Why Privacy Terminology Matters
Privacy policies, app permissions, and news about data breaches are full of technical terms that can feel deliberately obscure. When you understand what words like metadata, data broker, or end-to-end encryption actually mean, you're better equipped to make real decisions about which apps to trust, what permissions to grant, and which settings actually protect you.
This glossary is a plain-language reference — not legal advice. Use it alongside practical guides like our Digital Privacy for Beginners guide when you're ready to put these concepts into action.
Personal Data
Any information that can identify you, either directly (your name, Social Security number, email address) or indirectly when combined with other data (your ZIP code plus birthdate plus employer). In the US, different laws define this differently depending on the sector.
Cookie
A small text file placed on your device by a website to remember information about your visit — such as login status, preferences, or browsing behavior. Third-party cookies, set by advertisers rather than the site you're visiting, are commonly used to track you across multiple websites.
Tracking Pixel
A tiny, often invisible image embedded in a webpage or email that reports back to a server when loaded — revealing your IP address, email client, and sometimes your location. Unlike cookies, pixels work even when cookies are blocked.
Data Broker
A company that collects personal information from a wide range of sources — public records, loyalty programs, social media, and more — and sells or licenses that data to third parties. Most Americans are in multiple data broker databases without being aware of it.
Metadata
Data about data. For example, a phone call's metadata includes the time, duration, and phone numbers involved — but not the conversation itself. Metadata can reveal a great deal about your habits and relationships even without capturing content.
End-to-End Encryption (E2EE)
A method of securing communications so that only the sender and recipient can read the message. Even the service provider cannot access the content. Messaging apps that offer E2EE protect your conversations from interception in transit.
Two-Factor Authentication (2FA)
A security process that requires two forms of verification before granting access to an account — typically your password plus a one-time code sent to your phone or generated by an authenticator app. It significantly reduces the risk of unauthorized account access.
VPN (Virtual Private Network)
A service that routes your internet traffic through an encrypted tunnel to a server in another location, masking your IP address from websites and your internet service provider. A VPN improves privacy on public Wi-Fi but does not make you fully anonymous online.
Data Breach
An incident in which unauthorized parties gain access to private or sensitive data held by a company or organization. Breached data often includes email addresses, passwords, and financial information, and can circulate on dark-web marketplaces.
Opt-Out vs. Opt-In
Opt-in means you must actively agree before your data is collected or shared; opt-out means your data is collected by default unless you take action to stop it. US privacy law generally uses an opt-out model, while European law (GDPR) requires opt-in consent for many uses.
IP Address
A numerical label assigned to every device connected to a network, used to route internet traffic. Your IP address can reveal your approximate geographic location and internet service provider, and is routinely logged by websites you visit.
Phishing
A type of cyberattack in which a bad actor impersonates a trusted entity — a bank, employer, or government agency — to trick you into revealing passwords, financial details, or other sensitive information. Phishing most commonly arrives via email but also occurs via text (smishing) and phone calls (vishing).
Key Privacy Concepts at a Glance
The terms below fall into a few broad categories: how your data is collected, how it's used, how it can be protected, and what rights you may have. Understanding the connections between these ideas is just as important as knowing each definition individually.
| US State Privacy Laws | Multiple states have enacted comprehensive consumer privacy laws (Including California (CCPA/CPRA), Virginia, Colorado, and others as of 2024) |
| Data Broker Databases | Hundreds of data brokers operate in the US (Electronic Frontier Foundation and consumer advocacy groups) |
| Most Common Breach Data | Email addresses and passwords (Consistent finding across major breach analysis reports) |
| Federal US Privacy Law | No single comprehensive federal consumer privacy law exists (As of 2024; sector-specific laws (HIPAA, FERPA, COPPA) apply in narrow contexts) |
| 2FA Effectiveness | Blocks the vast majority of automated account-takeover attacks (Google Security Blog research on account compromise) |
For example, understanding what a cookie does helps explain why tracking pixels work differently — and why clearing your browser history alone doesn't make you invisible online. For more on common misconceptions, see our article on online privacy myths that give people a false sense of security.
Once you're comfortable with these terms, a good next step is reviewing your actual exposure with our annual online privacy audit checklist.
US Privacy Law Is Fragmented — By Design
Unlike the European Union's unified GDPR, the United States has no single federal consumer privacy law. Instead, a patchwork of sector-specific laws (covering health data, financial data, children's data) and a growing number of state laws govern how your information can be collected and used. Your rights and protections may differ significantly depending on where you live and which type of company holds your data. When in doubt, consulting the privacy policy of a specific service — however tedious — is the most direct source of information about how your data is handled.
The content on this site is for informational purposes only and is not a substitute for professional advice. Always consult a qualified professional for guidance specific to your situation.