Online Privacy in Practice: What Each Company Knows

Online privacy advice is usually a list of settings, delivered without explaining what the settings are actually for. That leads to a lot of clicking with little effect. It is more useful to start from one fact: the vast majority of data collection is not mysterious and is not the thing you would worry about. It is a handful of known mechanisms, and each one has a specific setting that addresses it.

The four mechanisms that matter

Cookies and local storage. Small files a site stores to remember you. First-party cookies keep you logged in. Third-party cookies let a completely different company follow you between sites, which is the mechanism behind most cross-site advertising.
Server logs. Every request records your IP address, user agent, timestamp and the page requested. Retained for a period set by the operator, and accessible to them and often to nobody else.
Account data. What you typed in, which is the largest and most sensitive category: email, phone, address, purchases, messages, files.
Fingerprinting. Deriving a stable identifier from the combination of your browser characteristics, fonts, screen and hardware. No cookie is involved, so clearing cookies does nothing, and blocking it requires a different approach.

Two further categories are structural rather than technical. Data brokers aggregate records from many sources and sell them, which is why your email address can appear in a breach you had nothing to do with — see people search and background checks for how that industry works. And identity providers track you across sites that embed their login button, which is a real privacy cost of convenience that people rarely price in.

The settings worth changing

In rough order of effect per unit of effort:

Use a browser that blocks third-party cookies by default

This is the single highest-impact change. Several major browsers now partition or block them, which removes most cross-site tracking without any effort from you. Check what yours does rather than assuming.
Turn on tracking protection

A content blocker with a sensible default filter set is more effective than trying to configure exception lists by hand. Be aware that some sites break, and that a very strict configuration can break more than it is worth.
Use the global privacy control where your browser offers it

Where supported, this sends a legally recognised opt-out signal for sale of your data. It is respected more widely than individual opt-outs and costs nothing.
Turn off ad personalisation in the big platforms

On the advertising settings pages of the large platforms. The setting is a genuine choice, not a toggle that appears to work — you can verify by checking whether the behaviour of the site changes.
Check your Google, Apple or Microsoft account's activity and ad settings

Your main email address is a strong identity key and is linked to far more than email. Review which third-party apps have access to your account calendar, contacts and files — this list surprises people.
Delete what you no longer use

Unused accounts are live data stores attached to an email you still own. Closing them, or at minimum removing the data, is more effective than any setting.

How to tell a real control from a decorative one

There is a reliable test, and it is not difficult. A privacy control that works changes what the company receives. A decorative one changes what the interface shows you.

Change the setting, then use a request tool such as your browser's network panel to see whether the tracking request still goes out.
Delete your account and see what the service tells you it removes. A service with a genuine deletion process tells you specifically; one without says almost nothing.
Ask whether you can export your data. Services that cannot export are frequently services that have nothing to give you, which is informative.
Check whether the setting applies to data already collected. "We no longer use it" and "we no longer have it" are very different claims, and only the second is a privacy outcome.

On your own accounts

Two places accumulate more than people expect: email and phone. Your email address is used as an identifier across thousands of services, so a breach at any of them confirms an association. Using an alias address for anything that is not your primary correspondence reduces that linkage meaningfully, and it costs nothing.

Your phone number is in a similar position, and a prepaid or secondary number for services that insist on one breaks the chain. This is not paranoia — it is the same observation that makes public records feel unsettling, applied deliberately to yourself.

What is not worth worrying about

Some visible tracking is a real trade rather than a threat. Analytics that tell a site which pages are useful, and A/B tests that decide which layout to show, generally do not identify you, and blocking them can leave you on a worse version of the site. The distinction worth holding is between a company profiling you to sell access, and a site measuring whether its content is working. Both are tracking in the literal sense; only one of them builds a dossier about a person.

Common questions

Frequently asked questions

Is incognito mode private?

It stops your browser storing history, cookies and cache locally, which is genuinely useful on a shared machine. It does not hide anything from your internet provider, the site you are visiting, your employer if they administer the device, or the network operator. And it actively breaks any site that requires a persistent login. It is a local hygiene tool, not anonymity.

Does a VPN make me anonymous?

It hides your address from the sites you visit and encrypts the hop to the VPN provider, which is real and useful on untrusted networks. It does not make you anonymous. The provider can see what you are connecting to, and the sites you visit still identify you through accounts, fingerprints and behaviour. Treat it as network privacy, which is a genuine thing, rather than as invisibility.

How do I remove my data from data brokers?

Each broker has a suppression request, and in the US a written opt-out request is legally recognised and must be honoured. Expect to repeat it: the same data is resold to other brokers. Work from the source upward, check back after a few months, and be aware that some services ask you to submit identification, which is itself a small disclosure.

Is it worth going fully anonymous?

For most people, the effort and the friction are not justified, and it comes at real costs in convenience. A pragmatic middle is well understood: unique passwords and a second factor, third-party cookies blocked, tracking protection on, a global privacy control sent, an alias address for non-essential sign-ups, and unused accounts deleted. That covers the overwhelming majority of the risk for an afternoon of work.

Where to go next

These are the services referenced above. Compare them on your own terms before you sign up for anything.