Cookie 5 7 3 – Protect Your Online Privacy Issues

1. Cookie 5 7 3 – Protect Your Online Privacy Issues Act
2. Cookie 5 7 3 – Protect Your Online Privacy Issues Without
3. Cookie 5 7 3 – Protect Your Online Privacy Issues Free
4. Cookie 5 7 3 – Protect Your Online Privacy Issues Regarding

Therefore, you must take additional steps to protect your privacy. Because the network at a Wi-Fi hotspot is unsecured, Internet connections remain open to intrusion. Hackers can intercept network traffic to steal your information. There are 3 major privacy threats in a Wi-Fi hotspot. 7.5 APP 7 may apply to an agency in the circumstances set out in s 7A (see paragraph 7.13 below). 7.6 An individual may request an organisation not to use or disclose their personal information for the purpose of direct marketing, or for the purpose of facilitating direct marketing by other organisations (APP 7.6). How to protect your privacy with third party cookies In order to enjoy some of the conveniences of the modern day internet you're going to have to put up with some cookies. Dsp quattro 5 2 1. Many sites use third party cookies as a way to boost their revenue, so it's likely they'll block you from seeing content until you accept third party cookies. If you do configure your browser to delete stored cookies, this often only clears traditional cookies, without removing super cookies and Flash cookies. Some browsers have recently implemented a 'private browsing mode,' designed to protect privacy. In Firefox, for example, web cookies are deleted when a private browsing session is ended. Consumer privacy protection activists argue that given the huge evolution of websites like Facebook which pose extensive security concerns as well as the evolution of 'hidden' cookie technology as exemplified by flash cookies, an opt out regime is the only effective way to safeguard user information.

Version 1.1

Key points

• APP 7 provides that an organisation must not use or disclose personal information it holds for the purpose of direct marketing unless an exception applies. APP 7 may also apply to an agency in the circumstances set out in s 7A.
• Direct marketing involves the use or disclosure of personal information to communicate directly with an individual to promote goods and services.
• Where an organisation is permitted to use or disclose personal information for the purpose of direct marketing, it must always:
  • allow an individual to request not to receive direct marketing communications (also known as ‘opting out'), and
  • comply with that request
• An organisation must, on request, provide its source for an individual's personal information, unless it is impracticable or unreasonable to do so.

What does APP 7 say?

7.1 An organisation must not use or disclose the personal information that it holds about an individual for the purpose of direct marketing (APP 7.1). Animal crossing support. The term ‘holds' is discussed in Chapter B (Key concepts).

7.2 There are a number of exceptions to this requirement. The exceptions in APP 7.2 and 7.3 apply to personal information other than sensitive information. They draw a distinction between the use or disclosure of personal information by an organisation where:

• the personal information has been collected directly from an individual, and the individual would reasonably expect their personal information to be used for the purpose of direct marketing (APP 7.2), and
• the personal information has been collected from a third party, or from the individual directly but the individual does not have a reasonable expectation that their personal information will be used for the purpose of direct marketing (APP 7.3). Sources of third party data include data list providers, third party mobile applications, third party lead generation and enhancement data

7.3 Both of these exceptions require an organisation to provide a simple means by which an individual can request not to receive direct marketing communications (also known as ‘opting out'). However, in the circumstances where the organisation has not obtained personal information from the individual, or the individual would not reasonably expect their personal information to be used in this way, there are additional requirements to ensure that the individual is made aware of their right to opt out of receiving direct marketing communications from the organisation.

7.4 Exceptions to this principle also apply in relation to:

• sensitive information (APP 7.4), and
• an organisation that is a contracted service provider for a Commonwealth contract (APP 7.5)

7.5 APP 7 may apply to an agency in the circumstances set out in s 7A (see paragraph 7.13 below).

7.6 An individual may request an organisation not to use or disclose their personal information for the purpose of direct marketing, or for the purpose of facilitating direct marketing by other organisations (APP 7.6). The organisation must give effect to any such request by an individual within a reasonable period of time and for free (APP 7.7).

7.7 An organisation must, on request, notify an individual of its source of the individual's personal information that it has used or disclosed for the purpose of direct marketing unless this is unreasonable or impracticable to do so (APP 7.6).

7.8 APP 7 does not apply to the extent that the Do Not Call Register Act 2006, the Spam Act 2003 or any other legislation prescribed by the regulations apply (APP 7.8). APP 7 will still apply to the acts or practices of an organisation that are exempt from these Acts.

‘Direct marketing'

7.9 Direct marketing involves the use and/or disclosure of personal information to communicate directly with an individual to promote goods and services.[1] A direct marketer may communicate with an individual through a variety of channels, including telephone, SMS, mail, email and online advertising.

