A practical guide
What can you do about it?
You cannot personally reverse every bad product decision. You can make the record clearer, make leaving easier and keep more of your life outside a company’s permission system.
Before you buy
- Check whether the core feature works offline or locally.
- Find the cancellation, renewal and price-change terms.
- Ask what happens to your files, purchases and hardware if you leave.
- Prefer formats, services and devices that let you export or repair.
When the deal changes
- Save the original offer, current terms, receipts and relevant emails.
- Take dated screenshots of changed features, prices or cancellation flows.
- Write to the company with the outcome you want: repair, refund, cancellation or an explanation.
- Keep the reply. A pattern is easier to prove than a memory.
Keep what you own
- Consider a local copy or local-first tool before taking on a server. Self-host only if you can maintain updates, backups and recovery.
- Use local-first tools, including Home Assistant, so a vendor app is not the only way to run your own home.
- Keep your photos, documents, media and exports on physical storage you control—and test that you can restore them.
- Start with storage you already have and test a restore. Consider a NAS only if shared access or capacity justifies the cost and maintenance; buying more hardware is not the first step.
- Buy or borrow physical books, discs and games where that is the version you need to keep.
- Preserve games you care about: emulation can keep older work playable when consoles age, fail or become inaccessible.
You have a right to back up. If you paid for the hardware, the vendor should not remain its gatekeeper.
Ownership is not a badge on a checkout screen; it is the ability to keep using, copying, repairing and moving something without asking a company to let you. A business model that works against a buyer’s agency and best value is not ownership—it is control rented back to the customer. In the long run, the person preserving your ownership will usually be you.
Games are human work, not disposable generations of hardware. When a console fails, emulation can carry the games people grew up with to new machines, offer better accessibility and leave something for the people who come after. Preservation is the alternative to buying the latest box and throwing the old work away.
Use cloud on your terms
The cloud is useful. It is not your only copy.
- Read the service’s export, deletion and account-recovery terms before you depend on it.
- Check what happens if your account is locked, suspended, hacked or closed by mistake.
- Know where your files are stored, who can access them and whether settings can limit data use.
- Keep a local, readable copy of anything irreplaceable—then keep a second backup somewhere else.
- Review privacy and terms-of-use updates. A service can change the deal after your files are already inside.
Reduce avoidable tracking
Start with the layer you control.
You do not need a new phone or a home server to begin. Choose your device, pick one tool you can maintain, check that your usual sites still work, then add another layer only if it solves a real problem.
17 tools, easiest first
Built into iPhone
App Privacy Report
- Low effort
- Built in
See which apps used your location, camera, microphone, photos or contacts in the past seven days, and which web domains each app contacted. It is the quickest way to find an app that talks to more companies than its job needs.
Watch for: It shows activity; it does not block anything. Needs iOS 15.2 or later, and the report is kept only on the device.
How to set it up
- Open Settings › Privacy & Security › App Privacy Report and turn it on.
- Use your phone normally for a few days.
- Check Most Contacted Domains and each app’s Network Activity, then remove permissions or apps you do not need.
iPhone
Built into iPhone, via the App Store
A Safari content blocker
- Low effort
- Free, paid extras
iPhone Safari accepts content-blocking extensions from the App Store. Once allowed in Settings, a blocker hides ads and known trackers as pages load, and you can turn it off for a single website without changing anything else.
Watch for: Blockers only work inside Safari and apps that use it, not in other apps. Check the developer’s privacy policy: some blockers are free with paid extras.
How to set it up
- Install a content-blocking app from the App Store.
- Open Settings › Apps › Safari › Extensions, tap the blocker and turn on Allow Extension (and for each Safari profile you use).
- If a site breaks, tap the left side of Safari’s address bar, choose Manage Extensions and switch the blocker off for that site.
iPhone
Built into Android
Private DNS
- Low effort
- Built in
Enter the hostname of a filtering DNS provider and Android encrypts DNS lookups and applies that provider’s blocklists across apps, on Wi-Fi and mobile data. No extra app is needed.
Watch for: It protects DNS questions and answers only. Choose the provider carefully: every domain your phone looks up goes to it.
Android
Built into Windows 11
Windows privacy settings
- Low effort
- Built in
Windows has several advertising and personalisation settings, many chosen once during setup and then forgotten. Switching off the advertising ID, personalised offers, tailored experiences and optional diagnostic data takes a few minutes, and Microsoft says the device works normally sending only required data.
Watch for: Turning off the advertising ID does not reduce the number of ads; it limits how they are targeted. On a work computer these options may be managed by your organisation and greyed out.
How to set it up
- Open Start › Settings › Privacy & security › Recommendations & offers (called General on computers without the latest update).
- Turn off “Let apps show my personalized ads by using my advertising ID” and the language-list and personalised-offer settings you do not want.
