10 Ways to Protect Your Privacy Online
Your digital footprint is larger than you think. Every website visit, signup, and online purchase leaves traces that companies and hackers can exploit. Here are 10 actionable steps to take back control of your privacy - in roughly the order of cost-to-impact ratio. Each step adds a defense, but none guarantees privacy by itself.
1. Use Temporary Email Addresses
Stop giving your real email to every website. Services like DustMail let you create disposable addresses that expire automatically. Temporary addresses reduce primary-address exposure but do not guarantee a spam-free inbox, anonymity, or protection from a breach.
The key insight: an email address is one of the strongest pseudo-identifiers on the internet. It's used by ad networks, data brokers, and credential-stuffing botnets to link activity across platforms. Every site you give your real address to is one more potential leak point. By using a different temp mail address per signup, you remove the common identifier. This can limit cross-service linkage, while other account and device metadata can remain useful after a breach.
2. Enable Two-Factor Authentication (2FA)
MFA adds a defense but does not prevent every account takeover. An authenticator app avoids depending on the SMS delivery channel, but it still has limits and needs a secure recovery plan.
If an attacker takes control of a phone number, an SMS-based factor may also be exposed. An authenticator app separates the factor from SMS delivery, but device compromise, phishing, and recovery processes still matter.
3. Use a Password Manager
Generate unique, complex passwords for every account. Popular options include Bitwarden (open-source), 1Password, and KeePass. Never reuse passwords across sites.
Unique passwords reduce credential-reuse risk after one service is breached. A password manager makes a different password for each account practical and limits reuse of leaked credentials. A temporary address can separately reduce exposure of your primary address, but it does not neutralize a leaked password.
4. Browse with a VPN
A VPN encrypts traffic between your device and the VPN server. Your ISP can still see the VPN connection, although it generally cannot see destinations or content carried inside the tunnel. The VPN provider can observe your source IP and traffic metadata, while each destination site sees the VPN server's egress IP. This reduces direct IP exposure; it does not guarantee anonymity.
Review a provider's policy, jurisdiction, and business model: a VPN shifts part of your trust from the ISP to the VPN operator.
5. Use Privacy-Focused Browsers
Switch to browsers that prioritize privacy, like Firefox or Brave. Enable tracking protection and consider using browser extensions like uBlock Origin and Privacy Badger.
Browser fingerprinting is increasingly the dominant tracking method now that third-party cookies are dying. Tools like Mullvad Browser, Tor Browser, or hardened Firefox configs actively reduce your fingerprint by standardising user-agent and screen properties. Combine that with strict tracking protection, and a sizable chunk of the ad-tech industry simply can't see you.
6. Review App Permissions
Regularly audit the permissions granted to apps on your phone. Revoke access to contacts, location, and camera for apps that don't need them.
Mobile permissions are where the most invasive tracking happens because the apps already have a stable identifier (your device). Pay particular attention to Background location, Contacts, and Bluetooth permissions - these are routinely abused by “free” apps to build location and social graphs. iOS App Tracking Transparency made a real dent in this but you still need to actively review.
7. Use Encrypted Messaging
Switch to end-to-end encrypted messaging apps like Signal for sensitive conversations. Regular SMS and many popular chat apps don't encrypt your messages.
Signal is the gold standard because it's built by a non-profit, the protocol is open source, and the metadata footprint is intentionally minimal. WhatsApp uses the same underlying Signal protocol but its metadata sits on Meta servers - a meaningful difference depending on your threat model. Avoid SMS for anything sensitive: it's plaintext over a network operated by carriers and intermediaries.
8. Limit Social Media Sharing
Review your social media privacy settings. Limit who can see your posts, remove personal information from your profiles, and be mindful of what you share publicly.
Public-facing profiles are also data sources for OSINT-driven phishing. The more information attackers can scrape (employer, hometown, kids' names, hobbies), the more convincing their bait becomes. The minimal-information profile is the best defence: a small avatar, a generic bio, and posts visible only to actual contacts.
9. Use Separate Email Addresses
Maintain different email identities for different purposes: one for banking, one for shopping, and temporary emails for one-time signups. This limits the damage from any single breach.
Think of it like compartments on a ship - if one floods, the others stay watertight. DustMail Premium combined with a custom domain makes this practical: you can have [email protected], [email protected], and catch-all temp addresses for everything else, all served by DustMail's infrastructure.
10. Keep Software Updated
Security patches fix known vulnerabilities. Keep your operating system, browser, and apps updated to protect against the latest threats.
Updates apply fixes for known vulnerabilities and can reduce exposure to attacks that target unpatched software. Enable auto-update on every layer where you reasonably can: OS, browser, browser extensions, password manager, authenticator app. The friction of monthly updates is nothing compared to a compromised account.
What to do this week
If the list above feels overwhelming, do these three things in the next seven days:
- Set up a password manager and migrate your top 10 accounts.
- Move 2FA off SMS onto an authenticator app for those same accounts.
- Use temporary email for the next signup you make - any signup. Build the habit.
The rest of the steps compound on top. Want a deeper dive into the role of disposable email specifically? Read our guide on why temporary email matters in 2026.