8 Firefox Privacy Tools for Researchers Who Open Dozens of Sources

Open forty sources in an afternoon and the ad networks embedded in those pages end up holding your reading list. The browser is one of the least examined instruments in research. A Firefox left on its defaults can reveal the shape of an investigation long before anything gets written. Eight tools reduce most of that exposure, and four of them are already installed.

The scale of the problem was measured a decade ago, when two Princeton computer scientists crawled the top million websites and found that news sites carried more trackers than any other category. Editorial pages pay for free articles with advertising, so they tend to load the most third parties. The crawl dates from January 2016, and since most publishers still fund their articles the same way, there is little reason to assume the ranking has flipped.

Say an analyst is reading up on a company her firm may acquire. Thirty pages about one mid-sized company, opened inside two hours, from one browser. An ad network present on a handful of those pages can reasonably infer that somebody has become very interested. Hardly anyone on a research team would email that source list to a stranger. A browser on default settings can pass along something close to it without being asked.

Start With the Protection Firefox Already Ships

1. Enhanced Tracking Protection in Strict mode. It is free and already in the browser, which is why it comes first, and in our view it covers more ground than most of the add-ons people install to do the same job. Even on the Standard setting, Firefox keeps each cookie locked to the site that set it (Mozilla’s name for this is Total Cookie Protection) and blocks the fingerprinters and cryptominers on its list. Strict mode, as Mozilla’s page on Enhanced Tracking Protection describes it, blocks tracking content in every window instead of only in private ones. It also clears the cookies left by bounce trackers, the redirects that route you through a tracking domain before you reach the page you clicked on.

Strict does break things now and then. Mozilla’s own warning lists logins, comment boxes and video players, since trackers are sometimes built into those parts of a page. You’ll find the option under Privacy & Security in Settings. Once it’s on, go through the databases and subscription sites you can’t work without and sign in to each. If one of them refuses to load, click the shield icon in the address bar. That switches protection off for that site only.

Block the Ads, Then Be Careful What Else You Install

2. 2. An ad blocker. Tracking protection works from a list of known trackers, which leaves the ads themselves, the pop-ups and the autoplay video still loading on forty pages at once. Adblock Plus for Firefox is the name most readers will recognize in this category, and for a heavy tab user the case for it has as much to do with attention as with privacy, because a page stripped of its ad slots is easier to read and to compare against the next one.

There is a security case as well. Criminals buy search ads that pose as real brands, and the problem was serious enough by December 2022 for the FBI to put out a public alert. Its advice included a line telling users to use an ad blocking extension when searching. A lot of background work begins with typing an organization’s name into a search bar, and the first result on the page is frequently an ad. A blocker removes that slot before a tired click lands on it.

Here the argument has to turn on itself. Every extension you install can read pages you visit, so a list of tools is also a list of things to trust. In December 2019, ghacks reported that four Avast and AVG extensions had disappeared from Mozilla’s add-on store, after a researcher showed they were sending the addresses and titles of visited pages back to Avast. It is the reason half of the eight tools here are settings Firefox already has and just three need installing. Anything beyond those three deserves a look at its publisher and its permissions before you click Add.

Keep Your Logins Out of Your Research Tabs

3. 3. Multi-Account Containers. This is Mozilla’s own extension, and it may be the one tool here that changes how research feels from day to day. Multi-Account Containers sorts tabs into color-coded groups with separate browsing data, so a login in one group does not exist in another.

A workable setup uses three. Paywalled subscriptions go in the first container and social platforms in the second, which leaves the third for the current investigation. That third container does the most good on days spent comparing outlets with different owners and funding models, since you will be visiting a dozen publishers in a row and none of them needs to see the account you use for email or social media. Regular sources can be pinned to a container with the “Always open this site in” option. You set it once per site, and Firefox handles the sorting from then on.

Clear the Banners and Clean the Links

4. Consent-O-Matic. Forty sources means forty cookie banners, and by the tenth most people click “Accept all” to reach the text. Researchers at Aarhus University built an extension that fills in those consent forms for you, applying your stored preferences and falling back to the most privacy-preserving option when a site invents its own categories.

The banners are often built to wear you down. A 2020 study of consent pop-ups on the UK’s top 10,000 websites found that only 11.8% of the designs it examined met the minimal requirements the authors drew from European law, and that removing the opt-out button from the first screen raised consent by 22 to 23 percentage points. A researcher on a deadline is the person that design works on.

5. Copy Clean Link. Few roundups of privacy tools mention this one, probably because there is nothing to install. Right-click a link, or the URL in the address bar, and Firefox offers to copy it without the tracking parameters that sites tack on the end. A raw link often carries a campaign tag naming the newsletter that sent you to the article, and whoever clicks it from your document inherits the same tag. Clean URLs are also easier to deduplicate in a shared reference list.

One caveat on scale. Someone checking four hundred articles a week for mentions of a company is doing collection, and at that volume the browser is probably the wrong instrument. There is a long-running argument over whether an API or a scraper is the better way to gather that kind of data, and either usually beats a person clicking through consent banners.

Mask Your Email and Encrypt the Connection

6. Firefox Relay. More and more sources want an email address before they hand over a report or a dataset. With Firefox Relay, you give them a masked address instead, and anything sent to it is forwarded to your real inbox with common email trackers removed. The free plan stops at five masks. That limit is a good reason to use one mask per publisher, so that spam arriving at a masked address tells you which registration it came from. Larger teams that track coverage for a living tend to avoid the signups by paying for media monitoring platforms to do the collecting. A researcher working alone rarely has that budget.
7. DNS over HTTPS and 8. HTTPS-Only Mode. Both of these guard the connection between you and the site, and they earn their place on shared Wi-Fi in libraries, airports and conference venues. Every time you visit a site, your browser first looks up its address, and whoever runs the network can read those lookups. DNS over HTTPS encrypts them. Desktop users in the United States have had it on by default since 2019 and Canadians since 2021. The default has a weak spot, though, because Firefox goes back to ordinary DNS whenever an encrypted lookup fails.

With HTTPS-Only Mode switched on, Firefox will not open an unencrypted page until you say so. We would enable it for all windows, knowing that some old municipal archives and small newspaper sites will bring up a warning page. You can continue past it, or add a permanent exception for an archive you visit often.

Set Up the Eight Before Your Next Deadline

None of this makes a researcher invisible. The publisher still logs your visit, a subscription login identifies you more precisely than most trackers could, and these tools do little about a fingerprint built by a script that no blocklist has caught yet. There is also the question of who pays. Many of the outlets a researcher depends on are funded by the advertising these tools suppress.

Our suggestion is to treat ad blocking as a choice you make per site. Set aside one sitting to move Firefox to Strict, add the three extensions and build your containers. After that, go back to the publications whose reporting you depend on and allow their ads, if keeping them funded matters to you. Your next forty-tab afternoon should then leave far less of a trail.