Are PETs Enough To Mitigate The Privacy Risks Of Device Fingerprinting?

February 16 Google is lifting the ban on capturing fingerprints from devices for companies that use its advertising products.

It’s a surprising turn of events. In 2019, Google called the method “opaque” and said it would “aggressively block” it to protect user privacy.

So what has changed?

According to Google, it is “refreshing” its platform policies in light of two shifts in the advertising ecosystem: the rise of connected TV and the rise of privacy-enhancing technologies (PETs).

IP addresses are already widely used to target and measure ads on CTV, Google says, and innovations like PETs can help mitigate the associated privacy risks.

PET is any technical method for keeping personal data safe. In an advertising context, it can mean use processing on the device minimize data transfer or multi-party computation so that multiple parties in a clean room analyze personal data without sharing it.

Google is integrating PETs into its ad products and says it plans to partner with the broader advertising industry to “help make PETs more accessible.”

No one disputes that PETs can help protect and secure sensitive databut are they sufficient to mitigate the privacy risks of device fingerprinting? We asked the experts:

• Arielle GarciaCOO, Check My Ads
• Julie RooneyChief Privacy Officer, OpenX
• Mateusz JedrochaChief Product Officer, Adlook
• Daniel RosenzweigFounder and General Counsel, DBR Data Privacy Solutions
• Cillian KieranCEO and Founder, Ethyca

Arielle Garcia, COO, Check My Ads

No. Google refers to PETs and privacy technologies by seeing the privacy risk associated with fingerprints as ostensibly limited to re-identification of individuals by third parties.

What Happened When Google Said “Fingerprints”it subverts the user’s choice and is wrong”, because people can’t remove their fingerprints? The goals will move to where Google needs them.

Julie Rooney, Chief Privacy Officer, OpenX

The ad tech industry’s commitment to developing PETs that meaningfully enhance data privacy and security within the ecosystem is real. In recent years, many players have made great strides in this field.

However, this change seems likely to give more personal data to more players, or at least ease restrictions on its use. While this is done more securely through PETs, there are always increased risks when more personal data changes hands or is used in new ways.

Mateusz Jedrocha, Chief Product Officer, Adlook

PETs undoubtedly help to ensure the safe handling of data. However, a key issue in using IP addresses as identifiers is user autonomy. Can individuals opt out of tracking or delete data collected about them?

The broader debate centers on user choice and control. This remains a primary challenge that is separate from the technical guarantees offered by PETs.

Daniel Rosenzweig, Founder and General Counsel, DBR Data Privacy Solutions

Generally speaking, yes, I believe PETs mitigate privacy risks and are a good idea to implement when possible and justified – although I also think the devil is in the details.

This means that even with the use of PETs, the main liability remains unchanged. When an organization processes data in a way that qualifies it as personal data – including data used for device fingerprinting – it should apply the same level of due diligence as any personal data.

Cillian Kieran, CEO and founder of Ethyca

PETs are like armor on the battlefield. They protect but do not eliminate combat. And they’re not a silver bullet, especially when applied to techniques like fingerprint scanning, which by design operate in the shadows of users’ awareness.

The truth is that fingerprinting is inherently invasive. It tracks people without their knowledge and creates data profiles they never consented to. PETs cannot solve this fundamental problem because they do not address consent or transparency.

PETs can make fingerprints less aggressive by adding a layer of confusion and reducing the accuracy of the data. If PETs are used as a genuine attempt to create a more privacy-conscious framework, they are valuable. If they are used to justify the status quo, they will not solve the underlying problems of trust.

The potential is there, but it depends on the execution.

The answers have been slightly edited and condensed.