Online Privacy Guide
How tracking actually works, who benefits from your data, and the practical steps that make a real difference.
Why privacy matters — beyond "nothing to hide"
The "I have nothing to hide" argument misunderstands what privacy is for. Privacy is not about secrecy — it's about control. You have control over who enters your home, who reads your mail, and who knows your medical history. Online privacy extends that same principle to your digital life.
The data collected about you is used to build detailed profiles for advertising targeting, credit decisions, insurance pricing, and political influence. Information shared in one context (a health app) can end up in another (an employer background check). Data breaches expose personal information to criminals. And surveillance — whether corporate or governmental — has a documented chilling effect on free expression and behavior.
You don't need to be doing anything wrong to care about privacy. Journalists, abuse survivors, political activists, business owners, and ordinary people all benefit from controlling what information others can access about them. The goal is not to disappear — it's to make informed choices about what you share, with whom, and on what terms.
How online tracking actually works
Most people know they're tracked online but have a vague sense of how. Understanding the mechanics makes it possible to defend against specific techniques rather than just hoping for the best.
Third-party cookies
When you visit a website that loads content from a third-party (an ad network, a social media button), that third party can set a cookie in your browser. The next time you visit any other site that loads content from the same third party, they recognize your cookie and log your visit — building a profile of your browsing across thousands of sites. This is the foundation of behavioral advertising.
Browser fingerprinting
Every browser has a unique combination of properties: screen resolution, installed fonts, time zone, language settings, hardware concurrency, GPU model, and more. A JavaScript fingerprinting script can collect dozens of these signals and compute a hash that uniquely identifies your browser — without setting any cookies, surviving clears and private mode.
Tracking pixels
Invisible 1×1 pixel images embedded in websites and emails. When your browser loads the pixel, a request goes to the tracker's server, logging your IP address, browser, time of access, and (for emails) whether you opened the message. Used widely for email open rate tracking and cross-site visit logging.
Link tracking and UTM parameters
URLs shared in emails, social posts, and ads often contain tracking parameters (utm_source, fbclid, gclid, etc.) that identify the specific campaign and link you clicked. When you share that URL, the tracking data travels with it. Privacy-respecting tools can strip these parameters before the request reaches the destination site.
Supercookies and HSTS sniffing
Advanced trackers use storage mechanisms that survive regular cookie clearing: localStorage, IndexedDB, service workers, cached resources, and even HTTP Strict Transport Security records. "Evercookies" synchronize across multiple storage mechanisms so deleting one doesn't remove the tracker.
Cross-device tracking
Advertisers link your phone, laptop, and tablet together using deterministic signals (same Google account, same WiFi network) and probabilistic signals (similar browsing patterns, time zones, location data). This allows them to show coordinated ads across all your devices and measure which device led to a purchase.
What your ISP can see and do with it
Your Internet Service Provider is in a uniquely powerful position: all your internet traffic flows through their infrastructure. Even with widespread HTTPS adoption, they can observe significantly more than most people realize.
What ISPs can see
- Every DNS lookup (domain name you visit, before HTTPS)
- Destination IP addresses and ports
- Timing and volume of all connections
- SNI (Server Name Indication) — the hostname in HTTPS connections
- All unencrypted HTTP traffic content
- What time you connect, for how long, how much data
What ISPs can do with it
- Sell anonymized browsing data to advertisers (legal in many jurisdictions)
- Provide data to law enforcement under legal process
- Implement bandwidth throttling for specific services
- Inject advertising into unencrypted pages
- Comply with government-mandated content filtering
Using encrypted DNS (DNS over HTTPS or DNS over TLS) prevents ISPs from seeing your DNS lookups. Using a VPN prevents them from seeing destination IPs and timing data. Using HTTPS Everywhere ensures content is encrypted. All three together provide substantially better privacy at the ISP level.
The data broker industry
Data brokers are companies that collect personal information from hundreds of sources and sell it — to advertisers, employers, landlords, insurance companies, lenders, government agencies, and anyone else willing to pay. Most people have never heard of them, but they have profiles on virtually every internet user.