- In Privacy & security › Diagnostics & feedback, choose Required diagnostic data only and turn off Tailored experiences.
- Use Delete diagnostic data on the same page to clear what has already been collected.
Windows
Microsoft: recommendations & offers →Microsoft: diagnostics & feedback →
Built into the browser
Firefox tracking protection
- Low effort
- Built in
- Open source
Firefox’s Enhanced Tracking Protection is on by default: it blocks known social-media trackers, cryptominers and fingerprinters, and Total Cookie Protection keeps each site’s cookies to that site. Strict mode also blocks tracking content in every window and all cross-site cookies.
Watch for: Strict mode can break some site features. Use the shield in the address bar to relax protection for that one site rather than switching back everywhere.
How to set it up
- On desktop, open Settings › Privacy & Security.
- Under Enhanced Tracking Protection, choose Strict.
- If a site misbehaves, click the shield icon in the address bar and turn protection off for that site only.
Browser · Android · iPhone
Mozilla: Enhanced Tracking Protection →What each mode blocks →
Browser extension
uBlock Origin
- Low effort
- Free
- Open source
Block many ads and trackers where pages load. Full uBlock Origin works best on Firefox, including Firefox for Android. In browsers using newer extension rules, check the separately maintained uBlock Origin Lite; it has different capabilities.
Watch for: A blocked script can break a checkout or login. Pause it for that site rather than removing it everywhere.
Browser
Browser extension
Privacy Badger
- Low effort
- Free
- Open source
Made by the Electronic Frontier Foundation. Instead of relying only on lists, it learns: a third party that appears to track you across several sites gets blocked. Available for Firefox, Chrome, Edge, Opera and Brave.
Watch for: It targets third-party tracking, not advertising in general, so it complements a list-based blocker rather than replacing one.
Browser
Any device or router
A filtering DNS provider
- Low effort
- Free, paid extras
A low-effort way to block known ad and tracker domains across apps. AdGuard offers a public filtering resolver; NextDNS offers configurable lists and logging choices. On a phone, this pairs well with Private DNS or the provider’s own profile.
Watch for: Read the provider’s privacy terms: your DNS requests go to the resolver you choose.
iPhone · Android · Mac · Windows · Linux · Home network
Application firewall
Portmaster
- Medium effort
- Free, paid extras
- Open source
Safing’s free, open-source firewall for Windows and Linux. See every connection each app makes, block ads and trackers system-wide at the DNS level, set per-app rules and use encrypted DNS. The free version is a complete firewall; paid Plus and Pro plans add network history, bandwidth views and Safing’s SPN routing network.
Watch for: Strict rules can break apps that need a connection. Start with the defaults and read the monitor before tightening anything.
How to set it up
- Install Portmaster from safing.io (Windows installer, or .deb/.rpm for Linux).
- Leave the default privacy filter on and use your computer normally for a day.
- Open the network monitor to see which apps connect where, then block the connections an app does not need.
- If something breaks, find the blocked connection for that app and allow just that domain.
Windows · Linux
Application firewall
Little Snitch
- Medium effort
- Paid, free demo
Objective Development’s network monitor and firewall for the Mac. It asks before an app connects, maps live traffic in its Network Monitor, encrypts DNS, and subscribes to blocklists that deny known tracking or malware hosts for every app at once. A one-off licence; the demo runs for three hours at a time and can be restarted.
Watch for: Little Snitch 6 needs macOS 14 Sonoma or later; older Macs need Little Snitch 5. A broad blocklist can catch something you use, so review false positives rather than disabling the whole list.
How to set it up
- Install it and approve its system extension in System Settings when macOS asks, then restart if prompted.
- Start in Silent Mode if the alerts feel overwhelming: connections are allowed and recorded, and you decide later.
- Add a blocklist: pick a curated list by topic, such as tracking, or add a list you trust by URL. Hosts files, domain lists and IP ranges all work.
- Watch the Network Monitor for a few days. If a site or app breaks, disable the single false-positive entry and keep the rest of the list.
Mac
Application firewall
LuLu
- Medium effort
- Free
- Open source
Objective-See’s free, open-source Mac firewall alerts you when an unknown app tries to connect out, and supports block and allow lists from a local file or URL, one host or IP address per line. Runs on macOS 10.15 or later.
Watch for: It watches outgoing traffic only. Hostname rules work only for apps that use Apple’s networking frameworks, so some browsers, such as Chrome, need IP-based rules.
Mac
Application firewall
OpenSnitch
- Medium effort
- Free
- Open source
A free, open-source Linux firewall inspired by Little Snitch. It asks before an application connects out, lets you set per-application rules and applies blocklists system-wide: hosts files, domain and IP lists, network ranges and regular expressions.
