7 Microsoft Edge Settings and Tools That Reduce Cross-Site Ad Tracking

Two Deadlines and a Browser Set to Balanced

Edge has two dates circled for early 2027. Microsoft begins pulling the plug on Manifest V2, the older extension format plenty of ad blockers still use. California, for its part, is set to require browsers to offer a built-in opt-out signal. Neither touches the ad tracking that follows Edge users across sites today, because the browser ships with tracker blocking set to a middle setting and third-party cookies enabled. Anyone on Windows or a Mac can cut it back with seven settings and tools, most of which are accessible from edge://settings/privacy and the Edge Add-ons store.

Compatibility is the reason Microsoft gives for its cautious defaults, and it's a fair one. Heavy blocking does break the odd login box. Microsoft also sells advertising, though, and every default decides whose convenience comes first. Edge's tend to put the websites ahead of the person reading them.

1. Strict Tracking Prevention Does the Most Work

Of the seven, tracking prevention is the one to change first, since one click here probably buys more protection than anything else on the list. Edge files every known tracker under a category (advertising, analytics, content, cryptomining, fingerprinting, social and a catch-all "other") using Disconnect's open-source lists. Your level then sets the rules for each category.

So what does Balanced actually let through? On Balanced, the default, advertising trackers lose their storage access but still load on the page. Strict blocks the requests themselves. Balanced also goes easier on trackers from companies whose own sites you visit often, wherever those trackers turn up, and Strict switches that exemption off.

Don't judge Strict by its tally of blocked trackers. Because it stops trackers from loading at all, the follow-up requests they would have made never happen, so Strict can report fewer blocks than Balanced while doing more work.

Even Strict has limits. Edge exempts requests between domains owned by the same parent company at every level, meaning an ad business that also runs popular websites can keep its trackers running on its own properties. Trackers classed as content keep loading too, with only their storage cut off.

Some sites will misbehave on Strict, and Edge lets you exempt them one at a time. InPrivate windows follow your main setting by default, so if daily Strict still feels like too much, a toggle on the same page applies it to private browsing alone.

For IT teams, Edge's TrackingPrevention policy can set the level across a managed fleet, although it skips profiles signed in with a personal Microsoft account. Web developers should assume some visitors run Strict. Since the same-company exemption only covers domains Disconnect has mapped to one owner, a separately branded CDN may not qualify, so it pays to test your own site under Strict before customers do.

2. A Content Blocker Stops the Ad Request Itself

Second comes a content blocker, which attacks the problem from the other end. Tracking prevention works by filtering known tracker domains, whereas a blocker matches ad requests and refuses to load them. In most cases, an ad that never renders is one fewer script reporting back where you've been.

Edge's own calendar makes that choice more pressing. Since mid-September, Microsoft has been showing Manifest V2 deprecation warnings to some Edge users. Anyone comparing options for ad-blocking for Microsoft Edge should favor extensions already rebuilt on Manifest V3, because the older ones are on their way out.

Manifest V3 moves the filtering into the browser itself. Instead of inspecting every request on its own, an extension hands Edge a set of declared blocking rules, and Edge applies them as pages load.

Microsoft's published migration timeline expects enterprise deprecation of the old format to begin in early 2027, so administrators should audit edge://extensions now rather than in January. The ExtensionManifestV2Availability policy can buy a managed fleet some time for force-installed extensions. Even so, Microsoft's policy documentation states that every extension will eventually need to migrate to Manifest V3. Standardizing on one vetted blocker and pushing it through the ExtensionInstallForcelist policy is the cleaner route.

One blocker is enough, ideally from a publisher you could name without looking it up. Stack three and pages slow down, while each extension you add is one more company with permission to read every page you open.

Blocking ads also has a security case. Back in December 2022, the FBI made that case after spotting criminals buying search ads that mimicked real brands and steered people to malware. Its advice in alert I-122122-PSA was to use an ad-blocking extension when performing internet searches. The FBI also noted that blockers can be paused on trusted sites. For readers who'd rather not starve the publishers they visit every day, that pause button matters.

3. Edge Still Accepts Third-Party Cookies by Default

A lot of cross-site ad tracking still runs on third-party cookies. Say you read a recipe on a food blog that loads ads from some exchange; that exchange drops a cookie. Open a hardware store's site an hour later, and if the same exchange serves ads there, your browser hands the cookie straight back. Multiply that by every site carrying the same exchange, and a record of your reading builds itself.

Chrome was supposed to have dropped these cookies by now. Google changed course, and in October 2025, Britain's competition regulator released Google from its Privacy Sandbox commitments once the plan to retire cookies was abandoned. So Chromium, the engine under both Chrome and Edge, probably isn't going to retire them on your behalf.

Unless a user or an IT admin changes the setting, third-party cookies are allowed by default in Edge. Flipping Block third-party cookies under Cookies takes seconds, and since Strict already denies storage to trackers on Disconnect's list, the toggle mainly catches cookie-setting domains nobody has classified yet.

There's a cost. Some comment widgets and "sign in with" buttons break. Edge's per-site allow list exists for exactly that, so add the site that broke and keep the block everywhere else. The list cuts both ways. Under "Not allowed to save and read cookies," you can shut out a site you don't trust at all.

