Protecting data privacy starts with reducing unnecessary sharing and securing the accounts that hold your information. Different tools protect different parts of that process. Encrypted DNS, a VPN, an authenticator app and a private browser window are useful in specific situations; none makes every online activity private.
This guide helps you choose controls according to who might see your information, what matters to you and what you can realistically change. Start with your email account, device access and app permissions before buying another privacy product.
Privacy and security solve different problems
Security concerns unauthorized access or changes. Privacy concerns how information is collected, used, shared and retained, including by services you deliberately use. A securely stored profile can still contain more information than you want a company to hold.
Make a short inventory: your main email, financial accounts, cloud storage, messaging accounts and shared devices. For each, record the type of information stored, who should have access and the consequence if access is lost. Do not put passwords or recovery secrets in that inventory.
Secure the accounts that unlock other accounts
Use unique passwords rather than repeating one across services. A password manager can make that manageable. Keep its recovery method secure, and learn how you would regain access after losing your device.
Where supported, consider passkeys or FIDO security keys. Passkeys use cryptographic credentials tied to the service, providing phishing-resistant sign-in. Secure the device and any credential-manager account that stores them, and check the service’s fallback recovery routes. FIDO Alliance passkey guidance.
An authenticator app that produces rotating codes removes SMS delivery from that factor, but manually entered codes can still be stolen by a phishing page. Read our OTP scam prevention and account-recovery guide for the distinction.
Understand what each network tool protects
| Tool | Scope | Boundary |
|---|---|---|
| HTTPS | Encrypts the connection to the website | The site can still receive the data you submit and track your visits |
| DNS over HTTPS | Encrypts supported DNS queries between client and resolver | Does not encrypt all application traffic or hide queries from that resolver |
| VPN | Routes covered traffic through an encrypted connection to the VPN provider | Changes who you trust; websites can still recognize signed-in accounts and trackers |
| Private browsing | Limits retention of browsing-session data on the device | Does not make your activity invisible to websites or network administrators |
RFC 8484 defines DNS over HTTPS for DNS queries and responses. Switching your DNS setting is not equivalent to adding encryption to every app. Your chosen resolver still handles the queries, so consider its privacy policy and any workplace network requirements.
A VPN can be useful when you need a different network route, but it is not an anonymity guarantee. Cookies, tracking pixels, fingerprinting and account sign-ins remain relevant. Review the provider’s ownership, logging explanation, supported protocols and independently documented audits rather than treating a “no logs” slogan as proof. We have not compared or endorsed commercial providers here. EFF’s VPN guidance.
Private browsing primarily changes what the browser retains locally. It does not conceal your activity from the websites you visit, your employer or internet provider. Logging in identifies you to that service even in a private window. Chrome’s Incognito documentation.
Reduce what apps and websites can collect
- Review permissions: look at location, microphone, camera, contacts and photo access. Keep only permissions needed for features you use. Prefer narrower choices, such as selected photos, where offered.
- Check sharing settings: inspect public profiles, shared folders, calendar links and document links. Confirm the intended recipients and remove access that is no longer needed.
- Check browser settings: review cookie controls and extensions. An extension’s permissions can matter as much as the browser’s privacy settings.
- Minimize form fields: provide information needed for the transaction. Pause before giving identity documents or unrelated personal details.
- Review connected apps: remove integrations you no longer use, especially those with access to email, files or account management.
Blocking or deleting cookies can reduce some tracking, but browser fingerprinting is another mechanism for linking activity. Combining controls is more realistic than assuming one setting stops every tracker. EFF’s explanation of tracking mechanisms.
Protect your device and recovery routes
Keep your operating system, browser and apps updated. Lock your device when it is unattended. Review notification previews if sensitive messages appear on a locked screen. Keep a backup of important files and check how restoration works before you need it.
Check carrier account protection against unauthorized number transfers where offered. An account PIN or transfer lock adds a check; it does not guarantee prevention. A SIM PIN protects use of the SIM itself and is a separate control. Do not treat either as a substitute for securing account-recovery settings. Our SIM swap guide explains the distinction.
A practical privacy review worksheet
- Account: what information does it hold?
- Access: who can sign in or use a shared link?
- Recovery: are the listed contacts current and secure?
- Collection: which permissions or optional data can you remove?
- Retention: what can you delete or archive, and what does the service say it retains?
- Verification: record the date, change made and next review date.
Privacy rights and deletion obligations vary by location and service. Use the service’s verified privacy contact and applicable local guidance for a rights request. Deleting an account may not remove information already copied or retained under another obligation.
If information has already been exposed
First determine what was exposed: a password, an active session, personal documents or payment details require different responses. Contact the affected service independently, secure account access and review recovery settings and sessions. Preserve incident references privately. If money or identity misuse is involved, use your provider’s verified fraud channel and the appropriate authority in your location.
Avoid paying an unsolicited “recovery expert” or uploading more identity documents to an unverified portal. A privacy tool cannot undo information that someone already obtained.
Glossary
- DNS resolver: the service that answers domain-name queries.
- Fingerprinting: linking activity using characteristics of a browser or device.
- Recovery route: a method of regaining account access.
- Data minimization: limiting collected or shared information to what is needed.
Sources and editorial review
Updated 1 October 2026. This guide draws on the linked IETF standard, FIDO guidance, browser documentation and EFF explanations. It distinguishes documented capabilities from practical review suggestions. No independent product testing, legal assessment or guarantee of anonymity is claimed. Send corrections through our contact page.
Written and prepared by Kshitij Gupta.
