01 Jan 2024

effective privacy tips

Disclaimers: This page is regularly updated with links and copy changes. This page is not intended for people with a specific personal security need or threat. But it does include some tips that will make it easier for vulnerable people to blend into a crowd of other people doing similar things. See links at the end if you want to put more time into privacy stuff after trying these tips.

Most people don’t have time to follow all the privacy advice available to them. This is my current list of what I think are the tips that will provide the biggest impact for the time available. For me, this is not so much about protecting myself today, but in moving money out of surveillance and into constructive areas in the future.

A lot of privacy tutorials will tell you to act independently and protect yourself, but in the real world that’s hard to do. See the section on privacy labour in the W3C Privacy Principles. The surveillance industry has the resources to make more privacy settings than you can possibly find and fix. (Can you win Realistic Facebook Privacy Simulator?) Privacy tips are only part of the solution, and they really only help as part of collective action. The problems with individual privacy include

Using privacy tips in situations where other people don’t use them just makes you more identifiable.
If only a few people use privacy tips, then money keeps flowing into surveillance. CMOs fund surveillance marketing projects at companies, VCs fund surveillance startups, and surveillance budgets keep going up.

In the long run I want to lower the expected return on investment (ROI) of future surveillance, which means it’s generally better to have more people doing the few highest-impact measures than a few people getting more protection.

In my humble opinion, my good fortune in having nothing to hide comes with an obligation to help others by taking privacy measures that can make others safer. This is my latest attempt to pick some good privacy tips that most Internet users should be able to do, and rank them. I’m looking not just at the privacy scene, but also at industry sources and legal documents. When a tool or setting has the result of lowering revenue for Big Tech, or if they try to nudge people into not doing it, then that’s a good sign, and I move it up on the list.

These tips are all focused on the USA, and different tips might work more or less well elsewhere. I’m also assuming that you can have both a computer and a phone—a basic laptop and a basic phone are a lot better for doing these than even the best possible phone. If anyone has written effective privacy tips for people who are phone-only please let me know and I’ll link here. And tips will get more or less effective as laws, regulations, compliance, and features change. I have been updating this page fairly often. Ready? Let’s start with an easy, high-impact one.

1. Fix mobile privacy settings. These are different on Apple iOS and Google Android. Fixing these settings is still today’s best privacy tip, because of the ubiquity of smartphones, the good research showing high impact, the small amount of time required, and the stickiness of the settings once set. Limiting ad personalization should give you an immediate fraud protection win, too. According to the National Bureau of Economic Research, the Apple setting reduces money lost in all complaints by 4.7% and money lost reported in internet and data security complaints by 40.1%.

On Apple iOS (iPhone and iPad):

In Settings, go to Privacy & Security, then Tracking, and make sure Allow Apps to Request to Track is turned off.
Also in Settings under Privacy & Security, find Apple Advertising and make sure that Personalized Ads is turned off. (You will probably have to scroll down—Apple makes this one a little trickier to find.)
In Settings, under Safari, scroll down to Advanced, and turn off Privacy Preserving Ad Measurement (This is an ad tracking feature, not a privacy filter on existing ad tracking.)

On Android, there are also at least two settings to check.

Open Settings, go to Privacy, then Ads and select Delete advertising ID.
Under Settings, go to Security & Privacy, Privacy, Ads, Ads privacy, Ad topics. Toggle the switch next to Allow ad topics off.

Consumer Reports has instructions that should work across Android versions. See Workout 4 at CR Data Bootcamp

2. Fix Google and Meta advertising settings.

If you have a Google Account, turn off ad personalization. Go to https://myadcenter.google.com/home and set Personalized Ads to Off. This does not turn off the tracking that feeds into the ad selection, but makes it harder to infer anything about you based on having received a particular ad, and makes it harder for scammers to target you (like malware operations targeting IT staff for fake download ads.) Most important, it looks like this setting will help limit Google ad revenue (PDF) so they have less money to build future surveillance. And, as a bonus, it will help you buy better stuff.

If you use Meta sites or apps (including Facebook, Instagram, WhatsApp, or Threads), fix Meta settings. John Oliver covers How to change your settings to make yourself less valuable to Meta. These settings don’t limit how much information about you goes to Meta, but they will probably limit your exposure to well-targeted scams, as well as reducing the amount of ad money that goes to Meta. Meta gives you a bunch of steps to go through, but this is worth it.

Go to accountscenter.facebook.com and (here we go…)

Part one: activity from ad partners (surveillance on non-Meta sites and apps)

Click “Ad preferences.”
Click “Manage info.”
Click “Activity information from ad partners.”
Click “Review setting.”
Select “No, don’t make my ads more relevant by using this information.”
Click “Confirm.”

