{
 "name": "Browser privacy defaults",
 "description": "WebRTC, DNS over HTTPS, fingerprinting, third-party cookie and GPC defaults of seven browsers, with sources.",
 "license": "https://creativecommons.org/licenses/by/4.0/",
 "rights": "MyIPScan's work under CC BY 4.0; quoted text belongs to its source.",
 "attribution": "MyIPScan (https://myipscan.net/tools/privacy-diagnostics/browser-defaults/); quoted evidence belongs to its source",
 "page": "https://myipscan.net/tools/privacy-diagnostics/browser-defaults/",
 "url": "https://myipscan.net/tools/privacy-diagnostics/browser-defaults.json",
 "dateModified": "2026-10-21",
 "records": 42,
 "data": {
  "checked": "2026-10-21",
  "features": [
   {
    "key": "webrtc_local_ip",
    "label": "Hides your local IP from WebRTC"
   },
   {
    "key": "webrtc_public_ip",
    "label": "Public IP visible to WebRTC"
   },
   {
    "key": "dns_over_https_default",
    "label": "DNS over HTTPS by default"
   },
   {
    "key": "fingerprinting_protection",
    "label": "Fingerprinting protection"
   },
   {
    "key": "third_party_cookies",
    "label": "Blocks third-party cookies"
   },
   {
    "key": "global_privacy_control",
    "label": "Sends Global Privacy Control"
   }
  ],
  "browsers": [
   {
    "key": "chrome",
    "name": "Chrome",
    "cells": {
     "webrtc_local_ip": {
      "text": "Yes (mDNS name)",
      "verdict": "good",
      "fact": "b00"
     },
     "webrtc_public_ip": {
      "text": "Yes, via STUN",
      "verdict": "bad",
      "fact": "b01"
     },
     "dns_over_https_default": {
      "text": "Automatic, falls back to plain DNS",
      "verdict": "mixed",
      "fact": "b02"
     },
     "fingerprinting_protection": {
      "text": "No; the Incognito script blocking was never launched",
      "verdict": "bad",
      "fact": "b42"
     },
     "third_party_cookies": {
      "text": "No; yes in Incognito",
      "verdict": "bad",
      "fact": "b04"
     },
     "global_privacy_control": {
      "text": "No",
      "verdict": "bad",
      "fact": "b05"
     }
    }
   },
   {
    "key": "firefox",
    "name": "Firefox",
    "cells": {
     "webrtc_local_ip": {
      "text": "Yes (mDNS name)",
      "verdict": "good",
      "fact": "b06"
     },
     "webrtc_public_ip": {
      "text": "Yes, via STUN",
      "verdict": "bad",
      "fact": "b07"
     },
     "dns_over_https_default": {
      "text": "Only in rollout countries, such as the US and Canada",
      "verdict": "mixed",
      "fact": "b08",
      "fact2": "b46"
     },
     "fingerprinting_protection": {
      "text": "Partial: known scripts blocked, some APIs limited",
      "verdict": "mixed",
      "fact": "b09",
      "fact2": "b45"
     },
     "third_party_cookies": {
      "text": "Partitioned per site, not blocked",
      "verdict": "mixed",
      "fact": "b10"
     },
     "global_privacy_control": {
      "text": "Private windows only",
      "verdict": "mixed",
      "fact": "b11"
     }
    }
   },
   {
    "key": "safari",
    "name": "Safari",
    "cells": {
     "webrtc_local_ip": {
      "text": "Yes, until camera or mic is allowed",
      "verdict": "good",
      "fact": "b12"
     },
     "webrtc_public_ip": {
      "text": "Yes, via STUN",
      "verdict": "bad",
      "fact": "b13"
     },
     "dns_over_https_default": {
      "text": "Not a Safari setting: system DNS",
      "verdict": "neutral",
      "fact": "b14"
     },
     "fingerprinting_protection": {
      "text": "Partial: known scripts (Safari 26)",
      "verdict": "mixed",
      "fact": "b15"
     },
     "third_party_cookies": {
      "text": "Yes, except opt-in partitioned (CHIPS) cookies",
      "verdict": "good",
      "fact": "b16",
      "fact2": "b44"
     },
     "global_privacy_control": {
      "text": "No",
      "verdict": "bad",
      "fact": "b17"
     }
    }
   },
   {
    "key": "edge",
    "name": "Microsoft Edge",
    "cells": {
     "webrtc_local_ip": {
      "text": "Yes (mDNS name); docs conflict",
      "verdict": "mixed",
      "fact": "b18"
     },
     "webrtc_public_ip": {
      "text": "Yes, via STUN",
      "verdict": "bad",
      "fact": "b19"
     },
     "dns_over_https_default": {
      "text": "Automatic on personal devices",
      "verdict": "mixed",
      "fact": "b20"
     },
     "fingerprinting_protection": {
      "text": "Partial: listed trackers",
