Tracking Prevention: the Layered Defense Model

Most tracking-prevention advice is a list of apps with no model behind it. Here is the model: tracking happens at distinct layers, and each defense only covers some of them. Stacking layers is what works — no single tool is enough.

What is being collected

Three things get collected about you as you browse: identifiers (cookies, device fingerprints, login state) that link your visits together; behavior (pages, clicks, scrolls, time, sometimes full session recordings); and context (IP address, location, referrer, the ads you saw). Advertising and data-broker systems join these across sites into a profile. Analytics tools collect a subset of the same data — the difference is mostly purpose and who keeps it.

The five layers

1. Browser engine. Your browser’s built-in tracking prevention decides whether third-party cookies load, whether storage is partitioned per-site, and whether referrers and URL parameters are stripped. This is the highest-leverage layer and it is free — see the per-browser guides.
2. Extensions. Content blockers (uBlock Origin), tracker blockers (Privacy Badger), and consent/URL cleaners stop requests the engine allows. They cover the long tail the browser misses.
3. Network / DNS. A blocking DNS resolver (Pi-hole, AdGuard Home, NextDNS) refuses to resolve known tracker and ad domains for every device on your network, including phones and TVs that can’t run extensions.
4. Transport (VPN / proxy). A VPN hides your IP and location from sites and from your ISP. It does not stop cookies, fingerprinting, or login-based tracking — a common and expensive misunderstanding.
5. Behavior & policy signals. Logging out, using separate profiles/containers, rejecting consent, and sending the Global Privacy Control signal change what you are legally and technically opting out of.

What you can and cannot win

You can largely defeat third-party cookie tracking and most ad/tracker network requests with layers 1–3. You can substantially raise the cost of fingerprinting (Brave and the Tor Browser do this best) but not eliminate it. You cannot technically block server-side tracking — when a site sends your data to an analytics or ad vendor from its own servers (server-side tagging, Meta’s Conversions API), nothing in your browser sees it. That is exactly why auditing what a site sends matters: tools like ad.rip inspect the collection a site performs, including the parts a blocker can’t reach.

Start here

If you do only three things: switch to a privacy-respecting browser and set tracking protection to strict (layer 1), install uBlock Origin (layer 2), and enable Global Privacy Control (layer 5). Then add a blocking DNS resolver for your whole network. The per-topic guides below cover each layer in detail.