01 / 21

Ethical & Social Issues
Around Data Collection

Explore the privacy, consent, and societal impacts of collecting, storing, and analyzing personal data in our increasingly connected world.

AP Computer Science A

What Is Data Collection?

Data collection is the systematic process of gathering information from users, sensors, transactions, and public sources. Every time you browse the web, use an app, or swipe a card, data about your behavior is captured and stored.

Explicit
Data you knowingly provide: filling out forms, surveys, or creating accounts.
Implicit
Data gathered without direct input: cookies, location tracking, usage analytics.

Why Ethics in Data Matters

Data Collection Privacy Violations Algorithmic Bias Mass Surveillance Consent Issues

Data collection connects to four major ethical concerns: privacy violations, algorithmic bias, mass surveillance, and consent issues. As a programmer, every design decision can amplify or mitigate these risks.

Key Definitions You Need

PII
Personally Identifiable Information: any data that can identify a specific individual, such as name, SSN, email, or IP address.
Informed Consent
User explicitly agrees to data collection after being told what is collected, why, and how it will be used.
Data Aggregation
Combining data from multiple sources to create detailed profiles, often revealing more than any single source.

The Core Ethical Principle

Benefits Innovation Personalization Safety Harms Privacy Loss Discrimination Manipulation Balancing Utility vs. Privacy The Ethical Tradeoff

The Data Lifecycle

Collect Store Process Share Delete Consent? Security? Bias? Third parties? Retention? Ethical questions arise at every stage

Ethical concerns exist at every stage of the data lifecycle. From the moment data is collected through its eventual deletion, developers and organizations must consider their responsibilities at each step.

Two collaborators work on one shared model

Two collaborators adjust one blue articulated model while a second model stands apart.Two variables can provide access to one shared object. Copying a reference creates another access path; it does not duplicate the object.

A new container can share its elements

Two separate list containers point from corresponding slots to the same mutable Box object.Copying the list creates a separate container while copying its element references. Both lists can still reach the same mutable Box. String and Integer values are immutable, so those elements cannot be mutated through either list.

A data-sharing trail that survives clearing the local list

A cleared local screen sits beside records retained along a data-sharing trail.Clearing a local list affects that list’s defined scope. Copies retained by recipients or backups follow their own retention and deletion processes.

Local clearing and retained copies

A local clearAllData operation empties its own record while separate recipient and backup records remain.Suppose clearAllData() removes data in the local object. Recipient and backup copies remain separate objects or records and require their own deletion steps. Clearing fields and garbage collection do not by themselves securely erase every retained copy.

Privacy vs. Security

Privacy Security
Definition Right to control who sees your data Measures to protect data from threats
Focus Who has access and why Preventing unauthorized access
Example Opting out of ad tracking Encrypting stored passwords
Without it Data used without your knowledge Data stolen by attackers

How to Evaluate Data Practices

1
Identify what data is collected. List every piece of information the system gathers, including implicit data like location and browsing habits.
2
Ask: is consent informed? Does the user understand what is collected, why, and how it will be used? Or is consent buried in a 50-page terms-of-service?
3
Apply the minimization principle. Is the data collected the minimum necessary for the stated purpose? If not, it is over-collection.
4
Consider downstream harm. Could this data be used to discriminate, manipulate, or surveil? Who benefits and who is harmed?
5
Check retention and deletion. How long is data stored? Is there a clear policy for deletion when it is no longer needed?

Example: Social Media Data

User Social Platform Collects everything Location History Contacts List Browsing Habits Advertisers Targeted ad profiles

Example: Health App Data

A fitness tracking app collects heart rate, sleep patterns, exercise routes, and weight data. Consider the ethical implications:

✓ Benefit
Users gain health insights. Aggregate data can advance medical research and public health outcomes.
✕ Risk
Insurance companies could buy this data to deny coverage or raise premiums based on health indicators.

Example: Algorithmic Bias

Training Data Historical records Algorithm Learns patterns Decisions Biased outcomes Feedback loop amplifies bias Hiring Algorithm Trained on past hires: penalizes diverse applicants Loan Algorithm Uses zip code as proxy: denies based on neighborhood

Check who enters the records

Group A has population 80 and 16 recorded; group B has population 20 and 8 recorded. Capture rates are 20% and 40%, and observed shares are 16/24 and 8/24.Suppose group A contains 80 people and group B 20. Recording 16 from A and 8 from B gives capture rates of 20% and 40%; the recorded sample is two-thirds A and one-third B. Compare these denominators before explaining why representation differs.Open full diagram

Legal Frameworks & Regulations

GDPR
EU regulation requiring explicit consent, data portability, and the "right to be forgotten."
COPPA
US law protecting children under 13 from data collection without verifiable parental consent.
CCPA
California law giving residents the right to know, delete, and opt out of the sale of personal data.

Scenario: School Database

A school district builds a student database that stores grades, attendance, disciplinary records, health information, and family income levels. The district wants to share this data with a third-party analytics company to "improve educational outcomes."

1
What data is collected? Grades, attendance, discipline, health, and financial data — much of it highly sensitive PII.
2
Is consent informed? Students and parents may not know their data is shared with a private company.
3
Minimization? Does the analytics company need family income to improve education? Likely not: this is over-collection.
4
Downstream harm? Data could be used to profile students, sold to advertisers, or breached.

Scenario: Facial Recognition

A city installs facial recognition cameras across public spaces to "reduce crime." The system scans and identifies every person who walks by, storing their face data in a central database.

Claimed Benefit
Faster identification of suspects, deterrence of crime in public areas.
Ethical Concerns
Mass surveillance of innocent people. Higher error rates for people of color. No opt-out possible.

Common Mistakes in Ethical Reasoning

✕ "Nothing to Hide"
Assuming privacy only matters if you have something to hide. Everyone has a right to privacy, regardless of whether they are doing something wrong.
✕ Confusing Legal with Ethical
Something can be legal but unethical. Selling user data may be permitted by a ToS but still harmful and deceptive.
✕ Ignoring Aggregation
Treating each data point as harmless in isolation, when combined data reveals far more than any single piece.

Summary: Ethical Data Practices

Principle Ethical Practice Unethical Practice
Consent Clear opt-in with plain language Buried in 50-page ToS
Minimization Collect only what is needed Collect everything possible
Purpose Use data only for stated purpose Sell to third parties
Transparency Users can see and delete their data Data stored indefinitely, no access
Equity Audit algorithms for bias Deploy without bias testing

Question 1 of 5

Which of the following best describes Personally Identifiable Information (PII)?

Question 2 of 5

A fitness app collects heart rate data to provide workout recommendations. It later sells this data to insurance companies without informing users. Which ethical principle is most directly violated?

Question 3 of 5

A hiring algorithm trained on 10 years of company data consistently ranks male applicants higher than female applicants. What is the root cause of this bias?

Question 4 of 5

Researchers demonstrated that combining zip code, birthdate, and gender can uniquely identify most Americans. This is an example of:

Question 5 of 5

Which of the following best identifies the ethical problems in this scenario?