How to Protect Your Information Online in 2026

JoseMonkey is very good at finding people. With their permission, of course.

As a self-styled “open source intelligence researcher” operating on TikTok, Instagram and YouTube, JoseMonkey’s specialty is pinpointing a person’s exact global location using only the non-descript video of their face, which they send him first.

His posts — most of them documenting his lighthearted digital manhunts — gain hundreds of thousands of views each, with nearly 20 million total likes over five years.

To do this work, JoseMonkey focuses on the background details of the videos he’s sent — like the landscape and visible street signs — and uses publicly available tools like OpenStreetMap. But he only tries to “find people who ask to be found,” JoseMonkey told KQED’s Close All Tabs podcast.

JoseMonkey does this for fun — and also because of his advocacy for online privacy. When he felt like people weren’t taking his concerns about the information they were unknowingly sharing seriously, he took to TikTok for a different approach.

By walking his viewers “through the process of how I could look at a seemingly mundane video that doesn’t show very much” and nonetheless deduce the exact location it was taken, “I thought that might be something that people would think was both interesting, but maybe slightly unsettling,” JoseMonkey said. “And then, they would pay attention to this idea of internet safety.”

@the_josemonkey This one was tricky 😅 #geolocation #OSINT @mastrosmom ♬ original sound – josemonkey

Oversharing online is so common that most people don’t think twice about it. Think of the most popular posts online: “Get ready with me,” apartment tours, “Come with me.” Videos like these can, even unwittingly, contain a huge amount of personal geographic information — details which could make them vulnerable to scams or even attacks.

“The important takeaway here is that a sufficiently motivated individual who has an attention to detail and time to spend … can find you from a video,” JoseMonkey explained. “I don’t wanna scare people by saying that, but people should know it is possible.”

KQED’s Close All Tabs spoke to JoseMonkey and other experts on how you can start the new year with privacy in mind by adjusting some of your digital habits — without overwhelming you too much.

Jump to: 

• What should I think about when I post?
• What are the first steps I can take toward digital hygiene?

How much danger might my personal privacy be in?

You don’t need to guard yourself against every threat that exists, explained Eva Galperin, the director of cybersecurity at the Electronic Frontier Foundation.

The only way to really do that is to “live as a hermit on a mountain and fling all of your devices into the sea,” she said.

Instead, Galperin said, it’s more helpful to think about what advocates like her call “threat modeling”: What you want to protect and who you want to protect it from.

Some of the common threat models you might consider:

Being scammed online by ransomware …

For most people, their threat is scammers looking for money, access to their accounts or access to people who trust them.

“One of the big problems that we have right now is that we are in a golden age of grift,” Galperin explained. And if you have a phone, email address or any way of being reached, you are “constantly getting messages from scammers and criminals.”

“A lot of us feel very smart because every day we get targeted with, like, six of these things and we don’t fall for it,” she said. “But what’s really important to understand is that all a scammer needs is for you to have one bad day.”

A common method is ransomware, in which a scammer tricks you into downloading software that locks up your devices and holds them hostage until you pay a ransom — or in some cases, uses such software to spy on you.

… or a phishing attempt

Phishing entails a bad actor pretending to be someone you trust — a bank, a friend, a family member — and luring you into clicking on a link, or logging into a fake website to obtain information.

You may be able to tell you are being phished by viewing the message closely and noticing inconsistencies, like the email address being slightly wrong.

“A sort of indicator of a scam is a sense of urgency,” Galperin said. “‘Something is on fire,’ ‘an emergency is happening’ or ‘you could get rich if you click here in the next five minutes.’”

“That sense of urgency is aimed at overriding your common sense,” she warned.

Being tracked as someone seeking an abortion

Experts worry about the digital safety of people seeking reproductive care across state borders following the overturning of Roe v. Wade.

Abortion advocates have taken major steps to educate people in states that severely restrict abortion on how to cover their tracks in pursuing the procedure elsewhere, including turning off their location. (Read The Markup’s thorough guide on protecting your privacy if you are seeking an abortion.)

When communicating about abortion, a major way that patients and providers can protect their messages is to use an encrypted app, like Signal.

In this case, end-to-end encryption means that your telecommunications company and the messaging platform can’t read your messages.

Being threatened as a survivor of domestic abuse

Creating a threat model for scenarios like domestic abuse is harder, often because an abuser can gain physical access to a person’s possessions, like their phone.

When talking to survivors of domestic abuse who are attempting to leave an abuser, Galperin said the first thing she suggests is creating a new account — or a device — where they know their communications will be safe and private.

How can my posts and videos reveal too much about my location?

Always review what you are posting before you post it, JoseMonkey said — even though “many people” never take this step.

“They record something, and they just press send,” he said. And a person may not even realize “that there was some big thing that they forgot that they didn’t want to include,” he warns, until the post is out there.

This could, for example, be a visible street sign behind you, which can be easily remedied by cropping it out or covering it with text or a sticker — or just rerecording the video to keep it out.