      "verdict": "mixed",
      "fact": "b21"
     },
     "third_party_cookies": {
      "text": "No; yes in InPrivate",
      "verdict": "bad",
      "fact": "b22"
     },
     "global_privacy_control": {
      "text": "No",
      "verdict": "bad",
      "fact": "b23"
     }
    }
   },
   {
    "key": "brave",
    "name": "Brave",
    "cells": {
     "webrtc_local_ip": {
      "text": "Yes (mDNS name, Chromium default)",
      "verdict": "good",
      "fact": "b43"
     },
     "webrtc_public_ip": {
      "text": "Not documented for current versions",
      "verdict": "unknown",
      "fact": "b25"
     },
     "dns_over_https_default": {
      "text": "Not documented (Chromium base: automatic)",
      "verdict": "unknown",
      "fact": "b26"
     },
     "fingerprinting_protection": {
      "text": "Yes, randomised",
      "verdict": "good",
      "fact": "b27"
     },
     "third_party_cookies": {
      "text": "Yes",
      "verdict": "good",
      "fact": "b28"
     },
     "global_privacy_control": {
      "text": "Yes",
      "verdict": "good",
      "fact": "b29"
     }
    }
   },
   {
    "key": "tor",
    "name": "Tor Browser",
    "cells": {
     "webrtc_local_ip": {
      "text": "WebRTC off",
      "verdict": "good",
      "fact": "b30"
     },
     "webrtc_public_ip": {
      "text": "No, WebRTC off",
      "verdict": "good",
      "fact": "b31"
     },
     "dns_over_https_default": {
      "text": "No: names resolve through Tor",
      "verdict": "neutral",
      "fact": "b32"
     },
     "fingerprinting_protection": {
      "text": "Yes, strongest of the seven",
      "verdict": "good",
      "fact": "b33"
     },
     "third_party_cookies": {
      "text": "Yes, plus first-party isolation",
      "verdict": "good",
      "fact": "b34"
     },
     "global_privacy_control": {
      "text": "Yes",
      "verdict": "good",
      "fact": "b35"
     }
    }
   },
   {
    "key": "mullvad",
    "name": "Mullvad Browser",
    "cells": {
     "webrtc_local_ip": {
      "text": "Yes (host candidates removed)",
      "verdict": "good",
      "fact": "b36"
     },
     "webrtc_public_ip": {
      "text": "No: TURN relays only",
      "verdict": "good",
      "fact": "b37"
     },
     "dns_over_https_default": {
      "text": "Yes, DoH only",
      "verdict": "good",
      "fact": "b38"
     },
     "fingerprinting_protection": {
      "text": "Yes (resistFingerprinting)",
      "verdict": "good",
      "fact": "b39"
     },
     "third_party_cookies": {
      "text": "Yes, plus first-party isolation",
      "verdict": "good",
      "fact": "b40"
     },
     "global_privacy_control": {
      "text": "Yes",
      "verdict": "good",
      "fact": "b41"
     }
    }
   }
  ],
  "facts": [
   {
    "id": "b00",
    "browser": "chrome",
    "feature": "webrtc_local_ip",
    "detail": "Yes, hidden by default. Local IPs in ICE candidates are replaced with mDNS hostnames unless an admin policy lists the origin or the mDNS flag is set to Disabled.",
    "evidence": "Otherwise, local IP addresses are concealed with mDNS hostnames.",
    "source_url": "https://chromium.googlesource.com/chromium/src/+/HEAD/components/policy/resources/templates/policy_definitions/Miscellaneous/WebRtcLocalIpsAllowedUrls.yaml",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b01",
    "browser": "chrome",
    "feature": "webrtc_public_ip",
    "detail": "Yes. The default WebRTC IP handling is unrestricted ('default', all interfaces), so STUN server-reflexive candidates can reveal the public IP. Only an admin policy such as disable_non_proxied_udp restricts this.",
    "evidence": "When unset, defaults to using all available network interfaces.",
    "source_url": "https://chromium.googlesource.com/chromium/src/+/HEAD/components/policy/resources/templates/policy_definitions/WebRtc/WebRtcIPHandling.yaml",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b02",
    "browser": "chrome",
    "feature": "dns_over_https_default",
    "detail": "On by default in automatic mode in all regions (no regional limit stated). Chrome upgrades to DoH only when the user's current DNS provider supports it, and falls back to unencrypted DNS on failure. It is unavailable on managed devices or with parental controls.",
    "evidence": "By default, secure DNS in Chrome is turned on in automatic mode.",
