Principle 03 of 8
Privacy
Collect only what is needed, use it only as agreed, and protect it.
Protects
Customers, workers, people who never signed up
Why it matters
Personal information outlives the moment it is given, and it can be used against the person it describes.
Covers
Data collection, tracking, retention, sale, and breach handling (Category 4), and consent to data use (5.1).
Practices that break it
17 subsections · 87 practices
3.5Forced Action+ Autonomy5
4.1Over-Collection5
4.2Shadow Profiling of Non-Users3
4.3Cross-Device & Cross-Platform Tracking5
4.4Location Tracking Beyond Necessity5
4.5Biometric Collection Without Consent+ Autonomy5
4.6Worker / Workplace Surveillance+ Responsibility7
4.7Sensitive-Attribute Inference+ Fairness5
4.8Children's Data Collection+ Care7
4.9Indefinite Retention5
4.10Data Sale to Brokers / Third Parties+ Autonomy8
4.11Smart-Device & IoT Harvesting7
4.12Breach Notification Failures+ Accountability4
4.13Insider & Access Abuse+ Accountability3
5.1Consent Manipulation+ Autonomy7
5.3Misleading Privacy Claims+ Honesty4
10.9Domestic-Violence Survivor Endangerment+ Care2
The same principle, across industries
Every practice above, as it reads in the catalog. Numbers link to the standard.
3.5 Forced Action · 5 practices
Privacy+ Autonomy
| § | Practice | Description | Seen in |
|---|---|---|---|
| 3.5.1 | Forced Registration | Requiring account creation for actions that don't need persistent identity (viewing prices, completing a one-time purchase). | E-commerce, news/media, software downloads |
| 3.5.2 | Forced Continuity | Automatic conversion of a free trial to paid without a clear pre-charge prompt. | Streaming, supplements, software |
| 3.5.3 | Friend Spam / Contact Upload | Requiring contact-list access or social-graph permissions as a condition of basic functionality. | Social media, productivity apps |
| 3.5.4 | Forced Ad Targeting | Making personalized ad targeting a non-negotiable condition of using the service, even in paid tiers. | Social media, streaming |
| 3.5.5 | Aggressive In-Person Solicitation | Verbal solicitation, shouting, harassment, or physical blocking of potential customers in transit hubs and tourist zones to coerce a transaction before they can compare alternatives. | Taxi services at airports/stations, timeshare reps, street vendors |
4.1 Over-Collection · 5 practices
Privacy
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.1.1 | Excessive Data Collection | Gathering more data than is necessary for the stated purpose. | Cross-domain (mobile apps, automotive infotainment, smart appliances, fitness, gaming) |
| 4.1.2 | Purpose Creep | Using data collected for one purpose ("service improvement") for unrelated purposes (ad targeting, employee evaluation, partner deals) without renewed consent. | Internal company ethics, social media, telecom, healthcare |
| 4.1.3 | Cloud-Dependency Coercion | Requiring cloud connectivity for core product functionality so data collection becomes a precondition of operation. | Home appliances, automotive, gaming |
| 4.1.4 | Phoning Home Without Purpose | Software transmitting telemetry to company servers when no cloud feature is needed for the product to function. | Operating systems, productivity software, smart appliances |
| 4.1.5 | Infotainment / Synced-Phone Harvesting | Collecting contacts, calendar entries, text messages, or media from a connected phone without clear disclosure. | Automotive infotainment, smart TVs |
4.2 Shadow Profiling of Non-Users · 3 practices
Privacy
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.2.1 | Shadow Profiling | Building behavioral, demographic, or social-graph profiles of individuals who have never created accounts, via pixels, contact uploads, or third-party data. | Social media, advertising, data brokers, internal company ethics |
| 4.2.2 | Public-Records Aggregation Profiling | Combining disparate public records — court filings, deeds, voter rolls — into invasive composite profiles. | Data brokers, credit reporting |
| 4.2.3 | Inferred-Attribute Profiling | Using algorithms to infer protected or sensitive characteristics (health conditions, sexuality, religion, immigration status) from behavioral data. | Data brokers, advertising, insurance |
4.3 Cross-Device & Cross-Platform Tracking · 5 practices
Privacy
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.3.1 | Cross-Site Tracking Without Consent | Following users across sites and apps via tracking pixels, device graphs, or identifier sharing. | Digital advertising, social media |
| 4.3.2 | Browser & Canvas Fingerprinting | Using browser, canvas, or device fingerprinting to circumvent cookie restrictions and re-identify users who have cleared cookies. | Digital advertising |
| 4.3.3 | Cross-Device Identity Stitching | Linking activity across a user's phone, tablet, and desktop into unified profiles without explicit consent. | Digital advertising, search engines |
| 4.3.4 | Cross-Product Data Fusion | Merging data across multiple products of the same vendor into unified profiles without product-specific consent. | Internal company ethics, large platforms |
