| name | data-privacy |
| description | Understanding and managing what digital services collect, store, share, and infer about you. Covers password security and entropy, multi-factor authentication, privacy settings, data minimization, the difference between first-party and third-party tracking, cookies and fingerprinting, privacy laws (GDPR, CCPA), and how to respond to data breaches. Use when helping a learner make informed decisions about what to share, with whom, and under what terms. |
| type | skill |
| category | digital-literacy |
| status | stable |
| origin | tibsfox |
| modified | false |
| first_seen | "2026-04-12T00:00:00.000Z" |
| first_path | examples/skills/digital-literacy/data-privacy/SKILL.md |
| superseded_by | null |
Data Privacy
Data privacy is the practical discipline of deciding what personal information to share with which services, under what conditions, and for what purpose. It is not about being paranoid and it is not about opting out of modern life. It is about developing the habits and mental models that let you participate in digital systems without letting those systems accumulate more leverage over you than you intended. This skill covers authentication (keeping accounts your own), collection (what services take), aggregation (what they infer), and remediation (what to do when things go wrong).
Agent affinity: palfrey (institutional privacy), boyd (contextual integrity), noble (platform power asymmetry)
Concept IDs: diglit-password-security, diglit-privacy-management, diglit-data-collection, diglit-digital-footprint
Password Security
Passwords are still the front door for most accounts. Two-thirds of real-world breaches trace back to weak or reused passwords. The principles:
Entropy, not cleverness
A password's strength is its entropy -- the number of possible values an attacker must try. A 12-character random string has more entropy than "Tr0ub4dor&3" (the old XKCD joke). A four-word passphrase like "correct horse battery staple" has similar entropy to a 10-12 character random string, and is easier to remember.
Minimum in 2026: 12 characters random or 4+ word passphrase. 16+ characters for high-stakes accounts.
No reuse
The single most important password rule: never reuse passwords across accounts that matter. When one site leaks, attackers try the same credentials everywhere else (credential stuffing). One breach becomes many.
Password managers
You cannot remember hundreds of unique strong passwords. A password manager stores them encrypted behind a single master password. Good options in 2026: 1Password, Bitwarden (open source), KeePassXC (local, open source). Most operating systems also include one.
Counterintuitively: Using a password manager is safer than not using one, even though "all your passwords in one place" sounds risky. The alternative is reuse, and reuse is worse.
Multi-factor authentication (MFA)
Multi-factor authentication requires a second proof beyond the password: something you have (phone, hardware key) or something you are (fingerprint, face). Even a perfect credential stuffing attack fails without the second factor.
Hierarchy of MFA strength (weakest to strongest):
- SMS codes -- vulnerable to SIM swap attacks but still better than no MFA
- Authenticator apps (Authy, Google Authenticator) -- not SIM-swappable
- Push notifications to a trusted device -- convenient, phishing-resistant when implemented well
