The fix, in one snippet
1. Type about:config in the address bar and press Enter
2. Accept "Accept the Risk and Continue"
3. Search for: Privacy.resistFingerprinting
4. Click the toggle so the value reads true
This also standardises your timezone, screen size and fonts, so some
sites will look slightly different. Brave and Tor Browser do the
equivalent by default.Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
The scan draws a small scene into an off-screen <canvas>: text in a specific font, an emoji, overlapping arcs with alpha blending and a gradient. It calls toDataURL() and hashes the result, then repeats the drawing. If the two hashes differ, the browser is adding noise (Brave, and Firefox with fingerprinting protection) and the check passes. If toDataURL() throws, prompts or returns a blank image (Firefox with privacy.resistFingerprinting, Tor Browser), it also passes. If the hash is stable and readable, we report how common that hash is among previous visitors.
Limits: a stable canvas hash is the normal state for most browsers and is only one component of a fingerprint. Many people with the same GPU, driver, operating system and browser build produce the same hash, so "exposed" does not mean "unique". That is why the default severity is low.
Why it matters
Canvas fingerprinting, described by Mowery and Shacham in 2012, works because the same drawing commands produce subtly different pixels depending on the GPU, driver, font rasteriser and anti-aliasing settings. The result is high-entropy, stable across sessions and private windows, and invisible to the user. Acar and colleagues' 2014 study "The Web Never Forgets" found canvas fingerprinting scripts on 5.5% of the top 100,000 sites, mostly through a handful of advertising and analytics providers.
The realistic scenario is an advert or analytics frame that computes the hash on many sites and joins your visits; the moment you log in anywhere that shares the same provider, the profile gets a name.
How to fix it
Firefox: Settings > Privacy & Security > Enhanced Tracking Protection > Custom, tick "Suspected fingerprinters"; or set privacy.resistFingerprinting to true in about:config, which prompts before a script can read canvas data. Brave: Shields randomise canvas output by default. Safari: enable Advanced Tracking and Fingerprinting Protection for all browsing under Settings > Advanced. Chrome and Edge: there is no built-in canvas defence; rely on a blocker for known fingerprinting scripts rather than a noise-injecting extension, because injected noise is itself detectable. Tor Browser asks permission before any canvas read.
Do not disable canvas entirely: maps, charts and games depend on it. See the combined result in fingerprint uniqueness and the background in browser fingerprinting explained and how online tracking works.
Where this fits
Canvas fingerprinting exposure is check 9 of 16 that the browser security & privacy check runs under browser privacy and policy enforcement, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Browser defaults cookies to SameSite=Lax (low), where your browser sent a cookie that has no SameSite attribute on a cross-site request, so it does not apply the Lax default that limits cross-site request forgery. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Canvas fingerprinting exposure closes one route in. Immediately below it: Full referrer sent cross-site, where when you follow a link to another site, your browser sends the full address of the page you came from, including its path and query string; Global Privacy Control signal, where your browser is not sending the Global Privacy Control signal, so sites that are legally required to honour opt-outs will not receive yours automatically; WebGL renderer exposure, where scripts can read your graphics card model and driver details through WebGL, a strong and long-lived identifying signal.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Canvas fingerprinting exposure (low severity)
Scanner check id: canvas-fingerprint
What this check tests: Your browser renders a hidden test image identically every time and lets scripts read the pixels back, so the result can serve as a stable tracking signal.The rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
References
Related guides
7 min read · Updated Sep 02, 2026
Browser Fingerprinting Explained: How Sites Identify You Without Cookies
Browser fingerprinting combines dozens of small facts about your browser and device into an identifier that survives cookie deletion and...
Read the guide
8 min read · Updated Sep 02, 2026
How Online Tracking Works: Cookies, Pixels, Fingerprints and Data Brokers
Tracking is the business of linking your visits across sites into a profile. Each technique from third-party cookies to fingerprinting...
Read the guide