Stop Being Easy Data: Managing Your Digital Exhaust

The Signal is where the fiction meets the record. This one is a field guide.

The villain doesn't hack you. He buys you.

In The Null Identity, Max never picks a lock. He doesn't need to. He assembles you — your home, your movements, your medications, your money, the people you love — out of data that was already for sale. "The phone never lies," he writes in his log, "because the phone doesn't know it's talking." That is the whole trick. And here is the part that should keep you up at night: almost none of it is invented.

In December 2024, the Federal Trade Commission ordered a data broker called Gravy Analytics and its subsidiary Venntel to stop selling Americans' location data — data the company boasted it pulled from more than a billion phones a day. Weeks later, in January 2025, Gravy Analytics was breached, and a sample of that trove spilled onto the open internet: tens of millions of precise location points harvested from fitness apps, dating apps, transit apps, and games. The company built to track everyone got tracked. Its raw material — you — is loose.

Your digital exhaust is the trail you leave simply by living online: the accounts, the app permissions, the loyalty cards, the public records, the breaches. Each scrap is harmless alone. Assembled, it is a dossier. You cannot make yourself invisible — but you can make yourself expensive and low-yield: harder to buy, harder to assemble, not worth the trouble. That is the goal. Not disappearance. Friction.

Why this is on you now

You might assume someone is coming to fix this. For a moment, someone tried. In late 2024 the Consumer Financial Protection Bureau proposed a rule to treat data brokers like the credit bureaus they resemble — bound by the Fair Credit Reporting Act. In May 2025 the Bureau withdrew it. The federal cavalry turned around and rode home.

What is left is a patchwork — and, quietly, some real leverage. The FTC keeps swinging at the worst location brokers (Kochava, X-Mode / Outlogic, Gravy, Mobilewalla — one of which geofenced union organizers and political rallies). A dozen states now hand you enforceable privacy rights. And a few tools exist today that didn't a couple of years ago. The catch: nearly all of it is opt-in. Nothing protects you until you go turn it on. So let's turn it on.

You can't disappear. But you can refuse to be Easy Data.

The playbook

Work top to bottom. Each tier assumes the one above it. You will not finish — and that's fine. Every single step raises your price.

Tier 0 — Lock the doors

Minimizing your exposure is pointless if someone can just walk into your accounts. Start here.

• Unique passwords + a password manager. One breached password should not unlock your whole life. A manager makes unique passwords effortless.
• Two-factor authentication — but not by text. Use an authenticator app or a passkey. SMS codes can be intercepted through SIM-swaps.
• Freeze your credit. It's free, and it's the single highest-return anti-fraud move there is: a freeze blocks new credit opened in your name at all three bureaus. The FTC explains how.
• Harden your phone. It is the richest sensor you own. Go through location permissions app by app, and reset or delete your Advertising ID — the tag that stitches your movements to your identity in broker feeds (steps for Android and iPhone). Higher-risk? Turn on Apple's Lockdown Mode and Advanced Data Protection.

Tier 1 — Turn off the spigot

Before you bail water, stop the leak. These cut the new exhaust you generate every day.

• Block trackers. Install a tracker blocker — EFF's Privacy Badger or uBlock Origin. This starves the web trackers that quietly feed broker profiles.
• Turn on Global Privacy Control. This is the sleeper. GPC is a one-time browser setting (built into Firefox, Brave, and DuckDuckGo, or added via extension) that broadcasts "do not sell or share my data" to every site you visit. As of January 2026, roughly a dozen states — California, Colorado, Connecticut, Texas, Oregon, and more — legally require businesses to honor it. One toggle, automatic opt-out, enforceable by law.
• Stop handing out your real email and number. Use masked aliases (Apple's Hide My Email, Firefox Relay, DuckDuckGo Email Protection) and a secondary number for signups, loyalty cards, and forms. When one leaks, you burn the alias, not your identity.
• Say less, on purpose. Audit your social accounts; make the personal ones private; assume anything public is being scraped. In the book, the machine even swallows a child's crayon drawing. That is not a metaphor — brokers really do vacuum up the incidental.

Tier 2 — Erase what's already out there

Now go reclaim what has already been sold.

• Doxx yourself first. In a private window, search your name, address, phone, and email. You'll land on "people-search" sites listing your address, your relatives, your history. Note what you find and where.
• Opt out — and know the trade-off. You can remove yourself for free using journalist Yael Grauer's meticulously maintained Big-Ass Data Broker Opt-Out List. It's tedious, and brokers repopulate, so treat it as a habit, not a one-time chore. Here's the counterintuitive part: a Consumer Reports study found many paid removal services were less effective than doing it yourself — manual opt-outs cleared about 70% of listings within a week, versus as little as 0% for some services. If you'd rather pay for convenience, fine — Consumer Reports' own free Permission Slip app will act as your authorized agent — but don't mistake a subscription for a force field.
• Clean your search results. Google's Results about you tool alerts you when your contact information surfaces in Search and lets you request its removal.
• Californians: use the nuclear option. The state's DELETE Act created DROP — the Delete Request and Opt-out Platform — where, starting in 2026, a single request forces every registered data broker to delete you. One form instead of three hundred. Other states are watching; expect imitators.

Tier 3 — If the target is specifically you

Some people carry extra risk — and the book is built on exactly these cases.

• Servicemembers and veterans. Duke University researchers bought active-duty and veteran data — health, finances, even religious practice — from U.S. brokers for as little as $0.12 a record, some of it sold to buyers overseas. If you or someone you love served, the steps above are not optional. (Soldier for Sale was not a flight of imagination.)
• Survivors of stalking or abuse. Many states run address-confidentiality programs ("Safe at Home") that give you a proxy address for public records, and the Coalition Against Stalkerware can help you check a device.
• Journalists, activists, and public figures. PEN America's Online Harassment Field Manual is the best playbook for hardening before a campaign starts.

The mindset: perfect is the enemy of done

You will not do all of this, and you don't have to. Privacy isn't a switch; it's a dial — and every click of it costs your would-be Max more time and yields him less. Decide what you're actually protecting and from whom. A scammer, a stalker, an advertiser, and a foreign intelligence service are four different threats, and your effort should follow the one that's real for you. Half-measures are not failure. In this fight, raising the price is the win.

The record

Max's entire method rests on one assumption: that you are cheap and legible. That your life can be bought in bulk, "no questions asked and none answered." Every alias you burn, every broker you delete, every signal you switch off is a small refusal of that assumption. You become a worse deal. And the machine, as he confesses in his log, is only ever as smart as what it's fed — "which means there is a seam. There is always a seam."

Find yours. Then close it.

Further reading & sources

• EFF Surveillance Self-Defense, How to Manage Your Digital Footprint, and Behind the One-Way Mirror (how data brokers work).
• FTC enforcement: Gravy Analytics / Venntel, Mobilewalla, and Kochava.
• TechCrunch, the January 2025 Gravy Analytics breach.
• Federal Register, the CFPB's withdrawal of its data-broker rule.
• California Privacy Protection Agency, the DELETE Act and the DROP platform.
• Global Privacy Control and the state universal-opt-out laws that now require honoring it.
• Consumer Reports, study on removal-service effectiveness and the Permission Slip app.
• Duke Sanford, Data Brokers and the Sale of Data on U.S. Military Personnel.
• Yael Grauer, Big-Ass Data Broker Opt-Out List.
• FTC, how to freeze your credit.

Read The Null Identity free — a new chapter every Thursday, or hold the first-edition hardcover.

The Null Identity is fiction. The surveillance in it is not. — The Signal