Firefox extension
Privacy Monitor
Firefox extension report · version 1.3.0 · observe-only privacy auditor. It records and explains. It does not block cookies, cancel requests, rewrite pages, or send reports anywhere else.
What this extension is for
Privacy Monitor answers one question: what did this site attempt to store, contact, load, or track about me? Each monitored tab gets a live report. The toolbar badge shows a count colored by severity: known trackers and high-confidence fingerprinting in red, third-party cookies in yellow, other third-party requests in orange.
- Extension version
- 1.3.0
- Minimum Firefox
- 140+
- Max saved visits
- 80
- Visit retention
- 30 days
Auto monitor is on by default and records every HTTP(S) tab as you browse. Turn it off, and nothing is recorded until you click Scan this site in the popup or sidebar. That scan snapshots cookies and storage for the current tab and watches it until the tab closes.
- Observe-only: no blocking, rewriting, or remote reporting
- Live report per tab, plus a saved visit history on this device
- Toolbar badge colored by the strongest signal on the page
- Scan this site when auto monitor is off
What it observes
Two independent collectors feed one background observer. Network and cookie events come from Firefox APIs. Storage and fingerprinting events come from content scripts injected at document_start in every HTTP(S) frame.
| Signal | What is recorded | Why it matters |
|---|---|---|
| Cookies | Created, updated, sent, or already present. First vs third party. Partitioned vs unpartitioned. Expiry. | Unpartitioned third-party cookies can follow you across sites. |
| Third-party requests | Hosts contacted from the page. Scripts, images, XHR/fetch, iframes, websockets, beacons, pixels. | This is how most trackers, ads, and analytics actually run. |
| Storage | localStorage, sessionStorage, and IndexedDB keys as they are written, removed, or already present. | Sites often stash visitor IDs here when cookies are restricted. |
| Fingerprinting APIs | Canvas, WebGL, Audio, WebRTC, plugins, fonts, battery, device enumeration. Attributed to the calling script when the stack allows it. | These APIs can build a stable device fingerprint without cookies. |
| Click IDs | Advertising parameters on the page URL (gclid, fbclid, utm_*, and similar). | Shows the visit arrived from a paid or tracked campaign. |
| Known trackers | Hosts matched against Disconnect Tracking Protection plus a short extras list. | Separates advertising/analytics from CDNs and same-company infrastructure. |
| CNAME cloaking | First-party subdomains whose DNS CNAME points at a tracker. | A tracker can hide behind a subdomain that looks first-party. |
The sidebar follows the active tab with the same UI as the popup, so you can keep the report open while you click around a site.
How data moves
The website tab talks to page-hook.js. Firefox network APIs and bridge.js both feed background.js, which writes the live report the popup, sidebar, and full report page read from storage.local.
webRequest watches requests without blocking. Third-party hosts are stored; first-party hosts are skipped unless DNS shows a CNAME to a tracker. Request and response Cookie / Set-Cookie headers are parsed. cookies.onChanged and a snapshot of the cookie jar on navigation fill in cookies the headers missed. Partitioning is taken from Set-Cookie Partitioned and from Firefox partitionKey.
Source: extension architecture in manifest.json, background/background.js, content/page-hook.js, and content/bridge.js.
- Network and cookies from Firefox APIs (observe, never block)
- Storage and fingerprinting from document_start content scripts
- One background observer owns the report and local snapshots
How a domain is labeled
Lookup is suffix-based, so pixel.facebook.com matches facebook.com. Tracker extras are checked before Disconnect, which lets consent managers and bot-defense CDNs be marked countAsTracker: false.
| Rule | Result |
|---|---|
| Same registrable domain as the page | First-party. Not a tracker. |
| Same company map (Google, Meta, LinkedIn, …) | Own infrastructure. Not a tracker. |
| Disconnect Advertising / Analytics / Social | Known tracker. Counted and highlighted. |
| Disconnect Consent or Content, or extras with countAsTracker false | Labeled (Consent, CDN, bot defense) but not counted as a tracker. |
| Known CDN (jsDelivr, CloudFront, Google Fonts, …) | Library CDN / content delivery. |
| Beacon, ping, or 1x1 / /pixel / /collect URL | Tracking beacon, even if the host is unknown. |
| CNAME of a first-party host points at a tracker | Cloaked tracker. Purpose includes (CNAME). |
Cookie names are also classified by regex (_ga, _fbp, session ids, theme/lang). Storage keys that look like visitor IDs are flagged as suspicious.
