Apple Safari
What the default settings do
Safari ships with several privacy protections already enabled. Intelligent Tracking Prevention (ITP) is on by default and limits cross-site tracking by restricting third-party cookies and storage access. Fraudulent site warnings are also active out of the box. Since Safari 26 (iOS 26 and macOS Tahoe), Apple also applies its advanced fingerprinting protection to all browsing by default, not just Private Browsing, which makes it harder for sites to identify your device from its technical characteristics.
However, some defaults still allow data to flow in ways you may not expect. Search engine suggestions send partial queries to your default search engine as you type, and AutoFill stores personal and financial information that can be populated into web forms automatically.
A reasonable privacy baseline
These settings are found in Safari → Settings (macOS) or Settings → Apps → Safari (iOS/iPadOS 18 and later; Settings → Safari on older versions).
Privacy section
Prevent Cross-Site Tracking → On (default)
This enables Intelligent Tracking Prevention, which limits third-party cookies and cross-site tracking. It is on by default and worth confirming.
Advanced → Advanced Tracking and Fingerprinting Protection → All Browsing (default since Safari 26)
This feature adds noise to the signals sites use to fingerprint your device (such as canvas, WebGL, and audio readouts) and presents a simplified view of your system configuration so more devices look alike. It used to apply only to Private Browsing; since Safari 26 it covers all browsing by default. It is worth confirming it is still set to All Browsing, since it can be limited to Private Browsing or turned off.
Hide IP Address → Trackers Only
Sends traffic to known trackers through Apple's two-relay system so those trackers cannot see your IP address. With an iCloud+ subscription, the "Trackers and Websites" option routes all Safari traffic through iCloud Private Relay, but "Trackers Only" is a reasonable baseline for most people.
Fraudulent Website Warning → On (default)
Safari checks visited URLs against a list of known malicious sites. This involves sending some URL data to Google Safe Browsing (or Tencent Safe Browsing in some regions). Keeping this on is generally worthwhile for security.
Privacy-Preserving Ad Measurement → On (default) or Off
This allows websites to measure ad effectiveness without tracking you individually. The data is aggregated and delayed. Leaving it on is reasonable; turning it off removes this limited data sharing entirely.
Search section
Search Engine Suggestions → Off
When enabled, Safari sends partial queries to your default search engine as you type. Turning this off means suggestions come only from your bookmarks and history rather than from a remote server.
Safari Suggestions → Off
Sends search queries and location information to Apple to provide suggestions. Disabling this stops that data sharing.
Preload Top Hit → Off
Safari preloads the page it considers most likely from your search, which means connecting to a site before you choose to visit it.
AutoFill section
AutoFill → Credit Cards → Review and consider Off
AutoFill can populate saved credit card details into web forms. If you prefer to enter payment information manually to reduce the risk of accidental submission on unfamiliar sites, turning this off is reasonable.
AutoFill → Contact Info → Review and consider Off
Populates your name, address, and phone number into forms automatically. Turning this off gives you more control over when personal information is shared with websites.
Privacy Report
Privacy Report → Review periodically
Safari provides a Privacy Report (accessible from the toolbar or start page) showing which trackers have been blocked. This is informational only and does not require a settings change, but reviewing it occasionally gives visibility into how tracking prevention is working.
Trade-offs
- Turning off Search Engine Suggestions and Safari Suggestions means you will see fewer real-time results as you type in the address bar. You will need to press Enter to see full search results.
- Disabling Preload Top Hit means the first result will not begin loading until you explicitly select it, which adds a small delay.
- Setting Hide IP Address to “Trackers Only” rather than “Trackers and Websites” means non-tracker sites can still see your IP address. The broader option requires iCloud+ and routes more traffic through Apple’s relay servers.
- Turning off AutoFill for credit cards and contact info means filling in forms manually, which is slower but gives you explicit control over what is submitted.
- Advanced fingerprinting protection can occasionally cause sites that rely on canvas or audio features (some games, drawing tools, or bot checks) to behave oddly. Setting it to Private Browsing only is the fallback if a site you need stops working.
- Disabling Privacy-Preserving Ad Measurement removes a system designed to be privacy-respecting. Some view this feature as a reasonable compromise that supports the ad-funded web.
Who should not change these settings
- If you prefer the convenience of real-time search suggestions as you type, leaving Search Engine Suggestions and Safari Suggestions on is reasonable, especially if you are comfortable with your search engine’s data practices.
- If you frequently shop online and value the speed of AutoFill for credit cards, keeping that setting on with strong device authentication (Face ID or Touch ID) is a practical choice.
- If you use iCloud+ and want broader IP address protection, choosing “Trackers and Websites” instead of “Trackers Only” provides additional coverage.
- If a site you depend on breaks with advanced fingerprinting protection on for all browsing, limiting it to Private Browsing is a reasonable compromise.
- If the Safari defaults already align with your expectations, no changes are necessary. Safari’s out-of-the-box privacy posture is stronger than most browsers.