Seventy-five percent of Firefox users could be singled out by a leading tracking script. Mozilla now reports that its changes cut that to 46%. That is the headline of a research paper Mozilla and university co-authors accepted to the ACM CCS 2026 conference. The Mozilla Security Blog summarized the work on November 10, 2026. This post covers what Firefox fingerprinting protection does, what Mozilla measured, and what you have to switch on yourself.
What Browser Fingerprinting Is
Fingerprinting is tracking without cookies. A website script reads small details about your browser and device, such as screen size, processor count and how your system draws images. Alone, each detail means little. Together, they can act like an ID that follows you from site to site.
Clearing cookies does not reset it. That is why browser makers treat it as a separate problem. Mozilla’s security blog post says the goal is to make more browsers look alike to these scripts, while keeping the information sites need, like language and timezone.
What Firefox Changed
Mozilla describes several changes. Firefox now limits what screen-size tools reveal, so sites cannot see the size and position of your taskbar or dock. It can also report your processor count as either 4 or 8 instead of the exact number. Mozilla made image rendering, Web Audio and, on Android, some math operations return more consistent results across devices.
Mozilla also uses randomization for other signals. It says the benefit of that part is harder to quantify and is not included in the reported measurements.
Rollout status matters here. Per Mozilla, the taskbar and dock protection is on by default in all browsing modes. The other protections arrived first in Private Browsing and in Strict Enhanced Tracking Protection, with a stated plan to enable them by default later. Mozilla gives no date for that.
The Numbers Behind the Claim
The study used measurements from almost 25 million Firefox release users. The paper says data was collected between March 25 and April 16, 2026. Mozilla simulated what scripts from three commercial fingerprinting vendors could collect. The companion site, fingerprinting.study, lists the share of users each simulated script could uniquely identify, before and after the protections.
| Modeled fingerprinting script | Users uniquely identifiable before | After |
|---|---|---|
| Fingerprint Pro | 75.7% | 46.8% |
| Signifyd | 60.9% | 38.5% |
| Akamai | 18.2% | 9.0% |
Source: Mozilla and co-authors, fingerprinting.study. These are Mozilla’s own modeled figures, not tests of the vendors’ live products.
The paper’s abstract says the protections shipped in Firefox 143. The Mozilla Security Blog says the most recent ones shipped in Firefox 145. Check your version in the About Firefox window to be sure you have both.
Mozilla says it kept raw telemetry for 90 days, then deleted it and kept only aggregate results. It also says it added privacy safeguards beyond its usual data collection policies. Independent coverage from PiunikaWeb and CyberInsider reports the same headline figures.
How to Turn On the Stronger Settings
This works in Firefox on desktop, per Mozilla’s support page. Click the shield icon left of the address bar, then Protection Settings, then Privacy Settings. Under Enhanced Tracking Protection, choose Advanced settings, select Strict, and reload your tabs. Strict applies the extra defenses in regular windows, not only Private Browsing.
Mozilla’s support page warns that Strict can break some sites. It names login fields, forms, payments, comments and videos. You can add exceptions for sites that misbehave. The paper also notes that users are more likely to disable protections than to tolerate disruptions.
Limits and Open Questions
Mozilla is direct about the limits. In its words, these changes do not make fingerprinting impossible, because trackers can adapt. The results describe the overall Firefox population, not any single site, and they vary by operating system. The paper also puts browser extensions out of scope, and about 7% of users opt out of the telemetry used.
The protections also do nothing against scams. For that, see our look at Singapore’s AntiScam Pango app. Treat the version numbers above as Mozilla’s claims. The sources I read disagree on which version shipped what.
Why It Matters to You
If you use Firefox, the taskbar and dock protection is already working for you. Anyone who wants the rest can switch to Strict today and accept a few broken sites in return.
If you use another browser, this study shows what is possible, not what you have. One step this week: open your browser’s privacy settings and see what it says about fingerprinting.
Sources
- Mozilla Security Blog, “Open research, stronger privacy: Making Firefox users harder to fingerprint,” November 10, 2026
- Mozilla Firefox blog, “Firefox expands fingerprint protections,” page dated November 10, 2025
- fingerprinting.study, companion site to the research paper (no date shown)
- Mozilla Research, extended paper “Large-Scale Measurement and Real-World Mitigation of Web Browser Fingerprinting in the Wild,” extended version dated October 6, 2026
- Mozilla Support, Enhanced Tracking Protection on desktop, last updated September 24, 2026
- PiunikaWeb, November 11, 2026
- CyberInsider, November 11, 2026