First Party Isolation Firefox: Browser Isolation Guide (2026)

What Is First-Party Isolation in Firefox?

First party isolation Firefox is one of the most powerful — yet least understood — privacy features available in any mainstream browser. Originally developed for the Tor Browser, First-Party Isolation (FPI) was integrated into Firefox’s codebase and remains accessible through the about:config advanced settings page. In 2026, it coexists with Firefox’s newer Total Cookie Protection (TCP) system, creating a layered but sometimes confusing privacy landscape.

FPI works by partitioning virtually all browser state — cookies, cache, image cache, HSTS data, OCSP stapling, SSL session tickets, DNS records, and more — by the first-party domain of the website you’re visiting. This means that a tracker embedded on shopping.com and newssite.com gets entirely separate storage contexts on each site, making cross-site tracking through shared browser state effectively impossible.

In this comprehensive guide, we’ll cover how FPI works under the hood, the critical about:config settings that control it, how it compares to Total Cookie Protection and Enhanced Tracking Protection, known compatibility issues, and why professionals who need maximum isolation should consider dedicated tools like Send.win.

How First-Party Isolation Works: Technical Deep Dive

First-Party Isolation was born from the Tor Browser’s “Cross-Origin Identifier Unlinkability” design requirement. The core concept is simple but far-reaching: all browser-managed state that could potentially be used to link user activity across sites is keyed — or partitioned — by the first-party domain (the eTLD+1 of the URL in the address bar).

What FPI Partitions

When privacy.firstparty.isolate is set to true, Firefox partitions all of the following by first-party domain:

Browser State	How FPI Partitions It	Tracking Vector Blocked
Cookies	Separate cookie jar per first-party domain	Cross-site cookie tracking
HTTP Cache	Cached resources keyed by first-party + resource URL	Cache probing, timing attacks
Image Cache	Separate image cache per first-party context	Image-based cache tracking
Favicon Cache	Favicons isolated per first-party domain	Favicon-based supercookies
HSTS State	HSTS entries partitioned per first-party domain	HSTS supercookie attacks
OCSP Responses	OCSP cache isolated per first-party domain	Certificate-based tracking
SSL/TLS Session IDs	Session identifiers partitioned	TLS session resumption tracking
DNS Cache	DNS resolutions isolated per first-party context	DNS-based timing attacks
Alt-Svc Header Cache	Alternative service mappings partitioned	Protocol-level tracking
Speculative Connections	Pre-connections isolated per first-party domain	Connection-based fingerprinting
SPDY/HTTP2 Session IDs	Session multiplexing isolated	Connection pooling identification
window.name	Cleared on cross-origin navigations	Cross-origin data leaking
Blob/Data URLs	Isolated per first-party context	Cross-site data exfiltration

This comprehensive partitioning covers far more state than most users realize browsers even maintain. Many of these vectors — like HSTS supercookies and favicon cache tracking — have been demonstrated in academic research as viable tracking mechanisms that can survive cookie clearing and even browser restarts. For a deeper look into how storage partitioning works across different browsers, see our dedicated guide.

Enabling FPI: The about:config Settings

First-Party Isolation is not exposed in Firefox’s regular settings UI. You need to access the advanced configuration page:

1. Type about:config in Firefox’s address bar and press Enter.
2. Accept the risk warning (“I accept the risk!”).
3. Search for privacy.firstparty.isolate.
4. Double-click to toggle it to true.

Related settings you should know about:

Setting	Default	Recommended	Description
privacy.firstparty.isolate	false	true (if not using TCP)	Master switch for First-Party Isolation
privacy.firstparty.isolate.restrict_opener_access	false	true	Restricts cross-origin window.opener access
privacy.firstparty.isolate.block_post_message	false	false	Blocks cross-origin postMessage (breaks many sites)
privacy.firstparty.isolate.use_site	false	false	Uses full site (scheme + eTLD+1) instead of just eTLD+1

Important warning: Enabling privacy.firstparty.isolate can cause significant website breakage. It’s designed for users who prioritize privacy over convenience and are willing to troubleshoot issues.

