Concepts · Core concepts
Visitor ID
What identifies a browser, and why the IP is not an input.
The visitor ID is the stable identifier for a browser profile. It is what lets the question "has this browser been here before" have an answer.
Where it is derived#
On the server, from what the SDK reports, the browser never sends it.
The ordering matters. A visitor ID the client chooses is a cookie with extra steps: clearing storage or opening a private window mints a new "person" every time. Deriving it here means the same profile keeps its ID across sessions, and two profiles that differ only in the value they claim cannot collide.
What goes into it#
Only components that survive a page reload and a browser restart:
- Canvas, audio and math hashes
- The GPU's WebGL vendor, renderer and parameter hash
- Platform, time zone, language list
- Screen width, height, colour depth
- CPU thread count, device memory
- Font names, not the count, two machines with thirty fonts each are routinely different machines
Window size, scroll position and battery level are all measurable and all excluded: they change within a single session, and an identifier that moves mid-session is useless for counting people.
The IP is not an input#
This is a deliberate choice.
A visitor switching from wifi to mobile data is still the same visitor. Folding the address in would split them in two. At the same time, if the other components happened to match, it would merge everyone behind one office NAT into a single person.
The address is still measured and still scored. It just takes no part in answering "who".
The `fpc_vid` cookie#
The SDK puts the identifier in a first-party cookie on your own domain, so your backend can read it and pass it to POST /api/v1/verdict.
The cookie is on your domain and a determined visitor can edit it. It is only used to find a record we wrote ourselves. When no record is found, the verdict is judged from the request rather than the claim, the reply says so with source: "request".
data-cookie="false" turns it off, but then the server-side check has no way to know which browser is knocking, and an operator's block can never take effect.
When an ID changes#
When the hardware or configuration changes enough: a new graphics card, an OS upgrade, newly installed fonts, a different time zone. This is correct behaviour, the ID describes a profile, and that profile is now different.