7.10 Organisations involved in direct marketing often collect personal information about an individual from a variety of sources, including:

• public records, such as telephone directories and land title registers
• membership lists of business, professional and trade organisations
• online, paper-based or phone surveys and competitions
• online accounts, for example, purchase history or the browsing habits of identified, or logged in, users[2]
• mail order or online purchases

7.11 Examples of direct marketing by an organisation include:

• sending an individual a catalogue in the mail addressed to them by name
• displaying an advertisement on a social media site that an individual is logged into, using personal information, including data collected by cookies relating to websites the individual has viewed[3]
• sending an email to an individual about a store sale, or other advertising material relating to the store, using personal information provided by the customer in the course of signing up for a store loyalty card

7.12 Marketing is not direct, and therefore APP 7.1 does not apply, if personal information is not used or disclosed to identify or target particular recipients, for example, where:

• an organisation sends catalogues by mail to all mailing addresses in a particular location, addressed ‘To the householder' (that is, where recipients are not selected on the basis of personal information)
• an organisation hand delivers promotional flyers to the mailboxes of local residents
• an organisation displays advertisements on a website, but does not use personal information to select which advertisements are displayed

When are agencies covered by APP 7?

7.13 An agency must comply with the direct marketing requirements of APP 7 in the circumstances set out in s 7A. These circumstances include where:

• the agency is listed in Part 1 of Schedule 2 to the Freedom of Information Act 1982 (the FOI Act) and is prescribed in regulations,[4] or
• the act or practice relates to the commercial activity of an agency specified in Part 2 of Schedule 2 to the FOI Act[5]

Using and disclosing personal information for the purpose of direct marketing where reasonably expected by the individual

7.14 APP 7.2 provides that an organisation may use or disclose personal information (other than sensitive information) about an individual for the purpose of direct marketing if:

• the organisation collected the personal information from the individual
• the individual would reasonably expect the organisation to use or disclose the personal information for that purpose
• the organisation provides a simple way for the individual to request not to receive direct marketing communications from the organisation (also known as ‘opting out'), and
• the individual has not made such a request to the organisation

Reasonably expect

7.15 The ‘reasonably expect' test is an objective test that has regard to what a reasonable person, who is properly informed, would expect in the circumstances. This is a question of fact in each individual case. It is the responsibility of the organisation to be able to justify its conduct.

7.16 Factors that may be important in deciding whether an individual has a reasonable expectation that their personal information will be used or disclosed for the purpose of direct marketing include where:

• the individual has consented to the use or disclosure of their personal information for that purpose (see discussion in paragraph 7.23 below and Chapter B (Key concepts) for further information about the elements of consent)
• the organisation has notified the individual that one of the purposes for which it collects the personal information is for the purpose of direct marketing under APP 5.1 (see Chapter 5 (APP 5))
• the organisation made the individual aware that they could request not to receive direct marketing communications from the organisation, and the individual does not make such a request (see paragraph 7.21)

7.17 An organisation should not assume that an individual would reasonably expect their personal information to be used or disclosed for the purpose of direct marketing just because the organisation believes that the individual would welcome the direct marketing, for example, because of the individual's profession, interest or hobby. Autodesk flame 2020 1000.

7. https://coolafile257.weebly.com/double-dragon-free-games.html. 18 An individual is not likely to have a reasonable expectation that their personal information will be used or disclosed for the purpose of direct marketing where the organisation has notified the individual that their personal information will only be used for a particular purpose unrelated to direct marketing. For example, where an individual provides personal information to their bank when setting up internet banking, and the bank tells the individual that it will only use that personal information for enabling security for internet banking, the individual is not likely to have a reasonable expectation that their personal information will then be used or disclosed for the purpose of direct marketing.[6]

Providing a simple means for ‘opting out'

7.19 A simple means for opting out should include:

• a visible, clear and easily understood explanation of how to opt out, for example, instructions written in plain English and in a font size that is easy to read
• a process for opting out, which requires minimal time and effort
• an opt out process that uses a straightforward and accessible communication channel, or channels. For example, the same communication channel that the organisation used to deliver the direct marketing communication. However, in some circumstances, a straightforward and accessible communication channel may be a different channel to that used to deliver the direct marketing communication, such as telephone and email, where the original channel was post, and
• an opt out process that is free, or that does not involve more than a nominal cost for the individual, for example, the cost of a local phone call, text message or postage stamp

7.20 The individual should be able to easily find out how to opt out. For example, an organisation could provide information about how to opt out in each direct marketing communication. An organisation should also consider whether the means for opting out is accessible to a person with a disability.

7.21 If the individual has ‘opted out', the organisation must not use or disclose their personal information for the purpose of direct marketing, in accordance with the individual's request (APP 7.2(d)). Further examples of a simple means to opt out are given in paragraphs 7.27–7.30 below.

