Abyss Privacy Playbook

Lock Down Your Browser and Stop Web Tracking

Most of the tracking that follows you around the web happens inside your browser, and two separate mechanisms are doing it: cookies, the old way, now in decline, and fingerprinting, the harder-to-block way that's taking over. You handle them differently — and thanks to a major change in how browsers work, the single highest-impact move is often just choosing a better browser.

Block third-party cookies — and know the real story. Despite years of "cookies are dying" headlines, Google reversed course in 2024 and is not removing third-party cookies from Chrome. They still work, and in Chrome they're on by default. Safari, Firefox, and Brave block them automatically; Chrome makes you do it yourself.

• Chrome: Settings → Privacy and security → Third-party cookies → Block third-party cookies.
• Safari / Firefox / Brave: already blocked by default — worth confirming in privacy settings, but you're covered.
• What it does: stops the cross-site cookie that lets advertisers follow you from page to page. What it doesn't: it won't stop fingerprinting or a site's own first-party tracking.

Understand fingerprinting — the harder problem. Even with cookies blocked, a site can combine your screen size, fonts, browser version, graphics hardware, and timezone into a "fingerprint" unique enough to recognize you with no cookie at all. It's much harder to stop.

• Browsers with built-in defenses help: Brave randomizes your fingerprint, Tor Browser makes every user look identical, and Firefox has a resist-fingerprinting mode, though it can break some sites.
• See what you're actually leaking with EFF's free Cover Your Tracks test.
• Honest limit: fingerprinting is an arms race. No everyday tool makes you fully unfingerprintable except Tor Browser, which carries real usability costs. The realistic goal is raising the cost of tracking you, not vanishing.

The browser you choose is now the biggest lever — here's why. In 2024–25, Google finished moving Chrome to a new extension system (Manifest V3) that gutted the most powerful ad and tracker blockers. The full version of uBlock Origin — the gold-standard blocker — no longer runs on Chrome; Chrome users get only a weaker "Lite" version. It still runs at full strength on Firefox and Brave. So your browser choice now directly determines how well you can block tracking.

• Firefox: the privacy power-user's pick. Full uBlock Origin works, with strong built-in tracking protection.
• Brave: blocks ads, trackers, and fingerprinting out of the box; Chromium-based but still runs full uBlock Origin; the easiest "set it and forget it."
• Safari: solid defaults for Apple users who won't switch.
• Tor Browser: the strongest anonymity, but slow and breaks some sites — for high-risk situations, not daily use.
• Mullvad Browser: Tor Browser's anti-fingerprinting without the Tor network; pair it with a VPN.
• Chrome: the weakest of the bunch for this now — gutted blockers, third-party cookies on by default, and it's made by an advertising company. If you won't leave it, at least block third-party cookies and install uBlock Origin Lite.

• Firefox
• Brave
• Tor Browser
• Mullvad Browser
• DuckDuckGo

Install a real blocker. On Firefox or Brave, install full uBlock Origin — it blocks ads, trackers, and many fingerprinting scripts in one move. On Chrome, uBlock Origin Lite is the most you can get under the new rules.

Small wins that compound.

• Use a private search engine — DuckDuckGo, Brave Search, Startpage, or Mullvad — so your searches aren't tied to a profile.
• Strip tracking tags from links before you share them: the ?fbclid=, ?gclid=, and utm_ bits identify where a click came from. Some browsers and extensions remove these automatically.
• Watch for email tracking pixels — invisible images in marketing emails report when and where you opened them. Turn off automatic image loading, or use a mail app that blocks trackers.

What this does and doesn't do: blocking cookies and trackers and switching to a privacy-respecting browser removes the bulk of routine commercial tracking — the profiling that quietly follows the default majority. It does not make you anonymous: your IP address, your logged-in accounts, and fingerprinting still tie activity back to you, and only Tor-class tools come close to real anonymity. The goal here is to stop being the easy, automatically-tracked default.

Reset or Delete Your Advertising ID

Your phone carries a unique advertising ID — Apple calls it the IDFA, Android calls it the GAID. It isn't your name, but it's a persistent tag that apps, ad networks, and data brokers use to stitch together your app activity, location, and habits into a profile they buy and sell. Clearing it is one of the fastest, highest-impact privacy steps you can take, and it costs about a minute.

On iPhone

• Go to Settings → Privacy & Security → Tracking and turn off "Allow Apps to Request to Track." With this off, apps can't access your IDFA — it's handed to them as a string of zeros instead.
• Then go to Settings → Privacy & Security → Apple Advertising and turn off Personalized Ads.
• Note: iPhone no longer has a "reset" button the way Android does. That's because opting out zeroes the identifier entirely, which is stronger than rotating it.

Apple - app tracking

On Android (exact path varies by manufacturer)

• Go to Settings → Privacy → Ads, or Settings → Google → Ads.
• Choose Delete advertising ID to remove it outright (available on Android 12 and later) — apps then receive a string of zeros. Or choose Reset advertising ID to swap in a fresh one.
• Deleting is stronger than resetting. If your phone only offers reset, do it regularly.

