Protecting Personal Information Online

Protecting personal information online helps families reduce exposure to scams, impersonation, account theft and harassment. This guide explains what counts as personal information, how to share less and what to do after a mistake or breach. It is suitable for parents, teenagers and adults who want practical advice without technical jargon.

What counts as personal information?

Personal information includes names, contact details, photographs, recordings and information that can identify someone indirectly. A location history, device identifier or username may also become identifying when combined with other details. The Data Protection Commission explains personal data and why context matters.

For example, health details, identity documents, financial records and private conversations need particular care. However, seemingly ordinary information can also reveal routines or recovery clues. A pet’s name, birthday and school detail may help someone invent a convincing story about your family.

Why it matters: Protecting personal information online means controlling both what you publish and what you give to services. A private profile alone does not secure your email, prevent scams or control another person’s screenshots.

Protecting personal information online

Before completing a form, ask who needs the information and why. Avoid providing optional details simply because a website asks for them. However, use accurate information where it is necessary for a legitimate service, especially age dependent child protections.

• Avoid publishing full dates of birth, home addresses, identity documents or account recovery details.
• Use a neutral avatar for a child’s profile and avoid revealing usernames.
• Check photographs for uniforms, house numbers, documents and location clues.
• Share travel updates after returning rather than announcing an empty home.
• Ask permission before publishing information about another person.
• Use official organisational channels for school, health or financial information.

Why it matters: A detail that seems harmless by itself can become revealing when combined with other posts. Our Digital Footprint guide explains how to review information already online.

Secure email and other important accounts

The National Cyber Security Centre’s account guide explains passwords, passkeys and additional login protection. Email deserves particular attention because it often receives recovery links for other accounts.

Use strong, different passwords

A long, unique password reduces the damage if another service suffers a breach. A password manager can create and store passwords, but its own access also needs protection.

• Review your most important accounts, starting with email and banking.
• Replace reused or exposed passwords with different strong passwords.
• Protect the password manager with its strongest supported login protection.
• Keep recovery details current and store recovery codes somewhere secure.

Why it matters: Reusing a password can allow one exposed login to affect several services. Changing a password does not remove an active session automatically on every platform.

Use passkeys or additional login protection

A passkey uses a device or security key to authenticate a login. Where supported, it can reduce phishing risk compared with typing a password into a website. If a passkey is unavailable, enable two factor authentication using the strongest suitable option the service offers.

• Open the service’s official account security settings.
• Follow its setup instructions for Passkeys or Two factor authentication.
• Save the recovery information provided.
• Review signed in devices and remove sessions you do not recognise.
• Never share a login code or approve an unexpected sign in request.

Why it matters: Additional protection reduces risk but does not make an account invulnerable. Use our Secure Online Accounts with 2FA guide alongside the provider’s current instructions.

Personal information and account privacy

Protecting personal information online involves several different controls. For example, device permissions govern access to features such as cameras, while account settings govern audiences and contact. In addition, advertising controls address some other uses of information.

• Review camera, microphone, location, photo and contact permissions.
• Remove access that does not match the app’s purpose.
• Check post audiences, followers, tags and messaging options.
• Review linked apps, account connections and cloud sharing.
• Install supported software updates and remove unused browser extensions.
• Use a device lock and take care with shared computers.

Why it matters: A device permission does not control information already uploaded to a service. Use our Children and Online Privacy guide for verified iPhone and Android permission steps.

Personal information and scams

Phishing means using deceptive messages or websites to obtain information or access. Similarly, scams can arrive by text, phone, QR code or social message. However, an urgent tone, familiar logo or correct personal detail does not prove authenticity.

• Stop when a message pressures you to act immediately or secretly.
• Open the organisation’s official app or type its known website address yourself.
• Contact the organisation using a number you already trust.
• Avoid logging in through an unexpected message link.
• Never disclose passwords, payment PINs or one time codes to a caller.
• Reject unsolicited requests to install remote access software.

Why it matters: A padlock or HTTPS protects a connection, but does not prove that a website or seller is trustworthy. The NCSC guidance library provides further cybersecurity advice.

AI voice cloning, chatbots and photographs

AI can imitate a voice or create a convincing image. Therefore, a familiar voice or video is not enough to verify an unexpected request for money. Our family safety word article explains one useful precaution.

