NoScript takes care of most tracking systems (those loaded from third-party domains), and has surrogate scripts to prevent it from breaking websites that attempt to depend on the most common tracking scripts, and for this it is the first line of defense. AdBlock I use mostly for most common forms of single-pixel tracking images (and ads, of course), and Cookie Monster to manage cookie permissions, and BetterPrivacy to get rid of flash cookies. RequestPolicy is the nuclear option for when I'm feeling most paranoid. (EDIT: RequestPolicy's 1.0 betas have a default-allow mode, which makes it much easier to leave enabled during everyday use.)

For me, the toughest thing is to figure out which cloudfront subdomains to allow.