Free Privacy Checklist for U.S. Households

Lock Down Your Identity

Should I freeze my credit? For most U.S. adults, a free security freeze at Equifax, Experian, and TransUnion is one of the strongest ways to reduce new-account credit fraud. You can lift it when you need to apply for credit. Federal law makes freezes free, and a freeze does not change your credit score. See the CFPB explanation.

Freeze the specialty files that fit your risk

• ChexSystems is commonly used for checking and savings account decisions.
• NCTUE covers information used by some telecom, pay-TV, security, internet, and utility providers.
• Innovis provides a separate consumer freeze.
• LexisNexis / SageStream provides another separate consumer freeze process.

Parents and guardians can also request a child credit freeze. The FTC child identity theft guide explains how a protected consumer record can be created and frozen and what documents may be needed.

Protect taxes, existing accounts, and prescreened mail

• Get an IRS Identity Protection PIN. The IRS issues a new PIN each year and will not unexpectedly ask you to reveal it.
• Review reports through AnnualCreditReport.com, the official federally authorized site.
• Use OptOutPrescreen, the consumer credit reporting industry’s official opt-out mechanism for prescreened credit and insurance offers.

Optional advanced employment protection

myE-Verify Self Lock remains available and can lock a Social Security number against new E-Verify and Self Check use. This adds friction: unlock it before a legitimate employer runs E-Verify. It is not a credit freeze.

Protect Your Number Without Hiding Every Important Call

Apple, Google, and the carriers have made useful attempts to reduce unwanted calls. They help, but nothing is 100%: no reputation or automatic-blocking system can perfectly distinguish a scammer from an important caller you have not met yet.

Healthcare and other large organizations may use rotating outbound numbers, centralized scheduling systems, PBXs or contact centers, automated reminders, and high calling volume. A call can come from a number that is not in Contacts, while carrier reputation databases may treat legitimate high-volume patterns as suspicious.

STIR/SHAKEN authenticates information about the calling number; it does not prove that the caller is trustworthy. An “A” (full) attestation is still the signing provider’s own assertion about what it knows, not an independent guarantee that the number was not spoofed. The FCC explains that distinction. In 2024 the FCC settled with Lingo Telecom for a $1 million civil penalty after the company applied A-level attestations to spoofed AI robocalls while relying on a customer’s certification rather than verifying the number itself (Consent Decree DA-24-790).

When you cannot miss an unfamiliar call

• Keep spam and caller-ID warnings on, but use automatic blocking cautiously.
• Consider manual screening and live voicemail where appropriate.
• Temporarily reduce aggressive filtering when expecting a doctor, hospital, government agency, school, or recruiter.
• After changing a setting, test from an unsaved number and inspect recent calls, voicemail, and carrier filter lists.

Use our detailed Apple, Google, and carrier call-screening guide with the current official instructions for Apple spam and unknown-call controls and Google caller ID and spam protection. Carrier resources include AT&T ActiveArmor and robocall controls, T-Mobile Scam Shield, and Verizon Call Filter.

Protect the carrier account too

Use a strong account PIN, enable carrier MFA, add the carrier’s available SIM or port lock, account lock, and port-out protection, secure voicemail with a PIN, and remove people who should no longer be authorized users. The FCC describes provider account-lock requirements.

Does the Do Not Call Registry stop scam calls? No. Registration is free and restricts many legitimate telemarketers that follow the law, but it does not block calls and scammers may ignore it. The FTC explains the exemptions and limits.

The FTC guide to blocking unwanted calls explains the difference between call-blocking services, carrier tools, and reporting.

Your state may offer additional protection

Start with the free National Do Not Call Registry Official source Policies checked Sep 1, 2026. Separately, these twelve states also maintain their own Do Not Call / No-Call consumer programs. Registering on both the national list and your state’s list (when available) is often worthwhile. Eligibility, update schedules, and exemptions differ, and scammers may ignore every list.

Additional protections (most states): file unwanted-call complaints with your state attorney general, use carrier spam tools, and report illegal robocalls to the FCC and FTC. Prefer official .gov pages over third-party “we’ll register you” services.

