Most people vaguely know that companies collect their data. Fewer understand what that means in practice: which entities have it, what they infer from it, how long they keep it, and what rights — if any — allow you to see, correct, or delete it. Digital rights aren’t abstract philosophy; they’re the legal and technical infrastructure that determines who controls your online life.
What Are Digital Rights?
Digital rights are an extension of established human rights — freedom of expression, privacy, due process — applied to the online environment. They include the right to communicate without mass surveillance, to access information without government-imposed filters, to not be subject to automated decisions without explanation or appeal, and to control personal data that has been collected about you. Several of these rights are now codified: the EU’s General Data Protection Regulation (GDPR), Brazil’s Lei Geral de Proteção de Dados, and California’s CPRA all create enforceable data rights. Most of the world’s population, however, lives without equivalent protections.
What Data Is Actually Collected
The range is wider than most people expect. Beyond obvious data like email addresses and purchase history, companies collect:
- Behavioral data: where your cursor hovers, how long you pause on a post, in what order you scroll.
- Inferred data: psychological profiles, political leanings, health conditions, financial stress indicators — derived by algorithm from behavior, not declared by you.
- Location history: fine-grained movement data often collected via apps and sold to data brokers entirely separate from the original app developer.
- Device fingerprints: unique identifiers assembled from your browser version, screen resolution, installed fonts, and dozens of other technical attributes — persistent even if you delete cookies.
The Difference Between Privacy and Secrecy
A common counterargument to privacy concerns is “I have nothing to hide.” This misunderstands what privacy protects. Privacy is not about hiding wrongdoing; it is about maintaining the power to control your own narrative. A medical diagnosis shared with your doctor, a political opinion expressed in a private message, a financial hardship discussed with a spouse — none of these are secrets in the shameful sense, but all of them belong to you. When they are scraped, inferred, and sold without your knowledge, the relationship between you and powerful institutions changes in ways you don’t control and often don’t know about.
Your Rights Under GDPR and Similar Laws
If you are in the EU or interact with companies that serve EU users, you have specific enforceable rights. You can request a copy of all data a company holds on you (a Subject Access Request). You can demand correction of inaccurate data. You can request deletion under certain conditions (the “right to be forgotten”). You can object to your data being used for profiling or direct marketing. Submitting these requests is often cumbersome — companies are not incentivized to make it easy — but the rights are real and national data protection authorities can impose substantial fines for non-compliance.
Surveillance Beyond Advertising
The digital rights conversation extends well beyond commercial data collection. State surveillance — conducted either directly or through purchase of data from brokers — is a documented reality in dozens of countries, including liberal democracies. The Edward Snowden disclosures in 2013 revealed the scope of NSA mass surveillance under programs like PRISM. More recently, the Pegasus spyware scandal showed that commercial surveillance tools developed by NSO Group were used to target journalists, lawyers, and human rights activists in multiple countries. Digital rights organizations like Access Now and Amnesty Tech’s Security Lab work specifically on these cases.
Practical Steps to Protect Yourself
Full anonymity online is neither achievable for most people nor necessarily the goal. But meaningful privacy improvements are accessible. Using a privacy-focused browser (Firefox with uBlock Origin, or Brave) eliminates most behavioral tracking by default. Switching to Signal for sensitive conversations provides end-to-end encrypted messaging. Using a reputable VPN on public Wi-Fi prevents passive interception. Opting out of data broker listings — services like DeleteMe or manual opt-outs through sites like Spokeo and WhitePages — reduces the profile available for commercial and government purchase.
The Collective Dimension
Individual privacy choices matter, but digital rights are ultimately a structural issue. What data brokers are permitted to sell, whether encryption can be legally mandated to include backdoors, how long telecoms must retain metadata — these are policy questions decided through legislation and court cases. Organizations like the Electronic Frontier Foundation, Privacy International, and Article 19 work on these fronts. Supporting them — financially or by following their advocacy campaigns — is as practical a privacy action as switching browsers.