In California, the CCPA (as amended by the CPRA) gives consumers rights over their personal information, and its definitions include device identifiers. A fingerprint that can recognise a consumer’s device can therefore be personal information. Using it to keep your service secure is a recognised purpose, but you still have to tell people at collection, use it in a proportionate way, and honour their rights.
Informational, not legal advice. This page summarises the California Consumer Privacy Act and its regulations in general terms. It does not say whether the law applies to your business or what it requires of you. Take advice from a qualified lawyer for your own case, and check the current regulations of the California Privacy Protection Agency. Other US states have their own privacy laws.
The law in one paragraph
The California Consumer Privacy Act of 2018 (CCPA, California Civil Code section 1798.100 and following) was amended and expanded by the California Privacy Rights Act (CPRA), approved by California voters as Proposition 24. It applies to “businesses” that meet its thresholds. It is enforced by the California Privacy Protection Agency, which also issues regulations, and by the California Attorney General.
Is a fingerprint personal information?
The definitions in section 1798.140 are broad:
- Personal information includes identifiers such as a “unique personal identifier, online identifier, internet protocol address” and similar, where the information identifies, relates to or could reasonably be linked with a consumer or household.
- Unique identifier (or unique personal identifier) means a persistent identifier that can be used to recognise a consumer, a family or a device linked to them over time and across services, and the definition lists device identifiers and “probabilistic identifiers” among its examples.
- Probabilistic identifier means identifying a consumer or a consumer’s device to a degree of certainty of more probable than not, based on categories of personal information.
A visitorId, and the device result behind it, fit these descriptions when they are linked or linkable to a consumer. Treat them as personal information.
Security and integrity as a purpose
The CCPA recognises “helping to ensure security and integrity”, to the extent the use of personal information is reasonably necessary and proportionate, as a business purpose. Security and integrity is defined to include the ability to detect security incidents, to resist malicious, deceptive, fraudulent or illegal actions, and to help prosecute those responsible. Fraud prevention and bot detection with device signals are usually assessed under this purpose.
The law also requires that collection and use be reasonably necessary and proportionate to the purposes for which the information was collected. Collecting only at protected moments, dropping unneeded components and keeping retention short all speak to that.
What you have to do
| Obligation | What it means for device signals |
|---|---|
| Notice at collection (section 1798.100) | at or before collection, tell consumers the categories of personal information collected, the purposes, whether it is sold or shared, and how long it is kept |
| Privacy policy | describe the categories (identifiers, device information), sources, purposes and rights |
| Purpose and proportionality | use the results for the disclosed purpose; do not repurpose them for advertising without the proper notice and rights |
| Selling and sharing (section 1798.120) | if you disclose results to third parties for value, or for cross-context behavioural advertising, consumers have a right to opt out; using them only for your own security is not selling or sharing in itself |
| Consumer requests | be able to find, provide and delete device data linked to a consumer, subject to the law’s exceptions (security and integrity among them) |
| Service providers and contractors | if a vendor stores or analyses results for you, put the contract terms the law requires in place |
| Reasonable security | protect stored ids and results |
Device fingerprints are not listed among “sensitive personal information” in the CCPA, but precise geolocation and account log-in credentials are. WhiskerJS reads no geolocation. If you store device results next to login data, protect the whole record accordingly.
How WhiskerJS supports proportionality
- The library has no network code: no third party receives data from it, so it creates no disclosure on its own.
- It stores nothing on the device and shows no prompts.
- Large values leave only as truncated SHA-256 digests.
- You can drop components with
collect({ exclude }). - It respects privacy browsers instead of working around them.
These choices support necessity and proportionality. They do not answer whether the law applies to you or replace your notices. See Privacy (library docs).
A checklist for your team
- Check, with advice, whether the CCPA and other state laws apply to you.
- Name the purpose (security and integrity, fraud prevention) and the moments you collect.
- Add device information to your notice at collection and privacy policy, with a retention period.
- Keep the use proportionate: collect only where needed, drop unneeded components.
- Do not sell or share results unless your notices and opt-outs cover it.
- Make device data findable for access and deletion requests.
- Put service provider terms in place with any vendor that handles results.
Questions and answers
Is a device fingerprint personal information under the CCPA?
It can be. The CCPA's definitions cover unique identifiers, including device identifiers and probabilistic identifiers, that can be used to recognise a consumer or a device linked to a consumer.
Does using device signals for fraud prevention count as selling or sharing?
Not by itself. Selling and sharing are about disclosing personal information to third parties for value or for cross-context behavioural advertising. WhiskerJS sends nothing to anyone; what you do with the result decides the question.
Does the CCPA apply to my business?
Only to businesses that meet its thresholds and do business in California. Check the current thresholds and your obligations with an adviser.