Sources include public records (voter registrations, property records, court filings), social media profiles, loyalty card purchase histories, location data from app SDKs, web browsing data from ISPs, survey responses, and data shared with third parties you've interacted with. Brokers cross-reference all these sources to build profiles with hundreds of data points per person.
What they collect
- Name, age, address history
- Phone numbers and email addresses
- Estimated income and credit range
- Purchasing habits and interests
- Political and religious affiliations
- Health conditions (inferred)
Who buys it
- Advertisers and marketers
- Employers running background checks
- Insurance companies for risk pricing
- Lenders assessing creditworthiness
- Landlords screening tenants
- Law enforcement agencies
What you can do
- Opt out directly from major brokers
- Use data removal services (automated opt-outs)
- Use alias email addresses for signups
- Limit public social media profiles
- Freeze your credit bureau reports
Browser privacy: choosing and configuring your browser
Your browser is the primary interface between you and the web, and its defaults have a massive impact on your privacy. Different browsers make very different choices about what data to collect and what tracking to block.
Firefox
Strong privacy defaults with Enhanced Tracking Protection enabled out of the box. Blocks social trackers, cross-site tracking cookies, fingerprinting scripts, and cryptominers in Strict mode. Open source. Mozilla is a nonprofit, so there's no advertising business model depending on your data.
- Enable Strict tracking protection
- Enable DNS over HTTPS (Cloudflare or NextDNS)
- Set to clear cookies on close for extra protection
Brave
Chromium-based browser with aggressive built-in privacy protection including ad blocking, fingerprint randomization, and automatic HTTPS upgrades. Includes a built-in Tor integration for private windows. Good performance and compatibility while blocking more by default than Firefox.
- Enable Shields on all sites
- Set fingerprinting protection to strict
- Use Brave's private windows with Tor for sensitive browsing
Chrome
By far the most popular browser, but made by an advertising company. Google uses Chrome to collect data about your browsing. It has improved privacy options over time but requires significant manual configuration, and some tracking is built into the browser at a fundamental level.
- Block third-party cookies in settings
- Use a Google account? Know they link your browsing to your identity
- Consider Firefox or Brave as alternatives
Essential browser extensions
uBlock Origin
The best ad and tracker blocker. Uses filter lists to block requests to known tracking domains before they load.
Privacy Badger
EFF's tracker blocker learns from your browsing behavior to identify trackers that aren't on standard blocklists.
ClearURLs
Strips tracking parameters (utm_*, fbclid, gclid, etc.) from URLs automatically before you click them.
DNS privacy: the overlooked leak
Every website you visit starts with a DNS lookup — translating the domain name into an IP address. By default, these lookups are sent in plain text to your ISP's DNS server, exposing every domain you visit regardless of HTTPS. This is often called "the biggest privacy leak most people don't know about."
DNS over HTTPS (DoH)
Encrypts DNS lookups inside HTTPS traffic, making them indistinguishable from regular web requests. Your ISP cannot see which domains you're resolving. Supported natively in Firefox, Chrome, and Windows 11. Use providers like Cloudflare (1.1.1.1), NextDNS, or Quad9 — they offer additional filtering features and don't sell your data.
DNS over TLS (DoT)
Encrypts DNS over TLS on port 853. Provides similar protection to DoH but is more easily identified and potentially blocked by network operators. Preferred for system-wide configuration on Android and supported by many enterprise firewalls. Works at the OS level rather than per-browser like DoH.
Password security done properly
Credential reuse is one of the most common ways accounts get compromised. When a service you use is breached, attackers use automated tools to try those username and password combinations on thousands of other sites — a technique called credential stuffing. If you reuse passwords, one breach compromises all your accounts.
Password manager basics
A password manager generates, stores, and auto-fills unique, long, random passwords for every site. You only need to remember one strong master password. Reputable options include Bitwarden (open source, free tier), 1Password, and Proton Pass. They encrypt your vault before it leaves your device.
