Glossary

The vocabulary of data protection

Each term is explained from an official page, cited below. These explanations are for information only. They don't replace legal advice.

Caller ID spoofing: Faking the name and number that show up on your phone. The FTC warns that caller ID is easy to fake, so a familiar name or a local number does not confirm who is really calling.; Source : FTC: Robocalls
CAN-SPAM Act: A federal law that sets the rules for commercial email and establishes requirements for commercial messages, according to the FTC. It applies to email that promotes a product or service.; Source : FTC: CAN-SPAM Act compliance guide for business
CCPA (California Consumer Privacy Act): The California Consumer Privacy Act of 2018 gives consumers more control over the personal information that businesses collect about them, according to the California Attorney General.; Source : California Attorney General: California Consumer Privacy Act
CPRA (California Privacy Rights Act): Proposition 24, known as the CPRA, is a California ballot measure that amended the CCPA and added new privacy protections, according to the California Attorney General.; Source : California Attorney General: California Consumer Privacy Act
Credential stuffing: The use of credentials, such as usernames and passwords, obtained from a consumer's breached account to gain access to the consumer's other accounts.; Source : FTC: press release on Ring (May 2023)
Credit freeze: When a credit freeze is in place, nobody can open a new credit account in your name. According to the FTC, it is free and lasts until you lift it.; Source : FTC: Credit Freezes and Fraud Alerts
Credit freeze vs. fraud alert: A freeze stops anyone from opening new credit in your name until you lift it. A fraud alert asks businesses to verify your identity but, unlike a freeze, does not prevent them from seeing your credit report.; Source : FTC: What to Know About Credit Freezes and Fraud Alerts
Credit report: A summary of your personal credit history. It includes identifying details such as your address and date of birth, plus how you handle your bills and debts. You can get free reports through AnnualCreditReport.com.; Source : FTC: Free Credit Reports
Dark web: Places on the internet not indexed by traditional search engines. The FTC notes that not every site there is criminal, but sites that illegally sell consumer data tend to gather there.; Source : FTC: The dark web: What your business needs to know
Data breach: An event in which data becomes accessible to people who should not have access to it.; Source : CISA: Project Upskill Glossary
Data broker: Data brokers are companies that collect information about people and sell or share it with others.; Source : FTC: What To Know About People Search Sites That Sell Your Information
Data broker registry (California): A public table published on the California Privacy Protection Agency's website. It shows the information each registered data broker provided during the registration process.; Source : California Privacy Protection Agency: Data Broker Registry
Fraud alert: A fraud alert makes lenders verify your identity before they grant new credit in your name. According to the FTC, an initial alert lasts one year and an extended alert lasts seven years. Both are free.; Source : FTC: What to Know About Credit Freezes and Fraud Alerts
Global Privacy Control (GPC): A browser-level signal that works like a stop-selling-or-sharing-my-data switch. The California Attorney General says businesses must treat it as a valid request to stop the sale or sharing of personal information.; Source : California Attorney General: Global Privacy Control
Identity Protection PIN (IRS IP PIN): A six-digit number from the IRS that prevents someone else from filing a tax return using your Social Security number or ITIN.; Source : IRS: Get an Identity Protection PIN
Identity theft: Identity theft is when someone uses your personal or financial information without your permission.; Source : FTC: What To Know About Identity Theft
Imposter scam (government impersonation): A scam in which someone pretends to be from a government agency such as the FTC, the Social Security Administration, or the IRS, according to the FTC. The FTC's page describes callers who demand payment or personal information.; Source : FTC: How to avoid a government impersonation scam
Multi-factor authentication (MFA): A layered approach to securing your online accounts. You confirm your identity with two or more methods, such as a password plus a phone confirmation or a fingerprint.; Source : CISA: Multifactor Authentication
National Do Not Call Registry: A free list of phone numbers that tells registered telemarketers what numbers not to call. The FTC says it does not block calls and will not stop calls from scammers making illegal calls.; Source : FTC: National Do Not Call Registry FAQs
Opt out (people-search sites): A request to a people-search site to stop selling your information. The FTC notes that it might not fix every privacy concern: details can still appear in relatives' reports, and information can reappear if public records change.; Source : FTC: What To Know About People Search Sites That Sell Your Information
Passkey: A newer way to prove your identity online. A private key is stored on a device you already carry. Unlike passwords, passkeys can't be easily stolen through phishing and don't require memorization.; Source : NIST: How Do I Create a Good Password?
Password manager: An app that makes creating and using passwords easier by generating and storing strong passwords. NIST says the manager itself still requires a login, so choose one that supports multi-factor authentication.; Source : NIST: How Do I Create a Good Password?
People-search site: A type of data broker. These sites collect personal information from a variety of sources, compile it into reports, and offer the reports for purchase. They are also called people finder sites.; Source : FTC: What To Know About People Search Sites That Sell Your Information
Personally identifiable information (PII): Information that can be used to distinguish or trace an individual's identity, either on its own or when combined with other linked or linkable information.; Source : NIST CSRC Glossary: Personally Identifiable Information
Phishing: Scammers use email or text messages to trick you into giving them your personal and financial information. These messages often tell a story to get you to click a link or open an attachment.; Source : FTC: How To Recognize and Avoid Phishing Scams
Ransomware: Per CISA, ransomware is an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable.; Source : CISA: Ransomware 101
Right to delete: Under the CCPA, you can ask a business to delete personal information it collected from you. The California Attorney General lists this among your core privacy rights.; Source : California Attorney General: California Consumer Privacy Act
Right to know: Under the CCPA, you can ask a business to disclose the categories or specific pieces of personal information it has collected about you, according to the California Attorney General.; Source : California Attorney General: California Consumer Privacy Act
Right to opt out of sale or sharing: Under the CCPA, you may ask a business to stop selling or sharing your personal information. The California Attorney General lists this among your privacy rights.; Source : California Attorney General: California Consumer Privacy Act
Robocall: According to the FTC, if you answer the phone and hear a recorded message instead of a live person, it is a robocall.; Source : FTC: Robocalls
Sensitive personal information: In California's privacy law, sensitive personal information is a specific subset of personal information that includes certain government identifiers. Californians have the right to limit its use and disclosure, according to the California Attorney General.; Source : California Attorney General: California Consumer Privacy Act
Smishing: A form of social engineering that exploits SMS, or text, messages.; Source : CISA: Avoiding Social Engineering and Phishing Attacks
Vishing: A social engineering approach that uses voice communication, such as a phone call, to get information from you.; Source : CISA: Avoiding Social Engineering and Phishing Attacks