Rethinking Why Privacy Matters

You have probably said or thought one of these sentences before. They don’t mean we don’t care about our privacy: most of the time, we simply don’t see what difference it makes, or what we could do about it. I spent two years answering them with arguments that I now find too abstract. So this article takes these sentences one by one, based on documented cases in Switzerland and Europe: what is collected, what happens to it and what you can still do about it.

How I came to have doubts

Four years ago, I had a Google Nest Audio in my room, a smart speaker with Google Assistant. I controlled about ten devices with my voice: an alarm at 8 a.m., an evening routine, lights that turned on before I had even opened the door, etc. Honestly, it was a convenience I really enjoyed.

Two years later, it clicked during a job in customer service at a bank. To help customers, I had access to their balance, their payments with the amount, place and merchant, their address, their phone number and so on. There was nothing worrying about this access: any bank needs it to take care of its customers and the team I worked with was honest, transparent and genuinely went all out for its users. What made me think was what this said about all the other services. A bank needs this information to do its job. But behind our photos, our files and our emails, there are also people who can technically access them and what they do with them depends to a very large extent on their goodwill and on the rules of each company. So my goal was never to become invulnerable, that would be unrealistic, but to limit this exposure where it was easy.

From there, I took a closer interest in data protection and I realized how much can be collected about us. I also realized that some companies aren’t exactly the type to pass up that kind of opportunity. Around the same time, I was studying in another city and barely used my Nest anymore. So I gave it to my mom and deleted the Google Home app.

Then I went much further. I replaced Gmail, Google Photos, Chrome, Google Maps and then my iPhone with a phone running GrapheneOS. I deleted dozens of online accounts, bought YubiKeys and Faraday bags and paid in cash as much as possible. Today, I have more control over my personal information. I’m not saying this approach is right for everyone and I’ll come back to that.

There is an important distinction here, by the way. The more passionate I became about the subject, the more my approach turned into a personal experiment. Without this interest, I would probably have stopped much earlier.

All this time, whenever I saw someone close to me not caring about their data, I tried to explain why it mattered. I thought I had an obvious answer. While trying to explain it, I realized it wasn’t that simple: several of my own arguments had no real foundation. I ended up asking myself why I had gone all this way and whether these efforts had been worth it.

If I set my passion aside, one question remains: why should someone who doesn’t share this interest care about their privacy online? This article is my answer. To write it, I started by going back over the arguments I used myself.

What are the usual arguments worth?

When you look up why privacy matters, you quickly come across the same answers: democracy, freedom of speech, the risk of a government turning authoritarian. These topics are important. But what’s often missing is the link to what most people experience in their daily lives. Many of these texts also address their readers as if they were all exposed to the same risks.

Maybe you have nothing illegal to hide, you have other priorities, or you don’t see who could be interested in you in particular. These are reactions I’ve often come across. An argument that doesn’t explain how this affects you, specifically, is unlikely to change that.

Looking back at the arguments I used to make with people close to me, I realize that several of them were too hasty. Here are four.

None of these arguments is entirely wrong. What they all have in common is a missing step. A regime that might change, a spectacular abuse abroad, a particularly exposed person: these examples can matter, but the argument still has to show how they relate to your situation, instead of taking that link for granted.

So I’ll hold myself to one simple rule: I won’t ask you to believe in a disaster just because it’s possible. At the same time, I won’t go to the other extreme and assume a precaution only makes sense once something has already happened to you.

I used to think that a possible danger was reason enough to protect my data. Now I’d rather know what actually happens: what is collected, where it ends up and what it’s used for. Let’s start there.

How is your data collected and what happens to it?

Collection starts in very ordinary situations. The examples below come from what companies themselves disclose, not from a list of the worst abuses and they involve services most of us use every day.

