Skip to main content

Website evidence · pilot dataset

Does booking.com fingerprint you?

Browser signals observed; fingerprinting is unconfirmed.

Browser API activity met a monitored signal threshold in the latest measured scans. The activity alone does not establish a tracking purpose.

Open evidence JSON ↗

All 7 source records are included in the JSON. Scan timestamps and versions are shown as recorded. The tabs show the latest usable homepage measurement for each setup. Later failed attempts remain in the history. Scan scope and methodology ↗

Inside the scan

← All websites

Visitor setup

Not observed

0 of 5 signal families observed

Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Not observed
Measurement
Measured · Partial load
Page context
Page document
Scan time
2026-10-22T19:46:51.546710Z
Browser / scanner
156.0.8078.4 / 0.4

Captured titleBooking.com | Official site | The best hotels, flights, car rentals & accommodations

CanvasDraws text and reads canvas output.1 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext1 calls

Frame: https://www.booking.com/

  • Inline caller recorded
WebGLQueries the graphics environment.0 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

No matching API call was captured.

AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.0 API entries

Observed requires at least ten text-measurement calls. Guide ↗

No matching API call was captured.

DeviceReads browser and display properties.1 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

navigator.userAgent2 calls

Frame: https://www.booking.com/

  • https://cf.bstatic.com/psb/capla/static/js/81da5f32.a942ad2f.chunk.jsline 2 · col 277950
  • https://cf.bstatic.com/psb/capla/static/js/client.4b84af48.jsline 8 · col 561505
Providers, script signatures, and DNS 1 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

  • Google Adssecurepubads.g.doubleclick.net
Network and worker observations 270 requests
Captured scripts
40
Instrumented frames
1
Google Ads observed
Yes
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

Third-party hosts

  • cdn.cookielaw.org
  • cf.bstatic.com
  • q-xx.bstatic.com
  • r-xx.bstatic.com
  • securepubads.g.doubleclick.net
  • t-cf.bstatic.com
Other recorded API calls 2
  • document.cookie.read7 calls
  • document.cookie.write2 calls
Source record and integrity
Original source
results/headful/booking-com-20261022T194651.json
Original file SHA-256
4210f76caef9b470486d76e5c7c0bf3e14f9f613240d384c4a91a46ca9fc5951

Run ID: headful-4210f76caef9. The JSON contains sanitized observations, not the original private scan payload.

Other scan attempts (4)

Visitor setup

Not observed

0 of 5 signal families observed

Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Not observed
Measurement
Measured
Page context
Page document
Scan time
2026-10-21T23:02:56.874369Z
Browser / scanner
156.0.8078.4 / 0.3

Captured titleBooking.com | Official site | The best hotels, flights, car rentals & accommodations

CanvasDraws text and reads canvas output.1 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext1 calls

Frame: https://www.booking.com/

  • Inline caller recorded
WebGLQueries the graphics environment.0 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

No matching API call was captured.

AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.0 API entries

Observed requires at least ten text-measurement calls. Guide ↗

No matching API call was captured.

DeviceReads browser and display properties.0 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

No matching API call was captured.

Providers, script signatures, and DNS 1 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

  • Google Adssecurepubads.g.doubleclick.net

Static script signatures

  • https://www.booking.com/[redacted-id]/[redacted-id]/[redacted-id]/challenge.jsAPI patterns only · 9 API patterns
Network and worker observations 133 requests
Captured scripts
2
Instrumented frames
1
Google Ads observed
Yes
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

Third-party hosts

  • cdn.cookielaw.org
  • cf.bstatic.com
  • securepubads.g.doubleclick.net
Source record and integrity
Original source
results/headful/booking-com-20261021T230256.json
Original file SHA-256
53fb8531367a10670319b250cbd5af0aae65fcd9452637352d79ff15d9addd1f

Run ID: headful-53fb8531367a. The JSON contains sanitized observations, not the original private scan payload.

Visitor setup

Scanner error

Scanner error

Canvas: UnmeasuredWebGL: UnmeasuredAudio: UnmeasuredFonts: UnmeasuredDevice: Unmeasured
Measurement
Scanner error
Page context
Page not measured
Scan time
2026-10-22T14:14:42.995416Z
Browser / scanner
156.0.8078.4 / 0.4
Scanner error — no usable scan result

The scanner crashed while collecting this page. No usable API results were saved for this setup. A fresh scan is needed; this is not a site-blocking verdict.