    "source_url": "https://support.google.com/chrome/answer/10468685?hl=en",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b03",
    "browser": "chrome",
    "feature": "fingerprinting_protection",
    "detail": "No general fingerprinting protection documented for regular windows. Incognito only: Script Blocking stops known re-identification scripts in third-party contexts (list-based).",
    "evidence": "Chrome only checks active resources that are served from a third-party context in Incognito",
    "source_url": "https://privacysandbox.google.com/protections/script-blocking",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b04",
    "browser": "chrome",
    "feature": "third_party_cookies",
    "detail": "Not blocked in regular windows (allowed by default, user can change). Blocked by default in Incognito.",
    "evidence": "Leaving it unset allows third-party cookies, but users can change this setting.",
    "source_url": "https://chromium.googlesource.com/chromium/src/+/HEAD/components/policy/resources/templates/policy_definitions/Miscellaneous/BlockThirdPartyCookies.yaml",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b05",
    "browser": "chrome",
    "feature": "global_privacy_control",
    "detail": "Not supported; the Sec-GPC header is not sent.",
    "evidence": "\"chrome\": { \"version_added\": false }",
    "source_url": "https://raw.githubusercontent.com/mdn/browser-compat-data/main/http/headers/Sec-GPC.json",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b06",
    "browser": "firefox",
    "feature": "webrtc_local_ip",
    "detail": "Yes, hidden by default. Host candidate addresses are obfuscated with mDNS.",
    "evidence": "pref(\"media.peerconnection.ice.obfuscate_host_addresses\", true);",
    "source_url": "https://raw.githubusercontent.com/mozilla-firefox/firefox/release/modules/libpref/init/all.js",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b07",
    "browser": "firefox",
    "feature": "webrtc_public_ip",
    "detail": "Yes. ICE is not limited to TURN or to the default address by default, so STUN server-reflexive candidates reveal the public IP.",
    "evidence": "pref(\"media.peerconnection.ice.relay_only\", false); // Limit candidates to TURN",
    "source_url": "https://raw.githubusercontent.com/mozilla-firefox/firefox/release/modules/libpref/init/all.js",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b08",
    "browser": "firefox",
    "feature": "dns_over_https_default",
    "detail": "On by default only in rollout regions: US (since Feb 2020), Canada (2021), Ukraine and Russia, per Mozilla's live doh-config. The 'global' record has rolloutEnabled false, so DoH is off by default elsewhere and opt-in.",
    "evidence": "Firefox began the rollout of encrypted DNS over HTTPS (DoH) by default for US-based users.",
    "source_url": "https://blog.mozilla.org/en/firefox/firefox-continues-push-to-bring-dns-over-https-by-default-for-us-users/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b09",
    "browser": "firefox",
    "feature": "fingerprinting_protection",
    "detail": "Partial by default. Enhanced Tracking Protection (Standard) blocks known fingerprinting scripts (list-based). The stronger API-level Fingerprinting Protection is on only in Private Browsing and ETP Strict (privacy.fingerprintingProtection is false by default).",
    "evidence": "Firefox has long blocked known tracking and fingerprinting scripts as part of",
    "source_url": "https://blog.mozilla.org/en/firefox/fingerprinting-protections/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b10",
    "browser": "firefox",
    "feature": "third_party_cookies",
    "detail": "Not blocked outright. Third-party cookies are partitioned per top-level site by default (Total Cookie Protection / dynamic First-Party Isolation, cookieBehavior 5). Known trackers are handled by ETP.",
    "evidence": "// Enable Dynamic First-Party Isolation by default (BEHAVIOR_PARTITION_FOREIGN). pref(\"network.cookie.cookieBehavior\", 5);",
    "source_url": "https://raw.githubusercontent.com/mozilla-firefox/firefox/release/browser/app/profile/firefox.js",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b11",
    "browser": "firefox",
    "feature": "global_privacy_control",
    "detail": "Supported. Sent by default only in Private Browsing windows; off in normal windows (opt-in setting).",
