How has this been so effective, when Panopticlick still says my Safari browser has "a nearly-unique fingerprint"? (And based on what I've read from other users's experience, this is normal.)
Re/Targeted ads require the decision to be made in milliseconds, including network transit time. They just don't have the time to fingerprint you on every request. They could do it once, but then they are back to the problem of having to set a cookie to keep track of you after that.
No, it takes a minute because it’s trying to load trackers in order to test your adblocker. Fingerprinting itself takes only a moment. Try TorZillaPrint: the results are instantaneous.
https://ghacksuserjs.github.io/TorZillaPrint/TorZillaPrint.h...
In practice, good content blockers (i.e. uBlock Origin) block most fingerprinting scripts. I don’t know whether Safari’s includes this.
If they're served on page-load when a user first visits a site, but I guess a significant minority are also requested+served in the middle of your newspaper article two minutes after page load, or in the middle of your Youtube video, or a refreshing sticky-footer ad, or just the next page loaded on a site.
Having to fingerprint every pageview also creates latency and still isn't that deterministic so everything will need to shift to probabilistic and contextual targeting. That's a hard change to make for most legacy networks.
IPv6 with probabilistic modeling comes pretty close though.
For example, if you update your browser or add a new plugin, you can look like a new person so it makes it harder to find a match. A cookie would not change through that event.
Enough people have the same fingerprint that it limits its effectiveness. Maybe you can only reliably identify 40% of your user base that way.
It is like using your IP address as an identifier. For some people it can be 100% accurate, but others switch networks or share an IP with multiple other people which limits its usefulness.
What ends up happening is that companies will correlate IP address with other fingerprint information to get a probabilistic match but that is complex and still has flaws.
you can be in California and using say an iPhoneX and it will tell you you're one in 500k. If you calculate the number of people with their iPhone set to English in the PST timezone (the only things there is to distinguish one iPhoneX from another) and then you divide that by the pantoptclick number you get it's claiming there are only 10-100 iPhoneXs in all of Seattle Metro Area, San Francisco Bay Area, Los Angeles Metro Area, and San Diego Metro Area combined. Clearly wrong
> Your browser fingerprint appears to be unique among the 251,543 tested in the past 45 days.
It only counts against those other people who visited panopticlick, and that in the last 45 days. That's explicitly stated, but hidden in the click-through for details section.
There are also things it can't detect, such as the existence of the Cookie Auto-Delete extension. So it thinks cookies are enabled and can be used for tracking, but in reality they get deleted whenever I close a tab (and links to new domains get opened in new tabs). Or user-agent randomization, which will make your fingerprint more unique but less useful for tracking.