To protect your privacy online, close the channels that track you and reclaim the data already collected: block third-party cookies and fingerprinting in your browser, send Global Privacy Control, encrypt DNS, deny apps your advertising ID, run each account's privacy checkup, sign up with email aliases, and ask data brokers to delete your records.
Privacy is a different problem from security. Security keeps criminals out of your accounts and devices; privacy limits what legitimate companies collect about you, combine and sell. A fully patched laptop with strong passwords can still report every page you read to an ad network. This guide explains how tracking works, then goes through the settings that limit it in browsers, on the network, on phones and in your accounts, and the legal rights that make data brokers delete what they hold. For the security side, start with our guide to staying safe online; social media settings have their own guide, and keeping devices patched is covered in how to update your computer or phone.
How online tracking works
Tracking means recognizing the same person, browser or device across visits, sites and apps, and linking what they do into a profile. The FTC's consumer guide to online tracking names the main techniques: cookies and pixels, device fingerprinting, and advertising identifiers on phones. Each needs a different defence, which is why no single setting fixes privacy.
Cookies and third-party tracking
A cookie is a small file a website stores in your browser so it can recognize you on the next visit. When the site you are on sets it, that is first-party tracking, and it is how you stay signed in. When the site lets another company's code load and set its own cookie, that is third-party tracking: the same ad or analytics company, embedded on many sites, sees you arrive on each of them and can join the visits into one history. A tracking pixel does the same job without a cookie of its own: it is a tiny, invisible image loaded from the tracker's server, and the request for it announces your visit.
Browser fingerprinting
Fingerprinting skips storage entirely. A script reads details your browser exposes to every site, such as screen dimensions, the number of processor cores, the list of installed speech voices and the way your device draws graphics and processes audio (the list Safari 26 now keeps from known fingerprinting scripts), and combines them into an identifier that few other browsers share and that stays the same on every site. The W3C's guidance on fingerprinting explains why this matters: a fingerprint typically cannot be cleared or reset, and clearing cookies or using a VPN does not stop the correlation. It is not a fringe technique either. From February 16, 2025, Google stopped prohibiting advertisers that use its ad products from fingerprinting, a change the UK Information Commissioner's Office answered with a warning that fingerprinting must still be lawful and transparent.
Tracking pixels in email
Marketing email carries the same pixel. When your mail app loads the images in a message, the request for the invisible one tells the sender that you opened it, when, and from which IP address, which gives away your approximate location. Gmail's help pages say Gmail processes images so that senders cannot use image loading to learn about your computer or location, but add that senders may still know whether you opened a message. Apple's Mail Privacy Protection goes further: it hides your IP address and stops senders seeing whether you opened the message, though it does not cover links or attachments.
Advertising IDs in apps
Phones give apps an advertising identifier: the IDFA on iPhone and iPad, and the advertising ID from Google Play services on Android. Because every app on the device can read the same value, advertisers can use it to follow you from app to app, as the FTC guide describes. Both systems let you refuse or remove it, as the phone section below shows.
Data brokers
Data brokers sit at the end of all this: companies that collect information about you and sell or share it. People-search sites, one kind of broker, show how it works. They buy data from other brokers, collect public social media profiles and compile government records such as property, voter registration, court and licensing records, then sell reports to anyone who pays. A name or a phone number is enough to buy one listing your age, current and past addresses, relatives, education and employment history.
Where Chrome stands on third-party cookies in 2026
Chrome is not phasing them out. Google announced its Privacy Sandbox initiative in 2019, and changing how Chrome treats third-party cookies was part of it. On April 22, 2025, Google changed course: Chrome would keep its current approach of letting users choose, would not roll out a new standalone prompt, and would add protections to Incognito mode, which already blocks third-party cookies by default. On October 17, 2025, Google retired most of the Privacy Sandbox technologies, including the Topics and Protected Audience advertising APIs and IP Protection, an Incognito feature it had planned to launch in the third quarter of 2025. Google's feature status page, last updated in August 2026, lists IP Protection and a proposed script-blocking defence against re-identification as scheduled for phase-out.
The practical result: in a normal Chrome window, third-party cookies stay available until you block them yourself. The Chrome help page puts the switch at Settings > Privacy and security > Third-party cookies > Block third-party cookies. If a site you trust breaks, add it to the exceptions list on the same page rather than turning blocking off everywhere.
