Understanding data privacy in a connected world
Every time you use an app, visit a website, buy something online, use a connected device, or create an account, you may be generating information about yourself.
Some of that information is obvious, such as your name, email address, or purchase history. Other information can be less obvious, including your location, device information, browsing activity, preferences, or interactions with a service.
So who owns all of this information?
The answer is more complicated than simply saying that you or the company owns it.
Privacy laws differ by country, state, industry, and type of information. What matters in practice is understanding what information is collected, why it is collected, how it is used, who can access it, and what choices or rights you have.
What counts as personal data?
Personal data, also called personal information in many U.S. privacy laws, can include information that identifies you or can reasonably be associated with you.
Examples can include:
- Your name and contact information
- Account credentials
- Purchase history
- Location information
- IP addresses and device information
- Browsing or app activity
- Photos, recordings, or communications
- Health or financial information
- Certain biometric information
- Information that can be combined with other data to identify or profile you
The exact definition varies depending on the applicable law.
For example, California's privacy law gives consumers rights related to personal information that businesses collect, use, and share. Those rights can include knowing what information is collected, requesting deletion in certain circumstances, and opting out of certain sales or sharing.
Do companies own your personal data?
There isn't one universal answer.
When you provide information to a company, you may be giving that organization permission to collect and use it for specific purposes. The terms of the service, privacy policy, contracts, and applicable laws can all affect what the organization can do with that information.
That does not necessarily mean the company has unlimited rights to use your information however it wants.
Privacy laws can give individuals specific rights over their information. Companies can also make privacy promises that they are legally required to honor.
The Federal Trade Commission, for example, says businesses need to live up to privacy and security promises they make to consumers.
So instead of asking only “Who owns my data?”, it can be more useful to ask:
Who has access to it?
What are they allowed to do with it?
Who can they share it with?
How long can they keep it?
What choices do I have?
Why do companies collect so much information?
Data can help companies provide and improve their products and services.
For example, information can be used to:
- Create and manage your account
- Process payments
- Provide personalized experiences
- Recommend products or content
- Understand how customers use a service
- Detect fraud or security threats
- Provide customer support
- Measure advertising and marketing
- Develop or improve products
Some data collection is necessary for a service to work. Other collection may be optional or used for purposes that you may not expect.
That's why data minimization is an important privacy concept. Organizations should consider whether they actually need to collect and retain particular information rather than collecting everything simply because they can.
The FTC has long encouraged businesses to collect only the information they need, limit access to it, and safely dispose of information they no longer need.
What about data collected by connected devices?
The growth of connected devices has made the privacy question even more complicated.
Smartphones, smart speakers, vehicles, fitness devices, cameras, televisions, appliances, and other connected products can generate large amounts of information.
Some devices may collect information about:
- Location
- Usage patterns
- Device performance
- Voice interactions
- Movement
- Preferences
- Connected accounts
- Interactions with other devices
The important question isn't simply whether a device collects data. It is what the device collects, why it collects it, where the information goes, and how it is protected.
Organizations should consider privacy and security throughout the lifecycle of connected products and services.
What about AI?
Artificial intelligence has added another layer to the data privacy conversation.
AI systems can process enormous amounts of information, and organizations may use personal or business data to provide services, analyze information, or improve systems.
That creates important questions:
- What information is being provided to the AI system?
- Is the information stored?
- Who can access it?
- Is it used to train or improve a model?
- Can information provided by one user affect another user's experience?
- How long is the information retained?
The FTC has specifically warned AI companies that they must honor privacy and confidentiality commitments made to customers. It has also emphasized that companies should not secretly use customer information in ways that contradict their privacy promises.
For consumers and businesses, this means it is worth understanding an AI service's data practices before entering sensitive information.
Privacy and security are not the same thing
Privacy and cybersecurity are closely connected, but they are different.
Privacy is about how information is collected, used, shared, retained, and managed.
Cybersecurity is about protecting systems and information against unauthorized access, attacks, loss, or other threats.
You need both.
