November 3, 2026
True digital privacy cannot be achieved through superficial software settings or compliance policies. Securing genuine user anonymity requires an architecture of absolute data refusal — stripping out tracking middleware, avoiding telecom verification loops, and prioritizing purpose-built independent networks.
The internet privacy debate is often muddled by vague surface-level marketing promises designed to reassure customers while avoiding structural changes to maintain privacy. Businesses routinely make promises like “your data belongs to you” or “we don’t sell your data to anyone,” and customers often take them at face value.
In the vast majority of circumstances, these commitments imply a level of benevolence that doesn’t exist. Customers feel misled when they find out that “we don’t sell your data” can mean “we sell your data as part of an anonymised package”, or “we share your data for free with our partners”. Or that “your data belongs to you” can mean “you can delete your data from our service, but we’ve already shared it with others”.
This landscape of half-truths isn’t accidental. It’s designed to let companies say as much as possible while committing to as little as they can. This ambiguity is what enables their data business to thrive.
Businesses get away with selling user data despite seemingly contrary promises by “anonymising” it before they put it on the market. The argument is that, by removing the user’s name from the data collected and grouping it with others, they’re not selling their customers’ data. They’re selling a bundle of usage information that isn’t linked to any individual customer.
The problem is that a user's identity doesn’t just live in their name. It lives in the GPS tracking that reveals the school they visit every day. The local news they view. The searches for family genealogy, the business they’ve reviewed, and the content they’ve watched.
A 2008 study from the University of Texas remains the seminal work on this topic. Netflix had released “anonymous” film ratings from ~500,000 subscribers. The researchers found that knowing just eight of somebody’s ratings, with roughly correct dates, was enough to match 99% of records. By cross-referencing a small sample against public IMDb reviews, they were able to unmask users.
An MIT-led study in 2013 went further by analysing 15 months of mobile phone records for 1.5 million people. Each data record logged the mobile mast the phone connected to and the hour it connected. With just four of these records, the researchers could identify 95% of users.
Unfortunately, it’s only getting easier with the advent of large language models. In 2026, researchers at ETH Zurich used off-the-shelf AI models to autonomously unmask pseudo-anonymous online accounts from nothing more than what they had posted.
At this point, there are dozens of examples that show it takes only minimal, publicly available information to re-identify users. One point of metadata may not be enough to identify a customer, but just a few create a unique fingerprint leading straight back to them.
The picture only gets worse when you realise that rather than taking best efforts to anonymise users, many companies are doing exactly the opposite. In fact, their whole business model is centered around hoovering up more data on a user than their competitors to uncover the most personal details about their life.
In October 2026, Amazon users discovered a hidden section of their profile that showed insights derived from their shopping activity. Some user-shared insights include “Has a bad father”, “Has flat buttocks”, and “Has a father named George Klein who wrote the lyrics for ‘echo butterfly’”.
These kinds of insights are made possible by the vast ecosystem of connected services companies like Amazon have systematically developed. Details that seemed innocent can potentially be gathered and analysed from Amazon reviews, Alexa conversations, Prime watch history, Kindle purchases, Audible listens, IMDb history, Ring doorbell metadata, Twitch donations, Whole Foods shops, and US postal deliveries.
The scariest part is that Amazon is just one of a dozen companies with this kind of reach. It’s not even the worst offender — it primarily uses customer data within its platforms rather than selling it. Companies like Google have similar reach but allow others to buy ads to target its users. Data brokers collect information on consumers from as many sources as they can and sell it to the highest bidder.
Alongside tech giants and data brokers, there are networks of smaller companies that specialise in collecting data on consumers in a certain way. Middleman telecom providers that manage the two factor authentication codes your customers receive every day are one example. Lighthouse Reports says it caught one such provider, Fink Technologies (FTS), attempting to locate the phone of a Mexican journalist just hours before he was shot and killed. The company appeared to be routing SMS messages while working as a contractor for the surveillance industry.
That was just the tip of the iceberg. The team later received a dataset of 100 million packets sent over FTS’s infrastructure over the span of a week. It revealed that 2FA codes from the world’s biggest tech companies — Google, Meta, Amazon, Tinder, Snapchat, Airbnb, Uber, and more — were included. It also found at least 150 geolocation requests often used by surveillance for hire companies to geolocate cell phones. Lighthouse does not believe FTS is in any way unique. In fact, it says that “any number of companies could play a similar role, given the market conditions prevailing around SMS routing”.
All of this highlights that companies using forced SMS verification are exposing both their customers and themselves to risks they can’t see. They simply do not have the visibility to reassure customers that their sensitive data is safe. Unfortunately, when contacted about the issue by Lighthouse, most companies exposed appeared indifferent.
That’s perhaps unsurprising given that some of those companies have been exposed for misusing 2FA data themselves. In 2018, researchers at Northeastern and Princeton found that a phone number added to Facebook for 2FA became targetable by advertisers after 22 days. They also found that “shadow” contact numbers uploaded by friends could be used for targeting. Facebook was subsequently barred from using 2FA for advertising, but not from using shadow contacts.
Twitter was found to have made a similar “mistake”. It used security phone numbers and emails as part of its tailored advertising products and was ordered to pay a $150m fine.
Another important aspect to understand is that a phone number isn’t a neutral login token. It’s tied to a billing or SIM registry identity at the carrier level, and that means it can be looked up. Vendors like Telesign and Twilio use this data to sell a fraud “trust score” to clients like TikTok, Microsoft, and Salesforce, but the person scored rarely sees the score or the signals behind it. Privacy organisation noyb alleges that TeleSign’s profiling is so extensive that it covers half of the world’s mobile phone users without informing them.
