Browser evaluations · technical guide

What Is Chrome Fingerprinting?

How Chrome remains recognizable when context changes.A layer-by-layer examination of what a site can observe, what Incognito and a VPN actually change, and what one commercial recognition system returned during controlled boundary tests.

This page explains the recorded behavior and relevant browser surfaces. It does not reverse-engineer Fingerprint's proprietary model, identify a hardware serial, or claim that every tracker can reproduce the result.

01 · Finding

Chrome was recognized as a returning visitor after multiple context changes.

In the recorded runs, changing local session mode, restarting Chrome, moving to a different server-observed public IP, and creating a fresh Chrome profile did not reliably produce a new visitor alias.

Changed

Normal ↔ Incognito
Browser process
Chrome profile
Observed network path

Returned

Same returned visitor alias

0.92–1.00 confidence across the recorded device runs

02 · Evidence

View the 14 captures

The image below demonstrates that incognito mode was on and the IP address changed while the visitor identifier remained the same. The JSON below outlines fourteen captures and preserves repeated-value relationships across two devices.

Selected paired observation using synthetic public values. The relationships between the two captures are preserved.

Public evidence set

Inspect all 14 captures.

Choose a capture to compare the intervention, returned alias, and complete synthetic response.

Device A

Baseline · home network

Intervention: baseline
Changed from prior capture: initial observation
Held constant: None recorded
Returned: ABC · 1.00 confidence

