L1
·
Quiz
·
Lab
L2
·
Quiz
·
Lab
L3
·
Quiz
·
Lab
L4
·
Quiz
·
Lab
Module Test
Module 2 · Lesson 1

The Permission Sleight of Hand

How app install screens became the fine print nobody reads — and what that actually costs you.
When you tap "Allow," what exactly are you allowing?

In 2014, researchers at Carnegie Mellon University ran a study asking Android users to estimate how often apps accessed their data. Users guessed their apps collectively accessed their location around 30 times over a two-week period. The actual figure, recorded by the researchers' monitoring software: over 5,398 times — an underestimate by a factor of nearly 180. Users weren't lying. They genuinely had no idea.

Why Permissions Don't Work the Way You Think

When an app asks for permission, the request is deliberately framed around a single, reasonable-sounding use. A flashlight app needs camera access to turn on the LED. A weather app needs location to show your local forecast. A game needs storage to save your progress. Each request, isolated, sounds fine.

The problem is aggregation. The same camera permission that lets a flashlight work also gives the app access to the camera hardware at any time the app is running — and in older versions of Android, while it was backgrounded too. The same location permission that delivers your weather can ping your GPS every few minutes, building a detailed movement history that reveals your home address, your workplace, your medical appointments, your church, your political rallies.

This gap between stated purpose and actual capability is the sleight of hand.

Documented — FTC vs. Goldenshores Technologies, 2013

The maker of "Brightest Flashlight Free" — which had over 50 million downloads — settled with the FTC after the agency found the app transmitted users' precise location and device ID to advertising networks. The app's permission screen mentioned location access. The privacy policy did not explain that this data was being sold to third parties in real time. The FTC called it deceptive. The app remained in the Play Store.

The Six Permissions That Matter Most

Modern smartphones group permissions into categories. Some are low-stakes. Others are essentially a master key to your private life. Security researchers at the International Computer Science Institute analyzed 17,260 apps in 2020 and found a category of data they called side channels — ways apps extract sensitive information using permissions that sound innocuous.

Permission Stated Use What It Also Enables Risk
Location (Precise) Maps, weather Home/work inference, movement tracking, religious/political profiling High
Microphone Voice search, calls Ambient audio sampling, TV show detection, conversation fragments High
Contacts "Find friends" Social graph mapping, email harvesting, relationship inference High
Camera Photos, QR codes Facial recognition data, environment scanning, document capture High
Storage / Files Save files Read all photos, documents, cached data from other apps Medium
Network State Check connectivity Identify Wi-Fi networks you've connected to — reveals locations visited Medium
The "Just-In-Time" Permission Theater

Both Apple and Google, under regulatory and reputational pressure, introduced runtime permissions — popups that ask for access exactly when a feature needs it rather than at install time. Apple added precise-vs-approximate location in iOS 14. Google introduced one-time permissions in Android 11.

These changes are genuinely meaningful. But they don't solve the underlying problem: the permission dialog describes a capability, not a business practice. Granting location to a navigation app and granting location to a free game are the same tap, the same dialog — but the business logic behind them is entirely different. The navigation app needs your location to function. The free game needs your location to sell it.

The 2021 Ruling That Changed Nothing

In 2021, Norway's Data Protection Authority fined Grindr €9.63 million for sharing users' precise GPS coordinates, HIV status, and other sensitive attributes with at least 87 advertising partners — without valid consent. Grindr's permission screen said it collected location for "functionality." The data was leaving the app within milliseconds of launch. Similar findings were made against Period Tracker Flo, which was sending ovulation and pregnancy data to Facebook and Google despite explicit promises in its privacy policy that it wouldn't.

Key Terms
Runtime PermissionA permission dialog shown when a specific feature is first used, rather than at app install. Required on Android 6.0+ and iOS for sensitive data types.
Permission Scope CreepWhen permissions granted for one stated purpose are quietly used for additional, undisclosed purposes — typically data monetization.
Side ChannelA method of inferring sensitive information indirectly — e.g., using accelerometer data (requires no permission on Android) to infer keystrokes or location.

