[{"data":1,"prerenderedAt":111},["ShallowReactive",2],{"doc:\u002Fdocs\u002Fdevice-fingerprinting-vs-cookies":3},{"page":4,"toc":105,"updated":110},{"path":5,"title":6,"seoTitle":7,"description":8,"blocks":9},"\u002Fdocs\u002Fdevice-fingerprinting-vs-cookies","Device fingerprinting vs cookies","Device Fingerprinting vs Cookies and Local Storage IDs","How a device fingerprint differs from a cookie or a local storage ID: what survives clearing storage, what a visitor controls, and when to use each in your app.",[10,13,18,53,56,61,64,70,73,75,83,87,90,92],{"type":11,"text":12},"p","A cookie or a local storage ID is a value your site writes into the browser and reads back later. **Device fingerprinting** works the other way round: nothing is written, and the server recognises the device from what it sends. Both answer \"have I seen this visitor before?\", and they fail in different ways, so fraud prevention usually wants both.",{"type":14,"level":15,"text":16,"id":17},"heading",2,"Side by side","side-by-side",{"type":19,"columns":20,"rows":24},"table",[21,22,23],"","Cookie or local storage ID","Fingerly visitor ID in a browser",[25,29,33,37,41,45,49],[26,27,28],"Where the identity lives","In the browser, as a value your site set.","On the server. The browser SDK sets no cookies and keeps nothing in the browser.",[30,31,32],"The visitor clears storage","The identity is gone.","The same device keeps its visitor ID.",[34,35,36],"A private window","A new, empty store.","The `incognito_mode` signal can fire, and it adds to the score.",[38,39,40],"The visitor edits the value","Possible. The value is theirs.","There is no value in the browser to edit.",[42,43,44],"The device cannot be recognised","A new cookie is simply set.","The answer has `identifiable: false` and a fresh visitor ID, and you are not charged.",[46,47,48],"Tells you how risky the session is","No.","Yes: `suspect_score`, `suspect_level` and, to your backend, the `triggers`.",[50,51,52],"Works inside an app","Only in a web view.","Not with the web SDK. Use the [iOS](\u002Fdocs\u002Fsdks\u002Fios) or [Android](\u002Fdocs\u002Fsdks\u002Fandroid) SDK, which recognise an install ID.",{"type":14,"level":15,"text":54,"id":55},"When a cookie is enough","when-a-cookie-is-enough",{"type":57,"items":58},"list",[59,60],"Keeping someone signed in, remembering a preference or a cart, and anything else that is about the person who chose to stay.","Anything you want to disappear when the visitor clears their browser.",{"type":14,"level":15,"text":62,"id":63},"When you want a device fingerprint","when-you-want-a-device-fingerprint",{"type":57,"items":65},[66,67,68,69],"Limiting sign-ups, redemptions or trials per device, however many cookies, accounts or email addresses it uses. See [sign-up abuse](\u002Fdocs\u002Fuse-cases\u002Fsign-up-abuse) and [promotion abuse](\u002Fdocs\u002Fuse-cases\u002Fpromotion-abuse).","Counting failed logins per device rather than per address. See [credential stuffing](\u002Fdocs\u002Fuse-cases\u002Fcredential-stuffing).","Recognising a returning customer on a login or a payment, so a known device meets little friction. See [account takeover](\u002Fdocs\u002Fuse-cases\u002Faccount-takeover).","Seeing that one device is behind many accounts, or that a fresh-looking visitor is one you have seen before.",{"type":14,"level":15,"text":71,"id":72},"Using both","using-both",{"type":11,"text":74},"Keep your own session cookie for sessions, and store the `visitor_id` next to your user, order or session records. Comparing the two is where the signal is: one account with many visitor IDs, or one visitor ID with many accounts, is worth a look.",{"type":76,"samples":77},"code",[78],{"label":79,"lang":80,"code":81,"check":82},"On your server","ts","\u002F\u002F Your own session says who is signed in. The visitor ID says which device they are on.\nconst event = await fingerly.events.get(requestId)\nconst knownDevice = await db.devices.exists({ userId: session.userId, visitorId: event.visitor_id })\n\nif (!knownDevice && event.suspect_level !== 'low') return challenge()",false,{"type":84,"tone":85,"text":86},"callout","tip","Treat a visitor ID as evidence, not as proof of who is signing in. The [visitor identification](\u002Fdocs\u002Fvisitor-identification#using-visitor-ids) page lists the patterns that work.",{"type":84,"tone":88,"text":89},"note","A visitor ID identifies a device, not a person, and it is not a replacement for authentication. In apps, the identity is a random install ID the SDK keeps on the device, so what survives a reinstall differs between iOS and Android. See [what device fingerprinting is](\u002Fdocs\u002Fdevice-fingerprinting#web-and-native-apps).",{"type":11,"text":91},"Whether a cookie, a local storage ID or a fingerprint needs consent depends on your lawful basis and where your visitors are. Fingerly's SDKs collect nothing until you pass `consent: granted`. See [privacy and consent](\u002Fdocs\u002Fprivacy-and-consent).",{"type":93,"columns":15,"cards":94},"cards",[95,100],{"title":96,"text":97,"href":98,"icon":99},"What is device fingerprinting?","The idea, and what it cannot do.","\u002Fdocs\u002Fdevice-fingerprinting","fingerprint",{"title":101,"text":102,"href":103,"icon":104},"Quick start","Get a visitor ID in five steps.","\u002Fdocs\u002Fquick-start","bolt",[106,107,108,109],{"id":17,"text":16,"level":15},{"id":55,"text":54,"level":15},{"id":63,"text":62,"level":15},{"id":72,"text":71,"level":15},"2026-11-12T11:59:51.000Z",1794493376608]