Easy practices for online privacy

If you're online, your personal data is at risk. It might feel impossible to protect your data from hacks and breaches, but there are methods to make it slow and expensive for bad actors to target you. Our experts share simple measures to better protect your data online, including practices you can pick up starting now. Learn more about sponsor message choices: podcastchoices.com/adchoicesNPR Privacy Policy

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  I'm Kevin Roos. And I'm Casey Newton. And together, we've been tech journalists for decades. Now, we're your hosts of Machine Gods, a new podcast from NPR that makes sense of what AI means for your work, your life, and all of our futures. Twice a week, we'll be exploring the biggest moves in tech and give you unmatched access to the real titans of industry. Listen to Machine Gods from NPR on the NPR app or wherever you get your podcasts.

• 0:24Marielle Segarra?

  You're listening to Life Kit from NPR. Hey, it's Marielle. If you have ever used the internet, which, given the fact that you're listening to a podcast right now, I think you have, then your data is up for grabs. Things like your full name, your date of birth, what websites you visit, and your location, among many other things. There are people who are very interested in your data. I mean, it seems like every day another company is admitting to a data breach. Just a few examples from the past couple of years. AT&T, Ticketmaster, Yahoo, Facebook, and the data broker National Public Data have all experienced breaches that compromised millions of private records.

• 1:09Marielle Segarra?

  This has been very concerning for Samuel Horst Kessler. He's a producer for the Planet Money podcast.

• 1:15Speaker 02

  We've worked on this episode about the illegal and legal markets for your data. And I've previously kind of had this stance of like, well, it's my data, but I'm not really using it. So like, if somebody else wants to take it for a spin, you know, that's all fine with me. But the more I learned about what people are using my data for and how they can access it, the more just like nervous I became, like, right in the pit of my stomach.

• 1:40Marielle Segarra?

  On this episode of Life Kit, Sam is going to talk to experts about what kind of data about us lives on the internet, who wants it, why? And of course, what steps you can take to protect yourself.

• 1:57Speaker 03

  Stay tuned for the following announcements and messages from our sponsors. This week on Wait, Wait, Don't Tell Me, panelists Paula Poundstone shares a hot tip for saving money this Halloween.

• 2:08Speaker 04

  I used to have my kids go out early enough that I could take their candy and give it out.

• 2:15Speaker 03

  That's so smart.

• 2:16Speaker 04

  Yeah.

• 2:16Speaker 03

  Don't miss our full conversation and the rest of our games. Listen to the Wait, Wait, Don't Tell Me podcast in the NPR app or wherever you get your podcasts. This midterm election season, the NPR app is your single stop for clear, independent coverage. Stay on top of national and local storylines with news, stories, podcasts, and political analysis on demand. Download the NPR app and check out the Elections 2026 tab today.

• 2:48Speaker 05

  This week on Here and Now Anytime, in the closing days of the midterm elections, we're in Iowa and Arizona, two states where independent voters will decide who controls Congress for the next two years.

• 3:00Speaker 06

  Even though we're in a red district, we will get out the Democratic and independent vote. We will.

• 3:06Speaker 05

  Here and Now Anytime. Listen on the NPR app or anywhere you listen to podcasts.

• 3:13Speaker 02

  So the more I learned about how my data lives online, the more anxious I found myself becoming. I wanted someone to help alleviate that, so I went and spoke with Rebecca Skeet, the COO of Black Girls Hack. It's a nonprofit focused on training in technology and cybersecurity. I've existed on the internet for most of my life.

• 3:32Speaker 05

  Right.

• 3:32Speaker 02

  And during that time, I've had many accounts. I've been on Twitter. I've been on Instagram. I had a Neopets account. Club Penguin probably has my social security number at this point. Like, am I already screwed? Like, is everything already out there that could be out there?

• 3:45Speaker 07

  Um, I'm not going to say everything. Is there a possibility or likelihood that you have been impacted in some way by some breach at some point? Then the short answer to that is yes, it's possible. Is it likely? Probably.

• 3:59Speaker 02

  OK, so Rebecca, not exactly coming in hot with the silver lining, but she did help me understand better that even though the digital genie might already be out of the bottle, I do have some control over the situation.

• 4:11Speaker 07

  I think the first thing that you can do is take power in the ways and the opportunities that you have to take power in. I read this quote one time that said that, uh, "Action is the antidote to anxiety." So what action can you take?

