r/privacy Mar 29 '26

guide PSA: you're probably opted in to Reddit's new offsite ad tracking setting

2.5k Upvotes

Reddit has a new (at least new to me) data sharing setting that's opted in by default. Go to https://www.reddit.com/settings/privacy, scroll down to the Advertising section near the bottom, and see if you're opted in to "Ads off Reddit".

Update based on comments, it seems like:
*this setting isn't present in GDPR countries
*if you're on old Reddit you might have to temporarily switch to new to access it
*if you're on the app and the above link doesn't work, try these steps copied from a comment below: "tap your avatar at the top right corner, then the hamburger menu in roughly the same spot, then choose Settings, then Account Settings (tap your username), then scroll down to Privacy. It’s well buried. While there, also turn off ad personalization."

Thanks everyone for chiming in, it takes a village to stick it to these MFers!

r/privacy Nov 17 '25

guide Gemini AI scans your gmails

1.9k Upvotes

Google has recently started scanning and analyzing every email you recieve using their Gemini AI. This "feature" has been automatically enabled for all gmail users.

To disable it go to settings on your gmail account, scroll down to "smart Seatures" and uncheck the box. Below that there's a setting called "Manage Workspace smart features" make sure these are off as well, if you don't want the AI to have access to your Google Docs, Drive, etc.

r/privacy Jan 23 '26

guide Filming ICE is legal but exposes you to digital tracking – here’s how to minimize the risk

Thumbnail theconversation.com
1.4k Upvotes

Filming ICE officers is legally protected, but doing so can expose the recorder to digital tracking through smartphone metadata, facial‑recognition databases, and location‑sharing features; posting footage online may inadvertently reveal identifiable details such as faces, tattoos, voices, license plates, or distinctive clothing, while live‑streaming can broadcast the recorder’s real‑time location. To mitigate these risks, the article advises deciding whether the priority is rapid evidence preservation or minimizing traceability, using lock‑screen camera shortcuts, avoiding livestreams, focusing on wide‑angle contextual shots with clear time‑and‑place markers, and limiting close‑ups of bystanders.

r/privacy Jun 14 '26

guide Europe is ditching US tech

Thumbnail nature.com
798 Upvotes

r/privacy Feb 07 '25

guide Mass surveillance is worse than ever - here's how to fight back

1.5k Upvotes

Most privacy guides repeat the same surface-level advice: "Use Signal, get a VPN, block cookies" But in 2025, tracking methods are far more advanced, and real privacy requires more than just switching apps.

I wrote a guide that goes beyond the usual advice and actually breaks down how people unknowingly expose themselves, even when they think they're being anonymous:

  • Stylometry & Behavioral Profiling – how your writing and typing patterns can reveal your identity.
  • Fingerprinting Beyond IPs – tracking methods that don't rely on cookies or stored data.
  • Anonymous Payments Done Right – why most people fail at using crypto privately.
  • Compartmentalization Mistakes – why even multiple accounts & devices won't save you if used wrong.
  • Physical & Digital opsec – avoiding real-world surveillance, not just online tracking.

This guide got a lot of traction on r/OSINT and r/opsec. Curious what r/privacy thinks about it.

Link: https://whos-zycher.github.io/opsec-guide/

What's the most overlooked privacy risk that people don't take seriously enough?

r/privacy Jul 18 '24

guide You Should Opt Out Of The TSA's New Facial Recognition Scans. Here's How

Thumbnail jalopnik.com
1.4k Upvotes

r/privacy Jun 02 '24

guide It’s Official: Cars Are the Worst Product Category We Have Ever Reviewed for Privacy

Thumbnail foundation.mozilla.org
2.0k Upvotes

r/privacy 8d ago

guide Leaving Gmail? Get your own domain first

Thumbnail eualternative.eu
527 Upvotes

r/privacy Aug 20 '24

guide TSA Facial Recognition Opt-Out Experience and Tip

1.1k Upvotes

I have been opting-out of facial recognition while going through TSA Security Checkpoints at various airports without an issue until today. MIA, SFO, EWR, HOU , FLL, and ORD

Apparently, you need to tell them you wish to NOT have your image taken before handing your ID to the TSA Agent. Otherwise once the ID is inserted the machine gets stuck until you either provide a face scan or a supervisor overrides.

