Step by Step
D
Data Minimization — collect only what you absolutely need
Data minimization means collecting only the data absolutely necessary for the task at hand, rather than collecting everything technically possible just because it might be useful someday.
Example: an app collecting only the specific location data it needs for its core feature, rather than continuously tracking a user's location for no clearly justified purpose.
A
Anonymization — removing or masking identifying information
Anonymization means removing or masking personally identifying information from training data, reducing the risk that individuals can be identified from that data.
Example: stripping names, exact addresses, and other directly identifying details from a medical dataset before using it to train a research model.
C
Consent — people should know and agree to how their data is used
Consent means people should genuinely know and explicitly agree to how their data will be used, rather than having their data used in ways they weren't clearly informed about.
Example: a company clearly explaining to users, and getting their explicit agreement, before using their data to train an AI model, rather than burying this in fine print.
⭐
Privacy by design — building it in from day one
Privacy by design means building these protections (data minimization, anonymization, consent) into a system from the very beginning of development, rather than trying to add them on as an afterthought later. GDPR (Europe) and CCPA (California) codify many of these rights into law, and federated learning is one technical solution supporting these principles.
Example: a development team designing their data collection and storage architecture around these three privacy principles from the very start of a project, rather than retrofitting privacy protections after the system is already built.
Applied Walkthrough
1
A company is designing a new AI-powered health app and must decide how to handle user data from the very beginning of development.
2
Applying data minimization, they collect only the specific health metrics genuinely needed for their core feature, rather than every possible data point.
3
Applying anonymization, they strip out directly identifying details from any data used to train or improve their underlying models.
4
Applying consent, they clearly explain to users how their data will be used and obtain explicit agreement — building all three of these principles into the system's design from day one (privacy by design), rather than retrofitting them after facing regulatory pressure or a privacy incident.
Exam Application
Exams test whether you can name and describe the three core AI privacy principles (data minimization, anonymization, consent) and whether you understand "privacy by design" as building these protections in from the start rather than adding them later. Also expect a reference to GDPR and CCPA as the legal frameworks codifying these rights.
⚠ Common Trap
The most common trap is assuming these three principles are optional best practices rather than principles increasingly codified into binding law. GDPR (Europe) and CCPA (California) specifically codify many of these privacy rights into enforceable legal requirements, not just voluntary ethical guidelines.
✓ Quick Self-Check
1. What does data minimization mean?
Collecting only the data absolutely necessary for the task at hand, rather than everything technically possible.
Tap to reveal / hide
2. What does anonymization involve?
Removing or masking personally identifying information from training data.
Tap to reveal / hide
3. What does consent require?
People genuinely knowing and explicitly agreeing to how their data will be used.
Tap to reveal / hide
4. What does "privacy by design" mean?
Building privacy protections into a system from the very beginning of development, rather than adding them on later as an afterthought.
Tap to reveal / hide
5. Name two legal frameworks that codify these privacy principles into law.
GDPR (Europe) and CCPA (California).
Tap to reveal / hide