| 4.3.5 | Cross-Service Data Sharing | Using customer data from one service to benefit another service in the provider's portfolio without explicit consent. | Cloud/SaaS, streaming, telecom |
4.4 Location Tracking Beyond Necessity · 5 practices
Privacy
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.4.1 | Background Location Tracking | Continuing to collect precise location when the app is closed or backgrounded, beyond what is needed. | Dating, ride-hailing, food delivery, social media |
| 4.4.2 | Vehicle Location Sale | Selling or sharing real-time or historical vehicle location data with data brokers. | Automotive, ride-hailing |
| 4.4.3 | Logistics Recipient Tracking | Continuing to track delivery worker or recipient location after order completion. | Food delivery, ride-hailing, shipping/logistics |
| 4.4.4 | Visit-Frequency Profiling | Tracking physical-venue check-in frequency for behavioral profiling or targeted advertising. | Fitness, retail, hospitality |
| 4.4.5 | Worker Off-Hours Location | Requiring devices or software that track employee location outside work hours or in private spaces. | Internal company ethics, gig economy |
4.5 Biometric Collection Without Consent · 5 practices
Privacy+ Autonomy
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.5.1 | Biometric Boarding/Entry Coercion | Defaulting to facial recognition, fingerprint, or iris scans for boarding or venue entry, with opt-out paths intentionally burdensome. | Airlines, ticketing/venues, government services |
| 4.5.2 | Always-On Microphone | Voice-activated features that retain microphone access without clear status indication or user control. | Home appliances, smart speakers, gaming |
| 4.5.3 | Biometric Storage Beyond Verification | Retaining identity documents, faceprints, or fingerprints beyond the verification event. | Tobacco/vaping (age verification), financial onboarding, gambling |
| 4.5.4 | Public-Space Biometric Surveillance | Operating facial recognition in public space without informed, specific, revocable consent. | Government, retail (loss prevention), transit |
| 4.5.5 | Wearable Biometric Sale | Collecting heart rate, body composition, recovery, or fitness assessment data and selling to insurers, employers, or brokers. | Fitness, sports, healthcare wearables |
4.6 Worker / Workplace Surveillance · 7 practices
Privacy+ Responsibility
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.6.1 | Keystroke / Screen Monitoring | Recording keystrokes, screenshots, or screen contents continuously or at random intervals without meaningful notice. | Internal company ethics, surveillance technology, staffing/temp agencies |
| 4.6.2 | Behavioral Analytics on Staff | Using AI to analyze employee communication patterns, tone, sentiment, or social graph to score, rank, or flag workers. | Internal company ethics, HR |
| 4.6.3 | Productivity Score Quantification | Assigning numerical scores based on mouse movement, idle time, or app switching, then using them in performance, termination, or promotion decisions. | Internal company ethics, surveillance technology |
| 4.6.4 | Covert Meeting Recording | Recording, transcribing, or analyzing internal meetings or calls without the contemporaneous knowledge of all participants. | Internal company ethics |
| 4.6.5 | Personal-Device MDM Intrusion | Requiring monitoring or MDM software on personally owned devices as a condition of employment. | Internal company ethics |
| 4.6.6 | Union-Busting Surveillance | Tools or services designed to identify, track, or undermine labor organizing. | Surveillance technology |
| 4.6.7 | AI-Driven Worker Monitoring | Tracking keystrokes, bathroom breaks, movement, or productivity to create constant surveillance environments. | AI vendors, warehousing, call centers, ride-hailing, food delivery |
4.7 Sensitive-Attribute Inference · 5 practices
Privacy+ Fairness
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.7.1 | Mental-Health Inference for Targeting | Inferring depression, anxiety, grief, or emotional vulnerability from posting patterns and using it for ad targeting or feature manipulation. | Social media, advertising |
| 4.7.2 | Pregnancy / Health-Condition Inference | Inferring pregnancy, chronic illness, or health condition from browsing behavior for targeting. | Digital advertising, retail, insurance |
| 4.7.3 | Sexual-Orientation Inference / Disclosure | Inferring or exposing sexual orientation through ad targeting or data sharing without explicit consent, creating outing risk. | Dating, social media, advertising |
| 4.7.4 | Financial-Distress Inference | Identifying financially vulnerable users for predatory ad targeting (high-interest loans, debt-relief schemes). | Digital advertising, financial services |
| 4.7.5 | Emotion-Recognition Pseudoscience | Deploying affect-detection systems for hiring, security, or border control as if scientifically validated. | AI, HR/recruitment, government |
4.8 Children's Data Collection · 7 practices
Privacy+ Care
