Digital Privacy Tips for Beginners

Why Online Privacy Matters

Online privacy matters because information about you rarely stays where you left it. A phone number typed at checkout, a birthday on a public profile or a reused password can be copied, combined and sold, then used to scam you, break into your accounts or find your home. Privacy isn't about having something to hide. It's about deciding who gets to know what.

Scattered details become profiles. Data brokers are companies that collect and sell personal information about people they have no relationship with. Privacy Rights Clearinghouse lists their sources as public records, social media, purchase histories, loyalty programs, app usage and location tracking. One detail on its own is harmless. A profile tying your name, number, address and relatives together is not.

Exposed contact details invite scams. Scammers need a way to reach you, and a phone number reaches you directly. The FTC reported that consumers lost $470 million to scams that started with text messages in 2024, five times the amount reported in 2020.

Privacy is personal safety. In a Pew Research Center survey from September 2020, 41% of U.S. adults said they had personally experienced online harassment, and 25% had faced severe forms such as physical threats, stalking or sustained harassment. For someone leaving an abusive relationship, an exposed phone number or address is a safety problem, not an annoyance.

Leaks don't expire. You can change a password after a breach. You can't change your date of birth, and changing your phone number is a real hassle. Keeping details from getting out is far easier than chasing them down afterward. The principle is old even if the technology is new: Article 12 of the Universal Declaration of Human Rights protects everyone from arbitrary interference with their privacy and correspondence.

Your Digital Privacy Checklist, in Priority Order

If you only have half an hour, spend it on the accounts that unlock other accounts. Your email inbox receives every password reset link. Your mobile number receives sign-in codes. Your bank and payment apps hold money. Secure those first, then your devices, then the trail of data you've left around the web.

The list also covers the four core steps that CISA's Secure Our World campaign asks everyone to take: use strong passwords, use multifactor authentication and a password manager, update software, and avoid and report phishing.

Use a Password Manager and Long, Unique Passwords

Reuse is what turns one breach into many. When a site you joined years ago leaks its password database, attackers try those email and password pairs on email providers, banks and shops. If your password there was unique, the damage stops at that one site.

The rules have changed since most of us learned them. NIST's digital identity guidelines, SP 800-63B-4, tell services to require at least 15 characters for passwords used on their own, to stop forcing mixtures of character types, and to stop demanding periodic changes unless there's evidence a password was compromised. Length beats complexity. A passphrase of four or five random words is easier to remember than a short jumble of symbols, and its length makes it harder to crack.

How to start with a password manager

A password manager creates a random password for every site, keeps them in an encrypted vault and fills them in for you, so the only one you memorize is the master password. Apple's Passwords app and Google Password Manager are built in, and standalone managers such as Bitwarden and 1Password work across every platform. NIST also tells services to allow password managers and pasting, so a site that blocks them is behind the guidance, not you.

You don't have to fix everything in one sitting:

1. Pick a long master password you use nowhere else, and turn on two-factor authentication for the manager itself.
2. Change your email password first, then your bank, mobile carrier and payment apps.
3. Let the manager replace other passwords as you sign in over the following weeks, and run its security report to find reused ones.

To see whether your email address appears in a known breach, search it on Have I Been Pwned, a free breach search and alert service. A match doesn't mean you've been hacked. It tells you which old passwords to change first.

One more habit: answer security questions with made-up answers and store them in the manager. Your real first school or pet's name is often a few clicks away on social media.

Two-Factor Authentication: Choose an Authenticator App Over SMS

Two-factor authentication (2FA) asks for a second proof, usually a six-digit code, after your password. A stolen password alone then isn't enough. The FTC's guide to two-factor authentication points out that it's usually off by default: you switch it on in each account's settings, where it may be called two-step verification or multi-factor authentication. The FTC suggests starting with email, bank and credit card accounts, social media, payment apps and your tax filing site.

Second factors aren't equally strong:

Method	How it works	Main weakness
Passkey or security key	Your device or a small physical key confirms the sign-in	You need a backup method if you lose it
Authenticator app	An app on your phone shows a fresh code every 30 seconds	Can still be phished if you type the code into a fake site
Text message code	The service texts a code to your number	A SIM swap or number transfer can send your codes to someone else
No second factor	Password only	One leaked password is enough

The FTC says a texted code beats having no second factor, but calls an authenticator app safer because it can't be stolen through a SIM swap, and calls security keys the strongest option. CISA's guidance on multifactor authentication goes further, describing FIDO/WebAuthn as the only widely available phishing-resistant authentication, because it won't complete a sign-in on a fake website. Passkeys, now offered by many large services, are built on that FIDO standard.

