What Data Can Websites Collect About You Without Permission?
The moment a page loads, it can read far more than most people expect — no permission dialog required. Permission prompts only guard a small set of especially sensitive capabilities.
Updated July 2, 2026 · 5 min read
Collected with zero prompts
The following are all readable by JavaScript on any page you open, without asking:
- IP address and the approximate city and ISP derived from it.
- Operating system, browser, and exact version, from the user-agent and client hints.
- Screen resolution, colour depth, and window size.
- Timezone and full language preference list.
- CPU core count and approximate device memory.
- Battery level and charging state, on many browsers.
- Installed fonts, which can reveal the software you run.
- GPU vendor and model via WebGL.
- A canvas and audio fingerprint that is stable across visits.
- The number of connected cameras, microphones, and speakers (names stay hidden until you grant access).
- The site you arrived from, via the referrer.
What requires your permission
A short list of high-sensitivity capabilities still trigger an explicit prompt: precise GPS location, camera and microphone access, clipboard reading, and notifications. Denying these is always safe — sites should degrade gracefully — but many request them by routine, and a granted permission can be silently reused on your next visit.
What websites genuinely cannot see
The browser sandbox and same-origin policy hold firm on the things people worry about most. A page cannot read your other open tabs, your browsing history on other sites, your files, or another site's cookies. It can, however, detect the instant you switch away from its tab.
Frequently asked questions
- Can a website see my name or email without me typing it?
- Not directly. A page cannot read your identity out of the browser. It can, however, build a persistent fingerprint and combine it with data brokers or logged-in third-party widgets to link your visit to a profile over time.