# Done everything, they still track me? **URL:** https://discuss.privacyguides.net/t/done-everything-they-still-track-me/38484 **Category:** Questions **Created:** 2026-06-11T20:35:18Z **Posts:** 36 ## Post 1 by @newjohn — 2026-06-11T20:35:18Z OK, maybe not EVERYTHING but I’m surfing the web on Fedora + Mullvad browser (standard settings, no custom blocklist) + non-Mullvad VPN with kill-switch. Problem: some popular sites (streaming, chat-bot etc) show me interface, login pop-up or google SSO, in my NATIVE (non-English) language like they can track me regardless of all my setup. I rarely use these sites but they keep me thinking. how can they do this? I just tested with Tor (standard settings) too, FIXED, showing sites in random languages (maybe its German, derived from Tor exit node). Is the VPN leaking my IP? I have checked some browser fingerprinting/IP/DNS/WebRTC sites, didn’t notice anything out of ordinary. What should i do? --- ## Post 2 by @FranklyFlawless — 2026-06-11T21:52:03Z > [@newjohn](#): > > how can they do this? Browser locales. --- ## Post 3 by @SwampTrainer — 2026-06-12T04:29:17Z If you’re able to stream with Mullvad, you don’t have the security level settings high enough to prevent browser fingerprinting. Go into settings and select a level of safer or safest. The lowest setting can still give up things like language, time zone set on your machine, fonts, etc. However, this will break many sites, including streaming sites, because it will prevent JS from loading. Which is fine, that’s how it’s supposed to work. But it’s also something you have to balance out in terms of how you want to use the internet vs. what level of privacy you need to maintain. You can either spend time right-clicking and allowing JS on some sites temporarily and only use one browser for everything. Or, alternatively, use another browser and another VPN location for anything you need to be logged in to see, and/or streaming sites alone. That creates one browser that’s the one that works on every site and gives up data, and then a safe space back in Mullvad. There’s a balance between security/privacy and convenience, and you need to find where you personally fall on that spectrum. --- ## Post 4 by @Revival873 — 2026-06-12T08:18:59Z I believe that is incorrect. This is the first time I have heard that claim about Mullvad Browser. The general consensus is that using Mullvad Browser at its default settings together with a VPN allows users to blend in with the crowd. --- ## Post 5 by @maqp — 2026-06-12T09:45:28Z > [@Revival873](#): > > The general consensus is that using Mullvad Browser at its default settings together with a VPN allows users to blend in with the crowd. So the thing is, Mullvad Browser is basically Tor browser, just without the Tor network. It has the same three-setting security slider that divides users into three buckets. I ran some tests in January this year and found that both Tor browser and Mullvad have identical amount of entropy leak in EFF’s panopticlick with each of the settings: ``` Standard: 7.93 bits of identifying information, one in 243.48 browsers has the same fingerprint. Safer: 9.47 bits of identifying information, one in 708.03 browsers has the same fingerprint. Safest: 7.74 bits of identifying information, one in 214.10 browsers has the same fingerprint. ``` The less bits there are, the more you blend in. So the safest leaks the least, probably because there’s so little features it could be used to to identify users. Disabled JS is the biggest reason for that. Standard is the least safe, but it leaks the second least, most likely because it’s the default: there’s more identifying information, but there’s also so many users running the standard setting with very similar hardware etc., that you blend into a bigger crowd of identical users. The mid option is least blending, most probably because if someone cares about the slider, they might care about setting it to max. But there will be reasonable amount of people who want the balanced amount of extra privacy. In some ways, it might be also adding real security against attack code. E.g., the mid setting prevents HTML 5 media from auto-playing which will protect against zero-click attacks through the media library. Some users want that but not JS blocking, and some probably go with the “golden middle way” thinking that, that way, they won’t be in