By the end of this lesson you will be able to
- Say what counts as personal data and which items are most sensitive.
- Explain what a digital footprint is and tell the active part from the passive part.
- Adjust privacy settings on a social media account to limit who sees what.
- Describe how personal details can be combined to commit identity theft.
- Apply the data minimisation habit: share the least that is needed.
Every time you sign up, post, search or shop online you leave something behind, and the pieces add up. Individually they seem harmless: a birthday here, a street name there. Together they can be used to guess your security questions, impersonate you to your bank or find where you are. This lesson shows what counts as personal information, how to see your own footprint and the simple settings and habits that keep it small.
What counts as personal information
Personal data is any information that can identify you or be linked to you. Some of it is obvious (your name) and some is not (a photo with a location hidden inside it). A useful way to think is in three groups, from low to high sensitivity.
| Group | Examples | How to treat it |
|---|---|---|
| Public-ish | Your name, the town you live in, a profile photo | Share only where there is a reason. |
| Private | Phone number, home address, date of birth, school or workplace, daily routine, photos of your home | Share with people and services you trust, not publicly. |
| Sensitive | National ID number, passport details, bank and card numbers, passwords, health details, one-time codes | Share only with the organisation that needs it, through its official route. Never in a message or on social media. |
Notice that a date of birth and a mother's maiden name are classed as private, even though they feel harmless. Banks and websites use them as security questions, so a person who learns them can pretend to be you.
- Phone numberUsed to reach you and to reset accounts.
- Home addressWhere you live; used in many identity checks.
- Date of birthA very common security question.
- PhotosCan show places, badges and hidden location data.
- LocationWhere you are, or are often.
- Email addressThe key to resetting your other accounts.
Read this figure as text
A gallery of six icon cards showing items of personal data: phone number, home address, birth date, photos, location and email.
Six cards. Phone number: used to reach you and also to reset accounts. Home address: where you live, and the answer to many security checks. Date of birth: a very common identity check. Photos: can show faces, places, school badges and house numbers, and may carry a hidden location. Location: where you are now, or where you often are. Email address: the key to resetting passwords for other accounts.
Your digital footprint
Your digital footprint is all the data about you that exists because of what you and others do online. It has two parts. The active footprint is what you deliberately put out: posts, comments, photos, forms you fill in. The passive footprint is collected without you typing anything: websites recording which pages you visit, apps noting your location, adverts tracking you across sites using cookies and other trackers. Other people add to it as well when they tag you or post photos of you.
- Posts and comments
- Photos you upload
- Forms and sign-ups
- Reviews you write
Control it by thinking before you post.
- Pages and searches
- Location history
- Device and browser details
- Cookies and trackers
Control it with settings and permissions.
Read this figure as text
Two columns comparing the active and passive parts of a digital footprint with examples.
Active footprint, what you choose to share: posts and comments, photos you upload, forms you fill in, accounts you create, reviews you write. Passive footprint, collected as you go: pages you visit, searches, location history, device and browser details, cookies and trackers, purchase history. Others can add to both: a friend can tag you or post your photo. You control the active part directly and the passive part through settings.
A good first experiment is to search for your own name, in quotation marks, in a search engine, and to look at the first few pages. You are checking what a stranger, an employer or a scammer could find in a few minutes. Do this in a private window, so that your personalised results do not distort it.
Social media privacy
Most social media sites are built to share by default. A few settings change that. The names differ by service, but look for these in the Privacy or Settings area: who can see your posts (choose friends or followers you approve, rather than public), who can find you by phone number or email, who can tag you or see posts you are tagged in, whether your location is attached to posts and whether your friends list is visible.
- Marker 1: Choose friends, not public
- Marker 2: Limit how you can be found
- Marker 3: Approve tags first
- Marker 4: Keep location off
Read this figure as text
A simulated privacy settings page with four numbered settings: post audience, find by phone number, tagging and location.
A simulated privacy page from a fictional app, not a real service. Marker 1: Who can see your posts, set to Friends only and not Public. Marker 2: Who can find you by phone number or email, set to Only me. Marker 3: Review tags before they appear on your profile, set to On. Marker 4: Add location to posts, set to Off. Each setting reduces what strangers can learn about you. Real services use different words and place these in different menus.
How your data is shared
Many free services make money from your data. When you accept terms, you may allow the company to share information with partners, advertisers or data brokers, companies that collect and sell data about people. A privacy policy is the document that says what is collected and who receives it. You will not read every one, but it is worth checking three things when the account matters: what is collected, whether it is sold or shared, and how to delete your account and data.