Everyday sites often contribute to mass data collection without fully realising what they’re signing users up to. Data leaks the moment customers visit a page, and the checkout just adds more channels on top.
The HTTP Archive’s 2025 Web Almanac found at least one third-party tracker on 75% of desktop pages, and Google services on 61%. The median page makes 83 third-party requests, with each request potentially carrying a visitor’s IP address, device fingerprint and the page they came from. Checkout pages add purchase events that often use tracking pixels to send the items customers bought and what they type to outside services.
The important thing to note is that many websites aren’t fully aware of this. It’s often a simple tracking toggle in Shopify or their Google dashboard that they enable for their own uses. It just so happens that the third party also collects the data and does with it what they will.
Cookie banners unfortunately don’t stop tracking as robustly as users believe. A 2024 study found that 39% of top sites with cookie notices kept using them after users opted out. Fingerprinting also needs no cookie at all. Instead, it uses signals such as canvas rendering, hardware specs, and IP addresses to create an ID that survives even if a customer clears their browser. There’s evidence fingerprints are used for ad targeting in place of cookies as a way to bypass GDPR and CCPA opt-outs.
As well as analytics, payment middlemen collect data on checkout. Stripe admits it may collect the information customers type into a checkout form even if you abandon the purchase. PayPal has shared US shoppers’ data with merchants since 2024, and PIRG caught Mastercard selling bundles of “anonymised” transaction data through data marketplaces.
For some businesses, limiting data collection can feel exhausting. With analytics, payments, and verification vendors all collecting by default, sovereign technology operations can feel borderline impossible.
At Liber, however, we believe total data privacy is not only possible but a corporate asset. It starts by moving away from defensive monitoring and instead implementing data refusal at the structural level.
Businesses put a lot of emphasis on how they handle and store user data because that’s what their compliance guidelines say they need to do. We believe it’s often simpler for a business, and better for its customers, to focus on designing systems that don’t store data at all.
Often, this starts with the sign-up flow. Most platforms ask for full name, date of birth, phone number, and sometimes even a billing profile before the user does anything. Every field on the form is a liability the business has to store and secure. Implementing data rejection means only asking for the information you need in that moment. If a service only really needs an email and password to function, only ask for those fields. And design the schema and API so that the data has nowhere to go.
That smaller dataset means less to encrypt, audit, and secure, fewer compliance obligations to work around, and more privacy for customers. In the event of a breach, you can’t leak data you never collected, so your legal and financial exposure is limited.
When even anonymised data can be traced back to users, the safest thing a business can do is never store real-world credentials in the first place. Services collect thousands of selfies and ID photos a day to verify users’ identities, and regularly leak them in data breaches. In 2025 alone, Tea leaked 13,000 selfies and ID photos it said were deleted, and Discord support provider 5CA may have leaked the IDs and personal information of 70,000 users.
The same goes for phone numbers and credit data. Phone numbers are used to verify users and block duplicate accounts, and credit-file data is used for identity checks. A 2019 GAO review found US federal agencies verifying people with credit-file questions, and warned that the Equifax breach, which exposed about 147 million names and dates of birth, made those answers unsafe.
Cryptographic tokens offer a viable alternative, since they can prove a fact without handing over the credential behind it. Based on the blind signature introduced by David Chaum in 1983, they enable issuers to view an ID once, create a random token based on it, and disguise it with a secret value. The issuer then signs that disguised value. The user presents that token to the service, which only needs to check the issuer's signature. Because the issuer only saw the disguised token, it can’t link the token back to the user’s real identity.
Privacy Pass and Apple’s Private Access Tokens already use this technology. Google’s Longfellow goes a step further by enabling zero-knowledge proof of age and other ID information. Passkeys apply the same idea to logins, a privacy-first account security model: your device keeps the private key and the service stores a public key, leading no phone number to hijack or SMS code to intercept.
Tokens, of course, still aren’t trustless. Issuers are still trusted, and ecash systems like Cashu and Fedimint, which use blind signatures for payments, rely on custodial mints. The idea is instead to reduce the information services receive to “over 18”, rather than “full name and address”. With no shared identifier like a phone number, services have nothing to match a customer’s record to, and the issuer can’t see which services a customer uses. It’s about building an anonymous authentication architecture that makes it impossible to see user data.
Not every business profits from privacy. Free services funded by advertising or data sales have built their whole business model around eroding user privacy as much as they can get away with. But for services whose product is trust, such as VPNs, hosting, or messaging, refusing to collect data can become a major competitive advantage. Data that’s never collected can’t be breached or subpoenaed.
Take Ashley Madison as an example. The site advertised itself as a 100% anonymous, discreet service, and sold a “Full Delete” that promises to remove all of a user’s data. Its 2015 hack exposed customer names, emails, home addresses, and credit card information. It was fined $1.6 million by the FTC and had to pay $11 million to settle a class action lawsuit. It likely spent millions more on rebranding and security, and lost nearly a quarter of its yearly revenue. Its parent company also indefinitely suspended its IPO.
In contrast, privacy-focused services that get subpoenaed or raided don’t just avoid the negative impact of a data leak — they actively benefit. Signal’s responses to US grand jury subpoenas proved that it could only supply when an account was created and last connected. Mullvad’s raid by Swedish police demonstrated that it had no useful data for law enforcement to walk away with. For both companies, the attempts cemented them as true privacy brands.
The lesson is that trust is earned by how a service is built, not what it promises. Every outside vendor touching user data is another place it can leak. That means avoiding third-party lock-in and building platforms that are physically incapable of tracking or betraying their audience. If your service sells trust, the strongest competitive advantage is having nothing worth stealing or selling.