| Most common tracking method | Third-party cookies |
| What a VPN hides | Your IP address and location from websites and your ISP |
| E2EE availability | Not universal — must be verified per app or service |
| Metadata example | Photo EXIF data: GPS coordinates, device model, timestamp |
| 2FA effectiveness | Blocks the vast majority of automated account-takeover attempts (Google Security Blog research) |
| Private browsing protects against | Locally stored history and cookies — not fingerprinting or your ISP |
Why This Vocabulary Matters
Privacy policies, app permission screens, and news headlines about data breaches all use a specific vocabulary — and if those words feel foreign, it's hard to make confident decisions about your own data. You don't need to become a security expert. You just need enough fluency to recognise what's happening and act accordingly.
This reference covers the core terms that appear most often when everyday users navigate digital privacy. Each definition is written to be immediately useful, not technically exhaustive. If you're just starting out, the primer on online privacy is a good companion to this guide.
Encryption
The process of scrambling data so that only someone with the correct key can read it. Encrypted data looks like meaningless characters to anyone who intercepts it without the key.
End-to-End Encryption (E2EE)
A form of encryption where only the sender and recipient can read the message. Even the service provider handling the data cannot decrypt it. Look for this in messaging and file-storage apps when sharing sensitive content.
Metadata
Data that describes other data. A photo's metadata can include when and where it was taken and on what device — even if the image itself reveals nothing personal. Metadata can be as revealing as the content it describes.
Browser Fingerprinting
A tracking technique that identifies your device by combining details like your browser version, screen resolution, installed fonts, and time zone into a unique profile. Unlike cookies, it works even in private browsing mode.
VPN (Virtual Private Network)
A service that routes your internet traffic through a server in another location, masking your real IP address from websites and your internet provider. A VPN hides your location but does not make you fully anonymous.
Cookie
A small file a website stores in your browser to remember information about you — such as login status or shopping cart contents. Third-party cookies placed by advertisers are used to track your activity across multiple websites.
Data Broker
A company that collects personal information from many sources — public records, app data, purchase history — and sells or licenses it to other businesses. Most people have profiles with multiple data brokers without knowing it.
Two-Factor Authentication (2FA)
A login security method that requires two forms of verification: typically your password plus a code sent to your phone or generated by an app. It significantly reduces the risk of account compromise even if your password is stolen.
IP Address
A numerical label assigned to your internet connection that can reveal your approximate geographic location and your internet service provider. Websites and apps routinely log it.
Phishing
A social engineering attack in which someone impersonates a trusted organisation — a bank, a tech company, a government agency — to trick you into handing over login credentials or personal information, usually via email or fake websites.
Data Minimisation
The privacy principle that a service should collect only the data it genuinely needs for its stated purpose — and no more. When reviewing app permissions, asking 'does this app actually need this?' applies the principle in practice.
Zero-Knowledge
A system architecture in which a service provider has no access to your data or passwords — technically, they have zero knowledge of your content. Often used to describe cloud storage and password manager designs that store only encrypted data.
Key Concepts in Plain English
Once you understand the individual terms, you can start connecting them into a clearer picture of how data moves, who sees it, and where the risks actually live.
| Most common tracking method | Third-party cookies |
| What a VPN hides | Your IP address and location from websites and your ISP |
| E2EE availability | Not universal — must be verified per app or service |
| Metadata example | Photo EXIF data: GPS coordinates, device model, timestamp |
| 2FA effectiveness | Blocks the vast majority of automated account-takeover attempts (Google Security Blog research) |
| Private browsing protects against | Locally stored history and cookies — not fingerprinting or your ISP |
Tracking and Identification
Browser fingerprinting is one of the sneakier techniques worth knowing. Because it doesn't use cookies, clearing your browser history or switching to private/incognito mode does nothing to prevent it. The only reliable defenses are using a browser specifically hardened against fingerprinting or a VPN — and even then, results vary.
Metadata is frequently underestimated. A photo taken on your phone contains metadata that can reveal the exact GPS coordinates of where it was shot, the device model, and the time it was taken — even if the image itself shows nothing sensitive. Stripping metadata before sharing files is a simple habit with meaningful privacy benefits.
Data Protection Mechanisms
When a service advertises end-to-end encryption, it means the company itself cannot read your messages — only you and the recipient hold the keys. This is a meaningful distinction from encryption in transit, where the provider encrypts data traveling between you and their servers but can still access it once it arrives. Check which type a messaging or storage service offers before trusting sensitive content to it.
Your connected devices deserve the same scrutiny. Smart home gadgets often collect far more data than users expect, making these definitions directly relevant beyond your phone or laptop.
Private Browsing Is Not Full Privacy
Incognito or private mode prevents your browser from saving local history, cookies, and form data — but it does not hide your activity from your internet provider, employer network, or the websites you visit. It also offers no protection against browser fingerprinting. Think of it as clearing your local footprints, not becoming invisible.
When you're ready to apply these concepts hands-on, device privacy settings explained in plain language walks through exactly what each toggle and permission actually controls.