No name, no email, no permission prompt. Still, by the time a page loads, the site has a fair picture of your connection. Here is what it gets and why it matters.

Your IP address and its network

Every request carries the address the reply has to go back to. At home that is your router, on a phone your carrier, with a VPN or proxy the server you go out through.

The address tells a site more than a rough location. It tells it whose network you are on: a home provider, a mobile carrier, a company, or a data center. Ordinary people rarely browse from a data center, so that alone gets noticed. Some networks also publish their addresses openly, like Apple for iCloud Private Relay and the Tor Project for its exits, so those are recognised with certainty.

Your operating system

Each operating system builds the first packet of a connection in its own way. A site can read that and guess Windows, macOS, Linux or Android without asking the browser. If your browser says Windows but the packet looks like Linux, something in between, usually a proxy server, opened the connection for you.

Your browser

Before anything is encrypted, the browser announces which encryption options it supports. Chrome, Firefox and Safari each do it differently, and so do scripts and apps. A site can tell whether the browser is really the one its User-Agent claims to be. Tools that only copy Chrome’s User-Agent are easy to spot this way.

Your DNS server

Before connecting, your device asks a DNS server for the site’s address. A site can find out which server that was. On a VPN it should be the VPN’s or a public one. If it is still your home provider’s, that is a DNS leak: the site sees a resolver in your real country.

WebRTC

WebRTC is what browsers use for video calls. Any page can ask it which addresses it would use, without touching the camera or microphone. With a proxy set only in the browser, that answer often contains your real address. That is a WebRTC leak.

Time zone and language

Your device sets its time zone from where you are, and any page can read it. An address in Germany with a clock set to New York doesn’t prove anything, but it adds up with everything else. Language matters much less: plenty of people browse in a language that isn’t the local one.

Distance

A reply can’t travel faster than light in fibre, so how quickly you answer puts a limit on how far away you are. It can also show an extra hop: if reaching your browser takes noticeably longer than reaching the machine that opened the connection, there is probably a proxy in between.

It’s the combination that counts

None of this convicts anyone on its own. Plenty of honest people use VPNs, Linux or a laptop that just landed in another country. What sites look for is a story that doesn’t hold together: a Windows browser on a Linux connection, from a data center in one country, with a clock and a WebRTC address from another.

A well set-up VPN tells a consistent story and is still recognised by its address. How websites detect VPNs covers that side.