# Privacy and compliance

> What the main privacy laws ask of a site that reads device signals, and how WhiskerJS keeps the data small. Informational, not legal advice.

Source: https://whiskerjs.com/privacy/ (last updated 2026-10-26)

> **In plain words:**
>
> A device fingerprint can single out a device, and in many places that makes it personal data even if you never learn the person’s name. Some laws also regulate reading information from someone’s device in the first place. These pages explain, in plain terms, the questions the main laws raise for a site that uses WhiskerJS, and what WhiskerJS does to keep the data small.

> **Informational, not legal advice.** These pages summarise public legal texts and regulator guidance as general information. They do not tell you what applies to your site. Laws change and depend on your facts: take advice from a qualified lawyer or your data protection officer for your own case.

## Two questions every site has to answer

1. **May we read this information from the device at all?** Some rules (in the EU and UK, the ePrivacy rules) cover access to information on a user’s device, not only what happens to it later. They can require consent unless an exemption applies.
2. **May we process the result, and how?** Data protection laws (the GDPR, POPIA, the CCPA as amended by the CPRA, and others) require a purpose, a lawful basis or a legal permission, transparency, security and limited retention.

WhiskerJS cannot answer either question for you. It is a script that your site runs; your site is the one that decides why, when and for how long.

## The guides

- [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/): Device access, consent, legitimate interests and fraud prevention in the EU and UK.
- [POPIA](https://whiskerjs.com/privacy/popia/): South Africa's conditions for lawful processing applied to device signals.
- [CCPA and CPRA](https://whiskerjs.com/privacy/ccpa-cpra/): Device identifiers as personal information in California, notice and opt-outs.
- [Fingerprinting without cookies](https://whiskerjs.com/privacy/fingerprinting-without-cookies/): What changes, and what does not, when nothing is stored on the device.
- [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/): Adaptable text and a checklist of what to fill in.

## How WhiskerJS keeps the data small

These design choices support data minimisation. They do not, on their own, make any use lawful.

| Design choice | What it means for you |
| --- | --- |
| No network code, no telemetry | the result goes only where your own code sends it; no third party receives it from the library |
| No storage, no cookies | WhiskerJS writes nothing to the device; each `collect()` starts from nothing |
| No permission prompts | permission states are only read with `navigator.permissions.query`; no location, camera, microphone, contacts or files |
| Large values only as digests | images, audio samples, font lists and similar leave as the first 128 bits of SHA-256 |
| Privacy browsers respected | components that Brave, Firefox and Safari fingerprinting protection, Firefox resistFingerprinting and Tor Browser randomise or normalise are not collected at all |
| Volatile signals outside the ids | zoom, taskbar, permissions, keyboard layout and versions do not change the ids |
| `collect({ exclude })` | you can drop any component your purpose does not need |
| Collector only | no scoring, profiling or decisions in the library |

Details and how each point is tested: [Privacy (library docs)](https://whiskerjs.com/docs/privacy/).

## What stays with you

- Choosing the purpose (for example security and fraud prevention) and keeping to it.
- Deciding the lawful basis, and whether consent is needed for device access in your jurisdiction.
- Telling users, in your privacy notice and where you collect. See [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/).
- Setting a short retention for stored ids and results, and deleting them on time.
- Securing what you store, and handling access, deletion and objection requests.
- Assessing risk, for example with a data protection impact assessment where the law asks for one.

## Questions and answers

### Is device fingerprinting legal?

It depends on where you operate, why you do it and how. Many laws treat a device fingerprint as personal data and some regulate reading information from a device at all. Take advice for your own case.

### Does WhiskerJS make my site compliant?

No. WhiskerJS is designed to collect little and send nothing, which helps with data minimisation, but the lawful basis, consent, notice and retention are decisions the site makes.

### Where does WhiskerJS itself describe what it collects?

On the Privacy page of the docs, which lists every kind of data collected, what is never collected and how each rule is enforced by the test suite.

## Related pages

- [Privacy (library docs)](https://whiskerjs.com/docs/privacy/): Exactly what WhiskerJS does and never does.
- [Signals](https://whiskerjs.com/signals/): Every component, what it reads and reveals.
- [Use cases](https://whiskerjs.com/use-cases/): The purposes device signals are used for.
- [Storing ids](https://whiskerjs.com/docs/integration/#storing-ids): What to keep per event, and keeping it short.