Defences that work

The idea: break the links

Think back to the pinboard of index cards joined by string. You cannot take a card off a broker's board, but you can stop handing over cards that match. Every defence below works by making two parts of your life share less.

Strong defences

• Stay logged out when you can. The cross-device lab showed that a shared login was the one near-certain clue. Reading news, comparing prices or watching a video rarely needs an account.
• Separate profiles or containers. Most browsers let you create several profiles, each with its own cookies, history and logins. Some offer containers, tabs whose cookies are kept apart from other tabs (checked October 2026). Use one for work, one for shopping, one for personal accounts.
• Email aliases. A different forwarding address for each shop or newsletter. The identity-graph lab showed an email is a strong join key; an alias used in one place joins nothing else. Many mail providers and some password managers offer aliases (checked October 2026).
• Give a phone number only when it is truly needed. Phone numbers rarely change, so they join records across many years.
• Avoid "Log in with..." buttons on sites you do not trust. They link your account at one big provider to every site you use it on.

Defences that help a little

• A VPN hides your home IP address from the sites you visit, so the shared-address clue weakens. It does nothing about logins, typing rhythm or hours of use, and the VPN provider can see the address instead.
• Timing protection. Some privacy-focused browsers reduce how precisely pages can measure the time of events, which blurs keystroke timing somewhat (checked October 2026). The typing lab showed why this helps only partly: moderate noise only dents a matcher, and large noise makes typing feel slow.
• Writing plainly and briefly when anonymity matters, as in the stylometry lesson. Short, rephrased text carries fewer habits.

What a browser can and cannot do

A browser controls what pages can read on your device. It can partition cookies, block known trackers, limit fingerprinting surfaces and blur timers. Those protect the device-level joins that earlier legs covered.

But much person-level tracking happens after the data leaves you. When you log in, the site knows who you are, whatever the browser does. When you give a shop your email and phone, the shop can sell or share them. When your words are published, anyone can analyse their style. No browser setting reaches into a company's database. Those joins are stopped only by what you choose to share in the first place.

A common misconception

"Private browsing mode makes me anonymous." Private mode forgets your history and cookies when you close the window, which is useful. But if you log in during that window, the site knows exactly who you are, and your typing still has its rhythm. Private mode protects your device from remembering; it does not hide you from the sites.