Calibration noise as a unique ID
Research (notably the “fingerprinting via accelerometer calibration” work) showed something simple but powerful: the fixed offset and gain errors stamped into a phone’s MEMS sensors (the tiny mechanical chips inside) at the factory are stable and can be measured straight from JavaScript. Record a short burst of readings, fit the calibration curve, and you get an identifier that survives app reinstalls and browser resets - because it comes from the silicon itself, not from any software setting you could clear. Ambient light and magnetometer readings pile on extra entropy (distinguishing power), so the combined fingerprint narrows down to one specific unit.
Browsers pushed back by gating these APIs behind HTTPS (the encrypted connection behind https://), explicit user permission, and slower sampling. But on permissive setups the readings are still a usable fingerprinting signal.
Why it matters for mobile scraping
When you emulate a mobile device - faking a phone User-Agent and touch support - anti-bots on mobile-heavy sites may ask for motion data. A desktop headless browser claiming to be an iPhone returns no DeviceMotionEvent stream, or returns constant zeros. That contradicts the device it claims to be, and a lie detector flags it. So convincing mobile emulation needs plausible, slightly-noisy sensor playback - not silence. That is one reason real-device farms (banks of actual phones) stay popular for the hardest mobile targets.
What it means for mobile and app scraping
Sensor fingerprinting is mostly a mobile problem, and it is brutal for emulators. A headless Android emulator, or a desktop browser pretending to be a phone, reports either no DeviceMotion/DeviceOrientation data at all, or perfectly flat, noise-free values that no real accelerometer ever produces. A genuine device leaks tiny per-unit calibration offsets and a constant trickle of jitter even sitting still on a table - and detectors look for exactly that texture.
This is why real-device farms and residential mobile setups exist for scraping mobile sites and apps at scale: faking a believable sensor stream is far harder than faking a User-Agent. If you only need the mobile content and do not have to pass a hardware check, requesting the mobile version through a web scraping API avoids the sensor surface entirely instead of trying to forge it.