Here’s how privacy works today. You read the policy. You dismiss the cookie banner. You hunt through three settings menus for the opt-out toggle that someone buried on purpose. All of that to exercise a right that should’ve been the default. And while you’re still on the first paragraph of the terms of service, every click, scroll, hover and the exact timing of your keystrokes has already been harvested, packaged and sold. Somewhere along the way I stopped finding that strange, and that bothers me more than the harvesting does.
The defensive playbook is the standard answer. Use a VPN. Block trackers. Stay off social media. Self-host what you can. I do most of this, and I’d recommend it. But there’s a structural flaw in it that nags at me every time I think about it.
Defence means you have to win every round
You can only block what you know about. The widget embedded three layers deep in a page you visited once. The analytics SDK bundled into an app you forgot you installed. The tracking domain that spun up this morning. None of that is on your blocklist yet. The collector only has to slip through once to start building a profile. You have to catch it every time, on every device, forever.
Nobody plays that perfectly. I certainly don’t. Ad blockers work until a site detects them and degrades the page. A VPN hides your IP until fingerprinting routes around it. DNS blocking catches known trackers until tomorrow’s domains show up. On one side sits an industry with billions of dollars of incentive. On the other side, you and a browser extension.
So I keep coming back to a different question. What if you stopped trying to win every round?
Let them collect garbage
Imagine you let the collection happen. The tracker fires, the SDK phones home, the profile gets built. But the profile is garbage. The model trained on your data learns the wrong things. The advertiser bidding on your attention is bidding on noise.
That’s the shift. You’re going to lose the fight to prevent collection eventually, so you stop fighting it and make the collected data unreliable instead. The system still runs. It just captures nothing worth having.
Think of giving a fake name at a coffee shop. The barista still makes your coffee. The loyalty system still logs a visit. But the data point they wrote down points at a person who doesn’t exist. Scale that up and you get data poisoning. You deliberately feed misleading, noisy or corrupted information into the systems that profile you, until the quality drops below the point where anyone can use it.
Old idea. Resistance groups in occupied territory filed false reports and seeded deliberate misinformation to degrade what their occupiers knew. When you can’t stop the surveillance, you can still poison what it learns.
The tools already exist
This is the part that surprised me when I first dug in. None of this is a research curiosity. The tooling ships today, and a lot of it runs in your browser.
AdNauseam clicks every ad it sees, quietly, in the background. To the ad networks you suddenly look interested in baby clothes, retirement homes, skateboards and farming equipment, all at once. Your profile gets so noisy that targeting you becomes pointless. The network still collects its per-click fee, but the advertiser pays for nothing. Google pulled AdNauseam from the Chrome Web Store, which I take as a decent sign that it does what it claims.
TrackMeNot does the same trick to your search history. It fires off random queries in the background, so your real searches sit buried in a pile of fake ones. Same principle as AdNauseam. If you can’t hide the signal, drown it in noise.
Poisoning AI training data
This is where it gets interesting for me, because it lines up with the moment we’re in.
Large language models are trained on enormous datasets scraped off the open internet. Your blog posts, your forum replies, your Stack Overflow answers, the things you wrote about yourself. All of it feeds the pipeline. Nobody asked you. Nobody paid you. And there’s no meaningful way to pull your contribution back out after the fact.
Nightshade, built at the University of Chicago, adds perturbations to images that your eye can’t see. The picture looks identical to you. To a training pipeline it reads as something else entirely. A dog parses as a cat, a car as a cow. Get enough poisoned images into the dataset and the model’s ability to generate certain content degrades.
Glaze, from the same group, targets artists specifically. It wraps a style cloak around artwork so models can’t learn and replicate an artist’s style, while the art still looks unchanged to humans.
Text is the one that gets me, because text is what I put online. If you know your writing is being scraped for training, you can embed adversarial patterns into it. Subtly contradictory claims, carefully built edge cases, statements that mislead in context. All of it can drag down model quality in a specific domain. Some sites have started planting invisible text aimed straight at scrapers, a robots.txt with actual teeth. Researchers have shown that poisoning as little as 0.1% of a training set can measurably hurt performance on targeted tasks. That number is the whole argument. Poisoning a dataset costs you almost nothing, and cleaning it costs them a lot.
Yes, this is sabotage. Read the context.
Some of you are already uncomfortable, and I get it. This looks like vandalism. So let me be honest about the context rather than dodge it.
These companies took your data without asking. They built products worth billions on your creative output, your technical answers, your personal writing, and handed back nothing except “you agreed to our terms.” There’s no honest way to leave that arrangement, so I’ve stopped calling obfuscation an attack and started calling it self-defence.
This is the sovereignty principle applied to data. As I argued in Sovereign Infrastructure, depending on systems you don’t control and can’t inspect is a vulnerability. I self-host for that reason, not because it’s the easy path. The same logic carries over here. If I can’t control whether my data gets collected, I can at least control what it’s worth once it’s been taken from me without real consent.
What this looks like in practice
You can start today. None of this needs a lab.
Browser noise:
- Install AdNauseam to poison your ad profile
- Run separate browsers with different personas for different activities
- Clear all cookies now and then to break tracking continuity
Search pollution:
- Use TrackMeNot to generate background queries
- Spread your searches across engines so no single company holds the full picture
AI training resistance:
- Run any visual art through Glaze before you post it
- Think about what signals your scraped content sends to a model
- Use your
robots.txt, while remembering it’s a request and not enforcement
Infrastructure level:
- Keep a Pi-hole or AdGuard Home for DNS-level blocking as your baseline
- Hand out per-service email aliases, which a catch-all domain makes trivial
- Look at tools like Chaff that generate fake browsing traffic
The obstacles are real
I’d be selling you something if I skipped the downsides, so here they are.
Resource cost. AdNauseam burns bandwidth clicking ads. TrackMeNot generates traffic. You’re spending your own resources to manufacture noise.
Collateral damage. Small publishers who live on ad revenue catch phantom clicks. Those clicks cost advertisers money, which eventually tightens the whole ad market. You might hit people you never meant to hit.
Arms race. Collectors adapt. Google already blocked AdNauseam from the Chrome Web Store. Expect smarter fingerprinting and better poisoning detection over time.
Legal grey areas. Depending on where you live, some of these techniques may brush up against terms of service or computer fraud law. Know your jurisdiction before you act.
Ethical ambiguity. Poisoning LLM training data hits everyone who uses those models, not only the firm that scraped you. That’s a genuine collective action problem, and I don’t have a clean answer for it. It’s also the reason I still hesitate on the text side.
These costs are real. Whether they’re worth paying depends on how much more you value privacy than convenience, and how much collateral damage you’re willing to own.
Closing the gap
Data poisoning isn’t a magic fix, and I wouldn’t trust anyone who sold it that way. It belongs inside a wider strategy that still includes blocking, self-hosting, encryption and pushing for stronger privacy law through actual politics.
What it adds is the thing pure defence can’t give you. Degrading data is cheap for you and cleaning it is expensive for them, and for once you’re on the cheap side. That makes mass surveillance a little less profitable, and it seeds doubt into systems that only work when the data is clean. You don’t have to migrate your whole life to feel it. Pick one tool, run it for a month, and watch what changes.
Hiding was never the only answer to surveillance. The other one is to make the surveillance unreliable, without breaking anything, by feeding it data too noisy to use. I still do the defensive part. I’ve just stopped counting every tracker that slips past it as a loss.