Canvas and WebGL Fingerprinting in 2026

Canvas and WebGL fingerprinting have been cornerstones of device identification since the early 2010s. But the landscape has shifted significantly with Chrome's Privacy Sandbox initiatives, Firefox's Enhanced Tracking Protection, and Safari's Intelligent Tracking Prevention. Here is the state of GPU-based fingerprinting in 2026 — what changed, how we adapted, and why these signals remain indispensable.

What Changed with Chrome's Privacy Sandbox

Chrome's Privacy Sandbox, rolled out progressively starting in 2024, introduced several changes that affect fingerprinting. The most significant is the partitioned storage initiative, which reduces the effectiveness of cookie-based tracking but does not directly affect canvas or WebGL fingerprinting.

However, Chrome has begun experimenting with canvas noise injection — adding small random perturbations to canvas pixel data to prevent exact fingerprinting. When enabled, the same drawing instructions produce slightly different pixel outputs on each execution. This breaks naive hash-based canvas fingerprinting that expects exact reproducibility.

Adapting to Canvas Noise

Our response to canvas noise injection was to switch from exact matching to similarity-based matching for canvas signals. Instead of computing a single hash of the entire canvas pixel data, we now extract multiple feature vectors from different regions and drawing operations.

The noise injection is typically small — a few pixels changed per frame. By extracting features at a coarser granularity (dividing the canvas into regions and computing aggregate statistics), we can identify the underlying hardware signature despite the noise. Our cross-session matching algorithm compares these feature vectors using cosine similarity, with a threshold tuned to accept hardware-consistent variations while rejecting different devices.

WebGL: Still a Goldmine

While canvas fingerprinting faces new challenges, WebGL fingerprinting remains largely unaffected by privacy initiatives. The WebGL API exposes hardware parameters — maximum texture sizes, shader precision formats, supported extensions — that are inherent to the GPU and cannot be easily perturbed without breaking WebGL functionality.

Chrome has discussed limiting WebGL renderer and vendor string access (replacing specific GPU names with generic labels like "GPU"), but this change has not been widely deployed. Even if it were, the dozens of other WebGL parameters we query would still provide highly distinctive identification signals.

The GPU as a Hardware Anchor

The fundamental reason GPU-based fingerprinting remains powerful is that it reads hardware characteristics that are physically determined by the GPU chip, the driver, and the rendering pipeline. These characteristics are not software choices that can be easily changed — they are consequences of how the silicon was designed and manufactured.

A device with an NVIDIA RTX 4070 will always report specific maximum texture sizes, specific shader precision, and specific extension support because those values are determined by the GPU architecture. The only way to change these values is to use a different GPU or a different driver — and driver changes are relatively infrequent for most users.

Canvas Rendering: Beyond Pixel Hashing

Modern canvas fingerprinting goes beyond simple pixel hashing. We use drawing operations specifically designed to amplify hardware-dependent rendering differences. Text rendering with specific fonts exercises the font rasterizer. Bezier curves with particular control points exercise the GPU's curve tessellation. Gradients with specific color stops exercise the color blending pipeline.

By choosing drawing operations that maximize the variance across GPU models while minimizing the variance across repeated runs on the same GPU, we create canvas tests that are simultaneously more distinctive and more robust than the simple text-and-shapes approach used by early fingerprinting libraries.

WebGL Shader Fingerprinting

A newer technique we deploy is WebGL shader fingerprinting. By compiling specific shader programs and querying their compiled properties (precision, optimization level, instruction count), we can extract information about the GPU's shader compiler — another hardware-dependent characteristic that varies across GPU families.

This technique is particularly valuable for distinguishing devices that have similar basic WebGL parameters. Two different GPU models might support the same maximum texture size, but their shader compilers will produce different compiled outputs for the same shader source code.

Privacy Considerations

GPU-based fingerprinting, like all fingerprinting, must be used responsibly. We use these signals for legitimate purposes — fraud prevention, bot detection, and account security — not for cross-site tracking or advertising. Our cloud-hosted deployment ensures that fingerprint data stays on our customers' infrastructure, eliminating third-party data sharing.

The privacy landscape will continue to evolve. Browsers may introduce additional protections that affect GPU fingerprinting. Our strategy is to continuously adapt — finding new hardware-dependent signals as old ones are restricted, while maintaining the accuracy and stability that our customers depend on.