Email, Browsing and Online Privacy

Why email is the master key

Think about what happens when you forget a password. You click "Forgot password." The website sends a link to your email. You click it and choose a new password. That is how nearly every site on the internet works.

Now picture a stranger sitting inside your inbox. They click "Forgot password" on your bank's website. The link lands where they can see it. They choose the new password. You are locked out of your own account, and you may not know for days.

That is why this course keeps coming back to email. A crook who takes over your inbox can also read your old messages, find out where you bank and what you owe, and write to your friends as you. The FBI's Internet Crime Complaint Center (IC3) logged 191,561 phishing and spoofing complaints in 2025, with reported losses of about $215.8 million (as of October 2026, from the IC3 2025 report). Phishing means a fake message that tries to trick you into giving up a password, a code or money. Many of those messages are aimed straight at your email login.

Two things protect an inbox better than anything else. A long, unique password that you use nowhere else, and two-step sign-in, which means a second proof such as a code or a tap on your phone. Lesson 3 covers both. If you do nothing else in this course, do those two for your email account.

What "secure email" really means

You will hear the words "secure email" a lot. They are used loosely, so here is what matters.

Encryption means scrambling information so only someone with the right key can read it. Email gets two very different kinds.

The first is encryption in transit, also called TLS. Picture a postcard that travels inside a locked mail truck. Nobody on the road can read it. But the post office at each end can, because it has to sort it and deliver it. TLS protects your message while it moves from one mail company to the next. It does not stop the mail companies themselves from reading, scanning or storing the message.

The second is end-to-end encryption. Picture a letter sealed in a box that only you and your friend have the key to. The post office handles the box but cannot open it. With end-to-end encryption, only the sender and the receiver can read the message. The company in the middle holds no key.

Most everyday email, including the mail you get from Gmail, Outlook and iCloud, is protected by TLS and is not end-to-end encrypted. That is fine for most people. A thief on the public internet cannot read your recipe swap. The bigger risks for a homeowner are a stolen password and a convincing fake message, not someone tapping the wire.

What the big email services do, as of October 2026

Service	Protected in transit (TLS)	End-to-end encrypted	What to know
Gmail (Google)	Yes, on every account, when the other side also supports it	No for ordinary accounts. Google lists S/MIME and client-side encryption only for work or school accounts	Gmail shows a red open lock when a message was not encrypted in transit
iCloud Mail (Apple)	Yes	No. Apple says iCloud Mail is not end-to-end encrypted, even with Advanced Data Protection on	Apple holds the keys. Your saved passwords in Apple's Passwords app are end-to-end encrypted, mail is not
Outlook.com (Microsoft)	Check Microsoft's current help page	Check Microsoft's current help page	Options differ between free and paid accounts. Read the page before you rely on it
A private email service built around end-to-end encryption	Yes	Yes, but usually only between two users of the same kind of service or with extra steps for outsiders	Costs money or limits features, and you must keep your own recovery key safe

When a private email service matters

For most households, Gmail, iCloud Mail or Outlook with a strong password and two-step sign-in is a sound choice. A private service built around end-to-end encryption starts to make sense in a few cases. You regularly send tax returns, medical records or account numbers by email and cannot use a secure portal instead. You are caring for someone and exchanging sensitive paperwork with a relative. Or you simply do not want a big advertising company to hold years of your messages.

The tradeoffs are real. If you lose the password and the recovery key at a service that cannot reset your account, your mail may be gone for good. Messages to people on other services may not be end-to-end protected at all. And a private service does nothing to stop phishing. A fake message still works the same way on any inbox.

The safer habit that costs nothing: do not put Social Security numbers, bank account numbers or passwords in the body of an email, whichever service you use. Call, use the company's secure message page, or mail it.

Spam, aliases and keeping your inbox quiet

Spam is junk mail you did not ask for. Most mail services filter it for you. You make the filter smarter by using it.

