now supply a post-reversal canvas-fingerprinting baseline (May 2025, 12.7% of the top 20K), so what is missing is the same instrument run on both sides of the date rather than any measurement at all. The pre-side baseline data (FP-Radar, FP-Inspector) is public.
• Partly answered since this page was written. Annamalai et al. [34Annamalai, Meenatchi Sundaram Muthu Selva; De Cristofaro, Emiliano; Bilogrevic, Igor (2025): "Beyond the Crawl: Unmasking Browser Fingerprinting in Real User Interactions", in: Proceedings of the ACM Web Conference. (DOI)] compared real user sessions against an automated crawl of the same sites and found the crawl missed 211 of 471 fingerprinting websites (45%) — the first published size for this gap. What is still open is the narrower question: how much of that 45% is headless versus headful as opposed to interaction depth, authentication and consent, which the paper attributes it to.
• Prevalence figures are incomparable across papers because unit, rank cut and definition all vary. A shared benchmark — a fixed site sample with hand-labelled ground truth — does not exist for fingerprinting the way EasyList serves ad-blocking research.
• Consent and fingerprinting: only 10 of 83 papers touch a law, and none in the corpus tests whether a CMP's consent signal changes fingerprinting behaviour on the same site. Combining this page's detection tooling with Consent's CMP interaction is a well-defined study.
• Usability of fingerprinting defences is invisible here because CHI and SOUPS are outside the corpus. Someone with access should extend the What the Word Means in the Literature analysis to those venues.

• Cookies — the stateful counterpart; fingerprinting and cookies are used together, and respawning links them directly [30Fouad, Imane; Santos, Cristiana; Legout, Arnaud; Bielova, Nataliia (2022): "My Cookie is a phoenix: Detection, measurement, and lawfulness of cookie respawning with browser fingerprinting", in: PETS 2022-22nd Privacy Enhancing Technologies Symposium. (DOI) (Link)].
• JavaScript — classifying the scripts that 39.8% of these papers are actually detecting.
• Requests — the filter lists that most of this literature uses as ground truth, and why that is a compromise.
• Consent — the open compliance question: a technique with no refusal mechanism.
• Website classification — where fingerprinting sits in the wider classification taxonomy.
• OpenWPM and Tracker radar collector — the two instrumented crawlers this page depends on.
• Stateful stateless — only 36.8% of these papers state it, and for fingerprinting it changes what you see.
• Crawling location — the other axis a fingerprinting crawl is judged on.
• Biases — why a uniqueness percentage is a property of your sample.

[1]

Laperdrix, Pierre; Bielova, Nataliia; Baudry, Benoit; Avoine, Gildas (2020): "Browser Fingerprinting: A Survey", ACM Transactions on the Web 14(2). (DOI)

[2]

Eckersley, Peter (2010): "How Unique Is Your Web Browser?", in: Proceedings of the Privacy Enhancing Technologies Symposium, pp. 1-18. (DOI)

[3]

Karami, Soroush; Ilia, Panagiotis; Solomos, Konstantinos; Polakis, Jason (2020): "Carnus: Exploring the Privacy Threats of Browser Extension Fingerprinting", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[4]

Laperdrix, Pierre; Starov, Oleksii; Chen, Quan; Kapravelos, Alexandros; Nikiforakis, Nick (2021): "Fingerprinting in Style: Detecting Browser Extensions via Injected Style Sheets", in: Proceedings of the USENIX Security Symposium. (Link)

[5]

Agarwal, Shubham; Fass, Aurore; Stock, Ben (2024): "Peeking through the window: Fingerprinting Browser Extensions through Page-Visible Execution Traces and Interactions", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[6]

Chalise, Shekhar; Nguyen, Hoang Dai; Vadrevu, Phani (2022): "Your speaker or my snooper?: measuring the effectiveness of web audio browser fingerprints", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[7]