• 4:25Speaker 02

  What action can you take? How can you do things like protect your social security number and credit score? Strategies like these are what we're going to be going through in today's episode. But first, I wanted to understand, before I take any action, what's at stake here? Does my digital footprint really matter all that much? Which brings us to our first takeaway, understanding the risks and understanding your risks. Anyone is susceptible to identity theft, and the consequences can be dire. But it's also up to each individual to determine what exactly is at stake for them and what action they can take to best ensure their protection. To better understand my digital risks, I spoke with staff attorney for the Federal Trade Commission, Megan Cox.

• 5:07Speaker 02

  She's helped prosecute cases relating to online privacy and data security. She helped me define some questions like, who should I be worried about getting their hands on my data? When I hear about bad actors, people don't mean like Nick Cage, right? They mean like, it's something else. Like, what is a bad actor online? Like, what do they, what do they do?

• 5:24Speaker 08

  When we're talking about bad actors, we're talking about identity thieves and fraudsters.

• 5:29Speaker 02

  I should say, no shade to Nick Cage, he's still my favorite Superman.

• 5:32Speaker 08

  So to take a step back, I think defining the term "identity theft" is helpful. It's when someone's using your personal or financial information without your permission. It can include stealing your name and address. Credit card, bank account, or financial information, social security number, or even your medical insurance accounts and information.

• 5:52Speaker 02

  Identity thieves might buy expensive tech with your credit cards. They can open up new credit cards or new accounts in your name. They can also start utilities, electricity, phone, gas accounts, using your identity. They can steal your tax refund if they file a tax return before you get to it. They can use health insurance to get medical care and let you foot the bills. And importantly, in many cases, they can destroy your credit score and leave you unable to get a line of credit in the future. This is all if you lose a hold of your PII, your personally identifiable information. This means things like your social security number, your SSN. You can take steps to protect your SSN by not carrying your card with you, destroying documents that have it written down, and calling the Social Security Administration and asking them to place a self-lock on your SSN,

• 6:37Speaker 02

  which would make it harder for anyone to access your social security records, but it also may make applying for a job harder. So make sure to unlock it before you begin a job hunt. You should also take care to not share freely information like your full name, your date of birth, your address, or your financial information.

• 6:52Speaker 08

  But there are other numbers that might not immediately come to mind as ways to perpetuate fraud or create risk of identity theft to you, like a passport number or a lost driver's license. There are ways that those forms of identification can be misused and cause problems. So we urge everybody to try to keep as much as their information and these documents secure and in your possession.

• 7:14Speaker 02

  While protecting your most essential information, like your SSN, is crucial for everyone, our experts recommend doing a kind of personal risk assessment. What assets do you have? What's at risk for you? Do you have a high or low risk tolerance?

• 7:27Speaker 07

  For someone who is an influencer, their risk profile is going to be different for me. I don't have to share the level of things that someone whose livelihood is derived from what they do online. They're going to have to share locations and things like that, but they can still be mindful of how they do it.

• 7:43Speaker 02

  We're going to discuss the ways to protect yourself and your data, but all of these may not be applicable or useful to every individual. Think of it like a toolkit, and you can pick and choose what tools you need. Rebecca with Black Girl's Hack does want to make sure everyone understands that even if you think you may not be a target for identity thieves, you may still be at risk.

• 8:01Speaker 07

  Because I've heard a lot of people say, ah, well, if they get into my bank account, they're not going to be able to get much, or whatever else. But if there are 100 people who have a dollar, you still get $100 if you get those 100 people, you know? And so they're not looking at it as a, hey, I have, this person only has $1. It's, look at all of this low-hanging fruit.

• 8:19Speaker 02

  And consider that you may not even be the main target. It could be your company or a family member. The data you've shared online can be leveraged to convince someone else of something that isn't true, like that you're being held for ransom, say. Rebecca says when it comes to theft, you may not have to take every effort, but employing some basic protection can at least make it difficult and expensive for identity thieves to get your information, which may be enough for them to look elsewhere for targets.

• 8:48Speaker 02

  That brings us to our second takeaway. Don't be an easy target. You can adopt a healthy skepticism to every interaction online. Rebecca calls this polite paranoia. It's a term coined by Rachel Toback with Social Proof Security. This means asking questions about how your data is going to be used, pausing and thinking twice before you hand anyone your PII.

• 9:12Speaker 07

  And then be cautious, you know, with what you share online. You mentioned all those different platforms and places where your information may lie. We can still be guarded and cautious with the information that we share.

• 9:25Speaker 02

  Like, before you fill out an online quiz or before you jump on the hot new meme, pause and think twice.

• 9:32Speaker 07

  I used to love the things of, what's your Bridgerton name? It's the street you live on, and it's your dog's first name. While you can do that internally, you can play the game and maybe text it to your friends, don't post that online because oftentimes, those questions and things that folks ask are portals into your personal information that people often leverage for their passwords and things like that.

