Question 1

What is PII?

Accepted Answer

PII is any information that can identify a specific person, either on its own or when combined with other data. Direct identifiers like a name, email address, phone number, or Social Security number are obvious PII. But so are indirect identifiers — an IP address, a device ID, or a ZIP code plus a birth date — because they can be combined to single someone out. There is no single legal definition: US regulators, state laws, and the GDPR each draw the line slightly differently.

Question 2

What is PHI?

Accepted Answer

PHI is individually identifiable health information created or held by a HIPAA covered entity or its business associate. It includes diagnoses, treatment, payment records, and the 18 identifiers HIPAA lists — names, dates, contact details, device identifiers and more. The crucial limit is who holds it: the same information in a consumer fitness app usually is not PHI, because that app is generally not a covered entity.

Question 3

What is a DSAR?

Accepted Answer

A DSAR — data subject access request — is a formal request from an individual asking an organization to disclose the personal data it holds about them, and often to correct, delete, or stop sharing it. Under the GDPR the response deadline is one month; under California's CCPA/CPRA it is 45 days, extendable once with notice. There is no required format: an email that makes the request clear is usually enough to start the clock.

Question 4

What is the TCPA?

Accepted Answer

The TCPA is a US federal law restricting telemarketing calls, autodialed calls, prerecorded messages and text messages to consumers. Its teeth come from statutory damages: $500 per violation, trebled to $1,500 for wilful violations, with a private right of action. Because damages are per message, a single campaign to a modest list can produce enormous exposure — which is why proof of consent, not the mere assertion of it, is the operative issue.

Question 5

What is prior express written consent?

Accepted Answer

Prior express written consent is the TCPA standard for marketing calls and texts sent with an autodialer or prerecorded voice. It requires a written agreement, signed by the consumer, that clearly authorizes marketing messages from a specific seller, discloses that consent is not a condition of purchase, and identifies the phone number to be contacted. An electronic signature counts. The common failure is not the signature but the disclosure: vague wording, or wording that has since changed and was never preserved.

Question 6

How do you prove consent was given?

Accepted Answer

A defensible consent record captures four things a typical record omits: the verbatim disclosure text as displayed, the identity of every party the data was going to, the site's terms and privacy policy exactly as they read that day, and a timestamp bound to all of it so nothing can be changed afterwards without detection. A database row saying consent equals true, next to a page that has since been redesigned, proves a submission — not an agreement.

Question 7

What is the difference between consent and notice?

Accepted Answer

Notice is informing someone what will happen to their data. Consent is their affirmative agreement to it. A privacy policy provides notice; a ticked box that a person chose to tick provides consent. The distinction matters because most legal standards that carry real penalties require consent, while most organizations have only implemented notice — a published policy, and an assumption that continued use implies agreement.

Question 8

What data privacy rights do I have in the US?

Accepted Answer

The US has no single federal privacy law, so your rights depend mainly on your state. Roughly twenty states now have comprehensive privacy laws giving residents the right to know what data a company holds, to correct it, to delete it, to obtain a copy, and to opt out of sale or targeted advertising. If you live in a state without one, you still have sector-specific protections — health, financial, credit, children's data — and the practical option of asking anyway, since many companies apply one process nationwide.

Question 9

Who does HIPAA apply to?

Accepted Answer

HIPAA applies to covered entities — health plans, health care clearinghouses, and health care providers that transmit health information electronically — and to business associates who handle protected health information on their behalf. It does not apply to most consumer health apps, wearables, life insurers, or employers acting as employers. Those organizations are frequently still regulated, but by state privacy laws, the FTC Act, or the FTC's Health Breach Notification Rule rather than by HIPAA.

Question 10

How do I stop companies from selling my data?

Accepted Answer

In states with comprehensive privacy laws you can require companies to stop selling or sharing your personal data, usually through a Do Not Sell or Share link in their footer. You can also enable Global Privacy Control in your browser, which sends an automatic opt-out signal that California and several other states legally require businesses to honor. For data already held by brokers, each broker must be contacted separately — California's DELETE Act is building a single mechanism, but it is not fully operational everywhere yet.

Question 11

What is data minimization?

Accepted Answer

Data minimization is the principle that you should collect only the personal data you actually need, keep it only as long as you need it, and use it only for the purpose you collected it for. It appears in the GDPR as an explicit obligation and in most US state privacy laws as a reasonable-necessity standard. Its practical value is simple: data you never collected cannot be breached, cannot be requested in a DSAR, and cannot be sold by a vendor you forgot you used.

The vocabulary everyone uses and nobody defines.

Terms

Regulations

Practices

Why we publish this