Just slightly more difficult than punching "give me javascript that returns fictional but plausible motion sensor data to a website that asks for it, to spoof that we are on a device that actually has a motion sensor" into ChatGPT.

From the text, feels like user agent should be capable, it should let site request sensor data and randomly reject certain requests after X (random) seconds, while providing fake data in other cases.

I understand that Akamai’s new bot manager does more than just grab telemetry data.

It’s more like a captcha for browsers, i.e. if the user is using a real browser it should behave in a way that pre-scripted bots can’t easy replicate. The payload is auto-injected by Akamai so the expected behaviour can be altered in a non-deterministic way.

Just record couple hours of phone usage IMU data and then feed it to them with random segments added together and they won't by any wiser. Or just rock the phone in it's cradle. There are companies with robots tapping the screens, adding some rocking movements is not going to be that hard.

Extremely easy. You use a headless browser. This is already used heavily for automated testing.

Half of the point of these scripts is to detect headless browsers. Most of them are fairly obvious, and even when they’re hidden, it’s things like what the article mentions that gives them away. For example, headless browsers can’t respond to permission requests, so they’ll likely immediately accept or reject the request for motion data.