Pop-ups, overlays and prompts
Pop-up blocking has been on by default for two decades and it defeats the crude version: a script that opens a window the instant a page loads. What still gets through is the pop-up attached to a gesture, because browsers deliberately allow a window opened in response to a real click — that is how sign-in windows work. Bind the interruption to a play button and your click is genuine, the window is consented to, and the blocker stands down.
Overlays are a different animal in the same costume. A subscription wall, a banner stacked on a banner, a video that shrinks into the corner — none are pop-ups in the technical sense. They are ordinary elements positioned on top of the article, so no pop-up setting has authority over them. Auto-play rules govern sound rather than motion, which is why a silent ad reel can still start moving.
Permission prompts are a third mechanism again. Notifications, location, camera, microphone and sensors are each gated behind a per-origin grant whose default is ask, so every new domain gets one chance. And a grant is sticky: nothing expires, and push does not need the site to be open — which is how a desktop showing a spreadsheet suddenly displays a headline from a news site nobody has visited in eighteen months.
What third-party trackers do
A third-party request is any resource a page pulls from a domain other than the one in your address bar. Plenty are ordinary — a font service, a video player, an embedded map. Others exist only to record that a particular browser was on a particular page at a particular moment.
The classic mechanism, the third-party cookie, is now heavily restricted: Safari and Firefox block cross-site cookies by default and Chrome gives users controls over them. That changed the tooling rather than ending it. Tracking pixels still work, so does link decoration, and so does fingerprinting, which identifies a browser by its fonts, screen dimensions and how it renders a test graphic — without storing anything. Blocking cookies limits what a third party may store and re-read; it does not stop the request being made.
Auditing what you already allow
This is the part with the highest ratio of relief to effort, and it takes about ten minutes per browser.
Where the lists live
- Chrome: Privacy and security → Site settings, where "View permissions and data stored across sites" is the whole ledger in one place.
- Edge: Cookies and site permissions — the same structure, including a per-site "All permissions" view.
- Firefox: Privacy & Security → Permissions, where each dialog offers "Block new requests asking to allow".
- Safari: Settings → Websites, one tab per capability.
What to do once you are there
Work by exception. Revoke anything you cannot immediately justify, keep a short allow list where a capability is load-bearing, and set the notification default to do not allow. Check your installed extensions too, because one you stopped using still holds whatever access it was granted.
Where an adblocker fits
Browser settings are per-capability switches applied to origins one at a time. A content-blocking extension works a layer beneath: it reads maintained filter lists and decides on each request a page makes and each element it draws. So it can stop a request before it leaves your browser, hide in-page overlays that no pop-up setting can touch, and cover sites you have never visited.
The limits matter just as much. It does not revoke a notification permission you have already granted — only the settings page clears that — and it cannot help with an account you are logged into. None of this produces a silent web. What it produces is a browser whose behaviour is explainable, and that does not require you to buy anything.