The browser privacy settings worth changing, and the one that changes nothing

Most browser privacy advice starts and ends with the same suggestion: open a private window. It is the wrong place to start, because private browsing is not a privacy control in the sense people assume. The FTC states it plainly — private modes may delete your browsing history after a session, but the mode "doesn’t block websites from seeing your online activity." What follows is the set of settings that do change what gets collected, and an honest account of how far they reach.

What a private window actually clears

A private or incognito window does one job well. When you close it, the local record of what you did goes with it — history, cookies set during the session, form entries. On a shared laptop, or a machine in a library, that is genuinely useful.

It is a feature for hiding your browsing from the next person to sit down at the same computer. It was never designed to hide your browsing from the far end of the connection, and the FTC’s wording leaves no room to read it otherwise: the mode does not block websites from seeing your activity. The site you log into still knows it is you. Your employer’s network still sees the connection. Your internet provider still sees where you went.

The settings that do change what is collected

These live in your browser’s own privacy section, and the FTC describes them as giving you "some control over the information websites collect about you". Work through them in a normal window, where the changes persist.

• Cookie handling. CISA’s instruction is to "change your browser settings to limit and clear cookies to minimize the amount of data third parties might be able to access". Third-party cookies are the ones to restrict first.
• Personalised advertising. The FTC notes browser privacy settings "let you choose whether to allow or block personalized ads based on your browsing history". This is a distinct toggle from cookie handling.
• Site permissions. Location, camera, microphone and notifications are granted per site and stay granted. The list is worth reading rather than assuming.
• Automatic updates. NCSC’s requirement is that automatic updates are on for the browser and its extensions. A browser you never restart is a browser that never finishes updating — which is part of why CISA also says to close it out frequently.

One opt-out is never enough

This is the part that quietly defeats people. Ad-tracking opt-outs are not account settings; they are stored in the browser you set them in. The FTC’s instruction is explicit: "If you opt out, be sure to opt out on each device and browser."

So the work multiplies. Laptop browser, phone browser, tablet, the second browser you keep for work — each one separately. The FTC names two industry tools for this: the Digital Advertising Alliance’s AdChoices and the Network Advertising Initiative opt-out tool. Both have the same per-browser limitation.

There is a third control that sits outside the browser entirely. The FTC points out that "your phone also has a setting that lets you opt out of personalized ads from the company that makes the operating system (for example, Apple or Google)". CISA’s version of the same instruction is blunter: "Disable your Ad ID." Changing your browser settings does nothing to this identifier.

Clearing cookies is one control among several

Deleting cookies is worth doing and it is not the finish line. The FTC lists it alongside browser privacy settings, the operating-system ad-ID opt-out, app permissions on the phone, the privacy settings on internet-connected TVs and streaming devices, and the industry opt-out tools. Cookie deletion touches one of those.

It does nothing about an app on your phone that has been granted access to your contacts. It does nothing about a data broker that assembled a profile from property records and voter registration. Treating cookie clearing as the whole of privacy work is how people end up surprised by how much is still out there.

Where the browser’s settings stop

Everything above governs what is collected passively as you browse. None of it touches what you hand over deliberately. If you are signed into an account, the operator of that account knows what you do inside it regardless of any setting on this page.

Nor does it reach the second-hand market. The FTC’s people-search guidance describes data brokers compiling property records, driving records, voter registration information, criminal records, civil actions and judgments, and birth, marriage, divorce and death records — and buying from other brokers on top. No browser setting reaches a public record.

Set the browser controls because they are cheap and they help. Just do not mistake the private window for any of it.

Sources: FTC — How to protect your privacy online · CISA — Best practices against tracking technologies and spyware · NCSC UK — Managing web browser security · FTC — What to know about people search sites · FTC — Protecting your privacy online (hub)

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from the FTC, CISA and NCSC UK. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.