# brief — and non-complete — technical info on violations A reference catalog of techniques used today to track and collect data about users on the web, on mobile, and in email. Organized by mechanism. None of this is exhaustive — vendors invent new combinations every quarter — but it covers the load-bearing categories as of mid-2026. The intent is descriptive: to name the techniques so a reader can recognize and refuse them. Inclusion here does not imply endorsement. --- ## 1. Storage-based identifiers (the user's own browser holds the ID) ### 1.1 HTTP cookies - **First-party cookies** — set by the site the user is visiting. Survived all recent browser policy changes; they are the backbone of session/login plus most modern analytics. - **Third-party cookies** — set by a domain other than the one in the address bar. Blocked by default in Safari (ITP) and Firefox (ETP). In Chrome they were scheduled for deprecation but Google reversed course in July 2024 and again in October 2025, retiring most of the Privacy Sandbox replacement APIs and keeping third-party cookies enabled by default. They remain the default cross-site identifier on Chrome/Edge. - **CHIPS (Cookies Having Independent Partitioned State)** — a partitioning model where a third-party cookie is keyed to the top-level site, so the same embedded service cannot stitch a user across different parent sites. Surviving Privacy Sandbox feature. - **SameSite=None / Lax / Strict** — controls whether the cookie is sent on cross-site requests. `SameSite=None; Secure` is what cross-site trackers require. ### 1.2 Web storage / databases - **localStorage**, **sessionStorage** — JS key-value stores. Persist IDs that survive cookie clears unless the user wipes site data. - **IndexedDB** — larger structured database in the browser. Used for offline apps and as a regen surface for evercookie-style tracking. - **Web SQL** (deprecated, still present in some embedded WebViews). - **Cache Storage / Service Worker caches** — content cached by a service worker can encode an ID (e.g., the URL of a precached asset). - **File System Access API** — origin-private filesystems (OPFS) provide another persistence vector. ### 1.3 Cache- and metadata-based identifiers (no storage permission needed) - **ETag tracking** — server returns a unique `ETag` per visitor; the browser sends it back in `If-None-Match` on the next request. - **Last-Modified** — same idea, different header. - **HSTS supercookies** — encode bits of an ID across many subdomains by toggling HSTS pins. - **HTTP/2 and HTTP/3 connection coalescing / 0-RTT tickets** — session resumption tickets can carry an identifier across connections. - **TLS session tickets / session IDs** — same family. - **Favicon cache** — variants of the favicon URL persist across incognito sessions in some browsers. - **Browser back/forward cache, prefetch state** — secondary surfaces for ID re-injection. ### 1.4 Service workers and background scripts A registered service worker runs across visits, intercepts network requests, and can re-establish identity even after cookies are cleared. Combined with Cache Storage and Background Sync, it turns the browser into a tracker host. ### 1.5 Supercookies and evercookies - **Evercookie** (open-source PoC by samy.pl) writes the same identifier to ~15 different storage mechanisms (cookies, localStorage, IndexedDB, ETag, HSTS, Flash LSO historically, Silverlight, window.name, etc.) and respawns it from any surviving copy. Its descendants live on as commercial fraud-prevention SDKs. - **ISP supercookies / UIDH (Unique Identifier Header)** — the network operator (Verizon was the famous case) injects a unique header into outbound HTTP requests at the carrier. The user cannot remove it from the browser; it lives on the ISP's edge. - **Zombie cookies** — generic term for any cookie that respawns after deletion via one of the above mechanisms. --- ## 2. Browser fingerprinting (no storage; "the browser is the ID") The browser's hardware + software configuration is read out and hashed. Fingerprints can re-identify a user with 80–95% accuracy across cookie clears and incognito sessions, and ML systems now flag anti-fingerprint countermeasures by their inconsistency patterns. ### 2.1 Graphics / rendering - **Canvas fingerprinting** — render text and shapes to an off-screen 2D canvas, hash the pixel output. GPU + driver + font hinting + AA settings each shift pixels deterministically. - **WebGL fingerprinting** — read GPU vendor/renderer strings, shader precision, supported extensions, and run shader programs whose output varies by GPU model. - **WebGPU fingerprinting** (newer) — the WebGPU adapter exposes more granular capability flags than WebGL; emerging high-entropy signal. - **Font enumeration** — measure rendered glyph metrics for each font in a list to detect which fonts are installed. - **Emoji rendering** — variant per OS/font version. ### 2.2 Audio - **AudioContext fingerprinting** — process a known waveform through `OfflineAudioContext`, hash the output. Differs by audio stack version. Safari 17+ injects randomization in Private mode. ### 