Personal data is collected by companies on a scale most people do not understand.
A full IELTS Writing Task 2 answer to this question, with a paragraph plan, ideas you can use, and the vocabulary that fits this topic.
The question
You should spend about 40 minutes on this task.
Personal data is collected by companies on a scale most people do not understand.
What problems result from this? What measures could be taken to protect people?
Give reasons for your answer and include any relevant examples from your own knowledge or experience.
Write at least 250 words.
How to read this question
The prompt itself contains the key: people do not understand the scale. That means consent is the mechanism that has failed, and solutions built on better consent — clearer notices, more checkboxes — are addressing the symptom. The strongest answers argue that the burden must move from the individual to the collector, which is a specific and defensible position rather than general unease about privacy.
Paragraph plan
Introduction — Paraphrase, then signpost: the problems are meaningless consent and inference from harmless-looking data; the solutions must shift responsibility away from the user.
Body 1 — Problems — nobody can read or evaluate what they agree to, and combined datasets reveal what was never disclosed.
Body 2 — Solutions — restrict collection by default, ban use beyond the stated purpose, and enforce with penalties large enough to alter behaviour.
Conclusion — Consent cannot carry this weight; the answer is to limit what may be collected, not to explain it better.
Model essay
Band 8.5–9.0 model essay
322 words
Companies now gather personal data on a scale that the average person scarcely comprehends. Nevertheless, certain measures could be taken to safeguard individuals from the resulting risks.
The principal danger stemming from extensive data collection is that individuals become vulnerable to exploitation without their knowledge. To clarify, companies frequently compile detailed profiles covering browsing habits, purchasing patterns and even physical location, which can then be sold to third parties or used to manipulate consumer behaviour through highly targeted advertising that exploits personal vulnerabilities, such as insecurities about appearance or finances. Beyond commercial exploitation, poorly secured databases are attractive targets for cybercriminals, and when breaches occur, sensitive information such as financial details or medical records can be exposed, exposing victims to identity theft and financial fraud that may take years to resolve, causing lasting damage to their credit history. Even seemingly minor data points, when combined across multiple platforms, can reveal intimate details about a person's habits, relationships and vulnerabilities that they never intended to disclose.
To protect the public from these risks, governments should enforce stringent data protection legislation that compels companies to obtain explicit, informed consent before collecting personal information, rather than burying such permissions within lengthy, unread terms and conditions. Regulators should also impose substantial financial penalties on organisations that fail to secure user data adequately, thereby incentivising stronger cybersecurity investment. In addition, public education campaigns could teach individuals practical steps to limit their digital exposure, such as adjusting privacy settings and avoiding unnecessary data sharing. Independent oversight bodies should also be empowered to audit corporate data practices regularly and impose sanctions where necessary. Companies should further be required to delete data that is no longer necessary for its original purpose, reducing the volume of information at risk in any single breach.
In conclusion, unchecked data collection exposes individuals to manipulation, fraud and privacy violations, but robust legislation, meaningful financial penalties and greater public awareness could considerably reduce these risks.
Created by a Band 8.5–9.0 IELTS Writing achiever — Premium. Sign up free to read the rest of this essay and unlock every model on the site.
This is a problem and solution question. The essay above shows you what a strong answer looks like when it is finished. What it cannot show you is how to get there from a blank page in forty minutes.
That is what our Writing Study Library is for: the structure we teach for this exact question type, the paragraph pattern that goes with it, and the sentence openers for each stage — so the essay is planned before you start writing rather than assembled as you go.
Introduction: Introduction — paraphrase that companies collect personal data on a scale most people do not understand, and note that measures could protect people.
Body 1: Body 1 — explain the problems: companies build detailed profiles used for exploitative targeted advertising, and poorly secured databases are targeted by cybercriminals, exposing victims to identity theft and financial fraud.
Body 2: Body 2 — explain the solutions: governments should enforce data protection legislation requiring informed consent, impose financial penalties for poor security, run public education campaigns, and empower oversight bodies to audit companies.
Conclusion: Conclusion — briefly summarise that unchecked data collection enables manipulation and fraud, but legislation, penalties and public awareness could reduce these risks.
Word or phrase
Meaning
Used in a sentence
personal data
information that identifies or relates to an individual
Companies now gather personal data on a scale that the average person scarcely comprehends.
detailed profiles
comprehensive records built about a person's habits and behaviour
companies frequently compile detailed profiles covering browsing habits, purchasing patterns and even physical location.
targeted advertising
adverts aimed specifically at individuals based on their data
used to manipulate consumer behaviour through highly targeted advertising that exploits personal vulnerabilities.
cybercriminals
people who commit crimes using computers or the internet
poorly secured databases are attractive targets for cybercriminals.
identity theft
the crime of using someone else's personal information fraudulently
exposing victims to identity theft and financial fraud that may take years to resolve.
data protection legislation
laws that regulate how personal information is collected and used
governments should enforce stringent data protection legislation.
informed consent
agreement given with full understanding of what is being agreed to
compels companies to obtain explicit, informed consent before collecting personal information.
privacy settings
controls that let users limit what personal information is shared
teach individuals practical steps to limit their digital exposure, such as adjusting privacy settings.
Created by a Band 8.5–9.0 IELTS Writing achiever — Premium. Sign up free to see the ideas and vocabulary for this topic and unlock every model on the site.
Answers checked here may be published on this page, without your name, to help other learners. Nothing else about you is stored.
Common questions
How do I use the wording of the prompt to build an argument?
Take its claim seriously and follow the consequence. Here, "people do not understand the scale" means consent cannot function — which immediately rules out solutions based on better explanation. Reading the prompt closely is frequently where the best essays find their thesis.
Is it acceptable to dismiss education as a solution?
Yes, if you give a reason and do not dismiss it entirely. Saying it has a modest role but misplaces responsibility onto the weakest party is evaluation. Simply ignoring an obvious remedy looks like an oversight.
Do I need technical knowledge of how data is collected?
No. Everyday examples — locations, purchases, how long you look at something — carry the argument completely. What matters is the reasoning about consent and inference, not familiarity with the technology.
