How to Protect Your Privacy Online

Most people approach online privacy like a junk drawer. They know it needs sorting, they open it, they see how much is in there, and they close it again.

The good news: you don’t need to sort all of it. A handful of steps do most of the work, and most of them are free. The trick is doing them in the right order.

Here’s the short version. To protect your privacy online, secure your accounts first, then limit app permissions, then clean up your browser, then remove your data from data brokers. Those four steps matter more than any product you can buy, including ours. The fifth step is a physical habit that covers what software can’t.

How to protect your privacy online: the 5 steps

1. Secure your accounts with a password manager and two-factor authentication.

2. Cut app permissions for location, contacts, microphone, camera and Bluetooth.

3. Switch to a privacy-focused browser and clear saved autofill data.

4. Opt out of data brokers that collect and sell your personal information.

5. Take devices offline physically when you don’t need them connected.

Each step below includes how long it takes and why it’s ranked where it is. The order matters. Steps one through four deliver the most protection for the least effort.

Why order matters more than the list

Most online privacy tips come sorted by category: passwords here, social media there, browsers somewhere else. That’s tidy, but it doesn’t tell you where to start.

This list is ranked by effort-to-payoff. The first step closes the biggest gap in the least time. Each step after that gets a little more specific.

You can stop after any step and be meaningfully better off than you were. That’s the point.

Step 1: Secure your accounts

Time: about an hour.Cost: free or a few dollars a month.

Your accounts are the front door. Email in particular is the master key, because almost every other account resets its password through it.

The two biggest risks are reused passwords and single-factor logins. When one site leaks passwords, and they regularly do, criminals try those same email-and-password pairs on banks, shopping sites and email providers. If you reuse passwords, one breach becomes ten.

What to do

• Get a password manager. It creates and remembers a unique password for every site. You only need to remember one.

• Turn on two-factor authentication (2FA), starting with email, banking and your phone carrier account. An authenticator app or passkey is stronger than a text message code.

• Use passkeys where offered. They replace passwords with your device’s fingerprint or face unlock, and they can’t be phished the same way.

• Check whether your email shows up in known breaches and change any passwords that appear.

• Update your recovery details. Make sure the backup email and phone number on each key account are current and belong to you. An old recovery address is an easy way back in for someone else.

CISA, the U.S. government’s cybersecurity agency, says multi-factor authentication makes you significantly less likely to get hacked. It’s the single highest-value setting on this list.

Step 2: Cut app permissions

Time: 20 minutes.Cost: free.

Apps ask for more access than they need because data is valuable. A flashlight app has no reason to know your location. A game has no reason to read your contacts.

Location is the big one. A record of where your phone has been shows where you live, where you work, who you visit and when you’re away from home.

What to do

• Open your phone’s privacy settings and go through location access app by app. Set most to “Never” or “While using.” Very few apps need “Always.”

• Turn off precise location for apps that only need a rough area, like weather.

• Review microphone, camera, contacts, photos and Bluetooth access. Remove anything that doesn’t make obvious sense.

• Limit ad tracking. On iPhone, turn off “Allow Apps to Request to Track.” On Android, delete your advertising ID in privacy settings.

• Delete apps you haven’t opened in months. An unused app with permissions is all cost and no benefit.

Repeat this every few months. Updates and new installs quietly add permissions back.

Step 3: Clean up your browser

Time: 30 minutes.Cost: free.

Your browser is where most online tracking happens. Third-party trackers follow you from site to site and build a profile of what you read, buy and search for.

What to do

• Use a browser with tracker blocking built in. Several block third-party trackers by default. We compare the main options in our guide toprivacy browsers.

• Change your default search engine to one that doesn’t build a profile from your searches.

• Clear saved autofill data. Browsers store names, addresses, phone numbers and sometimes card details. That’s convenient until someone else gets access. Ourstep-by-step guide to clearing autofill walks through it for each major browser.