    "evidence": "// Enable GPC in private browsing mode pref(\"privacy.globalprivacycontrol.pbmode.enabled\", true);",
    "source_url": "https://raw.githubusercontent.com/mozilla-firefox/firefox/release/browser/app/profile/firefox.js",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b12",
    "browser": "safari",
    "feature": "webrtc_local_ip",
    "detail": "Yes, hidden by default. Host (local) ICE candidates are exposed only after the page is granted camera or microphone access.",
    "evidence": "Without access to capture devices, WebKit only exposes Server Reflexive and TURN ICE candidates",
    "source_url": "https://webkit.org/blog/7763/a-closer-look-into-webrtc/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b13",
    "browser": "safari",
    "feature": "webrtc_public_ip",
    "detail": "Yes. Server-reflexive (STUN) candidates, which carry the public IP, are exposed without any permission.",
    "evidence": "which expose IPs that could already be gathered by websites",
    "source_url": "https://webkit.org/blog/7763/a-closer-look-into-webrtc/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b14",
    "browser": "safari",
    "feature": "dns_over_https_default",
    "detail": "Not a Safari setting. Safari uses the OS resolver, which is encrypted only if a NetworkExtension app or MDM profile configures encrypted DNS. No Apple statement of a Safari DoH default was found; treated as off by default.",
    "evidence": "System DNS settings can be configured either by a NetworkExtension app",
    "source_url": "https://developer.apple.com/videos/play/wwdc2020/10047/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b15",
    "browser": "safari",
    "feature": "fingerprinting_protection",
    "detail": "Yes, partial by default. Safari 26 restricts known fingerprinting scripts' access to device-revealing APIs; the post does not say whether this applies in all modes. The full 'Advanced Tracking and Fingerprinting Protection' is on by default only in Private Browsing, and the user can extend it to all browsing.",
    "evidence": "Safari 26.0 now prevents known fingerprinting scripts from reliably accessing web APIs",
    "source_url": "https://webkit.org/blog/17333/webkit-features-in-safari-26-0/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b16",
    "browser": "safari",
    "feature": "third_party_cookies",
    "detail": "Yes, all cross-site (third-party) cookies are blocked by default (since Safari 13.1).",
    "evidence": "Cookies for cross-site resources are now blocked by default across the board.",
    "source_url": "https://webkit.org/blog/10218/full-third-party-cookie-blocking-and-more/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b17",
    "browser": "safari",
    "feature": "global_privacy_control",
    "detail": "Not supported.",
    "evidence": "\"safari\": { \"version_added\": false }",
    "source_url": "https://raw.githubusercontent.com/mdn/browser-compat-data/main/http/headers/Sec-GPC.json",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b18",
    "browser": "edge",
    "feature": "webrtc_local_ip",
    "detail": "Yes, hidden by default. With the policy unset, the local IP is replaced by an mDNS hostname (when the mDNS flag is Enabled).",
    "evidence": "The local IP address is concealed with an mDNS hostname.",
    "source_url": "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/WebRtcLocalIpsAllowedUrls",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b19",
    "browser": "edge",
    "feature": "webrtc_public_ip",
    "detail": "Yes. The default IP handling allows all interfaces, so STUN server-reflexive candidates reveal the public IP.",
    "evidence": "AllowAllInterfaces (default) = Allow all interfaces.",
    "source_url": "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/WebRtcLocalhostIpHandling",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b20",
    "browser": "edge",
    "feature": "dns_over_https_default",
    "detail": "Unmanaged devices: on by default in automatic mode, using the current DNS provider with fallback to unencrypted DNS. Managed (organization) devices: off by default. No regional limit stated.",
    "evidence": "By default, your current DNS service provider is used, to avoid disruptions to your browsing.",
    "source_url": "https://learn.microsoft.com/en-us/legal/microsoft-edge/privacy",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b21",
