A closer look at Firefox's Tracking Protection feature
Tracking Protection is a privacy feature of the Firefox web browser designed to block certain unwanted elements on sites visited in the browser.
All Firefox users have options to control Tracking Protection in the web browser; Mozilla announced in June 2019 that Tracking Protection is enabled by default for new Firefox installations, and that it plans to make it the default for existing Firefox installations as well provided that the user has not customized Tracking Protection.
The announcement raised several questions: users wanted to know more about Tracking Protection, whether the system was good enough to make installed extensions superfluous, whether they could uninstall content blockers, and if there was any downside to enabling the feature.
Tracking Protection Basics
Firefox users may customize Tracking Protection functionality in several ways. One of the easier options is to load about:preferences#privacy in the Firefox address bar and check the "content blocking" section on the page that opens.
Tracking Protection offers three presets: standard, strict, and custom.
- Standard (default): blocks known trackers in private windows, third-party tracking cookies in all windows, and cryptominers (as of Firefox 69). As of Firefox 72, fingerprinters as well.
- Strict: blocks the same as the default setting plus Fingerprinters (as of Firefox 69)
- Custom: select what to block:
- Trackers: in all windows, private windows, change blocklist.
- Cookies: third-party trackers, from unvisited websites, all third-party cookies, all cookies.
Firefox displays a Shield icon next to the site address if Tracking Protection is blocking something on the active site. A click on the icon provides an overview of what is being blocked on the page.
The Content Blocking section of the panel that opens provides the following information and controls:
- Tracking Protection status (e.g. custom or standard).
- Whether Trackers, Cookies, Miners, or Fingerprinters are blocked, or partially blocked. Note that Firefox displays only the types that are blocked and not the others.
- Option to look at blocked content.
- Option to turn off Tracking Protection for the site.
A click on a content type that is blocked on the active site displays the list of content that is blocked on it.
Options to interact with the blocked content are not provided but you find a link to the content blocking options in the interface.
Tracking Protection lists and exceptions
Firefox uses lists provided by Disconnect. Level 1 is the default that is used by the browser's Tracking Protection feature.
- Level 1: allows some trackers to avoid site breakage.
- Level 2: blocks all detected trackers. Mozilla notes that this may break "some videos, photo slideshows, and social networking features".
The only option to switch to the level 2 list is to set Tracking Protection to the custom level. Select "change block list" under custom options to do so.
Disconnect maintains a list of trackers that it does not block. If a company runs a tracker on its main site, blocking the tracker would prevent access to the site at all.
You find the current list of unblocked domains here. The list includes sites such as aol.com, gravatar.com, amazon.com, or akamai.com.
There is no option to configure Firefox's Tracking Protection to block these trackers as well. Since you find CDNs on the list as well, blocking them would break sites that rely on these.
Tracking Protection vs. Ad-blocking
Tracking Protection and ad-blocking share some features but are different in others. Mozilla's Tracking Protection approach tries to improve user privacy by blocking certain forms of tracking, namely tracking cookies and a list of known trackers.
Ad-blockers focus on advertisement elements on websites and block these, and by doing so, improve privacy as well as they may block cookies from being set by advertising domains.
Tracking Protection may block some ad elements on websites that you visit but others may still be displayed. A content blocker like uBlock Origin blocks all advertisement on a page by default. Some content blockers, especially Adblock Plus, allow certain ads by default.
Tracking Protection History
- 11.2014 -- Mozilla launches Tracking Protection in desktop Firefox Nightly.
- 12.2014 -- Tracking Protection added to mobile Firefox for Android.
- 03.2015 -- Tracking Protection enabled in private browsing mode.
- 05.2015 -- Study suggests that tracking protection reduces page load time by 44% on average.
- 09.2015 -- Option to select different blocklists added.
- 09.2016 -- Tracking Protection Test Pilot experiment launches.
- 11.2017 -- Tracking Protection launches in Firefox 57 Stable (works in non-private windows)
- 05.2018 -- Optional anti-mining and anti-fingerprinting protections added.
- 06.2018 -- Mozilla plans to push Tracking protection.
>You find the current list of unblocked domains here.
instagram (aka facebook), amazon, pinterest…
It’s almost as if people use those websites and would get really upset if they were blocked or something.
Are you insinuating that something like EasyList would break those sites? No, I can browse just fine those websites while using these filters: imgur.com/S9m67j4
That whitelist, which you adamantly defend (I think I’m seeing you for the second time with such a reply to my comments) is allowing all those domains to be 3rd party trackers. You don’t need Google’s, Yahoo’s or Facebook’s tracking to access nytimes dot com, for example, now do you?..
Disconnect is a pathetic heap of rubbish. If Mozilla were really serious about this they’d be using (at the very least) EasyPrivacy or Peter Lowe’s list… Even Opera – the big bad Chinese wolf, wooooo! – uses these lists and you can disable any exceptions.
@ShintoPlasm: why do you say that about the Disconnect list? I know uBO does not use it, but why do you dislike it? Just interested.
I don’t like Disconnect because its list of blocked trackers is pretty short, and doesn’t cover nearly as many as some of the other established lists. Especially for non-English languages, many ads and trackers slip through (which doesn’t ordinarily happen with EasyList or EasyPrivacy). The Disconnect list also appears to be fairly basic when it comes to rule syntax, something which EL/EP and others do support well. In all, I just find Disconnect obsolete and ineffective.
Same people? wonder why its so bad with their kind of skills if thats the case o_O
Why is ghacks using a third-party cookie from https://static.h-bid.com ?
Thankfully Firefox blocked this for me :)
you can’t stop FF from sending “do not track” until you disable tracking protection .
I always figure you get too aggressive with this blocking your going to break stuff and then you either white list that site or users just get fed up and turn it off anyway. Mozilla has tried this before and had to back off because it frustrated too many users who probably didn’t even care about this privacy stuff. They just want a browser that works, and honestly Firefox’s path here is riddled with questions about how many users are “really” interested in privacy? I am just not sure you can brand yourself as just that and make it successful.
When they say built-in tracking is protection is good enough and nuke ad.blocker extensions, will there be a hacky way to inject better lists?
theres pihole, but if google/cloudflare encrypted dns providers get hard coded in the browser.,
From my point of View, i’d like to say, cool, but,…FF is so a so much obsolete Project, because it’s too slow.
Nowadays i prefer Opera GX or Edge Chromium, cos they are much faster on older Machines, if u ran em in 16 Bit Mode.
Thnx FF for being innovative 10 Years….
The Privacy Badger add-on from EFF detects trackers. It’s slider system allows individual websites to easily be “allowed”, or to “block cookies” or “block domain.” It sends websites a “do not track” signal. It prevents WebRTC from leaking local IP address. It allows for the import and export of user data. It seems to work fine. I’m not certain what benefit Mozilla is adding to FF that isn’t already in the Privacy Badger add-on. Why not just promote Privacy Badger?
is there anyway trackers can potentially track you via the Do Not Track message you are sending? is there any downside to sending Do Not Track message?