10 Everyday Habits to Protect Your Privacy in the Age of AI

Your phone pings with a delivery update. You tap your loyalty card at the till. A smart speaker hears a song request. A work chat fills with quick screenshots and voice notes. None of it feels dramatic, but each moment sheds tiny crumbs of data. AI is good at sweeping those crumbs into a neat pile, then guessing who you are, what you’ll buy, where you’ll go, and what might scare you into clicking.

In this post, privacy means control: what gets collected, who can see it, and how it’s used. Not “go off-grid” privacy, just the kind that fits around school runs, office calls, and a busy weekend.

Rules are shifting in 2026, with tighter expectations around automated decisions and profiling (and more opt-outs in some places). The UK regulator has also been vocal about accountability when AI tools act on people’s behalf, and EU rules affect many UK firms that serve EU users. Even so, personal habits still matter, because a lot of privacy loss happens before any law can help.

Photo by cottonbro studio

Shrink your data footprint before it gets scooped up

Make “share less” your default for apps, forms, and profiles

What to do: practise data minimisation. If an app can work without a permission, don’t grant it. Keep location, contacts, photos, Bluetooth, and microphone access as tight as possible. Choose “Only while using the app” for location, and say no to “Precise location” unless it’s a map or taxi app.

Where to find the setting:

• On iPhone: Settings → Privacy & Security (then check Location Services, Contacts, Photos, Bluetooth, Microphone, Camera).
• On Android: Settings → Privacy or Security & privacy (then Permission manager).
• For ad tracking: look for Advertising settings and switch off ad personalisation (many phones also let you reset an advertising ID).

Add one small routine: once a month, delete apps you haven’t used, close old accounts, and remove public-facing details from profiles (date of birth, phone number, home town). AI can stitch these together like scraps of fabric into a recognisable pattern.

Common mistake to avoid: tapping “Allow” to clear a pop-up fast, then forgetting it. Permissions aren’t a one-time choice, they’re a standing invitation.

Switch on Global Privacy Control and tighten cookie settings

What to do: enable Global Privacy Control (GPC) where it’s available, and choose strict cookie options on sites. GPC is a browser signal that tells sites “don’t sell or share my data”. It won’t stop everything, but it can reduce the flow of browsing data that fuels ad targeting and, in some cases, data reuse for training.

On cookie banners, prefer “Reject non-essential” or “Essential only”. If a banner offers “legitimate interest” toggles, turn those off where you can. That wording often means “we’ll track unless you stop us”.

Where to find the setting:

• In a privacy-focused browser: check Privacy or Tracking protection settings for GPC and stronger anti-tracking.
• In mainstream browsers: look for Privacy and security options like stricter tracking protection, and review cookie controls.

This is also where the 2026 rule changes matter. Expect more services to offer clearer opt-outs and better explanations of automated decisions. Trend trackers such as privacy enforcement expectations for 2026 show a push for transparency and tighter limits on profiling. Still, your browser settings are the front door.

Common mistake to avoid: accepting cookies for “speed”. A site might load one second quicker, but you pay for it with months of tracking.

Block trackers as you browse, and clear the clutter

What to do: block trackers and keep your browsing tidy. Trackers are hidden scripts that watch what you do across sites, then report back to ad networks and data brokers.

Use a reputable tracker blocker (built-in or add-on), turn off third-party cookies, and clear site data for places you no longer use. Treat your browser like your hallway cupboard: if you never empty it, it fills with junk you didn’t ask for.

A practical rule helps: if a site won’t work without invasive tracking, consider a different site. Plenty of publishers and shops function fine without following you around.

Where to find the setting:

• Browser settings: Privacy and security → block third-party cookies, tighten tracking protection.
• Browser history controls: clear cookies and site data for specific sites you’ve stopped using.

Common mistake to avoid: clearing everything daily and thinking you’re “safe”. That can break logins and annoy you into turning protections off. Aim for targeted clean-ups: remove what you don’t need, keep what you do.

Stop accidental oversharing through photos, files, and links

What to do: prevent metadata leaks. Photos can include location data (EXIF). Documents can reveal your name, edits, comments, and even older versions. Sharing links can quietly move from “only invited people” to “anyone with the link”, which is basically “anyone who forwards it”.

Turn off location tagging for your camera unless you truly use it. Before sending a file, export or “print to PDF” where possible, and remove comments and tracked changes. For cloud links, use invite-only access for personal documents, and set links to expire when the option exists.

Where to find the setting:

• Phone camera settings: look for Location tags, Geotagging, or Save location.
• Google Drive, OneDrive, Dropbox-style sharing: open Share settings and check link access (invited people vs anyone-with-link).
• Office apps: check Document inspector or Remove personal information options.

Common mistake to avoid: sharing a folder when you mean to share one file. A folder can expose future uploads too, not just what’s inside today.

Lock down accounts so AI-powered scams don’t walk right in

Use a password manager, then move to passkeys when you can

What to do: use unique logins everywhere. Re-used passwords fail in the simplest way: one breach becomes a master key for your other accounts. AI makes that worse by helping criminals test, guess, and message at scale with believable “support” chats.

A password manager is the one place to remember, it creates and stores strong passwords. Then, where major services offer them, switch to passkeys. Passkeys are designed to resist phishing because there’s no password to type into a fake page.

Where to find the setting:

• In your device settings: both iOS and Android offer built-in password management, and browsers can store passkeys.
• On key services (email, banking, shopping): look under Security, Sign-in methods, or Passkeys.

Quick checklist: choose a long master password, keep your phone or laptop locked (PIN or biometrics), and store recovery codes somewhere safe (not in the same email inbox you’re protecting).

