Case Study: A Day in Data — Mapping Jordan's Digital Footprint

"The best way to understand a system is to trace what it does when no one is paying attention." — danah boyd, It's Complicated: The Social Lives of Networked Teens

Overview

Section 1.2 of this chapter introduced the concept of datafication and traced a hypothetical student's day in data. In this case study, you will go deeper. You will follow Jordan Reeves — a 20-year-old college junior — through a single, ordinary Wednesday, mapping every data point generated, identifying who collects it, analyzing why they collect it, and uncovering the power dynamics embedded in those flows. By the end, you will have a concrete, experiential understanding of the data ecosystem that surrounds a single person on a single day.

Skills Applied: - Identifying data types (personal, metadata, data exhaust, sensitive categories) in real-world scenarios - Tracing data through the lifecycle (collection, storage, processing, analysis, sharing, retention, deletion) - Analyzing stakeholder interests and power asymmetries in data flows - Distinguishing between structured, unstructured, and semi-structured data

Meet Jordan Reeves

Jordan is a 20-year-old junior at Lakeshore State University, majoring in Communications with a minor in Sociology. They live in a two-bedroom apartment about a mile from campus with a roommate, work part-time at the campus bookstore, and carry a full course load. Jordan is not particularly tech-savvy or tech-averse — they are, in most respects, a thoroughly ordinary student. They have a smartphone (iPhone, paid for on a family plan), a laptop (university-issued Chromebook), a Fitbit they got for their birthday, an Instagram account, a TikTok account, a Spotify subscription, and a debit card from a national bank.

Jordan does not think about data much. They accepted every terms-of-service agreement they have ever encountered without reading a single one. They do not use a VPN. They have never checked their browser's cookie settings. They have "nothing to hide."

This is Jordan's Wednesday.

The Scenario: One Ordinary Wednesday

6:15 a.m. — The Wake-Up

Jordan's Fitbit vibrates silently on their wrist. The device has been tracking their sleep since they lay down at 11:47 p.m. the night before: sleep stages (light, deep, REM), heart rate variability, blood oxygen saturation, restlessness episodes, and skin temperature. The Fitbit syncs this data to Fitbit's cloud servers via Bluetooth through Jordan's phone.

Jordan picks up their iPhone. The screen lights up. iOS logs the unlock time. Three notifications are visible: one from Instagram (a friend tagged them in a post), one from their university's learning management system ("Quiz due by 5 p.m."), and one from a weather app. Jordan taps the weather app. It requests and receives Jordan's precise GPS coordinates — latitude, longitude, altitude — and sends them to the app's servers, which are operated by a company called Tomorrow.io, which also shares location data with advertising partners.

Jordan has been awake for ninety seconds. They have already generated data across four separate corporate systems.

6:30 a.m. — Getting Ready

Jordan showers (their apartment's smart meter records the hot water usage spike and the electricity draw), brushes their teeth, and gets dressed while listening to a Spotify playlist called "Morning Energy." Spotify logs every song played, every skip, the time each track started and stopped, the device used, and the volume level. This data feeds Spotify's recommendation algorithm — but it is also shared with rights holders, aggregated for trend analysis, and used to serve targeted audio advertisements between songs on the free tier.

Jordan makes coffee using a standard drip machine (no data generated — one of the few analog moments in their morning) and eats a granola bar.

7:10 a.m. — The Commute

Jordan leaves their apartment. Their phone, still in their pocket, continuously broadcasts its location. Google's Location History (enabled by default during initial phone setup, buried seventeen screens deep in Settings) records their route to campus. The city's traffic management system captures their phone's WiFi probe requests — short signals that phones emit when searching for known networks — to estimate pedestrian traffic density.

Jordan walks past two intersections with municipal traffic cameras. At one intersection, a newer camera equipped with automatic license plate recognition (ALPR) technology also captures pedestrian images, though the city's stated purpose for the cameras is "vehicle traffic flow optimization." Whether these images are stored, and for how long, is not specified in any publicly available policy document.

Jordan arrives on campus at 7:28 a.m. Their phone automatically connects to the university's WiFi network. The network authentication system logs their device's MAC address, the access point they connected to (which identifies their approximate building location), and the timestamp. This data is retained by the university's IT department for 180 days — a policy Jordan agreed to when they checked "I accept" during freshman orientation, along with 43 pages of other IT policies.