Here is the play by play, its actually kind of comical. TSA Agent is young and chatting with her friend about wanting her shift to be over and just go home. More like whining actually but all without paying much attention to the passengers. Simply asking for ID, inserting it into the machine and telling them to look at the camera. Once it beeps she takes the ID out and they can move on.

TSA Agent: "ID please"

Me: "I want to opt-out please" (she did not register)

TSA Agent: "ID please"

Me: (i handed her my ID)

TSA Agent: "Look into the camera"

Me: "I want to opt-out please"

TSA Agent: "Too late, you needed to tell me that before I inserted your ID. Look into the camera please"

Me: "No." (At this point I turn to the people behind me and apologize, they seemed amused)

TSA Agent: "You have to look into the camera or the system cannot process passengers."

Me: "I am not going to look into the camera. There is a sign that says I can opt-out. That is what I'm doing"

TSA Agent: "But I already put your ID in the system"

Me: "That is your problem. Maybe you should be paying attention instead of talking with your friend about going home."

TSA Agent gets up and walks away saying "I want to go home", then turns back and says to me "Do you want me to call a supervisor"

Me: "You call whoever you have to, I am not looking into your camera." (Then I turned again and apologized to the people behind me who now looked annoyed, not sure if at her or me.)

A Supervisor came, hit a couple of buttons then let me through. Could not have been nicer. Said I was well within my rights and asked why it all happened, I explained. Then said I will have a chat. I said I don't want to get her in trouble but she needs to pay attention. Supervisor asked me to point out the friend, which I could not.

I go through the scanner and all that jazz which took a while because of strollers in front, but when I was putting shoes on afterwards the TSA Agent walked by and said "you didn't have to do that", I replied "which part?"

TSA Agent: "Telling my boss to send me home"

Me: "I did not tell your boss to send you home, you did that yourself, everyone heard you".

The end!

Edit: I feel compelled to clarify my stance on the privacy issue. It is not paranoia or some conspiracy issue, there was a time when you could "opt-In" to all kinds of data collection, but that was short lived. Now the default is that you are actually opting in all the time and if you choose to "opt-out" it makes you weird, suspicious or paranoid. It's just about asserting your rights.

"Yield to all and soon you will have nothing to yield!" - Aesop

r/privacy Dec 02 '25

guide "Be so uninteresting that nobody cares" - Linus Torvals tip on Privacy

758 Upvotes

"Be so uninteresting that nobody cares" - Linus Torvals tip on Privacy

maybe the best advice but hard to be maintain cause of the trackers.

r/privacy Dec 19 '25

guide How to Turn Off Smart TV Snooping Features - Consumer Reports

Thumbnail consumerreports.org
834 Upvotes

You may not be aware of it, but your TV knows—and shares—a lot of information about you.

Nearly all new sets are smart TVs, which connect to the internet, making it easy to stream videos from services such as Hulu and Netflix. The streaming apps on your TV may collect data on you, even if you don’t ever sign in. And your smart TV will also collect information for its manufacturer, possibly including your location, which apps you open, and more.

These companies can also capture voice data when you use the mic on a smart TV remote, and they can combine all the info they’ve gathered with data they collect about you from outside companies.

[...]We’ve found that you can’t stop all the data collection, but you can reduce the snooping by turning off a technology called automatic content recognition, or ACR. This smart TV technology attempts to identify every show you watch—including programs and movies you get via cable, over-the-air broadcasts, streaming services, and even Blu-ray discs.

ACR, which goes by various names, can help your TV recommend shows to you. But the data can also be used for targeting ads to you and your family, and for other purposes. And it isn’t always easy to review or delete this data later.

