Your Personal Threat Model: How Much Anonymity Do You Need?

Additional resource for the lesson “Your Personal Threat Model: How Much Anonymity Do You Need?” — Online Anonymity course

A personal threat model sounds like something for spies or security teams. In practice it is a short set of everyday questions: what you want to protect, from whom, how likely and how bad a problem would be, and how much effort you are willing to put in. This resource helps you answer them for your own life on a single page, so that the anonymity you choose fits what you actually need, no more and no less.

A. Why this matters

This course is about anonymity: being able to act without what you do being linked back to who you are. It overlaps with privacy, which is deciding what others know about you, and with security, which is protecting your accounts and devices. But anonymity asks its own question every time: what connects this action to me, and do I want that connection?

The answer is not the same for everyone, or even for every part of one person’s life. A teacher, a small business owner and a student who games late at night have different things to protect and different people they would rather not reach. The same person might be happy to be recognised by a supermarket and uneasy about a colleague.

Without a plan, anonymity advice feels like an endless list. With one, you can see which few changes cover what matters to you, and leave the rest alone with a clear conscience.

That is why this resource opens the course: your threat model tells you which of the sections that follow to read first.

What the sources say

The Electronic Frontier Foundation (EFF), a digital rights organisation, builds its online safety guide around a personal security plan. It starts with “What do I want to protect?” and “Who do I want to protect it from?”, then asks how bad the consequences would be, how likely they are, and “How much trouble am I willing to go through”. A final question asks who your allies are. The aim, the EFF explains, is a plan that balances “convenience, cost, and privacy”, and it adds that your plan “can change as your situation changes.”

The same guide is clear that tools come second. One of its pages is headed “Security Is a Process, Not a Purchase”, and warns that “no tool or piece of software will give you absolute protection from surveillance in all circumstances.”

In Europe, the European Commission’s explanation of EU data protection rules draws a line that matters to anyone using a nickname. Data that has been “de-identified, encrypted or pseudonymised but can be used to re-identify a person” remains personal data; only data rendered anonymous, so that the person “is no longer identifiable”, falls outside the rules. France’s data protection authority, the CNIL, takes an everyday angle in its public advice: give as little as possible when you sign up, use pseudonyms and an email address that does not carry your name, and keep different audiences, such as friends, colleagues and family, on different tools.

Anonymity is also a matter of rights. In a 2015 report to the UN Human Rights Council, the Special Rapporteur on freedom of opinion and expression, David Kaye, concluded that encryption and anonymity “enable individuals to exercise their rights to freedom of opinion and expression in the digital age.”

B. Key concepts

Six ideas that turn the planning questions into a plan.

Threat model: your answers, written down

A threat model is simply your answers to those questions, applied to your own life. The Cyber Welfare glossary entry on threat models explains the term in more detail; here the focus is on using it to decide how much anonymity you need.

Why it matters to you: Writing the answers down turns a vague unease into a short list, and shows you where you are already fine.

What you protect: often a link, not a secret

The EFF calls the things you value and want to protect “assets”. For anonymity, the asset is often not a secret at all but a separation: your personal life apart from your work, an opinion apart from your name, a search apart from your everyday profile.

Why it matters to you: Once you see that you are protecting a link rather than a piece of information, the question changes from “what do I hide?” to “what should not be connected, and to whom?”.

From whom: ordinary audiences, not villains

In the EFF’s terms, a person or entity that poses a threat to your assets is an “adversary”. In daily life that rarely means a criminal. It can be an advertising network building a profile, an employer, a parent at the school where you work, or a stranger who types your name into a search engine.

Why it matters to you: Naming the audience tells you which links matter. Keeping something from an advertiser and from a colleague call for different, usually simple, choices.

Likelihood and impact

The EFF describes risk as “the likelihood that a particular threat against a particular asset will actually occur.” Impact is the other half: how much it would matter to you if it did. A likely but harmless link deserves less effort than an unlikely one that would genuinely hurt.

Why it matters to you: Two rough ratings, low, medium or high, are enough to sort your situations. You do not need formulas or numbers.

