Most privacy advice fails for one reason: it asks for too much at once. You don't need to disappear from the internet. You need a short list of high-impact habits that you'll actually keep. This checklist is ordered by payoff, so even if you stop halfway through, you've covered the most important ground.
1. Fix your passwords first
Password reuse is still the single most common way ordinary people get compromised. When one site leaks, attackers try the same email and password combination everywhere else — a technique called credential stuffing. The defense is simple in principle:
- Use a unique password for every account. A password manager makes this painless.
- Generate passwords instead of inventing them. Our free password generator creates strong random passwords in one click.
- Turn on two-factor authentication for email, banking, and any account that can spend money. Prefer an authenticator app over SMS where possible.
Your email account deserves the strongest protection of all, because it can reset every other password you own.
2. Find out what has already leaked
Privacy isn't only about the future — some of your data is likely already out there. Check whether your address appears in known breach corpuses with our breach check tool, and test whether a password you rely on has shown up in leaked datasets with the password leak check. If anything comes back positive, change that password everywhere it was used, starting with your email account.
Make this a recurring habit, not a one-time event. A quick check every few months costs you two minutes.
3. Compartmentalize your email
Your email address is the closest thing you have to a universal ID online. Every service you hand it to can profile you, email you forever, and — when they inevitably get breached — leak it. The fix is compartmentalization:
- Primary address: banking, government, work, and people you know. Give it out sparingly.
- Secondary address: long-term accounts you care about but that don't need your identity.
- Disposable addresses: everything else — one-time downloads, Wi-Fi portals, coupon forms, "enter your email to continue" walls.
For that third tier, a temporary inbox is ideal. MailDrop gives you a receive-only inbox with no signup that expires automatically, so throwaway signups never touch your real address. If you're new to the concept, start with what temp mail is and how it works.
4. Cut down email tracking
Most commercial email contains tracking pixels that report when and where you open messages. Disable automatic image loading in your mail client, and be stingy about clicking tracked links. We explain the full mechanics — and every countermeasure — in our guide to how email tracking works.
5. Tighten your browser
Your browser leaks more about you than any other app you use. A few settings do most of the work:
- Use a browser or extension that blocks third-party trackers by default.
- Clear or block third-party cookies.
- Review which sites hold permissions for your location, camera, microphone, and notifications, and revoke anything you don't remember granting.
- Use HTTPS everywhere; modern browsers can warn or refuse when a site is unencrypted.
You don't need ten privacy extensions. One reputable content blocker plus sane settings beats a fragile stack of overlapping tools.
6. Starve the data brokers
Every form field is optional until proven otherwise. Practical habits:
- Give the minimum a form requires. Skip optional phone numbers and birthdays.
- Use a nickname or initials where legal identity isn't required.
- Don't sign in to unrelated sites with your main Google or social accounts; that links your activity across services.
- Before you enter an email to "unlock" content, ask whether the relationship is worth being marketed to indefinitely. If not, use a disposable inbox instead.
7. Lock down what you already have
- Review the privacy settings on social accounts once or twice a year; defaults tend to drift toward more sharing.
- Delete accounts you no longer use. A dormant account is pure liability — it can leak but never benefits you. Our guide to throwaway account hygiene covers keeping low-value accounts contained.
- Keep your devices and apps updated. Most real-world compromises exploit known, already-patched vulnerabilities.
8. Learn to spot manipulation
Technology can't save you from a convincing lie. Phishing remains the most effective attack against individuals because it targets the person, not the software. Learn the telltale signs — urgency, mismatched sender domains, credential-hungry links — in our rundown of phishing red flags, and treat any unexpected "verify your account" message as guilty until proven innocent.
The realistic standard
Perfect privacy is not the goal; asymmetry is. Every step above makes collecting and exploiting your data more expensive while costing you almost nothing day to day. Do the password work once, check for breaches quarterly, and route disposable signups through a temporary inbox — and you'll be better protected than the vast majority of people online.