Part two: Data used to target you for ads on non-Meta apps

Click “Ad preferences.”
Click “Manage info.”
Click “Ads from ad partners.”
Select “Don’t show me ads from ad partners.”
Click the “X” button to close out.

If you have separate Facebook and Instagram accounts, then you also have to do the same steps at accountscenter.instagram.com to cover Instagram and Threads.

Those are the two essential ones. (John Oliver also recommends another setting on his page but I’m leaving that one alone for now because it’s not critical and I might want to use some of the data for privacy research.) Limiting how personalized the ads are might mean you miss out on seeing some legit products, but the risks from fraud and misinformation targeted to you are bigger than the potential upside.

2. DROP (California) or get an authorized agent. California residents now have the option to sign up for a state service that will remove data from all state-registered data brokers. It’s not in effect yet, but if you have a California address you can sign up at Delete request and opt-out platform (DROP) on the CalPrivacy site.

Consumer Reports Permission Slip is free and works well to automate your right to opt out of data sales or sharing. It has an auto requests option to handle the big data brokers, so you can sign up once and then leave Permission Slip to do its thing. Or if you’re interested in the surveillance economy you can open up the app and choose to send opt-outs for individual companies manually.

If you have tried an authorized agent in the past and gotten limited results, it may be soon be time to try again. A big company finally got a fine for making an authorized agent opt-out unnecessarily difficult, so expect more companies to come into compliance soon. This tip is a contender for number one in a future list, as three trends continue.

Consumer Reports is adding more companies to the list.
More companies are coming into compliance and automating their interactions with authorized agents.
More state privacy laws keep taking effect.

When you sign up for Consumer Reports you can also get on their list and start keeping up with political stuff, which will help with another tip on this list. (Disclaimer: I worked on the CR research that led up to Permission Slip and am still an advisor to CR.)

Permission Slip offers both a free service and a paid upgrade. Two paid-only options are Incogni and DeleteMe.

3. Switch to non-surveillance apps and change app habits.

For messaging, switch to Signal where possible. This doesn’t just give you better personal security and privacy. If you have nothing to hide, switching can still help you protect others.

help vulnerable people hide in the crowd of other users chatting about boring stuff on Signal
collect less surveillance data in total, to limit the ability of Big Tech AI to learn to spot the targeted users

Go through your phone and remove extra apps. This includes not just the obvious social media and messaging. Most mobile apps have some kind of tracking built in.

If you really need a surveillance app—for example, if a family member is in an activity that only puts announcements on a Facebook group—then move the app off your phone’s home screen and work on developing alternate habits to replace it.

Habits can be powerful. Elena Rossini writes, I will be thinking: what do the Big Tech billionaires and kleptocrats wish I would do? And then I will do the OPPOSITE. Look for ways to nudge yourself into doing some beneficial habit instead of feeding a surveillance app with your attention. WikTok is a fast-scrolling feed of Wikipedia content that might help break an app habit. And make a habit of checking less risky apps first, so that people learn that they’re a better way to reach you.

4. Fix smart TV settings. You can skip this one if your TV is not connected to the Internet and you know that nobody will connect it, or if you don’t have a TV that can be connected to the Internet.

TVs have a lot of confusing menus to navigate, and manufacturers keep moving the settings around. Two good articles on how to find and turn off the The article How to Turn Off Smart TV Snooping Features is about as clear an explanation as I have found. The reason this tip is number three here is because Tom Cruise says you have to change some other default settings on the TV anyway, so you might as well do the privacy stuff while you’re digging into your TV menus.

4.5 Set up a YouTube-only email address. This is a prerequisite for the next step. If you don’t have a spare email address that you can dedicate to YouTube, you can use Apple Hide My Email or Firefox Relay to make a separate address just for YouTube. (Using different email addresses for everything is a privacy tip but can be inconvenient enough that it doesn’t make my list—YouTube does.)

Another option is to make an account on Hotmail or some other non-Google email service, just for YouTube.

5. Fix YouTube. YouTube is the number one social network by some metrics. And it’s a big surveillance risk because it’s tied to other Google services.

It’s important not to log in to YouTube with your regular Google account if you have one, or to make a YouTube account with your normal email address. You need to log in with an email address you only use for YouTube.

You have a couple of options. One that takes a couple of steps to set up, but that just works once it’s set up is to use Firefox containers. The instructions at cleaning up YouTube cover how to do the container along with an extension to fix some design misfeatures that tend to promote disinformation and AI slop.

If you know how to use browser profiles, then you can put YouTube in a separate profile for your normal browser.

Otherwise, use YouTube from a different browser that you only use for YouTube. I have uses LeechBlock to block YouTube in other browsers so that I remember to open it in its own browser.

