[throwaway6789]

I take great care to separate my browsing sessions. Still I find YouTube recommendations on my main account on topics that I watched on another machine in my home network. My typical setup involves:

1. Virtualbox VM restored to a snapshot after each usage (browser completely clean, never uses my main Google accounts here)

2. Firefox on main machine with clear all cookies set, ublock origin. Rarely logs into my main Google account, if I do, always in incognito.

3. pfsense with block lists for Google & Microsoft

4. Mobile with Disconnect tracking blocker (mobile wide) plus Firefox focus & Firefox set to clear all history on exit.

Still Google manages to track me. Whenever I see those recommendations in YouTube, I feel like Google is mocking me - "ha ha do whatever you want, you can never hide from us".

[rnhmjoj]

Check how unique your fingerprint is using panopticlick[1] and try to fix it by adopting more common settings. Also don't use Firefox Focus: it has telemetry and shares data with a third party[2]. Use the german version[3] if you must, it has telemetry disabled by default.

[1]: https://panopticlick.eff.org

[2]: https://www.ghacks.net/2017/02/12/firefox-focus-privacy-scan...

[3]: https://f-droid.org/packages/org.mozilla.klar/

[tinco]

Maybe you ended in the "people that put too much effort in anti-tracking" bin, and you get recommendations for those kinds of people :p

[fapjacks]

You jest, but having worked in the ad tech industry, I can say this is actually a completely viable means of tracking people. This is why you don't load uBlock Origin into your Tor Browser or use a custom User-Agent string while using your VPN. Everything you do that is different than what everyone else does (i.e. the default) is a means of identifying you. And if I could do it at that startup, certainly Google can do it in a million more ways a million times more accurately.

[AstralStorm]

If the bin is big enough or merges with other bins, it becomes the new norm.

Tor Browser has a strong "disable JavaScript" option that is relatively popular; the remaining vector is then tracking images and the rule would be to check for Tor exit node that hasn't downloaded the image cookie.

Even with JS on TB tries to reduce impact of such history based attacks.

Pretty targeted and obviously possible to fuzz.

[ReverseCold]

Changing your user agent is also probably a bad idea. There are other ways to detect browser, so you're pretty unique of you're using Firefox on MacOS with a Chrome for Windows user agent.

[fapjacks]

Yes, don't use any custom extensions in TB or any custom user-agent string or otherwise deviate from the default.