Privacy Dashboard: What ‘Free’ Services Know About You

Additional resource for the lesson “What ‘Free’ Services Know About You” — Online Privacy course

The lesson described the exchange behind “free” services: you get the service, and the service gets data about how you use it. This resource is where you stop taking that on trust. In twenty minutes you will open the privacy dashboard of the service you use most, read the profile it keeps about you, and make one choice about it, which can include carrying on exactly as before.

A. Why this matters

A “free” service still has to be paid for somehow. One common way is advertising, and adverts can be chosen using what a service knows about you. So the service keeps records: what you searched, what you watched, where you were, which apps you signed in to with your account.

None of this is hidden in a legal sense. It is described in privacy policies, and much of it is shown back to you in your account settings. What is usually missing is the moment when you actually look. Reading that a profile exists is one thing. Seeing your own list of interests, some accurate, some out of date and some simply wrong, is another.

This is not about finding something shocking or deleting everything. It is about knowing what you are trading, so that whatever you decide, you decide it with your eyes open.

What the sources say

The US Federal Trade Commission (FTC), the national consumer protection authority, explains that companies track what you do online partly to show you personalised adverts. It also describes third-party tracking, where advertising companies follow your activity across many different sites, and notes that browser and phone settings let you turn off adverts based on your browsing history. You will still see adverts; they simply will not be personalised.

The large platforms now offer tools to see and manage this data. Google’s help pages describe “My Activity” as the place to find and delete your activity, and its advertising controls as the place to choose topics you want more or fewer adverts about. Microsoft describes its dashboard as a set of tools “to view and clear this data and to manage your privacy settings”.

Behind these tools sits a legal right. Under data protection law in the UK (UK GDPR) and the European Union (GDPR), you can ask an organisation whether it holds personal information about you and ask for a copy. The UK Information Commissioner’s Office (ICO), the UK’s data protection regulator, calls this “the right of access”, also known as a subject access request, and notes that “Organisations usually have one month to respond to a SAR.” The European Data Protection Board (EDPB), which brings together the EU’s data protection authorities, adds that there is “no need to justify the request”, and that the first copy must be provided free of charge.

B. Key concepts

Five ideas that turn a settings page into something you can read.

The exchange model

The idea that a “free” service is paid for, at least in part, with data and attention rather than money. Your activity helps the service decide which adverts to show you and how to keep you using it.

Why it matters to you: Once you see it as an exchange, the question changes from “am I being watched?” to “is this a deal I am happy with, for this service?”. That is a question only you can answer, and the answer can differ from one service to another.

Privacy dashboard

The part of your account where a service gathers your activity, your advertising settings, your connected apps and your privacy controls in one place. The name varies: “Data & privacy”, “Privacy”, “Your data”.

Why it matters to you: It is the closest thing to a mirror the service offers. It does not show everything the service knows or infers, but it shows a great deal of what you can see and change.

Activity history

The running record of searches, videos watched, places visited and other actions linked to your account.

Why it matters to you: Histories are the raw material of the profile. On many services they can be paused or set to delete themselves after a period you choose. In a Google Account, for example, this sits under Data & privacy › History settings › Auto-delete, where you choose how long to keep your activity.

Inferred ad interests

The topics a service believes describe you, worked out from what you do rather than from what you told it. This is the “inferred” layer of personal data that earlier lessons in this section introduced.

Why it matters to you: Reading the list shows you how profiling actually works: it guesses, often well, sometimes badly. Google’s My Ad Centre, for instance, lets you choose topics and brands you want more or fewer adverts about, or turn personalised adverts off. With personalisation off, Google says adverts are based on general factors such as the time of day or the page you are viewing.

Your copy of your data

Two related things: the download tool many services offer, and the legal right of access that stands behind it.

Why it matters to you: A download turns “they have my data” from a feeling into a folder you can open. Google’s download tool is called Takeout, and Google points out: “If you download your Google data, it doesn’t delete it from Google’s servers.” Where a service has no download button, a subject access request is the route the law gives you.

C. A practical example: Sara meets her profile

Sara, 28, a teacher, opened the privacy settings of her main account one evening “just to see”. She had used the same account for years, for email, maps, videos and searches, without ever looking at what it kept.

She found her web and app activity switched on and going back years, covering searches, videos watched and places looked up on maps. She found a long list of advertising interests: two that described her well, one about a sport she had stopped years ago, and one about a health topic she had only once read an article about. And she found eleven apps and websites she had signed in to with this account, four of which she could not remember at all.

Her first reaction was unease. Her second was curiosity: why had one article produced an interest that now followed her around?

What changed for Sara

• She set her activity history, and any location history her phone kept, to delete itself automatically after a few months, instead of keeping everything.
• She removed the health topic and the old sport from her advertising interests, and left the two accurate ones, because she found those adverts useful.
• She removed the four connected apps she did not recognise.
• She requested a download of her data, out of curiosity, and spent ten minutes browsing it a few days later.

Then she kept using the service as before. “It feels like a deal I actually agreed to,” she said. Nothing about her habits had to change. What changed was that she now knew the terms.

D. Try it yourself: a privacy dashboard visit (20 minutes)

Five steps, with one service: the one you use most, usually the account behind your phone or your email. Have a pen or a note app ready.

