What Data Does Your Browser Leak? A Complete Privacy Guide

Every time you visit a website, your browser shares a surprising amount of information — even before you click anything or log in. This data is accessible through standard browser APIs and HTTP headers, and most of it is shared without asking your permission.

Here is what websites can typically see:

• Your IP address (and thus your approximate location, ISP, and connection type)
• Your browser name, version, and operating system
• Your screen resolution and window size
• Your timezone and language preferences
• Your installed plugins and fonts
• Whether you're using a VPN, proxy, or Tor
• Your WebRTC local IP (potentially revealing your real IP behind a VPN)
• Your battery status (on some mobile browsers)
• Your hardware specifications (GPU, CPU core count, memory)

You can check exactly what your browser reveals right now using LookMyIP's Privacy Check tool at lookmyip.com/privacy-check.

Your IP address is the most obvious piece of identifying information you share with every website. It reveals:

• Approximate location: Typically accurate to the city level (within 25-50 miles)
• ISP: Your Internet Service Provider
• Connection type: Whether you're on a residential, business, or mobile connection
• ASN: The network your traffic routes through

WebRTC leaks are a particularly sneaky problem. WebRTC (Web Real-Time Communication) is a browser technology used for video calls and peer-to-peer connections. It can expose your real, local IP address even when you're using a VPN, because it queries your network interfaces directly.

LookMyIP automatically detects WebRTC leaks and warns you if your real IP is exposed while using a VPN.

How to prevent IP leaks:

• Use a VPN to mask your public IP
• Disable WebRTC in your browser (Firefox: set media.peerconnection.enabled to false in about:config)
• Use browser extensions like WebRTC Leak Prevent or uBlock Origin

Browser fingerprinting creates a unique identifier for you based on the combination of your browser and system characteristics. Even without cookies, a website can identify you with high accuracy.

Key fingerprint components:

• Canvas fingerprinting: Websites draw invisible images using HTML5 Canvas. Tiny differences in how your GPU renders these images create a unique hash.
• WebGL fingerprinting: Similar to canvas but uses 3D graphics rendering, which varies by GPU model and driver version.
• Audio fingerprinting: Processing audio through the AudioContext API produces device-specific variations.
• Font enumeration: The set of fonts installed on your system is surprisingly unique.
• Screen and window properties: Resolution, color depth, pixel ratio, and window size.
• Navigator properties: Timezone, language, platform, hardware concurrency (CPU cores), device memory.

Studies show that browser fingerprints are unique for over 90% of users. Even if you clear cookies, your fingerprint remains the same — making it a powerful tracking mechanism.

Protection:

• Firefox with Enhanced Tracking Protection resists fingerprinting
• Tor Browser standardizes fingerprint characteristics across all users
• Brave Browser includes built-in fingerprint randomization
• Extensions like CanvasBlocker can spoof canvas fingerprints

First-party cookies are set by the website you're visiting. They're generally useful — keeping you logged in, remembering preferences, maintaining shopping carts.

Third-party cookies are set by external domains (ad networks, analytics services, social media widgets) embedded in the page you're visiting. These enable cross-site tracking — following you across different websites to build a browsing profile.

Major browser changes:

• Safari and Firefox already block third-party cookies by default
• Chrome has been working toward phasing them out (with Privacy Sandbox as a replacement)
• Many tracking services have adapted by using first-party cookies via CNAME cloaking or server-side tracking

Beyond cookies: Even if you block all cookies, trackers use fingerprinting, local storage, IndexedDB, ETags, and other storage mechanisms to persist identifiers. True privacy requires a multi-layered approach.

Level 1 — Basic (easy, minimal inconvenience):

• Use a modern browser with tracking protection (Firefox, Brave, or Safari)
• Install uBlock Origin ad/tracker blocker
• Use a reputable VPN service
• Check your exposure with LookMyIP's Privacy Check tool

Level 2 — Enhanced (some inconvenience):

• Disable WebRTC in browser settings
• Use Firefox with strict Enhanced Tracking Protection
• Use a privacy-focused search engine (DuckDuckGo, Brave Search)
• Clear cookies regularly or use container tabs (Firefox Multi-Account Containers)
• Disable JavaScript on sites that don't need it (NoScript extension)

Level 3 — Maximum (significant inconvenience):

• Use Tor Browser for sensitive browsing
• Use Tails OS for maximum anonymity
• Disable JavaScript by default
• Use separate browser profiles for different activities
• Avoid logging into any accounts while browsing anonymously

The right level depends on your threat model. For most people, Level 1–2 provides excellent privacy without breaking their browsing experience.

Third-party cookie blocking has been default in Safari since 2020 and Firefox since 2019, and Chrome has spent years attempting the same. Tracking did not stop. It moved.

CNAME cloaking is the most widespread workaround. A tracker persuades the site owner to point a subdomain — analytics.example.com — at the tracker's infrastructure via CNAME. To the browser, cookies set on that hostname are *first-party*, because the hostname is on the site's own domain. Every third-party cookie protection is bypassed, and the tracker also gains access to any cookie scoped to the parent domain. uBlock Origin on Firefox can resolve CNAMEs and unmask this; most other blockers cannot.

Storage beyond cookies. localStorage, sessionStorage, IndexedDB, the Cache API and service workers all persist data and were historically outside cookie controls. The response has been state partitioning: browsers now key every storage mechanism to the top-level site, so an identifier written by a tracker on one site is invisible to the same tracker on another.

