Data poisoning

Obfuscation works best when three things are true: the collector depends on data you control, your fake data looks like real data, and they cannot easily check it against another source. A made-up birthday on a shopping site usually meets all three. Random search queries sent from your real IP address, in your real browser, at machine-like intervals meet none of them.

Two lessons come up again and again in the research. First, noise ages badly. Whoever collected your data keeps it and can analyse it later with better tools, while you cannot go back and re-poison it; researchers made exactly this argument against photo-cloaking tools (Radiya-Dixit et al., ICLR 2022). Second, protections that introduce contradictions can be detected. The FP-Scanner study found that browser anti-fingerprinting tools could be identified from the inconsistencies they create, and that the original values could sometimes be recovered (Vastel et al., USENIX Security 2018).

• Fingerprinting became acceptable in Google ads. Since 16 February 2025 Google allows organisations to use fingerprinting in its advertising products. The UK data protection regulator called the change "irresponsible" (ICO). Blocking cookies alone now protects you less.
• Firefox added fingerprinting protection. Firefox 145 (November 2025) brought new defences to Private Browsing and Enhanced Tracking Protection Strict mode, which Mozilla says cut the share of users who look unique by almost half (Mozilla).
• Location data leaked through in-app ads. In January 2025, files reportedly hacked from the location data broker Gravy Analytics listed thousands of apps whose users' locations appeared to have been collected through ad auctions (404 Media). See location.
• Art-protection tools were bypassed again. LightShed, presented at USENIX Security 2025, flagged 99.98% of Nightshade-protected images in tests and removed the protection (USENIX). Glaze 2.2 followed in April 2026, adding support for newer NVIDIA graphics cards on Windows (Glaze downloads).
• A little poison goes a long way in AI. A study by Anthropic, the UK AI Security Institute and the Alan Turing Institute found that about 250 malicious documents were enough to plant a simple backdoor in language models of every size tested, from 600 million to 13 billion parameters (Anthropic, October 2025). It concerns attacks on models rather than privacy, and the authors say it is unclear whether it holds for larger models.
• Tarpits for AI crawlers went mainstream. In March 2025 Cloudflare launched AI Labyrinth, an opt-in feature on all plans that sends crawlers ignoring "no crawl" rules into mazes of generated pages (Cloudflare).
• One classic tool ended, another kept going. TrackMeNot's source repository now says the project is not maintained and the extension has been removed from browser stores (GitHub). AdNauseam is still updated; version 3.29.2 came out in September 2026 (releases).

Ad networks build interest profiles from the pages you visit, the ads you are shown and the ads you click. Blocking trackers with a content blocker or a privacy browser (Browsers) removes most of that data at the source and is the better first step. Ad obfuscation adds a second layer: instead of sending nothing, you send clicks on everything, so the click data no longer says what you care about.

The researchers who tested AdNauseam in 2021 could not show whether its clicks change what Google knows about a person, and they called it "a temporary and imperfect defense". Google disputed the test and said it filters most invalid traffic (MIT Technology Review). Treat it as protest with a possible privacy side effect, not as protection.

Ad settings on large platforms

Google, Meta and other large platforms have ad-settings pages where you can limit or switch off personalised ads and remove interests; the options differ by platform and country. That changes which ads you see, not what is collected. Liking or following random topics to scramble your profile works a little, but it also trains the recommendation system to show you those topics, and the platform still has your contacts, location and device data. Limiting personalisation and using the platform less achieves more. On phones, delete or reset the advertising ID and refuse app tracking requests (Mobile OS).

A browser fingerprint is the combination of details your browser reveals to every site: screen size, installed fonts, how your graphics hardware draws images, time zone, language and much more. Together they can recognise a browser without any cookies. There are two defences. Uniformity makes every user report the same values, so you hide in a crowd. Randomisation, which Brave calls "farbling", adds small per-site, per-session changes to those values. Brave's documentation describes this as poisoning the fingerprint so that it cannot be linked across sites (Brave wiki).

Built in beats bolted on. A browser's own protection is shared by everyone who uses that browser and is tested against breakage. An extension changes some values and leaves others alone, and the gaps between them are what detection scripts look for. Explaining why Tor Browser does not let users pick which operating system it reports, the Tor Project notes that "any option to choose would only make users more unique" (Tor Project). The browser guide compares the browsers themselves. The extensions below are for people who must use a browser without strong built-in protection. Never add them to Tor Browser or Mullvad Browser.

