I like that Firefox centers privacy controls as first class browser primitives, specifically Enhanced Tracking Protection (ETP) and Total Cookie Protection (TCP) working together to limit cross site tracking by locking cookies to the site where they were created. I also like that TCP is enabled by default in Standard mode, so the baseline posture is already protective without requiring deep configuration.
Enhanced Tracking Protection feels like a core subsystem rather than a bolt-on feature, because it is always present in the main browsing UI and can be inspected from the address bar shield. The Protections Dashboard at about:protections is also a practical touch, since it provides a centralized view of what was blocked and which protections are active.
The default blocking scope is broad enough to matter in real browsing, covering social media trackers, cross-site tracking cookies, fingerprinters, and cryptominers using a tracker list provided by Disconnect. That “multiple classes of tracking” approach is important because modern tracking rarely relies on a single technique.
Total Cookie Protection standsout as a structural privacy control because it partitions cookies into separate “cookie jars” per website, so third-party content embedded on one site cannot reuse the same cookies on other sites. The documentation is unusually clear about the mental model, which makes it easier to explain internally to teammates or stakeholders who are not browser specialists.
Having Total Cookie Protection enabled by default in Standard mode is a strong product decision because it reduces the gap between “privacy intent” and “privacy outcome.” Mozilla also states there should be no noticeable effect on browsing with this default, which sets an expectation of usability rather than “security at any cost.”
Strict mode adds Bounce Tracking Protection aimed at redirect-based tracking flows, where intermediate URLs are used to gather information as navigation happens. The behavior is described concretely, including automatic detection and clearing of cookies and storage associated with bounce trackers when there is no user interaction within a designated time.
Site-level control is handled in a way that fits troubleshooting reality: the shield panel shows whether blocking occurred and provides a toggle to disable Enhanced Tracking Protection for a specific site when breakage happens. The exception list concept is also explicit, which makes it clearer that the decision is persistent rather than a one-time bypass.
The “report a broken site” path is integrated into the same privacy surface, with an explicit “Send report” flow from the shield panel. That linkage between anti-tracking and compatibility reporting is useful because it encourages feedback loops instead of leaving users to silently weaken their posture.
Copy Clean Link is another detail that reads like someone thought about modern tracking patterns, since Firefox can strip tracking parameters from copied URLs starting with Firefox version 120. The fact that it applies to both copying from the address bar and in-page links improves consistency.
For identity separation, Multi-Account Containers provides a clear model: different containers keep separate cookies and site data, which supports working with multiple accounts and reduces accidental session mixing. The official documentation frames it as a way to separate browsing “contexts,” and that matches how work, personal, and testing identities often need to coexist.
On the security-hardening side, HTTPS-Only Mode is a valuable guardrail, because Firefox can attempt to load sites over HTTPS and warn when a secure connection is not available. The feature also supports exceptions when needed, which helps when interacting with legacy systems that have not been modernized.
DNS over HTTPS is handled with more nuance than a simple toggle, since Mozilla explains that traditional DNS lookups are unencrypted and that DoH performs name resolution over an encrypted HTTPS connection. Mozilla also acknowledges operational risks, including that DoH can bypass DNS-based filtering and parental controls, which is essential context for managed networks.
Mozilla’s DoH documentation goes further by describing mechanisms that can prevent DoH from enabling when it would conflict with policies or controls, which is exactly the kind of detail that makes a feature deployable rather than theoretical. The same page also discusses Encrypted Client Hello (ECH) and notes that Firefox uses DoH to fetch ECH configuration, which connects multiple privacy layers into a coherent story.
Password handling documentation is also refreshingly specific: Mozilla describes how Firefox encrypts saved passwords locally and outlines how Firefox Sync protects logins. That level of specificity is helpful when writing internal guidance, because “secure” can mean very different things depending on what is actually encrypted and where.
For web development workflows, Responsive Design Mode is documented as more than a viewport resizer, since it supports device simulation elements such as touch behavior and network throttling presets. Having this as a first-party feature reduces reliance on external tooling for basic responsive triage. Review collected by and hosted on G2.com.
Strong cookie protections can still break websites, and Mozilla explicitly notes that Total Cookie Protection may cause “site breakage,” especially around login flows, post-login functionality, or third-party iframe errors.
The primary workaround is often to disable protections for a site (or relax cookie settings), which fixes the immediate issue but can leave behind long-lived exceptions that are easy to forget and hard to audit later. Review collected by and hosted on G2.com.