Fingerprinting and the tracker list
Using canvas or WebGL once is not proof of fingerprinting. Confidence rises when a known tracker script calls a high-signal API, when several signals appear on a third-party host, or when the caller is not the page’s own company.
The bulk list is Disconnect Tracking Protection (about 4,400 domains) in lib/disconnect-list.js. A short extras file covers gaps such as googletagmanager.com, app-measurement.com, and HUMAN / DataDome bot-defense hosts.
- High-signal: Canvas.toDataURL, toBlob, getImageData, WebGL.readPixels, OfflineAudioContext, RTCPeerConnection
- Medium: WebGL.getParameter, AudioContext, plugins, fonts
- Low: battery, enumerateDevices, voices
- Low confidence means this API ran, not that you were fingerprinted
Surfaces
The same report is available as a compact popup, a persistent Firefox sidebar, and a wider full-report page with visit history. Settings stay small on purpose: auto monitor, open the other surfaces, and delete stored visits.
| Surface | Role |
|---|---|
| Toolbar popup | Live summary, verdict, filterable table, Scan this site when auto monitor is off, Full report, Settings, copy JSON. |
| Firefox sidebar | Same UI as the popup, always available from the Firefox sidebar menu. Follows the active tab. |
| Full report | Wider table with a Detail column, search, and a left list of saved visits grouped by site. |
| Settings | Auto monitor on/off, open sidebar, open reports, delete stored visit data. Explains the 80-visit / 30-day cap. |
What is stored, and for how long
Nothing leaves the device. Visit snapshots live in browser.storage.local under visits. In-progress tab reports use session storage when Firefox provides it. Settings are a single autoMonitor flag.
| Item | Cap | Typical size |
|---|---|---|
| Saved visits | 80 visits or 30 days, whichever comes first | 1–2 MB typical |
| Rows per visit | 250 | 10–30 KB typical |
| Worst-case history | 80 heavy pages | about 4–8 MB |
| Firefox local storage quota | about 10 MB without unlimitedStorage | headroom remains |
Size is estimated from JSON snapshots of cookies, request hosts, storage keys, and API names. Page HTML, screenshots, and cookie values are not stored.
- Local only: no sync and no remote backup
- Older visits are deleted automatically
- Delete stored visit data clears the history from Settings
Permissions
Each permission is used to observe, not to change the page. The extension never injects ads or posts data out.
| Permission | Used for | Not used for |
|---|---|---|
| cookies | Read names, domains, expiry, partition state | Changing or deleting cookies |
| webRequest | See third-party requests and Set-Cookie / Cookie headers | Blocking or modifying requests |
| webNavigation | Know when a tab starts a new page | Redirecting navigation |
| tabs | Identify the active tab and open the report page | Closing or rewriting tabs |
| storage | Save settings and visit history on this device | Sync or remote backup |
| dns | Resolve CNAME to detect cloaked trackers | Changing DNS |
| <all_urls> | Observe any http/https site you open | Injecting ads or posting data out |
Limits, caveats, and how to load it
It can miss things. Tabs already open before install need a reload so content scripts attach. Service workers and some sandboxed frames may not run the page hook. Stack-trace script attribution is best-effort. The company map is hand-maintained and will not cover every brand.
It can over-report. Fingerprinting APIs are also used for games, video, and fonts. Google Tag Manager is listed as analytics because it is often the loader for trackers, even when the container itself is first-party.
Not an ad blocker. Privacy Monitor will not make sites load fewer trackers. Use it to see what happened. Pair it with Firefox Enhanced Tracking Protection or a blocker if you want requests stopped.
In Firefox open about:debugging#/runtime/this-firefox, choose Load Temporary Add-on, and select manifest.json. Reload already-open tabs. The gecko id is privacy-monitor@web-analyse.local. Temporary add-ons unload when Firefox restarts until you load them again.
- Reload existing tabs after install
- Low confidence is “this API ran,” not “you were fingerprinted”
- Temporary add-on until it is signed and installed permanently