The Invisible Census: A Population Registry Built Without Consent

---

The Census Nobody Called

Before the republic had paved a single road, US marshals were already riding farm to farm with quill and ledger, scratching names for the 1790 headcount. Little has shifted in the marrow of that ritual across two and a half centuries: once a decade, someone from the government wants to know who you are, how many of you share a roof, where you sleep at night. You can slam the door. You know you're being counted.

In brief: Browser fingerprinting has become a ceaseless census: 60.2% of users are unique from just 13 attributes, and a single fingerprint can betray gender, age, income, and race. No consent. No warning.

Come 2025 and nobody rides horseback, nobody knocks, nobody asks. Ad networks, analytics outfits, and commercial SDKs threaded through every other major website have seized the headcount. Governments aren't running this one. Browser fingerprinting is the instrument, and what it yields is a planetary population ledger stitched together without a single nod of consent. You're in it whether you like it or not, much the way you're in the background of a stranger's vacation photo at Disneyland, except the photo never gets deleted and someone's selling prints.

What a Single Browser Request Tells About You

Picture a census form with dozens of blanks that fill themselves the heartbeat you crack open a webpage. No pen, no clipboard, no inkling that a form even exists.

A team from Google and MIT published How Unique is Whose Web Browser? in the peer-reviewed journal PoPETs in January 2025. Data from 8,400 people on the Prolific platform, matching demographic surveys to real browser attributes for the first time ever. What fell out of that dataset should unsettle anyone who's ever opened a tab.

Just 13 quotidian browser attributes, the kind any site reads without so much as a by-your-leave, made 60.2% of those people one of a kind. Sixty percent. Not sifted from a billion web users worldwide. From eight thousand in one country. Blow that ratio out to the full internet and uniqueness stampedes toward totality.

Worse still, uniqueness was only the overture. Same browser attributes let researchers statistically tease out gender, age, income bracket, and race. Gender proved easiest to read. Low-income users got flayed worst because their gear skews older and quirkier, throwing off a rarer fingerprint like a neon sign in a blackout. And here's a grim wrinkle baked right into the data: older people get tracked more sharply, and older people fret about surveillance more keenly. A vicious loop with no off-switch.

What one fingerprint holds:

• Device and model. Desktop, phone, tablet, specific maker.
• Operating system and version. Windows 11, macOS Sonoma, Android 14.
• Country and region. Timezone plus language settings add up to a near-exact locale.
• Language and nationality. Accept-Language header, keyboard layout, installed fonts.
• Income level. Screen resolution flags the price tier of your device. CPU core count and RAM fill in the rest. Someone running 4 GB of RAM behind a 1366×768 screen isn't living in the same zip code as an M3 Max owner with 36 GB. Hardware is a wealth confession.
• Profession. Installed fonts betray the trade. Adobe fonts point to a designer. Niche monospace fonts point to a developer.
• Gender. Statistical correlation across every parameter above, surfaced by PoPETs'25.

Swapping browsers doesn't help. Cao et al. at NDSS 2017 proved that OS-level traits like WebGL rendering, audio stack, and font inventory can pin a user even after jumping from Chrome to Firefox. Cross-browser fingerprinting welds your sessions together through hardware signals that won't budge when you change software. Switching from Coke to Pepsi doesn't change your dental records.

A traditional census asks these same questions, runs once a decade, works on willing footing, and bows to statute. Fingerprinting fires on every page load, bereft of consent and bereft of warning.

Scale: Who Runs This Census

If fingerprinting sounds like some chimerical curiosity dragged out of academic papers, meet the actual numbers.

Fingerprint, formerly FingerprintJS, holds the crown as the biggest open-source purveyor of browser fingerprinting code. North of 22,000 stars on GitHub, more than 40,000 dependent projects, and npm downloads clearing a million a month. By Fingerprint's own 2024 tally, their tech runs on 12% of the world's top 500 sites by traffic. Commercial wing handles over 12 billion requests monthly, layering server-side machine learning onto client-side signals to hone accuracy.

Client roster spans one of the world's largest cloud enterprise software providers, a leading European bank, an Asian Gen Z video platform, car dealerships dotting the American landscape. In 2024 alone the company shipped 10 major releases, keeping lockstep with every tweak in Safari 17 and 18.

One player. Just one.

ThumbmarkJS, a rival library, serves 60,000+ sites and a billion identifications. FP-Tracer from PoPETs 2024 found fingerprinting on 30% of sites in the web search category. As far back as 2019 the Washington Post reported more than a third of the top 500 American sites pulling the same stunt.