Network 192.0.2.10 · ZurichTimezone Europe/ZurichMode Normal · No VPN detected

{
  "capture_id": "CAPTURE-001",
  "baseline": false,
  "scenario": "Baseline · home network",
  "browser": "Chrome",
  "device_alias": "Device A",
  "environment_alias": "Environment A",
  "captured_at": "1788912905255",
  "interventions": [
    "baseline"
  ],
  "changed_from_previous_capture": [
    "initial observation"
  ],
  "held_constant_from_previous_capture": [],
  "result": {
    "visitor_alias": "ABC",
    "confidence": 1,
    "ip_address": "192.0.2.10",
    "city": "Zurich",
    "timezone": "Europe/Zurich",
    "incognito": false,
    "vpn": false
  },
  "server_response": {
    "event_id": "EVENT-001",
    "timestamp": "2026-08-01T14:00:00Z",
    "source": "device",
    "environment_id": "ENVIRONMENT-EB5D9A",
    "sdk": {
      "platform": "js",
      "version": "4.1.5",
      "integrations": [
        {
          "name": "custom-proxy-integration",
          "version": "1.0.2"
        },
        {
          "name": "custom-proxy-integration",
          "version": "1.0.4"
        },
        {
          "name": "fingerprintjs-pro-react",
          "version": "3.0.0"
        }
      ]
    },
    "replayed": false,
    "identification": {
      "visitor_id": "ABC",
      "confidence": {
        "score": 1,
        "version": "v1.1"
      },
      "visitor_found": false,
      "first_seen_at": "2026-08-01T14:00:00Z",
      "last_seen_at": null
    },
    "tags": {
      "referrerLink": "public-evaluation"
    },
    "url": "https://example.test/demo",
    "ip_address": "192.0.2.10",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36",
    "device": "Other",
    "os": "Windows",
    "os_version": "11",
    "browser_details": {
      "browser_name": "Chrome",
      "browser_major_version": "153",
      "browser_full_version": "153.0.0",
      "os": "Windows",
      "os_version": "11",
      "device": "Other"
    },
    "bot": "not_detected",
    "developer_tools": false,
    "ip_blocklist": {
      "email_spam": false,
      "attack_source": false,
      "tor_node": false
    },
    "ip_info": {
      "v4": {
        "address": "192.0.2.10",
        "geolocation": {
          "accuracy_radius": 20,
          "latitude": 47.3769,
          "longitude": 8.5417,
          "postal_code": "8001",
          "timezone": "Europe/Zurich",
          "city_name": "Zurich",
          "country_code": "CH",
          "country_name": "Switzerland",
          "continent_code": "EU",
          "continent_name": "Europe",
          "subdivisions": [
            {
              "iso_code": "CH-01",
              "name": "Zurich Region"
            }
          ]
        },
        "asn": "AS64500",
        "asn_name": "Example Network 1",
        "asn_network": "192.0.2.0/24",
        "asn_type": "isp",
        "datacenter_result": false
      }
    },
    "proxy": false,
    "proxy_confidence": "high",
    "proxy_ml_score": 0.182,
    "incognito": false,
    "privacy_settings": false,
    "suspect_score": 0,
    "tampering": false,
    "tampering_confidence": "high",
    "tampering_ml_score": 0.0044,
    "tampering_details": {
      "anomaly_score": 0,
      "anti_detect_browser": false
    },
    "velocity": {
      "distinct_ip": {
        "5_minutes": 1,
        "1_hour": 1,
        "24_hours": 1
      },
      "distinct_country": {
        "5_minutes": 1,
        "1_hour": 1,
        "24_hours": 1
      },
      "events": {
        "5_minutes": 1,
        "1_hour": 1,
        "24_hours": 1
      },
      "ip_events": {
        "5_minutes": 1,
        "1_hour": 1,
        "24_hours": 1
      }
    },
    "virtual_machine": false,
    "virtual_machine_ml_score": 0.08,
    "vpn": false,
    "vpn_confidence": "high",
    "vpn_ml_score": 0.049,
    "vpn_origin_timezone": "Europe/Zurich",
    "vpn_origin_country": "COUNTRY-EB8BF0",
    "vpn_methods": {
      "timezone_mismatch": false,
      "public_vpn": false,
      "auxiliary_mobile": false,
      "os_mismatch": false,
      "relay": false,
      "ml_prediction": false
    },
    "high_activity_device": false,
    "rare_device": false,
    "rare_device_percentile_bucket": "p95-p99",
    "raw_device_attributes": {
      "font_preferences": {
        "default": 143.124375,
        "serif": 143.124375,
        "sans": 138.304219,
        "mono": 117.829219,
        "apple": 143.124375,
        "min": 15.752813,
        "system": 141.802031
      },
      "emoji": {
        "font": "Synthetic Serif",
        "width": 1606.575,
        "height": 22.72,
        "top": 17.26,
        "bottom": 32.73,
        "left": 14.53,
        "right": 1613.855,
        "x": 14.53,
        "y": 17.26
      },
      "fonts": [
        "FONT-591537",
        "FONT-609811",
        "FONT-60421E",
        "FONT-0DFBBB",
        "FONT-CFA057",
        "FONT-228B88",
        "FONT-3543CA",
        "FONT-D8E29B",
        "FONT-6D19B7",
        "FONT-AD138B",
        "FONT-80CFB7",
        "FONT-76971E",
        "FONT-0290E5"
      ],
      "device_memory": 16,
      "timezone": "Europe/Zurich",
      "canvas": {
        "winding": true,
        "geometry": "GEOMETRY-F503B1",
        "text": "TEXT-093939"
      },
      "languages": [
        [
          "de-CH"
        ]
      ],
      "webgl_extensions": {
        "context_attributes": "6b1ed336830d2bc96442a9d76373252a",
        "parameters": "PARAMETERS-74AECA",
        "shader_precisions": "SHADER_PRECISIONS-3EBCB8",
        "extensions": "2ec6a06c62e232a16e719d1738edbc16",
        "extension_parameters": "EXTENSION_PARAMETERS-CAD557",
        "unsupported_extensions": []
      },
      "webgl_basics": {
        "version": "WebGL 1.0 (OpenGL ES 2.0 Chromium)",
        "vendor": "WebKit",
        "vendor_unmasked": "VENDOR_UNMASKED-7753EF",
        "renderer": "RENDERER-21028B",
        "renderer_unmasked": "RENDERER_UNMASKED-81EA1F",
        "shading_language_version": "WebGL GLSL ES 1.0 (OpenGL ES GLSL ES 1.0 Chromium)"
      },
      "screen_resolution": [
        1600,
        900
      ],
      "touch_support": {
        "touch_event": false,
        "touch_start": false,
        "max_touch_points": 0
      },
      "architecture": "ARCHITECTURE-9556B8",
      "cookies_enabled": true,
      "hardware_concurrency": 8,
      "date_time_locale": "de-CH",
      "vendor": "Google Inc.",
      "color_depth": 24,
      "platform": "Win32",
      "session_storage": true,
      "local_storage": true,
      "audio": "AUDIO-C40EDA",
      "plugins": [
        "PLUGIN-C80FD4",
        "PLUGIN-55F403",
        "PLUGIN-8DC338",
        "PLUGIN-8AE52F",
        "PLUGIN-99FFE1"
      ],
      "indexed_db": true,
      "math": "MATH-EA13A6",
      "font_hash": "FONT_HASH-18F30E",
      "timezone_offset": "+01:00",
      "battery_level": 87,
      "battery_charging": true,
      "keyboard_layout_hash": "KEYBOARD_LAYOUT_HASH-4F748B",
      "keyboard_layout_name": "de-CH"
    },
    "client_referrer": "https://example.test/"
  },
  "js_agent_response": {
    "event_id": "EVENT-001",
    "visitor_id": "ABC",
    "suspect_score": 0,
    "cache_hit": true,
    "sealed_result": "REMOVED_FROM_PUBLIC_COPY"
  }
}