See Whether Your Information Has Already Leaked

“Dark web monitoring” is often a marketing term. Normal users do not need to browse Tor forums, criminal markets, or stolen databases. Use a reputable service to check your own identifiers safely, or follow our privacy self-audit tools guide for manual checks. A link is an action for you to take, not evidence that BlockTheCalls ran that search.

Other breach-search products change quickly. SpyCloud’s current free check is aimed at business-domain exposure rather than household self-checks. DataBreach.com and smaller services can require additional identifier disclosure and are not recommended here without further privacy and provenance review.

What should I do after a breach hit?

1. Determine what information and which service were exposed.
2. Change every reused password, beginning with the primary email account.
3. Turn on MFA or passkeys and review active sessions and devices.
4. Watch for targeted phishing that uses exposed details.
5. Freeze credit if identity data was exposed and it is not already frozen.
6. If infostealer or session-cookie exposure is suspected, treat the device as potentially compromised, not just one password.

Use Unique Passwords, Passkeys, and Separate Contact Identities

Every important account needs a unique password. A password manager such as Bitwarden Privacy/data · 5/5 Policies checked Sep 1, 2026 or Proton Pass Privacy/data · 4/5 Policies checked Sep 1, 2026 can generate and store them. Use passkeys where available. Turn on multi-factor authentication. For critical accounts, an authenticator app or security key is preferable to SMS when supported, but SMS MFA remains much better than no MFA.

Protect the primary email account most strongly because it can reset other accounts. When a service permits arbitrary security-question answers, do not answer them truthfully: treat each answer as another password and store it in the manager.

Stop Giving Every Company the Same Email and Phone Number

Private email

Banks, taxes, government, healthcare, and account recovery. Never publish it.

Normal email

Personal correspondence and ordinary accounts.

Aliases

Shopping, newsletters, trials, retailers, and questionable signups. Options include SimpleLogin Privacy/data · 4/5 Policies checked Sep 1, 2026 / Proton Pass, Apple Hide My Email Privacy/data · 4/5 Policies checked Sep 1, 2026, and Firefox Relay Privacy/data · 4/5 Policies checked Sep 1, 2026.

Aliases reduce correlation, show which address leaked or was sold, and can be disabled. A secondary public phone number can help with noncritical signups. Do not use a temporary or disposable VoIP number for critical bank recovery unless the institution explicitly supports it.

Find Out Who Is Publishing Your Address and Phone Number

How do I remove my address from the internet? Removal from Google is different from removal at the original data broker. Start at the source, then ask the search engine to remove an eligible result.

1. Search your name plus city, then your phone, email, and home address.
2. Identify people-search and data-broker profiles that actually refer to you.
3. Use each broker’s official opt-out process; do not pay a look-alike site.
4. Record the profile, request date, and confirmation.
5. Re-check periodically because data can reappear.

Optery Free Basic Privacy/data · 3/5 Policies checked Sep 1, 2026 currently offers an exposure report and self-service opt-out information. A scan identifies likely profiles; it does not guarantee removal.

Want someone else to do the repetitive work?

Optional paid service Incogni (privacy policy; owned within the Surfshark/Nord group), DeleteMe (legal and privacy terms), and Optery (privacy policy) automate different portions of removal. These services need enough identity data, and often authorization, to find records and submit requests. Compare current coverage, data required, retention and deletion, ownership, reporting, household support, renewal, cancellation, and complaints. None can remove every source record or prevent data from reappearing.

Recommendation policy: BlockTheCalls receives no referral compensation for the resources listed in this guide as of the reviewed date. If that changes, the relationship will be disclosed beside the recommendation; recommendations should never be pay-to-play.

See Yourself Like a Stranger Does

Search only yourself or your household. Try your name in quotation marks, old names, email, phone, address, username, and combinations such as name plus city or employer. Use more than one search engine because indexes differ.

• Username reuse: Namechk or the WhatsMyName web app can help find public reuse. A distinctive username can connect identities you intended to keep separate.
• Reverse image search: use Google Lens, TinEye, or Bing Visual Search. Reusing one photo can connect public and pseudonymous profiles.
• History: review old sites in the Wayback Machine. Deleting the current page does not guarantee archived copies disappeared.
• Metadata: photos can contain location and device details, while documents can contain author and organization names. Turn off camera location where appropriate, share a sanitized copy, and inspect document properties, no command-line forensic tool is required.

