This lecture is a tour through a larger project. The larger project asks three questions, to be answered together: What justifies the duty of privacy? What does the duty of privacy require of us? Do current digital practices violate this duty? Like all tours, this tour stops longer at some locales than others, and passes by still other locales altogether. The first part of the talk critically reviews some attempts in the literature to justify the duty of privacy. I forewarn you that the conclusions of this part are relentlessly negative: that the attempts in the literature do not succeed in justifying the duty of privacy. I do not offer my own positive proposal for how to justify the duty of privacy. Instead, what I wish to get across is just an appreciation of how difficult it is to justify the duty of privacy. The following parts of the talk try to come to terms with three puzzling phenomena concerning privacy, phenomena that technological change has made salient. The topic of the second part is what I call “inferential laundering”: that it does not violate privacy to discover by inference what it would violate privacy to discover by some more direct route. The topic of the third part is what I call “publicizing what is already public”: that it violates privacy for Y to make information available to everyone in way B even if it does not violate privacy for X to make information available to everyone in way A. The topic of the final part is the idea that, individually or collectively, we own something called “our data,” such that the “surveillance capitalist” wrongs us, individually or collectively, by using our data without our valid consent.