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.8.1 | Identifier Collection from Minors | Collecting identifying information from users under 13 in violation of COPPA-equivalent rules. | Baby/children's products, gaming, social media, podcasting (kids' content) |
| 4.8.2 | Inadequate Age Verification | Using self-reported age with no verification, enabling minors to access age-restricted features. | Social media, gambling, alcohol, tobacco/vaping, cannabis |
| 4.8.3 | Engagement-Maximizing Features for Minors | Streaks, likes, infinite-scroll, push notifications targeted at or disproportionately affecting under-18 users. | Social media, gaming |
| 4.8.4 | Educational-App Surveillance | Selling or sharing student learning data, engagement metrics, or personal information to third parties. | Education, EdTech |
| 4.8.5 | Childcare Behavioral-Data Sale | Selling developmental assessments, behavioral records, or learning data from childcare programs. | Childcare/daycare |
| 4.8.6 | Smart-Monitor Infant Data | Collecting sleep patterns, vital signs, and movement from baby monitors beyond device function. | Baby/children's products |
| 4.8.7 | AI-Proctoring Bias on Students | Requiring AI exam monitoring that flags students of color at higher rates and collects biometrics without safeguards. | Education |
4.9 Indefinite Retention · 5 practices
Privacy
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.9.1 | Indefinite Personal-Data Retention | Storing personal data beyond functional need, with no retention schedule or deletion mechanism. | Cross-domain (search engines, social media, government, telecom, retail) |
| 4.9.2 | Post-Cancellation Data Retention | Retaining customer data beyond contract termination without justification, sometimes contingent on additional fees for deletion. | Cloud/SaaS |
| 4.9.3 | Crisis-Hotline Caller Retention | Retaining caller data, transcripts, or metadata from crisis hotlines beyond the immediate crisis. | Mental health |
| 4.9.4 | Background-Check Result Retention | Conducting more extensive background or credit checks than required and retaining results indefinitely. | Staffing/temp, HR |
| 4.9.5 | Customs / Logistics Metadata Retention | Retaining shipment, customs, or routing data beyond operational, legal, or service-required windows. | Logistics, shipping |
4.10 Data Sale to Brokers / Third Parties · 8 practices
Privacy+ Autonomy
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.10.1 | Data Sale to Brokers | Selling user, customer, patient, or worker data — including behavioral, demographic, and inferred attributes — to data brokers or downstream resellers. | Cross-domain (healthcare, retail, telecom, social media, automotive, real estate, search, fitness, mental health, dating, education, music, entertainment, ride-hailing, food delivery, banking, advertising, dental, veterinary, alcohol, tobacco, supplements, prison, wedding, funeral, wedding, baby/children, senior care, firearms, etc.) |
| 4.10.2 | Sensitive-Health Data Sale | Selling mental health, reproductive, addiction, or therapy session data — including AI chatbot conversations — to advertisers or third parties. | Mental health, pharma/biotech, dental, healthcare |
| 4.10.3 | Therapy-Conversation Harvesting | Using AI mental health chatbot conversations for training, profiling, or sale without explicit consent. | Mental health, AI |
| 4.10.4 | Clinical-Trial Genetic Data Sale | Selling or licensing genetic data collected from trial participants for secondary commercial use. | Pharma/biotech |
| 4.10.5 | Inmate Communication-Data Sale | Selling or sharing inmate call records, purchases, or location data — extending surveillance to family members. | Prison/corrections |
| 4.10.6 | Loyalty-Program Data Sale | Selling frequent-customer data — travel patterns, purchase histories, demographics — to insurers, marketers, or analytics firms. | Airlines, hotels, retail, financial services |
| 4.10.7 | Government-Agency Data Sale | Providing personal data to law enforcement without warrants, exploiting commercial channels to bypass constitutional protections. | Data brokers, surveillance technology |
| 4.10.8 | Authoritarian-Regime Sales | Providing data, analytics, surveillance, or imagery to governments with documented human rights abuses. | Data brokers, AI, surveillance technology, space/aerospace (satellite imagery) |
4.11 Smart-Device & IoT Harvesting · 7 practices
Privacy
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.11.1 | Smart-Appliance Surveillance | Gathering household composition, usage patterns, and behavioral data from connected appliances. | Home appliances |
| 4.11.2 | Firmware-Update Data Tunneling | Bundling new data collection or terms changes into mandatory security updates. | Home appliances, automotive, IoT |
| 4.11.3 | Connected-Vape Data Harvesting | Collecting puff frequency, duration, and location from smart vaping devices without meaningful consent. | Tobacco/vaping |
| 4.11.4 | Smart-Meter Granular Surveillance | Collecting fine-grained energy or water usage data that reveals occupancy and appliance use, without governance. | Energy utilities, water utilities |
