Online Privacy and Technology Flashcards

Under COPPA, what are the notice requirements for operators of child-directed websites?

Answer: Post a clear privacy policy and provide direct notice to parents before collecting data

COPPA requires operators to post a comprehensive privacy policy on their site and provide direct notice to parents, describing data practices, before collecting children's information.

What does the Stored Communications Act (SCA), part of ECPA, primarily protect?

Answer: Electronic communications stored by third-party service providers from unauthorized government and private access

The SCA (Title II of ECPA) protects electronic communications held in storage by third-party service providers from unauthorized access by both governments and private parties.

Which principle guides cookie consent requirements under US state privacy laws like CCPA?

Answer: Opt-out for non-essential cookies used for cross-context behavioral advertising

Under CCPA/CPRA, cookies used for cross-context behavioral advertising or sale of personal information trigger opt-out rights, not opt-in consent requirements.

What is a 'dark pattern' in the context of online privacy, and why is it a regulatory concern?

Answer: A deceptive UI design that manipulates users into sharing more data or opting into unwanted settings

Dark patterns are manipulative UI/UX designs that trick users into choices they would not otherwise make, such as pre-checked consent boxes or confusing opt-out flows.

Under the Video Privacy Protection Act (VPPA), what is prohibited?

Answer: Disclosing a person's video rental or purchase records without consent

The VPPA prohibits video tape service providers from knowingly disclosing personally identifiable information about consumers' video rental or purchase records without consent.

Which best describes a 'privacy by design' approach in technology development?

Answer: Embedding privacy protections into system design from the start rather than adding them later

Privacy by design means proactively embedding privacy into the architecture, design, and operation of systems from inception rather than retrofitting it after development.