• You browse a website that uses Google’s advertising or analytics services. Information about your activity may be associated with your activity on other sites that use these services. So the collection goes beyond the site you thought you were interacting with.²
• You regularly watch someone’s stories, without ever messaging them or liking their posts. Instagram says it uses how often you view an account’s stories to decide which ones to show you first. It also counts plays and replays of a Reel, as well as the time spent watching it. Even this silent viewing is recorded.³⁴
• Someone close to you uploads their address book to Facebook, Messenger or Instagram. Meta may then receive your name, your phone number or your email address, even if you don’t have an account.⁵
• You scan your Lidl Plus card or your Coop Supercard (a Swiss supermarket chain). Both programs link your purchases to your profile. Lidl lists the products, the store, the date, the time and the payment method. The Supercard terms also allow Coop to add information from third parties, such as household size or income bracket.⁶⁷

None of this is probably new to you: companies collect data about us. The real question is what happens to that data afterward.

One investigation offers some insight into this. In January 2025, the German outlet netzpolitik.org reported that it had obtained a free sample of location data from a US data broker, Datastream Group. Free, because it was a sales demo meant to make buyers want to pay for a subscription. The journalists analyzed it with several partner media outlets, including Le Monde and the Swiss public broadcaster SRF/RTS.⁸

380 million

The sample contained 380 million location points from around 40’000 apps, for a single day: July 2, 2024. In Germany alone, it covered around 795’000 phones. Some positions were precise enough to identify a building, others only an approximate area.

Where does this data come from? Part of it seems to come from online advertising. When an app shows you an ad, it passes information about the user to several intermediaries, in automated auctions that last a few milliseconds. This information can then travel all the way to brokers, although the exact path could not be fully traced. Among the apps for which locations appeared (approximate, probably derived from the IP address) were Candy Crush and dating apps such as Tinder. When asked, Tinder said it had no business relationship with this broker. In other words, trusting the company behind an app isn’t enough: it doesn’t necessarily control where the data passing through its advertising intermediaries ends up.⁹¹⁰

This data doesn’t include names, only advertising IDs. Imagine several locations linked to the same code, ABC123. This code makes it possible to connect observations to one another and then a home address or another clue can be enough to identify the person. So an ID in place of a name doesn’t guarantee anonymity.

HomeBowling alleySwiss Museum of Transport

The journalists showed this in practice: Using other datasets, SRF tracked down a Swiss user of Flightradar24, the data showed where he lived, where he went bowling and a visit to the Swiss Museum of Transport. In Germany, a woman from Lower Bavaria who used a weather app was identified through her home address. The data showed that she had gone to a hospital, then to a specialized clinic. She confirmed that the data was indeed hers.¹¹⁹

The investigation doesn’t report any harm suffered by this woman, but it shows that sensitive information about her was for sale.

The problem starts when this data gets combined. On its own, each piece of data seems harmless: it doesn’t really matter if someone knows where you were on Tuesday, or what you bought at Migros (a Swiss supermarket chain). But hundreds of points linked to the same identifier can show where you live, where you work, your habits and sometimes a visit to a clinic. Together, these points reveal much more than any single one of them.

It also matters who the data is shared with and why. Giving your location to a weather app to get the forecast is one thing. Having that same location resold to unknown parties, for other purposes, is another. Researcher Helen Nissenbaum calls this contextual integrity: information is neither “private” nor “public” in absolute terms. It all depends on whether its flow respects the context in which it was shared. Your doctor knows about your health and that’s normal. That doesn’t make it normal for your employer to receive your medical records.¹²

This doesn’t mean that every flow of information requires your consent. Your doctor sends your file to a specialist, your employer reports your salary to social insurance: these transfers have a legitimate reason. The question is whether there is one. Having given information to someone, for a specific reason, doesn’t give just anyone the right to use it for something else.

That’s exactly what happened in the Cambridge Analytica scandal. In 2014, around 270’000 Americans were paid a few dollars to take a personality quiz through an app connected to their Facebook account. The app collected their answers and profile information, such as their birthdate, location and the pages they liked. Facebook’s rules at the time also allowed it to collect the same kind of information about their friends, reaching up to 65 million people who had never taken the quiz. The researcher behind the app used the quiz answers to link likes to personality traits, then estimated the friends’ personalities from their likes alone. These estimates were matched with US voter records for Cambridge Analytica, a political consulting firm that offered to help campaigns decide which ads to show to whom. Information people had shared on Facebook was being used to try to influence them as voters.¹³¹⁴

1 person took the quiz240 people affected

Think of all this data as a pile of documents about you: it covers many parts of your life, keeps growing over time and you don’t know who has access to it or what they might use it for.

