Travel privacy and digital security: Wi-Fi, device searches, SIM cards, and location sharing

by

Last reviewed July 2026

Digital privacy rules for travelers change often and vary enormously by country, which makes this one of the harder travel topics to write anything durable about. What follows focuses on how each risk actually works and where to check current, authoritative rules, rather than a snapshot of specific regulations that will likely be outdated by the time you read this.

Public Wi-Fi: real risk, but not the one most articles describe

Public Wi-Fi earned its dangerous reputation years ago, when a large share of web traffic was unencrypted and anyone on the same network could read it with basic tools. That’s changed. Most web traffic today runs over HTTPS by default, which encrypts the connection between your device and the site you’re visiting, closing off a lot of the classic risk.1 The remaining real risks are narrower: “evil twin” networks that impersonate a legitimate hotspot’s name to intercept traffic before encryption applies, older apps or devices that still send some data unencrypted, and plain physical risks like shoulder-surfing or device theft in a crowded space.2 A VPN adds a genuine layer of protection against network-level snooping and masks your traffic from the network owner, but it isn’t the total solution some VPN marketing implies, and a free VPN has its own data-logging risk worth weighing.3 The most useful habits are ordinary ones: avoid logging into sensitive accounts on an open network you can’t verify, keep your device and apps updated, and don’t assume a network named after your hotel is actually run by your hotel.

Device searches at borders: authority varies sharply by country and changes often

How much authority a government has to search your phone or laptop at its border is not a settled, uniform rule, and it’s currently shifting in more than one major jurisdiction. In the United States, a new Customs and Border Protection directive took effect January 1, 2026, and it’s a useful illustration of how detailed and fast-moving this area is. It distinguishes a basic search (an officer manually reviewing what’s on the device, allowed without any suspicion) from an advanced search (connecting external equipment to copy or analyze data, which requires either reasonable suspicion of a legal violation or a national security concern plus supervisory approval).4 The directive also expanded what counts as a covered device to include SIM cards, smartwatches, and GPS units, set limits on how long a device can be held before higher approval is needed, and states that CBP is not supposed to intentionally access data stored only in the cloud, though travelers may be asked to switch a device to airplane mode first.5

Other jurisdictions handle this very differently. In March 2026, Hong Kong amended its national security enforcement rules to expand device search powers, with no equivalent restriction on cloud-stored data, a direct contrast with the US approach.6 The point isn’t to memorize either country’s specific rule, both will likely change again, it’s that border search authority is genuinely jurisdiction-specific and worth checking close to your travel date rather than assuming what applied on your last trip still applies, or applies somewhere new. The Electronic Frontier Foundation maintains a practical, regularly updated border search guide that’s a reasonable starting point for current specifics.

If this is a real concern for you, for instance if you carry sensitive professional data, the standard mitigations are: back up and then remove sensitive data before you travel rather than carrying everything, consider a minimal “travel” device with less on it, use full-disk encryption with a strong passphrase, and know that cloud-only storage carries different protections than local storage under most current policies.

SIM cards: registration is now the global default, not the exception

More than 150 countries require identity verification to activate a prepaid SIM card, a threshold that’s expanded substantially over the past decade.7 In most countries this simply means showing a passport at the point of sale. In others it goes further: China has required real-name registration with facial recognition since 2019, Russia requires biometric data from tourists purchasing a SIM, and Myanmar requires both fingerprint and facial scans along with a two-SIM limit per person.8 A smaller number of countries, including Japan for data-only plans and historically the UK, US, Canada, and several EU states, don’t mandate registration at all. International eSIM providers sometimes bypass local registration requirements entirely, though this is narrowing as more countries extend real-name rules to eSIM activation.9 The practical implication is less about any single country’s rule and more about the pattern: your SIM purchase in most of the world now becomes a permanent record tied to your identity, with wide variation in how well that data is protected once collected. Bring your passport, expect the process in most countries, and check your specific destination’s current requirement rather than assuming based on a neighboring country or your last trip there.

Location sharing: the risk is about timing and audience, not the feature itself

Real-time location sharing through geotagged posts or “story” features that reveal where you are while you’re still there is a documented pattern that opportunistic scammers and, separately, burglars have exploited, since it can broadcast that a hotel room or home is currently empty or that a tourist is currently isolated in a specific spot.10 This is different from location-sharing apps used deliberately with a small number of trusted contacts for solo-travel safety, which is a genuinely useful practice, not a risk. The distinguishing factor is audience and timing: sharing your location with two people who know to check in on you is protective; posting it publicly while you’re still standing there is not.

A reasonable baseline, without overreacting

  • Keep devices and apps updated, and treat HTTPS as your default baseline protection, not an optional extra.
  • Use a VPN on public networks if you want an added layer, understanding it protects network-level privacy, not everything.
  • Check your specific destination’s current SIM registration and border search rules close to your travel date, since both change faster than most travel content accounts for.
  • Post travel photos and locations after you’ve left rather than while you’re still there, if public sharing is part of how you document a trip.

Sources