Every day, your phone, your browser, and your apps quietly record where you go, what you search, what you buy, and who you talk to. Most of that data is not stolen by hackers. It is collected legally, by services you signed up for, under privacy policies almost nobody reads, and then sold, shared, or leaked in ways you never agreed to in any meaningful sense. The good news is that you do not need to become a security expert or give up the internet to fix most of this. A few hours of setup and a handful of habits will cut the data trail you leave behind by an order of magnitude.

This guide explains how online tracking actually works, then walks you through a practical privacy setup: securing your accounts, choosing the right tools, tightening your browser and phone, cleaning up what is already out there, and keeping it that way. Each section ends with something you can do today, in minutes, without spending money unless it is genuinely worth it.

Tracking is not one thing. It is several systems working together, and understanding them is what makes the fixes make sense. First, there are cookies and similar browser storage: small files websites leave in your browser so they recognise you when you return. First-party cookies remember your login and your shopping cart, which is useful. Third-party cookies, set by advertisers and analytics firms embedded in pages you visit, follow you across different sites and build a profile of your interests. Most major browsers now block third-party cookies by default, but the industry has simply moved to other methods.

Second, there is fingerprinting. Even without cookies, a website can identify your device with surprising accuracy by combining details your browser volunteers: screen size, installed fonts, operating system, time zone, language, and hardware details. Your combination is often unique among millions of visitors. Third, there are mobile identifiers. Apps collect your device's advertising ID, your location history, your contact list if you grant it, and data from other apps through software development kits buried inside them. Fourth, there is the data you hand over directly: the birthday, phone number, address, photos, and opinions you type into sign-up forms, quizzes, and social media posts. That last category is the one most people underestimate, because it is also the hardest to take back once it spreads.

The point of all this collection is rarely personal curiosity about you. It is advertising, fraud scoring, price testing, and data brokerage: companies that buy, combine, and resell personal information to anyone willing to pay. When a data broker is breached, the dossier it built about you ends up in criminal hands. Privacy, in other words, is not just about embarrassment. It is about reducing the number of copies of your personal information in circulation, because every copy is a future leak waiting to happen.

Start with the accounts that matter most, because they are the keys to everything else. Your email account comes first: anyone who controls your email can reset the password of nearly every other service you use. Give it a long, unique password, turn on two-factor authentication with an authenticator app rather than SMS where possible, and review the recovery options and connected devices. Do the same for your banking apps, your cloud storage, your password manager itself, and your main social accounts. This takes about half an hour for most people, and it is the single highest-value privacy and security step in this entire guide.

While you are in each account, run its security checkup. Google, Apple, and Microsoft all offer one, and they surface the things that actually matter: old devices still signed in, third-party apps with access to your data, and passwords that appeared in known breaches. Revoke access for apps you no longer use. A fitness app you tried in 2023 does not need ongoing access to your contacts. Check your email on haveibeenpwned.com to see which breaches already exposed your address, and change any password that was caught in one. If you have reused the same password across many sites, change the important ones first and work through the rest as you switch to a password manager.

The rule is simple: every account gets its own password, and no password is one you could memorise. A strong password today is at least 16 characters, randomly generated, and never reused. Nobody can remember fifty of those, which is exactly why a password manager exists. A reputable manager generates, stores, and fills in unique passwords for you, and unlocks them all with one strong master password plus two-factor authentication. The well-known options all work the same way at this level, so pick one with a published security model, a history of independent audits, and a price you will actually keep paying, because a manager you abandon is worse than none.

Where a service offers passkeys, use them. A passkey replaces your password with a cryptographic key stored on your device and unlocked by your fingerprint, face, or device PIN. Unlike a password, a passkey cannot be typed into a fake login page, because it only works on the genuine website it was created for, and it cannot be guessed, leaked in a database breach, or phished out of you. Google, Apple, Microsoft, Amazon, and most major banks now support passkeys. Set them up on your most important accounts first, keep a backup sign-in method for each one, and store your recovery codes somewhere safe and offline, such as printed in a drawer rather than photographed in your camera roll.

