“Browsers phone home” is one of those claims that everyone repeats and almost nobody has measured recently. The last widely cited study is several years old, the browsers have all changed substantially, and the privacy settings have been reorganised more than once. We thought it was worth redoing properly.
The design is deliberately boring. Four freshly imaged machines, one browser each, no accounts signed in, no extensions, no sync. A scripted workload drove identical browsing across all four: 120 page loads per day drawn from a fixed list of the top 500 sites, plus idle periods. Every packet leaving each machine was captured at the router and attributed by SNI and destination. Thirty days, twice: once at default settings, once with every privacy-relevant setting the browser exposes turned to its most protective value.
Volume at defaults
The spread is wide enough that it is worth stating carefully. These are requests to endpoints controlled by the browser vendor, not to the websites the script visited. A request in this count is something the browser chose to send about itself, its state, or its user's activity.
Raw volume, though, is the least interesting number in this study, and leading with it would be a mistake. A browser that checks for a component update every four hours is sending more requests than one that reports every URL you visit, and it is doing something categorically less concerning. Counting requests treats those as equivalent. So we categorised.
Categories matter more than counts
We sorted every vendor-bound request into five categories. Update and integrity covers version checks, component updates, and certificate revocation — functionally mandatory, and we would be alarmed by a browser that did none of it. Safe browsing covers malicious-URL protection, which is genuinely valuable and genuinely a disclosure depending on implementation. Feature services covers spell-check, translation, prefetch hints, and the like. Usage telemetry covers metrics about how the browser is used. Personalisation covers anything tied to a profile or an advertising identifier.
| Category | Chrome | Edge | Firefox | Safari |
|---|---|---|---|---|
| Update & integrity | 312 | 402 | 188 | 94 |
| Safe browsing | 486 | 510 | 142 | 38 |
| Feature services | 704 | 1,088 | 96 | 62 |
| Usage telemetry | 1,240 | 1,004 | 84 | 20 |
| Personalisation | 398 | 136 | 0 | 0 |
| Total per day | 3,140 | 3,140 | 510 | 214 |
The composition is more revealing than the totals. Chrome and Edge landed on the same daily total by different routes: Edge's volume is dominated by feature services, Chrome's by usage telemetry. Firefox's profile is dominated by the categories we would call unavoidable. Safari's low count reflects a design that pushes several of these functions to the operating system, which moves the disclosure rather than removing it — a caveat our methodology cannot fully capture, and one we want to state plainly rather than take credit for.
What survives opt-out
This is the result that changed how we think about the problem. Turning every available privacy setting to its most protective value reduced vendor-bound traffic by between 34% and 71%. None of the four reached zero. More importantly, the categories that survived were not consistent: usage telemetry was almost entirely suppressible in three browsers and only partly in the fourth, while feature services largely persisted everywhere because they are wired into functionality users would notice losing.
A setting can only switch off what the architecture made optional. Where a disclosure is load-bearing for a feature, the toggle either does not exist or quietly breaks something — and users experience that as the browser being broken, not as a privacy choice.
We think this is the actual finding, and it is not really about any of the four browsers. Privacy settings operate at the level of policy, and policy can only govern what the architecture left optional. If the semantic index that powers your address bar lives on a server, no toggle makes it local; the toggle can only decide whether you keep using the address bar. The choice is made when the system is designed, not when the user opens preferences.
Method
Limitations
Encrypted payloads mean we can classify destinations but rarely contents; a request to a telemetry endpoint might carry a single counter or a detailed event log, and we cannot distinguish them. Our categorisation is a judgement call, and reasonable people would sort some endpoints differently — the raw attribution table is published so that disagreement can be specific. Safari's numbers are the least comparable, because operating-system-level services handle work that other browsers do in-process; we did not capture OS traffic, so Safari's figure understates total disclosure by an amount we cannot quantify. Finally, a scripted workload is not a person, and real browsing would trigger feature services at different rates.
The full destination attribution table, the workload script, and the capture methodology are published at dartbrowser.com/research so the categorisation can be argued with directly. Corrections are welcome: research@dartbrowser.com.
Related work
Leith [1] performed the closest prior study, instrumenting six browsers and documenting what each transmits at rest and in use; his methodology strongly influenced ours and his findings on identifier persistence remain the sharper result. Englehardt and Narayanan [2] measured third-party tracking at web scale rather than first-party vendor traffic, which is the complementary half of the picture. Our study adds a longitudinal dimension — 30 days under an identical scripted workload — and a direct comparison between default and maximally-protective settings, which to our knowledge has not been published for the current browser generation.
Artefacts
Everything below is published or available on request. A number nobody can reproduce is an advertisement, not a result.
References
- Leith, D. J. (2020). Web Browser Privacy: What Do Browsers Say When They Phone Home? Trinity College Dublin.
- Englehardt, S., & Narayanan, A. (2016). Online Tracking: A 1-million-site Measurement and Analysis. ACM CCS.
- Snyder, P., Ansari, L., Taylor, C., & Kanich, C. (2016). Browser Feature Usage on the Modern Web. ACM IMC.
- Google (2025). Chrome Privacy Whitepaper.
- Mozilla (2025). Firefox Privacy Notice and telemetry documentation.
Bhardwaj, M. (2026). What browsers send home: a 30-day packet-level study. Dart Browser Research, DBR-2026-02.