Conventional ways of catching fingerprinting undercount something fierce. Beyond the Crawl, presented at ACM Web Conference 2025 by a team from UCL, UC Riverside, and Google Zurich, showed automated scanners miss roughly 45% of fingerprinting. Scripts hide behind login walls, bot shields, and triggers that only fire on real human input. Researchers stacked automated crawl data from 3,000 sites against real sessions from 30 users. Upshot: true fingerprinting prevalence doubles whatever any crawler-based estimate claims. Every published percentage of fingerprinted sites? Lowballing by about half. Which frankly makes every reassuring headline about the practice feel like a weather report that forgets to mention the tornado.

No sign of a lull either. In June 2025 Fingerprint announced a product that reckons the fingerprint on-device with minimal network calls. Commercial accuracy: 99.5%. Open-source libraries hover between 40 and 60%. A widening chasm between what researchers poke at in labs and what ships in production code. Fingerprinting is drifting from servers to client devices, growing ever less visible to anyone watching the wire.

The Pipeline: From Fingerprint to Dossier

A fingerprint by itself is just a label, no more menacing than a barcode on a cereal box. Real peril blooms when that label plugs into the plumbing of mass data harvesting, and that plumbing runs deep enough to make a sewer engineer blanch.

Programmatic advertising hinges on Real-Time Bidding. Every time you open a page carrying ads, an auction fires in milliseconds. By Iccl reckoning, the average American's data gets broadcast 747 times a day. Across the US and Europe together that clocks roughly 490 billion bid requests every 24 hours. Each request sprays user data to thousands of bidding companies: device ID, location, browsing history, interests. Win or lose the auction, everyone walks away with the data. Like a livestock sale where every bidder in the barn gets a copy of every animal's medical records whether they buy a head or not.

Gravy Analytics, founded in 2011, tracked over one billion mobile devices daily. Fourteen years of unbroken harvest. Its subsidiary Venntel sold data to the FBI, Immigration and Customs Enforcement, and US Customs and Border Protection. In January 2025 hackers cracked Gravy Analytics and walked off with 17 terabytes of location data. Just the analyzed slice from early January held 30 million records. Data poured in from thousands of apps: Candy Crush, Tinder, Grindr, MyFitnessPal, prayer apps, pregnancy trackers. According to Ailance data from January 2025, more than 40,000 apps pipe geolocation to third parties. Wired called the breach a nightmare scenario. Developers behind many of those apps had zero clue that embedded ad SDKs were siphoning user geolocation into the bidstream.

December 2024 brought the FTC down on data broker Mobilewalla, which had amassed files on more than a billion people. Sixty percent of that haul came straight from RTB auctions. Without placing a single ad. Mobilewalla didn't buy impressions; the company latched onto auctions purely to vacuum up data about the people being auctioned. Sold those feeds to track union organizers and Black Lives Matter protesters. Sorted human beings into bins: pregnant women, Hispanic churchgoers, Lgbt community. Your browser fingerprint is the on-ramp to all of it. Device ID, IP address, canvas hash: filaments tying an apparently anonymous ad auction to your dossier at a data broker.

EFF put it with admirable bluntness: RTB isn't an advertising system that taps data. RTB is a mass surveillance system bankrolled by advertising. Chew on that for a minute.

February 16, 2025: The Day Google Changed Its Mind

Back in 2019, Google declared war on fingerprinting. Official company statement called it a subversion of user choice, stamped it as wrong. Trade press ate it up. Privacy advocates popped figurative champagne.

On February 16, 2025, Google reversed course. Advertisers can now wield device fingerprinting inside Google's ad products. Six years of user-protection rhetoric, incinerated by one policy update. A volte-face so brazen it could make your head spin.

Blowback landed fast. UK's Information Commissioner's Office fired off a public rebuke, setting 2019 Google against 2025 Google line by line. Privacy researcher Lukasz Olejnik asked openly whether we'd just lived through the steepest privacy erosion in a decade.

Damage runs structural, not cosmetic. When the world's biggest ad platform greenlights fingerprinting across its own products, chasing lone websites for the same practice becomes pure kabuki theater. Google didn't merely let fingerprinting through a side door. Google crowned it standard.

Beyond Ads: When a Fingerprint Becomes a Weapon

Advertising is money. For certain people on this planet, fingerprinting is a question of staying alive.

