Cookie Blockers Won't Save You — Your Email Address Is the Real Tracking Vector

Cookie Blockers Won't Save You — Your Email Address Is the Real Tracking Vector

Most privacy discussions in tech circles focus on cookies, fingerprinting, and IP leaks. Meanwhile, one of the most durable tracking identifiers gets almost no attention: the email address.

Ad platforms like Google, Meta, and LinkedIn support server-side matching — a business uploads a hashed customer email list, and the platform matches it against its own user profiles. This handshake happens server-to-server, completely outside the browser. No cookie blocker, VPN, or tracker-prevention extension can see it, let alone stop it.

Brave Browser shipped a practical fix for this in v1.94: native Email Aliases.

How it works, technically:

• Users authenticate via a Brave Account using OPAQUE (RFC 9807) — a password-authenticated key exchange protocol where the password is never transmitted to the server, not even hashed
• Client and server derive shared authentication material via an oblivious pseudorandom function
• Aliases + primary address are encrypted at rest
• Forwarded mail is scanned for spam/malware only, then deleted from Brave's servers within seconds
• Alias notes stay local unless Brave Sync is enabled, in which case they're end-to-end encrypted

From a threat-model standpoint: this doesn't grant anonymity — Brave still knows the alias-to-inbox mapping — but it meaningfully breaks cross-service identity correlation via email, which is a real gap most privacy tooling ignores entirely.

Limitations worth flagging: desktop-only at launch, 5 free aliases per account, and early deliverability issues while Brave builds sender reputation.

I wrote a full breakdown covering the OPAQUE architecture, a real-world tracking scenario, and safe usage practices here:

https://www.xpert4cyber.com/2026/08/brave-browser-email-aliases-privacy.html