IPQualityScore

Overview

IPQualityScore (IPQS) is a fraud prevention service widely integrated into e-commerce, fintech, and advertising platforms. When deployed on a website, its scripts run device fingerprinting and behavioral analysis in the browser to generate real-time risk scores, helping site operators distinguish legitimate visitors from bots, proxy users, and fraudulent actors.

What This Script Does

The IPQS script loads from IPQualityScore's CDN and performs client-side data collection to build a device fingerprint. Data gathered includes:

• Device fingerprinting: Browser type and version, operating system, screen resolution, installed plugins, timezone, language settings, and canvas/WebGL rendering characteristics.
• Network analysis: The visitor's IP address is evaluated against IPQS's threat intelligence database to detect VPNs, proxies, Tor exit nodes, and known-bad IP ranges.
• Behavioral signals: Mouse movement patterns, keystroke timing, and interaction cadence to distinguish human visitors from automated bots.
• Cookies/storage: IPQS may set first-party cookies or use localStorage to persist a device identifier across sessions for returning-visitor recognition.

The collected data is transmitted to ipqualityscore.com API endpoints, which return a fraud risk score used by the site's backend for access decisions (block, challenge, or allow).

Consent & Compliance

IPQualityScore operates in a mixed essential/analytics consent category. The fraud detection function serves a security purpose, while the device fingerprinting and behavioral profiling components collect detailed personal data.

Under GDPR and ePrivacy, device fingerprinting constitutes accessing information on the user's terminal equipment under the ePrivacy Directive, which normally requires consent. However, fraud prevention can qualify for an exemption under Article 6(1)(f) of GDPR (legitimate interest) when the processing is strictly necessary to prevent fraudulent activity. The key test is proportionality — collecting only what is necessary for fraud detection.

Under CCPA/CPRA, the device fingerprinting data constitutes personal information. If the fraud scores are used solely for security purposes and not shared with third parties for other purposes, it falls under the security exception.

Should You Block This Without Consent?

Conditional. The fraud detection functionality serves a legitimate security purpose and can operate without consent under the GDPR legitimate interest basis, provided the implementation is proportionate and limited to fraud prevention. However, if IPQS data is also used for analytics, visitor profiling, or shared with third parties beyond fraud prevention, those additional uses require consent. Review your IPQS configuration to ensure it is scoped to security-only purposes.