    "browser": "edge",
    "feature": "fingerprinting_protection",
    "detail": "Partial, list-based only. Tracking prevention 'Balanced' (the default) blocks trackers on Microsoft's fingerprinting list that also appear on another tracker list. Trackers that appear only on the Fingerprinting list are not blocked. No API-level randomization is documented.",
    "evidence": "Trackers that appear on solely on the Fingerprinting list are considered non-malicious fingerprinters",
    "source_url": "https://learn.microsoft.com/en-us/microsoft-edge/web-platform/tracking-prevention",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b22",
    "browser": "edge",
    "feature": "third_party_cookies",
    "detail": "Not blocked in regular windows (allowed by default). Blocked by default in InPrivate. Tracking prevention separately restricts known trackers' storage.",
    "evidence": "third-party cookies are allowed by default, but users can change this setting",
    "source_url": "https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies/BlockThirdPartyCookies",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b23",
    "browser": "edge",
    "feature": "global_privacy_control",
    "detail": "Not supported natively.",
    "evidence": "\"edge\": \"mirror\"",
    "source_url": "https://raw.githubusercontent.com/mdn/browser-compat-data/main/http/headers/Sec-GPC.json",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b24",
    "browser": "brave",
    "feature": "webrtc_local_ip",
    "detail": "Yes, hidden by default. With fingerprinting protection on (part of Shields, which are on by default), the WebRTC policy is 'Disable Non-Proxied UDP', which exposes no local addresses.",
    "evidence": "This is the default when Fingerprinting Protection is on",
    "source_url": "https://github.com/brave/brave-browser/wiki/WebRTC-Custom-Settings",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b25",
    "browser": "brave",
    "feature": "webrtc_public_ip",
    "detail": "Not via UDP STUN by default (when fingerprinting protection is on): WebRTC uses TCP only unless a proxy supports UDP, so no STUN server-reflexive candidate is gathered.",
    "evidence": "should only use TCP to contact peers or servers unless the proxy server supports UDP",
    "source_url": "https://github.com/brave/brave-browser/wiki/WebRTC-Custom-Settings",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b26",
    "browser": "brave",
    "feature": "dns_over_https_default",
    "detail": "Unknown. Brave does not document its DoH default. It inherits Chromium, whose default is automatic mode, and Brave says it does not disable secure DNS even under group policy.",
    "evidence": "When group policy is in place, Brave does NOT disable secure DNS.",
    "source_url": "https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b27",
    "browser": "brave",
    "feature": "fingerprinting_protection",
    "detail": "Yes, on by default. Shields are on for every site and randomize ('farble') fingerprintable APIs.",
    "evidence": "Brave prevents sites from tracking you based on your browser fingerprint",
    "source_url": "https://brave.com/shields/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b28",
    "browser": "brave",
    "feature": "third_party_cookies",
    "detail": "Yes, blocked by default. Third-party storage is blocked, and the 2021 post introduces temporary per-site ephemeral storage as its replacement.",
    "evidence": "Since our first release, Brave has by default blocked all third-party application storage",
    "source_url": "https://brave.com/privacy-updates/7-ephemeral-storage/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b29",
    "browser": "brave",
    "feature": "global_privacy_control",
    "detail": "Yes, the GPC signal is sent by default.",
    "evidence": "For versions of Brave that have GPC implemented, the feature is on by default.",
    "source_url": "https://brave.com/web-standards-at-brave/4-global-privacy-control/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b30",
    "browser": "tor",
    "feature": "webrtc_local_ip",
    "detail": "Yes, hidden. WebRTC is disabled entirely by default; mDNS obfuscation and TURN-only are also set as defense in depth.",
    "evidence": "pref(\"media.peerconnection.enabled\", false);",