the low-hanging fruit category. --- ## Post 6 by @SwampTrainer — 2026-06-12T11:20:57Z I would love to be wrong about this. However, that claim falls in contrast to [fingerprint.com](http://fingerprint.com) profiling me as a repeat visitor regardless of switching IP addresses, while using the “standard” security profile. Based on the “blending in” idea, either I should pop up as having visited 5 times from this visit, at 5 IP addresses (only 3 repeat visits pinged as repeats, 2 others didn’t) - or even far more, 20, 30 40 visits. Which is what I have seen when testing Tor when JSCreep still worked: first time was my 80th visit. ![image](https://forum-uploads.privacyguidesusercontent.com/original/3X/5/7/57ce7e57e144f1a0dafdda05255c1644cd9ca53d.png) ![image](https://forum-uploads.privacyguidesusercontent.com/original/3X/4/9/492eb9d0d48a765c1a7f5b1b8be549b3517329a2.png) Which is fine, because if I wait 20 minutes and try it again with a new VPN location, I’ll start over at 1 visit usually. I know that Mullvad is based on Tor, but there seems to be enough of a difference that regular, no-changes Mullvad can be profiled enough. It looks like if I change around, it pins me as 2 different users, I think based on a factor of trustworthiness of my IP/VPN location. ![image](https://forum-uploads.privacyguidesusercontent.com/original/3X/1/d/1d591342e2669ce3b0b7f9b754dc69528be6a286.png) But that means that anyone on Mullvad on any Linux distro should be able to go to [fingerprint.com](http://fingerprint.com) right now and ping for either of these hashes. And I doubt that will be the case since I’m always starting at 1, and AFAIK this is a common place to check. The “blending in” part doesn’t apply to your OS, so you’re only “blending in” within the category of your OS. Which is fine, but if you’re super concerned about blending in, you would then want to run chrome in a Windows VM. --- ## Post 7 by @anon67953901 — 2026-06-12T11:50:18Z Are you closing the app or pressing the new identity button? I recently learned that the new identity button does more than closing and reopening. I think they should function the same. Now I’m curious if it’s the same with the Tor browser, maybe this should be mentioned in the privacyguides. --- ## Post 8 by @anon92447704 — 2026-06-12T12:31:34Z where can i see those locales? sites like [browserleaks](https://browserleaks.com/javascript) or pages like about:support in browser? about:config? i haven’t changed anything in browser settings and my fedora is installed as en-US language, i just changed the time zone (no NTP) which i thought is not a big deal since both browser reset it to UTC inside the browser. i do NOT even have my languages keyboard layout select in settings. I kept testing around and my results just got switched, now Tor browser shows ads for my native language, but Mullvad browser(with ublock disabled show foreign language ads, i had to disabled ublock to see sites reaction) Isn’t Tor and Mullvad basically the same thing? how can their fingerprint be different enough to leak my info like this? (both browser are set to “standard” settings because Tuta mail doesn’t work for anything higher I’m the same newjohn by the way, lost the account --- ## Post 9 by @SwampTrainer — 2026-06-12T15:08:31Z Excellent question. I’m fully closing the browser and giving it about a minute or two before changing VPN locations and going to a bookmark of the site. For [fingerprint.com](http://fingerprint.com) in particular, it looks like their “suspect score” includes the IP as part of some reputation data, which I think jukes the stats a bit. I would be curious to see how it performs without adding that in - I do wish that someone would recreate JSCreep as it used to be with the API, it was truly amazing. @anon92447704 For higher settings, if a site breaks, right click anywhere on blank space and you’ll see at the bottom of the menu a NoScript option. Click that and temporarily approve parts of the site. For Tuta, I’m sure it’s just them. That way even for sites that break, you can turn on the parts of JS that you want and leave the trackers turned off. Keep in mind those are typically temporary approvals. You can over-ride them and make it permanent, but it’s not recommended. --- ## Post 10 by @anon92447704 — 2026-06-12T15:26:42Z Thanks for all of your comments, To emphasize my point let me give you an