Browser Privacy Settings for Kids: The Complete 2026 Walkthrough

A 10-year-old opens Chrome to do a report on ocean pollution. Within seconds, tracking pixels fire to ad networks, third-party cookies map her browsing session, and her IP address is logged by a dozen analytics services she’ll never know about. None of this is illegal. All of it happens in the default configuration. The Electronic Frontier Foundation has documented how browser-level data collection feeds profiling systems that persist for years. For children, whose digital footprint starts accumulating before they understand what privacy means, the stakes are higher. The good news: the settings that matter most take about 20 minutes to configure per browser, and you only have to do it once.

Key Takeaways

• Default browser settings on Chrome, Firefox, Safari, and Edge all allow significant third-party tracking of child users
• Browser fingerprinting allows sites to identify users even in Incognito/Private mode — it does not make children anonymous
• Third-party cookies are being phased out, but replacement tracking technologies (like Chrome’s Topics API) continue the same behavior
• DNS-over-HTTPS can block a substantial portion of tracking and ad infrastructure at the network level
• Browser extensions can read everything typed in the browser, including passwords — audit installed extensions before any other privacy step
• Safe Search enforcement must be done at the DNS or router level to survive browser changes

First: The Extension Audit (Do This Before Anything Else)

Browser extensions are the most overlooked privacy risk in a child’s browser. A 2020 study in the Proceedings of the Web Conference found that 5.5% of Chrome extensions were malicious or privacy-invasive. Many children install extensions for games, homework help, ad blocking, or entertainment — without understanding that extensions can read every keystroke, every form field, and every page a child visits.

To audit extensions in Chrome:

1. Go to chrome://extensions
2. Click “Details” on each extension
3. Look at “Permissions” — specifically note any that say “Read and change all your data on all websites”
4. Remove any extension you didn’t intentionally install, and any with excessive permissions relative to their claimed function

In Firefox:

1. Open the menu → Add-ons and Themes → Extensions
2. Click each extension → Permissions tab
3. The same “Access your data for all websites” permission is the red flag

A Grammarly extension legitimately needs to read text. A “free Robux notifier” extension that asks to read all website data does not. When in doubt, remove it.

Chrome: Step-by-Step Privacy Configuration

Chrome is the most widely used browser and has the most granular privacy settings — and the most aggressive tracking by default.

Core Privacy Settings

1. Open Chrome → click the three-dot menu → Settings
2. Go to Privacy and security → Cookies and other site data
3. Select “Block third-party cookies” — this stops the most prevalent form of cross-site tracking
4. Under Privacy and security → Security, change from “Standard protection” to “Enhanced protection” — this enables more aggressive Safe Browsing, warning detection, and site safety checks
5. Under Privacy and security → Privacy Sandbox, disable all topics. The Privacy Sandbox is Google’s replacement for third-party cookies — it still profiles browsing behavior; it’s just done on-device rather than by third parties

Safe Search in Chrome

Google Safe Search is not enabled by default in Chrome. To enforce it:

1. Go to Google.com → Settings (bottom of results page) → Search Settings
2. Check Turn on SafeSearch and Lock SafeSearch
3. Note: A child can manually turn this off unless you lock it. Locking requires signing into a Google account with Supervised User access or using Google Family Link

DNS-over-HTTPS in Chrome

1. Chrome Settings → Privacy and Security → Security → scroll to “Use secure DNS”
2. Toggle ON
3. Select Custom and enter 1.1.1.3 (Cloudflare’s family-safe DNS) or 9.9.9.11 (Quad9 family)
4. These DNS providers block many malicious sites and some tracking infrastructure at the DNS level — before the browser even loads the page

Firefox: Privacy-First Configuration

Firefox offers stronger default privacy protections than Chrome and was the first major browser to block third-party tracking cookies by default (since 2019).

Core Settings

1. Open Firefox → Menu → Settings → Privacy & Security
2. Under “Enhanced Tracking Protection,” select Strict mode
3. This blocks: tracking cookies, cryptominers, fingerprinters, and cross-site tracking scripts
4. Under “Cookies and Site Data,” click Manage Exceptions and review any sites that have cookie exceptions

Firefox-Specific Privacy Features

Total Cookie Protection (enabled in Strict mode): Each website gets its own “cookie jar” — cookies cannot be shared across sites, which prevents the most common form of cross-site tracking.

