The Privacy Ladder: Who Is Watching and How Far to Go

Privacy advice usually comes in one of two flavors. One says you have nothing to hide, so relax. The other says everyone is watching, so buy a burner and move to a cabin. Both are lazy. Most people need a handful of settings changed and a few habits. A smaller group needs a lot more. This guide is built as a ladder so you can climb exactly as far as your life requires and stop there. To pick a rung, you first have to know who is collecting, what they get, and how the data actually moves.

The threat: who collects, and how

A short list of collectors accounts for nearly everything gathered about an ordinary person. They overlap, and data flows between them all the time. A location point your weather app records on a Tuesday morning can end up in an ad auction, a broker's file and a contractor's dashboard without anyone typing your name.

Companies you use

Your phone maker, your apps, your email provider, your bank, the grocery loyalty card. They know what you do inside their products, and many share or sell some of it.

Your internet provider is the one people forget. In October 2021 the Federal Trade Commission published a staff study of six providers that together covered about 98 percent of the mobile internet market: AT&T Mobility, Verizon Wireless, Charter, Comcast, T-Mobile and Google Fiber. The FTC found they had access to all of a customer's internet traffic and real-time location, and that several combined browsing data, app usage and personal details to target ads. Some grouped customers by sensitive traits such as race and sexual orientation. The report also found location data had reached bail bondsmen and bounty hunters without reasonable safeguards or customers' knowledge.

Ad tech: the auction that leaks you

Every time an app or web page shows you an ad, an auction runs in a fraction of a second. Your device sends out a bid request: roughly, here is a person on this kind of phone, at about this location, using this app, with this advertising ID. Dozens of companies may receive it and bid. One wins and shows the ad. The rest have still seen the request.

In December 2024 the FTC said, in its case against the broker Mobilewalla, that the company collected data from these auction exchanges, and when it bid and lost, it kept the bid request data anyway. From January 2018 to June 2020, the FTC said, Mobilewalla gathered more than 500 million unique advertising IDs paired with precise location. It built audience segments such as women who had visited pregnancy centers, and in June 2020 it produced a report analyzing people who protested George Floyd's death, including their racial backgrounds. The proposed order bans Mobilewalla from keeping auction data for any purpose other than taking part in the auction.

So the ad you scroll past can be the least interesting part of the transaction.

Data brokers

Brokers are companies you have never heard of that buy, combine and resell. When the FTC studied nine of them in 2014, it found one broker's database held 1.4 billion consumer transactions and over 700 billion aggregated data elements. Another had 3,000 data segments for nearly every U.S. consumer, with labels like "Expectant Parent" and "Diabetes Interest."

The scale has grown since. In the same December 2024 round of cases, the FTC said Gravy Analytics and its subsidiary Venntel claimed to process more than 17 billion signals from around a billion mobile devices every day. The FTC said they used geofencing (drawing a virtual boundary around a place) to sell lists of people who attended events tied to medical conditions and places of worship, and that they inferred traits such as health decisions, political activity and religious views from where devices went. The order bars them from selling sensitive location data, with exceptions for national security and law enforcement.

Brokers usually call the data anonymous because it is keyed to a device ID instead of a name. The FTC has said, case after case, that the location data was not anonymized and could identify people. A phone that sleeps at one house every night is not much of a mystery. People-search sites sit on top of this trade and sell your address and relatives to anyone with a credit card. The old warning case: in 1999 a New Hampshire man paid the online broker Docusearch $45 for a young woman's Social Security number and $109 for her work address, then shot her as she left work. EPIC's file on the Amy Boyer case has the 2003 state Supreme Court ruling that brokers can be liable for that kind of harm. Removal from those sites is covered in Data Brokers, Credit and Identity.

Government

Agencies get data through warrants and subpoenas, through their own cameras and plate readers, and sometimes by buying it from brokers. A January 27, 2022 report by a senior advisory group to the Director of National Intelligence, later declassified, said intelligence agencies acquire substantial amounts of commercially available information. It said such data can be combined to identify people, including Americans, even when it is labeled anonymized. Its own words: "CAI can reveal sensitive and intimate information about individuals." The FTC's January 2024 complaint against the broker X-Mode said it sold location data to private government contractors. How police purchases work, and what records show them, is covered in police purchases of broker data.

Here this guide draws a hard line. You can limit what you hand to companies, which shrinks what anyone can buy. You do not get to defeat a warrant.

Stalkers and abusive partners

These are the collectors most likely to hurt you physically, and they often have something no company has: your phone in their hand, or your password. Most tech abuse is low tech: a shared Apple ID or Google account, location sharing nobody turned off, a family plan one person controls, a partner who knows your passcode.

Then there is stalkerware. In September 2021 the FTC banned the company behind SpyFone, and its CEO, from the surveillance business, the first time the agency had won a ban in a stalkerware case. The FTC said the app let buyers secretly watch a phone's photos, texts, web history, GPS location and email, and that the company told buyers how to hide the app from the phone's owner. On Android, the buyer had to get around many of the phone's built-in protections, and reading email required "rooting" the phone. That detail matters: this kind of spyware usually needs someone to have your phone in hand with the passcode. The company also stored what it collected so carelessly that a hacker got into its server in August 2018 and took data on about 2,200 people. The CEO asked the FTC to lift the ban; on December 8, 2025 the Commission said no.

Criminals and scammers

Scammers want your accounts and money, and they work from breach dumps, broker files and whatever you post. As the SpyFone breach shows, whatever someone collects about you can be stolen from them. Phishing is covered in Phishing and Social Engineering.