In February 2025 the Knight First Amendment Institute and the University of Toronto's Citizen Lab released Silenced by Surveillance. Authors Siena Anstis and Ronald Deibert ran more than 80 semi-structured interviews from 2019 through 2024 with journalists, human rights defenders, and dissidents in exile. People who genuinely believe their home governments are hunting them, because often enough they're right.

One case from the report: Carine Kanimba, a Rwandan activist living between the US and Belgium. Her phone was infected with Pegasus spyware during a meeting with Belgium's foreign affairs minister to discuss her imprisoned father's case. States hire private firms to build digital armies that stalk the diaspora across borders.

Fingerprinting feeds the identification layer that makes all of this workable. Gravy Analytics breach in January 2025 laid bare the gears: location data from a billion devices came not through some shadowy hack but through lawful ad infrastructure. Bidstream data, sprayed to thousands of companies with every RTB ad impression, carries device IDs, GPS coordinates, and app metadata. Government agencies bought these feeds from commercial middlemen. Between an ad SDK in a prayer app and an intelligence agency's query sit three or four companies and zero court orders. America's Fourth Amendment shields citizens from unreasonable searches. Buying data on the open market doesn't count as a search, apparently. A loophole you could drive a freight train through.

Planting Pegasus needs an exploit and access to the device. Fingerprinting a device needs nothing at all. A journalist visits a site. A script reads canvas, WebGL renderer, font inventory, audio context. A unique tangle of signals locks onto one device. No cookies. No malware. No trace on the target's machine.

From there a fingerprint works to pin identity across sites, track research threads, tie pseudonymous accounts to a flesh-and-blood person even behind a VPN, and trip targeted attacks through watering holes: trap pages wired to fire on a specific fingerprint. Knight/Citizen Lab report found that digital technologies have perversely grown into the chief wellspring of insecurity, fear, and self-censorship for activists worldwide.

A fingerprint costs less than Pegasus. Needs no zero-day exploits. Runs through any web browser. Target never sees a thing.

Why GDPR Doesn't Work

Europe's data protection framework formally covers fingerprinting. Article 29 Working Party acknowledged device fingerprinting falls under the ePrivacy Directive. On the statute books it sits right next to cookies, calling for explicit user consent. On paper, the shield stands firm.

Real world tells a different tale entirely. Five lacerating reasons.

Invisibility. Cookies leave a mark on the device, forcing browsers to show a consent banner. Fingerprinting stores nothing on the client. No files, no banners, no warnings. User never knows, and what you don't know you can't fight.

No way out. You can wipe cookies with two clicks. You can't wipe your fingerprint. Existing hardware and software traits are the raw substrate. Opting out means quitting web browsers altogether, which in 2025 is like opting out of electricity.

Server-side reckoning. Entire computation can happen on the server. Nothing lingers client-side. DevTools shows a blank.

Invisible to enforcers. Regulators catch cookies through automated crawls. Fingerprinting scripts look like any other JavaScript. Canvas API draws interfaces. AudioContext plays sound. WebGL renders 3D. Same APIs harvest fingerprints. Only dividing line is intent, and intent can't be read from code. Asking a regulator to tell benign JavaScript from fingerprinting JavaScript is like asking a postal worker to distinguish love letters from ransom notes by weighing the envelopes.

Jurisdictional arbitrage. Many heavy-fingerprinting sites sit outside EU reach entirely.

FingerprintJS itself claims its open library meets GDPR because it stores no data. Technically true. Practically a hollowed-out shell. What the library does is spin a hash from outward browser traits. Storage lands with whoever called the library, somewhere else, in some other jurisdiction, under some other set of rules or none at all.

GDPR has doled out staggering fines for consent and data-handling breaches: Meta paid 390 million euros in 2023, Amazon 746 million euros in 2021. Yet cases tied specifically to fingerprinting fit on one hand. Not because fingerprinting is rarer. Because proving it in court borders on impossible when victims suspect nothing and can brandish no evidence. Canvas API renders interfaces. AudioContext handles sound. WebGL draws 3D scenes. Same APIs pull fingerprints. Sole dividing line is intent. Intent doesn't show up in source code.

ePrivacy Regulation, drafted to plug these lacunae, was proposed by the European Commission in 2017. Nine years of sclerotic wrangling ended with the Commission shelving the whole thing. Tech outpaces lawmaking. Always has, and the gap is widening like a cracked dam.

Google's February 16, 2025 reversal drives the final nail into regulatory ambitions. When Google itself weaves fingerprinting into ad infrastructure, telling lone websites to cut it out is like fining jaywalkers on a highway with no sidewalks.