Google - advertising ID

Bonus — feed it to DROP (California): Your advertising ID is one of the identifiers data brokers key on. If you live in California, you can enter it into the state's free DROP portal to have registered data brokers delete what they've tied to it. (See the Rights section below.)

What this does and doesn't do: it removes one of the most durable tags pointed at your device and makes profiles harder to maintain. It is not invisibility — apps can rebuild a profile over time through other means — so treat it as routine maintenance, or just delete the ID and leave it deleted.

Know — and Use — Your Biometric Privacy Rights

You have more rights over your face data than most people realize, but they depend heavily on where you live. Here's the honest map.

If you're in the EU or EEA (GDPR): Face data used to identify you is "special category" data under Article 9 — companies generally need your explicit consent to process it. You have the right to ask what a company holds about you, the right to erasure (the "right to be forgotten," Article 17), and the right to complain to your national Data Protection Authority. Organizations generally must respond to an erasure request within about 30 days. This is the framework behind the repeated multi-million-euro fines against Clearview AI for scraping faces without consent — and under the newer EU AI Act, building facial-recognition databases by untargeted scraping of face images is now outright prohibited.

EU - find your Data Protection Authority

If you're in Illinois (BIPA): Illinois has the strongest biometric law in the United States. A company must get your informed written consent before collecting your faceprint, fingerprint, or other biometric identifier — and Illinois is the only U.S. state where you can personally sue a company that doesn't (a "private right of action"). A 2024 amendment limited damages to a single recovery per person rather than one per scan, but the consent requirement and your ability to sue both remain intact.

Illinois BIPA statute

Other U.S. states: Texas and Washington also have biometric laws, but they're enforced by the state attorney general, not by you directly — you can't file your own lawsuit. Separately, around 20 states now have broad consumer-privacy laws (such as California's CCPA/CPRA) that classify biometric data as sensitive and give you rights to access and delete it.

The honest scope: GDPR rights are for people in the EU/EEA — a U.S. resident generally cannot invoke GDPR for domestic data processing, despite what a lot of privacy advice implies. Your strongest U.S. levers are your own state's privacy law, BIPA if you're in Illinois, and deletion tools like California's DROP. Check what your state actually offers before assuming a right applies to you.

Putting it to use:

• File an access or deletion request directly with companies that hold your data.
• For face-search engines, use their opt-out (see the next section).
• If you live in Illinois, Texas, or Washington, you can request deletion of your facial data from scrapers like Clearview AI.

IAPP US state privacy tracker

This is general information, not legal advice. Biometric law is changing quickly and varies by state and country — confirm the current rules for where you live, and talk to a lawyer for anything specific to your situation.

Photo Hygiene — Control What Your Pictures Give Away

Every photo you post can leak more than the image itself. There are two separate things to manage: the hidden data baked into the file, and your face becoming searchable.

A. Strip the location data out of your photos. Photos can embed GPS coordinates, a timestamp, and your device model in their metadata (called EXIF). Post an un-stripped photo taken at home and you may be broadcasting your address.

• Stop geotagging at the source. iPhone: Settings → Privacy & Security → Location Services → Camera → Never. Android: open the Camera app's settings and turn off location/GPS tags.
• Strip it on the way out. iPhone: when you share a photo, tap Options at the top of the share sheet and toggle off Location.
• Most large social platforms strip EXIF automatically when you upload, but photos sent by email or messaging, or posted to smaller sites and forums, often keep it. When in doubt, strip it.

B. Keep your face from becoming a search key. Reverse-face-search engines like PimEyes and FaceCheck.ID let anyone upload a photo of you and find other pictures of your face across the public web, complete with source links. This is the threat most people have never heard of.

• Audit yourself first. Search your own face on PimEyes to see what's already indexed.
• Opt out. PimEyes has an opt-out form: you upload a clear full-face photo and an anonymized ID to verify it's you. It removes matching results from PimEyes' searches. FaceCheck.ID has its own separate opt-out.
• Know the catch before you do it. Opting out removes you from that engine's results only — the original images stay on the sites they were scraped from, photos can reappear later at new web addresses (so you may need to repeat it), and other face-search engines exist that you'd have to handle separately. It also means handing a face-search company a fresh selfie and a copy of your ID, which is an uncomfortable trade for a service you may not trust. It's a real reduction in exposure, not an erasure.

PimEyes opt-out

FaceCheck.ID opt-out

C. Habits that compound. Set social accounts to private. Limit how many public, high-resolution, full-face photos of yourself are out there. Control who can tag you. Avoid posting images that quietly reveal your home, your routine, or your location patterns over time. If a state privacy law covers you, you can also request deletion of facial data held by scrapers like Clearview AI.

Clearview AI requests

What this does and doesn't do: none of this makes you unsearchable. What it does is shrink your exposure and remove the easy wins — which is the majority of the practical risk for most people.