Spyware

Spyware is a form of malware designed to gather information from the infected device. Spyware comes in many different shapes and forms and may be installed intentionally or unintentionally.

There is considerable debate over the scope of the term malware; while some people and groups qualify certain non-malware software as spyware, such as Microsoft, Meta, and Google owned software due to the large quantity of data these corporations collect from its users, others disagree with that qualification, due to the user having technically consented to the data collection.

How it works

Spyware comes in many different forms. It may present itself as an actual software, while secretly spying on your device in the background.

Malware with deeper level access to your device has more potential for harm, which is a reason some are cautious of Kernel Level Drivers.

Some "free" services, such as Google services(check here for more info: List of Google products), often come at the cost of user data being collected to be sold for profit and/or to be used as training data for Artificial intelligence.

The Legally collected data may also just be diagnostic data or just a way to make things "more convenient"(like with cookies).

Data that tends to get collected:

• Username
• Passwords
• Email addresses
• Diagnostic data(how you use their platform, errors & crash reports, logs, etc)
• Phone Numbers
• Payment Information
• Stored videos & photos
• Metadata of photos & files
• Stored documents
• Contact info from other devices.
• Internet-protocol(IP) addresses
• Browser Type
• Device Type

Why it is a problem

Spyware, as the name suggest, spies on the device, which contains the user's data. Spyware is inherently negative for users' privacy. As companies like Microsoft, Meta and Google are collecting more information on consumers(either by legal or illegal means), they make users less secure & more susceptible to data breaches/leaks.

Spyware & data collection from a consumer rights perspective:

Lack of transparency from companies:

A lack of transparency on a consumers ability to opt-out of data collection if even possible is quite common among popular services

For example, a usage of Deceptive language frequently used against consumers or simply hiding things in the terms of service may be enough trick a consumer into thinking there is nothing wrong with the service or may be enough to prevent/discourage a consumer from learning what a company does with their data & what data they collect.

Lack of a consumers control:

Many corporations use Forced arbitration or Consent-or-pay in order to gain access to user data, with the main incentive/goal of doing this being a desire to make profit(which is why many companies are okay with users opting out of data collection as long as the users still pay for the service as found in Consent-or-pay).

The need for consumer control and proper disclosure:

Reasons/arguments include:

• Improved user satisfaction
• The ability to opt-out allows users to prevent their sensitive data from being leaked in the event of a data breach
• The option for consumers to properly see the data being collected allows them to more easily infer what data tends to be collected without dealing with intentionally deceptive language

Types(illegal/malware)

1. Adware: This type of spyware monitors user activity to then sell that data to malicious advertisers.
2. Info-stealer: This type of spyware takes data from the device, such as recent actions, applications, etc.
3. Key-loggers: Key-loggers are a type of Info-stealer that gains access to data by observing keystrokes done by a user on an infected machine(This data is then saved onto an encrypted log file).
4. Rootkits: Rootkits allow infiltrators extreme levels of access to a device(around administrator level).

Methods used by companies (legal)

1. Cookies: Small pieces of data stored in files on your device(s). This type of data may include, but is not limited to: Preferences on websites, login information, & your browser history.
2. Tracking Pixels: Tracking pixels are incredibly small images that are embedded into websites or emails. This method allows companies to see how users interact with their content on the web.
3. Accounts & Online Forms: Websites typically have users sign up with an account so they can tie data to it. Both account setup and forms similar to it tend to require data such as: Email addresses, phone numbers, Names, & sometimes data that should be optional(like your location).
4. Device & location tracking: Some websites will request access to your geographical position(which can be declined), but what tends to be collected more often are IP addresses(usually outside of your control).

See also

• Anti-privacy legislation(Extremely undeveloped article, but still on the topic of privacy)
• Backdoor
• Data brokers
• Device fingerprint
• De-anonymization
• Forced identification