Pseudonymous is not the same as anonymous

A nickname, a second email address or a separate account gives you a pseudonym: you act under another name. That is useful, but if something can still lead back to you, such as a phone number, a photo, a payment or a detail only you would mention, the link survives. EU data protection law follows the same logic: pseudonymised data that can still be used to re-identify someone is personal data.

Why it matters to you: Knowing which one you have avoids an unpleasant surprise later, and helps you decide whether a pseudonym is enough.

Proportion: every step has a cost

Tools sit on a scale. A private window in Firefox deletes “the browsing history, cookies, and site data from that session” when you close it, but Mozilla is clear that it “doesn’t hide your IP address or your location.” Tor Browser goes much further and hides your IP address (the number that identifies your connection) from the sites you visit, but the EFF notes that browsing “is much slower over Tor, and certain websites may not work at all”, and that signing in still lets a site identify you. Rules on using such tools vary by country.

Why it matters to you: The strongest tool is not automatically the right one. The right one is the lightest choice that covers the situation in your threat model.

C. A practical example: Sara’s three situations

Sara is 28 and teaches at a secondary school. She has never thought of herself as someone who needs anonymity. But three ordinary situations in one month made her stop and think:

• Her personal social media account. When a parent from school sent her a friend request, she realised her account of holiday photos and jokes was easier to find than she had assumed.
• A review under a nickname. After a disappointing weekend course in her town, she wanted to post an honest review on a local forum, without it appearing next to her name when someone searches for her.
• A job search. She is looking at vacancies at other schools and would prefer to tell her head teacher herself, once she has decided.

One Sunday she spent twenty minutes writing a page about them.

What changed when Sara wrote it down

Her page was short. For each situation she noted the five answers:

• Personal account. Protecting the line between her private life and her role at school, from pupils and parents. Fairly likely to be looked for; awkward rather than serious if found. Effort: a few minutes. She made the account private and chose a profile photo that does not show her face.
• Review. Protecting the link between an opinion and her name, from the course organiser and anyone searching for her. Unlikely to matter; mildly uncomfortable if it did. Effort: low. She opened the forum account with a separate email address that does not carry her name, instead of signing in with her social media account, and left out details only she would know. She knows this is a pseudonym, not anonymity, and is comfortable with that.
• Job search. Protecting her plans, from her employer, until she was ready. Unlikely, but the timing mattered. Effort: small habits. She searches on her own phone and home connection, never with a school account or network.

What Sara did not do matters too. She did not install new tools or start using Tor Browser: nothing on her page called for them. She marked two parts of the course to read first: sharing without exposing yourself, and how we are identified online.

D. Try it yourself: write your personal threat model on one page (20 minutes)

Four short steps, on paper or in a note. Do not write down real secrets or passwords: short labels such as “job search” or “holiday photos” are enough.

Step 1 — Choose three situations (4 minutes)

• Think of three moments in an ordinary month when you would prefer something not to be connected to you: an account, a search, an opinion, a place, a purchase.
• Mix them: one account, one thing you share, one thing you look up.
• If nothing comes to mind, note one situation where being recognised is perfectly fine.

Step 2 — Answer five questions for each (8 minutes)

• What do I want to protect? Often it is a link: my name and this account, my work and my private life.
• From whom? Name the audience: an advertiser, an employer, a neighbour, a stranger searching my name.
• How likely is it that they would look for it, or come across it? Low, medium or high.
• How bad would it be if they did? Low, medium or high.
• How much effort am I willing to put in? A few minutes, an evening, or a lasting change of habit.

Step 3 — Sort by likelihood and impact (3 minutes)

• Put a star next to any situation that is high on both, or high on impact alone.
• Situations that are low on both can stay as they are. That is a decision, not a failure.
• For each starred situation, note one ally: a friend, a colleague or a help page you could turn to.

Step 4 — Choose one change and your course map (5 minutes)

• For your top starred situation, write the lightest change that would loosen the link: a separate email address, a private account, a different browser or device for one activity.
• Then mark the parts of the course that matter most to you: how we are identified online; sharing without exposing yourself; your identity in the age of AI; surveillance, censorship and new rules; first steps with Tor Browser.
• Keep the page somewhere you will find it again.

A single page you come back to is worth more than a perfect plan you never write.

