Why the browser is a good place to start
Your browser is the program that sits between you and nearly every website. It stores history, cookies, saved passwords and form entries, and it decides what information to share with sites you visit. Because so much passes through it, a handful of settings can reduce a lot of tracking without much effort.
Menu names differ between Chrome, Firefox, Safari, Edge and others, and they change over time, so this article describes what each setting does rather than exact click paths. Look in the browser’s Settings page for a section called Privacy, Privacy and security, or similar, and use the search box inside Settings if you cannot find an item.
Cookie controls
Cookies are small files that sites store in your browser. Some keep you signed in or remember a shopping basket. Others, set by third parties, help follow you from site to site. The difference is explained in the article on tracking cookies.
Common options include:
- Block third-party cookies. This is the single most useful switch for many people. Some browsers do it by default, others offer it as an option. Occasionally an embedded login, video or payment feature stops working, and you can allow an exception for that one site.
- Clear cookies when the browser closes. This logs you out of most sites each time, which is less convenient but limits long-term tracking. You can usually whitelist sites you want to stay signed in to.
- Review stored cookies. Most browsers let you see which sites have stored data. A long list of unfamiliar names is normal and not necessarily a cause for alarm.
Tracking protection and “Do Not Track”
Many browsers include a tracking protection mode that blocks known tracking scripts and sometimes fingerprinting, a technique that identifies a browser by its combination of settings and fonts. Levels are often labelled standard, strict or custom. Stricter settings block more but can break parts of some pages.
A “Do Not Track” or “Global Privacy Control” signal tells sites you prefer not to be tracked. Honouring it is voluntary in many places, so treat it as a request, not a guarantee. It is still usually harmless to switch on.
Site permissions
Websites can ask to use your location, camera, microphone, notifications, clipboard and more. In the permissions section you can set each type to ask, allow or block by default and review which sites already have access.
A good habit is to set notifications to blocked by default, since many sites use them mainly for marketing, and to check the list of sites that can use your camera or microphone. These controls are similar in spirit to the app permissions on a phone, and they matter for location tracking when a site requests your position.
History, downloads and saved data
Browsers keep several different records, and they can be cleared separately.
- Browsing history is the list of pages visited. It is stored locally and also may sync to your account if sync is on.
- Cached files are copies of page elements that speed up reloading. They are not especially sensitive but can take space.
- Download history lists files you fetched, not the files themselves.
- Autofill data includes addresses, phone numbers and payment cards saved for faster forms.
- Saved passwords are stored inside the browser or a separate password manager.
Clearing history does not remove data held by the sites you visited, your internet provider or your employer’s network. It only tidies what is on the device. Many browsers can also delete history automatically after a set time, which is a low-effort way to keep the record short.
Saved passwords and autofill
Browsers can store passwords and card details for convenience. If you do use this feature, make sure your device itself is locked with a strong passcode or biometric, since anyone who can open your browser may be able to fill in your details. A dedicated password manager is often a stronger choice, as it is built specifically to protect stored credentials. Turning off autofill for payment cards is a reasonable step if you share a device.
Sync and account sign-in
Signing in to the browser with an account lets history, bookmarks and passwords follow you across devices, which also means they are stored on the provider’s servers. Check what categories sync and turn off any you do not want. Some browsers allow end-to-end encrypted sync with a separate passphrase, which limits what the provider can read, though you must not forget the passphrase.
Search engine and address bar
Whatever you type in the address bar may be sent to the default search engine, sometimes before you press enter, to power suggestions. You can turn off search suggestions or choose a search engine whose policy you prefer. Different engines keep different amounts of search history, so look at the privacy policies of any you consider.
Extensions
Extensions can add privacy protection, but they can also read the pages you visit, so the permissions they request deserve attention. Install few, choose ones from sources you trust, and remove those you no longer use. The article on the benefits of a browser extension that is secure looks at this more closely.
Keep the browser up to date
Updates close security holes that could otherwise expose stored data, so leave automatic updating on. This follows the same logic as software updates for the rest of your system.
What settings cannot do
Browser settings reduce tracking, but they do not make you anonymous. Your IP address is still visible to the sites you visit, and logging in to an account identifies you regardless of cookie settings. A virtual private network changes what your internet provider and sites see about your connection, but it does not stop an account you sign in to from recognising you. Combine sensible settings with careful sharing, and review them occasionally, because updates sometimes reset defaults.