Lesson 1 Quiz

The Permission Sleight of Hand — 4 questions
In the 2014 Carnegie Mellon study, users underestimated how often apps accessed their location by approximately what factor?
Users guessed about 30 location accesses; the actual count was over 5,398 — roughly 180 times more than perceived.
The Carnegie Mellon study found users underestimated by a factor of nearly 180 — guessing ~30 accesses when the real number exceeded 5,398.
What did the FTC find Brightest Flashlight Free was doing without users' knowledge?
Correct. The FTC's 2013 settlement found the app — which had 50M+ downloads — was selling real-time location and device ID to ad networks. The privacy policy never disclosed this.
The FTC found the app was transmitting users' precise GPS location and unique device identifier to third-party advertising networks in real time.
Which of these permissions is described as a "side channel" risk because it requires NO explicit permission on Android?
The accelerometer — used for steps, tilt, orientation — requires no permission grant on Android, yet researchers have used it to infer keystrokes, location context, and even conversations via vibration.
The accelerometer is a classic side channel: it needs no permission, yet researchers have used accelerometer data to infer keystrokes and even nearby speech via vibration patterns.
What key limitation do runtime permission dialogs (introduced by Apple and Google) fail to address?
Exactly. A permission dialog tells you what data an app can access — not what it will do with it. Granting location to a navigation app and to a free game look identical at the permission layer.
The core gap is that permission dialogs describe capability, not intent or business practice. Granting location to a game and to a navigation app look identical in the dialog.

Lab 1 — Permission Audit

Analyze what your apps are actually asking for and why.

Your Mission

Think of three apps on your phone that you use regularly. For each one, consider what permissions it has, what it claims to need them for, and whether that explanation actually holds up. Then discuss your findings with the AI below.

Try asking: "A flashlight app on my phone has location permission — is that suspicious?" or "What can a free game actually do with my contacts list?" or "How would I check what permissions an app actually has on Android vs. iPhone?"
AI Lab Assistant
Permission Audit
Let's do a permission audit. Tell me about an app you use regularly — what it does, and what permissions it has (or what you think it might have). I'll help you figure out whether those permissions make sense for that app's stated purpose.
Module 2 · Lesson 2

The Data Broker Pipeline

How your phone's data travels from app to advertiser to insurance company — often in under a second.
Who actually receives your data — and who is that company?

In December 2018, the New York Times obtained a dataset of over 50 billion location pings from the phones of more than 12 million Americans. The data had been collected by location data companies — firms whose names most users had never heard — operating as SDKs embedded silently inside popular apps. The Times was able to trace the movements of a Pentagon employee, identify regular visitors to a psychiatric facility, and track a person from their office to Alcoholics Anonymous meetings. All of this from a dataset that was described, in the contracts that authorized its collection, as "anonymous."

What Is an SDK and Why Does It Matter

An SDK — Software Development Kit — is a package of pre-built code that app developers drop into their apps to add features without building them from scratch. When you download an app, you're often also installing code from Google (analytics), Facebook (the "Like" button login), AppsFlyer (attribution tracking), Adjust (ad measurement), and sometimes a dozen smaller firms you've never heard of.

These SDKs run inside the app with the same permissions the app has. If you granted the app location access, every SDK inside it can potentially access your location too. The app developer may not have fully audited what the SDK is doing — they accepted a terms-of-service document and moved on.

Real Case — Premom Ovulation Tracker, 2023

The FTC sued Premom after discovering the app was sending sensitive reproductive health data — including menstrual cycle tracking and pregnancy indicators — to two Chinese analytics companies, AppsFlyer and Umeng, as well as Google. Premom's privacy policy promised data would only be used "to provide services." The SDKs embedded in the app had a different agenda. The FTC required Premom to delete the data and pay $200,000 — and explicitly banned the app from sharing health data for advertising.

The Real-Time Bidding Ecosystem

When you open an app that contains advertising, a silent auction takes place in approximately 100 milliseconds. Your device sends a bid request to an ad exchange — a packet containing your device ID, your approximate location, the app you're using, the time of day, and a profile built from your browsing and app history. Advertisers bid. The winner's ad loads. You see a banner for something you looked at two days ago.

This process is called Real-Time Bidding (RTB). The bid request itself — the packet your phone sends — is transmitted to potentially hundreds of companies simultaneously. Most of them don't win the auction. But they all received the data. RTB was designed to sell ads; it also functions as one of the most efficient personal data distribution systems ever built.

