None of this requires a technical background. Work through these roughly in order — each builds on the last.
The single highest-impact step. Data brokers are the source most other tracking eventually feeds into.
Most large data brokers are legally required to offer an opt-out or deletion request — it's usually a form on their site, not a phone call.
30–60 min, one-time per brokerA handful of states now require brokers to register publicly, which makes it possible to find brokers you'd never have known existed.
15 min researchTexas and Oregon also publish registries — search "data broker registry" on your Secretary of State's site.
Several reputable services automate the broker opt-out process for a subscription fee — useful if you want the effect without doing dozens of individual requests.
Ongoing, paidReclaim City walks you through real broker opt-outs, account security, and spotting scams one mission at a time — free, no account needed, and everything stays local to your browser.
Free, self-pacedReduce what's collected from you day-to-day, not just what's already out there.
Firefox, Brave, or Safari with strict tracking protection all meaningfully reduce cross-site tracking compared to a default Chrome install.
15 min, one-timeSearch queries are some of the most revealing data about you. A search engine that doesn't log queries to your identity closes that gap.
5 minBoth iOS and Android have a setting to limit ad tracking and reset your advertising ID — it's buried in privacy settings, not front and center.
5 min per deviceMost apps default to "always" location access when "while using the app" or "never" is enough. This alone shuts down a huge amount of location-broker data.
15 minMake the content of your conversations something only the people in them can read.
Signal is the standard reference point here — messages are encrypted so that not even the service provider can read them.
10 min setupReduces how much history exists to be exposed later in a breach, device search, or account compromise.
2 min per chatStandard email is not private by default — an encrypted provider closes that gap for the messages that matter most.
30 min setupReduce what's assembled about you from records and cameras you don't control.
Search your own name in quotes, along with your city, to see what's easily discoverable — this is often the first step attackers and brokers alike take.
10 minThese sites compile public records into searchable profiles. Most have an opt-out process, even if it's intentionally tedious to find.
1–2 hrs, one-timeA few states already give residents specific rights over biometric data or restrict facial recognition — worth knowing what's already on the books where you live.
15 min researchSome protections already exist today, patchwork as they are — use them while we push for something more permanent.
If you live in a state with a comprehensive privacy law (a growing list, including California, Colorado, Connecticut, Virginia, and others), you likely already have a right to request the data a company holds on you, correct it, and ask for deletion — check your state attorney general's site for the exact process.
Universal opt-out signals — like the Global Privacy Control — let your browser automatically tell every site you visit that you're opting out of data sales, without filling out a form on each one individually.
Most breaches don't happen through some elaborate hack — they happen through a reused or guessable password.
Bitwarden, 1Password, and similar tools generate and store a unique password per site, so one leaked account doesn't unlock the rest of your life.
30 min setupPrefer an authenticator app or a hardware key over SMS codes — SIM-swap attacks can intercept text messages, but not a physical key or app-based code.
5 min per accountBreach-notification services can tell you if an email address has shown up in a known data breach, so you know exactly which passwords to rotate first.
5 minProtects against the specific harm most people actually fear: someone using your data to open credit in your name.
A credit freeze with Equifax, Experian, and TransUnion is free and blocks new accounts from being opened in your name — you can lift it temporarily whenever you actually need credit checked.
15 min, one-timeReal-time alerts for any charge mean you find out about fraud in minutes, not at the end of a billing cycle.
10 minSeveral banks now offer virtual card numbers you can lock to one merchant — useful for free trials and unfamiliar sites.
Varies by bankYour router and smart devices are often the least-secured entry point into everything else you own.
Default router credentials are public knowledge and actively scanned for — this is one of the most-skipped basic steps.
10 minMost security patches close a vulnerability that's already being actively exploited elsewhere.
OngoingCheck retention settings for voice recordings and camera footage, and delete stored history on a regular basis.
15 minOrganizations doing this work full-time, if you want more than this page can cover.
The Electronic Frontier Foundation maintains an in-depth, regularly updated guide covering threat modeling, encryption, and tool-by-tool walkthroughs.
Plain-language guides on your existing legal rights around data, breaches, and identity theft, organized by topic.
If your state has a comprehensive privacy law, the AG's office is usually where the actual request forms and deadlines live.
Answer a few questions about your devices and habits and get a personalized, prioritized checklist — a good way to turn this whole page into a to-do list.
Everything above stops new profiling or hardens what's yours. This is the next layer: making the profile that already exists less trustworthy. See exactly how that profile gets built first →
Extensions like TrackMeNot run background searches on unrelated topics, mixed in with your real ones, so no single query pattern reads cleanly as "you."
15 min setup, then automaticTools like AdNauseam silently click ads in the background, flooding your ad-interest profile with irrelevant signal until targeting on it gets unreliable.
15 min setupFor sign-ups that carry no legal weight — newsletters, loyalty programs, in-store surveys, app onboarding quizzes — inaccurate demographic answers degrade the profile without being fraud on anything that matters. This does not apply to tax, financial, medical, identity, or government forms — falsifying those is a different thing entirely, and illegal.
No extra time, just a habitWhere a store allows more than one rewards account, or none tied to your real identity, splitting purchases across identities breaks the single continuous purchase history a profile depends on.
VariesOne person's noise is a rounding error the models absorb without notice. Thousands of people doing this at once measurably raises the error rate of everyone's profile — that's the actual goal, not individual invisibility.
Ongoing, collectiveAdvanced. The same idea as the section above, one layer down — your Wi-Fi, Bluetooth, and short-range radios are trackable even when you're not connected to anything.
What a "probe request" and a BLE advertisement actually reveal, why MAC address randomization doesn't fully close the gap, and which open-source projects broadcast harmless decoy identifiers to muddy the signal — plus a clear line between that and an actual (illegal) jammer.
Read the deep diveAdvanced. Telematics sold to your insurer, "smart city" infrastructure being built to read new cars directly, and old cars tracked by equipment they've had since 2007.
How OnStar-style "driving score" programs ended up setting insurance premiums, what the federal V2X rollout means for new cars, and why your tire pressure sensors alone are enough to build a movement history — no connected services required.
Read the deep diveEvery item above is something you're doing manually because the law doesn't yet require it to happen automatically. That's exactly what Section 11's universal consent signal and Section 15's access rights would change.
Social media lockdown
Social platforms are often the richest, most voluntarily-supplied source of the data brokers later resell.
Run each platform's built-in privacy checkup
Facebook, Instagram, X, and TikTok each have a privacy-review flow buried in settings — it takes minutes and resets defaults that quietly drifted back open.
10–15 min per platformTurn off precise location tagging on posts
Photo metadata and location tags are one of the most common ways someone's routine or home address becomes trivially discoverable.
5 minLimit who can look you up by phone number or email
Most platforms let anyone with your phone number or email find your profile by default — worth checking and narrowing.
5 min per platformReview third-party app connections
Old quiz apps and games you forgot about often still have standing access to your profile data years later.
10 min