It depends on the kind of risks you have in mind.

Are you worried about someone hacking an account, stealing passwords and committing identity theft? If so, the stakes are pretty high, but the probability is low as long as your brother takes care of updates and passwords. Also, avoiding shady software and sites helps too. I prefer to call this category security, but it certainly has privacy aspects too. IMO online security should be a high priority.

However, if you’re mainly concerned about Amazon, Meta, Microsoft, Google and other companies collecting data about you, the situation is very different. I call this thing privacy, and the risks are smaller, but the probability is very high.

When it comes to security, you just need to show what has happened to other people who screwed up and made themselves an easy target. However, privacy is a bit trickier. Appreciation of privacy is a more philosophical matter, since the practical side of it isn’t as tangible. If your brother doesn’t have certain values, principles or philosophy, it’s going to be difficult to convince him that privacy matters.

If your brother already takes good care of online security, but ignores privacy, you could talk about the way companies use your data. Focus on the ethical side of these practices. If not, forget about privacy and focus on security instead, since that should always be the higher priority.