Companies collect data about what you view, like and search for, and use it to show specific ads. Cookies are small bits of data a website saves in your browser, for example to remember your login. Cookies can be misused to link your visits and searches together, which is a privacy concern. Cookies track you only until you delete them, but fingerprinting uses more permanent identifiers such as hardware specifications and browser settings. Browser fingerprinting identifies a device by characteristics like screen resolution and installed fonts, so it keeps working even if you delete cookies. Algorithms are computer programs that recommend content based on what you have watched before. Some apps can see where you are, so check each app's location setting. Shocking content designed to make you angry or scared is often made for clicks, not because it is true. Deepfakes are fake images, videos and audio made with AI that can look and sound like a real person.

Websites ask you about cookies because of a data privacy law, the European GDPR, which became a model for many other laws. When a site asks you to accept cookies, you can choose to accept only the necessary ones. Browsers let you block, limit or delete cookies. Stronger privacy can cost convenience: stronger tracking protection often makes some websites work less well. A privacy policy should say how your information will be used and whether it is shared with other organizations. Data brokers are companies that collect and sell personal information about people, including information bought from apps, loyalty programs and retailers. Scammers can sometimes get data sold by data brokers and use it to write more convincing phishing messages.

As of November 2026, password guidance from NIST says services should not force complexity rules or regular password changes. It also says a password should be changed if there is evidence it has been compromised. NIST also says a password used by itself should be at least 15 characters long, and that websites should accept long passwords of at least 64 characters, with spaces, so that a passphrase works. A passphrase of four or more random words is one way to reach that length. As of November 2026, passkeys let you sign in with your device's fingerprint, face check or passcode instead of a password, and guidance from the NCSC recommends them wherever offered.

Two-step verification asks for a second proof that it is really you, such as a code sent to your phone, in addition to your password. It can stop a criminal who has your password from getting into your account. The second step can be a code sent by text, a code made by an authenticator app, or your fingerprint or face. A password manager is a program that makes, stores and fills in your passwords, so you only remember one strong one. Multifactor authentication uses something you know, something you have or something you are. A criminal who gets into your email could read private information, send messages pretending to be you, and reset your other passwords. Start by turning on two-step verification for your email, because email can reset your other accounts.

A software update patches security flaws, and attackers may target known flaws for months or even years after an update is available. Only download updates from trusted vendor sites, not from a link in an email, because fake update emails are a known trick. Old devices eventually stop getting security updates, and without them the device is less secure. HTTPS encrypts the data passing between your browser and a website, so attackers on the network cannot read it. A website's certificate ties its encryption key to its domain name, and a certificate authority checks that the web address belongs to that organization. A VPN sends your web activity through a secure network that encrypts and protects your data. It is best to install updates at home on a trusted connection rather than on public Wi-Fi.

Phishing is a form of social engineering: attackers use people's trust, rather than computer flaws, to get information. The internet gives a false sense of security because there is no physical interaction, so people may share more than they would face to face. Information can be used for social engineering: someone could use details about your hobbies and friends to pretend to be a trusted friend. Attackers use news events and times of year, such as holidays or disasters, to make their messages look timely. Texting scams are called smishing and voice-call scams are called vishing, and both are kinds of phishing. Caller ID can be spoofed, so a call that seems to come from a trusted number may not.

Poor spelling used to be a clue to a scam, but scams are getting smarter and some even fool experts, so do not rely on spelling alone. A real bank will never ask you to confirm your account details by email or a phone call it started. Scammers try to quickly gain trust and pressure you into acting without thinking; if a message is suspicious, stop and break contact. If a suspicious message could be real, look up the company's real contact details yourself instead of using the ones in the message. Even people you know can send a bad attachment, because viruses can spoof a sender's address. Reporting scam messages helps reduce how many you receive and protects other people.

Posted information can survive removal: saved or cached copies may still exist on other people's machines. As of November 2026, companies and schools sometimes look up applicants online, so what you post can matter later. Most people are judged on authenticity, not perfection. Think before you post: if you feel upset or angry, wait, because people do not always make good decisions when stressed. You can manage your digital footprint by limiting or deleting data browsers hold, deleting old accounts, and using private browsing. A self-audit means looking over your profiles from time to time and removing posts that no longer fit your values. Searching your own name, then discussing what strangers could find, is a way to check your footprint.

If someone shares an embarrassing or inappropriate image claiming it is you, tell a trusted adult, and report it to the site. If a friend's account sends a suspicious link, their account might be hacked, so check with them another way. If you gave your password to a scammer, change it on every account that uses the same password. If bank or card details were shared with a scammer, get in touch with the bank straight away, because it can help. If something online makes you feel sad, scared or confused, tell a trusted grown-up. Telling a grown-up about something that worried you online is the right thing to do, and you should not be in trouble for telling.

Words to know

• fingerprinting: device tracking
• GDPR: European privacy law
• brokers: data sellers
• certificate: site ID