The Quick-Start
1
Switch your browser
Chrome is built by the world's largest advertising company. Every page you visit feeds Google's profile of you. Google settled a $5 billion lawsuit in 2024 for tracking users in Incognito Mode.
Switch to Brave (blocks ads and trackers by default) or Firefox + uBlock Origin. For maximum anonymity, use Tor Browser. This single change eliminates most web-based tracking.
Switch to Brave (blocks ads and trackers by default) or Firefox + uBlock Origin. For maximum anonymity, use Tor Browser. This single change eliminates most web-based tracking.
2
Use a password manager
86% of data breaches start with stolen or reused credentials. The average person reuses passwords across 100+ accounts. When one service is breached, attackers try those credentials everywhere else.
Bitwarden is open-source, independently audited, and the free tier covers everything. Import from Chrome, generate unique passwords for every account, then delete your saved passwords from Google.
Bitwarden is open-source, independently audited, and the free tier covers everything. Import from Chrome, generate unique passwords for every account, then delete your saved passwords from Google.
3
Enable 2FA everywhere
A password alone isn't enough. The hierarchy:
- Hardware keys (YubiKey) — phishing-proof, verifies the site's identity
- Authenticator apps (Aegis) — time-based codes, better than SMS
- SMS codes — last resort, vulnerable to SIM-swapping
4
Switch to encrypted messaging
WhatsApp is owned by Meta and harvests metadata. iMessage backs up to iCloud — Apple can access it. Telegram isn't end-to-end encrypted by default.
Signal is end-to-end encrypted, open-source, and collects zero metadata. Sealed sender technology hides even the sender's identity from Signal's servers. Used by journalists, activists, and intelligence professionals.
Signal is end-to-end encrypted, open-source, and collects zero metadata. Sealed sender technology hides even the sender's identity from Signal's servers. Used by journalists, activists, and intelligence professionals.
5
Switch your email
Gmail's privacy policy allows reading your email content to build advertising profiles. Your email is the skeleton key — every password reset and account verification flows through it.
Proton Mail is end-to-end encrypted, Swiss-based, and open-source. They can't read your email even if compelled by a court. Free tier available. Set up auto-forwarding from Gmail and migrate over 2–4 weeks.
Proton Mail is end-to-end encrypted, Swiss-based, and open-source. They can't read your email even if compelled by a court. Free tier available. Set up auto-forwarding from Gmail and migrate over 2–4 weeks.
6
Use a real VPN
Most commercial VPNs are worse than nothing — they log and sell your traffic. Your ISP can see every site you visit, and in the US, they're legally allowed to sell that data.
Mullvad VPN requires no email, accepts cash by mail, and was raided by Swedish police in 2023 who found nothing. Proton VPN is also solid and open-source. Always use a VPN on public Wi-Fi.
Mullvad VPN requires no email, accepts cash by mail, and was raided by Swedish police in 2023 who found nothing. Proton VPN is also solid and open-source. Always use a VPN on public Wi-Fi.
Want the full playbook?
The Complete Guide to Data Privacy in 2026
8 chapters. 30+ actionable steps. Data broker removal, phone permissions audit, social media lockdown, advanced tools, situation-specific guidance, and a complete tool comparison table.
Included as a digital download with the Privacy Starter Kit — along with a YubiKey, Faraday sleeve, TailsOS USB, and USB data blocker.
Get the Kit + Full Guide — $199.99
Included as a digital download with the Privacy Starter Kit — along with a YubiKey, Faraday sleeve, TailsOS USB, and USB data blocker.