| Step | What it changes | Planning use |
|---|---|---|
| Disable your device’s Ad ID | Limits the tracking data your device hands to advertisers | Do this first on every phone and computer you use; it takes a single settings visit per device. |
| Deny apps data they do not need | Stops apps collecting categories of data beyond what they need to work | Review one app at a time, starting with anything that asks for location. |
| Search your own name | Shows the snapshot of public information that major search engines present | Use it as your baseline before removing anything. |
| Check email addresses in Have I Been Pwned | Reports whether an address appeared in major data breaches | Run every address you use; a hit tells you which passwords to retire. |
| Use a password manager as an inventory | Lists your accounts together so you can see which to delete | Do this before deleting or locking anything down. |
| Ask data brokers and platforms for removal | Removal may be possible, and the obligation depends on the laws where the company is headquartered | Treat it as a repeatable chore, not a guaranteed result. |
These figures and actions come from CISA’s guidance on limiting your digital footprint and the National Cybersecurity Alliance’s privacy guide.
How to protect your digital footprint starts with sharing less, tightening what remains and removing what already circulates. Begin with a name search and an app permission review, then work through breaches and data brokers.
What a Larger Footprint Costs You
A digital footprint is a record of your online activity: the data you share and the traces you leave. SBAM describes it that way, and InvestigateTV adds that the trail builds whenever you visit websites, send email or download apps. You do not have to post anything for the trail to grow.
The practical consequence is that other parties assemble the pieces. CISA notes that data brokers compile location and activity data into detailed user profiles that can be bought and sold. Once your information sits in a profile, you no longer control who reads it, so prevention at the source is cheaper than cleanup later.
That shapes how you should spend your effort:
- If tracking worries you most: start with the Ad ID and app permissions, because they cut collection at the device.
- If exposure to strangers worries you most: start with the name search and removal requests, because they deal with what is already public.
- If you suspect an old account was compromised: start with the breach check and password changes described later in this guide.
Choices That Shrink Your Footprint
The most reliable protection is limiting the data you share. SBAM puts it plainly: the best way to protect your digital footprint is to limit the data you share, and that means weighing whether the payoff justifies the disclosure before you fill in a form. The National Cybersecurity Alliance offers a simple test: for every data request from a digital service, first ask “Why?”
- Question each request. If a service asks for details it does not need to deliver what you want, leave the optional fields blank or choose another service.
- Disable the Ad ID. CISA’s instruction is to disable your device’s Ad ID, which reduces the data available for tracking.
- Deny unneeded app access. CISA advises denying apps access to categories of data they do not require for functionality. A torch or game app asking for contacts is the typical case to refuse.
- Post with an audience in mind. The National Cybersecurity Alliance suggests never posting something you would not be comfortable explaining to your boss or parent, which is a practical way to treat any post as potentially public.
Location deserves extra care. CISA points out the sensitivity of location data and links guides from the four major developers on limiting which apps can see it. Work through your installed apps and keep location only for those whose main function needs it, such as maps.
Shared devices and family accounts follow the same rules. If you manage a child’s accounts, Keeping Kids Safe Online: A Practical Internet Safety Guide For Parents And Guardians (2026) – Internetbuttons covers the household side in more detail.
Privacy Settings Checklist by Platform
Which privacy settings matter most? Prioritise the ones that control collection and visibility: advertising ID, location access, per-app data access and who can see your posts. The National Cybersecurity Alliance recommends getting to know the account privacy settings on the services you use, since they govern both posting visibility and data collection.
- Windows: CISA links a general privacy settings guide that covers disabling the Ad ID and controlling app access to your location.
- Phones and other major platforms: CISA links location-limiting guides from the four major developers, so follow the guide for the operating system you actually use rather than a generic list.
- Social and shopping accounts: open the privacy section of each service and check who can see what you post, then check what data the service collects.
- Your Google account: InvestigateTV quotes an expert noting that the payments section lists every card ever used to make a purchase. Remove cards you no longer need to be stored there.
Work platform by platform and finish one before starting the next. A short, repeatable order such as device settings first, then email, then social accounts keeps the job manageable and easy to resume.
Privacy Steps With Screen Readers and Keyboard Navigation
Privacy settings are ordinary menus and toggles, so you can use whichever navigation method suits you. If a toggle is hard to operate in an app, try the same setting in the service’s website or the device’s system settings instead, and check the platform’s help pages for an alternative route.
- Keep your checklist as text. A plain list in a note or document is easier to move through with a keyboard or screen reader than a mental sequence, and it lets you tick off each platform.
- Use the password manager as the account list. The National Cybersecurity Alliance recommends a password manager to take inventory, and a text-based list of accounts is simple to read item by item.
- Work in short sessions. One platform per sitting reduces the chance of changing a setting by mistake and leaves a clear point to resume from.
Removing Personal Information From Search Results and Brokers
Start by searching your name on the major search engines. The National Cybersecurity Alliance points to this as a way to see your online presence, and the results tell you what to remove. In some regions, Google lets you request removal of search results containing personal information such as phone numbers or addresses, so check whether that option exists where you live.
Removing a result from search does not delete the page it points to, so deal with the source as well. CISA says you may be able to request removal of your information from certain platforms. For data brokers, use this order:
- List the broker and people-search sites that show your details.
- Find each site’s opt-out form; the same FEEA guide notes that most data broker and people-search sites offer one.
- Submit the request and keep a note of the date and site so you can check back.
- Where a record comes from officials, ask the proper authority. CISA says some records, such as property taxes or addresses, can be removed from online access through requests to that authority.
Whether a broker must comply, according to CISA, may depend on the laws where the company is headquartered. A refusal does not mean you did something wrong, so repeat the search later to see what remains.
After a Data Breach
If a breach is suspected, check first. Entering your email addresses into Have I Been Pwned will tell you whether an address has been involved in any major data breaches, as the National Cybersecurity Alliance explains. Check each address you use, not just your main one.
Then act on any hit:
- Change the exposed password straight away. SBAM advises changing it immediately, and changing any account where you reused it. The National Cybersecurity Alliance likewise says to stop using the passwords tied to breached accounts.
- Let a password manager do the remembering. FEEA, citing National Cybersecurity Alliance guidance, describes strong passwords as at least 12 characters, never reused and hard to guess. A manager makes that realistic across many accounts.
- Add multi-factor protection. FEEA, citing CISA, says multi-factor authentication adds a layer of defence beyond passwords alone, which matters if a password has been compromised. Two-factor authentication on email and financial accounts is the sensible place to begin.
Breaches often lead to follow-up scam messages, so pair these steps with knowing how to spot a phishing email. If you also use your phone to scan codes, How To Scan A QR Code Displayed On Your Phone Screen: Practical Methods For Any Phone (2026) – Internetbuttons explains how to do it from the same screen.
Frequently asked questions
Is a virtual card worth using for online purchases?
It can help. InvestigateTV reports that a virtual card, which exists only in digital form, puts a buffer between users and potential hackers.
Should I avoid websites that do not use HTTPS?
Yes, for anything confidential. SBAM advises avoiding sites whose address does not begin with HTTPS when you would be entering confidential information.
Can I keep my data before deleting an account?
Usually. The National Cybersecurity Alliance notes that most major sites give you the option to download your information before deleting the account, so export first and delete second.