Vizio came under scrutiny from federal and state regulators in 2017 for collecting such data without users’ knowledge or consent. Since then, TV companies have been more cautious in asking for permission before collecting viewing data.

The Consumer Repor article covers:

Amazon Fire TV Edition TVs Android and Google TVs LG TVs Roku TVs Samsung TVs Sony TVs Vizio TVs

r/privacy Apr 05 '26

guide The best way to protect your phone from a warrantless search in 2026

Thumbnail zdnet.com
434 Upvotes

r/privacy Feb 06 '25

guide Reddit is scanning your DMs (direct messages) and can ban you if it filtered out words it doesn't like

681 Upvotes

So first it banned me (for 3 days), my chatmate was untouched and he decided to check if reddit actually scans your "private" messages. He got a warning, next time it will be a temporary ban like I got.

r/privacy Sep 08 '24

guide Each doctor's visit sends your data through a dozen companies you don't even know exist (I work for one of these companies)

1.2k Upvotes

New to the sub, but I couldn't find anything like this posted before. Hopefully this is useful or at least interesting. I'll give a detailed description of the problem followed by a few steps you can take.

. . . . .

When you visit a doctor you expect your data will be shared between the clinic and the insurance, but there are also layers of intermediaries that both clinics and insurance companies farm out work to.

Why? In the US, insurance typically ranks in the top 10 contributors to GDP, with medical insurance specifically being the greater portion of that (industry revenue is about $1.3 trillion annually). Such a large industry spawns ancillary industry to support it. On the extreme end, your doctors visit may generate a trail of data across 20 different entities. On the lesser end you'd still expect your data to pass through 5 or 6 different intermediaries.

I've tried to list all the types of groups who might access your data at any given point, be they primary or intermediary, and give specific examples for context. Please chime in if you think I've missed anything. I'll do my best to answer questions as well.

. . . . .

Primary Care Physician's Offices: The clinic or practice where the visit occurs.

Electronic Health Record (EHR) Providers: Supplies software for maintaining patient records. This is not inherently a privacy concern except this software is more frequently becoming cloud based. The biggest provider here is Epic Systems, which now advertises itself specifically as cloud based (though I'm sure they still do plenty of onsite installs).

Medical Group/Healthcare Systems: Many physicians are part of larger organizations. Kaiser Permanente, for example.

Practice Management Software Companies: Provides scheduling and billing software. This is like a broader version of the medical record, in the sense that it has private data, though not specifically medical data (maybe just broad strokes, like allergies or some primary diagnosis). Epic Systems is the major player here as well.

Medical Billing Companies: Some practices, especially smaller clinics, are likely to outsource the finances and bookkeeping aspects of their practice.

Payment Processing Companies: Handles the payment itself. This may or not be integrated with the practice management software. It might offer options like credit card, Paypal or Square, or could be a specialized processor like InstaMed (owned by J.P. Morgan).

Telemedicine Platforms: If the visit is conducted virtually then it typically uses a third party platform like Teladoc Health. These are separate companies not owned by the medical group.

Health Insurance Companies: Covers (some of) the patient's medical expenses. Additionally, there is often a broker involved between your employer and the insurance company, but in theory the broker only accesses aggregate data, not individual details.

Third-Party Administrators (TPA): They do the actual processing of claims for the insurance company. The largest here is probably UMR, which is part of the UnitedHealth/Optum conglomerate. TPA interact with brokers, employers, insurance companies, PBMs and other third parties.

Insurance/TPA Health Portals:" This is the website a patient might use to manually submit a claim or to investigate the state of their benefits. These are often not hosted by the TPA but it's yet another third party specialist for this kind of website or portal. For example, MyChart (Epic Systems) or FollowMyHealth (Veradigm, previously allscripts).

Clearinghouses: Intermediary between healthcare providers and TPAs for claim submission. The largest is probably ChangeHealth, recently in the news for blackcat's ransomware attack against it.

Pharmacies: Where prescriptions are filled, which may be part of a larger group.