The habit that helps most is data minimisation: give the least that is needed. If a shop asks for your date of birth to sell you a scarf, it does not need it. If a form has optional fields, leave them blank. Use a separate email address for sign-ups and newsletters so that your main email stays private.
Identity theft
Identity theft is when someone uses your personal details to pretend to be you, for example to open an account, take a loan, make purchases or take over your accounts. Criminals combine pieces: a name and birthday from a social media profile, an address from a leaked list and a phone number from a form. Each piece is small, but together they pass an identity check.
- Step 1: GatherName, birthday, address, number
- Step 2: CombinePieces form one profile
- Step 3: Pass a checkAnswers security questions as you
- Step 4: HarmAccounts taken, loans or purchases
Read this figure as text
A flow of four steps: gather pieces, combine them, pass a check, cause harm.
Step 1, Gather: a criminal collects a name and birthday from a public profile, an address from a leaked list and a phone number from an old form. Step 2, Combine: the pieces are put together into one profile of the person. Step 3, Pass a check: the criminal contacts a company or phone provider pretending to be the person and answers its security questions. Step 4, Harm: accounts are taken over, loans or purchases are made in the person's name. Defence: share less, use unique passwords and multifactor authentication, and answer security questions with unrelated made-up answers kept in your password manager.
Warning signs include bills or letters for things you never bought, a credit or loan refusal that surprises you, a sudden loss of mobile signal (a possible SIM swap), and login alerts. Defences are mostly the habits you have met: share less, unique passwords, multifactor authentication and watching your statements. Treat security questions with care: you can answer with a made-up phrase stored in your password manager instead of a real fact. If you are a victim, tell your bank, change your passwords and report it to the authority in your country.
Common mistakes
✖ Instead of: Posting a photo of a new ID card, ticket or bank card to celebrate.
✔ Do this: These contain numbers and barcodes others can use. Cover or crop them, or do not share them.
✖ Instead of: Accepting every friend or follow request.
✔ Do this: Accept only people you know. Fake profiles are used to gather personal details.
✖ Instead of: Using real answers for security questions.
✔ Do this: Treat them as extra passwords: unrelated made-up answers, kept in your manager.
If something goes wrong
- I cannot find the privacy settings on a social media app.
- Look under your profile picture or the three-line menu for Settings, then Privacy or Privacy and security. Search the help centre for the words “who can see my posts”.
- A search shows an old page with my details on it.
- Contact the site owner to ask for removal, using the contact or privacy page. Search engines also have a removal request form for some kinds of personal data. Removal may take time.
- I forgot which sites have my data.
- Search your email for “welcome” and “verify your email” messages, and review your password manager's list. Delete accounts you no longer use.
Key terms
- Personal data
- Any information that identifies you or could be used to identify you.
- Digital footprint
- The trail of information about you that exists online, from what you post and what others post or collect.
- Tracking
- Following what you do online, often with cookies or similar tools, to build a profile.
- Data minimisation
- Sharing only the information that is truly needed.
- Identity theft
- Using someone else's personal details to pretend to be them, often to get money or credit.
- Privacy policy
- A document in which a company says what information it collects and what it does with it.
Practise it for real
Reading is not the same as being able to do it. Complete these on your own computer, then tick only what you have actually done. These ticks are your own honest record: nothing checks them for you.
Look at your own footprint
In a private browser window, search for your own name in quotation marks and for your phone number. Look at the first two pages of results. Write down what a stranger could learn: your town, workplace, photos or anything else. Do not click on sites that ask you to pay or sign in. For each finding, note whether you can remove it or change who sees it.
Challenge: tighten one account
Choose one social media account. Without a step-by-step guide, find its privacy settings and make four changes: choose who sees posts, limit how you can be found by phone number or email, review tagging, and turn off location sharing on posts. Then ask a trusted friend to look at your profile when not signed in and tell you what they can see.
Knowledge check
6 questions. You need 80% to pass. Mistakes here are part of learning, and you can retry as often as you like.
Summary
- Personal data ranges from public-ish through private to sensitive; treat each with matching care.
- Your digital footprint has an active part you share and a passive part collected about you.
- Privacy settings limit audience, search, tagging and location, but a posted item can still be copied.
- Give the least data needed (data minimisation) and use a separate email for sign-ups.
- Identity theft combines small facts, so share less and protect accounts with unique passwords and MFA.
Checklist: can you do these?
Marking a lesson as read does not prove you can do it. Skills count as demonstrated when you pass the quiz (not yet) and complete the practical tasks (not yet).
Related lessons
References and further reading
Official sources for details that can change between versions.
- Protecting your privacy online (National Cyber Security Centre (UK))
- Privacy and security help (Mozilla Support)