What information do websites get when you visit them starts before you’ve clicked anything. In the first few milliseconds of a page loading, your browser has already handed over your IP address, screen resolution, timezone, installed fonts, GPU model, and even your device’s battery level. Most explanations stop at “cookies and IP address.” The real list is longer, and the timing matters as much as the content.
The Short Answer: A Lot, in the First Millisecond
What Loads Before You Click Anything
The moment a page begins loading, your browser automatically shares a batch of technical data with the server, without asking you and without any form involved:
- IP address, which reveals your approximate location and ISP
- User agent string, a text label identifying your browser, operating system, and device type
- Screen resolution and color depth
- Timezone and system language
- Installed fonts
- GPU or graphics processor model
- Battery level, on devices and browsers that expose it
None of this requires a login, a cookie, or a form submission. It’s volunteered automatically as part of how browsers and servers communicate.
What Loads a Moment Later
Right after that first exchange, the referrer URL arrives, showing which page sent you here, whether that’s a search engine, a social media link, or another site entirely. As the page continues loading, the site can log pages visited within your session, time spent on each page, click patterns, and scroll depth, the distance you scroll down a page before leaving.
The Complete Data Collection List
Identity Data
This is data tied to who you are specifically: form submissions, email addresses, login credentials, and account details you provide directly. Identity data is the one category that requires you to actively type or submit something.
Device Data
Device data includes the user agent string, screen resolution, GPU, installed fonts, operating system, and battery level. Individually, none of these identify you. Combined, they start to.
Behavioral Data
Behavioral data covers clickstream data, the sequence of pages and links you interact with, along with time on page, scroll depth, and search terms typed into a site’s own search bar.
Location Data
Geolocation, derived from your IP address, typically identifies your city or region, not your exact address, unless you’ve separately granted a site permission to access precise GPS location through your device.
Inferred Data
Inferred data is the category top results skip entirely. Sites don’t always need you to state your name or interests directly. Email address patterns, social media login connections, and purchase history all let a site or a data broker estimate demographic details you never typed in.
The Passive vs Active Footprint
Your active footprint is what you consciously give: a form you filled out, a review you posted, an account you created. Your passive footprint is what gets taken without a direct action: fingerprinting data, clickstream logs, and behavioral analytics collected simply because you loaded the page. Most people only think about the active footprint. The passive one is larger and runs continuously in the background.
Can Websites Identify You Without Logging In
Can websites see my personal information even when you’ve never created an account or logged in is where device fingerprinting matters. Browser fingerprinting combines dozens of individually harmless data points, screen resolution, timezone, installed fonts, GPU, language settings, into a combination specific enough to function as a unique identifier. This identifier can track you across separate visits and even across different sites, without relying on cookies at all.
If You Use a VPN, What Still Shows
A VPN hides your IP address and general location, but it does nothing to your browser fingerprint. Your timezone, screen resolution, installed fonts, and language settings still transmit exactly the same way, which means a VPN alone does not stop fingerprint-based tracking.
How Do Websites Track Visitors Over Time
How do websites track visitors across repeat visits relies on a mix of tools working together:
- Cookies, small files stored by your browser. First-party cookies are set by the site you’re on; third-party cookies are set by an outside advertiser and used to follow you across multiple sites.
- Tracking pixels, also called web beacons, which are invisible 1×1 pixel images embedded in a page or email that quietly report back when the page loads or the email is opened.
- Fingerprint matching, which re-identifies you on return visits even if cookies have been cleared.
What Websites Cannot See
The Boundaries That Actually Hold
A few reassurances are worth stating plainly, since fear here often outpaces reality:
- Websites cannot see your screen or take screenshots of your device
- They cannot read keystrokes unless you actually submit a form field
- They cannot see other open tabs in your browser, since browsers isolate tabs for security
- They cannot access your saved passwords, which are stored locally and encrypted
- They cannot read files stored elsewhere on your device
Where HTTP Changes the Picture
HTTPS encryption protects the content of what you submit to a site, meaning passwords and form data stay unreadable to anyone intercepting the connection. On an HTTP site, the older unencrypted protocol, that protection disappears. Form data, passwords, and full URLs become visible in plain text to anyone positioned on the same network. This is a separate risk from what the website itself collects. It’s about who else can see the same data in transit.
The Data Broker Ecosystem: Where Your Data Goes
A data broker is a company that buys, aggregates, and resells consumer data, often without the person ever interacting with that broker directly. Browsing data collected by one site can be packaged with data from dozens of other sources, purchase records, public records, app usage, then sold onward to advertisers, insurers, or other companies building profiles for targeted advertising, ad delivery aimed at your inferred interests rather than shown at random. Most people never see this transaction happen. It occurs entirely between companies, using data collected during ordinary browsing.
For how these same tracking mechanics interact with cookie consent laws, see why do websites ask you to accept cookies in every country. And for what your own network can see beyond what a site collects, see can someone see what you’re doing on their wifi.
How to Limit What Websites Collect
Browser-Level Options
Browser extensions like uBlock Origin and Privacy Badger block many tracking scripts and third-party requests before they load. Firefox’s Enhanced Tracking Protection blocks known trackers automatically without requiring an extension, and most major browsers now let you disable third-party cookies directly in settings.
Network-Level Options
A VPN encrypts your traffic and hides your IP address from the sites you visit, though as covered above, it doesn’t touch fingerprinting. Incognito or private browsing mode clears local cookies and history after your session, but it does nothing to stop fingerprinting or server-side data collection during the session itself, since that data leaves your device regardless of browser mode.
FAQs
Can a website see my saved passwords?
No. Saved passwords are stored locally on your device in encrypted form, and websites cannot access that storage directly.
Can a website see what I type before I hit submit?
Only if the site has deliberately built tracking code to capture keystrokes as you type, which reputable sites do not do. Normally, a site only receives what you actually submit.
Can a website see my other open tabs?
No. Browsers isolate each tab for security, and a site has no visibility into what else is open in your browser.
Do websites know my real name if I never provide it?
Not directly, but they can sometimes infer it or related demographic details through email address patterns, connected social logins, or data purchased from data brokers.
