Stop Being the Product: A Normal Person’s Guide to Online Privacy

The normal person’s guide to online privacy without becoming weird about it

The Silent Stalker: Why Your Devices Need a Gagging Order Or They Will Leak Like a Sieve

For years, my own devices were betraying me. Turns out, that was just under 70 times a minute.

The hard evidence is staggering. A deep dive into my personal tech logs revealed a relentless, automated surveillance apparatus, leaking data from my phone and computer 100,000 times a day to unseen corporate brokers. Here’s my home router data as I write this today.

It only stopped when I wised up and forcibly cut off the feed. Reclaiming your digital autonomy from these leaks does not require a computer science degree. It takes just a few minutes once you decide preying on your every move stops today.

Screenshot of my Pi-Hole dashboard

Table Of Contents
  1. Stop Being the Product: A Normal Person’s Guide to Online Privacy

Data Privacy Without the Tin Foil Hat

This guide is for anyone who feels caught between convenience and the nagging evidence of creeping intrusion.

Important: I am not a privacy expert, cybersecurity nerd, or professional network engineer, so this is for information purposes only. Any action you take is 100% your responsibility not mine. I accept no liability for what happens when you delve into this. This is what my rabbit-hole research revealed.

Most people already know they’re being tracked. That’s not the revelation any more. What’s changed is how little your existing defences actually do about it. The cookie banner you dutifully click “reject all” on? The tracking industry has already moved past cookies entirely and uses your screen resolution, browser extensions installed, details about your hardware like your graphics card, installed fonts, and screen configuration (a process called digital fingerprinting). The advice you half-remember about clearing your browser history? Largely obsolete. Not because it was wrong, but because the goalposts moved while you weren’t looking.

I hope seeing the deviousness on display here will encourage you to take the leap and try a new browser alongside Chrome and DuckDuckGo instead of Google Search. There is a reason why they want to get around your signal to block third party cookies… and you can bet it’s not in your interest.

So this isn’t a guide about vanishing from the internet, wrapping your router in foil and wrapping yourself in digital bandages so you can become “The Invisible Man”.

It’s about understanding what’s actually happening to your data in 2026, knowing your rights, and making deliberate choices instead of resigned ones.

Those “free” services you enjoy are paid for, just not with your money. They’re funded by the owner selling your intimate details, and with the technical advances that come with data aggregation and analysis, the bill is rising.

1. The privacy people were not wrong

Twenty years ago, worrying about data collection got you called paranoid. The people who shrugged and said “I’ve got nothing to hide” won that argument socially. They lost it factually.

Here’s what those supposedly paranoid people were right about. Edward Snowden’s 2013 leaks showed Western intelligence agencies were collecting billions of communications records with almost no meaningful oversight. The US Federal Trade Commission found that Vizio’s smart TVs captured second-by-second viewing data, bolted on demographic details, and sold the lot to advertisers, without telling anyone. Amazon’s Alexa was found to have retained children’s voice recordings and location data even after parents asked for them to be deleted.

That was the old news. Now here’s what’s changed, and it’s worse.

In December 2024, Google quietly announced it would reverse one of its own long-standing rules, and from February 2025 began allowing advertisers to use “fingerprinting”, a tracking method so invasive that Google itself, back in 2019, called it a practice that “subverts user choice and is wrong.” The UK’s data regulator, the Information Commissioner’s Office, called the reversal “irresponsible.” More on what fingerprinting actually is in a moment, because it’s the thing this whole guide hinges on. The short version: it’s tracking you can’t clear, can’t block by rejecting cookies, and can’t escape with private browsing. The company that spent years telling you it was protecting you just opened the back door.

And in January 2025, the FTC published the early findings of its surveillance pricing study. It confirmed something people had long suspected and been told they were imagining: companies use your mouse movements, the items you abandon in your basket, your precise location, and your browsing history to charge you a personally calculated price. Not “dynamic pricing” that rises with demand. A price built around you specifically, what they think you’ll tolerate.

So your data doesn’t just decide what ads follow you around. It decides what you pay. The sceptics weren’t paranoid. They were early.

Before you read on. look at your own surveillance

You can describe a leak all day. It’s seeing it that makes you reach for the stopcock. So before another paragraph, do these three. None takes more than two minutes, and you don’t need to install a thing.

1. Look at what Google thinks you are. While you’re signed into your Google account, go to myadcenter.google.com. That’s the page where Google shows you the version of you it has built to sell to advertisers: your age bracket, your “interests,” whether it reckons you’ve got kids, what it thinks you earn. Have a proper look. Some of it will be wrong, which is its own kind of unsettling. Most of it will be uncomfortably right. Either way, you didn’t fill this in. Google assembled it from watching you. That profile is the product. You aren’t Google’s customer, the advertiser is. You’re the thing being sold.

2. Count the companies feeding Facebook. Got a Facebook account? Buried in the settings is a tool called Off-Facebook Activity (Meta keeps shifting it, but search those words and you’ll find it). It lists the other apps and websites quietly reporting your activity back to Facebook. When journalists have run this on themselves, the numbers come back in the hundreds. One reporter found 686. Not 686 things they’d done on Facebook. 686 separate companies outside it, feeding it data about them. Look at your own number, then hit “Clear” and “Disconnect future activity.” It won’t stop the collection entirely. Meta is alleged to have admitted the data still arrives, it just stops bolting it to your name. but seeing the list is the point.