Step 1 — Find the door (2 minutes)

• Open your account settings on that service and look for a section called “Data & privacy” or “Privacy”. On a Microsoft account, the dashboard is at account.microsoft.com/privacy.
• If you cannot find it, search the service’s help pages for “privacy settings” or “download your data”.

Step 2 — Tour the histories (6 minutes)

• Find each history the service keeps: searches and activity, location, videos watched.
• For each one, note three things: is it on or off? How far back does it go? Is automatic deletion available, and for which periods?
• You do not need to change anything yet. Just write down what you see.

Step 3 — Meet your inferred self (5 minutes)

• Open the advertising or personalisation section and read the list of interests or topics.
• Note three that are accurate, one that is wrong or out of date, and the one that surprises you most.
• For the surprising one, ask yourself what you did that might have produced it.

Step 4 — Check the doors you left open (4 minutes)

• Find the list of apps and websites connected to your account, often called “third-party apps”, “connected apps” or “apps and websites”.
• Look for any you no longer use or do not recognise, and ask whether you still want each one linked to your account.

Step 5 — Make one informed choice (3 minutes)

Choose one of these, and only one:

1. Turn on automatic deletion for one history.
2. Pause one history completely.
3. Remove some interests, or turn off personalised adverts.
4. Remove one connected app you no longer use.
5. Request a download of your data, to look at later.
6. Carry on exactly as before, now that you know the terms.

The sixth choice is a real one. The aim of this exercise is not to make you change things. It is to make sure that whatever you do, you have chosen it.

Already covered in the Online Security course

Security and Privacy Settings: The Half Hour Worth Spending
Adds the security side of the same account pages: recovery options, active sessions and login alerts.

Privacy Focused Browser: The Setting You Use All Day
Explains how a browser can limit third-party tracking before data ever reaches a dashboard.

E. Videos, articles and further resources

Institutional sources first, then the platforms’ own help pages. All in English.

Institutional sources

ICO (UK) — Getting copies of your information (SAR)
The UK regulator explains the right of access and how to ask an organisation for a copy of your personal information.
https://ico.org.uk/for-the-public/getting-copies-of-your-information-subject-access-request/

European Data Protection Board — Right of access: guidelines summary
A short summary of what the right of access gives you under the GDPR: confirmation, a copy of the data, and information about how it is used.
https://www.edpb.europa.eu/system/files/2025-09/right-of-access-guidelines-summary_en.pdf

FTC (US) — How Websites and Apps Collect and Use Your Information
How tracking supports personalised adverts, and the settings that give you some control.
https://consumer.ftc.gov/articles/how-websites-and-apps-collect-and-use-your-information

Platform documentation

Google Account Help — Delete your activity
How to find and delete activity in My Activity, and how to set automatic deletion.
https://support.google.com/accounts/answer/465?hl=en-GB

My Ad Centre Help — Get started with My Ad Centre
Choosing ad topics and brands, and turning personalised adverts off.
https://support.google.com/My-Ad-Center-Help/answer/12155154?hl=en-GB

Google Account Help — How to download your Google data
Using Takeout to create an archive of your data, and what downloading does not do.
https://support.google.com/accounts/answer/3024190?hl=en-GB

Microsoft Support — View your data on the privacy dashboard
What Microsoft’s dashboard shows, and how to clear the data on it.
https://support.microsoft.com/en-us/accounts-billing/security/view-your-data-on-the-privacy-dashboard

Links checked in October 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Awareness pillar at level FL2 – Beginner: it turns the exchange model from the lesson into something you have seen for yourself.

Skills

• Finding and reading an account dashboard: histories, ad interests, connected apps, data download.
• Using automatic deletion and personalisation controls on purpose.
• Knowing how to ask an organisation for a copy of your data.

Awareness

• Understanding “free” as an exchange whose terms you can look up.
• Seeing the inferred layer of your data, including its mistakes.
• Knowing that downloading your data shows it to you but does not delete it.

Secure Behaviour

• Making one deliberate choice per visit, rather than many hurried ones.
• Removing connected apps you no longer use.
• Returning to the dashboard from time to time, for example once a season.

G. Questions to sit with

• Which inferred interest surprised you most, and what did you do that might have produced it?
• Does the exchange feel fair to you for this service? Would your answer be the same for another one?
• If you chose to carry on as before, what made that the right choice for you?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. What feeds the profile

• MS5 — Use a privacy-respecting browser such as Firefox or Brave, so that less of your browsing reaches advertising profiles in the first place.

Minimum commitment: set one history to delete itself automatically, or decide consciously to leave it as it is.

2. Connections and access

• R31 — Limit “sign in with” social accounts across unrelated services, and remove connections you no longer use.
• MS11 — Use a service’s mobile website instead of its app, where that works for you, to avoid app permissions.

Minimum commitment: remove one connected app you did not recognise in step 4.

In short

• A “free” service is an exchange: you get the service, and the service gets data about how you use it.
• The privacy dashboard is where you can see that exchange applied to you: histories, inferred interests, connected apps.
• You have a legal right to ask for a copy of your data; downloading it does not delete it.
• One informed choice is enough, and carrying on as before can be one of them.

Related resources in this course

• Your Digital Footprint: Map the Data Traces of One Ordinary Day
• Social Media Privacy Settings: A 10-Minute Visibility Check
• Oversharing Online: What Your Last Ten Posts Really Say

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.