Who is most at risk

The FTC orders above read like a list. Their sensitive locations include medical and reproductive health clinics, places of worship, domestic abuse shelters, homeless and refugee services, labor union offices, LGBTQ+ venues, and political protests. People who visit those places have more to lose when location data is sold. So do survivors of abuse, people leaving a controlling relationship, reporters with sources, activists, public officials and their families, and anyone who has been doxxed. For most readers, companies and brokers are the daily reality. For some, the person in the stalkers section is the whole problem. Your steps change a lot depending on which one you face, which is why the next part matters.

Your threat model in two minutes

EFF's Surveillance Self-Defense project boils planning down to six questions: what do I want to protect, who do I want to protect it from, how bad are the consequences if I fail, how likely is it, how much trouble am I willing to go through, and who are my allies. A full walkthrough with scoring lives in Threat Modeling in Plain Terms. You do not need the full version to start. You need honest one-line answers.

How to reduce it, level by level

Level 1 Everyday

Settings anyone can change in minutes. Free. No change to how you live. Turning off ad tracking and trimming app permissions cuts what your phone feeds into the ad auction and the SDK pipeline, which is where brokers like Mobilewalla and X-Mode got their data. Reviewing who you share with closes the easy doors a casual snoop or an ex would walk through. Everyone should be here.

What Level 1 does not stop: your internet provider still sees your traffic, brokers keep what they already bought, and an app you allow to use your location can still pass it on. It also does nothing about stalkerware already on the phone. Think of Level 1 as turning down the tap on new data.

Level 2 Careful

A few tools and habits, with a small loss of convenience. A tracker blocker in your browser, such as EFF's free Privacy Badger, which cuts the third parties that ride along on web pages. An email alias for store sign-ups, from a service such as Firefox Relay or DuckDuckGo Email Protection, so a breach or a broker cannot tie your shopping to your real inbox. Location set to "while using" for most apps, which starves background SDKs. Ad personalization turned off everywhere you find it. It still leaves your existing broker files alone and does little against someone who knows your passcode.

Level 3 Private

Deliberate choices that cost money or real convenience. Paying for an email provider that encrypts your mailbox. Paying for a service that removes you from people-search sites, or doing the opt-outs yourself one by one. Turning on encrypted cloud backups (on iPhone, Apple's Advanced Data Protection) and accepting that if you lose your recovery key, nobody can get your photos back. Freezing your credit at all three bureaus. This level goes after data already collected. It pulls your address out of broker listings and locks your stored data so the company holding it cannot read it. Removal is never permanent, because brokers refill their files, so this level is a chore you repeat. This is where most people who have been doxxed, or who just want out of the broker trade, end up.

Level 4 Hardened

For people with a specific threat: a stalking survivor, an activist who has been targeted, a reporter with sensitive sources, the family of a public official. Separate devices and accounts for separate parts of life. Strict habits about who sees your address. Features like Apple's Lockdown Mode or Android's Advanced Protection, which shut off the features sophisticated spyware tends to exploit. A safety plan made with someone who does this for a living. The cost is daily discipline and some broken features. When the threat is a person close to you, order matters more than tools.

Level 5 Hyper-vigilant

Compartmentalized identities, hardened phone operating systems such as GrapheneOS, phones kept off or in Faraday bags, and physical awareness of who is around you. High cost and real friction. Easy to get wrong, too, because one slip, such as logging into your real account from the "clean" device, ties everything back together. Very few people need this. They are usually better served by doing Level 4 perfectly than by doing Level 5 badly. Hyper-Vigilance covers when it is justified and when it is theater.

What overdoing it costs

Privacy has a price, and the bill shows up in unglamorous ways. People turn on encrypted backups, lose the recovery key, and lose ten years of photos. They lock their phone down so hard that the banking app stops working, then switch everything back off in frustration. Some get so anxious they stop using the tools at all.

Pick the level your plan supports. Do it well. Move up when your life changes, like a new job in public view or a breakup that went badly. Move back down when the threat passes. That is allowed.

What counter-surveillance means here

In this guide, counter-surveillance means protecting yourself: limiting what you hand out, cleaning up what is already out there, and noticing when someone is watching you. Every step is lawful and defensive.

It does not mean interfering with anyone else. You do not get into another person's phone or account, even to check it for spyware. You do not run jammers; the FCC's jammer enforcement page says federal law prohibits the operation, marketing or sale of any jamming equipment, with no exemption for your home or car. You do not cover your license plate. And nothing in these lessons is a way to defeat a warrant, a subpoena or a police investigation. Privacy from advertisers and stalkers is one thing. Obstructing lawful process is a crime, and this guide will not help with it.

The ladder for this topic

Level	What to do	Cost or tradeoff
Level 1 Everyday	Run Safety Check or Permission manager; turn on updates and multifactor login	Free, about 15 minutes
Level 2 Careful	Write a one-page plan; add a tracker blocker and email aliases	Free or nearly; some sites ask more often
Level 3 Private	Paid private email, broker removal, encrypted backups, credit freezes	Money and the duty to keep recovery keys safe
Level 4 Hardened	Separate devices and accounts, Lockdown Mode or Advanced Protection, a safety plan with an advocate	A second device, broken features, daily discipline
Level 5 Hyper-vigilant	Compartmentalized identities, hardened OS, Faraday storage, physical awareness	High cost, constant friction, easy to slip