You think you are pretty good at privacy.
You have a VPN. You use incognito mode. You once cleared your cookies and felt like Edward Snowden for about forty five minutes. You have told at least one person at a brunch that you are "pretty careful about your digital footprint," which is the modern equivalent of saying you eat clean while your DoorDash history looks like a crime scene.
You are not careful. None of us are. And you are not being tracked by some supercomputer in a bunker under Utah, at least not only that. You are being tracked by the most boring, most efficient surveillance apparatus ever invented: capitalism with good APIs.
Welcome to the part where we talk about how exposed you actually are.
The Lie of Being Boring
Everyone has the same comforting story they tell themselves. "Why would anyone track me? I'm boring. I have nothing to hide. I just watch cooking videos and argue about sports."
This is adorable, and completely wrong. You do not need to be interesting to be trackable. In fact, being boring makes you easier to track, because you are predictable.
You wake up at roughly the same time every day. Your phone checks the weather, and in doing so tells three different ad networks where you slept last night. You scroll the same three apps in the same order. You go to the same coffee shop, which has Wi-Fi that logs your MAC address, and a loyalty app that logs your soul.
You are not a mystery. You are a pattern. And patterns are trivial to model.
The modern tracking ecosystem does not care if you are a spy or an accountant who really likes sourdough. It cares that you are a stable, monetizable entity with habits. You think you are hiding in the crowd. You are not hiding in the crowd, you are standing in a crowd where everyone is wearing a neon sign with a unique ID that follows them across the street, into the store, and into the bathroom.
Consider just your phone number. That one dumb ten digit string you have had since college is the master key you handed to every single service you have ever signed up for. Data brokers take that number and join it with your name, your old addresses, your Amazon purchases, your voter registration, your leaked passwords from 2017 that you definitely reused, and your cousin's public family tree where she tagged you at Thanksgiving. Congratulations, you now have a permanent record that is for sale for about two dollars.
You did not need to be hacked. You volunteered, one Terms of Service at a time.
How You Leak Without Trying
Let us play a game. I will describe a totally normal person who is trying to be private, and you tell me how many times they just doxxed themselves today.
They post a photo of their dog on Instagram. The photo has EXIF data with GPS coordinates unless they stripped it, which they did not. The background shows the street sign outside their house and the distinctive shape of their neighbor's terrible fence.
They post a screenshot of a funny text conversation. They forgot to crop out the contact name, the time, and the battery percentage that correlates with their other screenshots.
They apply for a job on LinkedIn, which then tells everyone they know that they are looking for a job, and also updates a dozen people search sites with their current employer.
They order something on Amazon, which gets their address into yet another breachable database. They pay with a card, which links their purchase to their location history. They review the product, which links their anonymous Amazon username to their real name because they used the same handle they used on Reddit in 2012.
They go for a run with Strava, which draws a perfect little map from their front door around the park and back to their front door, and publishes it to a global heatmap where anyone can see where the fit people with expensive watches live.
None of this is sophisticated. None of this requires hacking. This is just what normal life looks like when every device you own is designed to report back to base. You are not being paranoid, you are being observed by products you pay monthly for the privilege of being observed by.
And the worst part? The metadata is worse than the data. You can be careful about what you say. You are never careful about what your behavior says.
You encrypted the message, great. The fact that you sent a message at 2:13 AM to a number that only ever receives messages when something is wrong is still visible. You used a VPN, great. The fact that your device connected to the VPN at exactly the moment your home IP went silent, and that your typing cadence and browser fingerprint stayed identical, is still visible. You turned off location, great. Your photos of your lunch still contain enough background to geolocate you within three blocks, and your Wi-Fi probe requests are still screaming your home SSID everywhere you go like a lost child.
You are not invisible. You are just slightly blurry, which is often worse, because blurry makes people curious.
The Fantasy of Deletion
Okay, so you are tracked. Fine. But you can erase it, right? You can delete your accounts, go off the grid, become one of those people who lives in a cabin and makes their own soap.
Sure. Let us talk about how erasure actually works.
You delete your Facebook. Facebook says, "We have deleted your account." What they mean is, "We have hidden your profile from other users and moved your data to a colder storage system that we will keep for legal and business purposes for as long as we deem necessary, which is forever."
You delete your tweets. The tweets are gone from your profile. They are not gone from the Wayback Machine, from the fifteen scraper bots that archive everything, from the screenshots your enemies took, from the Google cache that will refresh sometime between now and the apocalypse, or from the data broker who already ingested them into a sentiment model that thinks you are anxious about money.
You ask a data broker to remove you. They do, for their public facing site. Their API, the one they actually sell to customers, still has you. And their backup from last Tuesday still has you. And their partner network of four hundred other brokers, who they already sold you to, still has you.
Erasing yourself from the internet is like trying to unbake a cake that has already been mailed to ten thousand strangers who each took a bite and wrote a review.
Even the stuff that feels private is not. Your email is not private, it is a postcard that Google kindly scanned for you. Your DMs are not private, they are just private from other users, not from the platform, not from law enforcement with a warrant, not from the intern who can still read them.
And AI made this ten times worse, in a way nobody really wants to admit. Before, your data had to be searchable to be useful. Now it just has to exist. Large models can infer your location from your slang, your age from your punctuation, your health conditions from your grocery list, your political beliefs from the memes you like. You do not have to fill out a form that says "I am a 34 year old man who lives in Charlotte and has a bad knee." Your data exhaust already screamed it.
This is why "I have nothing to hide" is such a naive flex. You do not decide what is sensitive, the person looking at the data does. You think your takeout history is boring, an insurer sees a risk profile. You think your late night searches are harmless, an OSINT investigator sees a timeline. You think your public posts are just jokes, a future employer sees a liability.
You are not hard to find. You are hard to NOT find.
So What Do You Actually Do
You do not go full tinfoil. Full tinfoil is a lifestyle that ends with you yelling at a barista for asking for your name.
You get competent.
Privacy is not about becoming invisible, it is about becoming expensive to track. Most tracking works because it is cheap and automatic. Your job is to make it annoying. To add friction. To break the easy correlations that turn you from a person into a product.
That means understanding pivots, how one identifier leads to another. How an email leads to a breach, which leads to a password, which leads to a username, which leads to a forum post from 2011 where you used your real name because you were sixteen and dumb. It means understanding metadata, that the photo is not just the photo, it is the camera, the location, the time, the device. It means understanding that your phone is not a phone, it is a tracking beacon that occasionally makes calls.
It means learning to compartmentalize. Different contexts, different identities, different trails. Not because you are doing something illegal, but because you are not required to offer your entire life as a single searchable database to anyone with a browser.
The people who are actually good at this are not loud about it. They are not posting about going dark. They are just quietly harder to pin down. Their digital footprint looks intentional, not accidental. They know what dorks are, what brokers keep, what their own photos say, and what their AI exhaust looks like.
You do not need to become a ghost. You just need to stop being so easy to assemble.
Because right now, if someone wanted to, they could reconstruct your last five years in an afternoon with public data and a few clever queries. Not because they are a genius hacker in a hoodie. Because you made it simple.
Fix that part first. The rest is just tradecraft.
If you want the actual playbooks for making yourself expensive to track, these are the ones that do not waste your time: Privacy/Opsec Stack: Nukepack + Ghost Mode + OSINT Pivots + Metadata + AI-Native OSINT and the OSINT Investigator Pack: Pivots + Dork Bible + Obsidian Workflows + AI Toolkit.
Top comments (0)