Using and disclosing personal information for the purpose of direct marketing where no reasonable expectation of the individual, or information collected from a third party

7.22 APP 7.3 provides that an organisation may use or disclose personal information (other than sensitive information) about an individual for the purpose of direct marketing if:

• the organisation collected the information from:
  • the individual, but the individual would not reasonably expect their information to be used or disclosed for that purpose, or
  • a third party, and
• the individual has consented to use or disclosure for that purpose, or it is impracticable to obtain that consent, and
• the organisation provides a simple way for the individual to opt out of receiving direct marketing communications from the organisation, and
• in each direct marketing communication with the individual, the organisation includes a prominent statement, or otherwise draws the individual's attention to the fact that the individual may make such a request (referred to as an ‘opt out statement'), and
• the individual has not made such a request to the organisation

Consent

7.23 Consent is defined in s 6(1) as ‘express consent or implied consent' and is discussed generally in Chapter B (Key concepts). The four key elements of consent are:

• the individual is adequately informed before giving consent
• the individual gives consent voluntarily
• the consent is current and specific, and
• the individual has the capacity to understand and communicate their consent

Impracticable to obtain consent

7.24 Whether it is ‘impracticable' for an organisation to obtain consent will depend on a number of factors, including the time and cost involved in seeking consent. However, an organisation is not excused from obtaining consent by reason only that it would be inconvenient, time-consuming or impose some cost to do so. Whether these factors make it impracticable to obtain consent will depend on whether the burden is excessive in all the circumstances.

7.25 An organisation may obtain the consent from the individual in relation to a subsequent use or disclosure of the individual's personal information for the purpose of direct marketing at the time it collects the personal information. In order to rely on this consent, the organisation must be satisfied that it is still current at the time of the use or disclosure. ‘Current' consent is discussed in Chapter B (Key concepts).

7.26 Where an organisation did not obtain the individual's consent at the time of collection, it must obtain the consent of the individual for the proposed use or disclosure, unless it is impracticable to do so. In that case, the organisation should assess whether it is impracticable to obtain consent at the time of the proposed use or disclosure.

Providing a prominent statement about simple means for ‘opting out'

7.27 APP 7.3 requires that an organisation provides a simple means for an individual to opt out of receiving direct marketing communications (see discussion at paragraphs 7.19–7.21 above).

7.28 In addition, APP 7.3 requires an organisation to provide a prominent statement that the individual may request to opt out in each direct marketing communication. This statement should meet the following criteria:

• it should be written in plain English, and not use legal or industry jargon
• it should be positioned prominently, and not hidden amongst other text. Headings may be necessary to draw attention to the statement, and
• it should be published in a font size and type which is easy to read, for example, in at least the same font size as the main body of text in the communication

7.29 The following are given as examples of ways that an organisation may comply with the ‘opt out' requirements of APP 7.3:

• clearly indicating in each direct marketing email that the individual can opt out of receiving future emails by replying with a single word instruction in the subject line (for example, ‘unsubscribe'). Alternatively, ensuring that a link is prominently located in the email, which takes the individual to a subscription control centre
• clearly indicating that the individual can opt out of future direct marketing by replying to a direct marketing text message with a single word instruction (for example, ‘STOP')
• telling the recipient of a direct marketing phone call that they can verbally opt out from any future calls
• including instructions about how to opt out from future direct marketing in each mailed communication

7.30 In each case, an organisation may use an opt out mechanism that provides the individual with the opportunity to indicate their direct marketing communication preferences, including the extent to which they wish to opt out. However, the organisation should always provide the individual with an option to opt out of all future direct marketing communications as one of these preferences.

Using and disclosing sensitive information for the purpose of direct marketing with the individual's consent

7.31 APP 7.4 provides that an organisation may use or disclose sensitive information for the purpose of direct marketing if the individual has consented to the use or disclosure for that purpose.

7.32 The requirement to obtain consent applies even if the individual and the organisation have a pre-existing relationship.[7] If consent is not obtained, the organisation cannot rely on this exception, even if obtaining consent is impracticable or impossible in the circumstances.

7.33 Consent is discussed in paragraph 7.23 below, and generally in Chapter B (Key concepts). ‘Sensitive information' is defined in s 6(1) and discussed in Chapter B (Key concepts).

Using and disclosing personal information for the purpose of direct marketing by contracted service providers

7.34 APP 7.5 provides that an organisation that is a contracted service provider for a Commonwealth contract may use or disclose personal information for the purpose of direct marketing if:

• it collects the information for the purpose of meeting (directly or indirectly) an obligation under the contract, and
• the use or disclosure is necessary to meet (directly or indirectly) such an obligation

7.35 The terms ‘contracted service provider' and ‘Commonwealth contract' are defined in s 6(1) and discussed in Chapter A (Introductory matters).

