Skip to content

Know Your Rights: Internet Privacy and Protected Information

According to the Pew Research Center, 79 percent of American adults say they are very or somewhat concerned about how companies use the data collected about them online — yet most have no clear picture of what privacy on the internet actually means or what information is protected under the law. That gap between concern and understanding is where real risk lives.

This article covers what internet privacy means in plain terms, what counts as protected information, how a privacy statement works and what it should contain, and what your actual rights are as a user in the US and UK. You will also find the most common mistakes people make when they assume they are protected online but are not.

Most guides on this topic either stop at definitions or go so deep into legal language that they become useless for everyday readers. This one aims to do neither. It explains the concepts clearly, uses real examples, and tells you specifically what to look for — and what to ignore — when you encounter privacy policies and data collection notices online.

What Is Privacy on the Internet and Why the Definition Matters

Internet privacy, also called online privacy or digital privacy, refers to your ability to control what personal information is collected about you while you use the internet, how that information is used, and who has access to it. It is not a single thing — it is a cluster of rights, expectations, and protections that apply differently depending on where you are, what platform you are using, and what kind of data is involved.

The 1997 Information Infrastructure Task Force, created under President Clinton, defined information privacy as an individual’s claim to control the terms under which personal information is acquired, disclosed, and used. That definition is still widely used in US legal frameworks today. In the UK and EU, the General Data Protection Regulation (GDPR) uses slightly broader language, defining personal data as any information that relates to an identified or identifiable living individual — meaning even indirect identifiers like your IP address or device ID can count.

The practical distinction matters: under US law, privacy protections tend to be sector-specific (health data, financial data, children’s data each have their own rules). Under GDPR, which affects any site that handles data from UK or EU residents, the framework is more unified. If you are reading this in the US or UK, both sets of rules likely apply to the services you use every day.

One thing most definitions agree on is the element of control. Privacy is not about keeping everything secret — it is about having the meaningful ability to decide what you share, with whom, and under what conditions. That is harder to exercise than it sounds.

What Counts as Protected Information Online

Not all information carries the same privacy weight. Broadly, personally identifiable information (PII) is any data that can be used to identify a specific individual — either on its own or when combined with other data. Your name, email address, home address, phone number, date of birth, Social Security number, and financial account details are obvious examples. But PII extends further than most people realize.

IP addresses, GPS coordinates, device identifiers, browsing history, and purchasing behavior all qualify as personal data under GDPR. According to the National Institute of Standards and Technology (NIST), privacy means “freedom from intrusion into the private life or affairs of an individual when that intrusion results from undue or illegal gathering and use of data about that individual.” NIST’s framing is useful because it includes behavioral data — not just name-and-address information.

In practice, this means the following types of data are considered protected under various laws:

  • Name, email, phone number, and physical address
  • Financial data including bank account and credit card details
  • Health and medical records
  • Biometric data such as fingerprints and facial recognition data
  • Location data including GPS history and IP addresses
  • Browsing and search history when linked to an identifiable user
  • Social media activity when it can identify you individually

One nuance that most privacy guides skip: data that has been “anonymized” is not always truly private. Under GDPR, personal data that has been de-identified or pseudonymized but can still be used to re-identify a person remains personal data within the scope of the regulation. In other words, a company telling you your data is “anonymized” does not necessarily mean it cannot be traced back to you.

Quick Note: Many apps collect far more data than they need to function. A simple game asking for your location, or a shopping app requesting access to your contacts, should prompt you to ask why. Denying unnecessary permissions is one of the most effective privacy controls available to you right now.

Privacy Statement Definition — What It Actually Is and What to Look For

A privacy statement (sometimes called a privacy policy or privacy notice) is a legal document that discloses how an organization collects, uses, stores, and shares the personal data it gathers from users. It exists partly to satisfy legal requirements and partly to give users enough information to make informed decisions about sharing their data.

The two terms are often used interchangeably, but there is a meaningful difference. A privacy policy is typically the internal document governing how an organization handles data. A privacy notice is the outward-facing communication to users — what data is held and what will be done with it. When you see a “Privacy Policy” link at the bottom of a website, you are usually reading a hybrid of both.