Source record and integrity
Original source
results/headful/booking-com-20261022T141442.json
Original file SHA-256
e129e516462f31e55261249cf835a7b7f06fb46626a0ef44803e040242d9672d

Run ID: headful-e129e516462f. The JSON contains sanitized observations, not the original private scan payload.

Visitor setup

Navigation failed

Navigation failed

Canvas: UnmeasuredWebGL: UnmeasuredAudio: UnmeasuredFonts: UnmeasuredDevice: Unmeasured
Measurement
Navigation failed
Page context
Page not measured
Scan time
2026-10-22T14:14:43.588850Z
Browser / scanner
156.0.8078.4 / 0.4
Navigation failed — no usable scan result

Navigation or page loading failed in this browser setup. The record does not establish why it failed.

Source record and integrity
Original source
results/headful/booking-com-20261022T141443.json
Original file SHA-256
74b089f571fd2009b0f8afeb7719a258cfa4eaa7cfcf293b1494ab7a621ddea8

Run ID: headful-74b089f571fd. The JSON contains sanitized observations, not the original private scan payload.

Visitor setup

Scanner error

Scanner error

Canvas: UnmeasuredWebGL: UnmeasuredAudio: UnmeasuredFonts: UnmeasuredDevice: Unmeasured
Measurement
Scanner error
Page context
Page not measured
Scan time
2026-10-22T19:46:50.833847Z
Browser / scanner
156.0.8078.4 / 0.4
Scanner error — no usable scan result

The scanner crashed while collecting this page. No usable API results were saved for this setup. A fresh scan is needed; this is not a site-blocking verdict.

Source record and integrity
Original source
results/headful/booking-com-20261022T194650.json
Original file SHA-256
b54cccdbfeec250ca5b0963cf39459128b99add5f75bcd781f4e6caccda6c676

Run ID: headful-b54cccdbfeec. The JSON contains sanitized observations, not the original private scan payload.

Research setup

Signals observed

1 of 5 signal families observed

Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Observed
Measurement
Measured · Partial load
Page context
Page document
Scan time
2026-10-22T17:44:12.430551Z
Browser / scanner
156.0.8078.4 / 0.4

Captured titleBooking.com | Official site | The best hotels, flights, car rentals & accommodations

CanvasDraws text and reads canvas output.4 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext1 calls

Frame: https://cm.g.doubleclick.net/partnerpixels

  • Inline caller recorded
canvas.getContext1 calls

Frame: https://e3965682e08c3aedbdd796dcf46c564c.safeframe.googlesyndication.com/safeframe/1-0-45/html/container.html

  • Inline caller recorded
canvas.getContext1 calls

Frame: https://pagead2.googlesyndication.com/pagead/s/eeframe.html

  • Inline caller recorded
canvas.getContext1 calls

Frame: https://www.booking.com/

  • Inline caller recorded
WebGLQueries the graphics environment.0 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

No matching API call was captured.

AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.0 API entries

Observed requires at least ten text-measurement calls. Guide ↗

No matching API call was captured.

DeviceReads browser and display properties.10 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

navigator.deviceMemory2 calls

Frame: https://www.booking.com/

  • https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202610190101/pubads_impl.jsline 23 · col 318827
navigator.hardwareConcurrency1 calls

Frame: https://www.booking.com/

  • https://cf.bstatic.com/psb/capla/static/js/dc32f6b7.c74b5a8a.chunk.jsline 2 · col 289863
navigator.language31 calls

Frame: https://www.booking.com/

  • https://cf.bstatic.com/psb/capla/static/js/0fdff3cd.badfd118.chunk.jsline 2 · col 4510
  • https://cf.bstatic.com/psb/capla/static/js/35325389.f0b0422e.chunk.jsline 2 · col 54337
  • https://cf.bstatic.com/psb/capla/static/js/81da5f32.a942ad2f.chunk.jsline 2 · col 91736
  • https://cf.bstatic.com/psb/capla/static/js/8f1f9b37.5331a0f2.chunk.jsline 2 · col 9049
navigator.userAgent132 calls

