Free tool Browser privacy check: adblock test, fingerprint and privacy signals
Websites learn a lot without asking: whether you have opted out, whether they can store data, whether ads get blocked, and enough small details to recognise your device. This page tests each of those inside your browser and explains which ones actually stop tracking.
- GPC and Do Not Track
- Fingerprint surface, hashed locally
- Tests send no requests
Your browser privacy results
All tests run on this page. The tests send nothing to TapCub or anyone else, and they write no cookies or storage: the storage checks only read. Change a setting, reload, and run the check again.
JavaScript
Off (or still loading)
Global Privacy Control
—
Do Not Track
—
Cookies
—
Ad blocker
—
TapCub's analytics script
—
Checking…
Privacy signals and storage
What your browser tells every site about your choices, and what a site would be able to store.
| Signal | Your browser | What it means |
|---|---|---|
| Global Privacy Control | — | Sent as Sec-GPC: 1 with every request. Under California's CCPA regulations (§7025) a business must treat it as an opt-out of selling or sharing personal information. Built into Brave and DuckDuckGo (on by default) and Firefox (a setting); Chrome and Safari need an extension. |
| Do Not Track | — | The older header. Its W3C standard was abandoned in 2019, no law requires sites to obey it, and Safari removed it in 2019 because it made users easier to fingerprint. California's CalOPPA only requires privacy policies to say how a site responds to it. |
| Cookies for this site | — | From navigator.cookieEnabled. "Allowed" does not mean this site sets any: tapcub.com sets none. |
| localStorage | — | Readable only by the same site, kept until cleared. Checked by reading the property, without writing a test value. |
| sessionStorage | — | Like localStorage, but cleared when the tab closes. |
| IndexedDB | — | A database in the browser. Only its presence is checked; opening one would create it. |
| Storage quota | — | How much this site may store. A small quota is a common sign of a private window. |
| Third-party cookies | — | A single site cannot test this reliably: it needs a second domain. Safari blocks them by default, Firefox partitions them per site, Chrome allows them unless you block them in settings or use Incognito. |
| Ad blocker (cosmetic) | — | A hidden element with common ad class names is added to this page. If it disappears, a blocker that hides ads by element is active. Blockers that only cut network requests, such as DNS filters, cannot be seen without contacting an ad server, which this page does not do. |
| Automation flag | — | navigator.webdriver is true when the browser is driven by a test tool such as Selenium or Playwright. Bot filters, including TapCub's, read it. |
Fingerprint surface
Values any script can read without a permission prompt. Each alone is shared by many people; combined, they can single out a device without any cookie. The hash below combines them so you can see whether it changes between browsers, windows or days.
Checking…| Component | Your value | Hash |
|---|---|---|
| User agentExplained in detail here | — | |
| Languages | — | |
| Time zone | — | |
| ScreenSize, colour depth, pixel ratio | — | |
CPU threadshardwareConcurrency | — | |
| Device memoryChromium only, rounded | — | |
| Platform | — | |
| Touch points | — | |
| Canvas renderingSame drawing, rendered twice | — | |
| Graphics card (WebGL)Vendor and renderer | — | |
| Installed fontsChecked against a list of common system fonts | — | |
| Display preferencesColour scheme, motion, PDF viewer | — |
The hash is computed on this page and never leaves it. We do not say how unique it is: that would need a large database of other people's fingerprints, which this page does not have and does not build. A hash that changes on every run means your browser adds noise to canvas or other values.
Version v1.0Updated Update history
Which results actually protect you
The checks fall into three groups. Only the first one asks sites to stop; the second limits what they can store; the third is what is left when nothing is stored.
Opt-out signals
Global Privacy Control carries legal weight in California and some other US states, where it counts as an opt-out of selling and sharing data. Do Not Track carries none: honouring it is up to each site.
Storage and cookies
Blocking cookies and storage stops sites from writing an identifier into your browser. It does not stop server-side or cookieless measurement, and it breaks sign-ins.
Ad blocking
Cuts most ad and tracking scripts before they run, which removes far more tracking than any signal. The local test only sees blockers that hide page elements.
Fingerprint surface
What remains readable without permission. The defence is not hiding everything but making the values common or noisy: Brave, Firefox's fingerprinting protection and Safari randomise or simplify some of them.
A stable fingerprint hash does not prove anyone is fingerprinting you; it shows what a script could do. Seeing a different hash in a private window is normal when your browser hides or randomises values there.
Test a setting in three steps
No input needed: the page runs every check when it loads.
-
1
Note the baseline
Copy the combined hash and look at the six tiles at the top.
-
2
Change one setting
Turn on Global Privacy Control, enable an ad blocker, or open a private window, then reload this page.
-
3
Compare
See which tiles changed and whether the hash moved. If the hash changes on every reload, your browser randomises fingerprinting values.
What each test reads, and what it cannot
Every value comes from a standard browser API. Nothing here needs a permission prompt, which is exactly why these values matter for privacy.
