Chrome Privacy Settings: A Complete Configuration Guide for 2024

Chrome ships with a privacy configuration that’s good enough for most users and unremarkable for anyone who’s looked closely. The defaults reflect Google’s business reality: a browser made by an advertising company is going to leave certain doors open. The good news is that almost everything is configurable, and a half-hour walkthrough of the settings page can meaningfully tighten your exposure without breaking how the browser works day-to-day.

The Sync Question

Chrome Sync is the most consequential privacy decision in the whole settings page, and it’s the one most users make without realizing they made it. Signing in to Chrome with a Google account turns on synchronization of bookmarks, history, passwords, open tabs, autofill data, and extensions across every device where you’re signed in. That data lives on Google’s servers, and unless you turn on a sync passphrase, Google can read it.

If you want sync but don’t want Google reading your history, set a sync passphrase under Settings → You and Google → Sync and Google services → Encryption options. Choose “Encrypt synced data with your own sync passphrase.” Once set, your synced data is encrypted client-side with a key Google never sees. The tradeoff is that you’ll need the passphrase on every new device, and certain Google services (Chrome history search in your Google account, for example) stop working.

If you don’t need sync at all, the cleanest answer is to not sign in to Chrome. You can still use Google services in tabs without binding the browser itself to your account.

Cookies and Site Data

Chrome’s cookie controls are under Privacy and security → Third-party cookies (formerly under “Cookies and other site data”). The default for most users still allows third-party cookies, which is the single biggest tracking surface on the web. “Block third-party cookies” — the strict setting — is safe to enable for almost all browsing. Some legitimate cross-site features break (embedded payment forms, certain SSO flows) but the breakage is rare and usually obvious.

For a step beyond, “Clear cookies and site data when you close all windows” turns Chrome into something close to perpetual private browsing for cookie state. The downside is that you get logged out of everything every session, which is annoying. A middle ground is to enable that setting and then add exceptions for sites you actively want to stay logged in to.

Send a ‘Do Not Track’ Request — and Why It Doesn’t Matter

There’s a toggle for “Send a Do Not Track request with your browsing traffic.” Turn it on if you want, but don’t expect it to do anything. The DNT header was a voluntary standard that the ad industry never adopted, and most sites ignore it. The successor — Global Privacy Control — has slightly more legal weight under some US state privacy laws (California in particular) and is worth enabling for that reason alone. GPC support is built into Chrome via the Privacy Sandbox settings and via extensions.

Safe Browsing: Standard vs Enhanced

Under Privacy and security → Security, Chrome offers three Safe Browsing modes: No protection, Standard, and Enhanced. Standard checks visited URLs against a locally-cached list of known-bad sites and is fine for most users. Enhanced sends every URL you visit to Google in real time for analysis, plus a sample of the page contents in some cases.

Enhanced does provide better protection against new phishing campaigns, but you’re trading a meaningful amount of browsing data for that improvement. If your threat model includes Google as an adversary or a data-resale risk, stay on Standard. If your threat model is mostly random phishing and your work is sensitive enough that a single click could be expensive, Enhanced is reasonable.

Privacy Sandbox

Chrome’s Privacy Sandbox features — Topics, Protected Audience, Attribution Reporting — are Google’s replacement for third-party cookies. The pitch is that ad targeting happens in the browser, not on a tracking server. The reality is that they’re still ad-targeting features, and most privacy-conscious users will want them off.

Go to Settings → Privacy and security → Ad privacy and turn off all three (Ad topics, Site-suggested ads, Ad measurement). The browser will continue to work normally; you’ll just stop participating in Google’s new on-device ad infrastructure.

Permissions and Site Settings

Site Settings (Privacy and security → Site Settings) is where you control camera, microphone, location, notifications, and a long list of other per-site permissions. Two defaults are worth changing: set Notifications to “Don’t allow sites to send notifications” (or at least “Use quieter messaging”), and set Location to “Don’t allow sites to see your location” with case-by-case exceptions. The default of asking on every site means users habitually click through, and the prompt-fatigue defeats the protection.

For related context, see our writeup on cookie consent managers and our deeper guide to private browsing mode.

Frequently Asked Questions

Does Incognito mode actually hide my activity?

Incognito mode prevents the browser from saving history, cookies, and form data locally. It does not hide your activity from your ISP, your employer’s network, the sites you visit, or any extensions you’ve allowed to run in Incognito. It’s a local-state-management feature, not a network-privacy feature.

Should I use a different browser instead?

If you’re already deep in the Google ecosystem and only mildly privacy-conscious, a well-configured Chrome is good enough. If you want stronger defaults without configuration work, Firefox and Brave both do more out of the box.

What’s the single most impactful setting to change?

Block third-party cookies. It single-handedly eliminates most cross-site tracking and breaks almost nothing important.

Does Chrome’s password manager store passwords securely?

Locally yes — passwords are encrypted with your OS account credentials. Synced passwords are encrypted in transit and (if you’ve set a sync passphrase) end-to-end. The bigger risk is that anyone with access to your unlocked OS session can view stored passwords by re-entering your OS password, which is a deliberate design choice.