Reference · updated August 2026
Browsers do not apply one common privacy model. Compare cookie blocking, storage limits, URL parameter stripping, tracker blocking, and the practical impact on measurement.
Engine is not the same as browser. Chrome, Edge, and Brave all use Chromium/Blink, yet their default tracking protections differ substantially. On iPhone and iPad, the rendering engine and browser-brand rules can also depend on platform and regional policy. Test the actual browser, version, mode, and device you support.
Browser restrictions are technical controls, not consent. A request that a browser permits may still require consent or another legal basis, while a consented request may still be blocked by the browser or an extension.
The general picture
Tracking can fail at several independent layers. Cookie availability is only one of them.
A cookie is third-party when its domain differs from the site in the address bar. Browsers may allow it, block it, partition it per top-level site, or expose it only after user interaction through the Storage Access API.
Measurement impact: Cross-site audiences, attribution, frequency capping, embedded login, and ad-tech synchronization can lose continuity.
A first-party cookie is not automatically durable. Safari can cap JavaScript-created cookies and other script-writable storage; private modes and user settings can shorten storage further in every browser.
Measurement impact: Returning users may receive a new identifier, shortening attribution windows and inflating “new user” counts.
Identifiers such as gclid, fbclid, dclid, and msclkid travel in URLs. Some browsers remove known parameters; Safari can also apply a 24-hour storage penalty after decorated navigation from a classified tracker.
Measurement impact: Campaign-level UTM data may survive while user- or click-level ad attribution becomes incomplete.
List- or classifier-based protection can block a script, pixel, iframe, or network request before it runs. This is separate from cookie blocking: a request may disappear even when no cookie is involved.
Measurement impact: Client-side tags may never load or send, producing gaps that consent configuration alone cannot explain.
Trackers can briefly become first-party during a redirect and write storage. Modern protections detect or constrain this behavior through redirect tracking protection, debouncing, storage purging, or parameter filtering.
Measurement impact: Affiliate and advertising redirect chains need testing; long chains and identifier hand-offs are especially fragile.
Browsers can reduce referrer detail, randomize or standardize fingerprintable APIs, and block known fingerprinting scripts. IP address, device characteristics, and browser entropy are increasingly unreliable identifiers.
Measurement impact: Probabilistic identity and device matching become less stable and carry significant privacy and compliance risk.
Browser overview
These are shipping defaults and documented capabilities as of August 2026. Users, private mode, enterprise policy, extensions, and experiments can change the outcome.
WebKit
WebKit’s Intelligent Tracking Prevention (ITP) is the most consequential default policy for conventional browser analytics.
Primary sources: WebKit: Tracking Prevention · WebKit: ITP 2.3 · WebKit Tracking Prevention Policy
Gecko
Firefox combines Enhanced Tracking Protection (ETP) with Total Cookie Protection (TCP), isolating site state and blocking classified trackers.
Primary sources: Firefox: Privacy capabilities overview · Firefox: Query parameter stripping · Mozilla anti-tracking policy
Blink / Chromium
The engine is shared, but the privacy policy is not. Treat each Chromium-based browser as a separate measurement environment.
Third-party cookies allowed by default
Google no longer plans a forced third-party-cookie phase-out or a new standalone choice prompt. Users and administrators can still block them. CHIPS remains available for opt-in partitioned cookies; many advertising Privacy Sandbox APIs are being retired.
Balanced tracking prevention by default
Balanced mode blocks known harmful trackers and trackers from sites the user has not visited. Strict blocks most trackers. Third-party cookies remain a separate setting and are allowed by default in regular browsing unless the user or an enterprise policy blocks them; InPrivate is stricter.
Strong blocking by default
Brave Shields blocks cross-site cookies, known trackers, and fingerprinting techniques. It filters known click identifiers such as gclid, fbclid, and msclkid and gives permitted third-party storage an isolated, ephemeral lifetime.
Verify individually
Opera, Vivaldi, Samsung Internet, embedded WebViews, and enterprise-managed Chromium builds can ship different blocker lists, defaults, extensions, and cookie policies. “Chromium” alone is not a reliable answer.
Primary sources: Google: Privacy Sandbox plans · Edge: Tracking prevention · Edge: Third-party-cookie policy · Brave privacy features · Brave query string filter
For implementation
Track whether a tag loaded, whether a request left the browser, and whether the collector accepted it. “No conversion” does not identify which layer failed.
Use authenticated customer or transaction data where appropriate and consented. Do not rely on browser identifiers remaining available for a fixed marketing window.
Process permitted campaign information when the landing request arrives. Preserve coarse campaign fields separately from click IDs and document their retention.
Server-side tracking can improve request delivery, but hybrid implementations need a shared event ID so the vendor does not count both copies.
Cover Safari, Firefox Standard and Strict, Chrome, Edge Balanced, Brave, private modes, consent states, and common content blockers—not only browser engines.
Maintain a dated compatibility sheet and re-test important flows after browser releases. Exact block lists and exceptions can update independently of a major version.
This page summarizes documented browser behavior; it is not a promise that every request will behave identically. Browser vendors use classifications, compatibility exceptions, staged rollouts, and remotely updated lists. The primary vendor documentation linked in each engine section should be used when an exact implementation decision depends on current behavior.
Research reviewed: 27 August 2026