The Complete Guide to Online Privacy and Personal Cybersecurity

You search once for a pair of running shoes, and for the next month adverts for them follow you from site to site. A stranger at a party mentions your street name, and you realise it is listed on a people-search website. Your fitness app, set to public, has drawn a neat map of where your runs begin and end every morning: your front door.

None of this involves a hacker, yet all of it shows how much of your life is visible online. Online privacy is about deciding who gets to know what about you. It matters on its own terms, and it matters for security, because the details you share are exactly what scammers use to impersonate you, guess your security answers and write messages you will believe.

This guide explains who collects your data and how, the practical settings that protect your privacy on phones, browsers, apps and social media, what public Wi-Fi and VPNs really do, how to deal with data brokers, what rights you have, and a 30-minute checkup you can do today. It applies wherever you live.

Privacy and security: related, not the same

• Security keeps attackers out: strong sign-in, updates, backups and caution with links and files.
• Privacy controls who collects information about you, including companies you use legitimately, and what they do with it.

They overlap more than people expect. Every detail that is easy to find about you is a detail a scammer can use. Our guide to identity theft and account security covers the security side in depth; this guide focuses on controlling your information.

Who collects your data, and how

Start with a simple plan

Privacy advice can feel endless. Security experts often suggest starting with a few questions, an approach the Electronic Frontier Foundation's Surveillance Self-Defense guide calls a security plan:

1. What do I most want to protect? For example, my home address, my finances, my children's photos or my messages.
2. Who might want it? Advertisers, scammers, an ex-partner, a stalker, an employer.
3. How likely is it, and how bad would it be?
4. How much effort am I willing to put in?

Most people get the biggest benefit from a handful of changes: app permissions, social media visibility, location sharing and account security.

Privacy on your phone

App permissions

• Location: choose "while using the app" rather than "always", and turn off precise location for apps that only need your town.
• Microphone and camera: allow only for apps that clearly need them, such as calls and video.
• Contacts and photos: share selected photos rather than your whole library when your phone allows it.
• Review every few months in your phone's privacy settings, and remove apps you no longer use.

Advertising and tracking

• iPhone: in Privacy and Security, turn off "Allow Apps to Request to Track", or choose "Ask App Not to Track" when prompted.
• Android: in the privacy or Google settings, delete your advertising ID so apps cannot use it to link your activity.

Your lock screen

Hide message previews on the lock screen so codes and private messages are not visible to anyone holding your phone.

Privacy in your browser

• Turn on tracking protection in your browser settings, and block third-party cookies where you can.
• Understand private browsing. It stops your device saving history and cookies after you close the window. It does not hide your activity from websites, your network or your internet provider.
• Keep extensions to a minimum. Extensions can see the sites you visit; remove those you do not need.
• Consider a privacy-focused search engine if you would rather your searches were not tied to your profile.
• Use your account's privacy checkup. Google's Privacy Checkup, for example, lets you review and pause activity history and ad personalisation.

Social media visibility

Social media is often the largest source of personal information about any individual. Set profiles to private or friends-only, limit who can see your friends list, birthday and contact details, and think before posting children, documents, tickets and your location in real time. Our guide to social media scams explains how scammers use what they find.

Email and messaging privacy

• Use email aliases or a separate address for shopping and sign-ups, so your main address stays private and spam is easier to spot.
• Prefer end-to-end encrypted messaging for private conversations; only you and the recipient can read the messages.
• Use disappearing messages for sensitive chats, remembering that the other person can still take screenshots.
• Turn off automatic image loading in email if you want to limit tracking pixels that report when you open a message.

Public Wi-Fi and VPNs

Public Wi-Fi is safer than it once was. As the US Federal Trade Commission notes, most websites now encrypt their connections. The main risks today are fake hotspots with official-sounding names and fake sign-in pages that ask for your email password. Check the network name with staff, never enter your email or work password on a Wi-Fi sign-in page, and use your phone's mobile data for banking if you are unsure. More on this in working from hotels, airports and cafés.

A VPN encrypts your traffic between your device and the VPN provider. That hides your activity from the local network and can be useful on untrusted connections. But a VPN does not make you anonymous, does not stop tracking by services you sign in to, and does not protect you from phishing or scams. The VPN provider can see your traffic instead, so choose a reputable one and be wary of free VPNs.

Location privacy

• Photos: turn off location tagging in your camera settings, or remove location before sharing.
• Fitness and running apps: set activities to private and hide the start and end of routes near your home.
• Live location sharing: share only with people you trust, for a set time, and review who can see it.
• Check-ins and holiday posts: post after you have left, not while you are away from home.
• Location history: review and delete it in your phone or account settings, or turn it off.

Smart devices at home

• Change default passwords and keep smart devices updated.
• Review voice assistant recordings and delete them, or turn off recording history.
• Place indoor cameras thoughtfully, and use privacy shutters or schedules.
• Put smart devices on a guest network if your router allows it, separate from computers and phones.

Data brokers and people-search sites

Data brokers compile profiles about individuals from public records, marketing lists, apps and breaches, then sell or publish them. Some people-search sites show addresses, phone numbers and relatives to anyone.

1. Search for your name with your town to see which sites list you.
2. Use each site's opt-out process. It can be tedious, but it removes the easiest sources.
3. Use your legal rights where they exist to request deletion.
4. Reduce new data: share less at sign-up, use aliases and decline optional marketing.

