Can Your Registration Page Recognize a Member's Laptop? GPU Fingerprinting and the Scripts on Association Sites

A member clears her cookies, leaves the office network for a hotel’s, and opens your annual meeting registration page. The scripts your registration vendor, payment processor and analytics tools load onto that page may still be able to tell it is the laptop they saw last week. One route runs through the laptop’s graphics chip, and whoever signs the vendor contract is best placed to ask about it.

The W3C Privacy Working Group’s note on browser fingerprinting describes it as a site’s ability “to identify or re-identify a visiting user, user agent, or device via configuration settings or other observable characteristics.” Some arrive with every request, and for some populations, the note says, the User-Agent header and the IP address “will often uniquely identify a particular user’s browser.” Others come from scripts that run on the device and query it.

The graphics processor, or GPU, answers several of those queries. WebGL, the browser’s graphics interface, can return the name of the chip and its driver, and the Khronos extension registry says its debug extension exposes the unmasked strings “for debugging purposes” because browsers might otherwise mask them for privacy. The chip also draws a scene in its own slightly different way, and the Tor Project’s browser design document names the consequence: a hash of the rendered image “can be used almost identically to a tracking cookie by the web server.”

Timing is a third signal: DrawnApart, presented at NDSS 2022, found that speed differences among the execution units inside one GPU serve as a device signature that ordinary JavaScript can collect. The newer WebGPU interface carries its own warning: the W3C draft standard says compute pipelines pose “an additional risk for unique device fingerprinting,” and admits that revealing the GPU, which developers need to work around known driver bugs, “naturally expands the amount of fingerprinting information.”

The W3C note says fingerprinting “may occur without the user’s knowledge or consent and tools such as clearing cookies or using a VPN do not prevent further correlation.” A 2021 IEEE Security and Privacy paper by Iqbal, Englehardt and Shafiq notes, citing earlier work, that fingerprints, alone or combined with an IP address, can be used to regenerate or de-duplicate cookies. That is not a claim that a VPN is useless, only that the fingerprint can still link visits.

How far the measured numbers reach

The DrawnApart abstract opens by saying existing techniques “are unable to track individual users for an extended duration” because “browser fingerprints evolve over time.” Its authors recruited more than 2,500 machines with 1,605 distinct GPU configurations, collected almost 371,000 fingerprints, and joined their method to an existing tracking algorithm, FP-Stalker, rather than running it alone. In the seven-day collection run, the paper reports that median tracking time rose from 17.5 days to 28 days, about 60% longer, and the best gain across runs of two to seven days was 66.66%, which the abstract rounds to a boost “of up to 67%.”

Hohentanner, Kemmerzell and Florschütz, writing for ACM WiSec 2025, tested a technique called AtomicIncrement on a pool of 502 Android phones and tablets in a cloud lab of real devices, and with 256 fingerprints per guess, about 1.2 seconds of collection, the single top guess was the correct device 73% of the time, averaged over ten runs on devices kept out of training. Run by those authors with no more than 32 fingerprints, DrawnApart managed about 13%.

A WWW 2018 study by Gómez-Boix, Laperdrix and Baudry gathered 2,067,942 fingerprints from a single French website and found that 33.6% matched no other, 35.7% on desktops and laptops and 18.5% on mobile devices. The only attributes that study ties to the GPU were the WebGL vendor and renderer strings, and it also ran a canvas drawing test but no GPU timing, so it describes browser fingerprinting broadly.

Who puts these scripts on an association’s pages

Iqbal and colleagues found fingerprinting on more than 10% of the top 100,000 websites and over a quarter of the top 10,000, served from more than two thousand domains that “include both anti-ad fraud vendors as well as cross-site trackers.” Englehardt and Narayanan’s crawl of the top one million sites, run in January 2016, found canvas fingerprinting on 1.6% of them, with 98.2% of those cases coming from third-party scripts. Neither study measured GPU timing in the wild.

Some uses protect members rather than follow them. A peer-reviewed survey led by Pierre Laperdrix lists bot and fraud prevention, and login checks that can “block unauthorized access from new and unknown devices,” the sort of screening a member portal or dues page might want. One regulator sorts by purpose: the ICO’s page on exceptions requires consent for “device fingerprinting techniques for online advertising purposes” and lists fingerprinting “solely for network management purposes” under an exception. That is UK guidance, not US law, and none of the sources we read names a company that uses GPU fingerprinting.

What actually catches abusive images online

The primary sources on catching abusive images describe fingerprinting the image, not the uploader’s graphics card. The National Center for Missing & Exploited Children, a nonprofit, describes hash values as “unique digital fingerprints assigned to pieces of data, such as images and videos,” and says that as of December 31, 2025, it had shared more than 12.1 million of them with 78 electronic service providers that chose to take part. Details about who uploaded come from the provider, whose report under 18 U.S.C. 2258A can include, “at the sole discretion of the provider,” an email address, IP address, URL “or any other identifying information”; the statute does not require providers to monitor users or scan content. In United States v. Wilson, the Ninth Circuit described a report that carried the user’s email and IP addresses, to which NCMEC added geolocation. Not one of those three sources mentions fingerprinting a GPU or a browser.

Fingerprinting your own publications is a separate tool, and our article on what content fingerprints can prove takes it up.

Three questions for the registration vendor

The society below is made up for teaching and is not a case study. The Riverbend Society of Surveyors is replacing the form its members use to renew dues and register for the annual meeting, and its membership director sends each finalist three questions in writing. Do any scripts on the form or in its analytics read canvas, WebGL, WebGPU or other device attributes to recognize a visitor? If they do, is the purpose fraud and bot screening, login security, advertising, or measurement across other sites? Which outside parties load code on the page, given that the million-site crawl traced most canvas fingerprinting to third-party scripts? A specific written answer to each, kept with the signed contract, is the check, and our look at ad-tech invoices covers the advertising tags on the same page.

Two overstatements to refuse

A cleared cookie or a VPN is not a fresh start, and no study here shows a site following anyone forever: the measured gains run to days and weeks, with GPU timing added to other methods.