Privacy — AI Area

Online privacy isn’t about going off-grid — it’s about making smart, layered choices so your everyday life stays yours. The playbook below meets you where you are: if you’re non-technical, it translates the “big wins” into steps you can do in minutes (like turning on a password manager and moving smart gadgets to a guest Wi-Fi). If you’re a security pro, it ties those same moves to standards, controls, and deployment tactics you can roll out at scale.

Across both tracks, the strategy is the same: start with what matters most to you, reduce the data you expose, harden identities and devices, encrypt by default, segment risky tech, and keep good backups.

AI systems increasingly learn from the data we publish and upload, the guide also shows how to keep your info out of training pipelines — both in the apps you use and on sites you control.

1) Clarify what you’re protecting (threat modeling)

For everyone: Write down your most important stuff (email, banking, photos, location) and who might go after it (scammers, stalkers, data brokers). That list tells you where to start: lock the accounts that could ruin your week if stolen, then move outward. This “risk-based” approach is exactly how professionals prioritize protections (NIST, 2024; Nissenbaum, 2010). (NIST, 2024; Nissenbaum, 2010). (NIST)

For pros: Map assets, adversaries, and harms to outcomes in CSF 2.0 (IDENTIFY/PROTECT/DETECT/RESPOND/RECOVER) and align privacy risks to the NIST Privacy Framework (IDENTIFY-P/CONTROL-P). Use profiles to justify control selection and communicate tradeoffs to stakeholders (NIST, 2020; NIST, 2024). (NIST)

2) Identity & logins (the biggest win)

For everyone: Use a password manager so every account has a different, long password. Turn on multi-factor authentication (MFA) everywhere. If a site offers “passkeys” or security keys, use them — these protect you even if you’re phished (NIST, 2025). (nvlpubs.nist.gov)

For pros: Adopt SP 800–63B Rev. 4 controls: prefer phishing-resistant authenticators (FIDO2/passkeys), screen new passwords against breach corpora, and stop forced periodic rotations and composition rules. Where feasible, target AAL2/3 for high-risk roles (NIST, 2025). (NIST Pages)

3) Keep systems updated & shrink attack surface

For everyone: Turn on automatic updates on your phone, laptop, router, and apps. Uninstall software you don’t use. Avoid using “admin” accounts for daily work. These basics stop a lot of attacks (CIS, 2024). (CISA)

For pros: Drive patch cadence with asset inventories and SLAs (CIS Controls 1–4, 7). Use centrally managed update channels, application allow-listing, least-privilege, and config baselines to reduce exploitability (CIS, 2024/2025). (CISA)

4) Encrypt devices & your DNS lookups

For everyone: Turn on full-disk encryption (it’s built-in on iOS/Android/macOS/Windows) and set auto-lock with a PIN/biometrics. In your browser, enable “DNS over HTTPS” to hide which sites you look up from nosy networks (Hoffman & McManus, 2018; Mozilla, 2025). (IETF Datatracker)

For pros: Mandate encryption at rest for endpoints and removable media; enforce lockout and auto-lock. Push DoH/DoT via MDM and secure resolvers; monitor egress DNS for anomalies while respecting privacy (RFC 8484). (IETF Datatracker)

5) Lock down home Wi-Fi & segment IoT

For everyone: Change the router’s admin password, update its firmware, and use WPA3 (or WPA2-AES if WPA3 isn’t available). Make a separate “Guest/IoT” network for smart gadgets and turn off WPS and UPnP if you don’t need them (CISA, 2025). (CISA)

For pros: Use strong PSKs or 802.1X, disable legacy ciphers, and put IoT/guest on isolated VLANs with egress filtering. Monitor for default creds and services; apply vendor updates automatically where supported (NSA, 2023). (U.S. Department of War)

6) Reduce web tracking

For everyone: Turn on your browser’s tracking protection, block third-party cookies, and add a reputable content-blocker. This cuts down cross-site tracking and “fingerprinting” that follow you across the web (Acar et al., 2014; Englehardt & Narayanan, 2016). (senglehardt.com)

For pros: Standardize hardened browser configs, enable anti-tracking policies, and review extension allow-lists. Consider network-level controls (uBO/NextDNS profiles) and periodic telemetry to confirm effectiveness (Acar et al., 2014; Englehardt & Narayanan, 2016). (senglehardt.com)

7) Tame mobile app permissions

For everyone: Open your phone’s Settings → Privacy/Permissions and revoke anything apps don’t truly need (location, mic, photos). Re-audit monthly. That stops quiet over-collection (NIST, 2020). (NIST)

For pros: Use MDM to enforce least-privilege app permissions, block sideloading, and containerize work data. Map to Privacy Framework CONTROL-P outcomes and log permission changes for high-risk roles (NIST, 2020). (NIST Computer Security Resource Center)

8) Smarten up smart devices (IoT)

For everyone: Before buying, check if the brand promises security updates. After installing, change default passwords, auto-update firmware, and keep smart devices on that separate Wi-Fi (ENISA, 2020). (ENISA)

For pros: Procure against NISTIR 8259A capabilities (secure update, authN, logging). Threat-model by class, isolate with VLANs, and monitor mDNS/UPnP exposure. Use the OWASP IoT Top-10 to prioritize fixes (NIST, 2020; OWASP, 2018). (NIST Computer Security Resource Center)