Two-factor authentication, or 2FA, means logging in requires something you know, your password, plus something you have, usually a code or a key. It is the cheapest protection that exists, and it blocks the overwhelming majority of account takeovers. But not all second factors are equal. An authenticator app that generates a code on your own device is much stronger than a code sent by text message, because text messages can be intercepted, redirected through SIM-swapping, or read from a synced device. A hardware security key, a small USB or NFC device you tap to sign in, is stronger still, and is the right choice for your email and financial accounts if you are willing to carry one.

Turn on 2FA everywhere it is offered, starting with email, banking, cloud storage, social media, and any service that stores payment details. Keep backup codes for each account in a safe place, and set up a second verification method, such as a second key or a second device, so that losing your phone does not lock you out of your own life. One common mistake is turning on 2FA only on the accounts you worry about. Attackers do not care which account they take first; they take the easiest one and use it to reach the rest, often through password resets sent to your email.

Your browser is where most tracking happens, and it is also where the fixes are easiest. Start by choosing a browser that treats privacy as a feature rather than a setting buried three menus deep. Firefox with its Enhanced Tracking Protection set to Strict, and Brave with its built-in shields, both block most trackers out of the box. Whatever browser you use, turn on the strictest tracking protection it offers, block third-party cookies, and set it to clear cookies and site data when you close it, or at least for sites you do not log into regularly.

Add two extensions and no more. A reputable content blocker such as uBlock Origin stops most advertising and tracking scripts from loading at all, which also makes pages load faster. A privacy extension from a trusted developer, such as Privacy Badger, catches trackers the blocker misses. Resist the temptation to install a dozen privacy extensions: each one adds fingerprinting surface and a new party you must trust, and many free extensions make their money by collecting the very data they promise to protect. Check the permissions of anything you install, and remove extensions you do not recognise or no longer use.

For searches, a privacy-focused search engine such as DuckDuckGo or Brave Search does not build a profile of your queries tied to your identity. You do not need to abandon your usual search engine entirely; using a private one for health questions, financial research, political topics, and anything you would not want attached to your advertising profile is already a large improvement. Use private or incognito windows for what they are actually good for — keeping a session separate from your main logins on a shared computer — and understand what they do not do: they do not hide your activity from your internet provider, your employer, or the websites you visit.

A virtual private network, or VPN, encrypts your internet traffic between your device and the VPN server, and replaces your real IP address with the server's address. On a public Wi-Fi network in a cafe, hotel, or airport, that encryption is genuinely valuable: it stops other people on the same network and the network operator from snooping on unencrypted traffic. It also stops your internet provider from seeing which sites you visit, although it moves that trust to the VPN company instead. A VPN is a trust transfer, not a trust elimination, which is why the provider matters more than the marketing.

Choose a paid VPN with a published, independently audited no-logs policy, a kill switch that blocks all traffic if the connection drops, and servers in the countries you actually need. Avoid free VPNs for anything sensitive: running servers costs money, and a free service usually pays for them with your data or by showing you advertising, which defeats the purpose. Understand the limits. A VPN does not make you anonymous, it does not stop a website from recognising you once you log in, it does not block tracking cookies or fingerprinting, and it does not protect you from phishing or malware. Use it on public networks and whenever you want your provider out of your browsing, but do not let it become an excuse for skipping the rest of this guide.

Phones leak more personal data than computers, because they carry your location, your microphone, your camera, and your contact list everywhere. Open your phone's privacy settings and work through them once, properly. For each app, ask whether it needs the permission it holds. A torch app does not need your location. A photo editor does not need your contacts. A game does not need to track you across other apps. On both Android and iPhone you can set permissions to allow only while using the app, or only once, and you should do so for location, camera, and microphone by default. Saying no to tracking when your phone asks, through Apple's App Tracking Transparency prompt or Android's ad-privacy settings, is worth doing on every app that asks.

Location deserves special attention. Turn off precise location for apps that only need a general area, such as a weather or shopping app, and turn off location history in your Google account and Significant Locations on your iPhone unless you genuinely use the timeline feature. Review which apps have background location access, because that is the permission that builds a map of your daily routine. Delete apps you have not opened in months; every installed app is a standing permission and a future data breach. Finally, keep your phone's operating system and apps set to update automatically, since many privacy fixes arrive as security patches.

