For a lot of people, encrypted and signed DNS, has around 75% of the benefits of a VPN without actually using a VPN.

This is often overlooked but the thing is that most ISPs / countries block websites, log user activity and run traffic interception by changing DNS queries to redirect people to server they control and by simply using any DNS provider that is capable of DoH or DoT you’ll be safer (and yes, enable domain and certificate validations).

Using vpn to avoid Geo blocking and censorship I see as incredibly valid for those that need it.

So, no this might not even be a valid use-case for a lot of people.

Running as much open-sourced privacy oriented software as possible. This includes on computers, routers, and phones. While this is 100% a marathon, not just a quick change, it’s well worth the time. Utilizing an encrypted DNS would be another solid move. NextDNS is a fantastic choice as it has a free option which still provides granular control of what is filtered online. A trusted VPN mixing your internet traffic with others is great, but like you said, it’s not a magic bullet whatsoever.

I think you and your girlfriend should read about “threat modeling”. You need to figure out what you and her are trying to keep private and from whom. Without knowing that, its impossible to say if a VPN is a good solution.

For example if she is trying to hide her web traffic from her ISP then a VPN is a great solution, if she is trying to be annoymous on the web then a VPN won’t do much as you are still easily fingerprintable amongst other things.

People all to often act like privacy is some sort of list of sub items that you can check off like completing a quest in a MMO.

Each individual’s privacy goals are different, privacy is not a one size fits all problem or solution. Your girlfriends needs may be drastically different then your own.

Don’t use any social media, anything google, apple or Microsoft related.

Good luck.

Both of you make valid points. The trouble is that the Internet is getting more complicated and also getting more exploited by corporations, e.g. with the recent addition of the A.I. hype. And all kind of people think that they know the answer but later it turns out that they were wrong (Take for example all the Apple fans years ago thinking that Apple + privacy was a really good way of life). The other trouble is that maybe only a few VPN providers are really trustworthy. And then your browser fingerprint can be unique if you add too many extensions or fiddle with certain settings, which means you are track-able and user profiles can be created. And so on and so forth.

It makes sense to think about what you want to protect and avoid. Here some generic suggestion :

• Get yourself a pi-hole at home for your devices to connect to.
• Limit the amount of Java-Script in your web browsers. Lots of websites will do fine.
• Limit the amount of phone apps usage (like you wrote)
• Use Tor browser (slow) or Mullvad VPN in some cases you want to hide your IP address
• Be weary about default settings of Firefox, take a look at LibreWolf
• Use different browsers for different tasks

Here are some things you can do, roughly ranked:

• Use a password manager
• Assume anything you post/do online/financially can and will be used to build an advertising profile on you and/train AI/be shared with government authorities
• Disable ad personalization/history/sharing of information via privacy settings of mobile phone, mobile apps, Google, Facebook, banks, credit cards, ISP, cellular service, everything
• Turn off third-party cookies.
• Use an ad-blocker on desktop and mobile. They also help prevent a lot of tracking.
• Don’t use Chrome. Consider Firefox/Brave/whatever else
• Avoid using ad-supported services/companies. Consider using paid alternatives. This means using alternatives to Google Search, GMail, Facebook for photos, etc etc.
• Use a profile deleting service like https://monitor.mozilla.org/
• Different browser profiles: general use, Facebook, personal (GMail / Google Docs), and maybe more
• Use a VPN w/ secured DNS
• Many Google accounts: one for general, YouTube, Google Docs/personal, and maybe more
• Use a different email address to sign up for every account. I use StartMail’s aliases
• Don’t use your personal phone number for most things (finance/healthcare excepted). Get another number via a call and SMS forwarding service

I’m also going to add that any online service you sign up for, always check through their privacy settings and make sure the options to not gather data are enabled. Another one is to check through settings for your ISP and cellular plans. Some collect various data to “enhance” services. Lastly I’ll mention that on mobile devices switch to a privacy oriented browser like the recommendations below, and use Progressive Web Apps instead of native apps. These will include the browser’s privacy protections by default.

1. Use different passwords for things
2. Use a password manager
3. Don’t upload all your stuff to Google
4. Switch to DuckDuckGo
5. Install Firefox (or LibreWolf/Fennec) or at least Brave
6. Use Signal

Switch your browser (Firefox or Librewolf) and use uBlock Origin. Tweak settings for privacy and security (check the guide on /c/piracy). Use DuckDuckGo as your default search engine. Remove personal details from social media, especially anything public-facing.

Just my two cents here to mention that it’s necessary to see this as a journey and a mindset, not a single-step or one-size-fits-all panacea.

If she’s annoyed of advertisements creeping up, introduce her to adblockers and slowly make her get used to it. If she has shared concerns after seeing her friends or colleagues receive abusive comments on their social media accounts, comment on the dangers of oversharing one’s private life and its potential consequences and tangible threats, like medical insurance companies abusing the info, and so on.

True! Lots of wonderful comments here.