free tier · operational reference

Anonymization Tips

Historical reference compiled May2026. Availability reviewed September2026. Provider links, pricing and procedures have not been reverified for this release.

How to limit blast radius when you have to use services.

Date: 2026-05-26 · Status: working-only · Companion to: Data Broker Removal Playbook. The playbook clears the old; this prevents new accumulation.

§1 Core principle

You can't anonymize everything, and you shouldn't try, that's how you get flagged for fraud or locked out of legitimate services. The goal is minimum viable disclosure: give each service the least identifying info that still lets them function, and vary the inputs so a leak from one service doesn't compound across the rest.

Three rules:

Vary inputs per service. Different email, different phone (or virtual number), different name spelling if practical. Then a leak names its source.
Compartmentalize. Personal email never touches a service that asks "what brings you here today?" Loyalty cards never share a password manager entry with banking.
Use real info only where legally required. Check the applicable identity requirements and service terms; this guide does not determine where substitute details are permitted.

§2 Email aliases

The single highest-leverage move. One real mailbox, unlimited aliases that route to it. If service-name-7f3@yourdomain starts getting spam, you know exactly who sold you out, and you can disable that alias permanently in one click.

Tool	Approx cost	Notes
SimpleLogin (now part of Proton)	Free tier (10 aliases) / $30/yr unlimited	Open-source, can self-host. Best overall.
Firefox Relay	Free tier (5 aliases) / $1/mo unlimited	Mozilla-backed, simple.
Apple Hide My Email	Included with iCloud+ ($1/mo)	iOS/macOS only. Per-service unique aliases generated inline.
DuckDuckGo Email Protection	Free	`@duck.com` aliases. Strips trackers from incoming mail.
Fastmail	$50/yr (includes mailbox)	Custom-domain aliases. Wildcard subdomain trick: `*@aliases.yourdomain` catches anything.
AnonAddy / addy.io	Free / $1–3/mo	Open-source alternative to SimpleLogin.

Pattern: pick one. Generate a unique alias per service. Disable on first sign of spam. Never reuse.

§3 Phone numbers

Phone is harder than email because so many services use SMS 2FA, and short-code SMS often won't deliver to VoIP. Workarounds:

Tool	Notes
Google Voice	Free US number. Delivers most SMS but increasingly blocked (banks, some 2FA, government).
MySudo	$1–15/mo. Multiple numbers per account, real-feeling cell numbers. Best for compartmentalized identities.
Hushed / Burner	$4–8/mo. Disposable. Good for short-term needs.
Twilio (direct)	Pennies per SMS, real number, full programmatic control. Geek path.
JMP.chat	$3/mo. Real US/CA number, routes SMS over XMPP/Matrix. Privacy-forward.

Operational tip: use a real cell number ONLY for: bank/brokerage 2FA, doctor's office, the IRS, emergency contacts. Everything else gets a virtual.

Better than virtual for 2FA: app-based TOTP (Authy, 2FAS, Aegis on Android, Raivo on iOS). Doesn't depend on phone number at all. Some services refuse to offer it, those services get a virtual number you can rotate.

§4 Mailing addresses

If a service needs an address but doesn't need your address, give it one that's yours-but-not-where-you-sleep.

Option	Approx cost	Notes
USPS PO Box	$30–200/yr depending on size/region	Cheapest. Can't receive non-USPS packages (no UPS/FedEx).
UPS Store mailbox (PMB)	$20–40/mo	Real street address format, accepts all carriers. Most useful.
iPostal1	$10–40/mo	Virtual mailbox: physical PMB in city of your choice, they scan + forward. Good for travelers.
Earth Class Mail	$20–80/mo	Business-grade virtual mailbox.
Anytime Mailbox	$10–30/mo	Cheap virtual. Many city locations.
Stable	$15–60/mo	Virtual mailbox for businesses.

Pattern: UPS Store PMB for personal use, virtual mailbox if you travel or want a business address in a different city. Use this address for: subscription services, loyalty programs, donations, anywhere "address required" but no physical delivery is needed.

Real home address gets: government, bank, employer, medical, immediate family. That's the list.

§5 Payment

Credit card data is the highest-value PII because it's monetizable directly. Solution: never give a merchant your real card if you can help it.

