You do not need to become a security expert to stop most of the tracking that follows you around the web. You need one afternoon, a handful of settings, and the willingness to leave a few things switched off.

Almost every guide to browser privacy starts by handing you a list of twenty extensions. This one does the opposite. Most of the work is done by four or five decisions, and the rest is noise that will slow your browser down and break the sites you use every day.

What “hardening” actually means

Hardening is not making yourself invisible. It is reducing the number of companies that get a copy of what you do, and reducing the amount they can join together. Think of it as closing the windows rather than moving house.

Before you change anything, spend two minutes on your threat model — who you are actually worried about. Someone avoiding advertising surveillance needs different settings than someone whose ex-partner has physical access to their laptop. If you skip this, you will spend the afternoon fixing the wrong problem.

Step 1: Pick a browser you trust

The single biggest decision is which browser you open in the morning. Any of the well-maintained ones will do: Firefox, Safari on Apple devices, or a Chromium browser that is not built by an advertising company. What matters more is that it updates itself automatically and that you actually keep using it. A hardened browser you abandon after a week protects nobody.

Whatever you choose, turn on automatic updates and restart the browser when it asks. Most real-world attacks use holes that were patched months ago.

Step 2: One content blocker, not five

Install a single, reputable content blocker and stop there. A good blocker removes trackers and ads in one pass; stacking three of them on top of each other mostly produces broken pages and a browser that feels slow, and it makes you more identifiable rather than less.

Expect to whitelist two or three sites — your bank, a work tool, a video player. Learn where the “pause on this site” button is on day one, so that the first broken checkout page does not make you uninstall everything.

Step 3: Turn off third-party cookies

Third-party cookies are the classic way one company recognises you across hundreds of unrelated sites. Every major browser can now block them, and in most of them it is a single switch in the privacy settings. Turn it on.

You will barely notice the difference. The sites you log into use their own cookies, which keep working. What stops working is the invisible handshake between a news site and the ad networks and data brokers behind it.

Step 4: HTTPS-only and a better DNS

Switch on HTTPS-only mode. Your browser will then refuse to load pages over an unencrypted connection without warning you first. On the modern web this breaks almost nothing, and it removes a whole family of problems on public Wi-Fi.

Then consider encrypted DNS. Every time you visit a site, something has to translate the name into a number, and by default your internet provider does it and can see the list. Encrypted DNS moves that lookup to a provider you pick, over an encrypted connection. Be honest about the trade: you are choosing who sees your browsing list, not making it disappear.

Step 5: Separate profiles for separate lives

This is the step people skip and later wish they had not. Use one browser profile for your logged-in life — email, banking, work — and a second one for general reading and searching. Two profiles cost you nothing and break the easiest way to link your identity to your browsing.

If your browser supports container tabs, the same logic applies inside one window: the social network in one container cannot see what you do in another. Whichever mechanism you use, the rule is the same — the profile where you are logged in as yourself should not be the profile where you browse everything else.

Step 6: Decide what survives closing the window

Now choose how much your browser remembers. The comfortable setting is to clear cookies and site data when you quit, while keeping your history and bookmarks. The stricter setting clears everything. Either is fine; what matters is that you decided rather than accepting the default.

If you clear cookies on exit, you will log in more often, so use a password manager — and for a start the one already built into your browser or phone (Apple, Google) is perfectly good, because anything is better than reusing one password everywhere. Private windows are a different tool: they forget locally, but the sites and networks you visit still see you.

Step 7: The address bar and your default search

Two small settings with a surprisingly large effect. First, turn off the suggestions that send everything you type in the address bar to a search engine as you type it — including the half-finished thoughts you never pressed enter on. Second, change your default search engine to one that does not build a profile of you. You can always run a single query on the big engine when you need it.

Fingerprinting, honestly

Even with cookies gone, sites can guess who you are from the combination of your screen size, fonts, language, time zone and graphics hardware. This is fingerprinting, and it is the part of this guide where the honest answer is: you can reduce it, not eliminate it.