Nikiforakis, Nick; Kapravelos, Alexandros; Joosen, Wouter; Kruegel, Christopher; Piessens, Frank; Vigna, Giovanni (2013): "Cookieless Monster: Exploring the Ecosystem of Web-Based Device Fingerprinting", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[8]

Acar, Gunes; Eubank, Christian; Englehardt, Steven; Juarez, Marc; Narayanan, Arvind; Díaz, Claudia (2014): "The Web Never Forgets: Persistent Tracking Mechanisms in the Wild", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[9]

Englehardt, Steven; Narayanan, Arvind (2016): "Online Tracking: A 1-million-site Measurement and Analysis", in: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp. 1388–1401. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[10]

Iqbal, Umar; Englehardt, Steven; Shafiq, Zubair (2021): "Fingerprinting the Fingerprinters: Learning to Detect Browser Fingerprinting Behaviors", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[11]

Rizzo, Valentino; Traverso, Stefano; Mellia, Marco (2021): "Unveiling Web Fingerprinting in the Wild Via Code Mining and Machine Learning", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[12]

Lerner, Ada; Simpson, Anna Kornfeld; Kohno, Tadayoshi; Roesner, Franziska (2016): "Internet Jones and the Raiders of the Lost Trackers: An Archaeological Study of Web Tracking from 1996 to 2016", in: Proceedings of the USENIX Security Symposium. (Link)

[13]

Bahrami, Pouneh Nikkhah; Iqbal, Umar; Shafiq, Zubair (2022): "FP-Radar: Longitudinal Measurement and Early Detection of Browser Fingerprinting", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[14]

Gulyás, Gábor György; Ács, Gergely; Castelluccia, Claude (2016): "Near-Optimal Fingerprinting with Constraints", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[15]

Gómez-Boix, Alejandro; Laperdrix, Pierre; Baudry, Benoit (2018): "Hiding in the Crowd: an Analysis of the Effectiveness of Browser Fingerprinting at Large Scale", in: Proceedings of the ACM Web Conference. (DOI)

[16]

Berke, Alex; Calacci, Dan; Mahari, Robert; Yabe, Takahiro; Larson, Kent; Pentland, Sandy (2025): "How Unique is Whose Web Browser? The Role of Demographics in Browser Fingerprinting Among US Users", Proceedings on Privacy Enhancing Technologies 2025(1):720-758. (DOI)

[17]

Vastel, Antoine; Laperdrix, Pierre; Rudametkin, Walter; Rouvoy, Romain (2018): "FP-STALKER: Tracking Browser Fingerprint Evolutions", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)

[18]

Pugliese, Gaston; Riess, Christian; Gassmann, Freya; Benenson, Zinaida (2020): "Long-Term Observation on Browser Fingerprinting: Users’ Trackability and Perspective", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[19]

Laor, Tomer; Mehanna, Naif; Durey, Antonin; Dyadyuk, Vitaly; Laperdrix, Pierre; Maurice, Clémentine; Oren, Yossi; Rouvoy, Romain; Rudametkin, Walter; Yarom, Yuval (2022): "DRAWN APART: A Device Identification Technique based on Remote GPU Fingerprinting", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[20]

Su, Junhua; Kapravelos, Alexandros (2023): "Automatic Discovery of Emerging Browser Fingerprinting Techniques", in: Proceedings of the ACM Web Conference. (DOI)

[21]

Boussaha, Soumaya; Hock, Lukas; Bermejo, Miguel; Rumín, Rubén Cuevas; Rumín, Ángel Cuevas; Klein, David; Johns, Martin; Compagna, Luca; Antonioli, Daniele; Barber, Thomas (2024): "FP-tracer: Fine-grained Browser Fingerprinting Detection via Taint-tracking and Entropy-based Thresholds", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[22]

Annamalai, Meenatchi Sundaram Muthu Selva; Bilogrevic, Igor; Cristofaro, Emiliano De (2024): "FP-Fed: Privacy-Preserving Federated Detection of Browser Fingerprinting", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[23]

