Advanced Privacy & Security Configurations
Signal, encrypted email, mobile lockdown, and automated data removal - the next layer for people who've finished the basics.
Start here first
This guide assumes you already have a password manager and MFA set up across your main accounts. If you haven’t done that yet, start with the foundational guide →.
For active account compromises, refer to the Incident Response Guide →.
1. Network-level data control Setup: ~15 mins
Most tracking happens before you ever click anything - it runs at the network level the moment a page loads. Two layers stop most of it: your browser (blocks scripts in the tab) and your DNS (blocks connections before they even start). The EFF’s Surveillance Self-Defense goes deeper on the threat-modeling side if you want to understand what you’re actually defending against.
uBlock Origin
An open-source extension that stops tracking scripts and ad code from running in your browser.
NextDNS
A DNS-level firewall that kills connections to tracking and malware domains before anything leaves your device.
Setting up a DNS firewall
NextDNS
NextDNS is a DNS-level firewall you control. Route your traffic through it and you block ads and telemetry across every device on your network - including smart TVs, phones, and anything else that doesn’t support browser extensions.
Set up NextDNS ↗
DNS filtering vs. a VPN
DNS filtering blocks connections to known tracking and malware domains. It doesn’t encrypt your traffic or hide your IP from the sites you actually visit.
A VPN encrypts everything between your device and the provider, hiding your IP and browsing from whoever runs the network you’re on.
Lock down your router
Router settings worth changing
2. Mobile device security configurations Setup: ~20 mins
Your phone knows where you’ve been, what you’ve searched, and who you talk to. The defaults share more of that than you’d want. These settings take about 20 minutes and don’t break anything.
Lock down your cloud accounts
Apple iCloud:
Enable Advanced Data Protection. This turns on end-to-end encryption for most iCloud data - only your trusted devices hold the decryption keys, not Apple.
Google Accounts:
Enroll in the Advanced Protection Program. This enforces the use of hardware security keys and limits the scope of third-party application access to account data.
Settings to change on your iPhone
Stripping location data from photos
Every photo your phone takes embeds GPS coordinates by default. When you text or post it, that data goes with it. Easy to remove before sending.
On iOS: Tap share → Options at the top → toggle Location off before you send it.
Takes two extra taps. Worth making it a habit for anything you’re sharing publicly or with people you don’t fully trust.
3. Hardware and application audits Setup: ~20 mins
Most people have apps with permissions they’ve forgotten about, cloud sync enabled on things they don’t use, and no encryption on their drive. This pass catches all of it.
4. Identity compartmentalization Setup: ~25 mins
If every service knows your real name and email, a breach at any one of them connects back to all the others. The fix is to use different identifiers for different tiers of trust - and keep your real identity off anything you don’t need it on.
Email aliasing
Your real email should be known only to institutions you actually trust. Everything else gets an alias you can kill the moment it starts getting abused.
Your real address
Restricted to financial institutions, government agencies, and family contacts.
Aliases you hand out
Use these for retail, entertainment, and app signups you don’t fully trust.
Built into Apple
Hide My Email
iCloud+ generates a throwaway address for every service you sign up for and forwards the mail to your real inbox. The service never sees your actual address.
Free, works anywhere
Sub-addressing
Add a tag to your existing address - name+netflix@gmail.com - and you’ll know exactly who leaked or sold it when spam starts arriving. Free, and you can filter on it.
Private messaging
Signal Protocol
Signal encrypts your messages and calls end-to-end, and the code has been independently audited. It also keeps far less metadata about who you talk to than SMS does.
Review Signal Protocol ↗
Carrier Port Protections
All three major US carriers offer this for free, just under different names: Verizon’s Number Lock, T-Mobile’s Port-Out Protection, and AT&T’s Wireless Account Lock. Turn it on - it blocks anyone from moving your number to a new SIM without your say-so.
Hardware security keys
Hardware-based authentication provides high resistance to phishing by requiring physical presence to authorize account access.
YubiKey 5C NFC
A physical key that cryptographically verifies the destination domain before authorizing a login. It is a standard for protecting high-value accounts such as primary email and financial portals.
Machine Learning Opt-Outs
Automated Data Removal
Brokers re-list you every few months, so a one-time removal doesn’t hold. These services keep submitting the requests for you.
Shows you exactly where your data appears, then handles removal automatically. The free tier scans and shows you the exposure report, which is worth running even if you never pay. Removals start at $39/year for 375+ sites.
See Optery pricing ↗
A managed service that files deletion requests across 750+ brokers and sends you quarterly reports. $129/year for one person, $329 for a family of four. Annual billing only.
See DeleteMe pricing ↗
California Residents: DROP Utility
The California Privacy Protection Agency provides the Delete Request and Opt-Out Platform (DROP). This utility allows residents to submit deletion requests to all registered brokers through a single government interface.
Access DROP Utility ↗
5. Financial insulation Setup: ~30 mins
Use a different card number per merchant, so a breach at one store doesn’t expose your actual account everywhere else. You don’t need to go all-in on this - Apple Pay, Google Pay, and Google Wallet already tokenize your card for free every time you tap to pay, which covers most everyday purchases with zero setup. Virtual card services are for the sites and subscriptions you can’t tap to pay for.
Virtual cards for online purchases
Privacy.com
Privacy.com lets you create a unique virtual card per merchant. If a vendor gets breached, that card number is useless everywhere else - your actual bank account stays isolated.
Review Virtual Card Features ↗
Keeping this up over time
None of this is set-and-forget. New accounts pile up, data brokers re-list you months after a removal, and devices fall behind on updates if you’re not checking. A few minutes every few months keeps it from drifting.
Frequently asked questions
Do I need a VPN at home?
Why use encrypted email like Proton Mail?
How do I get my data removed from people-search sites?
Cite this guide: "Advanced Privacy & Security Configurations", jason.guide, updated 2026-08-19. https://jason.guide/guides/privacy-advanced