Online privacy: how tracking works and what you can do

What online privacy means

Online privacy is your ability to control who collects information about you, what they do with it, and who they share it with. Security keeps criminals out. Privacy is also about the legal, everyday collection done by apps, websites, advertisers and the companies that trade in data.

How tracking works

• Cookies. Small files sites store in your browser. First-party cookies keep you logged in. Third-party cookies, set by ad and analytics companies embedded in many sites, follow you between them.
• Tracking pixels and scripts. Invisible images and code on web pages and in emails report when you load a page or open a message.
• Browser fingerprinting. Combining details such as screen size, fonts, time zone and browser settings to recognize your device without cookies. The EFF's Cover Your Tracks tool shows how unique your browser looks.
• App SDKs. Code libraries inside phone apps that send usage data, device IDs and sometimes location to ad networks.
• Location data. Phones can report precise location through apps. In 2024 the FTC barred the data broker X-Mode Social (later Outlogic) from selling sensitive location data, after alleging it sold data that could reveal visits to places such as medical clinics.
• Your IP address. It reveals your rough location and internet provider to every site you visit. A VPN replaces it with the server's address. See what is a VPN.

What data brokers do

Data brokers collect information from public records, purchases, apps and other sources, build profiles of people, and sell or license them for marketing, risk scoring or "people search." In a 2014 report on nine data brokers, the FTC found they held information on almost every US consumer and sorted people into segments, some of them sensitive, such as categories based on ethnicity, income or health interests.

California runs a public data broker registry. Under its Delete Act, Californians have been able to use a free state tool, the Delete Request and Opt-out Platform (DROP), since January 1, 2026, to ask every registered broker to delete their data in one request. Registered brokers had to start processing those requests from August 1, 2026. Our data broker removal guide explains how to opt out elsewhere.

The main privacy laws

GDPR. The General Data Protection Regulation has applied across the EU since May 25, 2018. It requires a lawful basis, such as consent or a contract, for using personal data, and gives people rights over data about them. Regulators have used it against large companies; for example, Ireland's Data Protection Commission fined Meta €265 million in 2022 over the scraping of Facebook users' data. See our Facebook security incidents page.

CCPA and CPRA. The California Consumer Privacy Act took effect on January 1, 2020. The California Privacy Rights Act, approved by voters in 2020, amended it and created the California Privacy Protection Agency. The California Attorney General's 2022 settlement with Sephora made clear that businesses must honor the Global Privacy Control browser signal as an opt-out of data sale.

The US has no single federal privacy law covering all consumer data. Sector laws such as HIPAA (health) and COPPA (children's data) cover specific areas. The IAPP keeps a tracker of state privacy laws.

Practical steps that make a difference

1. Change your browser and search engine Use a browser that blocks third-party trackers by default, and consider a search engine that doesn't build a profile of you. See private browsers and private search engines.
2. Turn on Global Privacy Control Browsers such as Firefox and Brave, and some extensions, send this signal. In California and some other states, businesses must treat it as an opt-out.
3. Review app permissions Remove location, contacts and microphone access from apps that don't need them. On iPhone, Apple's App Tracking Transparency lets you tell apps not to track you across other companies' apps.
4. Reset or limit your advertising ID Both Android and iOS let you limit or delete the advertising identifier apps use to profile you.
5. Opt out of data brokers Use DROP if you live in California, and the opt-out pages of large people-search sites elsewhere. See data broker removal.
6. Use end-to-end encrypted messaging So the service can't read your messages. See encrypted messaging apps.
7. Use a VPN on networks you don't trust It hides your browsing from the local network and ISP. It doesn't stop cookies or fingerprinting. See public Wi-Fi safety.
8. Use your legal rights Ask companies what they hold on you and to delete it. Under the GDPR and California law they must respond within set time limits.

You can check what your browser reveals with our browser privacy check.