Total Cookie Protection (TCP): Firefox’s Modern Approach

While FPI was the original isolation mechanism, Firefox has since developed Total Cookie Protection (TCP) as a more practical, user-friendly alternative that achieves similar privacy goals with far fewer compatibility issues.

How TCP Differs from FPI

Total Cookie Protection, enabled by default in Firefox’s Enhanced Tracking Protection (ETP) Strict mode since 2022, focuses specifically on cookie partitioning rather than the comprehensive state partitioning that FPI provides. However, Firefox has gradually expanded TCP to cover network state partitioning as well.

Key differences:

Feature	FPI (privacy.firstparty.isolate)	TCP (Total Cookie Protection)
Origin	Tor Browser project	Firefox privacy team
Activation	Manual (about:config)	Default in ETP Strict mode
Cookie partitioning	All cookies partitioned by first party	Third-party cookies partitioned by first party
Cache partitioning	Full HTTP/image/favicon cache partitioning	HTTP cache partitioned (network partitioning feature)
HSTS partitioning	Yes	Yes (via network partitioning)
DNS partitioning	Yes	Yes (via network partitioning)
SSO compatibility	Poor — often breaks SSO flows	Good — heuristic-based exceptions
Smart exceptions	None — strict partitioning only	Yes — popup/redirect heuristics for SSO, payments
Storage Access API	Supported but limited	Fully integrated
Website breakage	Frequent and severe	Rare — designed for mainstream use
Maintenance status	Legacy — minimal updates	Active — ongoing development
Recommended for	Privacy maximalists, Tor-like isolation	All Firefox users

TCP’s Smart Exceptions: How Firefox Avoids Breakage

One of TCP’s biggest advantages over FPI is its heuristic-based exception system. When Firefox detects that a user is actively engaging in a cross-site interaction — such as clicking through an SSO popup or being redirected through a payment processor — it temporarily grants the third-party site access to its unpartitioned cookies. This happens automatically and transparently.

The heuristics cover common patterns:

• Popup interactions — If a site opens a popup to a third-party domain (common in OAuth/SSO flows) and the user interacts with it, Firefox temporarily grants cookie access.
• Redirect chains — If a user is redirected through a third-party domain during an active navigation (e.g., payment processing), temporary access is granted.
• Storage Access API requests — Sites can explicitly request unpartitioned access through the standardized Storage Access API, which Firefox supports with user interaction requirements.

How Send.win Helps You Master First Party Isolation Firefox

Send.win makes First Party Isolation Firefox simple and secure with powerful browser isolation technology:

• Browser Isolation – Every tab runs in a sandboxed environment
• Cloud Sync – Access your sessions from any device
• Multi-Account Management – Manage unlimited accounts safely
• No Installation Required – Works instantly in your browser
• Affordable Pricing – Enterprise features without enterprise costs

Try Send.win Free – No Credit Card Required

Experience the power of browser isolation with our free demo:

• Instant Access – Start testing in seconds
• Full Features – Try all capabilities
• Secure – Bank-level encryption
• Cross-Platform – Works on desktop, mobile, tablet
• 14-Day Money-Back Guarantee

Try Send.win Free Demo Now

Ready to upgrade? View pricing plans starting at just $9/month.

These smart exceptions mean that TCP rarely breaks websites in practice — a stark contrast to FPI, which applies strict partitioning without any exceptions.

Enhanced Tracking Protection (ETP): The Broader Framework

Both FPI and TCP exist within Firefox’s broader Enhanced Tracking Protection (ETP) system. Understanding ETP’s three levels is essential for choosing the right privacy configuration.

ETP Levels Compared

Protection	ETP Standard	ETP Strict	ETP Custom
Known trackers blocked	Yes (Disconnect list)	Yes (Disconnect list)	Configurable
Third-party tracking cookies	Blocked (known trackers only)	All third-party cookies partitioned (TCP)	Configurable
Cryptominers blocked	Yes	Yes	Configurable
Fingerprinters blocked	Known fingerprinters	Known fingerprinters + suspected	Configurable
Tracking content blocked	Only in Private Windows	In all windows	Configurable
Total Cookie Protection	Partial	Full (all third-party cookies partitioned)	Configurable
Website compatibility	Excellent	Good	Depends on settings

For most users, ETP Strict with Total Cookie Protection enabled is the recommended configuration. It provides strong anti-tracking protection with minimal website breakage. For a broader overview of privacy-focused browsers, check out our roundup of the best browser for online privacy in 2026.

