Skip to main content

Website evidence · pilot dataset

Does bankofamerica.com fingerprint you?

Browser signals observed; fingerprinting is unconfirmed.

Browser API activity met a monitored signal threshold in the latest measured scans. The activity alone does not establish a tracking purpose.

Open evidence JSON ↗

All 2 source records are included in the JSON. Scan timestamps and versions are shown as recorded. The tabs show the latest usable homepage measurement for each setup. Later failed attempts remain in the history. Scan scope and methodology ↗

Inside the scan

← All websites

Earlier measurement shown. Review the scan time and subsequent attempts below.

Visitor setup

Signals observed

1 of 5 signal families observed

Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Observed
Measurement
Measured
Page context
Page document
Scan time
2026-10-21T22:50:59.638733Z
Browser / scanner
156.0.8078.4 / 0.3

Captured titleBank of America - Banking, Credit Cards, Loans and Merrill Investing

CanvasDraws text and reads canvas output.1 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext3 calls

Frame: https://www.bankofamerica.com/

  • Inline caller recorded
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 5 · col 43412
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 13 · col 146386
WebGLQueries the graphics environment.0 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

No matching API call was captured.

AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.0 API entries

Observed requires at least ten text-measurement calls. Guide ↗

No matching API call was captured.

DeviceReads browser and display properties.9 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

navigator.doNotTrack1 calls

Frame: https://www.bankofamerica.com/

  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 203 · col 159
navigator.maxTouchPoints1 calls

Frame: https://www.bankofamerica.com/

  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 23 · col 560
navigator.platform4 calls

Frame: https://www.bankofamerica.com/

  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 1 · col 24203
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 1 · col 24266
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 1 · col 24396
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 17 · col 557140
navigator.plugins24 calls

Frame: https://www.bankofamerica.com/

  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 304 · col 271
  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 304 · col 296
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 23 · col 5077
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 23 · col 5110
navigator.userAgent25 calls

Frame: https://www.bankofamerica.com/

  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 5 · col 31931
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 13 · col 66706
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 17 · col 33
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 17 · col 4573
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 17 · col 557062
screen.colorDepth2 calls

Frame: https://www.bankofamerica.com/

  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 304 · col 493
  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 304 · col 512
screen.height7 calls

Frame: https://www.bankofamerica.com/

  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 304 · col 469
  • https://www1.bac-assets.com//homepage/spa-assets/js/pages/homepage-dap-es6-page-31a5382f433176772fe0.m.jsline 1 · col 281407
screen.width7 calls

Frame: https://www.bankofamerica.com/

  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 304 · col 456
  • https://www1.bac-assets.com//homepage/spa-assets/js/pages/homepage-dap-es6-page-31a5382f433176772fe0.m.jsline 1 · col 281398
window.devicePixelRatio1 calls

Frame: https://www.bankofamerica.com/

  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 17 · col 4936
Providers, script signatures, and DNS 0 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

Static script signatures

  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsArkose Labs · 1 API patterns

CNAME delegation

  • adobedc.demdex.net → demdex.net.ssl.sc.omtrdc.net

DNS delegation identifies infrastructure; it does not prove which browser code ran.

Network and worker observations 146 requests
Captured scripts
5
Instrumented frames
1
Google Ads observed
No
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

Third-party hosts

  • adobedc.demdex.net
  • secure.bac-assets.com
  • secure1.bac-assets.com
  • tags.tiqcdn.com
  • www1.bac-assets.com
Other recorded API calls 2
  • document.cookie.read116 calls
  • document.cookie.write17 calls
Source record and integrity
Original source
results/headful/bankofamerica-com-20261021T225059.json
Original file SHA-256
ed2c5008689b90d8c0cf725080857ecb68a41d6e361a7e8ee517c323d55be489

Run ID: headful-ed2c5008689b. The JSON contains sanitized observations, not the original private scan payload.

Earlier measurement shown. Review the scan time and subsequent attempts below.

Research setup

Signals observed

1 of 5 signal families observed

Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Observed
Measurement
Measured
Page context
Page document
Scan time
2026-10-21T21:10:00.769191Z
Browser / scanner
156.0.8078.4 / 0.3

Captured titleBank of America - Banking, Credit Cards, Loans and Merrill Investing

CanvasDraws text and reads canvas output.1 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext3 calls

Frame: https://www.bankofamerica.com/

  • Inline caller recorded
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 5 · col 43412
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 13 · col 146386
WebGLQueries the graphics environment.0 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

No matching API call was captured.

AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.0 API entries

Observed requires at least ten text-measurement calls. Guide ↗

No matching API call was captured.

DeviceReads browser and display properties.9 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

navigator.doNotTrack1 calls

Frame: https://www.bankofamerica.com/

  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 203 · col 159
navigator.maxTouchPoints1 calls

Frame: https://www.bankofamerica.com/

  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 23 · col 560
navigator.platform4 calls

Frame: https://www.bankofamerica.com/

  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 1 · col 24203
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 1 · col 24266
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 1 · col 24396
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 17 · col 557140
navigator.plugins3 calls

Frame: https://www.bankofamerica.com/

  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 304 · col 271
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 23 · col 5077
navigator.userAgent25 calls

Frame: https://www.bankofamerica.com/

  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 5 · col 31931
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 13 · col 66706
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 17 · col 33
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 17 · col 4573
  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 17 · col 557062
screen.colorDepth2 calls

Frame: https://www.bankofamerica.com/

  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 304 · col 493
  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 304 · col 512
screen.height9 calls

Frame: https://www.bankofamerica.com/

  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 304 · col 469
  • https://www1.bac-assets.com//homepage/spa-assets/js/pages/homepage-dap-es6-page-31a5382f433176772fe0.m.jsline 1 · col 281407
screen.width9 calls

Frame: https://www.bankofamerica.com/

  • https://tags.tiqcdn.com/utag/bofa/main/prod1/utag.jsline 304 · col 456
  • https://www1.bac-assets.com//homepage/spa-assets/js/pages/homepage-dap-es6-page-31a5382f433176772fe0.m.jsline 1 · col 281398
window.devicePixelRatio1 calls

Frame: https://www.bankofamerica.com/

  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsline 17 · col 4936
Providers, script signatures, and DNS 0 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

Static script signatures

  • https://www1.bac-assets.com//homepage/spa-assets/js/common-chunks/common-es6-components-4381cc6e9b73b7969c01.m.jsArkose Labs · 1 API patterns

CNAME delegation

  • adobedc.demdex.net → demdex.net.ssl.sc.omtrdc.net

DNS delegation identifies infrastructure; it does not prove which browser code ran.

Network and worker observations 72 requests
Captured scripts
8
Instrumented frames
1
Google Ads observed
No
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

Third-party hosts

  • adobedc.demdex.net
  • cdn.cookielaw.org
  • secure.bac-assets.com
  • secure1.bac-assets.com
  • tags.tiqcdn.com
  • www1.bac-assets.com
Other recorded API calls 2
  • document.cookie.read183 calls
  • document.cookie.write21 calls
Source record and integrity
Original source
results/headless/bankofamerica-com-20261021T211000.json
Original file SHA-256
d75c9480ba8ff9e53fec1da703393762f1e3c30da92a0c88baa2de4b47f8b92a

Run ID: research-d75c9480ba8f. The JSON contains sanitized observations, not the original private scan payload.

Queries, request bodies, cookies, extracted values, raw errors, and session payloads are excluded before publication. The source digest identifies the original private record.

Read the sanitized JSON →