How to Create a Personal Privacy Threat Model

Not everyone faces the same privacy risks. A domestic violence survivor has different privacy needs than a corporate executive, and a teenager's threats differ from a retiree's. A personal privacy threat model helps you identify your specific risks, understand who might target your data and why, and prioritize the protections that matter most for your situation. Here is how to build one.

What Is a Privacy Threat Model?

A privacy threat model is a structured way of thinking about your personal security. Instead of trying to protect against every possible threat — which is exhausting and impractical — a threat model helps you answer five key questions:

1. What data do I need to protect?
2. Who might want access to it?
3. How could they get it?
4. What happens if they succeed?
5. What am I willing to do to prevent that?

Your answers determine where to focus your time, money, and effort. A threat model prevents you from wasting resources on low-probability risks while ignoring the threats that are most likely to affect you.

Step 1: Inventory Your Sensitive Data

Start by listing the personal information that exists about you. Be thorough:

Identity Information

• Full legal name, aliases, maiden name
• Date of birth and Social Security number
• Driver's license and passport numbers
• Home address (current and previous)
• Phone numbers and email addresses

Financial Information

• Bank account and credit card numbers
• Tax returns and income information
• Investment and retirement accounts
• Property ownership records

Digital Footprint

• Social media accounts and posts
• Online shopping accounts with saved payment methods
• Cloud storage contents (photos, documents)
• Email archives
• Browsing history and search history

Sensitive Personal Data

• Medical records and health information
• Legal records (court cases, arrests, divorces)
• Location data and movement patterns
• Biometric data (fingerprints, face scans)
• Private communications

Step 2: Identify Your Adversaries

Who might want access to your personal information, and why? Your adversaries determine the severity and sophistication of the threats you face:

Low-Sophistication Threats

• Data brokers: Automatically collect and sell your information from public records — the most common and persistent threat for most people
• Marketers and advertisers: Track your online behavior to target ads
• Nosy acquaintances: People who search for your information out of curiosity

Medium-Sophistication Threats

• Scammers and identity thieves: Use stolen data for financial fraud, synthetic identity creation, and account takeovers
• Online harassers: Doxxers, cyberbullies, and organized harassment campaigns
• Ex-partners or stalkers: Use publicly available information to track your location and activities
• Employers or landlords: Search for information that could influence hiring or rental decisions

High-Sophistication Threats

• Nation-state actors: Target journalists, activists, and government employees
• Corporate espionage: Target executives and employees with access to trade secrets
• Organized crime: Target high-net-worth individuals for fraud or extortion

Most people primarily face threats from data brokers, scammers, and identity thieves. Your threat model should reflect this reality rather than preparing for worst-case nation-state scenarios that are unlikely to affect you.

Step 3: Map Your Attack Surface

Your attack surface is the collection of all the ways someone could access your data. Common attack vectors include:

• Data broker sites: Over 4,000 data brokers collect and sell personal information from public records
• Social media profiles: Information you share publicly or with connections
• Data breaches: Compromised credentials from services you use
• Phishing and social engineering: Tricking you into revealing information
• Physical documents: Mail, trash, and documents left unsecured
• Public records: Property deeds, court filings, voter registrations, business licenses
• Infostealer malware: Malware that harvests saved passwords and browser data from your device

Step 4: Assess Impact and Likelihood

For each threat you identified, rate two things:

• Likelihood: How probable is it that this threat will actually materialize? (High, Medium, Low)
• Impact: How much damage would it cause if it happened? (Severe, Moderate, Minor)

Focus your energy on threats that are both likely and impactful. For example:

• High likelihood, severe impact: Data broker exposure leading to identity theft — prioritize this
• High likelihood, minor impact: Targeted advertising — annoying but not dangerous
• Low likelihood, severe impact: Nation-state hacking — devastating but unlikely for most people
• Low likelihood, minor impact: Nosy neighbor looking you up — not worth worrying about

Step 5: Choose Your Protections

Based on your threat assessment, select the protections that address your highest-priority risks:

Essential for Everyone

• Use a password manager with unique passwords for every account
• Enable two-factor authentication on all important accounts
• Remove your data from major data broker sites
• Freeze your credit at all three bureaus
• Review and tighten social media privacy settings

For People With Elevated Risks

• Use a data removal service for continuous monitoring and removal
• Set up dark web monitoring for compromised credentials
• Use a VPN to prevent ISP tracking
• Use email aliases for different services
• Remove your address from property records where possible (use an LLC or trust)

For People Facing Active Threats

• Use hardware security keys instead of app-based 2FA
• Separate your online identity with multiple email addresses and phone numbers
• Use a privacy-focused phone setup
• Consider an address confidentiality program if available in your state
• Engage professional privacy protection services

Step 6: Review and Update Regularly

Your threat model is not a one-time exercise. Review and update it when:

• You change jobs or careers
• You move to a new address
• You go through a major life event (marriage, divorce, having children)
• You receive a data breach notification
• You experience harassment or threats
• New privacy laws or tools become available

Set a calendar reminder to review your threat model at least once a year, even if nothing major has changed.

Put Your Threat Model Into Action

For most people, the single highest-impact action is removing your personal information from data broker sites — the primary source of freely available personal data. PrivacyOn automates this by continuously removing your data from over 100 data brokers and people-search sites, monitoring the dark web for compromised credentials, and providing 24/7 surveillance of your digital footprint. With family plans covering up to 5 people starting at $8.33 per month, PrivacyOn addresses the most common and impactful privacy threat most people face.