# Fingerprinting under POPIA > South Africa's Protection of Personal Information Act and a site that reads device signals for security. Informational, not legal advice. Source: https://whiskerjs.com/privacy/popia/ (last updated 2026-10-26) > **In plain words:** > > South Africa’s privacy law, POPIA, applies when you process personal information in South Africa or about people there. A device fingerprint linked to an account can be personal information. POPIA does not ban using it for security; it asks you to have a justification, to tell people, to keep it safe, to use it only for the purpose you named and to delete it when you no longer need it. > **Informational, not legal advice.** This page summarises the Protection of Personal Information Act in general terms. It does not say what applies to your site. Take advice from a qualified South African lawyer or your information officer for your own case, and check the current guidance of the Information Regulator. ## The law in one paragraph The Protection of Personal Information Act 4 of 2013 (POPIA) regulates the processing of personal information by a “responsible party” (the organisation that decides why and how information is processed). It sets eight conditions for lawful processing, gives data subjects rights, and is enforced by the Information Regulator. It protects natural persons and, unusually, juristic persons such as companies. ## Is a fingerprint personal information? Section 1 defines personal information broadly, as information relating to an identifiable person, and its examples include “any identifying number, symbol, e-mail address, physical address, telephone number, location information, online identifier or other particular assignment to the person”. A visitorId stored with an account, a login or an order relates to that person. Treat ids and results as personal information unless your advisers conclude otherwise. POPIA does not contain a separate rule written specifically about reading information from a device, of the kind the EU’s ePrivacy Article 5(3) has. The question under POPIA is whether your processing meets the conditions below. If you also have users in the EU or UK, the ePrivacy question applies there; see [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/). ## The eight conditions applied to device signals | Condition (sections) | What it asks | Applied to WhiskerJS results | | --- | --- | --- | | Accountability (8) | the responsible party ensures the conditions are met | assign an owner for the device checks | | Processing limitation (9 to 12) | lawful, minimal processing with a justification | collect only at the moments you need; drop components with `exclude`; pick a section 11 justification | | Purpose specification (13 and 14) | a specific, explicitly defined purpose; records kept no longer than necessary | name the purpose (for example fraud prevention and account security); set a retention period | | Further processing limitation (15) | further use must be compatible with the original purpose | do not reuse device results for marketing | | Information quality (16) | information is complete, accurate and updated where necessary | remember ids change with library versions; store `idVersion` and `signalsVersion` | | Openness (17 and 18) | documentation, and telling the data subject what is collected and why | update your privacy notice before you deploy | | Security safeguards (19 to 22) | appropriate technical and organisational measures; breach notification | protect stored ids and results like other account data | | Data subject participation (23 to 25) | access and correction rights | be able to find and explain the device data linked to an account | ### Justification under section 11 Section 11(1) lists the justifications for processing, among them consent, the conclusion or performance of a contract, compliance with a legal obligation, protecting a legitimate interest of the data subject, and pursuing the legitimate interests of the responsible party or a third party. Security and fraud prevention are often assessed under the last of these. Where you rely on a justification other than consent, the data subject may object under section 11(3) in the circumstances the Act describes. Choose and document your justification with advice. ### Telling users: section 18 Section 18 asks the responsible party to take reasonably practicable steps to make the data subject aware of, among other things, the information being collected, the name and address of the responsible party, the purpose, whether supplying it is voluntary or mandatory, and the data subject’s rights. [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/) has a text you can adapt. ### Automated decisions: section 71 Section 71 restricts decisions with legal consequences, or that affect a person to a substantial degree, made solely on the basis of automated processing intended to profile them, subject to exceptions and safeguards. If a device rule can refuse a payment or close an account automatically, check this section with your advisers and keep a way for a person to make representations. ### Cross-border transfers: section 72 If you store results with a provider outside South Africa, section 72 sets conditions for transferring personal information abroad. WhiskerJS itself transfers nothing: the result goes only where your code sends it. ## How WhiskerJS supports the conditions - No network code and no telemetry: the library sends nothing to anyone, so there is no hidden third-party transfer. - No storage on the device: no cookies, local storage or IndexedDB. - No permission prompts, no location, camera, microphone, contacts or files. - Large values only as truncated SHA-256 digests. - `collect({ exclude })` for processing limitation. - Privacy browsers respected rather than worked around. These choices support minimisation and security. They do not choose your justification or make any use lawful by themselves. See [Privacy (library docs)](https://whiskerjs.com/docs/privacy/). ## A checklist for your team 1. Name the purpose and the moments you collect. 2. Choose and record a section 11 justification. 3. Drop components you do not need. 4. Set a retention period and delete on time. 5. Update your privacy notice to meet section 18. 6. Secure stored ids and results; include them in your breach process. 7. Keep a human route for automated refusals. 8. Check transfers abroad if your storage is outside South Africa. ## Questions and answers ### Is a device fingerprint personal information under POPIA? It can be. POPIA's definition of personal information includes an online identifier or other particular assignment to a person, and it protects juristic persons as well as natural persons. ### Do I need consent under POPIA to use device signals for fraud checks? Not necessarily. Section 11 lists several justifications besides consent, including the legitimate interest of the responsible party. Which one fits depends on your facts; take advice. ### Who enforces POPIA? The Information Regulator of South Africa, which also publishes guidance and handles complaints. ## Related pages - [GDPR and ePrivacy](https://whiskerjs.com/privacy/gdpr-eprivacy/): The EU rules, for sites with users in both regions. - [What a privacy notice should say](https://whiskerjs.com/privacy/privacy-notice/): Including what section 18 asks you to tell users. - [Privacy (library docs)](https://whiskerjs.com/docs/privacy/): What WhiskerJS collects and never collects. - [Payment fraud](https://whiskerjs.com/use-cases/payment-fraud/): Device context at checkout.