Who would be interested in you?

You might be thinking: “But who would care about me? There are far more interesting people than me.” In fact, nobody needs to be interested in you in particular. A system can calculate scores or send out offers at scale. Scammers can launch a fraud campaign without looking at each person individually. You don’t need to be famous or handpicked to be included.

Let’s start with data breaches. Maybe you don’t mind Google, your health insurer or your doctor knowing about your health. But companies regularly suffer data breaches and the question becomes: are you okay with this information no longer being in their hands, but accessible to companies and people you don’t even know exist?

In March 2022, more than 40’000 medical files from two doctors’ offices in Neuchâtel were published on the dark web. Journalists from the Swiss newspaper Le Temps were able to look at them: the files were neither encrypted nor password-protected. They found the patients’ names, addresses, dates of birth, phone numbers and jobs, as well as their conditions and treatments. One patient was identified as HIV-positive, another as suffering from depression after an accident. Some records went back to 1998. One of the offices said it was impossible to contact each patient individually, so many found out from the press that their file might have been leaked. Nobody was interested in these patients in particular: simply having a file there was enough.¹⁵¹⁶¹⁷

Patient fileNeuchâtel, 2022

Name

Address

Date of birth

Phone

Job

Condition

Treatment

Not encryptedNo password

Before everything went digital, accessing a doctor’s records meant going there in person and making this kind of data public would have been very difficult. Today, anyone can break in from anywhere in the world and then share what they find with anyone.

Why does this matter? Because the more someone knows about you, the easier it is to harm, manipulate or influence you.

Take scams. In 2025, the Swiss Federal Office for Cybersecurity received nearly 65’000 reports of cyber incidents, 90% of which came from the public rather than from businesses.¹⁸ The most common were fake police calls (26%), phishing (19%) and investment scams through online ads (9%).¹⁹

The scammers’ method stays the same: gather as much information about you as possible, either through fake bank or insurance websites or by collecting what already exists, such as leaked data. This lets them make their scams much more personal and therefore more convincing. If someone calls you pretending to be your health insurer and mentions your last doctor’s appointment and your current treatment, there’s a good chance you’ll believe them, simply because they know things only your insurer or your doctor are supposed to know. And that’s exactly the kind of information that was in the files leaked in Neuchâtel. That’s the key point: what protects you from a scam is doubt and the more someone knows about you, the less you doubt.

This isn’t limited to scams either. The same logic holds whenever someone tries to influence you, whether to sell you something or to change your mind. For advertising, a study of more than 3.5 million people on Facebook found that ads tailored to their personality, inferred from nothing more than their “likes” (the same method used in the Cambridge Analytica case), could generate up to 50% more purchases. And for opinions, researchers at EPFL in Lausanne had 900 people debate in 2025, either against a human or against GPT-4. Without information about its opponent, the AI was no more convincing than a human. But as soon as it was given six basic facts about the person (age, gender, ethnicity, education level, employment and political affiliation), it beat the human in 64% of cases. With just six pieces of information. The pile of documents about you contains thousands.²⁰²¹

AgeGenderEthnicityEducation levelEmploymentPolitical affiliation

64%of debates with a clear winner were won by GPT-4

To be fair, personalizing a message doesn’t give anyone the power to make you think or buy just anything and an ad that introduces you to a product you really wanted isn’t, in itself, harmful. But an influence can be limited and still deserve a closer look.

Finally, even without any leak, your data can influence decisions made about you that you aren’t even aware of. In Switzerland, credit agencies collect information on how people pay their bills, turn it into a credit score and then share it with other companies.²² If your score is bad, you can be turned down for a phone contract or a payment plan, or asked to pay upfront.²³ One customer found this out in a store, when the salesperson came back to tell her that the payment plan for her glasses had been declined.²⁴ Checking that a customer can pay isn’t abusive in itself. But this score exists, it gets shared and most people have never seen it.²²

None of these examples measures your personal risk. They show one thing: you don’t need to be a target to be affected.

