A privacy pass across every browser and device you use

The reason privacy settings feel like they never stick is that most of them are not account settings at all. They live in the browser you set them in, on the device you set them on. The FTC states the consequence directly: "If you opt out, be sure to opt out on each device and browser." That turns privacy configuration into a sweep across everything you own. Here is a version of that sweep you can finish in an evening.

Who needs to do this, and how many times

Anyone with more than one device, which is nearly everyone. If you have a phone, a laptop and a television that connects to the internet, you have at least four or five separate places where these settings are stored independently of each other.

It is also for people who have already "done their privacy settings" once and assumed that covered them. It almost certainly covered one browser on one machine.

Why once is never enough

There is no central switch. An advertising opt-out is typically recorded as a cookie or a local preference, so it exists only where it was set — and it disappears when you clear that browser’s storage or reinstall.

Meanwhile the mobile operating system keeps its own advertising identifier, which the FTC treats as a separate control from anything in your browser. CISA’s guidance for people at elevated risk puts it as a plain instruction: disable your Ad ID, and consider asking data brokers and other online platforms to delete your data.

And apps are a third layer again. The FTC’s direction is to go to the privacy settings on the phone itself to see what information apps can access from the device. None of these three tiers knows about the others.

The sweep, device by device

1. Phone, operating system level. Find the advertising identifier setting and turn off personalised advertising. This is the one that reaches across apps.
2. Phone, app permissions. Work down the list in the phone’s privacy settings — location, contacts, photos, microphone, camera. Revoke anything an app does not need for the job you use it for.
3. Phone browser. Set cookie restrictions and the personalised-ads preference. This is separate from the operating-system setting you just changed.
4. Laptop or desktop, each browser separately. Same two settings again, per browser. If you use two browsers, that is two passes.
5. Industry opt-out tools. Run AdChoices and the NAI tool in each browser. Same limitation: per browser.
6. Television and streaming devices. The FTC specifically directs you here. Look for interest-based advertising, viewing data or automatic content recognition in the device’s privacy menu.
7. Social media accounts. CISA’s Module 6 names managing social media settings as one of three core privacy actions. Unlike the rest of this list, these are account settings and do follow you between devices.

The settings that are not per-device

A short list, because it is the exception rather than the rule. Anything stored in an account rather than a browser follows you: social media privacy settings, the advertising preferences inside a large platform account, and the interest categories those accounts maintain about you.

CISA’s Project Upskill privacy module names managing social media settings as one of three core actions precisely because it is account-level work that does not have to be repeated per device. If you are short of time, that is the part with the best ratio of effort to effect.

Everything else in this article is stored locally and has to be repeated. Knowing which is which saves you from redoing work that was already done, and from assuming work was done that never was.

What the sweep does not reach

Data brokers are outside it entirely. The FTC describes people-search sites compiling property records, driving records, voter registration information, criminal records, civil actions and judgments, and birth, marriage, divorce and death records, and buying from other brokers as well. Opting out of ad personalisation has no effect on any of that.

Broker opt-outs are a separate, slower exercise, and the FTC is candid about their limits: information "could re-appear for sale" when public records change, it "may still appear in the reports of your relatives, neighbors, or associates", and opting out "doesn’t delete your information from public records." The FTC’s instruction is to check back periodically rather than treat it as done.

How often to repeat this

• Every new device. A new phone or laptop starts with none of these settings applied.
• After clearing browser data or reinstalling a browser. Cookie-based opt-outs go with it.
• Once a year otherwise. Settings menus get reorganised and new toggles appear.
• After any major operating-system update, spot-check the advertising identifier and a couple of app permissions rather than the whole list.

Sources: FTC — How to protect your privacy online · CISA — Best practices against tracking technologies and spyware · CISA Project Upskill, Module 6 · FTC — What to know about people search sites · FTC — Protecting your privacy online (hub)

Reviewed 27 August 2026 by the CyberArtical editorial team against primary guidance from the FTC and CISA. Security guidance changes over time; where our earlier version of this page said something different, we say so in the article rather than editing it out quietly.