How to Protect Your Privacy Online: 10 Practical Steps

Why Online Privacy Matters

Online privacy is not about having something to hide. It is about maintaining control over your own information and limiting exposure to the range of harms that come from data being collected, aggregated, and potentially misused. Data brokers sell your information to advertisers and anyone else willing to pay. Breached databases expose your credentials to criminals. Targeted advertising uses behavioral data to manipulate purchasing decisions. These are concrete, documented harms, not hypothetical concerns.

Step 1: Use a Password Manager

The single most impactful thing you can do for your security and privacy is to use a password manager (Bitwarden, 1Password, or KeePassXC). Strong, unique passwords for every account mean a breach at one service does not cascade into a breach of all your other accounts. Password managers also reduce the temptation to reuse passwords or choose weak ones.

Step 2: Enable Two-Factor Authentication

Enable two-factor authentication on every account that offers it, prioritizing email, banking, and social media. Use an authenticator app (Aegis on Android, Raivo on iOS) rather than SMS where possible, since SMS-based 2FA is vulnerable to SIM-swapping attacks.

Step 3: Use Disposable Email for Low-Trust Sign-ups

Every time a website demands your email address in exchange for something you want, evaluate whether that exchange is worthwhile. For downloads, trials, and one-time registrations, use a disposable email address. This prevents your real address from being added to marketing lists and limits the damage if the service is later breached.

Step 4: Review App Permissions

Mobile apps routinely request access to contacts, location, microphone, and camera beyond what they need to function. Review the permissions granted to every app on your phone and revoke anything that is not clearly necessary. On both iOS and Android, you can grant location access only while using an app rather than always-on.

Step 5: Use a Privacy-Respecting Browser

Firefox with uBlock Origin is a strong choice for desktop. Brave is a reasonable alternative with built-in ad and tracker blocking. On mobile, Safari with content blockers enabled outperforms Chrome for privacy. Avoid keeping persistent browsing history and clear cookies regularly for sites you visit infrequently.

Step 6: Be Intentional About Social Media

Social media platforms are data collection businesses. Audit your privacy settings on each platform, remove personal information that is not necessary (employer, hometown, date of birth), and consider whether you need accounts on platforms you rarely use. Deleting dormant accounts reduces your exposure from future breaches.

Step 7: Use a VPN for Public Wi-Fi

A VPN encrypts your traffic on networks you do not control, such as coffee shops, hotels, airports, and other public hotspots. This prevents other users on the same network from intercepting your traffic. Note that a VPN does not make you anonymous; it shifts your trust from the network provider to the VPN provider. Choose a provider with a verified no-logs policy (Mullvad, ProtonVPN, or IVPN).

Step 8: Opt Out of Data Brokers

Data broker websites collect and sell personal information aggregated from public records, social media, and purchased databases. Services like DeleteMe or Privacy Bee automate the process of requesting removal from the major brokers. Manual opt-out is possible but time-consuming, as there are hundreds of brokers.

Step 9: Encrypt Your Devices

Enable full-disk encryption on your laptops and use strong passcodes on your mobile devices. On macOS, FileVault is built in. On Windows, BitLocker (Pro) or VeraCrypt (free). On iOS and Android, encryption is enabled automatically when you set a strong passcode.

Step 10: Stay Informed About Breaches

Monitor whether your email addresses appear in known data breaches using Have I Been Pwned (haveibeenpwned.com). Set up alerts for your email addresses so you are notified when a new breach is discovered that contains your address. When a breach is confirmed, change the password for the affected service immediately and check whether you reused that password anywhere else.