Anti-fingerprinting features in mainstream browsers help against lazy tracking. Anything stronger means accepting real inconvenience — a browser that lies about your screen, blocks fonts, and looks broken. If you need that level of protection, you are in the territory of Tor rather than a hardened everyday browser, and it is worth knowing where that line is before you cross it.

Your phone, in ten minutes

Phones deserve their own afternoon, but three settings cover most of it: install a browser that supports content blocking and set it as your default, turn off the advertising identifier in the system privacy settings, and go through the list of apps that have location permission and set most of them to “while using the app” or never. Ten minutes on the phone is often worth more than an hour on the laptop.

The afternoon, in order

• Update your browser and turn on automatic updates.
• Install one content blocker. Just one.
• Block third-party cookies.
• Switch on HTTPS-only mode; set up encrypted DNS if you are comfortable with it.
• Create a second profile: logged-in life in one, everything else in the other.
• Decide what gets cleared when you quit, and set up a password manager.
• Fix the address bar suggestions and your default search engine.
• Do the three phone settings.

That is the whole list. If a step fights you, skip it and come back — a browser you can live with beats a perfect configuration you abandon on Tuesday.

What this doesn’t solve

A hardened browser does not protect your messages once they leave the browser; for that, see our guide to encrypted messaging without the myths. It does not hide your traffic from your employer if you are on a managed device, it does nothing about what you voluntarily post, and it will not stop a company you have an account with from collecting what you do while logged in.

What it does do is make you a much harder target for the routine, industrial-scale tracking that treats every reader as a data point. That is a realistic goal, and you can reach it before dinner.

Nobody reads privacy policies. That is not a moral failing — the average policy runs to several thousand words of deliberately elastic legal language, and you are usually asked to accept it while standing in a queue or setting up a new phone. The good news is that you do not have to read one. You have to search one.

With your browser’s find function and a fixed list of words, you can pull the five things that actually matter out of almost any policy in about ten minutes. More importantly, you can do it the same way every time, which means you can compare one service against another instead of just feeling vaguely uneasy about all of them.

This guide assumes no legal training. It works best on a laptop with Ctrl+F (Cmd+F on a Mac). On a phone, use Find in page from the browser’s share or menu sheet.

What you are actually looking for

A privacy policy is not a promise to behave well. It is a disclosure document — a list of the things the company has reserved the right to do. Reading it tells you the outer boundary of what may happen to your data, not what is happening today. That distinction is the whole reason a ten-minute reading is worth anything: you are mapping the boundary, not auditing the behaviour.

Five questions do almost all the work. What do they collect? Why do they say they need it? Who else receives it? How long do they keep it? And what can you actually switch off or take back? Everything else in the document is scaffolding.

Minutes 1–2: make sure you have the right document

Companies rarely keep everything in one file. Expect a privacy policy, a separate cookie or tracking notice, the terms of service — which sometimes contains the data clauses that matter most — and increasingly a set of regional supplements: a section for the EEA and the UK, another for California, another for Brazil or Japan. The supplement that names your region usually grants you more than the main text does, so find it before you read anything else.

Two things to check immediately. First, the last updated date at the top. A policy that has not been touched in three years on a service that has just added an AI assistant is out of date, and that is useful information in itself. Second, whether the page you are on is a friendly summary with a link to the real version. Summaries are written by the marketing department; read the one written by the lawyers.

Minute 3: the sharing words

Search for: third part, share, sell, partner, affiliate, service provider, vendor. Truncate the words as shown — searching for third part catches both party and parties.

Pay particular attention to the sentence we do not sell your personal information. Under several data-protection laws, selling means an exchange for money, so a company can hand your data to advertising partners in return for services and still say, truthfully, that it does not sell anything. California’s law added the separate word share precisely to close that gap. This is why share tells you more than sell does.

Affiliates is the other word worth slowing down for. It means other companies inside the same corporate group, and in a large group that can be hundreds of entities in dozens of countries. A policy that permits sharing with affiliates for the purposes described has permitted quite a lot.

Minute 4: the purpose words

Search for: legitimate interest, consent, personalis and personaliz, advertising, improve our services, research, train, model.

