Lesson 8 of 16 · Level 2: Intermediate
Privacy and Personal Data Protection
- ⏱ 14 min read
- ❓ 4 review questions
- ✍️ Exercise with solution
In this lesson
- The difference between privacy and security, and which personal data is most sensitive.
- How your data is collected and shared by apps, websites, data brokers and breaches.
- The basics of U.S. privacy law: sector laws like HIPAA and GLBA, state privacy laws and breach notification.
- How to freeze your credit, set up a fraud alert and respond to a breach notice.
- A 30-minute privacy audit for your phone and accounts.
Security is about keeping data safe from people who shouldn't have it. Privacy is about how data is collected, used and shared in the first place, even by companies you willingly do business with. You can have perfect security and poor privacy: an app can store your location history very safely while selling it to advertisers. This lesson shows where your personal data goes, what U.S. law does and doesn't protect, and the practical steps (some take five minutes) that block the most common kind of harm: identity theft.
- Know your sensitive data
- See how it's collected
- Understand your rights
- Lock your credit
- Audit your privacy
Personal data: what counts and what's most sensitive
Personally identifiable information (PII) is any data that identifies you, alone or combined with other data: name, address, email, phone number, date of birth, photos, device IDs. Some categories cause much more harm if exposed, so laws and good practice protect them more strictly:
Identity data
Social Security number, driver's license and passport numbers, date of birth.
Risk: opening new credit, filing fake tax returns, getting medical care in your name.Financial data
Bank and card numbers, account logins, credit history.
Risk: direct theft and fraudulent charges.Health and biometric data
Medical records, prescriptions, fingerprints, face scans, genetic data.
Risk: discrimination, embarrassment and data you can never change.Location and behavior
Precise location history, browsing, purchases, contacts.
Risk: stalking, profiling and revealing visits to sensitive places.How your data is collected and shared
- Directly from you: forms, loyalty programs, sweepstakes, social media profiles.
- From your devices: apps that collect location, contacts or advertising IDs; smart TVs that log what you watch; cars that report driving behavior.
- From websites: cookies and tracking pixels follow you across sites to build an advertising profile.
- Data brokers: companies that buy, combine and sell profiles, including "people-search" sites that publish your address, relatives and phone number.
- Breaches: data held by a company you trusted is stolen and sold, then used in phishing and identity theft.
You can't stop all of it, but you can shrink it. The best privacy tactic is data minimization: share less, keep less, and delete what you no longer need. Every piece of data that doesn't exist can't be breached.
1. A free flashlight app asks for permission to access your precise location, contacts and microphone. What's the most privacy-protective response?
A flashlight needs none of those permissions. Requests that don't match an app's function are a sign its business model is collecting data. Grant only what's necessary.
U.S. privacy law in one page
As of late 2026, Congress has debated several proposals, but the United States still has no single comprehensive federal privacy law. Protection comes from a patchwork of federal laws for specific sectors, the FTC's general authority and a growing list of state laws. This is educational information, not legal advice.
| Law or rule | What it covers | Example |
|---|---|---|
| HIPAA | Health information held by covered entities (most providers, health plans, clearinghouses) and their business associates | A Phoenix dental office's patient charts |
| Gramm-Leach-Bliley Act (GLBA) and FTC Safeguards Rule | Customer financial information at financial institutions, including non-bank ones like tax preparers and mortgage brokers | A Charlotte accounting firm's client tax files |
| COPPA | Online collection of personal information from children under 13 | A game app aimed at kids needs verifiable parental consent |
| FERPA | Student education records at schools that receive federal funding | Grades and disciplinary records |
| FCRA | Credit reports and background checks | Your right to dispute errors on your credit report |
| FTC Act, Section 5 | Unfair or deceptive practices, including broken privacy promises and poor data security | A company that says "we never share your data" and then does |
| State comprehensive privacy laws | Personal data of state residents, for businesses that meet each law's thresholds | California's CCPA (as amended by the CPRA) and laws in about two dozen other states |
| State breach notification laws | Notice to residents when certain personal data is breached | A letter telling you your SSN was exposed |
State comprehensive privacy laws generally give residents rights such as accessing their data, correcting it, deleting it, getting a copy, and opting out of certain uses like the sale of data or targeted advertising. The exact rights, thresholds and exemptions vary by state, so check your state attorney general's website.
California's Delete Act created DROP (Delete Request and Opt-out Platform), a free state service that opened to residents on January 1, 2026. One request reaches every registered data broker, and brokers had to start processing requests on August 1, 2026, checking for new ones at least every 45 days. In other states, you can still opt out of individual people-search sites one by one, or pay a removal service to do it.
2. A dental office in Phoenix stores patient records in its practice management software. Which federal law most directly governs how it must protect those records?
Dental offices that bill electronically are HIPAA covered entities. COPPA protects children's data online, and FERPA covers school records.
