Skip to main content

Website evidence · pilot dataset

Does duolingo.com fingerprint you?

Browser signals observed; fingerprinting is unconfirmed.

Browser API activity met a monitored signal threshold in the latest measured scans. The activity alone does not establish a tracking purpose.

Open evidence JSON ↗

All 3 source records are included in the JSON. Scan timestamps and versions are shown as recorded. The tabs show the latest usable homepage measurement for each setup. Later failed attempts remain in the history. Scan scope and methodology ↗

Inside the scan

← All websites

Earlier measurement shown. Review the scan time and subsequent attempts below.

Visitor setup

Signals observed

1 of 5 signal families observed

Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Observed
Measurement
Measured
Page context
Page document
Scan time
2026-10-21T23:30:26.866509Z
Browser / scanner
156.0.8078.4 / 0.3

Captured titleDuolingo - The world’s most popular way to learn

CanvasDraws text and reads canvas output.1 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext1 calls

Frame: https://www.duolingo.com/

  • Inline caller recorded
WebGLQueries the graphics environment.0 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

No matching API call was captured.

AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.0 API entries

Observed requires at least ten text-measurement calls. Guide ↗

No matching API call was captured.

DeviceReads browser and display properties.3 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

navigator.userAgent37 calls

Frame: https://www.duolingo.com/

  • https://d35aaqx5ub95lt.cloudfront.net/js/8553-a0eeda7a.jsline 1 · col 5788
  • https://d35aaqx5ub95lt.cloudfront.net/js/app-8a3c480b.jsline 2 · col 1059735
  • https://d35aaqx5ub95lt.cloudfront.net/js/app-8a3c480b.jsline 2 · col 1060221
  • https://d35aaqx5ub95lt.cloudfront.net/js/app-8a3c480b.jsline 2 · col 1060493
  • https://www.duolingo.com/line 1 · col 1221
screen.height8 calls

Frame: https://www.duolingo.com/

  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 673546
  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 677649
screen.width8 calls

Frame: https://www.duolingo.com/

  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 673560
  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 677677
Providers, script signatures, and DNS 1 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

  • Google Tag Managerwww.googletagmanager.com

Static script signatures

  • https://www.recaptcha.net/recaptcha/enterprise.jsreCAPTCHA · 0 API patterns
Network and worker observations 126 requests
Captured scripts
18
Instrumented frames
1
Google Ads observed
No
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

  • https://www.duolingo.com/gcm-service-worker.jsThird-party hosts: None recorded

Third-party hosts

  • accounts.google.com
  • cdn.cookielaw.org
  • d35aaqx5ub95lt.cloudfront.net
  • geolocation.onetrust.com
  • www.googletagmanager.com
  • www.gstatic.com
  • www.recaptcha.net
Other recorded API calls 2
  • document.cookie.read568 calls
  • document.cookie.write6 calls
Source record and integrity
Original source
results/headful/duolingo-com-20261021T233026.json
Original file SHA-256
3fb6896f43a81c5ae8f0351a837b3a2380e48f867fc7a99c1d874e31b2f9ff9a

Run ID: headful-3fb6896f43a8. The JSON contains sanitized observations, not the original private scan payload.

Research setup

Signals observed

1 of 5 signal families observed

Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Observed
Measurement
Measured · Partial load
Page context
Page document
Scan time
2026-10-22T22:22:53.100601Z
Browser / scanner
156.0.8078.4 / 0.4

Captured titleDuolingo - The world’s most popular way to learn

CanvasDraws text and reads canvas output.3 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext1 calls
  • https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 829 · col 387
canvas.getContext2 calls

Frame: https://www.duolingo.com/

  • Inline caller recorded
  • https://d35aaqx5ub95lt.cloudfront.net/js/5314-33cb86aa.jsline 1 · col 11229
canvas.getContext1 calls

Frame: https://www.recaptcha.net/recaptcha/enterprise/anchor

  • Inline caller recorded
WebGLQueries the graphics environment.0 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

No matching API call was captured.

AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.0 API entries

Observed requires at least ten text-measurement calls. Guide ↗

No matching API call was captured.

DeviceReads browser and display properties.4 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

navigator.userAgent153 calls

Frame: https://www.duolingo.com/

  • https://d35aaqx5ub95lt.cloudfront.net/js/8553-a0eeda7a.jsline 1 · col 5788
  • https://d35aaqx5ub95lt.cloudfront.net/js/app-8a3c480b.jsline 2 · col 1059735
  • https://d35aaqx5ub95lt.cloudfront.net/js/app-8a3c480b.jsline 2 · col 1060221
  • https://www.duolingo.com/line 1 · col 1221
  • https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 535 · col 495
navigator.userAgent25 calls

Frame: https://www.recaptcha.net/recaptcha/enterprise/anchor

  • https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 535 · col 495
screen.height8 calls

