Online Privacy Tools: What You Need, What You Already Have, and What May Overlap

What they solve

Modern devices and accounts often include foundational protections such as:

• Screen locks and biometric unlock.
• Automatic operating-system and app updates.
• Device encryption or storage protection.
• Lost-device location, lock, or erase.
• Built-in harmful-app or malware checks.
• Account sign-in alerts and multifactor authentication.
• Password and passkey storage.
• Recovery contacts, recovery keys, or trusted devices.

The FTC recommends keeping operating systems, browsers, security software, and apps updated, using strong credentials, and turning on two-factor authentication. These steps usually deserve attention before a specialized privacy subscription.

Examples of built-in capabilities include Apple account and device protections, Android’s lost-device and Play Protect features, and Windows Device Encryption on supported systems. Availability and defaults vary by device, account type, edition, region, and administrator policy.

What they do not solve

Built-in device protections do not remove personal information from data brokers, prevent every scam, hide activity from every online service, or recover every compromised account. They also do not help if recovery information is stale or the encryption recovery key cannot be found.

What to verify

• Automatic updates are enabled.
• Every device has a strong screen lock.
• Encryption is active where supported.
• You know where the recovery key or recovery account is stored.
• Lost-device features are configured before the device is lost.
• Old or sold devices are removed from trusted-device lists.
• Household members use separate accounts rather than sharing one master account.
• Work or school administrators—not the individual user—control managed-device settings where applicable.

A paid security suite should be compared against these exact capabilities. “Includes device protection” is not enough to establish added value.

What they solve

A password manager helps generate and store unique credentials so one reused password does not become the key to several accounts. Many browsers and operating systems already include a manager. Apple’s Passwords app, Google Password Manager, and Microsoft’s password and passkey support are examples of built-in ecosystems; third-party managers may add broader cross-platform and household features.

Passkeys replace a shared secret with a cryptographic sign-in tied to a device, credential manager, or security key. NIST describes properly implemented cryptographic authentication as phishing-resistant because the authentication is bound to the legitimate service rather than a look-alike site. A passkey can still create recovery and device-access dependencies, so it is not a reason to ignore account recovery.

What they do not solve

A password manager or passkey does not:

• Make an unlocked or infected device safe.
• Prevent someone from approving a fraudulent recovery request.
• Protect an account that still has a weak fallback method.
• Stop every social-engineering scam.
• Remove personal information from public sites.
• Guarantee that every household member can recover shared access.

Start with what is already available

Use the manager already built into your device or browser when it works across your actual devices, supports the accounts you need, and gives you a recovery plan you understand. A free built-in manager is not automatically inferior to a paid one.

When a paid manager may add value

A paid or standalone option may be worth considering when it provides a documented advantage such as:

• Reliable support across several operating systems and browsers.
• Household or team sharing without sharing one account.
• Clear administrative recovery or emergency-access controls.
• Better separation of personal, family, and work vaults.
• Export, migration, audit, or support features you will actually use.

Do not buy a second manager merely to have a second vault. Two active managers can create conflicting autofill prompts, duplicate passkeys, unclear recovery, and uncertainty about which copy is current.

Recovery and household fit

Before migrating:

• Export only through the official process and protect the export file.
• Confirm how passkeys transfer—or whether they transfer at all.
• Test access on every important device.
• Store recovery codes or keys outside the vault when the provider recommends it.
• Give each household member an individual account with deliberate sharing.
• Remove old vault copies and unencrypted exports after the migration is verified.

Why an additional factor matters

Two-factor or multifactor authentication can prevent a stolen password from being sufficient by itself. The FTC recommends enabling it where available and notes that authenticator apps and security keys can provide stronger options than text or email codes when a service supports them.

OTP codes versus phishing-resistant methods

A time-based one-time code from an authenticator app is useful, but it can still be typed into a fake sign-in page. NIST does not treat manually entered one-time passwords as phishing-resistant.

Passkeys and FIDO-compatible security keys can provide phishing resistance when the service implements them correctly. That makes them particularly relevant for important email, financial, cloud, administrator, and recovery accounts. Compatibility and recovery still matter: not every service supports the same method, and work-managed accounts may restrict the available options.

Free and paid starting points

Start with the strongest method your important accounts already support and that you can recover safely.