Requests by an individual to stop direct marketing communications

7.36 If an organisation uses or discloses personal information about an individual for the purpose of direct marketing, the individual may request not to receive direct marketing communications from that organisation (APP 7.6(c)).

7.37 The organisation must not charge the individual for making or giving effect to the request (APP 7.7). It must also stop sending the direct marketing communications within a reasonable period after the request is made (APP 7.7(a)). A ‘reasonable period' would generally be no more than 30 days. However, an organisation could give effect to an opt-out request in a shorter timeframe, particularly where digital communication channels are being utilised.

7.38 When the first organisation engages a second organisation to carry out, or assist in carrying out direct marketing on its behalf, it should ensure that the contractual arrangements with the second organisation reflect the first organisation's obligations under APP 7. Where the second organisation is an APP entity, it must also comply with the APPs when handling personal information (see also paragraph 7.44 below).

7.39 In particular, where an individual makes a request to the second organisation to stop the direct marketing under APP 7.6, the contractual arrangements between the two organisations could require the second organisation to give effect to or pass on the opt out request to the first organisation.

Requests by an individual to stop facilitating direct marketing

7.40 An individual may request an organisation not to use or disclose personal information about the individual for the purpose of facilitating direct marketing by a second organisation (APP 7.6(d)).

7.41 The organisation must not charge the individual for making or giving effect to the request (APP 7.7). It must also stop using or disclosing the personal information for the purpose of facilitating direct marketing by a second organisation within a reasonable period after the request is made (APP 7.7(a)). A ‘reasonable period' would be no more than 30 days. However, an organisation could give effect to an opt-out request in a shorter timeframe, particularly when digital communication channels are being utilised.

7.42 Where the second organisation is an APP entity, an individual can also make a separate request to not receive direct marketing communications from that organisation (APP 7.6(c)).

When does an organisation ‘facilitate' direct marketing?

7.43 An organisation (the first organisation) facilitates direct marketing where it collects personal information for the purpose of providing that personal information to another organisation (the second organisation), so that the second organisation can undertake direct marketing of its own products or services.[8] For example, an organisation facilitates direct marketing where it collects personal information and sells that personal information to the second organisation which uses or discloses the personal information to send out marketing material.

7.44 An organisation does not facilitate direct marketing where it engages a second organisation to carry out, or assist in carrying out, direct marketing on its own behalf. In these circumstances, the second organisation will usually be a contractor, or an agent of the first organisation (see paragraphs 7.38–7.39 above). The following are given as examples of where an organisation ‘carries out' direct marketing through a contractor, rather than facilitates direct marketing by a second organisation:

• An organisation engages a mailing house to mail out its direct marketing communications.
• An organisation engages a second organisation to conduct door-to-door marketing or telemarketing on its behalf.

Requests by an individual to identify the source of the personal information

7.45 An individual may ask an organisation to identify the source of the personal information that it uses or discloses for the purpose of direct marketing, or for the purpose of facilitating direct marketing by other organisations (APP 7.6(e)).

7.46 The organisation must then notify the individual of its source, unless this is impracticable or unreasonable (APP 7.7(b)). It is the responsibility of the organisation to be able to justify that it is impracticable or unreasonable to provide this notification. Relevant considerations may include:

• the possible adverse consequences for the individual if they are not notified of the source
• the length of time that has elapsed since the personal information was collected by the organisation
• for personal information collected before commencement of APP 7, whether the source of the personal information was recorded
• the time and cost involved. However, an organisation is not excused from notifying an individual by reason only that it would be inconvenient, time-consuming or impose some cost to do so. Whether these factors make it unreasonable to do so will depend on whether the burden is excessive in all the circumstances.

7.47 Notification of the source of the personal information must be given within a reasonable period after the request is made (APP 7.7(b)). A ‘reasonable period' would generally be 30 days unless special circumstances apply.

Interaction with other legislation

7.48 The Spam Act 2003 (Spam Act) and the Do Not Call Register Act 2006 (DNCR Act) contain specific provisions regarding direct marketing. Where the act or practice of an APP entity is subject to the Spam Act, DNCR Act, or other legislation prescribed under the regulations, APP 7 does not apply to the extent that this legislation applies (APP 7.8).

7.49 If an organisation that is an APP entity is exempt or partially exempt from the Spam Act or DNCR Act, APP 7 will still apply to the acts and practices of that organisation to the extent of that exemption.

Footnotes

[1] Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 81.

[2] For more information about online behavioural advertising and personal information, see OAIC, Targeted Advertising, OAIC website .

[3] For more information about cookies, see OAIC, Targeted Advertising, OAIC website .

