Website evidence · pilot dataset
Does spotify.com fingerprint you?
Browser signals observed; fingerprinting is unconfirmed.
Browser API activity met a monitored signal threshold in the latest measured scans. The activity alone does not establish a tracking purpose.
All 8 source records are included in the JSON. 2 older runs have no recorded timestamp; missing provenance stays unknown. The tabs show the latest usable homepage measurement for each setup. Later failed attempts remain in the history. Scan scope and methodology ↗
Inside the scan
← All websitesVisitor setup
Signals observed
1 of 5 signal families observed
- Measurement
- Measured · Partial load
- Page context
- Page document
- Scan time
- 2026-10-22T16:36:41.519213Z
- Browser / scanner
- 156.0.8078.4 / 0.4
Captured titleSpotify – Web Player
CanvasDraws text and reads canvas output.
Observed requires a text-drawing API and a canvas readback API. Guide ↗
canvas.getContext1 callsFrame: https://open.spotify.com/
- Inline caller recorded
canvas.getContext1 callsFrame: https://www.google.com/recaptcha/enterprise/anchor
- Inline caller recorded
WebGLQueries the graphics environment.
Observed requires at least three distinct WebGL probing APIs. Guide ↗
No matching API call was captured.
AudioRenders or reads audio samples.
Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗
No matching API call was captured.
FontsMeasures text repeatedly.
Observed requires at least ten text-measurement calls. Guide ↗
No matching API call was captured.
DeviceReads browser and display properties.
Observed requires at least three distinct browser, screen, or window properties. Guide ↗
navigator.deviceMemory2 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/web-player.50a25f0d.jsline 18 · col 23446https://open.spotifycdn.com/cdn/build/web-player/web-player.50a25f0d.jsline 18 · col 23565
navigator.hardwareConcurrency2 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/web-player.50a25f0d.jsline 18 · col 23590https://open.spotifycdn.com/cdn/build/web-player/web-player.50a25f0d.jsline 18 · col 23724
navigator.language2 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/encore~web-player.c7335fd5.jsline 1 · col 16377https://open.spotifycdn.com/cdn/build/web-player/web-player.50a25f0d.jsline 31 · col 561656
navigator.platform1 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/web-player.50a25f0d.jsline 2 · col 206306
navigator.userAgent61 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/vendor~web-player.fe5bb2c7.jsline 18 · col 39711https://open.spotifycdn.com/cdn/build/web-player/web-player.50a25f0d.jsline 2 · col 793939https://open.spotifycdn.com/cdn/build/web-player/web-player.50a25f0d.jsline 51 · col 52367https://open.spotifycdn.com/cdn/build/web-player/web-player.50a25f0d.jsline 51 · col 52388https://open.spotifycdn.com/cdn/build/web-player/web-player.50a25f0d.jsline 74 · col 11099
navigator.webdriver1 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/web-player.50a25f0d.jsline 31 · col 483649
Providers, script signatures, and DNS 0 provider labels
Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.
Static script signatures
https://www.google.com/recaptcha/enterprise.jsreCAPTCHA · 0 API patternshttps://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsreCAPTCHA · 0 API patterns
Network and worker observations 110 requests
- Captured scripts
- 7
- Instrumented frames
- 2
- Google Ads observed
- No
- Transmission evidence
- Not validated
Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.
Third-party hosts
encore.scdn.coo22381.ingest.sentry.ioopen.spotifycdn.comwww.google.comwww.gstatic.com
Other recorded API calls 1
document.cookie.read3 calls
Source record and integrity
- Original source
results/headful/spotify-com-20261022T163641.json- Original file SHA-256
473a255d2c6554c324d0e613fa09b351e18398f69e3e578f9bf999cbc852ec0e
Run ID: headful-473a255d2c65. The JSON contains sanitized observations, not the original private scan payload.
Other scan attempts (3)
Visitor setup
Signals observed
1 of 5 signal families observed
- Measurement
- Measured
- Page context
- Page document
- Scan time
- Not recorded
- Browser / scanner
- Unknown browser / Unversioned
Captured titleSpotify – Web Player
CanvasDraws text and reads canvas output.
Observed requires a text-drawing API and a canvas readback API. Guide ↗
canvas.getContext1 calls- Inline caller recorded
WebGLQueries the graphics environment.
Observed requires at least three distinct WebGL probing APIs. Guide ↗
No matching API call was captured.