3. Find out which leaks already have your details. Go to haveibeenpwned.com and type in your email. It’s a free, well-respected tool that checks your address against every major data breach on record. Most people get a list, old accounts, forgotten sites, companies that lost your password years ago and never told you. It’s not there to frighten you. It’s there to show you that your data getting out isn’t a future risk you’re guarding against. It already happened. The only question now is how much more you hand over from here.

Why is any of this our job?

Let’s name the absurdity at the centre of all this before we go further.

Why are you, on your own time, expected to install blockers, hunt through buried menus, opt out of registers and learn what “fingerprinting” means, just to claw back a basic decency that should have been the default? You shouldn’t have to test the milk to find out if it’s off. You shouldn’t have to audit your own telly to find out if it’s spying on you. And yet here we are, doing the company’s homework for them, because they built the whole thing assuming you’d be too busy, too tired, or too baffled to push back.

That assumption is the business model. The friction is deliberate. The buried settings are deliberate. The pre-ticked boxes are deliberate. None of it is an accident. It’s a bet that you won’t bother.

So the most useful thing you can do isn’t even technical. It’s to stop accepting that this is normal. Get a little bit cross. Then do three small things from this guide and prove the bet wrong. They are counting on you not to.

2. What’s actually being collected and the words worth knowing

People throw “privacy” around as if it’s one thing. It isn’t, and the muddle works in the trackers’ favour. A few distinctions are worth getting straight, because they change what you can do about each problem. I’ll keep the jargon to a minimum and explain anything that earns its place.

  • Privacy is about who can see your data and what they’re allowed to do with it. When your GP surgery texts you an appointment reminder, that’s access you chose. When an ad network knows you searched for knee pain and starts following you round the web with physiotherapy ads, that’s access you didn’t.
  • Security is whether your data is safe in transit and storage. That little padlock in your browser bar means the connection between you and the website is encrypted, so nobody in between can read or tamper with it. Security and privacy overlap but aren’t the same: a service can be perfectly secure and still hoover up everything you do.
  • Telemetry is the stuff your device reports back to its maker without asking. Which apps you open, how long you use them, what you type into search bars, sometimes what’s sitting in your clipboard. It’s on by default, and most people never know it’s running.
  • Metadata is the “who, when, where and how” around your activity, not the content of a message, but everything surrounding it. Who you called, when, for how long, and from where can paint a fuller picture than what you actually said.

And then there’s the one that matters most in 2026.

Fingerprinting: the tracker you can’t wash off

This is the big one, and it’s the thing that quietly broke most of the privacy advice you half-remember.

Every time you load a website, your browser hands over a surprising amount of information before you’ve clicked a thing: your screen size, the fonts you have installed, your graphics hardware, your timezone, your language, your operating system, your browser version, even the subtle way your particular device draws certain shapes on screen. On its own, none of that identifies you. Combined, it produces a profile so distinctive it works like an actual fingerprint. Hence the name.

Here’s why it changes everything. A cookie is a little file stored on your device. You can delete it, block it, or reject it at the banner. A fingerprint isn’t stored anywhere. It’s calculated from your device every time, fresh. So clearing your cookies does nothing to it. Hitting “reject all” does nothing to it. Private mode does nothing to it. Most VPNs don’t stop it either. The ICO put it plainly: when you clear all your site data, you’re controlling cookies, but fingerprinting relies on signals you can’t wipe, so the company tracking you can recognise you again instantly.

This is why being bold and moving to a user focused browser like Brave, Firefox, or LibreWolf, which all scramble or generalise some of that technical data, matters. Plain Chrome doesn’t bother. Why would it? It needs all its resources to harvest data! It makes you wonder why Google has installed a 4Gb local AI model, Gemini Nano, on users machines without their permissions. It for “security” and fraud protection… Oh really. Here’s Malware Bytes advice on how to remove it. Oh, and by the way, privacy researcher Alexander Hanff calculated that pushing this single unrequested file to 1 billion users would consume around 240 gigawatt-hours of energy, about enough to meet the needs of 22,000 homes for a year, potentially dumping between 6,000 and 60,000 tonnes of carbon dioxide equivalent into the atmosphere. Nice.

Anyway, back to third party cookies. This digital fingerprinting wheeze is why the cookie banner you’ve been dutifully hammering away at to reject tracking matters less and less. (Sorry if you hate cookie popups all the more now. Check out this extension.) For years the frontline was cookies. That advice wasn’t wrong, it’s just defending a gate the industry walked around.

Since February 2025, with Google formally permitting fingerprinting in its advertising products, the technique most people have never heard of is becoming the default, and the defences most people rely on were built for a threat that’s already been superseded. You can’t beat fingerprinting completely. But you can reduce how exposed you are, and the browser advice later in this guide shows you how. The first step is simply knowing it exists.

3. Why “I’ve got nothing to hide” misses the point

The line sounds reasonable until you sit with it. Privacy was never about hiding wrongdoing. It’s about keeping control over how information about you gets used, and by whom.

You close the curtains at night. Not because anything criminal is happening behind them, but because the decision about who sees in is yours to make. The moment data about you exists and can be bought, that decision stops being yours.

And it has consequences that reach well past embarrassment. Data is leverage. It shapes what you’re shown, what you’re offered, and this is the bit that ought to make you sit up… what you’re charged.

What it actually costs you, in pounds

Let’s talk money, because this is where it stops being about principle and starts being about your wallet.

