Online Privacy Basics: Simple Steps Anyone Can Take

Online privacy advice often jumps straight to VPNs and encrypted everything, skipping the simpler steps that matter just as much - and are a lot easier to actually do. Here’s a practical order of operations, from lowest to highest effort.

1. Check what you’re actually exposing (5 minutes)

Before changing anything, it helps to know your starting point:

• Run our Privacy & Browser Leak Checker to see if WebRTC is leaking your IP, whether cookies are enabled, and whether canvas fingerprinting is possible in your browser.
• Check your public IP and approximate location - this is the baseline every site sees by default.

You can’t fix what you don’t know is exposed, and both of these run entirely in your browser with nothing sent to a server.

2. Use a password manager (15 minutes to set up)

Reused passwords are the single biggest cause of account compromise - one breached site leaks credentials that get tried everywhere else. A password manager generates and stores a unique password per site, so one breach doesn’t cascade into every other account you own.

3. Turn on two-factor authentication (a few minutes per account)

For anything that matters - email, banking, primary social accounts - 2FA means a leaked password alone isn’t enough to get in. Prioritize your email first, since it’s usually the recovery method for everything else.

4. Review what your browser and apps actually track

• Check your browser’s privacy settings for third-party cookie blocking (most modern browsers default to blocking these now, but it’s worth confirming).
• Periodically review app permissions on your phone - location, microphone, and contacts access granted to apps that don’t need them for their core function.

5. Understand what a VPN or proxy actually adds (and doesn’t)

A VPN or proxy hides your IP address from the sites you visit, replacing it with the VPN/proxy’s own. This is genuinely useful for:

• Not letting every site you visit build a location and browsing history tied to one identifiable IP.
• Protecting your traffic on untrusted networks (public Wi-Fi).

What it does not do: make you anonymous if you’re logged into accounts, protect against phishing, or fix weak passwords. It’s one layer, not a replacement for the steps above. If you’re deciding between the two, see our Proxy vs VPN comparison - and if you already use one, run the leak checker to confirm it’s actually doing what you think it is, since WebRTC leaks can bypass both silently.

The realistic takeaway

Perfect privacy isn’t the goal - meaningfully reducing your exposure with a few concrete steps is. The password manager and 2FA alone address the failure modes that actually cause most real-world account compromises, and they take less time than most people assume.