Building a Personal Threat Model: The First Step to Real Privacy

Why “I have nothing to hide” stops working

Most people don’t think about privacy until something goes wrong. A data broker sells your home address. An old social media post resurfaces during a job search. A stalker or ex-partner finds your location through a photo’s metadata. None of these situations involve secrets. They involve information that was collected, stored, and eventually used in a way you didn’t expect or want.

Privacy isn’t about hiding wrongdoing. It’s about controlling the gap between what you’re comfortable sharing and what actually gets shared. That gap is usually much bigger than people assume, because most data collection happens quietly, through defaults you never reviewed.

Who is actually collecting your data

Before you can protect anything, it helps to know who’s watching and why. There are a few distinct categories, and they have different motives.

Advertising and data broker networks

Apps, websites, and even some smart devices collect behavioral data (what you click, where you linger, what you search) and feed it into advertising networks. Data brokers separately aggregate public records, purchase history, and location data, then sell profiles to marketers, insurers, and sometimes anyone willing to pay. This is the largest and least visible category of collection.

Platforms you use directly

Social networks, email providers, and cloud services collect data as part of the service itself, then often monetize it further. Their business model usually depends on knowing more about you, not less, so privacy-friendly settings tend to be buried rather than default.

Employers and institutions

Workplace software, school systems, and healthcare portals collect data for legitimate operational reasons, but retention policies vary widely and breaches happen. Data collected for one purpose (say, an employee wellness app) can end up stored indefinitely and exposed later.

Bad actors

Scammers, stalkers, and criminals don’t need to breach anything sophisticated. Often they just piece together information you’ve already made public: your city from a post, your workplace from LinkedIn, your daily routine from check-ins. This is the category most people underestimate.

Build a threat model before you change any settings

The biggest mistake in personal privacy is trying to lock everything down at once. That approach burns out fast and usually breaks things you actually need, like being findable by real contacts or being able to sign in to your own accounts. A threat model fixes this by asking a specific set of questions first.

What am I actually trying to protect?

Be concrete. Examples: your home address, your daily location, your financial accounts, your children’s information, your professional reputation, your medical history. A vague goal like “be more private” won’t tell you what to prioritize.

Who am I protecting it from?

An ex-partner, a stranger online, an advertiser, a data broker, and a nation-state actor all require different defenses. Most people reading this are not defending against sophisticated targeted surveillance. They’re defending against opportunistic data collection and occasionally against a specific person who knows them. Be honest about which category applies, because it changes what’s worth your time.

How bad would it be if this information got out?

Rank your concerns by consequence, not just by discomfort. Your home address leaking to a stalker is a high-consequence event. An ad network knowing you shop for running shoes is low-consequence, even if it feels invasive. Spend your effort where the consequence is highest.

How much effort and inconvenience will I tolerate?

Total anonymity is possible but expensive in time and convenience. Most people want meaningful protection without giving up group chats, online shopping, or being reachable by friends. Decide your tolerance level honestly before you start, so you don’t abandon changes halfway through.

Once you’ve answered these four questions, you have a working threat model. It doesn’t need to be written down formally, but it should guide every decision that follows.

Browser decisions that actually matter

Your browser is the single biggest data collection surface most people use daily. A few changes make an outsized difference.

• Use a browser with strong tracking protection built in, and check that it’s actually enabled rather than assuming a default install is configured well.
• Install a content blocker that stops third-party trackers, not just ads. Trackers follow you across sites even when you never click anything.
• Separate your browsing contexts. Use one browser profile or a dedicated private window for anything sensitive, like banking or medical portals, and keep your everyday browsing separate.
• Clear cookies periodically, or set your browser to do it automatically when you close it. This limits how long advertising networks can track your session across visits.
• Check your search engine. If it logs and personalizes based on your search history, that history is being stored somewhere and can be requested, subpoenaed, or breached.

VPN decisions without the hype

VPNs get marketed as a universal privacy fix, but they solve one specific problem: hiding your traffic and IP address from your internet provider and from networks you connect to, like public Wi-Fi. They do not make you anonymous, and they do not stop websites from tracking you once you’re logged in.

When a VPN is worth using

• On public or shared Wi-Fi, where anyone on the same network could intercept unencrypted traffic.
• When you specifically want to hide your general location or IP from your internet provider or from certain services.
• When traveling somewhere with heavy network monitoring or restrictions.

When it’s not doing much

If you’re logged into Google, Facebook, or your email while using a VPN, those services still know exactly who you are regardless of your IP address. A VPN protects the pipe, not your identity once you’ve authenticated. Don’t treat it as a substitute for the account and browser changes that address the rest of your exposure.

Settings worth actually changing

Rather than auditing every app you own, focus on the handful of changes that produce the biggest reduction in exposure for the least effort.

• Turn off ad personalization in your phone’s operating system settings. This limits cross-app tracking at the source.
• Review location permissions app by app. Most apps don’t need constant access; “while using” or “never” is sufficient for the majority of them.
• Check what your social accounts show to the public by default, especially past posts, tagged photos, and your friends or followers list.
• Enable two-factor authentication on your email and financial accounts. This isn’t strictly a privacy setting, but a compromised account exposes far more data than any single leak.
• Opt out of data broker listings where possible. Many brokers offer an opt-out process, though it’s often manual and needs to be repeated periodically since new listings appear.

Keep it maintainable

Privacy isn’t a one-time project. New apps, new accounts, and new default settings keep appearing. Pick a recurring time, once every few months, to revisit your threat model and check whether anything has changed: a new job, a new relationship, a move, a new device. Adjust your defenses to match, and don’t try to defend against threats that no longer apply to your life. The goal is meaningful control over your information, not permanent vigilance over everything at once.

For the complete, structured playbook on this topic, see The Privacy Playbook in our library. New here? Start with our free guide.