Common mistake to avoid: putting recovery codes in a Notes app that syncs everywhere without protection. Treat recovery codes like spare house keys.

Turn on strong sign-in checks, and avoid SMS codes

What to do: enable multi-factor authentication (MFA) that stands up to modern attacks. SMS codes are better than nothing, but they can be stolen through SIM swap fraud, where a criminal tricks a mobile provider into moving your number to their SIM. Once they have your texts, they have your codes.

Use an authenticator app or a physical security key instead. Then review your account security pages twice a year: logged-in devices, recent logins, connected apps, and “trusted” sessions. Kick out anything you don’t recognise.

Where to find the setting:

• Email accounts: Security → Two-step verification (choose app or security key).
• Social and messaging apps: Account → Security (often includes “devices” lists).
• Apple ID or Google Account: Security pages show logins and connected apps.

Common mistake to avoid: turning on MFA, then ignoring “new login” alerts. If you get a prompt you didn’t trigger, assume someone has your password and act fast.

Build a quick “pause and verify” routine for messages and calls

What to do: slow down before you respond. AI helps attackers write polished phishing emails, fake support chats, and even clone voices for urgent calls. The trick is speed. They want you flustered, not careful.

Use a simple method: pause, check the sender, then verify using a second channel. If a “bank” text arrives, don’t tap the link. Open your banking app directly or type the known address yourself. If a colleague asks for gift cards, confirm via a call to the number you already have, not the one in the message.

For families, a passphrase can stop panic transfers. It doesn’t need to be clever, it just needs to be private and consistent for “urgent money” requests.

Where to find the setting:
This habit lives less in menus and more in your own routine, but you can support it by turning on spam call filtering, enabling message request filters, and limiting who can add you to group chats.

Common mistake to avoid: trusting familiarity. A familiar name and a normal tone can be faked. Verification beats vibes.

Make your devices quieter, and keep smart tech on a short leash

Treat microphones and cameras like open windows

What to do: reduce always-on sensing. Mics and cameras are like open windows in winter. Most of the time nothing bad blows in, but you still don’t leave them wide open all day.

Use a physical webcam cover on laptops. Review which apps have microphone and camera access, and remove access for anything that doesn’t need it. If you don’t use wake-word features on smart speakers or phones, turn off always-listening mode. Also remember to check browser permissions for mic and camera on your laptop.

Add a weekly habit: after installing new apps, do a quick scan of mic and camera permissions.

Where to find the setting:

• Phone: Privacy → Microphone and Camera permissions.
• Laptop browsers: Site settings → camera and microphone permissions.
• Smart speakers: device app settings often include wake-word and voice recording controls.

Common mistake to avoid: assuming “mute” is always mute. Some devices have a software mute, a hardware mute, or both. Prefer hardware mutes when possible.

Buy fewer “smart” features, and put IoT on a guest network

What to do: keep your smart-home simple, and fence it off. In one line, the difference is this: local processing stays in your home, cloud processing gets uploaded. The more cloud features you add, the more data leaves your network.

Before buying a gadget, ask what it needs to send out to work. Then do the basics: update firmware, change default passwords, and place IoT devices on a guest Wi‑Fi network if your router allows it. That way, if a cheap plug or camera gets compromised, it’s less likely to expose your laptops and phones.

Where to find the setting:

• Router settings: look for Guest network or Guest Wi‑Fi in the router app or admin page.
• Each IoT device app: check for firmware updates, account security, and cloud recording settings.

Common mistake to avoid: using the same password for your router and your devices. If one falls, they can all fall.

A quick family note: kids’ tablets and shared home accounts often collect more than you expect, because people log in, out, and in again. Keep separate profiles where possible, and review app permissions on family devices regularly.

Opt out of profiling and clean up the “AI guesses” about you

What to do: reduce targeted ads and automated decisions. Profiling is when software guesses what you’ll do, buy, or believe, based on your behaviour. Those guesses can be wrong, sticky, and hard to see.

Go into major accounts and look for settings like “personalised ads”, “profiling”, “interest-based ads”, and “automated decision-making”. Turn them off where offered. Where services allow it, request a copy of your data and delete old inferences. This matters for teens too, because interest profiles can follow them into adult life.

To understand why this is becoming a bigger deal, it helps to keep an eye on public privacy discussions such as Data Privacy Day 2026 guidance and summaries like data privacy trends for 2026. The direction of travel is clear: less silent profiling, more accountability.

Where to find the setting:

• Google, Meta, Microsoft-style accounts: Privacy and Ads sections.
• Mobile devices: Privacy → Advertising (turn off personalisation, reset IDs).
• Streaming and shopping services: Account → Privacy or Personalisation.

Common mistake to avoid: changing the setting in one place and assuming it applies everywhere. Many services have separate toggles for ads, recommendations, and “improving products”.

Conclusion: privacy is a routine, not a one-off fix

These 10 habits add up: share less by default, send clearer signals to reduce tracking, block and clean browsing data, strip metadata, use unique logins with passkeys where possible, choose stronger MFA than SMS, verify messages through a second channel, rein in mics and cameras, separate smart-home devices, and opt out of profiling while cleaning up the “AI guesses” about you.

Try a small plan that doesn’t rely on willpower. Spend 10 minutes on Sunday checking permissions, updating devices, and scanning account security pages. Then do one monthly clean-up: delete unused apps, close old accounts, and review cloud sharing links.

Privacy isn’t perfection. It’s steady choices that make you harder to profile and harder to trick, even as AI gets sharper at both.