Chapter 21 introduced cybersecurity: the technical systems and strategies that protect computers, networks, and data from attack. Chapter 22 focuses on a related but distinct question — how do digital systems affect people: their personal information, their identities, their reputations, and their safety?

Security asks, can a system be broken into? Privacy asks, who has access to what, and should they? These questions are related but not identical. A system can be technically secure and still collect far more personal information than users understand or would consent to. A system can be open and transparent while still treating personal data responsibly. Understanding both security and privacy requires understanding both the technical layer and the human layer of digital systems.

This chapter teaches students to think clearly about personal data, digital identity, online tracking, passwords, account security, digital footprints, scams, and responsible digital citizenship. These are not soft topics or afterthoughts. They are technical, social, legal, and ethical questions that affect every person who uses a connected device.

Privacy is often misunderstood as hiding things. But a clearer and more useful definition is this: privacy is the ability to control information about yourself. Under this definition, privacy is active, not passive. You can share information openly — with friends, with the public, with a company — while still maintaining privacy, as long as you are the one choosing what to share, with whom, and under what conditions.

When privacy is damaged, control is lost. Someone else — a company, a government, another person — decides what happens to information about you, without your knowledge or meaningful consent. The information you provided for one purpose is used for another. The audience you intended sees what you shared, but so does an audience you never imagined.

Autonomy. People behave differently when they know they are being watched. If you believe every search you conduct is recorded and analyzed, you will self-censor. You will avoid certain topics, certain questions, certain expressions of curiosity or doubt. The ability to search, think, experiment, and express yourself privately is part of being a fully autonomous person. A society in which every action is observed is a society in which behavior is shaped by the observer, not only by the individual.

Safety. Personal information in the wrong hands creates real danger. A home address leaked to a stalker. A daily commute pattern visible to someone who intends harm. Medical information used against a person seeking employment. Financial details used to drain an account. Privacy is not abstract — its violation can cause physical, financial, and emotional harm.

Reputation and fairness. Information about you can be taken out of context, misinterpreted, or deliberately distorted. A photo, a comment, a search history, a medical diagnosis — any of these might be used to judge you unfairly if seen by the wrong person at the wrong time. Privacy gives people space to be human: to make mistakes, to learn, to change without those changes being permanently held against them.

Power. Information is power. Organizations that know a great deal about you have leverage over you — what content they show you, what prices they offer you, how they classify you. Privacy is part of a broader balance of power between individuals and institutions.

Different countries and regions approach privacy law differently. The European Union's General Data Protection Regulation gives individuals rights over their data, including the right to access it, correct it, and in some cases delete it. The United States has sector-specific laws covering areas like health data and financial data, but no single comprehensive privacy law. Other countries have their own frameworks at various stages of development.

What matters for this chapter is that legal compliance is not the same as ethical data practice. Many data collection practices are technically legal but ethically questionable. A company may be entirely within the law while collecting far more data than users understand or would consent to if they genuinely understood what was happening. Law sets a floor; ethics asks higher questions.

Personal data is information that identifies or can be used to identify a specific individual. Some personal data is obviously identifying: your full legal name, home address, phone number, email address, national identification number, biometric data (fingerprints, face geometry, voice patterns), medical records, and financial records.

Other personal data is not obviously identifying on its own, but becomes identifying when combined with other data. This is one of the most important and least understood aspects of modern data privacy. Your birthday alone does not identify you. But combined with your name and ZIP code, it often does — because few people share all three values. Your general location at one moment is vague. Your location over many days, logged by an app running in the background, reveals where you sleep, where you work, where you worship, and who you spend time with.

Some categories of personal data are considered particularly sensitive because their misuse can cause disproportionate harm:

Metadata is data about data. It describes the context of information rather than its content — who, when, where, and how, without necessarily including what.

Metadata can be as revealing as content — sometimes more so. Consider phone call metadata: even without recording the content of any conversation, a list of who you call, when, and for how long reveals a great deal. Regular calls to a cancer treatment center. Long late-night calls to a specific number during a difficult period. A sudden spike in calls to lawyers. Metadata tells a story about your life through the pattern of your communications, even when every word remains private.