You Can Be Public Without Making Everything About You Public

Platform privacy checkups

• Facebook Privacy Checkup: audience, profile fields, connected apps, blocking, and account security.
• Instagram privacy settings: account visibility, interactions, tags, mentions, and messages.
• TikTok account privacy: private accounts, discoverability, activity, downloads, and interactions.
• LinkedIn profile visibility: public search, email and phone discoverability, and off-LinkedIn visibility.
• X public and protected posts: audience and discoverability choices.

Do not post real-time vacations, exact locations, or empty-house announcements. Inspect photos for house numbers, license plates, school names, boarding passes, tickets or QR codes, badges, mail labels, screens, and keys. “Friends only” does not prevent a screenshot.

Lock Down the Devices That Hold Your Life

Review every app’s access to location and precise location, contacts, photos, microphone, camera, Bluetooth or nearby devices, and local network. Prefer “While Using the App” to “Always” when practical.

• Use a strong device PIN or passcode and biometrics.
• Enable Find My or Find My Device, automatic updates, backups, and lock-screen notification privacy.
• Remove unused apps and avoid random phone cleaner, RAM booster, antivirus, or “privacy” apps.

Private person-to-person communication

Signal is a strong default for end-to-end encrypted Signal-to-Signal messaging and calling. It does not make ordinary SMS private, and device security still matters: someone with an unlocked phone can read what is on it.

Reduce Tracking Without Chasing “Anonymity”

Two practical free approaches are Firefox with uBlock Origin from the official Mozilla Add-ons store, or Brave with built-in protections. Install extensions only from an official store and remember that aggressive filtering can break some sites; use a narrow site exception when you trust the site and need it to work. Keep the browser updated, block unnecessary third-party tracking, review site permissions, enable Global Privacy Control where supported, and remove extensions you do not need.

Do I really need a VPN?

A VPN can reduce some local-network observation, hide some destination/IP relationships from a local ISP, and help on an untrusted network.

A VPN cannot make Facebook forget who you are after you log in, eliminate cookies or fingerprinting, stop phishing or malware, or make you anonymous by itself. Do credit freezes, a password manager, passkeys or MFA, SIM/port protection, and public-data removal first. If a free VPN fits your threat model, review Proton VPN’s current free plan Privacy/data · 4/5 Policies checked Sep 1, 2026; avoid random “free VPN” apps.

Turn On Financial and Physical-Mail Warnings

Enable transaction alerts for every card purchase when practical, plus login, transfer, new-payee, new-device, and password-change alerts. Never approve an MFA prompt you did not initiate, and treat a caller asking you to read back a one-time code as a major red flag.

Mail still exposes cards, IRS letters, bank documents, and account-change notices. Use USPS Informed Delivery, reduce prescreened offers through OptOutPrescreen, and consider Catalog Choice or the small-fee DMAchoice after the free options.

Privacy Maintenance: 15 Minutes Every 3 Months

• Review HIBP alerts and credit reports periodically.
• Verify freezes and carrier protections remain in place.
• Review bank alerts, activity, devices, and payees.
• Search your name, email, phone, usernames, and profile images.
• Check for data-broker reappearance.
• Review social privacy settings and contact syncing.
• Review app permissions and lock-screen notifications.
• Update devices and remove old apps and extensions.

How We Choose Resources

• Free resources first.
• Government and official sources preferred.
• Reputable nonprofit and open-source services where useful.
• Paid products only when they add material convenience or protection.
• No product is presented as complete protection.
• Any affiliate or referral relationship must be disclosed beside the recommendation.

Know a free or low-cost tool that helps U.S. households protect privacy, and that we should review for this guide? Email [email protected] with the name, link, and why you recommend it. Suggestions are not commitments to list a product.

This privacy guide is separate from the BlockTheCalls Privacy Policy. BlockTheCalls is a U.S. incoming-call-screening service, not a telecommunications carrier. Outbound calls and 911 continue through the normal phone and carrier. This public site does not collect payment details.

Privacy checklist FAQ