How Companies Use Your Data

• A. Demographic data purchased from a data broker
• B. Purchase history recorded when you buy from an online store ✓
• C. Credit scores obtained from a credit bureau
• D. Location data sold by a mobile app's advertising partner

Why: First-party data is collected directly by a company from its own interactions with you, such as your purchase history on the store's website. The other options describe third-party data that comes from outside sources.

• A. A company that only stores data for a single business client
• B. A regulated bank that manages customer financial records
• C. A company that collects, aggregates, and sells personal information about consumers ✓
• D. A government agency that tracks public records

Why: Data brokers gather personal information from many sources, including public records, websites, and other companies, then package and sell it to advertisers, employers, and others. Most consumers have never interacted with them directly.

• A. Browser cookies that store your language preference
• B. Email subject lines you have opened
• C. Location data from GPS, Wi-Fi, and cell towers ✓
• D. The font size you select on a website

Why: Location data from GPS, Wi-Fi networks, and cell towers can build a detailed history of where you go and when. This makes it one of the most sensitive types of data companies collect.

• A. Data about how you act online, such as pages viewed, clicks, and time spent on content ✓
• B. Data that a company uses to judge your moral character
• C. Data submitted through formal surveys only
• D. Data that is required by law to be reported to regulators

Why: Behavioral data tracks your actions, such as what you click, how long you watch a video, and what you search for. Companies use it to predict your interests and target ads or recommendations.

• A. To fix hardware problems in your device remotely at all times
• B. To tailor the app to your device and to help identify you across sessions and sites ✓
• C. Because device information is legally required to access the internet
• D. To permanently erase your previous browsing history

Why: Device details help companies optimize how content displays and can create a unique 'fingerprint' that recognizes your device across visits, even without cookies. This supports both functionality and tracking.

• A. A cookie set by the website you are currently visiting
• B. A cookie set by a domain different from the site you are visiting, often used for cross-site tracking ✓
• C. A cookie that stores your password securely on your device
• D. A cookie that expires immediately after you close your browser

Why: Third-party cookies come from domains other than the one shown in the address bar, such as advertising networks, and allow tracking of your activity across many different websites.

• A. A high-resolution image used to improve website graphics
• B. A tiny, usually invisible image embedded in a page or email that reports back to a server when it loads ✓
• C. A password-protected folder that stores browsing history
• D. A type of antivirus scanner built into browsers

Why: Tracking pixels are often 1x1 pixel images. When your browser or email client requests them, the server logs that request, revealing that you viewed the page or email and sometimes when and from where.

• A. It encrypts your browsing history so only you can read it
• B. It identifies you by combining attributes like screen size, installed fonts, and browser version, without needing cookies ✓
• C. It verifies your fingerprint to log you into websites
• D. It blocks all websites from accessing your device settings

Why: Fingerprinting builds a profile from many device and browser details. Because the combination is often unique, a site can recognize you even after cookies are deleted.

• A. To speed up the app's performance on older devices
• B. To link your activity across different apps and websites for targeted advertising and measurement ✓
• C. To protect your device from malware
• D. To automatically update the operating system

Why: Advertising identifiers are resettable IDs that let advertisers and data brokers connect your behavior across many apps, which is why both platforms give users options to limit or reset them.

• A. A tool that records users' mouse movements, clicks, and typing to recreate their visit as a video-like playback ✓
• B. A tool that replays the sound of a website's background music
• C. A backup system that restores deleted browser tabs
• D. A feature that repeats a video automatically when it ends

Why: Session replay tools capture user interactions so companies can see how people use their site. This can include sensitive input unless the tool is configured to mask form fields.

• A. Selling physical products directly to consumers
• B. Collecting, aggregating, and selling personal information about individuals to other companies ✓
• C. Providing internet access to households in rural areas
• D. Designing software for government agencies only

Why: Data brokers collect personal information from many sources, combine it into profiles, and sell or license those profiles to businesses for marketing, risk assessment, and other purposes.

• A. Only information you explicitly type into your own private diary
• B. Public records, loyalty card programs, online browsing activity, and purchase histories ✓
• C. Information exclusively from your employer's internal files
• D. Nothing, because data brokers are legally prohibited from collecting any data

Why: Data brokers draw from public records like property and voter registrations, commercial sources like retail loyalty programs, and digital sources like cookies and app usage.