Set your browser to block tracking
Your browser is where most tracking happens, and the defaults differ more than most people expect.
| Browser | Blocked by default | What to change |
|---|---|---|
| Firefox | Social media trackers, cross-site tracking cookies, fingerprinters, cryptominers; other cookies kept per site | Strict mode blocks tracking content and all cross-site cookies |
| Safari | Cross-site tracking data, your IP address from known trackers, device details that feed fingerprints | Confirm Prevent cross-site tracking is on; iCloud+ can hide your IP too |
| Chrome | Third-party cookies in Incognito only | Block third-party cookies; choose a secure DNS provider |
Firefox ships Enhanced Tracking Protection in Standard mode. It blocks social media trackers, cross-site tracking cookies, fingerprinters and cryptominers from Disconnect's list of known trackers, and its Total Cookie Protection confines every other cookie to the site that created it. Tracking content hidden in ads and embedded videos is blocked only in private windows, unless you switch to Strict, which also blocks all cross-site cookies and adds bounce tracking protection. Strict can break embedded logins, forms, payments, comments and videos; when a site misbehaves, click the shield in the address bar and turn protection off for that site only. Type about:protections in the address bar to see what Firefox blocked over the past week.
Safari limits third-party cookies and data by default and hides your IP address from known trackers; for iCloud+ subscribers it hides the address from websites as well. Against fingerprinting, Safari presents a simplified version of your system configuration so your Mac looks more like everyone else's, and since Safari 26.0, released in September 2025, known fingerprinting scripts are also blocked from reading device characteristics and from setting long-lived cookies. On a Mac, check Safari > Settings > Privacy > Prevent cross-site tracking; on an iPhone, the same switches are in Settings > Apps > Safari.
Chrome needs the most changes: block third-party cookies as described above, and set a secure DNS provider as described in the next section.
Note
Private browsing is not tracking protection. It deletes your browsing history when you end the session, but, as the FTC points out, it does not stop websites from seeing what you do while it is open.
Turn on Global Privacy Control
Global Privacy Control (GPC) is a signal your browser sends to every site, asking it not to sell or share your personal data. Under California's privacy law it is more than a courtesy: the California Attorney General says covered businesses must honour it as a valid request to stop selling or sharing your personal information. Mozilla notes that GPC also works as a "Do Not Sell" request in states such as Colorado and Connecticut, and may be read as an opt-out of targeted advertising in other places, including the EU and the UK. Elsewhere, sites may ignore it.
The GPC project lists Brave and DuckDuckGo, where the signal is on by default, and Firefox, where it is a setting: Settings > Privacy and security > Tell websites not to sell or share my data, available since Firefox 120. Firefox removed its older Do Not Track option in version 135. For other browsers, the same site lists extensions that send the signal, such as EFF's Privacy Badger. That gap is closing by law: California's AB 566, signed on October 8, 2025, requires any browser a business develops or maintains to include a setting that sends an opt-out preference signal from January 1, 2027.
Encrypt your DNS lookups
Before your browser connects to a site, it looks up the site's IP address with the Domain Name System (DNS). Traditionally that lookup travels in plain text, so your internet provider, the Wi-Fi operator and anyone else on the same network can read the list of sites you visit. DNS over HTTPS (DoH), standardized as RFC 8484 in October 2018, sends the same lookups inside an encrypted HTTPS connection; DNS over TLS (DoT) does it over a dedicated TLS connection.
- Firefox: DoH is on by default for desktop users in the United States (since 2019) and Canada (since 2021), in a fallback mode. Elsewhere, or to pick your own provider, turn it on in Firefox's DNS over HTTPS settings.
- Chrome: secure DNS is on by default in an automatic mode that falls back to unencrypted lookups when it has trouble. Choose a custom provider under Settings > Privacy and security > Security > Use secure DNS, and Chrome no longer falls back.
- Android: the Private DNS setting, added in Android P, upgrades to DNS over TLS automatically when the network's DNS server supports it. Enter a provider's host name to require it for every app that uses the system's DNS.
Know what this does not do. Encrypted DNS moves your lookups from your internet provider to the resolver you chose, which can still see them; Mozilla binds its DoH partners to a policy that forbids collecting personally identifying information. It also bypasses DNS-based parental controls and malware filtering, which is why Firefox checks for them and stays off when it finds them. And your provider still sees the IP addresses you connect to, plus the site name that travels in plain text at the start of the TLS handshake (the Server Name Indication), unless the site supports Encrypted Client Hello, published as RFC 9849 in March 2026 and supported in Firefox since version 118.
