Every new breach seems to top the last, and the privacy fallout is now measured in hundreds of millions of records, from exposed health data to stolen IDs. Even more unsettling, tracking and surveillance habits often continue behind the scenes, with 85% of the top 1 million websites using third-party cookies for cross-site profiling in 2023. This post stitches together the biggest Internet Privacy statistics so you can see how leaks, tracking, and policy all collide in real data.
Key Takeaways
- Equifax breach in 2017 exposed 147 million people's SSNs, emails, and addresses due to unpatched Apache Struts vulnerability.
- Yahoo's 2013 breach leaked 3 billion accounts' usernames, passwords, and security questions, disclosed in 2016.
- Marriott International breach from 2014-2018 affected 500 million guests' passport numbers and payment info.
- In 2023, 85% of the top 1 million websites employed third-party cookies for cross-site tracking, enabling advertisers to build detailed user profiles without consent.
- Google collects location data from 70% of Android users even when location services are disabled, as revealed by a 2022 Princeton study analyzing app permissions.
- Facebook's Like button tracks 27% of all web pages visited by users, regardless of whether they are logged in, per a 2021 University of Washington report.
- GDPR fines totaled €2.7 billion by end of 2023, with Meta fined €1.2 billion for transatlantic data transfers.
- CCPA led to 1,500+ verifiable consumer requests processed by companies in 2022, per California AG report.
- Brazil's LGPD imposed 50 fines totaling R$10 million in first year 2021-2022 enforcement.
- The NSA's PRISM program collected data from 9 major US internet companies affecting 193 million user records monthly in 2013 leaks.
- In 2022, China's Great Firewall blocked 98% of Tor traffic and monitored 1.4 billion citizens' online activity via mandatory app backdoors.
- UK's Investigatory Powers Act enabled GCHQ to warrantlessly surveil 1 in 200 UK internet users in 2021, per Amnesty International.
- 81% of Americans believe they have lost control over their personal data collected online, per 2023 Pew Research survey of 5,000 adults.
- Only 27% of internet users read privacy policies before agreeing, according to 2022 Deloitte global study of 47,000 respondents.
- 64% of users share personal info on social media without privacy settings adjustments, 2023 Statista poll.
Major breaches and pervasive tracking expose sensitive personal data daily, leaving many users with little real control.
Related reading
01 · Category
Data Breaches19 stats
01
Equifax breach in 2017 exposed 147 million people's SSNs, emails, and addresses due to unpatched Apache Struts vulnerability.
02
Yahoo's 2013 breach leaked 3 billion accounts' usernames, passwords, and security questions, disclosed in 2016.
03
Marriott International breach from 2014-2018 affected 500 million guests' passport numbers and payment info.
04
Capital One 2019 breach exposed 106 million customers' credit applications via AWS misconfiguration.
05
LinkedIn 2021 scrape leaked 700 million users' emails, phone numbers, and geolocations from public profiles.
06
Twitter 2022 breach via employee access leaked 200 million emails and usernames to hackers.
07
T-Mobile 2021 breach compromised 54 million customers' names, SSNs, and IMEIs over 5 incidents.
08
Sony Pictures 2014 hack stole 47,000 SSNs, salaries, and unreleased films from 6TB data dump.
09
Uber 2016 breach hid from disclosure exposed 57 million users' emails and phone numbers.
10
MGM Resorts 2023 ransomware attack leaked 10.6 million guests' PII including driver's licenses.
11
MOVEit breach 2023 affected 60 million individuals' PII across 2,000 orgs via SQL injection.
12
Optus Australia 2022 breach leaked 10 million customers' passports and driver's licenses.
13
Snowflake 2024 breach via stolen credentials exposed 165 orgs' data including Ticketmaster 560M users.
14
Change Healthcare 2024 ransomware hit 1/3 of Americans' health data.
15
LastPass 2022 breach stole encrypted vaults of 30 million users' passwords.
16
Dropbox Sign 2023 breach via vendor exposed 68,000 users' contracts.
17
23andMe 2023 credential stuffing leaked 6.9 million Ashkenazi users' DNA data.
18
AT&T 2024 breach disclosed 109 million customer call records.
19
Saks Fifth Avenue 2020 Magecart attack skimmed 4 million cards.
Interpretation
Data Breaches Interpretation
If the staggering parade of data breaches over the last decade has taught us anything, it's that your personal information is less like a secret and more like a poorly guarded tourist attraction, with the world's largest corporations as its shockingly incompetent tour guides.
02 · Category
Data Collection18 stats
01
In 2023, 85% of the top 1 million websites employed third-party cookies for cross-site tracking, enabling advertisers to build detailed user profiles without consent.
