Mozilla Explains Stronger Firefox Anti-Fingerprinting: What Web Developers Need to Test
In research published on November 10, 2026, Mozilla explained how Firefox is making its users harder to distinguish through browser fingerprinting, a tracking method that can work without cookies. The company’s research suggests that limiting a relatively small set of highly distinctive browser signals can substantially weaken the ability to identify a specific user across websites.
For web developers, the important lesson is not that a new blanket privacy switch was flipped this week. Mozilla describes protections developed from its research and shipped over time, with the most recent changes evaluated in its report appearing in Firefox 145. Some protections apply by default in regular browsing, while other defenses are currently available through Private Browsing or Strict Enhanced Tracking Protection.
What a fingerprinting script looks for
A fingerprinting script may combine information about screen dimensions, installed fonts, graphics rendering, audio behavior and the number of logical CPU cores. Each detail may appear innocuous. Together, those values can be distinctive enough to help track someone between sites, even when no cookie is stored.
Mozilla’s research used measurements from nearly 25 million Firefox users, with additional privacy protections for the study data. Rather than hiding every browser capability, the project studied which attributes contributed most to distinctiveness and how to reduce exposure without breaking ordinary web applications.
The company highlights several examples:
- Firefox can limit information about screen resolution to avoid revealing the exact size and position of the operating system’s taskbar or dock.
- Processor counts exposed to scripts can be bucketed into values such as four or eight rather than the exact hardware count.
- The research informed more consistent outputs for image rendering, Web Audio and certain Android mathematical operations.
Mozilla says these steps reduce uniqueness and create larger groups of browsers that look similar to tracking scripts. They do not make fingerprinting impossible. Trackers can adapt, and privacy improvements need to be tested against site compatibility.
What changes for website teams
Web applications should not assume that browser-exposed hardware or display details are stable, exact identifiers. For responsive layout, measure the available viewport and use CSS capabilities rather than deducing a user’s device model. For workload sizing, avoid treating navigator.hardwareConcurrency as a permanent or precise CPU inventory.
For graphics and audio features, test the actual feature or output required by your application rather than expecting byte-for-byte device-specific results. Be especially careful if a third-party anti-abuse, analytics or identity product depends on browser attributes: an identifier inferred from them may behave differently across browsing modes. Legitimate abuse prevention should use risk-appropriate mechanisms and privacy-conscious signals, not silently depend on fingerprint uniqueness.
Web2Generators’ browser Network inspection guide provides a practical way to audit requests made by scripts and embedded services. Network inspection cannot by itself prove the absence of fingerprinting, since script-level reads of browser properties may occur locally before a value is sent. But it can show where data goes and help a team identify unexpected third-party connections.
A useful cross-browser testing checklist
Test in a standard Firefox window, a private window and Strict Enhanced Tracking Protection mode. Check whether a feature fails gracefully when an attribute is rounded, standardized or unavailable. Compare behavior with other browsers rather than assuming that every browser exposes identical hardware values.
For background on the data websites keep in the browser, see our guide to localStorage, sessionStorage and cookies. Fingerprinting is a separate mechanism: clearing stored values does not necessarily stop a script from recognizing the same browser again.
Our report on Safari’s block on email-based identity resolution tracking covers another way sites can link identities across visits. Review both browser-derived signals and identifiers supplied to third parties when checking your own integrations.
The broader direction
Mozilla is publishing the work as open research, including a paper accepted for CCS 2026 and a companion browser test site. The message for developers is to design for less precise browser signals while continuing to use standard, explicitly supported APIs for real user features.