Irish DPC Investigation into Google RTB, 2021–2022

Ireland's Data Protection Commission investigated Google's RTB system and found that each time an auction occurs, Google's bid request shares users' personal data — including location, browsing habits, device identifiers, and inferred characteristics like income bracket and health conditions — with potentially thousands of advertising companies globally. The DPC noted this happens "billions of times per day." Google was fined €150 million by France's CNIL in 2022 for related cookie consent violations, and the RTB system investigation remains among the largest open cases in EU data protection law.

The Data Broker Layer

Beyond advertising, a parallel industry buys, aggregates, and resells this data: data brokers. Companies like LexisNexis Risk Solutions, Acxiom, Oracle Data Cloud, and hundreds of smaller firms purchase location pings, app usage data, purchase history, and behavioral profiles — then sell processed versions of this data to employers, insurers, lenders, law enforcement, and political campaigns.

In 2023, the Senate Judiciary Committee published a report finding that data brokers were selling Americans' location data to foreign adversaries, including firms with ties to Chinese military intelligence. The data had originated in ordinary apps — weather apps, games, utilities — that users had installed on their phones and granted location access.

Buyer Type
Insurance Companies
Purchase location and driving behavior data to adjust premiums. GM OnStar shared driving data from 1.5M customers with LexisNexis and Verisk without clear disclosure (2024 FTC probe).
Buyer Type
Law Enforcement
The U.S. military and ICE purchased location data from Babel Street and Venntel — sourced from ordinary apps — to conduct warrantless surveillance. Documented by Vice/Motherboard (2020).
Buyer Type
Political Campaigns
Location data from rallies, churches, and gun shows is used to build voter profiles. The 2016 Trump campaign purchased data from Cambridge Analytica, which had itself harvested Facebook data via a quiz app.
Buyer Type
Employers
Background check companies now sell "risk scores" derived from app behavior data. Some include inferred health conditions, financial stress signals, and "social media sentiment analysis."
Key Terms
SDKSoftware Development Kit — third-party code packages embedded in apps. SDKs inherit the host app's permissions and may send data to their own servers independently.
Real-Time Bidding (RTB)An automated ad auction that occurs in ~100ms when you open an app. The bid request broadcasts your device data to potentially hundreds of ad companies simultaneously.
Data BrokerA company that buys personal data from apps and advertisers, aggregates it, and sells processed profiles to third parties — including insurers, employers, and governments.

Lesson 2 Quiz

The Data Broker Pipeline — 4 questions
In the 2018 New York Times investigation, what was the dataset the Times analyzed officially described as in the contracts that authorized its collection?
Correct. Despite being labeled "anonymous," the Times was able to identify specific individuals — including a Pentagon employee and visitors to a psychiatric facility — from the location ping data.
The contracts called it "anonymous" — yet the Times was able to identify specific named individuals, including a Pentagon staffer and people attending AA meetings, from the dataset.
What critical security property do SDKs embedded inside an app automatically inherit?
Exactly. SDKs run inside the app's process and inherit all permissions the host app has. If the app has location access, every SDK inside it can potentially use that location access too.
SDKs run within the host app's process and inherit all of its granted permissions. A location-enabled app passes that capability to every SDK it contains.
In Real-Time Bidding, approximately how long does the ad auction process — and data broadcast to hundreds of companies — take?
RTB auctions complete in approximately 100 milliseconds — faster than a human blink. In that time, your personal data has been broadcast to potentially hundreds of advertisers, most of whom didn't win the bid but kept the data.
RTB runs in ~100ms — faster than a blink. Your data is broadcast to potentially hundreds of companies in that window, regardless of who wins the ad auction.
The 2023 Senate Judiciary Committee report found that data brokers were selling Americans' location data to whom?
Correct. The Senate report specifically found location data originating from ordinary consumer apps — weather apps, games, utilities — was being sold through brokers to entities with ties to foreign intelligence services.
The Senate Judiciary Committee found that app-derived location data was making its way to foreign adversaries including firms linked to Chinese military intelligence, via the data broker supply chain.

Lab 2 — Tracing the Pipeline

Follow your data from app to advertiser to data broker.

Your Mission

Pick an app you use daily — a social media platform, a game, a news reader, or a utility. Now think about the invisible journey your data takes from the moment you open it. Use the AI to map that journey and identify who might be receiving your data downstream.