• 9:55Speaker 02

  They had one of those for NPR. It was like your favorite pattern of clothing and then what you had for breakfast this morning.

• 10:03Speaker 07

  The answer has absolutely nothing to do with anything pertinent to me, but Argyle pancakes. It sounds fantastic.

• 10:10Speaker 02

  So right there, you can hear Rebecca does a quick risk assessment. You know, am I asking her for any personal information that can be leveraged against her? And she says she did the same thing when I first reached out to interview her. She paused, considered if what I was asking from her was suspicious or crossed a line, and then made an informed decision.

• 10:28Speaker 07

  Ask questions. If something feels weird, ask questions. And because usually if it feels weird, it kind of is, you know? And it's OK to say, you need this information. Why? What are you doing with it? It might not be you, but what if someone is able to leverage you, leverage the connection of being you, acting like you, or saying that they know you, to then infiltrate or take advantage of a family member or your work?

• 10:51Speaker 02

  A method Rebecca champions is called Take 9, meaning take nine seconds at least to think over any requests for your data online. Take 9 is also the name of an initiative between several cyber organizations. They encourage web users to take basic internet safety measures to ensure we all experience a safer internet. Some of the methods they and other experts recommend include updating your software often, because companies use updates to fight the latest malware. You should also restart your devices at least once a week to apply software updates and improve performance. And you should be using unique, strong passwords. You can also consider using a password manager. Some popular ones are OnePassword, LastPass, or NordPass.

• 11:33Speaker 02

  One thing that I just kind of have been wondering for a minute now is like, when you use a password manager, you're giving them everything. You're giving them passwords to all of your stuff. And like, is there a risk?

• 11:46Speaker 07

  Not a high one, because password managers employ, you know, they have strong encryption and other security measures to protect your passwords.

• 11:55Speaker 02

  Rebecca says password managers are often built with zero-knowledge architecture, meaning the manager doesn't have access to your passwords, nor do they have the key to your passwords. You're the only one who can access it, even if they get infiltrated. But she says if you're still worried, you can take things one step further. Say your password manager has an autofill function. You can also add a special character at the end that only you are aware of, like a punctuation mark or a favorite number.

• 12:21Speaker 07

  My password is password 32. Think, OK, why 32? Because in Love and Basketball, that was the number of Monica, the lead character.

• 12:30Speaker 02

  And now you can never use that.

• 12:31Speaker 07

  Right, no, and I wouldn't.

• 12:33Speaker 02

  You should also turn on multi-factor authentication or two-factor authentication. That's where, besides entering a password, the site sends you a code via another method to ensure you're really you.

• 12:43Speaker 07

  The benefit of having that two-factor authentication in place is that even if someone were to get your password, they don't have that second factor, and it can at least be a block for a potential intruder.

• 12:53Speaker 02

  One of the preferred methods is through an authenticator app, like Duo or Google Authenticator. I should note, Google is a financial supporter of NPR. You can also get a physical pass key, which plugs into your computer and enters a code automatically. Those aren't free, though, typically, and are susceptible to loss. You can also get a code via SMS text, but experts feel this is less secure because identity thieves can SIM swap or take control of your phone number and intercept your messages.

• 13:18Speaker 07

  It is better than nothing because at least there's some secondary step in place, but it would be, of them, the least protective.

• 13:26Speaker 02

  So maybe try authenticator apps first. Now, you've got multi-factor authentication set up, you've got a password manager, you're being politely paranoid, you're taking nine. Congratulations, you are no longer the easiest target out there. And fortunately, after you've taken these steps, you can mostly forget about them. They're passive, which is why you should also take some time semi-regularly to be active when it comes to your data.

• 13:51Speaker 02

  Which brings us to our third takeaway: clean up your digital environment, just like you would your living environment.

• 13:56Speaker 07

  I do a digital spring cleaning.

• 13:59Speaker 02

  So, delete unused apps, remove extensions, go through your accounts and web browsers, and review your data and privacy settings, and delete your browser history. Clear your cache. Double-check your public accounts to make sure they are not sharing any unwanted information. People, delete those old tweets.

• 14:14Speaker 07

  It's a good opportunity that, ideally, we should do it more frequently, or as frequently as possible, but realistically, it's not something that people can do once a month or once a quarter. So at the very least, if when you're doing your physical spring cleaning, you do a digital spring cleaning, and clear out those applications, you know, check to see the different extensions that you have that you don't necessarily use anymore, see what information those things are gathering.

