Your Data & Who Has It

What your phone collects, who buys it, and the settings that actually matter

Most people assume their data is gone and there is nothing to be done. That is roughly half true, and the useful half is the other one. A phone straight out of the box shares your location continuously, lets every app build an advertising profile, and feeds your voice recordings and photos into systems you never agreed to specifically. Twenty minutes of settings changes cuts most of that off. The rest — data brokers who sell your address, phone number and family members to anyone with a credit card — takes an afternoon to reduce and matters more than people think, because that is where scammers get the detail that makes a call convincing. This guide is about the changes that make a real difference, not the ones that just make you feel careful.

Free PDF, about ten pages. No sign-up.

Call a licensed professional for these

Knowing where to stop is a skill, not a failure of nerve. These jobs are not DIY:

If someone has opened accounts in your name, stop and start at identitytheft.gov. It produces the official recovery plan and the affidavit that banks and credit bureaus require, and it is free.
If you are being stalked, harassed, or are leaving an abusive relationship, do not follow generic advice — a removed location share can itself signal something. Contact the National Domestic Violence Hotline at 1-800-799-7233 for guidance that accounts for that risk, and consider Texas's Address Confidentiality Program.
If a data broker refuses a deletion request or ignores you past the legal deadline, the Texas Attorney General's office takes complaints, and Texas has a data broker registry with real obligations.
If a company you dealt with is breached and your Social Security number was involved, freeze your credit at all three bureaus before doing anything else. It is free and it is the single most effective step.
If images of you are being shared without consent, contact an attorney and use StopNCII.org. Do not negotiate with whoever has them.
For a business holding customer data, talk to a lawyer about your obligations before a breach rather than after. Texas notification rules have deadlines and penalties.

What you need

An afternoon

The settings pass takes twenty minutes. Broker removals take longer and are worth doing once properly.

A password manager

The free tiers are fine. Reused passwords are how one breach becomes six.

A second email address

For shops, signups and anything that will sell you out. Keep your real one for people and banks.

Your phone's privacy dashboard

Both iPhone and Android now show which apps used your location, camera and microphone, and when. Genuinely revealing.

A credit freeze

Free at all three bureaus. Blocks new accounts in your name. The strongest single thing on this list.

Part 1

The twenty-minute settings pass

Do these in order. They are the changes with the largest effect per minute spent, and none of them break anything you actually use.

1
Turn off location for apps that do not need it
iPhone: Settings, Privacy & Security, Location Services. Android: Settings, Location, App permissions. A weather app needs approximate location. A game, a flashlight, a shopping app, or a social network does not need your precise position, and none of them need it in the background. Set everything you can to While Using or Never.
2
Stop the advertising identifier
iPhone: Settings, Privacy & Security, Tracking — turn off Allow Apps to Request to Track. Android: Settings, Privacy, Ads — delete the advertising ID. This is the number that lets separate companies stitch your behavior across apps into one profile. Removing it is the highest-value single toggle here.
3
Review microphone and camera access
Same privacy menus. Anything that has microphone access but is not a phone, messaging, or recording app should lose it. Then look at the recent-access log, which is often the moment people take this seriously.
4
Turn off voice recording retention
Siri, Google Assistant and Alexa each keep recordings and each let you stop it and delete history. Amazon: Alexa Privacy settings. Google: myactivity.google.com. Apple: Settings, Privacy, Analytics & Improvements.
5
Check what your chatbot keeps
Most AI tools default to using your conversations for training and let you turn it off in settings. If you have ever pasted work documents or personal details in, do this now, and delete the old conversations while you are there.
6
Turn on two-step verification for email
Not strictly privacy, but your email resets every other password you own. It is the account that matters most and it is usually the least protected.

Safety

Do this on the phones of anyone in the family who will not do it themselves — that usually means teenagers and older parents. Both groups are targeted specifically, for different reasons.

Part 2

Data brokers, and why they matter to you

These are companies that compile and sell your name, current and previous addresses, phone numbers, age, relatives and estimated income. This is not theoretical: it is where the caller who knows your daughter's name got it.