But let’s say none of this ever happens to you.

Why should you care if nothing happens to you?

One person interviewed by SRF said they could live with this collection as long as it didn’t have any negative consequences for them. That’s an important objection and I understand it. We just need to keep in mind that “I can’t see the effect” is not the same as “there is no effect.”²⁵

Maybe you’re also thinking that you have nothing to hide. But private doesn’t mean illegal. Your medical history, your finances, your political views or your relationships aren’t criminal and yet you wouldn’t share them with just anyone. So you may have nothing to hide, but you certainly have things you don’t tell everyone. The patients of the Neuchâtel doctors’ offices had nothing to hide either.

Talking to your doctor about your health, discussing a problem with someone close to you, sharing a photo with a few friends: these aren’t shameful secrets. They’re things you choose to share within a specific relationship, without expecting them to end up available to everyone else. If an intimate conversation is passed on to someone it wasn’t meant for, it doesn’t matter whether that person ever uses it against you. The line has already been crossed.

And even if you personally don’t mind, that doesn’t fully settle the question: some information also involves the people close to you. Most of the people whose data was collected in the Cambridge Analytica case hadn’t taken the quiz. A friend had. What one person agreed to share also exposed information about others.¹³ Think of the photos of young children that parents post on social media. The child hasn’t agreed to it. And once the image is online, nobody controls who picks it up or what they do with it, including for purposes no parent has in mind when posting it.²⁶

Then there’s a subtler effect. Would you talk about a doubt that’s been bothering you the same way in a WhatsApp group of thirty people as in a message to a close friend? Probably not. Who might read what we write shapes what we choose to say. A confidential space lets you choose who you share a doubt or a worry with, which is often what gives you the courage to say it at all.

Whether you realize it or not, you behave differently when you feel watched, even if everything you do is perfectly legal. In 2013, Edward Snowden revealed that US intelligence agencies were conducting mass surveillance of the online activity of millions of ordinary people, both in the United States and abroad. Researchers then compared Google searches in 41 countries before and after these revelations.²⁷ They found that searches on sensitive topics, such as health-related ones, had dropped. Yet the surveillance had been going on before, too. The only thing that had changed was that people now knew they were being watched. And that was enough for some people to stop searching Google for certain health questions, even though there was absolutely nothing illegal about it.

What do you lose by knowing you’re being watched, even when nothing happens? Sometimes, part of your freedom to search, talk or ask for help without wondering what trace it will leave. We can measure a drop in searches, but we can’t know what each person would have wanted to look up. A question nobody dared to ask leaves by definition no trace.

In 2008, Germany required telecom operators to keep records of all their customers’ communications for six months: who contacted whom and when, but not what was said. A poll by the German institute Forsa that same year gives a sense of what this changed: More than half of respondents said they would avoid using the phone or email to contact a psychotherapist, a marriage counselor or an addiction support service. And roughly 1 in 13 said they had already held back at least once from using their phone or email for this reason.²⁸

This reluctance can also follow you into the doctor’s office. In a US study published in 2014, about one in eight adults said they had withheld information from a healthcare provider out of concern for the privacy or security of their records.²⁹ The appointment still happened, but some things went unsaid.

So even before any information is used against you, the fear of what might happen to it can be enough to make you hesitate. And when it comes to asking for help, that hesitation matters.

What can you actually control?

This article might give the impression that I assume you don’t care about your privacy. That’s probably not true. Chances are you’re uncomfortable with the idea of being tracked online and yet, like many people, you click “Accept all” to get rid of the banner. This has a name: the “privacy paradox.”

We value your privacy

This site and our partners use cookies to personalize content and ads and to analyze traffic.

