Firefox Put Every Site In Its Own Jar
Since 2022, Firefox has shipped Total Cookie Protection on by default for every user worldwide. The idea is simple to picture: instead of one shared cookie store that trackers can read across sites, Firefox gives each website its own separate "cookie jar." Mozilla's own example is blunt. If you visit Facebook, Facebook can't see your activity on Etsy, because the cookies it sets on Etsy live in Etsy's jar and nowhere else.
That's a structural change, not a blocklist. Older tracking protection worked like a spam filter, blocking domains someone had already flagged. Total Cookie Protection doesn't wait for a domain to be identified. Every third party is isolated to the site it appears on, whether anyone has heard of it or not.
Two Layers: ETP And Total Cookie Protection
Firefox stacks two mechanisms. Enhanced Tracking Protection (ETP) is the blocklist layer, and Total Cookie Protection is the isolation layer built into it. They do different work:
- ETP blocks known trackers outright using Mozilla's tracking lists, so flagged social trackers, cryptominers, and fingerprinters never load.
- Total Cookie Protection confines every cookie to the site that created it, so even a tracker that isn't on any list can't follow you between sites.
Per Mozilla's documentation, Total Cookie Protection "confines every cookie to the website where it was created." The combination means Firefox limits both the trackers it recognizes and the ones it doesn't.
Firefox ETP: Standard vs Strict
| Blocked | Standard (default) | Strict |
|---|---|---|
| Cross-site tracking cookies | Blocked; other third-party cookies isolated by Total Cookie Protection | All cross-site cookies blocked |
| Social media trackers | Blocked | Blocked |
| Tracking content (ads, scripts) | In private windows only | In all windows |
| Fingerprinters and cryptominers | Blocked | Blocked |
| Bounce (redirect) tracking | Not enforced | Bounce Tracking Protection active |
Standard Mode Is What Most Users Actually Have
The default matters more than the strict option, because most people never change it. In Standard mode Firefox already blocks social media trackers, cross-site tracking cookies, cryptominers, and fingerprinters, and it runs Total Cookie Protection to isolate everything else. Tracking content (the ad and analytics scripts themselves) is blocked in private windows only, which keeps most sites from breaking in normal browsing.
Strict mode goes further: it blocks all cross-site cookies, blocks tracking content in every window, adds Enhanced Cookie Clearing, and turns on Bounce Tracking Protection. Bounce protection targets redirect trackers, the ones that bounce you through an intermediate URL to set an identifier. Firefox classifies those domains and clears their cookies and storage if you don't actually interact with them.
What It Means For Your Tracking
If your setup relied on third-party cookies or cross-site pixels, Firefox already broke that quietly for its whole user base. What still works is genuine first-party measurement on your own domain, within that site's cookie jar. What doesn't survive is any attempt to read the same identifier across two different sites you operate, because each site gets its own isolated jar.
There's a second, subtler effect. Firefox also strips tracking parameters in some flows (its Copy Clean Link feature removes them when a user copies a URL), and Strict mode's bounce protection erases redirect-based identifiers. So the same attribution signals ITP shortens in Safari are also degraded in Firefox, through a different route. Treat first-party, consent-based measurement as the durable path, covered in First-Party Data Strategy.
Isolation Is Not Consent
Total Cookie Protection stops one site's cookies from reaching another. It does nothing about whether you had a legal basis to set those cookies in the first place. A first-party analytics cookie sitting neatly in its own jar is still a non-essential cookie that, under ePrivacy, needs prior consent before it's written. Firefox protects its user from cross-site tracking; it doesn't handle your compliance, and it doesn't apply to the Chrome and Safari visitors who make up most of your traffic. That gap is exactly what a consent banner exists to close.
Where CookieBeam Fits
CookieBeam blocks your non-essential tags until the visitor consents, in Firefox and every other browser, so your legal obligation is met consistently instead of being partially and unpredictably enforced by whatever browser someone happens to use. Our scanner inventories the cookies, scripts, and outbound connections your pages load so each one lands in the right consent category. Be aware the scanner reports the full tracker surface from a controlled browser environment, not the reduced set a Firefox user sees after ETP and Total Cookie Protection have done their filtering. You gate based on what your site loads; the browser is a bonus layer for the user, not your compliance mechanism.
Related Guides and Sources
Compare browsers in Safari ITP Explained for Marketers and Brave Browser, Shields, and Your Consent Banner, and see the conceptual split in Browser-Level Blocking vs Consent Management. Primary sources: Mozilla's Total Cookie Protection in Standard Mode and Enhanced Tracking Protection in Firefox support articles.