The scope of personal data protection has shifted. Classic recommendations (strong password, antivirus, updates) remain a foundation, but they no longer cover the most active leakage vectors. The massive use of generative AI tools, the increase in transfers outside the European Union, and the rise in exfiltrations documented by ANSSI require a reassessment of the priority hierarchy to ensure the security of your data and your online privacy.
Data leaks via generative AI prompts: an underestimated vector
Every query sent to a generative AI service can contain personal information, excerpts from internal documents, or identifiers. When the provider reserves the right to reuse queries to train its models, this data is permanently out of the user’s control.
In 2025, the CNIL published specific recommendations on AI and GDPR. It advises pseudonymizing documents before submitting them to a model and prohibiting the sending of confidential data when the service contract does not guarantee their non-reuse. For individuals, this means never pasting a bank statement, an ID, or a medical record into a public chatbot.
We recommend systematically checking the terms of use of the AI service. Two points to verify: the clause on the reuse of prompts for training and the location of processing servers. A comprehensive guide on security on Wiki Dark details the exfiltration mechanisms related to conversational tools.
Local hosting, European cloud, or public service: arbitrate according to data sensitivity
The CNIL now distinguishes three levels of hosting for AI tools, and this reasoning applies to any application processing personal data. The choice of hosting mode directly determines the level of privacy protection.
- Local deployment (on-premise): data never leaves the user’s or company’s infrastructure. This is the most protective option for sensitive information (health, finance, HR data).
- European cloud governed by a GDPR subcontracting contract: the provider contractually commits to location, retention period, and no transfer outside the EU. This is the most common compromise for SMEs.
- Public service (ChatGPT, Gemini, Copilot in free version): guarantees vary according to updates to the terms and conditions. Transfers outside the European Union are frequent and rarely explicitly reported.
Before entrusting personal data to an online service, the relevant question is no longer “Is this service secure?” but “Where is my data stored and who can access it contractually?” The GDPR gives users the right to obtain this information from any data controller.
Increase in data exfiltration: what the ANSSI 2025 Panorama reveals
The 2025 Cyber Threat Panorama published by ANSSI reports a significant increase in incidents related to data exfiltration compared to 2024, while the overall volume of confirmed incidents remains almost stable. This discrepancy has a direct implication: attackers are increasingly targeting data theft rather than system disruption.
For an individual, this changes the defense strategy. Ransomware is immediately detectable (encrypted files, ransom demand). Silent exfiltration can go unnoticed for months. The stolen data then fuels personalized phishing campaigns or identity theft.
We observe that the most effective preventive measures against exfiltration are rarely those highlighted in public guides:
- Enable login notifications on each critical service (email, banking, cloud). A login from an unusual device or location should trigger an alert.
- Segment your email addresses: one address for financial services, one for social media, one for occasional registrations. In case of a leak, the exposure surface remains limited to a single perimeter.
- Regularly check if your credentials appear in compromised databases, using services like Have I Been Pwned.
Web privacy: beyond the VPN
The VPN encrypts traffic between your device and a remote server. It masks your IP address from the visited sites. However, it does not protect against fingerprinting (browser fingerprint), tracking by third-party cookies, or data collection by applications installed on your phone.
A VPN combined with a browser that is not configured to block trackers leaves a footprint almost as identifiable as browsing without a VPN. Online privacy protection relies on a set of complementary settings: disabling third-party cookies, blocking fingerprinting, and restricting application permissions.
On the phone side, the CNIL reminds us that each application requesting access to GPS, the microphone, or contacts must justify this access for a specific purpose. Refusing unnecessary permissions reduces the amount of personal data collected in the background, often without the user’s awareness.
GDPR rights: concrete levers still underused
The right of access, the right to erasure, and the right to data portability have existed since 2018. Their use remains marginal among individuals. Exercising your right of access with a service allows you to see exactly what information is held and with whom it has been shared.
The right to object to profiling, provided for in Article 21 of the GDPR, allows any user to refuse that their data be used to build an advertising or behavioral profile. This right is exercised by a simple written request to the data controller, who has one month to respond. In case of no response, the CNIL can be contacted directly online.
Data security and online privacy protection are no longer limited to basic digital hygiene. The regulatory framework offers precise legal tools, and current threats require combining them with informed technical choices regarding hosting, encryption, and segmentation of digital identities.
