Consequences

By this point in the section, you might be wondering why we should even bother with personal privacy. With so much information “out there” and so many different devices collecting it, is privacy a lost cause? In this lesson, we’re going to take a look at several major consequences that could arise from the sharing or release of personal information.

Targeted Advertising

One might scan the contents of this page and believe that this first category of consequence isn’t like the others. If this observation applies to you, then congratulations! The marketing companies have successfully delivered their narrative that somehow the “service” of showing “ads that are more relevant to you” is somehow a benefit intended for you instead of an insidious money-making attempt by them.

Targeted advertising (also known by various euphemisms like “personalized messages”) is a data-driven way to direct specific ads to consumers who are more likely to “convert” (or buy something) in response to those ads. This approach to advertising involves collecting as much information about people as possible, including how they behave, what kinds of interests they have, what their habits are, demographic information (such as race, gender, and income), and so forth. Companies that collect or obtain these data then try to group customers into “segments” that can be selected according to marketing criteria. Ads matching the segment preferences are then displayed to consumers who are identified as being members of these segments, hopefully increasing the conversion rate compared to displaying a generic ad to a broad audience.¹

Most consumer devices and Web browsers have facilities built into them that are directly designed for ad targeting. Both Android and Apple iOS contain resettable “advertising identifiers” that are designed to allow different apps and websites to correlate behaviors associated with a single mobile phone to that phone’s user.² Google’s “Privacy Sandbox” proposal, which has initial availability in the Chrome browser, is an attempt to shift the segmentation of audiences from the data collection and aggregation companies to users’ devices.³ Even Mozilla, which has historically been a champion for privacy on the Internet, enables an ad measurement system by default on new Firefox installations.⁴

Fundamentally, the use of advertising identifiers, the “Privacy Sandbox,” and supposedly private ad measurement are all privacy theater for one critical underlying reason. Regardless of where the segmentation of people into marketing target groups happens, the underlying premise of targeted marketing is based on pure psychological manipulation. Ads are shown to people who are most psychologically vulnerable to being influenced into purchasing the corresponding product or service, regardless of whether or not they actually need it, and regardless of whether or not they can actually afford it. Worse yet, these kinds of ads can even affect a person’s self-image.⁵ Thanks to the shrewd work of businesses, our society has come to accept this form of manipulation as part of our consumer-driven economy and is thus completely legal.

Crime

In 2023, around 1 million Americans reported being victims of identity theft, and another 2.6 million reported being victims of fraud.⁶ Both of these kinds of financial fraud are the result of a threat actor obtaining sensitive personal information about the victim and then using that information to open accounts in the victim’s name, siphon money from an existing account, fraudulently claim a tax return, etc. Threat actors have a number of ways to obtain information about potential victims, including dumpster diving for paper records, sending phishing emails designed to get people to reveal passwords, social engineering, malware, and data breaches, among others.⁷

Financial crimes are not the only kinds of crime that can be facilitated using personal information. Burglars are known to use social media posts to determine when a homeowner isn’t at home, allowing them to schedule a break-in.⁸ A common crime directed at younger Internet users is that of sextortion, which occurs when a threat actor is able to obtain explicit images or videos of a person and then use the obtained material to coerce the person into providing more material or into paying money. Historically, a significant amount of sextortion was targeted at teenage girls, with the predator seeking to obtain more sexual content. However, recent trends reported by the National Center for Missing and Exploited Children indicate that 79% of sextortion attempts are now ransom demands. Boys between the ages of 14 and 17 are often targeted for financial extortion by these criminals.⁹

Prosecution

On the flip side of becoming a crime victim, personal information could also be used to implicate a person in a crime, perhaps falsely. In the previous section, we already saw how personal information derived from OSINT can be used to identify a criminal. However, this same kind of information can also be used to sweep up otherwise innocent people into a net of suspicion. Although one appellate court in the U.S. has ruled it unconstitutional, a geofence warrant is a type of search warrant that compels a company that has user location data to provide information on all users within a specified geographic area in a given timeframe to law enforcement. This type of warrant has been used to collect geolocation data from Google, which stores user location information by default for Android users.¹⁰