9) Safer use on travel & public networks

For everyone: Treat café/airport Wi-Fi as untrusted: avoid sensitive logins, prefer your phone’s hotspot, and if you must use public Wi-Fi, use a trusted VPN and end-to-end encrypted apps/sites (NSA, 2021). (NSA)

For pros: Harden mobile profiles (disable auto-join/open SSIDs, disable sharing radios when unused), require device attestation, and enforce per-app VPN for risky networks (NSA, 2021). (NSA)

10) Backups & recovery

For everyone: Keep automatic backups on, and ensure at least one copy is off-device (cloud or an external drive you plug in occasionally). Backups turn disasters into inconveniences (NIST, 2024). (NIST)

For pros: Apply 3–2–1 backup with immutability/versioning, regularly test restores, and cover SaaS (M365/Google Workspace) with retention policies. Map these to CSF 2.0 RECOVER outcomes (NIST, 2024). (NIST)

11) Keep your public footprint small (and exercise your rights)

For everyone: Review privacy settings on your social, maps, and cloud accounts and turn off ad personalization where possible. In Canada, you have rights under PIPEDA to meaningful consent — use them and opt out of data brokers where you can (OPC, n.d.). (Privacy Commissioner Canada)

For cybersecurity pros: Create internal playbooks for data-broker removals and de-indexing abusive content; track vendor compliance with regional laws. Expect friction: some data brokers hide opt-out pages, so persistence matters (The Markup/CalMatters via Wired, 2025). (WIRED)

12) How to limit your information being used by AI

For everyone:

In AI apps you use (like ChatGPT), turn off “use my data to improve models” in Settings → Data Controls so your chats aren’t used for training (OpenAI Help, 2025). 2) Think before you share: don’t paste IDs, financials, or private images into any AI chat. 3) If you run a website, you can add rules in robots.txt to tell reputable AI crawlers not to use your pages for training—for example, disallowing OpenAI’s GPTBot or Google’s Google-Extended. This reduces model-training use of your content (OpenAI; Google). Note: robots.txt is voluntary; bad actors may ignore it. (OpenAI, 2025; Google, 2025). (OpenAI Help Center)

For cybersecurity pros: Add targeted robots.txt directives (e.g., User-agent: GPTBot / Disallow: /; User-agent: Google-Extended / Disallow: /) and monitor access logs for AI user-agents. Consider noindex/account-gating for high-value content; document policy in your ToS. If you operate an API or dataset, rate-limit and require keys; block non-compliant scrapers at the edge. Remember that Common Crawl and others publish opt-out information but compliance varies—treat robots directives as signals, not enforcement (OpenAI; Google; Common Crawl). (OpenAI Platform)

13) Want the “why” behind these controls?

Two standard texts explain the technical foundations (encryption, authentication, and privacy guarantees like differential privacy) so you can make informed choices (Anderson, 2020; Katz & Lindell, 2020; Dwork & Roth, 2014). (Wiley)

References (APA)

Acar, G., Eubank, C., Englehardt, S., Juarez, M., Narayanan, A., & Diaz, C. (2014). The web never forgets: Persistent tracking mechanisms in the wild. Proceedings of ACM CCS. (senglehardt.com)

Anderson, R. (2020). Security engineering: A guide to building dependable distributed systems (3rd ed.). Wiley. (Wiley)

Center for Internet Security. (2024). CIS Critical Security Controls v8.1. (CISA)

Dwork, C., & Roth, A. (2014). The algorithmic foundations of differential privacy. Now Publishers. (Now Publishers)

Englehardt, S., & Narayanan, A. (2016). Online tracking: A 1-million-site measurement and analysis. Proceedings of ACM CCS. (Computer Science Department at Princeton)

Hoffman, P., & McManus, P. (2018). RFC 8484: DNS Queries over HTTPS (DoH). IETF. (IETF Datatracker)

Mozilla. (2025). Firefox DNS over HTTPS — how to enable/disable. (Mozilla Support)

National Institute of Standards and Technology (NIST). (2020). NIST Privacy Framework Version 1.0. (NIST)

National Institute of Standards and Technology (NIST). (2024). NIST Cybersecurity Framework (CSF) 2.0. (NIST)

National Institute of Standards and Technology (NIST). (2025). SP 800–63B-4: Digital identity guidelines — Authentication and authenticator management. (nvlpubs.nist.gov)

Nissenbaum, H. (2010). Privacy in context: Technology, policy, and the integrity of social life. Stanford University Press. (Stanford University Press)

Office of the Privacy Commissioner of Canada (OPC). (n.d.). Online privacy resources and tips; PIPEDA consent guidance. (Privacy Commissioner Canada)

OWASP Foundation. (2018). OWASP IoT Top 10. (OWASP Wiki)

ENISA. (2020). Guidelines for securing the Internet of Things. European Union Agency for Cybersecurity. (ENISA)

U.S. National Security Agency (NSA). (2021). Securing wireless devices in public settings. (NSA)

CISA. (2025). Securing your home Wi-Fi (Project Upskill Module 5). (CISA)

OpenAI. (2025). Data Controls FAQ; Overview of OpenAI crawlers. (OpenAI Help Center)

Google Search Central. (2025). Robots.txt & crawler controls (incl. Google-Extended). (Google for Developers)

Common Crawl. (2025). Opt-out registry / protocols overview. (Common Crawl)