18 Online privacy is the ability to control how your personal information is collected, used, stored and shared when you use the internet. Achieving it requires a combination of good security practices, privacy-focused technology and careful decisions about where your data goes. Every online activity can generate data. Websites may record browsing behavior, applications collect account and device information, and online services store everything from photos and documents to financial and business records. Some collection is necessary to provide a service, while other data may be used for analytics, personalization or advertising. At the same time, cyberattacks and data breaches create another privacy risk. Information that an organization legitimately collects can become exposed if the systems storing it are compromised. The best methods for achieving privacy online address both sides of the problem: reducing unnecessary exposure and protecting the information that must be stored. 1. Use strong, unique passwords Strong passwords remain one of the simplest ways to protect online accounts. Reusing the same password across multiple services creates unnecessary risk. If attackers obtain credentials from one compromised service, they can attempt to use the same username and password elsewhere in a technique known as credential stuffing. A password manager makes it practical to generate and store long, unique passwords for individual accounts. This reduces password reuse without requiring users to memorize dozens of complex credentials. For accounts that support them, passkeys can provide another option. Passkeys use cryptographic authentication rather than a conventional shared password and are designed to resist common threats such as phishing and credential theft. 2. Enable multi-factor authentication Multi-factor authentication (MFA) requires an additional form of verification beyond a password. Depending on the service, this could include an authenticator application, hardware security key, passkey or biometric verification. MFA can significantly reduce the usefulness of a stolen password because an attacker still needs the additional authentication factor. Authentication applications and hardware security keys generally provide stronger protection against account takeover than SMS-based verification. However, any form of MFA is typically preferable to relying on a password alone. 3. Keep software and devices updated Software vulnerabilities can allow attackers to gain access to devices and the information stored on them. Operating systems, browsers, applications, routers and other connected devices should therefore receive security updates regularly. Enabling automatic updates where practical reduces the time between the release of a security patch and its installation. Older devices that no longer receive security updates deserve particular attention. Even if they continue to function normally, unsupported software can leave known vulnerabilities unpatched. 4. Use encrypted connections Encryption makes information more difficult for unauthorized parties to read. Websites using HTTPS encrypt traffic between a browser and the website. Most major browsers indicate whether a connection is secure and may warn users when a website does not support HTTPS. Virtual private networks (VPNs) provide another layer of protection by encrypting traffic between a device and the VPN provider. They can be useful when connecting through networks you do not control, including public Wi-Fi. A VPN does not provide complete anonymity, however. The VPN provider may still have visibility into aspects of network activity, while websites can use cookies, account information, browser fingerprinting and other methods to identify or track visitors. Choosing a reputable VPN provider and understanding its data-handling policies are therefore important. 5. Choose privacy-focused browsers and settings Web browsers are a major source of online data collection because they mediate much of a user’s interaction with websites. Modern browsers provide controls that can reduce tracking, including blocking third-party cookies, restricting cross-site tracking and controlling website access to information such as location, cameras and microphones. Privacy-focused browsers and browser extensions can provide additional protection against advertising and tracking technologies. Users should periodically review browser privacy settings because defaults and available controls can change as browsers are updated. 6. Limit the personal information you share One of the most effective online privacy practices is also one of the simplest: provide less information when it is not required. Social media profiles, online forms, shopping accounts, mobile applications and other services frequently request personal information. Before providing it, consider whether the service actually needs that information to perform its function. Reducing the amount of information associated with online accounts can limit the potential impact of a breach or unauthorized disclosure. This principle can also be applied to account creation. If a service does not need your precise location, date of birth, phone number or access to your contacts, there may be little reason to provide it. 7. Review application permissions Mobile and desktop applications can request access to sensitive device capabilities and data, including: Location Contacts Photos and files Cameras Microphones Bluetooth devices Local networks Some permissions are essential to an application’s function. Others may be optional. Periodically reviewing permissions makes it possible to remove access that is no longer necessary. Applications that have not been used for a long time can also be removed, reducing the number of services with access to personal information. 