• End an unexpected urgent call and contact the person through a trusted number.
• Check the story with another family member before sending money.
• Keep a family safety word private and change it if someone exposes it.
• Avoid entering private documents, identifying school details or other people’s information into a chatbot.
• Review an AI provider’s privacy, retention and training choices before using it.

Why it matters: A friendly chatbot response does not create confidentiality. The DPC’s AI and data protection guidance explains why personal data entered into AI tools requires care.

Browsers, public networks and connected devices

In addition, cookies, extensions and signed in accounts can affect how services connect your activity. Declining optional advertising cookies can reduce some collection, while deleting browsing history mainly affects the local device. Neither action removes every record held elsewhere.

A VPN can protect some network traffic, but it does not make a scam safe or hide what you publish. It also requires trusting the VPN provider. For sensitive tasks, use a trusted connection and the official service, with account security enabled.

Similarly, review smart speakers, cameras, wearables and shared family devices as well as phones. In particular, check recordings, shared users, updates and account access. Before selling or recycling a device, follow the manufacturer’s backup, account removal and reset instructions.

If personal information is exposed

Act promptly, but avoid panic. The next step depends on what you shared, who received it and whether someone still controls the account. Do not pay anyone promising a guaranteed recovery.

• Contact your bank immediately through an official channel if payment details or money are involved.
• Use the provider’s official recovery process for a compromised account.
• Change affected and reused passwords from a trusted device.
• Review sessions, recovery details and email forwarding or filters.
• Tell affected contacts if someone is impersonating you.
• Keep messages, links, dates and reference numbers for reporting.
• Review any sensitive documents exposed and contact the issuing organisation for advice.

Why it matters: Uninstalling an app or deleting a message does not necessarily resolve the underlying compromise. For suspected fraud or crime, use Garda reporting guidance.

Personal information requests and reporting

You can ask an organisation about access, correction or deletion of personal information. The DPC’s right to erasure guide explains that exceptions apply. Keep the request and response, and use the DPC concern process where appropriate.

For intimate images shared without consent or suspected child sexual abuse material, use Hotline.ie. Do not download or circulate sexual images of a child. Report threats or suspected crime to Gardaí, and call 112 or 999 if someone faces immediate danger.

The Coimisiún na Meán reporting guides explain platform reporting routes. For additional family support, use Childline or our Useful Links page.

Protecting personal information online checklist

• Use different passwords or supported passkeys.
• Enable additional login protection and secure recovery information.
• Review device permissions and public profile details.
• Check family photo and location sharing.
• Verify urgent payment requests independently.
• Keep private information out of unnecessary AI uploads.
• Remove unused account connections.
• Know the bank, platform and reporting routes you would use after an incident.

Frequently Asked Questions

Does HTTPS mean a website is safe?

No. It protects the connection but does not establish that a website’s claims, owner or products are trustworthy.

Can a privacy setting prevent every scam?

No. Privacy settings reduce some exposure, while independent verification and account security address other risks.

Should I change every password after one breach?

Prioritise the affected account and any accounts sharing its password. Follow the provider’s verified advice, and check email and account recovery access.

Are AI conversations always confidential?

No. However, data practices differ by service, account and settings. Therefore, check the provider’s information before sharing anything sensitive.

Related CODA Guides

Continue with Social Media Safety Settings for platform controls. Our Resources for Parents and Video Guides offer further family learning.

References

• Data Protection Commission explains personal data: Meaning and examples of identifying information.
• National Cyber Security Centre’s account guide: Plain English account security guidance.
• NCSC guidance library: Official cybersecurity advice and further resources.
• DPC’s AI and data protection guidance: Personal data considerations when using AI tools.
• Garda reporting guidance: Official crime reporting and emergency information.
• DPC’s right to erasure guide: Erasure rights, circumstances and exceptions.
• DPC concern process: How to raise a data protection concern after contacting an organisation.
• Hotline.ie: Reporting suspected illegal online content and intimate image abuse.
• Coimisiún na Meán reporting guides: Platform reporting and complaint guidance.
• Childline: Support for children and young people.

About Children of the Digital Age

Children of the Digital Age provides online safety education and training for families, schools and organisations. Our work brings together practical safety guidance, cybersecurity and cyberpsychology. For education and training enquiries, visit Contact Us.

Send a message

Contact us to discuss education, training or practical guidance for your family, school or organisation. Use emergency and safeguarding services for urgent concerns.

Last updated: 14 October 2026