A paid hardware security key may add value when:

• The account supports it.
• The consequence of account takeover is high.
• You can maintain at least one backup method or backup key.
• Every relevant device has a compatible connection method.
• The account’s recovery flow will not simply bypass the key with a weak fallback.

Backup before rollout

Before removing an old factor:

• Add and test the new factor.
• Generate and store recovery codes.
• Register a backup key or another approved recovery method.
• Confirm which family member or administrator can recover the account.
• Remove lost devices and obsolete factors.
• Document any account that still depends on SMS or email recovery.

More factors are not always better. The goal is a small set of strong, recoverable methods—not a collection no one understands.

What they solve

Browser protections can block or partition third-party cookies, known trackers, fingerprinting scripts, cryptominers, and other unwanted browser behavior. Firefox Enhanced Tracking Protection, Safari cross-site tracking controls, and Chrome third-party-cookie controls are examples of built-in starting points.

Use the browser’s standard protection first. Increase blocking only when you understand the compatibility tradeoff.

What they do not solve

Browser protections do not make you anonymous. A website can still know who you are when you sign in, provide an email address, make a purchase, or otherwise identify yourself. Browser controls also do not remove data already held by a company, secure a compromised account, or cover traffic from every non-browser app.

What blocking can break

Stricter blocking can interfere with sign-in, payments, embedded media, shopping carts, or other site functions. Prefer a narrow site exception over disabling protection globally. Review extensions carefully because an extension may request broad access to web pages and browsing activity.

Global Privacy Control is a signal, not universal deletion

Global Privacy Control, or GPC, can send a browser signal asking participating businesses to stop selling or sharing personal information. California enforcement authorities describe it as a signal for exercising applicable opt-out rights. Its legal effect depends on the law and the business; it is not a universal account-deletion or data-deletion command.

The problem it solves

A DNS lookup translates a site name into the network address a device needs. Encrypted DNS methods such as DNS over HTTPS protect that lookup while it travels between the device or browser and the selected DNS resolver.

Android includes a Private DNS setting, and Firefox includes DNS over HTTPS protection modes. A household may also configure secure or filtered DNS at the router level.

What it does not hide

Encrypted DNS does not:

• Encrypt all application traffic.
• Hide your IP address from the sites you contact.
• Make a browser session anonymous.
• Stop a user from entering credentials on a phishing site.
• Remove trackers already loaded by a page.
• Remove information from data brokers or search results.

Resolver trust and network conflicts

Encrypted DNS changes who handles the lookup. The selected resolver may be able to receive DNS-query information, subject to its architecture and policy. Review the resolver’s privacy policy, retention, security documentation, jurisdiction, and business model.

Secure DNS can also conflict with workplace controls, local parental controls, malware filtering, captive portals, VPN configurations, or network policies. Firefox’s default mode can fall back or disable DNS over HTTPS in some of these environments. A setting that works on one browser does not necessarily cover every app or device.

When paid value may exist

A paid DNS service may add value through household filtering, central policy, analytics, support, or easier router management. That is an administration decision—not proof that paid DNS is inherently more private.

What a VPN changes

A consumer VPN routes device traffic through infrastructure controlled by the VPN provider. Depending on the implementation, it can encrypt traffic between the device and the provider, obscure traffic from the local network, and make destinations see the VPN server’s IP address rather than the user’s usual public IP address.

This changes the trust relationship. The FTC has warned that a VPN app can receive permission to intercept internet traffic and does not make a user entirely anonymous. The local network or internet provider may see less, while the VPN provider becomes a party the user must evaluate.

What a VPN does not solve

A VPN does not automatically prevent:

• Phishing or fraudulent websites.
• Malware or unsafe downloads.
• Account takeover through weak credentials or recovery.
• Tracking after you sign in or identify yourself.
• Browser fingerprinting in every situation.
• Data-broker collection from public records or other sources.
• Identity theft.
• Publication of personal information.

Do not use “VPN on” as a substitute for browser, account, device, and recovery controls.

Public Wi-Fi does not automatically create a VPN requirement

The FTC’s current consumer guidance notes that widespread HTTPS encryption has made public Wi-Fi usually safe for ordinary web use. The fundamentals—updated devices, strong account security, scam awareness, and checking that a site is legitimate—still matter.

