How Do I Protect My Data Online?

How Do I Protect My Data Online?

Your data is being collected, sold, and analyzed at a scale most people never fully reckon with. Every search query, every app on your phone, every website you visit, every purchase you make online — these are data points that feed profiles that companies and governments use to predict, influence, and surveil you.

For Black communities specifically, mass surveillance has always carried additional risk. The FBI’s COINTELPRO program surveilled civil rights leaders for decades. Fusion centers today share law enforcement data across agencies. Social media companies have provided user data to law enforcement with minimal pushback. The tools that allow surveillance to operate at scale are the same tools most people carry in their pockets and trust with their most sensitive information.

This is not an argument for paranoia. It is an argument for deliberate, layered defense. You cannot make yourself invisible — but you can make surveillance significantly more expensive and less rewarding.

Layer 1: Encrypted Communications

The most impactful single action you can take is switching your messaging and email to encrypted alternatives.

Messaging: Signal is the gold standard. It uses end-to-end encryption by default for all messages and calls, the protocol has been publicly audited by independent cryptographers, and Signal’s servers cannot read your messages even if compelled by law enforcement. Switch your close contacts to Signal. WhatsApp also uses the Signal protocol but is owned by Meta, which collects extensive metadata. iMessage encrypts end-to-end between Apple devices but the backup to iCloud is not encrypted by default.

Email: Email is structurally difficult to encrypt because it was designed before encryption was a priority. The most practical options:

• ProtonMail: End-to-end encryption between ProtonMail users, Swiss privacy law, no advertising. Free tier is functional.
• Tutanota: Similar positioning to ProtonMail, open source, German servers.
• Self-hosted: If you run your own mail server, you control the data at rest — but email in transit to Gmail recipients is still unencrypted unless both parties use PGP.

For maximum protection on sensitive communications, use Signal or an encrypted email service. Do not rely on Gmail or standard SMS.

Layer 2: A Trustworthy VPN

A VPN (Virtual Private Network) encrypts your internet traffic and routes it through a server in another location, hiding your real IP address from websites and hiding your browsing activity from your Internet Service Provider.

VPNs do not make you anonymous. They shift trust from your ISP to the VPN provider. This only matters if the VPN provider is more trustworthy than your ISP — which is often, but not always, true.

Criteria for a trustworthy VPN:

• No-logs policy, audited: The VPN must claim it does not log your activity, and that claim must be verified by an independent audit — not just a promise in their marketing.
• Open source client software: If you cannot read the code, you cannot verify what it does.
• Jurisdiction: VPNs based in countries with strong privacy laws (Switzerland, Iceland) are preferable to those in Five Eyes countries (US, UK, Canada, Australia, New Zealand), which have surveillance-sharing agreements.

Recommended options: Mullvad (no accounts, cash payment accepted, audited), ProtonVPN (Swiss, audited, open source clients), IVPN (audited, privacy-focused).

Avoid free VPNs. If the service is free, your data is the product.

Use your VPN on public Wi-Fi always. Use it at home when you want your ISP to see only encrypted traffic. Understand it does not protect you from the websites you visit — they can still track you through browser fingerprinting and cookies.

Layer 3: Browser and Search Hygiene

Your browser is one of the most invasive surveillance tools on your computer. Chrome sends data to Google. Firefox is better but not perfect. Brave is a Chromium-based browser with aggressive tracker blocking built in and a privacy-respecting default configuration.

For search, stop using Google. DuckDuckGo does not build user profiles and does not track searches. Brave Search is independent (its own index, not powered by Google or Bing). SearXNG is a self-hostable meta-search engine.

Browser extensions that reduce tracking:

• uBlock Origin: The most effective ad and tracker blocker. Free, open source.
• Privacy Badger: Learns and blocks invisible trackers.
• Do not use too many extensions — each one can also be a vector for data collection.

Layer 4: Password Security

Password reuse is how accounts get compromised. If you use the same password on 20 sites and one site gets breached, attackers now have access to all 20 accounts. This is not theoretical — it happens millions of times per day.

Use a password manager. It generates and stores a unique, long, random password for every account. You only remember one strong master password.

Options:

• Bitwarden: Open source, free tier is excellent, self-hostable if you want full control
• KeePassXC: Offline only, stores password database as a file on your device, maximum control
• Avoid proprietary password managers like LastPass, which has had multiple serious breaches

Enable two-factor authentication (2FA) on every important account — email, banking, social media. Use an authenticator app (Aegis on Android, Raivo on iOS, or Bitwarden’s built-in TOTP) rather than SMS codes. SMS 2FA can be bypassed through SIM-swapping attacks, which have specifically targeted cryptocurrency holders and activists.

Layer 5: Device and Account Hygiene

• Keep your operating system and apps updated. Most breaches exploit known vulnerabilities that have already been patched.
• Review app permissions regularly. That flashlight app does not need access to your contacts and location.
• Disable ad ID tracking on your phone (Settings > Privacy on iOS; Settings > Google > Ads on Android).
• Use full-disk encryption on your devices (FileVault on Mac, BitLocker on Windows, built-in on modern Android and iOS).
• Be deliberate about what accounts you create. Every account is a data point. Only create accounts where you receive genuine value.

The Realistic Goal

Perfect privacy is not achievable for most people within modern digital infrastructure. The goal is not to disappear — it is to make surveillance expensive. Encrypted messages are not worth intercepting if the cost of decryption exceeds the intelligence value. An anonymized browsing trail is not worth analyzing if there is nothing useful in it.

You are not the target of a nation-state intelligence operation (probably). But your data is being harvested at scale, sold to data brokers, purchased by law enforcement, and used to manipulate your behavior. Basic defenses — Signal, a password manager, a VPN, a privacy browser — significantly reduce your exposure at minimal cost.

Start with Signal and a password manager. Add a VPN. Replace Google Search. These four steps will put you ahead of 95% of the population in terms of data protection.