Privacy Laws & Your Rights

The data-broker lesson mentioned that legal standing for opt-outs varies significantly by location. This lesson explains why, covering the actual privacy laws that give individuals concrete, enforceable rights over their own data — directly complementing Path 01's laws-and-ethics lesson, which focused on what's illegal to do rather than what rights you personally have.

:::

GDPR: the EU's General Data Protection Regulation

The GDPR, effective since 2018, is widely considered the most comprehensive privacy law in the world, applying to any organization processing the personal data of EU residents — regardless of where that organization itself is based. Its core individual rights include:

  • Right to access — the right to request a copy of exactly what personal data an organization holds about you
  • Right to erasure ("right to be forgotten") — the right to request deletion of your personal data, subject to certain exceptions (legal obligations, for instance)
  • Right to data portability — the right to receive your data in a usable, transferable format
  • Right to object — the right to opt out of certain uses of your data, including for advertising purposes

CCPA/CPRA: California's privacy law, and the US patchwork

Unlike the EU's single comprehensive law, the US has no single federal privacy law — instead, a growing patchwork of state-level laws, led by California's CCPA/CPRA, which grants California residents rights broadly similar to GDPR's: the right to know what data is collected, the right to delete it, and the right to opt out of its sale — directly relevant to the data-broker lesson's opt-out process, since CCPA gives California residents specific legal leverage many other US residents currently lack. Several other US states have since passed similar laws, though the specific rights and coverage vary state by state.

Why this matters even if you're not in the EU or California

Many organizations, facing the practical complexity of applying different privacy standards to different users, choose to extend GDPR-level or CCPA-level protections to all users globally rather than building separate systems per jurisdiction — meaning you may benefit from rights technically written for a different region's residents, even without formally qualifying for them. It's still worth checking a specific organization's actual privacy policy rather than assuming this is universal.

How to actually exercise these rights in practice

  1. Locate the organization's privacy policy — required by law to describe how to submit a data request in any jurisdiction with these protections
  2. Submit a formal request — typically a "Data Subject Access Request" (GDPR) or a "Do Not Sell/Share My Personal Information" request (CCPA), often through a dedicated form or email address the privacy policy specifies
  3. Know the response timeline — GDPR generally requires a response within 30 days; CCPA has its own specified timelines — an organization ignoring a legitimate request entirely is itself a violation worth escalating to the relevant regulator

:::challenge Evaluate a real scenario A US resident living in a state without its own specific privacy law submits a GDPR-style data deletion request to a large multinational company they've never directly interacted with, having only encountered the company's advertising through a third-party site.

HintDoes the person's location alone determine whether they have any right to make this request, or does the company's own policy choice matter too?
Show answerWhether this request succeeds depends on the specific company's privacy policy, not solely on the requester's jurisdiction — exactly the "extended protections" pattern this lesson described. Some large multinational companies, for the practical reasons this lesson explained, apply GDPR-equivalent rights to all users globally regardless of location, in which case this request would likely be honored despite the requester not being an EU resident. Other companies apply protections strictly by jurisdiction, in which case this specific requester might not have a legally enforceable right to insist on deletion, though many companies will still honor the request as a matter of goodwill or simplicity even without a strict legal obligation to do so. Checking the specific company's actual privacy policy, rather than assuming either outcome, is the only way to know for certain.

🧪 Hands-on lab — exercise a real right

Pick one online service you actively use, locate its privacy policy, and identify exactly how to submit a data access or deletion request under whichever privacy law applies to you (or that the company has chosen to extend globally). You don't need to actually submit the request — just confirm you could, and note how straightforward or difficult the process actually is.

  1. What's the key structural difference between how the EU and the US approach privacy law?
  2. Name two specific rights GDPR grants individuals.
  3. Why might someone outside the EU or California still benefit from GDPR- or CCPA-level protections in practice?

Key terms

  • GDPR (General Data Protection Regulation) — the EU's comprehensive privacy law, applying to any organization processing EU residents' data.
  • CCPA/CPRA — California's state-level privacy law, granting residents rights to know, delete, and opt out of the sale of their data.
  • Data Subject Access Request (DSAR) — a formal request under GDPR (or similar laws) for an organization to disclose what personal data it holds about you.

Recap

Privacy law gives individuals concrete, often legally enforceable rights over their own data — GDPR's comprehensive EU-wide protections and the growing US state-level patchwork led by California's CCPA both grant meaningful rights to access, delete, and opt out of the sale of personal information, directly strengthening the practical leverage behind the data-broker opt-out process from the previous lesson. Many organizations extend these protections globally for practical reasons, meaning it's worth checking a specific privacy policy rather than assuming your jurisdiction determines your rights either way.

References

Next up → Privacy Settings Audit