Address
304 North Cardinal St.
Dorchester Center, MA 02124
Work Hours
Monday to Friday: 7AM - 7PM
Weekend: 10AM - 5PM
We use Google to search, Microsoft to work, WhatsApp to communicate, Zoom to attend meetings, Apple devices to access our digital life, Amazon Alexa to interact with our homes, and Facebook or Instagram to socialize.
Most people think privacy means one simple question:
“Is someone listening to me?”
But modern digital surveillance is much broader than secretly turning on a microphone.
Companies can learn a remarkable amount from search history, browsing activity, location, device information, identifiers, app activity, contacts, interactions, voice recordings, cookies and metadata.
And this isn’t just a theory. There are documented investigations, regulatory actions and company disclosures showing how different platforms collect and process user data.
Google & YouTube: Your Activity Can Become a Profile
Google operates some of the world’s most widely used digital services, and its data ecosystem can connect information across products.
One documented case involved YouTube.
In 2019, the U.S. Federal Trade Commission and New York Attorney General alleged that YouTube collected children’s personal information without obtaining the required parental consent. The information included persistent identifiers such as cookies that could track viewers over time and across websites for targeted advertising.
Google and YouTube agreed to pay $170 million to settle the allegations—the largest COPPA-related penalty at that time.
The important lesson isn’t that “Google secretly watches everyone.”
It is this:
Online activity can be converted into data that helps identify patterns, interests and behavior.
And that’s far more sophisticated than simply listening to a microphone.
Microsoft: Windows Can Send Diagnostic and Usage Data
Your computer itself can generate a large amount of information.
Microsoft openly documents Windows diagnostic data collection.
Required diagnostic data can include information about the device, its configuration and whether it is operating correctly. Optional diagnostic data can include additional information such as websites browsed, device activity, application activity and enhanced error reporting.
Microsoft also documents that optional diagnostic data can include information about which programs are launched, how long they run, browser activity and search terms in Microsoft browsers.
This does not mean Microsoft employees are sitting and watching individual users’ screens.
It demonstrates something more important:
An operating system can generate telemetry about how a device is being used.
Zoom: When “End-to-End Encryption” Wasn’t What Users Thought
Zoom provides one of the clearest examples of why security claims matter.
During the COVID-19 pandemic, Zoom became a critical communication platform.
In 2020, the FTC took action against Zoom over allegations that the company had misled users about its security practices.
According to the FTC complaint, Zoom had advertised “end-to-end, 256-bit encryption”, but the FTC alleged that Zoom actually provided a lower level of security and maintained cryptographic keys that could potentially allow Zoom to access meeting content.
The FTC also alleged that some cloud recordings were stored unencrypted for periods of time. Zoom agreed to implement a comprehensive security program and stop making misleading privacy and security claims.
The lesson:
Encryption on the label does not automatically tell you who can access the data.
You have to understand where encryption happens, who controls the keys and what the provider can technically access.
WhatsApp: Encryption Doesn’t Mean “No Data”
WhatsApp is different from many other platforms because its personal messages and calls are designed around end-to-end encryption.
But end-to-end encryption protects message content; it doesn’t mean the service necessarily has zero information about the user.
WhatsApp’s relationship with its parent company Meta has also faced regulatory scrutiny.
In 2024, India’s Competition Commission concluded that WhatsApp’s 2021 privacy-policy update forced users to accept expanded data-sharing terms without an effective opt-out, and it specifically addressed sharing of WhatsApp user data between Meta companies. The CCI ordered restrictions including a five-year prohibition on certain sharing of WhatsApp user data with other Meta companies for advertising purposes.
So the important distinction is:
Encrypted content ≠ zero metadata ≠ zero data processing.
A platform can protect the content of a conversation while still processing information necessary to operate the service and other information permitted by its policies.
Facebook: When Third-Party Apps Became a Privacy Problem
Facebook’s Cambridge Analytica controversy is one of the most famous examples of how data collected through a platform can travel into another ecosystem.
The FTC alleged that an app called GSRApp, developed by Aleksandr Kogan, collected information from users who answered personality questions and shared Facebook profile information. The FTC said the app also collected information relating to users’ Facebook friends.
The data was subsequently obtained and analyzed by Cambridge Analytica.
The broader Facebook privacy case became so serious that in 2019 Facebook agreed to a $5 billion FTC settlement over allegations that it violated an earlier privacy order and deceived users about their ability to control their personal information.
This case demonstrated an important principle:
Your data doesn’t always have to be collected directly by the company that eventually uses it.
Third-party apps, integrations and data-sharing relationships can create additional paths.
Apple: Your iPhone Can Tell You Which Apps Access Your Data
Apple’s privacy model is different, but even Apple acknowledges that apps can request access to sensitive resources.
Apple’s App Privacy Report can show how often apps have accessed information such as:
- Location
- Photos
- Camera
- Microphone
- Contacts
It can also show which internet domains apps have contacted.
Apple also requires apps to ask permission for certain tracking across other companies’ apps and websites.
This is actually a useful lesson for users:
Don’t assume an app has access to everything simply because it is installed. Check the permissions.
At the same time, permission-based access means that the operating system itself has to monitor and enforce those permissions.
Amazon Alexa: Voice Data Can Become Long-Term Data
Smart speakers introduce a different category of privacy risk:
voice data.
In 2023, the FTC and U.S. Department of Justice charged Amazon over Alexa’s handling of children’s information.
According to the complaint, Amazon retained children’s Alexa voice recordings and geolocation information for years and allegedly undermined parents’ deletion requests.
The complaint contains an especially striking allegation: between August 2018 and September 2019, Alexa voice recordings were accessible to approximately 30,000 Amazon employees, around half of whom allegedly had no business need for that access.
This is a very different kind of surveillance story.
The device doesn’t need to be “secretly spying.”
The privacy question becomes:
Where is your voice data stored, how long is it retained, and who can access it?
The Bigger Picture
These examples involve different companies and completely different technologies.
Google has search and advertising ecosystems.
Microsoft operates an operating system and productivity ecosystem.
Zoom provides communication infrastructure.
WhatsApp provides encrypted messaging.
Meta operates social networks and advertising systems.
Apple controls a mobile operating system and app ecosystem.
Amazon operates voice assistants and cloud services.
Yet one common factor connects them:
Data.
Sometimes that data is collected to provide a service.
Sometimes it is used for security, diagnostics or product improvement.
Sometimes it supports advertising or personalization.
And sometimes regulators conclude that a company’s practices crossed legal or privacy boundaries.
That is why the most accurate question isn’t:
“Is this company spying on me?”
A better question is:
“What information does this service collect, what can it infer from that information, where is it stored, who can access it, how long is it retained, and under what circumstances can it be shared?”
Because modern digital surveillance doesn’t necessarily require someone to sit behind a screen and listen to your conversation.
Sometimes a company can learn a lot simply by knowing:
where you go, what you search, what you click, what device you use, which apps you open, who you interact with, what websites you visit and how you behave online.
And that’s what makes the modern privacy problem so complicated.
The most valuable information about you may not be what you say.
It may be the pattern of everything you do.