Digital Privacy for Regular People: You Don’t Have to Be a Hacker to Stop Being Harvested

My grandmother never locked her door. In a village of 78 people, it didn’t make much sense to. Everybody knew everybody. Trust was built through presence, not policy.

Then she moved to Anchorage. First week, she left the door unlocked. She learned fast.

The internet is that move. Most of us grew up on a smaller, simpler web—or we arrived on a platform that felt friendly and familiar. We never locked the door. And meanwhile, a few dozen companies turned our unlocked house into a gold mine.

Here’s the thing about digital privacy: it isn’t a technical problem. It’s a design problem. The systems harvesting your data were built to harvest your data. The defaults are set against you. That’s not paranoia—that’s just the business model.

The good news? You don’t have to become a Linux wizard or live off-grid to start pushing back. Most of the meaningful changes take about 20 minutes and cost nothing.

What’s Actually Being Collected—And Why It Matters

Let’s be specific, because vague warnings about “your data” tend to make people’s eyes glaze over.

Here’s what’s being collected in a typical day: every search query you type, every link you click, how long you hover over an image, your physical location (often to the city block), your shopping patterns, your political leanings inferred from reading habits, your health concerns inferred from search history, and increasingly—what you pay for things.

That last one is worth pausing on. Corporations are now using harvested behavioral data to charge different customers different prices for the same product—a practice called surveillance pricing. They know what you can afford. They know when you’re desperate. They price accordingly. California is pushing to ban it, which tells you it’s real and it’s happening now.

“The business model isn’t selling you a product. The business model is selling you to advertisers—and now, apparently, charging you more because they know you’ll pay it.”

Who’s trying to control who here? That’s the question worth sitting with.

The Government Angle Nobody Talks About at Dinner

Corporate surveillance is one thing. Government surveillance is another animal entirely—and the two are more connected than most people realize.

For years, there was a legal mechanism called Section 702 of the Foreign Intelligence Surveillance Act. On paper, it was about surveilling foreign threats. In practice, it was routinely used to scoop up communications from ordinary Americans without a warrant—because if a foreign person is on the other end of your email, that email is fair game.

In a development worth paying attention to, Section 702 has expired. That’s a meaningful shift, and groups like the EFF fought hard for it. It doesn’t mean mass surveillance ended—not by a long shot—but it’s a reminder that these legal frameworks aren’t permanent. They respond to pressure. They can be changed.

The practical takeaway: your communications aren’t as private as you assume, and the legal protections around them are in constant flux. Building privacy habits now—before you need them—is the move. You don’t install smoke detectors after the fire.

Five Things You Can Do This Week (No Tech Skills Required)

Look, I’m not going to hit you with a 40-step hardening guide. Most people won’t finish it. Here’s what actually moves the needle for regular people who aren’t trying to become security professionals.

• Switch your browser to Firefox. Chrome is a data collection tool that also browses the web. Firefox is a browser. The difference is enormous. Install uBlock Origin as an extension—it blocks most trackers and ads automatically, and it takes three minutes.
• Use a password manager. Bitwarden is free, open-source, and regularly audited. Most people are reusing the same five passwords across 80 accounts. That’s not a privacy problem—that’s a vulnerability waiting to become a catastrophe.
• Replace Google Search with Brave Search or DuckDuckGo. Your search history is one of the most intimate maps of your mind that exists. Stop handing it to a company whose revenue depends on profiling you.
• Turn on two-factor authentication everywhere. Authenticator apps (like Aegis on Android or 2FAS, which is free and open-source on both platforms) are more secure than SMS codes. Takes ten minutes to set up on your most important accounts.
• Audit your phone’s app permissions. Go to your privacy settings right now and look at which apps have access to your location, microphone, and camera. You’ll find at least one app that has no legitimate reason to be listening. Revoke it.

None of these require technical knowledge. They require about 45 minutes and the decision to care.

The Mindset Shift That Makes All of This Stick

Here’s where most privacy guides lose people: they treat it as a checklist instead of a worldview.

Privacy isn’t about hiding something wrong. It’s about owning something real—your attention, your behavior, your inner life. When you search for symptoms online, that’s a private conversation with yourself. When you look up a political topic, that’s your mind doing its work. The idea that those moments should be catalogued, sold, and used to influence your future behavior is, if you think about it clearly, deeply weird.

We’ve just been normalized to it.

The commercial web was built on a surveillance model because surveillance was profitable. That’s not a conspiracy—it’s just economics. But economics respond to behavior. When enough people start using tools that don’t harvest them, the calculus changes.

I’m not naive enough to think browser extensions are going to bring down a trillion-dollar surveillance industry. But I’ve seen what small shifts in consumer behavior do to markets over time. It moves slower than we’d like and faster than we expect.

You Don’t Have to Go All the Way to Go Somewhere

Perfect privacy is a fantasy. That’s not defeatism—it’s just physics. You use the internet, you create data. The question isn’t how to leave zero footprint. The question is how much of your footprint you’re willing to hand over for free to people who will use it against your interests.

Even a few changes dramatically reduce your exposure. The person who locks their door, uses a different password on their bank account, and doesn’t leave their location services on 24/7 is already a harder target than 80% of internet users. You don’t have to be invisible. You just have to be harder to exploit than average.

The fishing boats I grew up around had a phrase for unnecessary risk: “feeding the water.” You don’t have to stop fishing to stop feeding the water. You just have to stop being careless about what you’re giving away.

So: what’s one permission you’ve never questioned that you’re going to revoke today?