First-party data is information you directly provide to a company, or that a company collects from its own direct interactions with you. When you create an account with an online store and enter your name, address, and payment information, that is first-party data. The store has a direct relationship with you, and you are at least aware that you are providing the data.

Third-party data is information collected about you by entities you have no direct relationship with. Data brokers are companies that compile personal records from public records, loyalty programs, app usage data, browsing histories, and other sources, then sell aggregated profiles. You likely have a data broker profile whether or not you have ever heard of data brokers. These profiles may include your name, address history, phone numbers, estimated income, education, household composition, political affiliation, purchasing behavior, and inferred interests — assembled without your knowledge or direct involvement.

A cookie is a small piece of text stored in your browser by a website you visit. Cookies were originally designed for useful purposes: keeping you logged in, remembering your shopping cart contents, saving your preferences. Without session cookies, websites would forget who you were on every page load.

Session cookies expire when you close your browser. Persistent cookies last for days, months, or years. The most significant category for privacy is third-party cookies — placed not by the website you are visiting, but by advertisers or analytics companies whose code is embedded in that website. If the same advertiser's code is embedded in thousands of different websites, that advertiser can track your visits across all of them, building a detailed picture of your interests, behavior, and likely identity — even if you never directly interact with that advertiser.

A tracking pixel is a tiny, often invisible image embedded in a webpage or email. When the image loads, it sends a request to the company's server — confirming that you opened the email, what device you used, what time you opened it, and roughly where you are. Most marketing emails contain tracking pixels. You may have noticed that email clients sometimes ask whether to "load images" — this is partly a defense against tracking pixels.

Browser fingerprinting is a tracking technique that requires no cookie at all. Your browser has a configuration: the specific browser version, the operating system, installed fonts, screen resolution, time zone, language settings, installed plugins, and other details. Taken together, these details form a fingerprint that is often unique to your device. Because fingerprinting uses characteristics of your browser that exist for legitimate technical reasons, it cannot be prevented by clearing cookies or browsing in private mode. Incognito mode does not change your browser's configuration.

Apps that request location permission can access precise GPS coordinates. Even without GPS, devices can be located using nearby Wi-Fi network names, Bluetooth beacons, and cell tower triangulation. Some apps request location access continuously, tracking where you go throughout the day even when you are not actively using the app. Reviewing app location permissions periodically is one of the most practical privacy actions a smartphone user can take.

Smartphones also carry unique device identifiers — hardware IDs and advertising identifiers (such as Apple's IDFA or Google's AAID). Apps that are granted appropriate permissions can use these to track activity across different apps on the same device, and advertisers use them to link behavior across time and context.

This ecosystem is largely invisible to ordinary users. The privacy policy of any given service — typically long, dense, and rarely read — may describe data sharing, but the full scope of who eventually sees your data is rarely disclosed in an understandable way. Data collected from a single website visit may eventually inform credit decisions, employment screening, or pricing on other platforms.

A digital identity is the set of information associated with you across digital systems. It is not stored in one place — it is distributed across every service you have ever used. It includes your usernames and email addresses, profile information such as names and photos, preferences and settings, content you have created (posts, documents, comments), behavioral data linked to your accounts, and the credentials (passwords, security keys, recovery methods) that prove the account belongs to you.

Your digital identity matters because controlling it determines what you can do, what others can say about you, and what risks you face. When a piece of your digital identity is compromised — an account taken over, personal data exposed in a breach — the consequences extend into your financial life, your reputation, and sometimes your physical safety.

An account is compromised when an unauthorized person gains access to it. This can happen in several ways. Password theft occurs through phishing, data breaches at services you use, keyloggers (malware that records your keystrokes), or social engineering. Credential stuffing is the automated use of username and password pairs leaked from one breach to try logging into other services — this is effective precisely because many people reuse passwords across multiple accounts. Account recovery abuse exploits weak recovery processes, such as guessable security questions or SMS-based password resets, to reset credentials without knowing the password.

