Privacy Glossary

Also: de-identification · pseudonymization · re-identification

Anonymisation is the process of altering data so that individuals can no longer be identified from it, either directly or by combining it with other available information — as distinct from pseudonymisation, which only replaces identifiers with reversible tokens.

Also: device fingerprinting · canvas fingerprinting

Browser fingerprinting is a tracking technique that identifies a user by combining observable characteristics of their device and browser — screen resolution, installed fonts, graphics rendering behaviour, time zone — into a signature distinctive enough to recognise across sites.

Also: California Consumer Privacy Act · CPRA · California privacy law

The CCPA, as amended by the CPRA, is California's consumer privacy law, granting residents rights to know what personal information businesses collect about them, to delete it, to correct it, and to opt out of its sale or sharing.

Also: cookie banner · CMP · consent banner

Consent management is the process of obtaining, recording, and honouring users' choices about the processing of their personal data, most visibly through the cookie and tracking consent banners required by privacy law.

Also: information broker · people search site

A data broker is a company that collects personal information from public records, commercial transactions, apps, and online activity, then aggregates and sells it to other organisations — typically without any direct relationship with the individuals concerned.

Also: privacy by design · collection limitation

Data minimisation is the principle that an organisation should collect and retain only the personal data actually necessary for a stated purpose, and no more, for no longer than needed.

Also: DPIA · privacy impact assessment · PIA

A data protection impact assessment (DPIA) is a structured evaluation of the privacy risks a proposed processing activity poses to individuals, together with the measures planned to mitigate them.

Also: DSAR · subject access request · privacy rights

Data subject rights are the legal entitlements individuals hold over their personal data, typically including the rights to access, correct, delete, port, and object to the processing of information held about them.

Also: DP · privacy budget · epsilon

Differential privacy is a mathematical framework that adds carefully calibrated statistical noise to data or query results, providing a provable guarantee that the presence or absence of any single individual has negligible effect on the output.

Also: data at rest encryption · disk encryption

Encryption at rest is the encryption of stored data — on disks, in databases, or in backups — so that physical access to the storage medium does not yield readable data.

Also: E2EE · E2E encryption

End-to-end encryption (E2EE) is a system in which messages are encrypted on the sender's device and decrypted only on the recipient's, so that no intermediary — including the service provider — can read the content in transit or at rest on its servers.

Also: federated training · on-device training

Federated learning is a technique for training a shared model across many devices without centralising the training data: each device computes updates locally, and only those model updates — not the underlying data — are sent to a server for aggregation.

Also: perfect forward secrecy · PFS

Forward secrecy is a property of encryption protocols ensuring that if a long-term private key is later compromised, past recorded sessions still cannot be decrypted, because each session used ephemeral keys that were discarded afterwards.

Also: General Data Protection Regulation · EU data protection

The GDPR (General Data Protection Regulation) is the European Union's data protection law, which governs how personal data of people in the EU may be collected and processed, and grants individuals rights over their data regardless of where the processing organisation is based.

Also: communications metadata · traffic analysis

Metadata is the information surrounding a communication rather than its content — who contacted whom, when, for how long, from where, and how frequently — which remains visible even when the content itself is encrypted.

Also: local processing · client-side processing

On-device processing means performing computation locally on a user's own hardware rather than transmitting data to a remote server, so that the raw input never leaves the device.

Also: PQC · quantum-resistant cryptography

Post-quantum cryptography refers to cryptographic algorithms designed to remain secure against attacks by quantum computers, which would break the public-key algorithms such as RSA and elliptic-curve cryptography that currently secure most internet traffic.

Also: right to be forgotten · RTBF · data deletion

The right to erasure, commonly called the right to be forgotten, allows individuals to request deletion of their personal data in defined circumstances, such as when it is no longer necessary for the purpose it was collected for or consent has been withdrawn.

Also: mass surveillance · surveillance capitalism · commercial spyware

Surveillance in the privacy context refers to the systematic monitoring of individuals' communications, movements, or behaviour, whether conducted by states for security purposes or by companies for commercial ones.

Also: tracking cookie · cross-site cookie

A third-party cookie is a cookie set by a domain other than the one shown in the address bar, historically the primary mechanism allowing advertising networks to track individual users across unrelated websites.

Also: zero knowledge · client-side encryption

A zero-knowledge architecture is one in which a service provider stores user data but holds no ability to decrypt it, because encryption and key management happen entirely on the user's device.