The New York-based Committee to Protect Journalists (CPJ) has issued a new safety advisory for journalists around the world to assist them in reducing their exposure to surveillance through digital advertising systems, warning that the technology underpinning targeted online advertising can collect, aggregate, and distribute sensitive information about journalists and other internet users.
In the safety advisory published on August 27, 2026, titled “Protecting against advertising technology,” CPJ said advertising technology, commonly known as “ad tech”, had become a significant source of data about individuals, with information collected through websites, mobile applications, and digital advertising systems potentially being acquired by private companies, governments, and other actors.
The organisation said its research, conducted in collaboration with the Carr-Ryan Center for Human Rights at Harvard Kennedy School, had demonstrated that journalists could be exposed to risks from this mass-surveillance architecture both in their home countries and while living in exile.
It stressed that although structural changes were required to address the underlying surveillance system, journalists could take practical measures to reduce the amount of information collected about them.
A major recommendation is for journalists to disable or limit advertising identifiers on their devices and review privacy and location settings.
The organisation advised Android users to switch off features including ad topics, suggested ads, and ad measurement, while limiting location permissions granted to individual applications, adding that users of Android 12 and later should also delete their advertising ID.
For Windows 11 users, CPJ recommended disabling the computer’s advertising ID, while iPhone and iPad users are advised to turn off app tracking, restrict location tracking, and disable personalised advertising.
It also recommended that journalists should review their Google Account privacy settings, switch off web and app activity where appropriate, disable personalised advertising, and limit connections between their accounts and third-party applications and services.
CPJ said these measures are important because sharing a location with an application could potentially result in that information being shared with third parties, while information gathered through advertising systems can extend well beyond the relationship between the user and the application.
It recommended that journalists use privacy-enhancing browser tools and ad blockers to limit tracking by advertisers and other third parties.
Among the tools highlighted is Privacy Badger, a free browser extension developed by the Electronic Frontier Foundation (EFF), an American international non-profit digital rights organization based in San Francisco, California. The browser extension is designed to block advertisers and other third parties from tracking users across websites.
However, CPJ cautioned that ad blockers generally operate within web browsers and do not necessarily prevent tracking conducted inside mobile applications. It therefore advised journalists to exercise particular caution when downloading applications, especially those that request access to location information.
According to the organization, applications may contain software development kits (SDKs) that collect sensitive information which can subsequently be shared or sold.
It therefore advised journalists to use tools such as Exodus and App Microscope to investigate potential privacy concerns associated with applications before installing them and encouraged journalists to take steps to remove personal information that is already available online.
The organisation recommends the use of free and open-source resources, including its guide to removing personal data from the internet and BADBOOL, a tool for identifying and manually requesting removal of information from data brokers and public databases.
It said that journalists who prefer to use commercial services can also engage private companies that offer data-removal services but cautioned that such companies may take as long as 30 days to remove information.
CPJ stressed that the recommendation is particularly relevant to investigative journalists, human rights reporters, and others whose work may attract unwanted attention, as publicly available information can make it easier for hostile actors to identify journalists’ homes, families, routines, and other sensitive details.
It also recommended that journalists assess how much personal information is publicly accessible, including through tools designed to help individuals conduct their own “doxxing” assessments.
Noting that media houses are increasingly relying on websites, mobile applications, analytics systems, and digital advertising to reach audiences and generate revenue, CPJ advised news organisations to consider conducting privacy and security assessments of the advertising, analytics and other third-party technologies deployed on their websites and applications.
It urged them to establish clear policies governing the use of journalists’ personal devices, location services, applications, and cloud-based services, particularly for reporters working on high-risk investigations.
CPJ advised that the training of journalists in digital security should go beyond passwords and encrypted messaging to include understanding how applications, advertising technologies, location services, and data brokers can expose sensitive information.
It noted that although its advisory provides journalists with practical measures for reducing their exposure, individual action alone could not resolve the underlying problem.
According to CPJ, digital advertising surveillance has become “ubiquitous” and structural change is needed to address the risks associated with the mass collection and distribution of personal information.
The situation, it said, points to the need for stronger regulatory safeguards governing the collection, processing, sharing, and sale of personal data, as well as greater transparency concerning the companies and third parties receiving such information.
CPJ advised that journalists and news organisations requiring specialised advice or training can contact its emergencies team, while additional physical, digital, and mental-health safety resources are available through CPJ’s journalist safety programmes.
