Back to Blog overview

Privacy creep: what it is and why it matters

EU privacy
Big tech privacy concerns illustration

Reading time: 8 min.

I had already read the policies. I read the cookies, trackers, consent banners, dark patterns. The usual sludge we get daily when browsing the internet.

Then I put Pi-hole (a great tool to track your internet traffic) on my own router and watched what happened.

That was the moment the whole polite lie collapsed.

Because the problem was never just cookies. The problem was that social media companies and Big Tech had quietly trained people to accept constant reporting, constant tracking, and constant behavioral extraction as the normal price of using the internet (You can get a rough version of the same shock with RethinkDNS on your phone: try it here for Android: https://rethinkdns.com/ ). You do not need to be deeply technical. You just need to see how much ordinary digital life keeps trying to phone home.

I was not looking at one rogue app acting badly. I was looking at a business model: endless background chatter, telemetry, analytics, tracking calls, third-party requests, and little scraps of data peeled off from normal activity and sent away as if that were some natural law of computing.

It is not.

It is a choice, repeated over and over again by the companies that own the platforms too many businesses still treat as home. If you want the longer version of that argument, see why LinkedIn’s browser scan should worry every professional.

Privacy creep stopped being abstract on my own network

Privacy creep is the slow normalization of invasive behavior by companies. One more cookie. One more tracker. One more partner integration. One more "optional" setting that is only optional on paper. One more platform asking to know a little more than it needs.

That is how the boundary moves. Not all at once. Just often enough that people adapt to the new baseline and stop noticing the drift.

That is why should be aware that privacy creep exists. It is not a dramatic hack. It is a gradual expansion of what platforms expect to collect, infer, and retain.

The fairy tale was cookies. The real story was surveillance.

For years, people were sold a childish version of the privacy debate. The story went like this: privacy means cookies, cookies mean banners, banners mean click accept and move on.

That was always nonsense.

The real story lives in privacy policies, ad systems, partner integrations, tracking pixels, inferred interests, device identifiers, off-platform activity matching, and the growing habit of treating user behavior as raw material for machine learning and ad targeting.

That is why this is not only a privacy issue. It is also a website issue. A business issue. A control issue. The more your business depends on those platforms, the more your business depends on companies whose stated policies make it very clear what they think users are for.

That is also why clean site structure matters. If you want the opposite of platform dependency, start with a site that is fast, readable, and easy to own. The argument in why a fast website matters fits neatly here.

The look into policies

But do not take my word for it, the policies the big tech states in small letters which you click away and do not read, say it all.

LinkedIn still likes to cosplay as the respectable network. But its own privacy materials say it uses service activity, search history, content you read, page visits, videos you watch, ad clicks, partner data, and inferences including age, gender, industry, seniority, compensation bracket, interests, and traits. LinkedIn’s current policy also says it may use personal data to develop and train AI models. Its ad help materials explicitly mention inferred gender, age range, interests, and traits such as expat, frequent traveler, and job seeker. That is not some clean little professional directory. That is behavioral profiling in a suit. (LinkedIn Privacy Policy)

. See also my previous post on LinkedIn's "Browsergate".
Zoomed detail of privacy tracking

Meta is the same machine with a louder logo. Its help pages say businesses and organizations share information with Meta about interactions people have with them outside Meta’s platforms. Its 2025 EU AI announcement also made it clear that public content shared by adults and people’s interactions with Meta AI could be used for training, unless users objected. That is the core trick. Make the platform feel social, then turn everything around it into intake. (Meta help page)

TikTok’s EEA privacy policy is unusually blunt. It says TikTok collects device and network information including device model, operating system, keystroke patterns or rhythms, IP address, system language, and device settings. It also says advertisers, measurement partners, and other partners share information about actions taken outside the platform, including activity on other websites and apps or in stores, plus identifiers used to match that off-platform behavior back to TikTok accounts. That is not a cute video app. That is a surveillance system with better music. (TikTok Privacy Policy)

