If you ever assumed that what you do on the Internet is private unless someone is looking over your shoulder, think again. The Electronic Frontier Foundation has recently published a series of articles about how easily people can be identified online even within the limits set by federal laws and typical web site privacy policies. Although these policies usually promise that any "personally-identifiable information" you share will be kept strictly confidential, they also make exceptions for the supposedly anonymous demographic information you reveal. This includes statistics like your birth date, gender, zip code, and the technical specifications of your computer and web browser. It would be impossible to identify you from just one of these anonymous bits of information. However, the EFF points out that these demographic facts, used in combination, are almost always enough to pinpoint individuals.

For example, in a September blog post, the EFF cited a study at Carnegie Mellon University to show that 87% of Americans have a unique combination of birth date, zip code, and gender. If you live in the United States, that means there is an 87% chance that these three supposedly "anonymous" facts, taken together, are enough to identify you. The less populous your zip code, the more likely that someone can link that data directly to your name. For a more detailed explanation of the mathematics of identifying unique individuals with this kind of demographic information, see the EFF's recent Primer on Information Theory and Privacy.

The technical information that your computer sends to each website you visit reduces your anonymity even further. Websites collect data on the configuration of your computer in order to optimize their own compatibility with your system. However, the high number of unique computer configurations means that few people are likely to be using exactly the same combination of operating system, screen resolution, web browser version, browser plug-ins, and fonts as you are. The EFF has launched a website called Panopticlick that can tell you just how unique your own setup is.

Like a fingerprint, a unique computer configuration can easily be tracked as it hops from web page to web page, even if you have cookies disabled and you have a dynamic IP address. If you share information as limited as your birth date, gender, and zip code at a website where someone connects it with your particular computer setup, that person could potentially track your movement online, gaining clues about your interests, your hobbies, your beliefs, your political opinions, and your friends, while linking this data directly to your name and address. Companies like Acxiom specialize in just this kind of data analysis in order to help advertisers develop targeted marketing campaigns, and to aid credit card and insurance companies in deciding whether or not to provide you their services and at what price.

You may think you have nothing to hide. Privacy isn't just about keeping dirty secrets, however. You can surely think of things in your life that you would be embarrassed to tell certain people. Is that wrong? How many people would tell their parents everything they tell their best friends, or tell their best friends everything they tell their parents, or tell either of these things to their children or their coworkers? The truth doesn't have to be "bad" to be uncomfortable. Think of the secrets you keep with good intentions, to surprise someone or protect someone. Is that wrong? Would you tell a random stranger where you live? Would you give away your email password or your bank account number?

We all have secrets. You have a right to privacy — a right to choose what the world should or should not know about you. Information is power, and information about you is the power to persuade you, to embarrass you, to manipulate you, to rob you, and even to predict you. Laws about privacy are defined by our expectations of privacy. What happens if you don't care what kind of information Google, Microsoft, Facebook, and Twitter collect from you? The U.S. Constitution only guarantees against "unreasonable searches and seizures." If you think it's reasonable to be spied on while you're on the web, then how much privacy does the law grant you?