Already covered in the Online Security course

Map Your Digital Life: Where Your Protection Really Starts
It maps your accounts, devices and critical accounts from the security side, to decide where protection matters most; this resource asks a different question about the same life: which actions you want kept apart from your name, from whom, and at what cost.

Already covered in the Online Privacy course

Your Digital Footprint: Map the Data Traces of One Ordinary Day
It maps the declared, observed and inferred data that one day leaves behind; this resource uses that kind of picture to decide which links to your identity are worth loosening, and how much effort to spend on each.

E. Videos, articles and further resources

Planning guides first, then European and international sources, then tool documentation. All in English except the CNIL page, which is in French.

Planning your own approach

Electronic Frontier Foundation — Your Security Plan
The planning questions (what you protect, from whom, how likely, how bad, how much effort, who your allies are), with plain definitions of assets, adversaries and risk.
https://ssd.eff.org/module/your-security-plan

Electronic Frontier Foundation — Choosing Your Tools
Why security is a process rather than a purchase, and why no single tool protects you in every situation.
https://ssd.eff.org/module/choosing-your-tools

European and international sources

European Commission — Data protection explained
What counts as personal data under EU rules, and why pseudonymised data that can be re-identified is still personal data.
https://commission.europa.eu/law/law-topic/data-protection/data-protection-explained_en

CNIL (France) — 4 réflexes pour mieux protéger votre identité en ligne
In French: the French data protection authority’s everyday advice on pseudonyms, non-nominative email addresses and keeping different audiences on different tools (2017).
https://www.cnil.fr/fr/4-reflexes-pour-mieux-proteger-votre-identite-en-ligne

UN Human Rights Council — Report of the Special Rapporteur on freedom of opinion and expression (A/HRC/29/32, 2015)
The report by David Kaye on encryption and anonymity as supports for freedom of opinion and expression.
https://digitallibrary.un.org/record/798709/files/A_HRC_29_32-EN.pdf

Tool documentation

Firefox Help (Mozilla) — How Private Windows protect you
What a private window deletes when you close it, and what it does not hide.
https://support.mozilla.org/en-US/kb/common-myths-about-private-browsing

Electronic Frontier Foundation — How to: Use Tor
What Tor Browser hides, what it does not, and its practical costs, such as slower browsing.
https://ssd.eff.org/module/how-to-use-tor

Links checked in November 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Awareness pillar at level FL2 – Beginner: understanding your own situation before choosing any tool.

Skills

• Answering the planning questions for real situations in your own life.
• Rating likelihood and impact roughly, without numbers.
• Telling a pseudonym apart from something closer to anonymity.

Awareness

• Recognising that anonymity needs differ between people, and between parts of one life.
• Understanding that more anonymity has costs in time, convenience and compatibility.
• Knowing that a plan is a snapshot that changes when your situation does.

Secure Behaviour

• Choosing the lightest change that covers a situation, rather than the strongest tool available.
• Keeping contexts you want apart on separate accounts, addresses or devices.
• Rereading your page after a change of job, home or public role.

G. Questions to sit with

• Which part of your life would you most like to keep apart from the rest, and from whom?
• Is there a situation where you have been putting in more effort than your threat model suggests, or less?
• If your situation changed next year, which line on your page would you rewrite first?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Keep your contexts apart

• R31 — Limit social login: each “Sign in with…” joins a new service to an account you already use, which can connect two contexts you would rather keep separate.
• MS6 — Make your social media accounts private when the audience in your threat model, such as colleagues or the people you work with, is one you would rather not reach.

Minimum commitment: choose the one context on your page you most want kept apart, and give it its own email address or account.

2. Keep the plan proportionate

• Start with the lightest change that covers your top situation; add stronger tools only if the page shows a need for them.
• Revisit your threat model when your situation changes: a new job, a move, a more public role.

Minimum commitment: today, set a reminder six months from now to reread your one-page threat model.

In short

• A personal threat model is your answers to a few questions: what you protect, from whom, how likely, how bad, and how much effort you will accept.
• What you protect is often a link, such as your name and an opinion, rather than a secret.
• A pseudonym is useful but is not anonymity; the right tool is the lightest one that fits the situation.
• Your plan changes as your life does, so keep it short and come back to it.

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.