UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 3.3 Free with a free account
Why Shopping Online and on Mobile Devices Creates Unique Privacy Vulnerabilities
Ethics in Technology · Chapter 3: When Technology Invades Personal Life: Privacy, Economics, and Online Commerce RisksSection 3.3 · lesson 10 of 11615 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Using Social Platforms Responsibly in a Professional and Workplace Context →← The Financial Ripple Effects That Information Technology Creates Across EconomiesNext lesson: Using Social Platforms Responsibly in a Professional and Workplace Context →
In this lesson
Payment protection is one part of a much larger information exchange.
- Identify supplied, observed, and inferred records
- Judge mobile permissions and location access
- Explain payment tokens and loyalty exchanges
- Assess Wi-Fi precautions and PCI DSS limits
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,821 words). Read along, or search it.
Chapter 3
Shopping Privacy on Websites and Phones
Shopping online can create a detailed personal record, before any purchase reaches a payment page. The information includes what shoppers supply, what services observe, and what businesses infer from those records. Mobile shopping adds device capabilities and movement information, depending on permissions and the platform's controls. We will judge requests against the feature being used, rather than accepting every prompt automatically. Payment tokenization can reduce exposure of the underlying card number, which is a valuable security benefit. It does not erase the purchase, the delivery address, or the retailer's continuing profile. Loyalty programs link transactions over time, exchanging immediate benefits for a durable information relationship. Public Wi-Fi requires a balanced assessment, recognizing both modern encryption and risks that encryption leaves unresolved. Finally, we examine the shared payment-security baseline, established through the Payment Card Industry Data Security Standard. Keep asking what the other party receives, and whether that scope matches the purpose of the exchange.
Information Categories
A Retailer Can Learn Without Completing a Sale
Separate a retailer's information into three categories, because each creates a different privacy question. Supplied information includes names, delivery addresses, contact details, sizes, gift recipients, and payment information. These details can directly identify shoppers, and connect them with households or other people. Observed information includes device characteristics, pages viewed, searches, dwell time, and abandoned shopping carts. Those observations can accumulate even when the person browses, leaves, and buys nothing. Inferred information includes estimated income, health interests, life changes, and sensitivity to prices. A pattern of purchases may suggest pregnancy or a house move, without an explicit disclosure. That suggestion remains an inference, and should not be treated as a confirmed fact about the shopper. The resulting advertisement can be visible, while the assumption behind it remains obscure. The privacy issue therefore includes what is concluded, how it is used, and whether mistakes can be challenged.
Shopping Journey
Collection Surrounds the Transaction
Collection can start with searches, clicks, comparisons, scrolling, and the time spent considering a product. A discount code's effect on the decision can become another recorded behavioral signal. Checkout then adds addresses, contact information, payment handling, and information used for fraud checks. Persistent identifiers can connect these records with earlier visits, making the history more useful for analysis. The retailer may also load services supplied by analytics providers, advertisers, fraud-scoring companies, and chat operators. Recommendation engines can introduce further parties, each receiving information according to the particular implementation. The shopper's visible relationship is with the store, while its service relationships may be harder to discover. Terms such as service providers or trusted partners, do not themselves identify every actual recipient. Informed assessment requires knowing recipients, purposes, retention, and the scope of the continuing collection. The completed transaction is consequently only one stage, within a much broader information exchange.
Mobile Permissions
Compare the Request With the Feature
A phone is often carried throughout the day, making its activity closely connected with an individual. Installed apps and websites have different capabilities, subject to operating-system permissions and other protections. Precise location may support a nearby-store feature, without requiring continuous access outside that feature. Contacts access can expose other people, when referring one friend needs only a chosen contact. Camera access can support barcode scanning or virtual try-on, requested when the feature is opened. Microphone access should match an actual voice function, rather than be assumed necessary for ordinary shopping. A photo picker can provide one review image, instead of opening an entire photo library. Advertising identifiers and tracking controls vary by platform, so review the available settings rather than assuming identical behavior. A permission prompt usually explains a capability, without fully describing retention, frequency, or downstream recipients. Judge the narrowest access needed for the chosen task, and reconsider access that continues beyond it.
Location
Movement Adds Meaning to Purchase Records
Location access changes purchasing records into information about where a person moves and spends time. Satellite positioning can provide coordinates, while nearby wireless information can help place a device indoors. In-store beacons are small radio transmitters, allowing nearby phones to support more detailed indoor positioning. A delivery address supplied at checkout can confirm or add meaning to other observations. Repeated nighttime and working-hour locations can suggest a home, employer, and regular daily routine. Visits to competitors, clinics, or places of worship can reveal information beyond the purchase itself. The same pattern can remain identifying, even when the record has no explicit personal name. A store finder needs relevant location during its use, rather than an automatic justification for continuous collection. The issue is proportionality, comparing the feature's need with the movement history actually gathered. Information from several ordinary sources can become much more revealing, once combined over time.
Tokenization
A Substitute Number Reduces Payment Exposure
Tokenization replaces a sensitive payment number with a substitute, governed by the issuing payment system. In the wallet example, the bank or payment network provisions a token for the device. The wallet supplies that substitute to the merchant, instead of handing over the underlying full card number. A transaction-specific security code accompanies the token, allowing the payment system to verify the transaction. This limits the usefulness of intercepting and replaying a payment message, within the system's protections. A merchant breach need not expose a reusable underlying card number, when that number was never supplied. Tokens can also be revoked or replaced, according to the issuer's procedures and the payment arrangement. Different token systems impose different restrictions, so do not assume every substitute is interchangeable or merchant-specific. The diagram illustrates the division of responsibility, rather than every technical message in a payment protocol. The essential benefit is reducing exposure of the valuable original number, at a point where compromise could occur.