| 4.11.5 | In-Room IoT Surveillance | Using in-room cameras, smart-TV cameras, voice assistants, or sensor-based mini-bars in private spaces (hotels, rentals). | Hospitality, real estate |
| 4.11.6 | Cross-Device Household Profiling | Correlating data across multiple connected devices to build household behavioral profiles. | Home appliances |
| 4.11.7 | In-Vehicle Telematics Sale | Using driving data — speed, braking, location — for insurance scoring or advertising without explicit opt-in. | Automotive, insurance |
4.12 Breach Notification Failures · 4 practices
Privacy+ Accountability
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.12.1 | Breach Notification Delay | Delaying disclosure of data breaches beyond legally required timelines to manage PR or assess liability. | Cross-domain (financial services, cloud, credit reporting, telecom, data brokers, retail) |
| 4.12.2 | Breach Severity Downplaying | Minimizing the scope, data types, or number of affected individuals in public disclosures, providing technically accurate but materially misleading statements. | Cybersecurity, healthcare |
| 4.12.3 | Breach Insurance Upselling | Using a breach event as an opportunity to sell identity-theft monitoring rather than improving baseline security. | Credit reporting, financial services |
| 4.12.4 | Breach-Insurance Vacuum for Affected | Carrying no provision or insurance to compensate data subjects harmed by breaches, leaving victims without recourse. | Data brokers |
4.13 Insider & Access Abuse · 3 practices
Privacy+ Accountability
| § | Practice | Description | Seen in |
|---|---|---|---|
| 4.13.1 | Insider Access Without Need-to-Know | Allowing broad, unmonitored employee or contractor access to consumer data, leading to unauthorized lookups, theft, or stalking. | Data brokers, technology platforms |
| 4.13.2 | Inadequate Encryption of Sensitive Data | Storing or transmitting financial, health, or location data without encryption at rest or in transit. | Data brokers, tax preparation |
| 4.13.3 | Third-Party API Without Controls | Exposing bulk data via APIs without rate limiting, usage auditing, or purpose restrictions. | Data brokers, social media |
5.1 Consent Manipulation · 7 practices
Privacy+ Autonomy
| § | Practice | Description | Seen in |
|---|---|---|---|
| 5.1.1 | Bundled Consent | Requiring users to accept broad data collection, tracking, and analytics as a single all-or-nothing package rather than granular choices. | Internal company ethics, social media, mobile apps |
| 5.1.2 | Coerced Consent | "Accept or leave" ultimatums that make refusal impractical even when refusal should be a viable option. | Social media, telecom, healthcare (data sharing in treatment forms) |
| 5.1.3 | Consent Fatigue | Overwhelming users with repeated or fragmented consent requests so that meaningful choice degrades into reflexive acceptance. | Cookie banners, mobile permissions |
| 5.1.4 | Opt-Out Friction / Burial | Burying tracking opt-outs in obscure settings, requiring admin privileges, resetting preferences after updates, or requiring account creation to opt out. | Internal company ethics, advertising, social media |
| 5.1.5 | Opt-Out Expiration | Setting time limits on opt-out requests, automatically re-enrolling consumers in data collection after a period. | Data brokers |
| 5.1.6 | Coerced Wearable / Telematics Sharing | Conditioning meaningful discounts on sharing of wearable, driving, or other behavioral data, penalizing privacy-conscious customers. | Insurance, automotive |
| 5.1.7 | Genetic Data Coercion | Using or requesting genetic testing data for underwriting decisions or as a condition of service. | Insurance |
5.3 Misleading Privacy Claims · 4 practices
Privacy+ Honesty
| § | Practice | Description | Seen in |
|---|---|---|---|
| 5.3.1 | Deceptive De-Identification Claims | Claiming telemetry or shared data is "anonymous," "aggregated," or "crash-only" when it is sufficient to identify or re-identify individuals. | Internal company ethics, healthcare |
| 5.3.2 | Re-Identifiable Anonymized Sharing | Sharing supposedly anonymized datasets that can be cross-referenced to re-identify subjects. | Prison/corrections, healthcare |
| 5.3.3 | Selective Transparency Reporting | Publishing transparency or data-request reports that omit proprietary surveillance, internal monitoring, or shadow profiling volumes. | Internal company ethics, social media |
| 5.3.4 | Security-Veiled Surveillance | Justifying invasive tracking under the pretense of "security," "fraud prevention," or "integrity" when the primary use is behavioral analytics. | Internal company ethics, financial services |
10.9 Domestic-Violence Survivor Endangerment · 2 practices
Privacy+ Care
| § | Practice | Description | Seen in |
|---|---|---|---|
| 10.9.1 | Inadequate DV Survivor Protections | Failing to offer profile hiding, location masking, or block-list portability for users fleeing abusers. | Dating, social media |
| 10.9.2 | Image-Abuse Enablement | Allowing screenshots, scraping, or unencrypted message storage that enables revenge porn or harassment. | Dating, social media |