The best ways to block online trackers

Online trackers are the quiet layer behind targeted advertising. They include cookies, tracking pixels, advertising identifiers, scripts and browser fingerprinting, all of which can join separate visits into a behavioural profile. The same systems may follow a person from a news site to a shopping site, an email link or a mobile app, often without revealing an obvious tracker name.

Blocking online trackers can cut exposure to cross-site profiling and irrelevant advertising, but it is not the same as blocking every advert. Some protections work at browser level, others at network level, and apps need separate controls. A sensible setup improves privacy without pretending that a single extension makes someone invisible online.

Start with the browser because most Australians manage daily browsing there, then add network and device controls only where they solve a clear gap. Keep the configuration simple enough to maintain, test important sites after changes, and remember that good privacy comes from several complementary safeguards rather than a perfect product.

What online trackers actually collect

Not every cookie is dangerous. A first-party cookie can keep a banking session secure or remember a basket, while a third-party cookie set by an advertising network can follow the user across unrelated sites. Device fingerprinting takes a different approach, combining browser characteristics, screen details and timing patterns to create a probable identifier. Tracking pixels, audio beacons and platform advertising IDs add more signals, making the resulting profile detailed even when no single technology appears especially invasive.

Websites also learn through aggregate analytics, and an apparently harmless page may contain scripts from several third parties. Even an article about ethical project investing can carry analytics or advertising requests, so a visit may be attached to an existing profile rather than remain anonymous. Financial and health-related reading deserves particular care because inferred interests can become surprisingly revealing. Data brokers may then repackage identifiers or behavioural segments for other companies, extending the life of information beyond the site that first collected it.

Browser controls that make the biggest difference

Start with the protections already built into a major browser. Safari’s Intelligent Tracking Prevention, Firefox’s Enhanced Tracking Protection and the tracking controls in Chrome and Edge can limit cross-site follow-up without specialist software. Review third-party cookie choices, clear browsing data periodically and decline prompts that are not needed for the page to work. Browser settings are also the best place to remove saved account details on a shared or borrowed computer.

Extensions can fill the gaps, but overlapping tools can conflict or duplicate their work. uBlock Origin stops many requests to advertising and tracker domains and can reduce the amount of code loaded by a page. Privacy Badger targets companies that track people across sites, while ClearURLs strips known tracking parameters from links. Give an extension only the permissions it needs, keep it updated, and avoid blocking lists so aggressive that essential buttons stop working.

Search habits matter as well. A precise query can reveal location, health concerns or a purchase plan, and search engines may connect it with an existing account. Signing out, using a search engine with stronger privacy protections and avoiding personalised results can reduce the link between a query and a profile. Private browsing mainly hides local history; it does not block fingerprinting, conceal an IP address or prevent a site from identifying a logged-in account.

DNS, VPNs, apps and email

DNS filtering works one level below the browser. It blocks connections to known advertising and tracking domains, either through a filtering resolver, a supported device setting or a router. Encrypted DNS such as DNS over HTTPS or DNS over TLS protects those lookups from casual interception on the local network. It will not stop a tracker hosted on the same domain as the site being viewed, and it cannot remove first-party analytics already downloaded by a permitted script.

A reputable VPN adds encryption between the device and the VPN provider, which is useful on public Wi-Fi such as the café and airport networks used across Sydney, Melbourne and other Australian cities. It can also stop an internet service provider from seeing DNS queries on an NBN connection supplied by a provider such as Telstra, Optus or Vodafone. The destination still receives the connection details, however, and a VPN provider can observe metadata, so the service must be trusted rather than treated as magical anonymity.

Mobile apps need their own controls. Apple’s App Tracking Transparency prompts for permission to track across apps and sites, while Android’s Privacy Dashboard and advertising ID settings offer similar limits on supported versions. Banking, loyalty and retail apps—including those from Australian firms such as Commonwealth Bank, Woolworths and Coles—may collect analytics or crash reports alongside their core functions, so location, contacts and microphone access should be reviewed rather than granted automatically. In email, remote images and tracking links can report opens or confirm that a message reached a particular inbox.

A practical privacy baseline for Australia

The Office of the Australian Information Commissioner administers the Privacy Act 1988 and the Australian Privacy Principles, giving Australians rights to access and correct personal information held by covered organisations. Those rights differ from a browser setting: a tracker may operate without an obvious commercial relationship, and a request to one company may not remove a profile held by another. OAIC guidance on data brokers and direct marketing is useful for understanding those wider flows, while the mandatory notifiable data breaches scheme addresses a separate problem after information has been exposed.

Publishers also use on-site analytics and search research to understand what readers want. A discussion of keyword competitiveness shows how ordinary queries can become market intelligence, which is useful for editorial planning but does not make intrusive collection necessary. Smaller sites and Australian businesses can gain similar insight with privacy-respecting analytics that aggregate data, shorten retention periods and avoid selling identifiable profiles.

• Enable standard tracking protection in each browser, remove unnecessary permissions and sign out of accounts on shared devices.
• Use one well-maintained blocker for scripts or trackers, adding specialised extensions only when a clear gap remains.
• Apply DNS filtering on the home network, or encrypted DNS on devices where the router cannot support it.
• Review app advertising IDs, location and contact permissions every few months, and disable remote images in email.

These measures reduce the amount of information sent onward, but they do not automatically erase profiles that already exist. Resetting an advertising ID, deleting old retailer and social-media accounts, and using available privacy dashboards can close part of that gap. Filters may also cause publishers to show fewer ads or replace them with less targeted promotions, a visible trade-off that is easier to accept than opaque profiling.

Building a layered routine that lasts

A workable routine begins with automatic browser protection and one trusted blocker, followed by DNS filtering for the home network. Use clean links when a message or article includes them, remove unnecessary parameters from copied addresses, and keep an eye on newly installed browser extensions. These steps cover the largest everyday sources of cross-site tracking without requiring constant technical work.

Expect occasional breakage. Aggressive filters can interrupt ticketing, banking or shopping sites, especially when scripts serve security functions as well as advertising. Keep exceptions narrow, record why each one is needed and retest after browser updates. On shared family devices, separate browser profiles, a private session and clear downloads can prevent one person’s accounts or history from being exposed to everyone else.

A short review after major operating-system changes, or once per quarter, keeps permissions, extensions and account settings from drifting. The privacy benefit also depends on the accounts and services involved, so removing unused newsletters and old shopping logins is as useful as changing technical settings. The practical takeaway is to combine automatic browser protection, one carefully maintained blocker, sensible DNS or VPN use and periodic account reviews; layered controls maintained over time provide stronger privacy than any single setting.