Rules
Browser privacy problems: persistent sign-ins, tracking, risky extensions and fingerprinting
Browser privacy problems traced through symptoms, checks, fixes, and limits for sessions, tracking, extensions, saved secrets, permissions, and fingerprints.
What to take away
- Name the layer firstlocal storage, account session, extension, or server record.
- Clearing cookies does not end a session held on the service side.
- Revoke sessions and trusted devices before you delete a saved password.
- Treat a widened extension permission as a new decision, not an update.
- No browser setting promises anonymity; it narrows what a site can collect.
Most browser cleanups fail because the wrong layer gets changed. Cookies and history are separate stores. A private window still loads extensions. A second profile can sync back to the same account.
Persistent sign-ins
A site that signs someone back in after a cookie wipe is usually holding a server-side session. The browser forgot the token; the service did not.
Persistent Sign-In Check
- Browser syncing cookies or account state
- Password manager auto-signing in
- Site uses remembered device
- Federated identity provider active session
- Check site's session and device page
Check four things before touching anything. Browser sync of cookies or account state, a password manager that auto-fills, a remembered-device flag on the site, and an active session at a federated identity provider.
Then sign out at the service, not the browser. Revoke every active session and drop trusted-device status where the site offers it. Clear that site's storage, review sync, and only then remove the saved password.
Cross-site tracking
Similar ads across unrelated sites suggest shared signals, not proof of one cause.
Cross-Site Tracking Fixes
- Enable built-in tracking protection
- Restrict third-party state
- Review advertising-account controls
- Clear stale site data
- Avoid unnecessary logged-in browsing
- Keep exceptions narrow
- Cross-site cookies
- Link parameters
- Embedded resources
- A logged-in ad account
- Purchased data
- Household devices
- Coincidence
Record what you saw and where before changing settings. Enable the browser's built-in tracking protection, restrict third-party state, and review ad-account controls. Clear stale site data, keep exceptions narrow, and test the sites you actually need.
Risky extensions
Watch for unfamiliar pages opening, a changed search engine, new permissions, or an extension reading every site for a narrow job.
Extension Risk Review
- Source and publisher
- Update date
- Reviews
- Requested and optional permissions
- Site access
- Private-window access
- Recent changes
Mozilla's page on optional Firefox extension permissions explains that extensions can request optional features and that you can review and change those in the Add-ons Manager. That supports the review procedure for Firefox. It says nothing about whether a given extension is safe.
Work through the extension in this order:
- Check publisher, source, and last update date.
- Read requested permissions against the stated function.
- Check site access and private-window access.
- Disable one suspect extension at a time and retest.
- Remove anything you cannot justify, then reset search, startup, proxy, and site settings.
- If page or credential access is plausible, change passwords from a known-clean device.
Saved secrets
Autofill on a shared device exposes more than passwords. Account suggestions, payment details, addresses, and clipboard history all surface.
Check the browser vault, profile sign-in, sync, and the operating-system keychain. Also check these:
- form autofill
- exported files
- screenshots Then ask who can sign in to the device account itself.
Move each credential into the manager you intend to keep, delete the copies you do not, and wipe exported plaintext. Give each person a separate device account. Rotate what was exposed and revoke sessions; hiding autofill leaves the credential live.
Permission creep
Old sites accumulate notification, location, camera, and microphone grants long after the need ends. A grant proves the browser allowed access under its rules. It does not prove access happened.
Review global defaults and saved exceptions. Reset what is stale. Prefer ask-each-time or while-in-use, and grant only at the moment you use the feature. For an unexpected camera or microphone indicator, check browser, operating-system, and application logs where they exist.
Fingerprinting
MDN defines browser fingerprinting as combining distinguishing browser and operating-system traits to identify a browser. These traits include the following:
- version
- language
- fonts
- settings
- display details That is why cookie clearing alone is incomplete. It does not prove a specific site used the technique.
Before blaming fingerprinting, rule out simpler causes. These include an account login, IP address, link identifiers, and stored data. Also consider browser traits. A consumer test page is not proof of uniqueness or anonymity.
Use built-in anti-fingerprinting and tracking protection, keep the browser updated, and limit extensions. Unusual tweaks tend to make a browser more distinctive, not less. When the threat model justifies it, separate high-risk activity onto another device.
Worked example: a shared laptop that keeps signing in
A staff laptop at a small clinic signs into a scheduling tool after every cookie wipe. The browser is syncing cookies to a personal account, and the tool has the laptop marked as a trusted device.
The fix runs in order. Turn off cookie sync for that profile. Sign out at the tool. Revoke all sessions and clear the trusted-device flag. Clear the site's storage, then remove the saved password and re-add it once recovery is confirmed. Recheck after a restart and after the next sync run.
Verify the outcome
Write down the original symptom, the settings you changed, sessions revoked, and extensions removed. Also note categories cleared, test pages, account state, and what still does not add up. Recheck after a restart and after sync runs. If behavior you cannot explain continues, move to a fresh device account or a known-clean device and bring in qualified incident help.
Common questions
Why did a site stay signed in after I cleared history?
History and cookies are different categories, and neither one ends a session held on the service. Sync, identity-provider sessions, remembered devices, or a password manager can restore access on their own.
Is every extension with broad permissions malicious?
No. Some functions genuinely need broad access. Scope, publisher, implementation, and update path still have to be reviewed. Continuing need also has to be reviewed. The review is the point.
Does resetting permissions delete data already collected?
No. It changes what the browser allows next. The site may keep anything it already received.
Can browser settings guarantee anonymity?
No. Several types of data can still identify or connect activity:
- Accounts
- Network information
- Device software
- Behavior
- Link identifiers
- Server records