Legally, what a privacy statement must include depends on jurisdiction. In the US, there is no single federal privacy law requiring all companies to have one, but sector-specific laws fill the gaps. The Children’s Online Privacy Protection Act (COPPA) applies to sites collecting data from children under 13. The Health Insurance Portability and Accountability Act (HIPAA) requires written privacy notices for health services. The California Consumer Privacy Act (CCPA) gives California residents the right to know, delete, and opt out of the sale of their data — and requires businesses to disclose their practices clearly.

In the UK and EU, GDPR sets a higher bar. A valid privacy notice must state what data is collected, the legal basis for collecting it, how long it will be kept, whether it will be shared with third parties, and what rights the user has — including the right to access, correct, or erase their data.

What should you actually look for when reading a privacy statement? Four things matter most. First, check whether the site says it sells or shares your data with third parties. Second, look for what the legal basis for data collection is — “legitimate interest” is vague and worth scrutinizing. Third, find out how long your data is retained. Fourth, check whether there is a clear process for requesting deletion of your data. If any of these are absent or written in impenetrable language, treat that as a warning sign.

A 2007 University of California, Berkeley study found that 75 percent of consumers believed a site having a privacy policy meant it would not share data with third parties. That assumption is wrong, and it remains common. A privacy policy is a disclosure document — not a promise of protection.

The Difference Between Data Privacy, Data Security, and Confidentiality

These three terms get tangled constantly, and the confusion leads people to misunderstand what they actually have — and do not have — when a company says their data is “secure.”

Data privacy is about rights and rules: who has the legal right to access your data, under what conditions it can be collected, and what choices you have about how it is used. Data security is about technical protection: the tools and procedures — encryption, firewalls, access controls — that prevent unauthorized parties from accessing data. A company can have strong data security and still terrible data privacy. Your information might be perfectly safe from hackers while being sold freely to advertisers.

Confidentiality is different again. It is an ethical obligation on the part of whoever receives your data to protect it from unauthorized disclosure. Your doctor, your lawyer, your therapist — these professionals have confidentiality obligations that exist independently of technical security measures. Online, confidentiality is a murkier concept because most services are not bound by the same professional ethics codes.

Our take: The distinction between privacy and security is the one most worth internalizing. When a company announces it has suffered a “data breach,” the conversation tends to focus on security failures. But the more important question is often why that company was holding so much of your data in the first place — and what their privacy practices allowed them to do with it before the breach occurred. Security failure is visible. Privacy failure is often invisible and ongoing.

How Online Privacy Works in Practice — and Where It Breaks Down

Understanding what online privacy means in theory is one thing. Seeing how it operates (and fails) in real life is more useful.

Cookies are the most familiar example. When you visit a website and see a cookie consent banner, you are being asked whether to allow the site to store small data files in your browser that track your behavior — on that site and, through third-party cookies, across other sites. Under GDPR, sites must get meaningful consent before setting non-essential cookies. In practice, many cookie banners are designed to make “accept all” easy and “manage preferences” deliberately difficult — a pattern the UK’s Information Commissioner’s Office (ICO) has repeatedly called out as non-compliant.

Social media platforms present a more complex case. Apps like Instagram and Facebook collect user data for a personalized experience, but they also track user activity across other apps and websites. According to a 2023 Surfshark report, shopping and food delivery apps collect the most data of any app category, while Facebook and Instagram rank among the worst for privacy practices overall. When you use “Sign in with Google” or “Sign in with Facebook” on a third-party site, you are giving that site access to whatever permissions that social account allows — and giving the social platform data about your activity on the third-party site.

The Cambridge Analytica case remains the clearest large-scale example of privacy breakdown at scale. Cambridge Analytica collected personal data from over 85 million Facebook users without informed consent, and used that data for politically targeted advertising during the 2016 US presidential election. The US Federal Trade Commission fined Facebook $5 billion as a result — and the scandal directly influenced the development of GDPR enforcement.

On the tools side, both DuckDuckGo (US) and Proton (Switzerland, widely used in the UK) have built substantial user bases specifically by offering privacy-first alternatives to mainstream search and email. DuckDuckGo does not build user profiles or track search history. Proton Mail uses end-to-end encryption so that even Proton cannot read user emails. These are not perfect solutions — no tool eliminates all risk — but they represent concrete alternatives for users who want more control over their data than mainstream platforms offer.