Two habits make any method stronger. Never share a code with anyone who calls or texts you, even someone claiming to be your bank: a sign-in code is meant for you alone. And if a code or sign-in prompt arrives that you didn't request, deny it and change that account's password. If you already typed a password or code into a page you reached from a text, follow the steps in clicked a link in a scam text.

Treat Your Phone Number Like a Password

Your phone number has quietly become one of your most important identifiers. Banks text codes to it, your email may use it for account recovery, messaging apps use it as your username, and data brokers use it to link your accounts to your name and address. Yet most people give it out far more freely than any password, which creates four separate risks.

Sign-in codes and account recovery

If your email or bank lets someone reset your password through a text to your number, whoever controls that number controls the account. Check the recovery options on your main email account and lean on an authenticator app and recovery codes where they're offered.

Hide message previews on your lock screen as well, so a code can't be read off a phone left on a table. On iPhone, go to Settings, then Notifications, then Show Previews, and choose When Unlocked. On Android, look in the notification settings for the option to hide sensitive content on the lock screen. Menu names vary by version as of October 2026.

SIM swapping

In a SIM swap, a scammer talks your carrier into moving your number to a SIM card they control. The FTC's SIM swap alert explains that the scammer then gets your calls and texts, including verification codes. Warning signs include your phone suddenly losing service, or a notice from your carrier that your SIM was activated on a new device. The FTC recommends putting a PIN or password on your carrier account.

Some carriers now offer stronger locks. As of October 2026, Verizon offers SIM Protection and Number Lock in the My Verizon app, which block unauthorized SIM changes and number transfers, and AT&T offers a free Wireless Account Lock in the AT&T app. Other carriers have their own versions, so ask yours. Our guide to SIM swapping warning signs covers what to do if it happens anyway.

Data brokers and people-search sites

Search your own number in quotes and you may find it beside your name, age, address and relatives on a people-search site. That is how a stranger with only your number can learn where you live. The data broker section covers removal, and our explainer on what someone can do with your phone number separates the realistic risks from the myths.

Sharing it with strangers

The simplest protection is upstream: give your real number to fewer people. A marketplace buyer, a dating match you haven't met or a shop's loyalty program doesn't need the number that unlocks your bank account. Our list of privacy mistakes that put your phone number at risk shows where numbers usually leak.

When someone needs a text from you but shouldn't keep your number, a masking service fills the gap. Ghost sends your SMS to 100+ countries from a protected sender ID, so the recipient sees the message but never your number. Texts to the US, Canada and Europe start with "GHOST:", which tells the recipient the text came through Ghost without revealing who sent it.

Know its limits. Ghost only sends texts: it can't make calls, its messages can't contain links, and it isn't meant for receiving verification codes from other services. Masking hides your number from the recipient, not from Ghost, the carriers or lawful legal process, as the privacy summary explains. For a contact who will need to call you for months, a second number fits better, as our comparison of number masking vs a second phone number explains.

Keep Your Devices Updated, Locked and Encrypted

Updates are security fixes. The FTC's advice on protecting your phone from hackers is to install operating system updates promptly, set your phone to update automatically, and update your apps too. Do the same for your computer, your browser and your router.

Lock every device. The FTC recommends setting your phone to lock when idle and using a passcode of at least 6 digits; face or fingerprint unlock makes that painless. It also recommends turning on your phone's lost-device feature, which can locate, lock or erase it, and backing up regularly to the cloud or a computer. On iPhone that feature is Find My, and on Android it is Google's Find Hub, previously called Find My Device.

Encryption comes almost free once a lock is set. Recent iPhones and Android phones encrypt their storage when you have a screen lock, so a thief gets a locked device rather than your photos and messages. On a computer, check that full-disk encryption is on: FileVault on a Mac, and BitLocker or Device encryption on Windows, depending on your edition. Keep the recovery key in your password manager.

Check what your apps can see

Apps often ask for more than they need. EFF's guide to phone location tracking notes that some apps send your location to their providers, and that location data collected this way has been bought by law enforcement without a warrant. EFF recommends cutting location access for as many apps as possible and granting approximate rather than precise location where you can.

Review contacts, camera, microphone and photo access the same way. EFF also flags mobile advertising IDs, which apps share and which can be linked back to you. On iPhone, turn off Allow Apps to Request to Track under Privacy and Security, then Tracking. On Android, look under privacy settings for Ads and delete your advertising ID. Menu names vary by version as of October 2026.

Browser Privacy Basics: Trackers, Public Wi-Fi and VPNs

Much of the tracking on the web comes from third-party scripts and cookies that follow you between sites to build an advertising profile.

Reduce tracking in your browser

Safari, Firefox and Brave block many cross-site trackers by default. If you use Chrome, open its privacy settings and review the options for third-party cookies and ad privacy. One reputable tracker blocker, such as EFF's Privacy Badger, adds more protection. Don't pile on extensions, because each one can read the pages you visit.

