they compute the deviceid on the server using signals from the browser. i think having js disabled is just another signal.