Study of 1M top sites sheds light on techniques some firms use to track users: Canvas, Canvas-Font, AudioContext fingerprinting, local WebRTC IP discovery, more
During our January 2016 measurement of the top 1 million sites, our tool made over 90 million requests, assembling the largest dataset …
Context & Ripple Effects
Princeton's Web Transparency project turned its crawler loose on the top 1 million sites in January 2016, logging over 90 million requests to document how widely Canvas, Canvas-Font, AudioContext fingerprinting and local WebRTC IP discovery are deployed against ordinary visitors. The study matters because it names specific browser APIs being repurposed as tracking surfaces at scale, giving regulators and toolmakers a concrete target list rather than anecdotes.
The arc since then has validated the concern: [[a:925328|analysis of top-site code found 30.5% of Alexa's top 10K running anti-ad-blocking measures hidden from visitors]], [[a:978951|real-time bidding was later shown exposing a person's activity and location hundreds of times per day]], and by 2025 researchers caught [[a:886505|Meta and Yandex reusing web identifiers to pull browsing histories from Chromium-based Android browsers]]. This dataset is the early map of that covert-tracking ecosystem.
First-order effects
- Tracking firms named in the study now face documented evidence of which APIs they exploit, handing privacy-tool developers and browser makers a checklist of behaviors to detect and block.
- Users of cookie-blocking extensions learn the limits of their protection: fingerprinting via Canvas and AudioContext works without stored identifiers, so clearing cookies defeats none of it.
Second-order effects
- Browser vendors come under pressure to restrict or randomize the very APIs the study flags, forcing trackers into an arms race toward new fingerprinting surfaces — the same cat-and-mouse visible later in the Meta/Yandex identifier reuse.
- Ad-tech intermediaries that rely on cross-site identity face rising detection risk, pushing budget toward contextual targeting and walled gardens that don't need third-party fingerprints.
Third-order effects
- If measurement studies like this keep converting invisible practices into named ones, the likely endpoint is regulatory treatment of fingerprinting as a tracking method requiring consent, with enforcement aimed at the API level rather than the cookie.
- The structural pattern is a permanent asymmetry: each disclosed technique degrades but rarely eliminates covert tracking, so web privacy increasingly depends on continuous independent auditing of top-site code rather than one-time compliance fixes.
The trend: Web tracking is migrating from cookies toward device- and browser-fingerprinting techniques, with academic audits serving as the primary discovery mechanism ahead of regulation.