The Safari Privacy Settings Worth Changing

Published August 14, 2026 · Last reviewed September 2, 2026

The settings, in order of value

Action

Confirm Prevent Cross-Site Tracking is on.

Why it helps

It stops third-party trackers embedded on one site from reading the data they set on another, which is the mechanism behind most follow-you-around advertising.

Verification

The toggle is green. Sites still work; ads become less personal over time.

Action

Set Hide IP Address. With iCloud+ choose Trackers and Websites; without it, choose Trackers.

Why it helps

Your IP address is a stable identifier that survives clearing cookies, so hiding it closes the fallback trackers use once cookies fail.

Verification

The setting shows your chosen option, and location-based sites still resolve to roughly the right region.

Action

Turn on Advanced Tracking and Fingerprinting Protection under Safari's Advanced menu, and set it to All Browsing rather than Private Browsing only.

Why it helps

Fingerprinting identifies you from your device's characteristics without any cookie at all. Limiting it to private windows leaves normal browsing — where you spend most of your time — unprotected.

Verification

The setting reads All Browsing.

Action

Turn on Fraudulent Website Warning and Block Pop-ups.

Why it helps

The first checks sites against known phishing lists before the page loads; the second removes the interruptions that scam pages depend on.

Verification

Both toggles are green.

Action

Review Safari's per-site settings under Settings for Websites, especially camera, microphone, and location.

Why it helps

Website permissions are separate from app permissions and accumulate the same way, unnoticed.

Verification

Each listed site has a permission you would deliberately grant today.

Private Browsing: what it does and does not do

Private Browsing stops Safari saving your history, cookies, and autofill data on the device, and on recent iOS it also locks private tabs behind Face ID when you switch away. That is genuinely useful for a shared device or a surprise-gift search.

It does not hide your browsing from your employer if you are on their network, your internet provider, or the sites you visit. Nor does it make you anonymous. Treat it as “leave no trace on this phone”, not as “be invisible online” — a distinction a surprising number of people get wrong in a way that matters.

iCloud Private Relay, briefly

If you subscribe to iCloud+, Private Relay routes Safari traffic through two separate relays so that neither Apple nor the relay operator can see both who you are and what you are visiting. It is not a full VPN — it covers Safari and some unencrypted traffic, not every app — and some networks and enterprise setups block it. It is worth turning on if you have it, and worth knowing why it occasionally needs disabling on a corporate Wi-Fi.

The extensions question

A content blocker reduces trackers and speeds up page loads, but it is also an extension with visibility into your browsing. Choose one from a developer who publishes a clear privacy policy and a business model that is not advertising, install one rather than four, and review it in Settings › Apps › Safari › Extensions twice a year. Several overlapping blockers cause broken pages far more often than they add protection.

How it works

Cross-site tracking historically worked through third-party cookies. A tracker embedded on thousands of sites would set a cookie under its own domain; whenever you visited any of those sites, the tracker recognised the cookie and appended another entry to your profile. Safari's Intelligent Tracking Prevention breaks this by partitioning storage per site, so data set by a tracker on one site is invisible to the same tracker on another. The tracker still loads; it simply cannot recognise you.

When cookies stop working, trackers fall back to identifiers you cannot clear. Your IP address is one: it is reasonably stable and often maps to a household. Fingerprinting is the other: instead of storing anything, a script measures your device — screen dimensions, fonts, time zone, graphics rendering quirks — and derives an identifier from the combination. Enough characteristics together are close to unique.

Safari answers each in kind. Hide IP Address routes tracker connections so the destination sees a relay address instead of yours. Fingerprinting protection makes the browser present a more uniform, less distinctive profile and withholds the highest-entropy details, so your device looks like many others rather than like itself. Neither is absolute — the aim is to raise cost and reduce accuracy, not to make identification provably impossible.

Worked example

A phone where Safari has never been touched since setup. Opening Safari’s settings shows Prevent Cross-Site Tracking on (the default) and Hide IP Address set to Trackers. Under Advanced, fingerprinting protection is limited to Private Browsing only — which means the setting is doing nothing for the ninety-odd percent of browsing done in normal tabs.

Two changes are made. Fingerprinting protection is set to All Browsing. The owner has iCloud+, so Hide IP Address is raised to Trackers and Websites and Private Relay is turned on in iCloud settings.

Settings for Websites holds the surprise: a video site granted camera and microphone access two years ago for a one-off call, and three sites granted location. All are reset. Over the following week one corporate Wi-Fi network refuses to work with Private Relay, which the owner resolves by disabling it for that network only — a known trade-off rather than a fault. Nothing else changes visibly, which is what a well-chosen privacy setting looks like.