| Action | What it changes | Planning use |
|---|---|---|
| Review settings on a schedule | Devices, apps and browsers get a recurring check, although settings do not always stop information being shared | Set a repeating reminder and treat settings as a way to reduce exposure, not a guarantee. |
| Choose your own settings | Defaults are replaced by deliberate choices | Open each major account and set its options yourself instead of accepting what ships. |
| Turn on multifactor authentication | A second layer protects the account even if the password is compromised | Start with the accounts that hold the most personal data. |
| Use secure networks and consider a VPN when travelling | Information sent over unsecured Wi-Fi may be viewed by others | Plan for a VPN on trips and avoid sensitive tasks on open networks. |
The table summarises guidance from the North Carolina Department of Information Technology and the University of Michigan Ross School of Business IT team.
Knowing how to protect online privacy comes down to a short, repeatable routine: tighten settings, secure sign-ins, limit app access and avoid untrusted networks. No single tool covers every risk.
For the legal side of who may collect and sell your data, see our guide to data privacy laws explained. The sections below cover the practical side: what is at stake, which settings to change and how to audit them.
What default settings cost you
Leaving defaults in place means accepting someone else’s choices about your data. The University of Michigan Ross School IT guidance advises choosing your own privacy settings rather than accepting the defaults, and notes that most apps and websites collect some information about you when you use them or visit. Collection on its own is routine. The consequence comes from where the data ends up.
North Carolina’s Department of Information Technology warns that companies often sell this data to build detailed profiles about you, covering habits, interests, buying patterns and health information. Businesses that trade in personal data this way are commonly called data brokers, and a profile built from many small pieces can say more about you than any single account does.
Settings reduce this exposure but do not remove it. The same North Carolina guidance reminds readers that privacy settings do not always prevent information from being shared. That is a reason to combine several measures instead of relying on one toggle.
- Treat company promises as limited to that company. Google states that its products are private by design and that it never sells personal information to anyone. That statement covers Google products, not the other apps and sites you use.
- Use retention controls where they exist. Google says it set the default to automatically and continuously delete core activity data after 18 months, and that privacy and ad settings let you choose what is right for you. If you rely on a service with such controls, check what they are set to rather than assuming.
- Accept that this is ongoing work. A setting changed once can be undone by an update or a new feature, which is why the audit checklist below is built to be repeated.
Sign-in protection that limits the damage
A stolen password is the most common way an account is opened by someone else, so the sign-in is where protection pays off first. The University of Michigan guidance explains that two-factor authentication provides an extra layer of security that stops criminals from using a stolen password to compromise your account. North Carolina’s guidance frames multifactor authentication the same way: it adds protection even if your password is compromised.
In practice, the password stops being a single point of failure. Even a leaked or guessed password is not enough on its own. Turn it on wherever an account offers it, beginning with the accounts that would do the most harm if taken over.
Passwords still matter because the second factor is a backup, not a replacement. The insurer Chubb suggests combining lower and upper-case letters, numbers and symbols and changing passwords periodically. Reusing one password across sites defeats the point, and remembering many distinct ones is unrealistic. North Carolina’s guidance says password managers generate unique, secure passwords and can store them automatically. Our explainer, Password Managers Explained: Why You Need One And How It Protects Your Digital Life In 2026 – Technopolicy, covers how they work and what to look for.
- If you already use a password manager: run its password checkup, a feature Google lists alongside passkeys, Sign in with Google and password managers as ways to log in more safely.
- If you do not: adopt one before changing anything else, because every later step involves new credentials.
- If an account offers passkeys: they are one of the sign-in options Google highlights, so consider them for accounts that support them.
App permissions, tracking and social profiles
Apps and trackers
Every installed app is a standing relationship with a company that collects some information about you. The practical consequence is that the more apps and browser extensions you keep, the more places your data can flow. The consumer-protection firm CPAI advises deleting any apps and browser extensions you do not use, because they can keep collecting data in the background.
Two further settings address tracking directly. CPAI recommends disabling cross-app tracking in your phone settings and disabling ad customization in the apps you use. Both reduce how easily one company can follow you across services, though North Carolina’s reminder that settings do not always prevent sharing still applies.
Social profiles
Social accounts expose the most personal detail to other people, so audience settings matter as much as tracking settings. Chubb advises checking your privacy settings so you know who is seeing your posts, and limiting what you share about your location and birthday. Decide who each kind of post is for before posting, since a setting applied afterwards does not recall what has already been seen.
This also suits anyone worried about profiling: details you never post cannot be collected from your profile.
Networks and the VPN question
Whether you need a VPN depends on where you connect, not on how much you care about privacy. The University of Michigan guidance warns that information you send may be viewed over an unsecured Wi-Fi network. Chubb adds that most free public Wi-Fi networks have very few security measures, so others on the same network could access your activity.
A VPN addresses exactly that exposure. CPAI describes it as encoding your browsing information so it is unreadable to hackers, and it also hides your location. The Michigan guidance recommends considering its institution’s VPN when travelling.
- Travellers and public Wi-Fi users: a VPN is a sensible addition, since open networks are the risk the guidance describes.
- People who stay on networks they trust: a VPN is less pressing. Use secure networks and avoid sending sensitive information over unsecured ones.
- Anyone hoping a VPN solves tracking: it concerns the connection. It does not change what an app collects once you use it, so the settings above still need attention.
Privacy audit checklist
Run this checklist on a schedule, because North Carolina’s guidance advises regularly checking and adjusting settings on devices, apps and browsers. Work through it in order, since the first items protect the later ones.
- Settings: open privacy settings on each device, app and browser, and replace defaults with deliberate choices.
- Updates: turn on automatic updates on your phone and computer, as CPAI recommends, and keep applications updated and patched, as the Michigan guidance advises.
- Sign-in: confirm multifactor authentication is on and that no two accounts share a password.
- Tracking: confirm cross-app tracking and ad customization are off.
- Clean-out: remove apps and extensions you no longer use.
- Profiles: recheck who can see posts, plus location and birthday sharing.
- Retention: look at activity controls on services that offer them, including auto-delete.
Biometric tools raise their own data questions, and Facial Recognition Technology: 7 Real Benefits Transforming Security, Service, And Efficiency In 2026 – Technopolicy gives a different angle on how personal data is used in security.
Frequently asked questions
How do I protect my privacy online?
Combine several measures: multifactor authentication, unique passwords from a manager, deliberate app and social settings, and secure networks. Repeat the checks regularly instead of relying on one change.
What settings should I change?
Start with the privacy and ad settings on major accounts, then cross-app tracking on your phone, ad customization in apps and who can see your social posts. Avoid keeping default values by default.
Do I need a VPN?
Mainly if you travel or use free public Wi-Fi, where others on the network could access your activity. It protects the connection, not what apps collect.
Do privacy settings stop all data sharing?
No. North Carolina’s guidance notes that privacy settings do not always prevent your information from being shared, so pair them with fewer apps and careful posting.
Does Google sell my personal information?
Google states that it never sells personal information to anyone. It also describes a default of automatically deleting core activity data after 18 months.