Fingerprint protection: Firefox’s Strict mode includes fingerprinting protection. Under Settings → Privacy & Security → scroll down to “Firefox Data Collection and Use” and uncheck all options including “Allow Firefox to install and run studies.”

DNS-over-HTTPS in Firefox:

1. Settings → General → scroll to the very bottom → Network Settings → Settings
2. Check “Enable DNS over HTTPS”
3. Select Custom and enter https://family.cloudflare-dns.com/dns-query for child-safe DNS filtering

Safari: macOS and iOS Configuration

Safari is the default on iPhones and iPads, making it the primary browser for most child iOS users.

macOS Safari

1. Safari → Settings → Privacy
2. Check “Prevent cross-site tracking” (on by default, but confirm it’s enabled)
3. Check “Hide IP address from trackers” (requires iCloud+ subscription, but worth enabling if you have it)
4. Under Extensions tab: review all installed extensions with the same permission audit described above

iOS Safari (iPhone / iPad)

1. Settings → Safari → toggle ON “Prevent Cross-Site Tracking”
2. Toggle ON “Block All Cookies” (note: this may break some websites — “Prevent Cross-Site Tracking” is the better balance)
3. Toggle ON “Fraudulent Website Warning”
4. Under Privacy Preserving Ad Measurement — turn OFF (this sends ad effectiveness data to Apple)
5. For child devices, enable Screen Time Content Restrictions → Web Content → Limit Adult Websites — this adds a DNS-level filter that blocks categories of content regardless of browser used

What Incognito / Private Mode Actually Does (and Doesn’t Do)

This is one of the most important misconceptions to correct with kids. Private browsing mode:

• Does NOT make you anonymous to websites you visit
• Does NOT hide your browsing from your network (school, home router, ISP)
• Does NOT prevent browser fingerprinting
• DOES prevent the browser from saving local history, cookies, and form data to the device

The network administrator at school can see every site visited in private mode. Your home router logs these visits. The websites themselves can still profile the visitor using fingerprinting. Private mode is useful for gift shopping on a shared computer. It is not a privacy tool for children trying to avoid parental oversight.

Edge: Privacy Configuration for Windows Households

Microsoft Edge now includes a “Kids Mode” specifically designed for under-12 use, and a solid set of privacy controls for older children.

Kids Mode (under 12)

1. Click the profile icon in the top right → click Kids Mode
2. Set the child’s age range
3. Kids Mode enforces: curated content allowlist, Bing SafeSearch locked, no extension installation, no InPrivate browsing, no adult content
4. Parents can customize the allowed site list under Settings when in Kids Mode

Standard Privacy Settings for Older Users

1. Edge Settings → Privacy, search, and services
2. Set Tracking prevention to Strict
3. Under “Privacy,” toggle ON “Send ‘Do Not Track’ requests” — note this is a polite request, not technically enforced, but adds signal
4. Turn OFF “Allow sites to check if you have payment methods saved” and “Microsoft Defender SmartScreen” can stay ON (it’s legitimate malware protection, not tracking)

What Is Browser Fingerprinting?

Browser fingerprinting is a tracking technique that doesn’t require cookies. Instead, websites query the browser for a combination of data points — screen resolution, installed fonts, browser version, time zone, graphics card, language settings — and combine them into a unique “fingerprint” that identifies that specific device. The Electronic Frontier Foundation’s Panopticlick tool demonstrates this: most browsers are unique among millions of users even without a single cookie.

Children who clear their cookies, use private mode, and think they’re anonymous can still be identified and tracked via fingerprinting. Firefox’s Strict mode provides some fingerprinting resistance. Brave browser was built with anti-fingerprinting as a core feature and is worth considering for privacy-focused households.

