Living with the digital dragnet — a practical plan to reduce surveillance exposure

That is the digital dragnet: not one watcher, but thousands of routine collections that quietly pool. Australians can feel it. In the OAIC's 2026 Community Attitudes to Privacy Survey, 87% said they were more concerned about privacy than five years ago. Only 20% felt in control of their data, down from 32% in 2023, and 39% said protecting their privacy was simply too much effort.

This plan is written for that 39%. It rests on three verbs — collect less, share less, retain less — and assumes you have an afternoon, not a career.

Collect less: start with the phone

Your phone is the richest sensor you own, and location is what it gives away most readily. It is also the hardest data to anonymise: a landmark 2013 study of 1.5 million people found that four time-stamped locations were enough to single out 95% of them. An hour in your settings cuts off a surprising amount of it.

• Location. Set every app to "while using" or "never", and switch off precise location for anything that isn't navigating you — weather, shopping and social apps work fine with an approximate location.

• Background scanning. On Android, turn off Wi-Fi and Bluetooth scanning in location settings; otherwise apps and services can use those radios to locate you even when they appear switched off.

• Advertising identifier. On an iPhone, turn off "Allow Apps to Request to Track"; on Android, delete your advertising ID. It will not stop all tracking, but it removes the easiest key for joining your records together.

• Permissions. Review microphone, camera, contacts, Bluetooth and photos app by app. Grant access to selected photos rather than your whole library, and refuse contacts to anything that doesn't need them.

• Unused apps. Delete anything you haven't opened in three months. Every ad-supported app you keep is another seat at the kind of auction Gravy's data came from.

• Audit tools. iPhone's Safety Check and Android's privacy dashboard show which apps can use, or have used, your location, camera and microphone. Revisit them every few months.

Retain less: clear the cloud's memory

Many services keep a diary of you by default, and anything kept can later be breached, subpoenaed or repurposed. When Latitude Financial was hacked in 2023, attackers took 7.9 million driver licence numbers — and only 40% had been provided in the previous decade. Some records dated back to 2005. You can't audit Latitude's servers, but you can stop your own accounts hoarding.

• Google. Set Web & App Activity and YouTube history to auto-delete after three months. Maps Timeline moved onto your phone during 2025; if you don't use it, switch it off.

• Meta. In Accounts Center, open "Your activity off Meta technologies", clear previous activity and disconnect future activity. Be aware that this disconnects the data from your profile rather than deleting it.

• Voice assistants. Delete stored recordings and set the assistant not to save new ones. Settings are the vendor's to change: in March 2025, Amazon withdrew the option for some US Echo devices to process requests locally.

• AI assistants. Turn off training on your conversations where the option exists, delete histories you don't need, and don't paste in anything you wouldn't email to a stranger.

• Your own devices. Keep messages for a year rather than forever, or use disappearing messages, and let your browser clear history automatically. A phone that holds less has less to give up if it is lost, seized or compromised.

Share less: close the accounts you've forgotten

Every dormant account is a copy of you held by an organisation with little reason to guard it. Australian organisations notified the OAIC of 1,205 data breaches in 2025, the most since mandatory reporting began. Few people could list every account they hold.

1. Find them. Search your inbox for "welcome", "verify your email" and "your receipt", and check the list in your password manager.

2. Check them. Run your email addresses through Have I Been Pwned to see which services have already leaked them.

3. Revoke connected apps. "Sign in with Google, Apple or Facebook" quietly links services to your main account. Review the connected apps list in each and remove what you no longer use.

4. Strip, then close. Before deleting an account, remove saved cards, addresses and optional details, then use the service's own deletion process.

5. Ask in writing. Where there is no delete button, email the privacy officer. Under the Australian Privacy Principles, covered organisations must destroy or de-identify information they no longer need and, with limited exceptions, give you access to what they hold. Only 45% of Australians know they can ask for access; 11% ever have.

Everyday habits that shrink your profile

The rest is habit, and habits compound.

• Leave optional fields blank. Date of birth, mobile number and address are what make separate records joinable. Give them only where the law or the service genuinely requires it.

• Use email aliases. A separate forwarding address per service — Apple's Hide My Email, Firefox Relay and similar tools do this — means one breach does not expose your real inbox, and you can see who passed your address on.

• Protect your mobile number. It follows you for decades and links almost everything. Keep it off public profiles, and consider a private SIM for numbers you don't want tied to your name.

• Weigh loyalty programs. The ACCC lists loyalty schemes among the sources data brokers draw on. The discount is the price of your shopping history; decide whether it's worth it.

• Default to encryption. Use end-to-end encrypted messaging for anything personal, and turn on the strongest cloud encryption your provider offers.

• Strip photo locations. Photos often carry GPS coordinates. Remove location before sharing, especially images taken at home or at your children's school.

Where personal choices hit a wall

Here is the honest part. Everything above shrinks the share of the dragnet you feed voluntarily. A great deal of it is not voluntary.

Telcos must keep two years of metadata on every customer. Banks and telcos must verify your identity, and a growing list of platforms must now check your age. Your friends' address books can upload your number to apps you have never installed. And you do not choose your providers' suppliers: when e-prescription provider MediSecure was breached in 2024, the health data of 12.9 million Australians went with it — people who had never chosen the company. The ACCC has found consumers are generally unaware how much of their data flows to data firms at all.

Australians know this. In the 2026 survey, 58% agreed that if they want to use a service, they have no choice but to accept what it does with their data — up from 50% in 2023.

The law is moving, slowly. Since 10 June 2025, individuals can sue over serious invasions of privacy. On 31 August 2026 the Attorney-General released draft reforms proposing a "fair and reasonable" test for handling personal information and a right to erasure — but only against large digital platforms, and without removing the small business exemption that leaves most Australian businesses outside the Privacy Act. Meanwhile, 93% of Australians support a legal right to have organisations delete their data.

So do both. Tidy your own house, because it genuinely reduces what can be joined, sold or stolen. Then tell your representatives what the law should say, because the biggest collectors will not stop on their own.

A final word

Nobody escapes the dragnet entirely, and a plan that promised otherwise would be selling something. The goal is narrower and achievable: be a smaller, blurrier, shorter-lived target than you were last month. Data you never generate cannot be collected, data you never share cannot be sold, and data nobody keeps cannot be stolen.

Xiph Cyber builds for exactly that position — hardened handsets, private SIMs and encrypted communications for individuals, and risk audits and vCISO support for organisations that want to collect less, share less and keep less themselves. Get in touch and you'll speak to a real person within 24 hours.

Further reading

• OAIC, Australian Community Attitudes to Privacy Survey 2026 — https://www.oaic.gov.au/engage-with-us/research-and-training-resources/research/australian-community-attitudes-to-privacy-survey/australian-community-attitudes-to-privacy-survey2026

• OAIC, Data breach notifications increase to all-time high in 2025 (July 2026) — https://www.oaic.gov.au/news/media-centre/data-breach-notifications-increase-to-all-time-high-in-2025,-new-ndb-stats-show

• ACCC, Consumers lack visibility and choice over data collection practices (May 2024) — https://www.accc.gov.au/media-release/consumers-lack-visibility-and-choice-over-data-collection-practices

• de Montjoye et al., Unique in the Crowd: The privacy bounds of human mobility, Scientific Reports (2013) — https://pmc.ncbi.nlm.nih.gov/articles/PMC3607247

• 404 Media, Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location (January 2025) — https://www.404media.co/candy-crush-tinder-myfitnesspal-see-the-thousands-of-apps-hijacked-to-spy-on-your-location/