The Complete Browser Privacy Audit for 2026

Why Browser Privacy Has Never Been More Complex

Modern web browsers have evolved into sophisticated application platforms with access to your camera, microphone, location, file system, payment methods, and dozens of hardware sensors. The same powerful APIs that enable video calls, interactive maps, and rich web applications can be exploited by advertisers, trackers, and malicious websites to build detailed behavioral profiles, fingerprint your device, and monitor your activity across the web.

A comprehensive browser privacy audit examines over 60 distinct privacy vectors — from cookie storage mechanisms and permission grants to fingerprinting surfaces and privacy-invasive APIs. The goal isn't paranoia; it's understanding your actual exposure and making informed decisions about which risks to accept and which to mitigate. This guide walks through the complete audit systematically.

Cookie Storage and Supercookies: Beyond Basic Cookies

Most users understand HTTP cookies. But "supercookies" — tracking mechanisms that persist through normal cookie clearing — represent a more sophisticated threat that standard privacy settings don't address:

• localStorage and sessionStorage: Web Storage APIs can store up to 5MB per origin. Trackers use localStorage to store persistent identifiers that survive cookie clearing. Unlike cookies, localStorage doesn't expire automatically and isn't sent with HTTP requests — making it less visible in network analysis.
• IndexedDB: A full client-side database API allowing websites to store arbitrarily large structured datasets. Increasingly used to store detailed behavioral profiles locally, which are then synchronized to tracking servers at intervals.
• Cache-based tracking (ETags): HTTP ETags are cache validation tokens that web servers can use to verify whether a client has a cached version of a resource. Trackers exploit this: they assign unique ETags to tracking resources, and when your browser returns the ETag in subsequent requests, the server uses it as a tracking identifier that persists across sessions.
• HSTS supercookies: HTTP Strict Transport Security forces browsers to use HTTPS for specific domains. Trackers can encode a unique ID into binary patterns across HSTS settings for multiple subdomains — even after cookies are cleared, the HSTS settings encode the tracking ID.
• Favicon cache tracking: A recently documented technique exploits browser favicon caching behavior. By timing favicon requests, trackers can determine which subdomains have been visited before, encoding a tracking vector in timing patterns.
• Service Worker persistence: Service Workers can run in the background even when no browser tab is open. Malicious service workers can store tracking data that persists indefinitely.

Comprehensive Permission Audit

Every permission grant represents a persistent privacy exposure. Most users grant permissions during moments of high task-focus and forget they granted them. A systematic permission audit often reveals permissions granted to sites you haven't visited in years:

• Camera access: Any site with camera permission can activate your camera whenever you visit it. In Chrome, go to Settings → Privacy and Security → Site Settings → Camera to see all granted permissions. Revoke all camera access from sites you don't actively use for video.
• Microphone access: Even if camera is blocked, microphone access enables audio fingerprinting and raises always-on surveillance concerns. More sensitive than camera in some ways since audio can be captured without visible indication.
• Location (Geolocation): Persistent location permission means a site can request your GPS coordinates any time you visit. This should never be granted persistently — only per-use. Revoke all persistent geolocation permissions; grant per-use only when you actively need location features.
• Notifications: Push notification permission is often granted carelessly. Beyond enabling push notifications, it establishes a persistent relationship with the site's push notification service — your IP address may be transmitted to that service even when you're not browsing the site.
• Clipboard access: Some sites request clipboard read access — this lets them read anything you've most recently copied, which could include passwords, sensitive documents, or personal information.
• USB and Bluetooth: Sites can request access to connected USB devices and Bluetooth devices. Any granted device access persists until manually revoked.

Privacy-Invasive API Audit

Modern browsers expose hardware and system information through JavaScript APIs that can be used for fingerprinting and surveillance beyond what most users expect:

• Battery Status API: Returns your current battery percentage, charging status, time to full charge, and time to discharge. Changes in battery levels over time create a behavioral fingerprint. Largely removed from Chrome but still present in Firefox.
• DeviceMotion and DeviceOrientation APIs: Provide real-time accelerometer and gyroscope data on mobile devices. Can fingerprint device hardware characteristics and infer physical activity, location context, and device model.
• Network Information API: Reports connection type (WiFi vs. cellular), effective bandwidth category, and round-trip time estimates. Used for adaptive content delivery but also for fingerprinting network environment.
• Performance Timing APIs: High-resolution timing enables measurement of how quickly specific operations complete — JavaScript execution speed, memory access patterns, network round-trip times. These timing fingerprints can reveal hardware specifications and geographic location with surprising precision.
• Ambient Light Sensor API: Reports ambient light level in lux. Combined with other signals, this can correlate your browsing with physical location context (office vs. home, indoor vs. outdoor).

Third-Party Script Analysis

The average webpage loads scripts from 15-20 third-party domains. Each of these external scripts has the ability to read and write cookies, access localStorage, make network requests, fingerprint your browser, and report your activity back to their servers — subject only to the permissions the page grants them. Privacy audits increasingly focus on third-party script exposure:

• Advertising networks embedded across thousands of sites correlate your visits to build cross-site behavioral profiles
• Analytics platforms (Google Analytics, Mixpanel, Amplitude) receive a report of every page you visit on sites using them
• Social media widgets (Facebook Like buttons, Twitter Share buttons) report your visit to those platforms regardless of whether you click them
• CDN-hosted libraries and fonts from Google create opportunities for cross-site tracking via shared HTTP/2 connections

Step-by-Step Browser Privacy Hardening

1. Conduct a complete storage purge. In Chrome/Edge: Settings → Privacy and Security → Clear browsing data → Advanced → select all types including Cookies, Cached images, localStorage, IndexedDB, and Service workers. In Firefox: Preferences → Privacy → Clear Data.
2. Audit and revoke all permissions. Go through Camera, Microphone, Location, Notifications, Clipboard, and USB/Bluetooth permissions. Revoke everything except what you actively need for current, regular use.
3. Enable Enhanced Tracking Protection. Firefox includes three levels: Standard, Strict, and Custom. For most users, Strict mode significantly reduces tracking with minimal site breakage.
4. Install uBlock Origin. The most efficient and effective content blocking extension available. Use it in medium mode for significant protection with acceptable site compatibility.
5. Configure DNS over HTTPS. In Chrome: Settings → Privacy → Security → Use secure DNS. In Firefox: Preferences → General → Network Settings → Enable DNS over HTTPS.
6. Disable WebRTC if not used. In Firefox, set media.peerconnection.enabled to false in about:config. In Chrome, use an extension if you don't use browser-based video calls.
7. Implement browser compartmentalization. Use separate browser profiles (or different browsers entirely) for work, personal browsing, and sensitive financial/health-related browsing. This prevents cross-context tracking and limits breach blast radius.
8. Review installed extensions. Each extension with access to all sites can read all your web traffic. Audit your installed extensions and remove anything you don't actively use or trust completely.

Measuring Your Privacy Improvement

After implementing these changes, run a comprehensive browser privacy audit tool to measure your actual privacy improvement. Look for specific metrics: fingerprint uniqueness reduction, tracker blocking effectiveness, cookie isolation status, and WebRTC leak status. Privacy tools that show before/after comparisons make it clear which specific measures have had the most impact on your unique browser configuration, enabling you to prioritize further hardening where your exposure remains highest.