deviceId and fingerprinting (or user tracking)

Folks,

I expect there is a consensus already in the WG on the topic.  I'd like to get some help to understand the mitigation mainly from the UA implementation perspective.  

The deviceId is currently defined as an identifier which must be *persistent* between application sessions.  So a website can get the same deviceId's when a user visits the website using the same system, calling gUM() or not.  Should we expect the deviceId's for any specific website be (largely) consistent across all systems?  Otherwise, in the worst case when the Id is unique to each system, the website can potentially track the user.

Appreciate any comment!

Best, Shijun

Received on Thursday, 25 September 2014 16:22:12 UTC