Tracking Prevention: the Layered Defense Model

Most tracking-prevention advice is a list of apps with no model behind it. Here is the model: tracking happens at distinct layers, and each defense only covers some of them. Stacking layers is what works — no single tool is enough.

68.3% of pages fire at least one request to a known tracker 10,732,563 / 15,707,041 pages

6 third-party domains contacted by the median page p90: 15 · p99: 66

125 third-party requests on a p90 page load median: 24

79.8% of pages talk to a domain owned by Google alone 12,536,065 pages

Not a survey of what sites admit to — a measurement of what actually loaded, across 15.7M real pages. The median page contacts six separate companies before you have read a sentence.

Our data The State of Web Tracking — our own measurement of the June 2026 HTTP Archive crawl Full arithmetic and queries at /methodology.

What is being collected

Three things get collected about you as you browse: identifiers (cookies, device fingerprints, login state) that link your visits together; behavior (pages, clicks, scrolls, time, sometimes full session recordings); and context (IP address, location, referrer, the ads you saw). Advertising and data-broker systems join these across sites into a profile. Analytics tools collect a subset of the same data — the difference is mostly purpose and who keeps it.

The five layers

1. Browser engine. Your browser’s built-in tracking prevention decides whether third-party cookies load, whether storage is partitioned per-site, and whether referrers and URL parameters are stripped. This is the highest-leverage layer and it is free — see the per-browser guides.
2. Extensions. Content blockers (uBlock Origin), tracker blockers (Privacy Badger), and consent/URL cleaners stop requests the engine allows. They cover the long tail the browser misses.
3. Network / DNS. A blocking DNS resolver (Pi-hole, AdGuard Home, NextDNS) refuses to resolve known tracker and ad domains for every device on your network, including phones and TVs that can’t run extensions.
4. Transport (VPN / proxy). A VPN hides your IP and location from sites and from your ISP. It does not stop cookies, fingerprinting, or login-based tracking — a common and expensive misunderstanding.
5. Behavior & policy signals. Logging out, using separate profiles/containers, rejecting consent, and sending the Global Privacy Control signal change what you are legally and technically opting out of.

Layer	Third-party cookies	Tracker requests	Fingerprinting	IP / location	Server-side collection
1 · Browser engine Safari ITP, Firefox TCP, Brave Shields	● Stops it	◐ Raises cost	◐ Raises cost	○ No effect	○ No effect
2 · Extensions uBlock Origin, Privacy Badger	● Stops it	● Stops it	◐ Raises cost	○ No effect	○ No effect
3 · Network / DNS Pi-hole, AdGuard Home, NextDNS	◐ Raises cost	● Stops it	○ No effect	○ No effect	○ No effect
4 · VPN / proxy the layer most people overrate	○ No effect	○ No effect	○ No effect	● Stops it	○ No effect
5 · Behavior & signals log out, containers, GPC, reject consent	◐ Raises cost	○ No effect	○ No effect	○ No effect	◐ Raises cost

●Stops it◐Raises cost○No effect

Read down a column to see which layers stop a given technique. Only the last column — data your browser never sees because the site's own server sends it — has no row that stops it, which is why auditing what a site sends is a separate discipline from blocking.

Source webtracking.org analysis of documented browser, extension, and resolver behavior A defense counts as “stops it” only in its default or commonly-recommended configuration, not a hardened edge case.

What you can and cannot win

You can largely defeat third-party cookie tracking and most ad/tracker network requests with layers 1–3. You can substantially raise the cost of fingerprinting (Brave and the Tor Browser do this best) but not eliminate it. You cannot technically block server-side tracking — when a site sends your data to an analytics or ad vendor from its own servers (server-side tagging, Meta’s Conversions API), nothing in your browser sees it. That is exactly why auditing what a site sends matters: tools like ad.rip inspect the collection a site performs, including the parts a blocker can’t reach.

Layer 1 is where the browsers diverge — and Chrome is now the outlier

Browser	3rd-party cookies blocked or partitioned	Known trackers blocked	Fingerprinting defenses
Brave Shields on by default	● Yes	● Yes	● Yes
Safari full 3rd-party cookie blocking since 2020	● Yes	● Yes	◐ Partial
Firefox Total Cookie Protection — a cookie jar per site	● Yes	● Yes	◐ Partial
Edge “Balanced” blocks trackers from unvisited sites	○ No	◐ Partial	◐ Partial
Chrome Privacy Sandbox retired Oct 2025; defaults unchanged	○ No	○ No	○ No

●Yes◐Partial○No

Safari has blocked third-party cookies outright since 2020; Firefox gives every site its own cookie jar, so a third-party cookie set on one site cannot be read on another. Google abandoned third-party cookie deprecation in 2024, dropped the replacement prompt in 2025, and retired most of the Privacy Sandbox APIs in October 2025 — leaving Chrome's default where it was a decade ago. Your choice of browser is the single highest-leverage privacy decision you make.

Source Vendor documentation — WebKit ITP, Mozilla Total Cookie Protection, Brave Shields, Microsoft Edge tracking prevention Privacy Sandbox retirement: Google, October 2025. States reflect out-of-the-box defaults, not the strictest available setting.

Why fingerprinting is the layer you cannot close

• EFF Panopticlick — browsers with Flash or Java 94.2%
  2010 · n = 470,161 · self-selected, privacy-interested visitors
• EFF Panopticlick — all browsers measured 83.6%
  2010 · the widely-quoted figure
• Berke et al. — US panel study 60.0%
  Dec 2023 · n = 8,400 · Prolific panel, skewed younger and more technical

Two studies, thirteen years apart, both finding that a majority of browsers are unique on their measurable attributes alone. The numbers are not directly comparable — the 2010 figure came from self-selected, privacy-interested visitors, and the 2023 figure from a paid US panel that still skewed young and technical — and both research teams said so. The honest reading is the direction, not the decimal: blocking cookies does not make you anonymous.

Source Eckersley, “How Unique Is Your Web Browser?” (EFF/PETS 2010); Berke et al., “How Unique is Whose Web Browser?” (2024) Both papers explicitly caution that their samples are not representative of the general population.

The 2023 study adds an uncomfortable finding the headline number hides: fingerprinting risk rose with age, and users in lower-income groups were more identifiable than higher-income ones. The people least likely to be told any of this are the most exposed to it.

Start here

If you do only three things: switch to a privacy-respecting browser and set tracking protection to strict (layer 1), install uBlock Origin (layer 2), and enable Global Privacy Control (layer 5). Then add a blocking DNS resolver for your whole network. The per-topic guides below cover each layer in detail.