A Realist's Guide to Digital Privacy

1. Check if your data is already loose

Your first step is reconnaissance. See what is already out there. Use a free, respected service like Have I Been Pwned to check if your email address or phone number has appeared in any known data breaches. This is not a cause for panic. It is a to-do list.

If your credentials for a service were exposed, go change that password immediately. If you reused that password anywhere else—a common and dangerous mistake—change it there, too. This check gives you a clear, prioritized list of accounts that need immediate attention.

2. Enable proper two-factor authentication

A password alone is a weak lock. Two-factor authentication (2FA) adds a second lock, requiring both something you know (your password) and something you have (your phone or a hardware key). Turn it on for every important account: your primary email, your bank, and your social media.

Not all 2FA is equal. Avoid using SMS (text messages) for your second factor if possible, as it is vulnerable to SIM-swapping attacks. Government agencies like the UK's National Cyber Security Centre (NCSC) and the US Cybersecurity and Infrastructure Security Agency (CISA) recommend using an authenticator app (like Google Authenticator or Authy) or, for maximum security, a physical hardware key (like a YubiKey).

3. Review your main social media privacy settings

The default settings on social media platforms are designed for maximum sharing, not maximum privacy. Go into the privacy and security settings of Facebook, Instagram, X (formerly Twitter), and any other network you use. Limit who can see your posts to “Friends” instead of “Public.” Restrict who can find you using your email or phone number. Turn off location history. This is your data. You decide who sees it.

4. Cull your phone's app permissions

That free game does not need access to your contacts. Your flashlight app does not need your location. Modern mobile operating systems (iOS and Android) offer granular control over what data each app can access. Go to your phone’s privacy settings and start revoking permissions.

Be ruthless. If an app’s function does not logically require access to your microphone, camera, location, or contacts, turn it off. The app will ask again if it truly needs it for a specific task, giving you a chance to grant temporary permission.

5. Install a browser tracker blocker

Every time you load a website, dozens of third-party companies you have never heard of are likely tracking your activity to build a profile for targeted advertising. You can stop most of this by installing a browser extension. Tools like the Electronic Frontier Foundation's Privacy Badger or uBlock Origin actively identify and block these trackers from loading, which makes your browsing more private and often faster.

6. Stop remembering passwords. Start managing them.

This is the single most important change you can make. The human brain is not built to create and remember dozens of unique, complex passwords. A password manager is a secure, encrypted vault that does it for you. You remember one strong master password, and it generates and stores long, random passwords for every site you use.

When creating a new password or your master password, use a passphrase. Instead of `Jk5^b$9!pL`, use a memorable but long string of unrelated words like `yellow-stapler-runs-quickly`. It is far easier for you to remember and exponentially harder for a computer to brute-force.

7. Start adopting passkeys

Passwords are a flawed legacy technology. Passkeys are their replacement. A passkey uses your device (phone or computer) and its biometric security (fingerprint or face scan) to log you into a website or app. There is no password to be stolen in a data breach or given away in a phishing attack. The cryptographic key never leaves your device.

Major platforms like Google, Apple, and Microsoft are pushing this standard. When a service offers you the option to create a passkey, take it. This technology is a massive step forward for security and makes phishing nearly impossible for the protected account.

8. Update everything. Now.

Those annoying update notifications are not just about new features; they contain critical security patches. Running outdated software is like leaving your front door unlocked. Set aside time to update your computer’s operating system, your phone’s OS, your web browser, and all your most-used applications. Better yet, enable automatic updates wherever the option exists. This is fundamental digital hygiene.

9. Switch to a private search engine

Your search history is an intimate log of your thoughts, fears, and plans. Using a search engine like Google means feeding that log directly into one of the world's largest advertising profiles. Switch your browser’s default search engine to one that does not track you, such as DuckDuckGo, Startpage, or Brave Search. The results are high-quality, and your curiosity remains your own.

10. Change your device's DNS resolver

The Domain Name System (DNS) is the internet’s phone book, translating human-readable domain names (like novapedia.com) into machine-readable IP addresses. Your Internet Service Provider (ISP) usually handles this, logging every site you visit. You can switch to a third-party DNS resolver that prioritizes privacy and may even block malicious sites. By better understanding the internet's core components, as described in an article on a web request's long journey, you can identify points to bolster your privacy.

Services like Cloudflare (1.1.1.1) and Quad9 (9.9.9.9) offer free, fast, and privacy-focused DNS. Changing this setting on your router covers every device on your network, or you can change it on individual devices. It is a slightly technical but powerful step.

11. Learn to spot a phish

The most sophisticated security can be defeated by a single, ill-advised click. Phishing—fraudulent attempts to trick you into revealing sensitive information—is a constant threat. Learn the signs: a sense of extreme urgency, an unfamiliar sender address pretending to be a known contact, spelling and grammar mistakes, and requests to click a link or download an attachment. For a deeper look at this and other dangers, it is worth reading about common cybersecurity threats and how to stay safe.

Be skeptical. If your bank emails you unexpectedly about a problem with your account, do not click the link. Go to your bank’s website directly by typing the address into your browser. This simple habit neutralizes the entire attack.

12. Think before you share

The most significant source of data leakage is often you. Every piece of information you post online—your child's school, your vacation dates, your political opinions, your new car—is collected, indexed, and stored. Forever. It can be used by advertisers, data brokers, future employers, and even large language models, as data scraped from the public web is a primary training source for systems like ChatGPT.

Before you post, pause. Ask yourself: who needs to see this? What is the worst-case scenario if this information becomes public? Adjust your audience or, better yet, just do not post it. A little self-censorship goes a long way.

13. Exercise your legal data rights

Regulations like Europe’s GDPR and California’s CCPA grant you legal rights over your data. These include the right to access the data a company holds on you and the right to request its deletion. The UK's Information Commissioner's Office (ICO) provides clear guidance on these rights. While companies do not always make it easy, you can send formal requests to services you no longer use to have your account and associated data wiped. It is tedious but powerful.

14. Start the data broker opt-out process

Data brokers are companies that exist solely to buy and sell your personal information: your address, age, income, interests, and more. Removing your information from these services is a frustrating, manual process of visiting each broker's site and navigating its opt-out procedure. Paid services can do this for you, but you can also do it yourself if you have the patience. Starting with the biggest brokers can significantly reduce your public data profile.

15. Freeze your credit reports

This is less about browsing privacy and more about protecting you from the financial consequences of identity theft. In the US, you can place a free security freeze on your credit files with the three major bureaus (Equifax, Experian, and TransUnion). A freeze prevents anyone from opening a new line of credit in your name. You can temporarily lift the freeze when you need to apply for a loan or credit card. This is one of the most effective ways to stop identity thieves in their tracks.