Protect your online privacy: first steps

1. First decide what you want to keep private

A five-minute start: read a public page without an unnecessary login, leave optional profile fields blank, and review one website permission. Choose just one step first. You do not need every tool at once.

Perhaps you want to read gift ideas without immediately linking them to your shopping account. Or you are looking into a personal question. Privacy means having a say in who gets which information about you.

Ask yourself: What do I want to protect? From whom? How much does it matter in this situation? A shop, other people using the same device and your internet provider see different things. There is no single number for your anonymity.

2. Share only what your goal needs

Data minimisation means using as little information as possible for a particular purpose. Before you submit anything, check which fields are optional.

An everyday example: A newsletter provider needs an address to send it to. You can leave an optional birthday or phone number field empty. Delivering a parcel, on the other hand, calls for a delivery address. The point is the purpose, not a blanket ban on sharing information.

You cannot be expected to spot every hidden collection of data. Providers have a responsibility to collect less and offer understandable choices. Missing a setting does not make you to blame for unwanted uses of your data.

3. Sign in when you need the account

You can often read a public recipe without signing in. If you want to save it in your account, logging in is a deliberate choice: the service can then link that visit to your account.

That link is still possible over Tor or a VPN. Signing out does not undo earlier links. An account may use only a nickname; an email address, profile details or other linked information can still connect it to a person.

4. Match permissions to the task

A permission lets a website access something such as your location, camera or microphone. Ask yourself: Do I need that right now? Reading a restaurant menu does not need your camera. A video call may.

If a map also lets you choose a place manually, you can use that to find a café without sharing your device location. Review permissions in your browser’s website settings later and remove those you no longer need. That does not delete data already sent.

5. Being recognised does not mean your name is known

Imagine a cloakroom ticket with the made-up number 47. It helps find a coat without knowing its owner’s name. A browser identifier can similarly link visits. The comparison only explains recognition.

A real name is not needed to build a picture of someone’s interests. If an identifier is later connected to an account or information someone enters, it can reveal more about a person.

Browser characteristics are clues, not identity documents: a time zone is a setting, not proof of your location. A digital fingerprint compares many characteristics; it can be inaccurate and can change.

6. Choose tools for the job

Tor Browser sends its web connections through several relays and makes recognition harder. For ordinary websites, the destination sees a Tor exit’s IP address instead of your connection’s IP address. Your other apps are not automatically protected.

A VPN creates an encrypted connection tunnel to a provider. Encrypted means outsiders cannot simply read the contents along the way. It can help hide some connection information from the local network. In return, you trust the VPN provider. Accounts, cookies and information you share do not disappear when you use a VPN.

HTTPS encrypts the connection to the website. The website itself still receives what you send it. Check that you are on the website you intended to visit, too.

Trackers are services that follow activity online. Browser protection against known trackers can make recognition harder, but it does not catch everything. Extra extensions in Tor Browser can interfere with its protections. A long list of tools does not prove greater anonymity.

What does incognito or private browsing do? It normally keeps history and session cookies out of your ordinary browser profile after you close the private windows. It does not hide your connection IP from websites or your connection from the network provider. Downloads and bookmarks can remain.

Example: you look for a birthday present on a shared computer. A private window helps with a search history someone might later see on that computer. If you log into the shop, the shop can still link the research to your account.

7. Know the limits without worrying about everything

Someone who can observe both the beginning and the end of a Tor connection may be able to compare timing patterns. Tor does not remove this limitation. This requires a particular view of the traffic; it does not mean every website knows everything about you.

Start with one manageable step: leave an optional field empty, read without signing in, or remove an unnecessary permission. This can reduce data sharing without turning your whole life upside down.

Account security is a different goal: a unique password and an additional login factor help prevent account takeover. They do not make you anonymous to the provider. Privacy concerns who learns information; security helps prevent unauthorised access.

Self-check: you clear cookies and then log back into the same account. Is the provider definitely unable to link earlier visits? No: the account remains the same identifier. Clearing cookies also does not remove data already stored on a server.

Next: understand traces through examples

The separate traces demo shows how individual clues can work together. As you try it, ask: What was actually observed, what was only estimated, and what is a made-up example?

You do not need to enter personal details. The demo is a learning example, not a test that rates your anonymity.