Firefox blocks cross-site tracking by default

Chrome runs on the majority of the world’s desktops and phones, and it is built and maintained by Google, a company whose core revenue comes from advertising. That single fact defines the conflict of interest in the software you use to read this. The browser is the most instrumented program on your device. Every page you open executes code written by parties you did not select, inside an execution context you do not control, with access to network requests, storage, timing signals, and device characteristics you never agreed to expose. The browser decides what those parties are allowed to see. It is the enforcement point. Firefox matters here for one structural reason: Mozilla does not run an advertising business that depends on watching you.

The browser is the boundary between you and the tracking apparatus, and boundaries are only as strong as what they enforce. A privacy setting that is documented but not applied by default protects almost no one, because almost no one changes defaults. If the browser permits cross-site correlation, cross-site correlation will happen at scale, automatically, on every page load, with no human in the loop on the attacker’s side. Trackers do not need to breach anything. They operate inside the permissions the browser hands them. Whatever the browser allows, the ad-tech supply chain will take, and it will take it from every user simultaneously.

Anonymity in this context is not about hiding activity. It is about controlling who is allowed to assemble a profile of you across the sites you visit, the searches you run, and the accounts you hold. That profile is the asset. It is bought, sold, correlated with offline records, and retained indefinitely by parties you will never identify. The question is not whether you have something to hide. The question is who holds the ability to link your behavior together, and whether your browser is working to break that link or to preserve it.

Most users operated on an assumption that private browsing equals anonymity. It does not. Private or incognito mode changes one thing: it prevents the browser from writing history, cookies, and form data to local disk after the session ends. That is a local hygiene feature. It does nothing to the network. Your ISP still sees your DNS lookups and destinations. The sites you visit still receive your IP address, your request headers, and enough device characteristics to fingerprint you. Third-party scripts on those pages still load and still report. Private mode protects the person sitting next to you at your machine. It does not protect you from the parties on the other end of the connection.

The second assumption was that tracking is a cookie problem. Block third-party cookies, clear your cookies periodically, and the tracking stops. That model was accurate years ago and is incomplete now. When third-party cookies became easier to block, the tracking industry moved to techniques that do not require a cookie to persist. Browser fingerprinting combines your user agent, screen resolution, installed fonts, canvas rendering output, timezone, and dozens of other attributes into an identifier that survives cookie deletion. Bounce tracking routes you through an intermediary domain during navigation so that domain can set first-party state. Link decoration appends identifiers directly onto the URLs you click. None of these depend on the classic third-party cookie you were told to block.

The third assumption was that the default configuration is safe and that opting out works. Default browser settings are tuned for compatibility and page functionality, not for the strongest available protection. The Do Not Track header was the clearest demonstration of this failure. It was a request, not an enforcement. It asked trackers to voluntarily stop, carried no technical weight, and was ignored by most of the industry, in some cases used as one more fingerprinting signal. An opt-out that the other side is free to disregard is not a control. It is a preference log. Treating it as protection left a large population of users believing they had defended themselves when nothing on the wire had changed.

What changed is where enforcement happens. Firefox moved the boundary out of user configuration and into the browser engine itself, and it changed the mechanism from asking to isolating. Total Cookie Protection is the clearest example. Instead of debating which third-party cookies to allow, Firefox partitions storage by the top-level site you are visiting. Each site gets its own separate cookie jar. A tracker embedded on Site A and Site B can still set state, but the state it sets on Site A is walled off from the state it sets on Site B. The identifier cannot be read across sites, so the cross-site link that the entire tracking model depends on breaks at the storage layer. This is enforcement by isolation, not by permission, and it applies without the user configuring anything.

The engine also began attacking the techniques that replaced cookies. Enhanced Tracking Protection blocks known trackers against maintained lists. Query parameter stripping removes known tracking identifiers appended to URLs before the request is made. Redirect and bounce tracking protection detects domains used only as navigation intermediaries and purges the state they set, closing the first-party redirect loophole. Fingerprinting protection blocks scripts from suspected fingerprinting sources and reduces the uniqueness of the attributes those scripts can read. Each of these targets a specific, observed evasion path rather than a general category, and each operates at the point where the request or the script actually executes.

