Bounce Tracking Mitigation: The Redirect-Tracking Defense Every Browser Ships, but Only Safari Turns On by Default
Chrome, Firefox, and Safari all now mitigate bounce tracking. The shipping order and default status are messier — and more useful to know — than the headline suggests.
By Palancar · 5 min · 13 October 2026
Bounce Tracking Mitigation: The Redirect-Tracking Defense Every Browser Ships, but Only Safari Turns On by Default
Bounce tracking — sometimes called redirect tracking — is what a tracker does once third-party cookies stop working reliably: instead of loading a tracking pixel inside another site, it briefly redirects the user’s own navigation through a tracking domain on the way to their actual destination. That domain gets a first-party moment to read or write storage, then bounces the browser onward so fast the user never notices an extra hop happened. Because the tracker is briefly the first-party site during that bounce, it sidesteps a lot of the cross-site cookie blocking that’s supposed to stop exactly this kind of correlation. All three major browser engines now do something about it, but “does something about it” covers three genuinely different levels of protection, and knowing which one you’re actually getting matters more than the shared feature name suggests.
Bounce tracking matters specifically because it routes around defenses that already look solved. SameSite cookie defaults and third-party cookie blocking both work by refusing to send a cookie when a request originates from a different site than the one that set it — a bounce tracker never triggers that check, because from the browser’s point of view the tracking domain briefly is the site the user is currently on, not a third party embedded in someone else’s page. The same first-party moment that makes normal browsing work — letting a site read its own cookies when the user is actually there — is what a redirect-based tracker exploits, which is why this needed its own dedicated mitigation rather than falling out of the cookie-partitioning work already underway.
The Shared Spec, and Who’s Actually Building to It
The Privacy Community Group’s Bounce Tracking Mitigations proposal defines a common heuristic: watch for navigations that look like a bounce (a fast redirect through a domain with no meaningful page interaction), and if that domain hasn’t had genuine first-party interaction from the user within a defined window, periodically clear its stored state. Chrome and Firefox both built to this shared spec. Safari did not — its bounce-tracking defense is older than the spec itself and uses a proprietary list-and-heuristic approach baked into Intelligent Tracking Prevention since ITP 2.0, back in 2018, well before the cross-browser effort existed at all.
Chrome Shipped First — With an Important Catch
Chrome shipped its Bounce Tracking Mitigations to stable in version 116, in mid-2023 — chronologically the first of the two spec-aligned implementations. The catch is what it’s conditioned on: the mitigation only runs in contexts where third-party cookies are already blocked, which for most Chrome installs means Incognito mode only. Chrome’s broader plan to block third-party cookies by default for all users was reversed in 2026 — Google confirmed it would not ship a standalone third-party-cookie deprecation after all, a reversal our third-party cookies coverage traces in full — which means the bounce-tracking mitigation Chrome shipped three years ago still isn’t doing anything for the default, signed-in, regular-browsing-mode Chrome user it was ultimately meant to protect.
Firefox Shipped Second — Also Not On by Default
Firefox’s dedicated Bounce Tracking Protection arrived in Firefox 133, released November 26, 2024 — over a year after Chrome’s version reached stable. It’s tied to Enhanced Tracking Protection’s “Strict” mode, which is not Firefox’s default setting; the out-of-the-box “Standard” mode doesn’t enable it. Firefox later reworked the implementation to run in a “stateless” mode as of version 145, refining how it detects a bounce without needing to persist as much intermediate state itself. Firefox does layer a second, older redirect-tracking defense underneath this — a disconnect.me list-based mechanism that clears storage for known trackers after 45 days without interaction, part of the same Enhanced Tracking Protection system our Firefox tracking-protection coverage describes — so Firefox users get some protection regardless of ETP mode, but the newer, spec-aligned mitigation specifically requires opting into Strict.
Safari Was Never Building to the Spec, and Still Wins on Defaults
Safari’s approach predates the whole cross-browser effort and doesn’t follow the Privacy Community Group’s heuristic at all — it relies on WebKit’s own tracking-classification list and behavioral signals, developed as one arm of Intelligent Tracking Prevention. The result is a genuine inversion of the pattern you’d expect from “who shipped first”: the browser with by far the oldest bounce-tracking defense, predating the formal spec by roughly five years, is also the only one of the three that runs it for every user by default rather than gating it behind Incognito mode or a non-default privacy setting — consistent with the broader default-on posture our Safari ITP coverage has tracked since ITP’s earliest versions.
What This Actually Means for a Reader Deciding What to Do
If you use Chrome in its normal, signed-in mode, the Bounce Tracking Mitigations feature Google shipped in 2023 is not currently protecting you, because the third-party-cookie-blocking condition it depends on isn’t your default state and Google has backed away from making it one. If you use Firefox, the meaningful move is switching Enhanced Tracking Protection from Standard to Strict — the underlying disconnect.me list gives you partial coverage either way, but Strict mode is what turns on the newer, spec-aligned mitigation. If you use Safari, you’re already covered by default, and there’s no setting to check, because ITP’s bounce-tracking detection has been part of the browser’s baseline behavior since 2018.
The broader lesson generalizes past this one feature: a browser vendor’s blog post announcing a privacy mitigation is not the same claim as “this protects you today, in your default configuration.” The gap between “shipped” and “on by default for the browsing mode you actually use” is exactly where bounce tracking mitigation across all three engines currently sits, and it’s worth checking that gap specifically before assuming a feature you read about is doing anything for you.