A VPN may still be useful for a specific untrusted-network, remote-access, IP-location, or all-app traffic requirement. But “I sometimes use coffee-shop Wi-Fi” is not, by itself, enough to establish that a separate paid VPN is necessary.

Private Relay is not a full-device VPN

Apple describes iCloud Private Relay as an iCloud+ feature that protects Safari web browsing by separating identity and destination information across two relays. It applies to Safari browsing, is not available in every region, and can affect how some sites behave. Treat it as a limited built-in relay—not as an automatic substitute for every VPN use case.

What to verify before paying

• Which devices, users, apps, and routers are covered.
• Whether work or school use is permitted.
• Whether the provider publishes clear ownership, jurisdiction, logging, retention, incident, and audit information.
• What traffic and metadata the provider may receive.
• Whether the app asks for permissions beyond its stated purpose.
• Whether the subscription is already included in another bundle.
• Renewal price, refund terms, device limits, simultaneous connections, and cancellation method.
• What happens to account and diagnostic data after cancellation or deletion.

Do not repeat “no logs,” server counts, country counts, speed claims, or audit claims without current, plan-specific verification.

Where aliases help

An email alias or mask gives a website a unique address that forwards to a real inbox. Apple Hide My Email and Firefox Relay are examples of platform and browser-linked approaches.

Aliases can:

• Reduce repeated disclosure of a primary email address.
• Make it easier to identify which signup leaked or misused an address.
• Let a user disable one alias without changing the main mailbox.
• Separate shopping, newsletters, trials, and less-trusted accounts.

What aliases do not solve

An alias is not the same as message encryption, anonymous identity, spam elimination, account security, or identity-theft protection. The website may still know who you are through payment, shipping, device, or account information.

The relay becomes a dependency

Mail and metadata pass through the relay provider. The provider’s forwarding, retention, spam-filtering, reply, attachment, logging, and account-deletion practices matter. Review the current privacy and support pages rather than assuming that every alias service handles mail the same way.

Mozilla’s own guidance advises caution with relay addresses for critical communications such as financial, medical, or legal matters. That is a product-specific limitation, not a universal rule, but it illustrates the larger point: a disposable address is not always the right recovery address.

Important-account and cancellation checks

Before using an alias for an important account, confirm:

• You can receive verification and recovery messages reliably.
• Replies and attachments work when needed.
• The alias can be transferred or replaced.
• You know which real mailbox receives it.
• The provider’s account is itself strongly protected.
• Cancellation will not immediately disable addresses that control account recovery.
• A custom domain, if used, remains under your control.

Before canceling an alias service, replace every alias used for sign-in, billing, password reset, or recovery—or confirm the provider’s documented post-cancellation behavior.

Detection, not prevention

Breach monitoring checks known breach data for an email address, credential, or other identifier and alerts the user when a match is found. It does not prevent a company from being breached, prove that an account was taken over, or prove that an address absent from the database has never been exposed.

Have I Been Pwned states that its database is only a subset of all breached records and that many breaches are not publicly released or even detected. Mozilla Monitor uses Have I Been Pwned data and similarly warns that some breaches may be missing because they have not been discovered or made available.

Free and built-in starting points

Free starting points may include:

• Have I Been Pwned searches and notifications.
• Mozilla Monitor alerts.
• Compromised-password warnings in a browser, operating system, or password manager.
• Security alerts from the account provider itself.

Each service receives at least the identifiers needed for the search or alert. Have I Been Pwned says its notification service stores the email address, subscription date, and a verification token. Other services may collect more; verify the current policy.

What to do with an alert

Do not click a sign-in link merely because an alert looks urgent. Go directly to the affected service and:

1. Read the provider’s incident notice.
2. Change an exposed or reused password.
3. Sign out unknown sessions.
4. Review recovery methods and trusted devices.
5. Enable a stronger authentication method.
6. Watch financial or credit activity when the exposed data warrants it.
7. Treat an unexpected MFA prompt or recovery change as a possible active compromise.

A paid monitoring product adds value only when its alerts, covered data, household support, and recovery assistance meaningfully exceed what the user already receives.

What they solve

Data-broker removal services help find and submit opt-out, deletion, do-not-sell, do-not-share, suppression, or related requests to supported data brokers and people-search sites. Their main paid value is often recurring administrative work rather than a one-time technical fix.

