What Data Can Websites Collect About You Without Permission?

Collected with zero prompts

Depending on browser support and settings, a page may read the following through JavaScript without asking:

• IP address and the approximate city and ISP derived from it.
• Operating system, browser, and exact version, from the user-agent and client hints.
• Screen resolution, color depth, and window size.
• Timezone and full language preference list.
• CPU core count and approximate device memory, when those APIs are supported and exposed.
• Battery level and charging state, on browsers that still expose the Battery Status API.
• Some font-related signals; broad installed-font enumeration is restricted or unavailable in many browsers.
• GPU vendor and model via WebGL, when WebGL is available and not blocked.
• Canvas and audio rendering signals that may be repeatable across visits, depending on browser defenses.
• In some browsers, counts of connected cameras, microphones, and speakers (names stay hidden until you grant access).
• The site you arrived from, via the referrer.

What requires your permission

A short list of high-sensitivity capabilities still trigger an explicit prompt: precise GPS location, camera and microphone access, clipboard reading, and notifications. Denying these is always safe — sites should degrade gracefully — but many request them by routine, and a granted permission can be silently reused on your next visit.

What websites genuinely cannot see

The browser sandbox and same-origin policy hold firm on the things people worry about most. A page cannot read your other open tabs, your browsing history on other sites, your files, or another site's cookies. It can, however, detect the instant you switch away from its tab.