A user can delete cookies but can't change the fingerprint reliably. Fingerprints also are easier to secretly share between multiple conspiring parties. Using cookies is a legitimate and more-or-less civilized practice, fingerprints are by definition meant to spy on users against their will. Why do we have cookie warnings but no fingerprinting warnings? Browser fingerprinting should be strictly outlawed for non-police use and require a court order. It's more like eavesdropping rather than like cookies.

Cookies are only mentioned once in the GDPR, as an example in the preamble (paragraph 30). Article 4. defines personal data and identifiers without referencing specific technologies:

> (1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;