example. On Tor browser with standard settings i go [Claude](https://claude.com) i see an Google SSO in Dutch (exit nod was Nederlands), i click on Tor circuit icon to get a new circuit (this time exit node is USA) now Google SSO is changed to my native(non English, non Spanish) language. on next try show my language even for Dutch IP. On 22.do (temp mail) it shows ads in my native language(not in Mullvad because of ublock), some global streaming sites even as go far to suggest me tags and trends in my language. ( i haven’t created any account on these sites yet). On Mullvad safer settings, Claude doesn’t even work gives me this output "Claude will return soon Claude is currently experiencing a temporary service disruption. We’re [working on it](https://status.anthropic.com/), please check back soon." Which is unusable plus not the point, i want to know what info I’m leaking , is there anything in fedora should i check?? --- ## Post 11 by @any1 — 2026-06-12T17:03:27Z > [@SwampTrainer](#): > > I know that Mullvad is based on Tor Base Browser + Mullvad specific changes → Mullvad Browser Base Browser + Tor specific changes → Tor Browser Mullvad Browser isn’t based on Tor Browser, they instead share the same foundation. --- ## Post 12 by @pvreq — 2026-06-12T18:55:17Z > [@SwampTrainer](#): > > I would love to be wrong about this. However, that claim falls in contrast to [fingerprint.com](http://fingerprint.com) profiling me as a repeat visitor regardless of switching IP addresses, while using the “standard” security profile. Did you do the test on [https://fingerprint.com/demo/](https://fingerprint.com/demo/) ? A couple days ago, I had following procedure: Switch to VPN location A → Visit → Press new identity browser button → Switch to VPN location B → Visit . Both visits showed different identifiers on standard security level. --- ## Post 13 by @eteszi — 2026-06-12T19:31:06Z Go to [CreepJS](https://abrahamjuliot.github.io/creepjs/) and check out any non en-US parameters. --- ## Post 14 by @SwampTrainer — 2026-06-13T07:17:39Z Not the /demo URL, but the [fingerprint.com](http://fingerprint.com) front page gives the same data in a bit more depth. Which, right now, it’s showing 3 visits from me over the last 24 hours, including right now. That includes a hash that is NOT one of the ones above, and 2 visits clustered from when I was hitting the site a few times. Oddly, it said 4 visits a minute ago, and dropped a visit with, I assume, a low confidence score. FWIW, I still have security settings at “standard” and not “safer.” I didn’t screenshot a first couple of visits yesterday, so this tracks with my visits, and only my visits. I didn’t copy/paste the CreepJS hashes yesterday, but with that one once they got rid of the API, you can only know if you alone get the same hash. I don’t know if the “blend in” method works unless we all are getting the same hash. So anyone on linux using Mullvad browser going to CreepJS, if you get a hash ending in ec0a then we’re all looking the same. --- ## Post 15 by @SwampTrainer — 2026-06-13T07:28:37Z OK, tried your “change identity” method, changed VPN location, closed and re-opened the browser. Now I’m pinging the third screenshot above, hash ending in uriA From the /demo link. Showing 2 visits from same time as posting that comment above. ![image](https://forum-uploads.privacyguidesusercontent.com/original/3X/d/1/d1efb064125b7b91577b2081e085be5f96007acd.png) CreepJS hash is the same, ending in ec0a. I get a different hash on CreepJS using LibreWolf on the same IP. So confirming I’m not pasting the wrong thing. Just the FP ID from the top of the page. But, it looks like the [Fingerprint.com](http://Fingerprint.com) hash always includes something about the IP. My visits tracked under the hash above all are when the VPN was based in the US, and likely shows a connection to the same company’s VPN network. Best as I can tell, the first hashes are correlated to double-hop routing and IPs showing a different VPN exit node company. As it’s just a demo, between the two of these, to me, it seems that if [Fingerprint.com](http://Fingerprint.com) just dropped the IP part, or ignored it, they would have everyone of my visits on Mullvad pinned to me if I’m letting JS run. I dunno y’all - am I missing something here? This seems like Mullvad does well at hiding fingerprint data, but leaves enough to still work