• Audit your extensions. Remove any you don’t recognize or no longer use. Extensions can see a lot of what you do.

• Keep the browser updated. Most updates fix security holes.

Step 4: Opt out of data brokers

Time: a few hours, spread out. Or a paid service.Cost: free to moderate.

Data brokers are companies that collect personal information and sell it. That includes your name, address history, phone numbers, relatives, age and sometimes much more. Much of it ends up on “people search” sites that anyone can look up.

This is the step most people skip because it’s tedious. There are dozens of these sites, and each one has its own process. It’s also the one that removes information already out there, rather than just slowing new collection.

What to do

• Search your own name plus your city on a few people-search sites to see what’s listed.

• Use each site’s opt-out page. Most have one, usually linked in the footer. Expect to confirm by email.

• Consider a removal service if you’d rather pay someone to handle requests and repeat them. Listings can reappear, so ongoing removal is the honest expectation.

• Check your state’s options. Some states give residents extra rights to request deletion. California now runs a single deletion request that covers registered data brokers.

• Use email aliases for new sign-ups, so your real address doesn’t spread further.

Step 5: Take your devices offline, physically

Time: seconds a day.Cost: one-time.

Here’s the honest part. If you only do steps one through four, you’ve handled most of what matters for online privacy. Nothing we sell replaces them.

What software can’t do is stop a device from broadcasting. Settings can reduce what your phone shares. But while it’s on, it still talks to cell towers, scans for Wi-Fi and announces itself over Bluetooth. Settings also reset with updates, and they depend on trusting the device to follow them.

A Faraday bag removes that trust question. It’s a shielded enclosure that physically blocks cellular, Wi-Fi, Bluetooth, GPS, RFID and NFC signals. When a device is sealed inside, it can’t send or receive anything. No location pings, no background syncing, no remote access while it’s closed.

SLNT bags use patented Silent Pocket® construction, originally developed for Special Operations teams who needed devices fully offline on demand. Now the same idea works for anyone who wants an off switch that doesn’t depend on a menu.

One important limit: a Faraday bag cuts a phone’s wireless connections, but it doesn’t turn off the microphone. The mic is built into the device and still works inside the bag. For a private conversation, leave the phone in another room.

Where the habit fits

You don’t need to bag everything all day. A few moments do most of the work.

At night, the phone goes into aFaraday phone sleeve on the nightstand. No location history building overnight, no notifications pulling you awake.

In a sensitive work meeting, everyone’s phone goes in a sleeve on the table. Nobody’s device is connected to anything until the meeting ends.

At home, the car key fob lives in a Faraday pouch by the door. Relay thieves can’t pick up a signal it isn’t sending.

On a work trip, the laptop goes in a Faraday sleeve when you leave the hotel room. It can’t join networks or be reached while you’re out.

If you hold crypto, the hardware wallet stays in a Faraday pouch when it’s not in use. It only connects when you decide it should.

On a weekend you want to actually take off, the phone goes in the bag and stays there for a few hours. You stop reaching for it surprisingly fast.

Quick wins if you only have 10 minutes

• Turn on two-factor authentication for your email.

• Set your phone’s location access to “While using” for every app that doesn’t need more.

• Turn off app tracking requests in your phone’s privacy settings.

• Delete three apps you haven’t used this year.

That’s a real improvement, and it took less time than a coffee break.

Why it matters

Online privacy isn’t about having something to hide. It’s about deciding who gets to know where you are, what you do and who you talk to.

Every account you lock down, every permission you remove, every listing you take down puts a little more of that decision back in your hands. You also get some peace of mind. Fewer notifications, fewer surprises, fewer moments of wondering who knows what.

None of this needs to happen in one weekend. Start with step one. Do the next one when you have time. The order does the heavy lifting.

When you’re ready for the physical layer, ourFaraday phone sleeves are a simple place to start.

Silence the chaos.