Here is a complaint that arrives in some form every week. Somebody clears their cookies, installs four privacy extensions, switches on every toggle they can find, and still sees ads for a washing machine they looked at once. Open that browser and the reason is usually visible inside a minute: nine extensions, three of them doing overlapping jobs, one an ad blocker whose filter lists stopped updating two years ago, and a grab-bag of anti-fingerprinting tweaks copied from a forum post that together make the browser an unusual and therefore memorable combination of settings. A lot of work, almost no reduction in exposure. The settings that genuinely change what follows you around are few, dull, and mostly already sitting in the browser you have. The ones that feel like privacy work are largely theatre, and a couple of them actively make you easier to recognise. This is the sorted list, in the order I would hand it to somebody who asked.
cookies, and what the third-party cookie mess actually settled
A cookie is a small value a site asks your browser to store and send back. First-party cookies are the ones that keep you logged in, and blocking those makes the web unusable. Third-party cookies were the ones set by a domain other than the site you were on, which let one advertiser recognise you across thousands of unrelated pages.
Those are now blocked by default in Firefox and Safari, and Chrome has spent years walking through various plans for them. Here is the part that matters for your expectations: cross-site tracking did not stop, it moved. Tracking now leans on first-party storage shared through a server, identifiers stitched to your login, link decoration where identifiers ride along in the URL you clicked, and fingerprinting. So clearing cookies helps, and it does not deliver what the washing-machine complaint above expected, because that interest was most likely attached to an account the person stays permanently signed into.
Link decoration is worth recognising because you can act on it. Notice the long trail of parameters after the question mark in a link shared on WhatsApp or pasted from a newsletter. Some of that is analytics for the publisher, and some of it identifies the person who shared it. Firefox (in Strict mode and private windows) and Safari (in Private Browsing) strip some known tracking parameters, and Firefox has a copy-clean-link option. Elsewhere, delete everything after the question mark yourself and check the link still works. Getting into the habit of trimming what you paste into a family group is a tiny act with a real effect, since those links get forwarded dozens of times.
the settings that change real exposure
Four changes do most of the work. In Firefox, set Enhanced Tracking Protection to Strict. Total Cookie Protection, which keeps each site’s cookies in a separate jar, has been on by default since 2022. Strict adds tracker and fingerprinter blocking in all windows and can break some sites. In Chrome or Edge, block third-party cookies explicitly in the privacy settings. Google is retiring the Topics and ad-measurement APIs that older guides tell you to switch off, so turn off whatever ad-personalisation setting your version still shows. Everywhere, switch on HTTPS-only mode. And sign out of accounts you are not using, because a logged-in identity beats every cookie setting you own.
# Firefox, about:config — three that earn their place
privacy.trackingprotection.enabled true
dom.security.https_only_mode true
network.cookie.cookieBehavior 5
# Then verify in the UI rather than trusting a pasted list:
# about:preferences#privacy and about:protections| Setting | What it changes | Verdict |
|---|---|---|
| Strict tracking protection | Blocks known trackers, isolates cookies per site | Real, do it |
| HTTPS-only mode | Refuses plaintext page loads instead of silently allowing them | Real, do it |
| Content blocker with maintained lists | Stops the request before it happens | Real, do it |
| Do Not Track header | Retired in Firefox 135 in favour of Global Privacy Control; most sites ignored it | Theatre; use GPC where offered |
| Private window | Local history only, invisible to nobody else | Useful, widely misread |
| Clearing cookies weekly | Resets some tracking, logs you out | Minor once cookies are isolated |
| Random user-agent switching | Makes your browser stand out | Usually counterproductive |
The private window row deserves a sentence, because it causes real confusion. It keeps the session out of your local history and discards cookies when you close it. Your ISP, your employer’s network and the sites you visit see exactly what they would otherwise. It is a feature for sharing a laptop, not for hiding from anyone.
fingerprinting, and why hardening can backfire
A site can ask your browser plenty of innocent questions: screen size, timezone, installed fonts, how your graphics stack renders a shape, which audio features exist. None of those identify you. All of them together often do, because the combination is rare. That is browser fingerprinting, and it needs no cookie and survives clearing everything.
Now the counterintuitive bit. Most fingerprinting defences work by making you look like everyone else. Anti-fingerprinting settings copied from a forum thread, an unusual font set, a spoofed user agent and three extensions that each modify page behaviour do the opposite: they produce a configuration almost nobody else has. The over-tuned laptop described at the start is the standard example: distinctive before the hardening, and more distinctive after it.