one out that I’m still leaving a fingerprint. Unless someone else gets the same CreepJS fingerprint as me, I’m unsure where exactly Mullvad excels here vs. LibreWolf or even Brave. FWIW, this is why I use 7 different browsers. --- ## Post 16 by @anon67953901 — 2026-06-13T08:11:24Z Try using the automatic random mode on the Mullvad extension it should be more convenient than manually changing servers. --- ## Post 17 by @maqp — 2026-06-13T08:54:59Z > Developed together with Tor > > Mullvad Browser is developed together with the Tor Project. You could say that Mullvad Browser is a Tor Browser without the Tor Network. Instead you can use the Mullvad Browser with (or without) a VPN. > **[Free the internet with Mullvad Browser](https://mullvad.net/en/browser)** > > The Mullvad Browser is a privacy-focused web browser developed in collaboration between Mullvad VPN and the Tor Project. It’s produced to minimize tracking and fingerprinting. --- ## Post 18 by @anon92447704 — 2026-06-13T10:21:24Z Only thing “non en-US” is **Timezone** Atlantic/Reykjavik (which is the default not my location), i still don’t know why i see relevant ads and interfaces --- ## Post 19 by @eteszi — 2026-06-13T11:07:18Z Are you sure there’s no IP leak? > **[dnscheck.tools - check your dns resolvers](https://dnscheck.tools/)** > > A tool to test for DNS leaks, DNSSEC validation, and more --- ## Post 20 by @Encounter5729 — 2026-06-13T11:43:50Z In tests, I would always try to pause 15-30 min between tries. This should give a more accurate indication. But the issue with fingerprinting sites, is that it’s not realistic. It could just give the same ID for every user in a country, and you would have the impression that you are super tracked. Maybe we could do sessions where we exchange messages and connect to the same VPN and see if we get the same id? This would show whether it’s realistic. Also, it doesn’t matter too much if they don’t know who you are. Like I have cookies enabled on YouTube, so they know what I like to watch, but that doesn’t bother me, it’s not linked to my real identity. At the end of the day, I think that as long as you have KYCed account (consider any account where you shared enough precise info about yourself to be able to determjne your ID) that you connect to (same IP as the rest), it is technically possible to determine your browsing history. But this would require coordination between many actors that put a lot of effort to analyze their IP logs and so on. Likely only a threat if you are under investigation by a robust LE. * * * If you want to reduce the above risk, you would likely need to use containers with a Proxy, but I really wish we could use containers with a VPN\*. /\* Is it still accurate that proxys are unencrypted between your exit and the proxy exit? --- ## Post 21 by @anonymous630 — 2026-06-13T13:50:08Z I wonder if these visitor IDs we’re screenshotting and throwing around is sensitive information. --- ## Post 22 by @anonymous630 — 2026-06-13T13:51:06Z I hate being reminded of the creepy fingerprinting we are subjected to every single day by our fellow humans. I wonder if they hate themselves for it or just don’t care. Prob the latter. ;/ --- ## Post 23 by @SwampTrainer — 2026-06-13T16:17:42Z lol, no. They’re hashes of a collection of data so that a collection of bits of data can be expressed as a single, cross-refeerence-able text string. Hashes go one way only. You could post here the hash of your name, DOB, and all the PII you can think of and no one could reconstruct it from the hash alone. @Encounter5729 It’s easy to test fingerprinting sites by using different browsers. Each should give you a different hash for a different browser, even if on the same IP. Meaning that a fingerprint hash is not just “everyone in a country” or everyone at a single IP, but at the very least, tied to data from an individual’s browser. The question is more so would everyone on the same OS (which cna’t be successfully spoofed) using Mullvad or Tor get the same hash. I know that on Tor, that does happen, and have tested it so confirm it. --- ## Post 24 by @any1 — 2026-06-13T16:26:24Z [https://gitlab.torproject.org/tpo/applications/wiki/-/wikis/Development-Information/Tor-Browser/Tor-Browser-Repository-Overview#base-browser](https://gitlab.torproject.org/tpo/applications/wiki/-/wikis/Development-Information/Tor-Browser/Tor-Browser-Repository-Overview#base-browser) > Some