7:35 a.m. — Breakfast at the Dining Hall

Jordan swipes their student ID card at the dining hall. The point-of-sale system records: student ID number, timestamp, dining location, and meal plan deduction. If Jordan uses the self-service kiosk to order, additional data is captured: specific items selected, dietary modifications, and time spent browsing the menu.

Jordan sits down and scrolls Instagram for twelve minutes while eating. Instagram records: every post viewed (and for how many seconds), every story tapped through, every reel watched (and whether they watched to the end or scrolled past), every ad displayed (and whether Jordan paused on it), and the precise sequence of all these actions. This behavioral data — called an "engagement signal stream" in platform parlance — is processed in real time by Meta's recommendation algorithms and advertising auction systems.

9:00 a.m. — Class

Jordan arrives at their 9:00 a.m. Sociology lecture. The classroom is equipped with an iClicker system; Jordan's responses to three in-class polling questions are recorded, time-stamped, and linked to their student ID. The university's learning management system (Canvas) records that Jordan logged in at 9:04 a.m. and downloaded the day's lecture slides as a PDF.

The professor records attendance using the university's system. Jordan is marked "present." This attendance datum will be retained in university records for seven years after graduation, per state education data retention requirements.

10:30 a.m. — The Bookstore Shift

Jordan clocks in for their bookstore shift using a time-tracking app called When I Work. The app records their GPS coordinates at clock-in to verify they are physically at the store. During the shift, Jordan processes twelve transactions at the register. Each transaction generates data about the customer (card number, name, purchase amount, items, timestamp) and about Jordan (employee ID, register number, transaction speed, void/return rate).

During a quiet moment, Jordan uses their personal phone to check TikTok. TikTok records their content consumption patterns — which videos they watch, which they skip, which they watch twice, how they interact with comments. TikTok's algorithm updates Jordan's interest profile in real time, adjusting future content recommendations within minutes.

12:45 p.m. — Lunch and Errands

Jordan clocks out and buys lunch at a sandwich shop near campus using their debit card. Their bank records the transaction: merchant name, merchant category code (5812: "Eating Places, Restaurants"), amount ($9.47), timestamp, and terminal location. This transaction data is shared with the bank's fraud detection system, which runs the purchase through a machine learning model that compares it to Jordan's historical spending patterns.

Jordan walks to a pharmacy to pick up a prescription. The pharmacy records the medication dispensed (linked to their insurance ID, prescribing physician, and diagnosis code). This health data falls under HIPAA protections — one of the few data points in Jordan's day subject to sector-specific privacy regulation. Jordan also buys a bag of chips and a magazine at the pharmacy checkout; this non-prescription purchase is recorded by the pharmacy's point-of-sale system and linked to their loyalty card, which they signed up for two years ago for a 10% discount.

2:00 p.m. — Studying at the Library

Jordan studies at the university library for two hours. The library's access control system logs their entry via student ID card tap. The university's WiFi system tracks their device moving from the third-floor study area to the second-floor computer lab. Jordan logs into a library computer and accesses three academic databases — JSTOR, PubMed, and ProQuest — each of which logs their search queries, articles viewed, and downloads, linked to the university's institutional account.

Jordan also uses Google Scholar to find additional sources. Google logs these searches and adds them to Jordan's advertising profile — which now knows, among thousands of other data points, that Jordan is interested in "social media effects on political polarization."

5:15 p.m. — Evening

Jordan walks home. They order takeout through DoorDash, generating data about: their delivery address, phone number, food preferences, order history, payment method, tip amount, and the timestamp of each stage of the delivery process. DoorDash shares this data with the restaurant, the delivery driver (partially), and its own analytics and advertising systems.

Jordan settles in to watch Netflix. Over the course of three episodes of a documentary series, Netflix records: what they watched, when they paused, when they rewound, when they adjusted the volume, the device and screen resolution used, and whether they skipped the intro sequence. Netflix's algorithm processes this data to refine Jordan's recommendation profile and, in aggregate, to inform decisions about what content to produce next.

