https://tosdr.org/

Show them exactly what the company says the collect in plane language not legalese.

I personally like to show how easy it can be to cyberstalk someone.

I pulled up a friend's LinkedIn and pasted their bio text into Google line-by-line until I got a trail to a very old LiveJournal which had links to a NSFW Tumblr (before the purge). What led me there was a phrase that they used frequently in conversation and on the bio. It was their "bone apple tea" moment that made it VERY easy to pin down. I also followed the username trail to some fanart on DeviantArt, and a snapshot of an old website on archive.org.

I present that, then tell them if I can build a profile like this with less than an hour's work, imagine what data processors can do with the amount of data harvested from voluntarily accepting an "invasion" policy, especially if they (the data processors) are able to automatically match speech patterns to users!

Just send them the new report on Nissan of the Mozilla foundation 😂

IMO the problem is rather "What they gonna do with my data? Show me better ads? Nice."

I've met a ton of people that just don't care. The problem often isn't that they don't know companies are collecting a shit-ton of data. That's really not new or isolated to tech companies.

"If I get better ads and it saves me time, what do I care?"
"I'm getting something for free. What does it matter if they know?"

"It's too much work to avoid"

Have them open Google maps if they use it and show them the timeline. That usually freaks people out a bit. Then you can say sites are doing this same tracking with their digital information or something.

If you're willing to spend 40$, various data brokers will sell you all the information people in this thread have mentioned

Facebook Offline Activity page. It displays the activity you have performed on external websites. This was the trigger for me to disable my FB account

If it's worth $3 to you, I recommend "Take This Lollipop".

It used to be free, but I guess they gotta eat too.

It's basically a creepy interactive movie that uses a person's own personal data to scare them about privacy and what they put on the net.

Show them the consequeces. You might scare a few people who are already anxious by showing data collected, but most people will be apathetic. Illustrate why its bad. Be systemic about it.

The stunt outlined elsewhere of texting someone with their info is good, but "we all know google isn't going to threaten us" is the prevailing attitude. Demonstrate what google is going to do and how it hurts people individualy and directly. Until there are personal consequences, peopae won't really care.

John Oliver's Edward Snowden interview where they talk about the fact that the government collects people's dick pics. If that doesn't make them care, nothing will.

Honesty I've kinda given up trying to show normies that privacy is important. And have started to focus on making my own digital life as private as I can. Some will wake up and come ask you, and then you can share what you know with them and help them switch to privacy respecting tech and practises.

For example I recently converted a friend to Linux and they even bought a System76 laptop and has been very happy with it( I'm an old Thinkpad lover).

Or they will simply suffer the eventually inevitable consequences due to how little people care, and how much big companies and governments are willing to take advantage of that.

It's not that I don't think it's a worthy fight and won't continue to at least get called crazy for mentioning that it matters. But don't be surprised how little most people care.

Way back in the early days of Justin/Twitch, if people wouldn't listen about their data security being important, what I did was simply look up their home addresses and phone numbers and texted them the information.

Had them get on fixing their digital footprint quite fast.

I used to have a plugin that mapped how many companies were getting data from the website I was on. I'm not sure if it still exists.

One eye opener that's easily accessible is going into their Facebook third party data agreements. If it's not turned off they'll probably be shocked about how permissive the data is. Just visiting a website can result in a Facebook agreement to share data with that company. It's one of the reasons apps suddenly know random things you were just talking to somebody about. It gets keyed up instantly and they start that whole analysis of shadow profiles stuff industry experts talk about.

Amiunique is a good one that demonstrates how just with the specs of the device you are using (os, browser, screen size, browser version, user agent, color pallette, js engine, language, keyboard type, etc) you can create a totally unique fingerprint that can be used to track you without ever knowing your name, or who you are as a person.

Have them install duck duck go on their phones and turn on the app tracking protection and then they can see the data collected by companies they have never heard of. It will show how they try to collect your full name, email, and exact gps coordinates.

Most people aren't going to care anyway. I do not care whatsoever and I build ELT and ML systems.