Firefox Privacy Settings: How to Make Firefox Private (2026)

Is Firefox private out of the box?

More than most browsers. Every window runs Enhanced Tracking Protection in Standard mode, which blocks social media trackers, cryptominers and known fingerprinters. Total Cookie Protection gives each site its own cookie jar, so an ad network’s cookie from one site is useless on the next.

Connections are upgraded to HTTPS wherever a site offers it (since Firefox 136). In the US, Canada, Russia and Ukraine your DNS lookups are encrypted by default as well.

The defaults you may not want:

• Usage data for Mozilla: technical and interaction data, a daily usage ping, crash reports and feature studies are on.
• Sponsored content: sponsored shortcuts on the New Tab page, sponsored stories in some countries, and suggestions from sponsors in the address bar where Firefox Suggest runs.
• AI features: the chatbot sidebar and the Smart Window assistant are offered. Firefox 148 added a switch that blocks them all.
• Google as the search engine in most regions.

Mozilla’s ad business is the part people argue about. In February 2025 it introduced Terms of Use and dropped “we never sell your data” from its FAQ. Its explanation was that some laws define “sell” far more broadly than most people use the word (The Register covered the row). The privacy notice in force since May 4, 2026 is back to “What little we do know, we never sell”, and says New Tab ad partners get data only “on an aggregated and/or de-identified basis”.

Aggregated or not, you don’t have to take part. The sponsored settings in chapter 2 switch it off, and Firefox works the same without them.

The Firefox privacy settings to change

Everything here is in Settings. On a Mac you can also use Firefox > Settings in the menu bar.

Strict tracking protection

Strict blocks tracking content (the hidden trackers in ads and videos) in every window, not just private ones. It also adds Firefox’s newer fingerprinting defenses (chapter 4). When a site misbehaves, click the shield icon in the address bar and turn protection off for that site; everything else stays on Strict.

Data collection

Settings > Permissions and data > Firefox data collection and use has six boxes. Unticking “Send technical and interaction data to Mozilla” also counts as a request to delete what Mozilla already has, within 30 days. It doesn’t stop the daily usage ping. That one has its own box.

One box deserves a second thought. The built-in VPN (chapter 7) only works with “Allow Firefox to improve features, performance, and stability between updates” turned on.

Global Privacy Control instead of Do Not Track

If you’re looking for the Do Not Track box from older guides, it’s gone. Firefox 135 removed it because many sites ignored it, and in some cases it could even reduce privacy. Its replacement is “Tell websites not to sell or share my data”, which sends the Global Privacy Control signal. Some laws require websites to honor it, which Do Not Track never had going for it. Firefox already sends it in private windows; the box adds normal ones.

Sponsored content and AI

Three places to look. In Home and startup, untick Sponsored shortcuts and Sponsored stories. In Search, under Firefox Suggest, untick Suggestions from sponsors.

In AI controls, Block AI enhancements hides the current and future AI features, and the pop-ups that advertise them. You can also block features one by one. Smart Window, for example, needs a Mozilla account and sends your requests through Mozilla’s servers to an AI provider.

DNS over HTTPS

Default protection uses a trusted resolver where Firefox has switched it on, and falls back to your normal DNS when something goes wrong. It also turns itself off when it detects a VPN, parental controls or an enterprise policy. If you want encrypted DNS every time, choose Custom, pick a provider and tick “Always warn me if secure DNS isn’t available”: Firefox then shows a warning instead of falling back silently.

Search engine

Settings > Search > Default search engine. DuckDuckGo and a few others are in the list already; our guide to browsing privately compares the private search engines.

Security settings that keep Firefox itself safe

Privacy settings don’t help much in an outdated browser. Firefox updates itself, so the one job left to you is restarting when it asks. In July 2026 Mozilla fixed two critical bugs with public exploit code in Firefox 152.0.6. With a release every two weeks, a browser that hasn’t been restarted for a month is already two versions behind.

HTTPS-Only Mode

Firefox already tries HTTPS first and drops back to plain HTTP when a site doesn’t support it. HTTPS-Only Mode turns that silent fallback into a warning page, so you decide whether an unencrypted page is worth opening. It’s under Privacy and security > Connection and software security > Advanced settings: choose Enable HTTPS-Only Mode in all windows.

A primary password

If you save logins in Firefox, set one in Settings > Passwords and autofill (older versions: “Use a Primary Password”). Someone else using your computer then can’t view or use your saved passwords without it.

Site permissions

Settings > Permissions and data > Permissions shows which sites may use your location, camera, microphone and notifications. Each has a Settings button where you can remove sites and block new requests. Blocking new notification requests is the quickest win there.