    "source_url": "https://gitlab.torproject.org/api/v4/projects/tpo%2Fapplications%2Ftor-browser/repository/files/browser%2Fapp%2Fprofile%2F001-base-profile.js/raw?ref=tor-browser-140.17.0esr-15.0-1",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b31",
    "browser": "tor",
    "feature": "webrtc_public_ip",
    "detail": "No. WebRTC (RTCPeerConnection) is disabled by default.",
    "evidence": "pref(\"media.peerconnection.enabled\", false);",
    "source_url": "https://gitlab.torproject.org/api/v4/projects/tpo%2Fapplications%2Ftor-browser/repository/files/browser%2Fapp%2Fprofile%2F001-base-profile.js/raw?ref=tor-browser-140.17.0esr-15.0-1",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b32",
    "browser": "tor",
    "feature": "dns_over_https_default",
    "detail": "No. DoH is off (TRR mode 5) in all regions, and local DNS is disabled; names are resolved by the Tor proxy at the exit relay.",
    "evidence": "pref(\"network.trr.mode\", 5, locked);",
    "source_url": "https://gitlab.torproject.org/api/v4/projects/tpo%2Fapplications%2Ftor-browser/repository/files/browser%2Fapp%2Fprofile%2F000-tor-browser.js/raw?ref=tor-browser-140.17.0esr-15.0-1",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b33",
    "browser": "tor",
    "feature": "fingerprinting_protection",
    "detail": "Yes, strongest of the set. resistFingerprinting is on and locked in release builds, with letterboxing, user-agent spoofing and first-party isolation.",
    "evidence": "Tor Browser includes multiple defenses - like letterboxing, user-agent spoofing, and first-party isolation",
    "source_url": "https://support.torproject.org/tor-browser/features/fingerprinting-protections/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b34",
    "browser": "tor",
    "feature": "third_party_cookies",
    "detail": "Yes, blocked (cookieBehavior 1, first-party cookies only), plus first-party isolation is always on.",
    "evidence": "// Only accept cookies from the originating site (block third party cookies)",
    "source_url": "https://gitlab.torproject.org/api/v4/projects/tpo%2Fapplications%2Ftor-browser/repository/files/browser%2Fapp%2Fprofile%2F001-base-profile.js/raw?ref=tor-browser-140.17.0esr-15.0-1",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b35",
    "browser": "tor",
    "feature": "global_privacy_control",
    "detail": "Yes, GPC is sent by default in both normal and private mode.",
    "evidence": "pref(\"privacy.globalprivacycontrol.enabled\", true);",
    "source_url": "https://gitlab.torproject.org/api/v4/projects/tpo%2Fapplications%2Ftor-browser/repository/files/browser%2Fapp%2Fprofile%2F001-base-profile.js/raw?ref=tor-browser-140.17.0esr-15.0-1",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b36",
    "browser": "mullvad",
    "feature": "webrtc_local_ip",
    "detail": "Yes, hidden. WebRTC is enabled, but host candidates are suppressed (no_host) and obfuscated with mDNS.",
    "evidence": "pref(\"media.peerconnection.ice.obfuscate_host_addresses\", true);",
    "source_url": "https://gitlab.torproject.org/api/v4/projects/tpo%2Fapplications%2Fmullvad-browser/repository/files/browser%2Fapp%2Fprofile%2F001-base-profile.js/raw?ref=mullvad-browser-140.17.0esr-15.0-1",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b37",
    "browser": "mullvad",
    "feature": "webrtc_public_ip",
    "detail": "No via STUN. ICE is limited to TURN relay candidates (relay_only), so no server-reflexive candidate exposes the public IP. Behind a VPN, any IP seen would be the VPN's.",
    "evidence": "connect using TURN only, to avoid IP leaks if user enables WebRTC",
    "source_url": "https://gitlab.torproject.org/api/v4/projects/tpo%2Fapplications%2Fmullvad-browser/repository/files/browser%2Fapp%2Fprofile%2F001-base-profile.js/raw?ref=mullvad-browser-140.17.0esr-15.0-1",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b38",
    "browser": "mullvad",
    "feature": "dns_over_https_default",
    "detail": "Yes, DoH-only (TRR mode 3) to doh-mullvad.quad9.net in all regions, with the DoH rollout heuristics disabled.",
    "evidence": "pref(\"network.trr.mode\", 3);",
    "source_url": "https://gitlab.torproject.org/api/v4/projects/tpo%2Fapplications%2Fmullvad-browser/repository/files/browser%2Fapp%2Fprofile%2F000-mullvad-browser.js/raw?ref=mullvad-browser-140.17.0esr-15.0-1",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b39",
