Privacy Theater: The Tools That Don’t Work

Security theater is widely understood: visible security measures that don’t meaningfully improve safety. Privacy theater is its counterpart: tools, features, and policies that appear to protect privacy but don’t.

Common privacy theater

“Do Not Track” browser header: A signal sent by browsers requesting that websites not track you. Websites are under no obligation to honor it. Most don’t. Ironically, enabling DNT makes your browser fingerprint slightly more unique.

Cookie consent “Reject” buttons that don’t work: Some websites display reject options that don’t actually disable tracking. The cookies are set regardless of your selection.

Privacy policies claiming “we care about your privacy”: A long privacy policy is not privacy protection. Many detailed policies exist specifically to authorize extensive data collection.

VPN marketing claiming “total anonymity”: VPNs shift trust from ISP to VPN provider. They don’t provide anonymity. Browser fingerprinting, account logins, and behavioral patterns still identify you.

Incognito/private browsing mode: Doesn’t protect against ISP monitoring, employer monitoring, website tracking, or browser fingerprinting. Only prevents local browser history storage.

Phone “location off” setting: Disabling GPS doesn’t prevent cell tower tracking, WiFi-based location, or IP geolocation. It reduces precision but doesn’t eliminate location tracking.

How to identify privacy theater

Ask these questions about any privacy tool or feature:

1. Who has access to the data? If the company can read your data, it’s not private from them.
2. What happens with a subpoena? If law enforcement can compel access, the protection is limited.
3. Is it independently audited? Claims without verification are just marketing.
4. Is it open source? Can the community verify the claims?
5. What’s the business model? If the product is free and the company runs on advertising, your data IS the product.

Real privacy tools

• Signal: Open source, audited, E2EE by default, minimal metadata
• Shield: Open privacy model, blocks measurable trackers, no data collection
• Sentinel: Public data aggregation, on-device processing, no location tracking
• Tor Browser: Open source, audited, routes traffic through three nodes
• Tails: Open source, leaves no trace, all traffic through Tor

Real privacy tools are transparent about what they protect and what they don’t.