Browser privacy defaults, compared
What seven browsers do before you change anything: whether WebRTC shows your addresses, whether DNS is encrypted, and how they handle fingerprinting, third-party cookies and Global Privacy Control. Each cell links the vendor page or preference file it comes from.
Seven browsers, six defaults
Each cell starts with one word — Protective, Partial, Exposed, Different model or Unknown — so the table reads without colour. “Public IP visible to WebRTC” matters most with a VPN: the address should be the VPN’s, and the WebRTC Leak Test shows whether it is.
| Browser | Hides your local IP from WebRTC | Public IP visible to WebRTC | DNS over HTTPS by default | Fingerprinting protection | Blocks third-party cookies | Sends Global Privacy Control |
|---|---|---|---|---|---|---|
| Chrome | Protective Yes (mDNS name) source | Exposed Yes, via STUN source | Partial Automatic, falls back to plain DNS source | Exposed No; the Incognito script blocking was never launched source | Exposed No; yes in Incognito source | Exposed No source |
| Firefox | Protective Yes (mDNS name) source | Exposed Yes, via STUN source | Partial Only in rollout countries, such as the US and Canada source source | Partial Partial: known scripts blocked, some APIs limited source source | Partial Partitioned per site, not blocked source | Partial Private windows only source |
| Safari | Protective Yes, until camera or mic is allowed source | Exposed Yes, via STUN source | Different model Not a Safari setting: system DNS source | Partial Partial: known scripts (Safari 26) source | Protective Yes, except opt-in partitioned (CHIPS) cookies source source | Exposed No source |
| Microsoft Edge | Partial Yes (mDNS name); docs conflict source | Exposed Yes, via STUN source | Partial Automatic on personal devices source | Partial Partial: listed trackers source | Exposed No; yes in InPrivate source | Exposed No source |
| Brave | Protective Yes (mDNS name, Chromium default) source | Unknown Not documented for current versions source | Unknown Not documented (Chromium base: automatic) source | Protective Yes, randomised source | Protective Yes source | Protective Yes source |
| Tor Browser | Protective WebRTC off source | Protective No, WebRTC off source | Different model No: names resolve through Tor source | Protective Yes, strongest of the seven source | Protective Yes, plus first-party isolation source | Protective Yes source |
| Mullvad Browser | Protective Yes (host candidates removed) source | Protective No: TURN relays only source | Protective Yes, DoH only source | Protective Yes (resistFingerprinting) source | Protective Yes, plus first-party isolation source | Protective Yes source |
Where the sources are thin
- Safari’s WebRTC behaviour rests on a 2017 WebKit post (Safari 11) and a 2019 Safari Technology Preview note that turned on mDNS names by default.
- Microsoft’s Edge policy pages disagree on whether the local IP is shown to WebRTC by default; one says it is hidden behind an mDNS name, another that it is exposed.
- Chrome and Edge hide the local IP behind an mDNS name while a browser flag is on. Chromium’s source turns that flag on by default; Microsoft’s pages do not say.
- Global Privacy Control support for Chrome and Edge comes from MDN’s browser compatibility data; neither vendor documents it. Apple documents GPC only as a switch for apps built on WebKit, off by default (Safari 27), not for Safari itself.
- Brave’s WebRTC and DNS-over-HTTPS defaults are documented only in a 2018 wiki and its list of changes from Chromium; we mark them unknown rather than inherit Chromium’s.
Sources
Vendor help pages and policy documentation first; for Firefox, Tor Browser and Mullvad Browser the shipped preference files; for Global Privacy Control in Chrome, Edge and Safari, MDN’s browser compatibility data. Each value rests on a short quote from its source, read 21 Oct 2026 and re-read weekly by a script. Defaults change with releases. How the data pages are built.