Open any of the four major browsers on a new laptop and you’ll be asked, within the first few screens, to “set your privacy preferences”. Almost nobody does. Most of us click through and start typing in the address bar, which means the default settings baked in by Google, Apple, Mozilla and Microsoft are, in practice, the only privacy settings most Australians will ever have. That’s worth taking seriously, because those defaults are wildly different between browsers, and the gap between them has actually widened over the past couple of years rather than narrowed.
We went through the current privacy and tracking controls in Chrome, Safari, Firefox and Edge on both desktop and mobile, the way an ordinary reader would find them rather than the way a developer would. The differences aren’t subtle. Comparing browser privacy settings properly means looking at what’s blocked out of the box, not what’s theoretically possible if you dig through eleven sub-menus, because almost nobody digs through eleven sub-menus.
Why this matters more than it used to
Tracking cookies, the small files that let advertisers follow you from site to site and build a profile of your browsing habits, used to be the main privacy battleground. They still matter, but the fight has moved on to fingerprinting: techniques that identify your device by its screen size, fonts, battery level and dozens of other quiet signals, without needing a cookie at all. A browser that blocks third-party cookies but does nothing about fingerprinting is really only solving half the problem, and that’s exactly where a couple of the big four still fall short.
The stakes for Australians specifically come down to data broking and targeted scams. The OAIC has flagged data brokering and profiling as an area of growing concern under Australian privacy law, and the top cybersecurity threats facing Australians we’ve covered before increasingly start with a scammer who already knows more about you than they should, because some ad network sold a profile that included your suburb, your recent purchases and your browsing habits. Tighter browser defaults won’t fix that on their own, but they genuinely reduce the raw material available to build those profiles in the first place.
Chrome: the default nobody questions
Chrome remains the browser most Australians use, largely because it comes pre-installed or pre-recommended on so many devices. Its privacy story is improving, slowly. Google has been phasing out third-party cookies and replacing them with its “Privacy Sandbox” approach, which groups users into interest categories on-device rather than tracking them individually across the web. The theory is sound. The practice is that Google is still, fundamentally, an advertising company grading its own homework.
Chrome’s “Enhanced Safe Browsing” setting, found under Privacy and Security, is genuinely worth turning on, it checks sites and downloads against Google’s threat list in closer to real time. But fingerprinting protection is still limited compared with its rivals, and Chrome ships with sync turned on by default for anyone signed into a Google account, which means your browsing history is, by design, part of your Google profile unless you go in and switch it off.
Our take: Chrome is adequate once you’ve spent ten minutes in the settings menu, and roughly nobody does.
Safari: privacy as the selling point
Apple has made privacy a marketing pillar for years now, and on this particular comparison the marketing mostly checks out. Safari’s Intelligent Tracking Prevention uses on-device machine learning to identify and block cross-site trackers automatically, no settings menu required. It also includes “Private Relay” for iCloud+ subscribers, which routes browsing traffic through two separate relays so neither Apple nor the websites you visit can see both your identity and your destination at once.
The catch is that Private Relay sits behind a paid iCloud+ subscription, and plenty of Australians running Safari on an older iPhone or a shared family iCloud plan won’t have it switched on even if they’re entitled to it. Safari’s defaults for everyone else, tracker blocking, limited fingerprinting resistance, no third-party cookies, are still the strongest “do nothing extra” baseline of the four. Apple’s own privacy overview covers the mechanics in plain terms if you want to check what’s switched on for your account.
Short version: Safari does the most for people who never open the settings app, which, let’s be honest, is most of us.
Firefox: the one built for this fight
Firefox is the browser that treats privacy as the actual product rather than a feature bolted onto an advertising business or a hardware ecosystem. Its “Enhanced Tracking Protection”, set to Standard by default, blocks known trackers, cryptominers and fingerprinting scripts without you needing to touch anything. Switch it to Strict and it blocks considerably more, at the occasional cost of a site rendering oddly, which is the trade-off every privacy-first browser eventually runs into.
Mozilla is a non-profit-adjacent foundation rather than an advertising company, which changes its incentives in a way worth pausing on. It still needs revenue, largely from a default search engine deal, but it isn’t selling your attention to advertisers the way Chrome’s parent company ultimately is. Firefox also supports “Total Cookie Protection”, which isolates cookies per site so a tracker embedded on multiple pages can’t link your activity between them.
