Finally, also in your professional career you can make a difference. If you are an entrepreneur, carefully consider your business model. If you aim for a start up, do not focus on the buy out, but actually focus on the product you are designing and consider how society (not your company) can benefit. If you work for a company, voice your privacy concerns and convince your co-workers and management to change course.
In essence, there are three parties that constitute a potential threat to your privacy: you yourself, the providers of the devices, applications and services you use, and third parties that try to gather personal information about you. Let us consider the latter first.
Use disc encryption to ensure personal data on external storage (like your hard drive or solid state drive) cannot be accessed if your laptop gets stolen or your tablet or smartphone gets lost. Again, modern operating systems provide disc encryption solutions out of the box. Disc encryption ensures that as soon as your device is locked the decryption key (that is necessary to access any data stored) vanishes. It is only regenerated or recovered if the correct passcode or password is entered or when you unlock your device with your fingerprint for example.
Be careful with any metadata in documents or pictures that you share, as discussed in the chapter "It's Merely Metadata".
Use different passwords for each and every service you are using. This ensures that if one service is careless and somehow leaks your password in a data breach, all your other accounts on other services are still secure. Also make sure that your passwords are strong enough (ten random characters or, even better, a five word pass phrase). In essence this means you have to use a password manager that generates and stores such passwords for you (as nobody can remember that many strong passwords). Use a strong password to protect the password manager. Finally, use two-factor authentication (as discussed in chapter "We Always Need To Know Who You Are") for accounts that you strongly care about. Consider using a separate physical dongle, like a YubiKey which you can insert in an USB port and that securely generates one time access code when pressed. In particular use it for the email account that you use to send password reset requests to, in case you forgot the password.
When browsing the web, make sure you connect securely to each website you visit (as discussed in chapter "I've Got Nothing To Hide"). You achieve this by only visiting websites whose URL (i.e. hyperlink) starts with https://
(instead of the insecure http://
) - i.e. the s
stands for secure. You can also tell whether you are visiting a website securely by checking that an image of a small padlock is shown in your browser alongside the hyperlink of the page you are visiting. You can force your browser to always visit a website securely (and warn you if this is not possible) by installing the HTTPS Everywhere browser extension.
Some people suggest to use secure email, like PGP (Pretty Good Privacy), an oldie), for additional privacy protection. But this is fraught with problems and hard to use really securely. In fact it is easier (and more secure) to transmit a document with an end-to-end encrypted messaging app like Signal (which also has a desktop app). The downside is that this restricts the people you can communicate with to those that have the same messaging app installed. Also, the archiving options sometimes leave something to be desired.
In general your risks increase as soon as you connect your device to a network and start using Internet-based services (as we saw in "You Have Zero Privacy Anyway - Get Over It"). Despite the scaremongering surrounding the insecurity of using public, unsecured, wireless (WiFi) networks, this is in fact a general problem: even if the WiFi network is secured, or if you use a wired, Ethernet, network the risks are similar. The fact of the matter is simply that you do not know, and therefore cannot trust, the person running the network. Moreover almost all networks in principle operate in `broadcast mode' which means that they either shout your messages to anybody on the local network or can easily be tricked to forward your messages to anybody else on the local network. Visiting websites only over a secure connection (explained above) solves this problem. Alternatively you can use a Virtual Private Network (VPN, discussed in chapter "I've Got Nothing To Hide"). Many commercial offerings for VPNs exist. Often your ISP provides one you can use, or your work will most likely have one to allow you to connect to the enterprise Intranet securely. A VPN encrypts all your network traffic (up to the servers of the VPN provider) and shields your identity (i.e. your IP address) from the websites you visit. Note though that the VPN provider now gets to see all your Internet traffic, which websites you visits, and thus learns a lot about your surfing habits (and much more if you websites that do not offer secure connections over https). It is therefore important you select a VPN provider you can trust. If you this really is concern to you, a more privacy friendly alternative is to use Tor, The Onion Router, discussed extensively in chapter "It's Merely Metadata". Using Tor prevents anyone from learning which websites you are visiting. But you pay for this strong form of privacy protection with high latency and low bandwidth.
Stop using free email services like Gmail and switch to a email provider you can trust, like ProtonMail. (If your company or institution uses Google for email, cloud storage, and collaboration, try to convince them to stop.) Typically an email service is part of your Internet subscription (and you will need to trust your Internet Service Provider for the most part anyway). For full autonomy, register your own domain and create an email account under that domain. This ensures that your email address remains the same and remains yours forever, even if you switch Internet service provider, or if your ISP goes bankrupt.
