why a click can be tracked · learn lab
A web request is like posting a letter: it must carry a return address so the reply can come back. That return address is your IP. You can't omit it — nothing would load. This is the one identifier that is unavoidable (a VPN doesn't remove it, it just replaces yours with the VPN's).
Before any encryption, your browser sends a "hello" listing which ciphers and extensions it supports, in a specific order. That exact shape is a fingerprint of your software (called JA3) — it reveals whether a real Chrome connected, or a script pretending to be one. Bots get caught here.
With the request, the browser automatically attaches info to be helpful: what browser/OS it is (User-Agent), your preferred languages (Accept-Language → hints your country/native tongue), and which page you came from (Referer). You never chose to send these — the browser does it every time.
Here's the key part: you didn't send your city. The server takes your IP and looks it up in databases — a geo-IP DB (→ country/city/coords) and an ASN DB (→ which ISP or hosting/VPN company owns that IP). If the owner is a VPN/cloud brand, a defender instantly knows you're hiding.
Once the page loads, its JS asks the browser standard questions any site may ask — no permission popup: screen size, timezone, CPU cores, GPU model. Then it draws a hidden image on a canvas: your exact GPU + drivers + fonts render it with tiny pixel differences → a stable hash unique to your machine. Combined, these form a device fingerprint that follows you even after you change IP or open incognito.
resistFingerprinting. They spoof/block canvas + WebGL + normalize screen/timezone so millions look identical.