New Surfaces: The Census Widens

Every fresh browser API cracks open a new attack surface for fingerprint extraction, and the roster of harvested data swells faster than any defense can keep stride.

WebGPU, an API for GPU-side computing, landed in Chrome in 2023. Researchers at ACM WiSec 2025 showed atomic operations on the GPU can single out a device with 70% accuracy from a pool of 500. Browsers have shipped zero countermeasures. WebGPU sidesteps every privacy guard built for WebGL clean as a whistle. Another door left ajar in a house that's already drafty.

Behavioral biometrics, the technology that knows you by how you steer a mouse, strike keys, and scroll, sits at $2.72 billion in 2025 and is forecast to hit $11.38 billion by 2031. Average yearly growth: 26.95%. Your micro-twitches, the caesurae between keystrokes, the telltale cadence of your typing. All of it a sellable product now. Census logs not just who you are but how you move through a page.

How Unique is Whose Web Browser? from PoPETs 2025 layered on another grim axis: demographic inequity before surveillance. Low-income users caught the worst of it because their devices trend older and more unusual. An aging phone running Android 10 with low resolution and 4 GB of memory throws off a more singular fingerprint than a new iPhone with a stock setup. Poverty makes you louder in the signal. Surveillance mirrors social stratification with eerie fidelity: those least able to bear being tracked get tracked with the sharpest focus. If that doesn't rankle you, read it again.

What WHOX Sees

If an invisible census is running, finding out what it's jotted down about you just makes sense. WHOX scans your browser with the same methods ad networks and data brokers wield, then shows the findings to the device's owner instead of to a buyer.

Here's what gets drawn from a single visit:

Canvas, WebGL, WebGPU, audio. Four separate fingerprints, each tethered to device hardware. Canvas draws an unseen scene and reads back pixels. WebGL queries the GPU. Audio Context spawns a sound buffer. Output holds steady for months and doesn't flinch in incognito mode.

Network and protocols. JA4 fingerprint of the TLS handshake, HTTP header order, HTTP/2 behavior, QUIC traits. Can't be forged from JavaScript because they're shaped at the browser's network stack level.

Leaks. WebRTC bleeding your real IP through a VPN. IPv6 slipping past the tunnel. DNS resolver sitting in a different country than your IP address. mDNS leaking the device name. System probes 18 types of network leaks.

Behavior. Mouse speed and curvature, scroll cadence, click-interval variability. Bots drag cursors in a straight line at fixed velocity. Humans quiver. Algorithm tells the difference.

Environment integrity. API prototype spoofing, global object pollution, Proxy traps, script injections. If an antidetect tool has doctored the browser, checks flag it.

FORESIGHT module ties sessions together through 18 signals across four categories and builds a Digital Shadow: a profile of your digital wake scored for trackability, linkability, and the cash worth of your data. One person who cycled through three VPNs, two browsers, and incognito mode still left a connectable trail through GPU and WASM hardware timings.

Split between WHOX and an ad network boils down to directionality. Ad network peers at you. WHOX lets you peer at yourself through their lens.

A Census Every Second

A traditional census is a snapshot. Once a decade. Voluntary. Anonymized. Released in aggregate. Governed by law and public oversight.

Fingerprinting census is a live feed. Fires on every HTTP request. Pegged to a specific device and through that device to a specific person. Not anonymized. Not released. Not overseen. Warehoused on servers of commercial outfits, in jurisdictions handy for owners rather than for the people whose data fills the rows.

	Traditional Census	Fingerprinting Census
Frequency	Once per 10 years	Every site visit
Consent	Required by law	Never sought
Visibility	Questionnaire, enumerator	Invisible
Opt-out	Possible	Impossible without ditching the browser
Data	Demographics in aggregate	Device, behavior, network, demographics
Storage	Government archives, 72 years until release	Commercial servers, retention unknown
Regulation	Constitution, census laws	GDPR on paper, nobody in practice
Scope	One country's population	Every internet user

2020 US Census cost $14.2 billion and covered 331 million people. FingerprintJS handles 12 billion requests a month. For the budget of a single engineering team, a commercial company runs what amounts to a monthly planetary census.

Government census asks first. Locks data away for 72 years before anyone sees it. Faces prosecution for leaks. Commercial census never asks, stores data without end, and when breached issues an apologetic press release like a shrug in PDF form. Gravy Analytics hoarded data on a billion devices for fourteen years. Hackers took the lot in one operation.

