"protecting privacy" is meaningless without specific threat model. family in china needs very different setup from family worried about ads