Personal Privacy Audit: A Quarterly Checklist for Accounts, Apps, and Data Brokers

Overview

Online privacy exposure accumulates gradually. An account you no longer use may still hold personal details, an old app may retain access to a cloud drive, and a public profile may reveal information useful for impersonation. A privacy audit does not remove every risk, but it helps you identify what exists, decide what is necessary, and close or limit what you no longer need.

Set aside time once each quarter and work from a private, trusted device. Use a password manager or a secure document to record progress, but do not place passwords, recovery codes, identity documents, or full payment details in the audit log. For each item, record the service, the action taken, the date, the result, and the next review date.

Use this status system:

• Keep: The account, permission, or listing is needed and has been reviewed.
• Reduce: The service remains, but unnecessary access, visibility, or personalization has been limited.
• Close: The account or permission is no longer needed and has been deleted or revoked.
• Follow up: A request is pending, incomplete, or requires another check.

Checklist by scenario

1. Review important accounts first

• List email, banking, payment, cloud storage, social, shopping, healthcare, government, work, and developer accounts.
• Confirm that each important account has a unique password and multifactor authentication where available.
• Review recent sign-ins, active sessions, remembered devices, recovery addresses, and recovery phone numbers.
• Remove old recovery methods and devices you no longer control.
• Check forwarding rules, mailbox delegates, connected storage, and other settings that could expose messages or files.
• Delete unused accounts when practical. Before closing one, export information you need and remove saved payment methods or personal details if the service allows it.

If you discover unfamiliar access or a password reused elsewhere, treat it as a security issue rather than a routine privacy task. Change the affected password from a trusted device, revoke sessions, and investigate whether a breach notification or credential leak alert applies. For a broader response plan, use the data breach response checklist.

2. Review connected apps and permissions

• Open the connected-app or authorized-app page for your email, social, cloud, and identity-provider accounts.
• Remove apps you do not recognize, no longer use, or cannot explain.
• Inspect permissions for contacts, files, calendars, location, microphone, camera, and profile data.
• For mobile apps, compare the permission with the app’s actual purpose. Turn off access that is not needed.
• Review browser extensions and remove those that are abandoned, duplicated, or unnecessary.
• Check integrations used by work or development tools. Removing an integration can disrupt a workflow, so document the owner and purpose before changing it.

3. Reduce advertising and profile exposure

• Review advertising, personalization, and activity-history settings on major platforms.
• Limit use of precise location, contact uploads, cross-service activity, and sensitive interest categories where controls are available.
• Clear or reduce saved searches, watch histories, and other activity records that you do not need.
• Review public profile fields, friend or follower visibility, old posts, tagged content, and discoverability by email address or phone number.
• Check whether a profile exposes your workplace, routine, family relationships, birthday, address, or other information useful for impersonation.

Privacy controls differ by service and may move after product changes. Review the current settings directly rather than relying on an old guide or a screenshot.

4. Search for public and data-broker exposure

• Search for your name, common name variations, old usernames, phone numbers, and email addresses.
• Look for exposed addresses, relatives, employment history, property details, or other identifying information.
• When you find a data-broker listing, record the exact listing URL, the information displayed, and the service’s current removal or opt-out process.
• Submit opt-out requests only through a page you have verified as belonging to the service. Avoid uploading more identity information than the request requires.
• Record the submission date and any confirmation number. Do not assume one request removes information from every broker or from the original public source.

Search results can change, and removals may not be permanent. The useful goal is documented reduction: identify the exposure, submit a clear request, and return later to verify the result.

5. Tighten browser and device privacy

• Install operating system, browser, and security updates from the device’s normal update mechanism.
• Review browser permissions for location, notifications, camera, microphone, and automatic downloads.
• Remove saved passwords from shared or unmanaged browsers, and use a reputable password manager where appropriate.
• Clear unnecessary site data and review which sites retain active sessions.
• Check device location sharing, Bluetooth visibility, backup settings, lock-screen previews, and account synchronization.
• Separate personal and work browser profiles when that reduces accidental sharing or permission confusion.

What to double-check

The most valuable part of a privacy audit is verifying that a change actually took effect.

• Account closure: Confirm that you received a closure message and that signing in no longer restores access. Some services may retain limited records for operational or legal reasons; check the service’s current notice rather than assuming immediate erasure.
• Permission removal: Reopen the authorized-app list and confirm the integration is gone. Also check the third-party app itself for stored tokens or sessions.
• Data-broker opt-out: Return to the original listing after a reasonable interval and search again using the same identifying terms. Record whether the listing disappeared, changed, or remains.
• Public information: Review search results in a private browser window and while signed out. Personalization can hide what another person may see.
• Recovery details: Make sure every recovery email and phone number is current, controlled by you, and protected with its own security measures.
• Shared devices: Check family, work, and old devices for stored sessions, synchronized files, browser profiles, and notification previews.

A simple tracking row can look like this: Item | Exposure found | Action | Date submitted | Result | Next check. Keep supporting evidence such as confirmation emails or screenshots, but store it securely and remove unnecessary copies.

Common mistakes

• Trying to fix everything at once: Start with primary email, financial accounts, identity providers, and accounts containing sensitive files.
• Deleting an app without revoking access: Removing an app from a phone does not necessarily remove its account authorization or stored data.
• Using the same email for every purpose: Consider separate addresses or aliases for sensitive accounts, shopping, newsletters, and one-time registrations when practical.
• Trusting an unsolicited privacy message: Do not use links in unexpected emails or texts to change settings. Sign in through a known address or official app.
• Oversharing during an opt-out: A removal request should not require you to send unrelated identity documents or account credentials. Pause and verify the process if the request seems excessive.
• Ignoring old phone numbers and addresses: Historical details can continue to connect records. Include them in searches where relevant, but do not publish them in your tracking file.
• Confusing privacy with complete anonymity: The practical aim is to reduce unnecessary collection, access, visibility, and retention—not to guarantee that no data exists.

If a suspicious message, website, or account alert triggered your audit, preserve the original message and avoid clicking further links. The guides on investigating suspicious messages and reporting phishing with evidence can help you document and escalate it.

When to revisit

Repeat the full audit every quarter, then run a smaller review whenever your circumstances change. Revisit immediately after a suspected data breach, a lost or replaced device, a new phone number, a major account change, or an unexpected privacy notice. Also review before seasonal planning cycles when you create new accounts, sign up for services, travel, move home, or begin a new job.

At each review, compare your current account list with the previous audit. Add newly created accounts, remove closed ones, and check every item marked Follow up. Recheck data-broker removals and public listings, since information can reappear or be published by a different source. Finally, inspect the permissions of tools added since the last audit, including browser extensions, workplace integrations, and mobile apps.

Finish by choosing three concrete actions: one account to secure, one permission or listing to reduce, and one old account or service to close. Record the results and set the next review date. A consistent, documented privacy audit is more useful than a one-time cleanup because it turns changing exposure into something you can monitor and manage.