diff --git a/netwerk/base/src/nsChannelClassifier.cpp b/netwerk/base/src/nsChannelClassifier.cpp
index e0dfd4319804..999ac1ae470b 100644
--- a/netwerk/base/src/nsChannelClassifier.cpp
+++ b/netwerk/base/src/nsChannelClassifier.cpp
@@ -41,6 +41,7 @@ NS_IMPL_ISUPPORTS(nsChannelClassifier,
                   nsIURIClassifierCallback)
 
 nsChannelClassifier::nsChannelClassifier()
+  : mIsAllowListed(false)
 {
 #if defined(PR_LOGGING)
     if (!gChannelClassifierLog)
@@ -122,7 +123,12 @@ nsChannelClassifier::ShouldEnableTrackingProtection(nsIChannel *aChannel,
     }
 #endif
 
-    *result = permissions != nsIPermissionManager::ALLOW_ACTION;
+    if (permissions == nsIPermissionManager::ALLOW_ACTION) {
+      mIsAllowListed = true;
+      *result = false;
+    } else {
+      *result = true;
+    }
 
     // Tracking protection will be enabled so return without updating
     // the security state. If any channels are subsequently cancelled
@@ -259,7 +265,7 @@ void
 nsChannelClassifier::MarkEntryClassified(nsresult status)
 {
     // Don't cache tracking classifications because we support allowlisting.
-    if (status == NS_ERROR_TRACKING_URI) {
+    if (status == NS_ERROR_TRACKING_URI || mIsAllowListed) {
         return;
     }
 
diff --git a/netwerk/base/src/nsChannelClassifier.h b/netwerk/base/src/nsChannelClassifier.h
index 02766b3a9cf9..baa10c9cd6ef 100644
--- a/netwerk/base/src/nsChannelClassifier.h
+++ b/netwerk/base/src/nsChannelClassifier.h
@@ -24,6 +24,8 @@ public:
 
 private:
     nsCOMPtr<nsIChannel> mSuspendedChannel;
+    // Set true if the channel is on the allow list.
+    bool mIsAllowListed;
 
     ~nsChannelClassifier() {}
     void MarkEntryClassified(nsresult status);