Try asking: "If I open Instagram on my phone right now, who actually receives data about that action?" or "What is AppsFlyer and why is it in so many apps?" or "How does a free weather app make money from my location?"
AI Lab Assistant
Pipeline Tracer
Let's trace the data pipeline. Name an app you use regularly — or describe a type of app — and I'll walk you through who typically receives data when you use it, and how that data travels downstream to advertisers and data brokers.
Module 2 · Lesson 3

What "Free" Apps Actually Cost

The economics of surveillance capitalism — and why your data is worth more than you think.
If you're not paying for the product, what exactly are you paying with?

In 2018, as part of the Cambridge Analytica congressional hearings, internal Facebook documents revealed the company's data valuation models. Facebook estimated the average U.S. user generated approximately $26.76 in advertising revenue per quarter — roughly $107 per year. But this figure only captured direct advertising. Independent analyses of Facebook's data licensing, API access, and shadow profile construction suggested the total economic value extracted per active user was substantially higher — estimates ranged from $200 to $900 annually depending on demographic and behavioral profile richness.

The Mechanics of Monetization

Free apps generate revenue through several mechanisms, often simultaneously. Understanding them is the first step to understanding what you're actually exchanging when you install a free app.

Revenue Model
Behavioral Advertising
The app sells your attention and your behavioral profile to advertisers. Your click history, search queries, dwell time on content, and app usage patterns build a profile used to target ads. This is the primary revenue source for Google, Meta, TikTok, and Twitter/X.
Revenue Model
Data Licensing
Some apps explicitly sell raw or processed data to third parties. Weather apps (see: The Weather Channel case, 2019), flashlight apps, and many free VPNs are built primarily as data collection vehicles with a utility feature as the hook.
Revenue Model
SDK Revenue Sharing
App developers embed data-collection SDKs from companies like Kochava, Verizon Media, or X-Mode. The SDK company pays the developer a fee per install or per data point collected. The developer gets paid; you get tracked.
Revenue Model
Freemium Conversion
Some free apps use data collection to power personalization that makes the premium tier more compelling. Spotify's free tier collects listening data to improve its recommendation algorithm — which is then marketed as a premium feature.
Case Study — The Weather Channel App & IBM, 2019

Los Angeles City Attorney Mike Feuer sued IBM's The Weather Company (owner of the Weather Channel app, then with 45 million active users) for selling users' precise location data to third parties — including hedge funds, retailers, and energy companies — without making this clear in its disclosure screens. The app's prompts said location was needed "to provide weather forecasts to your exact location." It was also being used to power a commercial location data product. IBM settled in 2021, agreeing to change its disclosure practices. No fine was assessed.

The VPN Trap

Free VPNs represent one of the starkest examples of the "free = product" dynamic. A VPN is supposed to protect your privacy by encrypting your traffic and masking your IP address. A free VPN achieves this — and simultaneously routes your entire internet traffic through its servers, where it can be logged, analyzed, and sold.

In 2019, a report by Top10VPN analyzed 150 free VPN apps and found that 86% had unacceptable privacy policies, 26% contained tracking libraries, and 18% had no encryption at all. Several traced back to Chinese ownership, including Hotspot Shield's previous parent and, most notably, VPN Proxy Master, which was linked to Guangzhou-based developer Innovative Connecting — the same company behind other data-harvesting utility apps flagged by cybersecurity researchers.

FTC Action — Kochava, 2022–2024

In 2022, the FTC sued Kochava — a mobile analytics and data broker company — for selling geolocation data that could be used to track people's visits to reproductive health clinics, addiction treatment centers, and places of worship. The FTC alleged this data was sourced directly from apps that had embedded Kochava's SDK for attribution tracking. Kochava countersued and the litigation continued through 2024. The case established a significant legal precedent: that selling data enabling inference of sensitive conditions — even without a direct health record — could constitute an unfair trade practice.

The Compounding Value Problem

Individual data points are cheap. A single location ping is worth fractions of a cent. What makes personal data economically powerful is combination and longitudinal depth. A data broker who has your location history for 18 months can infer your income bracket (neighborhoods you frequent), your religion (houses of worship), your health status (hospital visits, pharmacy trips), your political leanings (rallies, campaign offices), and your relationship status (co-location patterns with other devices).

