Is the use of Fingerprinting a lawful means of marketing in England and Wales?

Most people will be aware of ‘cookies’ when using the internet. Fingerprinting is a potential work around for companies seeking to target individuals for marketing purposes and accordingly is not a marginal issue. It involves collecting enough information from a device’s hardware, software, configuration or settings to identify a particular device and user uniquely. The danger is that such tracking can succeed even when a user clears cookies or opts out of traditional tracking. Guidance published by the Information Commissioners Office (ICO) on 19 December 2024 explains fingerprinting “relies on signals that you cannot easily wipe” and is “harder for browsers to block”.

Put plainly, fingerprinting erodes the control that users expect to have over how their data is collected and used.

In February 2025, Google changed its policy on fingerprinting. In a complete U-Turn, having previously stated openly that fingerprinting “subverts user choice and is wrong”, Google decided to change its policy to allow fingerprinting as an option for those using its services for marketing purposes.

By lifting its ban on fingerprinting, Google is signalling that the ad-tech industry can and should treat such invasive device-based tracking as an acceptable substitute for third-party cookies, after their decline. According to the ICO, this is “irresponsible”.

From a legal standpoint, the shift sets up a tension between commercial pressure (to track and target users more precisely) and individuals’ rights/companies’ obligations under data protection law. In short, just because Google sanctions fingerprinting, does not mean it is automatically lawful in every jurisdiction across the world and that is precisely the point the ICO has made in its guidance.

The legal obligation remains: consent, transparency, fair processing

Importantly, the ICO stresses that the data protection rulebook has not changed simply because Google’s policy has. Existing data-protection law including the UK’s implementation of the ePrivacy framework via the Privacy and Electronic Communications Regulations 2003 continues to apply.

Any business seeking to deploy fingerprinting must demonstrate compliance with data protection law in any specific jurisdiction. In England and Wales, that includes:

Given the persistent nature of fingerprinting signals and their resistance to deletion or blocking, meeting those requirements will be far from trivial. The ICO itself notes that, in many cases, the bar will be high. It is also unclear how companies that deploy fingerprinting could comply with an individual’s right to be forgotten pursuant to the UK data protection legislation.

What this means for businesses and users

For businesses & advertisers

If you are considering deploying fingerprinting, you should treat this as a strategic legal decision, not merely a technical workaround for cookie loss. You will need to conduct a thorough risk-assessment under data protection law, ensure your consent mechanisms are robust and document compliance.

For users

Expect more fingerprinting especially on connected devices like smart TVs or streaming platforms, where cookies are less relevant. But also expect more pushback: carefully watch for consent banners or privacy notices, evaluate whether your consent is freely given and use tools or browsers that offer anti-fingerprinting protections if you value your privacy.