commits in the `tor-browser-` branch are considered “Base Browser” commits, which have the “BB” prefix. These commits are shared by both Tor Browser and [Mullvad Browser](https://gitlab.torproject.org/tpo/applications/mullvad-browser). They contain changes to Firefox that are needed for both browsers, excluding any changes specific to Tor Browser, such as features related to the use of the Tor network. > > When we perform a Firefox rebase, we create the final `tor-browser-` branch with all the Base Browser commits placed prior to any Tor Browser specific commits. The final such Base Browser commit is marked with a corresponding `base-browser-*-build1` tag. This tag marks the common base that the corresponding `mullvad-browser-` branch will then use. > > After this initial branch creation, any new commits targeting either Base Browser or just Tor Browser will both land on the same `tor-browser-` branch, and will therefore become mixed together. They will be separated out again at the next rebase. Any Base Browser commit should also be picked onto the corresponding `mullvad-browser-` branch. --- ## Post 25 by @maqp — 2026-06-13T17:23:52Z Mozilla produces Firefox. Tor Project has a fork of Firefox with strong fingerprinting guards it calls Base Browser. Tor Project publishes Tor Browser that attaches Base Browser Tor branding, and the `tor` client that can automatically connect to the Tor network to mask IP. Mullvad publishes Mullvad Browser that attaches Tor Project’s Base Browser the Mullvad Browser extension and branding, but if no VPN is used, it won’t mask IP. Mullvad Browser inherits the fingerprinting protections of Base Browser developed by Tor Project? So is this just nit picking about the inheritance terminology (“Mullvad Browser is based on Base Browser by Tor Project, not Tor Browser by Tor Project”) or did I miss something? --- ## Post 26 by @anon92447704 — 2026-06-13T19:38:53Z > [@eteszi](#): > > Are you sure there’s no IP leak? NO. i am not sure. i actually asked the same question on my original post. BUT 1. i am using Windscribe (not recommended in this site but it just has unparalleled censorship circumvention capabilities + Linux support) with “always on+” firewall mode. 2. i even tested with VPN+Tor, still the same result, Tor (without bridges) is blocked in my area, so i kinda acts as a kill switch 3. some of those target sites are even blocked in my area too, adding an other layer blockage which kinda makes me rule out IP leak, but i can’t be sure edit: keep in mind according to [Windscribe wiki](https://github.com/Windscribe/Desktop-App/wiki/Known-Issues#firewall-conflicts) : > The Windscribe firewall uses OS-provided frameworks (WFP on Windows, PF on macOS, nftables on Linux) to block undesirable traffic and prevent leaks. If you have other programs with administrative privileges which may override Windscribe’s rules, you may cause leaks to occur. For example, installing docker on Linux will enable rules which allow container traffic to bypass the firewall. > > Some applications will aggressively reinstate its rules if modified, and we don’t want to get into a loop where we are trying to assert our rules while another app asserts theirs. As such, before reporting a leak, please ensure that you have disabled any applications in your environment which may touch the firewall. I don’t have Docker, but Fedora has Podman installed by default which i have never ever touched. only network related apps that i have installed are Wireshark, Opensntich, ProtonVPN(no kill switch activated, i never run 2 VPNs on same boot), Windscribe, i don’t like tinkering OS, so its pretty untouched --- ## Post 27 by @anon92447704 — 2026-06-13T20:35:08Z > [@Encounter5729](#): > > Maybe we could do sessions where we exchange messages and connect to the same VPN and see if we get the same id? Awesome, i would very much love that. > [@Encounter5729](#): > > Also, it doesn’t matter too much if they don’t know who you are It’s not about corporate tracking. some sites might lead into legal issues. i exit every site that “hint” at knowing me when I don’t even have account. i don’t even bother to memorize their URL > [@Encounter5729](#): > > consider any account where you shared enough precise info about yourself some sites did this literately the first time i visited them, keeping me completely