How to Stop Being Tracked Online

Seven layers, the setting that stops each one, and the order to do them in

State of Surveillance

By State of Surveillance Published: 2026-11-13

TL;DR

Online tracking is not one thing. It happens in seven layers, and each has its own switch: the browser (cookies, fingerprints, trackers), the network (your IP address), the account (the identity you sign in with), the device (the advertising ID), the apps (SDKs and permissions), the email (tracking pixels), and the brokers (what was already sold). Fix them in that order, because a tracker that loses one layer moves to the next. Each layer below names the setting, described by the company that ships it.

Layer 1: The browser

Most tracking that looks mysterious happens in the browser. A site writes a small file, reads it back later, and can read it from a site you have never heard of, and clearing your history does not remove it. A script can also build a picture of your browser from your screen size, fonts, graphics hardware and language settings, with no cookie involved. Brave calls the fingerprint "the unique set of data points (like your graphics hardware, audio hardware, device type, and more)" that could help identify you online [1], and the Tor Project's summary of the danger is that most browsers inadvertently create a unique fingerprint for each user, which can be tracked across the internet [2].

Brave, one switch and no configuration. Brave Shields are on for every site you visit by default, with no setup. Brave's feature list says they block third-party ads and trackers, block cross-site cookies and thus prevent site-to-site tracking, and block browser-language and font fingerprinting [1].

Tor Browser, when the fingerprint is the problem. Tor limits font enumeration, standardizes screen and window sizes with letterboxing, and restricts requested languages to a small predefined set. Tor Browser is "specifically engineered to minimize the uniqueness of each user's fingerprint across various metrics," and Tor says it is "practically impossible to make all Tor Browser users identical" [2]. Side by side: Privacy Browsers Compared.

Layer 2: The network (your IP address)

All of that happened while your real address was on the wire. Mullvad's explanation is plain: your IP address identifies you [4]. When you use a VPN, your traffic is encrypted and sent to a VPN server before it travels on to the site you want to visit, so your ISP cannot see which sites you visit and third-party actors cannot use your IP address to identify you [4]. Provider options are in the site's Mullvad VPN review.

Tor hides you from your provider too. The Tor Project lists three main properties of the Tor network, and the first two are the ones that matter here: your internet service provider, and anyone watching your connection locally, will not be able to track your internet activity, including the names and addresses of the websites you visit, and the operators of the websites and services you use will see a connection coming from the Tor network instead of your real Internet (IP) address [3]. Tor Browser routes traffic through three random servers, also known as relays [3]. Which one you need depends on who you are hiding from: VPN vs Tor vs Proxy.

Layer 3: The account

This is the layer most guides skip. When you sign in you hand over a name, an email address and a password, and the site now knows exactly who you are. Every cookie, fingerprint and IP address you removed in the first two layers is now attached to a confirmed identity. No setting undoes that. You change what you log in with.

Apple documents the simple version: if you subscribe to iCloud+, you can use Hide My Email to generate unique, random email addresses that forward to your personal email account, so you do not have to share your personal address when filling out forms on the web or signing up for newsletters [5]. The wider version is compartmentalization: Email Aliases Compared for the address, and Digital Compartmentalization for the rest of your identity.

Layer 4: The device (the advertising ID)

Both mobile operating systems hand out an advertising identifier that apps can read, and both give you a switch over it.

iPhone. Apple's App Tracking Transparency allows you to choose whether an app can track your activity across other companies' apps and websites [6]. If you tap Ask App Not to Track, the app developer cannot access the system advertising identifier, the IDFA, which is often used to track [6]. Apple's steps:

  1. Go to Settings, then tap Privacy & Security, then tap Tracking.
  2. Tap to turn off or turn on permission to track for a specific app.
  3. To stop the prompts, turn off "Allow Apps to Request to Track". Each app that asks while it is off is treated as if you tapped Ask App Not to Track.
  4. While it is off, each app that requests to track cannot access the advertising identifier.

Android. Google describes the advertising ID as a unique, user-resettable, and user-deletable ID for advertising, provided by Google Play services [7]. Google's steps:

  1. On your Android device, go to Settings, then tap Privacy, then Ads.
  2. Tap Reset Advertising ID and confirm your changes, or tap Delete Advertising ID and confirm. Google notes that after deletion, attempts to access the identifier receive a string of zeros instead [7].
  3. On some older versions of Android, open Settings, tap Privacy, then Advanced, then Ads, and turn on Opt out of Ads Personalization.

