{"id":2409,"date":"2018-10-23T06:00:05","date_gmt":"2018-10-23T13:00:05","guid":{"rendered":"https:\/\/blog.mozilla.org\/security\/?p=2409"},"modified":"2018-10-23T05:59:31","modified_gmt":"2018-10-23T12:59:31","slug":"firefox-63-lets-users-block-tracking-cookies","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/","title":{"rendered":"Firefox 63 Lets Users Block Tracking Cookies"},"content":{"rendered":"

As announced in August, Firefox is changing its approach to addressing tracking on the web<\/a>. As part of that plan, we signaled our intent to prevent cross-site tracking for all Firefox users and made our initial prototype available for testing.<\/p>\n

Starting with Firefox 63, all desktop versions of Firefox include an experimental cookie policy that blocks cookies and other site data from third-party tracking resources.<\/b> This new policy provides protection against cross-site tracking while minimizing site breakage associated with traditional cookie blocking.<\/p>\n

This policy is part of Enhanced Tracking Protection, a new feature aimed at protecting users from cross-site tracking<\/a>. More specifically, it prevents trackers from following users around from site to site and collecting information about their browsing habits.<\/p>\n

We aim to bring these protections to all users by default in Firefox 65. Until then, you can opt-in to the policy by following the steps detailed at the end of this post.<\/p>\n

What does this policy block?<\/b><\/h4>\n

The newly developed policy blocks storage access for domains that have been classified as trackers. For classification, Firefox relies on the Tracking Protection list<\/a> maintained by Disconnect<\/a>. Domains classified as trackers are not able to access or set cookies, local storage, and other site data when loaded in a third-party context. Additionally, trackers are blocked from accessing other APIs that allow them to communicate cross-site, such as the Broadcast Channel API<\/a>. These measures prevent trackers from being able to use cross-site identifiers stored in Firefox to link browsing activity across different sites.<\/p>\n

Our documentation on MDN provides significantly more technical detail on the policy, including: how domains are matched<\/a> against the Tracking Protection list, how Firefox blocks storage access<\/a> for tracking domains, and the types of third-party storage access that are currently blocked<\/a>.<\/p>\n

Does this policy break websites?<\/b><\/h4>\n

Third-party cookie blocking does have the potential to break websites, particularly those which integrate third-party content. For this reason, we\u2019ve added heuristics to Firefox to automatically grant time-limited storage access under certain conditions<\/a>. We are also working to support a more structured way for embedded cross-origin content to request storage access. In both cases, Firefox grants access on a site-by-site basis, and only provides access to embedded content that receives user interaction.<\/p>\n

More structured access will be available through the Storage Access API<\/a>, of which an initial implementation is available in Firefox Nightly (and soon Beta and Developer Edition) for testing. This API allows domains classified as trackers to explicitly request storage access when loaded in a third-party context. The Storage Access API is also implemented in Safari and is a proposed addition<\/a> to the HTML specification. We welcome developer feedback, particularly around use cases that can not be addressed with this API.<\/p>\n

How can I test my website?<\/b><\/h4>\n

We welcome testing by both users and site owners as we continue to develop new storage access restrictions. Take the following steps to enable this storage access policy in Firefox:<\/p>\n

    \n
  1. Open Preferences<\/li>\n
  2. On the left-hand menu, click on Privacy & Security<\/li>\n
  3. Under Content Blocking, click the checkbox next to \u201cThird-Party Cookies\u201d<\/li>\n
  4. Select \u201cTrackers (recommended)\u201d<\/li>\n<\/ol>\n

    \"Preference<\/a><\/p>\n

    If you find a broken site, you can tell us about it directly in Firefox with the \u201cReport a Problem\u201d button<\/a> in the Control Center. If you encounter problems in the implementation of this policy, please let us know on Bugzilla<\/a>. Site owners may also be interested in our debugging tools<\/a>.<\/p>\n

    Does this mean Firefox will no longer support the Tracking Protection feature?<\/b><\/h4>\n