    "browser": "mullvad",
    "feature": "fingerprinting_protection",
    "detail": "Yes. resistFingerprinting is on and locked in release builds (Tor Browser's anti-fingerprinting set).",
    "evidence": "pref(\"privacy.resistFingerprinting\", true, locked);",
    "source_url": "https://gitlab.torproject.org/api/v4/projects/tpo%2Fapplications%2Fmullvad-browser/repository/files/browser%2Fapp%2Fprofile%2F001-base-profile.js/raw?ref=mullvad-browser-140.17.0esr-15.0-1",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b40",
    "browser": "mullvad",
    "feature": "third_party_cookies",
    "detail": "Yes, blocked (cookieBehavior 1), plus first-party isolation.",
    "evidence": "// Only accept cookies from the originating site (block third party cookies)",
    "source_url": "https://gitlab.torproject.org/api/v4/projects/tpo%2Fapplications%2Fmullvad-browser/repository/files/browser%2Fapp%2Fprofile%2F001-base-profile.js/raw?ref=mullvad-browser-140.17.0esr-15.0-1",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b41",
    "browser": "mullvad",
    "feature": "global_privacy_control",
    "detail": "Yes, GPC is sent by default.",
    "evidence": "pref(\"privacy.globalprivacycontrol.enabled\", true);",
    "source_url": "https://gitlab.torproject.org/api/v4/projects/tpo%2Fapplications%2Fmullvad-browser/repository/files/browser%2Fapp%2Fprofile%2F001-base-profile.js/raw?ref=mullvad-browser-140.17.0esr-15.0-1",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b42",
    "browser": "chrome",
    "feature": "fingerprinting_protection",
    "detail": "",
    "evidence": "Script blocking Scheduled for phaseout",
    "source_url": "https://privacysandbox.google.com/overview/status",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b43",
    "browser": "brave",
    "feature": "webrtc_local_ip",
    "detail": "",
    "evidence": "BASE_FEATURE(kWebRtcHideLocalIpsWithMdns, base::FEATURE_ENABLED_BY_DEFAULT);",
    "source_url": "https://raw.githubusercontent.com/chromium/chromium/main/third_party/blink/common/features.cc",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b44",
    "browser": "safari",
    "feature": "third_party_cookies",
    "detail": "",
    "evidence": "CHIPS brings back partitioned cookies, this time opt-in",
    "source_url": "https://webkit.org/blog/17640/webkit-features-for-safari-26-2/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b45",
    "browser": "firefox",
    "feature": "fingerprinting_protection",
    "detail": "",
    "evidence": "name: privacy.baselineFingerprintingProtection type: RelaxedAtomicBool value: true",
    "source_url": "https://raw.githubusercontent.com/mozilla-firefox/firefox/release/modules/libpref/init/StaticPrefList.yaml",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b46",
    "browser": "firefox",
    "feature": "dns_over_https_default",
    "detail": "",
    "evidence": "by-default DNS-over-HTTPS rollout in Canada",
    "source_url": "https://blog.mozilla.org/en/mozilla/news/firefox-by-default-dns-over-https-rollout-in-canada/",
    "verified_at": "2026-10-21"
   },
   {
    "id": "b47",
    "browser": "safari",
    "feature": "webrtc_local_ip",
    "detail": "",
    "evidence": "Enabled MDNS ICE candidate support by default",
    "source_url": "https://webkit.org/blog/8566/release-notes-for-safari-technology-preview-74/",
    "verified_at": "2026-10-21"
   }
  ],
  "caveats": [
   "Safari’s WebRTC behaviour rests on a 2017 WebKit post (Safari 11) and a 2019 Safari Technology Preview note that turned on mDNS names by default.",
   "Microsoft’s Edge policy pages disagree on whether the local IP is shown to WebRTC by default; one says it is hidden behind an mDNS name, another that it is exposed.",
   "Chrome and Edge hide the local IP behind an mDNS name while a browser flag is on. Chromium’s source turns that flag on by default; Microsoft’s pages do not say.",
   "Global Privacy Control support for Chrome and Edge comes from MDN’s browser compatibility data; neither vendor documents it. Apple documents GPC only as a switch for apps built on WebKit, off by default (Safari 27), not for Safari itself.",
   "Brave’s WebRTC and DNS-over-HTTPS defaults are documented only in a 2018 wiki and its list of changes from Chromium; we mark them unknown rather than inherit Chromium’s."
  ]
 }
}