First parties collect data via cookies, user-generated content (UGC), and account terms of use; in California and the EU they give notice before setting cookies. They may also append data from data brokers, whom the FTC has scrutinized.
How this supports CIPP/US study
Use this lesson to identify the legal source, actor, data and activity before applying a rule to a scenario. Continue with the CIPP/US study guide.
Cookies are one way first parties collect data; in California and the EU, first parties provide notice before setting cookies. Consent to cookies is only consent to set the cookies - creating an account means agreeing to longer terms of use that can grant broader rights, such as tracking location or selling data. Social networks retain user-generated content (UGC) for granular targeting.
Cookie consent vs terms of use
Cookie consent covers only setting cookies; the broader collection and processing rights (e.g. selling data, tracking location) come from the terms of use a user accepts when joining a service.
First parties may also append data from data brokers - businesses that obtain, cleanse, and license data. The FTC and other regulators have scrutinized data brokers; studies put the annual data brokerage market above $250 billion.
Key terms - quick answers
What is “User-generated content (UGC)”?
Text, photos, or videos a user posts to a website, providing granular insight into interests and offline activities.
What is “Terms of use”?
The longer policy (also called terms of service or terms and conditions) a user agrees to when creating an account, often granting broader data-collection rights than cookie consent.
What is “Data brokers”?
Businesses that obtain data from one or more sources, process and cleanse it, and license it for use by first parties; scrutinized by the FTC over privacy concerns.
Sources and study method
This independent lesson uses active recall, spaced retrieval and scenario practice. Read the full study method.
