What “personal data” covers
Personal data is any information that relates to an identifiable person. Some of it is obvious: a name, an email address, a phone number, a home address. Much of it is less obvious: a device identifier, an approximate location, a list of pages visited, the time of day you usually open an app, or a purchase history. Laws in different places define the term differently, but the common thread is whether information can reasonably be tied back to a particular individual or their device.
Data privacy is the question of who gets to collect that information, what they may do with it, and how much say the person it describes has. It is related to security, but not the same thing. Security is about keeping data safe from unauthorized access. Privacy also asks whether the collection and use were appropriate in the first place, even when everything is stored securely.
Three ways data comes to be collected
It helps to separate data by how it arrives.
- Volunteered data. You type it in yourself: a sign-up form, a profile, a message, a delivery address.
- Observed data. It is recorded as a side effect of using a service: clicks, searches, scroll behavior, device type, network address, and often a rough location.
- Inferred data. It is derived from the other two. A pattern of purchases or browsing may be used to guess interests, income range, or life events. Inferences can be wrong, yet they can still be stored and used.
Most people think mainly about the first kind. In practice the second and third kinds are often far larger in volume, which is part of why privacy is hard to manage by instinct alone.
Who collects it
Several kinds of organizations gather personal data, usually for different reasons.
- The services you use directly, such as shops, social platforms, banks, streaming services, and apps. They need some data to work at all.
- Advertising and analytics companies, which often operate in the background across many sites. Their methods are known as online tracking.
- Device makers and network providers, who can see certain technical information about how devices connect and behave.
- Employers, schools and public bodies, which hold records tied to their relationship with you.
- Intermediaries that compile and resell information, known as data brokers.
Why it is collected
Reasons range from clearly necessary to clearly commercial.
To provide the service. A delivery app needs an address. A map needs a location. A messaging tool needs to know where to send a message.
To improve and secure the service. Companies often analyze usage to fix bugs, spot fraud, and decide what to build next. This is a common use of data analytics.
To personalize. Recommendations, search results and feeds often rely on past behavior. Personalization can be genuinely useful, though it also shapes what a person sees.
To advertise. Much of the free internet is funded by ads, and targeted ads are generally considered more valuable than untargeted ones. That gives many businesses a financial reason to collect more than a service strictly needs. The broader field is known as digital marketing.
To train systems. Some data is used for machine learning, where models are built from large collections of examples. What goes into training data can include information that came from users.
To meet legal or operational duties. Tax records, financial rules and safety requirements can require organizations to keep certain information.
Why the “I have nothing to hide” view is incomplete
A common reaction is that ordinary people have little to protect. Privacy, though, is not only about secrets. It is about context. Information shared with a doctor, a friend, a bank and an advertiser is shared under different expectations. Problems arise when data moves out of the setting where it was given. Pieces that seem harmless alone, such as a postal code, a birth date and a gender, can be combined to narrow down who someone is. Data can also be kept for years and used in ways nobody foresaw at the time of collection.
There are also practical risks: stored data can be exposed in a breach, used for scams that rely on personal details, or relied on for decisions about credit, pricing or employment where errors are hard to spot. How common or severe these outcomes are varies widely, and it is fair to say that the risk for any single person is uncertain.
What control can and cannot mean
Control over personal data usually comes in a few forms. Many regions have laws giving people rights to see, correct, delete or limit the use of data held about them, though the exact rights, and how well they are enforced, differ from place to place. Services also offer controls of their own, and those privacy settings have limits. Individuals can choose what to share, use separate accounts for different purposes, and keep devices updated.
Control is rarely complete. Data that has already been copied or shared can be hard to pull back. Some collection happens through channels a person never sees. And understanding every policy is a lot to ask of anyone, which is why many privacy advocates emphasize that organizations should carry more of the responsibility, for instance by gathering less in the first place.
Practical habits that help
None of these guarantee anything, but they reduce exposure.
- Share the minimum a service needs, and think twice about optional fields.
- Review permissions that apps request, such as location, contacts, camera and microphone.
- Use strong, unique credentials and a second step at sign-in where available.
- Keep software current, since updates fix known weaknesses.
- Be cautious about unsolicited messages that ask for personal details.
- Delete accounts and apps you no longer use.
Privacy is best seen as an ongoing set of trade-offs rather than a switch. Understanding what is collected and why makes those trade-offs easier to judge, and makes it easier to ask better questions of the services you rely on.