• 14:42Speaker 02

  Backup your devices. On an external hard drive and dispose of old devices securely. This is to make sure they don't fall into the hands of bad actors who can dredge up information from any drives they come into possession of. This would also be the time to change your passwords. But remember to use unique, strong passwords for every account. You may also consider using a data removal service if you can afford it, like DeleteMe or Incogni. They can check for your personal information across different databases and remove them for you. You can also consider a credit freeze. A freeze blocks access to your credit reports, so no one can open a credit card or get a loan in your name. You can do this with any one of the big credit reporting agencies, like what Megan Cox at the FTC calls the big three: Equifax, TransUnion, and Experian.

• 15:25Speaker 08

  If you are able to, you can consider a credit freeze. And this keeps people from being able to access your credit report for creditors to open new accounts. So if somebody wants to check your credit before giving it a new credit card, a new mortgage, they would be checking your credit report. And if it's frozen, they can't see it. And so they're very much less likely going to extend credit. So in that case, a fraudster would be blocked from opening a new credit account or a new mortgage, for example.

• 15:53Speaker 02

  Credit freezes are free, take only a few minutes, and you can thaw them at any time. Like if you need to apply for a loan or an apartment, just make sure to give it a little bit of a window for the thaw to go into effect. You might also consider using a credit monitoring service. These agencies offer them, and so do other companies like LifeLock. Those can detect potential fraudulent activity, track your credit score, and give you access to your credit reports, and sometimes offer tools and tips to boost your credit score. Now, I should note that even these big credit reporting agencies experience data breaches. In 2017, Equifax, one of the big three, fell victim to a data breach itself that exposed the personal information of 147 million people. Experian suffered a similar breach in 2015, though not as severe.

• 16:37Speaker 02

  Also, when you sign up for credit monitoring, a company's terms and conditions may ask you to waive your rights to sue the agency and may ask your permission to use and share the information on the legal data market.

• 16:48Speaker 08

  I think it's it's an individual bargain that every consumer kind of has to determine for themselves if engaging with a credit monitoring service would be a A pro for them and outweigh any of the cons that they might see from data being used. I would urge them to, in that case, read the terms and conditions to understand if they can opt out of any of that.

• 17:08Speaker 02

  It's true. You can opt out from the big three, selling and sharing your personal information. You just have to follow the steps on the website's privacy page. That's in regards to the legal sharing and selling of your data. But going back to your personal risk assessment, do you prefer to have credit reporting in case your data gets leaked, knowing that your data might be at risk of a leak with one of these big three credit reporting agencies? That's ultimately up to you to decide. Another item for your digital spring cleaning? Consider using antivirus software, or what's known as a VPN. A VPN, or a virtual private network, is like a tunnel you can use to protect your data from anyone who wants to access it, like identity thieves or data harvesting companies.

• 17:50Speaker 02

  Many people choose VPNs to provide more private browsing, but you should also be cautious about VPNs, since whatever company offers it will have access to that data. And, just like all the other strategies we're talking about today, they're not bulletproof. Experts recommend Proton VPN or Nord VPN for the best privacy at low or no cost. And if you are worried about cost, Rebecca says you don't always have to shell out on privacy products. A lot of products come native to your device. You can start there and see if it's doing the job you'd like it to.

• 18:20Speaker 07

  Just because it's free doesn't mean it's good, but just because it's free also doesn't mean that it's bad.

• 18:24Speaker 02

  And on that note, one more practice to pick up during your digital spring cleaning. Talk to your friends and family about their digital environments. Encourage them to do their own personal risk assessment. Walk them through the different tools that are available to them. This goes for the less tech literate, or, say, children, learning how to interact on the internet for the first time. Megan recommends talking them through the digital best practices and understanding what information they shouldn't share online. She also recommends freezing their credit, at least until they're old enough to begin doing things like taking out a student loan or renting an apartment.

• 18:56Speaker 08

  And then finally, locking down their social networks so that they're not sharing information more broadly than they are intended, or communicating with individuals that parents might not be aware that they're communicating with. When they're, you know, starting online as a new digital citizen, I should say.

• 19:13Speaker 02

  Similar to fighting infectious diseases, if each individual does their part to protect themselves, we all become a lot safer in the digital world. And by the way, not all of this has to get done immediately. Any little bit helps. Maybe today you set up a VPN and a week from now you change five of your passwords. Or maybe you set aside an afternoon to do a total clean sweep, checking off all of the above. Remember, action is the antidote to anxiety. So if you're feeling anxious, combat it with some small action to take charge of your digital security.

• 19:46Speaker 02

  But what if the worst happens? What if we do end up having our data leaked in a breach? Well, that brings us to our fourth and final takeaway. Don't panic. Megan Cox has been there before.

