Privacy and Personal Choice: Real-World Threats to Your Data

Let’s start with the core thesis right out of the gate.

It’s OK not to care about your privacy. Many privacy advocates just screamed in horror after reading this, probably. Still, if you genuinely don’t care, and you’re making that choice consciously, that’s your call.

What’s not OK is when you don’t have a choice. Or when you’re pushed into believing that wanting privacy is suspicious, selfish, or somehow “anti-social.”

Privacy is not a niche preference. It’s a basic requirement for everyday life to work. Governments need privacy so adversaries cannot learn state secrets. Businesses need privacy so product ideas and negotiations don’t leak to competitors. Movie studios need privacy so plot details don’t spill before release. You need privacy when you plan a surprise birthday party, talk to a therapist, or send a credit card number to pay for something online.

So yes, it’s OK not to care. But it’s also completely reasonable to want your personal information to stay private. Most of modern life assumes you do.

What’s at stake

The important thing to understand is this: the outcome of privacy is usually not an event. It’s the absence of an event.

Privacy means spammers don’t know your real email address or phone number. It means nobody can access your banking information. It means a stalker cannot find your home address. When privacy works, nothing happens. That is the feature.

So if your personal data is not protected, what can happen?

Spam, robocalls, and unwanted contact

In 2025, U.S. consumers received 52.5 billion robocalls, according to YouMail’s Robocall Index. That works out to about 140 million robocalls per day. Texts are following the same path: the U.S. PIRG Education Fund reports that the volume of scam robotexts has nearly tripled since 2021.

These calls and texts are not random. They are fueled by personal data harvested from breaches, data brokers, and careless online habits. Once a phone number, email, or home address ends up in a broker’s database, or gets sold on the dark web, it tends to circulate forever. Juniper Research projected that global consumer losses to robocalling fraud would exceed $80 billion in 2025, driven by increasingly sophisticated scams and the growing use of AI-generated voice cloning.

Spam is not the worst case. It’s the early warning sign.

Spam is annoying. Phishing is dangerous.

When attackers have access to detailed personal data (name, employer, home address, recent purchases, family members), they can craft targeted messages that look real. If a scammer knows your bank, your address, and your spouse’s name, a fake “security alert” email becomes much more convincing.

Sometimes it’s even simpler. Scammers learn which services you use, send an email pretending to be one of them, push you to a fake login page, steal your password, and then try the same password on other sites. That last step works because many people reuse passwords.

The 2023 23andMe breach illustrates the ripple effect: attackers used reused credentials to access approximately 14,000 accounts, then leveraged the DNA Relatives feature to reach information on 6.9 million users. The consequences for affected individuals can include unauthorized purchases, drained bank accounts, and exposure of sensitive personal, and in this case genetic, information.

Identity theft

Identity theft hits hardest when attackers get access to high-value identifiers like Social Security numbers, dates of birth, and home addresses.

The 2024 National Public Data breach exposed 2.9 billion records, including Social Security numbers, names, dates of birth, and mailing addresses. Victims of breaches like this face years of monitoring, credit freezes, and the constant risk that their data is being traded and re-traded.

The people most affected are often those least equipped to recover. A study of identity theft victims aged 65 and older found that those living at or below the federal poverty level were nearly five times as likely to suffer out-of-pocket costs.

SIM swapping

SIM swapping is a targeted attack where criminals convince a mobile carrier to transfer a victim’s phone number to a new SIM card. Once they control the number, they can intercept SMS-based two-factor authentication codes and reset passwords for email, banking, and social media accounts.

What makes SIM swapping particularly dangerous is how much of the required personal information (phone number, date of birth, carrier details) is readily available online through data brokers, social media, or previous breaches.

If your phone number is your identity, your SIM is your front door key.

Doxxing, swatting, and physical harm

At the extreme end of the spectrum, exposed personal data enables doxxing (publishing someone’s private information to invite harassment) and swatting (making false emergency reports to send armed police to a victim’s address).

A UCL-led study of crime survey data for England and Wales found that cyberstalking is growing faster than other forms of stalking, and that 16- to 24-year-olds are the most likely to be targeted. In a 2022 survey by the Victims’ Commissioner for England and Wales, more than 40% of cyberstalking victims said the abuse lasted longer than two years. Cyberstalking can escalate from online surveillance to physical tracking when perpetrators gather enough location data, daily routines, and personal details from online sources.

The common thread across all of these threats is simple: they start with personal information that should have stayed private.

Practical steps to protect personal data

Secure your accounts

Use a password manager. Password managers generate and store unique, complex passwords for every account. The key benefit is eliminating password reuse, which is the single biggest enabler of credential stuffing and account takeovers.

Enable two-factor authentication (2FA) everywhere. 2FA requires a second verification step beyond a password, such as a code from an authenticator app or a hardware security key. Even if an attacker gets your password, they still need the second factor.

Prefer authenticator apps over SMS codes. SMS-based 2FA is better than nothing, but it is vulnerable to SIM swapping. Authenticator apps (such as Aegis, 2FAS, or Proton Authenticator) generate time-limited codes on your device and don’t depend on your phone number.

Protect your email

Use email aliases. Instead of giving every service the same email address, use unique aliases for each signup. If one service gets breached, the leaked address is not your master key to everything else. Aliases also help you spot which company leaked or sold your data, since spam arriving at a specific alias points back to the source.

Separate email addresses by purpose. Use one address for banking and government, another for shopping, and a third for social media and newsletters. This compartmentalization limits the blast radius of a breach.

Control your online footprint

Remove yourself from data broker sites. Data brokers collect and sell personal information (names, addresses, phone numbers, relatives, estimated income) to anyone willing to pay. Removal can be done manually through each broker’s opt-out process, or automated through services like Incogni or Optery. Google also allows requests to remove personal information from search results.

Lock down social media. Set profiles to private. Audit what personal details are visible: birthdate, location, employer, family relationships. Doxxers rarely “hack” you. They assemble you from crumbs.

Delete old accounts. Unused accounts on old platforms still hold personal data and can still be breached. Closing them reduces exposure.

Protect your physical safety

Never publish your home address online. Exposed home addresses enable everything from harassment deliveries to swatting to physical stalking. Use a PO Box or mail forwarding service when a physical address is required for non-essential services.

Be cautious about sharing information about relatives. Knowing who someone’s family members are enables targeted social engineering. A scammer who knows a parent’s name, a child’s school, or a sibling’s workplace can build a believable story fast.

Secure your communications

Use end-to-end encrypted messaging. Services like Signal encrypt messages so only the sender and receiver can read them.

Consider self-hosted messaging for sensitive groups. For families or small teams who want more control, Matrix (via the Element app) can be self-hosted. Messages can be end-to-end encrypted, and running your own server reduces reliance on a large platform’s infrastructure. This takes some technical skill, but it can be a good fit for small, trusted communities.

Be mindful of metadata. Even encrypted messaging can reveal who talked to whom, when, and how often. For most people, Signal is a strong balance of security and usability. For higher-risk situations, self-hosted Matrix can reduce dependence on any central server.

Why it matters

The goal of privacy is not secrecy for its own sake. It’s prevention.

When personal data stays protected, nothing happens: no fraud, no harassment, no stolen savings, no armed officers at the door because of a false report. The absence of bad outcomes is the point.

Every person has data worth protecting. These threats are not theoretical. They scale from billions of spam calls that waste everyone’s time, through account takeovers that quietly drain finances, to doxxing that spills into the real world. The tools to defend against this exist. They’re accessible. They just need to be used.