No proprietary software. Open source only. (Partial exception for certain games, in a virtual machine, after I review their privacy policies.)
No retail rewards memberships.
No Google anything.
No Meta anything. (Facebook/WhatsApp/Instagram/etc.)
No phone number given to web sites or (most) businesses. VoIP number for the handful that might legitimately need to call me.
Unique email addresses for each web account and service provider. When one gets leaked or spammed, I know who did it and I cut them off.
VPN when I feel it's appropriate.