FPI vs TCP vs ETP: When Should You Use Each?

Choosing between FPI, TCP, and ETP depends on your threat model and tolerance for website breakage. Here’s a practical decision framework:

Use ETP Strict (with TCP) If You…

• Want strong privacy protection with minimal hassle
• Need websites to work reliably (SSO, payments, embedded content)
• Are a typical Firefox user who wants better-than-default privacy
• Don’t want to touch about:config

Use FPI If You…

• Are a privacy maximalist willing to accept website breakage
• Need Tor Browser-level isolation without using Tor
• Are conducting security research or privacy testing
• Understand how to troubleshoot broken sites by temporarily disabling FPI
• Are comfortable navigating about:config settings

Use Both FPI and TCP If You…

• Want the absolute maximum partitioning Firefox can provide
• Accept that many websites will break and are prepared to maintain exception lists
• Are running Firefox in a controlled environment (research, testing, specific workflows)

Important note: FPI and TCP can coexist, but enabling FPI on top of TCP adds additional partitioning that can cause conflicts. In some cases, FPI’s stricter partitioning overrides TCP’s heuristic exceptions, negating TCP’s compatibility benefits. Mozilla’s official recommendation is to use TCP (via ETP Strict) rather than FPI for mainstream use.

Common Compatibility Issues with FPI

Because FPI was designed for the Tor Browser’s extreme threat model, it causes predictable breakage patterns on the general web. Here are the most common issues and workarounds:

Single Sign-On (SSO) Failures

FPI partitions cookies by first-party domain, so when you log into Google on accounts.google.com, that session cookie is only available when Google is the first party. When a third-party site tries to authenticate you via Google OAuth in an embedded iframe, the Google cookie is invisible because the first-party context has changed.

Workaround: Open the SSO provider in a new tab, complete authentication there, then return to the original site. Alternatively, temporarily disable FPI for the login flow.

Embedded Content Breakage

YouTube embeds, Google Maps, embedded tweets, and other cross-origin iframes lose access to their cookies under FPI. This means:

• YouTube embeds may not remember your preferences or show age-restricted content
• Google Maps embeds may not load saved locations
• Social media embeds may appear logged out

Payment Processing Failures

Payment gateways like Stripe, PayPal, and Braintree that operate in iframes may fail to complete transactions because they can’t access their session cookies across the first-party boundary.

Workaround: Complete payment on the payment processor’s own site rather than through embedded forms, or temporarily disable FPI.

Multi-Domain Sites

Organizations that use multiple domains (e.g., cdn.example.com, api.example.com, auth.example.com) may experience issues because FPI treats each domain’s cookies separately. Sessions established on one subdomain may not carry over when resources are loaded from another.

Beyond Browser Settings: True Isolation with Dedicated Profiles

Both FPI and TCP are valuable privacy tools, but they share a fundamental limitation: they only partition browser state within a single browser profile. No matter how aggressively Firefox partitions your cookies and cache, the following remain constant across all partitioned contexts:

• Your browser fingerprint — Canvas hash, WebGL renderer, installed fonts, screen resolution, hardware concurrency, and dozens of other signals remain identical whether you’re visiting Site A or Site B.
• Your IP address — Every request originates from the same IP, allowing network-level correlation.
• Your browsing history and bookmarks — While not directly accessible to websites, browser-level data like history can be probed through CSS visited-link attacks and other side channels.
• Your extensions — The same set of browser extensions are present across all contexts, and many extensions can be detected or fingerprinted by websites.

For users who understand the full scope of browser tracking methods, it’s clear that state partitioning alone isn’t enough when your goal is truly independent browsing identities. Learn more about the techniques that work even without cookies in our guide on tracking without cookies.

