Firefox is often called the privacy browser, but the gap between "enabled privacy features" and "actually private browsing" is wider than most users realize. Here's what Firefox does for you automatically, what you have to configure yourself, and where the limits are.
What Firefox Does Automatically (Default Settings)
Enhanced Tracking Protection (Standard mode): Blocks known tracking scripts and social trackers from loading. The Disconnect.me list is updated regularly. This is on by default and requires no configuration.
Total Cookie Protection: Third-party cookies are isolated per site. Amazon's tracker on a news site can't read Amazon cookies from other sessions. Enabled by default since Firefox 86.
Safe Browsing: Firefox checks URLs against Google's Safe Browsing API to warn about known malware sites. Note: this involves sending URL data to Google's servers, anonymized but not zero-disclosure.
HTTPS upgrades: When available, Firefox upgrades HTTP links to HTTPS automatically.
What You Have to Configure Yourself
ETP Strict mode: Settings → Privacy & Security → Enhanced Tracking Protection → Strict. Blocks more trackers but may break some sites. Not on by default because the false positive rate is higher.
DNS-over-HTTPS: Settings → Privacy & Security → DNS over HTTPS. Encrypts DNS queries. Not on by default in all regions.
HTTPS-Only Mode: Settings → Privacy & Security → HTTPS-Only Mode → Enable for all windows. Prevents connecting to any HTTP site without a warning.
Telemetry: Settings → Privacy & Security → Firefox Data Collection and Use → uncheck everything. Firefox collects usage statistics by default. This data is anonymized but it's still data leaving your device.
about:config fingerprinting resistance: privacy.resistFingerprinting → true. Significantly reduces fingerprinting attack surface. Not on by default because it changes some browser behavior.
What Firefox Cannot Do for You
IP address: Your IP is visible to every site you visit. Firefox provides no IP masking without a VPN or Tor.
Fingerprinting at the network level: Even with resistFingerprinting enabled, sophisticated fingerprinting using network timing, TCP/IP characteristics, and HTTP2 behavior can still identify users.
HTTPS doesn't hide the site: HTTPS encrypts the content of requests. Your ISP and anyone watching the network can still see which domains you're connecting to (via DNS queries and TLS SNI).
Logged-in accounts: When you're logged into Google, Facebook, or any account, that service knows exactly what you're doing on their platform regardless of privacy settings.
The Extension Layer
Privacy-focused extensions can add protections beyond Firefox defaults:
- uBlock Origin: Goes beyond ETP by blocking more network requests, including some that ETP misses. The single most effective browser privacy tool.
- Privacy Badger: Adaptive blocking based on observed tracking behavior rather than a static list.
- Multi-Account Containers: Session isolation that prevents sites from tracking you across their entire ad network ecosystem.
The Practical Reality
For most threat models — not wanting your browsing sold to data brokers, not wanting ad targeting based on browsing history — Firefox with default settings plus uBlock Origin provides meaningful protection.
For higher threat models (activism, journalism, avoiding government surveillance): Firefox is a starting point, not an end point. Tor Browser (Firefox ESR-based) with its default configuration addresses more of the remaining gaps.
For zero friction everyday privacy: Firefox defaults are already meaningfully better than Chrome defaults. You don't have to do anything special.
A Note on New Tab Extensions
One frequently overlooked privacy surface: your new tab extension. An extension with <all_urls> permission running on every page you visit is a significant privacy risk if it's malicious.
New tab extensions that only run on the new tab page (not on every website) have a much smaller attack surface. Weather & Clock Dashboard runs only on new tabs, uses only tabs + optional location permission, and is MIT open source. That's the permission model worth looking for in any new tab tool.
Top comments (0)