The FTC’s January 2025 surveillance pricing findings confirmed what shoppers had long suspected: companies use your data, your location, your browsing, what you’ve left sitting in your basket, to decide what price to show you specifically. The regulator ordered firms including Mastercard, JPMorgan Chase, Accenture and McKinsey to explain how they do it. One example they flagged should make your jaw tighten: a retailer working out from your recent purchases that you’re a new parent, and from your searches that your baby is unwell, and then nudging the price up on the things you’re now desperate to buy. That isn’t personalisation. That’s a marketing department monetising your anxiety.

So, this isn’t only about dignity. The same data trail that follows you around can reach into your pocket. Every tracker you block, every profile you starve of fresh detail, makes you a harder target to squeeze. The companies aren’t on your side, the defaults are designed to cost you. Protect the data, and you protect the wallet it leads back to. Why? Well imagine you send your birthday list of three items via Google or Facebook message to your friend. Your friend google’s for your item a couple of days before your birthday (which they know) and lo and behold, the price could be bumped up. Spoken about attending a funeral before booking a flight. Guess what? Yep. The price goes up! Sorry no prizes, but thanks for playing along with the pantomime.

It doesn’t stop at pricing. Insurers adjust premiums on purchase histories. Landlords screen tenants through automated scoring. Lenders make decisions shaped by data you never knowingly handed over. The pattern underneath all of it is the same: they know more about you than you know about them, and they use the gap. Protecting your data isn’t paranoia. It’s refusing to be the only one at the table playing with your cards face up.

4. Why the privacy checkboxes aren’t enough

Cookie banners, GDPR pop-ups, app permission prompts, they look like control. They feel like control. Mostly, they’re theatre.

Your smart TV doesn’t pop up a consent banner before logging what you watch. Your phone doesn’t ask permission before reporting your location to a data broker. The tracking that matters most happens underneath the consent layer, baked into the hardware and software rather than offered up as a tick-box. The banner asking about cookies is regulating the front door while the real traffic goes through the back.

And the front door it’s regulating barely matters any more. Safari has blocked third-party cookies since 2020. Firefox blocks known trackers by default. Even Chrome spent years testing a phase-out. Then, in April 2025, Google reversed course and announced Chrome would keep third-party cookies after all, having already, four months earlier, opened the door to fingerprinting as an alternative tracking method.

Sit with that sequence.

The one defence ordinary people actually understood, managing or rejecting cookies, was kept alive just as it became less relevant, and the replacement is something most people have never heard of, can’t see happening, and can’t easily stop. Clicking “reject all” still feels like doing something. Increasingly, it’s regulating the old threat while the new one strolls past, casually poking through your digital sock drawer, gloriously unfettered.

This isn’t a reason to give up. It’s a reason to stop relying on the bits of “protection” designed to make you feel safe rather than be safe, and to focus on what actually moves the needle.

That’s what the rest of this guide is for. I am hoping with a better understanding of the level of abuse the general public gets from Big Tech with no real opposition, you’ll want to make your little bit of the internet a little bit nicer.

5. It’s not just companies. the state has been leaking for years

Everything up to this point has been about corporations tracking you for profit. But there’s a second pipeline, and vigilance alone can’t fix it, because you were never given a choice in the first place.

The UK government holds enormous quantities of your personal data: tax records, health histories, benefits claims, criminal justice files, electoral details, and its track record of protecting that data is, to put it politely, appalling. This isn’t a one-off scandal. It’s a pattern that spans every party in government and shows no sign of stopping.

In June 2025, HMRC revealed that organised criminals had used phishing-sourced personal data to impersonate 100,000 taxpayer accounts and led to £47 million being stolen. Not a sophisticated state-level hack, a basic phishing operation exploiting fundamental weaknesses.

The Legal Aid Agency was breached, exposing years of personal data from people who’d applied for legal help. NHS patient data, including, allegedly, medical records of members of the Royal Household, ended up on the dark web after an Oracle software vulnerability was exploited.

The Electoral Commission lost the details of roughly 40 million registered voters. The Police Service of Northern Ireland accidentally published the names and roles of every serving officer, earning a £750,000 fine and an estimated £140 million in civil claims. The Ministry of Defence’s payroll system was hacked, exposing the details of serving military personnel.

And when the Cabinet Office commissioned a secret internal review of all these failures, covering HMRC, the Met Police, the MOD, the benefits system, and cases involving Afghan nationals and child sexual abuse victims, it found exactly the same problems everywhere: no controls on bulk data exports, emails sent to wrong recipients, inadequate training, and insufficient safeguards against human error.

That review was completed, kept confidential, and only revealed publicly in September 2025 after sustained pressure. The National Audit Office warned in January 2025 that government departments are lagging badly behind on cybersecurity and that the national threat is “severe and advancing quickly.”

Independent polling shows more than 60% of British people already don’t trust the government with their data. Looking at the record, the surprise is that the number is that low.

If you’re not in the UK, don’t worry, plenty of other nations have had critical breaches. You’re not missing out. #Sigh.

What this means for you

Your personal data hasn’t just been traded by companies. It’s been lost by institutions that had a legal duty to protect it. Some of it is already sitting on the dark web: medical details, tax records, addresses, employment history, assembled into profiles by criminal brokers who trade in stolen identities the way data brokers trade in advertising profiles.

Being careful about what you hand over going forward is necessary, but it can’t undo what’s already out there. So what can you do about the data that’s already leaked? These days, quite a lot of people vote with their feet and use a company that doesn’t ask for government ID. There is a reason why I have not validated my LinkedIn profile. “But LinkedIn says it makes you look more trustworthy?!” I hear you ask. LinkedIn uses Persona to do the validations, who have a glowing track record. Oh no, hang on, scratch that.

