A recent Youtube Web update has added a canvas whenever the seek bar is visible, an HTML5 canvas pops up. This was not asked for and not needed. If you disable canvases for privacy, this will cause a horrific red bad to cover half the screen until you hide the seekbar. Canvases can be used for fingerprinting, which I’m sure Google is doing here.
It’s just an API that allows a web page to draw in a box. The problem is, that for a bunch of technical reasons that I’m mostly not aware of, it can be used to fingerprint you.
The canvas API needs specific access to hardware that isn’t usually available via browser APIs. It’s usually harder to get specific capability information from a user’s GPU for example. The canvas API needs capability information to decide how to draw objects across differently capable hardware, and those extra data points make it that much easier to uniquely identify a user. The more data points you can collect, the more unique each visitor is.
Here’s a good utility from the EFF to demonstrate the concept if you or anyone else is curious.
https://coveryourtracks.eff.org/