Harden Firefox for Privacy

Firefox is the most privacy-capable mainstream browser out of the box because of Total Cookie Protection, which puts every site’s cookies in a separate jar so they can’t be used to follow you across sites. Here is how to configure it properly.

Settings (Privacy & Security)

• Set Enhanced Tracking Protection to Strict. This blocks cross-site tracking cookies, social trackers, fingerprinters, and cryptominers, and enables Total Cookie Protection. A few sites break under Strict; the shield icon lets you exempt one without lowering the global setting.
• Turn on “Tell websites not to sell or share my data” — this sends the Global Privacy Control signal, which is legally enforceable under California’s CPRA and several other state laws.
• Enable DNS over HTTPS (Settings → Privacy & Security → DNS over HTTPS) in Increased or Max Protection mode so your ISP can’t see or log your domain lookups.
• Under Cookies and Site Data, enable “Delete cookies and site data when Firefox is closed” if you want sessions wiped each time (you’ll re-login more often).

URL-parameter stripping

Firefox can strip tracking parameters (like ?fbclid= and utm_* from clicked links). In about:config set privacy.query_stripping.enabled to true, and privacy.query_stripping.enabled.pbmode to true for private windows. This removes click-identifier parameters automatically.

Containers

Install Multi-Account Containers to isolate identities — keep work, personal, and shopping logins in separate color-coded containers that don’t share cookies. Add Facebook Container to confine Meta’s cookies to Facebook tabs only, so the like-buttons and pixels embedded on other sites can’t read them.

about:config keys worth knowing

• network.cookie.cookieBehavior = 5 — Total Cookie Protection (set automatically by Strict mode).
• privacy.resistFingerprinting = true — strong anti-fingerprinting, but it changes timezone/canvas/window behavior and breaks some sites; enable only if you accept the trade-offs (the Tor Browser uses this).
• privacy.firstparty.isolate = true — extra first-party isolation; usually redundant with Strict mode.

Don’t over-tune. Strict ETP + GPC + DoH + the two containers covers the large majority of real-world tracking with minimal breakage. resistFingerprinting is the only “expert” toggle worth considering, and only if you understand what it changes.