UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 3.1 Free with a free account
How Modern Technology Collects, Stores, and Exposes Your Personal Information
Ethics in Technology · Chapter 3: When Technology Invades Personal Life: Privacy, Economics, and Online Commerce RisksSection 3.1 · lesson 8 of 11614 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: The Financial Ripple Effects That Information Technology Creates Across Economies →← Practical Measures You Can Take Right Now to Defend Your Computer Against AttacksNext lesson: The Financial Ripple Effects That Information Technology Creates Across Economies →
In this lesson
Small records combine into a revealing personal profile.
- Separate active and passive digital footprints
- Explain 5 collection mechanisms
- Trace aggregation by data brokers
- Recognize exposure and re-identification risks
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,737 words). Read along, or search it.
Chapter 3
How Technology Collects Your Information
Personal information is collected through much more than the forms people knowingly complete. Browsing behavior, device characteristics, locations, and connected products can create an extensive passive record. This lesson separates that passive footprint, from the information deliberately supplied through accounts and posts. We examine cookies, pixels, fingerprinting, location readings, and connected devices as distinct collection mechanisms. They can work together, so controlling one does not automatically control the others. Data brokers then acquire scattered records, match them to people, and sell assembled profiles. The combined record can reveal information no single source originally held in one place. Exposure can involve an attacker, but also sales, sharing, legal demands, mistakes, or re-identification. Finally, we consider why leaked information can remain useful, and make a later exposure more damaging. The central issue is the revealing combination, rather than whether any one fragment seems harmless alone.
Digital Footprint
What You Provide and What Activity Reveals
An active footprint contains information a person knowingly provides, through accounts, photographs, forms, or orders. People can generally describe these disclosures, and may make deliberate choices about what to share. A passive footprint records activity, such as pages opened, time spent, devices used, and locations observed. That record can grow while the person is paying attention to something entirely different. It can become extensive, because collection continues across repeated activities and devices. Active information is often an edited self-description, reflecting how someone chooses to present themselves. Passive records describe actions, which may interest parties studying behavior or predicting future choices. An agreement accepted once can describe collection that continues long after the original transaction. That does not automatically establish informed understanding, or settle whether every later use is appropriate. Ask what is collected, for what purpose, by which parties, and for how long.
Mechanism 1
Cookies Remember State and Sometimes Connect Sites
A cookie is a small item of browser storage, returned to a website during later interactions. A first-party cookie comes from the visited site, supporting preferences, shopping baskets, or sign-in state. Those functions help the service work across pages, instead of forgetting every previous action. A third-party cookie comes through content belonging to another organization, embedded within the page. Where browser rules permit it, the same third party can connect activity across different sites. Advertising networks can use that pattern to build a profile beyond any one visited website. Browser protections and settings can limit this mechanism, so cross-site tracking is not equally possible everywhere. Clearing cookies removes stored identifiers, though permitted later activity can create new cookies again. This is useful protection against a particular mechanism, rather than a complete description of collection. To understand the remaining footprint, we must also consider methods that do not depend on stored cookies.
Mechanism 2
A Tracking Pixel Reports Through Its Request
A tracking pixel, or web beacon, may be an image just one pixel across. It can also be equivalent code, included within a website or an email message. Loading it sends a request to the server providing the embedded content. That request can reveal timing, network address, and some information about the requesting device. It allows the sender to infer that content was opened, without requiring an additional click. Email systems use related mechanisms to measure apparent opens, repeated views, or approximate location. The available information and accuracy depend on how the email service handles the request. Blocking remote images can reduce this collection route, though it does not govern every tracking method. The important point is that receiving content can itself involve sending information back. A tiny, unnoticed component can therefore create a record beyond the visible message being read.
Mechanism 3
Fingerprinting Combines Ordinary Device Details
Fingerprinting derives an identifier from a combination of characteristics reported by the device. Relevant details include browser version, operating system, screen size, time zone, and language. Fonts, graphics behavior, and audio-processing characteristics can add further distinctive information. Any single detail may be ordinary, while the combination narrows the possible devices substantially. This mechanism does not necessarily leave a stored identifier that cookie clearing can remove. The device can report a similar combination again, allowing recognition across later activity. Private browsing alone should therefore not be treated as a guarantee of anonymity. Modern browser protections can reduce or alter exposed characteristics, so their behavior is not identical. The source's general lesson remains useful: a defense must address the mechanism actually doing the collection. Changing browser storage is different from controlling the information a device reveals about itself.
Mechanism 4
Repeated Location Points Become a Pattern
Location can be inferred through satellite positioning, nearby wireless networks, mobile towers, or network addresses. Applications often request access, even when their visible purpose needs only limited location information. A single point can support a nearby-store result, but a continuing stream creates something much more revealing. Repeated nighttime and working-hour locations can suggest a residence and an employer. Visits and time spent can also suggest clinics, places of worship, union activity, or personal relationships. These implications arise without anyone reading a private message or asking an explicit question. The source asks whether a shopping application needs location continuously to display nearby stores. Access while the person is actually using that feature serves the stated purpose more narrowly. Background collection produces a pattern extending beyond the point needed for that task. Compare the collection's scope with its purpose, rather than treating every permission request as equally necessary.
