Posted by royfish 23 hours ago
A news site doesn't need to do audio processing on my machine and read back the buffer? It doesn't need to use webgl to render triangles to an offscreen buffer?
Broad geographical targeting shouldn't be an issue. In fact, it's so easy that I think we should invent an ad-targeting API people can opt in to. If I could tell advertisers my geographic location, gender, age cohort, languages, and 3 interests, I'd not feel that's an invasion of privacy when they use that to deliver ads. I'd just get lawnmower ads instead of shampoo ads and that's fine.
The problem is, they don't want to use that kind of targeting. They want to target me with ads for a travel destination that my coworker mentioned in a Messenger message to another coworker five minutes ago. But we should just not accept that.
It's the browser that introduced many of these APIs in the first place.
That should answer the question.
(If you ask me if a browser should report how many cores the machine has, including physical and logical ones, I would answer never, every time. But not everyone thinks that way. https://developer.mozilla.org/en-US/docs/Web/API/Navigator/h...)
Because it's known that interrupting the user-intent with a unrelated consent-popup doesn't help.
Older people may remember that this was the approach of Java J2ME, where you couldn't provide a fluent user-experience as the user first had to answer huge popups about individual API-permissions with "Always Allow", "Allow now" etc.
You go to Facebook to see your cute nephew make spit bubbles. Do you care that they access your camera and canvas? What is a canvas? And sure access my camera, I want to upload photos!
It's fundamentally broken. They've studied the dark patterns, not to avoid them but to implement them best.
If it's a site I trust, and I think it genuinely needs audio, I give it audio. If someone doesn't understand and just does allow all, they never see it again either (and their ads are suspiciously well targeted).
We already have these consent popups for camera and microphone. Reading back bytes from an audio buffer seems like such a rare thing to do that it hopefully just stops happening.
We do this to check whether the browser is what it claims to be, not to track who you are. Similarly, font rendering, floating-point math results, WebGL renderer strings, and whether built-in functions are patched is all much harder to fake. These considerations determine how hard the proof-of-work puzzle should be, and site owners can see it as a risk score. We don't do cookies or browser storage, IPs aren't stored, and nothing gets used to recognize you on another site or on a later visit. The biggest players in automated traffic prevention can't (and usually don't) say this much, because of conflicts of interest between automated bot detection and their other products (e.g. ad sales and IP-profiling).
Your example is really fair though. I chatted with our engineers, prompted by this thread, and we found nothing in our detection that currently uses the audio hashes we collect, so we've started talking about removing the collection.
For example, on multiple instances, my spouse declined "location permissions" an app designed to work with a piece of Bluetooth-connected hardware, and would blame the hardware as being crappy.
"This smart lock app doesn't work."
"You need to enable this permission."
"Why do I need to give the smart lock app location permissions?"
It's not obvious to people that "Bluetooth can be used sneakily by big-enough companies as a makeshift GPS" even if the app needing Bluetooth access doesn't actually need a GPS location.
We should go further. A web-site with mostly static content should not use user-side scripting (Javascript) at all, it's unnecessary for it. It should be required only in rare cases where a site is basically an application and require manually turning it on each time such application is opened.
Then sites that want to track will just add some JS. Seems unlikely to help.
If such client-side behavior counts as “basically an application,” then “applications” is a larger set than seems useful.
Simple answer: The makers of 3 largest browsers by market share (collectively 90%+) are buddies with the people who want to fingerprint you. Only the 4th largest gives a shit.
I agree with you but really from a point of privacy and what/how data is allowed to be mined, shared, sold, etc. The implications to the business/ad industry are second order effects that are just collateral damage.
Last I checked it's because it was generally considered that preventing fingerprinting is practically impossible anyway. It's not like you need a lot of entropy for fingerprinting, and the web API surface is enormous. To actually stop fingerprinting you'd need to make your web browser more or less useless.
How so? There seems a fairly inherent tension between having things just work by default and hiding surface area for fingerprinting behind permissions pop ups. For example say you go to a maps website, how do you decide whether to share the users location with the website? Or enable webGL functionality to render some fancy layout on the screen? As a user having to enable all that stuff per-website is annoying.
Maybe there's some other way Im missing?
Google's business model has been ads from the beginning. Search, gmail, drive, office, chrome, everything they do is just to drive ad revenue further.
They don't care about the user. Never have, and never will.
And the outcome we are seeing is what happens when a defunct state isn't able to protect citizens from conglomerates. That's what the Kartellamt or the FTC is supposed to be for.
The company as a whole also really stopped caring at some point and are now following the “do be evil” paradigm
Not sure if I can't see this comment as anything else than hypocritical. It's always easier on the money receiving side, isn't it? How do you think the term malvertisement came to be?
AdMob is kind of the definition of inevitable Surveillance Capitalism and the prime example for necessary regulation through government.
On the web one is drive-by fingerprinted by sites they never once approved of or intended to visit thanks to the browser’s ability to redirect and embed without input from the user. The magnitude of the problem is far greater on the web.
To reframe it, in a given week the average person only uses a small handful of apps, but in the same span of time their browser has connected to thousands, maybe tens of thousands, of unique domains, most of which are tracking them in some capacity and the majority of which are tracking things most of us would consider invasive.
"You're protected from the methods I use here. You disabled JavaScript, so this fingerprinting trick can't run at all. You're still vulnerable to network-based methods. Read on to see what it does to everyone else.
From now on I’ll call you:…"
I've run sans JS as default almost since its inception in the Netscape days and I've very little difficulty without it. On rare occasions when I'm forced to use JS I'll cut-and-paste the URL into another browser.
I no longer use ad blockers as I just don't see ads with JS disabled. The other privacy precautions I take are the obvious ones such as no Google or social media accounts, flushing cookies at session's end, regularly randomize my IP and never let Chrome anywhere near my machines and make judicious use of multiple browsers (this is being written in Privacy Browser on Android).
Using NewPipe and sponsor block on PipePipe increases privacy and makes YouTube ad free.
Client-side scripting was a mistake which was obvious from the outset (or not severely limiting the reach of scripting engines).
What I find hard to understand is why alternative plugin JS engines haven't been developed that are under user control. Spoofing, randomizing and returning junk data to webservers would go a huge way towards stopping fingerprinting by websites.
I guess you use the web in quite a limited manner? (Or use that other browser quite a lot...?).
I've tried no JS various times over the years and always end up constantly whitelisting sites. It's even worse in 2026 and gets worse each year.
Banking, insurance, webmail, groceries, eBay, CAPTCHAs... not to mention what feels like 50% of the web that is behind either Cloudflare or similar, which almost always require Javascript.
Unfortunately this idealistic principle (no JS) attracts the worst people.
You're on Tor? You have JS disabled? I might as well warm up fbi.gov/investigate/cyber for the probable report I'll have to do...
"Unfortunately this idealistic principle (no JS) attracts the worst people."
Again, how did you come to that opinion? Where's your evidence/stats? Generally comments like that come from web/JS programmers who've realized that client-side users have them stymied when they disable JS.
An additional reason I avoid JS is speed, webpages become blinding fast when there's no JS. Once one gets addicted to the great rendering speed there's no return. I'm not against JS per se, trouble is you JS programmers have weaponised it against users, webpages of 7, 10 and even 20MB are now commonplace. Presenting such slow massive pages to users is nothing other than abuse.
I do not use Tor.
BTW, I should point out that my views about JS and privacy abuse were formed from my years working in govt. surveillance where the stakes are very high.
That does not change what I have dealt with. I am not a “JavaScript fanboy” remember I made a community that could work WITHOUT needing JavaScript and that lead to a bunch of grief for me which made me understand the extreme naivety of that original idealistic idea on the internet.
> language
I dont think js is needed for either of those things.
If we control the servers the clients are connecting to, I don't see how there could be much hope of hiding. We can spoof things like latency toward an upper bound, but we can never ever defeat the lower bound. Physics is still quite insistent about that one.
If we control multiple servers, we know where they are, and we can periodically compel our clients to rotate between them (see: DNS), we can engage in latency-based multilateration to put them on a real-world map. Depending on the number of servers and samples over time, this can be remarkably accurate. Determining someone's actual postal code just from network timing information is feasible.
VPNs obviously confound this in first order terms, but if we aren't careful they can make it even easier to identify our activity in other ways. We are trading concealment in the woods for concealment in a crowd. Both have their advantages and disadvantages. The VPN might also have a side channel that we aren't aware of.
https://www.usenix.org/legacy/event/nsdi07/tech/full_papers/...
Is there any reason a browser or plugin couldn't just spoof the data used in fingerprinting to random values? So it emits different values for each page or resource you load?
Spoofing 'Newly installed most recent version of Google Chrome on the latest version of Windows 11 in the US' without leaving any holes revealing something fishy is surprisingly hard, but that or 'Safari running on recent-ish iPhone running up to date iOS' would be the ideal target to blend in with the crowd.
It doesn't matter if it looks wrong as long as it looks differently wrong over time. Don't bother trying to blend in with the crowd because you can't ever expect to catch everything that can be used to fingerprint you. New techniques come out all the time. You can block a lot of information from even being collected. Limit what data you send at all, randomize what's left, change IP frequently (VPN) and you should be fine.
For a more proper solution, you could try to convince Mozilla that granting every website uncapped multi-threading and direct GPU access is a bit much. If webgl/webgpu truly is a must, then maybe each website permission should start with a single-threaded software-renderer that behaves indistinguishable on all supported platforms. And only after granting the website that extra permissions let it determine that a more powerful GPU is available.
https://jshelter.org/faq/#what-jshelter-configuration-should... :
First, see our blog post. Consult also other blog posts and other questions in this FAQ.
If you want to have the same fingerprint as many users, We suggest going for Tor Browser (do not install JShelter in Tor Browser). If you want to make cross-site fingerprinting linkage hard, go for the Recommended JShelter level. If you want better protection for the real data at the cost of having the same fingerprint on different sites, go for the Strict JShelter level. Keep NBS active. If you want to detect and prevent fingerprinting attempts, use FPD.
On the technical level there is no problem to block tracking - intriduce noise and make APIs unavailable until user permits to a web site. But that is not implemented.
The same with native applications. If your bank app requires you to share your location you can't spoof it. The makers of Android and iOS made spoofing of geo location impossible - you don't have that control, which means the phone is not your device. You have to give up your real location.
That's basically the ideal. It's become obvious that it's impossible to try to be identical. Web browsers are too leaky, and something will out you. You really don't want to try to blend in the "typical" users because none of them use ad blockers.
>coveryourtracks.eff.org shows you how unique your fingerprint is, with entropy for each measured data point.
Something to note - if a fingerprint is generic enough, that might be a _good_ thing!
Having worked with fingerprinting, anti-fingerprint browsers are very hard to properly identify. The ways to get around it are things like collecting more coarse fingerprints[0], as the overall one is fairly easy to change (e.g. make your browser lie about a collection of browser apis).
What's imo more difficult though is a fingerprint like:
- iPhone <new_version> - running os <latest_stable> - using default safari - bought and used in <common_location> (e.g. usa)
on a 5g mast in a decently sized city, you'll share a fingerprint with at least one other active user using a setup like ^
grapheneOS on the other hand stands out a bit more!
[0] - https://blog.castle.io/fingerprints-beyond-device-ids-engine...
Just because someone can theoretically demonstrate your fingerprint today doesn't mean you have the same fingerprint in a few days. It's that kind of stability that you actually need for consistent matching for advertising or tracking purposes.
90% of commercial fingerprinting services still rely mostly on the IP address. Once you remove the IP address, you're left with a set of configurations that have a very short half life - volume settings, installed fonts, software versions, etc. You can expect a good portion of your audience to degrade within a couple of days. (Whereas a cookie has a life of 2 years - practically though they only survive a few months).
What you actually pay for from third party vendors is a connection made around a more stable data point - a phone number, an email address, a user ID, etc. With one of these data points you can actually track people across multiple devices for as long as you want.
Suddenly the credit report was no longer a prerequisite to the mortgage.
But for real. You say you no longer live there, so I'm assuming you left for more opportunities. My wife and I are interested in countries with opportunities for engineers and privacy. Bonus points if there is engineering research opportunities.
Not asking polemically, I just have never studied economics and wonder if my intuition here is flawed
Some societies prefer huge risks for huge benefits, in those one (might) need a more detailed credit reports because everything is faster, people accept huge risks and the situation can suddenly change.
Some societies prefer more stability. Lower risks, lower surprises. Less opportunities, everything is slower, people can't even take that many risks, simpler histories will do th trick.
From what I notice though, housing seems to be a problem in both types of societies, irrespective on how credits are given, because there are other things involved (regulation, NIMBY, housing used as value, airbnb, geography, etc).
It feels onerous as an idea because bank statements, monthly bills, payslips, will bequests, stock vests and trades, bank robberies*, and investment income each have different ways of being tracked. At least most of these records of individual financial activity come with a PDF these days. It wasn’t that long ago that applying for a loan meant scanning in papers for your lender to review.
Computers are smarter now. Not only can they read documents (or at least match the shapes against shapes they’ve been told are real) but they can also understand the contents too (or at least match the words against ideas they’ve been told are real.)
There may well yet be a future Data Valhalla where individuals hold their life.zip themselves, and upload whatever bits of it are needed to get that Nordstrom store card / car financing / cheeseburger loan without having an intermediate credit agency.
*I feel there’s a kernel of a joke there about a bank robber asking for a receipt with the loot in anticipation of declaring it on their tax return.
Credit isn't like insurance where these things can be checked later during a claim (which can then be denied) - you need to know the person is a bad-payer before you send them the ten thousand dollar loan as that affects the terms, not afterwards when they default and you can't get your money back.
Potentially, with loans or other things, some kind of technical solution could work. You could have a personal document that you control, and you give permission for companies to write to the document.
With a loan, for example, if I give you a loan, I can also append to your document that I've loaned you the money; for every payment you make, I write to the log to say you've made a payment. If you stop making payments, I stop writing to the log. This would be cryptographically signed by me, so it can't be forged.
When you want to take out another loan, you can proactively share your document, the bank can see everything written on the log, and make a decision based on that.
For the latter it’s whether you’ve had a judgment against you, which is a matter of public record.
For the former it’s based on how much money you have and what you spend, including on servicing existing debt. Lying about this would be fraud. In that sense, my proposal does indeed open up a new avenue for fraud but I don’t think that’s the same as it being unworkable!
The Western governments have horribly failed of caring for their people - cost of living are exploding, and at the moment way too many people are papering over that with unsecured credits backed by their data being free to exploit, and everyone else not willing of doing that is increasingly locked out of existence.
You hit the nail on the head with the first statement. It required humans in the loop. It scaled linearly. Local branch managers had relationships with the people in their community, and knew who could and couldn't be trusted.
It was an imperfect system, where a human could be prejudiced against another human, and deny them access to credit.
Sometimes that would get discovered, and the human was held accountable for their actions, or had their actions upheld by a (org-chart-superior) human.
Similar to the imperfect system today, where the models a computer uses could be prejudiced against a human, and deny them access to credit. Dissimilar in that the model or the computer is rarely, if ever, held to account. "Computer says no" is a meme for a reason.
And every now and then we have to rescue banks that are too big too fail at the cost of everyone else, because someone dreamed up a way to increase short term profits that involves giving loans to people who will never pay them back.
> neither your car,
Praising a trillion dollar GDP, but can't afford a used car.
When I grew up I was told to not make debts if not needed. So many older people did indeed save up until they could afford a car or a house. Education was always mostly free where I lived.
Nowadays it seems like ordinary people would need to pay off a house their whole life and thus also need to keep income high enough to keep paying installments. This takes away so much freedom from people as they are trapped in their high paying jobs...
> we solved the problem with ramshackle one-room buildings with dirt floors,
there is a fallacy here. People with access to debt bid up the price of an asset, like a house, against other peoples’ similar access to debt. Sans debt access, the solution was not necessarily a small ramshackle house. The fallacy is the belief that the same asset price - whether opulent or ramshackle house, wouldn’t adjust to the reduced level from the bidding environment. The differential cost of construction for a nicer house can be countenanced in the access-to-debt case, but that is second order.
Illustrative straw-man example: Suppose, once one had a parcel of land, that it was trivial to construct one’s ‘starter home’ the ramshackle house if you like. Get one’s family and friends to help build in exchange for future return favors. As one advances in life, rebuild to have something more opulent. The rub is in the parcel itself. Unlike the would-be house, it had no cost built-in, just whatever price the previous owner was willing to accept to release their parcel. That parcel’s (and those around it) price reflects the market’s access to debt, or lack of access to debt. In the market without access to debt, parcel pricing reflects which buyers have accrued more savings vs other buyers. In the market with access to debt, parcel pricing reflects who can access more debt (through the various means we know of today - down payment ability yes, which parallels the non-debt’s savings case, someone co-signing, long term expected future earning potential vs someone retired, the parcel itself put up as collateral, perhaps other non-immobile assets put up as collateral, like the family oxcart).
The point is that there isn’t necessarily a 1:1 coupling between market’s debt vs non-debt access and whether the construction is opulent vs ramshackle.
A good number of European countries have only half the poverty rates - the dirt floors and carts you're talking about - of the US yet barely use credit cards.
That does mean banks can't know if you lie by omission and hide some unpaid bills, but they can raise the evidence requirements to compensate and I think everyone deserves a second chance.
https://www.malwarebytes.com/blog/news/2025/02/google-now-al...
There's a fingerprint demo on github called JSCreep (https://abrahamjuliot.github.io/creepjs/) that used to keep your fingerprint profile for 90 days and show you how many times you visited. Worked extremely well, and is still around, but no longer uses the API to retain fingerprint data, so you have to track your hash yourself. It would easily track most browsers across changes in IP address. Only Mullvad, Brave, or Tor would not leave an easily tracked fingerprint.
The demo presented in the royfish.dev link is easily foiled by browser extensions that scramble fingerprint data, the presence of which would itself be detected by more sophisticated profilers and used to define the fingerprint. I can refresh the page and get a new hash and adjective-animal name with the same IP. JSCreep sticks firm to the same hash for me, even with a new IP address and some spoofed browser data.
A lot of data can change over days, weeks, but if you can maintain an accurate fingerprint with tinier changes, and granted you have consistent visits from the user, could you just keep up?
Especially if one service is tapped into several websites, and can continually keep up with smaller data changes and distribute that info. Is this possible? In practice anywhere?
Let's say I'm logged in a famous search engine, they associate my fingerprint X to my account A. If they then encounter fingerprint X anywhere else, there is a good chance it was me, A, doing it. If the next day I get fingerprint Y, it gets attached to A as well and the tracking information follows it.
Does this make sense?
Even easier if, additionally, many of the smaller websites were syndicated into a tracking network?
Indeed. I checked this website a few hours ago and got one fingerprint. Just rechecked and got another.
Sorry, but that's simply not true. It's actually the default way of how people eg track people across installs in app stores ever since they started removing that feature.
Data harvesting gains most of its value because they sell some or all data to businesses which wish to leverage that data in advertising. If they cant advertise they wont need most of the data, which should at the least reduce the problem significantly...
Generally, how can society discover new products and services?
I would be open to having some kind of directory that i could browse at my own convenience, but that's ultimately going to devolve to paid placement.
I'm surprised you can't imagine a society where the consumer would be the one recommending products and not the producer. Any entrepreneur can find one first consumer to test their new product. And that first consumer have access to a great communication network to recommend that products to their social network — it's called "the Internet". Social networks are a great platform for people to share interesting things to their friends, family, colleagues and also to people they don't actually know ("the Internet" can connect you to strangers). Such networks cost little to operate when the content is created by users, instead of producers and their intermediaries (people favors short, insightful written text instead of catchy commercial once detoxed).
Being born in the 1990s, I did experience that "Internet", when advertising networks didn't exist and when people intentionally interacted to make connections and actively look for information. They were happy to tell about things they discovered, with little to expect in return ("influencer", aka mercenary, wasn't a job yet).
I want to learn about products that are useful to me, but not through ads. As it turns out, it is incredibly difficult to learn about new products that are useful, as those do not tend to show up in ads at all and even seeking them out is very difficult.
It's weird how no one has come together to make a website specifically designed around users finding product categories that will make their life better. For example, I didn't learn about height adjustable desks from an ad. Nor did I learn about balance boards from an ad. Or trackballs. Or essentially every other product that made my life better once I realized that product category exists.
What a myopic view. Also, the world is very much filled with shades of gray. I’m certain this dichotomy is indeed a false one.
Yes, and those people are free to visit equivalent of mail order catalog or go to the store or subscribe to consumer goods quality testing journal or to any of the enthusiast magazines about electronics or gardening or whatever where they perform independent testing and benchmarking or look up a video comparing ceiling fans across a century when they feel hot in the summer.
So yes, we should absolutely ban third party advertisements. People will still be able to discover good products.
Maybe I'm just not a typical person, but I have never woken up in the morning and said to myself, "You know, I would just love for a corporation to help me learn about their new products and services today." Never. Not even once. When I want to learn about something, I will actively seek information out about it, and I'm not going to look to advertisements for impartial information. The purpose of advertising is never to inform. It's to bombard and saturate.
We also cant get rid of cancer, it doesnt mean we shoudl close down all hospitals.
The spectre of possible interpretations is wide.
Some see only problems everywhere whatever the benefits might be, some see only new opportunities no matter the tragic outcomes, some see various blend of this and that.
The only winning move is not to play--er, to somehow not to have this kind of game in the first place.
The solution is explicit trust. Not fingerprints for users, but digital signatures for content. If it's not signed by somebody the user trusts, don't render it.
The user is the only one who can be approach that task without a conflict of interest. If somebody wants the user to run code that phones home about user behavior, make them gain the user's trust.
It only works if you re-architect the web into something that's even more censorship friendly than it currently is. I hate ads too, but the medicine seems worse than the disease in this case.
Hospitals are not perfect, people die, with your l;ogic we should close down them all.
Doing nothing and keeping advertising keeps a negative situation alive.
It was never about cookies. Thats what the industry made you think. You don't need to show consent banners for cookies (like auth sessions). You need consent for tracking. This includes profiling. And it doesn't matter what you use, fingerprinting or tracking cookies, the consenst banner is required either way.
Consent is required. The banner is just one mechanism, but not required. A website could hold off on all tracking until a suitable point in the usage of the site (like creating a profile, for example) and ask at that point.
The banner is an artefact of the hostile way most sites choose to try and hoodwink the user into being monetised and ultimately to piss users off so much that they complain about the legislation rather than the lack of online privacy.
Better to just harass them into a habit of dismissing the banner.
