Turn the dial down too far and you don’t just disappear, you break + 20 Things you can do now.
The privacy conversation usually goes one of two ways. Either people don’t think about it at all, or they romanticize full anonymity, off the grid, no footprint, ghost mode. The first is negligence. The second creates its own problems.
Try buying a house, qualifying for life insurance, opening a business banking account, or getting an SBA loan with no digital footprint. Automated underwriting doesn’t care about your philosophy. It pulls credit, cross-references identity against public records, validates address history, and scores you against a risk model built entirely on the assumption that you exist in a traceable and consistent way. Go too dark and the algorithm doesn’t find you mysterious. It finds you a liability, or it doesn’t find you at all.
The goal isn’t zero exposure. It’s controlled exposure. There’s a difference.
Here are 20 things you can actually do, ranked loosely from easy to more deliberate.
1. Freeze your credit at all three bureaus. Equifax, Experian, TransUnion. Free, reversible, and closes off one of the most common identity exploitation vectors. Takes about 15 minutes. Most people have never done it.
2. Turn off Bluetooth when you’re not using it. Android apps use Bluetooth scanning to build location profiles without ever asking for GPS permission. Researchers have shown that Bluetooth signals can be used to fingerprint and track specific devices, and that even toggling Bluetooth off from the control center on some phones doesn’t fully stop beacon emissions. Kill it at the OS level when you don’t need it.
3. Turn off WiFi when you’re not connected. Your phone is constantly broadcasting probe requests looking for known networks. Those broadcasts include identifiers that can be passively logged by anyone running a scanner. Retailers, event venues, and data brokers use this. Researchers found that 86% of analyzed apps collect device identifiers, GPS coordinates, and WiFi scan results, often without meaningful user awareness.
4. Delete free apps that have no reason to need your location. Weather apps, navigation apps, coupon apps, and family safety apps frequently request location access and share it with data brokers via embedded SDKs, sometimes without the app developer even being fully aware. Free means the data is the product. If an app is free and wants your location, you’re the inventory.
5. Audit every app’s location permissions right now. On iPhone: Settings > Privacy & Security > Location Services. On Android: Settings > Location > App permissions. Anything set to “Always” that doesn’t need it gets changed to “Never” or “While Using.”
6. Disable WiFi scanning and Bluetooth scanning in location services. Both iOS and Android allow apps to use WiFi and Bluetooth radio data to infer location even when GPS is off. This is a separate setting from location services itself. Find it and turn it off.
7. Understand that your carrier already sold your location data. In 2024 the FCC fined AT&T, T-Mobile, Verizon, and Sprint nearly $200 million for selling customers’ real-time location data to third-party aggregators without consent. They say they stopped. They still store it. Law enforcement can still get it. The data that already moved is already gone.
8. Stop using SMS for two-factor authentication. SMS is not encrypted. SIM swapping is a documented, common attack. Use an authenticator app, Authy or Google Authenticator at minimum, a hardware key like a YubiKey if the account is worth it.
9. Use a registered agent service for any business entity. Costs under $150 a year. Keeps your home address off public corporate filings, which are searchable by anyone, including people who want to find you. This is not spy tradecraft. It’s basic hygiene.
10. Search yourself on data broker sites and submit opt-out requests. Start with Spokeo, Whitepages, BeenVerified, Intelius, and MyLife. Each has a removal process. It’s tedious. Do it anyway. Then do it again in six months because they repopulate.
11. Use a password manager and stop reusing passwords. If one account gets breached, every account with the same password is compromised. A credential stuffing attack is automated and takes seconds. Bitwarden is free and open-source. 1Password works. Either is fine.
12. Remove metadata from photos before posting them publicly. Photos taken on a smartphone embed GPS coordinates, device model, and timestamp in the EXIF data. A photo posted publicly with location metadata tells anyone who looks where you were and when. On iPhone, turn off location tagging in camera settings. On Android, same. Strip existing metadata with a tool like ExifTool before posting anything sensitive.
13. Stop logging into apps and websites with Google or Facebook. Every time you use “Sign in with Google” or “Sign in with Facebook,” you’re adding a data point to a profile that already has a lot of data points. Create a separate account. Use an alias email if the service doesn’t require verified identity.
14. Use an alias email for accounts that don’t need your real one. SimpleLogin and Apple’s Hide My Email generate forwarding addresses that route to your real inbox. When a service gets breached or starts spamming, you disable the alias. Your real address stays clean.
15. Pay attention to your car. Senators have urged the FTC to investigate car companies caught selling and sharing customer driving data without clear consent. If your vehicle has a connected services subscription you don’t use, cancel it. It’s collecting driving history, location, and in some cases braking and acceleration data that gets sold to insurers.
16. Use a VPN on public WiFi, always. Coffee shops, hotels, airports. Anyone on the same network can intercept unencrypted traffic. A VPN isn’t a magic privacy shield, but it encrypts your connection and keeps your traffic off the local network. Mullvad and ProtonVPN are solid. Free VPNs have the same problem as free apps.
17. Lock down your social media location data. Most platforms log approximate location with every post and session. Turn off precise location for every social media app. Check your account settings for stored location history and delete it.
18. Use a browser that doesn’t build a profile on you. Chrome reports back to Google. Firefox with uBlock Origin is a reasonable step up. Brave goes further. For searches, DuckDuckGo or Brave Search over Google, which correlates searches with your account and device identity.
19. Separate your personal and professional exposure surfaces deliberately. Different email addresses, different phone numbers if feasible, different accounts for personal and business use. When everything runs through one identity, one breach or one subpoena covers everything. Compartmentalization is just architecture.
20. Run yourself as a subject before someone else does. Google your name, your phone number, your address, your email. Check court record search tools for your county. Look at what your corporate filings expose. This is what I do at the start of every due diligence engagement, and the results usually surprise people. You cannot manage exposure you haven’t measured.
The dial metaphor holds because the decision is always contextual. When you’re building credit, turn toward visibility. When you’re in litigation, tighten up. When you’re doing ordinary commerce, maintain reasonable defaults and stop volunteering more than the transaction requires.
What you don’t want is to find out someone else has been adjusting your dial for you. Data brokers, your carrier, the free app you installed three years ago and forgot about, the address on a business filing from 2019. That’s not a privacy failure. It’s an awareness failure. And it’s the more common one.
Want to know where your dial is actually set?
I offer paid privacy consulting for individuals and small businesses. One session, no ongoing commitment. We look at your actual exposure and you leave with a clear picture of what’s visible, what’s at risk, and what’s worth fixing.