A version of this story ran earlier on sdcitytimes.com. Click here to read the original story in English and Spanish.
San Diego City College students rely on social media for everything from shopping and finding information to staying connected with friends, and a new tool offered in California is designed to keep them safer online.
The state’s Delete Request and Opt-out Platform, known as DROP, launched Jan. 1, 2026, giving Californians more control over their personal data. Once verified, users create a profile specifying which data they want deleted from data brokers, according to the California Privacy website.
Professor David Kennemer, director of the computer information systems program at City, said “students are prime targets for phishing scams”.
“Students often list their university, major and class schedules publicly,” Kennemer said. “A simple social media app update can reset privacy settings to public defaults, exposing personal information. A post about your pet’s name or your college becomes the key to building trust in a fraudulent message.”
Personal information allows scammers to create highly targeted phishing attacks. Phishing attacks are when fraudsters impersonate legitimate organizations to trick you into sharing sensitive data like passwords or credit card numbers.
Kennemer warned that fraudsters might pose as college administrators, financial aid officers or even classmates, using details from social media to make their requests for login credentials or payments appear legitimate.
According to the FBI’s Internet Crime Complaint Center, with phishing scams and digital fraud on the rise, student users are at risk of data breaches.
The San Diego Community College District’s IT department now requires multi-factor authentication for all student accounts.
In addition to Kennemer’s advice, students in California can now take advantage of DROP with an easy three-step process.
Under the California Delete Act, DROP allows users to create a profile with basic information and submit a deletion request.
Once registered with the DROP tool, registered data brokers must delete submitted data within 90 days. Users can also submit requests on behalf of children or elderly relatives.
The tool offers significant benefits for students concerned about their digital footprint.
By limiting the information data brokers collect and sell, DROP helps reduce unwanted texts, calls and spam.
Using DROP tool also decreases the risk of identity theft, fraud and AI-generated impersonations.
When your data stops getting sold, you have greater security against leaks and hacks, according to the Privacy website of the state of California.
For students, reducing their footprint is particularly beneficial as they navigate college applications, job searches and financial aid processes where personal data vulnerability is highest.
Kennemer suggests these additional five tips for securing user data.
1. Check privacy settings after every app update
In today’s digital world, updates occur regularly. It’s left to the consumer to check their digital privacy settings regularly.
“Application updates often restore default privacy configurations,” Kennemer said.
These defaults typically maximize data visibility for the company.
“You have to go back to privacy settings frequently,” Kennemer said.
A single update can alter permissions previously restricted. Consistent verification is the only way to maintain a preferred level of privacy.
This practice ensures personal information remains protected.
2. Use a web browser, not the mobile app
A web browser is the preferred method for safely accessing the web and provides access to a platform’s complete data usage policies.
Mobile applications often present abbreviated or simplified terms of service. The full legal documentation is typically available on the company’s website.
“You might have to go into a web browser … to find out exactly how they are using your data,” Kennemer said.
Important details about data use are often hidden. Checking on a computer gives a clearer view and helps students understand how their data is used and how to give informed consent.
3. Enable multi-factor authentication
The multi-factor authentication process requires a second form of verification after entering a password.
This is often a code sent to a phone or generated by an app. In the event a password was compromised, the account would remain secure.
Kennemer said enabling multi-factor authentication is the most important security step available to users.
It adds a critical layer of protection beyond just a password. Every major online platform now offers multi-factor authentication.
“Students should enable it for their email, social media and financial accounts. It is a simple step with a substantial security payoff,” Kennemer said.
DROP adds another layer by removing data at its source, preventing it from ever being sold to scammers in the first place.
4. Use a separate email address for social media
Students should create a unique email account used exclusively for social media. This isolates a primary personal email from a professional email address.
This strategy minimizes spam and phishing attempts in the primary inbox. It also limits the damage if a social media account is compromised.
Hackers cannot use that email to target other critical online accounts.
5. Change passwords regularly
Students are encouraged to change passwords regularly and avoid reusing them across all platforms.
Kennemer advised students to operate under the assumption that nothing is private. Any digital communication or post could potentially become public.
This mindset encourages more thoughtful and cautious online sharing.
For more information about how to keep your data safe, visit sos.fbi.gov/en/students.
