When you visit a page, browser APIs expose capabilities needed by web applications. Some results can also contribute to profiling when they are collected and combined at scale.
Here are 10 observable signals, what they can reveal, and the limitations that matter when interpreting them.
1. GPU Hardware Models (WebGL API)
The WebGL API provides access to hardware-accelerated graphics. When available, WEBGL_debug_renderer_info can return a renderer and vendor string. Browsers may expose an exact model, a generalized value, or a software renderer.
- Risk: Adds graphics-stack information to a broader profile.
- Mitigation: Built-in browser fingerprinting defenses may standardize or restrict the value; aggressive overrides can break graphics-heavy sites.
2. Battery Telemetry (Battery Status API)
The Battery Status API exposes your device's battery level percentage and remaining charging time.
- Risk: Time-varying values can contribute a short-lived correlation signal where the API is available.
- Mitigation: Browser support is limited and values may be rounded. Check current browser policy rather than assuming the API is exposed.
3. Installed System Fonts
Websites can measure text render dimensions to test for the presence of hundreds of pre-installed system fonts.
- Risk: Having custom design or language fonts makes your browser configuration stand out in tracking indexes.
- Solution: Use a browser extension that blocks font measurement or enforces standard system fonts.
4. Local IP Leaks (WebRTC API)
WebRTC gathers ICE candidates to discover possible network paths. Candidates may include mDNS names, private addresses, public endpoints, or relay addresses.
- Risk: A routing problem can expose a public endpoint different from the VPN address; numeric local addresses reveal topology.
- Mitigation: Use a VPN that handles WebRTC, compare addresses, and follow current browser/VPN routing guidance.
5. Audio Processing Hashes (Web Audio API)
By rendering a known signal in an OfflineAudioContext, scripts can summarize differences in the browser and operating system's audio-processing implementation. Offline rendering does not pass through a physical DAC.
- Risk: A repeatable result can add one signal to a broader fingerprint.
- Mitigation: Browser randomization or standardization can reduce stability, with possible compatibility tradeoffs.
6. Timezone Offset & Locale Discrepancies
The Intl.DateTimeFormat().resolvedOptions().timeZone property exposes your system timezone (e.g., Asia/Kolkata).
- Risk: A timezone/IP mismatch may contribute to fraud or profiling models, but does not prove a physical location.
- Mitigation: Privacy browsers may standardize timezone. Manual spoofing can also create inconsistent signals.
7. Media Device Count (MediaDevices API)
Calling navigator.mediaDevices.enumerateDevices() returns the count and connection kinds (mic, speaker, webcam) connected to your computer.
- Risk: Device kinds and counts can add a signal; labels and identifiers are normally permission-gated.
- Mitigation: Review site permissions. Counts can remain visible or incomplete even without capture permission.
8. CPU Logical Cores (Hardware Concurrency)
navigator.hardwareConcurrency returns the number of logical CPU cores on your processor (e.g., 8, 12, or 16).
- Risk: Exposes a coarse hardware tier.
- Mitigation: Some browsers cap or standardize the value. Manual spoofing may cause compatibility issues.
9. Network Connection Estimates (Network Information API)
Exposes your connection type (Wi-Fi, cellular) and estimated download speeds.
- Risk: Adds coarse, changing network information where supported.
- Mitigation: Support varies by browser and values are estimates rather than a speed test.
10. Device Memory API
navigator.deviceMemory returns an approximate, rounded memory tier where supported.
- Risk: Categorizes your device category.
- Mitigation: Browser rounding and caps already reduce precision; blocking or spoofing may affect adaptive sites.
Test Your Browser Leak Status
Visit the BrowserProbe homepage to inspect hardware, network, and privacy signals in one report. Use the evidence and limitation labels before deciding whether a setting change is useful.