Digital Platforms, Marketing and Surveillance Technologies

Introduction

Digital services depend on the continuous collection and analysis of information. A social-media platform records interactions; a mobile application requests device permissions; an online advertiser observes browsing behaviour; an employer monitors access logs; and an internet-connected device reports location, usage or environmental data. These practices can improve security and personalisation, but they also create significant privacy risks.

Privacy law therefore regulates more than the final use of personal information. It addresses the entire lifecycle: collection, notice, consent, access, sharing, retention, security, profiling, decision-making and deletion. A technology may be lawful in one context and unlawful in another because the purpose, expectation, sensitivity of the data and power relationship differ.

This chapter uses widely recognised principles found in instruments such as the EU General Data Protection Regulation (GDPR), the ePrivacy framework, the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act (CCPA/CPRA), and comparable national laws. Requirements differ by jurisdiction. Organisations must identify the law that applies, determine whether sector-specific rules exist, and obtain current professional advice before deployment.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain how cookies, pixels, SDKs and other tracking technologies operate.
2. Distinguish necessary, preference, analytics and advertising technologies.
3. Apply privacy principles to online advertising, social media and mobile applications.
4. Identify special risks arising from biometrics, location data, IoT and workplace monitoring.
5. Evaluate lawful bases, consent, transparency, rights and retention requirements.
6. Design a practical privacy governance response for a digital service.

1. A Framework for Analysing Digital Surveillance

A useful analysis begins with six questions:

1. What is collected? Identify identifiers, device data, behavioural events, images, voice, location and inferred attributes.
2. Who determines the purpose and means? This helps identify the controller or business responsible for the processing and the processor or service provider acting on instructions.
3. Why is it collected? State a specific, legitimate and understandable purpose rather than a vague objective such as “improving services”.
4. What is the legal basis? Depending on the jurisdiction, this may include consent, contract necessity, legal obligation, vital interests, public task or legitimate interests.
5. What is the impact? Consider intrusion, discrimination, chilling effects, security harm and effects on children or vulnerable persons.
6. What safeguards apply? Consider minimisation, access controls, retention limits, encryption, transparency, rights mechanisms and independent review.

The central principle is proportionality: the privacy intrusion should be justified by a sufficiently important purpose, be reasonably necessary to achieve it, and not impose excessive harm. A technically possible practice is not automatically a legally or ethically acceptable practice.

Important terminology

• Personal data: Information relating to an identified or identifiable person. An online identifier can qualify even if it does not contain a name.
• Processing: Any operation performed on personal data, including collection, storage, analysis, disclosure or deletion.
• Controller: The organisation determining purposes and essential means of processing.
• Processor: An organisation processing data on behalf of a controller.
• Pseudonymisation: Separating direct identifiers while retaining a controlled ability to link data to a person.
• Anonymisation: Irreversibly preventing identification, taking account of reasonably available means.
• Profiling: Automated processing used to evaluate or predict personal characteristics or behaviour.
• Special-category or sensitive data: Categories receiving enhanced protection, such as health, biometric data used for unique identification, political opinions or religious beliefs under some regimes.
• Dark pattern: A user-interface design that manipulates or unfairly steers a person into a privacy decision.

2. Cookies and Online Tracking

A cookie is a small data item stored by a browser. A first-party cookie is set by the website the user is visiting. A third-party cookie is set by a different domain, often through advertising, analytics or embedded content. Cookies may maintain a login session, remember language preferences, measure traffic or construct an advertising profile.

Other tracking mechanisms include:

• Pixels or web beacons: Invisible resources that report when a page or message is opened.
• Local storage and software development kits (SDKs): Browser or application mechanisms that retain identifiers and send events to providers.
• Advertising identifiers: Resettable identifiers used by mobile operating systems or advertising ecosystems.
• Fingerprinting: Combining device characteristics, such as screen settings, browser configuration and installed features, to distinguish a device without relying on a conventional cookie.
• Server-to-server tracking: Data is transmitted directly between systems, which may make it less visible to browser controls but does not remove legal obligations.

Categories and controls

In many jurisdictions, storing or accessing non-essential information on a user’s device requires consent, while data-protection law separately governs subsequent processing. Consent should be informed, specific, freely given, unambiguous and as easy to withdraw as to provide. A banner that preselects advertising, hides refusal, bundles unrelated purposes or treats continued browsing as consent may fail these requirements.

A compliant consent-management design should:

• present purposes separately and in plain language;
• avoid loading non-essential tags before consent where the law requires prior consent;
• provide an equally prominent “reject” route;
• record the time, interface, purposes and version of the notice;
• honour withdrawal across relevant systems;
• avoid passing identifiers to vendors before permission; and
• periodically review whether vendors still need access.

