For more details, here is the Firefox bug report:
https://bugzilla.mozilla.org/show_bug.cgi?id=1549587
To enable Dynamic First Party Isolation: in Firefox Nightly's about:preferences#privacy, select "Custom" Enhanced Tracking Protection and "Cookies" = "Cross-site and social media trackers, and isolate remaining cookies". Or just set `network.cookie.cookieBehavior` pref = 5 in about:config.
"When third-party cookies are allowed, 101 domains can reconstruct over 50% of a user's history and 161 could recover over 40%. Even when these cookies are blocked, 44 domains could recover over 40% of a user's history."[1]
[1] Study back in 2014: https://securehomes.esat.kuleuven.be/~gacar/persistent/the_w...
Add to that web beacons, ads, like buttons, browser fingerprinting via HTTP header, javascript, canvas, plug-ins, add-ons or hardware, keystroke biometrics and gestures on smartphones. Of course, there are also several techniques for e-mail tracking as well as tracking of documents (word, .pdfs etc).
Previously it only enabled third-party cookies for domains you had explicitly visited. https://www.theverge.com/2017/9/14/16308138/apple-safari-11-...
It can be a bit annoying due to eg Recaptcha, but it works fine 99% of the time. Some sites will break, but these are far and few between. I just use another browser for those.
It was upstreamed from TOR and will scope all data (cookies, caches, etc) per domain. It's not a panacea, but definitely a good step.
(about:config , privacy.firstparty.isolate)
I feel like something like this should be the (standardized) behaviour of browsers. Sharing any kind of observable state between domains should require an explicit opt-in with a prompt.
Like: "Privacy Warning: techcrunch.com wants to share your data with facebook.com. Do you want to allow this?"
(such fine grained permissions are a complicated topic of course, but that's a longer discussion...)