A more subtle aspect people may not think about? “The more you move the camera, the more information you’re going to show,” JoseMonkey said.

“If you’re out for a walk somewhere, people can see everything around you,” he added.

Many people record videos in their car, but “people underestimate how much you can see through the windows of your car,” JoseMonkey warned. And if the car’s mirrors or its GPS are visible, that’s more information being shared.

Be mindful of your posting history — “you may not remember that three years ago, you posted something that’s still there on your account that revealed some other bit of information,” he said.

And this could be spread across several platforms. You tweeted something on one account, you posted a picture on another, have your LinkedIn on another, and a larger picture about you is created.

“Now people have all these bits and pieces of information about you,” JoseMonkey said — and you’ve potentially made it far easier for someone to find you.”

OK, I’m convinced. What should my first steps to improve my digital safety be?

While the world of surveillance and privacy can be incredibly overwhelming (and scary), it shouldn’t completely discourage you from adopting good practices that are attainable for anyone with a phone or computer.

Consider the following checklist a form of basic digital hygiene — like washing your hands — that can help make you safer from the “kinds of threats that most people face every day,” Galperin explained.

Strengthen — and manage — your passwords — and get a password manager

To secure your accounts, Galperin said, you should make sure:

• All of your passwords are different from one another
• The passwords are long
• Use a password manager like Bitwarden or ProtonPass, a secure application that manages, stores and even creates passkeys to different websites (you may need to pay for this service, although free password managers are available too)

“Your password manager will be unlocked with a single password,” Galperin said. “That single password again should be long and strong, and easy for you to memorize.”

To make this single password easier to manage, Galperin recommends using a pass phrase instead: “Like five or six words, chosen at random.”

In choosing a password manager, Galperin said that you should search the name of the application and “security incident” — to make sure the password manager you’re considering doesn’t have a history of being broken into. For example, LastPass — once one of the more popular password managers — has faced controversy for a 2022 breach that still sees theft today.

“If it has a history of being untrustworthy, don’t touch it,” she said. But “if you don’t find a bunch of security incidents, it’s probably OK or good enough.”

Ultimately, though, the best password manager is the “one you actually use,” and that fits your daily life, Galperin said.

“If you spend a bunch of time getting a top-of-the-line password manager and then you only put two passwords in it, then you haven’t really done yourself a lot of good,” she said.

Install two-factor authentication

Two-factor authentication, or 2FA — also called multi-factor authentication or MFA — adds another layer of protection to your account beyond just your password. Many websites and applications encourage you to activate 2FA on your profiles, like Instagram, Discord and Gmail.

How it looks for most users: you enter your password, and then the website will send a unique code to you through SMS (a text) or to your email account, which you then enter back into the website. After that, you will have access to your account.

But Galperin points out that contrary to what you might assume, getting a code through SMS is actually “the least secure way” of protecting your account — because “SMS messages are not encrypted,” and it’s “possible to intercept them.”

While SMS is better than nothing in most cases, Galperin recommended instead using an authenticator app, which syncs to your account and receives your code. Examples of these kinds of apps include Duo Mobile and Google Authenticator.

Another layer of security could be getting a physical key: a keychain-sized flash drive that you can insert into your devices, allowing you to log in. But keep in mind, “if you break your physical key and you don’t have a backup key somewhere, you can end up locked out of your account,” Galperin said.

She also doesn’t recommend using a physical key to survivors of domestic abuse, or anyone in “a situation in which you need to secure your account against somebody who has physical access to you.”

Pull your data from the brokers selling it

Data brokers collect your information and sell it through all sorts of means, including scraping from public records. These brokers can also grab personal information from tracking cookies, which can trace your browsing history and social media interactions.

You can mitigate the latter by installing an extension like Privacy Badger on your web browser, Galperin said. Privacy Badger’s website states that it stops advertisers and other third-party trackers from “secretly tracking where you go and what pages you look at on the web.”

Californians can also now fill out a request to the state to opt out of data brokers, stopping them from storing and selling personal information. Keep in mind, these requests will only start being processed by data brokers in August.

More digital safety resources

• Electronic Frontier Foundation’s Surveillance Self-Defense
• Tools from the Electronic Frontier Foundation
• Privacy Guides (Español)
• Cornell University’s Clinic to End Tech Abuse
• The Markup
• Zebra Crossing (繁體中文)
• Digital First Aid Kit (Español)
• The Games and Online Harassment Hotline
• Privacy International
• Digital Defense Fund (aimed at people seeking reproductive care)
• Asian Americans Advancing Justice (aimed at people seeking reproductive care) (languages include 简体中文, Tagalog, ภาษาไทย, Tiếng Việt, বাংলা, ខ្មែរ, 한국어.)
• Mask On Zone (aimed at people going to protests)
• Digital Security Checklists for Activists (aimed at people going to protests and organizers)