Privacy
49 bites tagged Privacy — interview questions with model answers, and 60-second explainers.
Design a scalable CMP for GDPR, CCPA, and global regulations
Tests cross-domain privacy architecture at scale. Great answers: edge-based geo-routing, schema-per-regulation consent stores, signed preference tokens, and a postMessage vendor API. Red flag: plain localStorage or equating GDPR opt-in with CCPA opt-out.
Describe the technical steps for displaying and enforcing a cookie consent banner.
Tests privacy-first frontend architecture. Outline: check consent record, render banner if absent, classify scripts as essential or non-essential, persist choice, and inject tracking only after explicit opt-in.
Design anonymous-to-authenticated user journey stitching for ROI
Tests identity resolution and privacy-compliant attribution. Strong answers cover first-party UUID stitching, consent-gated probabilistic matching, async CDP merge, and TTL deletion. Red flag: treating anonymous IDs as non-personal data or skipping consent.
How do you attribute a delayed direct conversion to original ad copy?
Persist copy IDs in first-party cookies at landing, read at conversion to fire server-side events in a 90-day window. Cross-session attribution architecture. Using only client-side pixels or third-party cookies.
How does email open and click tracking work?
This tests beacon and redirect mechanics plus event schema design. A strong answer covers a 1x1 pixel fetched on open, a redirect link that logs then forwards, and data like IP, timestamp, and UA. A red flag is omitting image blocking or privacy implications.
Explain a conversion pixel, click-to-signup flow, and failure points
Tests cross-session attribution state. Strong answers trace the GCLID from URL parameter to cookie or local storage, then to the conversion tag, plus list failure modes like ITP, ad blockers, and race conditions.
PII: Data That Identifies a Real Person
PII is any data that can identify a real person. Email addresses, IP addresses, and device IDs all count, so analytics systems must mask or hash them before storage. A leaked salt can still expose a hashed email, so do not assume hashing removes PII.
How do you approach user identity stitching?
This tests your grasp of data architecture for analytics, not just a simple algorithm. A strong answer defines anonymous vs. known IDs, explains the backfilling/rekeying process upon authentication, and notes the need for a central event store.
Design a Privacy-Compliant Analytics Architecture
This tests your ability to balance data utility with strict privacy controls. A great answer outlines a central governance layer, dynamic masking, and purpose-based access tied to auditable logs.
Data Minimization: Collect Only What You Need
Treat user data like a liability, not an asset. The Data Minimization principle states you should only collect personal data that is strictly necessary for a specific purpose. This is a core tenant of GDPR. The footgun is collecting data "just-in-case".
HealthKit: The Secure Vault for User Health Data
HealthKit is a secure, centralized database for user health data, not a sensor. Your app requests permission to read or write data like steps or workouts, which the OS manages. The footgun is assuming access; users grant permissions per data type.
Rust Modules: Your Code's File System
Think of Rust modules as a file system for your code, grouping logic and hiding details. You declare them with `mod`, and Rust finds the code in corresponding files. The footgun: items are private by default, so you must use `pub` to expose them.
Homomorphic Encryption: Compute Without Decrypting
Homomorphic encryption lets you perform computations on data while it's still encrypted. This allows a third party, like a cloud provider, to process your sensitive data without ever seeing the raw information, ensuring privacy.
Federated Learning: Train Models on Decentralized Data
Federated learning trains a shared model by sending the model to the data, not the other way around. It's used for training on sensitive, decentralized data like phone keyboards. The main footgun is that non-uniform data across clients can skew the model.
Differential Privacy: Anonymize Data with Math
Differential Privacy adds mathematical noise to data queries, making it impossible to know if one person's data is included. Tech giants use it to learn from user behavior without seeing individual activity.
GDPR: Marketing is More Than Just Selling
Under GDPR, direct marketing isn't just selling products; it's promoting your 'aims and ideals.' This applies to email newsletters and targeted ads. The biggest footgun is assuming non-profits are exempt—they aren't, and users have an absolute right to opt…
CCPA & CPRA: California's Consumer Privacy Rules
Think of CCPA/CPRA as giving California consumers a remote control for their personal data. It forces businesses to honor user requests to know, delete, correct, or stop selling their info.
Scoped Storage: Your App's Private File Cabinet
Scoped Storage gives your app a private file cabinet on external storage, not a key to the whole building. It's the default on modern Android for saving data or accessing media. The footgun: don't use direct file paths to shared files; you must use new.
App-Specific Storage: Your App's Private Locker
Think of app-specific storage as a private locker for your app's data, automatically cleaned up on uninstall. Use it for cache, settings, or internal data. The footgun: assuming this data is permanent—it's deleted when the user uninstalls.
Data Ethics: Beyond 'Can We?' to 'Should We?'
Data ethics is the moral framework for handling data, especially personal data. It applies when building systems that collect user info or make automated decisions.
Data Masking: Protect Data, Preserve Utility
Data masking creates a realistic but fake version of your data by scrambling sensitive fields. It's used to give developers and analysts safe datasets for testing or analytics without exposing real PII.
GDPR: Treating User Data as a Liability, Not an Asset
GDPR treats personal data as a liability borrowed from the user. It gives EU citizens strong rights over their data, like access and erasure, forcing any company processing it to comply. The footgun is assuming it doesn't apply if your company isn't in the EU.
Data Anonymization: Protecting Privacy by Removing PII
Data anonymization breaks the link between data and real people by removing personal identifiers. It’s used to share datasets for research or analytics while protecting privacy.
Client-Side vs. Server-Side Tracking
The difference is who sends your data: the user's browser (client-side) or your server (server-side). Client-side is simple but fragile against ad blockers. Server-side offers more control but adds cost. The footgun is thinking server-side is a magic fix.
Get Privacy bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.