This is why the standard industry defense — "we only collect anonymous, aggregate data" — is systematically misleading. Research by MIT and the University of Louvain has repeatedly shown that four location data points are sufficient to re-identify 95% of individuals in a dataset, even if names have been removed.

Key Terms
Surveillance CapitalismAn economic system, named by Harvard professor Shoshana Zuboff, in which the collection and commodification of personal data is the primary business model — using behavioral prediction as the product sold to advertisers and institutions.
Re-identificationThe process of re-attaching personal identity to supposedly anonymized data using auxiliary information. MIT research showed four location points suffice to identify 95% of individuals.
Shadow ProfileA profile built about a person who has never signed up for a service, constructed from data points provided by that person's contacts, behavioral traces, and third-party purchases. Facebook's shadow profile system was confirmed during the 2018 Congressional hearings.

Lesson 3 Quiz

What "Free" Apps Actually Cost — 4 questions
The 2019 lawsuit against IBM's Weather Channel app alleged it was using location data for what undisclosed purpose beyond weather forecasting?
Correct. The lawsuit found The Weather Channel app — with 45M users — was selling precise location data to hedge funds, retailers, and energy companies to power a commercial location data product, without clear disclosure.
The LA City Attorney's lawsuit found IBM/The Weather Company was selling location data to hedge funds, retailers, and energy companies — commercial buyers who used it for market analysis, not weather forecasting.
According to MIT and University of Louvain research, how many location data points are sufficient to re-identify 95% of individuals in an "anonymous" dataset?
Just four location points — e.g., home, work, a favorite restaurant, a gym — are enough to uniquely identify 95% of people in a dataset, even with names removed. "Anonymous" location data is rarely truly anonymous.
Only four location data points are needed to re-identify 95% of individuals in a supposedly anonymized dataset. The MIT/Louvain research fundamentally undermined the "anonymous data" defense.
What did the FTC allege Kochava was doing that made its data sales potentially an "unfair trade practice"?
The FTC's 2022 case against Kochava focused on the harm enabled by inference — that location data revealing visits to reproductive health clinics or addiction centers could be used to discriminate against or harm users, even without a direct medical record.
The FTC alleged Kochava's data enabled inference of sensitive personal conditions — visits to reproductive clinics, addiction centers, religious institutions — which could enable harm even without explicit health records.
What is a "shadow profile" as confirmed during the 2018 Congressional hearings about Facebook?
Shadow profiles are built on non-users using data contributed by that person's friends and contacts — phone numbers uploaded to "Find Friends," email addresses from contact syncs — combined with third-party data purchases.
A shadow profile is built on a person who never joined the platform, constructed from data that other users provided — contact uploads, email syncs — plus purchased third-party data. Confirmed by Zuckerberg during the 2018 Senate hearings.

Lab 3 — The True Cost Calculator

Work out what your apps are really extracting from you.

Your Mission

Think about the free apps you use most — social media, messaging, games, utilities. Using what you've learned about how these apps monetize data, try to estimate what those apps are actually worth from your data alone. Challenge the AI to help you think through the math and the logic.

Try asking: "If Facebook makes $107/year from my data, and I've had an account for 8 years, what's that worth?" or "I use TikTok for 2 hours a day — what data is being collected in a typical session?" or "Why is a health app's user worth more to advertisers than a game app's user?"
AI Lab Assistant
Data Value Analysis
Let's calculate the real cost of "free." Tell me about a free app you use regularly — how long you've used it, how often, and what kind of data it might collect — and I'll help you think through what that data is actually worth to the companies involved.
Module 2 · Lesson 4

Taking Back Control

What actually works, what's security theater, and how to think about the trade-offs.
Given everything apps collect — what can you realistically do about it?

In April 2021, Apple launched App Tracking Transparency — a requirement that all iOS apps explicitly ask users for permission before tracking them across other companies' apps and websites using the IDFA device identifier. Within six months, studies showed that only 24% of iOS users were opting in to tracking when given a clear choice. Meta reported a $10 billion revenue hit in the following fiscal year. The experiment demonstrated something important: when users are given a genuine, frictionless opt-out, most of them take it.