Server-side tagging moves the tracking script to the site's own server, which then forwards data to the analytics provider. Nothing the browser can see distinguishes it from ordinary application traffic.

Fingerprinting requires no storage at all, which is why it has become the fallback of choice. It is covered in detail below.

Link decoration appends an identifier to outbound URLs — the fbclid, gclid and msclkid parameters. The receiving site reads the parameter and reconstructs the association without any cross-site storage. Firefox and Safari now strip several known parameters automatically.

The pattern across all five is the same: each protection closes one channel, and the industry moves to another. Meaningful privacy comes from reducing the surface generally — a content blocker, a browser that partitions state by default — rather than from closing individual holes as they appear.

Rather than trusting configuration, measure. A handful of checks establish your real exposure in a few minutes.

Your IP and what it reveals. Start with the IP lookup to see your address, ISP, ASN and approximate location as a site sees them. Then run the privacy and leak test, which checks for WebRTC and proxy header leaks specifically.

WebRTC leaks. This is the one that undermines VPNs. Test it directly in the browser console:

const pc = new RTCPeerConnection({iceServers:[{urls:'stun:stun.l.google.com:19302'}]})
pc.onicecandidate = e => e.candidate && console.log(e.candidate.candidate)
pc.createDataChannel('')
pc.createOffer().then(o => pc.setLocalDescription(o))

Any public address in the output that is not your VPN's exit address is a leak. Modern browsers obfuscate local addresses with mDNS hostnames ending in .local, which is expected and not a leak.

DNS leaks. Confirm which resolver your queries actually reach:

nslookup -type=txt o-o.myaddr.l.google.com ns1.google.com

If that returns your ISP's address while you are connected to a VPN, your DNS is outside the tunnel and your ISP still sees every domain you visit.

Fingerprint uniqueness. The EFF's Cover Your Tracks and the open-source fingerprintjs demo both report how distinctive your browser is. A result of "unique among N tested browsers" means storage-free tracking works on you regardless of cookie settings.

Header leakage. Check what your browser volunteers:

curl -s https://httpbin.org/headers

Run the same from your browser and compare. Accept-Language, User-Agent and Sec-CH-UA client hints together are often enough for a strong partial fingerprint.

Re-test after every browser update. Defaults change, and extensions break silently.

Browser fingerprinting builds an identifier from characteristics your browser reveals as a side effect of working normally — no storage, nothing to clear, nothing to consent to.

The strongest signals:

Canvas fingerprinting renders text and shapes to an off-screen canvas and hashes the pixels. Differences in GPU, driver, font rasterisation and anti-aliasing produce a stable, highly distinctive value.

WebGL fingerprinting goes further, exposing the GPU vendor and renderer strings directly along with dozens of capability parameters.

AudioContext fingerprinting processes an audio signal and hashes the output, which varies by audio stack implementation.

Font enumeration measures rendered text dimensions to detect which fonts are installed — a set that is often close to unique, particularly on systems with design or language packs installed.

Screen, timezone, language, hardware concurrency, device memory and dozens of smaller attributes fill in the rest.

Here is the trap that makes naive countermeasures backfire. Privacy depends on your anonymity set — how many other people look identical to you. Installing five anti-fingerprinting extensions, spoofing your user agent, and disabling canvas produces a browser that is *more* unusual than a default one, not less. You have made yourself the only visitor with that exact contradictory combination, which is a better identifier than the one you were trying to hide.

Two coherent strategies exist, and mixing them is worse than either:

Blend in. Use the Tor Browser, or Firefox with privacy.resistFingerprinting enabled, both of which make every user report identical values. Your fingerprint stops distinguishing you because thousands of people share it.

Reduce the surface. Use a mainstream browser with default settings plus a content blocker, so that the fingerprinting scripts never load. You remain fingerprintable in principle, but far fewer parties collect it.

Do not attempt to be both unusual and hidden.

Does a VPN protect my privacy from websites?

It changes your apparent IP address and nothing else. Your fingerprint, cookies, and any account you log into are unaffected. It is effective against network-level observation — your ISP, a public Wi-Fi operator — and largely ineffective against the sites you visit.

Is private browsing mode useless then?

Not useless, but narrowly scoped. It prevents local storage of history, cookies and form data, which protects you from other people using your device. Websites, your ISP and your employer see exactly what they otherwise would. It is a local-privacy feature, not a network-privacy one.

Which browser is best for privacy?

Tor Browser is the strongest by a wide margin, at a real cost in speed and site compatibility. Firefox with strict Enhanced Tracking Protection is a good everyday balance. Safari has strong defaults, particularly Intelligent Tracking Prevention. Brave blocks aggressively out of the box. Chrome is the weakest default, being built by an advertising company.

Do "Do Not Track" and Global Privacy Control work?

Do Not Track is dead — it was voluntary, almost universally ignored, and has been removed from Firefox. Global Privacy Control is different because several jurisdictions, notably California under CCPA, treat it as a legally binding opt-out signal. Enable it; it costs nothing and has legal force in some places.

How often should I clear cookies?

Regular clearing helps less than it used to, since partitioned storage limits cross-site value and fingerprinting ignores storage entirely. A container or profile-based approach — keeping logged-in sessions isolated from general browsing — provides more benefit than periodic clearing, and does not log you out of everything.