How to Disable the Google Chrome ‘Enable Trust Tokens’ Flag

The Cookie Replacement Strategy

As the tech industry moves to phase out third-party tracking cookies due to severe privacy concerns, advertising networks and analytics platforms are scrambling for alternatives to verify user identities across the web. Google’s proposed solution is the “Trust Tokens” API. This system allows a website (like an advertising network) to issue cryptographic “tokens” to a user’s browser after they prove they are a real human (e.g., by logging into a Google account or solving a CAPTCHA). The browser can then silently pass these tokens to *other* websites to prove the user is legitimate without relying on easily traceable tracking cookies.

While Trust Tokens are technically more private than traditional cookies because they are cryptographically blinded (meaning they supposedly cannot be used to track an individual’s specific browsing history), they are still fundamentally a mechanism designed to facilitate cross-site identity verification for the benefit of the advertising industry. Many privacy advocates argue that the browser should not be participating in *any* form of cross-site identity bridging, regardless of the cryptography used. If you prefer a strict, zero-trust approach to web browsing where sites must evaluate you independently without relying on a hidden token ecosystem, you should disable this experimental API.

How to Turn Off Trust Tokens

You can prevent Chrome from issuing or storing cryptographic Trust Tokens via the experimental flags menu.

1. Open Google Chrome.
2. Click inside the main address bar at the top of the browser.
3. Type chrome://flags and press Enter.
4. On the “Experiments” page, use the search bar to look for Enable Trust Tokens.
5. If the flag is available, click the dropdown menu next to it and change it from “Default” (or Enabled) to Disabled.
6. Click the blue Relaunch button at the bottom of the screen.

Upon restarting, Chrome will refuse to participate in the Trust Token ecosystem, forcing websites to rely on traditional session management or explicit CAPTCHAs to verify your humanity.