Once an account is compromised, an attacker may read private communications, lock you out, impersonate you to others, drain linked financial accounts, access connected services, or use your account to attack other people. Email accounts are especially high-value targets because most other accounts can be reset through email — compromising your email is often the key that unlocks everything else.

Identity theft occurs when someone uses your personal information to impersonate you — typically for financial gain. This can include opening credit accounts in your name, filing fraudulent tax returns, accessing existing financial accounts, obtaining medical services using your insurance, or creating false records. Identity theft can take months or years to discover. Resolving it requires extensive documentation and persistence, and the damage to credit scores and financial records can persist even longer.

Passwords are the most common form of digital authentication, and they fail in several predictable ways. People choose predictable passwords — words from dictionaries, names, dates, keyboard patterns. Automated tools can try millions of common passwords per second. People reuse passwords across multiple services, meaning a breach at one service exposes the same credential everywhere it is used. People write passwords in insecure places — text files, browser history, physical notes. People share passwords with others. And people are tricked into entering passwords on fake sites.

Understanding why passwords fail points directly to the solutions: passwords need to be long, random, and unique per account. These three properties together neutralize the primary attack methods.

A password manager is a program that stores, generates, and retrieves passwords securely. It encrypts your stored passwords behind a single master password — the one password you must remember. The password manager handles the rest: generating long, random, unique passwords for every account and autofilling them when you need to log in.

Password managers provide several security benefits beyond mere storage. Because they autofill passwords based on the site's URL, they will not autofill on a fake phishing site with a different address — the password manager checks the URL before filling. They also alert you to reused or compromised passwords, helping you identify weak points in your security before an attacker does.

A well-designed service never stores your password directly. Instead, it stores a hash — the output of a one-way mathematical function applied to your password. When you log in, the service applies the same function to what you type and compares the result to the stored hash. If they match, access is granted, without ever storing or comparing the actual password.

This design means that even if an attacker steals the database, they do not have your passwords — only hashes. However, they can run hashing functions on millions of common passwords and compare results, which is how many stolen passwords are eventually cracked. Longer, more random passwords resist this attack because the hash of a unique random password is not in any precomputed list. This is why uniqueness and randomness matter even when passwords are hashed: a common password is vulnerable even if the service stores it correctly.

Traditional login relies on a single factor: something you know (your password). If that one thing is stolen, guessed, or otherwise obtained, your account is compromised. Multifactor authentication (MFA) — also called two-factor authentication (2FA) — requires verification from two or more of the following categories: something you know, something you have, or something you are. An attacker who obtains your password still cannot access your account without also satisfying the second factor.

Technical defenses — strong passwords, MFA, encryption, firewalls — protect against technical attacks. But many of the most successful attacks bypass technical defenses entirely by targeting human psychology. Social engineering is the use of psychological manipulation to deceive people into taking actions that compromise security. It works not by breaking systems but by exploiting trust, habit, emotion, and confusion.

Understanding social engineering is essential because no technical system can fully protect against it. A perfectly secure account with a strong password and hardware MFA can still be compromised if the legitimate owner is tricked into handing over their credentials or approving a fraudulent request. The human element must be understood alongside the technical element.

Phishing exploits predictable psychological mechanisms. Understanding them is the primary defense.

Urgency prevents careful thinking. "Your account will be closed in 24 hours unless you act now." People take action before reflection when they believe delay will cause serious harm. The manufactured deadline is designed to bypass the pause where critical thinking happens.

Authority exploits our conditioning to respond to institutional power. A message appearing to come from a bank, a government agency, or a technology company carries weight that a message from an unknown sender does not. Phishing messages mimic the visual identity of trusted organizations precisely to borrow that authority.

Fear creates anxiety that narrows attention. When we are afraid, we focus on the threat and lose the broader perspective that would let us evaluate the situation clearly. A warning that your account has been compromised activates fear before you have had a chance to ask whether the warning itself is trustworthy.

Familiarity lowers our guard. A message that looks exactly like one you have received from your bank before — same logo, same colors, same tone — is disarming. We rely on pattern recognition to navigate the world efficiently, and phishing exploits this reliance.