In February 2026 it came out that Persona had left its entire government identity-verification codebase sitting exposed on a federal server, revealing 269 separate verification checks running behind the scenes, including facial-recognition watchlist matching and the ability to file reports straight to financial-crimes investigators. Persona’s response was to point out that no single customer has all 269 checks applied. Phew. I guess that’s alright then. Right?

Data removal services

Tools like Incogni, DeleteMe and Optery exist to chase data brokers on your behalf and demand removal. You give them your details, they find your profiles across hundreds of broker databases, fire off legally-backed removal requests, and keep repeating the process every 60–90 days because the data tends to creep back.

They’re legitimate. Incogni’s processes have been independently verified by Deloitte, and it covers the UK. Pricing starts around £6–8 a month on annual plans. Reviews are broadly positive. I haven’t personally tested one yet, so I won’t pretend otherwise. But the concept is sound: you’re automating a process that would otherwise be a full-time job of sending individual opt-out requests to hundreds of companies who have no real incentive to make it easy. I also like the idea that it is a big administrative burden for them.

Here’s the honest caveat, though. It is whack-a-mole. Data brokers refresh their databases constantly, scraping public records, buying from other brokers, harvesting from breaches. You remove yourself today, and your details can reappear next month from a completely different source. The removal services know this. It’s why they run on a subscription and repeat the requests on a cycle. They reduce your exposure; they don’t eliminate it permanently. Think of it less like cleaning a stain and more like mowing a lawn: it grows back, but keeping it short is better than letting it go wild.

If the subscription cost puts you off, you can do the manual version yourself. Search your name on people-search sites, submit individual removal requests, and repeat periodically. It’s tedious but free. The paid services just automate the tedium.

Some people argue for caution here, and it’s worth sitting with. You’re handing over your real, verified details to match against data that’s often patchy or wrong. There’s a chance you’re not deleting a profile so much as completing one, filling in the gaps the brokers hadn’t quite joined up yet. Not a reason to avoid these services. Just a reason not to expect a silver bullet. After all, you’re trusting the very industry you’re trying to escape to act in good faith on your behalf.

The one thing that actually helps: poisoning the well

This devious move might feel the most satisfying, even if it’s subtle. Generate false identifiers.

Use a throwaway email address tools for every sign-up that doesn’t genuinely need your real one. That forum you want to use for a couple of weeks for research and you’ll never be back. Or that helpful company that needs to email you your invoice at the checkout rather than use a roll printer like everyone else.

Services like SimpleLogin, addy.io create disposable addresses that forward to your real inbox instead of sharing it. Give a different phone number when a shop asks for yours, You’re under no obligation to hand over the real one for a loyalty card. Use a slight variation of your name for non-essential accounts. Pay with cash or a prepaid card when you can be bothered.

None of this makes you invisible. That’s not the point. The point is that every false detail you feed into the machine degrades the profile they’re building. It adds noise. It makes the picture blurrier. Not just for you, but for everyone when they start aggregating it. It means when a data broker tries to stitch together “you” from forty different sources, some of those sources don’t quite match, and that mismatch reduces what you’re worth to them. A clean, complete profile sells for more than a messy, contradictory one. Of course, that means someone else’s clean profile takes the hit instead. That’s not a brilliant outcome for them, but it’s how the whole system gets weaker: the more people who understand this and start doing it, the noisier and less reliable every profile becomes, yours included. Small, deliberate inconvenience now buys you (and eventually everyone) a quieter, safer online life later.

Talk to people about this stuff. If they need help, arrange for a meet up over a coffee and help them make a few simple changes.

Will your act of data-poisoning change the system? No. Does it feel disproportionately good for something so small? Yes. There’s a quiet satisfaction in knowing that the machine grinding away at your privacy is chewing on the wrong data set, because you decided, even in a small, petty, human way, to give it the finger.

6. The “deGoogle” ladder: start where you are

First, let’s be honest about the effort.

Pretending this is effortless is how people end up feeling cheated and giving up, so let’s be straight with each other. Privacy has friction. Of course it does. (Try using the Facebook app through the browser and not the slick and fancy app. About as much fun a Sideshow Bob has standing on garden rakes in the Simpsons. #Buuuuhhhhh. I stopped using Facebook for a few days, popping in one a day for five minutes. My Brave Browser on the phone reported 1328 pings to Facebook’s DNS server. OVER 1000! I persevered with the browser version with marginally less annoyance.)

The whole Big Tech business model is built on making the tracked path the frictionless one, the default, the pre-ticked box, the “would you like to sync your browsing across all devices” so we have a grey zone so we can “legitimately” store all your browsing actions. Are you saying #Yippee! at this news? No?

Anything you do to step off that fluffy, soft, comfy, hypnotic path will, by design, cost you a modicum of extra effort. Just remember, especially if tech’s not really your thing, this isn’t a sign that you’re incompetent. That’s the system working exactly as Big Tech intended. Making it feel difficult even though it’s not. Think of it like this, you don’t order Just Eat meals for breakfast, lunch, and dinner. Sometimes, you actually do have the will to put two slices of bread in the toaster. You can do this.

And yes, the takeaway is effortless and lovely and tasty. What’s more, someone else decides what’s in it. No decision fatigue. But they also put in the salt, the sugar, the stuff you’d rather not know about, specifically the “do you agree” tickboxes that unlock the abuses buried in the 200-page privacy policy. And being such lovely companies, the price creeps up every few months once you’re hooked on the convenience to boost their share price.

