Setup guide · Last reviewed 10 November 2026

Browser privacy settings that actually change something

How to test your own browser, the three defaults worth changing, where blocking breaks sites, and why fingerprinting is the part a setting cannot fix.

Browser privacy advice tends to arrive as a list of extensions. That is the wrong starting point, because adding things is easy to sell and hard to undo: three overlapping blockers are a common cause of login pages that silently fail. The useful work is quieter - check what your browser already does, change a small number of defaults, then verify the result.

We lean on the Electronic Frontier Foundation's Cover Your Tracks here because it is a test a reader can run on their own machine in a minute. Browser defaults change between releases, and a live measurement is more honest than a claim written once and left on a page for two years.

Start by measuring your own browser

Open Cover Your Tracks in the browser you actually use and run the test. It loads simulated trackers to see which ones are blocked, and separately reports how distinctive your browser's configuration looks to a site. The two answers are different questions, and a browser can do well on one and poorly on the other.

Do this before and after any change. It turns a vague feeling of being protected into something you can compare, and it will occasionally tell you that the extension you installed last year is doing nothing. It is also a good way to see the effect of a browser update, since defaults are not frozen.

• Run the test in a normal window, not a private one, if you want to know about everyday browsing.
• Blocking trackers and having a non-distinctive fingerprint are separate results.
• A privacy extension can itself make a browser more identifiable by making it unusual.

The tools this step calls for, with their real licence and platform details:

The three defaults worth changing

First, put tracking protection at its standard or stricter setting and leave it there. Firefox ships Enhanced Tracking Protection with per-site cookie isolation, which confines a site's cookies to that site instead of letting a third party follow you across the web. Second, decide what happens to third-party cookies explicitly rather than inheriting a default you never looked at. Third, make sure HTTPS-only or equivalent is on, so a link that omits the scheme does not quietly fall back to plaintext.

None of these require an account, a subscription or a background process. They are settings in the browser you already have. Where Mozilla documents a protection, we link to its own support material rather than paraphrasing a second-hand summary, and the EFF test is the check on whether the setting did anything on your machine.

• Tracking protection: standard is a reasonable default; strict breaks more sites, so change one thing at a time.
• Cookie isolation matters more than periodically clearing cookies, which only removes the current copies.
• HTTPS-only mode occasionally needs an exception for an old internal device. Add one, not a global disable.

Where blocking breaks things

The failure mode is almost always a sign-in flow. A payment page opens a third-party window for verification, a corporate single sign-on bounces between two domains, or a video player needs a script that a blocker classifies as a tracker. The symptom looks like a broken website rather than a privacy setting, which is why the culprit is often missed.

Keep one known-good second browser for these cases instead of weakening the main one. That is not a compromise of principle; it is the same pattern as keeping a spare key. Our Firefox page explains why a non-Chromium engine is worth having as the daily browser, and the browsers category page covers what the alternatives actually differ on.

The tools this step calls for, with their real licence and platform details:

Fingerprinting is the part settings cannot solve

A site can identify a browser without storing anything on it, by combining the details the browser hands over freely: screen dimensions, installed fonts, graphics behaviour, time zone and language. The EFF's test measures this, and its own guidance is careful - protections can themselves become part of a fingerprint, and blocking trackers stops them reading it but does not make it disappear.

Be sceptical of any page that promises to make you anonymous with a toggle. For a general-purpose machine the honest goal is narrower: fewer third parties following you between sites, fewer extensions with broad permissions, and a clear idea of which browser you use for what. If you need genuine anonymity, that is a different tool and a different threat model, not a settings checklist.

• A distinctive browser can be recognised even with cookies blocked.
• Installing many 'anti-fingerprinting' add-ons often makes the browser more unusual, not less.
• Treat claims of anonymity as a claim about a specific threat model, and ask which one.

Mistakes to avoid

• Installing three content blockers that overlap and then debugging a broken login page for an hour.
• Clearing cookies on a schedule while leaving cross-site tracking enabled.
• Turning tracking protection off globally because one site failed, instead of adding one exception.
• Believing a private window hides you from the sites you visit. It mainly hides your history from people using the same device.
• Reading a privacy test result as a permanent property of the browser rather than of this version and this configuration.

Questions people ask

Do I still need a content-blocking extension?

Often not for everyday browsing. Start with the browser's built-in protection, run a live test, and add an extension only if the result shows a gap you care about.

Why does my bank's login page break with strict protection?

Verification flows frequently move between domains. Add a per-site exception rather than lowering the setting everywhere.

Is Firefox more private than Chrome?

The engines make different default choices about cross-site tracking, and Firefox is the only mainstream option here that is not built on Chromium. Which is better depends on the sites you use, so measure your own setup.

Does a VPN replace these settings?

No. A VPN changes who carries the traffic; it does not stop a site from identifying the browser at the other end.

Related guides

• Privacy-first setup
• VPN or mesh network
• Moving to a password vault
• New PC setup order

Or see all guides and category explainers.

Sources and further reading

These are the published sources this guide leans on. We summarise the part that changes a decision rather than copying a review; see the full citation policy.

• Cover Your Tracks ↗ — Electronic Frontier Foundation · Ongoing · Reader-run browser test. We link this as something a reader can run on their own machine instead of trusting our word. A browser's defaults change between releases, and a live test is more honest than a claim we wrote once.