voice engine fingerprint

every operating system ships a different set of text-to-speech voices. windows includes neural voices. macos has alex, siri voices, and dozens of multilingual options. android has google wavenet voices. the exact list — names, languages, and which are local vs cloud — is surprisingly stable and unique to your os version, locale, and installed voice packs.

no permission required. any page can call speechSynthesis.getVoices().

• no permission, persistent fingerprint. unlike canvas or webgl fingerprinting, voice lists are not affected by canvas blockers, vpns, or private browsing. they reflect your actual os installation. the hash is consistent across all browsers on the same device.
• the async timing is a signal too. chrome populates voices asynchronously and requires the voiceschanged event. firefox and safari return them immediately. this alone narrows the browser family without ua string parsing.
• locale + region + installed languages. a device with arabic, mandarin, and hindi voices alongside english tells a fingerprinter about geographic location, likely user demographics, and installed software. neural voices (azure, wavenet) indicate premium os tiers.
• accessibility telemetry. screen reader users have additional, specialized voices installed that non-screen-reader users don't. this can inadvertently out accessibility needs to every page visited.