- Use 16+ character random passwords for every site
- Never reuse passwords across different services
- Enable breach monitoring to know when your credentials appear in leaks
Two-factor authentication (2FA)
2FA adds a second verification step beyond your password. Even if your password is stolen, an attacker cannot log in without the second factor. Not all 2FA methods are equal.
Mobile privacy: iOS and Android
Smartphones are the most invasive tracking devices most people carry. They know your location, contacts, communications, health data, purchase history, and behavioral patterns. Managing this requires active configuration.
iOS privacy settings
- App Tracking Transparency — Always select "Ask App Not to Track." iOS 14.5+ requires apps to request permission before using the IDFA (advertising identifier). Most users who see this prompt deny tracking.
- Location permissions — Audit under Settings → Privacy → Location Services. Set most apps to "Never" or "While Using." Very few apps need "Always."
- Mail Privacy Protection — Enable in Mail → Privacy Protection to prevent email tracking pixels from loading and mask your IP from senders.
- iCloud Private Relay — Available with iCloud+ subscription, routes Safari traffic through Apple's relay network to hide your IP from websites and your ISP from your browsing.
Android privacy settings
- Advertising ID — Go to Settings → Privacy → Ads and opt out of ads personalization or delete your Advertising ID entirely. Android 12+ lets you delete it permanently.
- Permission audit — Settings → Privacy → Permission Manager. Revoke location, microphone, and camera access from apps that don't need them.
- Private DNS — Settings → Network → Private DNS. Set to a DNS over TLS provider (dns.cloudflare.com, dns.google, or your preferred provider).
- Google activity controls — myaccount.google.com/data-and-privacy to review and limit what Google collects from your account.
Email privacy
Email remains one of the least private communication channels, despite being the most-used. Free email providers like Gmail scan messages to build advertising profiles. Email metadata (who you communicate with, when, how often) is often more revealing than the content itself.
Use an alias service
Services like SimpleLogin, AnonAddy, or Apple's Hide My Email generate unique alias addresses that forward to your real inbox. When a service sells your email or gets breached, you can disable that alias without exposing your real address. Use a different alias for every signup.
Encrypted email providers
Proton Mail and Tutanota offer end-to-end encryption for messages sent between users on the same platform, and store messages in encrypted format that the provider cannot read. Both offer free tiers. Neither scans your email for advertising purposes.
Privacy myths that give false confidence
"Incognito mode makes me private."
Incognito (or Private mode) only prevents your browser from saving history, cookies, and form data locally. Your ISP still sees your traffic, websites still see your IP, and your employer or school network still logs your activity. It's useful for preventing local tracking (on a shared computer), not network or server-side tracking.
"HTTPS means the website is safe and private."
HTTPS encrypts the content of your communication with a website, which is important. But it does not make the website trustworthy, prevent the website from tracking you, or hide the fact that you visited from your ISP. A phishing site can run HTTPS just as easily as a legitimate one. The padlock means the connection is encrypted, not that the destination is safe.
"I deleted the app, so they deleted my data."
Deleting an app removes it from your device but typically does not delete the data the company collected. Most privacy policies require you to contact the company and request data deletion, often citing your rights under GDPR, CCPA, or similar laws. Some companies honor these requests easily; others make the process deliberately difficult.
"Using a VPN makes me anonymous."
A VPN hides your IP address and encrypts your traffic. It does not prevent fingerprinting, does not protect logged-in accounts, and does not prevent the VPN provider from logging your traffic. True anonymity requires layered approaches. A VPN is a useful privacy tool, not an anonymity guarantee.
Practical privacy checklist — start here
High impact, low effort
- □ Switch to Firefox or Brave with strict tracking protection
- □ Install uBlock Origin extension
- □ Enable DNS over HTTPS in your browser
- □ Use a password manager and unique passwords
- □ Enable 2FA on all important accounts
- □ Audit app location permissions on your phone
- □ Opt out of advertising ID on iOS and Android
Medium effort, significant gains
- □ Use a reputable no-logs VPN
- □ Switch to an encrypted email provider
- □ Use email aliases for signups
- □ Request removal from major data brokers
- □ Set up private DNS for your router
- □ Review social media privacy settings
- □ Freeze your credit bureau reports