Social media is the largest voluntary source of personal data, and the hardest to control after the fact, because other people share, screenshot, and repost what you publish. Before posting, ask whether the detail needs to be public: your child's school, your home in the background of a photo, your travel dates, your new job's office, your car's number plate. Photos carry hidden location data in their metadata unless your phone strips it, so check your camera settings and remove metadata before posting images from sensitive places. Review your audience settings once a quarter, and assume that anything posted to a large group or a public account is public forever, whatever the platform promises about deletion.

Then audit what is already out there. Search your own name, your username, and your phone number in a search engine and in each platform's search, and look at what a stranger would find. Remove old posts that reveal addresses, workplaces, routines, or family details you would not share today. Tighten the settings that matter most: who can see your posts, who can tag you, who can find you by phone number or email, and whether your account appears in search results. On each platform, also check the advertising and data settings — the sections labelled ads personalisation, data sharing with partners, or off-platform activity — and turn off the sharing options you do not need. You will still see ads, but they will be less precisely aimed at you.

Even a perfect setup leaves behind years of data collected before you started. Two cleanups are worth your time. First, data brokers: companies that sell your name, address, phone number, relatives, and property records to anyone who pays. You can request removal from the largest brokers one by one, which is free but slow, or use a paid removal service that does it repeatedly on your behalf, since brokers tend to re-add you from fresh public records. Either way, expect weeks rather than days, and accept that complete removal is unrealistic. Reducing your exposure still matters, because it makes you a harder, less profitable target.

Second, old accounts. Every forgotten forum, shopping site, and app account is a copy of your personal data sitting on a server you no longer watch, protected by a password you may have reused. List the services you can remember from your email history by searching your inbox for 'welcome', 'verify your account', and 'order confirmation', then delete the accounts you no longer use, starting with the ones that hold payment details or identity documents. For accounts you must keep, change the password and turn on two-factor authentication. This cleanup is dull work, and it is also the work that prevents a breach at a service you forgot you joined from becoming a problem in your present life.

On public Wi-Fi, prefer your mobile data or a VPN for anything sensitive, avoid logging into banking or email on a network you do not trust, and turn off automatic connection to open networks so your phone does not silently join a fake hotspot with a familiar name. Turn off Wi-Fi and Bluetooth when you are not using them, both to save battery and to stop your phone broadcasting its presence. For smart home devices, change the default password on your router and on every camera, speaker, and plug, keep them on a separate guest network if your router supports it, and check what data each one sends to its manufacturer. A voice assistant that records by accident, or a camera with a default password, can undo a careful privacy setup in a single device.

A few everyday habits complete the picture. Pause before quizzes and personality tests that ask for your mother's maiden name, your first pet, or your birthplace — those are common security-question answers dressed up as entertainment. Do not enter personal details into unfamiliar websites to unlock a result, a download, or a prize. Check the sender before clicking a link that asks you to log in, and prefer typing the address yourself or using a bookmark. And when a service asks for optional information — your phone number for a newsletter, your birthday for a discount — leave it blank unless there is a real reason to give it. Every field you skip is data that can never be leaked.

Privacy is not a one-time project; it is a routine, and it only works if it is small enough to keep. Once a month, spend ten minutes on three things: review new app permissions and connected accounts, check the security alerts in your email and main social accounts, and delete the apps and accounts you stopped using. Once a quarter, review your social media audience settings and your data-broker removals. Once a year, rotate your most important passwords where passkeys have not replaced them, review your password manager's emergency access settings, and check what a search for your own name reveals. Put the monthly check on your calendar now, while this guide is in front of you, because the setup you forget to maintain quietly decays.

Start today, in this order, and stop wherever you run out of time: turn on two-factor authentication for your email, install a password manager and change your five most important passwords, tighten your browser's tracking protection, and review your phone's app permissions. Those four steps take about an hour in total and remove most of the easy data collection aimed at you. The rest — the VPN, the data-broker cleanup, the social audit — can follow over the next week. You will never be perfectly private online, and chasing perfection is how people give up entirely. What you can be is a much harder target than you were this morning, with far fewer copies of your personal life floating around in databases you never chose. That is a result worth an hour of your time.