Consent is not always the correct basis. For example, a security cookie may be necessary for a requested service, while targeted advertising generally cannot be justified merely by claiming that it supports a free service. Legitimate-interest assessments, where available, require an identified interest, necessity analysis and balancing against the person’s rights and expectations.

3. Online Advertising and Social Media

Online advertising commonly involves an ecosystem of publishers, demand-side platforms, supply-side platforms, data brokers, analytics firms and identity providers. A single advertising request may disclose a device identifier, page context, approximate location, inferred interests and audience segment to several organisations.

Key risks include:

• lack of meaningful knowledge about downstream recipients;
• excessive retention and combination of data sets;
• targeting based on sensitive or inferred characteristics;
• discrimination in housing, employment, credit or insurance advertising;
• manipulation of children or persons in vulnerable circumstances; and
• difficulty exercising access, deletion or opt-out rights across the ecosystem.

A privacy-responsible advertising programme should use contextual advertising where possible. Contextual advertising selects an advert based on the content of the page rather than an enduring personal profile. If behavioural advertising is used, the organisation should document its purposes, lawful basis, consent signals, vendor responsibilities, retention periods, suppression lists, audit rights and mechanisms for objections or opt-outs.

Social-media platforms create additional complexity because users publish information about themselves and others. Public availability does not eliminate privacy obligations. A photograph may reveal faces, location, relationships or health information. Platforms should provide audience controls, reporting tools, deletion processes, protection against unauthorised scraping and safeguards for minors. Organisations embedding social plug-ins should understand whether merely displaying the plug-in transfers data to the provider.

Automated recommendation systems may infer interests, emotional states or political tendencies. Inferences can be personal data even when they were not directly supplied by the person. Explainability does not require revealing every proprietary algorithm, but people should receive intelligible information about the logic, consequences and available challenges where decisions significantly affect them.

4. Mobile Applications

Mobile applications are especially data-intensive because they can access sensors, contacts, photographs, microphones, Bluetooth, advertising identifiers and precise location. Privacy protection must be integrated into the application lifecycle rather than added after development.

Privacy-by-design process

1. Map each data flow from permission request to storage, analytics, vendor and deletion.
2. Define the minimum data needed for each feature.
3. Separate optional functionality from the core service.
4. Request permission at the point of need, using a clear explanation.
5. Provide settings to review, change and revoke permissions.
6. Encrypt data in transit and at rest where appropriate.
7. Test SDK behaviour, including hidden collection and transfers.
8. Maintain a software bill of materials and vendor register.
9. Provide accessible notices and rights mechanisms.
10. Reassess the design after updates, acquisitions or new uses.

An application should not request continuous precise location merely because a mapping feature occasionally needs location while open. A less intrusive alternative may be approximate location, one-time location or user-entered information. Children’s applications require particularly careful age assurance, default settings and avoidance of behavioural exploitation.

5. Biometrics and Facial Recognition

Biometric data is information concerning physical, physiological or behavioural characteristics, such as fingerprints, facial templates, iris patterns, voice characteristics or gait. A photograph is not necessarily biometric data, but processing it through a technical system to uniquely identify a person may trigger enhanced rules.

Biometric systems typically involve enrolment, feature extraction, template storage and matching. A system may perform verification—answering “is this person who they claim to be?”—or identification—answering “which person in a group is this?” Identification is usually more intrusive because it searches a population.

Risks include false matches, unequal error rates, function creep, irreversible compromise and covert identification. Unlike a password, a face or fingerprint cannot readily be replaced after disclosure. Organisations should therefore consider whether a non-biometric method, such as a physical token or one-time code, can achieve the purpose.

Before deployment, conduct a data-protection impact assessment where required; establish a clear legal basis and any special condition; test accuracy across relevant demographic groups; provide human review; set strict retention limits; prohibit secondary uses; secure templates; and disclose where biometric monitoring occurs. Public-space facial recognition deserves especially demanding necessity and proportionality analysis.

6. Workplace Monitoring

Employers may monitor systems for security, compliance, productivity, safety or safeguarding. However, the employment relationship contains a power imbalance, making consent an unreliable basis in many circumstances. Monitoring should be necessary, transparent, limited and proportionate.

Examples include email inspection, keystroke logging, screen capture, access-card records, CCTV, vehicle telematics, call recording and productivity dashboards. Continuous observation can create stress and a chilling effect. A target based on number of keystrokes may measure activity rather than meaningful work and may unfairly penalise disabled, remote or collaborative workers.

