What Websites Already Know About You Before You Click Anything

Open any website and, before you click a single thing, it already knows a surprising amount about you. None of it is hacking — it is information your browser hands over as part of making a normal request. Knowing what is on that list is the first step to deciding what you want to do about it.

Your IP address

Every connection needs a return address, so your IP is not optional — a site cannot send you a page without it. What it reveals is narrower than people fear and broader than they expect.

From an IP, a site can look up your internet provider and an approximate location, usually accurate to the city and sometimes only to the country. It cannot reveal your name, your street address or your phone number. Only your provider holds the record of which customer had which address at which time, and that normally requires a legal request to obtain.

Most home connections use a dynamic IP that changes periodically. Mobile data changes more often still, and often puts thousands of users behind one shared address.

Your browser and device

Every request carries a user agent string naming your browser, its version and your operating system. It exists so sites can serve a layout that works on your device, and it is also the first ingredient in fingerprinting.

Your screen and hardware

JavaScript can read your screen resolution, window size, pixel density, colour depth, number of CPU threads and roughly how much memory your device has. Individually these are harmless. Together they start to become distinctive.

Why the combination matters

Here is the uncomfortable part. Your resolution is shared by millions. Your time zone is shared by millions. Your language settings, your browser version, your installed fonts, the exact way your graphics card renders a test image — each is common on its own.

Combine fifteen or twenty of them and the result is frequently unique. That is browser fingerprinting, and unlike cookies there is nothing to delete: the fingerprint is a property of your setup, not a file stored on your machine.

This is how tracking survives cookie blocking, and it is why the privacy advice that actually works is about blending in rather than hiding. A standard browser with default settings is harder to fingerprint than one with an unusual collection of privacy extensions, because the unusual combination is itself the identifier.

What else is visible

• Referrer. The page you arrived from, unless it was stripped.
• Language preferences. The list you set in your browser, in order.
• Time zone. Read from your system clock, which often narrows location further than an IP does.
• Do Not Track. A setting you can turn on. Almost nobody honours it, which is why browsers have started removing it.
• Battery, connection type and more, depending on the browser and permissions.

What actually helps

1. Use a mainstream browser with default settings if fingerprinting is your concern. Firefox and Safari both include resistance features that make many users look alike.
2. Block third-party cookies. This is now the default in Safari and Firefox and removes the simplest cross-site tracking.
3. Use a content blocker. Blocking trackers at the network level prevents most fingerprinting scripts from ever running.
4. A VPN hides your IP from websites — and reveals your entire traffic pattern to the VPN operator instead. That is a trade, not a fix, so choose an operator you would be comfortable having that view.
5. Decline non-essential cookies when a consent banner appears. It takes one extra click and it is the setting with the most direct effect.

None of this makes you invisible, and nothing short of very disciplined habits will. But knowing what is on the list means you can decide which parts you actually mind about, rather than worrying about all of it equally.

Frequently asked questions