SettingsAccept all

And it has less to do with a lack of interest than with a sense of helplessness. People do care: when researchers tested a banner where visitors had to check the boxes themselves, fewer than 0.1% accepted everything.³⁰ What’s missing is a sense of control: in a 2019 survey across the European Union, only 14% of people felt they had complete control over the information they share online.³¹

People interviewed by SRF put it in their own words. One said they found it hard to picture something as abstract as the buying and selling of personal data.³² Another expressed resignation: it annoyed them, but they no longer thought they could control everything.³³

So you might be thinking that you have no choice but to go along with it reluctantly. You’re partly right: you won’t be able to completely stop this mass data collection. The good news is that you don’t need to and that’s not the goal either. The goal is rather to ask yourself: “Of everything I keep online, what matters most to me?”

This is where we need to come back to a phrase I often hear: “They already know everything about me anyway.” First, who is “they”? A service you gave information to, the companies it works with and a broker that passes it on are not one single actor. Liking a page on Facebook doesn’t mean you’ve agreed to let Cambridge Analytica use it to decide which political ads you see.

Just because one company already has some information about you doesn’t mean you’re fine with others getting it too. Each new recipient raises a new question: why should they have access to it and what can they do with it?

Second, this phrase only looks at the past. Go back to the pile of documents. You can’t delete it, or control who has access to it. But you can fairly easily reduce what gets added to it. Your life changes, some information becomes outdated and that’s your chance to decide what you still want to share. The goal isn’t to become a ghost to Google, but to tell yourself, for example: “I want to change what Google knows about my searches, so I’m switching to DuckDuckGo or Brave Search.” It’s literally a single setting.

Zero risk doesn’t exist and aiming for it would be unrealistic. The patients in Neuchâtel couldn’t have done much to protect themselves. But on the road, you still wear a seatbelt. You can’t avoid every accident, because it may not be your fault. At least, if it happens, you’ve done what you could on your side to limit the damage. The idea is the same here.

This doesn’t mean giving up convenient services. Accepting that a service uses certain information in order to work can be an informed choice. But you still need to understand what you’re giving in return: which data, to whom and for what purposes.

In my photo gallery, I have more than 17’000 photos documenting my travels, my daily life, my girlfriend, my friends, my family, birthdays. Do I want a company to be able to access this database and analyze it, when it documents my entire life and much of the lives of the people close to me? Obviously not. Does that mean I want to give up these photos? No: being able to look at them again and relive those moments is something I value. So the question becomes: is there a way to keep them and keep taking new ones, while making sure only I can access them? Yes and that’s why I switched to an end-to-end encrypted service.

You don’t even need to switch services for this. If you’re an Apple user and back up your photos with iCloud, one very simple step can significantly improve your privacy, with almost no change on your end: turning on Advanced Data Protection. It’s an option offered by Apple that enables end-to-end encryption for several of its services, including Photos, so that you’re the only one holding the key. Your photos stay backed up and synced across your devices, but Apple can no longer see them. Just make sure you’ve set up a recovery key or a recovery contact: since Apple will no longer hold the key, it’s up to you to make sure you don’t lose access.

This example points to something broader. We’ve gotten used to the idea that to store, find, back up and share our photos, messages and documents, the company behind the service necessarily has to be able to read them. That’s not always the case. So the question to ask yourself becomes: does this service really need to read my data to work? Often, the answer is no, whether for your photos, your emails or your files. It’s above all a matter of how services are designed, not a simple choice between privacy and innovation.

That doesn’t mean everyone needs the same precautions. This is what’s called threat modeling: protecting what matters to you, based on your needs and your situation. An undercover journalist inside a criminal group will need to take much stricter measures than you or I would.

But before taking any measures, privacy starts with simply being aware that this collection happens. The first steps come after.

Where should you start?

You might be thinking that you don’t have time for all this. In fact, it takes very little. The first step can be as simple as rejecting cookies. After that, things like using strong passwords, turning on two-factor authentication or adjusting your privacy settings take a few minutes and significantly reduce the risks. And you can go further by replacing, one at a time, your browser, your search engine, your messaging app or your email provider. No need to do everything at once: pick one thing and start there.