A responsible employer should:

• define the business purpose and alternatives considered;
• consult workers and, where applicable, representatives;
• give advance notice of categories, purposes, recipients and retention;
• avoid monitoring private communications or off-duty activity;
• restrict access to authorised personnel;
• prevent data being reused for unrelated performance decisions;
• review automated alerts for bias and error; and
• provide a channel to challenge inaccurate or unfair conclusions.

High-risk monitoring may require a formal impact assessment and consultation with regulators or worker representatives under local law. Security monitoring should not become a general licence for employee surveillance.

7. Location Data

Location data may be obtained from GPS, Wi-Fi, Bluetooth beacons, mobile networks, vehicle systems or user-submitted addresses. Precise location can reveal home, workplace, medical visits, religious attendance, political activity and social relationships. Even a sequence of apparently harmless points may disclose a highly sensitive pattern.

Organisations should distinguish between precise and approximate location, active and background collection, and direct use and onward sharing. Good controls include reducing precision, collecting only during a feature session, processing on the device, aggregating journeys, deleting raw coordinates promptly and preventing re-identification from supposedly anonymous movement data.

A location permission should explain who receives the data, how long it is retained and what functionality is lost if permission is refused. A user should not be forced to share continuous background location when an occasional location check is sufficient.

8. Internet of Things and Connected Environments

IoT devices—wearables, smart speakers, vehicles, cameras, appliances and industrial sensors—collect data in homes, workplaces and public spaces. They may be operated by one person but record visitors, family members, employees or passers-by who have not directly agreed to the processing.

Privacy risks are amplified by:

• insecure default passwords and outdated firmware;
• long product lifecycles and weak deletion processes;
• opaque supply chains and cloud dependencies;
• continuous audio, video or environmental monitoring;
• combining sensor data with identity, health or household information; and
• difficulty giving notice in physical environments.

Manufacturers and operators should use secure defaults, unique credentials, update mechanisms, vulnerability disclosure procedures, data minimisation, local processing where feasible, clear indicators of recording, guest controls and end-of-life deletion. A smart doorbell, for example, should be configured to minimise capture of neighbouring property and public walkways.

9. Direct Marketing and Individual Rights

Direct marketing includes email, SMS, telephone calls, postal communications, push notifications and targeted in-app messages. Rules often differ according to channel, existing customer relationships, business-to-business status, jurisdiction and whether the message is commercial or service-related.

An organisation should maintain a lawful source for contact details, document permission or another applicable basis, identify itself, provide an easy unsubscribe mechanism and respect suppression lists. Opt-out requests should be propagated promptly to relevant systems and vendors. Buying a marketing list does not transfer proof of valid consent or remove responsibility for compliance.

Data-protection rights may include access, correction, deletion, restriction, portability, objection to direct marketing and safeguards concerning solely automated decisions. An objection to direct marketing generally requires the organisation to stop that marketing, subject to applicable exceptions. Requests should be verified proportionately, logged, answered within the relevant deadline and escalated when identity, security or third-party rights are involved.

10. Impact Assessments and Governance

A Data Protection Impact Assessment (DPIA) is a structured method for identifying and reducing risks before high-risk processing begins. It should describe the processing, purpose, necessity, proportionality, risks to individuals, measures, residual risk and consultation. It is not merely a compliance form; it should influence architecture and procurement.

A practical governance model assigns:

• a product owner responsible for purpose and outcomes;
• privacy or legal specialists responsible for interpretation;
• security teams responsible for technical controls;
• procurement responsible for vendor diligence;
• records managers responsible for retention and deletion; and
• senior management responsible for accepting or rejecting residual risk.

Contracts with processors should address documented instructions, confidentiality, security, sub-processors, assistance with rights, breach support, deletion or return, audits and international transfers. A vendor’s certification is useful evidence but does not transfer the controller’s legal responsibility.

Illustrative Case Study: CityMove Mobility Application

Background

CityMove operates a smartphone application for bicycle and scooter hire. The application collects account details, payment information, trip routes, device identifiers and location. It also proposes installing an advertising SDK that records location and app events for “audience optimisation”.

Problem

The business wants continuous background location to improve fleet planning and behavioural advertising. The privacy team is concerned that riders may not understand the advertising transfer, that route histories can reveal homes and clinics, and that the SDK may collect data even when a trip is not active.

Analysis

Fleet planning requires information about vehicle use, but continuous personal tracking is not necessarily required. Aggregated station demand or short-lived trip telemetry may be sufficient. Advertising is a separate purpose from providing transport. Combining route histories with advertising identifiers creates a risk of sensitive inference. The app’s permission request, if presented during account creation as a condition of service, may not provide freely given choice for optional advertising.