This is, genuinely, our mildly contrarian opinion: of the four, Firefox is the one we’d actually recommend to most ordinary Australian readers, not Safari. Apple’s privacy tools are excellent but increasingly tied to buying more Apple hardware and subscriptions; Firefox gets you most of the same protection on Windows, an old laptop, a work PC, anywhere, for nothing, and it doesn’t quietly make your decisions for you about which features to withhold until you upgrade.
Edge: Chrome’s engine, Microsoft’s defaults
Edge runs on the same Chromium engine as Chrome, which surprises some readers who assume it’s a totally separate build. Underneath, though, Microsoft has made genuinely different choices. Edge’s tracking prevention has three levels, Basic, Balanced and Strict, with Balanced as the out-of-box default, and Strict is a legitimately aggressive setting that blocks the large majority of third-party trackers without needing an extension.
Where Edge loses points is the sheer number of Microsoft-specific extras layered on top: shopping prompts, Copilot integration pulling in browsing context, and a “Microsoft Rewards” layer that, in our view, muddies what should be a simple privacy conversation with a loyalty programme nobody asked a browser to run. If you’re on Windows 10 without paid Extended Security Updates, which now run through to October 2027 for consumers who enrol, Edge’s Strict tracking setting is worth switching on as one small offset against an operating system that’s otherwise past its support date.
Edge is a perfectly solid Chromium browser with a genuinely stronger privacy dial than Chrome itself, buried under more marketing than it deserves.
The settings worth changing today
If you only do three things this afternoon, these are the ones that matter across all four browsers.
- Turn tracking protection to its strictest useful setting, Strict in Edge and Firefox, Enhanced in Chrome’s Safe Browsing, and check Safari’s cross-site tracking toggle is on under Privacy in Settings.
- Clear or block third-party cookies specifically, rather than all cookies, so logins keep working while cross-site tracking doesn’t.
- Check your sync settings if you’re signed into a Google, Microsoft or Apple account, because browsing history syncing to the cloud is a privacy decision in its own right, separate from tracking protection.
None of this replaces a decent ad blockers and tracker blockers setup if you want to go further, and if you’re managing logins across devices it’s worth pairing whichever browser you land on with one of the password managers compared for 2026 rather than relying on the browser’s built-in password storage, which is convenient but tied to that one ecosystem.
The part nobody advertises: search engines
Here’s the thing the settings menus don’t mention: your default search engine often does more tracking than your browser. Chrome defaults to Google Search, Edge defaults to Bing, and both log your searches against your account if you’re signed in, regardless of how tight your tracker-blocking settings are. Firefox and Safari let you swap the default search engine in a couple of taps, and it’s one of the highest-value five-minute changes available, because search queries are arguably more revealing than browsing history. People type things into a search bar they’d never type into a URL.
This is also where the fingerprinting conversation loops back to scam prevention. A scammer or a dodgy comparison site doesn’t need to hack you if an ad network has already handed over a profile built from months of searches and site visits. The ACCC’s Scamwatch has repeatedly flagged how personalised scam messaging has become, and a chunk of that personalisation traces back to exactly the tracking these settings exist to block. It’s a quieter version of the same arms race that played out with email spam filters two decades ago: the defence gets better, the targeting gets smarter, and the browser vendors are perpetually one step behind the ad-tech industry they’re nominally policing.
Our pick for ordinary Australian users
If you want the honest, no-fuss recommendation: Firefox for anyone willing to install something other than the default, Safari for iPhone and Mac users who’ll never change a setting, and Edge over plain Chrome if you’re stuck on Windows and want a one-click upgrade with no new software to learn. Chrome is the one we’d actively steer people away from as a default, not because it’s unsafe, but because its privacy posture is still shaped by the fact that Google’s core business depends on knowing who you are.
None of these browsers will stop a determined data broker on their own, and none of them are a substitute for basic scam awareness, the kind we’ve written about before, like scam calls and robocalls in Australia. But the defaults genuinely matter, more than most people assume, and the ten minutes it takes to check them is about the best return on effort going in everyday tech maintenance.
— Dale Whitfield, Founding Editor, Tech Geek
