How the Browser Leaks Everything About You. A Full Breakdown
You think the browser is just a window into the internet. In fact it is the most informative surveillance tool that exists. Let us break it down by layers.
What the browser knows about you without cookies
Even if you cleared all cookies, logged out of all accounts and turned on incognito mode — you can still be identified. This is called fingerprinting — a digital fingerprint.
What it consists of (I will show it on my own example)
User Agent — the exact version of the browser and operating system. «Chrome 122.0.6261.112 on Windows 11 64-bit» — this already narrows the circle to millions but not to anonymity. Screen resolution and scaling — 1536x864, DPR 1.375, zoom 1.11. It is precisely these parameters that VK recorded in the remixscreen_* cookies on every visit. Installed fonts — the browser can check which fonts are installed in the system. A combination of 50–100 fonts is unique for each device. Canvas fingerprint — the browser draws an invisible graphic element. Each device renders it slightly differently because of the GPU, drivers, OS. The result is hashed — a unique ID is obtained. WebGL fingerprint — similarly, through 3D graphics. Even more precise than Canvas. AudioContext fingerprint — the browser processes an audio signal. The result depends on the audio chip and drivers — unique for the device. Time zone and language — Europe/Tallinn + ru-RU already says a lot. List of plugins — which extensions are installed in the browser. Mouse and keyboard behaviour — typing speed, mouse-movement patterns. This is a behavioural biometric profile. Unique like a signature. The totality of all these parameters creates a fingerprint that identifies me with an accuracy of 90–99% — without a single cookie, without an account, without a name. Check your fingerprint right now: coveryourtracks.eff.org
What happens when a page loads
You enter a site’s address and press Enter. Over the next 2 seconds the following happens: Millisecond 1–50 — DNS request. Your provider sees which site you are opening. Always. Even with a VPN if the DNS is not encrypted. Millisecond 50–200 — HTML load. The server sees your IP, browser, OS, language, where you came from (Referer). Millisecond 200–500 — the browser begins to load third-party scripts. Google Tag Manager, Facebook Pixel, advertising networks. Each of them receives your IP and begins to read cookies. Millisecond 500–1000 — the RTB auction. Dozens of companies simultaneously receive your profile and place bids for the right to show you advertising. All of this while the page is still loading. Millisecond 1000–2000 — the page is loaded. Session-recording scripts begin recording every mouse movement, every click, every scroll. In one page load your data is received by 10 to 70 companies. Simultaneously.
- BROWSER COMPARISON. HONESTLY AND WITHOUT EMBELLISHMENT.
Chrome (Google)
The most popular browser on the planet — 65% of the market. That is precisely why the most dangerous. What happens under the hood: every search query goes to Google. Browsing history is synced with the Google account. Google Analytics is on 85% of internet sites — Chrome transmits data about every visit. Safe Browsing sends Google a list of the sites you visit for a «security check». Privacy Sandbox — the new system to replace cookies that Google is developing — embeds profiling right into the browser. Google’s business model — advertising. 80% of revenue. Chrome — the main data-collection tool for this model.
Yandex Browser
Chrome with a Russian add-on. Everything Chrome does — plus the transfer of data to Yandex. Yandex Metrica is on millions of sites. The browser syncs with a Yandex account. The data is stored on servers in Russia. For an EU resident — the transfer of data to Russia without a legal basis by default is a violation of Chapter V of GDPR. Russia does not have the status of an «adequate country» by decision of the European Commission. An additional risk: Russian legislation obliges companies to provide data to intelligence services on request without a court decision.
Opera
Owned by a Chinese consortium since 2016. Headquarters — Oslo, but control — Beijing. Opera’s built-in VPN is not a VPN. It is a proxy that proxies only browser traffic and logs it. The data goes through Opera’s servers — a Chinese company. China does not have the status of an «adequate country» under GDPR. The transfer of an EU resident’s data to China — a violation.
Mozilla Firefox
A non-profit organisation. Business model — grants and a partnership with Google (Google pays Firefox to be the default search — about 400 million dollars a year). This creates a conflict of interest but does not make Firefox a surveillance tool. By default Firefox collects telemetry — data about browser usage. This can be turned off in the settings. Firefox with the extensions uBlock Origin + Privacy Badger + Cookie AutoDelete — one of the best options for privacy among mainstream browsers. The downside: it requires manual configuration. Out of the box it is not sufficiently protected.
Brave
Based on Chromium (like Chrome) but with all of Google’s code removed. What it blocks by default without configuration: all advertising trackers, fingerprinting (adds random noise to Canvas and WebGL), third-party cookies, bounce tracking. The built-in Brave Shields works at the browser level — before the scripts load. This is fundamentally different from extensions that block after loading. Controversy: in 2020 Brave was caught adding referral links to crypto sites. The problem was fixed and publicly acknowledged. Since then — clean. Brave Rewards — a built-in crypto-advertising system. Optional and off by default. Conclusion: the best choice for an ordinary user who wants privacy without complex configuration.
Tor Browser
Based on Firefox. All traffic passes through three nodes of the Tor network — each sees only the previous and next node, no one sees the full route. What it gives: real IP anonymity. The same fingerprint for all Tor users — individual identification is impossible. What it does not give: speed. Tor is significantly slower than an ordinary browser. Some sites block Tor nodes. For whom: journalists, activists, people in countries with censorship, legally significant correspondence where full anonymity matters. For everyday use — excessive and inconvenient.
The main principle for evaluating any browser
Three questions
Who is the owner? A Chinese or Russian company — automatically a red flag. Their jurisdiction obliges them to hand data to intelligence services. Is the code open? If not — it is impossible to verify what happens inside. What do they earn on? If the browser is free and takes no subscription — the product is you. The mobile-browser market is a minefield.
Search engines — a separate story
Google Search
Every query is tied to your profile. Google stores search history indefinitely if not deleted manually. Search results are personalised — you see not an objective result but what the algorithm considers necessary to show you specifically.
Yandex Search
Similar to Google — plus Russian jurisdiction.
Startpage
Uses Google’s results but as an intermediary. Google sees Startpage’s IP — not yours. Startpage does not store the history of queries. A Dutch company, GDPR applicable. The user gets Google’s quality without Google’s profiling. The best compromise for those used to Google’s results.
DuckDuckGo
An American company. Does not store search history. But in 2022 it emerged that DuckDuckGo allowed Microsoft to track users through scripts in the browser. After the scandal they fixed it.
- THE BOTTOM LINE. THE ONLY LOGICAL CONCLUSION. You cannot control what the sites you visit do. But you can control which tool you use to visit them. The choice of browser is not a matter of convenience. It is a matter of to whom you give data about every one of your actions on the internet.
Minimal protection right now: Brave + Startpage + Proton VPN with NetShield
Maximum protection for critically important actions: Tor Browser + DuckDuckGo What definitely not to use: Chrome, Yandex Browser, Opera — if privacy matters to you. Firefox — only with configuration and extensions. Out of the box, not enough.
Finally. No browser gives absolute anonymity. But the difference between Chrome and Brave is the difference between an open door and a closed one. Both can be broken into. But one is broken into by anyone who feels like it, the other — only by those who have a specific goal and resources. Choose consciously. Take care of the data about yourself and your loved ones.