Strong passwordsReject cookiesTwo-factorPrivacy settingsBrowserSearch engineMessagingEmail

I understand the urge to put this off: the effort is immediate, while the benefit seems distant and uncertain. After changing a setting, you won’t necessarily notice any difference in your day. And finding out that your data has leaked doesn’t yet tell you what the consequences will be. But there’s a difference between precautions that require daily attention and those you only take once. A setting that limits data collection for good can take just a few minutes and barely changes your habits. Leaked information, on the other hand, can keep circulating and you can’t take it back.

You may also have bigger concerns: your health, your finances, your family. They come first and rightly so. But a successful scam or a hacked account is just one more problem, often a financial one, piled on top of the others.

It’s not about giving up what you use either. You want to keep your Instagram account: that’s understandable and I haven’t deleted mine. But you can set some boundaries around it. Adjust a few settings that reduce what’s done with your data, strengthen your account’s security (a complex and unique password, two-factor authentication) and above all keep in mind that everything you share there, whether posts, stories or private messages, is no longer private and is analyzed by many companies for purposes you no longer control.

“Be careful with your privacy” is too vague to be useful advice. It’s better to start from what you want to protect, then choose the measure that addresses it. Switching search engines changes what Google learns from your searches, not what it already knows from your inbox. End-to-end encryption prevents a service from seeing the content of your photos and files, but it doesn’t protect your account if your password is weak. And a label like “open source,” “self-hosted” or “privacy-friendly” doesn’t tell you, on its own, what a piece of software actually protects.

Switching search engines

Protectswhat Google learns from your searches

Doesn’t changewhat it knows from your inbox

End-to-end encryption

Protectsthe content of your photos and files

Doesn’t changewho can get into your account if the password is weak

“Privacy-friendly”

Sounds likeit protects you

Doesn’t tell youwhat it actually protects

Cost matters too: time, complexity, how easily you can get your data back and what you ask of the people around you. A measure that’s easy to adopt can be worth it even for a small gain. If it makes daily life much more complicated, you need stronger reasons to recommend it. I’ll expand on this approach in a future article, The 20% to Regain 80%.

Finally, some problems go beyond what you can fix on your own devices. The ability to challenge a decision, what companies are allowed to do with your data and the safeguards around surveillance don’t just depend on which app you choose. They’re also shaped by politics. In Switzerland, for example, the Federal Council (the Swiss government) proposed in 2025 to require messaging services to identify their users once they reach 5’000 users. In the European Union, the proposal nicknamed “Chat Control,” put forward in 2022, originally aimed to require messaging services to automatically scan private messages. In late 2025, member states made this scanning optional rather than mandatory. Negotiations are still ongoing. So online privacy isn’t only a matter of individual defense: it also depends on the proposals we support and the people we vote for.³⁴³⁵

And the stakes go beyond your own case. The confidentiality of messaging apps, which these proposals directly affect, is also what allows a source to talk to a journalist. So you benefit from it even without having anything of your own to protect.

That leaves the question this article started with.

Were my efforts worth it?

Partly. Some of my reasons hold up better than others and they don’t all justify the same things.

What I’ve let go of. The idea that every bit of data collected will lead to harm, that everyone is a target or that pointing to one alarming case is enough to justify all my precautions. I’m also letting go of the opposite shortcut: if I don’t see any effect and can’t measure my risk, then there’s no good reason to be careful.

What remains. Documented consequences exist, but they don’t tell the whole story. I don’t need to wait for a scam or a rejected payment plan to care about keeping certain conversations private. I care about being able to choose who I share certain information with and I don’t think it stops mattering where that information goes just because it has left my phone once. I’d also rather use services that can’t read what I give them than rely on their promise not to. My choices can affect other people too and some boundaries have to be defended collectively.

Does this justify everything I’ve set up? No. My Faraday bags, for example, come more from curiosity than from need. And I’ll keep using GrapheneOS because I value the control it gives me and the freedom to experiment, not because I think everyone should do the same. Part of what I do meets specific needs and part of it comes from my interest in the subject.

The convenience I enjoyed with my Nest was real. So is my desire to share less. What’s different now is that I can distinguish more clearly between my own preferences, the documented risks and the limits I think are justified on where our information goes. And if I recommend a precaution, I need to be able to explain what it protects and what it doesn’t change.

