Privacy Settings of Everyday Services

Every service you use, whether it is a mailbox, a social network, a cloud drive, a streaming platform, a voice assistant or a connected watch, has a settings page where you can decide how much it knows about you. Most people never open it. In this lesson you will learn a method that works for any service, without needing to learn the interface of each one.

Interfaces change often, and the names of menus differ from one service to another, so we will not describe particular screens. Instead you will learn the categories of settings that matter, which you can recognize almost anywhere. Think of it as a checklist you carry around.

Why defaults rarely favor privacy

When you create an account, the default settings are chosen by the service. Often they are set to share more and collect more, because the data is useful to the company. In the EU, the GDPR requires "data protection by design and by default", which means that default settings should be privacy-friendly. In practice, behavior varies widely, so it is worth checking.

The good news is that a handful of changes, made once, remove most of the exposure.

The seven categories of settings

1. Account security

This is the foundation, and you have already done much of it in Chapter 2. Look for the section called "Security", "Sign-in" or "Login" and check:

• Two-step verification or passkeys: on, with the strongest method available.
• Recovery email and phone number: current and secured.
• Active sessions and devices: sign out of anything you do not recognize or no longer use.
• Security alerts: switched on, so you get notified of unusual sign-ins.

2. Profile visibility

Who can see your profile, photos, posts, friends list and activity? Choose the narrowest audience that suits you: "only me", "friends", "contacts" rather than "public" or "everyone". Check what you appear to a stranger who is not logged in. Also check discoverability: whether people can find you by email or phone number, and whether search engines may list your profile.

3. Data collection and activity history

Many services record your searches, locations, viewing history, voice commands and browsing, to personalize results. Look for "Activity controls", "History", "Data and personalization" or "Privacy dashboard". Typical options:

• Pause or switch off the recording of activity you do not want stored.
• Set automatic deletion after a period (such as three or twelve months) instead of keeping it forever.
• Delete past history, entirely or by category.
• Check whether recordings of your voice or videos are stored, and for how long.

4. Advertising and personalization

You can often turn off or reduce personalized advertising and the use of your data for ad targeting. The page may list the interests that the service has inferred about you, which is an interesting discovery. Remove those that are wrong or too sensitive. Opting out will not remove advertising altogether, but it makes it less based on your profile.

5. Permissions and connected apps

When you use a button like "Sign in with..." or connect a third-party app to a service, it gets access to some of your data. These links remain active until you cancel them. Review the "Connected apps", "Third-party access" or "Authorized applications" section and remove any you do not recognize or use. Also review the permissions the service's own mobile app has, as seen in lesson 3.4.

6. Sharing and communication

Who can contact you, tag you, add you to groups, send you friend requests or see when you are online? Restrict these to contacts or friends. Switch on tag review. Choose whether read receipts and "last seen" information are shared. Check the sharing links of cloud documents: "anyone with the link" is much less private than named people, and old links remain active until you disable them.

7. Your data: download and delete

Locate the "Download your data" and "Delete your account" options, and note where they are. This is how the rights of access, portability and erasure from lesson 5.1 become a few clicks. Download your data now and then, especially from services that hold photos, documents and messages that matter to you.

Special cases

• Voice assistants and smart speakers: they listen for a wake word and may store recordings. Review the history, switch off the retention of recordings if possible, use the physical mute button when you want to, and ask yourself whether you really need one in your bedroom.
• Smart TVs, cameras and connected objects: change default passwords, disable features you do not use (microphones, cameras, content recognition), keep them updated and put them on a guest network, as mentioned in lesson 4.2.
• Smartwatches and health apps: health data is particularly sensitive. Check what is shared, with whom and for what purpose, and be selective about third-party access.
• Messaging apps: check who can add you to groups, how long messages are kept, and whether chat backups are encrypted.
• Cloud storage: audit shared folders and public links, and enable encryption options when they exist.
• Shopping and payment services: remove stored payment cards you no longer need, and prefer virtual cards or payment methods with extra confirmation when offered.

A method for a 20-minute privacy checkup

Use this method on the services you use most. Set a timer for 20 minutes per service and go through the seven categories in order:

1. Open the account settings, then find the "Privacy" or "Security" center. Many services have a guided privacy checkup; use it, then continue manually.
2. Work through the seven categories. For each, ask: "Does this setting benefit me, or only the company?"
3. When in doubt, choose the more restrictive option. You can always loosen it later if you miss a feature.
4. Write down what you changed in your Security Notebook, with the date.
5. Come back once or twice a year, because services add new features and sometimes reset or add settings after an update.

Read the privacy policy... a little

Nobody reads whole privacy policies, and they are often written for lawyers. But a few minutes of targeted reading is useful before signing up for a service that handles sensitive data. Search the page for these words: "share", "sell", "partners", "retain", "delete", "third parties" and "location". Look for: what is collected, who it is shared with, how long it is kept, whether it is sold, and how you can exercise your rights. If you cannot find a clear answer, that is information too.

Your turn

Exercise. Pick your main email or cloud account and do the full 20-minute checkup using the seven categories. Note at least five changes.

See a solution

A typical result:

1. Security: second factor upgraded from SMS to an authenticator app; two unknown devices signed out.
2. Visibility: profile photo and name only visible to contacts.
3. History: location history switched off; search and activity history set to auto-delete after a year.
4. Advertising: personalized ads turned off; three wrong interest categories removed.
5. Connected apps: four old third-party apps revoked.
6. Sharing: two public links to old documents disabled.
7. Data: downloaded an archive and noted where the delete option is.

Add to your Security Notebook

Under "5. Privacy and law", list the three services you will check first, with a target date for each, and the "seven categories" in a short line you can reuse.

So far we have talked about your own data. The final lesson of this chapter addresses the people who need the most protection online: children and the family.