We have more privacy controls yet less privacy than ever.

"In 2026, online privacy is a luxury, not a right," states Thomas Bunting, an analyst at the UK innovation think tank Nesta, painting a potentially dystopian future where smart kitchen appliances could share intimate dietary details with health insurers. While this scenario is not inevitable, it is a deeply unsettling prospect for many. Bunting, only 25, confesses he doesn’t believe he has ever experienced true online privacy. Instead, he asserts, "We’ve been taught how to deal with it." This coping mechanism involves understanding privacy settings and accepting the exchange of personal data as a form of currency for services like social media. He recounts a striking memory from his teenage years when a teacher asked his class who considered privacy an important principle to protect; not a single hand was raised. "When I chat to people now who are coming off social media, they say it’s because of screentime, or they’re worried about addiction – privacy never comes up," he observes.

These generational shifts in perspective deeply trouble veteran privacy advocates, such as Professor Alan Woodward, a cybersecurity expert at Surrey University. "People should care about online privacy because it shapes who has power over their lives," he argues. He likens the indifference of some to privacy to a lack of curtains in their bedrooms, suggesting that caring about privacy isn’t about having something to hide, but rather "about having something to protect: freedom of thought, experimentation, dissent, and personal development without permanent surveillance." Professor Woodward’s concerns echo a chilling anecdote about a young influencer who revealed that many of her friends refrain from dancing in clubs for fear of being filmed and subsequently shamed. "When people assume they are constantly tracked, they self-censor," Woodward explains, emphasizing that this self-censorship extends far beyond personal behaviour, ultimately undermining free speech and weakening democratic foundations.

This sentiment echoes a now-famous declaration from 1999 by Scott McNealy, co-founder of Sun Microsystems: "You have zero privacy anyway. Get over it." The technology sector, while a consistent innovator in pushing privacy boundaries, has also been the architect of the very "fences" intended to protect us. Companies have proliferated hundreds, if not thousands, of privacy tools and settings, often introduced with the stated aim of safeguarding our digital right to privacy. These include private web browsers, encrypted messaging applications, password managers, tracker blockers, and Virtual Private Networks (VPNs).

Despite this proliferation of protective measures, the stark reality is far more alarming. According to data analysis firm Statista, in 2024, over 1.35 billion individuals were impacted by data breaches, hacks, or exposures – a staggering figure representing approximately one in eight people globally. Within the cybersecurity community, a common refrain underscores this paradox: we may possess more privacy controls than ever before, yet our actual privacy has diminished significantly.

A vast landscape of privacy-focused regulations now exists, with approximately 160 countries implementing their own privacy laws, as reported by the technology firm Cisco. This regulatory environment is why, in the UK and Europe, website visitors are routinely presented with cookie consent banners, small programs designed to collect information about their browsing habits. The widespread annoyance many feel when confronted with these banners serves as a prime example of the "privacy paradox" – the apparent disconnect between individuals’ stated concerns for data privacy and their actual online behaviour.

Cisco’s 2024 Consumer Privacy Survey, the most recent available data, reveals a striking disparity: while 89% of respondents claimed to care about their data privacy, only 38% identified as "privacy active." These "privacy active" individuals are those who have demonstrably taken steps to protect their data or have actively chosen to patronize companies with more favourable privacy policies. The issue is further compounded by the fact that, according to a 2023 Pew Research Center study, 56% of Americans do not read the fine print before agreeing to privacy settings. For those who do attempt to navigate these agreements, many websites request permission to share information about a visitor’s session with hundreds, and sometimes thousands, of "partners," also referred to as other vendors.

Critics argue that this system is fundamentally flawed. When terms and conditions are practically unreadable, and cookie choices are perceived as an irritating hurdle rather than a meaningful safeguard, the effectiveness of these policies is demonstrably undermined. Dr. Carissa Veliz, author of "Privacy is Power," contends that "we need regulators to do a better job" in both formulating appropriate legislation and ensuring its rigorous enforcement.

Meta, the parent company of platforms like Instagram, WhatsApp, and Facebook, offers its users a "privacy check-up" feature. However, to opt out of targeted advertising based on the company’s extensive data collection from user activity, individuals are required to pay a subscription fee. Similarly, Apple champions privacy as a core tenet of its products, but this commitment is also associated with a premium price point. Following its recent sale in the US, TikTok has updated its terms for American users, increasing the amount of data the platform collects. While users can opt out of certain data collection, such as precise location sharing, this information can often be gleaned from the device itself.

Veliz maintains that people have not abandoned the concept of privacy; rather, they often feel a sense of helplessness regarding its erosion. "Mostly, people don’t feel like they have control," she states. "It’s partly because we are being surveyed in ways that are beyond our control, and also partly because tech companies have an interest in selling us this narrative that it’s too late." However, she remains optimistic about the possibility of change. Veliz advocates for a "multi-pronged approach" to privacy, involving proactive regulators, responsible tech companies, and consumers who "vote with their feet" by choosing services that collect less data. This, she acknowledges, may necessitate a significant cultural shift.

Veliz herself chooses to communicate via Signal, a secure messaging app that collects substantially less user data compared to its vastly more popular competitor, WhatsApp. While Signal boasts around 70 million monthly users, WhatsApp serves an average of three billion. "That goes back to culture," Veliz concludes. "It’s about having [access to] the right tech, but also using it."