If your site reads device signals, tell your users in words they can follow: what you read, why, when, how long you keep it, and who gets it. This page gives you a text to start from, a list of the blanks to fill in, and what the main laws add in different regions.
Informational, not legal advice. The text below is a starting point, not a compliant notice for your site. What you must say depends on your jurisdiction, your purpose and your setup. Take advice from a qualified lawyer or your data protection officer before you publish it.
Text you can adapt
Device information for security. When you sign in [or: register, pay], our site runs a script in your browser that reads technical characteristics of your device and browser, such as screen size, language and time zone settings, installed fonts, and how your device draws a test image and processes a test sound. Most of these are turned into short codes (hashes) in your browser. We use them to recognise devices you have used before and to detect automated or fraudulent access. The script does not ask for any permission, does not read your location, contacts, files, camera or microphone, and does not store anything on your device. The results are sent to us only with the form you submit, are kept for [period], and are not sold or used for advertising. [Legal basis.] [How to object or contact us.]
Every statement about the script in this text is true of WhiskerJS as built: it asks for no permission, reads no location, contacts, files, camera or microphone, stores nothing on the device and sends nothing by itself. Keep it true of your setup: if you add other scripts, share results with a vendor or keep them longer, say so.
What to fill in
| Blank | What to decide | Notes |
|---|---|---|
| Moments | when you collect: sign-in, registration, payment, change of payout details | collect only where you need it; the notice should match |
| Purpose | for example security, fraud prevention, preventing automated abuse | do not add uses you do not have; do not reuse results for marketing |
| What is read | adjust if you drop components with collect({ exclude }) |
see Signals for what each one reads |
| Retention | how long you keep ids and results, and why | a concrete period, enforced by deletion |
| Recipients | who receives the results: only you, or a vendor or payment provider too | WhiskerJS itself sends nothing to anyone |
| Legal basis | your basis in each region | for example legitimate interests (EU and UK), a section 11 justification (South Africa) |
| Device access | whether you ask for consent before the script runs, or rely on an exemption | an EU and UK question; see GDPR and ePrivacy |
| Automated decisions | whether a device rule can refuse access or payments without a person | say how users can ask for human review |
| Rights and contact | how to object, access, delete, complain | include the regulator where required |
Region notes
EU and UK (GDPR, ePrivacy, PECR)
Articles 13 and 14 of the GDPR list what you must tell people, including: who you are and how to contact you (and your data protection officer, if any), the purposes and the legal basis, the legitimate interests you rely on where that is the basis, recipients, transfers outside the EEA or UK, the retention period, the rights to access, rectification, erasure, restriction, objection and complaint to a supervisory authority, and the existence of automated decision-making with meaningful information about the logic involved. Where consent is used for device access, the information has to be given before consent is asked for.
South Africa (POPIA)
Section 18 asks you to make the data subject aware of, among other things, the information collected, your name and address, the purpose, whether providing it is voluntary or mandatory and the consequences of not providing it, any law requiring the collection, any intended transfer abroad, and the data subject’s rights, including the right to object and to complain to the Information Regulator. See POPIA.
California (CCPA as amended by the CPRA)
At or before collection, tell consumers the categories of personal information you collect (for example identifiers and device information), the purposes, whether you sell or share it, and how long you keep it, and link to your privacy policy. The policy also covers consumers’ rights and how to exercise them. See CCPA and CPRA.
A short version for the form
A one-line notice next to the form, linking to the full text, helps users see it when it matters:
We check technical details of your device to protect your account from fraud. Learn more in our privacy policy.
Link “privacy policy” to the section that holds the full text.
Keeping the notice true
- Review the notice when you upgrade WhiskerJS: a new
signalsVersioncan add or change components. The changelog lists every change. - Review it when you change retention, add a vendor or start a new use.
- Keep the description of what is read consistent with your
excludelist.
Questions and answers
Where should the notice appear?
In your privacy policy, and in short form where you collect, such as near the login, sign-up or payment form, with a link to the full text. Some laws require information at or before collection.
Can I just copy the text?
Use it as a starting point. Change the moments, purpose, retention, legal basis and contact details to what you really do, and have your adviser review it.
Should the notice name WhiskerJS?
Naming the tool is optional. What matters is describing what is collected, why, how long it is kept and who receives it.