I've yet to see a satisfying, realistic answer to what to do about fingerprinting. Every proposal I've seen would A) cause significant harm to legitimate use of Web API features, and B) not actually make users un-fingerprintable.

So WebGL/Web Audio/et. al. leak information about your system. What are you going to do about it? Argue that these sorts of features should be reserved for native apps and remove them completely, or hobble them to the point that they are basically useless? (At which point you might as well just remove them completely.)

Okay, let's do that. Let's force every WebGL developer to start making native apps instead. We do not have a write-once-run-anywhere platform for developing applications that is anywhere near as reliable as the Web. So now, developers need to massively explode their project configuration to build all the native versions of their app for all the platforms that were previously supported by their web app. Every new release of their project has to go through a walled garden approval process. Hope you aren't a doing anything Apple or Google don't approve of!

It was painful, but here we are: users aren't fingerprintable.

Wrong. It's even easier now. The native application platforms give the nefarious data collector so much more access to be able to fingerprint users. Hell, you are often readily given a unique user identifier by the app platform. Even if the user resets that ID, it's not going to bug you too much because you'll just re-fingerprint them and then be able to correlate the new data to the old. Oh, you're not allowed to do that by the platform ToS? How long does it take to catch you doing that? And do you actually get banned, or told to cease and desist in favor of purchasing the same data directly from the platform? It's so nice of Google to make suggestions on what not to do here, wink wink nudge nudge https://developer.android.com/training/articles/user-data-id.... How would they even know if you were bridging advertiser IDs in your own database completely out of their control?

And your browser sessions are still fingerprintable, too, because even the most basic of common information that has been transmitted to HTTP servers since day 1 is enough to fingerprint users.

You've succeeded in none of your goals to reduce fingerprinting but have harmed legitimate developers massively. All for what? Because of essentialist arguments about how the Web used to be?

The problem is not that application platforms leak data. We are walking, talking data leaks by our very nature of not being 100% literal clones of everyone else. Maybe in the 1960s you could walk into a shop and pay cash for something and reasonably assume that nobody was videotaping you and collecting your credit card number and storing all this information in a database, but that ship sailed a long time ago. The problem is that collecting this data, correlating it, colluding between other data collectors, and selling it off to the highest bidder is not regulated. Look at all the data breaches that credit reporting services like Experian have allowed to happen to them. All of this data is a potential weapon against users and it's just sitting around in woefully underregulated databases, everyone hoping the likes of Equifax know what they're doing (when they have demonstrated on several occasions they don't).

But browsers and web app developers. That's where we need to draw the line. Right.