How to Audit Your Browser for Scraping and Paywall Bypass Risks

The New York Times sued Brave on November 2, 2026. So did the Daily News, Chicago Tribune, and Orlando Sentinel. The accusation: Brave allegedly crawls the full web — the suit claims more than 30 billion pages — then packages that content for AI companies including Anthropic, Perplexity, Mistral, xAI, and Cohere. Publishers say they never gave permission, cannot block the crawler, and see their paywalls bypassed. Brave says its index is independent and that it does not scrape other engines. The courts will sort out the legal question.

The practical question is yours to answer now: what is my browser actually doing with the pages I visit? The primary allegations come from the TechCrunch report on the lawsuits and the Brave AI web grounding page, which describes its independent index approach.

Why Browser Auditing Matters

Most of us choose a browser for speed, UI, or privacy headlines. We rarely audit what it sends in the background. But modern browsers can do three things that deserve scrutiny:

• Extensions with broad host permissions can read every page you visit and exfiltrate content.
• Built-in features like AI assistants, screenshot tools, or page summarizers can ship DOM and text to remote endpoints.
• Crawler participation — some browsers contribute to shared indexing projects that scrape publisher content without explicit consent.

You do not need to be a security engineer to check for these. A few manual steps in DevTools and Settings will tell you most of what you need to know. If you have followed my earlier pieces on AI economics or privacy-first AI assistants, you already know that “free” tools often extract value from your data in ways the Terms of Service never make clear.

Step 1: Inventory Your Extensions

Extensions are the most common source of silent scraping. An ad blocker is expected to read page DOM, but so is a coupon finder, a price tracker, or a “writing assistant” that highlights selected text.

What to check:

• Open your extension list (brave://extensions, chrome://extensions, or about:addons in Firefox).
• For each extension, click Details and review Site access. Anything set to On all sites or with host permissions for <all_urls> can read every page you load.
• Remove anything you do not recognize or no longer use.

If you want a quick test, disable all extensions, restart the browser, and see if network behavior changes. On Brave, you can also open the Brave Shields panel for the current site and scroll to Cookies and site data — a blocked tracker is harmless; an extension reading your Gmail DOM is not.

Step 2: Watch Network Traffic in DevTools

Browser DevTools is the fastest way to see what leaves your machine while you browse. You do not need to install anything.

What to do:

• Press F12 (or Ctrl+Shift+I) and open the Network tab.
• Enable Preserve log so requests survive redirects.
• Filter by Fetch/XHR to see programmatic API calls.
• Browse normally for a few minutes on a news site or login-protected page.
• Look for POST requests to unfamiliar domains, especially ones sending text/html, application/json, or large blobs of page content.

A legitimate analytics request is small and to a known domain. A scraping request often posts the entire rendered page or extracted text to an endpoint you do not recognize. If you see repeated text/html uploads to a third-party server while reading an article, that is worth investigating. We saw a similar pattern in the CVE-2026-111497 infrastructure story: the danger is not the protocol itself, but what gets shipped inside it.

Step 3: Check Browser Telemetry and Data Collection

Every major browser collects some telemetry. The question is whether you opted in and whether the data is limited to performance metrics or includes page content.

Brave: Go to brave://settings/privacy and scroll to Brave Shields and privacy. Under Web Discovery Project, Brave states that anonymous browsing signals may be used to improve search. If you want zero contribution, disable it.

Chrome: Visit chrome://settings/privacy and turn off Help improve Chrome’s features and performance, URL auto-complete sends to Google, and any Search and browse better toggles.

Firefox: Go to about:preferences#privacy and set Data Collection and Use to Never. Also review about:config for datareporting.policy.dataSubmissionEnabled.

These settings do not guarantee content is not being read, but they remove the officially documented collection paths. Browser vendors have a habit of changing browser behavior without notice, so re-audit these toggles after every major update.

Step 4: Test Paywall Behavior (Ethically)

The lawsuit specifically calls out Brave’s paywall-blocking feature. You do not need to pirate content to see whether your browser is helping you bypass publisher controls.

What to do:

• Visit a news site you know has a paywall.
• Open DevTools Console and type document.readyState. If it says complete, the page loaded.
• Check whether premium article text appears without a login prompt. If it does, something — an extension, browser setting, or cached session — is bypassing the wall.
• Open DevTools Application tab and inspect Cookies and Local Storage. Look for keys like __paywall, subscription, or publisher-specific tokens. A leftover valid token from a previous session is the most common cause of “free” access, not the browser itself.

The goal is awareness, not circumvention. If you find a workaround, respect the publisher’s terms of service.

Step 5: Audit AI Features and Agentic Browsing

Brave is testing AI browsing in its Nightly channel. This feature lets the browser autonomously research, fill forms, and summarize pages. It runs in an isolated profile and, according to Brave’s support docs, does not log conversations. But agentic browsing is inherently risky because the browser can extract page text, follow links, and send that content to a model.

What to check:

• If you use Brave Nightly, open brave://settings/ai and confirm whether AI browsing is enabled.
• Review which sites the feature can access. If the permission scope is broad, the browser can read your email, bank statements, and internal dashboards.
• In any browser, look for built-in AI or summarizer toggles in Settings and disable them if you do not need them.

The safest default for sensitive work is a separate browser profile with no extensions, no AI features, and no telemetry — just raw HTTP and the sites you trust. For sensitive research, I prefer running a local AI assistant that never touches the network unless I explicitly route it.

Step 6: Use External Tools to Validate

Manual checks are good, but they miss things. Two free tools help automate the audit:

• BrowserScan (browserscan.net) — tests your browser for fingerprinting vectors, known vulnerabilities, and leaked IP/DNS leaks. It runs entirely client-side.
• DNS leak test (dnsleaktest.com) — confirms whether your browser or VPN is leaking DNS queries to your ISP or a third party.

Run these quarterly, especially after installing a new extension or switching browsers. A clean scan does not mean you are safe forever; it means your current configuration is sound.

The Honest Bottom Line

The Brave lawsuit is about whether a privacy-focused browser can also be a content distributor for AI models without paying publishers. That is a legal and ethical question that courts will decide.

But the technical question is yours to answer now: is my browser doing more than I agreed to? Extensions, telemetry, and AI features can all read your browsing data. The six steps above — inventory extensions, watch network traffic, audit telemetry, test paywall behavior, check AI features, and validate with external tools — take less than an hour and will tell you more than any privacy headline.

I run a tight extension policy myself: only what I installed yesterday, only on the sites that need it, and everything else disabled. If a browser wants to index my browsing for AI training, I want to see that toggle and turn it off.