One day you’ll think enough’s enough. No more takeaways! That’s when you decide to batch-cook. You don’t start every meal from zero every night and face a big stack of dishes in the sink. You put in one proper afternoon, fill the freezer with things you like that reheat well, and for weeks afterwards a good meal is minutes away without all the grocery shopping and cleaning up to do.

Almost everything below is batch-cooking… on steroids. You do the work once and the freezer stays stocked for months not weeks. BLAM! A DNS filter, slammed into place. BIFF! A blocker, installed and swinging. THWACK! Off the public voter registers, opted out for good. KA-POW! Straight through the TV menu, diving down past the Seventh Circle of Hell, to the even deeper place, so deep they hoped you’d give up before you found it, to finally switch off the scraping of your viewing habits and every flick of the remote.

They are one-off jobs that then look after themselves once you’ve done them. You’re not signing up to faff with these settings every day for the rest of your life. You’re doing a quick burst of work once, so every day hence runs quietly in your favour.

Think of this as a ladder, not a cliff. Each rung is optional, and most people get the bulk of the benefit from the first two or three. Climb as far as suits your digital life, and stop without guilt. Think of it as deliberately walking away from someone watching you, rather than running for the distant horizon like a thing possessed.

Remember, every step puts more distance between you and them, and you don’t need to sprint for hours before the gap actually starts to matter. You could dart 50 paces and hide behind a big tree in a forest. Swap from Chrome. Try DuckDuckGo. Add a free DNS protection tool like AdGuard. Think of it as a bouncer on the door. Put one copy on your phone for when you’re out and about, and another that talks to the router to protect the whole house. AdGuard turns away a lot of trackers before they ever get in. You don’t need to tumble headfirst down the rabbit hole looking up privacy-hardened phones just yet.

Level 1: Stop the obvious bleeding

These are the easy wins. Think of this as “cancel-the-unused-subscriptions” territory. A small effort with a real payoff that doesn’t use three days of annual leave.

  • Ditch Chrome. But don’t “Switch”. “Add”.

    You don’t have to give Chrome up to stop it tracking you. Switching browsers sounds like a commitment: relearning everything, losing your bookmarks, breaking the banking site, those saved passwords. So don’t switch. Install Firefox, Brave or LibreWolf and run it alongside Chrome for a week or two. Do your reading, shopping and idle searching, the 90% of browsing that’s just you wandering around, in the new one. Try something more important when you’re ready. If it goes well, great. If not, do that bit back on Chrome. There’s no perilous irreversible moment. No showstopping risk. Chrome’s still sitting right there if you hate it.

    Total effort: one download while you enjoy a cuppa.

    Run both browsers for a fortnight and you’ll likely find you barely open Chrome any more, and the tracking that used to follow you everywhere has quietly lost its grip. Big Tech is counting on the word “switch” to put you off. Don’t let it. You managed a new school, a new job. You can click a new icon.

    When you’re ready to drop Chrome for good, here’s the part that should annoy you: on Windows, maybe thanks to some tech-bro backscratching, it’s wedged so deep into the operating system that it can carry on phoning home even when it’s closed. Background services and scheduled tasks pinging Google’s servers from startup, whether you’ve opened a browser window or not. (BTW, Microsoft has some pretty ugly telemetry tools you might want to consider removing.)

    It does make you wonder what the hell GDPR is for when, in theory, the law allows a business with a tiny mailing list to be fined thousands of pounds just for sending one follow-up marketing email to one customer who complained they had opted out, while these genuinely enormous invasions of your privacy run for decades unchallenged, hiding in the grey zones of legitimate interests (marketing = business survival so we need to take e-v-e-r-y-t-h-i-n-g about ya just to be sure, bruv!). #DeepBreaths, everyone.
  • Install a content blocker. uBlock Origin is free and open source. Once installed it works silently in the background, stopping websites loading tracking scripts, invisible ad beacons, and a lot of fingerprinting code. On Chrome, Google’s software design decisions mean you’re stuck with the watered-down uBlock Origin Lite instead of the real thing. Fear not, the full uBlock Origin still works properly on Firefox, Brave and LibreWolf. Answers on a postcard, please, for Google’s motivation here. Send to: PO Box 1, You Are The Product…
  • Review your phone app permissions. Does a torch app really need your location and contacts? Instead of doomscrolling social media, doomscroll your app settings and revoke anything that doesn’t make sense. If your handset manufacturer “helpfully” pre-installed apps, check those too.

    Make a note of what you toggle on and off. This is like leaving a thread through the Minotaur’s cave so you can find your way back to safety. Be bold. Delete the apps you no longer use. Forgotten apps get sold to new owners, who don’t ask the old users for permission to start mining their data. Annoyingly, the default setting, for almost everything that can watch you, is “on,” so it can “improve the service” for “you.” #Gits
  • Use a password manager and turn on two-factor authentication. This matters more than people think. Reuse the same password on your email and your supermarket loyalty account, and a breach at the supermarket hands someone the keys to your email, and from there, to almost everything. A manager like Bitwarden (free) generates and remembers a unique password for every account so you never have to.