Quick Note: The “I have nothing to hide” argument misunderstands what privacy is for. Privacy is not about hiding wrongdoing — it is about maintaining control over your own narrative, protecting yourself from manipulation, and preserving the right to change your mind without a permanent digital record following you.

One honest limitation worth naming: complete online privacy is not realistically achievable for most people without significant sacrifices in convenience. Some data sharing is unavoidable — navigation apps need location data to function, online banking requires identity verification, and tax authorities legitimately need income information. The realistic goal is not total privacy but meaningful, informed control over what you share and with whom.

Frequently Asked Questions

What is the difference between a privacy policy and a privacy statement?

In most everyday usage, the terms are interchangeable — both refer to the document a website or service publishes explaining how it handles your personal data. Technically, a privacy policy tends to refer to internal governance rules an organization follows, while a privacy statement or privacy notice is the outward-facing document addressed to users. Under GDPR, organizations are required to provide a privacy notice to users — a clear, accessible explanation of data collection and use. When you click a “Privacy Policy” link on a website, you are reading the public-facing version of that document.

Is my browsing history considered private information?

It depends on the jurisdiction and the context. Under GDPR, browsing history linked to an identifiable user is personal data and must be handled accordingly. In the US, your internet service provider can legally collect and sell your browsing history under current federal rules, though some states like California provide additional protections. Using a VPN can prevent your ISP from seeing what you browse, but does not protect you from data collection by the websites you visit directly. Incognito or private browsing mode does not protect your browsing history from your ISP — it only prevents your browser from storing a local record.

Do privacy policies actually protect my data?

A privacy policy is a disclosure — not a promise of protection. It tells you how a company handles your data, but reading it does not grant you protection if those practices are aggressive. A site can have a lengthy, legally compliant privacy policy while still selling your data to dozens of advertising partners. What matters is what the policy actually says about third-party sharing and data retention, not whether a policy exists at all. Under GDPR and CCPA, you have enforceable rights to access, correct, and delete your data — those rights are worth exercising when it matters.

What does “right to be forgotten” mean online?

The right to be forgotten, formally called the right to erasure under GDPR, is your right to request that a company delete the personal data it holds about you. This applies in the UK and EU, and covers situations where the data is no longer necessary for the purpose it was collected, where you withdraw consent, or where the data was unlawfully processed. It is not absolute — companies can refuse deletion requests if they have a legal obligation to retain the data. In the US, a similar right exists under the California Consumer Privacy Act for California residents, but there is no equivalent federal law covering all Americans.

What is the biggest online privacy risk most people overlook?

App permissions are consistently underestimated. Most people focus on data breaches as the main privacy threat, but ongoing, legitimate data collection by apps they willingly installed is a larger and more continuous risk for most individuals. Shopping apps, games, and utility apps routinely request access to location data, microphone, camera, and contacts far beyond what their function requires. Reviewing and revoking unnecessary app permissions — which takes about ten minutes on most smartphones — removes a significant amount of ongoing data exposure that no privacy policy change or VPN can address.

How does GDPR affect users in the US?

GDPR applies to any organization that handles personal data belonging to UK or EU residents, regardless of where that organization is based. If you are a US resident using a service that also operates in Europe, that service likely applies GDPR-level practices to some extent across its entire user base — though not always. Practically, GDPR has raised the baseline of privacy disclosures globally because large companies found it easier to apply a single standard than to build separate systems for different jurisdictions. It does not give US residents the same enforceable rights as EU citizens, but its influence on how major platforms handle data affects everyone who uses them.

Final Thoughts

Internet privacy is not a feature you opt into — it is a right you have to actively protect because the default settings of most online services are designed to collect as much as possible. Understanding what privacy on the internet means, what information qualifies as protected, and what a privacy statement is actually telling you puts you in a much better position than most users.

The most useful thing you can do right now is spend fifteen minutes reviewing the app permissions on your phone and the privacy settings on the two or three platforms you use most. That single action addresses more real-world data exposure than any theoretical understanding of privacy law. After that, look at the privacy notice of any service that holds sensitive data — your banking app, your health tracker, your email provider — and find where it explains third-party data sharing. What you find there will tell you more about your actual privacy situation than any headline about data breaches.