Don’t use the YouTube app, just a browser. Unfortunately this tip is here because of the impact level, not because the privacy development scene has good easy answers for how to do it. This tip also depends on habit power—saving YouTube links to watch later on a privacy laptop instead of opening on your phone right away. Attention developers: YouTube protection is a big need with relatively few solutions, good place to make a big difference.

7. Turn on Global Privacy Control. This will automate your do not sell/share for sites you visit. Hella easy so the denominator in the effect/time score is low. But it’s still not supported everywhere, because there are more companies required to comply with state privacy laws than there are people who know how to comply. As more companies come into compliance, and as more states require it, expect this one to work better and better, and move up on the list. Privacy Badger will turn on Global Privacy control for you, by default, along with blocking tracking scripts, so it’s possible to do two tips with one extension. There are several easy ways to do this one. More info on the Global Privacy Control site.

8. Participate in privacy politics. California has the CPRA because people voted for Proposition 24 in 2020. The CPRA isn’t perfect, but voting made a difference. Consumer Reports Impact Newsletter and Newsletter from The Markup are helpful for keeping up with privacy issues.

Make sure your voter registration is up to date and has your current address. You might be able to make a big difference as a juror in a privacy trial like the Flo case.

9. Check or replace your ad blocker. (Update: as the fraudulent search ad situation continues, this step is no longer optional. You can turn off the ad blocker on specific legit ad-supported sites if you want to make sure they get their ad revenue.) Some sites (and even the FBI) recommend an ad blocker, but just searching for ad blocker or taking the first online recommendation is a bad idea. Many ad blockers are either adware, or participate in a paid allow-listing scheme that allows tracking by default. Do not use Google Search or the search feature on the Chrome Web Store to find an ad blocker, even if you know the name of a good one. A lot of extension listings are fraudulent and Google has no incentive to help you with this search. Only use a link from a trustworthy privacy site.

You can visit EFF’s Cover Your Tracks to run a test and reconfigure your existing ad blocker, but switching to uBlock Origin is probably quicker and will give you a privacy upgrade as well as exposing you to fewer web annoyances. uBlock Origin has an active development, testing, and support scene. They’re especially good at eliminating turn off your ad blocker pop-ups.

(Privacy tools and settings often set off a lot more turn off your ad blocker pop-ups than uBlock Origin users get. If the web gets too annoying with Privacy Badger, then switching to uBlock Origin might be the best option.)

Other recommendations (not tested by me so far).

For Apple Safari: AdGuard for Safari
For Apple iOS: Lockdown Privacy
For Android: Block This

Ad blocking is tricky—if you block ads on normal sites but not YouTube or Google Search, then you are encouraging advertisers to send more money to one big company, which is a bad idea. Do the YouTube tip before this one. If you’re seeing ads on YouTube but not on other sites, you’re doing ad blocking wrong. Most people surveyed say they are running an ad blocker now, and experienced advertisers are more likely to have one, so this tip might move up soon.

If you do decide to install an ad blocker, make sure that it is blocking the ads on Google Search. The ads on search results pages are designed to be easy to confuse with search results, and Google allows a lot of malware and other fraud in the search ads—even ads that look like they link to Google’s own site.

10. Fix browser settings. Most browsers have sensible defaults by now, but there are two exceptions: so-called privacy-enhancing ad data collection, and the old-fashioned third-party cookies that remain in Google Chrome. Check and fix the settings for whatever browsers you use.

(I’m not including switch browsers in this list because switching can be a lot of work, and you need to change some privacy settings in all the major browsers. You do need a separate browser for YouTube though—see tip 5. Google Chrome is probably going to have to remind you to turn their advertising features off, but I don’t know whether the others will have to disclose what they’re doing. You have to check the settings.)

11. Nerd out with browser privacy extensions. Now we’re getting into the intermediate-level tips that will be interesting to some people.

ClearURLs gets rid of tracking parameters in URLs, and speeds up browsing by skipping data collection redirects.
NJS is a minimal JavaScript disable/enable button. Helpful for removing pop-ups and crap from sites where the real content works without JavaScript.
Personal Blocklist is surprisingly handy for removing domains that are heavy on annoyances and surveillance, but weak on actual information, from search results. (part of how to fix Google Search)

12. Read privacy policies and send opt out, right to know, or right to delete requests manually. All right, we’re deep in privacy nerd territory now, you probably should have stopped reading two tips ago. This is way too time-consuming. I do these, but I’m mainly looking for companies that should be on the lists used by authorized agents to opt everyone else out. For most people these are just privacy labour and you’re better off doing a higher-priority privacy tip or writing to your state representative.

Any others?

More: My talk from Southern California Linux Expo (slides and text) has more details on context for some of these. Also Privacy tips with no brand names and no links for those who can’t recommend a specific commercial service.

effective privacy tips

Other privacy how-to articles

blogroll

effective privacy tips

Other privacy how-to articles

Related

blogroll