Email phishing is the most common form — mass messages sent to millions of addresses, relying on a small percentage responding. Even a fraction of one percent of recipients represents thousands of successful attacks when the scale is large enough.

Spear phishing is targeted and personalized. The attacker researches a specific individual — using LinkedIn, social media, or information from previous breaches — and crafts a message that references real details of the person's life, work, or relationships. "Hi — following up on the project we discussed with your manager last week. Can you approve the attached invoice?" Spear phishing is far more effective than mass phishing because it feels familiar and specific.

Smishing is phishing via SMS text message. Fake package delivery notifications, bank alerts, and prize notifications are common. Vishing is phishing via voice call — callers impersonate bank fraud departments, tech support, government agencies, or law enforcement. Clone phishing takes a legitimate email you previously received, creates an exact copy with links or attachments replaced with malicious versions, and resends it: "Resending the document from last week — the link expired."

Romance scams involve attackers creating fake personas on dating apps or social media, building extended relationships over weeks or months, then manufacturing a crisis requiring money. The emotional investment built up over time is what makes these scams devastating — victims often know something is wrong but cannot bring themselves to accept it because the relationship feels real.

Tech support scams generate fake warnings that your computer is infected, then direct you to call a number or download software. The caller gains remote access to your computer or charges fees for imaginary services. These disproportionately target people less familiar with how technology actually behaves.

Impersonation scams range from fake family emergencies ("I'm in jail, please wire bail money") to fake government agencies (fake tax authority calls) to fake businesses (fake package delivery, fake account alerts). The common thread is borrowed authority — using a trusted identity to lower your defenses.

Your digital footprint is the total collection of data created by your activities online. It includes everything you have done, said, shared, liked, purchased, searched for, visited, and created in digital systems.

Digital footprints divide into two types. Your active digital footprint consists of data you deliberately create: posts you publish, photos you upload, comments you leave, forms you fill out, accounts you create. Most people are aware of their active footprint, at least in broad terms.

Your passive digital footprint consists of data collected about you without your active creation: your location recorded by an app running in the background, websites visited and logged by your browser and by analytics systems on those sites, the time you spent reading a particular article, purchases linked to your email address by loyalty programs, IP address logs. Most people have a much less clear picture of their passive footprint — which is typically larger and more detailed than their active one.

Digital information is persistent by default. A spoken conversation disappears when it ends. A post, comment, photo, or message can remain accessible indefinitely. When you delete content, it may disappear from public view immediately. But copies may exist in platform backups, in screenshots taken by others before you deleted it, in archive services, in caches on third-party servers, and in messages you sent to others — because you can delete your copy, but you cannot delete their copy.

A useful working principle: assume that anything you publish online may persist indefinitely and may reach audiences far beyond those you originally intended. This is not an argument against participating online — it is an argument for thoughtfulness about what you share.

Information shared in one context can feel very different in another. This phenomenon is called context collapse — when the boundaries between audiences disappear, and content intended for one group is seen by another.

A post written informally for close friends can be seen by employers. A photo shared in a small private group can be screenshotted and shared publicly. A comment made in a niche online community can be surfaced by journalists writing about an unrelated topic. The audience you imagine when you write something online is not always the audience that actually sees it. Effective digital communication requires thinking about not only who you are writing to, but who else might eventually read it.

Digital footprints affect reputation in real, material ways. Many employers search for applicants online during the hiring process — content that seems perfectly fine among friends might raise questions in a professional context, or might simply be misunderstood without the original context. College admissions processes sometimes include social media review. People routinely search online for others they are dating, befriending, or working with. Social media content has been used as evidence in legal proceedings, custody disputes, and insurance claims.

None of this means you should be paralyzed about your online presence. It means that the choices you make about what to share, on which platforms, under what privacy settings, are real choices with real consequences — not neutral acts that disappear when the screen goes dark.

Most digital services offer privacy settings — controls over who can see your information and how it is used. These settings are a practical tool, but understanding their limits is just as important as knowing how to use them.