- No network requests: the ad-blocker test uses an element on this page, not an ad server
- No writes: storage is checked by reading, so the page leaves nothing on your device
- The hash is SHA-256 over the values in a fixed order, computed in your browser
| Test | API | Limit |
|---|---|---|
| Global Privacy Control | navigator.globalPrivacyControl | Header Sec-GPC is what servers see |
| Do Not Track | navigator.doNotTrack | Missing in Safari since 2019 |
| Cookies | navigator.cookieEnabled | Browser setting, not per-cookie rules |
| Storage | localStorage, navigator.storage.estimate() | Read-only check |
| Ad blocker | Bait element + getComputedStyle | Misses network-only blockers |
| Canvas | canvas.toDataURL() | Rendered twice to spot noise |
| Graphics card | WEBGL_debug_renderer_info | Some browsers return a generic name |
| Fonts | measureText() width against fallbacks | Only fonts on our list |
One laptop, three browser setups
What typically changes when the same laptop is tested in different configurations. Your results will differ by browser version.
| Check | Default browser | Same browser, GPC on + ad blocker | Browser with fingerprint protection |
|---|---|---|---|
| Global Privacy Control | Off or not supported | On | On if built in |
| Ad blocker | Not detected | Detected | Detected if built in |
| Canvas | Stable | Stable | Randomised |
| Combined hash | Same on every reload | Same on every reload | Changes between sessions or sites |
| TapCub's script | Would run | Would not load | Would not load if GPC is on |
Turning on GPC and an ad blocker changes the signals but leaves the fingerprint untouched; only browser-level protection changes the fingerprint.
Misreadings to avoid
Privacy settings are easy to overestimate.
Relying on Do Not Track
Most sites ignore it, and it adds one more distinguishing value. Global Privacy Control is the signal with legal standing.
Thinking no cookies means no tracking
Fingerprinting and server-side identifiers need no cookie. Equally, cookieless analytics is not fingerprinting by definition: check what it reads.
Trusting a uniqueness score
A percentage only means something against a known population. Without that, "you are unique" is a guess.
Assuming an undetected blocker is off
DNS filters and network-only blockers do not hide page elements, so a local test cannot see them.
Analytics that respects these signals
TapCub's web analytics was designed around the checks on this page: it reads no fingerprint surface and stops when you opt out.
GPC and Do Not Track honoured
By default the script does not load when either signal is on, and the server treats any hit carrying the headers as anonymous aggregate data.
Learn moreNo cookies, no fingerprinting
Visitors are told apart on the server from the IP address and browser type with a salted hash. Canvas, fonts and graphics card are never read.
Learn moreCompliance centre
Consent records, opt-outs and one-person export or deletion in one place, with GDPR / CCPA as the baseline and a China mode on top.
Learn moreBrowser privacy questions
Still have a question?
Chat with the team behind TapCub — we usually reply within a few hours on business days.
How do I check my browser privacy?
Open this page: it tests Global Privacy Control, Do Not Track, cookies, storage, ad blocking and the fingerprint surface in your browser, then explains each result. Nothing is uploaded.
What is Global Privacy Control?
A browser setting that sends Sec-GPC: 1 with every request and exposes navigator.globalPrivacyControl to scripts. Under California's CCPA regulations, businesses must treat it as a request to opt out of selling or sharing personal information.
Does Do Not Track still work?
Technically yes, many browsers still send it. In practice its standard was abandoned in 2019, honouring it is voluntary, and Safari removed it. Use Global Privacy Control where you can.
How do I know if my ad blocker is working?
The ad blocker tile shows "Detected" when a blocker hides ad-like elements on this page. DNS-based and network-only blockers will show "Not detected" even when they work, because this page never contacts an ad server.
What is browser fingerprinting?
Recognising a device from values it reveals anyway — user agent, screen, time zone, fonts, canvas and graphics output — instead of storing an ID. It survives cookie clearing, which is why regulators treat it like cookies.
Can this page tell how unique my fingerprint is?
No. Uniqueness depends on how many other people share your values, and that needs a large dataset of fingerprints. This page computes your hash locally and stores nothing, so it shows the surface, not a ranking.
Why can't you test third-party cookies?
A third-party cookie belongs to a different domain than the page. Testing it needs a second domain to set and read one; this page uses only its own domain and sends no requests.
Does TapCub track me on this page?
This page writes nothing to your device and the tests send nothing. tapcub.com itself sets no cookies, and TapCub's own analytics script does not load when your browser sends GPC or Do Not Track.
Update history
New features, fixes and data refreshes for this tool, newest first.
-
· v1.0
LaunchedFirst release.
Missing something or found an error? Tell us — requests that come up often go into the next update. All tool updates
Measure your site without fingerprinting anyone
TapCub counts visits without cookies, reads none of the fingerprint surface above and stops when visitors opt out.