How fingerprinting works
On click and again on conversion, the tracker collects a bundle of attributes the browser exposes — user-agent string, OS and version, screen resolution and color depth, language and time zone, installed fonts, canvas and WebGL rendering quirks, and the IP address. Hashed together, these form a "fingerprint." If the conversion-time fingerprint matches a recent click-time fingerprint closely enough, the tracker attributes the conversion.
Why affiliates use it
It's cookieless, so it survives third-party-cookie blocking, cleared cookies, and cross-domain hops where a cookie can't follow. In paid media and CPA, fingerprinting is a fallback for matching a conversion to a click when the click ID or cookie is missing — a way to recover otherwise-lost attribution. Some trackers blend it with click IDs to lift overall match rates.
Accuracy and limits
Fingerprinting is probabilistic, not exact, and it fails in both directions:
- False matches — many devices share a near-identical fingerprint (the same phone model on the same carrier IP looks alike), so the tracker can credit the wrong click.
- Missed matches — a single user's fingerprint changes when they update the OS, switch networks, or rotate IPs, so a real conversion goes unmatched.
Treat it as a lower-confidence fallback behind click IDs and first-party data, not a primary identifier.
Privacy and legal status
Regulators increasingly treat fingerprinting the same as cookies. The EU's ePrivacy rules and GDPR require consent for fingerprinting used to track users; UK ICO guidance says the same; and browsers (Safari, Firefox, Brave) actively work to reduce the entropy fingerprinting relies on. If you use it, it belongs under the same consent and disclosure obligations as any other tracking — see the compliance playbook.
Fingerprinting vs the alternatives
Prefer, in order: a preserved click ID (exact and platform-blessed); first-party data you collected with consent (durable and owned); then fingerprinting as a last-resort fallback. Fingerprinting fills gaps, but building attribution on it alone is fragile and increasingly non-compliant.