When evaluating a browser's privacy capabilities, one should focus on its source code, network request behavior, and actual data flows rather than the vendor's public statements.