What a website sees in one visit
You haven’t logged in, clicked anything or typed a word, and the website already knows quite a lot about you. In this lesson you’ll look at that information yourself, on your own device, and sort it into what actually identifies you and what only sounds alarming.
In this lesson
- See the network information a site gets from your IP address
- See the details your browser hands over without asking
- Understand how ordinary details add up to a “fingerprint”
You’ll need: a computer or phone and a browser. A second browser (for example Chrome and Firefox, or Safari and Chrome) makes the last exercise more interesting.
Two sources of information
Everything a website learns about you on the first visit comes from two places:
- Your connection. To send you the page at all, the site’s server has to know where to send it: your public IP address. From that address, databases can work out your internet provider, the network it belongs to and a rough location.
- Your browser. To show the page properly, your browser tells the site, or lets its scripts ask, about your screen, language, timezone, operating system and hardware. None of this needs your permission, because it’s what pages use to lay themselves out.
Neither of these is a hack or a leak. It’s how the web works. The privacy question is what happens when a site, or a company that follows you across many sites, keeps it and combines it.
Try it yourself · part 1
What your connection gives away
- Open our IP address checker. Every website you visit can see the same things it shows you.
- Look at Location. It’s usually a city or region, and often not quite yours: it’s where your provider’s address block is registered, which is frequently a nearby city or your provider’s local hub. Write it down.
- Look at Provider and Network (ASN). That’s the company and network your traffic comes from. It’s correct almost every time, because providers register their address blocks publicly.
- Look at the label under your address. Residential connection means a home internet line, Mobile network a phone carrier, and VPN or datacentre network a server in a data centre, which is what most VPNs use. Sites use the same label to decide how much to trust a visitor.
- Notice what isn’t there: your name, your street address, your account with the provider. Only your provider can link the address to you, and normally only for a court order.
Try it yourself · part 2
What your browser gives away
- Open What This Website Already Knows About You. It reads what any site can read when you arrive, and shows it to you instead of saving it.
- Go down the list. You’ll see your browser and system, screen, languages, timezone, graphics chip, whether you have a touch screen, how you arrived at the page and whether cookies are on.
- For each one, ask: would this tell a stranger who I am? On its own, almost none of it would. Millions of people use the same browser, the same screen size and the same language.
- Now find the Canvas fingerprint. It’s a short code made from the tiny differences in how your particular device draws a hidden test image. It isn’t your name, but it tends to stay the same every time you visit with this browser on this device.
From ordinary details to a fingerprint
A browser fingerprint is all of those ordinary details combined. “Chrome on Windows” describes hundreds of millions of people. “Chrome on Windows, this exact screen size, these three languages, this timezone, this graphics chip and this canvas code” describes far fewer, sometimes only one.
That matters because a fingerprint works without cookies. You can clear your cookies and the combination stays the same, so a tracking company that sees it on two different sites can guess it’s the same person. It’s a guess, not a certainty, and browsers keep changing to make it less reliable, but it’s why “I delete my cookies” isn’t the whole answer.
Try it yourself · part 3
See the fingerprint change, and stay the same
- On the What We Know page, write down the first few characters of your canvas fingerprint. Reload the page: in most browsers it comes back exactly the same.
- Open the same page in a different browser on the same device. The canvas code is usually different, and so is the browser line, even though your IP address is identical.
- Some privacy-focused browsers, such as Brave, deliberately vary the canvas result so it can’t be used to follow you. If yours changes on every reload, that’s the protection working.
- Finally, open our Privacy Exposure Score. It runs six checks in your browser, including your address and network, WebRTC, IPv6, timezone consistency and your fingerprint, and scores how much you give away. Note your score: you’ll come back to it in Lesson 5.
What a site can’t see without asking
Some things always need your permission, and the browser shows a prompt before handing them over: your precise location from GPS, your camera and microphone, your contacts and your files. If a site gets those, it’s because someone clicked Allow. That’s why the browser permission prompt is worth reading every time instead of clicking through.
Anything you type or log in with is different again. The moment you sign in, the site knows exactly who you are, whatever your IP address or fingerprint says. Lessons 3 and 4 come back to that.
Key takeaways
- Your IP address gives a site your provider, your network type and a rough location, not your identity.
- Your browser shares dozens of ordinary details automatically, so pages can display properly.
- Combined, those details form a fingerprint that can recognise your browser even after you delete cookies.
- Precise location, camera, microphone and files always need your permission.
- Logging in identifies you completely, whatever else you do.
Check yourself
Three questions. Pick one answer each and you’ll see why.
1. A website knows your IP address. What can it usually work out from that alone?
2. You delete all your cookies. Why might a tracking company still recognise your browser?
3. Which of these can a website NOT get without your permission?
Want the full picture? What Does Your IP Address Reveal? goes deeper into the network side, and How Accurate Is IP Geolocation? explains why the location is so often off.
This lesson is part of the free course Privacy and VPNs, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.