    Tracking Protection is still available to users who want to opt-in to block all tracking loads; with our updated UI, this feature can be enabled by setting \u201cAll Detected Trackers\u201d to \u201cAlways\u201d. All tracking loads will continue to be blocked by default in Private Browsing windows.<\/p>\n

    Expect to hear more from us in the coming months as we continue to strengthen Firefox\u2019s default-on tracking protection.<\/p>\n","protected":false},"excerpt":{"rendered":"

    As announced in August, Firefox is changing its approach to addressing tracking on the web. As part of that plan, we signaled our intent to prevent cross-site tracking for all … Read more<\/a><\/p>\n","protected":false},"author":1597,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30,847,69],"tags":[],"coauthors":[320791],"yoast_head":"\nFirefox 63 Lets Users Block Tracking Cookies - Mozilla Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Steven Englehardt\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/\",\"url\":\"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/\",\"name\":\"Firefox 63 Lets Users Block Tracking Cookies - Mozilla Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.mozilla.org\/security\/files\/2018\/10\/Preference-third-party-cookies-.jpg\",\"datePublished\":\"2018-10-23T13:00:05+00:00\",\"dateModified\":\"2018-10-23T12:59:31+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/4e57438e5a1cb316da982a0053c6ed53\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/#primaryimage\",\"url\":\"https:\/\/blog.mozilla.org\/security\/files\/2018\/10\/Preference-third-party-cookies-.jpg\",\"contentUrl\":\"https:\/\/blog.mozilla.org\/security\/files\/2018\/10\/Preference-third-party-cookies-.jpg\",\"width\":1080,\"height\":468,\"caption\":\"Preference panel screenshot showing how to enable third-party cookies.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/security\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Firefox 63 Lets Users Block Tracking Cookies\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/security\/\",\"name\":\"Mozilla Security Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/4e57438e5a1cb316da982a0053c6ed53\",\"name\":\"Steven Englehardt\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/921e0113c6856efe3f1960058729d00f\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4013c3a1151063bb911608e4c8dc6f23?s=96&d=identicon&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4013c3a1151063bb911608e4c8dc6f23?s=96&d=identicon&r=g\",\"caption\":\"Steven Englehardt\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Firefox 63 Lets Users Block Tracking Cookies - Mozilla Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/","twitter_misc":{"Written by":"Steven Englehardt","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/","url":"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/","name":"Firefox 63 Lets Users Block Tracking Cookies - Mozilla Security Blog","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/security\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/#primaryimage"},"image":{"@id":"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.mozilla.org\/security\/files\/2018\/10\/Preference-third-party-cookies-.jpg","datePublished":"2018-10-23T13:00:05+00:00","dateModified":"2018-10-23T12:59:31+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/4e57438e5a1cb316da982a0053c6ed53"},"breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/#primaryimage","url":"https:\/\/blog.mozilla.org\/security\/files\/2018\/10\/Preference-third-party-cookies-.jpg","contentUrl":"https:\/\/blog.mozilla.org\/security\/files\/2018\/10\/Preference-third-party-cookies-.jpg","width":1080,"height":468,"caption":"Preference panel screenshot showing how to enable third-party cookies."},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/security\/2018\/10\/23\/firefox-63-lets-users-block-tracking-cookies\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/security\/"},{"@type":"ListItem","position":2,"name":"Firefox 63 Lets Users Block Tracking Cookies"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/security\/#website","url":"https:\/\/blog.mozilla.org\/security\/","name":"Mozilla Security Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/security\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/4e57438e5a1cb316da982a0053c6ed53","name":"Steven Englehardt","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/security\/#\/schema\/person\/image\/921e0113c6856efe3f1960058729d00f","url":"https:\/\/secure.gravatar.com\/avatar\/4013c3a1151063bb911608e4c8dc6f23?s=96&d=identicon&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4013c3a1151063bb911608e4c8dc6f23?s=96&d=identicon&r=g","caption":"Steven Englehardt"}}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2409"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/users\/1597"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/comments?post=2409"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/posts\/2409\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/media?parent=2409"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/categories?post=2409"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/tags?post=2409"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/security\/wp-json\/wp\/v2\/coauthors?post=2409"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}