X does not even bother pretending to be modest anymore. Its privacy policy says it collects device and advertising ID, operating system, carrier, language, memory, apps installed, battery level, location information, and log data even when you are signed out. It also says it may associate your account with browsers or devices other than the ones you used to sign in, and may infer your identity when you access X without being signed in. That is not using a social network. That is being reconstructed across contexts whether you asked for that or not. (X privacy policy)

Snapchat hides the same appetite behind softer colors. Snap’s own data-use material says it may process hardware model, operating system version, device memory, advertising identifiers, apps installed, browser type, keyboards installed, battery level, network data, location information, cookies, pixels, and other identifiers. The same material says inputs and outputs for AI features can include text, images, video, audio, precise location, engagement, and content shared with My AI. Playful interface. Industrial intake. Same story. (Snap data-use page)

Zoomed detail of privacy creep

Does Europe say anything about it?

Yes. And the important part is not that Europe treats privacy as a siloed legal topic. It treats privacy, disclosure, and interface design as connected problems.

That matters because the fight is rarely about whether a platform collects something. It is about whether the user can understand what is happening, find the control, and make a real choice without being pushed through friction.

That is where the bridge to WCAG becomes useful. Not because WCAG is a privacy law, but because both conversations ask the same practical question: is the interface understandable, transparent and operable for a real person?

If you want the formal accessibility and compliance side of that discussion, the WCAG and European Accessibility Act checklist is the practical companion piece.

Why privacy and WCAG belong in the same conversation

When privacy choices are scattered across settings, regional notices, help pages, ad dashboards, and vague labels, that is not meaningful control. It is camouflage.

WCAG 2.2 still rests on the principle that interfaces should be understandable and operable. The point is simple: if the user cannot find, understand, and use the control, then the control is not really serving the user.

That is why this is a design problem as much as a policy problem. A confusing privacy flow is often an inaccessible privacy flow. Once the interface is built to nudge instead of inform, the user is no longer making a clean choice.

The same logic shows up in the rest of your site strategy too. If you want the performance angle, why a fast website matters fits naturally here. If you want the ownership angle, why lean code wins and the hidden costs of free website builders both support the same point.

Why this matters for entrepreneurs

This is the bridge back to your own website.

Most entrepreneurs are pushed toward platform dependence because it is sold as convenient. Build your audience on LinkedIn. Get leads through Instagram. Stay visible on Facebook. Post on TikTok. Keep a profile on X. Maybe throw in Snapchat if the demographic looks young enough.

That advice is not a serious strategy.

Those companies are not helping you build an asset you own. They are helping you decorate a rented corner inside systems built to profile people, shape behavior, and tighten dependency.

So the lesson is not “leave the internet.” The lesson is much more practical. Use social media companies as distribution channels if you need them. Fine. Extract reach where you can. But do not build your actual business on land owned by companies whose own policies keep expanding what they can collect, infer, combine, retain, and now train on.

Your website is different.

Your website is where you set the terms: your domain, your forms, your structure, your copy, your customer path, your analytics choices, your contact flow, your actual authority.

If you want the business case for that ownership-first approach, the same logic runs through the hidden costs of free website builders and why a fast website matters.

That is why I build websites.

Not because websites are nostalgic. Not because social media is evil in some cartoonish way. But because a business that lives entirely inside Big Tech platforms does not really own its online presence. It borrows visibility from companies that can change the rules, squeeze the reach, expand the tracking, and call all of it innovation.

If you want a site that puts you back in control, start with services, compare plans, or get in touch. For a quick estimate, use the website quote form.

Summary

Privacy creep is social media companies and Big Tech normalizing surveillance so thoroughly that people start calling it "convenience".

I did not really feel the scale of that until I watched my own internet traffic and saw how much digital life now behaves like an informant.

That is exactly why I push businesses toward their own websites.

Because the more your business depends on platforms built to watch, profile, and extract, the less of your business you actually own.

You are not building on neutral ground.

You are building inside somebody else’s machine when you rely on those companies.

Sources

Sharing is caring!
What will my new personalised website be like? 🤔