The broader shift is that these protections are moving toward on by default, layered with HTTPS-Only Mode, DNS over HTTPS to remove plaintext lookups from your ISP’s view, container isolation to keep identities separated, and Global Privacy Control as a signal that carries legal weight in some jurisdictions rather than a voluntary courtesy. The change that matters is not any single feature in that list. It is that the browser stopped assuming the user would find and enable protection, and started enforcing it in the engine as the default state. The boundary is now doing work whether or not you touch a setting, and that is the difference between a documented preference and an actual control.

Every technique described so far shares one failure, and it is not on the attacker side. It is where control was placed. Do Not Track, third party cookie prompts, and any opt out model locate enforcement outside the browser engine and make it contingent on cooperation from the party being constrained or action from the user being protected. A control that the constrained party can decline is not a control. It is a request. The tracking industry read Do Not Track as a request, declined it, and in some cases logged the header as one more distinguishing attribute. The mechanism that fails is enforcement positioned where the subject of the control gets a vote.

The second failure is control scoped to a category instead of a behavior. Blocking third party cookies addresses a storage mechanism. It does not address identity persistence through channels that never touch that mechanism. Fingerprinting sets no cookie, so a cookie control never observes it. Bounce tracking converts a third party into a first party during navigation, so a third party rule does not apply to it. Link decoration carries the identifier in the URL itself, below the level any cookie policy inspects. Each evasion survives because the control was defined against a named category and the behavior moved to a channel outside that category’s view. Firefox’s response relocates enforcement to the storage layer and the request layer, where the behavior is observable regardless of which domain performs it or what reputation that domain holds.

The third failure is distribution. Protection that ships off by default reaches only the population that finds it, understands it, and enables it, and that population is small. The strength of a control at scale is set by its default state, because friction determines adoption and almost no one overcomes friction to change a setting they were never told about. A documented protection that is not the default protects the documentation, not the user. This is why the shift from opt in to on by default is the substantive change and the individual feature names are secondary. Moving Total Cookie Protection, tracker blocking, and query parameter stripping into the default state changes who is covered from the informed minority to everyone who installs the browser.

The pattern is general. A control fails wherever its enforcement is separated from the point where the behavior executes and made optional for the party it restrains. This is true whether the restrained party is a tracking script or a user who never opened settings. Location and default are not implementation details. They determine whether the control does work or only describes intent.

Read the Firefox changes against that pattern and each one maps to the same move. Total Cookie Protection stops asking which cookies to permit and partitions storage by top level site, so the cross site read fails at the layer where state is stored rather than at a prompt the user must configure. Query parameter stripping removes the identifier before the request leaves the browser rather than trusting the destination not to read it. Redirect and bounce tracking protection purges state set by navigation intermediaries rather than classifying those domains by reputation. In every case enforcement moved to the point of execution and stopped depending on a decision from the user or good faith from the tracker. The mechanism is identical across the features because the failure it corrects was identical.

The same reading exposes where protection still has limits, and stating it is part of the discipline. A blocklist is category based, so it is only current against domains already on the list, and a domain not yet listed is not confirmed to be blocked. Fingerprinting protection reduces the uniqueness of readable attributes and blocks suspected sources, which narrows the surface rather than eliminating it. These are enforcement improvements, not guarantees, and treating a reduced attack surface as a closed one repeats the original error in a smaller form. The pattern that condemns opt out models also forbids overstating what enforcement by isolation removes.

The operator position is that the browser is the enforcement point between you and the tracking apparatus, and enforcement is the only property that decides the outcome. A preference is a stated intention. A control is a behavior the system imposes whether or not anyone cooperates. Private browsing, Do Not Track, and any setting you have to find and enable are preferences. Total Cookie Protection applied by default is a control. The distance between those two words is the distance between believing you are protected and being protected.

What must now be true is that protection is evaluated by its default state and its enforcement point, not by its presence in a feature list. A browser that partitions storage, strips known identifiers, and blocks known trackers without a user touching a setting is doing the work. A browser whose parent company sells the profile that tracking assembles is structurally positioned to define that work down, because the enforcement point and the beneficiary of weak enforcement are the same organization. That is not an accusation. It is the fact stated at the top, and it does not resolve on its own.

Anonymity was never about hiding activity. It is about who holds the ability to link your activity together, and that ability lives or dies at the boundary the browser enforces. Firefox matters because it moved that boundary from your configuration into the engine and from asking into isolating. Hang on to the browser that treats the cross site link as the thing to break by default. The one that treats your profile as inventory will always find a reason to leave the link intact.