Strict mode, fingerprinting and what breaks

Fingerprinting is tracking without cookies. A site reads your screen size, fonts, graphics card and dozens of other details, and the combination is often unique to your device (our fingerprinting guide explains how).

Firefox fights it in layers. Standard mode blocks scripts from known fingerprinting companies, and since Firefox 151 (May 2026) it also limits what some browser features reveal. Mozilla says that cut the share of users who can be uniquely identified by about 14% on average and about 49% on Macs. Strict mode and private windows add the stronger defenses from Firefox 145, which Mozilla says “cut the percentage of users seen as unique by almost half”.

Strict’s price is the odd broken site: a sign-in through another site, an embedded video or a comment section that won’t load. Mozilla’s Strict settings include site-fix exceptions that relax rules known to break common sites. Leave them ticked unless you’d rather deal with each site yourself.

We’d skip privacy.resistFingerprinting, the about:config switch older guides still push. Mozilla itself says “we do not recommend this feature for the average Firefox user”. It shows the wrong time zone, ignores dark mode, opens new windows at a fixed size and breaks some sites. Strict mode gets you most of the benefit without the oddities.

about:config and hardening scripts

Type about:config in the address bar (one colon, whatever some guides say) and click Accept the Risk and Continue. Mozilla’s warning that changes there “can have serious effects on your browser’s stability, security and performance” is worth taking seriously. Most privacy tweaks that used to live here now have a box in Settings.

A few still have a use:

• media.peerconnection.enabled = false turns off WebRTC, which video calls in the browser need. It’s only worth doing if a WebRTC leak test shows your real IP address while your VPN is on.
• geo.enabled = false removes location access completely, instead of relying on the permission prompt.
• privacy.firstparty.isolate is one to leave alone. Total Cookie Protection replaced it, and the arkenfox project notes that turning it on disables those newer protections.

Hardening scripts change hundreds of these at once. The best known, arkenfox user.js, is a long, commented file you’re expected to read and adjust before you use it. Its releases trail Firefox: version 144 was the newest in early November 2026, while Firefox was on 159. If keeping a user.js up to date sounds like a hobby you don’t want, a browser with hardened defaults (chapter 8) is less work.

Add-ons: fewer is better

Every add-on can read the pages you let it read, and a malicious one reads all of them. In August 2026, researchers at Socket found 40 Firefox add-ons posing as OKX, Rabby Wallet, TronLink and other crypto wallets that stole recovery phrases and private keys. Prefer add-ons with Mozilla’s Recommended badge or a long track record, and remove the ones you no longer use.

The add-on most worth having is uBlock Origin. Tracking protection isn’t an ad blocker; uBlock Origin blocks ads and trackers, and the full version still runs in Firefox, while Chrome only allows the Lite one.

Containers no longer need an add-on. Since Firefox 153 you can right-click the New Tab button and open a tab in a container, which keeps its cookies and logins apart from your other tabs. Mozilla’s Multi-Account Containers add-on adds what most people want from containers: a site you assign always opens in its own one.

An HTTPS add-on, a staple of older guides, is no longer needed. HTTPS-First and HTTPS-Only Mode are built in (chapter 3).

Private windows and the built-in VPN

A private window forgets. History, cookies and form data go when you close it, or sooner if you click the fire icon next to the address bar (Firefox 151 and later). On the rest, Mozilla is blunt: Private Browsing “does not make you anonymous on the Internet”, and your “Internet service provider, employer, or the sites themselves can still gather information about pages you visit.”

That gap is what the built-in VPN from Firefox 149 (March 2026) is for. It’s free, with 50 GB a month, needs a Mozilla account, and is rolling out country by country, starting with the US, UK, Germany and France. It hides your IP address from websites, but only for traffic from Firefox; Mozilla’s help page describes it as a proxy server for the browser. Your other apps keep using your normal connection, and signing in to an account still tells that site who you are.

For the whole device you need a VPN app, such as Mozilla’s paid Mozilla VPN or one from our best VPN list. Our proxy vs VPN guide explains the difference.

Firefox-based browsers that do the work for you

If you’ve worked through this page and want more, a browser built on Firefox with stricter defaults saves you the upkeep.

LibreWolf

LibreWolf is a Firefox fork with no telemetry and no sponsored shortcuts, and it deletes cookies and history when you close it. Its automatic updates are off by default, so keeping it current is your job, which matters for a browser that gets security fixes this often.

Mullvad Browser

Made by the Tor Project together with Mullvad VPN, Mullvad Browser is “Tor Browser without the Tor Network”. It works with any VPN or none.

Tor Browser

For anonymity rather than less tracking. It routes your traffic over the Tor network and opens onion sites, at the cost of speed, and some sites block it. Our Tor Browser guide covers setup.