Watch for: Domain blocklists may not work on systems that use systemd-resolved, which many distributions do by default; the project’s wiki lists workarounds. Keep regular-expression lists small to avoid slowing connections.
How to set it up
- Install the .deb or .rpm package from the project’s releases page for your distribution.
- Answer the connection prompts as apps first go online, allowing only what each app needs.
- For blocklists, add a rule that points at a folder of list files; OpenSnitch reloads it when the files change.
Linux
Android app
Rethink DNS + Firewall
- Medium effort
- Free
- Open source
Inspect and limit which apps connect to the internet, with optional DNS blocklists on the phone.
Watch for: It uses Android’s VPN interface for local filtering, so check how it interacts with any VPN you already use before relying on both.
Android
Built into Samsung phones
Trim a Galaxy phone
- Low effort
- Built in
Uninstall optional apps, disable supported preloaded apps, and review Samsung account customisation and ad settings.
Watch for: Prefer built-in controls over bulk “debloat” scripts: removing system components can break updates, calls or features you need.
Android
Self-hosted DNS filter
Pi-hole
- High effort
- Free
- Open source
Run your own DNS filter for devices that use your home network, including some TVs and smart-home gear that cannot run a blocker themselves.
Watch for: It needs an always-on machine, updates and a fallback plan if DNS stops working. It will not follow a phone onto mobile data unless you set up remote access separately.
Home network
Self-hosted DNS filter
AdGuard Home
- High effort
- Free
- Open source
A free, open-source alternative to Pi-hole that runs on a Raspberry Pi, Linux or a Mac. It blocks ad and tracker domains for the whole network and adds parental controls, custom rules and an activity view.
Watch for: The same trade-offs as any home DNS server: something must stay on, stay updated and have a fallback.
Home network
If choosing a new phone
GrapheneOS
- High effort
- Free
- Open source
A privacy- and security-focused Android alternative for its listed supported Pixel devices—not a firmware option for a Samsung phone.
Watch for: Installation wipes the device, so verify support, app compatibility and backups first, then follow the official guide through bootloader relocking.
Android
DNS filtering blocks domains, not every ad or first-party tracker; apps can also use other resolvers. Encrypted DNS protects the DNS lookup in transit but does not make you anonymous. If a service breaks, review the relevant block rule rather than turning off all protection permanently.
The connection layer
What your ISP can usually see.
Your internet provider carries the connection, so it can link activity to the account, line or mobile service that pays for it. What it can inspect beyond that changes with the protocol, device settings, network design and the law where you live.
- Account and connection
- Subscriber details, assigned IP addresses, connection times, equipment and support or billing records.
- Traffic metadata
- The IP addresses your connection talks to, plus the timing, volume and direction of traffic. That pattern can still say a lot even when the content is encrypted.
- Names and destinations
- Traditional DNS exposes requested domain names to the DNS resolver. HTTPS protects page content, but destination information can remain visible unless the relevant DNS and TLS privacy features are enabled end to end.
What it usually cannot read
On a properly configured HTTPS connection, the content of the page, form or message is encrypted in transit. HTTPS does not make the connection anonymous, and a VPN moves visibility from the ISP to the VPN provider rather than making it disappear.
Practical baseline
Keep devices updated, use HTTPS, choose encrypted DNS only if you understand which resolver you are trusting, secure home Wi-Fi and check the privacy and retention terms of your own ISP. Do not treat Incognito mode as network privacy.
Technical background: TLS 1.3, DNS over HTTPS and Encrypted Client Hello specifications.
Report the pattern
Use the route that can act on it.
These bodies may not resolve an individual dispute, but reports can help them identify widespread harm. This is practical information, not legal advice; rights, copyright and licence rules vary by place and product.
Turn the problem into a clear request.
Keep one short chronology: what you bought, what was promised, what changed, when you contacted the company and what it said. Separate the outcome you want from your explanation of why the product is unfair.
A message you can adapt
I bought [product or plan] on [date]. The offer described [feature, price or cancellation term]. On [date], I found [specific change or charge]. I have attached [receipt, offer or confirmation]. Please [state the outcome you want] and confirm the next steps in writing. My reference number is [reference].
Use only the records needed to explain the issue. Redact unrelated transactions and other people’s details, and keep an unedited original for yourself. Record each reply rather than starting a new account of the problem every time you contact support.
The ACCC recommends contacting the business first and setting out the problem and requested outcome. Reporting a pattern to a regulator serves a different purpose from resolving your own complaint. ACCC: contacting a business →
If a subscription keeps charging
Save the cancellation request and confirmation, compare the charge date with the stated end date, and contact the company with those records. The FTC’s guide explains further steps for unwanted charges, including contacting the card issuer when a company will not stop charging. FTC: trials, renewals and subscriptions →
Have a document, screenshot or story that shows the change? Send a tip, or return to the case files.