Security & Privacy
Practical, reassuring steps to protect your online privacy, from smarter sharing to tidier settings, so you stay in control of your personal information.
If you have 30 minutes, the highest-impact moves are these: turn on a password manager with unique passwords everywhere, switch your important logins to app-based two-factor authentication or passkeys, and turn off cross-app tracking on your phone. Everything else in this guide is refinement on top of those three actions, which block the two biggest real-world threats: credential theft after a data breach, and the advertising industry quietly stitching your behavior into a profile.
Most privacy loss does not come from a dramatic hack. It comes from three ordinary channels. First, password reuse: when one site is breached, attackers take that email-and-password pair and try it on Gmail, PayPal, and your bank in an automated attack called credential stuffing. Second, advertising trackers: third-party scripts and mobile advertising IDs (Apple's IDFA and Android's AAID) follow you between apps and sites to build a behavioral profile. Third, oversharing and default settings: public profiles, permissions you granted years ago, and old accounts you forgot exist.
You cannot control a company's server security, but you fully control all three of those channels. That is the good news, and it is where your effort pays off.
Human-memorable passwords reused across sites are the single weakest link. A password manager fixes this by generating and storing a unique 16-plus character random password for every account, so a breach at one site cannot cascade. Bitwarden (free, open source), 1Password, iCloud Keychain (built into Apple devices), and Google Password Manager (built into Chrome and Android) are all solid choices. Pick one, set a long passphrase as its master password, and let it take over.
Check whether your credentials have already leaked at haveibeenpwned.com, a reputable free breach-lookup service. If an account shows up, change that password immediately and anywhere you reused it.
Two-factor authentication (2FA) means a password alone is not enough to log in. Not all 2FA is equal. SMS text codes are the weakest because they can be intercepted through SIM-swap fraud, though they are still far better than nothing. Authenticator apps using TOTP (time-based one-time passwords) such as Aegis, Authy, or Google Authenticator are stronger. Passkeys and hardware security keys like a YubiKey are strongest, because they are bound to the real website and cannot be phished. Enable 2FA at minimum on your primary email, because whoever controls your email can reset the password on everything else.
Apple's App Tracking Transparency lets you deny apps the right to follow you across other companies' apps and sites. Go to Settings > Privacy & Security > Tracking and turn off "Allow Apps to Request to Track" to blanket-deny every app. Then reduce Apple's own ad targeting at Settings > Privacy & Security > Apple Advertising by turning off "Personalized Ads."
Audit permissions at Settings > Privacy & Security > Location Services, and set data-hungry apps to "While Using" or "Ask Next Time" rather than "Always." For a reality check on who is actually phoning home, enable Settings > Privacy & Security > App Privacy Report, which logs how often each app touches your location, camera, mic, and which domains it contacts.
Open Settings > Security & privacy > Privacy > Permission manager (wording varies slightly by manufacturer) and review each category. Revoke location, microphone, and contacts from any app that has no honest reason to need them, and prefer the "Only this time" option when an app asks. Delete your advertising ID entirely at Settings > Security & privacy > Privacy > Ads > Delete advertising ID, which forces apps to see a string of zeros instead of a trackable identifier.
Finally, tame your Google account, which quietly logs searches, YouTube views, and location. Visit myactivity.google.com, and under "Web & App Activity" and "Location History" set auto-delete to the shortest available window (the choices are 3, 18, or 36 months). Use myadcenter.google.com to switch off personalized ads across Google's services.
Your browser is where most web tracking happens, and the fix is mostly about choosing a stricter mode.
A private or incognito window only prevents your own device from saving that session's history and cookies. It does not hide you from your employer, your internet provider, or the websites you visit. Treat it as a clean local slate, not a cloak.
The genuine risk on open public Wi-Fi is smaller than it was a decade ago, because nearly every serious website now uses HTTPS, the padlock that encrypts the traffic between you and the site. On HTTPS connections, others on the network cannot read your passwords or messages. What they can still see is which domains you visit and, on a malicious hotspot, they may try to redirect you.
A reputable VPN encrypts all your traffic to the VPN server, which hides your activity from the network operator and your internet provider, and masks your IP address. This is genuinely useful on untrusted networks. But be clear-eyed: a VPN does not make you anonymous, it simply moves your trust from your provider to the VPN company. Choose a paid, audited provider with a clear no-logs policy, and be deeply skeptical of "free" VPNs, which frequently monetize by selling the very data you were trying to protect.
You do not need to redo everything constantly. Once a quarter, spend 15 minutes: skim your phone's permission manager, delete one account you no longer use, run your main email through haveibeenpwned.com, and confirm 2FA is still active on your bank and email. Small, steady maintenance beats a single heroic cleanup.
Usually not for privacy from outsiders, because home Wi-Fi with a WPA2 or WPA3 password is already encrypted and your sites use HTTPS. A VPN mainly hides your browsing from your internet provider and masks your IP. It is most worthwhile on untrusted public networks or when you specifically want to keep your provider from logging which sites you visit.
Yes, because passkeys sync through your Apple, Google, or password-manager account, so a new device restores them after you sign back in. They cannot be phished the way passwords and SMS codes can. Keep your underlying account secured with a strong master password and recovery method, and you are covered.
The free tiers of Bitwarden, iCloud Keychain, and Google Password Manager are genuinely good and enough for most people. Paid plans add extras like secure file storage, family sharing, and breach monitoring. The important decision is simply using one at all rather than reusing passwords.
On iPhone, enable App Privacy Report under Settings > Privacy & Security to see which domains each app contacts and what sensors it uses. On Android, the Privacy Dashboard under Settings shows recent camera, microphone, and location access. Both turn invisible tracking into a plain list you can act on.
Theo writes about online safety the way a good friend would — clearly, calmly, and without trying to scare you. He's interested in the simple habits that stop most problems, and he thinks staying private online is a skill anyone can learn.
Keep reading
A reassuring, jargon-free guide to spotting fake online stores, covering the warning signs in prices, contact details, payment options, and reviews.
Theo Vance
A calm, jargon-free guide to protecting your privacy on your phone, covering app permissions, location sharing, lock screens, and trimming back data tracking.
Theo Vance