The share of Firefox users with a unique browser fingerprint fell from 75% to 46% after a set of new protections shipped. Mozilla reached that figure with measurements from nearly 25 million Firefox users. The core lesson is simple: hiding a few device details makes tracking much harder.
Tom Ritter, Frederik Braun and Christoph Kerschbaumer described the work in a Mozilla Security Blog post on fingerprinting research dated November 10. The ACM CCS 2026 security conference accepted the full paper, titled “Large-Scale Measurement and Real-World Mitigation of Web Browser Fingerprinting in the Wild.” Its companion site, fingerprinting.study, lists four more co-authors from the University of Toronto and UC San Diego.
What browser fingerprinting is
Fingerprinting lets websites recognize a person across sites without cookies. A script reads small details such as installed fonts, screen size and graphics hardware. Each detail looks harmless on its own. Combined, they can form a profile that sets one browser apart from others.
Firefox already blocks cookie-based cross-site tracking with Total Cookie Protection, which is always on. Fingerprinting is harder to stop, because it relies on information that websites also use for normal features.
What the Mozilla study found
The researchers simulated the measurements taken by scripts from three commercial services: Fingerprint Pro, Signifyd and Akamai. They then checked which combinations of measurements set users apart. A small number of high-impact signals drove most of the uniqueness, not the total amount of data collected.
The numbers on the study site make the point. Fingerprint Pro collects more than 50 metrics, yet just 8 of them identify 80% of the users it can single out. Signifyd collects more than 80 metrics, and 9 do the same job.
The table below shows the share of users with a unique fingerprint under each modeled script, before and after the Firefox changes. These are Mozilla’s simulations of each service, not tests of the companies’ live systems.
| Modeled fingerprinter | Unique users before | Unique users after |
|---|---|---|
| Fingerprint Pro | 75.7% | 46.8% |
| Signifyd | 60.9% | 38.5% |
| Akamai | 18.2% | 9.0% |
Mozilla also reports that the groups of users who share the same fingerprint grew larger. That second result matters, because a tracker learns less when many browsers look identical.
What Firefox now hides or evens out
- Taskbar and Dock size: Screen resolution APIs no longer reveal the size and position of the Windows taskbar or the macOS Dock.
- CPU cores: Firefox can report 4 or 8 logical processor cores instead of the exact count.
- Rendering differences: Mozilla fixed inconsistent results in image rendering, Web Audio and math operations on Android.
- Randomization: Firefox randomizes some other signals. Mozilla says this benefit is harder to measure and is not part of the published numbers.
- Kept as is: Language and time zone settings stay visible so websites keep working.
The effect varies by platform. On macOS, limiting screen resolution data cut uniqueness by 25.3 points. On other platforms, the same change moved the figure by only 0 to 3 points.
Which Firefox version brought the changes
The two Mozilla sources frame the timing a little differently. The study site credits protections shipped in Firefox 143 for the drop from 75% to 46%. The security blog says the most recent of these protections arrived in Firefox 145. Mozilla’s November 2025 Firefox 145 announcement said the update cut the share of users trackable by fingerprinters by half.
What changes for you
Not every Firefox user gets the full set of protections today. The split depends on how you browse.
- All windows, by default: Some protections, such as hiding the taskbar or Dock size, already apply everywhere.
- Private Browsing and Strict mode: The additional protections run in Private Browsing windows and when Enhanced Tracking Protection is set to Strict.
- Later: Mozilla plans to turn the extra protections on by default. It followed the same path with Total Cookie Protection.
In other words, a user on the Standard setting in a normal window gets only part of this work. Anyone who wants the stronger defenses now has to opt in.
How to turn on the stronger protections
- Open Firefox settings and go to the Privacy and Security section.
- Under Enhanced Tracking Protection, select Strict. This applies the extra protections in all windows.
- If a site stops working, turn protection off for that site. Mozilla’s Enhanced Tracking Protection help page explains how.
- To see how your browser compares, run the test on fingerprinting.study. It runs locally and does not store or send your results.
Expect some trade-offs with Strict mode. The study notes that breakage from stricter settings often shows up later, which can hide the cause from users. Mozilla treats site compatibility as a condition for turning protections on by default.
Mozilla also points to two other tools for privacy-minded users: Firefox Relay email masks and a built-in free VPN that masks IP addresses.
How Mozilla handled 25 million users’ data
This part matters, since the study itself needed the kind of data fingerprinters want. Mozilla says its safeguards went beyond its usual data collection rules.
- Data came from a dedicated telemetry ping that had to be enabled explicitly, and it carried no client ID.
- Submissions used Oblivious HTTP (OHTTP). A relay saw users’ IP addresses but not the content. Mozilla saw the content but not the IP addresses.
- Only four authorized Mozilla employees had access to the data.
- Raw records were kept for 90 days and are now deleted. Mozilla published only aggregate results.
- The released data leaves out any value seen fewer than 100 times in an operating system’s population.
- The authors held back some analyses so they would not help build better fingerprinters.
Mozilla’s OHTTP explainer covers the relay setup in more detail. The aggregate data and analysis code are available through the study site.
What remains unclear
Mozilla has not given a date for turning the extra protections on by default. The blog says the protections do not make fingerprinting impossible, and trackers can adapt their methods.
The randomization work is another open point, since its effect is not in the published numbers. The sources also include no response from Fingerprint Pro, Signifyd or Akamai. Because the study modeled their scripts, it does not show how the companies’ current production systems perform against Firefox.
