Every year on 28 January, the internet remembers privacy for about 24 hours. Brands post checklists. News sites run "10 tips" articles. Everyone nods, feels a bit guilty, and then goes right back to using the same password they've had since college.

The problem isn't that people don't care about privacy. Most of us do. The problem is that privacy gets treated like a one-day event instead of what it actually is — a habit. Like brushing your teeth or locking your front door. You don't do it once a year and call it done.

The good news is that you don't need to become a security expert. You don't need to buy expensive software or move to a cabin in the woods. Most of the damage that happens online comes from a handful of very ordinary mistakes, and most of those mistakes can be fixed with small habits that take a few minutes each.

Here's how to make privacy something you do, not something you read about once a year.

Why Small Habits Beat Big Gestures

When people decide to "get serious" about privacy, they usually try to do everything at once. New password manager, new browser, new email, VPN, encrypted messaging, delete all social media. It feels productive for about three days. Then it becomes annoying, and they quietly go back to how things were.

Small habits work better because they survive. Changing one password a week is boring — and boring is exactly why it keeps happening. A year later, you've changed fifty passwords without ever feeling like you were doing work.

Think of it like fitness. Nobody gets healthy from one intense weekend at the gym. They get healthy from ordinary walks, repeated for months. Privacy works the same way.

Habit 1: Fix Your Passwords, One at a Time

Let's be honest about how most people handle passwords. There's one main password, maybe with a number at the end. It's used on your email, your shopping accounts, that forum you joined in 2017, and possibly your bank.

This is the single biggest risk most people carry. Here's why: when a website gets hacked, attackers get a huge list of email addresses and passwords. Then they take that list and try the same combinations on every popular site — banks, email providers, social media. This is called credential stuffing, and it's automated. Nobody is personally targeting you. A script is doing it to millions of people at once.

If your password is unique to each site, a breach at one random website is a small annoyance. If it's the same everywhere, one breach means everything falls.

The habit: Get a password manager. There are good free ones, and your browser or phone probably has one built in. Then don't try to fix everything today. Just do this — every time you log into a site, if the password isn't unique, change it right then. It takes ninety seconds. Do it as you go, and within a few months your important accounts will all be clean.

Start with these, in order: your main email, your bank, your phone account, then everything else. Your email matters most because it can reset every other password you own. If someone controls your email, they control your entire digital life.

Habit 2: Turn On Two-Factor Authentication

Two-factor authentication (2FA) means that even if someone has your password, they still can't get in. They'd also need the code from your phone.

It sounds like a hassle. In practice, most sites only ask for the code when you log in from a new device, so you might see it once every few months.

Not all 2FA is equal. SMS codes are the most common, and they're much better than nothing — but they can be stolen through SIM swap fraud, where someone convinces your mobile operator to move your number to their SIM. Authenticator apps (like the free ones from Google, Microsoft, or open-source options) are safer because the code is generated on your device and never travels through the network.

Even better are passkeys, which are slowly replacing passwords entirely. A passkey uses your fingerprint or face to log in, and there's no password to steal in the first place. If a site offers passkeys, take it.

The habit: Turn on 2FA for one account every week until your important accounts are covered. And when you set it up, save the backup codes somewhere safe — people lock themselves out far more often than they get hacked.

Habit 3: Stop Giving Your Real Email to Everyone

Think about how many websites have your primary email address. The shopping site you used once. The PDF converter. The restaurant that wanted your email for a discount. The app you downloaded and deleted the same day.

Every one of those is a place your email can leak from. And once your address is on a marketing list, it gets sold, resold, and eventually ends up in spam databases and phishing campaigns.

The habit: Keep your real email for things that matter — banking, work, government services, close contacts. For everything else, use something disposable. There are three easy ways to do this:

Email aliases. Many providers let you create alternate addresses that forward to your real inbox. If one starts getting spam, you delete it and the spam stops.

Plus addressing. With many email services, you can write yourname+shopping@example.com and it still reaches you. It's not private (anyone can strip the "+shopping" part), but it's great for tracking who leaked your address.

Temporary inboxes. For one-time signups — downloading a file, reading a gated article, testing an app — a throwaway inbox that expires in an hour is perfect. You get the confirmation link, you're done, and nothing follows you home.

This one habit alone will noticeably reduce the junk you receive, and less junk means fewer chances of clicking something dangerous on a tired Tuesday evening.

Habit 4: Do a Monthly App Permission Check

Open your phone's settings and look at app permissions. Most people find something surprising — a photo editing app with microphone access, a game that can read contacts, a flashlight app that knows your location.

Apps ask for permissions at install time, when you're excited to use them and clicking "Allow" without reading. Months later, those permissions are still active.

The habit: Once a month, spend five minutes in your privacy settings. Go through location, camera, microphone, contacts, and photos. Ask a simple question about each app: does it actually need this to do its job? A note-taking app doesn't need your location. A shopping app doesn't need your contacts.

Also switch location permissions from "Always" to "While Using" wherever possible. That single change stops a lot of background tracking.

While you're there, delete apps you haven't opened in six months. An app you never use is still collecting data and is still a security risk if it stops getting updates.

Habit 5: Update Everything, Boringly and On Time

Software updates are annoying. They come at bad times, they change buttons you liked, and they take a few minutes.

