[Update on 2019-07-06: I am not seeing third-party cookies from
adservice.google.co.uk when I re-tested today. This domain still does not appear on the list of trackers used by Firefox, despite me reporting it to Disconnect at the time. If I notice Firefox letting though any "third party cookies" from Google again, I will try to contact Firefox.]
My Firefox appears to be blocking third-party cookies from
adservice.google.com. But not blocking the cookies from
I have Firefox 67.0, installed from the Fedora Linux package. The current date is 2019-06-13.
I visited a test site, and clicked on the shield in the left hand side of the address box. Under "Content Blocking", I clicked on "Blocking Tracking Cookies". Under "Tracking cookies", it shows that cookie(s) from
adservice.google.com were blocked.
Further down, under "third party cookies", it shows that there were cookie(s) from
adservice.google.co.uk that were not blocked by Firefox's tracking protection.
From Firefox's documentation:
By default, Firefox protects you from being tracked in private windows using a list of known trackers provided by Disconnect. Firefox allows some trackers so websites can function properly. You can change your settings to block trackers all the time, to block trackers from Disconnect’s level 2 list, or to not block any trackers at all.
The link goes to https://disconnect.me/trackerprotection. It gives some description, including:
Trackers we block
“Trackers” are those services that we’ve identified and determined meet the definition of tracking above.
Disconnect compiles several lists of trackers. The open source list of trackers that power our browser extensions, Firefox’s private browsing mode, and many other popular privacy tools can be found here, along with a change log and notes. Or you can view a simple list of blocked trackers here. Example changes to this tracker list can be seen below. Please submit feedback here.
It is not obvious to me where the "level 1" and "level 2" blocking is distinguished.
I cannot find that the current block list includes the specific domains
adservice.google.com or even
google.com. uMatrix currently shows me third party cookies by
google.com. uMatrix does not seem to show me any third party cookie by
So even what uMatrix is showing me seems to be something a bit different from what the Firefox built-in interface shows me. Confusing.
And I can't make sense of what the built-in interface shows me in terms of what I see in the open-source blocklist.
I also think I can see an entry on the block list for
google.co.uk, which uMatrix shows me is setting third party cookie(s).
One possible explanation for some discrepancies might be if the linked "open source list of trackers" is not used by Firefox any more. And instead, Firefox has licensed a more complex system from Disconnect on commercial terms. This seems relatively odd though - either Firefox would be getting something more advanced than the branded Disconnect extension for Chrome, or the bit about Disconnect browser extensions using the open source list is also out of date. So far it seems equally likely that I'm mis-understanding something somewhere :-)
Further background - how Disconnect.me lists can "block" google.co.uk cookies without massive risk of breaking google.co.uk as a first-party site
README.md at https://github.com/disconnectme/shavar-prod-lists -
Tracking protection technically works by blocking loads from blocked domains. But the Entity List conceptually changes it, so that it is no longer about domains, but about the companies. If you are visiting a website, engaged 1-on-1 with them, Tracking Protection will block the other companies who the user may not realize are even present and didn't explicitly intend to interact with.
Tracking Protection blocks loads on the blacklist when they are third-party. The Entity list whitelists different domains that are wholly owned by the same company. For example, if abcd.com owns efgh.com and efgh.com is on the blacklist, it will not be blocked on abcd.com. Instead, efgh.com will be treated as first-party on abcd.com, since the same company owns both. But since efgh.com is on the blacklist it will be blocked on other third-party domains that are not all owned by the same parent company.