This is where Send.win provides a fundamentally different approach. Rather than partitioning state within a single browser profile, Send.win creates entirely separate cloud browser environments. Each profile runs independently with:

• Unique browser fingerprint — Canvas, WebGL, fonts, screen resolution, and all other fingerprintable properties are independently configured per profile.
• Isolated storage — Cookies, localStorage, IndexedDB, cache, service workers — everything is completely separate with zero cross-profile leakage.
• Independent network identity — Each profile can be configured with its own proxy, giving each browsing identity a distinct IP address.
• Separate browser configuration — User agent, timezone, language, platform — each profile is a distinct browsing entity.

Where FPI partitions state within one profile, Send.win eliminates the concept of shared state entirely. There’s nothing to partition because each profile is a self-contained browser environment.

Setting Up Firefox for Maximum Privacy: Step-by-Step

If you want to maximize Firefox’s built-in isolation capabilities, here’s the recommended configuration for 2026:

Step 1: Enable ETP Strict Mode

1. Open Firefox Settings (Menu → Settings → Privacy & Security).
2. Under Enhanced Tracking Protection, select Strict.
3. This enables Total Cookie Protection, blocks tracking content in all windows, and enables fingerprinter blocking.

Step 2: Consider FPI (Advanced Users Only)

1. Navigate to about:config.
2. Search for privacy.firstparty.isolate and set to true.
3. Optionally set privacy.firstparty.isolate.restrict_opener_access to true.
4. Leave privacy.firstparty.isolate.block_post_message as false unless you need maximum isolation.

Step 3: Additional about:config Hardening

These complementary settings enhance Firefox’s privacy beyond FPI and TCP:

Setting	Value	Purpose
privacy.resistFingerprinting	true	Normalizes many fingerprinting vectors (timezone, screen size, fonts)
network.cookie.cookieBehavior	5	Enables dynamic cookie policy (TCP integration)
dom.storage.enabled	true	Keep enabled; partitioning handles isolation
media.peerconnection.enabled	false	Disables WebRTC to prevent IP leakage
geo.enabled	false	Disables geolocation API
browser.send_pings	false	Disables hyperlink ping tracking

Step 4: Install Privacy Extensions

Complement FPI/TCP with privacy-focused extensions:

• uBlock Origin — Blocks trackers, ads, and malicious scripts at the network level.
• Firefox Multi-Account Containers — Adds another layer of tab-level isolation (separate cookie jars per container).
• Skip Redirect — Bypasses tracking redirects that may plant first-party cookies.

Performance Impact of FPI and TCP

Storage partitioning does come with a measurable performance cost, though it’s generally minor in everyday use:

• Increased memory usage — Maintaining separate storage partitions for each first-party context requires more memory. If you have 20 tabs open visiting sites that all embed the same third-party resources, each gets its own cache copy instead of sharing one.
• More network requests — Partitioned caches mean that resources cached for one first-party context must be re-downloaded when the same third-party resource appears on a different site. This can increase page load times, especially for common resources like Google Fonts or popular JavaScript libraries.
• Slightly slower DNS resolution — Partitioned DNS caches can’t share resolutions across first-party contexts, leading to additional DNS lookups.

In practice, the performance impact is minimal on modern hardware and fast internet connections. The privacy benefit far outweighs the slight increase in resource usage. TCP’s smart exceptions also help by allowing shared access in cases where partitioning would cause disproportionate breakage without meaningful privacy benefit.

The Future of Firefox Isolation

Mozilla continues to evolve Firefox’s privacy capabilities. Several developments are worth watching in 2026 and beyond:

• FPI deprecation considerations — As TCP matures and covers more network state, FPI may eventually be deprecated in favor of TCP’s more compatible approach. Mozilla has not announced this officially, but the trajectory suggests TCP is the future.
• Bounce tracking protection — Firefox is actively developing protections against bounce tracking, where trackers briefly redirect users through their domain to set first-party cookies.
• Global Privacy Control (GPC) — Firefox supports the GPC signal, which legally invokes privacy rights under GDPR and CCPA. This works alongside technical protections like FPI and TCP.
• Network partitioning expansion — Firefox continues to extend network state partitioning to cover additional vectors like WebSocket connections and prefetch caches.