But a huge share of real-world hacks exploit flaws that were fixed months earlier. The fix existed. People just didn't install it. Attackers know this, so they target old versions specifically.

The habit: Turn on automatic updates for your phone, your computer, and your browser. Then stop thinking about it. For anything that can't auto-update — routers, smart TVs, smart home devices — set a reminder to check every three months.

Speaking of routers: if you've never changed the admin password on yours, do that this week. The default password is usually printed on the device or listed publicly by model number.

Habit 6: Clean Up Your Browser

Your browser knows more about you than almost anything else you own. It's also where most attacks arrive.

Three things worth doing:

Audit your extensions. Browser extensions can read everything on the pages you visit. Some genuinely useful ones get sold to new owners who quietly turn them into data collectors or ad injectors. Remove any extension you don't actively use and can't name the purpose of.

Handle cookies sensibly. You don't need to block everything — that breaks websites. But blocking third-party cookies is a good default in most modern browsers, and it stops a lot of cross-site tracking without ruining your day.

Check your saved data. Most browsers have a page showing saved passwords, addresses, and payment cards. Have a look at what's stored and remove anything you don't want sitting there.

Habit 7: Learn to Spot the Trick, Not the Message

Phishing has moved far beyond badly spelled emails from fake princes. Today's scams look like real delivery notifications, real bank alerts, real messages from your boss. AI has made the writing flawless.

So stop trying to spot bad grammar. Instead, learn to spot the shape of a scam. Almost every one has the same three ingredients:

Urgency. Your account will be closed. Your parcel will be returned. Act in the next two hours.

A link or a number they provide. They want you going through their door, not yours.

A request for something secret. An OTP, a password, a PIN, a card number, remote access to your screen.

The habit: When any message pushes you to act fast, slow down instead. Don't click the link. Open the app or type the website address yourself and check whether the alert is really there. If someone calls claiming to be from your bank, hang up and call the number printed on your card.

And remember the one rule that covers most fraud: no legitimate organisation will ever ask you for an OTP. Not the bank, not the delivery company, not customer support, not the police. Anyone asking for one is stealing from you.

Habit 8: Think Before You Post

Privacy isn't only about hackers. A lot of information leaks out because we hand it over willingly.

Photos can contain location data. A picture of your new home shows your neighbourhood. A holiday post announces that your house is empty. Those fun quizzes asking for your first pet's name and the street you grew up on are literally security question answers.

The habit: Before posting, ask what a stranger could learn from it. Not to become paranoid, just to be aware. Consider posting holiday photos after you get back instead of during. Blur or crop things like house numbers, vehicle plates, and documents. And check your social media privacy settings twice a year — platforms change their defaults more often than they tell you.

Habit 9: Delete What You Don't Need

Old accounts are quiet risks. You forgot about them, but they still hold your data, and you'll never notice when they get breached.

The habit: Once a month, close one account you no longer use. Search your email for "welcome" or "verify your account" and you'll rediscover services you signed up for years ago.

Depending on where you live, you may also have a legal right to ask companies to delete your data. Under laws like the GDPR in Europe and India's Digital Personal Data Protection Act, you can request deletion, and companies are required to respond. Most have a privacy page explaining how. It takes one email.

Habit 10: Back Up, Because Privacy Includes Not Losing Things

Ransomware doesn't care how careful you are. Neither do stolen phones, dead hard drives, or spilled coffee.

The habit: Follow the simple 3-2-1 idea — three copies of anything important, on two different types of storage, with one copy somewhere else. In practice for most people that means: the files on your device, an automatic cloud backup, and an external drive you plug in every few months.

Then test it once. A backup you've never restored from is a hope, not a plan.

Habit 11: Bring Your Family Along

The most careful person in a household can still get hurt through someone else. A shared computer, a child's tablet, a parent who gets a convincing phone call.

The habit: Have one relaxed conversation every few months. Not a lecture — a story. "Someone at work almost lost money to a fake courier message, here's how it worked." Stories stick where warnings don't.

For older family members, the single most useful rule to teach is: if someone calls and creates urgency, hang up and call back on a number you already have. For kids, the most useful rule is: if something online feels weird, tell me and you won't be in trouble.

Your Simple Privacy Calendar

Here's the whole thing, organised by how often you do it. Print it, screenshot it, whatever works.

Every time you log in: If the password isn't unique, change it now.

Weekly (5 minutes): Turn on 2FA for one account. Delete one unused app.

Monthly (15 minutes): Review app permissions. Close one old account. Check your browser extensions.

Every three months: Update devices that don't auto-update. Review social media privacy settings. Check whether your email appears in any known data breaches using a reputable breach-checking service.

Once a year: Test your backup. Review which apps and services have access to your main accounts. Do a search for your own name and see what's publicly visible.

The Point Isn't Perfection

You will never be perfectly private. Nobody is. Some of your data is already out there, and no amount of effort brings it back.

That's fine. The goal isn't to be invisible — it's to stop being the easiest target. Almost all online crime is opportunistic. Attackers work through lists, looking for the accounts with reused passwords and no second factor. Every habit on this list moves you further down that list.

So pick one thing from this article. Just one. Turn on 2FA for your email, or change three passwords, or spend five minutes in your phone's permission settings. Then pick another one next week.

Data Privacy Day is one day. Your habits are the other 364. In 2026, those are what will actually keep you safe.