There is a small moment I suspect most of us have experienced. You install an app. It asks for access to your location, contacts, microphone, photos and notifications. You look at the permissions for a second, decide that the app probably needs them, and tap Allow. Website asks whether you want personalised recommendations. You accept. Your browser offers to save the password. You click yes. Your phone asks whether it should remember your home and work locations. You enable it.
None of these decisions feels particularly important. That is precisely why they are interesting.
Privacy rarely disappears because someone makes one terrible decision. More often, we trade small pieces of it for small amounts of convenience. A better recommendation here. A faster login there. A smarter assistant. A map that already knows where you are going.
The individual trade usually feels reasonable. The accumulated result can be very different.
Privacy is not the opposite of convenience
Privacy discussions often become strangely black or white. Either you are a privacy maximalist who disables every tracking feature, or you supposedly do not care about your data. I don’t think that is useful.
I use services that collect information about me. You probably do too. Location history can be genuinely useful. Password managers need to store credentials. Cloud services need access to files. Banking apps need information about transactions. A navigation application becomes much more useful when it knows where you are. The question isn’t whether data should ever be collected.
The better question is – what are you getting in exchange for giving it away, and is the exchange still worth it?
That distinction matters because not all data has the same value.
Giving a weather application approximate location while you are using it is one thing. Giving a social platform continuous access to your precise location is another.
Allowing a photo-editing application to access one selected photograph is different from giving it access to your entire photo library.
Using a password manager to store passwords is different from allowing a random browser extension to read everything you type.
Privacy is therefore less about refusing data collection altogether and more about controlling the scope of the exchange.
We are more privacy-conscious than our behaviour suggests
There is a useful contradiction in recent European data.
Eurostat reported that 76.9% of EU internet users took steps to manage access to their personal data in 2025, up from 73.2% in 2023. Almost 59% refused to allow their data to be used for advertising, while 56.2% restricted or refused access to their geographical location.1
Privacy is an inherent human right, and a requirement for maintaining the human condition with dignity and respect.
Bruce Schneier2
That sounds encouraging.
But only 37.6% said they read privacy policy statements before sharing personal data.
There is a pattern here. People care about privacy, but they don’t necessarily want to spend twenty minutes understanding the terms of every service they use. And frankly, I don’t blame them. A privacy policy is often a terrible interface for making a privacy decision. The result is that we outsource the decision to defaults.
If the default is “share location”, most people share location. If the default is “personalised advertising”, many accept it. If the application makes the privacy-preserving option difficult to find, convenience wins.
This isn’t necessarily because people are careless. It is because friction has a powerful effect on behavior.
Convenience is often the product of data
Some digital conveniences would be impossible, or at least much worse, without personal data. Consider a navigation application.
It can estimate traffic because millions of devices provide location information. It can predict your arrival time because it knows where you are and where you are going. It can suggest a faster route because it has access to large amounts of behavioural and geographic data.
The convenience is real. So is the data collection. The same principle appears everywhere.
Streaming services learn what you watch. Online stores learn what you buy. Fitness applications learn about your routines. Smart-home devices learn when you are at home. Email services analyse messages to provide search, categorisation and spam filtering. AI assistants increasingly need access to documents, calendars, messages or other context to become genuinely useful.
The uncomfortable part is that better personalisation usually requires more context.
That doesn’t automatically make the service bad. But it means privacy has an economic dimension. You are not simply “using an app”. You may be exchanging information for functionality.
And sometimes you don’t know exactly what the exchange is.
The problem is not only what companies collect
One of the easiest mistakes in privacy discussions is to focus entirely on collection. Collection is only the first stage. The more interesting questions are what happens afterwards.
Who gets access? How long is the information retained? Can it be combined with information from another service? Can it be sold or shared? Can employees access it? Can an attacker steal it?
You might never tell an application that you are interested in changing jobs. But perhaps you repeatedly search for certain companies, read particular career articles, update your professional profile and use a job-search application.
None of those individual signals necessarily reveals much. Together, they can.
This is why privacy isn’t just about protecting individual pieces of information. It is also about protecting the relationships between pieces of information.
A location record can be harmless. A purchase can be harmless. A search query can be harmless. A calendar entry can be harmless.
Combine them, and suddenly you have a surprisingly detailed picture of someone’s life.
The best privacy strategy is usually data minimisation
If I had to choose one principle for everyday privacy, it would be simple:
Don’t give a service more information than it needs.
This sounds obvious, but it is surprisingly powerful. Suppose an application wants your location.
There are several possible questions:
- Does it need your location at all?
- Does it need precise location?
- Does it need continuous access?
- Does it need location when the application is closed?
- Does it need to retain your historical locations?
Those are five different questions.