Privacy settings have significant limits that users should understand. Settings change — companies update defaults over time, and what was restrictive may become more permissive after an update. Review your settings periodically. Most services default to maximum data collection; privacy-protective options exist but must be actively chosen rather than assumed.

Perhaps most importantly: privacy settings control your own data, not what others share about you. If a friend posts a photo of you publicly, your settings on your own account have no effect on its visibility. Your digital footprint is shaped by your own choices and by the choices of everyone who interacts with you online.

Even with restrictive settings, the platform itself retains access to your data. Privacy settings typically control external visibility — who else can see your content — not what the platform does with your data internally. The company that hosts your posts can still see and use them.

Informed consent means agreeing to something with genuine understanding of what you are agreeing to. In digital contexts, consent is collected through terms of service agreements (long documents rarely read), cookie consent banners (often designed to make acceptance easy and refusal difficult), app permission requests (often asking for more permissions than necessary), and privacy policies (frequently long, technical, and deliberately opaque).

Dark patterns are interface designs that manipulate users toward choices they would not make with a neutral interface. In privacy contexts, common dark patterns include making "Accept All" a large, prominent button while "Manage Settings" requires multiple clicks and sub-menus; pre-checking data sharing boxes that users must actively uncheck to opt out; using confusing language ("share data to improve your experience" instead of "use your data for advertising"); and burying privacy controls in difficult-to-find locations.

Recognizing dark patterns helps you navigate privacy choices more deliberately. When a consent interface feels designed to steer you toward a specific choice, it probably is. Slowing down and looking for the less prominent option often leads to a more privacy-protective result.

Digital citizenship refers to the responsible, ethical, and safe use of technology. The previous sections of this chapter focused largely on protecting yourself — understanding tracking, securing accounts, recognizing scams, managing your footprint. This section extends outward: what do you owe to others in digital spaces?

Rights and responsibilities are two sides of the same coin. You have a right to digital privacy — and so does everyone else. You have a right to control your personal information — and so do the other people whose information may pass through your hands. You have a right to a digital environment free from harassment and manipulation — and that right depends on others choosing not to harass or manipulate.

Respect others' privacy. Do not share private information about other people without their permission. Do not share photos, screenshots, or private messages that were shared with you in confidence. Before sharing anything involving another person, ask whether they would want it shared with the audience you are sharing it with.

Verify before sharing. Misinformation spreads because people share without checking. Before sharing a striking claim, ask: Is this from a reliable source? Does it seem designed to provoke emotional reaction rather than inform? A quick search often reveals whether a story is accurate, satirical, distorted, or fabricated. The speed of sharing makes the pause to verify more important, not less.

Consider context. Information shared in one context may cause harm when moved to another. Sharing a post from a small private community to a much larger public audience — without the original poster's knowledge — can expose people to attention they had reasonable grounds to expect they would not receive.

Do not impersonate. Creating fake accounts to impersonate others — to harass, deceive, or manipulate — causes real harm to real people and is illegal in most jurisdictions.

The digital information environment is a shared resource. Its quality depends on the choices of millions of individual participants. Information hygiene describes habits for managing information responsibly — as a consumer and as a sharer.

As a consumer: be skeptical of headlines designed to provoke rather than inform. Recognize that algorithms often surface content that generates strong emotional reactions, which is not the same as content that is accurate. Prefer primary sources over summaries. Distinguish between claims ("scientists say") and evidence ("this study found"). Be willing to update your understanding when better information appears.

As a sharer: recognize that your sharing choices shape what others see. Content you share — accurate or not — reaches your network and potentially beyond. The small effort of verifying before sharing, at scale across millions of people, significantly improves the quality of the information environment everyone navigates.

Digital safety is not only individual. Some people are more vulnerable to certain risks — older adults who may encounter scams for the first time, young people who may not yet understand the persistence of digital footprints, anyone in an unfamiliar digital situation. Supporting others is part of digital citizenship.

Sharing accurate information about scam tactics with people who may be targets. Helping family members recognize warning signs before an attack occurs, not only after. Reporting harassment and abusive accounts on platforms rather than ignoring them. Advocating — as a user, a voter, and a citizen — for privacy-protective practices from companies and policy makers.