How is account association detected? What platforms actually look at

Association is a probability, not a switch

A platform does not declare two accounts to belong to the same person because one piece of information matches. What actually happens is that dozens of signals are collected, each assigned a weight, and summed into a similarity score. Only when that score crosses a threshold does it trigger manual review or automated action.

That explains two things people often notice: why one person runs into trouble after changing nothing but their IP, while another changes nothing at all and never has a problem. The difference lies in how much the remaining signals overlap, and in how strictly each platform sets its threshold.

Layer one: storage-based identifiers

This is the most direct layer - cookies, LocalStorage, IndexedDB, Service Worker caches and the like. Platforms write long-lived identifiers here and simply read them back for comparison on your next visit.

The defining trait of this layer is that it can be cleared - and precisely because it can be cleared, no platform relies on it alone. Something you can delete is not solid enough to serve as the sole basis for a judgment.

Layer two: the browser fingerprint

This carries the highest weight and is the hardest layer to deal with. JavaScript on a page can read a large number of environment characteristics, and combining them produces an identifier with extremely high discriminating power.

The key point is that most of these parameters are determined by your hardware and operating system, so they do not change when you clear your data. That is exactly where the term fingerprint comes from.

• Canvas fingerprint: the browser is asked to draw a graphic and the result is hashed, and different GPUs and drivers render it with subtle differences
• WebGL fingerprint: graphics card model, driver version and the list of supported extensions
• Font list: the particular combination of fonts installed on the system, which is highly distinctive
• AudioContext: differences in the floating-point output of the audio processing pipeline
• Basic parameters: screen resolution, color depth, time zone, language, CPU core count, memory size, User-Agent

Layer three: network characteristics and consistency

Beyond the exit IP itself, what platforms care about most is whether all the pieces agree with each other. An IP claiming to be in the United States, paired with a UTC+8 system time zone and a Simplified Chinese browser language, is a contradiction that triggers a flag more readily than a repeated IP does.

WebRTC is another commonly overlooked point: it can expose your real local network address and public address to a page, bypassing your proxy settings entirely. A profile's WebRTC behavior therefore has to stay consistent with its proxy configuration.

• The type of exit IP (residential / datacenter / mobile network) and its history of use
• Whether the IP location matches the browser time zone and language
• Whether WebRTC is leaking a real address outside the proxy
• TLS handshake characteristics (JA3/JA4), determined by the order of the client's cipher suites

Layer four: behavioral patterns

This layer is not a technical fingerprint, but it counts just as much: whether several accounts log in at similar times, whether their action paths look highly similar, whether shipping addresses or payment methods overlap, whether they follow or interact with one another.

No technical measure addresses this part - only running the accounts in a way that makes sense on its own terms. Profile isolation handles the first three layers; the fourth comes down to how you use the accounts.

Frequently asked questions