[4] See the Federal Register of Legislation for up-to-date versions of the regulations made under the Freedom of Information Act 1982.

[5] See s 7A and OAIC, FOI Guidelines, Part 2, OAIC website .

[6] A and Financial Institution [2012] AICmrCN 1 (1 May 2012).

[7] Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 82.

[8] Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012, p 82.

Was this page helpful?

Security spy 5 2 11. Thank you.

If you would like to provide more feedback, please email us at websitefeedback@oaic.gov.au

Posted: Jul 01 1995 | Revised: Jan 16 2019

1. Online Tracking
2. Mobile Apps
3. Privacy Policies
4. Accessing the Internet
5. Passwords
6. Wireless Networks and Wi-Fi

1. Online Tracking

Almost every major website you visit tracks your online activity. Tracking technology can follow you from site to site, track and compile your activity, and compile all of this into a database. Generally, tracking utilizes a numerical identifier, rather than your real name. This information is used to personalize the content that you see online.

The good news is that almost all browsers give you some control over how much information is revealed, kept and stored. Generally, you can change the settings to restrict cookies and enhance your privacy. Most major browsers now offer a 'Private Browsing' tool to increase your privacy. However, researchers have found that 'Private Browsing' may fail to purge all traces of online activity.

Most browsers also provide a Do Not Track (DNT) setting. DNT is a way to keep your online activity from being followed across the Internet by advertisers, analytics companies and social media sites. When you turn on the DNT setting in your browser, your browser sends a special header to websites requesting that don't want your activity tracked. Unfortunately, honoring the DNT setting is voluntary. Individual websites are not required to respect it. While a few websites will honor DNT, most websites will ignore your preference.

Some of the tools that are used to track you online include cookies, flash cookies, and fingerprinting.

Cookies. When you visit different websites, many of the sites deposit data about your visit, called 'cookies,' on your hard drive. Cookies are pieces of information sent by a web server to a user's browser. Cookies may include information such as login or registration identification, user preferences, online 'shopping cart' information, and so on. The browser saves the information, and sends it back to the web server whenever the browser returns to the website. The web server may use the cookie to customize the display it sends to the user, or it may keep track of the different pages within the site that the user accesses.

For example, if you use the internet to complete the registration card for a product, such as a computer or television, you generally provide your name and address, which then may be stored in a cookie. Legitimate websites use cookies to make special offers to returning users and to track the results of their advertising. These cookies are called first-party cookies. However, there are some cookies, called third-party cookies, which communicate data about you to an advertising clearinghouse which in turn shares that data with other online marketers. These third-party cookies include 'tracking cookies' which use your online history to deliver other ads. Your browser and some software products enable you to detect and delete cookies, including third-party cookies.

Disconnect is a browser extension that stops major third parties from tracking the webpages you go to. Every time you visit a site, Disconnect automatically detects when your browser tries to make a connection to anything other than the site you are visiting. You can also opt-out of the sharing of cookie data with members of the Network Advertising Initiative.

Flash cookies. Many websites utilize a type of cookie called a 'flash cookie' (sometimes also called a 'supercookie') that is more persistent than a regular cookie. Normal procedures for erasing standard cookies, clearing history, erasing the cache, or choosing a delete private data option within the browser will not affect flash cookies. Flash cookies thus may persist despite user efforts to delete all cookies. They cannot be deleted by any commercially available anti-spyware or adware removal program. However, if you use the Firefox browser, there is an add-on called Better Privacy that can assist in deleting flash cookies.

Fingerprinting. A device fingerprint (or machine fingerprint) is a summary of the software and hardware settings collected from a computer or other device. Each device has a different clock setting, fonts, software and other characteristics that make it unique. When you go online, your device broadcasts these details, which can can be collected and pieced together to form a unique 'fingerprint' for that particular device. That fingerprint can then be assigned an identifying number, and used for similar purposes as a cookie.

Fingerprinting is rapidly replacing cookies as a means of tracking. Tracking companies are embracing fingerprinting because it is tougher to block than cookies. Cookies are subject to deletion and expiration, and are rendered useless if a user decides to switch to a new browser. Some browsers block third-party cookies by default and certain browser add-ons enable blocking or removal of cookies.

Unlike cookies and flash cookies, fingerprints leave no evidence on a user's computer. Therefore, it is impossible for you to know when you are being tracked by fingerprinting.

You can test your browser to see how unique it is based on the information that it will share with the sites that you visit. Panopticlick will give you a uniqueness score, letting you see how easily identifiable you might be as you surf the web.

Unfortunately, fingerprinting is generally invisible, difficult to prevent, and semi-permanent. There's no easy way to delete fingerprints that have been collected. Computer users determined to prevent fingerprinting can block JavaScript on their computer. However, some parts of a website (for example, video and interactive graphics) may not load, resulting in a blank space on the webpage.

