Decoding Data Security

On my 13th birthday, I woke up on a mission. I entered the living room with a printout of the Facebook privacy policy. “I read it all,” I said, thrusting the papers into my dad’s hands. “Can I have a Facebook now?”

My dad is an internet security professional. His job involves many moving pieces, but what I have always understood about his role is that my dad works hard every day to keep people safe on the internet. From the time I was old enough to understand, I had been taught things like why every password should be different and include numbers, letters and symbols, or how anonymity allows people to get away with cyberbullying. The internet is an incredible resource, but one that comes with enormous responsibility.

Now that I’m 20 years old, I have a very different view of data security. I admire and appreciate my dad’s rules about waiting until I was 13 to sign up for social media. I am glad he made me read the privacy policies and terms of use. I did not realize what a privilege it was at the time to have someone so invested in my internet well-being and footprint, someone constantly reminding me that the internet lives forever.

But at 13, I did not understand the importance of data privacy, password protection or the dangers presented by the internet. Despite having a dad who cared very deeply about all three subjects, all I knew was that I felt left out by not being on social media, and I wanted to be more like my friends and the rest of the world. Little did I know that my lack of understanding did make me more like the rest of the world.

In 2019, 59 percent of U.S. adults said they had very little to no understanding about what companies do with the data they collect, according to Pew Research Center. Even more shocking, 78 percent of adults had the same feelings about the data the government collects. And while 13-year-old kids who felt left out on social media were not polled, I cannot imagine the statistics would have been any more promising.

But perhaps the most concerning to me when researching about data privacy was this: just 22 percent of Americans polled in 2019 said they read privacy policies all the way through before agreeing with them, and 63 percent of Americans polled said that they understand very little or nothing at all about the laws and regulations that are currently in place to protect their data privacy.

While times have changed drastically since 2019, the statistics are not getting any better.

The recent Inside Higher Ed and College Pulse survey of 2,286 undergraduates from 120 colleges and universities sought to find out just how much students know about data privacy and how much data their institutions collect. The survey, supported by Kaplan, found that 51 percent of students don’t think their colleges have a data privacy policy or don’t know if there is one. A mere 12 percent of students surveyed have found and read their institution’s data privacy policy.

In researching for this piece, I realized I was not among the 12 percent, so I decided to look up my own university’s data policy. At Elon University, data is collected in the form of cookies, forms, website logs and email tracking, according to the Website and Email Privacy Statement.

Cookies collect information about the pages a student views and the activities taken on the page and enable the site to recognize the student; it’s, of course, how many sites customize the browsing experience. Forms are generally student surveys, event registrations and applications. The website logs and email tracking refer to the activity and usage of Elon University websites. The university collects data on IP addresses, pages visited, browser information and the email address you used to access it … just to name a few.

While students do have the ability to disable or not accept cookies on their browsers -- which does limit website capabilities in some cases -- opting out is not available for certain portions of the university’s website that require a login. When asked about available opt-outs for data collection, 69 percent of Student Voice respondents weren’t sure whether they had the ability to set permissions for the data their colleges collect, and only one-third of students said they do opt out when possible.

Even though the privacy policy states several times that the university will not sell personally identifiable information collected on its websites, I did not feel comforted. And I’m not alone. Fifty-five percent of students surveyed think it is somewhat or very unacceptable for a college to share students’ personal information with third parties, and 58 percent think it is somewhat or very unacceptable for a college to track the websites students visit while on campus Wi-Fi.

I don’t know nearly as much about the resource I use countless hours a day as I thought. How can colleges combat this lack of awareness? I believe it starts with being honest. Transparency for transparency’s sake is not enough. Students could learn and benefit much more from a class detailing what data are collected and why they are.

That last statistic stuck out to me. Websites I visit on campus Wi-Fi? As a student journalist, I do a lot of research throughout the day. What can my university see, and what does my university actually check? In reading the privacy policy, it seems only university-related sites are monitored, but the survey gave me pause and made me wonder if there was anything else I should know about.

While I had the privilege of growing up in a household with someone always looking after my internet well-being, I still felt unprepared coming into college, and I grappled with the statistics I researched. I realized that I am not unlike many of my peers across the country: I don’t know nearly as much about the resource I use countless hours a day as I thought. How can colleges combat this lack of awareness? I believe it starts with being honest. Transparency for transparency’s sake is not enough. Students could learn and benefit much more from a class detailing what data are collected and why they are than they can reading a website listing decisions made for them when they got their acceptance letter and put down a deposit.

Colleges and universities do so much to enrich the lives of the students entering their institutions and to ensure they leave ready to take on the world. Data privacy could be one of the many skills learned in colleges, and arguably one of the most important as students enter an ever-changing digital space.