• by Wendy Davis  @wendyndavis, October 1, 2021

Google's proposal to combat “device fingerprinting” -- a controversial tracking technology that relies on characteristics of users' computers -- may not be workable, according to the browser developer Mozilla.

Google recently floated what it calls a “privacy budget” to thwart fingerprinting. The concept involves limiting the amount of total information about devices that Chrome transmits to particular websites.

Mozilla this week questioned the plan's feasibility.

“Browser fingerprinting is a major threat to user privacy. However, based on our analysis the Privacy Budget proposal is unlikely to be a practical approach to addressing this issue,” the company writes in a detailed analysis posted Thursday.

Fingerprinting, which is already used by some companies, involves gathering information about users' devices -- such as their IP addresses, installed fonts, browser, even the amount of charge remaining in their batteries.

That information is then compiled into a digital fingerprint that can be used to recognize users across sites and apps.

Privacy advocates have long criticized device fingerprinting, arguing that it's opaque to consumers, and that it circumvents people's ability to control tracking by deleting their cookies.

Years ago, the internet standards group World Wide Web Consortium condemned digital fingerprinting as "a blatant violation of the human right to privacy."

Firefox has taken steps to block the technique, as has Apple's Safari.

Google said two years ago that it plans to restrict fingerprinting, and has floated several proposals, including the privacy budget concept. (A separate Google proposal, “Gnatcatcher,” would mask users' IP addresses.)

Mozilla is raising several potential practical problems with the privacy budget approach, including that not all data about devices is equally useful to trackers.

“The Chrome browser has many users and so learning someone uses Chrome is not very identifying; by contrast, learning that someone uses Firefox Nightly is quite identifying because there are few Nightly users,” the company states.

Mozilla adds that enforcement “is likely to lead to surprising and disruptive site breakage because sites will exceed the budget and then be unable to make API calls which are essential to site function.”

The company also notes the ironic possibility that the privacy budget will end up generating data that can be used for tracking.

“It is possible that the privacy budget mechanism itself can be used for tracking by exhausting the budget with a particular pattern of queries and then testing to see which queries still work (because they already succeeded),” Mozilla states.

The company notes in its more detailed analysis that Google's plan is still in the “conceptual stage,” and could be revised.

“The proposal is fairly high level and is possible that there are some variations which would improve the situation,” Mozilla states.

But the company adds: “Our analysis does not overly depend on the precise implementation details and it is unclear how they could be improved to address the issues we identify.”

A Google spokesperson says the privacy budget is “an early-stage proposal,” and that the company expects to make improvements.

“Our ultimate goal is to build a solution that restricts fingerprinting effectively without compromising key website functionality or introducing new forms of tracking.”

The spokesperson added that Mozilla's feedback shows that the “collaborative process” is working as intended.