Privacy & Ethical Considerations Flashcards

Under COPPA, parental consent is required before collecting personal information from children under what age?

Answer: 13

COPPA protects children under 13 online.

A marketer accidentally sends customer email addresses to Google Analytics. According to Google's terms, what must happen?

Answer: The data must be deleted and collection stopped

Google's terms prohibit sending PII, so the data should be removed and the source fixed.

Which item belongs in a good privacy policy for an analytics-driven site?

Answer: What data is collected, why, who receives it and how users exercise their rights

Transparency requires purposes, recipients, retention and user rights to be described.

Under the GDPR right to erasure, when may a controller refuse a deletion request?

Answer: When an overriding legal obligation or other exemption applies

Erasure is not absolute; legal obligations and certain other grounds can override it.

Why do regulators often reject 'cookie walls' that block access unless users accept tracking?

Answer: Consent must be freely given, and forced consent is not valid

Consent made a condition of access is generally not considered freely given.

Within what timeframe must a GDPR controller normally notify the supervisory authority of a personal data breach?

Answer: Within 72 hours of becoming aware

GDPR requires notification within 72 hours where feasible, unless the breach is unlikely to risk individuals.

Why does GA4 apply data thresholds in some reports?

Answer: To prevent small counts from revealing individual users' identities

Thresholding withholds low-count rows, especially with demographic data, to protect user privacy.