Privacy & Ethical Considerations Flashcards

Under the GDPR, which lawful basis is generally required before setting non-essential analytics cookies?

Answer: Explicit, opt-in consent

Under ePrivacy and GDPR rules, non-essential cookies need freely given, informed opt-in consent.

What key right does the CCPA/CPRA give California consumers regarding their data?

Answer: Right to opt out of the sale or sharing of their personal information

CCPA/CPRA lets consumers opt out of the sale or sharing of personal information.

What is the maximum fine for the most serious GDPR violations?

Answer: €20 million or 4% of global annual turnover, whichever is higher

The upper tier is €20M or 4% of worldwide annual turnover, whichever is greater.

When a company uses a web analytics vendor to process visitor data on its behalf, what is the vendor's typical GDPR role?

Answer: Data processor

A vendor processing data on the company's instructions is a processor, and the company is the controller.

How long does a controller generally have to respond to a GDPR data subject access request?

Answer: One month

GDPR requires a response without undue delay and within one month, extendable in complex cases.

Which data is generally NOT considered personal data under the GDPR?

Answer: Truly anonymized aggregate data that cannot be re-identified

Data that is irreversibly anonymized falls outside GDPR scope, unlike pseudonymized data.

How must a site treat a Global Privacy Control (GPC) signal from a California visitor's browser?

Answer: As a valid request to opt out of sale/sharing

California regulators treat GPC as a valid opt-out preference signal under CCPA/CPRA.