Lock down your identity: credit freezes and fraud alerts
The most common way stolen personal data hurts you is new-account fraud: someone opens a credit card, loan or phone plan in your name. A credit freeze blocks lenders from pulling your credit report, so new accounts can't be opened. Since September 21, 2018, federal law makes freezes free at all three nationwide credit bureaus.
| Tool | What it does | How to get it | Good to know |
|---|---|---|---|
| Credit freeze | Blocks access to your credit report for new credit | Contact each bureau separately: Equifax, Experian and TransUnion | Online or phone requests take effect within one business day; you can lift it within one hour when you apply for credit |
| Fraud alert | Asks lenders to verify your identity before opening an account | Contact one bureau; it notifies the other two | Lasts one year and can be renewed |
| Child credit freeze | Protects children's clean credit files | Parents request it at each bureau | Free for children under 16 |
| IRS Identity Protection PIN | A six-digit PIN required to file a federal return under your SSN | Request it through your IRS online account | Blocks fake tax returns filed in your name |
A freeze doesn't affect your credit score and doesn't stop you from using existing cards. It's one of the highest-value, lowest-effort protections in this whole course: about 15 minutes for all three bureaus.
When you get a breach notice
- Day 1Verify the noticeScammers send fake breach letters too. Confirm on the company's official website, and don't call numbers or click links you can't verify.
- Day 1Change the password and turn on MFAUpdate that account and any account where you reused the password.
- Day 1–2Freeze your creditEssential if your SSN or date of birth was exposed. Accept the free credit monitoring if offered.
- OngoingWatch statements and credit reportsReview bank and card activity weekly for a few months and check your free credit reports.
- If misusedUse IdentityTheft.govThe FTC's site creates a personalized recovery plan and an identity theft report.
3. A breach letter says your name, address and Social Security number were exposed. Which step blocks criminals from opening new credit cards in your name?
A credit freeze prevents lenders from checking your credit, so new accounts can't be approved. It's free, doesn't hurt your score, and you can lift it temporarily when you need credit.
Case: a 30-minute privacy audit in Minneapolis
After a breach notice from a retailer, Elena froze her credit at all three bureaus and set aside 30 minutes for a privacy audit. She reviewed app permissions one by one, deleted 9 apps she no longer used and set her social profiles to friends only.
Location access dropped from 38.9% to 11.1% of her apps (measured against the original 54), with nothing she actually used broken.
Your own 30-minute audit
Common mistakes
"I have nothing to hide."
Privacy isn't about hiding wrongdoing; it's about controlling information that can be used to scam, profile or impersonate you.
Posting a photo of a new driver's license, boarding pass or vaccination card.
Barcodes and numbers on these documents can reveal personal data. Keep them offline.
Waiting for fraud before freezing your credit.
Freeze it now. Thawing for a loan application takes minutes.
Answering "fun" social media quizzes about your first car or street.
These are common security questions. Skip the quiz.
4. During an audit, you find that 14 of the 40 apps on your phone can access your location. What percentage is that?
14 ÷ 40 = 0.35, or 35%. Most apps only need location while you're actively using a map or delivery feature, if at all.
Practice exercise
Daniel, a college student in Austin, discovers that someone opened a store credit card in his name. His Social Security number was in a breach last year, his Instagram is public and lists his birthday and hometown, and he reuses one password across most accounts. Write his recovery and prevention plan in priority order.
See solution
- Report and recover: go to IdentityTheft.gov to file an identity theft report and get a recovery plan; call the store card issuer's fraud department to close the account and dispute the charges.
- Freeze his credit at Equifax, Experian and TransUnion (free) to block further new accounts, and check all three credit reports for other unfamiliar accounts.
- Request an IRS Identity Protection PIN to stop a fake tax return using his SSN.
- Fix passwords: install a password manager, change email first, then banking and student accounts, and turn on MFA everywhere it's offered.
- Reduce exposure: make Instagram private and remove his birthday and hometown, since they help criminals pass identity checks.
- Monitor: review statements weekly for a few months and keep a log of every call and letter related to the fraud.
Summary
- Privacy is about how data is collected and shared; security is about keeping it safe. You need both.
- Identity, financial, health, biometric and location data cause the most harm when exposed.
- U.S. protection is a patchwork: HIPAA, GLBA, COPPA, FERPA, FCRA, the FTC Act and a growing set of state privacy and breach laws.
- A free credit freeze at all three bureaus is the best defense against new-account fraud; add an IRS IP PIN.
- A 30-minute audit of app permissions, ad tracking and social profiles shrinks your digital footprint.
Next lesson: Cybersecurity for Small Business: A Starter Plan. You'll build a 90-day security plan for a small company, learn which rules apply (like the FTC Safeguards Rule) and score your progress with the checklist.
Create your account in 30 seconds, mark your lessons and download your certificate at the end.