Online privacy

What does online privacy actually mean?

Online privacy means having control over what is collected about you and who is allowed to read it. It is not the same as secrecy. Somebody with nothing to hide still draws the curtains, and not because they are doing something wrong.

The subject has four layers, and the figure above the page is those four layers. The outermost is what you write yourself: a post, a comment, the number you left in a contact form. The next is what you agree to without reading: the permission you grant an app at install, the terms you tick at signup. The third is what you leave behind without writing anything: a network address, a time, the page you arrived from. And the core, the layer almost nobody thinks about, is what gets inferred from the three above it.

Our position is plain: being concerned is right, being frightened is not. Nobody is sitting behind each of your clicks watching. What actually happens is mechanical and slow and statistical, and that is exactly why it can be managed. The distance between a careful user and a careless one is a few small decisions, not one big laborious change.

One distinction is needed too. Security means nobody can get into your account; privacy means how much somebody with lawful, official access to your data gets to know about you. The second has no technical fix and is a decision. For the first, the security track carries the tools separately.

Where does the thing you never wrote down come from?

Every server in the world writes one line into a log file for every request, and ours is no exception. One real line from this site log, taken in the same window in which this lesson was verified, held these: the visitor network address, the exact time, the page they asked for, the page they came from, and the string their browser said about itself. The visitor had written none of it. Not one.

Now look at what comes out of that single line. The browser string said Android, Chrome version 152 and a phone, so the device, the operating system and even the rough generation of the handset are known. The referrer field said this visitor arrived through a link carrying a came-from-ChatGPT marker, so the route of arrival is recorded too. The time says when they were awake. And if the same line repeats for ten pages in a row, their order says what the visitor was after.

This is the inference layer: the thing nobody declared, assembled by putting traces side by side. The adverts that feel uncannily accurate come from here, not from a microphone. An advertising company does not need to know who you are; it is enough to know what a device with this behaviour responds to.

And this is exactly why "but I never post anything" is not an answer. Three quarters of what is kept about you was never postable in the first place.

Why is giving less away the only principle that actually works?

Because everything else happens after the data is collected and is therefore late. Encryption, a privacy policy, a delete-account button: none of them take back what has already been copied. Data minimisation means giving less from the start, and it is the only move whose effect is not reversible by somebody else.

In practice that is four habits. A form asking for name, email, phone and date of birth when it exists to hand you a file should be asking for the email only. An account you have not opened in three years should be closed, not abandoned. An app that does its job with one grant of access should not get permanent access. And whatever you write in a public group or comment should be written on the assumption that it is permanent, because it is.

The server side is exactly the same thing, and we run it on this site. Three of them can be checked right now with any online header tool: the site declares that it will never ask the browser for location, microphone, camera or payment; it does not hand the next site the full address of the page you were on and sends only the domain name; and the logs are kept for seven days and after that they are gone. None of these three makes a visitor feel anything, and none of them is visible. Doing it properly usually looks like this.

Our position, which not everybody shares: a cookie consent banner that sets tracking cookies before you click is worse than no banner. It has both done the thing and claimed a permission it never got. The details are opened up by the internet and networks track, in its lesson on cookies.

How do you review an app permissions?

Once a year, twenty minutes. On Android go from settings into the permissions section; on iPhone go from settings into privacy and security. Both have made one thing easy that used to be hard: instead of walking app by app, you can look from the permission side, that is, see which apps have location, which have the microphone, which have your contacts. It is the second view that surprises people.

The question to ask about each one is in the figure below and it is only one question: does this app do the thing you installed it for without this permission? A maps app does not work without location and that permission is right. A photo editor works perfectly well without contacts, and that permission has nothing to do with its job.

There are three choices most people do not know exist. First, "while using the app" instead of "always"; for location this one matters more than any other setting. Second, approximate location instead of precise, which is enough for a weather app and is not enough for turn-by-turn navigation. Third, one-time access, which is taken back on its own once you close the app.

And one item worth its own minute: access to all photos. Both operating systems now let you hand an app a few selected pictures only. An app that just wants you to set a profile picture has no need whatsoever for your whole library.

Where should you be concerned, and where not?

A simple ordering, arranged by real harm rather than by which item sounds scariest.

The most harm sits where your data ties to money or identity: a national ID number, a photograph of a bank card, the number your one-time codes arrive on, and a password reused across several services. Nobody wants these for advertising; they want them in order to pass themselves off as you. The least harm sits where the data is only used to sell you something; that is irritating and it is recoverable.

Between the two is a category that gets underrated: data that reveals location and relationships. Where you are at seven every day and who you are with is more sensitive than any advertising interest, and it is exactly what an "always" location permission collects quietly.

And what we think is not worth worrying about: a news site knowing you came from a phone, a shop knowing you looked at one pair of shoes three times, Google knowing you like football. If you have a limited amount of energy for this subject, spend it on the first category and let the last one go.

One next step that earns its time: today, open the list of interests that has been inferred for you in your Google account and read it. Most people do not expect that list to be as long as it is, and that single read turns this lesson from a text into an experience.