Mechanism 5
Connected Devices Bring Collection Into Daily Life
Connected devices extend collection into homes, journeys, and information about the body. A speaker processes sound to recognize its wake word, though product features and data handling vary. Televisions may identify viewed content, producing records about household media habits. Doorbells can record visitors and timing, including neighbors who did not choose to install the device. Fitness bands gather movement, heart-rate, and sleep information, revealing patterns in personal activity. Vehicles can record speed, braking, and routes, combining behavior with location over time. These products are often purchased for convenience, then configured once and rarely reconsidered. Collection can continue long after the owner stopped thinking about the original settings. The practical question is what the particular product records, stores, shares, and allows the person to control. Do not assume every device behaves identically, or that being inside the home makes its records private automatically.
Aggregation
Data Brokers Join Records Across Sources
A data broker's product is information about people, assembled from many sources. Retailers, applications, advertising networks, public registers, loyalty schemes, and other brokers can supply fragments. The broker matches records to individuals, then sells profiles to parties beyond the original collection setting. The person described may never have heard of the broker, or opened an account with it. A hashed email address can act as a matching hinge, connecting otherwise separate records. Advertising identifiers, home addresses, and device fingerprints can also connect fragments about the same person. Repeated matching creates a profile that no single contributing organization originally held in full. That explains why closing one account does not necessarily remove information held through another relationship. The difficulty includes discovering which organizations hold the profile, and which sources supplied its contents. Aggregation changes the meaning of small disclosures, because their combination becomes the product being sold.
Profile Contents
Observed Records and Inferred Traits
Profiles can include identity and household information, such as names, relatives, addresses, and property details. Those records can support advertising based on life stage, or identity-verification services. Financial indicators can include estimates of income, spending, borrowing behavior, or payment history signals. Behavioral profiles combine browsing, purchases, media, and application use, supporting advertising or issue campaigning. Location histories describe visits, routes, dwell time, and probable home or work locations. The broker may also infer sensitive characteristics, rather than merely repeat observations collected directly. Purchase patterns can suggest pregnancy, searches can suggest health concerns, and missed payments can suggest hardship. An inference is a guess, and the guess can be wrong. A person may nevertheless be treated as though it were true, without knowing the inference exists. That creates a second concern alongside collection: the consequences of decisions based on inaccurate personal assumptions.
Exposure Routes
A Break-In Is Only 1 Way Information Travels
A breach is one exposure route, when an attacker obtains records despite their intended protection. Onward sale needs no attacker, because transferring information can be part of the holder's business model. Sharing with partners, analytics providers, or advertisers increases the number of organizations holding copies. Each copy has its own protective arrangements, and its own possibility of misuse or failure. Legal demands can also compel disclosure, through courts or public authorities with applicable powers. Careless setup may leave storage readable by the public, creating exposure through ordinary configuration error. Re-identification connects supposedly nameless information back to the individuals it describes. These routes differ in cause and authority, so exposure should not be understood only as a dramatic break-in. Whether a transfer is lawful does not by itself answer every ethical question about its appropriateness. Understanding the route helps explain why information can reach parties beyond the person's original expectations.
Aggregation Effect
Removing a Name Can Leave Identifying Power
Removing a name does not necessarily remove the identifying power of the remaining record. A postal district, date of birth, and sex can together narrow a record to a person. Repeated location patterns can also reveal who is described, through probable home and work addresses. This is the aggregation effect: combinations reveal more than individual details considered separately. It follows the same basic principle as fingerprinting, applied to stored records rather than live device characteristics. An anonymity claim therefore needs examination of the remaining information, and what can be matched with it. Deleting a label while keeping a distinctive combination may leave the important privacy problem unchanged. The source's examples illustrate the possibility, rather than a universal percentage identifying every population. Ask whether the retained details can single someone out, directly or alongside another available record. Meaningful protection must address that combined identifying power, rather than rely on reassurance about removed names.
Durable and Compounding
One Release Can Make a Later Release More Harmful
Information is durable, because copies can persist in buyers' systems, archives, and backups. Deleting the original holder's copy does not necessarily recall every copy already transferred elsewhere. Exposure also compounds, as details from separate incidents can be joined around the same people. The source imagines email addresses and birth dates leaking in the first incident. Two years later, another incident exposes home addresses and answers to account-recovery questions. The earlier information can remain in circulation, making the newer release more useful than it would be alone. Combined details can support more specific targeting, identification, or attempts to take over an account. The harm develops through the join, rather than only through the amount revealed in one event. That makes restraint before collection valuable, alongside protection and recovery after information has been gathered. Consider what is actually needed, because information is difficult to recall once copies have spread.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About How Modern Technology Collects, Stores, and Exposes Your Personal Information
What is the difference between an active and a passive digital footprint?
How do websites track you without cookies?
What is a data broker?
Why is personal information that leaked years ago still a risk?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →