Considerable research has looked at people's attitudes and approaches to privacy, but little work has considered how people develop the skills to approach the increasing complexities associated with protecting one's personal information online. Based on focus group interviews, we explore the social and technical strategies people use to protect their personal privacy online with an emphasis on how users develop these skills. Previous research has looked at privacy skills in general, but not at the different ways that people acquire them. Conversations with young adults show that there are four main sources of information for privacy-protecting strategies among this group: personal experiences, social experiences, institutional requirements and nudges, and third-party materials. We discuss these four sources providing examples of participants' experiences with each. In order to develop effective interventions for helping people understand and implement privacy-protecting strategies, it is important to know how users tend to learn such skills.