Free tools versus paid services for a privacy checkup

Free tools versus paid services for a privacy checkup comes down to three jobs: reveal, change, monitor. Free tools built into Google, Apple, Microsoft and Meta accounts do the first two. Paid services mostly monitor data brokers and file removal requests. Buying the third job while skipping the free two is where most disappointment starts.

What to take away

Free tools versus paid services, side by side

Free and paid tools split by what they can touch. Only the service itself can change a setting inside Google, Apple, Microsoft or Meta. Paid services reach data brokers, credit files and breach corpora instead.

Free tools, by name

These are real, current and free. Each does one of the three jobs.

Google Takeout exports everything Google holds about you: search history, location timeline, YouTube watch history, saved passwords, contacts. It is a reveal tool. Reading the archive usually changes how you use the other services. Free with any Google account.

Google Security Checkup shows which devices are signed in, which third-party apps hold access, and which saved passwords appeared in known breaches. It is a change tool: you can revoke access and sign out devices from the same screen. Free.

Apple App Privacy Report (iOS 15 and later, under Settings, Privacy and Security) lists which apps touched your camera, microphone, location and contacts in the last seven days. It is a reveal tool, free with an Apple ID.

Apple Safety Check (Settings, Privacy and Security) reviews and revokes what you shared with people and apps in one pass. It is a change tool, and it is free.

Microsoft Privacy Dashboard (account.microsoft.com) shows the browsing, search and location history tied to a Microsoft account, and lets you clear it. Reveal and change, free.

Meta Off-Facebook Activity (Facebook Settings, Your Facebook Information) shows which apps and websites sent Meta data about you. You can disconnect them from the same screen. Reveal and change, free.

Have I Been Pwned (haveibeenpwned.com), run by security researcher Troy Hunt, checks an email address against known breach corpora. It is a reveal tool, free for individual checks.

Firefox Monitor (monitor.mozilla.org) does the same job against a smaller corpus, with email alerts. Free.

Chrome Password Checkup (passwords.google.com) flags passwords that are reused, weak or found in a breach. It works from your saved list, and it is free.

Bitwarden includes a data breach report powered by Have I Been Pwned on its free tier, plus password storage on unlimited devices. A paid tier exists, but the breach check is not behind it.

Paid services, by name

Paid tools cluster in monitoring and removal. Prices below are published list prices as of 2026; check the vendor's page before buying.

None of these can change a setting inside Google, Apple or Meta. Only the service itself can do that. Every one of them bills yearly, and the removal work stops when the payment does.

The three jobs, in order

Reveal shows what is currently true. Start here, because you cannot fix an exposure you have not seen.

Change alters something: closes a permission, ends a session, deletes a history. The useful ones are built into the service.

Monitor tells you when something happens later. Sales pressure lives here, because a subscription needs a recurring reason to exist.

A good pass uses all three in that order. The regulator's own account of what services collect is the FTC's material on how websites and apps use your information.

Reading a result honestly

A breach monitor tells you only about corpora it can access. Silence does not prove nothing leaked.

A profile preview shows what a signed-out stranger sees, not what a logged-in account or a mutual contact sees.

A permission list shows current grants, not what an app took while it had access.

Treat every green result as "nothing found here", never as "nothing exists". The useful output of a checkup is a short list of changes, not reassurance.

What no tool reaches

Copies other people took are out of your control the moment they were made. Content others published about you belongs to their account and its settings. The fix there is a conversation, not a dashboard.

Information you gave a company that has since been acquired now sits with whoever holds the assets, under whatever policy they arrived with.

This is the argument for the point made on privacy settings: the layer that lasts is what you decided not to publish. Tooling manages the rest.

Before you pay anyone

There is a real category here: services that submit removal requests on your behalf. There is also a large category of businesses that send an alarming message and then sell you the fix.

Most of these sites publish their own removal process. It is slow and tedious and it is free, and doing three of them yourself tells you quickly whether paying for the rest is worth it. What that industry is and how it assembles its records is described in the Wikipedia article on data brokers.

Making the pass repeatable

A checkup is only useful if it happens again. Keep a plain text note with one line per account: what you changed, what you could not find, and the date. Next time the pass takes twenty minutes instead of an afternoon.

Run the account-by-account version in the social media privacy audit. Do the device layer when you move to a new phone. If you publish for a living, the trade-offs differ and are covered in creator privacy settings.

Common questions

Which checkup should I do first?

The password report in your browser or password manager, then the email account behind everything else. Those two produce more risk reduction per minute than everything else combined, for reasons set out in account security.

Is a free tool worse than a paid one?

Not in this category. The most effective tools here are built into the services themselves and cost nothing, because only they can change a setting. Paid tools mostly do monitoring and paperwork.

A service says my data was found in a breach. What now?

Change that password everywhere you used it, starting with anything financial and your email. Do not use links in the notification to get to those accounts. The finding itself is usually old news; the reuse is the live problem.

Can I check what a stranger sees without making an account?

Yes. Open a private browser window, sign out of everything, and search your own name and your usual handle. That is closer to the real answer than most built-in previews, and it costs nothing.