EFFecting Digital Freedom
by Jason Kelley
You Are Not Being Tracked
On the surface, EFF's website looks pretty much like other sites out there. But underneath the hood, there's a major difference: we aren't tracking you.
The same is true of emails we send out. EFF doesn't include pixel tracking or other embedded trackers to record who opens which emails. And while much of the tech world is busy thinking up new ways to collect your data, we don't intend to change any of these privacy practices. In fact, we think the time is right for every other privacy-focused individual and organization to join us - and that means you, too.
Instead of granular tracking, EFF collects aggregate, anonymized data of our web traffic. This involves very limited logging, but still lets us know, for example, if a lot of traffic is coming from a particular country, or a particular website. We occasionally use session cookies, as well, where it makes sense to do so (for example, when the user is logged in). And we will use logs with full IPs when responding to an attack or technical problem, but unless absolutely necessary even those logs are aggregated and anonymized after seven days. And, with consent, we do get and retain voluntarily provided information about specific users, like our supporters' addresses (when they want to give them - anonymous donations are fine too!). You can read all of what we do in our clear Privacy Policy at www.eff.org/policy.
"Doesn't this make your work harder?" you may be asking. At times, yes, this lack of info on our users makes our work very slightly more difficult. We rely on donors like you to support our work, and as an advocacy organization, we rely on digital activism to get the word out. Having easy access to detailed analytics data about the visitors to our website or the readers of our emails could help us do both of these things. But that would require us to collect large amounts of data about our users, supporters, and followers, and we don't believe the tradeoff is worth it.
Despite this limited data, EFF is an active, growing, and successful organization that's been around for 31 years. And we aren't alone: plenty of other organizations, like the Internet Archive and companies like Basecamp, walk the talk by collecting much more limited data than is common. And we'd like to pose a challenge to others who care about user privacy: turn off overbroad tracking.
For 31 years, EFF has fought to protect the rights of the user - the person who's making use of a technology such as a website, a computer, or a smartphone. Tracking those users, by and large, benefits the company, person, or organization doing the tracking, if at all, not the user on the other end of the technology. Fighting for the user means giving them the control to not be tracked, to remain anonymous or private, and to not have their data collected without their permission. This is even more essential when the technologies are common and extraordinarily popular, like email and the web.
Many companies suggest that pervasive tracking is beneficial for users, because it allows them to be targeted for things that they care about. But this argument robs users of their consent. It assumes that people want to be tracked by default. EFF assumes people do not want to be tracked by default. This argument also sidesteps the fact that despite the vast amount of personal information companies collect, they still use this data to derive conclusions that are inaccurate or wrong.
The same is true for the argument that pervasive tracking, for instance, of your email interactions allows an organization to send you better, more effective, perhaps even more personalized emails in the future. This may be true at some level; but this digital tea reading, even when it "works," represents an invasion of privacy that privacy advocates should not take part in. And in a worst case scenario, it could expose your readers' private information to unexpected third-parties.
The slow, steady, relentless accumulation of thousands of data points about how we live our lives is a serious threat to our privacy. It can reveal political affiliation, religious belief, sexual identity and activity, race and ethnicity, education level, income bracket, purchasing habits, and physical and mental health. And unfortunately, due to the way that tracking and ad tech works, much of the data collected is often rolled up into a much more detailed profile about a user - even when it's collected by a single website or organization.
But it doesn't have to be that way. If you are building any sort of technology, consider whether or not your users would appreciate being tracked. The answer, we believe, is almost always no. And if the answer is yes, ask for user consent for any tracking you might do. Again, we believe that your users will appreciate this - and that this is their right.
Of course, the problem isn't just yours to solve. Companies that provide analytics tools, content management services, and mailing list management don't offer nearly enough privacy-protecting options, and we believe that's a big part of the issue. It's an insidious ecosystem that needs to be reformed, and along with other advocacy organizations, legislators, and activists like you, we can do it.
On an individual level, the easiest way to get started protecting your users' privacy is to think about what data you actually use. If you would be satisfied with anonymous, aggregate data about your website visitors (we are), or getting general insights about email usage rather than granular data about each recipient, there are options out there. We'll be working on recommendations in the coming months to make it easier for you to switch to more privacy-protecting options. For now, we hope you'll join us in turning off any granular tracking, and letting everyone using your services or technology know: you are not being tracked. Be clear about the data you collect - and why. You'll win points with your users, and you'll help us all move the needle one step closer to a better, privacy-conscious online future.