Top 30 Privacy Interview Questions and Answers
30 multiple-choice questions on Privacy, drawn from 30 bites out of the 49 tagged Privacy on Tezvyn. Answer them here or read straight down. Every question carries the correct option, why it is correct, and a link to the bite it came from.
30 questions. Pick an answer, or open “Show the answer” to read it.
Answers are graded in your browser. Nothing is saved, and no XP or streak is earned here. The app keeps score.
Question 1 of 30
For engineers building global platforms, what is the most significant technical implication of the UK plan to require passport-based social media verification?
Show the answer
Answer: c · It forces a shift toward gated authentication architectures and fragmented regional compliance.
The card emphasizes that requiring passport-based access forces platforms to redesign authentication around gated, national identity systems and likely creates fragmented regional architectures. Credit cards are merely one proposed verification method, so the plan does not eliminate the need for age-gating APIs or technical identity infrastructure.
Read the full bite: UK digital ID plan ends online anonymity for adults
Question 2 of 30
A team's current approach to keeping PII out of logs is to log full request and response bodies as usual, then run a nightly job that scans old logs and deletes lines matching an email regex. What is the main weakness of this approach?
Show the answer
Answer: d · It leaves PII sitting in logs until the nightly job runs, and regex scrubbing after the fact commonly misses fields it was not written to catch
Logging everything first leaves PII exposed in plaintext for up to a full day, and after the fact regex scrubbing routinely misses fields that do not match the pattern, so this is not equivalent to never logging it at all. The stronger control is preventing sensitive fields from being logged in the first place, not cleaning up after exposure.
Read the full bite: What is PII and how to keep it out of logs
Question 3 of 30
When designing a new online service, which practice best exemplifies the principle of Data Minimization?
Show the answer
Answer: b · Asking for only the information strictly necessary to provide the service's core functionality.
Data Minimization dictates collecting only the data strictly necessary for a specific, legitimate purpose, as described in option B. Option C violates this by collecting data 'just-in-case' for potential future use, which is explicitly warned against in the card.
Read the full bite: Data Minimization: Collect Only What You Need
Question 4 of 30
After a user authenticates, linking their anonymous ID to a known user ID, what is the critical data engineering step for creating a complete customer view?
Show the answer
Answer: a · Rekeying historical events from the anonymous ID with the known user ID.
Rekeying historical events is crucial because it connects pre-authentication behavior to the known profile, creating a unified journey. Simply mapping IDs for future events is incomplete as it misses this valuable historical context.
Read the full bite: How do you approach user identity stitching?
Question 5 of 30
A team running a six month diary study needs to link the same participant's data across sessions, so they generate each participant's ID by taking an unsalted SHA-256 hash of their email address and store only that hash. What is wrong with this approach?
Show the answer
Answer: a · An unsalted hash of a guessable input like an email is trivially reversible by precomputing hashes for common emails, unlike a keyed HMAC with a separately secured key
Because email addresses are guessable, an attacker can precompute hashes for likely emails and match them against the stored value, so an unsalted hash offers little protection. A keyed hash such as HMAC, with the key held separately and access controlled, is what actually secures a stable pseudonym, and the result is still pseudonymization, not the irreversible anonymization the third option claims.
Read the full bite: Anonymization vs pseudonymization and key handling
Question 6 of 30
Under Google's Consent Mode, what happens when a user denies consent for analytics tracking?
Show the answer
Answer: a · Anonymous, cookieless pings are sent to Google for data modeling, without storing personal identifiers.
When consent is denied, Google's Consent Mode prevents the storage of cookies or personal identifiers. However, it still sends anonymous, cookieless pings to allow for data modeling, making option B (all data collection halts) a common misconception.
Read the full bite: Analytics Consent Management: Respecting User Choices
Question 7 of 30
Which statement accurately describes a primary benefit of implementing server-side tracking over client-side tracking?
Show the answer
Answer: a · It allows for greater control over data enrichment and filtering before sending it to third-party vendors.
