">

Protecting your personal data is less about secret networks and more about extra copies. Brokers, apps, and old logins keep those copies.

Can you cut that trail without leaving the internet?

You can.

Begin with the accounts that reset everything else. Then lock the sensors on your phone. After that, go after the people-search listings you never created.

U.S. consumers don't get one master delete key. The useful work is still local, account by account.

Your privacy is a patchwork, not one federal switch

Company policy runs a lot of this. The privacy notice you clicked is often the real rule for that app.

Federal law does not currently give every American a GDPR-style dashboard for ordinary commercial data. The FTC can police unfair or deceptive practices. That helps after a company lies. It is not a settings menu.

California residents get more specific tools. State law covers opting out of the sale or sharing of personal information, and a state portal can reach registered data brokers. Other states wrote different privacy statutes. Don't assume a California form fixes an account tied to another state.

EU rules stay EU rules. They may bind a European company. They don't replace the "download your data" and "delete account" buttons inside a U.S. product you use every day. Thing is, your settings still do the work.

A reused password will beat a statute. Lawsuits are slow. Settings are not.

Fix the logins that already know you

Skip the shopping tab. Do this first.

  1. Give email, banking, and your main store unique passwords. A password manager is how normal people keep that straight.
  2. Turn on two-factor authentication. Use an authenticator app or a hardware key when the site offers one. A text-message code still beats no second factor.
  3. On Google, Apple, Microsoft, and any social login, open the security or apps page. Kick off devices and third-party apps you don't recognize.
  4. Close zombie accounts, or at least remove the stored card, the one you forgot was sitting there.

Use a separate email for merchants and quizzes if you can. That keeps your primary address off a chunk of resale lists.

Private browsing only hides local history from the next person on your laptop. The website still sees you. Your network sees you too.

Your phone leaks more than your laptop

Open the permission screen and treat it like a house key list.

On iPhone, that's Settings, then Privacy & Security. Apple documents the same map in its privacy controls, and it is worth reading once so you know which toggles actually stop tracking. You can refuse those tracking prompts.

You can also share approximate location instead of a precise pin, about 10 square miles rather than your driveway. Turns out a coupon app with "always" location is a tracker you installed on purpose.

Start here:

Android hides the same levers in the permission manager. Review location, contacts, camera, and microphone. In your Google account, you can opt out of ad personalization.

Home cameras and speakers should not still use the sticker password. Update the firmware. A guest Wi-Fi network is a decent fence if your router has one. Fitness and symptom checkers often sit outside hospital privacy rules. Read that app's policy before it uploads a sleep log.

Data brokers, and California's DROP request

People-search sites did not need your blessing. They stitch public records, purchases, and other feeds into a page that looks like you.

If you live in California, use the state's Delete Request and Opt-out Platform (DROP). You verify residency, then send one deletion request toward registered brokers. CalPrivacy launched DROP on January 1, 2026. Starting August 1, 2026, those brokers have to pull requests and check their files at least every 45 days. Matches get deleted on a cycle. Some exemptions still apply. CalPrivacy explains the match process.

If you've ever searched your own name and found an old address, a middle initial, and relatives you never listed, that's the broker file in miniature, and it keeps growing back because one polite email to one site never reaches the next reseller that already bought a copy, which is why a repeated, official request beats a one-off contact form. That's why the state portal exists.

DROP is not a wipe of your bank, your insurer, or the store you still shop. It targets data brokers in California's registry, over 600 of them per the agency.

Outside California, you still can contact individual brokers and the three nationwide credit bureaus. Paid removal companies exist. You don't have to use them.

If a breach already happened

Start with the accounts that move money. Then the email that resets those accounts.

Follow the CFPB's identity theft steps. The FTC's IdentityTheft.gov process can give you an Identity Theft Report and a recovery plan.

  1. Place a fraud alert with Equifax, Experian, or TransUnion. The one you call must notify the other two.
  2. Tell your bank and card issuer about any charge you don't recognize.
  3. Change the password on the breached site, and on every other site that shared that password.
  4. Save the emails and case numbers. You'll want them if a collector calls later.

There are initial alerts and extended alerts. Extended alerts tie to an identity theft report. If you're deployed in the military, the CFPB page has extra alert rules. Use that official list, not a screenshot from social media.

Ask the bureaus about freezing your credit file if you want a harder block on new accounts.

What extra software actually changes

A VPN encrypts traffic between your device and the VPN service. Cafe Wi-Fi gets less interesting. Your internet provider sees less of the destination list.

To be honest, that does not make you anonymous.

A VPN will not:

Tracker-blocking extensions cut a lot of advertising noise, and swapping to a search engine that does not keep a long query profile takes about a minute. Neither one replaces the account work above.

Skip public Wi-Fi for banking if you can. Your phone's cellular connection is the boring, good option. Reject optional cookies when the banner lets you. "Accept all" is how extra profiles get built.

Hardware keys are worth the drawer space for email and your bank. Keep backup codes off the same phone that holds the passwords.

Pick the email account that recovers everything else. Turn on app-based two-factor authentication before you go to bed. If mystery apps are still attached, revoke them. California residents can submit a DROP request after residency checks out.

That's an afternoon of unglamorous work. Most people never do it.