Cookie banners: what to choose

Cookie banners ask whether a website can use cookies and similar tracking. Many make "accept all" the easiest button. Choosing "reject all" or "necessary only" where offered limits tracking for advertising without breaking most sites. If a site hides the reject option, look for "manage settings" or "more options". Your browser's tracking protection helps on sites that do not offer a real choice.

Signing up for new services

• Give only what is required. Optional fields such as birthday, phone number and gender are often used for marketing.
• Use an alias email for newsletters, shopping and one-off sign-ups.
• Be careful with "sign in with" buttons. Check what the app will be allowed to see from your social or email account.
• Untick marketing and data-sharing boxes unless you really want them.
• Read the permissions, not the whole policy: what data, shared with whom, and for how long.

Privacy and AI chatbots

AI assistants and chatbots are useful, but anything you type may be stored, reviewed or used to improve the service, depending on the provider and your settings. Treat a chatbot like a public space.

• Do not paste passwords, ID numbers, full bank details, medical records or confidential work documents.
• Check the service's settings for chat history and whether your conversations are used for training, and change them if you prefer.
• At work, follow your organization's rules on which AI tools are approved and what information may be used with them.

Old accounts and old devices

Forgotten accounts still hold your data, and old devices can still hold your photos and passwords. Once a year, list the services you have signed up for, delete the accounts you no longer use, and download anything you want to keep first. Before selling or giving away a phone or computer, sign out of your accounts, remove it from "find my device", and perform a full factory reset so the next owner starts with a clean device.

Your privacy rights

Many countries give individuals legal rights over personal data. In the European Union, the General Data Protection Regulation gives you rights including to be informed, to access your data, to have it corrected or erased, to restrict or object to its use, and to receive it in a portable format. Organizations must usually respond within one month. Similar rights exist under laws such as the UK's data protection law, California's Consumer Privacy Act, Ghana's Data Protection Act, Nigeria's Data Protection Act, Kenya's Data Protection Act and India's Digital Personal Data Protection Act, though details differ.

To use your rights, contact the organization holding your data, usually through its privacy contact, and keep a record of your request. If it does not respond properly, your national data protection authority can help.

Personal cybersecurity: the essentials

Privacy settings mean little if an attacker simply walks into your accounts. Make sure the basics are in place:

• Unique passwords in a password manager, and two-step verification or passkeys on important accounts.
• Automatic updates on phones, computers and apps. Our guide to malware and ransomware explains why.
• Regular backups of photos and important files.
• Care with links, attachments and unexpected requests. See our complete guide to phishing.

Privacy for children and families

• Think before sharing children's photos publicly, especially with school uniforms, names or locations visible.
• Use family and parental controls on phones, tablets and app stores.
• Teach children not to share their full name, school, address or photos with people they meet online.
• Check the privacy settings of games and apps they use, particularly chat features.

Health, finance and other sensitive apps

Health trackers, fertility and period apps, mental health apps, banking and budgeting apps hold some of the most sensitive information about you. Before using one, check who makes it, what it shares with third parties, whether data is stored on your device or in the cloud, and how to delete your data. Prefer apps from established providers with clear privacy settings, and protect them with a passcode or biometric lock where the option exists.

People at higher risk

Some people need more than everyday privacy: journalists, activists, public figures, people leaving abusive relationships and anyone facing stalking or harassment. For them, careful planning matters, because some protective steps can alert the person they are protecting themselves from. The Electronic Frontier Foundation's Surveillance Self-Defense guide offers detailed, scenario-based advice, and local support organizations can help people in danger make a safety plan before changing devices or accounts.

A 30-minute privacy checkup

1. Review app permissions for location, microphone, camera, contacts and photos. Remove unused apps.
2. Turn off ad tracking on your phone.
3. Set social media profiles to private or friends-only and hide your birthday and contact details.
4. Turn on tracking protection in your browser and remove unneeded extensions.
5. Hide lock screen message previews.
6. Check location history and photo location tagging.
7. Search your name and opt out of the people-search sites that list you.
8. Confirm two-step verification is on for email, banking and social media.

Privacy at work

Organizations hold personal data about customers and staff, and privacy mistakes are often simple: an email to the wrong person or a folder shared too widely. See everyday data mistakes and how to prevent them and our guide to small business cybersecurity. CyberWatch AI helps organizations build the habits that protect data, with short training and realistic practice for every employee.

Common privacy myths

• "I have nothing to hide." Privacy protects you from fraud and manipulation, not just embarrassment.
• "Incognito mode makes me anonymous." It only stops your device keeping history.
• "A VPN makes me invisible." It hides traffic from the local network, not from the sites you sign in to.
• "My data is already out there, so it's too late." Every step still reduces what is easy to find and misuse.
• "Privacy settings are too complicated." A 30-minute checkup covers the changes that matter most.

Frequently asked questions

Sources

1. Top tips for staying secure online, UK National Cyber Security Centre
2. Surveillance Self-Defense, Electronic Frontier Foundation
3. Are Public Wi-Fi Networks Safe? What You Need To Know, US Federal Trade Commission
4. Information for individuals (data protection rights), European Commission
5. Privacy Checkup, Google Account
6. Privacy, Apple
7. Secure Our World, US Cybersecurity and Infrastructure Security Agency
8. Social media: how to use it safely, UK National Cyber Security Centre