Real-World Privacy Stack

Here’s a realistic “privacy stack” model—not the fantasy version where you disappear, but what actually works today against modern ad tracking and identity merging.

We’ll split it into levels so you can see what each layer achieves.

Level 1 — Basic privacy (stops most casual tracking)

This is what most people mean by “private browsing,” but done properly.

Use:

• Brave Browser or hardened Firefox

Add:

• Block third-party cookies

• Enable “strict tracking protection”

• Disable cross-site tracking permissions

• Use built-in ad/tracker blocking

What this achieves:

• Stops most ad retargeting (“you looked at shoes once, now they follow you”)

• Reduces cookie-based identity linking

• Cuts down tracking scripts significantly

What it does NOT stop:

• Fingerprinting (still quite possible)

• Logged-in tracking (Google, Meta, etc.)

• IP-based inference (basic level)

Level 2 — Strong privacy (breaks most cross-site linking)

Add on top of Level 1:

• Separate browser profiles (work / personal / random browsing)

• Disable or restrict JavaScript on unknown sites (optional but powerful)

• Use container tabs (Firefox-style isolation)

What this achieves:

• Prevents easy cross-site identity merging

• Makes tracking graphs fragment into smaller clusters

• Stops many “same session across sites” links

Tradeoffs:

Some websites break or degrade

More friction in daily browsing

Level 3 — Network privacy layer (hides location + ISP identity)

Use:

• Proton VPN or similar reputable VPN

What it adds:

• Hides real IP address

• Prevents ISP-level tracking

• Reduces geolocation accuracy

What it does NOT solve:

• Browser fingerprinting still works

• Logged-in accounts still identify you

• Behavioural linking still possible

Important reality:

VPN = “where you appear to be from,” not “who you are”

Level 4 — Anti-fingerprinting stance (high privacy)

This is where things get serious.

Best option:

• Tor Browser

What it does differently:

Instead of trying to hide you, it:

• Makes all users look the same

• Standardises fonts, canvas output, screen behaviour

• Limits many browser APIs

• Routes traffic through Tor network

What this breaks:

• Cross-site fingerprint matching (very effective)

• IP-based linking

• Most behavioural correlation across sites

What still works against it:

• Logging into accounts (instant identity anchor)

• Behaviour inside a single site

• Advanced server-side correlation (rare, expensive)

Level 5 — “High anonymity” operational behaviour (the part most people miss)

Even with Tor/VPNs, your behaviour can re-identify you.

To avoid that:

• Don’t log into personal accounts in anonymous sessions

• Don’t reuse usernames/emails across contexts

• Don’t mix identity “modes” (e.g. Tor + personal Gmail)

• Avoid repeating timing patterns (same browsing habits daily)

• Don’t open downloaded files outside the protected environment

This is called avoiding cross-context contamination.

Putting it all together (real-world stacks)

🟢 Normal privacy user

Brave + ad blockers

→ good for stopping ads and trackers

→ still fingerprintable

🟡 Strong privacy user

Firefox (hardened) + VPN + containers

→ breaks most tracking ecosystems

→ moderate fingerprint resistance

→ still linkable with enough data

🔴 High privacy user

Tor Browser + strict separation of identities

→ defeats most cross-site tracking

→ best practical anonymity tool available

→ slower + some usability tradeoffs

The key insight most people miss

Modern tracking doesn’t rely on one identifier.

It works like this:

“If enough weak signals point to the same pattern, we treat it as the same person.”

Privacy tools don’t need to make you invisible—they just need to:

• reduce uniqueness

• reduce consistency

• reduce linkability

Once those drop, tracking becomes guesswork instead of certainty.