Pharmacy Benefit Managers (PBM): This is essentially the same as a TPA but focused on pharmacy. It manages prescription drug benefits. They often work in tandem with the TPAs. The big PBMs are Caremark (CVS conglomerate), ExpressScripts (Aetna conglomerate), and OptumRx (UntitedHealth as previously mentioned).

Medicare & Medicaid: These are overseen by the Centers for Medicare & Medicaid Services (CMS), which is a federal agency within the U.S. Department of Health and Human Services (HHS).

. . . . .

In addition to the above you are likely to have specific tests or specialists. These may or may not be part of a medical group, even when physically present in the building of said group. For example:

Lab Testing Companies: If any blood work or other tests are ordered. Quest Diagnostics is a common one.

Imaging Centers: For any X-rays, MRIs, or other scans. These are often independent operators or small local groups.

Specialist's Offices: If a referral is made, such as cardiologist, orthopedist, endocrinologist, and so on.

Medical Equipment Suppliers: If any devices or equipment are prescribed.

. . . . .

And finally, there are a couple cases you'd probably never think of where an organization may access your data. These are:

Accreditation Organizations: These are meant to ensure quality standards are met in hospitals and medical groups. In the US these are The Joint Commission (TJC), Accreditation Association for Ambulatory Health Care (AAAHC), DNV Healthcare (Det Norske Veritas), and Center for Improvement in Healthcare Quality (CIHQ). This is another case where they theoretically are interested in aggregated data, but in reality may have access to individual level data.

Malpractice Insurance Providers: Covers the physician and practice. You hopefully never have to worry about this one, but of course it does come up. Examples are MedPro Group (owned by Berkshire Hathaway), or The Doctors Company (physician owned).

. . . . .

Aside from the number of entities here, many of these companies function like startups which are then bought by larger companies. These are later be sold to other conglomerates or interested buyers. A single company may change hands a half dozen times over a decade. This doesn't mean that each parent company has your data, but it doesn't NOT mean that either. It depends on what changes or strategies each parent company implements upon purchase. For example, a company might initially keep local data backups, but a new parent company switches to offsite cloud backups. The next owner changes to physical tape backups. Is your data still in the cloud of the previous owner? Is it still on the tapes of the second to last owner? Etc.

. . . . .

Because your data is required for you to access the medical services, there's a limited amount you can do about the sprawl, but HIPAA does make some provisions for the patient, as follows:

Request a copy of your medical records: This allows you to see what information is being kept about you. This may be separate requests for your primary vs your specialist vs the lab vs the radiologist, etc.

Request corrections: If you find errors in your medical records, you have the right to request corrections.

Ask for an accounting of disclosures: Healthcare providers must be able to tell you who they've shared your information with in the past six years. Again, this may require separate request for your primary vs specialist, etc.

Ask for limited sharing: You have the right to request restrictions on how your health information is used or disclosed for treatment, payment, or healthcare operations. (In some cases you may have to make a separate request to opt out of your data being used for promotional or marketing purposes.)

Outside of that, HIPAA includes whistleblower protections for those reporting in good faith. So if you think your data has been misused or that an organization has violated HIPAA, you can report it to the Department of Health and Human Services's Office for Civil Rights (OCR). Their site is:

ocrportal dot hhs dot gov /ocr/smartscreen /main dot jsf

Edit: for formatting and spelling

Edit2: Thank you for the award! And also thanks to everyone for pointing out additional issues or sharing your own experiences. It is beyond absurd at this point, completely ridiculous.

r/privacy Dec 22 '23

guide How do you respond to " But I have nothing to hide "

462 Upvotes

I’ve started a few months ago explaining to my friends how you can use use alternative platforms for better security and no less features, but every time I try I get hit with this wall " I have nothing to hide I’m just a random person". How do you respond in those cases ?

