The step-by-step guide
How to protect your privacy online (2026)
Privacy isn't one switch you flip — it's a short stack of habits and a few good tools, done in order of impact. This is the plan we'd give a friend: what to do first, what to do this week, and exactly where paying is worth it.
Last updated: July 10, 2026 · Researched and (for ad blockers) measured by the Privacy Intact team; see how we review.
Already breached, hacked, or found your data online? Start here.
If something has already happened — a breach email, an account you can't get into, your details on a people-search site — do these first, then come back for the full plan:
- From a device you trust, change the password on the affected account and on your email — make both new and unique.
- Turn on two-factor login for those accounts.
- Check Have I Been Pwned to see what else of yours has leaked, and change those passwords too.
- If money or your identity is involved, freeze your credit and call your bank.
- In your email and key accounts, sign out all other sessions (most providers have a "log out everywhere" option) so an attacker who's already logged in is kicked out — not just locked out of the new password.
- Check your email for sneaky auto-forwarding rules and unfamiliar connected apps.
Start at the top and work down
Steps run top-to-bottom by impact: the first few take ~20 minutes and block how people actually get hacked — do those today; spread the rest out. Where a tool is genuinely the answer we point you to our free-first guide for that job; where you can do it yourself for nothing, we say so.
Every step, scored by impact and effort
Our rating of where to spend your time first. Impact is how much a step cuts real-world risk; effort is the rough time and difficulty for a typical person; cost flags where a paid upgrade exists. These are our editorial judgement calls — shown openly, not lab measurements — so you can start where it pays off most.
| Step | Impact | Effort | Cost |
|---|---|---|---|
| Password manager + unique passwords | High | ~20 min | Free |
| Two-factor login (email & money first) | High | ~5 min each | Free |
| Update everything + auto-updates | High | ~10 min | Free |
| Ad & tracker blocker | Medium | ~2 min | Free |
| Harden your email account | High | ~15 min | Free |
| Review app & account permissions | Medium | ~20 min | Free |
| VPN on untrusted Wi-Fi | Medium | ~10 min | Free or paid |
| Lock down social media | Medium | ~15 min | Free |
| Remove your data from brokers | Medium | Ongoing | Free or paid |
| Zero-knowledge cloud for sensitive files | Medium | ~30 min | Free or paid |
| Freeze your credit (US) | High | ~15 min | Free |
| Private browser & search engine | Medium | ~10 min | Free |
Notice the pattern: every top-impact move is free and quick.
The plan
Start here — 20 minutes, all free
The highest-impact moves online, and none of them cost a cent. If you only do this tier, you're already ahead of most people.
Get a password manager and stop reusing passwords
Reusing one password is how a single breach becomes ten — attackers take a leaked login and try it everywhere. A manager makes every account unique and remembers them for you. Bitwarden is free and gives you unlimited passwords on unlimited devices, with zero-knowledge encryption; for most people that's all you need.
Turn on two-factor authentication — starting with your email
Even if your password leaks, a second factor blocks the most common automated attacks. Start with your email — it can reset almost everything else — then any account that holds money. Where it's offered, prefer an authenticator app or a passkey over a texted code: an app code can't be grabbed in a SIM-swap the way an SMS code can (where an attacker tricks your carrier into moving your number to their phone). Best of all is a passkey — it replaces the password entirely and is phishing-resistant — or a hardware security key as a phishing-resistant second factor. Many banks still only offer texted codes — turn that on anyway, it's far better than nothing.
Update everything — then turn on automatic updates
Unpatched software is one of the most common ways devices get compromised — often a bigger risk than which antivirus you run. Keep your phone, computer and browser current. On Windows the built-in Microsoft Defender scored a perfect 18/18 in AV-TEST's January–February 2026 Windows test (top marks for protection, performance and usability), so once you're patching, it's enough for most people. On a phone you don't need a separate antivirus app at all — iOS and Android sandbox apps and scan for malware themselves.
Install an ad & tracker blocker
It closes a major route for malware and tracking, and the web gets noticeably faster. uBlock Origin is free, open-source, and topped our own AdBlock Tester browser benchmark at 96/100 — ahead of AdGuard's free extension (77), and far better than running no blocker at all (full method on our ad-blocker page). One catch: for full strength run it in Firefox; on Chrome, Google's Manifest V3 has phased out the full uBlock Origin, leaving its lighter successor uBlock Origin Lite, which can't filter as aggressively. On a phone, use a system-wide or Safari content blocker, or DNS-level blocking.
This week — lock the doors
An hour, spread across a few sittings. This is where you close the gaps attackers and trackers actually use.
Treat your email as the master key
Your inbox can reset the password on almost everything else, so it earns your strongest unique password and two-factor login. While you're in there, check for sneaky auto-forwarding rules and remove unfamiliar connected apps — a classic sign someone's been poking around.
Review app and account permissions
Revoke the location, microphone, camera and contacts access that apps don't actually need, and remove old third-party apps connected to your Google, Apple or Facebook account — on iOS: Settings → Privacy & Security; on Android: Settings → Privacy → Permission manager. Most people are surprised by what's quietly on that list.
Use a VPN on untrusted Wi-Fi
On public or shared networks, a VPN keeps your traffic private. It also stops your internet provider from seeing which sites you connect to — though you're really shifting that visibility to the VPN provider, which is why a no-logs policy and independent audits matter. Most "free unlimited" VPNs monetise your data instead; Proton VPN's free tier (unlimited data, no logs, no ads and no data-selling) is the standout exception. It's not a magic anonymity shield, though — we're clear about what a VPN does and doesn't do. The free tier covers untrusted Wi-Fi; if you also want full speed and streaming, our Best VPNs guide shows which paid plan is worth it.
Tighten your social-media privacy settings
Set profiles to private, limit who can see your posts, friends list and birthday, and switch off ad-personalisation and off-platform activity tracking — the profile a platform builds from your behaviour on other apps and sites. It shrinks what strangers, and the data brokers scraping public profiles, can collect on you.
Shrink your footprint — the longer game
Not urgent, but this is what separates 'careful' from 'genuinely hard to profile.' Do it when the quick wins are in place.
Get your data off the broker sites
Data brokers quietly compile and sell profiles of you — address, phone, relatives, buying habits. Doing it by hand is free but slow: there are hundreds of brokers and they re-list you (California residents can also use the state's free DROP platform). A removal service automates the whole grind from about $3.99/month and keeps re-removing you as you reappear — which is exactly what makes it worth the money — and the mainstream automated services are month-to-month with a 30-day money-back window, so you can stop anytime.
Move sensitive files to zero-knowledge cloud
Google Drive, Dropbox and iCloud (by default) can read what you store — they hold the keys. Zero-knowledge storage can't: only you hold the key. Sync.com gives you 5 GB, with zero-knowledge encryption on the free plan too, so the private option costs nothing to start — and when you need more room, our Best cloud storage guide shows which paid plan keeps that zero-knowledge protection.
Freeze your credit
If you're in the US, a security freeze is free at all three major credit bureaus and is the strongest defence against someone opening NEW credit accounts in your name — and you can thaw it in minutes whenever you genuinely need credit. It won't stop takeover of accounts you already have (that's what unique passwords and 2FA are for), but it shuts the door on new-account fraud. For fuller US cover, also freeze the lesser-known files: Innovis, and the NCTUE telecom-and-utility exchange. Outside the US the principle is identical — lock new-credit applications and unlock them when you need credit: in Canada through Equifax and TransUnion, in the UK via a CIFAS Protective Registration, and through your national credit bureau elsewhere.
Switch to a more private browser and search engine
A privacy-respecting browser (Firefox or Brave) paired with a non-tracking search engine (such as DuckDuckGo) quietly cuts a lot of background profiling — at no cost and very little effort. It also makes the ad blocker above work even better. While you're at it, switch on encrypted DNS (DNS-over-HTTPS, or your phone's "private DNS" setting) so your internet provider can't log every domain you look up — a one-time, no-cost toggle in your OS or browser.
The habits that keep it working
Tools set you up; habits keep you safe. None of these cost anything:
- Slow down on links and attachments. Most account takeovers start with a convincing email or text. If a message creates urgency — 'verify now or lose access' — that's the tell. Don't click; go to the site directly.
- Check what's already leaked. Search your email on Have I Been Pwned (haveibeenpwned.com), or turn on your password manager's built-in breach alerts, and change the password on anything it flags. It's the fastest way to find the reused passwords attackers already have.
- Save your recovery codes. When you switch on two-factor login or set up a password manager, store the backup/recovery codes — and your manager's emergency kit — somewhere offline. Losing your phone or master password without them can lock you out for good.
- Share less by default. The data that can't leak is the data you never handed over. Skip the optional phone number, the real birthday on a shopping site, the quiz that wants your contacts.
- Back up the things you'd hate to lose. A simple 3-2-1 backup — three copies, on two different kinds of storage, with one kept off-site or in the cloud — turns ransomware or a dead hard drive from a disaster into an annoyance.
- Re-check once or twice a year. Permissions creep back, you sign up for new things, breaches happen. A 20-minute review keeps the setup honest.
Privacy myths that waste your time
“I need to go completely anonymous.”
You don't, and you can't — total anonymity is a full-time project most people neither need nor want. Realistic privacy is about reducing your exposure, not disappearing. Every step above moves the needle without that effort.
“Privacy costs money.”
The highest-impact moves on this page — unique passwords, two-factor login, updates, an ad blocker, a credit freeze — are all free. Paid tools buy real convenience and reach — and for some people that's well worth it; we flag exactly where.
“Incognito mode makes me private.”
It mostly doesn't. Private/incognito windows clear your local history and cookies when you close them — useful — but your ISP, your employer or school network, and the sites you visit can all still see you. It is not a VPN and not anonymity.
“I've got nothing to hide.”
Privacy isn't about secrecy, it's about control — over who gets your data and what they do with it. The brokers building a profile on you, and the scammers buying it, don't care whether you have anything to hide.
FAQ
Protecting your privacy, answered
What's the single most important thing I can do?
Put a unique password on every account (a password manager does this for you) and turn on two-factor authentication for your email and bank. That one pairing blocks the most common way people actually get hacked — a reused password from an old breach. It's free and takes one afternoon.
Do I need to pay for any of this?
No. Every step in the first two tiers can be done for free, and a credit freeze is free too. Paid tools — a fast no-logs VPN, hands-off data removal, more cloud storage — buy real convenience and reach, and we flag exactly where they're worth it and where they're not.
Is a VPN enough to stay private?
No single tool is. A VPN is genuinely useful on untrusted Wi-Fi and for keeping your ISP out of your browsing, but it doesn't make you anonymous, block malware, or stop data brokers. Privacy is a stack of small habits and a few good tools, not one purchase — which is the whole point of this guide.
How long does all this take?
The 'start here' tier is about 20 minutes. The 'this week' tier is roughly an hour, easily split across a few sittings. The longer-game items you can do whenever. You don't have to do everything at once.