Browser Privacy Feature Comparison

Feature	Chrome (configured)	Firefox Strict	Safari iOS	Edge Kids Mode	Brave (default)
Third-party cookie blocking	Yes (manual)	Yes (default)	Yes (default)	Yes	Yes
Fingerprint protection	Partial	Yes	Partial	No	Yes
DNS-over-HTTPS	Yes (manual)	Yes (manual)	Via iOS settings	Yes	Yes
Extension permission auditing	Yes	Yes	Yes	Blocked (Kids Mode)	Yes
Private mode truly anonymous	No	No	No	No	No
Safe Search enforcement	Manual	Manual	Via Screen Time	Built-in	Manual
Built-in password manager	Yes	Yes	Yes	Yes	Yes

Internal links

For more on teaching kids about online privacy risks, see our guide on kids’ online privacy and COPPA. If you’re concerned about how kids get tricked into sharing information online, read about social engineering tactics scammers use on children. For a full cybersecurity foundation, start with cybersecurity and digital literacy for kids.

What to Watch For Over the Next 3 Months

Week 1–2: Complete the extension audit on every device your child uses — laptop, tablet, shared family computer. Remove extensions you can’t explain the purpose of.

Month 1: Configure the DNS settings at the router level, not just the browser. Router-level DNS (using Cloudflare 1.1.1.3 or Quad9 9.9.9.11) applies to every device on your network — including smart TVs, gaming consoles, and smartphones — without per-device configuration.

Month 2: Run the EFF’s Cover Your Tracks tool (coveryourtracks.eff.org) on your child’s browser to see how trackable they are. Use the results as a teaching moment about fingerprinting.

Month 3: Revisit the extension list. Children install new extensions constantly. Schedule a monthly 5-minute audit as part of a broader digital check-in conversation.

Red flag: If your child’s browser suddenly has new extensions they didn’t mention, or if their browser homepage has changed without explanation, these are signs of potentially unwanted software installation. Audit immediately.

Frequently Asked Questions

Does my child need a special browser, or are the settings enough?

For most families, configuring settings in their existing browser (Chrome, Safari, or Edge) provides adequate protection. Firefox with Strict mode enabled is a meaningful step up without requiring behavior change. Brave browser offers the strongest built-in privacy defaults and is worth considering for privacy-conscious households, especially for teens who won’t allow parental management.

Will blocking cookies break websites my child uses?

Blocking third-party cookies — the trackers that follow your child across sites — rarely breaks websites. Blocking all cookies can break login functionality. The right setting is “Block third-party cookies” (Chrome, Edge) or Firefox’s Enhanced Tracking Protection, not “Block all cookies.” If a specific educational or school site breaks, you can whitelist that domain specifically.

Can I see what websites my child visits even with private mode enabled?

Yes. Your home router keeps a log of DNS requests, which reveals the domains visited regardless of browser mode. Tools like Circle (dedicated parental control device), or router-level DNS providers like NextDNS (with logging enabled), let parents review browsing history without installing software on the child’s device. School networks always log DNS and HTTP traffic at the network level.

What’s the most important single change I can make today?

Change the DNS settings on your home router to use Cloudflare 1.1.1.3 (family safety filter) or Quad9 9.9.9.11. This single change applies protection to every device on your network, blocks most malicious domains at the DNS level, and provides meaningful reduction in ad tracking infrastructure — all without touching individual device settings.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

---

Sources

1. Electronic Frontier Foundation. (2020). “Google Says It Doesn’t ‘Sell’ Your Data. Here’s How the Company Shares, Monetizes, and Exploits It.” https://www.eff.org/deeplinks/2020/11/google-says-it-doesnt-sell-your-data-heres-how-company-shares-monetizes-and
2. Ikram, M., Vallina-Rodriguez, N., Seneviratne, S., Kaafar, M. A., & Paxson, V. (2017). “An analysis of the privacy and security risks of Android VPN permission-enabled apps.” Proceedings of the 2016 Internet Measurement Conference. ACM. https://dl.acm.org/doi/10.1145/2987443.2987471
3. Electronic Frontier Foundation. (2024). “Cover Your Tracks.” https://coveryourtracks.eff.org/
4. Thomas, K., et al. (2021). “Measuring the effectiveness of privacy policies for voice assistant applications.” Proceedings of the Annual Computer Security Applications Conference. ACM. https://dl.acm.org/doi/10.1145/3485832.3485891
5. Federal Trade Commission. (2024). Children’s Online Privacy Protection Rule (COPPA). https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa
6. Mozilla Foundation. (2024). “Firefox Privacy Notice.” https://www.mozilla.org/en-US/privacy/firefox/