AudioRenders or reads audio samples.
Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗
No matching API call was captured.
FontsMeasures text repeatedly.
Observed requires at least ten text-measurement calls. Guide ↗
No matching API call was captured.
DeviceReads browser and display properties.
Observed requires at least three distinct browser, screen, or window properties. Guide ↗
navigator.deviceMemory3 callshttps://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23446https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23565https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 339 · col 312
navigator.getBattery1 callshttps://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 346 · col 83
navigator.hardwareConcurrency3 callshttps://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23590https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23724https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 339 · col 312
navigator.language2 callshttps://open.spotifycdn.com/cdn/build/web-player/encore~web-player.59a0f468.jsline 1 · col 15366https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 31 · col 540234
navigator.platform1 callshttps://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 2 · col 206307
navigator.userAgent395 callshttps://open.spotifycdn.com/cdn/build/web-player/vendor~web-player.842d320c.jsline 18 · col 39711https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 2 · col 775986https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 51 · col 52367https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 51 · col 52388https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 74 · col 11099
navigator.webdriver2 callshttps://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 31 · col 462228
screen.availHeight107 callshttps://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 218464https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 31 · col 30953
screen.availWidth107 callshttps://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 218428https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 31 · col 30932
window.devicePixelRatio3 callshttps://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 2 · col 828669https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 218387
Providers, script signatures, and DNS 0 provider labels
Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.
Static script signatures
https://www.google.com/recaptcha/enterprise.jsreCAPTCHA · 0 API patternshttps://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsreCAPTCHA · 0 API patterns
Network and worker observations 159 requests
- Captured scripts
- 9
- Instrumented frames
- Not recorded
- Google Ads observed
- No
- Transmission evidence
- Not validated
Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.
Third-party hosts
cdn.cookielaw.orgencore.scdn.coo22381.ingest.sentry.ioopen.spotifycdn.comwww.google.comwww.gstatic.com
Other recorded API calls 1
document.cookie.read8 calls
Source record and integrity
- Original source
results/headful/spotify-com.json- Original file SHA-256
e2ea7cc134d1dbedad7b768a6bc61852c9af158f377eed68b7b3aac438d1a66e
Run ID: headful-e2ea7cc134d1. The JSON contains sanitized observations, not the original private scan payload.
Visitor setup
Signals observed
1 of 5 signal families observed
- Measurement
- Measured
- Page context
- Page document
- Scan time
- 2026-10-19T06:12:03.255844Z
- Browser / scanner
- 156.0.8078.4 / 0.3
Captured titleSpotify – Web Player
CanvasDraws text and reads canvas output.
Observed requires a text-drawing API and a canvas readback API. Guide ↗
canvas.getContext1 callshttps://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 829 · col 387
canvas.getContext1 callsFrame: https://open.spotify.com/
- Inline caller recorded
canvas.getContext1 callsFrame: https://www.google.com/recaptcha/enterprise/anchor
- Inline caller recorded
WebGLQueries the graphics environment.
Observed requires at least three distinct WebGL probing APIs. Guide ↗
No matching API call was captured.
AudioRenders or reads audio samples.
Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗
No matching API call was captured.
FontsMeasures text repeatedly.
Observed requires at least ten text-measurement calls. Guide ↗
No matching API call was captured.
DeviceReads browser and display properties.
Observed requires at least three distinct browser, screen, or window properties. Guide ↗
navigator.deviceMemory3 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23446https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23565https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 339 · col 312
navigator.getBattery1 callsFrame: https://open.spotify.com/
https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 346 · col 83
navigator.hardwareConcurrency3 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23590https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23724https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 339 · col 312
navigator.language3 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/encore~web-player.59a0f468.jsline 1 · col 15366https://open.spotifycdn.com/cdn/build/web-player/vendor~web-player.842d320c.jsline 14 · col 20437https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 31 · col 540234
navigator.platform1 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 2 · col 206307
navigator.userAgent390 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/vendor~web-player.842d320c.jsline 18 · col 39711https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 51 · col 52367https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 51 · col 52388https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 74 · col 11099https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 535 · col 495
navigator.userAgent26 callsFrame: https://www.google.com/recaptcha/enterprise/anchor
https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 535 · col 495
navigator.webdriver2 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 31 · col 462228
screen.availHeight107 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 218464https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 31 · col 30953
screen.availWidth107 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 218428https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 31 · col 30932
window.devicePixelRatio4 callsFrame: https://open.spotify.com/
https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 2 · col 828669https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 218387
Providers, script signatures, and DNS 0 provider labels
Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.
