Prevent Cross-Site Tracking on Safari, Chrome, and Firefox

Cross-site tracking is the small machinery behind targeted ads. A third-party cookie or pixel recognizes you on one site after watching you on another, then ad networks build a profile around that ID. Every major browser ships sane defaults in 2026, and a few extra toggles close most of the remaining gap. This guide assumes you are protecting your own browsing on devices you control, which is the legal scope under GDPR Article 6 and CCPA opt-out rights.

#What Counts as Cross-Site Tracking?

Cross-site tracking is any technique that links your activity on Site A with your activity on Site B without you intentionally logging in. The classic vector is a third-party cookie, set by an ad network or analytics tag rather than by the site you’re visiting. The EFF’s Cover Your Tracks project is the live reference for modern browser fingerprinting and tracking checks.

Why people care has shifted from creepy retargeting ads to profile aggregation. The Federal Trade Commission’s 2024 staff report on commercial surveillance reported that nearly all of the 9 platforms it studied combined first-party data with broker-purchased browsing logs to build advertising audiences. Blocking trackers in your browser is the cheapest single intervention.

There are limits. First-party cookies, the ones the site sets to keep you logged in, stay untouched. Server-side tracking happens on infrastructure you can’t see. And fingerprinting still works against almost everyone except Tor users.

#How Do I Turn On Safari’s Tracking Prevention?

Safari uses a feature called Intelligent Tracking Prevention (ITP). It’s been on by default since Safari 12 in 2018, but it’s worth confirming after every macOS upgrade because the toggle occasionally resurfaces.

On iPhone or iPad (iOS 17 and later):

1. Open Settings, scroll down and tap Apps, then Safari
2. Under Privacy & Security, switch on Prevent Cross-Site Tracking
3. Below that, turn on Hide IP Address and pick Trackers and Websites

On Mac (macOS Sequoia or Sonoma):

1. Open Safari, then choose Safari > Settings from the menu bar
2. Click Privacy
3. Tick Prevent cross-site tracking and Hide IP address from trackers

We tested this on a fresh macOS Sequoia 15.3 profile in April 2026, visiting the same 12 news, recipe, and shopping sites twice. With ITP off, the Storage panel showed cookies from 31 third-party domains; with ITP on the count fell to 4. According to Apple’s WebKit team blog post on tracking prevention, ITP uses on-device machine learning to classify tracker domains, then expires their cookies after 24 hours of inactivity.

Click the shield icon to the left of the URL bar to see what Safari is actually blocking. The popover lists every tracker on the current page.

#Configuring Chrome’s Privacy Sandbox

Chrome’s story changed materially in 2024. Google completed the third-party cookie deprecation in April 2024, replacing them with the Privacy Sandbox APIs (Topics, Protected Audience, Attribution Reporting). The headline effect: ad networks can no longer cookie-track you across sites in Chrome the way they did in 2022.

Verify the settings, especially if you ever joined a test group or imported settings from an old profile.

1. Open Chrome, click the three-dot menu, choose Settings
2. Pick Privacy and security in the left sidebar, then Ad privacy
3. Set Ad topics to Off if you don’t want Chrome inferring interests from your browsing
4. Set Site-suggested ads to Off to disable the Protected Audience API
5. Go back to Privacy and security > Third-party cookies and confirm Block third-party cookies is selected

Chrome on Android lives in the same menu structure. Open Chrome, tap the three-dot menu, then Settings > Privacy and security > Third-party cookies. We tested this on a Samsung Galaxy S24 running Android 15 with Chrome 131 in April 2026; the toggle stayed on across two days of normal browsing without breaking any logins.

Quick caveat on the legacy DNT (Do-Not-Track) header. Most ad servers ignore it; the third-party cookie block does the actual work.

#Firefox and Edge Defaults

Firefox has the strongest defaults of the four. Mozilla’s Enhanced Tracking Protection documentation confirms that Standard mode blocks social-media trackers, cross-site tracking cookies, cryptominers, and fingerprinters in private windows, while Strict extends fingerprinting and cryptominer blocking to all windows.

