Question

A privacy engineer reviewing a company's website discovers that a third-party script collects the user's canvas rendering output, installed fonts, screen resolution, and hardware concurrency, then hashes these values into a persistent identifier used to recognize returning visitors—even after cookies are cleared. The site's consent banner only governs cookie storage. Which action best addresses the underlying privacy concern?

Accepted Answer

Extend the consent management platform to gate the fingerprinting script behind explicit consent, treating device fingerprinting as a tracking technology subject to the same lawful-basis and preference controls as cookies

Answer

Add the fingerprinting script's domain to the site's Content Security Policy allowlist so it loads reliably across browsers

Answer

Rely on the browser's built-in anti-fingerprinting protections, since modern browsers randomize canvas output and no additional controls are required

Answer

Document the fingerprinting activity in the cookie policy text but continue loading the script by default because no cookies are being set