What the Platform-Level Controls Actually Do

Both iOS and Android have meaningfully improved their privacy controls since 2020. These controls are real and worth using — but understanding their limits is as important as knowing their benefits.

iOS 14.5
App Tracking Transparency (ATT) — Required apps to request explicit permission before accessing the IDFA. Reduced cross-app tracking significantly. Does not stop apps from building first-party profiles or using fingerprinting workarounds.
iOS 15
Mail Privacy Protection — Masks IP address and loads email pixels through Apple's proxy, preventing email open tracking. Very effective for email surveillance; no effect on in-app tracking.
iOS 16
Lockdown Mode — Extreme hardening for users at high risk (journalists, activists). Disables most JS JIT compilation, limits API functionality, blocks message attachments. Not suitable for general use; genuinely effective for threat models it's designed for.
Android 12
Privacy Dashboard — Visual display showing which apps accessed location, camera, and microphone in the last 24 hours, with timestamps. First time Android gave users this visibility. Useful for identifying suspicious access patterns.
Android 13
Granular Media Permissions — Apps must now request permission for specific media types (photos vs. video vs. audio) rather than blanket storage access. Reduced the "read all files" permission scope significantly.
What Works — Practical Steps by Risk Level

Not every privacy action has the same impact. Some are high-leverage; others are theater. Here's a realistic assessment:

Action What It Stops What It Doesn't Stop Effort
Deny location to apps that don't need it GPS coordinate collection, movement profiling IP-based location estimation, Wi-Fi network inference Low
Enable "Precise Location Off" for apps that only need city-level Exact coordinate collection and movement tracking Neighborhood-level inference from approximate location Low
Opt out of ad personalization (iOS: Settings → Privacy → Tracking; Android: Settings → Privacy → Ads) Cross-app tracking via device ID; IDFA/GAID-based profiles First-party behavioral data; fingerprinting; cohort-based targeting Low
Use a paid VPN from a verified no-logs provider (Mullvad, ProtonVPN) ISP data collection; IP-based tracking; some Wi-Fi snooping In-app tracking; HTTPS-level data; anything the app sends directly Medium
Use Signal instead of SMS/iMessage for sensitive conversations Message content interception; metadata analysis by platform Device-level compromise; physical access attacks Medium
Delete apps you don't actively use Background data collection; periodic location pings; SDK activity Data already collected; profiles already built Low
The Fingerprinting Problem

When Apple's ATT made IDFA-based tracking harder, the ad industry didn't stop tracking — it shifted to device fingerprinting: building a unique identifier from the combination of your screen resolution, installed fonts, GPU model, system language, time zone, battery level, and other signals that don't require a permission grant. The EFF's "Cover Your Tracks" tool can demonstrate how unique your browser fingerprint is. Most devices are unique among millions. Apple has continued to fight fingerprinting in iOS 17+ by restricting the API calls used to build fingerprints, but the cat-and-mouse dynamic continues.

Opt-Out Registries and Data Broker Removal

Data brokers are required by several state laws — California's CCPA, Virginia's VCDPA, and others — to honor deletion requests from consumers. Services like DeleteMe (paid) and Privacy Bee (paid) automate the submission of removal requests to hundreds of brokers. Manual removal is possible but time-consuming; the major brokers include Spokeo, Whitepages, Intelius, BeenVerified, Acxiom, and LexisNexis. Critically: data re-aggregates. Removal is not permanent. Quarterly re-submission is typically required.

The FTC finalized rules in 2024 requiring data brokers to register with the agency and provide opt-out mechanisms — a significant step, though enforcement scope remains limited.

The Honest Conclusion

Perfect privacy on a modern smartphone connected to the commercial internet is not achievable. The data collection infrastructure is too deeply embedded in how apps are built, financed, and distributed. What is achievable is a meaningfully reduced profile: fewer tracking IDs, less precise location data, fewer third-party SDKs running on your device, and less data in broker databases. Each reduction lowers the value of your data to potential misusers — insurers, political operatives, malicious state actors — even if it doesn't eliminate it entirely.

Key Terms
App Tracking Transparency (ATT)Apple's iOS 14.5+ framework requiring apps to explicitly ask users before tracking them across other apps using the IDFA. Result: ~76% of users denied tracking when given a clear choice.
Device FingerprintingA tracking technique that builds a unique identifier from hardware and software characteristics — screen size, GPU, fonts, language settings — without requiring any permission grant or cookie.
IDFA / GAIDIdentifier for Advertisers (Apple) / Google Advertising ID (Android) — resettable device identifiers used by ad networks to track users across apps. ATT and opt-out settings limit access to these IDs.