Nikiforakis, Nick; Joosen, Wouter; Livshits, Benjamin (2015): "PriVaricator: Deceiving Fingerprinters with Little White Lies", in: Proceedings of the ACM Web Conference. (DOI)

[24]

Vastel, Antoine; Laperdrix, Pierre; Rudametkin, Walter; Rouvoy, Romain (2018): "Fp-Scanner: The Privacy Implications of Browser Fingerprint Inconsistencies", in: Proceedings of the USENIX Security Symposium. (Link)

[25]

Datta, Amit; Lu, Jianan; Tschantz, Michael Carl (2019): "Evaluating Anti-Fingerprinting Privacy Enhancing Technologies", in: Proceedings of the ACM Web Conference. (DOI)

[26]

Sánchez-Rola, Iskander; Bilge, Leyla; Balzarotti, Davide; Buescher, Armin; Efstathopoulos, Petros (2023): "Rods with Laser Beams: Understanding Browser Fingerprinting on Phishing Pages", in: Proceedings of the USENIX Security Symposium. (Link)

[27]

Zhang, Penghui; Sun, Zhibo; Kyung, Sukwha; Behrens, Hans Walter; Basque, Zion Leonahenahe; Cho, Haehyun; Oest, Adam; Wang, Ruoyu; Bao, Tiffany; Shoshitaishvili, Yan; Ahn, Gail-Joon; Doupé, Adam (2022): "I'm SPARTACUS, No, I'm SPARTACUS: Proactively Protecting Users from Phishing by Intentionally Triggering Cloaking Behavior", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[28]

Wu, Shujiang; Sun, Pengfei; Zhao, Yao; Cao, Yinzhi (2023): "Him of Many Faces: Characterizing Billion-scale Adversarial and Benign Browser Fingerprints on Commercial Websites", in: Proceedings of the Network and Distributed System Security Symposium. (Link)

[29]

Cassel, Darion; Lin, Su-Chin; Buraggina, Alessio; Wang, William; Zhang, Andrew; Bauer, Lujo; Hsiao, Hsu-Chun; Jia, Limin; Libert, Timothy (2022): "OmniCrawl: Comprehensive Measurement of Web Tracking With Real Desktop and Mobile Browsers", in: Proceedings on Privacy Enhancing Technologies. (DOI)

[30]

Fouad, Imane; Santos, Cristiana; Legout, Arnaud; Bielova, Nataliia (2022): "My Cookie is a phoenix: Detection, measurement, and lawfulness of cookie respawning with browser fingerprinting", in: PETS 2022-22nd Privacy Enhancing Technologies Symposium. (DOI) (Link)

[31]

Papadogiannakis, Emmanouil; Papadopoulos, Panagiotis; Kourtellis, Nicolas; Markatos, Evangelos P. (2021): "User Tracking in the Post-cookie Era: How Websites Bypass GDPR Consent to Track Users", in: Proceedings of the ACM Web Conference. (DOI)

[32]

Zeber, David; Bird, Sarah; Oliveira, Camila; Rudametkin, Walter; Segall, Ilana; Wolls´en, Fredrik; Lopatka, Martin (2020): "The Representativeness of Automated Web Crawls as a Surrogate for Human Browsing", in: Proceedings of The Web Conference 2020, pp. 167–178. Association for Computing Machinery, New York, NY, USA. (DOI) (Link)

[33]

Luo, Elisa; Ritter, Tom; Savage, Stefan; Voelker, Geoffrey M. (2025): "Canvassing the Fingerprinters: Characterizing Canvas Fingerprinting Use Across the Web", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[34]

Annamalai, Meenatchi Sundaram Muthu Selva; De Cristofaro, Emiliano; Bilogrevic, Igor (2025): "Beyond the Crawl: Unmasking Browser Fingerprinting in Real User Interactions", in: Proceedings of the ACM Web Conference. (DOI)