Static script signatures
https://www.google.com/recaptcha/enterprise.jsreCAPTCHA · 0 API patternshttps://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsreCAPTCHA · 0 API patterns
Network and worker observations 157 requests
- Captured scripts
- 16
- Instrumented frames
- 3
- Google Ads observed
- No
- Transmission evidence
- Not validated
Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.
https://open.spotify.com/service-worker.jsThird-party hosts: None recorded
Third-party hosts
cdn.cookielaw.orgencore.scdn.coo22381.ingest.sentry.ioopen.spotifycdn.comwww.google.comwww.gstatic.com
Other recorded API calls 1
document.cookie.read8 calls
Source record and integrity
- Original source
results/headful/spotify-com-20261019T061203.json- Original file SHA-256
ee900d8e0d13fa10a295c7de9c65b91dcc402e71868609caf7b107d7460b6cf9
Run ID: headful-ee900d8e0d13. The JSON contains sanitized observations, not the original private scan payload.
Visitor setup
Scanner error
Scanner error
- Measurement
- Scanner error
- Page context
- Page not measured
- Scan time
- 2026-10-22T16:36:40.695734Z
- Browser / scanner
- 156.0.8078.4 / 0.4
The scanner crashed while collecting this page. No usable API results were saved for this setup. A fresh scan is needed; this is not a site-blocking verdict.
Source record and integrity
- Original source
results/headful/spotify-com-20261022T163640.json- Original file SHA-256
93ff0843b41cd56a61e46f9f103165ab08178ceea366b555c816fd6285dedca9
Run ID: headful-93ff0843b41c. The JSON contains sanitized observations, not the original private scan payload.
Research setup
Signals observed
1 of 5 signal families observed
- Measurement
- Measured · Partial load
- Page context
- Page document
- Scan time
- 2026-10-22T19:00:44.022896Z
- Browser / scanner
- 156.0.8078.4 / 0.4
Captured titleSpotify – Web Player
CanvasDraws text and reads canvas output.
Observed requires a text-drawing API and a canvas readback API. Guide ↗
canvas.getContext1 callshttps://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 829 · col 387
canvas.getContext1 callshttps://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 829 · col 387
canvas.getContext1 callsFrame: https://open.spotify.com/
- Inline caller recorded
canvas.getContext1 callsFrame: https://www.google.com/recaptcha/enterprise/anchor
- Inline caller recorded
WebGLQueries the graphics environment.
Observed requires at least three distinct WebGL probing APIs. Guide ↗
No matching API call was captured.
AudioRenders or reads audio samples.
Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗
No matching API call was captured.
FontsMeasures text repeatedly.
Observed requires at least ten text-measurement calls. Guide ↗
No matching API call was captured.
DeviceReads browser and display properties.
Observed requires at least three distinct browser, screen, or window properties. Guide ↗
navigator.deviceMemory1 callsFrame: https://open.spotify.com/
https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 339 · col 312
navigator.getBattery1 callsFrame: https://open.spotify.com/
https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 346 · col 83
navigator.hardwareConcurrency1 callsFrame: https://open.spotify.com/
https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 339 · col 312
navigator.userAgent33 callsFrame: https://open.spotify.com/
https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 535 · col 495
navigator.userAgent25 callsFrame: https://www.google.com/recaptcha/enterprise/anchor
https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 535 · col 495
Providers, script signatures, and DNS 0 provider labels
Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.
Static script signatures
https://www.google.com/recaptcha/enterprise.jsreCAPTCHA · 0 API patternshttps://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsreCAPTCHA · 0 API patterns
Network and worker observations 23 requests
- Captured scripts
- 3
- Instrumented frames
- 4
- Google Ads observed
- No
- Transmission evidence
- Not validated
Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.
Third-party hosts
encore.scdn.cofonts.gstatic.comopen.spotifycdn.comwww.google.comwww.gstatic.com
Source record and integrity
- Original source
results/headless/spotify-com-20261022T190044.json- Original file SHA-256
e6d080481a59f4243cd02eb41daf519785d38653a0133d2d9d7f1479a061d67e
Run ID: research-e6d080481a59. The JSON contains sanitized observations, not the original private scan payload.