Level 2: Reduce everyday tracking

  • Switch search engines. Same trick as the browser. You don’t have to swear off Google forever. But next time you reach for it to settle an argument about who was in that film, or what time the chemist shuts, try DuckDuckGo instead. For the everyday stuff, the boring majority of searches, it’s perfectly good, and it just shows you search results instead of an AI’s confident guess bolted on top. Nobody’s building a dossier off the back of what you looked for, either. Set it as the default in your new private browser and you’ve made two big changes change without ever “deciding” to. The handful of times you really want Google’s freshest results, go to www.google.com. Try it for a week. If your searches are worse, switch back in ten seconds. Most people don’t, once they know everything you search for gets archived and shared with their “trusted partners” forever. Yeah. Even that time you looked up haemorrhoid cream. And with Google curating the results so heavily these days, you’re unlikely to see a real website link anyway #Streuth.
  • Add a DNS filter. DNS is the internet’s address book. Every site you visit triggers a lookup, asking “what’s the address for this domain?” before your browser can connect to anything. Whoever answers that lookup sees every domain you visit. That’s why Google runs a free, fast DNS server at 8.8.8.8. How convenient. A filtering service like AdGuard, NextDNS, Control D or Quad9 checks each lookup against a list of known tracker and malware domains. Ask for one of those, and it simply refuses to answer. No address, no connection, no tracker script ever loads. The bad request dies at the address book, before it ever reaches you. On Android, install Rethink DNS + Firewall. It lets you see which of your apps are quietly sending data back to their makers in the background, and block the ones you don’t trust. iOS and Android can use the AdGuard app.
  • Use separate browser profiles for work, shopping and personal life. Like keeping different bank accounts for different purposes. It makes it much harder for trackers to stitch all a complete picture of you together.
  • Look into ‘burner’ bank cards: These things are like financial Swiss army knives. They handing your real credit or debit card details to every online shop, subscription service, or app is a massive security gamble. A burner card acts as a protective firewall between your real money and the internet.
    Here is exactly why they are essential.

    They stop zombie subscriptions cold. This means those free trials that sneakily turn into paid monthly plans that are impossible to cancel if the company hides the “delete account” button. With a burner card, you just delete the card. When the company tries to charge it, the transaction fails instantly, and your real bank account remains completely untouched.

    They neutralise serious data breaches. If a website you bought a pair of shoes from gets hacked six months later, the criminals only steal a dead, deleted burner card number instead of your primary bank details.

    They enforce strict spending caps. You can set hard limits on individual cards. If you set a card’s limit to £20, a rogue merchant or hacker cannot steal a single penny more than that, completely eliminating overdraft or credit line drain.

    Blocks hidden cross-border fees: Some foreign sites hide sneaky conversion rates or extra processing fees until the charge hits. A merchant-locked or single-use card blocks any secondary or unapproved adjustments to the initial agreed total.

    In the US there’s Privacy.com . In the UK there’s Revolut / Starling.
  • Turn off Bluetooth when you’re not using it. Your phone and earphones Bluetooth Low Energy (BLE) signals can be picked up by nearby devices to track your movements, which is how some shops know you’ve walked past, what aisle you walked down and even what product you lingered before and for how long.

    A quick story. When I discovered this wheeze, I went to my local mall and there was one sensor every 20 metres, fitted to the ceiling. There were also sensors above tills in the stores. Thanks to BLE triangulation these systems can calculate a lot! Like the people around you if their phones are broadcasting their wifi and Bluetooth IDs. Nice to know if you went shopping with friends, or alone, right?

    I was furious. I bought some wired headphones that day and changed the name of my headphones to be “GDPR_REQUEST_INCOMING” although I never used them again in the mall because I was just too angry and the wired ones did the job. Oh and that free shopping centre wifi. It tracks your phone’s MAC address and can use that to track you. It’s buried in that 100-page T&Cs you agree to without reading. Let’s not talk about Smart doorbells. I’ll never end this section.
  • Invest in a “Faraday cage” case for your phone. These cost around £10–20 for a basic two-pack on Amazon, or look for ones tested by Which? or the police for keyless car theft. Make sure there’s enough space for you phone and its case. Drop your phone in and every signal, mobile, Wi-Fi, Bluetooth, GPS, RFID, is dead until you take it out. No tracking, no pings, no BLE beacons broadcasting your presence to every sensor in the shopping centre. Same trick works for car key fobs, which is why police actually recommend them. Keyless car theft has surged since 2019, and a fob sitting in a Faraday pouch on your hallway table can’t be relay-attacked from outside your front door.

    It also makes it a bit less accessible which means if you’re struggling with tech addiction, it does the same job as putting your phone in another room. It’s accessible, and yet not. I quite enjoyed leaving my phone in there for a day, especially after I knew Amazon and Google’s smart speakers could, in principle, use BLE proximity to work out what room I was in my … kitchen… lounge… hall… office. Or someone else’s house. All hidden with a cheery “pair your phone with bluetooth” option in the menus. I never did play MP3 directly. #Groan

Level 3: Network-wide protection

  • Set up Pi-hole. A small piece of software, usually run on a cheap Raspberry Pi or an old computer that can run Linux, that blocks ads and trackers for every device on your home network at once, phones, tablets, smart TVs, the lot, without installing anything on each device. Double-glazing for your network: fit it once, benefit continually. It is not a trivial task. It took me three hours to learn what to do and put it in place. Think batch-cooking 1000 meals! Have plenty of coffee/gin/cake to hand to get through if you’re not a network engineer. :)
  • Put your smart gadgets on a separate guest network. Most routers allow this. Keep your smart speakers, cameras and the kids’ tablets off the same network as your main devices, so a chatty gadget can’t see everything else.

Level 4: Reduce platform dependence

For when you’re ready to loosen Big Tech’s grip on your daily tools. If you fancy going further still, you could set up your own server at home: what people call a “homelab.” Go on, DuckDuckGo it. Fair warning: this step is no small thing. It will have you grinding your teeth, threatening your new server with a hammer when it goes feral, and learning to secure it from actual hackers who’d love to get at the data sitting on it, rather than just the ad networks who’d settle for less. Fun if you already love tinkering with tech. Character-building if you don’t.