Lesson 4 Quiz

Taking Back Control — 4 questions
After Apple launched App Tracking Transparency in April 2021, approximately what percentage of iOS users opted IN to cross-app tracking when given a clear choice?
Correct. Studies showed only about 24% of iOS users opted in to tracking when given a simple, clear choice. The rest declined — demonstrating that most users want privacy when the opt-out isn't buried in settings.
Only about 24% of iOS users opted in to tracking under ATT. The remaining 76% declined — a result that cost Meta an estimated $10 billion in revenue the following year.
What is device fingerprinting, and why did it increase after Apple's ATT framework?
Exactly. When ATT restricted IDFA access, ad companies shifted to fingerprinting — combining screen resolution, GPU type, fonts, battery level, and other signals to build a de facto unique ID that requires no permission.
Fingerprinting uses hardware/software characteristics (GPU, screen resolution, fonts, timezone) to build a tracking ID without requiring any permission grant. It expanded as IDFA became harder to access under ATT.
Using a paid VPN (like Mullvad or ProtonVPN) effectively stops which of the following?
A quality VPN stops your ISP from seeing your browsing activity and hides your real IP from websites and services. It does not affect what happens inside apps — SDK data, in-app behavioral tracking, and app-to-server communications are unaffected.
A reputable VPN primarily protects against ISP data collection and IP-based tracking. It doesn't stop what apps do with data internally — in-app SDK tracking, first-party behavioral profiling, and HTTPS traffic to app servers all continue unaffected.
Why is data broker opt-out/removal not a permanent solution?
Correct. Even after a successful removal, brokers continue receiving new data from apps, purchases, and public records. Your profile gets rebuilt. Services like DeleteMe recommend quarterly re-submission to maintain reduced exposure.
Removal isn't permanent because data brokers continuously ingest new data from apps, public records, and purchase histories. Removed profiles are rebuilt over months. Ongoing, periodic re-submission is necessary.

Lab 4 — Your Personal Privacy Audit

Build a realistic threat model and action plan for your actual situation.

Your Mission

Privacy advice is only useful if it matches your actual situation. Think about who you are, what you do, and what data you care most about protecting. Use the AI to build a personal, realistic privacy action plan — not a generic checklist.

Try asking: "I'm a college student who uses Instagram, TikTok, and a few finance apps — what should I actually do?" or "What does it mean to have a 'threat model' and do I need one?" or "What's the single most effective thing I can do right now to reduce my data exposure?"
AI Lab Assistant
Privacy Action Planner
Let's build your personal privacy action plan. Tell me a bit about yourself — what apps you use most, what kind of data you're most concerned about, and what your life looks like (student, professional, activist, general user). I'll help you figure out what's actually worth doing given your specific situation.