Frequently Asked Questions About First-Party Isolation in Firefox

What is First-Party Isolation (FPI) in Firefox?

First-Party Isolation is a Firefox privacy feature, originally developed for the Tor Browser, that partitions all browser state — including cookies, HTTP cache, image cache, HSTS data, OCSP responses, DNS cache, and SSL session IDs — by the first-party domain (the domain in the address bar). This prevents third-party resources embedded on different websites from sharing data and tracking you across sites. It’s enabled via the privacy.firstparty.isolate setting in about:config.

How do I enable First-Party Isolation in Firefox?

Type about:config in Firefox’s address bar, accept the risk warning, search for privacy.firstparty.isolate, and double-click to toggle it to true. Be aware that this can break many websites, including SSO login flows, embedded payment forms, and cross-origin iframes. For enhanced isolation without breakage, consider using Firefox’s ETP Strict mode with Total Cookie Protection instead.

What is the difference between FPI and Total Cookie Protection?

FPI partitions all browser state comprehensively with no exceptions, causing frequent website breakage. Total Cookie Protection (TCP) focuses on partitioning third-party cookies while using smart heuristics to temporarily grant unpartitioned access for legitimate interactions like SSO and payments. TCP is designed for mainstream use and is enabled by default in ETP Strict mode, while FPI requires manual activation and is best suited for privacy maximalists who can tolerate broken sites.

Can I use FPI and TCP at the same time?

Yes, FPI and TCP can coexist in Firefox, but it’s generally not recommended. FPI’s stricter partitioning can override TCP’s heuristic exceptions, negating TCP’s compatibility benefits while providing minimal additional privacy improvement. If you enable both, expect more website breakage than TCP alone. Mozilla’s recommended approach is to use ETP Strict (which includes TCP) for most users.

Does First-Party Isolation prevent browser fingerprinting?

No. FPI only partitions stored browser state (cookies, cache, DNS, etc.) — it does not change or mask your browser’s fingerprint. Your canvas hash, WebGL renderer, installed fonts, screen resolution, and other fingerprintable characteristics remain the same across all first-party contexts. To resist fingerprinting, you need to additionally enable privacy.resistFingerprinting in about:config, or use a dedicated antidetect browser like Send.win that provides unique fingerprints per profile.

Why does FPI break SSO and login with Google/Facebook?

SSO flows rely on third-party cookies. When you click “Login with Google” on a website, your browser needs to access Google’s cookies from within that site’s context to verify your identity. FPI partitions Google’s cookies by first-party domain, so the Google session cookie set when you logged in at google.com is invisible when Google’s auth iframe loads on example.com. The auth flow fails because it can’t find your Google session.

Is First-Party Isolation being deprecated?

As of 2026, Mozilla has not officially announced FPI deprecation. However, FPI receives minimal maintenance updates compared to Total Cookie Protection, which is under active development. TCP covers an increasingly large portion of the state that FPI partitions, and its superior compatibility makes it the de facto recommendation. FPI may eventually be deprecated if TCP reaches full parity, but it remains functional for now.

How does Send.win compare to Firefox First-Party Isolation?

Firefox FPI partitions browser state within a single profile — your fingerprint, IP, and browser identity stay consistent across all partitioned contexts. Send.win creates entirely separate cloud browser profiles, each with its own unique fingerprint, independent storage, configurable proxy, and distinct browsing identity. While FPI is a privacy setting within one browser, Send.win provides multiple completely isolated browsers — offering a fundamentally higher level of separation for professionals who need truly independent online identities.

Related Products & Resources

• Proxy Browser Setup Browser Isolation Guide 2026
• Browser Isolation Technology Browser Isolation Guide 2026
• Docker Browser Browser Isolation Guide 2026
• Application Isolation Browser Isolation Guide 2026
• Remote Access Browser Browser Isolation Guide 2026