15 Online Privacy Tips That Actually Make a Difference

Privacy advice tends to swing between “it’s already too late” and exhausting checklists nobody finishes. Most people need neither. A handful of changes do most of the work, and almost all of them are free.

The short version: use a password manager, turn on passkeys or two-factor authentication, keep your devices updated, and limit what your browser and apps can collect. The 15 online privacy tips below cover those and more, grouped into four themes and starting with the area that matters most: your accounts.

You don’t need to tackle them all at once. If you’re short on time, the table near the end shows where to start, with a rough time estimate and impact rating for each tip.

How to protect your privacy online without going overboard

If you’ve searched for how to stay private online, you’ve probably seen advice ranging from sensible to extreme. Realistically, privacy isn’t about disappearing from the internet. It comes down to three practical goals:

• Keep your accounts yours, so nobody else can read your email, messages or files.
• Reduce tracking, so fewer companies can build a profile of your browsing and location.
• Shrink your footprint, so less of your personal information is exposed, sold or leaked.

Unlike a lot of internet privacy tips, none of the steps below require technical skills or special hardware.

Accounts and passwords

1. Use a password manager

Reused passwords are one of the biggest risks most people carry. When one site is breached, attackers try the leaked email and password pairs on other sites, a technique called credential stuffing. A reputable password manager creates a long, unique password for every account and fills it in for you, so one breach stays one breach.

Start with your most important accounts: email, banking, social media and the Apple or Google account your phone uses. As a bonus, password managers typically won’t autofill on a lookalike phishing site, which is a useful warning sign.

2. Turn on passkeys or two-factor authentication

Two-factor authentication (2FA) adds a second check after your password, such as a code from an app. Even if your password leaks, an attacker can’t get in without that second factor. Where you have a choice, use an authenticator app instead of SMS codes, because text messages can be redirected through SIM-swap scams, in which someone persuades your carrier to move your number to a SIM card they control. SMS codes are still much better than nothing.

Better still, use passkeys where they’re offered. Passkeys are built on the FIDO2 and WebAuthn standards and are supported on Apple, Google and Microsoft platforms. You sign in with your fingerprint, face or device PIN, and because a passkey only works on the site it was created for, it’s highly resistant to phishing.

3. Check whether your email appears in data breaches

Breaches happen even at companies that do most things right. Have I Been Pwned is a long-running free service that shows whether your email address appears in known data breaches, and which ones. If it does, change the password for each affected account and anywhere you reused it, then turn on 2FA there. You can also sign up to be notified about future breaches.

4. Use email aliases

Every site that has your real email address can lose it in a breach, sell it or use it to connect your accounts. An email alias is a forwarding address that delivers to your inbox without revealing your real one, and if an alias starts attracting spam, you can switch it off.

Some email providers and privacy services offer aliases, and some password managers can create one as you sign up. Plus addressing, such as yourname+shop@example.com, works with many providers and helps with filtering, but it’s easy to strip off, so it doesn’t really hide your address.

Browsing

5. Review your browser’s privacy settings

Third-party cookies let advertising and analytics companies recognize you as you move from site to site. Some browsers block or isolate many of them by default; others leave it to you. Open your browser’s privacy settings, block third-party cookies and turn on any built-in tracking protection. If a site you trust breaks, most browsers let you make an exception.

While you’re there, review which sites can use your location, camera, microphone and notifications, and remove extensions you no longer use. Extensions can often read the pages you visit, so keep only those from developers you trust. For what private browsing does and doesn’t add, see incognito mode vs a VPN.

6. Turn on HTTPS-only mode

HTTPS encrypts the connection between your browser and a website, so your internet provider and whoever runs the network can’t read the pages or what you type. Most sites support it, but some links and old bookmarks still load unencrypted versions. An HTTPS-only setting, called HTTPS-Only Mode in Firefox and Always use secure connections in Chrome, upgrades connections automatically and warns you before loading a page without encryption.

7. Use encrypted DNS

Every time you visit a site, your device looks up its address through DNS, the internet’s address book. Traditional DNS lookups aren’t encrypted, so your internet provider and whoever runs your network can see the names of the sites you visit. DNS over HTTPS, standardized in 2018, and DNS over TLS fix that.