Many people use cloud services (Dropbox, Google Drive, Microsoft's OneDrive, Apple's iCloud or Amazon Web Services) to share documents with others, or to sync their documents over the different devices they use. Although these cloud services offer strong protection of your documents to prevent access by others, they themselves do have access to your data. Your only option is to switch to cloud providers that offer end-to-end encryption of data (like Teamdrive or go for a self-hosted solution (like NextCloud where you run the cloud hosting software on a server under your own control, as discussed in chapter "I've Got Nothing To Hide".
In any case, use sharing services sparingly and do not store data `in the cloud' just in case. Reconsider the use of such cloud based services critically, and ask yourself whether you really need to share your calendar, pictures, notes, contacts etc, with other people (or your other devices) and if so, use a service provider you can trust or use a self-hosted solution. Collaboration through Google Docs or Microsoft Office 365 indeed works like a charm, but again all your (sensitive) data is stored and processed by the provider of that service. There are a few self-hosted alternatives, like CryptPad. Even the non-self-hosted variant of CryptPad uses end-to-end encryption, guaranteeing that the hosting server does not get to see the contents of the documents you are collaborating on. And cryptpad also allows you to create privacy friendly polls and task lists.
As we saw in chapter "You Have Zero Privacy Anyway" service providers are able to track and profile you through browser fingerprinting}, using cookies, or through scripts embedded in web pages. To stop tracking and profiling when surfing the web thus means using a safe browser and blocking cookies, scripts and adds using an add or content blocker. Unfortunately, some websites detect whether you have an add blocker installed and refuse to serve their content in this case. Also review the browser extensions that are installed: some malicious extensions are designed to track you or trick you into using their service. Most browsers offer the option to block cookies, or to delete them automatically when you close the browser or after a certain period. Blocking all cookies may prevent certain websites from working correctly. But certainly blocking third party cookies should pose no problems and will significantly improve your privacy. Also, most browsers offer a private or incognito browsing mode which means that once you close the browser (or the particular browser window) all browsing history is erased and all cookies are destroyed. It is recommended to make private browsing the default if possible. In any case, check your browsing history every once in a while and clean it when needed.
A fundamental decision to make is which messaging app (like iMessage, WhatsApp, or Telegram) to use. Up until recently, these apps offered a limited form of security: the messages where encrypted when transmitted over the network, but stored in plaintext on the servers of the messaging service. This in principle allowed the messaging service providers to analyze the content of the messages, which was a concern especially when Facebook acquired WhatsApp in 2014. Then came Signal, a truly secure messaging app offering end-to-end encryption (as discussed in chapter "I've Glt Nothing To Hide"). Soon other followed suit, even though it is not always the default (Google Messages) and some us non-standard, dubious, forms of encryption (Telegram). Even though this now protects the content of your messages, end-to-end encryption does nothing to protect your metadata, i.e. with whom you are texting, how much and when. (This is similar to the fact that browsing the web securely using TLS does not prevent the collection of which websites you visit.) Facebook uses this data it gets through WhatsApp use to recommend new connections. Signal states that it does not collect or use such metadata, and even promises not to store your contact list when it checks whether your friends are also on Signal. But this is only a promise and not something that is (or easily can be) enforced through technical means.
Many security and privacy experts prefer Apple phones over Google phones because Apple has stronger control over the hardware, closer integration of hardware and its operating system (updates to Android do not necessarily reach all Android phones), tighter control over the apps on the app store (which means you have to be more careful to avoid malware when installing apps from Google's Play Store), stronger privacy features, and in particular a business model that does not depend on collecting your personal data. Having said that, others prefer Google's Android over Apple's iOS because Android is open source and iOS isn't, and because Android really allows the owner of the device to have full administrator privileges on the phone so they can install their own software outside the Google Play store (see here). Also, Apple's tight control over the App Store raise censorship concerns.
A final word of warning concerns wearables (like smart watches or fitness tracking devices). These are potentially even more intrusive than smart watches because they are literally on your skin, and have sensors that can measure your hearth rate and other health related indicators (like detecting seizures). These wearables often upload this very sensitive information to the servers of the manufacturer of the device regardless of whether you configured the device to work in private mode because you do not intend to share your health data with others. Consider buying a wearable that does not sync your data to a central server by default, but allows you to keep all your data locally on your PC or smartphone. A similar warning and recommendation applies to other Internet connected devices, like those used for home automation.