The pan-European data regulator group Article 29 has issued new opinion on how websites and advertisers can track users and the permissions they require.

The new opinion dictates that “device fingerprinting” – a process of silently collecting information about a user – requires the same level of consent as cookies that are used to track users across the internet.

“Parties who wish to process device fingerprints which are generated through the gaining of access to, or the storing of, information on the user’s terminal device must first obtain the valid consent of the user (unless an exemption applies),” the Article 29 Working Party wrote.

It means that some websites, including Google, Facebook and Microsoft, that have used alternative technical processes to try to bypass the need for a “cookie policy notice” will have to show a notification after all.

“The Article 29 Working Party has made it clear that companies cannot bypass consent by using covert methods to track users through their devices,” said Jim Killock, executive director of the Open Rights Group. “Building profiles to deliver personalised content and adverts clearly falls under e-privacy and data protection law.”

Silent tracking

Until now, device fingerprinting has been considered separate from the European legislation that covers cookies, which requires companies that store small bits of information on a users computer for storing settings and identity to explicitly ask for consent.

That requirement for consent is why most websites accessible from the UK have a small message either at the bottom or top of the site asking for permission to use cookies, or telling the user that the site uses cookies and continuing to use the site implies consent.

Since the consent for cookies legalisation was brought into play in 2012, internet firms have been working on a way to identify users without relying on cookies. Each device connected to the internet identifies itself in various ways to help websites and services deliver the requested information, be it the right sized website for a smartphone or the right video stream for a smart TV.

The small snippets of information aren’t able to uniquely identify a particular device on their own, but combined they provide a fingerprint of the device that, while not entirely unique in most cases, is able to identify a user in conjunction with other data such as their internet connection.

Advertising

Companies, including Google, Microsoft and Facebook, use this information broadcast by almost anything that connects to the internet to track users as they play, browse, buy and watch primarily for advertising purposes.

The problem with device fingerprinting, and one of the advantages over cookies as far are the technology companies are concerned, is that it is very difficult for a user to stop it happening. With cookies a user can simply prevent them from being put on their system through browser settings.

To avoid device fingerprinting users have to go to much more complex lengths, including using anonymity tools such as Tor.

Now that Article 29 has published explicit opinion on device fingerprinting techniques it has laid the ground work for developing new legislation to govern their use and protect user privacy.

“Many companies have little interest in being transparent about their use of customers’ data,” said Killock. “Profiling technologies are likely to proliferate so Article 29 are doing a vital job in explaining the line between getting consent and surreptitious tracking. The UK’s Ico needs to act on this opinion.”

Ultimately the regulation of device fingerprinting will fall to the individual data regulators in each country.

“The Information commissioners’ office (Ico) has always been clear that the law around cookies also applies to similar technologies. The Article 29 opinion adopted this week, which the Ico played a key role in drafting, confirms that digital fingerprinting is such a technology,” a spokesperson from Ico, the UK’s data watchdog, told the Guardian. “Digital fingerprinting accesses information stored on a user’s machine in a similar way to a cookie, and provides organisations with similar benefits. With that in mind, it is sensible to consider that the law applies to digital fingerprinting in the same way it does to cookies.”

“It is also worth noting that digital fingerprinting would typically see an organisation collecting information to allow identification of an individual, which brings potential data protection implications,” he said.

Microsoft, Google and Facebook were not immediately available for comment.

• European parliament votes yes on ‘Google breakup’ motion

• EU to Google: expand ‘right to be forgotten’ to Google.com