  • Nextcloud to replace Google Drive, Docs and Calendar. Your files, contacts and schedule, stored on your own hardware instead of Google’s.
  • Immich to replace Google Photos. Back up, browse and organise your own photos and videos, without Google running facial recognition on your family for free.
  • Jellyfin to replace Netflix-as-a-library and your old iTunes collection. Stream the films, shows and music you already own, on your own terms, with no subscription and nobody watching what you watch.
  • Home Assistant to replace Amazon Echo and Google Home. Your smart speakers and sensors talk to a hub in your house, not a server in Virginia.
  • Proxmox to create virtual machines and run proper backups. This one isn’t replacing a Google product, it’s the plumbing underneath everything else, letting you test, isolate and restore your setup without losing the lot to one dead hard drive or an experiment with a throwaway machine that went awry. Like spreading savings across more than one bank. If one fails or turns hostile, you’re not wiped out.

Level 5: Advanced moblie privacy

For people with genuinely elevated risks: journalists, activists, anyone with a specific reason, (or a ne’er-do-well looking to buy passwords on the dark web. These hacker types live there too.)

If you’re here, you already understand the concepts: Tor Browser for sensitive browsing, separate identities across separate devices, hardware security keys, cash or prepaid cards where it matters, and a privacy-focused phone OS like GrapheneOS.

Be wary of the cost of moving higher up the ladder

The honest trade-off across the whole ladder: the higher you climb, the more some everyday services get awkward. That’s real, and it’s why most people should plant themselves at Level 1 or 2 and feel good about it. Perfection isn’t the goal. Reducing your exposure is.

7. The free one almost nobody knows about

Get off the register that’s for sale. Here’s one that’s pure head-in-hands territory, and it’s uniquely British.

When you registered to vote, there were two registers. The full one, used for elections, fine, that’s the deal. And a second one, the “open register,” which any company can buy. Marketers. List brokers. The data giant Experian scoops it up, “enriches” it with everything else it knows about you, and sells it on. Your name and address, packaged and sold, because you didn’t untick a box you probably don’t remember seeing.

Now the part that should genuinely annoy you. Around 60% of people have already opted out. The councils that run it have repeatedly said they think selling your details is wrong. And yet, by law, the people registering you are forbidden from even mentioning that junk-mailers buy this list. They’re only allowed to give you the cheery reasons it exists. The system is built so you won’t opt out. Not because it’s good for you, but because your data is worth money to someone who isn’t you.

So opt out. It’s free, it doesn’t affect your right to vote in the slightest. Go to gov.uk and follow the “opt out of the open register” information.

If you’re outside the UK, please look up what your options are. There’s too many permutations for me to share here.

8. Quick wins, sorted by how much energy you’ve got

Pick by effort. People commit to “the two-minute ones” far more readily than to an undifferentiated list, so start where your energy is today and come back for the rest.

Two minutes, no commitment, do it right now:

Ten minutes, one-off, then forget about it (“batch cook”):

  • Install uBlock Origin on your devices.
  • Opt out of the open register at gov.uk if you’re a Brit. Check the rules for your location if you’re not.
  • Set Quad9, or AdGuard DNS, as the filtering DNS on your Android phone to gives you extra control over which apps can phone home. Use the AdGuard iOS App for iPhones.
  • Set up a password manager (Bitwarden) and turn on two-factor authentication (even though it’s friction and a faff).
  • Clear and disconnect your Off-Facebook Activity monitoring.
  • Opt out of personalised ads on Google, Facebook and Amazon.
  • Consider a data removal service like Incogni to chase brokers who already have your details.

An afternoon, properly worth it, set-and-forget for the household:

  • Put smart TVs and gadgets on a separate guest network so they can’t see your main network or each other.
  • Turn off tools like Automatic Content Recognition (ACR) and ad-tracking in your smart TV’s settings
  • Turn off Bluetooth when you’re not using it.
  • Turn off “auto-join” available networks if your phone has it.
  • Turn off “precise location services” which tracks you to the metre. You don’t need that much accuracy.
  • Invest in a good quality Faraday cage.
  • Look for open-source apps with better privacy, like OrganicMaps.

Eventually. Perhaps:

  • Look into Tor, GrapheneOS (which ironically only runs on Google Pixel phones, because Pixel hardware is the only thing meeting its strict security requirements)
  • Look into compartmentalised identities on different devices with throwaway email addresses.
  • Look into burner banking cards: Privacy (in the US) or Revolut / Starling (in the UK).
  • Set up Pi-hole for whole-home blocking (I put mine on a spare Raspberry Pi but you could run it on an old machine you picked up from Facebook marketplace, once you put Linux on it. Look up rufus.ie for an easier less complicated way to do that using a bootable USB stick..)

Important: You don’t have to do all of these today. Do one. Then another one when you’re ready. Momentum is half the battle. I think it took me three weeks to make most of the changes. There are some, like exploring Tor and Graphene I still have to do.

I still get angry every day about surveillance and it’s a constant nag checking an update hasn’t toggled on a load of spyware, or an old app hasn’t been taken over by a new company and rammed with trackers.

Looking at you my former weather app that suddenly needed permission to share my data with 1772 trusted partners for looking up how Cleethorpes might be. #FFS. That app got uninstalled. I left “tiresome enshittification” as my “why did you uninstall” exit quiz then I packed a kagoule and sunscreen and went out away from screens for the day to calm down. If I got soaked or heat exhaustion, so be it.

