The "aha" moment that made me realize data privacy settings aren't enough