Having read Edward Snowden’s revelations in the Guardian and in his book, I would like to protect myself from both the surveillance state and surveillance capitalism. I already use a VPN, and I am in the process of removing Google from my online life. What else should I be doing that’s reasonable for a home environment? Chris

Great timing! On Monday, the Electronic Frontier Foundation published a 17,000-word report on this topic. Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance, by Bennett Cyphers and Gennie Gebhart, covers both online privacy problems and the growth of real-word surveillance.

BOWM, for short, explains how personal data is gathered, brokered, and used to serve targeted advertisements. In theory, users should prefer useful adverts to irrelevant ones. In reality, it provides a stream of data to anyone who wants it. Most of us, I suspect, don’t object to the ads as much as to the vast infrastructure used to deliver them. Non-targeted ads are fine with me.

As the report points out, when you visit a website, data associated with your online identity will be sent to anyone interested in bidding in an auction to show you a targeted advertisement. A data-snorting company can just make low bids to ensure it never wins while pocketing your data for nothing. This is a flaw in the implied deal where you trade data for benefits.

You can limit what you give away by blocking tracking cookies. Unfortunately, you can still be tracked by other techniques. These include web beacons, browser fingerprinting and behavioural data such as mouse movements, pauses and clicks, or sweeps and taps.

Data brokers can try to connect whatever information they get to data that you are giving away in other areas. This might include your email address, mobile phone number, location, credit card and store card numbers, your car’s number plate and face recognition data. Some of this information may have been purchased from third parties.

You probably handed over your email address to get coffee-shop wifi or to register on various websites. You probably gave some social media sites and app-based services your phone number. You used your credit card to buy things online, and provided your home address for deliveries. Your smartphone is constantly giving away your location. Even if you turn off location tracking, your phone can be found by triangulating from cellular masts or by companies that have beacons listening for potential wireless or Bluetooth connections.

Even if you could avoid all the real-world trackers, you probably have smartphone apps that have access to all sorts of personal data and keep “phoning home”. Some of these apps may know how many steps you have taken, your heart rate, and how you slept, among other things.

As BOWM points out, real-world identifiers can last a lot longer than your browsers or even your devices. Your main email address, phone number, credit card number and car number plate don’t change very often. Good luck changing, or disguising, your fingerprint and face recognition data. “Gait recognition” is already being used in China. You can run but you can’t hide.

Today, we are past the stage where it’s a technology problem. Only governments can protect our privacy by banning the collection of data and giving us the rights both to prevent its collection without explicit permission, and to delete data that has already been collected. The EU’s GDPR (General Data Protection Regulation) was a baby step in the right direction. BOWM also mentions Vermont’s data privacy law, the Illinois Biometric Information Protection Act (BIPA) and next year’s California Consumer Privacy Act (CCPA). We need many more things like this, but I don’t expect we’ll get them in the UK – especially not if we’re outside the EU.

In any case, the game looks like moving on from browser-based surveillance to exploiting data from smartphones, smart watches and “Internet of Things” devices, with smart cars and smart roads to come. And rather than just flogging you stuff, the new threats include manipulating behaviour, as Shoshana Zuboff discusses at length in The Age of Surveillance Capitalism.

Browser choices

Google pioneered surveillance capitalism and it still dominates the market. According to Ghostery privacy extension-maker Cliqz, quoted in BOWM, Google collects data on more than 80% of measured web traffic, which is far more than Facebook or anybody else. It’s not enough to avoid Chrome and Google’s web properties because its trackers are on most other popular sites as well. You should therefore install Google’s “opt out” cookie in your browsers and pause data collection in My Activity.

There are lots of alternatives to Google Chrome, the main one being Mozilla’s Firefox. It’s the only major browser that is fully open source and not controlled by one of the web giants. It has some privacy features built in, such as tracking protection, and “containers” that can isolate privacy-threatening websites from other tabs. Multi-account containers let you operate two or more Twitter, email, Facebook or other accounts from a single browser.

But Firefox aims to provide ordinary users with a good online experience, where websites work as intended. If you take privacy more seriously, you will want to install a few extensions, and Mozilla has some recommendations.

Tor, the original anti-surveillance browser, is based on an old, heavily modified version of Firefox. However, it is more complicated to set up, and uses distributed relays to hide your internet address, which makes it rather slow. It’s less suitable for ordinary users.

Most other browsers are now, like Chrome, based on Google’s open source Chromium. Once enough web developers started coding for Chrome instead of for open standards, it became arduous and expensive to sustain alternative browser engines. Chromium-based browsers now include Opera, Vivaldi, Brave, the Epic Privacy Browser and next year’s new Microsoft Edge.

True to its name, Epic tries to maximise your privacy. It defaults to a sort of private-browsing mode, anonymises searches and clears browsing data when you quit. Epic has removed several Google features that could leak sensitive data including URL checks, URL tracking and error reporting. You will lose some features, such as auto-translation and spell checking. But there are often trade-offs between privacy and convenience, and Epic is still worth a look.

I’ve been using the beta version of Chr/Edge and recommend it as your second or third browser, because Microsoft has put a lot of effort into de-Googling the Chromium code. Microsoft may get some personal data in return, but I already use Windows 10, Defender, Outlook, OneDrive and Microsoft Office as a paying customer, not as an unwilling victim. Also, Microsoft’s business is based on selling software and services, not, like Google’s, on surveillance.

People who disagree are welcome to use Linux (free) or buy a Mac (expensive), but the US Defense Department and most major corporations are using Windows 10.

Extensions and plugins

Bennett Cyphers, co-author of BOWM, works on the EFF’s privacy-oriented browser extension, Privacy Badger. It’s a good option for most users. It’s lenient to begin with, but learns as it goes along. People who want something more aggressive can try Ghostery, Redmorph or Disconnect. The last two also work on Android smartphones and Apple iPhones.

Ghostery doesn’t block anything by default, but you can set it to block things you don’t like and either whitelist sites or unblock certain services (eg Disqus, in my case) as required. Ghostery’s data sharing “is solely related to tracking technologies” and it’s turned off by default. Also, it’s now open source and owned by a German company, Cliqz, in which Mozilla has invested.

Raymond Hill’s uBlock Origin is a general-purpose blocker, and what it blocks depends on the lists installed. EasyPrivacy and the Malware domain lists are among the ones installed by default. If you want to block trackers or analytics systems, as Ghostery does, you will need to add more filter lists. Otherwise, be careful not to confuse uBlock Origin with either uBlock.org or AdBlock. uBlock Origin is efficient, non-commercial, open source, and completely free.

HTTPS Everywhere tries to make your browser use an encrypted connection, where websites provide the option. It’s a joint project by the EFF and Tor, and it’s also available for Firefox on Android. It can run into problems with “mixed content” pages where some elements are sent securely (https) while others are sent insecurely (http), but it generally works pretty well.

It doesn’t cost anything to try different browsers and different extensions, except a little time. However, bear in mind that, like smartphone apps, extensions can compromise your privacy instead of enhancing it. Always uninstall any you don’t really need.

Have you got a question? Email it to Ask.Jack@theguardian.com