Online privacy: what is actually collected, and what you can change

Online privacy is usually framed as secrecy, which is why the debate stalls at "I have nothing to hide". A more useful framing: privacy is about who holds a durable record of your behaviour, and what they are permitted to do with it later.

That reframing matters because the risk is rarely embarrassment. It is that a profile assembled for advertising gets reused for something with consequences — a price, a decision, a scam that knows enough about you to be convincing.

What is actually collected

Three distinct mechanisms, often confused with one another, and they need different defences.

Stored identifiers

Cookies and their relatives: a small file placed on your device so a site can recognise it later. These are the mechanism most people know about, largely because they are the only one with a consent banner attached.

They are also the easiest to defeat. You can clear them, block third-party ones, or use a browser that partitions them per site.

Fingerprinting

This is the one that matters more, and almost nobody has heard of it.

Your browser reveals a large amount of incidental configuration to every site you visit: screen dimensions, installed fonts, time zone, language, graphics hardware behaviour, audio processing quirks. Individually, none identifies you. Combined, the set is frequently unique — and it requires storing nothing at all, so clearing cookies changes nothing.

→ How browser fingerprinting works

Aggregation

The third mechanism is not technical at all. Data brokers buy, merge and resell information from public records, purchase histories, loyalty schemes, app SDKs and each other. The resulting profile can include your address history, household composition, estimated income, health interests and daily movement patterns — assembled by a company you have never contacted.

→ What data brokers hold

Why it connects to scams

Privacy and fraud are usually treated as separate subjects. They are not.

Every detail in a profile is raw material for a more convincing approach. The FTC's own guidance on avoiding social media scams leads with limiting who can see your posts and contacts — because scammers "exploit what a user posts to figure out how to target them", and buy ads targeted by age, interests and shopping habits using the same tools any business uses.

A spear phishing message that names your employer, your recent purchase and your colleague is not the product of sophisticated hacking. It is the product of information that was available for purchase.

What actually helps

Ordered by effect per unit of effort. The first three are worth doing this week; the rest are refinements.

1. Review app location permissions

The highest-value change available to most people. Open your phone's privacy settings, look at every app with location access, and downgrade anything that does not need it to "while using" or "never". Turn off precise location for apps that only need a general area.

A movement history is the most revealing dataset most people generate. It identifies home, workplace, place of worship, medical appointments and personal relationships — without containing a single word of content.

→ Location privacy in practice

2. Audit the rest of your app permissions

Contacts, microphone, camera, photo library. Many apps request these speculatively at install and never need them again. Access granted in 2022 is still access today.

→ How to review app permissions

3. Use a browser that resists fingerprinting

Browser choice does more than any individual setting. Firefox, Safari and Brave all ship meaningful anti-tracking and anti-fingerprinting protection by default; enabling the stricter modes costs very little in practice.

4. Decline non-essential cookies

The banner is tedious and mostly theatre, but "reject all" genuinely reduces third-party collection. It takes one extra click.

5. Reduce what is publicly posted

Birth dates, employers, pet names, children's schools, holiday dates. Each is a security question answer, a password guess, or the specific detail that makes a pretext land.

6. Opt out of data brokers

Slow, repetitive, and partially effective — profiles regenerate as new data flows in. Worth doing for the largest brokers, and worth knowing that some jurisdictions now provide a single deletion mechanism.

What does not help as much as people think

• Incognito mode prevents local history being saved. It does not hide you from the sites you visit, your network, or fingerprinting.
• A VPN hides your traffic from your network provider and moves trust to the VPN operator. It does nothing about cookies, fingerprinting, or the account you then log into.
• Deleting one social media account while the same information remains across three others and several brokers.

Where to go next

• Browser fingerprinting — how a device is identified with no stored data
• How online tracking works — the machinery behind following you between sites
• Data brokers — who assembles the profiles, and how to remove yourself
• App permissions — a practical review you can do in ten minutes
• Location privacy — the most sensitive category, and what to change