• A. To replace their own employees with automated systems
• B. To build more detailed profiles of consumers for targeting, pricing, and risk assessment ✓
• C. To comply with tax reporting requirements
• D. To delete outdated records on their own customers

Why: Buyers use broker data to better understand potential customers, target advertising, set insurance or credit-related risk estimates, and fill gaps in their own information.

• A. Posting more personal details publicly on social media
• B. Opting out with data brokers directly and limiting app permissions and cookies ✓
• C. Using the same password across every online account
• D. Sharing your loyalty card number with every store you visit

Why: Many brokers offer opt-out processes, and limiting app permissions, managing cookies, and reducing unnecessary data sharing all reduce the information flowing into broker databases.

• A. Only criminal law, since data collection is a crime
• B. Privacy laws such as the California Consumer Privacy Act (CCPA) or the EU's GDPR ✓
• C. Maritime shipping regulations
• D. No laws apply to data brokers anywhere in the world

Why: Privacy laws like CCPA in California and GDPR in the European Union give residents rights such as access, deletion, and opt-out regarding personal data that companies hold.

• A. Your physical height and weight
• B. Your browsing history, search queries, and the sites you visit ✓
• C. Your handwriting samples
• D. Your favorite book from childhood

Why: Companies rely heavily on browsing history, search queries, and site visits because these show your interests and intent, which helps advertisers decide which ads are most relevant to you.

• A. A small file stored on your device that can track your activity across websites ✓
• B. A snack that websites give you as a reward
• C. A password that protects your bank account
• D. A type of virus that deletes your files

Why: Cookies are small text files placed on your device by websites and advertisers. They allow tracking of your visits and behavior over time, which supports targeted advertising.

• A. A fixed price that never changes for any customer
• B. A pricing strategy where prices change based on demand, timing, or customer data ✓
• C. A discount offered only to people who pay in cash
• D. A tax added to products sold online

Why: Dynamic pricing adjusts prices in real time based on factors like demand, competitor pricing, time of day, or information about a customer. This is one way companies use data to set prices.

• A. The website is randomly broken for one of them
• B. Companies may use data such as location, device, or browsing history to personalize prices ✓
• C. Prices are always the same, so this never happens
• D. Only the first visitor of the day gets the true price

Why: Companies can use data like your location, the device you use, or your past behavior to personalize offers and prices. This is a common practice in e-commerce and travel booking.

• A. Turning up your screen brightness
• B. Blocking third-party cookies and limiting app permissions for tracking ✓
• C. Using a larger font size on your phone
• D. Buying more products online

Why: Blocking third-party cookies and restricting app tracking permissions limits how much of your activity can be followed across sites and apps, which reduces the data available for targeted ads and personalized pricing.

• A. To delete inactive user accounts automatically
• B. To build predictions about individuals' interests, behaviors, and likely actions based on their data ✓
• C. To encrypt customer data so it cannot be read by staff
• D. To print physical copies of customer records for audits

Why: Profiling uses data about a person to infer characteristics and predict future behavior, such as what products they might buy or content they might enjoy.

• A. A customer manually reading a privacy policy
• B. A loan application being automatically approved or rejected by software based on a credit score model ✓
• C. An employee choosing a font for a company newsletter
• D. A website displaying its opening hours

Why: An automated decision is one made by a system without meaningful human involvement. Loan approvals driven by scoring models are a classic example.

• A. The algorithm is required by law to repeat content
• B. Your device is running out of storage space
• C. The system learns from your clicks and watch history and reinforces patterns that keep you engaged ✓
• D. Companies pay users to only see certain videos

Why: Recommendation systems optimize for engagement by learning from past behavior, which can create feedback loops that narrow the content you see.

• A. Only the user's handwriting samples
• B. Only the user's legal name and birthdate
• C. Browsing history, purchase records, app usage, and location patterns ✓
• D. The weather forecast for the user's city

Why: Behavioral profiles are typically assembled from many signals, including what people view, buy, how they use apps, and where they go.

