We receive a reminder email from a site we don’t recognize, we click without thinking, and three days later a bank account is compromised. This scenario, common in 2026, illustrates how much personal data protection is no longer just about the privacy settings of a browser. The GDPR still regulates the collection and processing of information by companies, but the threats on the user side have changed in nature.
Infostealers and advanced phishing: the real risks to your data in 2026
Competitors extensively detail how the GDPR works or the obligations of companies. Let’s start from the other end: what concretely threatens an internet user when they open their computer in the morning.
The ENISA Threat Landscape 2026 report, published on September 15, 2026, identifies phishing as the main social engineering technique observed in incidents analyzed in 2025. “Phishing-as-a-service” kits have proliferated, allowing attackers without technical skills to launch credible campaigns in just a few hours.
The other rising threat is infostealers. These malware programs no longer just steal a password. According to the same ENISA report, they now extract credentials, browsing data, multi-factor authentication (MFA) tokens, and session cookies. In practice, even with a strong password and two-factor authentication enabled, an infected device can compromise all your accounts.
We published a supplementary file on personal data on dubraz.com via Blognet News that details the obligations of sites regarding collection and consent.
What this changes on a daily basis: updating the operating system and applications is not generic advice; it is the first line of defense against infostealers. Using a password manager also limits exposure because you no longer type your credentials into a potentially compromised form.
CNIL controls in 2026: recruitment, algorithms, and what it means for users
We often talk about the CNIL as a distant regulator that punishes large platforms. In 2026, its priority control themes touch on sectors that directly concern individuals in their daily lives.
Among the focus areas this year are recruitment and the unique electoral register. In practice, this means that the CNIL checks how employers collect and store candidate data, and how electoral files are managed at the algorithmic level.
For an internet user applying online, the consequence is direct: you can ask a recruiter what data they retain, on what legal basis, and for how long. The right of access and the right to erasure provided by the GDPR also apply to CVs submitted on a recruitment platform three years ago.
Exercising your right of access without waiting for a breach
Most internet users discover their rights after an incident. We can act proactively. Any organization that processes personal data must respond to an access request within a timeframe set by the GDPR.
Here are a few situations where this approach has a concrete impact:
- Check what information a former employer or a temp agency still retains in its files, several years after the end of a contract.
- Request from an e-commerce site the complete list of data associated with your account, including browsing history and advertising preferences.
- Demand the deletion of data on a classifieds platform where you have not been active for a long time.
If the organization does not respond or refuses without a valid reason, the CNIL can be contacted directly via its online complaint form.
Consent to cookies and trackers: what has really changed
We click “Accept All” by reflex. The problem is that this action often allows dozens of advertising trackers to collect browsing, location, and purchasing profile data.
The privacy policy of a site must detail the purpose of each processing and the legal basis used (consent, legitimate interest, performance of a contract). In practice, feedback varies on this point: some sites display compliant banners but link to privacy policies written in jargon that is difficult to understand.
Refusing non-essential cookies should never be more complicated than accepting. This is a principle that the CNIL regularly reminds. If a site requires more clicks to refuse than to accept, it is potentially in violation.
Three reflexes to limit tracking in daily life
- Configure the browser to automatically delete cookies upon closing, which neutralizes most persistent trackers without blocking current browsing.
- Log out of open sessions on sensitive services (banking, messaging, health) after each use, especially on a shared device. This is the most direct defense against session cookie theft by an infostealer.
- Use distinct email addresses for critical services and for signing up for newsletters or promotions, to compartmentalize risks in case of a breach.
Multi-factor authentication: useful protection but not infallible
Everywhere, it is recommended to enable two-factor authentication, and it is a good reflex. Multi-factor authentication blocks the vast majority of unauthorized access attempts via stolen passwords.
The ENISA 2026 report brings a technical nuance: so-called Adversary-in-the-Middle attacks can hijack session tokens in real-time, thus bypassing MFA protection. This type of attack remains more sophisticated than classic phishing, but it is becoming more common through the same “as-a-service” kits.
MFA remains necessary, but it does not replace vigilance regarding links received by email or SMS. A phishing link that redirects to a malicious proxy can capture the MFA token at the very moment the user legitimately authenticates.
The best complement to two-factor authentication remains the combination of a password manager (which refuses to fill out a form on an unknown domain) and an up-to-date operating system (which limits the installation of infostealers). No isolated measure is sufficient: it is the stacking of layers of protection that truly reduces the risk of compromising your personal data.
