# Device fingerprinting vs cookies

> How a device fingerprint differs from a cookie or a local storage ID: what survives clearing storage, what a visitor controls, and when to use each in your app.

Last updated: 2026-11-12

A cookie or a local storage ID is a value your site writes into the browser and reads back later. **Device fingerprinting** works the other way round: nothing is written, and the server recognises the device from what it sends. Both answer "have I seen this visitor before?", and they fail in different ways, so fraud prevention usually wants both.

## Side by side

|  | Cookie or local storage ID | Fingerly visitor ID in a browser |
| --- | --- | --- |
| Where the identity lives | In the browser, as a value your site set. | On the server. The browser SDK sets no cookies and keeps nothing in the browser. |
| The visitor clears storage | The identity is gone. | The same device keeps its visitor ID. |
| A private window | A new, empty store. | The `incognito_mode` signal can fire, and it adds to the score. |
| The visitor edits the value | Possible. The value is theirs. | There is no value in the browser to edit. |
| The device cannot be recognised | A new cookie is simply set. | The answer has `identifiable: false` and a fresh visitor ID, and you are not charged. |
| Tells you how risky the session is | No. | Yes: `suspect_score`, `suspect_level` and, to your backend, the `triggers`. |
| Works inside an app | Only in a web view. | Not with the web SDK. Use the [iOS](https://docs.fingerly.io/docs/sdks/ios) or [Android](https://docs.fingerly.io/docs/sdks/android) SDK, which recognise an install ID. |

## When a cookie is enough

- Keeping someone signed in, remembering a preference or a cart, and anything else that is about the person who chose to stay.
- Anything you want to disappear when the visitor clears their browser.

## When you want a device fingerprint

- Limiting sign-ups, redemptions or trials per device, however many cookies, accounts or email addresses it uses. See [sign-up abuse](https://docs.fingerly.io/docs/use-cases/sign-up-abuse) and [promotion abuse](https://docs.fingerly.io/docs/use-cases/promotion-abuse).
- Counting failed logins per device rather than per address. See [credential stuffing](https://docs.fingerly.io/docs/use-cases/credential-stuffing).
- Recognising a returning customer on a login or a payment, so a known device meets little friction. See [account takeover](https://docs.fingerly.io/docs/use-cases/account-takeover).
- Seeing that one device is behind many accounts, or that a fresh-looking visitor is one you have seen before.

## Using both

Keep your own session cookie for sessions, and store the `visitor_id` next to your user, order or session records. Comparing the two is where the signal is: one account with many visitor IDs, or one visitor ID with many accounts, is worth a look.

```ts On your server
// Your own session says who is signed in. The visitor ID says which device they are on.
const event = await fingerly.events.get(requestId)
const knownDevice = await db.devices.exists({ userId: session.userId, visitorId: event.visitor_id })

if (!knownDevice && event.suspect_level !== 'low') return challenge()
```

> **Tip:** Treat a visitor ID as evidence, not as proof of who is signing in. The [visitor identification](https://docs.fingerly.io/docs/visitor-identification#using-visitor-ids) page lists the patterns that work.

> **Note:** A visitor ID identifies a device, not a person, and it is not a replacement for authentication. In apps, the identity is a random install ID the SDK keeps on the device, so what survives a reinstall differs between iOS and Android. See [what device fingerprinting is](https://docs.fingerly.io/docs/device-fingerprinting#web-and-native-apps).

Whether a cookie, a local storage ID or a fingerprint needs consent depends on your lawful basis and where your visitors are. Fingerly's SDKs collect nothing until you pass `consent: granted`. See [privacy and consent](https://docs.fingerly.io/docs/privacy-and-consent).

- [What is device fingerprinting?](https://docs.fingerly.io/docs/device-fingerprinting): The idea, and what it cannot do.
- [Quick start](https://docs.fingerly.io/docs/quick-start): Get a visitor ID in five steps.