Pick a browser with sensible defaults and leave the exotic settings alone. Either blend into a large crowd running stock configuration, or use a browser built specifically to make all its users look alike. Hand-tuning lands you in the worst of both.
extensions: two worth having, the rest is weight
One content blocker with well-maintained filter lists, and a password manager. That is the list I would defend. On Firefox that’s uBlock Origin, and the reasoning behind its settings is in my uBlock Origin guide. Chrome turned off Manifest V2 extensions, including uBlock Origin, for all users from Chrome 138 in July 2025, so on Chrome use a Manifest V3 blocker such as uBlock Origin Lite. For the password half, the argument sits in password managers and 2FA.
Everything beyond that needs to justify itself, for two reasons. Extensions usually request permission to read and change data on every site you visit, which is a large amount of trust to hand a developer you know nothing about, and ownership of a popular extension does change hands. And overlapping blockers fight each other, producing broken pages that people then fix by disabling the one that was working. If you want blocking that covers every device including the TV and the phone apps, do it on the network instead, which is the case I make in the DNS-level ad blocking explainer.
separate profiles do more than any toggle
The strongest privacy improvement available in a browser is not a setting. It is not mixing contexts. Cookies, logins and storage are shared across every tab in a profile, so your office webmail and your late-night shopping live in the same pot.
how I would split them
Three profiles, kept deliberately boring. One for work accounts and nothing else. One for personal browsing with the social and shopping logins. One with no logins at all, which is where anything you are merely curious about goes. Chrome and Edge do this with profile switching; Firefox has containers, which achieve the same separation inside one window with colour-coded tabs.
The payoff is concrete. A tracker present on both a news site and a shopping site can only join up activity inside one profile. Nothing you do in the no-login profile attaches to your name. And when a work laptop needs handing to IT, the personal half of your life is not in its history.
a sane default set for a family device
A laptop shared by parents or grandparents deserves a deliberately dull configuration, because anything clever becomes your support burden. Firefox or Chrome on automatic updates. Tracking protection on strict. HTTPS-only mode on. One content blocker, no others. The password manager installed and set up for them, with autofill on so they stop typing passwords into whatever page asks. Search engine set to something that does not require a login to be useful.
Two things worth deliberately skipping. Do not clear cookies on exit, because logging a parent out of their email every week trains them to distrust the browser. And do not install anything that shows warnings they cannot act on, since a person who dismisses five harmless warnings a week will dismiss the sixth one that mattered. One thing worth adding instead: the browser’s own list of saved logins deserves a five-minute review on each visit, so accounts nobody uses stop sitting there with a password from years ago.
common mistakes
- Stacking three content blockers. They overlap, they break pages, and the fix people apply usually disables the effective one.
- Copying anti-fingerprinting settings from a forum post, which makes your browser rarer rather than more anonymous.
- Believing a private window hides you from your ISP, your college network or the sites you visit. It hides local history, nothing more.
- Granting every extension permission on all sites without asking what it needs that access for.
- Tuning cookies carefully while staying signed into an account on every tab, which is the identifier that actually follows you.
- Postponing browser updates. Most of what a privacy setting protects against is handled upstream by the patched version you have not installed.
FAQ
which browser should I actually use?
Firefox with strict protection, or a Chromium-based browser with third-party cookies blocked. Both are reasonable. What matters more than the badge is that it updates itself, it is not a niche build nobody audits, and you have not decorated it with fifteen extensions. Use two different browsers for work and personal if profiles feel fiddly.
is incognito enough on a shared or café computer?
For keeping the next person out of your history, largely yes, provided you close the window. It does nothing about the machine itself, which may have software you cannot inspect, and it does nothing about the network. On a computer that is not yours, sign in to as little as possible, and never to banking. The related network questions are in my public Wi-Fi guide.
do those privacy test sites mean anything?
They are useful for one thing: showing you that fingerprinting is real and that your browser answers more questions than you assumed. Treat the scores as demonstrations rather than grades. A page telling you that you are unique is measuring a small pool of privacy-minded visitors, and chasing a better score there is exactly how people end up with the over-tuned setup this article warns about.
If you change only three things, make them strict tracking protection, HTTPS-only mode and one content blocker, and remove every extension you cannot justify out loud. A second profile for work will then do more for you than the next twenty toggles combined.
Update history: covers Chrome turning off Manifest V2 extensions such as uBlock Origin, Google retiring the Topics and ad-measurement APIs, and current Firefox behaviour for Total Cookie Protection, link stripping and Do Not Track.
Sources
- MDN privacy on the web — cookie behaviour, storage partitioning and fingerprinting surfaces described from the browser side.
- MDN web security documentation — how HTTPS enforcement and mixed content handling work in current browsers.
- Privacy Sandbox: update on plans for Privacy Sandbox technologies — Google’s October 2025 announcement retiring Topics and the ad-measurement APIs.
- Chrome Manifest V2 deprecation timeline — when Chrome turned off Manifest V2 extensions, including uBlock Origin, for all users.