What to Do

Window for regulation is narrowing by the month. Google legalized fingerprinting across its ad ecosystem. In January 2026 the company reached a global settlement in an RTB lawsuit and floated a mechanism called RTB Control for curbing data in auctions, which only works for users logged into a Google account. EFF has called for a flat ban on behavioral advertising. Not an opt-out. A ban.

Apple is steering the opposite direction: iOS 26 switches on Advanced Fingerprinting Protection by default for all browsing. Apple's reach stops at Safari, though. Chrome holds 65% of the browser market. Chrome now plays for the advertisers.

Over 80 people interviewed for the Knight/Citizen Lab report Silenced by Surveillance describe a world where digital tools have turned into instruments of transnational repression. Spyware grabs headlines. Fingerprinting stays crepuscular. Yet fingerprinting feeds the identification layer everything else rests on.

While regulators scramble, defense falls to you. Six steps that slash your trackability right now:

1. Check your fingerprint. Open WHOX, AmIUnique, or Cover Your Tracks from the EFF. See what your browser gives away unprompted. Ignorance isn't safety.

2. Turn on resistFingerprinting in Firefox. In about:config set privacy.resistFingerprinting to true. Flattens dozens of signals: fonts, timezone, canvas output. Uniqueness drops by an order of magnitude.

3. Kill WebRTC. In Firefox: set media.peerconnection.enabled to false. In Chrome you need an extension like uBlock Origin. WebRTC leaks lay bare your real IP even through a VPN.

4. Split your profiles. One browser for work, one for personal life. Firefox Multi-Account Containers wall off fingerprints by container. Session linking only works within a single profile.

5. Block third-party scripts. uBlock Origin in strict mode strips most fingerprinting libraries before they fire. Not just ads. All third-party JavaScript by default.

6. Forget incognito mode. Private browsing wipes cookies. Doesn't touch your canvas fingerprint, WebGL renderer, or font set. To fingerprinting systems, incognito and normal mode look the same.

Invisible census goes on. 747 data broadcasts for every American every day. Roughly 490 billion auctions in total. Zero requests for consent.

---

Frequently Asked Questions

Can gender and age be drawn from a fingerprint? Yes. Google and MIT's study in PoPETs'25, covering 8,400 people, showed that gender, age, income level, and race can be statistically gleaned from browser attributes. Low-income users are the most exposed because their devices stand out more.

Does fingerprinting work after switching browsers? Yes. Cao et al. at NDSS 2017 proved that cross-browser fingerprinting ties sessions through hardware signals like WebGL, audio, and fonts. Swap from Chrome to Firefox and those signals don't shift.

How many signals does a single browser request yield? WHOX scans 300+ signals across 13 blocks: canvas, WebGL, WebGPU, audio, fonts, screen, behavior, network, and others. With just 13 standard attributes, as PoPETs'25 showed, 60.2% of users are already unique.

Who runs this digital census? Ad networks, SDKs, analytics platforms. Fingerprint.com handles 12 billion requests a month. ThumbmarkJS serves 60,000+ sites. FP-Tracer from PoPETs 2024 found fingerprinting on 30%+ of sites in the search category.

How can I shield myself from the digital census? Standardization through tools like Tor or Mullvad Browser works better than randomization through Brave or extensions. Core idea: blend into a crowd of matching fingerprints rather than throwing up a unique wall of noise.

---

Read Next

• $700 a Year: The Price Tag on Your Digital Shadow · How your data becomes someone else's revenue
• The Privacy Paradox · Why protection makes you more visible
• 300+ Signals: The Entropy Map · Which signals carry the most information
• FORESIGHT: Session Linking · How systems know you're back

---

WHOX - We tell real signals from manufactured ones. Check your fingerprint at whox.com and find out what signals leak from your browser and how unique you are.

Sources: PoPETs 2025, popets-2025-0038 | Fingerprint Year-in-Review 2024 | ICO response to Google | Knight First Amendment Institute 25-05, Silenced by Surveillance | Beyond the Crawl, ACM WWW'25, arXiv:2502.01608 | FP-Tracer, PoPETs 2024 | Iccl: The Great Data Heist | FTC vs Mobilewalla, Dec 2024 | Gravy Analytics breach, Wired Jan 2025 | EFF: RTB Fuels Surveillance, Jan 2025 | ACM WiSec 2025: WebGPU Fingerprinting | NDSS 2017: Cross-Browser Fingerprinting | WHOX