Most data companies can legally collect a great deal about you, because in most jurisdictions the law starts from consent rather than prohibition. If a company tells you what it gathers and you keep using the service, that is usually enough. The practical question is not whether collection is legal. It is what you agreed to, and how to take the agreement back.
That framing matters for anyone thinking about digital privacy rights as a rights issue rather than a technical one. The record you generate — location pings, purchase histories, browsing trails — follows you into credit decisions, hiring screens and insurance pricing. Control over that record is a civil-liberties question, not just a settings question.
This explainer is general information, not legal advice. Rules differ by country and state, and this piece describes the broad shape of the law rather than any single statute's fine print.
What does "digital" actually cover here?
The word does more work than people assume. According to Merriam-Webster, digital describes technology built on electronic and computerized methods, and data composed of binary digits. In practice, that means nearly everything you do on a phone, a laptop or a connected device produces data in this form: every tap, search and pause.
Wikipedia's entry on digital topics likewise treats digital rights as a distinct category — legal rights of access to computers and the internet — sitting alongside digital culture and the digital economy. The point for a reader is simple: the data is not a byproduct. It is the product's raw material, and the law treats it as yours to grant or withhold, within limits.
What can companies legally collect?
Broadly, three buckets. First, data you hand over directly: your name, email, payment details, the content you upload. Second, data observed as you use a service: device type, browser fingerprint, pages viewed, time spent, approximate location derived from your internet address. Third, data bought or inferred: profiles assembled from other companies' records, or predictions about you built from patterns — that you are likely pregnant, likely to move, likely to accept a lower salary.
The legal default in most places permits all three, provided the company discloses and, for the more sensitive categories, asks. Sensitive data — health conditions, precise location, children's records, biometric identifiers such as face prints — usually triggers a stricter consent standard. But "stricter" still often means a checkbox, not a barrier.
How does consent actually work?
Consent frameworks come in a few recognizable shapes. Opt-in systems require a yes before collection starts; they are common in Europe under its general data protection regime. Opt-out systems assume yes and make you say no; that has been the American default, though several states have moved toward opt-out rights for sensitive categories and targeted advertising.
The catch is consent quality. A wall of toggles, pre-checked boxes, or "accept all" as the biggest button is legally contested territory, and regulators have penalized designs that make refusal harder than agreement. Still, the burden falls on you to notice. Consent is also revocable in principle, but revoking it rarely deletes what was already collected or sold.
Which opt-out tools give you real control?
Practical control comes from a short list of moves, each with costs.
- Browser-level signals. Tools such as Global Privacy Control send an automated opt-out signal to sites that honor it. Honoring is legally required in some jurisdictions for covered businesses and voluntary elsewhere, so coverage is uneven.
- Do Not Sell requests. Many state privacy laws give residents a right to tell companies not to sell or share their data. Companies must provide a request channel; whether you have this right depends on where you live.
- Access and deletion rights. Most modern privacy laws let you ask what a company holds and request deletion. Companies can keep some data for legal or security reasons, and they verify identity first, which slows the process.
- Technical blocking. Tracker blockers, private browsing modes and limiting app permissions reduce collection at the source. The cost is breakage: some sites and features stop working properly.
What this means in practice: no single tool covers the field. Layer them, and expect to repeat the work. Opt-outs attach to one company at a time, and new data brokers enter the picture constantly.
Where does the law draw the line?
The line is drawn by jurisdiction, and the map is patchy. Europe's regime is the strictest broad framework, built on opt-in consent and rights to access, correct and erase. In the United States, there is no single comprehensive federal privacy statute; instead, sectoral laws cover specific areas — health records, children's data, credit reports — and a growing set of state laws adds consumer rights such as opt-outs and deletion, with enforcement split between state attorneys general and, in some states, a dedicated agency. We covered a connected angle in Voting Rights Explained: Registration, ID and Access Rules.
Our analysis of the record is that the gap between the strictest and loosest regimes is effectively a rights gap. Two people with identical habits can hold very different legal controls over the same data depending on where they live — a pattern readers of this site will recognize from other rights maps, including our coverage of voting rights that vary by state. Federal proposals to unify the rules have circulated for years without becoming law. For related coverage, see Who can enforce the Voting Rights Act is now a question of where you live.
What should you actually do?
Start from a decision, not a panic. Decide which categories you care about most — precise location, health inference, children's data — and spend your effort there. Then take three steps.
- Turn on the strongest available privacy signal in your browser and check whether your state grants opt-out rights you can invoke.
- Exercise access and deletion rights with the companies you use most; keep copies of confirmations, because follow-up is common.
- Review app permissions on your phone annually. Location, microphone and contacts are the three that leak the most.
The honest limit of all this: consent frameworks were built to make data flows lawful, not to make them easy to refuse. The tools above shift real leverage, but the structural question — whether collection should be the default at all — is being argued in legislatures and courts, not in settings menus. For more on how rights frameworks get built and tested, see our other explainers, and for the enforcement side, our justice coverage tracks how regulators actually act.