Module 2 Test

What Apps Are Actually Collecting — 15 questions · 80% to pass
1. In the 2014 Carnegie Mellon study, users estimated their apps accessed location about 30 times over two weeks. What was the actual count?
The actual number was over 5,398 location accesses — nearly 180× what users estimated.
The real figure was over 5,398 — a factor of ~180 times more than users guessed.
2. What is the core problem with runtime permission dialogs, despite being an improvement over install-time permissions?
Runtime permissions describe what data an app can access — not what it will do with it. Granting location to a navigation app vs. a free game looks identical in the dialog.
The gap is between capability and intent. The dialog says "this app wants location." It doesn't say "this app will sell your location to 40 ad networks."
3. The FTC settled with Brightest Flashlight Free in 2013. What data was the app transmitting without clear disclosure?
The FTC found Brightest Flashlight Free — with 50M+ downloads — was selling real-time GPS location and unique device identifiers to advertising networks, without adequate disclosure.
The FTC found it was transmitting precise location and device ID to ad networks in real time. The app had 50 million downloads.
4. What critical security property do third-party SDKs embedded in an app automatically possess?
SDKs run inside the app's process and inherit all its permissions. If you grant location to an app, all its SDKs can potentially access that location.
SDKs inherit the host app's full permission set. Granting location to an app grants it to every SDK embedded inside that app.
5. In Real-Time Bidding (RTB), what happens to your data when an ad auction occurs?
RTB bid requests are sent to potentially hundreds of ad companies simultaneously. Only one wins the auction — but all of them received the data in the bid request.
The bid request goes to all participating bidders — potentially hundreds — simultaneously. The loser doesn't win the ad slot but did receive your data.
6. The 2018 New York Times investigation obtained location data showing 50 billion pings from 12 million Americans. What label did contracts use to authorize this collection?
Despite being labeled "anonymous," the Times identified a Pentagon employee, tracked visitors to a psychiatric facility, and mapped individuals' movements in granular detail.
The contracts called it "anonymous" — yet individuals including government employees and hospital visitors were trivially identifiable in the dataset.
7. The FTC sued Premom ovulation tracker (2023) for sending reproductive health data to third parties without disclosure. Which types of companies received the data?
Premom was sending sensitive menstrual and pregnancy tracking data to AppsFlyer, Umeng (both with Chinese connections), and Google — without clear disclosure in its privacy policy.
The FTC found data was going to AppsFlyer, Umeng (linked to Chinese companies), and Google — even though the privacy policy promised data would only be used "to provide services."
8. According to MIT and University of Louvain research, how many location data points are sufficient to uniquely re-identify 95% of individuals in an "anonymous" dataset?
Only four location points — such as home, work, a grocery store, and a gym — are enough to uniquely identify 95% of people in a location dataset, even with names removed.
Just four location points suffice. This finding fundamentally undermines the "anonymous location data" defense used by data brokers and app developers.
9. What was the core finding in the FTC's 2022 lawsuit against Kochava?
The Kochava case established that the harm from location data can be based on inference — selling data that reveals visits to sensitive locations can be an unfair practice even without explicit medical records.
The FTC focused on the inferential harm: location data revealing visits to reproductive clinics, addiction centers, and churches could enable discrimination and harm, even without direct health data.
10. The Weather Channel app (IBM) lawsuit found it was selling precise location data to commercial buyers beyond weather forecasting. Which buyers were identified?
The LA City Attorney found the data was going to hedge funds (for market intelligence), retailers (for foot traffic analysis), and energy companies — not disclosed to the app's 45 million users.
The lawsuit identified hedge funds, retailers, and energy companies as buyers — all using location data for commercial market intelligence, not weather-related purposes.
11. What is a "shadow profile" as confirmed by Facebook in the 2018 Congressional hearings?
Shadow profiles are built on people who never joined Facebook, using contact data uploaded by people who know them, combined with third-party data purchases. Zuckerberg confirmed this practice in Senate testimony.
Shadow profiles exist for non-users — built from contact uploads by friends, email syncs, and data broker purchases. Facebook knew who you were even if you never had an account.
12. After Apple's ATT framework launched in April 2021, approximately what percentage of iOS users OPTED IN to tracking?
About 24% opted in — meaning 76% declined when given a simple, clear choice. Meta reported a $10 billion revenue hit in the following fiscal year.
Only ~24% opted in. When the friction is removed and the choice is clear, most users prefer privacy. This cost Meta approximately $10 billion in annual revenue.
13. What is device fingerprinting and why did it become more prevalent after ATT?
When ATT restricted IDFA-based tracking, ad companies shifted to fingerprinting — combining GPU model, screen resolution, fonts, timezone, and other signals that require no permission — to build persistent tracking IDs.
Fingerprinting builds a unique identifier from device characteristics requiring no permission. When IDFA became harder to access under ATT, it became the ad industry's workaround.
14. Which of these privacy actions has the highest impact for the least effort?
Location data is among the most commercially valuable and sensitive data types collected. Restricting it — requiring no cost and about two minutes in settings — removes a major data pipeline with minimal impact on legitimate app functionality.
Restricting location permissions is high-impact, zero-cost, and takes minutes. Free VPNs often collect more data than they block, and manual broker opt-outs are time-intensive without being permanent.
15. Why is data broker removal not a permanent solution to reducing your data exposure?
Data brokers receive a continuous stream of new data from apps, purchase records, and public records. A removed profile gets rebuilt. Periodic re-submission — typically quarterly — is needed to maintain reduced exposure.
Brokers continuously receive new data from apps, transactions, and public records. Even after removal, your profile is rebuilt over time. Ongoing re-submission is required — services like DeleteMe automate this process.