3.3 Privacy, Security, Data Collection, and Local vs. Cloud Storage
Key Takeaways
- Digital services collect data through account forms, cookies, tracking pixels, device fingerprinting, location services, app permissions, purchase and loyalty records, and data brokers that combine sources.
- Privacy concerns who may collect and use personal information; security concerns protecting data and systems from unauthorized access, change, or loss.
- Cloud storage offers access from anywhere, easy sharing, and provider-managed backup, but depends on an Internet connection and a third party's security and data practices.
- FERPA protects student education records at schools that receive U.S. Department of Education funds; COPPA requires verifiable parental consent before commercial online services collect personal information from children under 13.
- Private or incognito browsing does not keep local history, but websites, employers, schools, and Internet providers can still see the traffic.
What this competency asks
ETS asks you to know privacy and security issues regarding the acquisition, use, and disclosure of information in a digital world:
- Using correct vocabulary, describe privacy and security issues.
- In context, identify appropriate strategies to safeguard privacy and ensure security.
- Describe trade-offs between local and cloud-based data storage.
- Identify methods that digital services use to collect information about users.
Core vocabulary
| Term | Meaning |
|---|---|
| Personally identifiable information (PII) | Data that identifies a person alone or in combination: name, address, ID numbers, biometric data, precise location |
| Privacy | A person's control over how information about them is collected, used, and shared |
| Security | Protecting data and systems from unauthorized access, modification, or loss |
| Metadata | Data about data, such as the time, location, and device attached to a photo or message |
| Data aggregation | Combining data from many sources into a detailed profile |
| Data broker | A company that buys, combines, and sells personal data |
| De-identification / re-identification | Removing identifiers from a data set, and the risk of identifying people again by linking it to other data |
| Data minimization | Collecting only the data a task actually needs |
| Data breach | Unauthorized access to or release of protected data |
| Consent | Permission given knowingly and freely, ideally opt-in |
Privacy and security overlap but differ. A company can have excellent security and still invade privacy by collecting too much and selling it. A company can have a strict privacy policy and still suffer a breach because of weak security.
How digital services collect information
| Method | How it works | Example |
|---|---|---|
| Account registration and forms | You type the data in | Name, birthdate, and email for a new account |
| Cookies | Small files stored by the browser. First-party cookies remember logins; third-party cookies track you across sites | Ads that follow you from site to site |
| Tracking pixels (web beacons) | Tiny invisible images or scripts that report when a page or email is opened | Marketing email "open" tracking |
| Device fingerprinting | Identifies a device from its combination of browser, fonts, screen size, and settings | Tracking that survives clearing cookies |
| Location services | GPS, Wi-Fi, and cell-tower data | Maps apps and "near me" features |
| App permissions and SDKs | Access to contacts, camera, microphone, or motion sensors; embedded analytics code | A flashlight app requesting contact access |
| Usage and interaction logs | Clicks, searches, watch time, typing patterns | Recommendations based on viewing history |
| Purchase and loyalty records | Transactions linked to a card or rewards number | Coupons based on shopping patterns |
| Smart and IoT devices | Voice assistants, fitness trackers, connected cars | Activity and location history |
| Photo metadata (EXIF) | Embedded time, camera, and sometimes GPS coordinates | A posted photo revealing a home location |
| Data brokers and aggregation | Combining public records, purchases, and online activity | Detailed profiles sold to marketers |
When a question asks how a service learned something the user never typed, the answer is usually tracking (cookies, pixels, fingerprinting), device permissions, metadata, or data bought from other sources.
Strategies to safeguard privacy and ensure security
| Goal | Effective strategies |
|---|---|
| Limit collection | Review app permissions; turn off unneeded location access; opt out of data sale and personalized ads; share less on social media |
| Limit tracking | Block third-party cookies; use tracker-blocking browser settings; clear cookies; remove photo location metadata before posting |
| Protect accounts | Long, unique passwords stored in a password manager; multi-factor authentication; watch for phishing |
| Protect data | Keep software updated; encrypt devices; use HTTPS; back up important files; use a VPN on untrusted public Wi-Fi |
| Choose tools carefully | Read privacy policies; prefer services that practice data minimization; for schools, vet ed-tech vendors and sign data-privacy agreements |
Common misconception: Private or incognito browsing only stops the browser from saving local history and cookies after the session ends. Websites, an employer or school network, and the Internet provider can still observe the traffic.
Local versus cloud-based storage
Local storage keeps data on devices you control, such as a laptop drive, USB drive, or school server. Cloud storage keeps data on a provider's servers, reached over the Internet (for example, Google Drive, OneDrive, or iCloud).
| Factor | Local storage | Cloud storage |
|---|---|---|
| Access | Only where the device is; works offline | Anywhere with Internet; offline access is limited |
| Collaboration | Harder; files must be copied or emailed | Easy real-time sharing and co-editing |
| Control and privacy | You control the hardware and who sees the data | The provider holds the data; subject to its policies and legal requests |
| Security responsibility | Yours: physical theft, encryption, updates | Shared: the provider secures its infrastructure; you secure your account |
| Reliability and backup | Lost if the device fails or is stolen without a backup | Provider typically keeps redundant copies; risk of outages or account lockout |
| Cost and capacity | One-time hardware cost; limited by the device | Subscription; scales easily |
| Speed | Fast for large local files | Limited by bandwidth |
Many organizations combine the two, for example local working copies with cloud backup. Section 15.4 revisits this trade-off from the systems perspective.
Student-privacy laws that shape classroom technology
- FERPA (Family Educational Rights and Privacy Act) protects education records at schools that receive U.S. Department of Education funds. Schools generally need written consent from a parent, or from an eligible student aged 18 or older, to disclose PII from those records. Under the "school official" exception, a vendor may receive records without consent if it performs a service the school would otherwise do itself, has a legitimate educational interest, is under the school's direct control regarding the records, and does not redisclose or misuse them.
- COPPA (Children's Online Privacy Protection Act) applies to commercial websites and online services directed to children under 13, or that knowingly collect data from them. They must obtain verifiable parental consent before collecting personal information. FTC guidance allows a school to authorize collection on parents' behalf only for an educational purpose, not for commercial uses such as behavioral advertising. The FTC updated the COPPA Rule in 2025.
- GDPR (General Data Protection Regulation) is the European Union's law. It applies to organizations that process personal data of people in the EU and grants rights such as access, correction, erasure, and data portability. In the United States, several states have their own consumer privacy laws, such as California's CCPA as amended by the CPRA.
Classroom connection
A CS teacher should be able to explain what a learning app collects about students, why a free service may be paid for with data, and how to adjust settings. Teachers should also vet tools against district privacy agreements before assigning them. These are exactly the discussion questions ETS lists for this competency.
A student who never entered their location notices that a shopping website shows ads for stores in their town. Which is the most likely way the website obtained this information?
A teacher is deciding whether students should save project files on the lab computers' local drives or in a district cloud service. Which statement is an accurate trade-off?
A student says, "I use incognito mode, so the school network can't see which sites I visit." What is the most accurate response?