At 10:30 p.m., Jordan sets their phone alarm for 6:15 a.m. and puts on their Fitbit. The cycle begins again.

Analysis: The Data Flows

Volume and Scope

Over the course of this single Wednesday, Jordan interacted with approximately 35 to 40 distinct data-collecting systems operated by at least 25 different organizations. A conservative estimate places the number of individual data points generated at several thousand — and that excludes the continuous background data collection by their phone's operating system, advertising trackers embedded in apps and websites, and the passive sensors (cameras, WiFi sniffers, smart meters) that Jordan passed without interaction.

Who Collects What — A Mapping

Data Structure Analysis

The data generated in Jordan's day spans all three structural categories from Section 1.3:

• Structured data: Transaction records (bank, dining hall, bookstore POS), attendance logs, prescription records, time-clock entries. Each has defined fields and formats.
• Unstructured data: Camera images from traffic intersections, the content of Jordan's Google Scholar searches, audio if any smart speaker was involved, the actual content of posts Jordan viewed on Instagram.
• Semi-structured data: App engagement logs (JSON event streams from Instagram, TikTok, Netflix), Fitbit health data (structured fields but variable schemas across firmware versions), email metadata.

Stakeholder Mapping and Power Asymmetries

The Stakeholders

Jordan (the data subject): Generates the data. Has minimal knowledge of the scope of collection, almost no control over downstream use, and functionally zero bargaining power. Jordan's "consent" was given via terms-of-service agreements that no reasonable person reads in full. Jordan receives services (entertainment, convenience, employment tools) in exchange for data, but the exchange rate is opaque.

The university: Collects academic, behavioral, and location data. Operates under FERPA (Family Educational Rights and Privacy Act) for education records, but much of its data collection — WiFi tracking, dining patterns, library usage — falls into gray areas not clearly covered by FERPA. The university uses this data for operations, but increasingly also for "student success" analytics: predictive models that flag students at risk of dropping out, sometimes based on behavioral signals the students don't know are being monitored.

App and platform companies (Meta, Google, Spotify, Netflix, TikTok, DoorDash): Collect behavioral data at massive scale. Their business models depend on this data for advertising revenue and engagement optimization. They operate under general consumer protection law and, in some states, data privacy statutes — but enforcement is inconsistent and penalties are often minor relative to revenue.

Data brokers and advertising exchanges: Receive data from apps (especially location data from weather and utility apps) and aggregate it into comprehensive consumer profiles. Jordan has no direct relationship with these entities and likely does not know they exist.

Government entities: The city's traffic management system and campus security cameras collect data about Jordan's movements in public spaces. Law enforcement can potentially access much of Jordan's commercial data through subpoenas, court orders, or — in some cases — direct purchase from data brokers, circumventing warrant requirements.

The Power Asymmetry

The asymmetry in Jordan's data ecosystem is stark:

1. Information asymmetry. Jordan does not know what is collected, by whom, or for what purpose. The data collectors know precisely what they collect and why. This imbalance is structural, not accidental — privacy policies are written to satisfy legal requirements, not to inform users.

2. Bargaining asymmetry. Jordan cannot negotiate terms. The choice is binary: accept the terms or do not use the service. For many services — university WiFi, the campus dining system, employer time-tracking — there is no meaningful alternative.

3. Aggregation asymmetry. Each individual data collector sees a slice of Jordan's life. But through data sharing, brokering, and cross-platform tracking (especially within ecosystems like Google's or Meta's), companies can assemble comprehensive profiles that know more about Jordan's patterns and preferences than Jordan does.

4. Temporal asymmetry. Jordan lives in the present. Data collectors retain data for months, years, or indefinitely. Jordan's 2024 pharmacy purchase, 2023 Google searches, and 2022 location history can all be combined retroactively by anyone with access.

The Consent Gap

Consider the forms of "consent" Jordan has given:

• Terms of service: Accepted without reading. Written at a college reading level or above. Average length: 4,000-8,000 words per service. Jordan uses approximately 40 services. Total terms-of-service text Jordan would need to read: roughly 200,000 words — the length of two novels.
• Cookie banners: Clicked "Accept All" reflexively. The alternative ("Manage Preferences") requires navigating a multi-screen interface that takes 3-5 minutes per site.
• Default settings: Many data collection features (Google Location History, WiFi probe broadcasting, app tracking) were enabled by default. Disabling them requires technical knowledge Jordan does not have and navigation through settings menus designed to discourage changes.
• Implied consent: Jordan's presence on a public street is treated as consent to camera surveillance. Their phone's WiFi probe requests are captured without any consent mechanism at all.