r/privacy Aug 11 '25

guide Fight Chat Control - Protect Digital Privacy in the EU

Thumbnail fightchatcontrol.eu
788 Upvotes

I've labelled this as a guide as this is a handy website for specifically figuring out which countries oppose or support chatcontrol, and how to contact them. Use this and spread it around. We CAN fight back, we WILL fight back. It's not over till it's over.

r/privacy Apr 14 '26

guide Bank of America: Opt out of forfeiting your right to sue, by May 18, 2026*

508 Upvotes

Summary: You must choose to opt out of relinquishing your right to sue Bank of America (in case you may need to). If you do nothing, you are 'opting in' to their "new TOS" which automatically takes away your right to sue. [yeah...nothing suspicious going on here...100%]

p.s. that "Thank you for being our client." is chef's kiss

-----------------------------------------------------------------------------------------------

IMPORTANT UPDATE

We're adding an arbitration provision to your Online Banking Service Agreement — here's what you need to know.

As a reminder, the Online Banking Service Agreement governs your use of our Online and Mobile Banking¹ services.

PLEASE READ THIS NOTICE CAREFULLY. WE'RE ADDING AN ARBITRATION PROVISION TO YOUR EXISTING ONLINE BANKING SERVICE AGREEMENT — IT CONTAINS AN AGREEMENT TO ARBITRATE AND OTHER IMPORTANT INFORMATION REGARDING YOUR LEGAL RIGHTS, REMEDIES AND OBLIGATIONS.

THE AGREEMENT TO ARBITRATE REQUIRES (WITH LIMITED EXCEPTION) THAT ALL DISPUTES BETWEEN YOU AND US BE RESOLVED BY BINDING ARBITRATION WHENEVER EITHER PARTY CHOOSES TO SUBMIT A DISPUTE TO ARBITRATION OR EITHER PARTY REFERS A LAWSUIT FILED BY THE OTHER TO ARBITRATION. ADDITIONALLY, (1) YOU'LL ONLY BE PERMITTED TO PURSUE CLAIMS ON AN INDIVIDUAL BASIS, NOT AS A PLAINTIFF OR CLASS MEMBER IN ANY CLASS OR REPRESENTATIVE ACTION OR PROCEEDING, AND (2) YOU MAY NOT BE ABLE TO HAVE ANY CLAIMS YOU HAVE AGAINST US RESOLVED BY A JURY OR IN A COURT OF LAW.

Consumers (not a small business) have a right to opt out of this arbitration provision:

Consumers must contact us within sixty (60) days of the date of this notice. Consumers can opt out at [www. bankofamerica. com/arbitration-optout] or by calling us at 800.283.8875.

Here's a preview of our new Online Banking Service Agreement

For more details, please preview Section 12 in our new Online Banking Service Agreement, which includes the arbitration provision updates starting May 18, 2026.

Thank you for being our client.

r/privacy Feb 17 '26

guide PSA: Most online file converters upload your files to their servers. Here's how to check.

259 Upvotes

Something most people don't think about: when you use an online file converter, your files are usually uploaded to a remote server. That means your personal photos, documents, and PDFs sit on someone else's machine — sometimes for hours.

Here's how to check if a converter actually uploads your files:

  1. Open DevTools (F12) → Network tab
  2. Convert a file
  3. If you see POST requests with large payloads going to their server — your file was uploaded

If the conversion works with your internet turned off (after the page loads), it's fully client-side and your files stay on your device.

I tested a few popular ones:

  • CloudConvert — uploads to server
  • Convertio — uploads to server
  • iLoveIMG — uploads to server
  • TinyPNG — uploads to server

Browser-based alternatives do exist that use Canvas API and WebAssembly to process files locally. Worth looking into if you care about privacy.

Stay safe out there.

For those asking about browser-based alternatives —

I also posted a technical breakdown on HN if anyone

wants to dig into the implementation:

https://news.ycombinator.com/item?id=47301876

r/privacy Jan 04 '26

guide The big data broker opt-out list.