1
Understand what is for sale
Search your own name plus your city. You will likely find several sites showing your address history and relatives. That is the raw material for a convincing scam call, and it is available to anyone for a few dollars.
2
Start with the big ones
Whitepages, Spokeo, BeenVerified, Intelius, PeopleFinders, Radaris, MyLife and Acxiom cover most of it. Each has an opt-out page, usually buried in the footer under Privacy or Do Not Sell My Information.
3
Use the state law
The Texas Data Privacy and Security Act gives you the right to demand deletion, and brokers operating here must maintain a registry entry. Say explicitly that you are exercising your rights under it — requests citing the law get handled properly far more often.
4
Expect to repeat it
Records reappear as brokers re-acquire data. Once a year is a reasonable rhythm. Paid removal services exist and mostly do exactly what you would do, on a schedule; that convenience is the product.
5
Remove the one that matters most first
If your time is limited, prioritize anything showing your current home address alongside family names. That combination is what makes a threatening or emergency-story call land.

Safety

Never pay a company that contacts you offering to remove your data. Legitimate services do not cold-call, and that pitch is itself a common scam.

Part 3

What smart devices in the house actually hear

Worth being accurate about, because both the panic and the complacency are wrong.

Smart speakers listen locally for the wake word and send audio after it triggers. They are not streaming everything continuously.
They do misfire, on television dialogue and ordinary conversation, and those recordings are kept. Check the history — it is usually a surprise.
Smart TVs are among the worst offenders, tracking what you watch through the screen itself. Look for Automatic Content Recognition in the settings and turn it off.
Doorbell cameras record neighbours and the street, not only your porch. Some share footage with police by default; know which setting you are on.
Newer cars collect location, speed, braking and phone contacts, and several manufacturers have sold that to insurers. Check the car's own privacy menu and the manufacturer's app.
Guests do not know any of this. Say so if a device is recording — in Texas one-party consent covers you legally for conversations you are part of, but that is not the same as being decent about it.

Part 4

AI tools and your information specifically

New tools, and the defaults are set for the company's benefit rather than yours.

1
Assume anything you paste may be kept
Conversations are commonly stored, reviewed by staff for quality, and used for training unless you opt out. Treat the box as if a stranger might read it, because in a small number of cases one will.
2
Never paste identifiers
Social Security numbers, account numbers, passwords, medical records, or a document containing someone else's personal details. If you need help with a document, redact the identifying parts first.
3
Understand photo uploads
A photo carries location and time in its metadata unless stripped. Uploading a picture of your house, your child, or a document shares more than the visible image.
4
Check the setting that matters
Look for 'improve the model for everyone', 'training', or 'chat history'. Turning it off is usually one switch and often disables history too, which is the trade.
5
Be careful with connected accounts
Tools that plug into your email, calendar or files are genuinely useful and genuinely broad. Read what access is being granted, and remove connections you stopped using.

Safety

For a business, an employee pasting customer records into a chatbot can be a reportable data incident. Have a written rule before it happens — the work guide in this library covers what it should say.

Part 5

The freeze, and why it beats monitoring

If you do one thing from this guide, do this. It is free, it is quick, and it prevents the harm rather than reporting it afterwards.

A credit freeze blocks new accounts being opened in your name. Monitoring only tells you after it happened.
Freeze at all three: Equifax, Experian and TransUnion. Missing one leaves the door open.
It does not affect your credit score and does not stop you using existing cards.
Unfreeze temporarily when you apply for credit — it takes minutes online.
Freeze your children's credit too. Child identity theft often goes unnoticed until they apply for their first loan at eighteen.
Keep the PINs somewhere you will find them. In a password manager, not on paper in a drawer.

The words people use

Knowing the right word is half of getting good help.

Data broker: A company that collects and sells personal information about people who never dealt with it.
Advertising ID: A number on your phone letting companies link your activity across apps. Can be deleted.
Metadata: Data about data — when a photo was taken and where, who a call was to and for how long.
Credit freeze: A block on new credit being opened in your name. Free, reversible, and the strongest simple protection.
Two-step verification: A second check beyond a password, usually a code. Stops most account takeovers.
Opt out: Telling a company to stop. Usually required by law to be honored, usually deliberately hard to find.
Automatic Content Recognition: Smart TV technology identifying what is on screen and reporting it back.
TDPSA: The Texas Data Privacy and Security Act, which gives Texans rights to access and delete their data.

Do these this week

Reading changes nothing on its own.

Do the twenty-minute settings pass on your own phone this week.
Then do it on a parent's or child's phone, because they will not.
Freeze your credit at all three bureaus. Free, and the highest-value item here.
Freeze your children's credit while you are in there.
Search your own name plus your city and see what is publicly for sale.
Opt out of the three brokers showing your home address, citing the Texas law.
Turn off training and delete old conversations in any AI tool you use.
Check the voice assistant history in your house. It is usually the moment this stops feeling abstract.

Next guide

The AI Already in Your House

Your phone, speaker, TV and car are already using it — make them work for you

Read it All Guides