None of this constitutes informed consent in any meaningful sense. Jordan has formally agreed to everything and genuinely understood almost nothing.

Discussion Questions

1. The analog test. Imagine Jordan's Wednesday in 1995 — before smartphones, before WiFi tracking, before streaming services. What data would still have been generated (bank transactions, library checkouts, attendance records)? What would not have existed at all? What has changed — the kind of surveillance, the scale, or both?

2. The "free" exchange. Jordan receives valuable services (navigation, entertainment, social connection, weather forecasts) in exchange for their data. Some argue this is a fair trade. Others argue Jordan cannot meaningfully evaluate the trade because they do not know what they are giving up. Where do you stand, and what information would you need to decide?

3. Stakeholder priorities. If you were redesigning the data ecosystem around Jordan's day, whose interests would you prioritize and why? Consider: Jordan's convenience and privacy, the university's operational needs, the companies' revenue models, and the government's public safety interests. Are there solutions that serve multiple stakeholders, or are the trade-offs irreducible?

4. The accumulation problem. No single data point from Jordan's Wednesday is, by itself, particularly sensitive. But in aggregate, the data paints a detailed portrait: where Jordan lives, works, and studies; their health conditions; their media consumption; their political interests; their financial status; their daily routine down to the minute. At what point does the accumulation of non-sensitive data become sensitive? Is there a principled way to draw that line, or is it inherently arbitrary?

Your Turn: Mini-Project

Option A: Map Your Own Day. Track your own data generation for a full day (or reconstruct yesterday from memory). For each data interaction, identify: (1) what data was collected, (2) by whom, (3) its type and structure, (4) the stated purpose, and (5) whether you meaningfully consented. Present your findings in a table like the one in this case study. Write a one-page reflection comparing your experience to Jordan's.

Option B: Stakeholder Analysis. Choose one data collector from Jordan's day (e.g., the university, DoorDash, or the city's traffic management system). Research their actual privacy policy and data practices. Write a two-page analysis: What do they collect? What do they disclose? What is left ambiguous? How would a reasonable person interpret the policy, and does that interpretation match reality?

Option C: The Redesign. Select three of the data collection points from Jordan's day and propose alternative designs that would achieve the same functional goals (e.g., meal plan management, content recommendations, traffic monitoring) while collecting significantly less personal data. For each, explain: What data would you eliminate? What would you keep? What functionality, if any, would be lost? Reference the concept of data minimization, which we will explore in depth in Chapter 10.

References

• boyd, danah. It's Complicated: The Social Lives of Networked Teens. New Haven: Yale University Press, 2014.

• Mayer-Schonberger, Viktor, and Kenneth Cukier. Big Data: A Revolution That Will Transform How We Live, Work, and Think. Boston: Houghton Mifflin Harcourt, 2013.

• Zuboff, Shoshana. The Age of Surveillance Capitalism: The Fight for a Human Future at the New Frontier of Power. New York: PublicAffairs, 2019.

• Nissenbaum, Helen. Privacy in Context: Technology, Policy, and the Integrity of Social Life. Stanford: Stanford University Press, 2010.

• Valentino-DeVries, Jennifer, Natasha Singer, Michael H. Keller, and Aaron Krolik. "Your Apps Know Where You Were Last Night, and They're Not Keeping It Secret." The New York Times, December 10, 2018.

• Fowler, Geoffrey A. "I Tried to Read All My App Privacy Policies. It Was 1 Million Words." The Washington Post, May 31, 2022.

• Stanford Internet Observatory. "The MetaPhone Study: Evaluating the Sensitivity of Phone Metadata." Stanford University, 2014.

• U.S. Department of Education. "Family Educational Rights and Privacy Act (FERPA)." 20 U.S.C. Section 1232g; 34 CFR Part 99.

• Federal Trade Commission. "Data Brokers: A Call for Transparency and Accountability." FTC Report, May 2014.