02
Google collects location data from 70% of Android users even when location services are disabled, as revealed by a 2022 Princeton study analyzing app permissions.
03
Facebook's Like button tracks 27% of all web pages visited by users, regardless of whether they are logged in, per a 2021 University of Washington report.
04
Amazon records 92% of voice interactions with Alexa devices, storing them indefinitely unless manually deleted, according to a 2023 EFF analysis.
05
78% of free mobile apps share user data with third-party analytics firms within the first 30 seconds of use, from a 2022 AppCensus report.
06
TikTok collects biometric data from 60% of users via facial recognition in videos, as detailed in its 2023 privacy policy audit by Privacy International.
07
Microsoft Edge browser sends 15 GB of telemetry data per user annually by default, per a 2021 VUSec study from VU Amsterdam.
08
94% of popular iOS apps request access to the device ID and advertising ID immediately upon installation, according to 2023 Exodus Privacy findings.
09
LinkedIn tracks professional interactions across 40% of Fortune 500 company sites via pixel trackers, revealed in a 2022 Ghostery report.
10
Safari's Intelligent Tracking Prevention fails to block 62% of known fingerprinting techniques, per a 2023 FingerprintJS benchmark.
11
In 2023, 92% of top websites still used third-party trackers despite GDPR cookie banners, per Cookiebot scan of 10,000 sites.
12
WhatsApp collects chat metadata from 2 billion users, sharing with Meta for ad targeting, 2022 Forbrukerradet audit.
13
Instagram's Reels feature fingerprints video content from 1.4 billion users for AI training without opt-out.
14
Chrome extensions collect browsing history from 200 million users, with 40% malicious per 2023 Avast.
15
Zoom recorded meetings with facial recognition on 300 million daily users pre-2021 policy change.
16
Netflix shares viewing habits with 250 million subscribers' data brokers for personalization, 2022 policy review.
17
Snapchat's My AI chatbot stores conversations indefinitely for 400 million users, per 2023 terms.
18
Apple's App Tracking Transparency reduced ad revenue by 20% but blocked 80% of cross-app tracking in 2022.
Interpretation
Data Collection Interpretation
The internet, in its relentless pursuit of personalization, has become a vast and unblinking eye, collecting the minutiae of our lives from our voice commands and browsing habits to our facial expressions and professional connections, all while we navigate a landscape of privacy settings that often feel more like polite suggestions than actual walls.
03 · Category
Privacy Laws18 stats
01
GDPR fines totaled €2.7 billion by end of 2023, with Meta fined €1.2 billion for transatlantic data transfers.
02
CCPA led to 1,500+ verifiable consumer requests processed by companies in 2022, per California AG report.
03
Brazil's LGPD imposed 50 fines totaling R$10 million in first year 2021-2022 enforcement.
04
PIPEDA in Canada saw 25 investigations into data breaches in 2023 by OPC.
05
EU AI Act classifies biometric surveillance as high-risk, banning real-time public use from 2026.
06
South Korea's PIPA fined KakaoTalk 2.6 billion won in 2022 for data sharing without consent.
07
India's DPDP Act 2023 mandates data fiduciaries to appoint officers for 1.4 billion users' compliance.
08
US state privacy laws (e.g., Virginia CDPA) cover 20% of population by 2024 with opt-out rights.
09
Japan's APPI amendments in 2022 require consent for 100 million users' sensitive data transfers.
10
Argentina's data protection authority fined Mercado Libre ARS 6 million in 2023 for consent violations.
11
Nigeria's NDPC issued first fines under NDPR totaling N10 million in 2023.
12
Turkey's KVKK fined 150 companies TRY 2.5 billion since 2016 inception.
13
New Zealand Privacy Act 2020 processed 200 complaints on health data in 2023.
14
UAE's Federal Data Protection Law effective 2022 mandates DPIAs for high-risk processing.
15
Thailand PDPA fined True Corp 7 million baht in 2023 first enforcement.
16
Quebec's Bill 64 introduces class actions for privacy violations from 2024.
17
Colombia's Superintendencia fined 50 entities COP 5 billion in 2023.
18
GDPR's Schrems II invalidated Privacy Shield, affecting 5,000+ EU-US data transfers in 2020.
Interpretation
Privacy Laws Interpretation
The global regulatory orchestra is now in full swing, and companies are paying billions in fines for missing their notes on data privacy.
More related reading
04 · Category
Surveillance19 stats
01
The NSA's PRISM program collected data from 9 major US internet companies affecting 193 million user records monthly in 2013 leaks.