Frame: https://www.booking.com/

  • https://cf.bstatic.com/psb/capla/static/js/81da5f32.a942ad2f.chunk.jsline 2 · col 277950
  • https://cf.bstatic.com/psb/capla/static/js/client.4b84af48.jsline 8 · col 561505
  • https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202610190101/pubads_impl.jsline 19 · col 3706
  • https://securepubads.g.doubleclick.net/tag/js/gpt.jsline 6 · col 1336
  • https://securepubads.g.doubleclick.net/tag/js/gpt.jsline 11 · col 33529
screen.availHeight2 calls

Frame: https://www.booking.com/

  • https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202610190101/pubads_impl.jsline 23 · col 318483
screen.availWidth2 calls

Frame: https://www.booking.com/

  • https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202610190101/pubads_impl.jsline 23 · col 318543
screen.colorDepth2 calls

Frame: https://www.booking.com/

  • https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202610190101/pubads_impl.jsline 23 · col 318602
screen.height4 calls

Frame: https://www.booking.com/

  • https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202610190101/pubads_impl.jsline 19 · col 152889
  • https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202610190101/pubads_impl.jsline 23 · col 318375
screen.width4 calls

Frame: https://www.booking.com/

  • https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202610190101/pubads_impl.jsline 19 · col 152871
  • https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202610190101/pubads_impl.jsline 23 · col 318429
window.devicePixelRatio2 calls

Frame: https://www.booking.com/

  • https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202610190101/pubads_impl.jsline 23 · col 318651
Providers, script signatures, and DNS 2 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

  • Google Adscm.g.doubleclick.net, e3965682e08c3aedbdd796dcf46c564c.safeframe.googlesyndication.com, pagead2.googlesyndication.com, securepubads.g.doubleclick.net, tpc.googlesyndication.com
  • Google Tag Managerwww.googletagmanager.com
Network and worker observations 305 requests
Captured scripts
26
Instrumented frames
5
Google Ads observed
Yes
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

Third-party hosts

  • awswaf.com
  • bat.bing.com
  • bstatic.com
  • c.amazon-adsystem.com
  • cdn.cookielaw.org
  • cf.bstatic.com
  • cm.g.doubleclick.net
  • dynamic.criteo.com
  • e3965682e08c3aedbdd796dcf46c564c.safeframe.googlesyndication.com
  • ep1.adtrafficquality.google
  • fonts.googleapis.com
  • gum.criteo.com
  • id5-sync.com
  • image6.pubmatic.com
  • js.adsrvr.org
  • lb.eu-1-id5-sync.com
  • lbs.eu-1-id5-sync.com
  • pagead2.googlesyndication.com
  • q-xx.bstatic.com
  • r-xx.bstatic.com
  • s.yimg.jp
  • securepubads.g.doubleclick.net
  • t-cf.bstatic.com
  • tag.flvcdn.net
  • tpc.googlesyndication.com
  • us.creativecdn.com
  • www.googletagmanager.com
  • www.redditstatic.com
  • z.moatads.com
Other recorded API calls 2
  • document.cookie.read51 calls
  • document.cookie.write7 calls
Source record and integrity
Original source
results/headless/booking-com-20261022T174412.json
Original file SHA-256
6c3adcf868fdcf4428b06d5b22c8f893177de027f739ed5051da54da3d8a6b16

Run ID: research-6c3adcf868fd. The JSON contains sanitized observations, not the original private scan payload.

Other scan attempts (1)

Research setup

Navigation failed

Navigation failed

Canvas: UnmeasuredWebGL: UnmeasuredAudio: UnmeasuredFonts: UnmeasuredDevice: Unmeasured
Measurement
Navigation failed
Page context
Page not measured
Scan time
2026-10-21T21:22:21.126056Z
Browser / scanner
156.0.8078.4 / 0.3
Navigation failed — no usable scan result

Navigation or page loading failed in this browser setup. The record does not establish why it failed.

Source record and integrity
Original source
results/headless/booking-com-20261021T212221.json
Original file SHA-256
32a5fdb8f9e39a19c9b5dd889d7fed04a48f70a9926e6862f7a5e09fd1c8773c

Run ID: research-32a5fdb8f9e3. The JSON contains sanitized observations, not the original private scan payload.

Queries, request bodies, cookies, extracted values, raw errors, and session payloads are excluded before publication. The source digest identifies the original private record.

Read the sanitized JSON →