But what if you aren’t a criminal and therefore have “nothing to hide”? Well, first of all, there is a good chance that you are a criminal in some technical fashion. It turns out the federal government has lost track of how many federal crimes there are, although it is believed to be somewhere north of 10,000.¹¹ It isn’t really possible for any person to claim not to be a criminal when the government can’t even tell us what is or isn’t a crime. Second, you could be falsely accused and convicted based strictly upon circumstantial or otherwise misleading evidence. Government-funded research on cases where DNA is available suggests a wrongful conviction rate of around 11.6%.¹²

Employment

As of 2018, roughly 70% of employers checked the social media profiles of potential job applicants, and over 50% of employers rejected an applicant based on information found in social media.¹³ Employers can use this type of open-source search to check for questionable posts (particularly those that advocate for discrimination), explicit content, illegal activity, and violence, among other traits.¹⁴ Remember that public social media posts can be archived on other sites and thereby show up with some simple searching. For this reason, it is extremely important to limit both what you post on social media and what your friends post about you. As a practical matter, the latter task is effectively impossible if you have more than a handful of friends, as is typically the case on social media.

Ironically, some employers may view a complete lack of social media presence as a negative, especially if there is evidence that you have recently erased past social media accounts and might therefore be trying to hide something.¹⁵ Remember that there are sites and services online that archive information, including social media posts. For this reason, it is best to manage your online presence carefully in the period of time leading up to your career position searches. Keep social media profiles professional, and favor career-oriented social media (such as LinkedIn) over “regular” social media platforms. It may also be wise to develop and maintain a professional website for marketing purposes.

Also remember that social media is not the only source of open-source intelligence (OSINT) that an employer can utilize during the screening process. Checks of criminal backgrounds and public records are common. Also be aware of forum posts, emails that could be leaked, and other information that could function as an indicator in your operations security model.

Insurance

One surprising place where collected consumer data can have consequences is when applying for insurance. Life insurance companies, in particular, are known to utilize all available data when determining the potential risk of an applicant. If you choose to have a consumer DNA test performed, be aware that in most states, a life insurance company can deny coverage if the test reveals that you may be genetically predisposed to a health condition.¹⁶ In a Consumer Reports study, all the major consumer DNA testing companies were found both to collect more data than necessary and to share data broadly for commercial purposes.¹⁷ One of the major DNA testing companies was also facing bankruptcy in early 2025, creating concern about who might buy the data if the company goes through reorganization or liquidation.¹⁸

Given the nature of the insurance industry, it doesn’t require too much imagination to surmise that they will use any and all available consumer data when making underwriting decisions. Your choices of phone apps, fitness trackers, social media, and other digital products and services might have some future bearing on your ability to obtain life, health, or other insurance.

Artificial Intelligence

Finally, we have one last emerging consequence in early 2025, which is Artificial Intelligence (AI). AI algorithms are already in development (and potentially in operation) in applications such as crime prediction,¹⁹ credit risk evaluation,²⁰ and insurance underwriting.²¹ At the current rapid pace of AI product development, it is likely to find its way into other applications as time progresses.

From a digital privacy perspective, AI represents both an existential threat and a significant future unknown. Companies are racing to push AI “features” into products, where the product is obviously designed to collect more data to train the AI algorithms. Microsoft’s Windows Recall addition to Windows 11 is an excellent example of this phenomenon.²² Until the risks of AI are fully understood, and significant regulations and safeguards are in place to contain its effects, consumers will need to be extremely wary of the products they buy and the services they use. Unfortunately, most consumers are not well-informed and will reflexively jump to the latest “shiny” offering they find available. Potentially disastrous effects may be observed in the future.

Notes and References