Approach and solution

CityMove conducts a DPIA and tests alternatives. It adopts the following design:

• precise location is collected only during an active rental, except where a clearly explained safety feature requires otherwise;
• fleet data is aggregated and separated from account identity after operational use;
• advertising SDKs are excluded from trip and background processes;
• optional advertising is disabled by default until valid consent is obtained where required;
• the privacy notice describes recipients, purposes and retention in layers;
• riders can withdraw advertising permission without losing transport access;
• raw route histories have a short operational retention period, with longer retention only in aggregated form;
• role-based access, encryption and vendor audits are implemented; and
• riders can access and delete account-associated data subject to legal exceptions.

Outcome

The company retains the operational benefits of location data while reducing unnecessary surveillance and separating service delivery from advertising. The design also makes the app easier to explain and defend because each data element has a documented purpose.

Learning points

The case demonstrates that privacy compliance is not achieved by adding a long notice after development. Purpose separation, minimisation, technical architecture and user choice must be designed together. It also shows why anonymisation claims require care: detailed route data may remain identifiable even after names are removed.

Challenges and Contemporary Developments

The advertising industry is moving from third-party cookies toward first-party data, browser APIs, contextual advertising and identity alternatives. These changes may reduce some forms of cross-site tracking but can also encourage new forms of fingerprinting, server-side matching or concentration of power in large platforms. A new technical mechanism must therefore be assessed by its function and impact, not by its marketing label.

Generative AI and machine-learning systems increase the importance of data provenance, inferred data and model governance. Training data may contain personal information; outputs may reproduce or infer personal characteristics; and automated targeting can amplify discrimination. Organisations should document data sources, evaluate necessity, test disparate impacts, restrict sensitive inference and provide human escalation where decisions have significant effects.

Privacy-enhancing technologies can reduce exposure. Examples include on-device processing, aggregation, access-controlled pseudonyms, secure deletion, federated learning and differential privacy. Differential privacy is a technical approach that adds controlled statistical noise so that the presence or absence of one person has limited influence on an output. It is not a universal solution: implementation choices affect utility, and repeated releases can accumulate privacy risk.

Best-Practice Checklist

Before launching a platform, campaign or monitoring system, ask:

1. Is the purpose specific, necessary and documented?
2. What is the least intrusive data and retention period?
3. Is the legal basis appropriate to the context and power relationship?
4. Are consent and refusal equally clear where consent is required?
5. Are children, workers, visitors and non-users affected?
6. Are inferences and sensitive categories being created?
7. Have vendors, SDKs, transfers and sub-processors been reviewed?
8. Are security, deletion, access and correction operational rather than merely promised?
9. Has a DPIA or equivalent assessment been completed for high-risk processing?
10. Can the organisation explain the system to an ordinary user and defend it to a regulator?

Chapter Summary

Digital platforms and surveillance technologies process data through cookies, pixels, SDKs, applications, social networks, sensors and automated systems. Privacy compliance requires analysis of purpose, lawful basis, necessity, proportionality, transparency, minimisation, security, retention and individual rights. Non-essential tracking commonly requires meaningful consent, while consent must not be manufactured through dark patterns or bundled choices. Advertising and social-media ecosystems create special risks through extensive sharing, profiling and inference.

Mobile applications should request only necessary permissions and control third-party SDKs. Biometrics require heightened caution because identifiers are difficult to replace and errors may be unequal. Workplace monitoring must account for power imbalance and avoid disproportionate surveillance. Location and IoT data can reveal intimate patterns even when individual data points appear ordinary. Direct marketing requires lawful contact practices, identification and effective opt-out mechanisms.

The most reliable approach is privacy by design: map data flows, separate purposes, minimise collection, assess impacts, govern vendors, secure systems and make rights effective. Technology changes rapidly, but these principles remain the foundation for responsible digital services.

Key Terms

Personal data: Information relating to an identified or identifiable person.

Processing: Any operation performed on personal data.

Controller: Entity determining the purposes and essential means of processing.

Processor: Entity processing data on behalf of a controller.

Cookie: Data stored by a browser or device for functions such as sessions or tracking.

Fingerprinting: Identifying or distinguishing a device through a combination of technical characteristics.

SDK: Software development kit that adds functions, often including analytics or advertising, to an application.

Profiling: Automated processing used to evaluate or predict characteristics or behaviour.

Consent: A voluntary, informed, specific and unambiguous privacy choice.

Dark pattern: Interface design that manipulates or unfairly steers a user’s decision.

Biometric data: Data concerning physical or behavioural characteristics used to identify or authenticate a person.

Verification: Biometric comparison asking whether a person matches a claimed identity.

