How survey panels fingerprint your device

In 2010 the EFF ran an experiment called Panopticlick and collected browser details from about 470,000 visitors. More than four in five of those browsers had a combination of settings that no other browser in the sample shared. No login, no cookie, no name. The browser just described itself, and that was enough to pick it out. The visitors were self-selected and more technical than average, so treat it as proof of concept, not a number for everyone. The EFF still runs the test today as Cover Your Tracks.

Survey panels use the same idea. A device fingerprint is a label built from dozens of small facts your browser or phone reveals, so a site can recognise the same device again without a cookie. If you do surveys, it is probably behind some of the “duplicate account” and “unusual activity” messages that arrive with no explanation. One caveat first. I can’t see any panel’s code and most don’t publish it, so this comes from public documentation on browser fingerprinting plus my own reasoning about how a panel would use it. I’ll mark the guesses as guesses.

what it is

A device fingerprint is a short identifier, usually a hash, computed from many attributes of your browser and hardware. No single attribute identifies you. Your screen size is shared with millions of people, and so is your timezone. Combine enough of them and the overlap shrinks fast. In the EFF’s sample it was often down to one browser.

The signals come in two kinds.

• passive: what arrives with every request anyway. Your IP address, the user agent string, the Accept-Language header, and the TLS handshake, which security teams sometimes hash using a method called JA3.
• active: what a script on the page asks your browser for. Screen size, timezone, fonts, and the graphics tricks below.

A cookie is something a site stores on your device and reads back later, so you can delete it. A fingerprint is something the site works out from what your device already has.

Nothing is stored on your side, so there is nothing to delete.

It also labels a browser on a device, not a person. Hold onto that, because most of the misconceptions further down come from forgetting it.

how it works

Step one is collection. A script on the signup page, the login page, or the page you land on when you click into a survey asks your browser a series of questions. The W3C publishes a note for spec authors, Mitigating Browser Fingerprinting in Web Specifications, that lists the same surfaces as things standards should be careful about exposing. The usual ones:

• user agent: browser name, version and operating system. Chrome has been shortening this string, so it gives away less than it used to.
• screen and window: width, height, colour depth, pixel ratio, touch points.
• time and language: the timezone from the browser’s Intl API and the ordered list in navigator.languages.
• hardware hints: navigator.hardwareConcurrency reports logical CPU cores, and Chromium browsers also report a rounded device memory figure.
• graphics: WebGL can return the GPU vendor and renderer strings, depending on the browser.
• fonts: the script writes text in a long list of font names and measures the width. A width that differs from the fallback font means the named font is installed.
• canvas: the script draws hidden text and shapes on a canvas element, reads the pixels back and hashes them. GPU, driver, operating system and text rendering each nudge a few pixels, so the same drawing comes out slightly different on different machines.

Step two is combining. The values are joined into one string and hashed to a fixed length. FingerprintJS is an open source library that does this in public, so reading its code shows you the basic technique. The maths is short. 2 to the power of 33 is about 8.6 billion, so around 33 bits of identifying information can single out one device among that many. Common values like a 1920x1080 screen add almost nothing. A rare font set adds a lot.

Step three is storing and comparing. The hash is saved against your account with the time, the IP address and the result of the check. Next visit, the panel compares. Expect a similarity score rather than an exact match, because a browser update changes the version string and a new monitor changes the screen size. Rules then run on top. The same fingerprint on two accounts. One fingerprint on fifteen signups in an afternoon. A fingerprint tied to an account that was closed before. Those are my examples, not any panel’s real thresholds, which I have never seen published.

Step four is cross-checking, and it is where honest people trip. The fingerprint reports a timezone and a language list, the IP address implies a country, and your profile says a third thing. When they disagree, that is a candidate flag. I wrote up the country side in how panels determine your country. Language settings also affect which studies bilingual members see, covered in bilingual members and language panels.

On a phone, a panel’s app has an easier job than a web page. It can read identifiers a browser can’t, such as the advertising ID (on iOS the app has to ask your permission first). And many surveys are hosted by a third party, which can run its own check before you get to question one. So “I only use the app” doesn’t put you outside any of this.

why it matters

Panels have four practical reasons to bother.

• Panels pay for completed surveys and their clients buy quotas by demographic, so one person with five accounts costs the panel five payouts and skews the sample. A matching fingerprint is the cheapest way to spot it. Honest households can get caught too. Two people sharing a laptop share a fingerprint, and a shared connection adds IP overlap, which is the situation in household IP sharing flags.
• Automated browsers often give themselves away. The WebDriver standard says navigator.webdriver is true when a browser is under automation, and headless setups tend to show odd screen sizes and few fonts. A panel that pays for completes attracts scripts, so it looks.
• Panels route studies and set rewards by country, so a gap between what you claim and what your device shows matters to them. If you are trying to understand a closure, start with why survey accounts get banned and ask which of the reasons there a device check could have caught.
• Withdrawal is the moment a panel actually spends money, so it is where I would expect the heaviest review. I can’t point to a panel that publishes this, so it is my reasoning and not a documented fact. If you are waiting on a payout, getting paid faster covers the parts you control.

Whether a panel may collect any of this depends on where you live and what its privacy policy says. That is a question for the policy and a lawyer, not me. This is not legal advice.

common misconceptions

Clearing cookies or using a private window resets it. It doesn’t. Private mode mostly stops the browser keeping history and cookies after the window closes, while your screen, GPU, fonts and timezone are all still there. You can check for yourself: run Cover Your Tracks in a normal window, run it again in a private one, and compare the results.

A VPN hides it. A VPN changes your IP address and little else. Your timezone, language list and hardware stay the same, and now they may disagree with the country the IP points to. I am not going to walk through faking the rest. Most panels’ terms ban giving a false country or running duplicate accounts, and that road ends in a closed account and, depending on the terms, a forfeited balance. One real person, one account and one device you actually use gives a fingerprint nothing to flag.

A fingerprint is a name tag. It is a probabilistic label for a browser. Two people on one laptop share one, and one person with a phone and a laptop has two. Phones blur it further. Many iPhones of the same model on the same iOS version look nearly identical because the hardware is uniform, so I would expect panels to lean on IP address, account history and behaviour as well. I would also expect a match to trigger a review rather than an automatic ban, though no panel I know of says so.

A privacy browser makes you invisible to these checks. Tor Browser tries to make all its users look alike. Brave adds small random noise to canvas and audio readings. Firefox has its own fingerprinting protection. These cut how unique you look to the wider web. But a fingerprint that changes on every visit, or reports a combination no real device has, can look strange to a fraud check. I have not tested how any panel reacts, so that is a question mark, not a finding. My position, which some people will argue with: for a panel account, use an ordinary current mainstream browser and keep the hardened setup for everything else.

where to go from here

Run your own browser through Cover Your Tracks once so you know what a site can see. Then pick the thread that matches your problem.

• If you were flagged and don’t know why, why survey accounts get banned is where I’d begin.
• More than one person in your home doing surveys: household IP sharing flags.
• The location half of these checks: how panels determine your country.
• Device checks are one side of quality control and your answers are the other, which I cover in why answering to qualify backfires.

The rest of the articles are on the blog index.

Written by Xavier Fok

disclosure: this article may contain affiliate links. if you buy through them we may earn a commission at no extra cost to you. verdicts are independent of payouts. last reviewed by Xavier Fok on 2026-09-22.