Why Clearing Files Stopped Being Enough
The old privacy logic was clean and intuitive. Block third-party cookies. Shut down local storage. Isolate the cache. The reasoning held that if a website couldn't write a file onto your machine, it had no way to recognize you when you came back. Strip away the storage, strip away the memory.
That model assumed identity lived in something a site deliberately saved. What it didn't account for is a world where the optimization layer itself can carry reusable signals. Compression Dictionary Transport, standardized as RFC 9842 in late 2025, is one example of why clearing stored data is only part of the privacy picture.
What RFC 9842 Actually Does
Start with the legitimate purpose, because it's genuinely clever. Traditional compression like Brotli or Zstandard hunts for repeated strings inside a single file and swaps them for shorter references. CDT pushes that idea further: it lets a server hand your browser a separate dictionary — a file packed with common code fragments, templates, or a previous version of a resource.
The next time you request a matching page or an updated script, the server doesn't recompress everything from scratch. It assumes you already hold most of the content in that dictionary and ships only the differences. For repeated resources, this can reduce transfer size and improve efficiency.
Smaller transfers mean faster loads and lower content delivery costs, which is why CDT has rolled out across Chromium-based browsers like Chrome, Edge, and Opera. Support is still listed as experimental, and major engines including Firefox and Safari don't implement it yet. This is a growing capability in parts of the ecosystem, not a universal default switched on everywhere.
How a Shared Dictionary Can Behave Like an Identifier
The protocol handshake runs through ordinary HTTP headers, and following it makes the privacy concern obvious.
[Your Browser] ──(Request asset)──> [Origin Server]
│ │
│ <──(Use-As-Dictionary header)────┤
▼ │
[Dictionary cached] ──(Next request)──> [Server reads Available-Dictionary hash]
When a server delivers a resource it wants reused, it attaches a Use-As-Dictionary response header describing which future URLs the dictionary applies to. Your browser caches that file. Later, when you request something that matches, the browser automatically sends an Available-Dictionary request header containing the SHA-256 hash of the dictionary it holds.
That hash is, by design, a distinct value tied to the exact bytes of a dictionary. A server that serves slightly different dictionary content to different visitors gets back slightly different hashes. Section 10 of RFC 9842 notes this privacy risk: dictionaries advertised by content hash can be repurposed as tracking identifiers if misused.
The Guardrails — and Where They Stop
To the standard's credit, it doesn't pretend the risk away. Several protections are baked in. Same-origin binding means a dictionary can only apply to resources from the origin that served it. Cache partitioning subjects dictionaries to the same partitioned HTTP cache rules as other resources. And the RFC instructs clients to treat dictionaries the way they treat cookies — clearing dictionaries whenever cookies are cleared.
The realistic concern is not permanence. It is the persistence that may accumulate between clearing events, riding inside a channel many users never think to inspect. Within a browsing session, across pages on the same origin, the hash can contribute to reidentification.
What Effective Containment Looks Like
The instinctive fix — disabling compression to dodge the dictionary handshake — is a poor trade. CDT negotiation happens inside native HTTP request and response headers during routine asset delivery, so forcing it off tends to bloat page loads or make browser traffic look anomalous.
The sounder approach works one layer up, at the point where questionable third-party scripts are requested in the first place. If a tracking script does not load, it has fewer opportunities to seed or read identifying signals.
Where Total Adblock Fits
Keeping track of which endpoints are trying to seed identifying dictionaries isn't something anyone manages by hand; the infrastructure shifts constantly and is built to look mundane. The Total Adblock browser extension automates that interception. Processing compressed assets is a normal part of using the modern web — the problem is the narrow set of analytics endpoints and tracking scripts that would repurpose the dictionary mechanism.
Total Adblock filters many known data broker, analytics, and ad-exchange requests before they load. Reducing those requests can limit opportunities for questionable payloads to run. If you also spend time with rich media, the extension can remove many intrusive in-play video ads.
It runs quietly in the background with settings and trusted-site controls you can review. The sites you depend on can be allowed as needed, while known advertising and tracking networks remain filtered.
The takeaway is a small but useful correction to the old habit. Clearing your files still helps — the standard even ties dictionary clearing to cookie clearing for exactly that reason. But the surface worth watching has moved into the plumbing of how the web delivers content, and the cleanest defense is to decide, at your machine's edge, who gets to participate in that exchange at all.