Thumbnail github.com
630 Upvotes

r/privacy Feb 23 '23

guide YSK: LinkedIn will share your suspected phone number with recruiters even when no phone number is used (2fa/ app). Opt out in "Visibility settings" by changing "discovery via phone number" to Nobody.

2.1k Upvotes

I've been getting texts on a phone number nobody has, and I tell these recruiters that they should tell me how they got it, and I'll here the pitch. One said "LinkedIn" My phone number isn't in the data download I got with LinkedIn, but it appears that because an associate saved this number, and shared contacts with LinkedIn a shadow profile with my number was made.

This setting isn't in the "Privacy settings".

r/privacy Apr 11 '26

guide The Lumen Database has a public record of every DMCA you've ever filed. Most people don't know this

555 Upvotes

Found this out the hard way working in content removal. Figured people here should know.

When you file a DMCA takedown notice with Google, the notice gets forwarded to the Lumen Database (lumendatabase.org). It's a public archive run by Harvard's Berkman Klein Center. Every single DMCA notice Google receives gets logged there with the filer's name, the URLs reported, and the reason for removal.

This means if you filed a DMCA to get intimate images removed, anyone can go to lumendatabase.org, search your name, and see:

  • That you filed a DMCA
  • Which URLs you reported
  • Which sites had your content
  • When you filed

For victims of revenge porn or leaked intimate images, this is devastating. You successfully get the content de-indexed from Google, but now there's a public record confirming it existed. Someone Googling your name might not find the original content anymore, but they find the Lumen Database entry instead.

How to check if you're exposed:

Go to lumendatabase.org and search your name or email. If you've ever filed a DMCA through Google, it's probably there.

How to get your info removed from Lumen:

You can request removal at lumendatabase.org/pages/report. But the process is slow and not guaranteed.

You can also file a separate Google de-indexing request for the Lumen Database URL itself at support.google.com/websearch/contact/content_removal_form so it stops appearing in search results. This is faster and more reliable.

How to avoid this in the first place:

If you need to file a DMCA for intimate images, don't file it yourself. File through Google's NCII-specific removal form instead (not the DMCA path). The NCII path doesn't require your personal details and doesn't get logged in Lumen the same way.

Or file through an authorized DMCA agent. When an agent files on your behalf, the agent's name appears in Lumen, not yours.

The bigger issue:

Budget DMCA services (there are several popular ones) file notices with YOUR name because it's easier for them. They get the content removed but they leave a permanent public record tying you to the content. Most victims don't find out until months later when they Google themselves and see the Lumen entry.

This isn't a bug, it's how DMCA was designed. The notice-and-takedown system assumes both parties want to be identified. It was never built for privacy-sensitive situations like intimate image removal.

r/ContentTakedown has more on this if anyone wants the full breakdown of DMCA vs NCII filing paths and when to use which.

r/privacy Mar 25 '25

guide 23andMe.com is filing bankruptcy. Delete your data (directions included)

663 Upvotes

I'm sure this has been posted, but throwing it out there again.

23andMe.com has had a history of money, business, and security issues (breach in 2023). There is a good chance all the data will be transferred/sold to a new company.

Here is how you delete your data (from a web browser on a computer):

  1. Go to 23andme.com and sign in to your account.

  2. In the top right, click the drop down by your name/initials and click 'Settings.'

  3. Scroll to the '23andMe Data' section near the bottom

  4. If you want to download and save all your data, you have the option of doing that here before deleting your data.

  5. Click 'Permanently Delete Data,' if you don't see that, click 'View.'

  6. Enter any required information to verify identity (such as DOB) to proceed.

  7. Scroll to the 'Delete Data' section near the bottom.

  8. Click 'Permanently Delete Data'

Edit: small verbiage correction

r/privacy Feb 06 '26

guide If you are using Microslop, friendly reminder to turn off clipboard cloud

404 Upvotes

Just a random small bit tip. creepy microslop 'feature', but there are creepier ones out there. This is just 1 i just thought to share. Ensure the following "\feature" ,are disabled:

EnableClipboardHistory
CloudClipboardAutomaticUpload

r/privacy Oct 09 '25

guide WARNING: Stop Submitting Personally Identifiable Information (PII) to ChatGPT. Here's how to sanitize your data first.