The card explicitly states that server-side tracking allows your server to "enrich it, filters it, and then forwards the processed data," giving you control over what data leaves your ecosystem. Option D is incorrect because while server-side tracking offers more resilience, no method guarantees 100% data capture or is fully immune to all privacy features.
Question 8 of 30
When supplementing a two-week remote diary study with technical instrumentation, which approach best validates self-reported behavior while preserving ecological validity?
Show the answer
Answer: d · Log anonymized feature usage, session duration, and device switches, then correlate them with diary entries via anonymized participant IDs
Option D is correct because it pairs passive, privacy-preserving analytics with anonymized linkage to triangulate diary claims without introducing observer bias. Option A is tempting but wrong because invasive capture like screen recording destroys the natural context that makes diary studies valuable and violates the required anonymization and consent protocols.
Read the full bite: What technical instrumentation supplements a two-week diary study?
Question 9 of 30
When architecting a pipeline from an analytics warehouse to a recruiting tool, which step must occur immediately before user identifiers are exposed via API?
Show the answer
Answer: a · Check the opt-out registry and confirm privacy consent
The card specifies that a consent and privacy gate must be inserted before any outreach, and identifiers should only surface to the recruiting tool after consent is confirmed. While cohort computation happens earlier in the warehouse and screener logic typically runs inside the recruiting tool after the API push, consent must be verified at the boundary before identifiers leave the warehouse environment.
Read the full bite: Design a system integrating analytics data with participant recruiting
Question 10 of 30
A dataset contains no names or emails, but includes zip code, birth date, and gender. Why is this still considered PII?
Show the answer
Answer: c · Because those fields can combine to uniquely identify specific individuals
The card's canonical example shows that zip code, birth date, and gender often uniquely identify individuals when combined, so the dataset remains PII. Option B is tempting but wrong because the card explicitly warns that stripping obvious identifiers like names does not automatically make data anonymous if quasi-identifiers remain.
Question 11 of 30
To make a struct defined within a submodule vegetables (located at src/garden/vegetables.rs) accessible from the crate root (src/main.rs), which visibility declaration is absolutely necessary?
Show the answer
Answer: d · The vegetables module, the garden module, and the struct must all be explicitly marked pub.
The card states that 'Every pub keyword here is essential; without them, the modules and the struct would be private and inaccessible from main.rs.' This means all modules and the item itself in the path must be public. The 'use' keyword only creates a shortcut to an item's path; it does not grant public visibility.
Question 12 of 30
Which scenario best illustrates the primary purpose of data anonymization?
Show the answer
Answer: d · A hospital sharing patient data with researchers for public health studies.
Data anonymization's primary purpose is to enable sharing and analysis of data while protecting individual privacy, as exemplified by hospitals sharing patient data for research. It is explicitly stated as unsuitable for operational systems like billing or customer support, which require individual identity.
Read the full bite: Data Anonymization: Protecting Privacy by Removing PII
Question 13 of 30
Which description best captures why modern conversion tracking relies on first-party cookies or local storage?
Show the answer
Answer: d · The user may navigate away and return later without the original URL parameter, so the identifier must be persisted in first-party storage.
The card emphasizes that attribution is deferred: the GCLID must be stored first-party because users often leave and return without the original URL parameter. Distractor B reflects the common misconception that the signup page can simply read the identifier from the URL automatically, omitting the critical storage step entirely.
Read the full bite: Explain a conversion pixel, click-to-signup flow, and failure points
Question 14 of 30
Which scenario most clearly requires a company to comply with GDPR?
Show the answer
Answer: d · A US company with all its servers in the US, but some users are French citizens living in France.
GDPR applies to any organization processing personal data of individuals inside the EU and EEA, regardless of the organization's location. Therefore, a US company with French users residing in France must comply. Truly anonymized data is exempt, and the location of the data subject (not their nationality) determines applicability.
Read the full bite: GDPR: Treating User Data as a Liability, Not an Asset
Question 15 of 30
Which statement accurately differentiates data masking from encryption?
Show the answer
Answer: d · Data masking creates a non-reversible, altered dataset, while encryption allows for original data recovery.
