6.1 Browsers and search engines

Defaults matter

For most people, the browser and search engine are the front door to the internet. They decide which sites load smoothly, which logins "just work" and which adverts follow you around. Those default choices are rarely neutral.

• A browser vendor may earn money from advertising or partnership deals.
• A search engine lives by collecting data about what people look for, when, and from where.

That does not make them inherently unsafe or unethical. It does mean the first tools you install shape what data leaves your device each day.

It is easy to fixate on dramatic threats and miss the quiet ones: routine collection of browsing habits, device characteristics and location hints that builds a long-term profile.

That profile is not a shadowy dossier. It is a practical tool that decides which adverts you see, which results you get, and whether you are asked for extra identity checks at sign-in. Knowing how browser and search engine work together helps you pick the trade-offs you are happy with.

Browser choice

A browser is not just a window; it is a platform. It runs code, stores cookies and keeps a history of where you go. Some are tightly tied into a wider ecosystem (email, maps, analytics); others keep more data on the device or cut tracking by default.

You notice the difference in small moments:

• whether a login auto-fills across devices;
• whether a site remembers what you looked at last week;
• how much data goes back to the vendor when a page loads.

In the UK, many people use whatever browser came with their phone or laptop. Perfectly rational: it is installed, tuned for the device and familiar. The issue is not that it is "bad", but that its defaults favour convenience and advertising over privacy. Telemetry, cloud sync and default search partnerships often mean more parties see your browsing than you expect.

Myth: a "privacy browser" makes you anonymous. Reality: it can cut passive tracking and block obvious trackers, but it cannot hide everything from your internet provider, your employer's network, or the services you sign into. What it can do is reduce routine collection across the wider web and make it harder for third parties to stitch your activity together.

The choice usually comes down to convenience versus control:

• Rely on tight integration with your phone or password manager? A mainstream browser may fit your life best.
• Prefer minimal data sharing and can live with the odd website quirk? A privacy-focused browser with stricter defaults may suit you better.

Either way, know what you gain and what you give up.

Search engine profiling

Search engines are knowledge brokers. They process your queries, learn from your clicks and refine future results, and that learning does not only happen on your device.

• Signed in: your searches can be tied to an account profile.
• Signed out: your IP address, time zone, device type and browser fingerprint can still link searches to the same person or household over time.

The impact is often subtle. Search "mortgage rates" then "schools in Birmingham" and estate agents, removal firms and financial products start appearing in your adverts. Look up a sensitive medical condition and related adverts may follow you for weeks. Not necessarily malicious, just how advertising works, but it can feel intrusive and it can nudge what you read and buy.

Then there is personalisation. Tailoring results by past activity or location is often useful (local news, transport updates), but it can narrow the range of perspectives you see. In the UK, where news and politics can be polarised, that matters. It is not a sealed bubble, but the order of results quietly shapes which sources feel prominent.

Mitigation does not need radical steps:

• use a search engine that keeps fewer logs, to reduce long-term profiling;
• sign out for general browsing, or use a separate browser profile for sensitive or throwaway searches;
• split tasks between engines, such as a mainstream one for local business information and a privacy-focused one for general research.

The cost: some convenience, like personalised suggestions and fast re-queries.

Making privacy-respecting choices

Principles are useful, but concrete options help more. The realistic goal is a sensible default, not a perfect one.

Browsers:

• Firefox: independent of the big advertising ecosystems, with strong, configurable anti-tracking.
• Brave: blocks trackers and adverts aggressively by default.
• Tor Browser: much stronger separation for genuinely sensitive reading, at a cost in speed and convenience (see 6.2).

Firefox and Brave are ordinary, capable everyday browsers, not specialist tools. The browsers tied most tightly to large data-driven businesses are not unsafe, but they collect more and are configured for the vendor's interests as much as yours. Making that trade-off visible is what this page is for.

Search: the key difference is whether your queries are logged and tied to a profile. Privacy-focused engines such as DuckDuckGo and Startpage are designed not to build a long-term record of your searches against your identity.

Switching your default search is one of the lowest-effort, highest-value privacy changes going: it takes a minute and affects every search from then on.

A worthwhile companion change: enable encrypted DNS, covered in 5.1, so your internet provider cannot trivially log the sites you visit, whichever search engine you use.

None of these makes you anonymous on its own, and they should fit your needs rather than be worn as a badge. Together, though, they meaningfully cut the routine, identity-linked data you shed each day.

That matters more as online life gets gated behind identity and age checks, the direction set out in Chapter 17. The less you leak by default, the less there is to attach to your name when a check does demand it.

Fingerprinting techniques

Fingerprinting identifies a device or browser from a bundle of characteristics rather than a single identifier. Ingredients include:

• browser version;
• installed fonts;
• screen size and language settings;
• how the device renders a particular image.

Individually mundane. Together, specific enough to track you across sites without cookies.

Examples: a site loads a small script to test how your browser draws a canvas element, and the tiny rendering differences become a fingerprint. Or it checks your list of audio devices, or the precise timing of certain operations. Not sci-fi: advertising networks and some fraud-detection services use these to recognise repeat visitors and spot unusual activity.

Myth: clearing cookies wipes the slate clean. Reality: it helps, but fingerprints can persist. Blocking fingerprinting entirely is hard because the same features make websites work across devices, and if a browser deliberately lies about its capabilities, some sites break or degrade.

The practical approach: reduce uniqueness rather than chase perfect invisibility.

• Some browsers have anti-fingerprinting features that standardise or limit what websites can see.
• A common configuration helps you blend into a larger crowd; unusual settings or rare add-ons make you stand out.
• If privacy is your priority, skip the novelty browser themes and obscure language packs.

The downside: a slightly less personalised experience and, now and then, a site that will not load unless you allow more access.

Extension risk

Extensions are genuinely useful: they block adverts, manage passwords, translate pages and de-clutter news sites. The catch: they often have broad permissions. An extension that can "read and change all your data on the websites you visit" is powerful, and that power can be misused if the extension is:

• poorly designed;
• sold to a new owner;
• compromised in an update.

Two realistic scenarios:

• A popular coupon finder is bought by a marketing company and updated to inject affiliate links or capture browsing data. Users who installed it for convenience may never notice.
• A legitimate extension is targeted by attackers who push a malicious update, which harvests session cookies and lets them hijack accounts.

The answer is not avoiding extensions altogether, but being selective. Fewer extensions means fewer points of trust.

• Prefer well-known vendors with clear update histories.
• Review permissions when you install or update.
• For a password manager, the vendor's official extension usually beats a third-party helper.
• Check whether a built-in browser feature can replace an extension entirely.

Not every risk goes away. Even reputable extensions have bugs, and permission prompts are blunt tools. Treat extensions like apps on your phone: install what you genuinely use, remove what you do not, and accept the small bit of friction that adds.