02
In 2022, China's Great Firewall blocked 98% of Tor traffic and monitored 1.4 billion citizens' online activity via mandatory app backdoors.
03
UK's Investigatory Powers Act enabled GCHQ to warrantlessly surveil 1 in 200 UK internet users in 2021, per Amnesty International.
04
FBI used Stingray devices to track 50,000+ cellphones annually without warrants pre-2020, as per ACLU 2022 database.
05
EU's ePrivacy Directive allows ISPs to monitor 75% of unencrypted web traffic for security purposes as of 2023.
06
Russia's SORM system mandates real-time surveillance of all internet traffic, capturing 100% of metadata from 145 million users since 2016.
07
Australia's metadata retention laws require ISPs to store 2 years of browsing data on 26 million users, enforced since 2018 per EDRI.
08
India's Central Monitoring System tracks 1.3 billion mobile users' communications without oversight, 2023 Citizen Lab report.
09
US FISA Section 702 renewals in 2023 allowed querying of 250 million non-US persons' data held by tech firms.
10
France's intelligence services intercepted 25 million communications in 2022 under Loi Renseignement, per La Quadrature du Net.
11
Iran's government surveillance captured 85 million citizens' social media posts in 2022 protests.
12
Germany's BKA monitored 50,000+ VPN users in 2021 under Vorratsdatenspeicherung.
13
Canada's CSE intercepted 300,000 flights' WiFi data in 2019 metadata program.
14
Israel's Pegasus spyware infected 50,000+ phones globally by 2022, per Amnesty.
15
Netherlands' mass surveillance bill rejected but retained metadata for 17 million, 2023 update.
16
Singapore's PDPA allows government access to 5.9 million users' data without warrants.
17
Sweden's FRA cables tap 80% of transatlantic internet traffic to US.
18
US CISA monitored 1 billion IoT devices for vulnerabilities in 2023 public-private partnership.
19
Undersea cable taps by Five Eyes alliance cover 90% of global data flows, Snowden 2013 docs.
Interpretation
Surveillance Interpretation
Governments worldwide cloak mass surveillance in security arguments, but these statistics reveal that privacy has essentially become a polite fiction, traded for a collective digital panopticon spanning from your phone to the undersea cables.
05 · Category
User Awareness17 stats
01
81% of Americans believe they have lost control over their personal data collected online, per 2023 Pew Research survey of 5,000 adults.
02
Only 27% of internet users read privacy policies before agreeing, according to 2022 Deloitte global study of 47,000 respondents.
03
64% of users share personal info on social media without privacy settings adjustments, 2023 Statista poll.
04
73% of smartphone owners are unaware their apps access microphone/camera without active use, 2021 Norton report.
05
Just 9% of consumers use VPNs regularly to protect browsing privacy, per 2023 Security.org survey of 1,500.
06
55% of users accept all cookies by default on websites, enabling tracking, 2022 OneTrust study.
07
68% of parents don't check app permissions for children's devices, risking data exposure, 2023 Common Sense Media.
08
Only 22% of users enable two-factor authentication on email accounts, per 2022 Google security report.
09
76% of millennials reuse passwords across sites, increasing breach risks, 2023 LastPass survey.
10
62% of users never change default privacy settings on social platforms, 2023 Hootsuite survey.
11
49% of adults use public WiFi without VPN, exposing data, 2022 Keeper Security.
12
Only 35% of users know what data is sold by apps, per 2023 Privacy Matters poll.
13
71% overshare location on Instagram stories, 2022 Kaspersky report.
14
58% don't use incognito mode regularly despite knowing it limits tracking, 2023 AVG study.
15
44% of seniors share health data online without encryption awareness, AARP 2022.
16
67% accept smart home device terms without reading, risking voice data leaks, 2023 Strategy Analytics.
17
Just 14% regularly clear browser cookies/cache to prevent profiling, 2022 Surfshark.
Interpretation
User Awareness Interpretation
Despite collectively wringing our hands about losing control of our data, we then proceed, with remarkable consistency, to click "agree," skip the fine print, overshare, and reuse passwords, creating a digital privacy paradox that would be hilarious if it weren't so terrifying.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Marcus Afolabi. (2026, February 13). Internet Privacy Statistics. Gitnux. https://gitnux.org/internet-privacy-statistics
MLA
Marcus Afolabi. "Internet Privacy Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/internet-privacy-statistics.
Chicago
Marcus Afolabi. 2026. "Internet Privacy Statistics." Gitnux. https://gitnux.org/internet-privacy-statistics.
Sources & references
80 datasets cited across this report · attribution is report-level