Most privacy statistics you find online are survey results — people reporting what they believe about their setup. These are measurements. Every figure below comes from a privacy test that actually ran in a real browser on this site, and every one is published with the number of sessions behind it.
What we measured
Between 2026-06-07 and 2026-08-12 we recorded 9,084 test results from human sessions. Automated traffic is excluded before counting.
| Measurement | Result | Sessions measured |
|---|---|---|
| Connections already routed through a VPN, proxy or hosting network | 48.2% | 4,669 |
| Browsers that exposed an IP address through WebRTC | 43% | 581 |
| Connections whose DNS resolution looked inconsistent with the tunnel | 35.2% | 1,703 |
| Visitors with working IPv6 connectivity | 16.6% | 1,055 |
| Visitors whose IPv6 path bypassed their IPv4 tunnel | 0.5% | 1,055 |
The single most striking figure is WebRTC. It is a browser feature that can reveal an IP address independently of any VPN tunnel, it is enabled by default almost everywhere, and a large share of the browsers we measured were exposing one — including many that were connected through a VPN at the time. People who have taken the trouble to run a VPN are frequently still leaking around it.
IPv6 tells the opposite story. Adoption among the visitors we measured is low, and precisely because so few connections carry working IPv6, IPv6-specific leaks are rare in absolute terms. That balance shifts as adoption grows.
How privacy-tested browsers actually score
The privacy test runs four independent checks and grades the result:
| Overall grade | Share | Sessions |
|---|---|---|
| Excellent (4 of 4 checks passed) | 4.8% | 43 |
| Good (3 of 4) | 48.8% | 435 |
| Fair (2 of 4) | 29% | 259 |
| Poor (0–1 of 4) | 17.4% | 155 |
Only 4.8% of graded sessions passed all four checks. This is a self-selecting audience — people who deliberately visit a privacy testing site skew far more careful than the general population — which makes the result more sobering, not less. If this is what an interested, motivated group looks like, the untested majority is unlikely to be doing better.
Method, and what these numbers are not
Each completed test contributes exactly one aggregate outcome. The recorded shape permits only booleans, small fixed enums and bounded counts, so an IP address or fingerprint cannot be stored alongside a result even by mistake — the boundary schema rejects any field outside that allowlist rather than storing it.
Three limits are worth stating plainly:
- Self-selection. Visitors to a privacy testing site are not a random sample of internet users. Read every figure as "among people who chose to test", never as a population estimate.
- Repeat testing. Someone who changes a setting and retests contributes more than one result. We do not de-duplicate across sessions.
- The DNS figure is a consistency check. It compares what independent endpoints observe about a connection; it does not directly observe which resolver an operating system queried. Read it as an indicator, not a verdict.
Test your own browser
Every number above came from a test you can run yourself, right now, in the browser you are reading this in:
- WebRTC Leak Test — the one most likely to surprise you
- DNS Leak Test
- IPv6 Leak Test
- VPN Check
- Privacy Test — all four checks, graded
Nothing you run is tied to you: results are counted, not stored against an identity.