Most people are aware of the obvious privacy risks: weak passwords, clicking phishing links, oversharing on social media. But some of the most significant ways your personal data is being collected, tracked, and monetized happen through mechanisms most people never think about — quietly, in the background, without a single suspicious email involved. Here are seven privacy risks that fly under the radar, what makes each one different from the “use a strong password” advice you’ve already heard, and what actually helps.

1. Your Browser’s Fingerprint Is More Unique Than Your Password

Websites can identify you without cookies by collecting data about your browser configuration: screen resolution, fonts installed, browser plugins, time zone, language settings, and dozens of other attributes. Combined, these create a “fingerprint” that is often unique to your specific browser/device combination. This fingerprint persists across cleared cookies, private browsing sessions, and even VPN connections — because it doesn’t rely on anything stored on your device, only on characteristics your browser reveals every time it connects.

Tools like coveryourtracks.eff.org let you see how unique your fingerprint is. Firefox with strict tracking protection and Chrome with a VPN still have measurable fingerprints — the only effective counter is a browser specifically designed for fingerprint uniformity, like Tor Browser, which deliberately makes every user’s browser report identical characteristics so no individual stands out from the crowd.

2. “Free” Apps Are Selling Your Location History

Many free apps — particularly weather apps, games, and flashlight apps — monetize through data brokers by selling precise GPS location data. A 2023 investigation found hundreds of apps sharing location data with brokers, who aggregate it into profiles showing everywhere you’ve been, how often you visit certain places, and who else is frequently at the same locations.

The data is sold to advertisers, but also to insurers, employers, and law enforcement with few restrictions. Reviewing and revoking location permissions for apps that don’t genuinely need them is an underutilized privacy protection — most phones let you set location access to “while using the app” or “never” on a per-app basis, and it’s worth going through the full list rather than assuming defaults are reasonable.

3. Your Old Accounts Are a Bigger Risk Than Your Active Ones

Think about the accounts you’ve created over the years: forums from 2008, services you stopped using, apps you deleted. These accounts still exist with your email address and often with old passwords you may still use elsewhere. They’re sitting targets in breaches — poorly-maintained old services often have worse security than the active platforms you use today, and a breach at a service you forgot existed can still expose a password you’re reusing on your current email or banking login.

JustDeleteMe.xyz helps you find deletion instructions for hundreds of services. Purging old accounts reduces your breach exposure and the volume of spam and targeted phishing you receive, since data brokers and spam operations both draw heavily from old, abandoned account databases.

4. Metadata in Your Photos Reveals More Than the Image

Photos taken on smartphones embed EXIF metadata including GPS coordinates (your exact location), device model, timestamp, and sometimes lens aperture and focal length. Sharing these photos publicly, in emails, or via certain apps can reveal your home address, daily patterns, and device information to anyone who inspects the file.

Most social media platforms strip EXIF data when you upload, but direct file sharing (via email, messaging apps, Dropbox) typically preserves it. You can strip EXIF data before sharing using free tools like ExifTool, or check your phone’s camera settings to disable location tagging by default so it’s never captured in the first place.

5. Your WiFi Router’s Name Broadcasts Your Location

Companies including Google, Apple, and Microsoft maintain databases of WiFi network names (SSIDs) and their physical locations, built by war-driving and mobile device scanning. Your home network’s name is in this database, mapped to your approximate address. Apps with WiFi scanning permissions (even without GPS permission) can determine your location by cross-referencing nearby SSIDs with these databases — which is why some apps that shouldn’t need your location can still infer it.

A simple mitigation: avoid using your name, address, or apartment number in your WiFi network name. It won’t stop the SSID-to-location mapping itself, but it does reduce what a stranger scanning nearby networks could learn about who lives where just by reading network names off a phone screen.

6. Connected Home Devices Expand Your Attack Surface Significantly

Smart TVs, speakers, thermostats, doorbells, and baby monitors all collect and transmit data — and many have poor security practices. Smart TVs often use Automatic Content Recognition (ACR) to monitor everything you watch, even from non-streaming sources like a game console or cable box plugged into the same TV. Voice assistants store recordings by default, and many devices continue transmitting telemetry even when you think they’re “off.”

