Fraud and bonus abuse

Device Fingerprinting Basics for Gambling Operators

What device fingerprinting does, how gambling operators use it against multi-accounting, fraud and exclusion evasion, its limits, and the privacy rules that govern it.

4 min readPart of fraud and bonus abuse

On this page
  1. What is device fingerprinting?
  2. What do gambling operators use it for?
  3. What are the privacy rules?
  4. How accurate is device fingerprinting?
  5. What should a privacy notice say about fingerprinting?
  6. Worked example: exclusion evasion
  7. What mistakes do operators commonly make?
  8. Checklist
  9. Frequently asked questions
  10. Sources
  11. More guides

Device fingerprinting builds an identifier for a device from attributes such as browser, operating system, screen and network characteristics, so an operator can recognise the device again even without cookies. Gambling operators use it to link duplicate accounts, spot account takeovers and detect exclusion evasion. It produces false positives on shared devices, and in the UK the ICO says organisations must offer fair choices and obtain consent where necessary under PECR.

Key takeaways

  • Fingerprints recognise devices, not people.
  • Most useful combined with payment and identity signals.
  • Shared household devices create false positives.
  • The ICO calls fingerprinting a high bar to meet and expects consent where required [1].
  • Document the purpose (fraud prevention, regulatory compliance) and retention.
Dec 2024ICO statement on fingerprinting
PECRUK rules on device storage and access

What is device fingerprinting?

A fingerprint is calculated from many small attributes of a device and browser. Unlike a cookie, it is not stored on the device, so clearing cookies does not remove it. Vendors combine fingerprints with behavioural and network data to score risk.

What do gambling operators use it for?

Uses of fingerprinting
Use How fingerprinting helps
Multi-accounting Links new accounts to devices used by existing ones
Bonus abuse Finds clusters claiming the same offers
Account takeover Flags logins from unfamiliar devices
Exclusion evasion Spots a self-excluded player’s device on a new account
Card testing Identifies devices trying many cards

See multi-accounting detection and account takeover.

What are the privacy rules?

  1. Define the purposeFraud prevention and regulatory compliance are different from advertising.
  2. Assess the legal basisIncluding whether PECR consent or an exemption applies; take advice.
  3. Tell usersExplain in the privacy notice.
  4. Limit retentionKeep fingerprints only as long as needed.
  5. Never use for ad targeting without consentThe ICO warns against using it as a cookie substitute [1].

How accurate is device fingerprinting?

Accuracy depends on the device mix and vendor. Fingerprints can change when browsers update, and identical corporate or family devices can look the same. That is why fingerprints should be one signal among several, with confirmed cases used to calibrate. See link scoring.

What should a privacy notice say about fingerprinting?

  • What device data is collected
  • The purposes (fraud prevention, regulatory compliance, security)
  • The legal basis and whether consent is requested
  • How long the data is kept
  • Who it is shared with (for example a fraud vendor)
  • How players can exercise their rights

Worked example: exclusion evasion

  1. New account registers with a different name and email.
  2. Fingerprint matches a device used by a player who self-excluded three months earlier.
  3. Account restricted pending review; identity checks show the same person using a relative’s details.
  4. Account closed; deposits returned; safer gambling record updated.

What mistakes do operators commonly make?

Acting on a device match alone

Shared devices are common.

Using fraud data for marketing

Different purpose, different legal basis.

No privacy notice

Users must be told.

Checklist

  • Purpose documented.
  • Legal basis and consent assessed.
  • Privacy notice updated.
  • Combined with other signals before action.
  • Retention limits set.
  • Fingerprint matches calibrated on confirmed cases.
  • Privacy notice covers fingerprinting.

Frequently asked questions

What is device fingerprinting?

Recognising a device from its attributes without storing anything on it.

Why do casinos use it?

To detect duplicate accounts, fraud, takeovers and exclusion evasion.

Is fingerprinting legal in the UK?

It can be, but the ICO expects fair choices and consent where necessary under PECR.

Can I avoid fingerprinting by clearing cookies?

No, fingerprints are not stored on the device.

Does a device match prove fraud?

No. Shared devices are common, so other signals are needed.

Is fingerprinting used for advertising?

The ICO warns against using it as a cookie substitute without consent.

How long is fingerprint data kept?

Only as long as needed for the stated purpose.

Does fingerprinting help responsible gambling?

Yes, it can detect self-excluded players opening new accounts.

Can fingerprints change?

Yes, for example after browser updates, which affects matching.

Should players be told about fingerprinting?

Yes, in the privacy notice, with the purpose and legal basis.

Sources

  1. ICO: response to Google’s fingerprinting policy change (December 2024)
  2. DLA Piper Privacy Matters: Google’s U-turn on fingerprinting and ICO guidance

Multi-accounting detection

How operators link duplicate accounts using identity, payment, device and behaviour signals.

Account takeover

How player accounts are taken over, the signals to watch, and recovery that does not help attackers.

Bonus abuse

The common bonus abuse schemes, how to detect them and how to enforce terms fairly.

Self-exclusion schemes

GAMSTOP, Spelpaus, OASIS, Cruks, BetGuard, Brazil’s platform and US state lists compared.

Chargeback fraud

Stolen cards, friendly fraud and family fraud: detection, evidence and representment.

Further reading elsewhere