Footnotes

1. Council of Europe, European Convention on Human Rights, Article 8: Right to respect for private and family life ↩

2. Google: Privacy Policy ↩

3. Adam Mosseri (Instagram), May 31, 2023: Instagram Ranking Explained ↩

4. Meta, April 2023: New Features on Instagram Reels: Trends, Editing and Gifts ↩

5. Meta: Information for people who don’t use Meta Products ↩

6. Lidl Switzerland: Informations sur la politique de protection des données Lidl Plus ↩

7. Coop, October 2021: Conditions générales de la Supercard Coop ↩

8. netzpolitik.org, January 15, 2025: Databroker Files: Neuer Datensatz enthüllt 40.000 Apps hinter Standort-Tracking ↩

9. Tagesschau, January 15, 2025: Datenhandel außer Kontrolle? ↩ ↩²

10. SRF, January 15, 2025: Spion in der Hosentasche: Tausende Apps verraten unseren Standort ↩

11. SRF, February 12, 2025: Verräterische Apps: die Spur der Datenhändler ↩

12. Helen Nissenbaum, Washington Law Review, 2004: Privacy as Contextual Integrity ↩

13. Federal Trade Commission (FTC), 2019: Opinion of the Commission, In the Matter of Cambridge Analytica ↩ ↩²

14. The New York Times, video, April 9, 2018: How Cambridge Analytica Exploited the Facebook Data of Millions ↩

15. Watson, March 30, 2022: Des hackers diffusent les données médicales de milliers de Neuchâtelois ↩

16. Le Matin, April 5, 2022: Un des cabinets médicaux piratés s’explique ↩

17. ICTjournal, March 31, 2022: Des milliers de fichiers de patients neuchâtelois fuitent sur le darknet ↩

18. Swiss Federal Office for Cybersecurity, February 16, 2026: Rapport annuel 2025 ↩

19. Swiss Federal Office for Cybersecurity, December 30, 2025: Semaine 52 : Des attaques de plus en plus ciblées, complexes et sophistiquées – près de 65 000 annonces faites à l’OFCS en 2025 ↩

20. Salvi et al., Nature Human Behaviour, 2025: On the conversational persuasiveness of GPT-4 ↩

21. Matz et al., PNAS, 2017: Psychological targeting as an effective approach to digital mass persuasion ↩

22. Federal Data Protection and Information Commissioner (FDPIC): Credit and collection ↩ ↩²

23. Moneyland, February 13, 2025: Credit Scores in Switzerland ↩

24. RTS, April 23, 2024: Ni vu ni connu, des sociétés nous donnent une note de bon ou mauvais payeur ↩

25. SRF, video report, February 12, 2025: Verräterische Apps: die Spur der Datenhändler, 04:34–04:45 ↩

26. Child Protection Switzerland: Sharenting : photos d’enfants sur le web ↩

27. Alex Marthews and Catherine Tucker, SSRN, 2017: Government Surveillance and Internet Search Behavior ↩

28. Forsa, May 2008: Survey on telecommunications data retention ↩

29. Agaku et al., Journal of the American Medical Informatics Association, 2014: Concern about security and privacy, and perceived control over collection and use of health information are related to withholding of health information from healthcare providers ↩

30. Utz et al., 2019: (Un)informed Consent: Studying GDPR Consent Notices in the Field ↩

31. European Commission, Special Eurobarometer 487a, June 2019: The General Data Protection Regulation (summary) ↩

32. SRF, video report, February 12, 2025: Verräterische Apps: die Spur der Datenhändler, 02:36 ↩

33. SRF, video report, February 12, 2025: Verräterische Apps: die Spur der Datenhändler, 02:46 ↩

34. Council of the European Union: Preventing child sexual abuse ↩

35. Federal Department of Justice and Police, February 11, 2026: Révision partielle de deux ordonnances d’exécution de la LSCPT (OSCPT, OME-SCPT) : rapport sur les résultats de la consultation, pp. 3, 6–8 and 14 ↩