Five steps, from handshake to probe
The first TCP packet carries your IP and system traits; the TLS handshake reveals the browser engine; request headers announce browser, system and language; page scripts read hardware, fonts and time zone; after loading, the site can make the browser contact other servers to see whether WebRTC and DNS bypass a proxy. The first three steps happen before any script, so turning JavaScript off does not stop them.