• Use the "Report spam" or "Report junk" button instead of just deleting. It teaches the filter.
• Do not click "Unsubscribe" in a message from a company you have never heard of. That can tell a crook your address is live. Unsubscribe only from stores and groups you actually joined.
• Never open attachments you did not expect, even from a name you know. A friend's hacked account sends convincing mail.
• If a message says your account is in trouble, do not use the link in it. Open a new browser window and type the company's address yourself, or call the number on your card. The FTC says a real company does not send you a link to update your payment information.

An email alias is a second address that forwards to your real inbox. It lets you hand out an address that is not your main one. If that alias starts getting junk, you shut it off and your real address stays clean. Apple's Hide My Email makes random forwarding addresses when you use Sign in with Apple, and Apple says each address can be used only by the site where you made it. Many free services, including Gmail, let you add a plus sign and a word to your address, such as yourname+store@gmail.com, which still lands in your inbox and shows you who sold your address. Some websites reject that format, so treat it as a small trick, not a lock.

A simple plan many families like: one address for banking and government, which you never give to a store; one address for shopping and coupons; one older address for junk. If you have only one, it is still worth creating a second for the sites that push offers at you.

Your browser: cookies, trackers and private windows

A browser is the program you use to visit websites, such as Chrome, Safari, Edge or Firefox. Websites and apps follow what you do. The FTC lists the tools they use as cookies, pixels, device fingerprinting and advertising identifiers on phones.

A cookie is a small file a website saves in your browser so it can remember you. Some are helpful, like the one that keeps items in your shopping cart. A third-party cookie comes from a different company than the site you are visiting. Advertisers use them to follow you from site to site and build a picture of your interests. A tracker is any code that records what you do and sends it to an advertiser or data company.

Set it once

When a site pops up a cookie notice, the FTC suggests choosing the option that allows only the cookies the site needs to work.

What private browsing does and does not do

A private window is called Incognito in Chrome and Private Browsing in Safari. When you close it, the browser forgets your history and cookies from that session. That is useful if you are shopping for a surprise gift on a shared computer.

It does not make you invisible. Chrome's own help page says websites you visit, including Google sites, can still observe what you do, and so can the organization that runs your network, such as your internet provider or employer. A private window will not stop a scam site from seeing you, and it will not protect you from a virus.

Search engines and ad settings

Search engines make money by showing ads, and they shape those ads from what you search for. You can turn off personalized ads and still see ads. They just stop being tailored to your past searches. The FTC suggests turning off personalized ads in your browser and in your phone's advertising privacy section. You can do that in the settings of your Google or Apple account, and on an iPhone under Settings, Privacy and Security, Apple Advertising. Look for the words "personalized ads" or "ad personalization."

Some search engines say they do not keep your search history or build an ad profile. Those are the companies' own claims. If this matters to you, open the search engine's privacy page and read what it says it collects. It is your call. Switching costs nothing and you can switch back.

One more caution. Scammers pay for ads that appear at the top of search results, so a fake "customer support" number or a fake copy of a utility's website can be the first thing you see. The FTC warns that top results are often paid ads. For banks, utilities and tech support, type the address yourself or use the number printed on your statement.

Data brokers and people-search sites

A data broker is a company that collects and sells personal information about people it has no direct relationship with. Privacy Rights Clearinghouse says brokers draw on public records, social media, purchase histories, loyalty programs, app use and location tracking. A people-search site is a kind of broker that puts your name, age, home address, phone number and the names of relatives on a public web page for anyone to read.

Scammers love these pages. They use them to pick targets, to find a grandchild's name for a fake emergency call, and to sound like they know you. Taking your details off is not a cure-all, but it removes a free tool from the crooks' kit.

How to get your name off, in order

Some companies sell a service that does this opt-out work for a yearly fee. You can do the same work yourself for free, with patience. Whether the fee is worth your time is your call. Check any paid service on the FTC's and the Better Business Bureau's pages before you give it your name and address.

Social media: settings and what not to post

Social media is where many crooks do their homework. They look at your public posts, your friends list and your photos. A few settings and habits shut most of that door.

