Key takeaways
- On iPhone, turning off Allow Apps to Request to Track under Settings, Privacy & Security, Tracking makes every app act as if you asked it not to track you.
- Most people search sites let you opt out for free, but the FTC notes listings can reappear, so search your name again every few months.
- If your information is misused, IdentityTheft.gov builds a recovery plan, and a free credit freeze at all three bureaus blocks new accounts in your name.
In this story 4 sections
Every app you open, site you visit and form you fill in leaves a little trail of data. Most of it ends up with advertisers and data brokers, companies that build profiles and sell them. Learning how to protect your privacy online is less about going off the grid and more about closing the doors you never meant to leave open. The checklist below takes about an hour the first time, and a few minutes a quarter after that.
Red flags that your data is leaking more than it should
Watch for these signs before you start. Each one points to a specific setting or habit you can change.
- Ads follow you from one app or site to another, sometimes minutes after you looked at a product.
- Searching your own name turns up a people search site listing your address, age, phone number or relatives.
- Apps you rarely use still have access to your location, camera, microphone or contacts.
- You get texts or calls that use details you never shared with the sender, like your street or your employer.
- You still sign in to old accounts you forgot existed, or you get breach notices from companies you barely remember.
- Your Google account or phone keeps years of search, location and voice history with no expiry date.
A step by step privacy checklist
Work through these in order. The first steps take seconds and cut off the most tracking.
1. Stop apps from tracking you across other apps
On an iPhone or iPad, go to Settings > Privacy & Security > Tracking and turn off Allow Apps to Request to Track. Apple explains that when this is off, every app is treated as if you tapped "Ask App Not to Track," which blocks the developer from reading your device's advertising identifier. You can still use the full app. See Apple Support's tracking guide for the details and the exceptions for managed devices.
On Android, look for the advertising section of your phone's privacy settings and delete or reset the advertising ID. The FTC recommends this step for any phone, since that identifier is what ad networks use to recognize you.
2. Trim app permissions
On Android, open Settings > Apps, choose an app, then tap Permissions. For location, camera and microphone you can pick "Allow only while using the app," "Ask every time" or "Don't allow." Google also offers a Permission manager under Settings > Security & privacy > Privacy, which shows every app that holds a given permission in one list. Turn on Pause app activity if unused so permissions are removed from apps you stop opening.
On iPhone, the same review lives under Settings > Privacy & Security, where each category (Location Services, Camera, Microphone, Contacts) lists the apps that have asked. A good rule: if you cannot say why an app needs a permission, switch it off and see whether anything breaks.
3. Put an expiry date on your Google history
Search, YouTube and location history can sit in your account for years. Go to Google Account > Data & privacy, choose an activity setting under History settings, click Auto-delete and pick how long to keep it. Google notes that location info and IP addresses are already removed from Web & App Activity after 30 days, but the rest stays until you set a limit. If you want a copy first, read our guide on how to download your data from Big Tech.
4. Tighten your browser
Clear cookies and browsing history on a schedule, and turn on tracking protection in your browser's privacy settings. The FTC points out that private or incognito mode only stops your own device from saving history. Websites and your internet provider can still see what you do. An ad blocker can help, but the FTC also warns that they don't necessarily block all tracking, so check reviews before you install one.
For ads that follow you on the web, two industry opt out tools are listed by the FTC: the Digital Advertising Alliance's AdChoices page and the Network Advertising Initiative's opt out page. You need to repeat the opt out on each browser and device.
5. Lock down social media
Public profiles are a gold mine for scammers who want your birthday, hometown or pet's name. Our social media privacy checkup walks through the settings on each major platform, including who can see your posts and who can look you up by phone number.
6. Opt out of people search sites
People search sites are a kind of data broker. According to the FTC's guide to people search sites, most of them let you opt out. Search your name on the site, find your listing, then follow its opt out or "remove my information" link. Repeat for each site, and check again every few months, because listings can reappear.
You can also pay a removal service. The FTC suggests asking how many sites it covers, whether you get a report of completed opt outs and how often it rescans. Keep in mind that opting out does not delete public records like property filings.
7. Protect the accounts that hold your data
Privacy settings mean little if someone can sign in as you. CISA's Secure Our World campaign boils it down to four habits: recognize and report phishing, use strong passwords with a password manager, turn on multifactor authentication and don't delay software updates.
8. Be careful on public WiFi
Most sites now encrypt traffic, but public networks still expose which services you connect to and invite fake hotspots. A VPN hides that from the network owner, though it does not make you anonymous. Our explainer on whether you need a VPN covers when it is worth paying for one.
What to do if your information is already out there
If a breach notice arrives or you find your details somewhere they should not be, act in this order.
- Change the password on the affected account and any account that reuses it, then turn on multifactor authentication.
- Freeze your credit with Equifax, Experian and TransUnion. It is free and stops new accounts being opened in your name. Our guide on how to freeze your credit has the steps for each bureau.
- If someone has used your information to open accounts or file taxes, go to IdentityTheft.gov, the FTC's site that builds a personal recovery plan and a report you can share with banks and police.
- Report scams, fake sellers and suspicious messages to the FTC at ReportFraud.ftc.gov. Online crimes involving money lost over the internet can also go to the FBI's Internet Crime Complaint Center at ic3.gov.
- Request removal from any people search site that lists you, and set a reminder to recheck in three months.
For a fuller recovery plan, see our guide on what to do after identity theft, and browse more security guides in our Tech section.
Keep it from creeping back
Privacy settings drift. New apps ask for permissions, phone updates add features and data brokers refresh their lists. Put a recurring reminder in your calendar every three months to review app permissions, search your name and clear old browser data. Ten minutes a quarter keeps most of the work you did today from quietly undoing itself.
Sources
Share this story
Spotted an error? Tell us
