What can you do?

When a site sells your data

Data selling and sharing · Does the company sell users' personal information?

Once sold, your data can be resold and combined with other sources. You can't take it back, but you can stop future sales.

• Turn on Global Privacy Control (GPC). Firefox, Brave and DuckDuckGo have it built in. In California, Colorado, Connecticut and several other states, businesses must treat it as a request not to sell or share your data. link
• Use the site's "Do Not Sell or Share My Personal Information" link, usually in the page footer.
• If you no longer use the service, ask it to delete your data, then close the account.

When your data is shared with advertisers

Data selling and sharing · Is personal information shared with third parties for advertising or marketing?

Ad partners use it to follow you across other sites and apps and build a profile of your interests.

• In the site's account settings, look for "ad preferences" or "ad personalization" and turn it off.
• Use a browser that blocks third-party trackers (Firefox, Safari, Brave) or add a content blocker such as uBlock Origin. link
• On your phone, tap "Ask App Not to Track" on iPhone, or delete your advertising ID on Android (Settings > Privacy > Ads).

When a site collects sensitive data

Collection scope · Does the company collect sensitive categories of data (precise location, biometrics, health, financial, or government ID)?

Precise location, health, biometric and financial data can reveal where you live, your habits and your health, and causes the most harm if leaked.

• In your phone's settings, give apps location access only "while using" and turn off precise location where the app doesn't need it.
• Leave optional profile fields empty, and don't connect health or fitness data unless you need the feature.

When a site gets data about you from other companies

Collection scope · Does the company obtain information about users from other companies (data brokers, partners, social networks)?

Data brokers and partners fill in what you never told the site yourself.

• Remove "Log in with Google/Facebook/Apple" connections you no longer use, in each of those accounts' security settings.
• California residents can ask every registered data broker to delete their data in one request through the state's DROP platform. link
• Opt out of the largest people-search sites one by one, or use your state's data broker registry to find them.

When a site keeps your data for an open-ended time

Retention and deletion · How long is personal information kept?

Data that is kept longer is exposed longer, to breaches, new uses and new owners if the company is sold.

• Turn on auto-delete for activity and history where the site offers it, and delete old content you no longer need.
• When you stop using a service, delete the account instead of leaving it dormant.

When deletion is only offered in some places

Retention and deletion · Can users have their personal information deleted?

Your right to delete depends on where you live, and the company only promises it where the law requires.

• Ask anyway. Many companies honor deletion requests from everyone, even where the law doesn't require it.
• The EU and UK (GDPR), California and a growing number of US states (including Colorado, Virginia and Texas) give residents a legal right to deletion.

When access to your data is limited

User rights · Can users access or export the personal information held about them?

Seeing what a company holds about you is the first step to correcting or deleting it.

• Look for a "download your data" tool in the account's privacy settings (for example Google Takeout or Facebook's "Download your information").
• Send an access request. Under GDPR the company must answer within one month; under California law, within 45 days.

When opting out of tracking is limited

User rights · Can users opt out of tracking, targeted advertising, or the sale or sharing of their information?

Without a working opt-out, tracking for ads and profiling is the default.

• Choose "Reject all" on cookie banners, and turn on Global Privacy Control in your browser. link
• Block trackers at the browser level, so you don't depend on each site's settings.

When security is described only in general terms

Security · Does the document describe specific security measures (such as encryption, access controls, or audits)?

A promise of "reasonable security" tells you nothing about how your data is protected.

• Use a unique password for this site (a password manager makes this easy), so a breach here can't unlock your other accounts.
• Turn on two-factor authentication, preferably with an authenticator app or a passkey rather than text messages.

When the site doesn't promise to tell you about a breach

Security · Does the company commit to notifying users of a data breach?

You may not find out your data was exposed until it is misused.

• Sign up for free breach alerts for your email address at Have I Been Pwned. link
• Use a unique password and two-factor authentication, so one breach stays contained.

When your data trains AI

AI and model training · Does the company use users' data or content to train AI or machine-learning models?

Your posts, messages or files may be used to build AI models, and that can't be undone once a model is trained.

• Check the privacy or data settings for an AI training opt-out. Many services have added one, often turned on by default.
• In the EU and UK you can object to this use of your data under GDPR, even without a setting.
• Keep private content out of public posts and shared files you wouldn't want in a training set.

When you give the site a broad license to your content

AI and model training · Do users grant the company a broad license to their content (for example worldwide, royalty-free, sublicensable)?

The site, and companies it licenses to, may copy, modify and distribute what you post.

• Keep your own originals somewhere else, and think twice before posting work you want to control.
• Many licenses end when you delete the content, but not all, and copies others have shared can remain. Check the terms.

When the site may share data with authorities

Government requests · Under what conditions does the company disclose information to governments or law enforcement?

Almost every company complies with valid legal orders. What differs is whether it also shares voluntarily.

• Look for the company's transparency report, which shows how many government requests it gets and how often it complies.
• For sensitive conversations, use end-to-end encrypted apps such as Signal, where the company can't read your messages at all. link

When the site won't tell you about government requests

Government requests · Does the company commit to notifying users about government requests for their data?

You may never learn that your data was handed over.

• Check whether the company publishes a transparency report, and prefer services that commit to notifying users where the law allows.

What a VPN does, and what it doesn't

A VPN hides your IP address from the sites you visit and hides which sites you visit from your internet provider or the Wi-Fi network you're on, which is useful on public Wi-Fi. It does nothing about what a site does with data you give it once you log in: a VPN won't stop a site from selling, sharing or training AI on your data. Using a VPN moves your trust from your internet provider to the VPN company, so choose one with an independently audited no-logs policy.

Passwords and two-factor authentication

Use a password manager so every account gets a unique password, and turn on two-factor authentication, preferably with an authenticator app or passkey. Most account takeovers come from passwords reused across sites.

Blocking trackers

Most cross-site tracking runs through third-party cookies and scripts. Firefox, Safari and Brave block many of them by default; a content blocker such as uBlock Origin blocks more. Turning on Global Privacy Control also sends a legal opt-out signal in several US states.

Your privacy rights

Depending on where you live, you can ask a company what it holds about you, ask it to correct or delete that data, and opt out of its sale. The EU and UK (GDPR), California and a growing number of US states give these rights by law. A short email to the address in the privacy policy, naming the right you are using, is enough to start.