Your traces online

A free flashlight app wants to know your location, a prize draw asks for your birthday, and your favourite website quietly loads dozens of invisible helpers in the background. Data is the raw material many services earn their money with: your behaviour turns into profiles, and profiles can be used for advertising, pricing and predictions. That is no reason to panic, but a good reason to pay attention. Because whoever understands what is collected and why can make their own decisions instead of having decisions made about them.

Metadata: the trail beside the content

Often it is not even about the content of your messages, but about the details around them: who with whom, when, how often, from where. This metadata looks harmless but is astonishingly revealing. If someone calls a heart clinic at three in the morning and their own family the next morning, nobody needs to listen in on the calls to understand a lot. A famous 2013 study of the mobile phone data of 1.5 million people showed how unique such traces are: four location and time points, each only accurate to the mobile cell and the hour, were enough to pick out 95 in 100 people in the anonymised dataset. Your movement pattern is almost as unique as a fingerprint.

Tracking: recognised from page to page

On the web, trackers do the collecting: small building blocks embedded in many websites at once that recognise you from page to page. You do not need to be signed in anywhere for that. All it takes is cookies, small recognition tags that a website stores in your browser, plus traits of your device such as screen size, language and installed fonts. Bit by bit, individual visits add up to an interest profile that is worth real money to advertising networks. Each visit looks harmless on its own, the real insight only emerges from chaining many small traces together.

Your rights: consent and data minimisation

This is exactly where the law steps in: the European General Data Protection Regulation has applied since May 2018 and allows personal data to be processed only when there is a legally recognised reason for it. For advertising and tracking that reason is almost always your consent, and it has to be given freely and be revocable at any time. Hence the cookie banners. The regulation also demands data minimisation: a service may only collect the data it genuinely needs for its purpose. And you have enforceable rights, for example to ask a company which data it has stored about you, and to have it deleted.

The most effective protection is not special software but a small chain of questions before every input: does the service really need this detail for its function? Who else gets to see it? Would I tell it to a stranger in the street? Add habits that cost little and achieve a lot: allow only what is necessary in cookie banners, review app permissions now and then and switch off what is not needed, use a separate password for every important account and turn on two-factor sign-in, where a short code from an app or by text message is asked for on top of the password. None of this makes you invisible, and it does not have to. The point is not to hide, but to choose deliberately which traces you leave.