No company needs to connect your private information to a global data-harvesting and sharing AI clanker to put a cloud next to Cleethorpes on a screen.

9. What I wouldn’t bother with first

This matters as much as the to-do list, because the fastest way to give up on privacy is to try to do everything at once and burn out by Tuesday. So skip these at the start:

  • Replacing every device immediately. Expensive, wasteful, unnecessary. Work with what you have.
  • Self-hosting everything so you can “deGoogle!!” before you’ve ever self-hosted anything. A misconfigured server is worse than no server. Losing all your data Walk before you run.
  • Routing all your traffic through Tor. It’s slower and breaks plenty of sites. Save it for when you actually need anonymity.
  • Trying to scrub yourself off the internet overnight. It doesn’t work like that, and chasing it will exhaust you.
  • Forcing family or colleagues onto obscure tools they didn’t ask for. Without buy-in it just breeds friction and resentment.
  • Reading forty Reddit threads before you change a single setting. The research rabbit hole is where good intentions go to die. Change one thing first. Read later. That’s why I put this page together, to cut down on the urge to overthink this.

Perfectionism is the enemy here. Start with what gives you the most protection for the least fuss, and let the rest wait.

10. The hardware problem

Privacy abuse isn’t just a website thing any more. It’s built into the physical objects filling your home and driveway.

Smart TVs log what you watch, second by second, and many sell it on. There is a reason why massive TVs are so cheap. The price is subsidised by selling your viewing habits. Voice assistants store your commands and your location. Wearables track your heart rate, your sleep and your movements, your location, and here’s the bit people miss: that data is governed by the wearable company’s privacy policy, not your doctor’s duty of confidentiality. Your fitness-tracker data has weaker legal protection than your medical records, even though it often reveals the same things.

Cars are the quiet shock. Modern connected cars collect far more than speed and location, some record cabin audio, log how hard you brake, and vacuum up the contacts from any phone you pair over Bluetooth. When Mozilla’s Privacy Not Included project reviewed major car brands, it rated every single one as failing basic privacy standards. Not most. All of them. (Here’s how that happens).

The honest tension: smart devices are genuinely convenient, and ambient data collection is the price tag written in invisible ink. The point isn’t to rip out every gadget. It’s to know a consent banner was never going to cover any of this, which is why putting them on their own network (Level 2) does more than any pop-up ever will.

11. Privacy, AI, and the problem of permanent memory

The difference between old-fashioned data collection and AI comes down to one word: forgetting.

A database stores what you did. An AI draws conclusions about who you are, and those conclusions are far harder to delete than any single record. AI doesn’t keep your data in a tidy file you could ask to have removed. It absorbs patterns and makes inferences, and those inferences don’t come from what you knowingly shared. Small fragments are enough. A handful of posts, a few purchases, and a model can guess things about you that you never told anyone.

Generative AI sharpens this further. Three minutes of your voice, from a podcast, a conference talk, a voicemail, is now enough to clone it convincingly. That’s not hypothetical; it’s a documented fraud technique, used to phone banks and relatives in the target’s own voice. Make sure you have a private safeword decided so people can check it’s really you.

And then the part that should worry anyone who took comfort in GDPR. The “right to erasure”, your legal right to have your data deleted, was designed for databases. It assumes the data sits somewhere specific and can be removed. AI models don’t work like that. You can’t pluck one person’s contribution out of a trained model without retraining the whole thing, which is wildly expensive and essentially never done. So the right exists on paper while the technical ability to exercise it often doesn’t. The ICO itself notes that training generative AI on scraped personal data leans on a “legitimate interests” justification and is high risk.

A database can forget. A trained model mostly can’t. That’s the new problem, and the law hasn’t caught up.

12. The reasonable position

Privacy isn’t all-or-nothing, and anyone who tells you it is, in either direction, is selling something.

You don’t have to quit the internet or move to a cabin. You also don’t have to accept that resistance is pointless. You can use the services that match your values, limit what you share, opt out where it’s offered, and demand better from the companies and regulators meant to be on your side.

We’re not anti-technology. We’re anti-exploitation. That distinction is the whole game.

13. Where to go next (UK-orientATED)

Start here:

Go deeper:

14. Last word

Privacy isn’t dead. It’s contested. Companies and governments will keep collecting until enough people make it inconvenient not to. The UK’s data protection law sets out good principles: fairness, purpose limits, data minimisation, your right to correct and erase, but enforcement is patchy, and as the fingerprinting story shows, the rules are forever one step behind the technology.

You probably can’t change Google’s business model on your own. But you can make it harder for them to profit from your specific data. Every permission revoked, every tracker blocked, every register you leave is a small refusal that adds up. You don’t have to be perfect. You just have to start.

I can’t do this for you. But I can make it less overwhelming to begin. Take what fits, leave what doesn’t, and do something today. The bleeding you saw at the top of this page doesn’t stop on its own. It stops when you decide it does.

Further watching

That’s All Folks

Thanks for joining me on this foray into data privacy. Quite the can of worms, isn’t it.

Just remember to take it step-by-step. You’ve been leaking data for a while, a few more chunks is annoying but not the end of the world.

Don’t rush. Check you know how to undo any changes before you make them, and make sure you have solid backups just in case. Murphy’s Law applies here as much as anywhere.

That said, if you want to grasp the nettle, go ahead. The browser and search engine swaps are easy, and I bet you’ve added a browser extension at some point, so those big wins are available to you today if you want them.

All the best with covering your tracks and gaining some control back.

Colette

Scroll to Top