Privacy advice for small businesses usually comes in two flavors: paranoid or useless. This is neither. Here’s what actually threatens a typical office, what changed recently, and the short list of defenses worth your time.

What actually tracks you

Third-party cookies were supposed to die in Chrome. They didn’t — Google reversed course after pressure from the UK Competition and Markets Authority, which had been investigating the Privacy Sandbox proposals. So the tracking cookie ecosystem continues: ad networks building profiles of browsing behavior across sites, including the sites your employees visit on work machines.

But cookies are only one vector. The threats we actually see compromise small businesses:

Phishing links — still the number-one way business data gets exposed. Not sophisticated zero-days; an email that looks like a vendor invoice with a link to a fake login page.
Shortened URLs and QR codes that hide the real destination.
Malicious browser extensions with broad permissions, installed casually.
Data brokers assembling employee and company information from public and semi-public sources.

What to actually do

You don’t need a privacy consultant. You need the basics, done consistently:

DNS filtering at the network level — blocks malicious domains for every device on the network, including the ones nobody manages. This is the highest-leverage single control for a small office.
Password manager + MFA everywhere. Phishing works because people reuse passwords. A password manager makes every login unique; MFA makes stolen passwords useless.
Browser hygiene: uBlock Origin or equivalent, automatic updates, and a policy against random extensions.
Staff training that respects people’s intelligence. The rule we teach: before clicking anything that asks for credentials, payment, or remote access, verify through a separate channel. Check the sender, hover the link, and ask “does this request make sense?” Thirty seconds of skepticism beats any software.
Endpoint protection that’s actually monitored — not the free antivirus nobody looks at.

The honest scope

None of this makes you untrackable, and anyone selling that is lying. What it does: makes your business a harder target than the one next door, keeps employee credentials out of breach dumps, and stops the common attacks — which are, overwhelmingly, the ones that succeed.

We set up DNS filtering, MFA rollouts, and practical security training for LA businesses as part of our cybersecurity work. Start with an assessment — we’ll tell you where the actual gaps are.

Source: UK CMA investigation into Google’s Privacy Sandbox browser changes — gov.uk.