Other scan attempts (3)
Research setup
Signals observed
1 of 5 signal families observed
- Measurement
- Measured
- Page context
- Page document
- Scan time
- Not recorded
- Browser / scanner
- Unknown browser / Unversioned
Captured titleSpotify – Web Player
CanvasDraws text and reads canvas output.
Observed requires a text-drawing API and a canvas readback API. Guide ↗
canvas.getContext1 calls- Inline caller recorded
WebGLQueries the graphics environment.
Observed requires at least three distinct WebGL probing APIs. Guide ↗
No matching API call was captured.
AudioRenders or reads audio samples.
Observed requires offline rendering, buffer reads, or analyser reads. Guide ↗
No matching API call was captured.
FontsMeasures text repeatedly.
Observed requires at least ten text-measurement calls. Guide ↗
No matching API call was captured.
DeviceReads browser and display properties.
Observed requires at least three distinct browser, screen, or window properties. Guide ↗
navigator.deviceMemory3 callshttps://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23446https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23565https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 339 · col 312
navigator.getBattery1 callshttps://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 346 · col 83
navigator.hardwareConcurrency3 callshttps://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23590https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 18 · col 23724https://www.gstatic.com/recaptcha/releases/[redacted-id]/recaptcha__en.jsline 339 · col 312
navigator.language2 callshttps://open.spotifycdn.com/cdn/build/web-player/encore~web-player.59a0f468.jsline 1 · col 15366https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 31 · col 540234
navigator.platform1 callshttps://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 2 · col 206307
navigator.userAgent53 callshttps://open.spotifycdn.com/cdn/build/web-player/vendor~web-player.842d320c.jsline 18 · col 39711https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 2 · col 775986https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 51 · col 52367https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 51 · col 52388https://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 74 · col 11099
navigator.webdriver1 callshttps://open.spotifycdn.com/cdn/build/web-player/web-player.0079e2e5.jsline 31 · col 462228
Providers, script signatures, and DNS 0 provider labels
Provider labels and static signatures are scanner observations. A library-name match does not establish that its code executed.
No provider or DNS evidence in this record.
Network and worker observations 45 requests
- Captured scripts
- 0
- Instrumented frames
- Not recorded
- Google Ads observed
- No
- Transmission evidence
- Not validated
Legacy transmission hints are excluded. A request after an API call does not establish that the extracted value was sent.
Third-party hosts
encore.scdn.cofonts.gstatic.como22381.ingest.sentry.ioopen.spotifycdn.comwww.google.comwww.gstatic.com
Source record and integrity
- Original source
results/headless/spotify-com.json- Original file SHA-256
d333a4807d9840f16d0e63718a9db7be8124cab90cfeb3bc90d88ff348ccb040
The research mode is inferred from the archive folder because this legacy record has no mode field.
Run ID: research-d333a4807d98. The JSON contains sanitized observations, not the original private scan payload.
Research setup
Navigation failed
Navigation failed
- Measurement
- Navigation failed
- Page context
- Page not measured
- Scan time
- 2026-10-19T05:56:21.870069Z
- Browser / scanner
- 156.0.8078.4 / 0.3
Navigation or page loading failed in this browser setup. The record does not establish why it failed.
Source record and integrity
- Original source
results/headless/spotify-com-20261019T055621.json- Original file SHA-256
75dd2029c6c7d1f832809b93a1f3326a1757b7e0fbf11e8c7189f26c2c5ffeb0
Run ID: research-75dd2029c6c7. The JSON contains sanitized observations, not the original private scan payload.
Research setup
Scanner error
Scanner error
- Measurement
- Scanner error
- Page context
- Page not measured
- Scan time
- 2026-10-22T19:00:43.919966Z
- Browser / scanner
- 156.0.8078.4 / 0.4
The scanner crashed while collecting this page. No usable API results were saved for this setup. A fresh scan is needed; this is not a site-blocking verdict.
Source record and integrity
- Original source
results/headless/spotify-com-20261022T190043.json- Original file SHA-256
031f70e6d3d88aed3effaa8f098e46e05c0b4b2b95567cbb1e76b1eff0a9fcfc
Run ID: research-031f70e6d3d8. The JSON contains sanitized observations, not the original private scan payload.
Queries, request bodies, cookies, extracted values, raw errors, and session payloads are excluded before publication. The source digest identifies the original private record.
Read the sanitized JSON →