Privacy is not about having something to hide

Information about the communication rather than inside it is called metadata.

It is easier to collect, easier to store, and far easier to analyse, because it is already tidy.

When a company says it does not read your messages, that can be perfectly true and still leave the useful part on the table.

Data described as anonymous usually just has the name removed.

A researcher showed that date of birth, sex and postal code together pick out the large majority of Americans uniquely. Three ordinary facts.

Location traces are worse. The place you sleep and the place you work, taken together, are a name.

There are companies whose entire business is buying, joining and reselling information about people.

You have no account with them. You did not agree to anything. They assemble a file from loyalty schemes, apps, public records and adverts, and your name on it came from joining things up, not from you.

You cannot opt out of the modern world, and pretending otherwise wastes effort.

What works is small and boring. Fewer places holding your information. Fewer permissions granted to the ones that do. And fewer of your identities joined to each other.

Location comes with a choice most people click past.

While using means it knows where you are when the app is open. Always means it can build a record of every night, every workplace, every clinic and every place of worship, whether the app is open or not.

Very few apps need always. A map does not.

Phones carry an advertising identifier: a code that lets companies recognise the same device across different apps.

It exists to be reset, and almost nobody resets it. Both big phone systems let you turn it off or clear it in the privacy part of the settings.

It is one screen, and it breaks a lot of joining-up.

The word covers three different promises and they are not equal.

Encrypted in transit means nobody can read it on the way. Encrypted at rest means it is scrambled on their disks. End to end means the company itself cannot read it.

Only the last one changes who can be asked for your messages.

Nobody reads these and nobody expects you to. Search them instead.

Four words find almost everything: third, share, retain, delete.

Who else gets it. How long they keep it. And whether there is any way to make them stop.

Cookie banners are designed so that agreeing takes one tap and refusing takes several. That asymmetry is the whole design.

Refusing the non-essential ones is worth the extra taps. It is also worth knowing that much tracking no longer needs cookies at all, so the banner is a smaller win than it looks.

This is the question that makes all the others answerable, and almost nobody asks it.

An advertiser, an ex-partner, a future employer, a thief, a scammer, a government. They want different things and they are stopped by completely different measures.

Decide who yours is before buying anything or changing anything.

One email address used everywhere is the thread that joins your file together.

Use a different one for shopping and sign-ups than for people who know you. Many providers let you make aliases that forward to the same inbox, which costs nothing and takes a minute.

When one starts getting spam, you know exactly who leaked it.

A service with no charge still has staff, servers and investors.

So the honest question about anything free is not whether it is a scam. It is what is being sold, and to whom.

Sometimes the answer is fine. Sometimes the answer is you. Asking is the whole skill.

Open the privacy settings on your phone and do three things.

Go through location and move everything from always to while using, except the one or two that truly need it. Turn off or reset the advertising identifier. Look at which apps have your contacts, and remove the ones that make no sense.

That is more than most people ever do, and it takes one sitting.