Data masking creates a new, permanently altered dataset for non-production use, making it irreversible. In contrast, encryption is reversible, allowing the original data to be recovered through decryption.
Read the full bite: Data Masking: Protect Data, Preserve Utility
Question 16 of 30
Which design best balances user experience, data quality, and scalability for tracking share clicks?
Show the answer
Answer: a · Batch structured events with hashed IDs using exponential backoff retry, then land in partitioned columnar storage
Option A is correct because it combines non-blocking batching with resilient retry, privacy-preserving identifiers, and scalable partitioned storage. Option B is tempting because beacon delivery and partitioned tables are valid choices, but including raw emails violates privacy guardrails and risks PII exposure.
Read the full bite: Describe the end-to-end data flow for tracking a 'Share' button click
Question 17 of 30
How does a click-tracking link typically record that a recipient clicked before sending them to the destination?
Show the answer
Answer: d · The sender's server logs the event and issues an HTTP 302 redirect
Click tracking routes the recipient through a sender-controlled URL that records metadata and returns an HTTP 302 redirect to the final destination. Option A is a tempting distractor because email clients block all scripts, making JavaScript-based tracking impossible inside an email.
Read the full bite: How does email open and click tracking work?
Question 18 of 30
A user clicks an ad Monday and converts directly Wednesday. Which method most reliably attributes the conversion to the original ad copy?
Show the answer
Answer: a · Parse landing URL parameters to set a first-party cookie on your domain, then read it server-side at conversion
A first-party cookie set at landing persists across the two-day gap and is read server-side to bypass ad blockers and ITP. Relying solely on a client-side pixel fails because the direct visit has no UTM parameters and the pixel is often blocked.
Read the full bite: How do you attribute a delayed direct conversion to original ad copy?
Question 19 of 30
Which architecture reliably delivers a survey to 10,000 users while protecting privacy and preventing duplicate sends?
Show the answer
Answer: d · Use an async queue with idempotency checks and rate limiting, deduplicate users before enqueueing, and isolate survey responses from personally identifiable information.
The correct design processes invitations asynchronously with idempotency and rate limiting to ensure exactly-once delivery without overwhelming providers, and it isolates PII from responses. The synchronous for-loop approach is tempting because it looks simple, but it risks provider blocks, duplicate sends, and commingling sensitive user data with survey answers.
Read the full bite: How do you reliably deliver a survey to 10,000 users?
Question 20 of 30
Which approach best fits a beginner 30-day DAU forecast using timestamped event logs?
Show the answer
Answer: a · Start with a regression baseline using day-of-week and recent daily totals, evaluating with MAE
The card prescribes an interpretable regression baseline using temporal features and recent totals scored with MAE before considering complexity. Option B is wrong because the card explicitly red-flags both deep learning and real-time online inference as over-engineering for a simple 30-day batch forecast.
Read the full bite: What data and approach for a simple 30-day DAU forecast?
Question 21 of 30
How should the platform handle a user deletion request across fifty independently deployed microservices while keeping aggregated analytics intact?
Show the answer
Answer: a · Orchestrate deletion commands to each product store and remove identity graph edges while preserving aggregated metrics
The card's concrete example states that the privacy vault orchestrates deletion commands back to source product stores and removes stitched graph edges, leaving aggregated analytics intact. Option D is tempting but wrong because deleting only in the central lake fails to reach independent source systems, and C mistakenly assigns deletion propagation to the schema registry rather than the privacy vault.
Read the full bite: Design a cross-product user journey data architecture
Question 22 of 30
Why can unit tests call private functions while integration tests cannot?
Show the answer
Answer: d · Unit tests are child modules in the same crate and can access private ancestor items, but integration tests are external crates
Unit tests are child modules within the same crate, so they can access private items in ancestor modules via super::, whereas integration tests are compiled as separate external crates and are restricted to the public API. #[cfg(test)] only controls conditional compilation, not visibility, so distractor A conflates the annotation with privacy rules.
Read the full bite: How does Rust differentiate unit and integration tests?