Tool	How it works	Best for
Privacy.com	Generates virtual debit cards funded from your bank. Merchant-locked, single-use, or limit-locked. Free for personal use.	Subscriptions you might forget about (lock to merchant + low monthly limit = autoshutoff). Trial signups.
Capital One Eno	Virtual card numbers for any merchant. Free for Capital One cardholders.	Daily online purchases on a real card without exposing the real number.
Apple Pay / Google Pay	Tokenizes your real card per transaction.	In-person and supporting online merchants. Merchant never sees your real number.
Issuer virtual cards	Citi, Chase, Bank of America offer this in their apps now.	Same as Eno, depending on your issuer.
Prepaid debit (cash-loaded)	Visa/Mastercard gift cards from a grocery store, paid in cash.	One-time purchases where you don't want any link to you. Note gift cards have $5–7 activation fees.

Pattern for subscriptions: every recurring charge gets a merchant-locked virtual card with a monthly limit slightly above the actual charge. Free trial that says "we won't charge you", virtual card locked to $0.01 limit, so when they try to charge they fail and the service auto-cancels without you having to fight customer support.

§6 Browser hardening

The browser is the leakiest part of your daily stack. Fingerprinting tracks you across services even when cookies are blocked.

Pick a browser

Brave, best default. Built-in tracker block, fingerprint randomization, Tor mode. Recommended for most people.
Firefox + arkenfox user.js, more configurable but you'll fight breakage. For people willing to maintain it.
Mullvad Browser, Tor Browser's fingerprint defenses without Tor. Use through a VPN.

Extensions (regardless of browser)

uBlock Origin in medium mode, blocks 3rd-party scripts by default, you allowlist what you need. Single most important extension.
Firefox Multi-Account Containers (Firefox only), Facebook lives in its own container, Google in another, banking in another. They can't see each other's cookies.
Cookie AutoDelete, wipes cookies on tab close except for sites you allowlist.
CanvasBlocker or JShelter, fingerprint randomization.

DNS

NextDNS ($20/yr), blocks trackers + malware at DNS level across all your devices. Best overall.
Quad9 (9.9.9.9), free, blocks malware DNS.
Cloudflare 1.1.1.1 for Families, free, adds malware/adult filters.

Search

Kagi ($10/mo), paid, no ads, no tracking, much better results. The actual upgrade over Google.
DuckDuckGo, free, ok privacy, mediocre results.
Brave Search, free, independent index, decent results.

§7 Network hardening

VPN, useful for hiding from your ISP, public WiFi, and IP-based tracking. Not useful for serious anonymity (browser fingerprinting still works through a VPN).

Mullvad ($5/mo, accepts cash by mail, no account email needed, they assign you a 16-digit number), gold standard.
IVPN ($6/mo), similar privacy posture, slightly fancier UI.
ProtonVPN ($5–10/mo), Switzerland-based, integrates with Proton mail.

Skip: Nord, Express, Surfshark, they're fine technically but their marketing budgets correlate inversely with their privacy postures.

Tor, for actual anonymity needs (whistleblowing, hostile regimes, evading state-level surveillance). Slow. Not for daily use.

Home network: separate WiFi SSID for IoT junk (TVs, smart bulbs, doorbells) on a guest VLAN. Keeps them off the network with your laptop / phone / files. Most modern routers support this out of the box.

§8 Identity-input variations to fingerprint leaks

When a service requires real info, you can still vary the encoding enough to track which one sold you out:

Name: "Edward J Honeycutt" vs "Ed Honeycutt" vs "Edward Honeycutt Jr", each looks legitimate, each is uniquely yours. When the data leaks to a broker, you can identify which encoding came from where.
Address format: "123 Main St" vs "123 Main Street" vs "123 Main St Apt 4" vs "123 Main, Apt 4", same place, different strings.
Email: always alias-per-service, as above.
Phone: if you can use a virtual, use a different one per category (subscriptions, professional, retail).
DOB: when legally required, give real. When asked but not legally required (loyalty programs, surveys), don't give it at all. If a service requires a birth date, review its purpose and terms before deciding whether to use it.

This is a passive anonymization, you're not hiding, you're tagging. Active hiding (full virtual identity) is for special-purpose use; for daily life, tagging is enough.

