People¶

Civil

Being watched, for most people, is not a decision someone made about them. They were swept into systems built to collect everyone, before any question of individual interest arises. That changes what defence means: the instinct to hide is largely beside the point, and the useful work is shrinking the surface a person presents and keeping the data already held about them accurate, correctable and bounded.

From concern to action¶

Concern	What can help
Data brokers hold and sell a profile	Remove personal data from broker sites, minimise what is stored, reset the advertising ID, pay privately
Followed from site to site and app to app	Block trackers, use a VPN, turn off Chrome’s Topics
“Anonymous” data traced back to a name	Keep identities separate, ask for deletion
A photo or a writing style used to attach a name	Foil facial recognition
Messages or email read in transit, or where others can reach them	Use encrypted messaging, protect email privacy
One reused or leaked password opening the rest	A password manager, two-factor authentication
Hidden metadata in photos and files pointing back to a name	Strip photo metadata, clean file metadata
A lost or seized device exposing what is on it	Encrypt the device
Devices searched at a border or on a risky trip	Prepare devices for travel
Smart-home devices watching from inside the network	Isolate them on a guest network
A device that may be monitored or compromised	Suspected device compromise
An account taken over, a phishing link clicked, or private details posted	Account compromise, phishing response, doxxing response
Data harvested now to decrypt once the cryptography breaks	Quantum-resistant encryption
Swept up by bulk collection	Little to do alone; argued at Nations and states and Systems effects

One thing first¶

An overwhelming list produces inaction; a short list of high-leverage changes produces movement. If only one thing gets done, a password manager and two-factor authentication on the main email account close the most common routes to compromise more than any other single step. Everything else can follow, in whatever order makes sense. Security fatigue is rational; the answer is to sequence, not to lower the bar.

The reach of personal action¶

The surveillance around ordinary life is extensive, but it is not monolithic. Reducing surface area helps even where exposure cannot be removed entirely: a greenhouse with better locks is safer than one with none, even if the walls stay glass.

Some of it, though, personal hygiene cannot reach. The data broker market runs on terms that are technically disclosed and practically unreadable, and opting out profile by profile is laborious and incomplete while the market carries on regardless. That part is a structural condition, and it is argued at Nations and states and Systems effects. Supporting the organisations that press for data protection is not separate from personal security; it is the half of it that individual action cannot buy.

Last reviewed: 2026-07-09.