What a VPN hides, and what it does not
A consumer VPN encrypts everything between your device and the VPN provider, and the provider forwards your traffic so that it appears to come from the provider's network. That hides your browsing from the café Wi-Fi and your internet provider, and your IP address from the sites you visit. It does not stop cookies or pixels, which work inside your browser, and the W3C notes that it does not stop fingerprinting either; it does nothing about accounts you are signed in to; and it moves the view your internet provider had to the VPN provider, so the choice of provider is a privacy decision in itself. For privacy, a VPN is one layer on top of the browser settings above, not a substitute for them; if you decide to use one, setting up a VPN covers choosing a provider and each device.
Stop apps on your phone from tracking you
iPhone and iPad
Since iOS 14.5 and iPadOS 14.5, App Tracking Transparency makes apps ask before tracking you across other companies' apps and websites. Tap Ask App Not to Track and the app cannot read the advertising identifier (IDFA), and is not permitted to track you with other identifiers such as your email address; the app keeps working fully either way. To stop the prompts altogether, turn off Allow Apps to Request to Track in Settings > Privacy & Security > Tracking, and every app is treated as if you had said no.
Then work through four more settings:
- Location. In Settings > Privacy & Security > Location Services, open each app. Set occasional apps to Ask Next Time, and turn Precise Location off wherever an approximate location is enough, such as weather.
- Apple's own ads. In Settings > Privacy & Security > Apple Advertising, turn off Personalized Ads, which Apple uses in the App Store, Apple News and Stocks. The same screen shows the information Apple may use to target ads to you.
- Mail. In Settings > Apps > Mail > Privacy Protection, turn on Protect Mail Activity.
- Safari. In Settings > Apps > Safari, keep Prevent Cross-Site Tracking and Hide IP address on.
Android
Android's advertising ID can be reset or deleted. Go to Settings > Privacy > Ads and tap Delete advertising ID; apps that ask for it then receive a string of zeros instead of the identifier. On Android 12 and later, the privacy dashboard (Settings > Security and privacy, or Privacy, then Privacy dashboard) shows which apps used which permissions and when, over the last 24 hours on Android 12 and the last 7 days on Android 13 and later, and lets you change permissions for the camera, microphone, calendar and more. For location, choose Allow only while using the app or Ask every time instead of Allow all the time, and share a precise location only with apps that need one, such as maps.
Run a privacy checkup on your main accounts
The platforms you are signed in to keep some of the most detailed records about you: searches, places, videos watched and purchases. Each has a review tool, and Google's can send you regular reminders to repeat it.
- Google. Privacy Checkup walks through what is saved to your account, what you share publicly and the kinds of ads you see. Then turn on auto-delete under Data & privacy > History settings for each activity setting, such as Web & App Activity and YouTube History. Google already removes location details and your IP address from Web & App Activity after 30 days.
- Microsoft. The privacy dashboard described in the Microsoft Privacy Statement lets you view and clear the Bing search history and Copilot activity tied to your Microsoft account. The statement also links a Personalized ads and offers page; opting out there while signed in applies across your devices.
- Apple. On Apple's Data & Privacy page you can request a copy of the data associated with your Apple Account, where the feature is available in your country, and see what Apple stores about you.
- Meta. Facebook's Privacy Checkup (Settings and privacy > Privacy Checkup) covers who can look you up by phone number or email address, which outside apps and websites you logged in to with Facebook, and which profile details advertisers can use to reach you. Post audiences and other social settings are covered in our social media guide.
Stop handing out your real email address and phone number
An email address or a phone number is enough to join records held by different companies. Apple's tracking rules name the email address as an identifier apps may not use to track you without permission, and the FTC notes that a phone number alone can buy a people-search report. An email alias breaks that link: each service gets its own forwarding address, so a leak or a sale points back to one alias you can switch off.
| Service | What you get | Keep in mind |
|---|---|---|
| Hide My Email | Unique random addresses that forward to your inbox, for forms and newsletters | Part of an iCloud+ subscription |
| Firefox Relay | Five free email masks with email tracker removal; unlimited masks and a phone mask on paid plans | Paid plans are sold in a listed set of countries |
| DuckDuckGo Email Protection | Free, unlimited private addresses; removes hidden email trackers | Forwards to the inbox you already use |
Keep your real address for your bank, your doctor and anything that needs an identity check: the Firefox Relay FAQ recommends exactly that, and some sites refuse masked addresses. For mail already arriving, stop pixels loading. In Gmail, open Settings > See all settings, and under Images choose Ask before displaying external images; in Apple Mail, turn on Protect Mail Activity as described above.
Remove your information from data brokers
Opt out of people-search sites
The FTC's advice is to work through them one at a time:
- Search a people-search site for your name, phone number or address.
