FF tracking protection helps. Disabling JS from iffy marketing companies mostly solves the problem. (From a legal standpoint, not a security standpoint). It's

FF tracking protection helps. Disabling JS from iffy marketing companies mostly solves the problem. (From a legal standpoint, not a security standpoint). It's illegal under wiretapping rules to share communication with a third party. (but if the user's browser hits a third-party data collection endpoint, that's somehow okay. See 'in re doubleclick'). Firefox tracking protection uses the disconnect.me list https://disconnect.me/trackerprotection/blocked https://disconnect.me/trackerprotection/blocked to get rid of all of these it can. If the adversary isn't a marketing firm that has to comply with the law, ignore the above. Then you're looking at browser flaws (canvas fingerprinting) and session inference (using client IP, URL, browser-agent, & timestamps to reconstruct identity from behavior).