One way to block JavaScript is to use the Firefox browser with the 'add-on' program called NoScript. The combination of Firefox and NoScript can stop JavaScript on websites. Disabling JavaScript stops many forms of browser fingerprinting, because it prevents websites from detecting plugins and fonts, which are necessary to effectively fingerprint a device.

Cross-device tracking. Cross-device tracking occurs when companies try to connect a consumer's activity across their smartphones, tablets, desktop computers, and other connected devices. The goal of cross-device tracking is to enable companies to link a consumer's behavior across all of their devices. While this information serves many purposes, it is particularly valuable to advertisers.

To engage in cross-device tracking, companies use a mixture of both 'deterministic' and 'probabilistic' techniques. The former can track you through an identifying characteristic such as a login. The later uses a probabilistic approach to infer which consumer is using a device, even when a consumer has not logged into a service.

For example, a company called BlueCava is able to identify and track users online across multiple devices. They can associate multiple devices to the same person or household, by attaching an IP address to a BlueCava identifier and by recognizing and collecting information about the various computers, smartphones, and tablets that people use to connect the internet. Thus, your behavior on one device can be associated with other devices from both your home and office. This information can be very valuable for marketing purposes.

BlueCava's technology enables them to recognize computers and devices by collecting information about your screen type, IP address, browser version, time zone, fonts installed, browser plug-ins and various other properties of your screen and browser. This information is put into a 'snapshot' and is sent to their servers to create a unique ID for every browser and to 'match' the snapshot to the snapshots they receive from their marketing partners. When they use snapshots to create a unique ID, they are also able to group related screens into 'households' based on common characteristics among the snapshots, such as IP addresses. BlueCava allows you to opt out of tracking.

If you are interested in some of the more technical aspects of online tracking, the Princeton Web Census measures cookie-based and fingerprinting-based tracking at one million websites and evaluates the effect of browser privacy tools.

2. Mobile Apps

Cookie 5 7 3 – Protect Your Online Privacy Issues Act

If you use a smartphone or other mobile device to access the Internet, chances are that you may be using mobile applications (apps) rather than an Internet browser for many online activities. An app is a program you can download and access directly using your mobile device. There are hundreds of thousands of apps available, including numerous free or low-priced choices. Unfortunately, apps can collect all sorts of data and transmit it to the app-maker and/or third-party advertisers. This data may then be shared or sold.

Some of the data points that an app may access from your smartphone or mobile device include:

• your phone and email contacts
• call logs
• internet data
• calendar data
• data about the device's location
• the device's unique IDs
• information about how you use the app itself

Many apps track your location. There are location-based services like Yelp and Foursquare that may need your location in order to function properly. However, there are also apps (such as a simple flashlight) that do not need your location to function and yet still track it.

Smartphones and other mobile devices may ask you for specific permissions when you install an app. Read these and think about what the app is asking for permission to access. Ask yourself, 'Is this app requesting access to only the data it needs to function?' If the answer is no, don't download it. Learn where to go on your particular phone to determine what you will allow the app to access, and if you are at all suspicious do more research on the app before you download.

Cookie 5 7 3 – Protect Your Online Privacy Issues Without

Mobile apps generally do not provide ad networks with the ability to set a cookie to track users. Instead, ad networks may use your phone's mobile advertising identifier. These identifiers have different names depending on the brand of your phone. For example, on Android devices they are called Google Advertising ID. On iOS, they are called Identifiers for Advertisers. You can find your device's options to set an opt-out flag using these instructions.

3. Privacy Policies

One way to protect your privacy online is to understand how a site or app will use and share your personal information. Websites and apps generally provide this information in their privacy policy.

California's Online Privacy Protection Act (CalOPPA) requires commercial websites or mobile apps that collect personal information on California consumers to conspicuously post a privacy policy. The privacy policy must, among other things, identify the categories of personally identifiable information collected about site visitors and the categories of third parties with whom the operator may share the information. The privacy policy must also provide information on the operator's online tracking practices. CalOPPA is the first law in the United States to impose disclosure requirements on website operators that track consumers' online behavior. As a practical matter, CalOPPA applies nationwide as long as the site operator collects personal information from California consumers.

According to the California Attorney General, a website, app, or other online service may violate this law if:

• it lacks a privacy policy
• its privacy policy is hard to find
• its privacy policy does not contain all the information required by law
• it does not follow its own privacy policy, or
• it does not notify users of significant changes to its privacy policy

The California Attorney General operates an online complaint form that consumers may use to report violations.