Identification: Biometric search asking which person in a population is represented.

Location data: Information indicating the geographic position or movement of a device or person.

Internet of Things: Network of connected physical devices that collect, transmit or act on data.

Pseudonymisation: Separating identifiers while preserving controlled linkability.

Anonymisation: Processing intended to prevent identification irreversibly.

Data Protection Impact Assessment: Structured assessment of high-risk processing and safeguards.

Privacy by design: Integrating privacy safeguards into systems and processes from the outset.

Direct marketing: Promotional communication delivered to identified or contactable individuals.

Review Questions

Short Answer Questions

1. Distinguish between first-party and third-party cookies.
2. Why is continuous precise location often more intrusive than one-time approximate location?
3. What is the difference between biometric verification and identification?
4. State two risks associated with workplace monitoring.
5. What features should a valid marketing opt-out mechanism have?

Long Answer Questions

1. Explain how an organisation should design a compliant consent-management process for non-essential cookies.
2. Discuss the privacy risks of online advertising ecosystems and propose appropriate safeguards.
3. Explain why privacy-by-design is particularly important for mobile applications and IoT devices.
4. Analyse the proportionality issues raised by facial recognition in public spaces.
5. Describe the main stages and governance value of a Data Protection Impact Assessment.

Analytical / Application Questions

1. A retailer wants to combine loyalty-card purchases, precise location and social-media interests to target customers. Identify the principal privacy risks and design a lawful, less intrusive alternative.
2. An employer proposes continuous webcam monitoring and keystroke scoring for remote staff. Apply necessity, proportionality, transparency and fairness principles to evaluate the proposal.
3. A smart speaker records all household conversations and sends them to a cloud provider for product improvement. Identify the affected individuals, purposes, safeguards and questions that should be addressed before deployment.

Multiple Choice Questions with Answers

Question 1

Which tracking mechanism distinguishes a device by combining technical characteristics such as browser configuration and screen settings?

A. Fingerprinting

B. Tokenisation

C. Encryption

D. Data minimisation

Correct Answer: A. Fingerprinting

Question 2

Which practice best supports valid consent for non-essential advertising cookies?

A. Loading all cookies before displaying the banner

B. Providing an equally prominent refusal option

C. Treating silence as consent in every jurisdiction

D. Bundling advertising consent with essential security functions

Correct Answer: B. Providing an equally prominent refusal option

Question 3

Why is biometric data particularly sensitive?

A. It is always stored only on paper

B. It cannot be used for authentication

C. A compromised biometric characteristic is difficult to replace

D. It never produces inaccurate matches

Correct Answer: C. A compromised biometric characteristic is difficult to replace

Question 4

Which is generally the least intrusive location practice for a feature needed only during a rental trip?

A. Continuous background tracking forever

B. Collecting precise location only during the active trip

C. Selling all historical routes to advertisers

D. Recording the location of all nearby devices

Correct Answer: B. Collecting precise location only during the active trip

Question 5

What is a principal concern with workplace keystroke monitoring?

A. It always improves the accuracy of performance evaluation

B. It may measure activity rather than meaningful work

C. It eliminates the need for transparency

D. It cannot produce personal data

Correct Answer: B. It may measure activity rather than meaningful work

Question 6

In data-protection governance, a processor usually:

A. Determines all purposes independently

B. Processes personal data on behalf of a controller

C. Has no security responsibilities

D. Is always the individual using an application

Correct Answer: B. Processes personal data on behalf of a controller

Question 7

Which advertising approach generally avoids constructing an enduring personal profile?

A. Contextual advertising based on page content

B. Cross-device behavioural profiling

C. Selling detailed route histories

D. Combining health inferences with advertising identifiers

Correct Answer: A. Contextual advertising based on page content

Question 8

What is a key purpose of a Data Protection Impact Assessment?

A. To guarantee that a project can never be challenged

B. To identify and reduce risks before high-risk processing begins

C. To replace all technical security controls

D. To make consent unnecessary in every situation

Correct Answer: B. To identify and reduce risks before high-risk processing begins

Question 9

Which statement about public information is most accurate?

A. Publicly available information is never personal data

B. Public availability automatically authorises any secondary use

C. Public information may still be subject to privacy obligations

D. Public information cannot reveal sensitive inferences

Correct Answer: C. Public information may still be subject to privacy obligations

Question 10

Which measure is most consistent with privacy by design in an IoT product?

A. Using a universal default password

B. Collecting all sensor data indefinitely

C. Providing secure defaults and a clear deletion process

D. Hiding recording indicators from household visitors

Correct Answer: C. Providing secure defaults and a clear deletion process