This is a synthetic public copy, not a fictional result: repeated source values receive the same substitute across all fourteen captures. Boolean findings, counts, versions, confidence values, and change relationships are retained. Sealed vendor payloads and original identifying values are not deployed.

03 · Surfaces

Recognition occurs across multiple layers.

Chrome reduces some passive details, including the legacy User-Agent string, while retaining a capable web platform. A recognizer can combine browser-exposed values with request, network, historical, and account context.

Request metadata

Passive

Every request carries protocol and header context before page JavaScript executes.

User-Agent reduction
Client Hint headers
Accept-Language
HTTP protocol behavior

Chrome reduces some passive detail, but a server still receives a structured request and may request additional Client Hints.

Chrome for Developers Chrome for Developers The Chromium Projects

Runtime environment

Active

Page scripts can query browser, display, language, timing, and device-adjacent properties.

Screen and pixel ratio
Languages and timezone
Hardware concurrency
Media and permission behavior

Individual fields can be common. A recognizer evaluates the combination, its stability, and how it changes over time.

Chromium source documentation Chromium source documentation

Rendering behavior

Active

Canvas, WebGL, text metrics, and related APIs can expose differences in the graphics and font pipeline.

Canvas output
WebGL renderer behavior
Font metrics
Color and image processing

Rendering output is not a serial number. It is one partial fingerprint whose value depends on the surrounding signals and observer.

Chromium source documentation

Connection context

Server-side

The destination observes the public route and server-side request behavior independently of local browser storage.

Public IP address
Proxy or VPN classification
Geolocation inference
Request history

A VPN changes the visible network path. It does not necessarily change the browser or device observations that arrive through that path.

The Chromium Projects Fingerprint

Signed-in continuity

Account context

Chrome profile state and direct use of Google services can add durable account context when the user signs in or enables relevant settings.

Chrome profile
Sync categories
Google Account
Direct service activity

This is a separate pathway from fingerprinting. It matters because multiple correlation pathways can coexist.

Google Chrome Help Google Account Help

Common runtime observationsjavascript

const surface = {
  languages: navigator.languages,
  timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
  screen: `${screen.width}×${screen.height}@${devicePixelRatio}`,
  cores: navigator.hardwareConcurrency,
  memory: navigator.deviceMemory ?? null,
};

console.table(surface);

Illustrative collection code. These values are not independently unique and this is not the vendor's implementation.

Requested User-Agent Client Hintsjavascript

const lowEntropy = navigator.userAgentData?.brands;
const requested = await navigator.userAgentData?.getHighEntropyValues([
  'architecture',
  'bitness',
  'model',
  'platformVersion',
  'fullVersionList',
]);

High-entropy hints are requested explicitly and availability may vary by browser, policy, context, and version.

Minimal rendering probejavascript

const canvas = document.createElement('canvas');
const ctx = canvas.getContext('2d');
ctx.font = '16px sans-serif';
ctx.fillText('404 privacy', 8, 24);

const pixels = canvas.toDataURL();
const width = ctx.measureText('404 privacy').width;

A teaching example only. Production recognizers can use multiple rendering operations and server-side context.

