Scripts read properties that together make a device distinctive: time zone, screen metrics, fonts, canvas or WebGL rendering, enumerated navigator fields. No cookie is stored, so cookie controls do not touch it.
Why it is a separate entry
Recognition without storage escapes exactly the controls people are told to use. Clearing cookies and refusing consent leave the technique untouched.
How it arises
anti-fraud or bot-detection library that also serves marketing
advertising script with built-in fingerprinting
Not to be confused with
Reading a time zone to localise a page is not this entry. The distinguishing feature is enumeration of multiple properties by a third party.
How to establish it
Calls to canvas, WebGL, font enumeration, time zone or navigator property enumeration originating from a script under a different registrable domain, before consent.
method network-observedQoD 90
Requirements on the measurement
hook the property reads through the debugging protocol; a HAR alone does not show them
record which script initiated each read
What would refute it
automatedThe properties are read by a first-party script, not a third party.reclassify
not from the captureThe reads serve a functional purpose such as localisation or accessibility.Purpose cannot be established from a capture. The entry establishes the reading, not the intent.weakens
Where this plugs into existing processes
The one question that surfaces itWhat reads the canvas, the fonts or the time zone, and who does it belong to?
In a DPIA, verify this
Verify whether device characteristics are read by third parties, rather than checking only for cookies.
As a procurement clause
No third-party script enumerates device characteristics for recognition purposes before consent.
With a complaint, hand over
A trace of property reads with the initiating script per read.
Reproduction
METHOD.md · by hand · no dedicated reproduction exists yet; follow the general method and the indicator above
repro/web/check.mjs · script · the run reports DPE-2026-0007 as present, with the detail behind it
Third parties that can confirm it: blacklight
Legal framing
nl-tw-11-7a
eu-gdpr-6-1-a
Objections, and the answer
“We set no cookies.”
The cookie provision covers storing and reading information on the device, not only cookies. Reading device characteristics for recognition is within its scope.
What this does not establish
harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there
DPE Catalogue. DPE-2026-0007: Device fingerprinting. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0007
Measurement
When you publish a finding, cite the method version alongside the entry: “DPE-2026-0007, established under DPE Measurement Method 1.0”
Identifiers are permanent and are never
reused. An entry that is deprecated keeps its number and its address, with the reason attached, because
references to it exist elsewhere.