What browsers do now
Why it matters The same website can track you very differently depending on which browser you open it in. Knowing what your browser does by default tells you which settings are worth changing.
Think of browsers as three different doormen. One turns away the cloakroom company at every door. One lets it in but gives it a fresh ticket book at each shop. One lets it in with the same book everywhere, unless you ask otherwise. All three are doing their job; they just have different house rules.
Facts in this lesson change, so each one is dated. If you read this much later, check the browser's own help pages.
Default: what a browser does if you never open its settings. Most people never change defaults, so defaults decide what most people get.
Safari
Safari's protection is called Intelligent Tracking Prevention (ITP). It blocks third-party cookies by default. It also limits what page scripts write: a cookie created by a script lasts at most 7 days, and other storage a script writes, such as localStorage, is deleted after 7 days of using Safari without interacting with that site. It also caps cookies set through trackers that disguise themselves as part of the site (a trick covered in the pixels module) (checked October 2026).
Firefox
Firefox has had Total Cookie Protection on by default since 2022. It gives every site its own cookie jar, which is the partitioning you saw in the last lesson, applied to all third parties. Firefox also blocks many known trackers outright through its Enhanced Tracking Protection (checked October 2026).
Chrome
Chrome keeps third-party cookies on by default, and has no removal planned. Google retired most of its Privacy Sandbox proposals in 2025, including Topics, Protected Audience, Attribution Reporting, IP Protection and Related Website Sets. CHIPS (the Partitioned attribute) and FedCM, a way to sign in with another account without third-party cookies, remain (checked October 2026).
In Chrome you can block third-party cookies yourself in Settings, under Privacy and security, then Third-party cookies. Incognito windows block them by default (checked October 2026).
Side by side
| Browser | Third-party cookies by default | What you can do |
|---|---|---|
| Safari | Blocked | Keep "Prevent cross-site tracking" switched on |
| Firefox | Partitioned, known trackers blocked | Consider Strict mode for more blocking |
| Chrome | Allowed | Switch on "Block third-party cookies" |
Other browsers built on the same engines often make their own choices; several block third-party cookies by default. Check yours rather than assuming it behaves like its engine.
A common misconception
"If my browser blocks third-party cookies, I cannot be tracked." Blocking cookies removes one method. Link decoration, fingerprinting, logins and other storage remain, which is why the rest of this leg exists.
Recap
- Safari blocks third-party cookies and limits cookies and storage written by scripts to about 7 days (checked October 2026).
- Firefox gives every site its own cookie jar by default, since 2022.
- Chrome allows third-party cookies by default; you can block them in Settings. CHIPS and FedCM remain.
- Cookie blocking is one layer, not the whole defence.
This lesson is locked
Lessons open one at a time. Finish the previous lesson to unlock this one.