- If a report about you appears, find the site's opt-out link or instructions and follow them. If there is none, search the site's name with "opt out" or "remove my information".
- Repeat on the other sites.
- Check again periodically, and send a new opt-out when your details come back.
Paid removal services do the same work for you. Before you sign up, ask how many sites they cover, whether they report which ones they opted you out of, and how often they rescan.
Warning
An opt-out stops a site selling what it has today, not forever. Your details can reappear when public records change, can still show up in the reports of relatives and neighbours, and remain in the government records themselves. Expect to give some personal information to verify each request.
Use your legal rights
Where the law gives you a right to deletion, you can make a company erase your record instead of only hiding it.
| Where you live | Law | What you can demand | Deadline |
|---|---|---|---|
| EU and EEA | GDPR | A copy of your data (Article 15), erasure on listed grounds (Article 17), an end to direct marketing (Article 21) | One month, extendable by two months for complex requests |
| California | CCPA and the Delete Act | Deletion, an opt-out of sale and sharing (GPC counts), one deletion request to every registered broker | Brokers process DROP requests at least every 45 days |
| Canada | PIPEDA; Alberta, British Columbia and Quebec have their own laws | Access and correction; withdrawal of consent | Access requests answered within 30 days, extendable by 30 |
In the EU, the GDPR's right to erasure (Article 17) obliges a company to delete your data without undue delay when one of the listed grounds applies: the data is no longer needed, you withdraw consent and there is no other legal basis, you object and there are no overriding legitimate grounds, or it was processed unlawfully. Marketing is simpler: once you object to processing for direct marketing under Article 21, it must stop. The company has to tell you what it did within one month of your request. The UK has an equivalent right, and the ICO publishes a template letter you can adapt.
In California, the CCPA gives you a right to delete and a right to opt out of the sale or sharing of your data, and the Delete Act goes further against brokers. SB 362, signed on October 10, 2023, required the state's privacy agency to build one deletion mechanism for every registered broker. That mechanism, the Delete Request and Opt-out Platform (DROP), opened to California residents on January 1, 2026. It is free, and one request reaches more than 600 registered data brokers. From August 1, 2026, brokers must check DROP at least once every 45 days, process the requests and keep deleting new data about you on the same cycle; the agency says it can take up to 90 days for status updates to appear.
In Canada, the federal private-sector law is still PIPEDA. It gives you the right to access and correct what an organization holds about you, with a reply due within 30 days, and you can withdraw consent at any time, subject to legal or contractual limits. Organizations must destroy, erase or anonymize information they no longer need, but PIPEDA has no stand-alone right to erasure like the GDPR's Article 17. Alberta, British Columbia and Quebec have their own private-sector laws. Reform is slow: Bill C-27, which would have enacted a new Consumer Privacy Protection Act, was still in committee when that session of Parliament ended on January 6, 2025. Its successor, Bill C-36, had its first reading on June 15, 2026 and, as of September 2026, has not passed.
Your online privacy checklist
| Area | Do this | Where |
|---|---|---|
| Browser | Block third-party cookies and known trackers | Chrome: Privacy and security > Third-party cookies; Firefox: Enhanced Tracking Protection |
| Browser | Send Global Privacy Control | Firefox: Tell websites not to sell or share my data; Brave and DuckDuckGo: on already |
| Network | Encrypt DNS | Chrome: Use secure DNS; Firefox: DNS over HTTPS; Android: Private DNS |
| Stop tracking pixels | Apple Mail: Protect Mail Activity; Gmail: Ask before displaying external images | |
| iPhone, iPad | Refuse tracking, trim location, turn off personalized ads | Settings > Privacy & Security > Tracking, Location Services, Apple Advertising |
| Android | Delete the advertising ID, review permissions | Settings > Privacy > Ads; Privacy dashboard |
| Accounts | Run the checkups, set history to auto-delete | Google Privacy Checkup; Microsoft privacy dashboard; Facebook Privacy Checkup |
| Sign-ups | Use an alias instead of your real address | Hide My Email, Firefox Relay or DuckDuckGo Email Protection |
| Data brokers | Opt out, or request deletion where the law allows | People-search opt-out pages; DROP in California; a GDPR Article 17 request in the EU |
If you run a website, the other half of this problem is yours: every tracker you embed follows your visitors to the next site. Our web design and development team builds sites with privacy-respecting analytics, security headers and a strict Content Security Policy, and our security testing service checks the TLS, HSTS and security headers of the sites you expose.