A company could have strong cybersecurity but still collect more personal information than necessary. Conversely, a company could have a thoughtful privacy policy but fail to adequately protect the information it collects.
NIST's Privacy Framework is designed to help organizations identify and manage privacy risks and can be used alongside cybersecurity risk-management practices.
Why privacy matters to small businesses
Privacy isn't only an issue for large technology companies.
Small and midsize businesses may collect customer names, contact information, payment information, employee records, health information, or other sensitive data.
They may also rely on third-party services such as cloud storage, payment platforms, marketing tools, customer relationship management systems, and AI applications.
That means a business should understand its entire data processing ecosystem, including the vendors and service providers that may handle information on its behalf. NIST specifically recommends considering privacy risk across these interconnected relationships.
Privacy can also affect customer trust.
If you tell customers that you will protect their information, you need to follow through. The FTC actively enforces privacy and security promises made by businesses.
How businesses can protect personal information
Businesses do not need to collect less information simply because data is valuable. They should collect and retain information thoughtfully.
Start with these practices:
Know what data you have
Create an inventory of the personal information your business collects and where it is stored.
Collect only what you need
If you don't have a legitimate business reason to collect information, consider whether you need to collect it at all.
Limit access
Employees and service providers should have access to information based on their responsibilities and business needs.
Protect the information
Use appropriate security controls to protect sensitive information from unauthorized access, loss, or misuse.
Review third parties
Understand what vendors and service providers do with information you provide to them.
Don't keep information forever
Establish retention practices so information is deleted or securely disposed of when there is no longer a legitimate reason to keep it.
Make privacy understandable
Your privacy policy should accurately explain what your business actually does with personal information.
These practices align with the broader privacy risk-management approach described by NIST and the FTC.
What can you do to protect your own data?
You don't have to become a privacy expert to make better decisions about your information.
Start by:
- Reviewing privacy settings on important accounts
- Limiting app permissions to what is necessary
- Using strong, unique passwords
- Enabling multi-factor authentication
- Keeping devices and applications updated
- Being careful about what information you provide to websites and apps
- Reviewing privacy policies when you create important accounts
- Deleting accounts you no longer use
- Being cautious about entering sensitive information into AI tools
Most importantly, think about the information you are sharing before you share it.
The future of data privacy
The amount of information generated by our digital lives will continue to grow.
AI, connected devices, personalized services, digital advertising, and other technologies can provide significant benefits, but they also create new privacy questions.
That means privacy cannot be treated as a one-time decision.
For organizations, privacy needs to be part of how products and services are designed, data is managed, vendors are selected, and risks are assessed.
For individuals, understanding what information we share and how it may be used can help us make more informed decisions.
The question of who "owns" your data may not always have a simple answer.
But you should know who controls it, what they can do with it, and what rights and choices you have.
Frequently Asked Questions
Who owns my personal data?
There is no universal rule that gives a simple ownership answer for all personal information. Rights and responsibilities depend on the type of information, the organization handling it, contracts, and applicable privacy laws.
Can companies do whatever they want with my data?
No. Companies may be subject to privacy laws, contractual requirements, and their own privacy promises. The FTC can take action when companies make privacy or security promises they do not honor.
What is data minimization?
Data minimization means limiting the collection and retention of personal information to what is necessary for a legitimate purpose. Collecting less information can reduce both privacy and security risks.
How does AI affect data privacy?
AI can process and analyze large amounts of information, which creates questions about what data is collected, how it is used, whether it is retained, and whether it is used to train or improve AI systems. Organizations should understand an AI service's privacy practices before providing sensitive information.
What should businesses do to protect customer data?
Businesses should know what information they collect, limit unnecessary collection, restrict access, protect information appropriately, review third-party providers, establish retention practices, and make sure their privacy statements accurately describe their practices.
Is privacy the same as cybersecurity?
No. Privacy concerns how information is collected and used. Cybersecurity focuses on protecting information and systems from unauthorized access and other threats. They overlap and should be managed together.