Most major browsers have a secure DNS setting, and on most Android phones you’ll find Private DNS in the network or connection settings. It won’t hide everything, as our guide to what your ISP can see explains, but it closes one of the biggest gaps.

8. Use a VPN on networks you don’t control

On public Wi-Fi at a coffee shop, hotel or airport, you’re trusting whoever runs the network. A VPN encrypts everything between your device and the VPN server, so the network owner sees only an encrypted connection, and websites see the VPN server’s IP address instead of yours. Our guide to public Wi-Fi safety covers the risks in more detail.

A VPN doesn’t make you anonymous: logins and cookies still identify you, and the VPN provider can see your connection details. So the provider matters, especially with free options. Here’s how to tell whether a free VPN is safe.

Devices and apps

9. Keep your devices and apps updated

Updates fix security flaws, including some that attackers are already exploiting. Turn on automatic updates for your operating system, browser and apps, and restart when prompted. If a phone or laptop no longer receives security updates, plan to replace it, especially if it’s the one you bank on.

10. Audit app permissions

Apps often ask for more access than they need. Go through the permissions for location, microphone, camera, contacts and photos, and remove anything that doesn’t make sense; a flashlight app has no business reading your contacts.

On iPhone, look under Settings > Privacy & Security. On most Android phones, search Settings for Permission manager. Recent versions of both let you allow location only while an app is in use, and share approximate rather than precise location. Deleting apps you no longer use is the simplest permission fix of all.

11. Review your location history settings

Your phone and some of the services you use can keep a detailed history of where you’ve been. Decide whether that’s worth it to you. On iPhone, look under Settings > Privacy & Security > Location Services > System Services, where you’ll typically find Significant Locations. If you use Google services, review the location history settings in your Google account. And check which apps can access your location all the time, not just while you’re using them.

12. Lock your screen and hide notification previews

A strong passcode or biometric lock keeps a lost or borrowed phone from becoming an open book. Then look at what appears on your lock screen: message previews and sign-in codes can be read by anyone who picks up your phone.

On iPhone, go to Settings > Notifications > Show Previews and choose When Unlocked. On Android, look for lock-screen notification settings that hide sensitive content; the wording varies by manufacturer.

Your data and social media

13. Tighten your social media privacy settings

Platforms change their settings regularly, so a check every few months is worthwhile. Review who can see your posts, friends list and profile details, whether people can find you by phone number or email address, and how your activity is used for ads. Many platforms offer a privacy checkup tool that walks you through the main options. Also remove third-party apps and games you’ve connected to your accounts but no longer use.

14. Think before you share

Every post adds to a picture of your life that strangers, scammers and data collectors can piece together. A few habits help:

• Check photos for location data. Phones can store GPS coordinates in a photo’s metadata. Many social networks strip it on upload, but files sent by email or cloud link may keep it. You can turn off location tagging in your camera settings.
• Post check-ins after you leave. Real-time posts tell people where you are, and that you’re not at home.
• Guard your security answers. Pet names, first schools and hometowns often turn up in quizzes and old posts.
• Ask before posting about others, especially children.

Heading abroad? Our travel cybersecurity tips cover what to share on the road.

15. Opt out of data brokers

Data brokers collect and sell personal details such as names, addresses, phone numbers and relatives, often compiled from public records and commercial sources. What you can do varies by country. In the US, many people-search sites have opt-out forms, and some states give residents extra rights over their data. In the EU and UK, data-protection law lets you ask organizations to delete your personal data in many situations.

Opting out is tedious and some listings reappear, so start with the sites that show up when you search your own name. Paid removal services can do the legwork if you’d rather not.

Where to start: online privacy tips by time and impact

Short on time? Work down this list. Times are rough estimates.

The bottom line

Good online privacy is mostly a handful of habits. Lock down your accounts with a password manager and passkeys or 2FA, keep your devices updated, tighten your browser and app settings, and think twice about what you share. You don’t need to do it all today; even an hour this week makes a real difference.

On Wi-Fi you don’t control, a VPN adds a useful layer. OqusFreeVPN is a free VPN built on WireGuard, with no ads and no credit card, and apps for Windows, macOS, Android, iOS and Linux are rolling out in Early Access. Check the download page for your device.