Frame: https://www.duolingo.com/

  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 673546
  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 677649
screen.width8 calls

Frame: https://www.duolingo.com/

  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 673560
  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 677677
Providers, script signatures, and DNS 1 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

  • Google Tag Managerwww.googletagmanager.com

Static script signatures

  • https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsreCAPTCHA · 0 API patterns
  • https://www.recaptcha.net/recaptcha/enterprise.jsreCAPTCHA · 0 API patterns
Network and worker observations 123 requests
Captured scripts
24
Instrumented frames
3
Google Ads observed
No
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

  • https://www.duolingo.com/gcm-service-worker.jsThird-party hosts: None recorded

Third-party hosts

  • accounts.google.com
  • cdn.cookielaw.org
  • d35aaqx5ub95lt.cloudfront.net
  • fonts.gstatic.com
  • www.googletagmanager.com
  • www.gstatic.com
  • www.recaptcha.net
Other recorded API calls 2
  • document.cookie.read2047 calls
  • document.cookie.write7 calls
Source record and integrity
Original source
results/headless/duolingo-com-20261022T222253.json
Original file SHA-256
8360150500014a4b9dc1d932287a586bbf9dfa29037c7e2a140da3140577c598

Run ID: research-836015050001. The JSON contains sanitized observations, not the original private scan payload.

Other scan attempts (1)

Research setup

Signals observed

1 of 5 signal families observed

Canvas: Not observedWebGL: Not observedAudio: Not observedFonts: Not observedDevice: Observed
Measurement
Measured
Page context
Page document
Scan time
2026-10-21T23:35:10.212760Z
Browser / scanner
156.0.8078.4 / 0.3

Captured titleDuolingo - The world’s most popular way to learn

CanvasDraws text and reads canvas output.2 API entries

Observed requires a text-drawing API and a canvas readback API. Guide ↗

canvas.getContext1 calls

Frame: https://www.duolingo.com/

  • Inline caller recorded
canvas.getContext1 calls

Frame: https://www.recaptcha.net/recaptcha/enterprise/anchor

  • Inline caller recorded
WebGLQueries the graphics environment.0 API entries

Observed requires at least three distinct WebGL probing APIs. Guide ↗

No matching API call was captured.

AudioRenders or reads audio samples.0 API entries

Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗

No matching API call was captured.

FontsMeasures text repeatedly.0 API entries

Observed requires at least ten text-measurement calls. Guide ↗

No matching API call was captured.

DeviceReads browser and display properties.3 API entries

Observed requires at least three distinct browser, screen, or window properties. Guide ↗

navigator.userAgent68 calls

Frame: https://www.duolingo.com/

  • https://d35aaqx5ub95lt.cloudfront.net/js/8553-a0eeda7a.jsline 1 · col 5788
  • https://d35aaqx5ub95lt.cloudfront.net/js/app-8a3c480b.jsline 2 · col 1059735
  • https://d35aaqx5ub95lt.cloudfront.net/js/app-8a3c480b.jsline 2 · col 1060221
  • https://d35aaqx5ub95lt.cloudfront.net/js/app-8a3c480b.jsline 2 · col 1060493
  • https://www.duolingo.com/line 1 · col 1221
screen.height8 calls

Frame: https://www.duolingo.com/

  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 673546
  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 677649
screen.width8 calls

Frame: https://www.duolingo.com/

  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 673560
  • https://d35aaqx5ub95lt.cloudfront.net/js/4779-0fb1dea3.jsline 2 · col 677677
Providers, script signatures, and DNS 1 provider labels

Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.

  • Google Tag Managerwww.googletagmanager.com

Static script signatures

  • https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsreCAPTCHA · 0 API patterns
  • https://www.recaptcha.net/recaptcha/enterprise.jsreCAPTCHA · 0 API patterns
Network and worker observations 142 requests
Captured scripts
12
Instrumented frames
2
Google Ads observed
No
Transmission evidence
Not validated

Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.

  • https://www.duolingo.com/gcm-service-worker.jsThird-party hosts: None recorded

Third-party hosts

  • accounts.google.com
  • cdn.cookielaw.org
  • d35aaqx5ub95lt.cloudfront.net
  • fonts.gstatic.com
  • geolocation.onetrust.com
  • www.googletagmanager.com
  • www.gstatic.com
  • www.recaptcha.net
Other recorded API calls 2
  • document.cookie.read842 calls
  • document.cookie.write6 calls
Source record and integrity
Original source
results/headless/duolingo-com-20261021T233510.json
Original file SHA-256
a2e58df79d4186d83a33b3cc68c8e805c8280257847c7c4b1766043f5df7b4b4

Run ID: research-a2e58df79d41. The JSON contains sanitized observations, not the original private scan payload.

Queries, request bodies, cookies, extracted values, raw errors, and session payloads are excluded before publication. The source digest identifies the original private record.

Read the sanitized JSON →