They don't seem to call it GPC, but their "ask websites not to track" feature now uses it instead of GPC.
if you write to your reps, they might just change that. The Eu is one of the few democracies left. Slow but powered by the people
The exact definition of "legitimate purpose" is unspecific (which is important to be able to adapt to development of new services) which leads to some lawyers being careful.
I also claim that some lobby groups promote having too many and too big consent banners to move blame from tracking companies to the EU ("stupid EU forcing all those banners!") in order to reverse the policy on tracking, which seems to have some effect.
Generally speaking JS code that makes request to server is covered by ePD while actually processing that request server side is covered by GDPR (there are some nuances to this).
The problem with this view, though, is that even the very agencies propagating these rules do the exact same thing! You can go to any site from an EU arm and get the same banners.
At this point, you can't really blame it on bad-faith actors, you have to accept that it's a bad rule. Which is not to say I know a better one!
Malicious compliance is not the law-maker's fault.
Not to mention the large number of "legitimate interest" exceptions that are absolutely not justifiable.
The main problem with the legislation is its lack of teeth and enforcement.
In fact the law even specifies “no pre-ticked boxes” but every banner always has “accept all”. And it’s 50/50 to see “reject all” even though it is a requirement that denying must be as easy as accepting.
They should pay a bounty for reporting non-compliance.
That's not entirely true. Websites that don't actively try to fuck over their users (because their purpose is not shoving third party ads at you, it's providing information about/a platform for their company's product) often provide a modal with two buttons:
'Accept' 'Decline'.
This, IMO, meets both the letter and the spirit of the law. The funny thing is, for any website actually doing that, if you click 'Accept', your data will likely only be used to improve it.
> Global Privacy Control detected. Advertising cookies are turned OFF.
Yes, I love this. My browser is already sending "do not track" requests.
If you ask my 70-year-old mom to decide whether she'd like to allow the WebGL API, she'll go bonkers. If anything, the constant cookie banners have just trained her to consent to stuff out of muscle memory. You could probably design a "Are you ok to sign over the deed to your house" question in the rough shape of a cookie banner and get 90%+ agreement.
> We Care About Your Privacy
> We, and our 228 partners use cookies and similar methods to recognize visitors [...]
228 partners should make anybody concious about the fact that something is wrong and you probably should not consent to that at all. Also, nobody cares about your privacy when they think sharing data with 228 parties is okay.
Or alternatively how weak the EU messaging was I guess
1) ePrivacy. the OG banner law. requires you to inform the user (but not consent, as I understand it) if you store data on a user's device. includes cookies, localStorage, indexedDB, etc. does not affect fingerprinting 2) gdpr. requires you to ask consent for any kind of user data processing, unless you can find another legal basis
eprivacy was about cookies, but forgot fingerprinting. gdpr was not specifically about cookies. but gdpr (or at least its past interpretation by the dutch privacy authority) didn't require consent for limited first party analytics.
which led to situations where you'd get the impression that you wouldn't need a banner for first party tracking using cookies .. well the gdpr didn't require it, but the older ePrivacy rules still did.
we still have the digital omnibus law package coming up which is supposed to simplify and resolve the overlap between the two above, and reduce banner requirements at least for SMB just analyzing their website visitors
It does. The current version says "storing of information, or the gaining of access to information already stored, in the terminal equipment". Reading e.g. navigator.userAgent is information already stored in the terminal equipment. If you then use that in any way that gets communicated to remote server (e.g. directly or calculating some fingerprint) you read that information in manner ePD describes.
The directive itself has been transposed incorrectly in many jurisdictions. For example from what I understand the Dutch law added an exception (roughly "for obtaining information about the quality or effectiveness of a supplied information-society service, provided this has no or only minor consequences for the user's privacy.") which is not permitted under ePD. ePD exception list is exhaustive and the only other exception can be done via Article 15. The exceptions done via that are related to things like national security and certain criminal prevention/investigation.
Of course that then raises the issue on how you get invalid exception invalidated. I don't know Dutch procedural law well enough to answer that.