Anyone running attribution off third-party cookies has a blind spot here already. Edge's InPrivate windows block those cookies by default (Microsoft's policy page says so outright), so private sessions likely show up as new, unattributed visitors. Each person who flips the toggle in a normal window adds to the blind spot.

4. Microsoft's Own Ad Personalization Switches

The fourth setting concerns tracking by Microsoft itself. Under Privacy sits a long-winded toggle whose label begins "Allow Microsoft to save your browsing activity including history, usage, favorites, web content" and keeps going. Leave it on, and Microsoft can use that data to personalize its services, ads included. In InPrivate and Guest windows, nothing is collected at all, and Microsoft's page on how Edge uses browsing history for personalized advertising says so plainly.

Switching the toggle off extends that courtesy to every window, including the ones you use for banking and health searches.

Inside the privacy section of your Microsoft account sit two more switches. One, labeled "Share my data with third parties for personalized ads," lets you decide whether Microsoft shares what it knows about you with partners who target ads on other sites. Microsoft's US State Privacy Notice is plain that third parties may use shared data to show personalized ads.

Flip the second switch and Microsoft stops personalizing ads from its own data. You'll still see ads afterward; they'll just be less precisely targeted. And because both settings live on your Microsoft account, not in Edge, they follow you to any browser where you sign in.

IT teams needn't rely on every employee finding the Edge toggle. Disable the PersonalizationReportingEnabled policy and users lose the ability to switch that Edge-side collection back on.

5. Wipe Cookies on Exit, or Split Your Profiles

Fifth, make cookies temporary. Under Clear browsing data, Edge can delete cookies and other site data every time you close the browser, which caps any identifier that slipped past the earlier settings at a single session. The price is signing back in to most sites, and on a shared machine it's worth paying.

Logging back in every morning gets old fast. Each Edge profile keeps a separate cookie jar, though. Reserve a second profile for shopping and social media, and whatever gets planted there stays out of the one you use for work.

Where Cookie Controls Run Out

An empty cookie jar still leaves a gap. Installed fonts and the quirks of your graphics chip can be enough to identify a device even after its IP address changes. None of it is stored in a cookie, so there's nothing for you to delete. A site simply rebuilds the fingerprint from your device on every visit.

The gap isn't theoretical. One research team built a tool called FPTrace to watch how advertiser bidding shifts when a browser's fingerprint changes. What they reported in 2025 was tracking that carried on after users cleared their cookies, and opting out under GDPR or the CCPA didn't reliably stop it.

Edge blocks known fingerprinting scripts at every level, Basic included. The scripts nobody has cataloged are why clearing cookies ranks fifth here rather than first. Running a fingerprint test from the Electronic Frontier Foundation before and after these changes shows how much of your setup still stands out. Security teams can run the same check before signing off on a standard browser build for staff.

6. Edge Secure Network Masks the IP Address, Not the Browser

Edge Secure Network covers a different signal, the IP address. Behind it sits Cloudflare's network; your traffic is encrypted, and the sites you visit see a similar regional address in place of your own. IP-based tracking gets harder as a result. Regional ads will probably keep finding you anyway, since the stand-in address sits roughly where you live.

Secure Network leaves cookies alone. Like other VPN services, it primarily protects network traffic and masks the user's IP address rather than preventing cookie-based tracking. Understanding what a VPN does and doesn't hide is important when considering how signed-in accounts and browser cookies can still be used to identify users. Secure Network should therefore complement the earlier privacy settings rather than replace them.

The catches add up. You get 5 GB free each month, and only after signing in to Edge with a personal Microsoft account. Microsoft says it won't pass that identity on to Cloudflare. Still, a privacy feature that starts by asking who you are is an odd design choice. Streaming sites skip the tunnel by default to save data.

Managed work devices can't use Secure Network at all, which leaves companies that want masked staff traffic relying on their own VPN. The tunnel also covers Edge alone. People who want every app masked all month have other ways to hide an IP address, including full VPN apps and Tor Browser.

7. Do Not Track Is the Weakest Setting on the List

Last and weakest is Send Do Not Track requests. It costs nothing to switch on. The toggle adds a header to every request asking sites not to track you, and honoring it has always been voluntary.

W3C's tracking protection group shelved the standard in 2019 for lack of deployment, and Microsoft's own US privacy notice says the company doesn't respond to the signal either.

Global Privacy Control and California's 2027 Deadline

In the same notice, Microsoft says it does honor Global Privacy Control, the newer opt-out signal that Firefox and Brave send natively. Edge doesn't send it.

That gap has a deadline. Signed in October 2025, California's Opt Me Out Act will require browsers to offer an opt-out preference signal from January 1, 2027. Under the law, people opt out once, in the browser, instead of site by site.

Compliance teams shouldn't wait for January. Companies covered by California's privacy law already have to honor GPC, since the state's attorney general treats it as a valid opt-out request. Load your own site in a browser with GPC switched on, and the consent platform and tag manager should behave as though the visitor had already clicked the opt-out link.