Review privacy settings on each connected device, disable ACR on smart TVs (usually under Settings > Privacy or Viewing Data), and segment IoT devices onto a separate network from your computers and phones — most home routers support a guest network that accomplishes this with a few minutes of setup.

7. Your Phone Number Has Become a Privacy Liability

Phone numbers were once throwaway contact information. Now they’re authentication credentials for 2FA, account recovery mechanisms, and rich data broker profiles. A phone number breach enables SIM-swapping attacks that can bypass SMS 2FA, and data brokers link your number to your identity, address history, and associated accounts across dozens of services.

Consider using a VoIP number for services that require a phone number but don’t need your real one — Google Voice (free) works well for sign-ups and low-stakes verification. And for 2FA, use an authenticator app rather than SMS wherever possible, since app-based codes aren’t vulnerable to SIM swapping.

Bonus Risk: Bluetooth and Cross-Device Tracking

Bluetooth beacons in retail stores, malls, and even some public transit systems can detect and log nearby Bluetooth-enabled devices, building a picture of foot traffic patterns and, in some implementations, linking repeat visits to the same device over time. Advertisers also use “cross-device tracking” — matching your phone, laptop, and smart TV as belonging to the same household or person based on shared network signals, login patterns, or even ultrasonic audio beacons embedded in TV ads that your phone’s microphone can pick up (a technique that has drawn regulatory scrutiny in several countries).

Turning off Bluetooth when you’re not actively using it, and periodically reviewing which devices and apps have Bluetooth permission, meaningfully reduces this exposure without much daily inconvenience.

Bonus Risk: Public Records Aggregators

Beyond app-based data brokers, dedicated “people search” sites compile information from public records — property records, voter registration, court records, marriage licenses — into searchable profiles that include your address history, relatives, and phone numbers. Unlike a data breach, none of this is illegally obtained; it’s aggregated from records that are technically public, which is precisely what makes it hard to fully prevent. Sites like Whitepages, Spokeo, and BeenVerified offer opt-out processes, though new aggregator sites appear regularly, so this is an ongoing maintenance task rather than a one-time fix.

Why These Risks Get Overlooked

Every risk above shares a common pattern: none of them require you to make an obvious mistake. You don’t click a bad link, fall for a fake login page, or use “password123.” The data still leaks — through a permission you granted months ago and forgot about, a setting that defaults to “on,” or a piece of metadata you never knew your phone was recording. That’s exactly what makes this category harder to defend against than phishing: there’s no single moment of “don’t do that” to remember, just a series of quiet defaults worth periodically reviewing.

A Practical Order to Address These

1. Review location permissions across all installed apps
2. Purge accounts on services you no longer use
3. Switch 2FA from SMS to an authenticator app where possible
4. Disable ACR on smart TVs and segment IoT devices onto a guest network
5. Strip EXIF data before sharing photos outside social platforms
6. Check your browser fingerprint uniqueness and adjust tracking protection settings

Assessing Your Full Privacy Risk Profile

The Privacy Risk Quiz assesses your habits across seven categories and identifies which risks apply most to your specific behavior — giving you a prioritized list of what to address first rather than an overwhelming checklist of everything that could theoretically go wrong.

Frequently Asked Questions

Can I stop browser fingerprinting completely?

Not entirely with a mainstream browser, though tracking protection settings and privacy-focused browsers like Tor Browser significantly reduce how unique and trackable your fingerprint is.

Do social media platforms really strip photo location data?

Most major platforms (Facebook, Instagram, X) strip EXIF metadata on upload, but direct file sharing through email, messaging apps, or cloud storage typically preserves it, so check before sharing full-resolution files outside social platforms.

Is a VoIP number as reliable as my real number for account sign-ups?

For most sign-ups and low-stakes verification, yes. Some services do block known VoIP number ranges, so it’s worth having your real number as a backup for anything critical.

How much of my data do data brokers actually have?

Often more than people expect — data brokers compile purchase history, location patterns, app usage, and public records into detailed profiles, then sell access to advertisers, insurers, and other buyers with minimal restriction in most US states.

Related Reading

• How to Check Your Digital Privacy Score
• How to Protect Your Personal Data Online: The Essential Guide
• Browser Privacy Settings: How to Stop Your Browser from Tracking You
• Ways to Stop Hackers from Stealing Information You Didn’t Know Existed
• Try our free Privacy Risk Quiz →