• 19:57Speaker 08

  I have received a lot of letters about different data breaches, exposures of information. And some, they range in the circumstances they provide about what might have happened or what information's exposed and different offers that you might get as the consumer who's impacted.

• 20:11Speaker 02

  This would be the time to see what offers the companies are giving you. They may offer you free credit monitoring, credit reports, or a credit freeze, all of which you can consider with the caveats we mentioned before.

• 20:22Speaker 08

  So if you receive a letter in the mail saying your data has been exposed, we would urge you to go to identitytheft.gov and find out what you can do next to learn about steps to take to mitigate any potential harms.

• 20:36Speaker 02

  If someone does attempt to use your personal information to impersonate you, you can file a report at identitytheft.gov and they will walk you through the next steps there. It is important to begin a paper trail validating the identity theft that may help you in the future, like if you have to go to court. Rebecca says you most likely will have to be vigilant after that point about suspicious activity.

• 20:55Speaker 07

  If you have been compromised, there are websites like haveibeenpoamed.com where you can enter your email address and see what breach it's potentially been involved in, and it'll also say what information might have been compromised.

• 21:07Speaker 02

  This would also be the time to go back to our previous takeaways. And if you haven't taken action, start now. Do a digital cleaning, lock down your accounts, set up two-factor authentication, and delete apps and accounts you no longer need.

• 21:19Speaker 07

  And then from a financial credit card account standpoint,

• 21:24Speaker 07

  make sure that you're watching your charges or new accounts opening your name. And if you see something that looks anomalous, place, you know, a fraud alert or a credit freeze with major credit bureaus. Don't waste time berating yourself pivot, okay? If it's something, if it's a personal email, you think your email has been, your password has been compromised, change your password.

• 21:45Speaker 08

  And if your information has not been misused yet, you don't necessarily need to make an FTC identity theft report, but you can still go to the website to learn about all those next steps.

• 21:54Speaker 02

  So I know this all can be overwhelming, but it doesn't have to be. Think of this like your home security. Not everyone needs round the clock guards and watchdogs. For most people, just taking common sense precautions can make you less of a target and you can always reassess and pivot. Our experts recommended just a skeptical disposition and to always be aware of your risks.

• 22:14Speaker 08

  Consumers should be vigilant. I think that there's a lot of data that's circulating in our ecosystems, whether it's on social media or your device or on the different wifi networks you're navigating to. You know, there are vulnerabilities in these systems. And so, understanding that your data is circulating out there and taking steps that make sense for you.

• 22:37Speaker 02

  On that note, it's time to recap our takeaways. Takeaway one, understand the risks and understand your risks. Assess your personal stakes. What assets do you have that are vulnerable and how can you protect them? Do you have family members or company information that bad actors may be interested in? What tools are available to you to help address those? Takeaway two, don't be an easy target. Make it slow and expensive for someone to get your data. You can do this by using a password manager, turning on automatic updates and using multi-factor authentication for your accounts. And remember, if someone asks for your personal information, be politely paranoid and take nine seconds to pause and evaluate your risks. Takeaway three: do your digital spring cleaning.

• 23:20Speaker 02

  Clean out apps, extensions, and update your public-facing accounts. Consider products like credit reports, VPNs, or antivirus software, but understand the risks associated with those and know you can always begin with free software before investing in paid products. And talk to your family about their risks and best practices. Takeaway four: if your data gets leaked, don't panic. Change your passwords and stay updated on the situation using either a credit reporting agency, or have I been pwned, or both, to know if your information is out there. You can visit identitytheft.gov to go through your options.

• 23:53Marielle Segarra?

  That was producer Sam Yellowhorse Kessler. For more Life Kit, check out our other episodes. We have one on avoiding scams and another on how to spend less time on your phone. You can find those at npr.org/lifekit. And if you love Life Kit and you just cannot get enough, subscribe to our newsletter at npr.org/lifekitnewsletter. Also, we love hearing from you, so if you have episode ideas or feedback you want to share, email us at [email protected]. This episode of Life Kit was produced and reported by Sam Yellowhorse Kessler. Our visuals editor is Beck Harlan, and our digital editor is Malika Gharib. Megan Cain is our senior supervising editor, and Beth Donovan is our executive producer.

• 24:36Marielle Segarra?

  Our production team also includes Andy Tagel, Claire Marie Schneider, Sylvie Douglas, and Margaret Serino, who also provided production help for this episode. Engineering support comes from Zoe Vangenhoven. Special thanks to Amanda Aronchek, Keith Romer, and Meg Kramer. I'm Marielle Segarra. Thank you for listening.