baffled as “what am doing wrong here?” > [@Encounter5729](#): > > /\* Is it still accurate that proxys are unencrypted between your exit and the proxy exit? some proxies (for better usability, reduced network throughput, firewall bypass ) , still allow insecure unencrypted traffic. > [@Encounter5729](#): > > containers with a Proxy don’t wanna try Docker as it might interfere with Windscribe firewall but I’m gonna test my results in VM plus with different VPNs after my tests are done, hopefully i get a better picture of whats happeing --- ## Post 28 by @wonder84 — 2026-06-14T23:11:00Z Also, would be interesting to try using SPB (start private browser) to see if between two instances you are tracked using mullvad? --- ## Post 29 by @wonder84 — 2026-06-14T23:11:05Z Which mode are you using in Mallvad Browser? I think JavaScript is blocked on ‘Safest’ ![mullvad-security-level](https://forum-uploads.privacyguidesusercontent.com/original/3X/1/2/12aec7062ea037e17ec3a754af855c9399221359.png) --- ## Post 30 by @anon67953901 — 2026-06-14T23:45:05Z With Mullvad Browser I’m able to get new IDs instantly with the randomize mode and new identity button. I generally don’t have to wait. Very occasionally it will match sessions up and I can wait 30 seconds and it’ll be tricked again. I just tested Donut Browser and it is effective as well and the browser isn’t detected as suspicious which is a big plus. Mullvad is detected as incognito (intended) and virtual machine. Donut is detected as only VPN, so it is considered not suspicious. Edit: Many places will consider it suspicious solely based on IP score, but specifically [fingerprint.com](http://fingerprint.com)’s score doesn’t if VPN is the only “bad” metric. --- ## Post 31 by @anon92447704 — 2026-06-15T09:08:22Z how is new instance gonna help if previous one is already allegedly leaking something? --- ## Post 32 by @anon92447704 — 2026-06-15T09:10:14Z perhaps you have skipped the thread while reading, 1. the site breaks with no JS 2. i want to know **how** and **why** and **what** am i leaking (if any), not to just disable the JS(with safest mode instead of current standard) and pretend nothing is wrong with my setup --- ## Post 33 by @Encounter5729 — 2026-06-15T19:11:51Z > [@anon92447704](#): > > Awesome, i would very much love that. Remind me in about a week when I will have more spare time. > [@anon92447704](#): > > don’t wanna try Docker as it might interfere with Windscribe firewall but I’m gonna test my results in VM plus with different VPNs after my tests are done, hopefully i get a better picture of whats happein I meant browser proxy, like in Firefox and soon(-ish) in Brave --- ## Post 34 by @anon92447704 — 2026-06-16T17:51:27Z > [@Encounter5729](#): > > Remind me Thanks. --- ## Post 35 by @anon92447704 — 2026-06-16T17:52:14Z I don’t know. Mullvad and my VPN aside, in Tor while browsing [perplexity](https://www.perplexity.ai/) with German exit node, i get German Google SSO login prompt (not my language). by getting a new Tor circuit(on the same tab, no restart), Google SSO language is changed, even though the Tor exit node (for example Sweden) has nothing to do with my language or my PC locale. i don’t know what conclusion to draw out of this! but it remaind me of Youtube RSS feed returing 4xx errors on Newsboat with VPN, while visiting [youtube.com](http://youtube.com) afterwards (in browser) kinda whitelists my VPN IP all of the sudden (I’m not passing any cookies etc. to Newsboat) and Newsboat works again, like google has correlated IP history to a bot and removes this association after seeing the same IP from a legitimate user( me) from browser. i keep changing the exit node in Tor browser and seeing different languages. suspecting that maybe i don’t have any leak but sites (google etc) are creating a history of IP → user and passing into on to other users with same IP. Is it possible that these ads/popups/ are correlated to my language just because somebody used those VPN/Tor IPs from my country (language) before me, and it has no relationship to Browser fingerprint, its just IP history? maybe you can visit the same site with the same Tor exit node and see the same results? by the way, do people get notified here if i don’t @ them? --- ## Post 36 by @FranklyFlawless — 2026-06-16T20:14:30Z Every user can choose how they are notified in the topic, regardless of mentions.