Security and Privacy
Protecting a Card Number Does Not Hide a Purchase
Normal wallet payments commonly require a fingerprint, face authentication, or a passcode before authorization. The actual rules and exceptions depend on the service, device, and payment mode being used. It is therefore too strong to claim that every stolen phone is unusable for every possible payment. Tokenization also does not remove the information surrounding the transaction, which is a separate privacy concern. The merchant can still know the goods, amount, timing, and delivery details of an order. Location and account records can still connect the purchase with a broader customer history. Retailer profiling or onward sharing is not prevented, merely because payment uses a substitute number. Wallet providers' access and retention differ, so avoid assuming all services retain identical personally identifiable histories. Protecting a card number is valuable, while protecting an entire life requires attention to other records. Assess the payment safeguard and the information exchange separately, before deciding what the purchase reveals.
Loyalty Programs
An Immediate Discount Builds a Durable Link
A loyalty program offers visible benefits, including discounts, points, personalized offers, and early access. In exchange, the retailer obtains a stable identifier, connecting transactions across time and shopping channels. That link can survive changes in payment card or device, and include purchases made with cash. Preferences and responses to offers help tailor later promotions, and can inform individual pricing decisions. Contact details and engagement support direct marketing, alongside any sharing permitted by the actual arrangement. Continuing purchase patterns can suggest health interests, financial stress, pregnancy, or a house move. These remain potentially mistaken inferences, even when they influence how the shopper is treated. The discount is immediate and easy to value, while later effects of the linked record are harder to assess. That imbalance is the source's ethical concern, involving proportion and comprehension of the exchange. Consider retention, recipients, and future uses, rather than judging the arrangement only by today's saving.
Public Wi-Fi
Encryption Protects Content, With Important Limits
Public Wi-Fi is useful, and modern encryption has changed the risks compared with older unprotected traffic. HTTPS generally protects payment content, between a device and the correct website during transport. Another nearby network user therefore cannot ordinarily read an encrypted card number simply from shared-network traffic. That protection does not settle which services can be inferred, from connection metadata available to the network. The visibility of destinations varies with the technologies and protections used by the device and service. A deceptive website can also use HTTPS, because encryption does not establish honest intent. An unexpected login request on a look-alike network can consequently remain a warning sign. Carelessly implemented apps can introduce risks, through unencrypted connections or mishandled certificate validation. The fair conclusion recognizes the payment-content protection, while checking destinations, connection choices, and unexpected prompts. Do not reduce the assessment to either complete safety, or the claim that all public traffic is readable.
Shopping Precautions
Make Deliberate Connection and Destination Choices
First, consider mobile data when an open network is unnecessary, especially for payment or account access. Second, disable automatic joining of open networks, so connection happens through a deliberate choice. This reduces the chance of silently using a network, merely because its name looks familiar. Third, check the expected website domain, rather than relying only on an encryption icon. A secure connection can still reach a fraudulent destination, if the address itself is deceptive. Fourth, evaluate a reputable virtual private network, when it is appropriate for unavoidable public connections. It changes who must be trusted with network traffic, moving that role toward the provider. It does not make a dishonest website trustworthy, or remove every risk from the device. Finally, stop and investigate unexpected login demands or certificate warnings, rather than dismissing them automatically. These precautions address particular mechanisms, while retaining a realistic understanding of what encryption already protects.
PCI DSS
6 Goals Organize 12 Broad Requirements
The Payment Card Industry Data Security Standard establishes a shared technical and operational payment-security baseline. The lesson groups twelve broad requirements under six goals, beginning with secure networks and systems. That includes traffic controls and secure configuration, instead of leaving vendor defaults in place. The second goal protects payment data, through limited storage, stored-data safeguards, and encrypted public-network transmission. The third concerns vulnerability management, including malware protection and secure application development. The fourth concerns access, restricted by business need, individual identity, and physical protection of systems. The fifth combines monitoring and testing, with access logs, reviews, and recurring checks of safeguards. The sixth requires security policies and responsibilities, kept current and understood by the people involved. Card-brand programs and acquiring relationships enforce compliance obligations, rather than the standard itself being a statute. Together, these goals raise the baseline across organizations, while applicable responsibilities depend on their payment arrangements.
Scope and Assurance
A Payment Baseline Does Not Resolve Every Privacy Risk
Payment-security obligations involve merchants and other entities handling account data, or affecting its security environment. Outsourcing processing can change which controls apply directly, without removing every responsibility from the merchant. The organization still needs to understand provider responsibilities, and the obligations of its own payment arrangement. The standard's subject is payment account security, rather than a complete privacy framework for every customer record. Browsing histories, movement trails, inferred characteristics, and loyalty profiles therefore require additional questions about appropriate handling. Periodic assessments also need continuing protection, because the assessed system and its risks can change. A past assessment alone cannot guarantee that every present vulnerability is controlled or every incident prevented. For a shopper, evaluate payment safeguards, permissions, collection, and sharing as related but distinct concerns. Ask what the service needs, what it actually receives, and how the resulting information is used. That is the lesson's central judgment, connecting a convenient purchase with the wider privacy exchange surrounding it.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About Why Shopping Online and on Mobile Devices Creates Unique Privacy Vulnerabilities
How does payment tokenization protect my card number?
Is it safe to shop online on public Wi-Fi?
What data do online retailers collect about shoppers?
What is PCI DSS?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →