Skip to main content

Website evidence · pilot dataset

Does costco.com fingerprint you?

Fingerprinting indicators observed.

The latest measured scans include canvas drawing and readback by the same script. This is a fingerprinting indicator, not proof of tracking intent or transmission.

Open evidence JSON ↗

All 2 source records are included in the JSON. Scan timestamps and versions are shown as recorded. The tabs show the latest usable homepage measurement for each setup. Later failed attempts remain in the history. Scan scope and methodology ↗

Inside the scan

← All websites

Earlier measurement shown. Review the scan time and subsequent attempts below.

Visitor setup

Draw + readback

4 of 5 signal families observed

Canvas: ObservedWebGL: ObservedAudio: Not observedFonts: ObservedDevice: Observed
Measurement
Measured
Page context
Page document
Scan time
2026-10-21T22:35:30.548173Z
Browser / scanner
156.0.8078.4 / 0.3

Captured titleWelcome to Costco Wholesale

CanvasDraws text and reads canvas output.7 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext1 calls
  • Inline caller recorded
canvas.getContext1 calls

Frame: https://www.costco.com/

  • Inline caller recorded
canvas.getContext16 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • Inline caller recorded
  • https://www.costco.com/[redacted]/[redacted]/ips.js
canvas.toDataURL80 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
canvas2d.fillText72 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
canvas2d.getImageData6 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
canvas2d.measureText10 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
WebGLQueries the graphics environment.4 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

webgl2renderingcontext.getExtension4 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
webgl2renderingcontext.getParameter12 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
webglrenderingcontext.getExtension1 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
webglrenderingcontext.getParameter19 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.1 API entries

Observed requires at least ten text-measurement calls. Guide ↗

canvas2d.measureText10 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
DeviceReads browser and display properties.20 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

navigator.deviceMemory2 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
navigator.doNotTrack1 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
navigator.getBattery2 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
navigator.hardwareConcurrency9 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
navigator.language4 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
navigator.languages9 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
navigator.maxTouchPoints5 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
navigator.mimeTypes5 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
navigator.platform12 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
navigator.plugins9 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
navigator.userAgent3 calls

Frame: https://www.costco.com/

  • https://www.costco.com/[redacted]/[redacted]/p.jsline 1 · col 137825
  • https://www.costco.com/consumer-web/browse/prd/homepage-usbc/_next/static/chunks/3794-a1b5889b753c138c.jsline 1 · col 15841
  • https://www.costco.com/consumer-web/browse/prd/homepage-usbc/_next/static/chunks/3794-a1b5889b753c138c.jsline 1 · col 78182
navigator.userAgent27 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
navigator.webdriver5 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
screen.availHeight2 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
screen.availWidth2 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
screen.colorDepth4 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
screen.height4 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
screen.pixelDepth1 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
screen.width4 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
window.devicePixelRatio8 calls

Frame: https://www.costco.com/[redacted]/[redacted]/fp

  • https://www.costco.com/[redacted]/[redacted]/ips.js
Scripts with both text drawing and canvas readback 1

These source URLs appear in both call groups. Aggregated logs do not preserve the full execution sequence or establish the purpose of the collection.

  • https://www.costco.com/[redacted]/[redacted]/ips.js
Providers, script signatures, and DNS 0 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

No provider or DNS evidence in this record.

Network and worker observations 214 requests
Captured scripts
29
Instrumented frames
4
Google Ads observed
No
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

Third-party hosts

  • bfasset.costco-static.com
  • cloudflare.com
  • reporting.cdndex.io
  • transcend-cdn.com
Other recorded API calls 2
  • document.cookie.read2 calls
  • webrtc.RTCPeerConnection2 calls
Source record and integrity
Original source
results/headful/costco-com-20261021T223530.json
Original file SHA-256
e34ab8301c2905a4a2c117ac6de28cfec8107c6a72bc283ec84bd164749aba6d

Run ID: headful-e34ab8301c29. The JSON contains sanitized observations, not the original private scan payload.

Earlier measurement shown. Review the scan time and subsequent attempts below.

Research setup

Not observed

0 of 5 signal families observed

Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Not observed
Measurement
Measured
Page context
Page document
Scan time
2026-10-21T20:57:34.922927Z
Browser / scanner
156.0.8078.4 / 0.3

Captured titleWelcome to Costco Wholesale

CanvasDraws text and reads canvas output.1 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext1 calls

Frame: https://www.costco.com/

  • Inline caller recorded
WebGLQueries the graphics environment.0 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

No matching API call was captured.

AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.0 API entries

Observed requires at least ten text-measurement calls. Guide ↗

No matching API call was captured.

DeviceReads browser and display properties.1 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

navigator.userAgent4 calls

Frame: https://www.costco.com/

  • https://www.costco.com/[redacted]/[redacted]/p.jsline 1 · col 141818
  • https://www.costco.com/consumer-web/browse/prd/homepage-usbc/_next/static/chunks/3794-a1b5889b753c138c.jsline 1 · col 15841
  • https://www.costco.com/consumer-web/browse/prd/homepage-usbc/_next/static/chunks/3794-a1b5889b753c138c.jsline 1 · col 78182
Providers, script signatures, and DNS 0 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

No provider or DNS evidence in this record.

Network and worker observations 214 requests
Captured scripts
25
Instrumented frames
1
Google Ads observed
No
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

Third-party hosts

  • bfasset.costco-static.com
  • cloudflare.com
  • reporting.cdndex.io
  • transcend-cdn.com
Other recorded API calls 1
  • document.cookie.read2 calls
Source record and integrity
Original source
results/headless/costco-com-20261021T205734.json
Original file SHA-256
a8fa670ca6d16de50fd6397223eef1a6b56e0256ccf725939c3980f407f0105c

Run ID: research-a8fa670ca6d1. The JSON contains sanitized observations, not the original private scan payload.

Queries, request bodies, cookies, extracted values, raw errors, and session payloads are excluded before publication. The source digest identifies the original private record.

Read the sanitized JSON →