8. Reduce online tracking Websites and advertising networks can use several techniques to track activity across the internet. These include cookies, tracking pixels, device identifiers and browser fingerprinting. Users can reduce tracking by blocking third-party cookies, using privacy-focused browser settings, rejecting unnecessary cookies and limiting advertising personalization. Private or incognito browsing can also prevent browsing history and cookies from remaining on a device after the session ends. It is important to understand its limitations, however. Private browsing does not make a user anonymous to websites, internet service providers, employers or network administrators. 9. Be cautious with phishing Online privacy depends partly on preventing attackers from convincing users to disclose information voluntarily. Phishing messages often imitate legitimate organizations and attempt to persuade recipients to enter passwords, financial information or other sensitive data into fraudulent websites. Unexpected requests for sensitive information should be treated carefully. Instead of following a link in an email or text message, users can navigate directly to the organization’s official website or application. Password managers and passkeys can also help reduce phishing risk because credentials are associated with specific websites rather than simply entered wherever a login form appears. 10. Protect the data you store Privacy does not end when information leaves a personal device. Photos, documents, backups, application data and business information are increasingly stored in cloud and online storage systems. The privacy of that information therefore depends on how the underlying storage environment protects it. Important controls include encryption, identity and access management, authentication, logging and appropriate restrictions on who can access stored information. For organizations, the scale of the problem is considerably larger. Sensitive data may exist across on-premises infrastructure, public clouds, SaaS platforms, endpoints and backup environments. Effective privacy requires understanding where that data resides and maintaining appropriate controls throughout its lifecycle. 11. Maintain secure backups Backups are usually associated with availability and ransomware recovery, but they also have privacy implications. Backup copies often contain the same sensitive information as production systems. If those copies are poorly secured, attackers may be able to access information through the backup environment even when primary systems are protected. Organizations should apply appropriate authentication, access controls, encryption and monitoring to backup data. Immutability can provide additional protection by preventing stored backup data from being modified or deleted during a defined retention period. This is particularly useful for improving cyber resilience when attackers attempt to encrypt or destroy recovery copies. 12. Delete data and accounts you no longer need Old accounts increase the number of organizations holding personal information. Periodically reviewing unused accounts and deleting those that are no longer necessary can reduce this exposure. Where account deletion is unavailable, users can remove unnecessary personal information and revoke permissions or integrations. Organizations can apply the same principle through data retention policies. Keeping information indefinitely creates additional storage, compliance and security requirements. Data that has reached the end of its required retention period should be managed according to applicable policies and regulations. Can you be completely private online? Complete online privacy is difficult to achieve. Internet services require some information to operate. Internet service providers route network traffic, websites receive connection information, online accounts associate activity with identities, and organizations may need to retain certain records for operational or legal purposes. The practical objective is therefore to minimize unnecessary data collection and make authorized access to sensitive information more difficult to abuse. Users can substantially improve their privacy by combining strong authentication, encryption, privacy-conscious browsing and careful data sharing. Organizations must extend these principles to the infrastructure where customer, employee and business data is stored. What is the best way to protect your privacy online? There is no single technology that provides online privacy on its own. The strongest approach combines several complementary practices: Use unique passwords or passkeys. Enable multi-factor authentication. Keep devices and applications updated. Use encrypted connections. Limit unnecessary personal information. Review browser and application permissions. Reduce third-party tracking. Recognize and avoid phishing attempts. Protect stored data with encryption and access controls. Secure backups and delete data that is no longer required. For individuals, these practices reduce the amount of personal information exposed online and make accounts more difficult to compromise. For organizations, privacy also depends on maintaining visibility and control over stored data across increasingly distributed infrastructure. As more sensitive information is created and retained digitally, privacy and data security remain closely connected. Controlling access, protecting stored information and minimizing unnecessary exposure provide a practical foundation for maintaining privacy online.