2.3 System/device - `navigator.userAgent`, **User-Agent Client Hints** (`Sec-CH-UA-*`) — browser, version, platform, mobile flag, architecture, model, full version list. - `navigator.hardwareConcurrency` — logical CPU count. - `navigator.deviceMemory` — RAM bucket. - `navigator.platform`, `navigator.oscpu`. - `screen.width/height/availWidth/colorDepth`, `window.devicePixelRatio`. - `Intl.DateTimeFormat().resolvedOptions().timeZone` and `Date.getTimezoneOffset()`. - `navigator.languages`. - **Battery Status API** (deprecated/removed in most browsers) — formerly used to correlate visits within ~30 minutes. - **Network Information API** — connection type, downlink. - **Permissions API** — query state for camera/mic/geo/notifications adds entropy. - **Media devices** — `enumerateDevices()` returns deviceIds (per-origin hashed) and device labels once permission is granted. - **Speech synthesis voices** — `speechSynthesis.getVoices()` reveals OS voice list. - **Plugins / MIME types** — mostly empty in modern Chromium but still reads in some browsers. - **Math/floating-point quirks** — small differences in `Math.tan`, `Math.exp` across CPUs/runtimes. - **CSS feature detection** — `@media`, `prefers-color-scheme`, `prefers-reduced-motion`. - **Sensor APIs** — Generic Sensor API exposes accelerometer, gyroscope, magnetometer, ambient light, orientation. Mobile-specific. Activity inference (walking/running/typing) is feasible. ### 2.4 Behavioral fingerprint additions - **Mouse-movement curves** and **touch-event timing** carry per-user entropy beyond the static config. --- ## 3. Network- and protocol-level fingerprinting These work even if the browser is locked down, because they happen below the JS layer. - **IP address** — coarse geolocation, ASN, VPN/datacenter detection. Combined with a small fingerprint, often unique. - **TCP/IP stack fingerprinting** (p0f-style) — TTL, window size, options ordering. - **TLS JA3 / JA3S** — hash of the ClientHello (cipher list, extension order, EC curves, EC point formats). Largely superseded. - **TLS JA4 / JA4+** — Cloudflare/AWS/VirusTotal industry standard. Sorts ciphers and extensions deterministically before hashing, which defeats the per-connection randomization Chrome and Firefox introduced. Used at the edge to flag headless browsers, automation libraries, and malware-family TLS stacks. - **HTTP/2 fingerprinting** (Akamai) — SETTINGS frame values, window-update sizes, header order, priority frames. Headless browsers and HTTP libraries each have a recognizable pattern. - **HTTP/3 / QUIC fingerprinting** — initial packet structure, transport parameters. - **DNS-side observables** — the resolver sees every domain the user visits if not using DoH/DoT to a third party. - **CNAME cloaking** — site sets up `analytics.example.com` and CNAMEs it to a tracker (Adobe, Eulerian, Pardot, etc.). The browser sees a first-party request, so cookies set on that subdomain dodge third-party-cookie blocking. Studies put adoption around 10–15% of EU enterprise sites. Safari (WebKit) caps the lifetime of cookies set on CNAME-cloaked responses to 7 days; Brave and Firefox uncloak via tracker lists. - **WebRTC ICE candidate leak** — `RTCPeerConnection` enumerates local network IPs (192.168.x.x, etc.) and the public IP from STUN, regardless of VPN state, unless WebRTC is disabled or the browser is hardened (Brave, Tor, recent Firefox with `media.peerconnection.ice.proxy_only`). - **WebSocket and EventSource** timing — long-lived connections with per-user IDs. - **DNS prefetch / preconnect** — leaks intent before the user even clicks. --- ## 4. Behavioral and interaction telemetry Captured by JS embedded on the page and sent to a backend. - **Pointer telemetry** — mousemove velocity, acceleration, jitter, click coordinates, hover dwell. Used for heatmaps and bot detection alike. - **Scroll depth, scroll velocity, rage-scroll detection.** - **Click maps and rage-click detection.** - **Keystroke dynamics** — flight time (key-up to next key-down) and dwell time (key-down to key-up). Per-user identifying at high accuracy. Also used for emotion/fatigue inference. Recent research reports >99% accuracy distinguishing humans from bots from keystroke and mouse traces. - **Form interaction telemetry** — captures characters as they are typed, field focus order, abandoned fields. The "submit" button is irrelevant to the recorder. - **Session replay** — full DOM-mutation recording (FullStory, Microsoft Clarity, Hotjar, LogRocket, Mida, UXCam, Glassbox). Reconstructs the visit as a video. Documented leaks of credit cards, passwords, and PHI when masking is misconfigured. Drove a wave of ~1,500 CIPA wiretap lawsuits in the US in the 18 months before mid-2025. - **Engagement / dwell** — visibility-API-based time-in-view per element. - **Copy/paste, right-click, print, screenshot detection** (the latter via UI-state heuristics). - **Battery-drain and device-thermal inferences** (where APIs allow). --- ## 5. Cross-site stitching Mechanisms that link the same user across multiple sites. - **Tracking pixels** — 1×1 image (or invisible iframe, or `