It started with an ad. Not a dramatic one — nothing that made me slam my laptop shut or call a lawyer. Just a product I had searched for on one platform, appearing as a sponsored post on a completely different one, about twenty minutes later. A small thing. The kind of thing most people notice for half a second, feel vaguely unsettled by, and then scroll past.
I scrolled past it too. I knew, in the abstract professional way that people in my line of work know things, that this was how the system worked. Data flows between platforms. Advertising networks share signals. Your search history on one service informs what you see on another. I understood the mechanism. I just hadn't really sat with what it meant that the mechanism was pointed directly at me, every day, in my own home.
That was the beginning of a slow, uncomfortable reckoning that took years to fully arrive — and eventually led me to rebuild almost my entire digital life from the ground up. This series is my attempt to document what I found, what I changed, and what I'd want someone I care about to understand before they decide whether to care about any of it themselves.
I should tell you who I am, because it matters for how you read this. I've spent the better part of twenty years working in cybersecurity — at utilities, at organizations that protect critical national infrastructure, and now at a company whose entire purpose is tracking sophisticated threats to industrial systems. My professional life involves reading about what happens when adversaries get inside networks that were supposed to be protected. I know what surveillance looks like from the threat intelligence side.
What I didn't fully reckon with, for too long, is what it looked like from the consumer side. From my side.
The Thing About Knowing
There's a particular kind of uncomfortable knowledge that professionals in certain fields carry around. Doctors know what cigarettes actually do to lung tissue. Structural engineers probably think about bridges differently than the rest of us. People who work in food safety may have opinions about buffets they don't share at dinner parties.
People who work in cybersecurity know, in considerable technical detail, what the major technology platforms are collecting about their users. We read the documentation. We see the telemetry in network traffic analysis. We sometimes sit in rooms where the implications of large-scale data collection are discussed in terms most people never encounter.
And yet. Many of us — myself included, for years — went home and used Gmail, and Google Maps, and Windows, and Facebook, the same way everyone else did. Because the products are good. Because opting out is friction. Because knowing something abstractly and feeling it personally are two very different things.
The ads kept coming. The suggestions kept being slightly too accurate. My Google Maps knew where I'd been on a Tuesday afternoon three years ago. My YouTube recommendations reflected conversations I'd had near my phone but never typed into any search box. Each individual data point was explainable. The cumulative weight of all of them, eventually, was not so easy to explain away.
I finally looked at my Google location history. I knew what was in there. I looked anyway. The discomfort was not what I expected — it wasn't shock, exactly. It was something closer to the feeling of finding an old diary you forgot you'd written. All that life, recorded, organized, searchable. By someone else.
There it was — every gym visit, every hospital appointment, every late night at an address I had no particular reason to have shared with anyone. Years of physical movement through the world, timestamped and mapped, held by a corporation whose primary business interest is selling access to people like me to advertisers.
I had agreed to this. Technically. In a terms of service document I had clicked through without reading, like virtually everyone does, because the alternative was not having Google Maps, and Google Maps is genuinely excellent.
This Is Not a Story About Evil Companies
I want to be direct about something, because I think a lot of writing on this subject gets it wrong in a way that ends up being counterproductive.
The companies involved in what I'm describing are not cartoon villains. The engineers who build these products are not cackling in server rooms somewhere. Many of them genuinely believe they're making useful things — because they are making useful things. Google Maps is one of the most remarkable navigation tools ever created. Gmail transformed how people communicate. The iPhone changed what a computer could be. These are real achievements that have made real differences in real people's lives.
The data collection is not a side effect of the business. It is the business. And the business model is so normalized, so woven into the fabric of how the modern internet works, that most people have never had occasion to look at it directly and ask whether they'd actually choose it if the choice were clearly offered.
That's the thing I keep coming back to. Not that the data is collected. Not even that it's used in ways that would make most people uncomfortable if they understood them fully. But that the choice — the real, informed, eyes-open choice — was never clearly offered. The terms of service were written by lawyers whose job was to make collection legally permissible, not to make it genuinely understood. The privacy settings were designed to make the privacy-protective option harder to find than the default. The default was always collection. The alternative always required effort.
My wife said something once that I keep coming back to. A relative was arguing against taking a medicine, insisting, "I don't know what's in it." My wife's response was immediate: "Oh, sweetie — I've seen you eat hot dogs, so that argument is kind of flat." I think about that often in relation to many things.
It applies here too. Nobody reads every ingredient list. Nobody fully understands every system they participate in. That's not a failure of character — it's just being human in a complicated world. The difference is that hot dog ingredients are regulated, labeled, and available if you want them. The data collection agreement was written by the company selling you the hot dog, in a document designed to be agreed to without being read, changeable at any time without meaningful notice. That's a different thing.
What This Series Is, and What It Isn't
Over the past year or so, I have been systematically replacing the commercial technology in my life with alternatives that I either control directly or that have fundamentally different relationships with my data. A new operating system on my laptop. A home server running services I manage myself. A network configured to give me visibility into what's actually moving in and out of my house.
Some of it has been straightforward. Some of it has been genuinely difficult. None of it has been perfect. I'm going to write honestly about all of it.
But before I get to any of that, I want to spend some time on the problem itself — because I think most people, even people who have a vague sense that "tech companies collect data," don't have a clear picture of what that actually means in practice. What specifically is collected. By whom. What it's used for. What it would feel like to look at it.
This series will eventually fork into two tracks — one for people who want practical, no-technical-skills-required steps to improve their privacy, and one for people who want to follow the full journey into self-hosting and open-source software. But both tracks start here, with the same question: do you know what you've agreed to?
I'm not writing this to frighten anyone, or to argue that you need to make the same choices I've made. If you read everything in this series and decide the tradeoffs aren't worth it for you — that the convenience is genuinely worth the cost — I think that's a completely legitimate conclusion. What I'd like is for that to be a conscious decision, made with your eyes open, rather than a decision that was quietly made for you by people whose interests weren't the same as yours.
That's all this is. An attempt to turn a light on in a room most people have never had reason to look at carefully.
What you do once you can see — that's entirely up to you.