4. Accessing the Internet

You are likely to access the internet using one or more of these services:

• An Internet Service Provider (ISP)
• A Mobile (Cellular) Phone Carrier
• A Wi-Fi Hotspot

If you use a computer to access the internet and pay for the service yourself, you signed up with an Internet Service Provider (ISP). Your ISP provides the mechanism for connecting to the internet.

Each computer connected to the internet, including yours, has a unique address, known as an IP address (Internet Protocol address). It takes the form of four sets of numbers separated by dots, for example: 123.45.67.890. It's that number that actually allows you to send and receive information over the internet.

Depending upon your type of service, your IP address may be 'dynamic', that is, one that changes periodically, or 'static', one that is permanently assigned to you for as long as you maintain your service.

Your IP address by itself doesn't provide personally identifiable information. However, because your ISP knows your IP address, it is a possible weak link when it comes to protecting your privacy. ISPs have widely varying policies for how long they store IP addresses. Unfortunately, many ISPs do not disclose their data retention policies. This can make it difficult to shop for a 'privacy-friendly' ISP. Some ISPs may share their customers' internet activity with third parties and/or collect your browsing history to deliver targeted advertisements.

When you visit a website, the site can see your IP address. Your IP address can let a site know your geographical region. The level of accuracy depends upon how your ISP assigns IP addresses.

You can block your IP address by utilizing a service such as Tor which effectively blocks this information. Another alternative is to use a Virtual Private Network (VPN). A VPN replaces your IP address with one from the VPN provider. A VPN subscriber can obtain an IP address from any gateway city the VPN service provides. You will have to pick a VPN provider very carefully. Unfortunately, experts can't agree upon which VPN services are best. Some VPNs have potential security flaws that could put your data at risk. It can be difficult to determine how secure a VPN is, and precisely what it is doing with your data. Most experts advise avoiding free VPNs, which may monetize your data in exchange for the free service.

If you access the internet with a phone or other mobile device, you may access the internet using a data plan tied to your cellular phone service. If you have a data plan, your service provider (such as AT&T, Sprint, Verizon, and T-Mobile) collects data about your usage.

5. Passwords

Whenever you have an opportunity to create and use a password to protect your information, make sure that you use a strong password. Passwords are the first line of defense against the compromise of your digital information. Revealing the data on your phone, your banking information, your email, your medical records, or other personal information could be devastating. Yet many people fail to follow proper practices when selecting the passwords to protect this important information. Many websites that store your personal information (for example web mail, photo or document storage sites, and money management sites) require a password for protection. However, password-protected websites are becoming more vulnerable because often people use the same passwords on numerous sites. Strong passwords can help individuals protect themselves against hackers, identity theft and other privacy invasions.

Here are some password 'dos' and 'don'ts' that can help you to maintain the security of your personal data.

• Do use longer passwords. Passwords become harder to crack with each character that you add, so longer passwords are better than shorter ones. A brute-force attack can easily defeat a short password.
• Do use special characters, such as $, #, and &. Most passwords are case sensitive, so use a mixture of upper case and lower case letters, as well as numbers. An online password checker can help you determine the strength of your password.
• Don't 'recycle' a password. Password-protected sites are often vulnerable because people often use the same passwords on numerous sites. If your password is breached, your other accounts could be put at risk if you use the same passwords.
• Don't use personal information (your name, birthday, Social Security number, pet's name, etc.), common sequences, such as numbers or letters in sequential order or repetitive numbers or letters, dictionary words, or 'popular' passwords.
• Don't feel obligated to change your passwords frequently, unless you believe that your password has been stolen or breached. Conventional wisdom considered changing passwords to be an important security practice. Recent research suggests that people who change their passwords frequently select weaker passwords to begin with, and then change them in predictable ways. Of course, if you believe that your password has been breached or compromised, it is essential to change it immediately.
• Don't share your passwords with others.
• Do enable two-factor authentication (when available) for your online accounts. Typically, you will enter your password and then a code will be sent to your phone. You will need to enter the code in addition to your password before you can access the account. Twofactorauth.org has an extensive list of sites and information about whether and how they support two-factor authentication. It's best to use an option that isn't SMS-based, such as an authentication app on your smartphone.
• Don't write down your passwords or save them in a computer file or email. Consider a password manager program if you can't remember your passwords. Alternatively, keep a list of passwords in a locked and secure location, such as a safe deposit box.

Password recovery methods are frequently the 'weakest link', enabling a hacker to reset your password and lock you out of your account. Be sure that you don't pick a question which can be answered by others. Many times, answers to these questions (such as a pet's name or where you went to high school) can be ascertained by others through social networking or other simple research tools. It's also a good idea to have your password resets go to a separate email account designed for resets only.