Question 23 of 30
In DP-SGD, what is the relationship between the epsilon parameter and the strength of the privacy guarantee?
Show the answer
Answer: a · A smaller epsilon gives a stronger privacy guarantee but typically lowers utility
Smaller epsilon bounds privacy loss more tightly, requiring more noise and usually reducing accuracy. Larger epsilon is a weaker guarantee, so the first option reverses the relationship.
Read the full bite: Differential privacy vs utility in LLM fine-tuning
Question 24 of 30
For which type of data is app-specific storage generally considered an unsuitable choice?
Show the answer
Answer: d · User-created documents intended for long-term retention
App-specific storage is automatically deleted when the app is uninstalled, making it inappropriate for user-created content like documents that users expect to retain. It is designed for app-internal data such as caches, settings, or downloaded offline content.
Read the full bite: App-Specific Storage: Your App's Private Locker
Question 25 of 30
Under Android's Scoped Storage, how does an app typically gain access to a user's shared media files, like photos?
Show the answer
Answer: b · By using system-provided APIs like the Photo Picker, which grant temporary access via a content URI.
Scoped Storage mandates the use of system-provided APIs like the Photo Picker or MediaStore to access shared media, granting temporary access via content URIs. Option A describes the deprecated legacy approach, while A is for specialized file manager apps, not typical applications.
Read the full bite: Scoped Storage: Your App's Private File Cabinet
Question 26 of 30
Which approach best balances ROI attribution, sub-100ms login latency, and GDPR compliance when stitching six months of anonymous browsing to a new subscription?
Show the answer
Answer: c · Emit an identity-link event to an async stream processor that merges a first-party UUID into the CDP, treat the anonymous ID as personal data, and bound the cookie TTL to 13 months.
Asynchronous merging via a stream processor keeps the login path under 100 ms while enabling warehouse attribution, and treating the first-party UUID as personal data with a bounded TTL satisfies GDPR. The synchronous backfill in option B seems thorough but would create database hotspots and violate latency SLAs.
Read the full bite: Design anonymous-to-authenticated user journey stitching for ROI
Question 27 of 30
What is the fundamental flaw in loading all analytics scripts at page startup and using a banner only to hide them until the user accepts?
Show the answer
Answer: d · Tracking scripts execute before consent, meaning user data can be collected and profiled before opt-in.
GDPR mandates gating script execution, not just visibility; once a tracking script runs, profiling may already have occurred. Distractor A is wrong because strictly necessary cookies like session tokens are exempt and may load immediately without consent.
Question 28 of 30
Why is crypto-shredding often preferred over physical deletion for erasing one user's data from an immutable S3 data lake?
Show the answer
Answer: d · It avoids rewriting large interleaved objects by destroying the per-user key instead
Per-user encryption lets you render data unrecoverable by destroying a key, avoiding expensive rewrites of immutable files. It does not propagate downstream nor remove the audit-trail requirement, and other methods can also be lawful.
Read the full bite: Enforcing GDPR Right to be Forgotten at scale
Question 29 of 30
Why is Private Set Intersection preferred over simply exchanging salted hashes when two parties need to identify overlapping users?
Show the answer
Answer: c · It computes the intersection without either party learning the others non-matching elements
PSI uses primitives like oblivious transfer to compute the intersection while keeping non-matching elements hidden from both sides, whereas salted hashes lack cryptographic guarantees and can be reversed. Distractor A is tempting but wrong because standard PSI protects only against honest-but-curious adversaries, and defending against malicious parties requires additional protections.
Question 30 of 30
When scrubbing conversational data for fine-tuning, why does detection recall typically matter more than precision?
Show the answer
Answer: a · A single missed identifier can be memorized and regurgitated by the model, while over-redaction mainly costs some utility
Leaked PII can be memorized and leaked at inference, a serious privacy harm, so missing identifiers (low recall) is worse than occasionally over-redacting. Precision and recall are both measurable and not strictly inverse.
Read the full bite: Preprocessing conversations to protect privacy before fine-tuning
Could you explain these out loud?
That is what an interview actually tests. Tezvyn gives you questions like these with what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.