Then think before you post. The things that help a crook are small and ordinary:

• Your full birth date, your mother's maiden name, the name of your first pet or the street you grew up on. These are the answers to common security questions.
• Trip plans. Post the beach photos after you are home.
• Photos that show your house number, your car's license plate, a boarding pass, a new credit card or your driver's license.
• Video and audio clips of your voice or your grandchildren's voices. The FTC warns that a short clip can be used with a voice-cloning program to make a caller sound like a relative.
• Anything you would not tell a stranger at the counter.

Quizzes and chain posts that ask for your first car, your high school or your favorite teacher are a favorite trick. They are collecting the answers to your security questions. Skip them.

Questions and answers

Is Gmail safe enough for banking and tax papers?

Gmail protects your mail in transit with TLS and has strong sign-in options. It is as safe as your password and your second step make it. Still, use your bank's secure message page for account numbers and your tax preparer's portal for returns. Mail attachments get forwarded and saved in many places.

What is the difference between spam and phishing?

Spam is junk advertising. Phishing is a trick: a message made to look like your bank, the IRS or a friend, built to steal a password, a code or money. Spam is annoying. Phishing is dangerous. Report both, click neither.

If I turn on every privacy setting, will websites stop working?

A few will act strangely when you block third-party cookies. Most browsers let you allow one site at a time. Start with the standard blocking setting and loosen it for the one site that complains.

Does clearing my cookies help?

It signs you out of websites and forgets saved choices, and it can reduce ads that follow you. Chrome puts this under More, then Delete browsing data, where you pick a time range and tick "Cookies and other site data." It is a tidy-up, not a shield.

Can I get my information off the internet completely?

No. You can cut it down a lot. Google removes results from its own Search, brokers remove listings when asked, but the original records, such as property records at your county, stay public. Expect to shrink your footprint, not erase it.

Should I worry that my email provider reads my mail?

Big providers scan mail for spam and viruses by machine. If you do not want a company to be able to read your mail at all, end-to-end encryption is the only real answer, and it has the tradeoffs listed above. Read the privacy page of your provider so you know what it says it does.

Is it safe to click "Sign in with Google" or "Sign in with Apple"?

It can be safer than making another password, because you use one strong account. The tradeoff is that the sign-in company learns which sites you use. Apple's version can hide your real email address with a random forwarding address.

My email was hacked. What do I do first?

From a device you trust, change the password. Turn on two-step sign-in. Look in the settings for forwarding rules or connected apps you did not set up and remove them. Then change passwords on your bank and any account that uses that email. Lesson 9 walks through the whole first hour in order.

Hard questions

Is it worth paying for a private email service?

For most people, no. The cheapest big win is a strong password and two-step sign-in on the account you already have. A private service helps if you send sensitive files by email often and cannot use a secure portal, or if you do not want a big company to hold your mail. It does nothing about phishing, and if you lose the recovery key you can lose the mail. If you try one, begin with a second account so you can learn it with low stakes.

Can I really stop companies from tracking me?

You can cut it down a good deal, but not stop it. Blocking third-party cookies, turning off personalized ads, trimming app permissions and using fewer logins gets you most of the benefit. Total invisibility is not realistic for someone who uses a phone, a bank and a store card. Aim for less, not zero.

Is a VPN part of the answer for browsing privacy?

A VPN is a service that routes your internet traffic through another company's computer. It hides your activity from your local network, such as a coffee shop's Wi-Fi, and shows your activity to the VPN company instead. It does not stop cookies or the sites you log in to from knowing who you are. For a typical home user with a protected home network, a VPN is not the first thing to buy. Lesson 4 gives the longer answer.

I cannot afford a paid service to remove my information. Am I stuck?

No. Everything in this lesson is free. Google's Results about you tool is free. Each people-search site's opt-out is free, though the forms are tedious. Set aside 20 minutes a week for a month and do two sites each time. Ask a grown grandchild to sit with you; the forms are easier with a second pair of eyes.

If my data is already out there, why bother?

Because the crooks work in volume. They go after the easy listings first. Removing your phone number from a dozen sites and tightening your social media will not make you perfect. It still moves you from the easy pile to the harder one. And the biggest step, a strong email password with two-step sign-in, stops the worst outcome whether your data is out there or not.