Yet many permission systems turn them into one:
Allow location access?
The same applies to contacts, photos, microphones and other sensitive information.
The privacy-friendly option isn’t always “deny”.
Sometimes it is:
Allow, but only within a smaller boundary.
That might mean “only while using the app”, “selected photos”, “approximate location”, “temporary access” or “don’t retain history”.
This is much more realistic than trying to live without digital services.
A practical way to think about the trade-off
When I decide whether to give an application access to personal information, I find five questions more useful than reading an entire privacy policy.
| Question | What you are really deciding |
|---|---|
| What does it need? | Is the data genuinely necessary for the feature? |
| How precise does it need to be? | Could approximate data work just as well? |
| How long will it have access? | One-time, while using it, or permanently? |
| What happens if the data leaks? | Would the consequence be annoying or genuinely damaging? |
| What do I get in return? | Is the convenience valuable enough to justify the exposure? |
The fourth question is particularly useful.
People tend to evaluate privacy decisions based on probability – What are the chances this will go wrong?
I prefer thinking about impact × probability.
If the downside is tiny, sharing might be perfectly reasonable. If the downside is severe, even a low probability can justify being more careful.
Giving a restaurant application your approximate location is probably a low-stakes decision. Giving an unknown application access to identity documents stored in your phone is a very different calculation.
Europe has a different instinct about this
European privacy regulation reflects a broader idea – personal data shouldn’t simply become an invisible by-product of using digital services.
The EU’s GDPR is built around principles including purpose limitation, data minimisation and transparency. That doesn’t mean European users are automatically better at protecting their privacy.
Eurostat’s 2025 figures show considerable differences between countries. Finland recorded 92.6% of internet users taking measures to manage access to their personal data, compared with 56.0% in Romania.
Regulation can establish rights and obligations. It cannot make every individual privacy decision for you. You still have to decide whether that convenient feature is worth what it asks from you.
Sourced from 3
Americans have a different problem
Recent US research highlights another side of the equation. Consumer Reports’ 2025 Consumer Cyber Readiness Report found that only 48% of Americans were at least somewhat confident that their personal data was private and not being distributed without their knowledge, down from 53% in the previous survey.4
That number is revealing because privacy is difficult to manage if you don’t believe you have meaningful control over it. Sometimes people aren’t consciously choosing convenience over privacy. They are choosing convenience because the privacy-preserving alternative is too difficult. That is a design problem.
If turning off tracking requires finding six different settings across three applications, most users won’t do it. If refusing personalised advertising makes a service substantially harder to use, many users will accept the tracking. If deleting an account is easy but deleting the underlying data is almost impossible, the user doesn’t have much practical control.
Privacy should therefore be treated as a usability problem as well as a security problem.
Convenience becomes dangerous when you stop noticing it
The most interesting privacy risks are often the ones that disappear into the background.
Each feature can be useful. The danger is not necessarily one particular feature. It is the gradual disappearance of boundaries.
Once a service becomes deeply integrated into your life, turning it off becomes expensive. You lose the convenience you have become accustomed to. That creates a form of lock-in that has nothing to do with contracts. The service becomes part of your routine. And once convenience becomes invisible, you stop making an active privacy decision. You simply continue.
What I would actually change
I don’t think most people need another enormous privacy checklist. I’d start with a few decisions that have disproportionate value.
Review location permissions on your phone. Look at which applications have access to your microphone and camera. Remove applications you no longer use. Use a password manager rather than trying to memorise dozens of passwords. Turn on multi-factor authentication for important accounts. Prefer passkeys where they are supported and appropriate. Be selective with browser extensions. And occasionally ask yourself why a service needs the data it is requesting.
That last habit is probably the most valuable. You don’t need to reject every request. Just stop accepting them automatically.
The better question isn’t “privacy or convenience?”
The privacy debate becomes much easier once you stop treating it as a choice between two extremes. The real choice is usually between different levels of convenience and different levels of exposure. Sometimes the trade is worth it. Sometimes it isn’t.
A navigation app knowing where you are for an hour might be a perfectly sensible exchange for getting across an unfamiliar city.
A shopping website remembering your delivery address may save you time with very little additional risk.
An unknown application requesting your contacts because “this improves your experience” deserves more skepticism.
The difference is not paranoia. It is proportionality. The goal isn’t to eliminate data sharing. It is to make sure that the amount of information you give away is proportional to the value you receive. That is a much more sustainable approach to digital privacy.
You can enjoy the convenience of modern technology without treating every privacy decision as an all-or-nothing battle. Just remember that convenience has a cost. Sometimes you pay with money. Sometimes you pay with attention. And increasingly, you pay with data. The useful skill is knowing which price you are actually paying.
