AudioContext fingerprinting is not new. Libraries like Fingerprintjs use it, among other device fingerprinting techniques. It's in there since 10 Jun 2018 (http

AudioContext fingerprinting is not new. Libraries like Fingerprintjs use it, among other device fingerprinting techniques. It's in there since 10 Jun 2018 (https://github.com/Valve/fingerprintjs2/commit/caf14daa9e2de105a8a55ae6d9c80667856f4afd https://github.com/Valve/fingerprintjs2/commit/caf14daa9e2de...). Combined with other methods, you can get very good accuracy. If there is an OSS lib to do it, you can bet the adtech companies are doing it even longer. Also, IANAL but I think it's legal under GDPR, Recital 29: > In order to create incentives to apply pseudonymisation when processing personal data, measures of pseudonymisation should, whilst allowing general analysis, be possible within the same controller when that controller has taken technical and organisational measures necessary to ensure, for the processing concerned, that this Regulation is implemented, and that additional information for attributing the personal data to a specific data subject is kept separately. The controller processing the personal data should indicate the authorised persons within the same controller. The fingerprint value is not PI because it can't identify one specific person, but only a device at best (if accurate enough between runs). With enough smart people and good incentive (=adtech), I bet this can be abused to identify the person.