What they do not solve

They do not automatically:

• Delete all information from the internet.
• Remove every public record.
• Remove every search result.
• Remove information from social media or news sites.
• Prevent new information from being collected.
• Prevent identity theft.
• Guarantee that a broker will comply or that a profile will never reappear.

Google Search removal, source-site removal, broker opt-outs, and identity recovery are separate workflows even when a commercial service combines some of them.

Free, manual, and official starting points

Start with the free path that matches the actual exposure:

• Use a data broker’s own opt-out or privacy-rights process.
• Use Google’s official Search tools for eligible Google results.
• Use applicable state privacy-rights tools.
• For California residents, the state’s Delete Request and Opt-out Platform, or DROP, provides a free route to send deletion and opt-out instructions to registered data brokers.

DROP is not a national service and does not cover every organization that holds personal information. Its official explanation also shows an important tradeoff: it needs identifying information to match a consumer to broker records, and optional identifiers can improve matching.

When paid recurring help may add value

A paid service may be useful when the reader:

• Has many broker profiles or name and address variations.
• Does not want to repeat manual requests.
• Wants recurring scans or submissions.
• Values human review, proof, reporting, or support.
• Needs household administration and the service actually supports the household.
• Has confirmed that the provider covers the relevant brokers and request types.

Do not compare services by a coverage count alone. Providers can count sites, brokers, domains, custom-request opportunities, verified removals, or optional coverage differently.

Information the service may need and send

A removal service often needs personal information to find matching records and submit requests. As one current official example, Optery’s terms describe collecting identifiers such as a full name, birth year, and current city and state, and sending necessary information to brokers or aggregators to process requests. Its terms also state that third-party handling is outside its control.

That example should not be generalized to every provider. Before enrolling, verify:

• Required and optional identifiers.
• Whether identity documents are required and under what conditions.
• Which information is sent to brokers.
• Authorization or power-of-attorney language.
• Data retention, deletion, subprocessors, and security documentation.
• Whether a scan account and a removal account collect different information.
• Whether the service can act for a spouse, family member, or minor.

Scope, recurrence, and cancellation

Check the actual plan rather than the vendor name:

• Supported broker list or coverage methodology.
• Automated versus manual or custom requests.
• Scan and submission cadence.
• Evidence or screenshot policy.
• Reappearance handling.
• Geographic and age limits.
• Household limits.
• What happens when a broker refuses, cannot verify, or claims an exemption.
• What stops after cancellation.
• Whether reports and request history can be exported.
• Whether canceling the subscription also deletes the service account and submitted identifiers.

A low price is not a bargain if the service does not cover the exposure the user is trying to reduce. A high coverage number is not proof of effectiveness or fit.

Decompose the bundle before comparing price

Identity-protection products may combine several capabilities:

• Identity or public-record monitoring.
• Credit monitoring.
• Recovery assistance.
• Identity-theft insurance.
• Data-broker removal.
• Antivirus or device-security tools.
• A VPN.
• A password manager.
• Parental or child features.

The CFPB notes that identity-monitoring services vary widely and may include monitoring, correction assistance, insurance, credit monitoring, or other tools. Compare each component against what the household already has.

A useful bundle is not the one with the longest feature list. It is the one whose important components are strong enough, compatible with the household, and easier to maintain than separate alternatives.

Credit monitoring versus a credit freeze

Credit monitoring generally alerts the user after a change appears in a credit file. The CFPB explicitly warns that monitoring does not protect against identity theft before it happens.

A security freeze is a different control. The FTC and CFPB explain that a freeze is free and generally blocks access needed to open new credit until the consumer lifts it. A fraud alert is also different: it asks lenders to verify identity but does not block access in the same way.

Monitoring, a freeze, and recovery assistance can complement one another. Do not let a bundle imply that its alerts replace an official freeze when the reader’s goal is preventing new-account credit fraud.

When a paid bundle may add value

A bundle may be worth paying for when:

• Human recovery support is important.
• The insurance terms cover costs the household cares about.
• Several adults or children are included under one clear plan.
• Alerts are actionable and reach the right person.
• The household would otherwise pay for several comparable components.
• Cancellation and migration are manageable.

Verify exclusions, deductibles, eligibility, reimbursement rules, support hours, data collected, family definitions, trial conversion, renewal price, and which features disappear at cancellation. Do not summarize an insurance benefit as a guarantee of reimbursement.