What privacy means online
Privacy is often described as the ability to decide who knows what about you. Online, that idea gets complicated, because almost every action leaves a record somewhere. Opening a web page, sending a message, paying for a coffee or carrying a phone in your pocket can all produce data. Digital privacy is the set of ideas, habits, tools and rules that govern what happens to that data.
Privacy is not the same as secrecy. Most people are happy to share a delivery address with a courier. The concern is usually about context: who receives the information, what else they combine it with, how long they keep it, and whether you knew about it. Privacy is also different from security. Security is about keeping data away from unauthorized people, while privacy is about whether the people who legitimately hold it should be collecting and using it in the first place.
What counts as personal data
Personal data is any information that relates to an identifiable person. Some of it is obvious, such as a name, home address, phone number, email address or government identification number. Much of it is less obvious:
- Account and contact details given when you sign up for a service.
- Device and network identifiers, such as the unique ID of a phone or the IP addresses your connection uses.
- Behavioral data, such as pages visited, searches, videos watched, items viewed in a shop and how long you stayed.
- Location data, from phones, vehicles, Wi-Fi networks and photos.
- Financial and purchase records, such as card transactions and order history.
- Content you create, including messages, posts, photos and documents.
- Inferred data, which nobody told the collector directly but which is estimated from other data, such as likely interests or income range.
Some categories are treated as especially sensitive in many legal systems, including health information, biometric data, data about children and information about beliefs or sexual orientation. The exact list varies by country.
Who tends to collect it
Several kinds of organizations gather personal data, and they usually have different motives.
Websites and apps collect data to run the service, such as keeping you signed in, and often to measure usage. Many also work with third parties that provide advertising or analytics tools, which is how a single page visit can reach several companies.
Advertising and analytics companies build profiles of interests and behavior so that ads can be targeted and measured. Much of the practical machinery here is explained in the article on browser cookies and trackers.
Device and platform makers run the operating systems, app stores and cloud accounts that sit under everything else. They can see a great deal, although many publish controls to limit it.
Retailers and payment services keep purchase histories. Together with loyalty programs, these can show a detailed picture of household habits.
Data brokers gather records from public sources, commercial sources and other companies, then package and resell them. Most people have never dealt with these firms directly.
Employers, schools and governments hold records because of the relationships you have with them, and they are often subject to separate rules.
Smart devices are a growing source. Voice assistants, IoT devices and home security cameras can all capture information inside the home, which makes their settings worth checking.
Why data is collected
Reasons vary and are often legitimate. A map service needs your location to give directions. A bank needs your identity to prevent fraud. A shop needs an address to deliver an order. Beyond this, data is used to personalize recommendations, to improve products, to measure advertising and, in some cases, to sell to other companies. The same data can serve a helpful purpose in one setting and an unwelcome one in another, which is why purpose limits are a recurring theme in privacy rules.
Common privacy risks
The risks tend to fall into a few groups. Data can leak through breaches, which are covered in the discussion of data breaches. Data can be combined from many sources to reveal more than any one source would. It can be used in ways you did not expect, such as for decisions about pricing or eligibility. It can also outlive its purpose when organizations keep it for years. Finally, supposedly de-identified data can sometimes be linked back to people, a point explored in the article on data anonymization.
Rules and rights
Many countries have laws that give individuals some control. The European Union’s General Data Protection Regulation is the best-known example, and it influenced rules elsewhere. Such laws commonly include rights to know what is held, to correct it and to request deletion, although the details and exceptions vary. Whether a right applies to you depends on where you live and which organization holds the data. Consult the official text or a qualified professional for specific situations.
Practical habits
You cannot control everything, but a few habits tend to reduce unnecessary exposure:
- Review app permissions and turn off the ones an app does not need.
- Use separate email addresses for different purposes.
- Keep software updated, since updates fix security flaws.
- Use strong, unique passwords, ideally with password managers, and turn on two-factor authentication.
- Share less where a form asks for optional details.
- Read the short summary sections of privacy policies when you can, and adjust settings in accounts you keep.
None of this makes someone invisible. A realistic goal is to understand the trade-offs, avoid the most avoidable exposure, and make deliberate choices about what you share.