§9 What you CANNOT anonymize (don't try)

Trying to anonymize these can land you in fraud or perjury territory:

Banking + brokerage, Patriot Act / KYC. Real name, real SSN, real address.
Real estate ownership, public record by statute. Workaround: hold property in an LLC or revocable trust (LLC name appears on record, not yours).
Vehicle registration, public in most states. Workaround: vehicle LLC, or accept it.
Voter registration, public in most states. Texas has limited exceptions for protected classes (judges, peace officers, family-violence victims).
Court records, public. Federal: PACER. State: per-state portals.
Professional licenses, public. Workaround: list LLC/PMB as the business address.
Tax filings, IRS sees everything. The right anonymization here is to minimize what external services know about your income, not to hide from the IRS.
Property tax records, county-level public. Some counties offer suppression for protected classes.
Medical (with provider), HIPAA protects sharing, but they need real info to bill insurance.

For these, the right strategy is legal entity layering (LLC, trust) and physical-presence separation (PMB on the public-facing forms where allowed).

§10 Identity-theft baseline (do once, forget)

Independent of broker removal, these reduce damage from inevitable future breaches:

Credit freeze at all four bureaus: Equifax, Experian, TransUnion, Innovis. Free since 2018. Unfreeze for 1 day when you apply for credit, refreeze.
ChexSystems freeze: chexsystems.com.
NCTUE freeze: exchangeservicecenter.com.
Password manager: Bitwarden (free, open source) or 1Password ($3/mo). Generate unique 20-char random passwords per service. This kills credential-stuffing attacks dead.
TOTP-based 2FA: Aegis (Android), Raivo or 2FAS (iOS), Authy (cross-platform). Hardware key (YubiKey) for highest-value accounts.
Have I Been Pwned alerts: haveibeenpwned.com, sign up for email notifications on your real address (and aliases that matter). Tells you the day a service you use gets breached.
Free annual credit reports: annualcreditreport.com, weekly under current FTC rules.

§11 Operational discipline

The infrastructure above does nothing if your habits leak:

Loyalty programs / "what's your phone number?" at checkout, say no. If they insist, give 555-867-5309 or a Google Voice number you never check.
"What's your zip?" at gas pumps / retail, 90210 works in most POS systems. They're trying to enrich your spending profile, not verify you.
Social logins ("Sign in with Google / Facebook / Apple"), never. That co-mingles data across services and the broker can correlate by social account ID.
Public WiFi, VPN always. Or hotspot off your phone.
Smart-home devices, segregate to IoT WiFi. Disable cloud features you don't use. Assume the manufacturer is selling the data unless they explicitly say otherwise.
Car infotainment, modern cars sell driving data to insurers. Opt out via the manufacturer's privacy portal. Vehicle Privacy Report (vehicleprivacyreport.com) shows what your car shares.
Photo metadata, strip EXIF before posting (most social media auto-strips; your blog or direct upload doesn't).
Receipts / shipping labels, shred or fully redact before trashing. They have name + address + last 4 of card.

§12 The annual sweep

Pair with the broker playbook's re-sweep cadence (every 6 months):

Re-check what HaveIBeenPwned has on you.
Pull all three credit reports (annualcreditreport.com, free weekly).
Audit your password manager, any old accounts to close?
Audit your virtual cards, any subscriptions to kill?
Audit your aliases, any with so much spam they should be retired?
Check vehicleprivacyreport.com if you've gotten a new car.
Check identitytheft.gov if anything weird showed up.

About 90 min twice a year. Pairs cleanly with the broker re-sweep.

§13 TL;DR (the 80/20)

If you do nothing else from this doc:

Password manager + unique 20-char password per service.
TOTP 2FA via Aegis/Raivo/Authy on every account that supports it.
SimpleLogin (or equiv), never give a real email again.
Privacy.com virtual cards on every subscription.
UPS Store PMB as your "address required" answer.
Credit freeze at all 4 bureaus + ChexSystems + NCTUE.
uBlock Origin + Brave (or Firefox+containers).
HaveIBeenPwned alerts on your real email.

That covers ~90% of the realistic threat model for someone who isn't being individually targeted by a state actor. The rest is hardening for higher threat tiers.

paired companion: see the data broker removal playbook for clearing existing exposure.