• A. To guarantee they receive the highest possible discount
• B. To understand, question, or contest decisions that may be unfair or inaccurate ✓
• C. To avoid ever having to create an online account
• D. To make the algorithm run faster

Why: Transparency lets people spot errors or bias and, in many jurisdictions, gives them rights to request explanations or challenge automated decisions.

• A. Physical theft of hard drives from data centers
• B. Weak or stolen credentials that give attackers unauthorized access to systems ✓
• C. Customers voluntarily posting their data publicly
• D. Government agencies releasing data under public records laws

Why: Most breaches begin with compromised credentials, such as reused or weak passwords, phishing-stolen logins, or missing multi-factor authentication, which let attackers enter systems that hold stored data.

• A. The data is encrypted only while being transmitted over the internet
• B. The data is stored in an encrypted form on disks or databases, so it is unreadable without the decryption key ✓
• C. The data has been permanently deleted from all servers
• D. The data is stored in a location that no employee can access

Why: Encryption at rest protects stored information on storage media or in databases, so if someone steals the physical drive or copies the files, they cannot read the contents without the key.

• A. Breached companies are required to share customer data with all their competitors
• B. People often reuse the same email and password across multiple accounts, so leaked credentials can be tried elsewhere ✓
• C. Stolen data automatically updates credit card limits at other stores
• D. Breaches always expose the entire internet's user base at once

Why: When leaked credentials are reused, attackers use them in automated 'credential stuffing' attacks against other websites and services, extending the damage far beyond the original breach.

• A. Storing as much data as possible in one large central file
• B. Collecting only the data actually needed and deleting it when no longer required ✓
• C. Printing all customer records and keeping them in filing cabinets
• D. Publishing customer data openly so breaches are less noticeable

Why: Data minimization and timely deletion mean less sensitive information exists to be stolen, so a breach exposes fewer people and fewer records.

• A. Ignore it, since breaches rarely affect individuals
• B. Immediately send your password to the company so they can verify it
• C. Change passwords for affected accounts, enable multi-factor authentication, and watch for suspicious activity ✓
• D. Close your bank account and open a new one with a different bank

Why: Changing passwords (especially any that were reused), turning on multi-factor authentication, and monitoring accounts for unusual activity are practical steps that limit the damage from exposed data.

• A. The Children's Online Privacy Protection Act (COPPA)
• B. The General Data Protection Regulation (GDPR) ✓
• C. The Fair Credit Reporting Act (FCRA)
• D. The Electronic Communications Privacy Act (ECPA)

Why: The GDPR, in effect since 2018, grants EU residents rights including access to their data, correction of inaccuracies, and erasure (the 'right to be forgotten'). COPPA protects children's data in the US, FCRA covers credit reports, and ECPA covers electronic communication interception.

• A. It blocks all advertisements from loading on web pages
• B. It sends a signal asking websites not to track your browsing activity across sites ✓
• C. It deletes all cookies automatically when you close the browser
• D. It encrypts all data sent between your device and websites

Why: Do Not Track is a browser header that signals to websites that you do not want to be tracked. Compliance is voluntary, so many sites ignore it, which is why it is often combined with other privacy tools.

• A. Uninstalling the app's updates
• B. Reviewing and turning off unnecessary permissions such as location, contacts, and microphone access in your device settings ✓
• C. Changing the app's display language
• D. Clearing the app's cache once a year

Why: Device permission settings directly control what data an app can access. Reviewing and revoking unnecessary permissions limits collection at the source, while the other options do not affect what data is gathered.

• A. Demand that a company pay you for your data
• B. Ask an organization to confirm whether it holds your personal data and receive a copy of it ✓
• C. Require a company to sell your data only to approved buyers
• D. Prevent any future data from ever being created about you

Why: A data subject access request is a formal request, available under laws like the GDPR and CCPA, that lets individuals find out what personal data an organization holds about them and obtain a copy. It does not involve payment or prevent all future data creation.

• A. Using the same strong password on every account
• B. Using a unique email alias or separate email address for sign-ups and opting out of marketing ✓
• C. Sharing your social media login with friends
• D. Keeping your browser history enabled so sites remember you

Why: Using separate email addresses or aliases for different services makes it harder for companies to match your identity across datasets and reduces spam and profiling. Reusing passwords is a security risk, not a privacy measure, and the other options increase data sharing.