To improve our services is the most flexible phrase in the genre and can cover anything from crash reports to product design. What you want to know is whether your content — messages, documents, photographs, search queries — is used to train machine-learning models, and whether that use is opt-in, opt-out, or neither. If the policy mentions training, search nearby for opt out and see what you find.

Legitimate interests is a lawful basis under the GDPR that does not require your consent. It is legal and often reasonable, but it must come with a right to object, so search for object as well. If a policy leans on legitimate interests and never explains how to object, that is a gap worth noting.

Minute 5: retention

Search for: retain, retention, how long, delete.

You are looking for a number — thirty days, twelve months, seven years. For as long as necessary for the purposes described in this policy is not a number; it means indefinitely, at the company’s discretion. Note also whether backups and logs are carved out of the retention rules, because they usually are, and whether deleting your account deletes your data or only your ability to log in. Those are very different things, and good policies say which one they mean.

Minute 6: the controls, and how much friction they carry

Search for: your rights, opt out, request, download, portab, withdraw.

Then ask the practical question, which the text will usually answer: how do you actually exercise these rights? A toggle in the settings screen is a real control. An e-mail address is a slower one. A web form that requires you to upload identity documents is a deterrent — and occasionally the identity check collects more data than the request removes. If the policy gives a response deadline, write it down; thirty days and forty-five days are the common ones, and knowing the deadline is what makes a follow-up e-mail possible.

Minute 7: who, and where

Find the name of the legal entity, not the brand, and the country it sits in. That is the company you would be dealing with if something went wrong, and it may not be the one whose logo is on the app.

Then search for transfer, adequacy and standard contractual clauses to see where data goes once it leaves your region. Finally, search for Data Protection Officer and representative. A named contact means there is somewhere to send a complaint that is not a support ticket, and many policies also name the supervisory authority you can escalate to. That single line is often the most immediately useful sentence in the whole document.

Minute 8: the escape hatches

Search for: may, at our discretion, material change, business transfer, merger, aggregate, de-identif, anonymis.

Two of these deserve real attention. A business-transfer clause means your data is treated as a company asset that moves if the business is sold, merged or wound up, and the buyer may operate under a different policy than the one you agreed to. And once data is described as aggregated, de-identified or anonymised, most policies stop treating it as personal data at all — which means the protections in the rest of the document no longer apply to it. Re-identifying supposedly anonymous datasets is a well-documented field of research, so read that word as a boundary line rather than a guarantee.

It is also worth noticing how often may appears. A document built on we may has reserved everything and committed to nothing.

Minutes 9–10: write down three lines

Open a plain text file and keep one entry per service: the name, the date you read the policy, what it collects, who receives it, what you can switch off, and one sentence saying whether you are willing to accept that. Three lines is enough.

This is the step people skip and it is the one that pays. After five services you have a comparison rather than an impression, and you can see which company is unusual. When a policy changes — and you will get an e-mail saying it has — you can check your own note in twenty seconds instead of re-reading eight thousand words.

The two-minute version

If you have two minutes instead of ten, search four words: share, retain, opt out and train. Who gets it, how long they keep it, what you can switch off, and whether you are feeding a model. That is not a complete picture, but it is enough to decide whether the service deserves the other eight minutes.

What this doesn’t solve

This method reads a document. It cannot tell you what a company actually does. A policy is a statement of permissions, and there is no way to verify compliance from the text — that takes regulators, auditors, leaks and lawsuits, which is why enforcement decisions are often more informative than any policy.

It also tells you nothing about what the software technically does on your device. Apps ship with advertising and analytics components whose behaviour is not described in any policy in a way you could check; seeing that requires inspecting network traffic, which is a different job and a different guide.

Reading the policy does not give you leverage. In most cases the offer is accept or leave, and for the services that matter most — your bank, your employer, your government, your child’s school — leaving is not on the table. Understanding what you have agreed to is still worth something, but do not mistake it for a choice.

Nor does any of this protect you from a breach. A company with an exemplary policy can still lose your data to an attacker, and the policy will contain a paragraph explaining that no method of transmission is completely secure. That paragraph is accurate.

Two further limits. A policy only covers data you hand over yourself; it does not govern what other people upload about you, which is how contact lists, photographs and tags put you into databases you never touched. And this is not legal advice: your local law may give you rights the policy does not mention, and where the two conflict, the law wins — a policy cannot sign away a statutory right, however confidently it is worded.

Ten minutes gets you a map, not a verdict. The point is that ten minutes is repeatable, and a habit you can keep beats a thorough reading you will never do twice.

  Deeplinks. Original article: Read More

This article was originally published by the Electronic Frontier Foundation (EFF) on July 20, 2026. Republished under Creative Commons CC BY 4.0. Read the original article: https://www.eff.org/deeplinks/2026/07/what-you-need-know-about-californias-drop-tool.

Featured image: “Data security privacy lock password” by Book Catalog, via Wikimedia Commons, licensed under CC BY 2.0.

The European Commission is currently finalising negotiations with the Trump administration to conclude an “Enhanced Border Security Partnership” (EBSP) Framework Agreement allowing border control authorities to screen travellers against biometric databases and profile them for security concerns. The leaked draft text suggests that the Commission significantly caved in to US’s excessive demands for unfettered information access, exacerbating travel surveillance and putting our fundamental rights at risk.

The post The EU is about to sell our most sensitive data to the US for visa-free travel appeared first on European Digital Rights (EDRi).

  European Digital Rights (EDRi). Original article: Read More

This article was originally published by European Digital Rights (EDRi). Republished under Creative Commons CC BY 4.0. Read the original article: https://edri.org/our-work/the-eu-is-about-to-sell-our-most-sensitive-data-to-the-us-for-visa-free-travel/.

Featured image: “Passports bangkok airport” by Jarcje, via Wikimedia Commons, licensed under CC BY-SA 3.0.

The Federal Communications Commission wants to require telecommunications providers to collect vast amounts of personal information from every person who wants a phone number in the name of combatting scam and spam calls. This plan will fail to combat the deluge of unwanted calls people in the United States receive every day while giving untrustworthy companies a gold mine of information that would harm everyday consumers’ privacy, access to communications, and ability to speak freely.

The requirement to provide ID and an address would completely cut off the ability to have an anonymous phone line, which would mean many people in the most precarious situations imaginable—domestic violence and human trafficking survivors, unhoused people, and children without stable homes—would not be able to gain access to a crucial lifeline. EFF, along with ACLU, has submitted comments advising the FCC to abandon this proposal entirely.

Requiring phone providers to collect consumers’ information will not appreciably decrease or eliminate unwanted calls. The FCC itself confesses in its own rulemaking that “the most effective way to prevent unwanted calls from reaching American consumers is by ensuring they never enter the network.” The Federal Trade Commission has found that a significant proportion of unwanted robocalls originate from overseas—collecting the personal information of everyone who wants to make a phone call will not put a dent in fraudulent calls.

Mass data collection of individuals does not address unwanted calls, but it does make us all less safe online. The telecommunications industry has proven time and again that they’re poor stewards of personal information, having been at the center of several large-scale data breaches in recent years, including incidents affecting tens of millions of AT&T and Comcast customers, and the Salt Typhoon attacks on the nation’s CALEA wiretapping infrastructure.

Anonymity in calls provides people the safety they may require to organize themselves, speak freely, and seek services. Anonymous phone calls give people the courage to participate in politics, reach out to a suicide or sexual-assault hotline, an addiction-recovery sponsor, seek medical care, or seek escape from a violent and coercive situation. Not everyone has the government-issued identification or stable home address the FCC’s proposal would require, which would shut many vulnerable people out of phone service entirely.

The FCC’s proposal will not decrease the amount of unwanted calls. All it will do is set up a data collection regime that harms everyday, law-abiding Americans, strips away the right to anonymous speech in calls, and disconnects those already at the margins. EFF recommends the FCC discard this proposal in its entirety.

This article was originally published by the Electronic Frontier Foundation (EFF). Republished under Creative Commons CC BY 4.0. Read the original article: https://eff.org/deeplinks/2026/06/fccs-spam-call-proposal-just-data-collection-scheme.