Every time you read a newspaper on your computer or buy an ebook, you can leave an electronic trail behind you. That trail is potentially lucrative for business, and is a new source of surveillance for government and law enforcement.

Retailers and search engines, most notably Amazon and Google, can now gather an astonishingly detailed portrait of our book-reading habits: what we buy, what we browse, the amount of time we spend on a page and even the annotations we make in an ebook. As campaigners have quipped, it's the equivalent of a bookshop hiring someone to follow you round the shop noting every book you pick up, then sitting at home with you while you read what you bought.

Defending the freedom to read is no longer only about battling against direct censorship in obscenity, blasphemy or libel cases. Since the digital revolution, it's now increasingly about protecting the freedom of the reader as much as the reading matter.

Last year, the state of California passed a law safeguarding the privacy of readers: for the first time, the vulnerability of readers in the digital age would be recognised in statute. The Reader Privacy Act means that government agencies will have to obtain a court order before they are able to access data on customers from bookstores or online booksellers. Civil liberties and digital rights groups are hopeful that other states will adopt the legislation. The EU has also passed a law that will make it less easy for websites to track our online activities without our consent.

In an age when our lives are lived out in public more than ever before, the loss of privacy might be a price some are happy to pay to be part of the digital future. But it fundamentally erodes the privacy that is necessary to enjoy our freedoms – above all, freedoms of thought and expression. Why should companies – let alone governments – know what we are reading? Government interest in our literary taste always increases when national security is at stake. In a notorious case in 2008, a student at Nottingham University was detained for seven days by the police after downloading the al-Qaida training manual from a US government website for his PhD on counterterrorism.

US civil liberties groups are in the vanguard of protecting readers' rights. The Electronic Frontier Foundation (EFF), which lobbied for the Reader Privacy Act along with the American Civil Liberties Union (ACLU), has published a detailed guide on how to protect your privacy as a reader of digital books. The EFF criticises e-reader manufacturers for not giving customers clear information on the data that is being held on them – and for what purpose. "Right now, there's no way for you to tell Amazon, 'I want to buy your books, but I don't want you to track what I'm reading'," Cindy Cohn, the EFF's legal director, has said.

The ACLU has criticised both Google and Amazon for their patchy protections for reader privacy. Google reserves the right to disclose information when it has "a good-faith belief" that it is reasonably necessary to "meet any applicable law, regulation, legal process or enforceable governmental request". Amazon also reserves the right to disclose information when it "believes release is appropriate to comply with the law". A stronger protection for our privacy should require a warrant before personal data is released.

That said, Amazon has proven itself a robust defender of customer privacy, by challenging government demands for the data it keeps. In 2006, federal prosecutors subpoenaed the company for the purchase records of 24,000 customers as part of a grand jury probe in a tax-evasion case; in 2010, the North Carolina Department of Revenue requested the records of 50m customers – a staggeringly broad request. In both cases, Amazon fought the demands and won, though the ruling emphasised the threat to e-commerce over that to freedom of expression.

Awareness of the problem is growing, from Google's catastrophic launch of its social network Buzz in 2010, which shared users' contacts without their permission, to the revelation last year that Facebook was still tracking users' browsing information after they had logged out. In February 2012, the Obama administration announced that it would be pushing for all browsers to include a "do not track" button as part of a Consumer Privacy Bill of Rights. In May, a class-action complaint was filed against Facebook for collecting data on the internet use of its members.

In the UK, there is alarm at the government's draft communications data bill, which will give the home secretary the power to force a wider range of service providers to store data for up to a year. Police would be able to request this data without a warrant for "permitted purposes", ranging from the detection of crime to public safety.

CS Lewis observed "We read to know that we are not alone", but at times that is exactly what we expect to be. The new possibilities for surveillance undermine the fundamental privacy of the act of reading. If readers, campaigners and civil liberties groups combined to assert the reading rights of us all, then that would be a force for change.

• Jo Glanville becomes director of English PEN on 3 September.