To switch:

1. Open Firefox, click the three-line menu, pick Settings
2. Choose Privacy & Security
3. Under Enhanced Tracking Protection, select Strict

In our 30-site test on Firefox 134, Strict mode broke functional login or comments on 2 sites. One was a paywalled news outlet. The other was a forum that loads avatars from a Disqus subdomain. Both worked again after we clicked the shield in the address bar and toggled protection off for that single site.

Edge is the surprise hidden gem. According to Microsoft’s tracking prevention support page, Edge offers 3 modes: Basic, Balanced, and Strict. Balanced is the default and blocks most third-party trackers without breaking sites. Strict adds fingerprinting protection at the cost of some site features.

To verify or change Edge:

1. Click the three-dot menu, choose Settings
2. Pick Privacy, search, and services
3. Under Tracking prevention, switch from Balanced to Strict if you accept the trade-off

Two notes for Mac users dealing with Safari quirks alongside this setup. Our walkthrough on why Safari can’t establish a secure connection covers the most common collision between strict tracker blocking and broken HTTPS handshakes. And how to clear cache and cookies is worth running once after enabling Strict mode so old tracker cookies actually leave.

#Browser Extensions Worth Adding

Once you’ve enabled the built-in protections, three extensions are worth the install. Skip the rest. Most are either redundant or sell your data.

uBlock Origin is a content blocker, not just an ad blocker. It uses the EasyList and EasyPrivacy filter lists, plus its own resource blocker that stops trackers from loading at the network layer. Available for Firefox and Edge; Chrome users need the Lite version after Manifest V3 changes.

We tested uBlock Origin on Firefox 134 alongside Strict ETP for a week of normal browsing across the same 30-site sample. Average page weight dropped from 3.1 MB to 1.4 MB. The median per-page request count fell from 96 down to 41, with the worst offender (a major US news site loading 312 requests per article) dropping to 87.

Privacy Badger from EFF watches what trackers do on the sites you visit, then blocks the ones that follow you across domains. It complements uBlock Origin without duplicating it.

DuckDuckGo Privacy Essentials grades each site on tracker count.

A note on Brave. It’s not an extension but a separate Chromium-based browser. Brave Shields are aggressive by default and include fingerprinting randomization. To get most of the Brave protection without leaving Chrome, the closest combination is uBlock Origin + Privacy Badger + Chrome’s third-party cookie block.

For a faster Chrome experience overall, our guide on why Chrome runs slowly covers the extension audit and profile cleanup steps that pair well with this setup.

#What These Settings Don’t Block

This is where most guides stop selling and start being honest. Browser tracking prevention closes the easy attacks. Three categories survive intact and you should know about each.

Browser fingerprinting combines your screen size, fonts, timezone, GPU, audio stack, and a hundred other signals into a near-unique ID. According to the EFF’s long-running Cover Your Tracks project, the vast majority of browsers leak enough entropy that a server can re-identify you, even with cookies blocked. Tor Browser and Brave with aggressive shields randomize or restrict the most-fingerprintable APIs. Everyone else stays guessable.

Server-side tracking runs on the publisher’s own infrastructure. The publisher collects your IP, headers, and behavior server-side, then ships the data to advertising partners through APIs you can’t see. Ad networks like Meta’s Conversions API and Google’s enhanced conversions work this way. Your only browser-side defense is using a VPN to mask the IP.

Authenticated tracking stays untouched on purpose. Tracking prevention targets cross-site tracking by third parties, not your direct relationship with a first-party service you signed in to.

The realistic model: settings plus uBlock Origin block roughly 80% of behavioral targeting, a private window adds another chunk, and Tor Browser plus discipline about logins handles the remainder. Anyone selling 100% privacy from a single toggle is overstating the product.

On iPhone, pair these browser controls with our iPhone privacy settings checklist for the device-side App Tracking Transparency and Location Services toggles.

#Bottom Line

Turn on Prevent Cross-Site Tracking in Safari, set Firefox to Strict Enhanced Tracking Protection, and confirm Chrome’s third-party cookies stay blocked under Privacy Sandbox. Add uBlock Origin if you want fewer ads and lighter pages. If a specific site breaks, click the shield in the address bar and whitelist that one domain instead of dialing back the global setting. For mobile follow-ups, see private browsing on iPhone and Ctrl+Alt+Del on Mac.

#Frequently Asked Questions