I kept my VPN on for most of a year because I thought it was doing the work of about five different privacy tools at once. It is not. A VPN (virtual private network, a tunnel that encrypts traffic between your device and a remote server, replacing your real IP with the server’s) hides your IP from the websites you visit and protects your traffic from the local network you are on. It does not stop cookies, does not stop browser fingerprinting, does not stop your browser from voluntarily telling a website where you are, and does not turn off insecure HTTP connections. Three Chrome settings did more for my actual day-to-day footprint than the VPN was doing.
Source: MakeUseOf piece by Oluwaseun Bamisile, “I turned on my browser’s privacy features, and my VPN became almost redundant” (August 20, 2026). The Chrome paths below match the version shipped in August 2026.
Setting 1: Block third-party cookies site-wide
A third-party cookie is a tracking file set by a domain other than the one you are visiting, usually by an ad network. The way the modern web actually tracks you across sites is mostly via these cookies. First-party cookies (the ones that keep you logged in) are useful. Third-party cookies are the cross-site profiling layer.
To turn them off in Chrome:
- Open Settings, then Privacy and security.
- Click Third-party cookies.
- Select Block third-party cookies.
- Click Add next to “Sites that can use third-party cookies” only if a specific site breaks; do not bulk-add exceptions.
Firefox and Safari already do this by default. Chrome leaves it as your choice.
There is a real trade-off. Some sites use third-party cookies for login or for embedded widgets (a “share” button, a payment form, a comment system). Block them and those features sometimes break. Chrome lets you add per-site exceptions. I keep the global block on and add exceptions when a site I actually use stops working. That is the right way around for me.
Source note: blocking third-party cookies does not block all cross-site tracking. Fingerprinting (a technique that identifies your browser by its unique combination of settings, fonts, and hardware) and CNAME cloaking (a trick where a first-party subdomain secretly points to a tracking domain) both still work. This is one setting among several, not a silver bullet.
Setting 2: Block all location requests by default
A VPN can change your IP, which gives websites a rough idea of where you are at the city level. It does nothing about the Geolocation API (the browser feature that uses Wi-Fi, GPS, and cell towers to find your precise location and shares it with sites that ask). When a site asks “Can we see your location?”, the answer comes from your browser, not your VPN.
Chrome’s default is “ask every time”, which means you get a popup for every site that wants to know where you are. Most people click Allow to make the popup go away. That is how you end up with 60 sites that know your home address.
The cleaner setting:
- Open Settings, then Privacy and security, then Site settings, then Location.
- Switch the toggle to “Don’t allow sites to see your location.”
This is strict. Sites that genuinely need location (a maps site, a delivery tracker) will stop working until you add an exception. I have two exceptions: Google Maps and the UPS tracker. Everything else gets nothing. If you would rather not go strict, leave the default and click “Don’t allow” on every prompt until your thumb learns the answer. The strict setting is the one that requires the least attention.
Setting 3: Turn on HTTPS-Only Mode
HTTP is the unencrypted version of the web. HTTPS encrypts the connection between your browser and the website so that someone on the same network (the coffee shop Wi-Fi, the airport hotspot, your ISP) cannot read or modify the traffic. HTTPS-Only Mode makes the browser refuse to load HTTP sites and shows a warning before it tries.
To turn it on:
- Open Settings, then Privacy and security, then Security.
- Enable Always use secure connections.
In 2026, the number of sites that still do not support HTTPS is small and shrinking. You will hit a warning page occasionally. It is worth clicking through once in a while to confirm a small site is really HTTP and not just misconfigured.
A VPN does not do this for you. The encrypted tunnel protects you from your local network, but the moment the VPN drops or you connect directly to Wi-Fi, HTTP traffic is exposed again. HTTPS-Only is the more durable protection because it lives in the browser.
What the VPN still does that Chrome cannot
I have not deleted my VPN client. Three things keep it installed:
- Public Wi-Fi. A coffee shop or hotel network is a hostile environment. The VPN tunnel encrypts traffic before it leaves my device, which means the local network operator (or anyone else on the same network running a packet sniffer, a tool that captures unencrypted traffic) sees nothing useful.
- Hiding the IP from the destination. A VPN replaces my real IP with the VPN server’s IP. The three Chrome settings above do not do that. If a site blocks users from a specific country, only a VPN (or Tor) gets me in.
- Geo-shifting for legitimate reasons. A VPN with servers in other countries is the only way to access a service that is region-locked. This is not a privacy feature. It is an access feature. It is the reason a VPN is still worth paying for even after the privacy settings above cut most of what the VPN was supposedly doing.
Trade-offs
These three settings are not free in convenience. Blocking third-party cookies breaks a small number of sites I actually use, and I have to maintain a per-site exception list that grows over time. Blocking all location means every map and delivery site gets an explicit allow before it works. HTTPS-Only Mode loads a warning page for the occasional HTTP-only site, which adds one click.
In my case, the math works out. I spend maybe five minutes a month managing exceptions. The five minutes is worth it for the reduction in tracking I get from the browser itself, which is bigger than what the VPN was ever contributing.
Your math will be different if you live inside a heavily geofenced workflow (a delivery driver, a traveling salesperson, a journalist in a restricted region). You may need location on most sites and a VPN for everything else. For the average reader browsing at home, the three settings above are the better return on time than another year of paid VPN subscription.
The migration took about ten minutes. The thing that was harder than expected was finding the right toggle for HTTPS-Only (it is buried under Privacy and security, then Security, not under the top-level “Privacy” link). The thing that was easier than expected was that Chrome did not need a restart for any of the three changes.
If you only do one thing from this article, block third-party cookies site-wide. That single change removes the layer of tracking that your VPN was never going to touch.
Bottom line
Turn on the three settings above. Keep your VPN installed for public Wi-Fi, geo-shifting, and IP hiding. Do not pay for a VPN under the impression that it is your main privacy tool in 2026. The browser does most of the work now.
Source: MakeUseOf, “I turned on my browser’s privacy features, and my VPN became almost redundant” by Oluwaseun Bamisile (August 20, 2026). Chrome menu paths verified against the current stable Chrome build (August 2026).