04 · Boundary behavior

Test conditions

Boundary	What changed	Observed return	Narrow interpretation
Normal → Incognito	Compare a normal window with an Incognito window on the same device. Device B changes both session mode and server-observed IP, then returns to the earlier IP.	Same visitor identifier	Local session isolation did not prevent recognition by this demo.
Browser restart	Close all Chrome windows and processes, relaunch Chrome, and revisit the demo. Device B isolates the restart on the same IP; Device A combines restart with a VPN change.	Same visitor identifier	Ending the browser process did not create a new identity in the recorded device run.
Network change	Compare responses after the server observes a different public IP. Device A moves from the home network to a VPN endpoint; Device B moves between two observed IPs.	Same visitor identifier	A changed server-observed IP did not prevent recognition in either standard device run.
New Chrome profile	Create a separate Chrome profile without importing the original profile's local browsing data. The new-profile request stays on the same observed VPN endpoint on Device A and the same observed IP on Device B.	Same visitor identifier	A fresh local profile did not prevent recognition in the recorded configurations.
Highly modified context	Restart across VPN endpoints A, B, C, and D; compare normal and Incognito requests and the returned aliases.	Persistent alternate identifier	Both aliases persisted. ABC crossed from the home network to endpoint C and from normal to Incognito there; HIJ crossed endpoints A, B, and D.

05 · Surveillance Architecture

Recognition happens because multiple layers agree.

Browser Surface

Browser and rendering surface

JavaScript APIs · screen · language · graphics · timingChanged only when the browser environment changes (chromium v. firefox)

Local session

Cookies, storage, and profile state

Normal profile · Incognito partition · fresh profileChanged when using incognito mode or separate/guest profiles

Request

Headers, protocol, and public network context

Client Hints · HTTP behavior · public IP · proxy classificationA VPN primarily changes the outward network path

Server history

Prior observations and correlation

Returned IDs · timestamps · event history · confidenceThe vendor's proprietary model operates here

Account context

Signed-in browser and service activity

Chrome profile · sync · Google Account · direct service useA separate continuity path. Not the same as fingerprinting

VPNs change your network path, not browser environment; and Chrome's Incognito documentation explicitly warns that websites and network operators may still observe activity. When these tools are combined, they can lead to meaningful identity separation (Identity C). Though, consistent application and careful management are required to achieve this effect.

06 · Direction

Chrome secures and narrows selected surfaces without standardizing all users.

Shipped

User-Agent reduction

The default User-Agent string exposes less passive detail, while sites can request structured Client Hints.

Chrome 152

Privacy Sandbox removals

Private Aggregation and related APIs were removed after Google's broader Privacy Sandbox direction changed.

Current distinction

Security v. Privacy

Exploit mitigation, permissions, and storage partitioning address important risks without making Chrome users indistinguishable.

Version tracking belongs here because implementation changes. The evaluation verdict remains a broad current overview; release-specific observations should link back to dated evidence and Chrome's primary release notes.

07 · Sources

Primary documentation and test provenance.

Identification request and visitor ID responseFingerprint · accessed September 10, 2026
Browse in Incognito modeGoogle Chrome Help · accessed September 10, 2026
What is User-Agent reduction?Chrome for Developers · accessed September 10, 2026
User-Agent Client HintsChrome for Developers · accessed September 10, 2026
Chromium network stackThe Chromium Projects · accessed September 10, 2026
Privacy Budget glossary: identifiable surfacesChromium source documentation · accessed September 10, 2026
Chrome Security FAQ: active and passive fingerprintingChromium source documentation · accessed September 10, 2026
Chrome 152 release notesChrome for Developers · accessed September 10, 2026
Update on plans for Privacy Sandbox technologiesGoogle Privacy Sandbox · accessed September 10, 2026
Sign in to ChromeGoogle Chrome Help · accessed September 10, 2026
Manage Web & App ActivityGoogle Account Help · accessed September 10, 2026

Need the plain-language judgment and use-case guidance?

Is Google Chrome Private? Read the review →