Canvases should never be readable by the other end without explicit permission. Basically transmitting anything rendered to a canvas should be equivalent to using my web camera from an integrity standpoint.

Time zone, operating system (from a short list) and language is fine, because it’s not a lot of entropy and my ip is known anyway unless on a vpn.

Gl renderer/graphics card, desktop resolution - nah. The viewport dimension is all that should be known.

Basically the browser should by default have an entropy budget for my entire fingerprint that ensures I’m not personally identifiable.