Search history reveals health worries, money problems and politics. Query noise tries to bury real searches among automatic fake ones. In practice the noise comes from your browser, IP address and account, it follows machine-like patterns, and your real queries are still stored in full. Even TrackMeNot's FAQ conceded that "with sufficient time and resources, search companies could likely detect a majority" of its fake searches (TrackMeNot FAQ).

It is better not to hand over the history in the first place: use a search engine that does not profile you (Search), stay signed out, and use Tor Browser for searches you would not want tied to your name.

Background browsing generators such as Noiszy, which visited sites you picked to create "meaningless web data", share the same weakness; its website was last updated in 2017 (Noiszy). Against an internet provider watching your traffic, a trustworthy VPN or Tor does far more than noise.

A phone's location history shows where you sleep, work, worship and see a doctor. It leaks through apps you give location access to, and through the advertising systems inside those apps. Files reportedly taken from the data broker Gravy Analytics in January 2025 suggested that much of its location data came from ad auctions inside ordinary apps, likely without the developers knowing (404 Media).

Step 1: make your real location less precise

• Deny location to apps that do not need it. For the rest, allow it only while the app is in use.
• On Android, grant approximate location instead of precise. Google's documentation puts approximate location at about 3 square kilometres (Android developers).
• On iPhone and iPad, switch off Precise Location for each app (iOS 14 and later, Apple).
• Location also leaks through your IP address, nearby Wi-Fi networks and photo metadata. See VPN and Metadata.

Step 2: a mock location, when you need one

Android's Developer options include Select mock location app, meant for testing apps in other places (Android developers). With it, an app can feed the whole phone a position you choose. iPhones have no such setting for ordinary users. A fake location helps in narrow cases, such as an app that refuses to start without location, or a social app you want to use without revealing your neighbourhood. It is not an everyday privacy setting.

Platforms learn far more from what you do than from what you type into your profile: who you message, what you watch and for how long, your contacts, your device and your location. Changing profile details touches little of that. What does help:

• Leave optional fields empty (gender, birthday, employer, school, relationship status). An empty field gives the platform nothing to cross-check, which is better than a false one.
• Give vague but true answers where something is required, such as a region instead of a neighbourhood.
• Limit ad personalisation and remove listed interests. Collection continues, but the most visible use is reduced.
• Separate accounts by purpose. A pseudonymous account with its own email address and browser profile reveals less than a "poisoned" main account (Separate identities).
• Random reactions have been tried as art. Ben Grosser's Go Rando extension picked a random Facebook reaction whenever you clicked Like, to blur your emotional profile (Go Rando). Projects like this tend to break when the site changes.

Decoy profiles and OSINT aggregators

OSINT lookup services such as osint.industries and Epieos take an email address, phone number or username and pull together whatever they can find keyed to it: breach records, data-broker entries and public accounts across dozens of sites. Doxxers and "OSINT-for-hire" use them to confirm an identity quickly. Minimising what is tied to your real email and number is the main defence (OSINT defense). As a secondary and much weaker step, some people register low-value accounts under invented personas on an alias email or number (Email, Phone numbers), so a lookup returns conflicting, low-confidence matches rather than a clean picture.

• Invent the persona. Use a made-up name and details, never a real person's identity. Impersonating someone real is a different thing with its own legal risks, covered under separate identities.
• Keep decoys off anything that matters. They belong on throwaway accounts, never where a name is verified or where false data could be read as fraud (see where false data is off-limits).
• Expect little. Aggregators score confidence and show their sources, so a handful of decoys rarely buries a real, well-sourced record, and heavy seeding can itself stand out.

Photo cloaking against face recognition

Tools such as Fawkes and LowKey add small, invisible changes to photos so that face recognition models trained on them learn the wrong features. A 2022 study concluded that this gives "a false sense of security": the photos stay online, and later models trained to ignore the changes can recognise the faces anyway (Radiya-Dixit et al.). Posting fewer clear photos of your face works better (OSINT defense).

