What a site reads about you

Everything a site learns in a visit falls into four groups, and the four are not equally changeable. Knowing which group a value sits in is the point of this lesson.

The lessons after this one take the groups apart value by value. This one is the map.

• Reported outright

  The platform, the clock, the languages, the screen, the fonts, the counts of cores and cameras.

• Computed by drawing

  A picture, a triangle and a tone are rendered, and the result is read back as a number.

• Carried by the network

  The exit address, the country and network behind it, and the connection the browser describes.

• Assembled from behaviour

  The hour you act, the pace you keep, the order of your clicks, the text you leave.

Most of the set is handed over on request, with no prompt and no permission. The browser and its version, the system and its version, the clock, the languages, the screen and the amount of hardware behind it.

Two of those answers surprise people. The browser also says how many microphones, speakers and cameras the machine has, and which languages its speech voices cover.

• The agent string and client hints

  The same facts twice: one long line of text, and a set of fields a site can ask for separately.

• Clock and languages

  The timezone as the system resolves it, and the whole ordered list of languages rather than the first one.

• Screen and memory

  Width, height, pixel ratio and colour depth, next to the number of cores and the heap ceiling.

• Fonts

  Measured by the width of a rendered line, so nothing has to admit the list for it to be read.

• Devices and voices

  How many microphones, speakers and cameras answer, and what languages the installed voices speak.

• The connection

  A coarse latency and a capped speed, with the kind of connection derived from the latency.

Some answers are not stored anywhere, so a site computes them instead of asking. It tells the browser to draw or to render something and reads the result back as a number.

The same instructions come out slightly differently on different cards, drivers and systems. That difference is the value, and it needs no cooperation from you.

• Canvas

  Text and shapes on a small canvas, read back as one long string and folded into a short hash.

• WebGL

  The card and vendor names, and then the actual pixels of a rendered triangle read straight out of the buffer.

• The audio path

  A tone pushed through a compressor and rendered with no speaker involved, then summed sample by sample.

The exit address comes with the request itself and cannot be talked out of. Behind it a site reads the country, the city, the network number and the name of whoever owns that network.

The browser adds its own rough picture of the line. It rounds the latency to a coarse step and caps the speed, then scales both by a factor drawn from the site's own name, so one machine reports slightly different figures to different sites.

Nothing above has anything to do with you. Behaviour does, and it is the part no browser answers for.

The hour, the pace, the order of actions and the content left behind are read across accounts as readily as a screen size. Accounts posting one text in one minute need no device in common to be linked.

This is the table worth keeping. It says where each group comes from, and how much of it a separate browser profile can change.

Any single value is shared with millions of machines and identifies nobody. The set of three dozen is another matter, and so is whether its parts agree.

A clock from one country next to a language list from another is a louder signal than either value alone. That is why a profile takes its clock and its languages from the country it leaves through, rather than from a dice roll.

You can read your own set without installing anything: the free check on this site reads 12 of these values in your browser and sends none of them anywhere.

Inside the app the reading goes further. The self-test takes 29 readings of a profile, and it puts the same questions to a hidden frame and a background worker, because a page is allowed to ask them there too.