In more detail
Manufacturing imperfections make each sensor pixel respond very slightly differently to the same light. That fixed pattern is tiny compared with random noise, but it is the same in every photo the camera takes. Averaging the noise residual (the image minus a denoised copy of itself) over a few dozen photos reveals the pattern, and a questioned photo can then be tested for it by correlation. Heavy compression, resizing, cropping and editing weaken the match, so results are probabilistic, not proof.
Why it matters
PRNU can link an anonymous photo to a specific camera without relying on Metadata, which is easy to strip or forge. It can also show that part of an image came from a different sensor. A weak or missing match is not evidence of tampering, though: platforms that recompress uploads destroy much of the signal.
Example
A simulation with 20,000 pixels: a fingerprint estimated from 50 photos of camera A correlated 0.117 with a new photo from A, 0.038 with a low-quality version of it, and -0.0005 with a photo from camera B. Real matches are judged the same way: a correlation of a few hundredths to a tenth can be decisive, while values near zero mean no link. See the image forensics tool.
Common confusion
PRNU is a property of the sensor and shows in the pixels. It is not Metadata such as EXIF, and it is different from Error level analysis (ELA), which looks for inconsistent compression.