Generative AI models are trained on images and text scraped from the web, often without asking. Artists have responded with tools that alter images before they are posted. Style cloaks such as Glaze make a model misread the style of an image, so fine-tuning a model on your work does not reproduce your style. Poisoning tools such as Nightshade go further: they try to make a model link a prompt with the wrong kind of image, so that training on unlicensed pictures becomes costly. The AI guide covers opting out of AI training where platforms allow it.

The research is discouraging. A 2024 study concluded that "tools based on adversarial perturbations cannot reliably protect artists from the misuse of generative AI", because simple steps such as upscaling weaken them (Hönig et al.). The Glaze team released an update in response and argues that, like antivirus software, protection is an ongoing contest (Glaze). The basic limit is not in dispute: once an image has been downloaded, whoever has it can wait for a better removal method. Treat these tools as a deterrent, post smaller versions of your work, and keep high-resolution originals offline.

If you run a website

Site owners whose pages are scraped by crawlers that ignore robots.txt have options beyond blocking. Cloudflare's AI Labyrinth leads such crawlers into generated pages; Cloudflare says the content is factual but irrelevant, so it wastes the crawler's resources without spreading falsehoods (Cloudflare, 2025). It also means routing your visitors through one large company (Hosting). Self-hosted tarpits such as Nepenthes trap crawlers in endless pages of generated text, but its author warns of heavy CPU load and that a site using it will likely disappear from search results (Nepenthes).

A rule of thumb: noise is fine when the only party affected is a company collecting data it does not need, and you gain nothing at anyone else's expense. It is not fine when someone relies on the information to make a decision, when the law requires it, or when the false data could land on a real person.

• Block and minimise first. Most of the benefit comes from not sending data at all. Noise is a supplement.
• Prefer protection that many people share. Tor Browser's uniform fingerprint, Brave's default randomisation and your phone's approximate-location setting are used by millions. Rare tools make rare users.
• Keep obfuscation boring. A vague birthday on a shopping site is invisible; a browser that changes its identity every few minutes is not.
• Do not mix identities. Noise in an account that also holds your real name, phone number and payment card mostly damages the account, not the link to you.
• Check the result. Look at the ad interests a platform lists for you, and test your browser with Cover Your Tracks.
• Keep a record. Note which details you changed where, in your password manager, so you can still recover your accounts.

• Believing noise hides the signal. Your real searches, clicks and visits are still recorded in full. Noise only helps if it cannot be separated out, and automated noise usually can.
• Stacking tools. Several anti-fingerprinting extensions, or one added to Brave, Tor Browser or Mullvad Browser, contradict each other and make you more unique.
• Spoofing one signal and leaking it elsewhere. A fake GPS position with your home IP address, or a fake time zone with your real language settings, points straight at the truth.
• Poisoning instead of leaving. Filling a profile with nonsense keeps you on a platform that still sees your contacts, messages and devices.
• Relying on abandoned tools. TrackMeNot and Fawkes no longer get updates, and the systems they were built against have moved on.
• Lying where it counts. False data on official, financial or contractual forms can be fraud, and can cost you far more than an account.
• Treating art cloaks as permanent. Anything posted publicly can be reprocessed later with better removal tools.

• Brunton and Nissenbaum: Obfuscation, A User's Guide for Privacy and Protest (MIT Press, 2015)books.google.comThe standard book on obfuscation: history, examples and when it is justified.
• Brunton and Nissenbaum: A political theory of obfuscation (First Monday, 2011)firstmonday.orgEarlier free paper setting out the theory, with examples from radar chaff to BitTorrent.
• MIT Technology Review: testing AdNauseam against Google (2021)technologyreview.comA field test of AdNauseam's clicks by Helen Nissenbaum's research group.
• Vastel et al.: FP-Scanner (USENIX Security 2018)usenix.orgHow inconsistent fake values expose anti-fingerprinting tools.
• Brave: fingerprinting defenses 2.0 (2020)brave.comThe case for randomisation over uniformity, with its stated limits.
• Radiya-Dixit et al.: Data Poisoning Won't Save You From Facial Recognition (2022)arxiv.orgWhy poisoning photos fails against models trained later.
• Anthropic: A small number of samples can poison LLMs of any size (2025)anthropic.comResearch on training-data poisoning from the attacker side.