6. Wireless Networks and Wi-Fi

Households and businesses establish wireless networks to link multiple computers, printers, and other devices and may provide public access to their networks by establishing Wi-Fi hotspots. A wireless network offers the significant advantage of enabling you to build a computer network without stringing wires. Unfortunately, these systems usually come out of the box with the security features turned off. This makes the network easy to set up, but also easy to break into.

Most home wireless access points, routers, and gateways are shipped with a default network name (known as an SSID) and default administrative credentials (username and password) to make setup as simple as possible. These default settings should be changed as soon as you set up your Wi-Fi network. In addition, some routers are equipped by default with 'Guest' accounts that can be accessed without a password. 'Guest' accounts should be disabled or password protected.

The typical automated installation process disables many security features to simplify the installation. Not only can data be stolen, altered, or destroyed, but programs and even extra computers can be added to the unsecured network without your knowledge. This risk is highest in densely populated neighborhoods and office building complexes.

Home networks should be secured with a minimum of WPA2 (Wi-Fi Protected Access version 2) encryption. You may have to specifically turn on WPA2 to use it. The older WEP encryption has become an easy target for hackers. Also, do not name your home network using a name that reveals your identity. Setting up your home Wi-Fi access point can be a complex process and is well beyond the scope of this fact sheet. To ensure that your system is secure, review your user's manuals and web resources for information on security.

The number of Wi-Fi hotspot locations has grown dramatically and includes schools, libraries, cafes, airports, and hotels. With a Wi-Fi connection you can be connected to the Internet almost anywhere. You can conduct the same online activities over Wi-Fi as you would be able to at home or work, such as checking email and surfing the web. However, you must consider the risks to your privacy and the security of your device when using a Wi-Fi hotspot. Most Wi-Fi hotspots are unsecured and unencrypted. Even the expensive pay Wi-Fi service available in many airplanes may be as insecure as the free Wi-Fi offered at your corner coffee house. Therefore, you must take additional steps to protect your privacy.

Because the network at a Wi-Fi hotspot is unsecured, Internet connections remain open to intrusion. Hackers can intercept network traffic to steal your information. There are 3 major privacy threats in a Wi-Fi hotspot:

• Man-In-The-Middle Attack refers to the act of intercepting the connection between your computer and the wireless router that is providing the connection. In a successful attack, the hacker can collect all the information transferred and replay them on his computer.
• Eavesdropping refers to the act of using sniffer software to steal data that is being transmitted over the network. A sniffer is an application or device that can read, monitor, and capture network data. This is particularly dangerous when conducting transactions over the internet since sniffers can retrieve logon details as well as important information such as credit card numbers.
• Looking over the shoulder is the simple act of others looking over your shoulder to see your activities.

There are various ways to help protect your privacy when using Wi-Fi. Begin with basic common sense. Look around to see if anyone is surreptitiously trying to look at your computer. Do not leave your computer unattended. Never conduct unsecured transactions over unsecured Wi-Fi. When entering sensitive information (such as your Social Security number, password, or credit card number), ensure that either the webpage encrypts the information or that your Wi-Fi connection is encrypted. Disable your wireless adapter if you are not using the Internet. Otherwise, you leave your computer open to vulnerabilities if it accidentally connects to the first available network.

Snagit 4 0 7 download free. VPN (Virtual Private Network). This is the first line of defense against vulnerabilities created by Wi-Fi. A VPN provides encryption over an unencrypted Wi-Fi connection. This will help ensure that all web pages visited, log-on details, and contents of email messages remain encrypted. This renders intercepted traffic useless to the hacker. You can obtain software to set up a VPN through your office or home computer, or you can use a commercial provider's hosted VPN service.

Secure surfing/SSL. When checking your email or conducting any important transaction, adding an 's' after 'http' may give you a secured connection to the webpage. Many webmail services provide this feature. This ensures that your login details are encrypted thereby rendering it useless to hackers. Although your email login may be encrypted, some webmail providers may not encrypt your Inbox and messages.

Check for SSL (Secure Sockets Layer) certificates on all websites on which you conduct sensitive transaction. SSL creates a secure connection between a client and a server, over which any amount of data can be sent securely.

Wi-Fi settings. Ensure that your computer is not set to automatically connect to the nearest available Wi-Fi access point. This may not necessarily be a legitimate connection point but instead an access point on a hacker's computer.

Disable file-sharing. Ensure that file sharing is disabled on your computer to ensure that intruders cannot access your private files through the network.

Cookie 5 7 3 – Protect Your Online Privacy Issues Free

Firewall. Install a firewall on your computer and keep it enabled at all times when using Wi-Fi. This should prevent intrusion through the ports on the computer.

Cookie 5 7 3 – Protect Your Online Privacy Issues Regarding

Security updates. Keep your computer's software and operating system up-to-date. This will help plug security holes in the software or operating system.