Turn on HTTPS-Only Mode in Firefox or Always use secure connections in Chrome so the browser warns you before loading an unencrypted page. For search, DuckDuckGo, Startpage and Brave Search say they don't build a profile from your search history.

Private or incognito windows are useful but narrow. They stop your browser saving history and cookies once you close the window. They don't hide your activity from websites, from the network you're on or from your internet provider.

Public Wi-Fi

Public Wi-Fi is less risky than its reputation now that most sites use HTTPS, which encrypts the connection between your browser and the site. The bigger risks are fake hotspots with convincing names and sign-in pages that ask for too much. Confirm the network name with staff, distrust any Wi-Fi page that wants an email password or card details, and use your phone's hotspot for banking. At home, change the router's default admin password and use WPA3, or WPA2 if WPA3 isn't available.

What a VPN does and doesn't do

A VPN encrypts traffic between your device and the VPN company's server. That hides the sites you visit from the café network and your internet provider, and hides your IP address from the sites themselves. A VPN does not:

• make you anonymous to sites and apps you're signed in to
• stop tracking through cookies, advertising IDs or browser fingerprinting
• protect you from phishing pages, scam texts or malware
• stop the VPN provider seeing what your internet provider used to see

A VPN moves trust rather than removing it. If you use one, pay for a reputable provider that has had its no-logs claims independently audited, and avoid free VPN apps that may make money from your data. For most beginners it's worth adding after the steps above, not before them.

Clean Up Old Accounts and Social Media Settings

Every account you've abandoned still holds your email, often your phone number, and sometimes an old reused password, waiting for that company's next breach. An inbox search for "welcome" or "verify your email" will surface accounts you've forgotten. Delete the ones you don't need through the account settings, since deleting the app leaves the account in place.

For the accounts you keep:

• Remove your phone number where it isn't needed for sign-in, and turn off settings that let people find you by your number.
• Review apps connected through Sign in with Google, Apple or Facebook, and remove the ones you no longer use.
• Check the devices and sessions signed in to your email and social accounts, and sign out of any you don't recognize.

On social media, the question is who sees what. Set profiles to friends-only where you can, hide your birthday, hometown, workplace and phone number from public view, and turn off location tagging on posts. Birth dates and pets' names are common security-question answers, and they help anyone trying to impersonate you.

Payment apps count too. Venmo lets you set payments to Public, Friends only or Private, and a public payment lets anyone see who paid whom, along with the note attached. If your number or address is already being used against you, see our guide to harassing text messages and how to document them.

Remove Your Information From Data Brokers

People-search sites are where scattered details become one profile anyone can look up. Getting off them takes persistence rather than skill.

1. Search yourself. Look up your full name with your city, and your phone number in quotes. Note every people-search site that has a profile on you.
2. Opt out site by site. Privacy Rights Clearinghouse advises finding each broker's privacy policy, submitting a formal deletion request through the process it provides, and verifying your identity when asked.
3. If you live in California, use DROP. Under the state's Delete Act, a single request through the Delete Request and Opt-out Platform reaches every registered data broker. The California Privacy Protection Agency requires brokers to start processing these requests from August 1, 2026, and to check for new ones at least every 45 days.
4. Clean up Google results. Google's Results about you tool lets you request removal of search results showing your phone number, home address or email, and can email you when new ones appear. Google is clear that removal from Search leaves the information on the source page, so pair it with opt-outs. Our guide to removing your phone number from Google walks through both routes.
5. Check again every few months. Profiles reappear as brokers buy fresh data.

Paid removal services file these requests for you on a subscription. They save time, but the free routes above do the same work.

Privacy isn't a project you finish. Repeat the checkup every few months, and browse the Ghost blog when you want to go deeper on one risk.

Frequently Asked Questions

Sources

• AT&T: Learn About AT&T Wireless Account Lock
• California Privacy Protection Agency: Data Broker Registry
• CISA: More than a Password (Multifactor Authentication)
• CISA: Secure Our World
• EFF: Mobile Phones: Location Tracking
• FTC: How To Protect Your Phone From Hackers
• FTC: New FTC Data Show Top Text Message Scams of 2024; Losses Hit $470 Million
• FTC: SIM Swap Scams: How To Protect Yourself
• FTC: Use Two-Factor Authentication To Protect Your Accounts
• FTC: What To Know About Identity Theft
• Google: Remove results about you from Google Search
• Have I Been Pwned
• NIST: SP 800-63B-4: Authentication and Authenticator Management
• Pew Research Center: The State of Online Harassment
• Privacy Rights Clearinghouse: Data Brokers
• Venmo: Manage your Venmo privacy settings
• Verizon: Enable/Disable SIM Protection and Number Lock