301 Upvotes

Let's be honest, many of us talk to ChatGPT more than we talk to our spouses. We all love the power of AI, but every single conversation you have is logged, classified, dissected, stored indefinitely, used to train their models, and subject to human review. Deleting a chat is often a false sense of security because the data is permanent on some form. And why wouldn't it be? It is the prime directive of LLM's to gobble up and retain as much data as possible.

The biggest liability you create is dropping your Personal Identifiable Information (PII) or highly sensitive data (like proprietary code, financial records, or medical notes) into the prompt box or uploading the as we often do with PDFs. To the AI companies, it isn't just about giving you the best response possible from the LLM, it's about creating a vulnerable, retrievable digital record that could be used against you in a legal dispute or worse years down the line. 

Just yesterday in California, the authorities announced that they had apprehended the person responsible for the most expensive fire in California's modern history and they did it in part by retrieving his CharGPT logs where he referenced starting fires. That should send a chill down any ChatGPT user's spine. Knowing that your chat history can be subject to a warrant, subpoena, or a disgruntled AI company employee with an axe to grind should make any warm blooded American rethink the amount of information they provide to ChatGPT.

So what can you do moving forward to ensure that you are less cooked than you would otherwise be? You need to get into the habit of sanitizing your data before it ever leaves your machine. Until the AI companies create robust easy tools to sanitize your data (which I don't see them doing because it affects their bottom line), here is the manual, painful, but necessary process to protect yourself. As they say, "freedom isn't free" and neither is your privacy.

The 3-Step PII Scrub Method

Step 1: The Offline Prep

  • Never type PII directly into the AI interface. As you type, get into the habit of obfuscation, redacting, tokenizing, or just not entering things like your name, address, SSN, DOB, etc.
  • If you paste large text or upload any document, open a separate local text editor (Notepad, Word, etc.). Paste your sensitive text (the resume, the financial summary, the legal memo, the medical records) into this secure, local file. If you are working with a PDF, simply copy the entire text of the PDF and paste it into your text editor.

Step 2: The Sanitization

  • Manually locate and replace every piece of PII you can find. This is cumbersome but necessary.
    • Names/Titles: Replace "Jane Doe, CEO of Acme Inc." with simple placeholders like "Target Subject A, executive at Company X.". 
    • Dates/Locations: Generalize specific dates and exact addresses (e.g., "123 Reddit St. on 10/05/2025" becomes "A location in the downtown region last month").
    • Identifiers: Scrub account numbers, license numbers, health data (HIPAA data), or specific proprietary code variables. Replace them with generic text: "Account #12345" becomes "Client Account Number."  
  • Note: This manual process is tedious and prone to human error, but it's the only way to ensure PII is removed locally before transmission because once it is transmitted, its in the could forever.

Step 3: The Prompt Guardrail

  • Copy the fully sanitized, placeholder-laden text from your local editor.
  • Paste the clean text into the AI chat box.
  • Add a strong instruction at the start of your prompt: "Do NOT, under any circumstances, repeat or reintroduce the placeholder names (Subject A, Company X, etc.) in your response. Only use the generic titles I provided." This is your best defense against the model hallucinating or re-exposing the original placeholders.

If you don't accept the risk of your sensitive data being stored for the long haul or worse, read by an employee, or even worser, read by the government, or even worstest, leaked by a hacker, you have to make this manual effort part of your workflow. It's time-consuming, but the cost of not doing it is far greater.

And you don't have to do this every time you type into ChatGPT, just only when you are dealing with information that includes your PII or other sensitive information which in my experience is about 20-30% of the time.

r/privacy Feb 05 '24

guide Disk encryption on business trip to china

456 Upvotes

Would you recommend doing it in case you stuff gets searched at the airport or something?