Layer 5: The apps, and the audit that runs here

This is the layer people mean when they say "my phone is tracking me", and the good news is that Apple ships a report on it. Apple's App Privacy Report, available in iOS 15.2 or later, includes the following [8]:

  • Data and sensor access: how many times and when an app accessed privacy-sensitive data or device sensors in the past 7 days.
  • App network activity: the domains contacted either directly or from content within an app in the past 7 days.
  • Most contacted domains: the domains most frequently contacted by all your apps in the past 7 days.

Apple's steps:

  1. In Settings, tap Privacy & Security, scroll down and tap App Privacy Report, then tap Turn on App Privacy Report.
  2. Wait. Apple is explicit that App Privacy Report starts gathering information only after you turn it on, so it may take a little time for details to appear.
  3. Read Most Contacted Domains. It lists the domains your apps contact most often.
  4. For anything unexpected, Apple says you can update your privacy settings or revoke permission.

One limit from Apple's own page: the data in your App Privacy Report is encrypted and stored only on your device [8].

Layer 6: The email

Every email can tell the sender you opened it, and can tell them roughly where you are.

Gmail. In the top right, click Settings, then See all settings. Scroll down to the "Images" section, click Ask before displaying external images, then Save Changes. Blocked images load on demand when you click Display images below [9]. Google's explanation of why it is worth doing: senders cannot use image loading to get information about your computer or location [9].

Apple Mail. Go to Settings, then Apps, then Mail. Tap Privacy Protection, then turn on Protect Mail Activity [5]. Apple states that Mail Privacy Protection hides your IP address so senders cannot link it to your other online activity or determine your exact location, and that it also prevents senders from seeing if you have opened the email message they sent you [5]. Apple also states the limit: Mail Privacy Protection does not extend to links or email attachments such as PDF or other files [5]. It also depends on Limit IP Address Tracking, which you enable in Settings, then Wi-Fi, then next to your network [5].

Layer 7: The brokers (the only part that reaches backwards)

Layers 1 to 6 stop new tracking. None of them retracts what was already sold. Data brokers are a separate job with a separate process: find your records, send a request, wait, follow up. This site walks it in Data Broker Opt-Out, lists the people-search companies in People Search Master List, and has the legal letter in Data Broker Opt-Out Request Template.

What none of this fixes

Nothing on this page makes you invisible, and it would be dishonest to imply otherwise.

  • Signing in still identifies you. Tor's wording is the honest one: a site will not know who you are unless you explicitly identify yourself [3]. A VPN or Tor protects the connection, not the account.
  • Deleting the advertising ID does not silence every app. Google says so directly: your advertising ID will be deleted, but apps may have their own settings, which can also affect the types of ads you see [7].
  • Turning off tracking permission does not delete what was already collected. It changes what happens from the next request onward.
  • Apple's report cannot see your private browsing. App Privacy Report does not include network activity from private browsing sessions in browser apps [8].
  • Blocking is weaker than anonymising. A blocked script never loads, so it never sees anything.
  • Some sites break when you block them, and you will be tempted to unblock them. Brave's FAQ tells you to verify that the site is trusted before putting Shields down [1].

The order to do it in

  1. App Privacy Report first. It shows you what your apps have actually done, and it starts counting only once you switch it on [8].
  2. Browser layer. Free, quick, and the layer you will notice.
  3. Device layer. Delete the advertising ID and set tracking permissions to off, on iPhone and Android.
  4. Email layer. Image blocking plus Mail Privacy Protection and its Limit IP Address Tracking switch.
  5. App layer. Read the report once it holds a week of data, then revoke what you did not expect.
  6. Network layer, if your threat model asks for it. Pick VPN or Tor based on who you are hiding from, not on marketing.
  7. Account layer. Aliases and compartmentalization, which take the longest to set up.
  8. Broker layer. Start the requests now. They are slow, and they are the only layer that reaches backwards.

Related Guides

Sources

  1. Brave, Brave Shields
  2. Tor Project, Fingerprinting protections
  3. Tor Project, About Tor Browser
  4. Mullvad, Mullvad VPN
  5. Apple Support, Use Mail Privacy Protection on iPhone
  6. Apple Support, If an app asks to track your activity
  7. Google Play Console Help, Advertising ID
  8. Apple Support, About App Privacy Report
  9. Gmail Help, Turn images on or off in Gmail