Privacy is Personal
You can’t get more private than I am right now: in a locked room, alone, unconnected to anything.
Privacy is personal. It’s not a service provided by somebody else. It’s not an agreement with a “provider,” or with anyone. And it won’t be until someone knocks on my door.
The room, the door and its lock are all privacy technologies. So are the clothes I am wearing. If I choose to let a person into my room, I am still being private about the parts of my body concealed by my clothes.
Since I’m living in a world that has been civilized for many generations, the signals sent to others by the privacy technologies I use—starting with shelter and clothing—are respected. Nobody (even my wife) comes through my closed door without knocking, and nobody plants a tracking beacon inside my clothes so they or their friends can follow me like a marked animal as I go about my life.
It’s essential to recognize the personal nature of privacy, because in the online world we still lack the equivalents of shelter and clothing, so those are still on the punch list of requirements for civilizing that world.
Meanwhile, for lack of civilization online, great advantages are taken of our inability to create private spaces for ourselves, and to signal what’s okay and what’s not okay, to help others respect those spaces. This is why, for example, most ad-supported websites today plant tracking beacons in our browsers. They can, so they do.
Still, tracking somebody without a personal invitation or a court order is wrong on its face. It can’t be excused because it’s easy, because it supports better analytics, because it might provide a better “advertising experience,” or because the site operator can’t find another way to make money. Privacy is just as personal in the online world as it is in the offline one, and violating one’s privacy in the online world is just as wrong as well.
To truly create privacy in the online world, developers need to make privacy technologies for individuals that scale, just as developers in bygone millenia did with shelter and clothing in the offline world.
Scale means an individual should be able to create privacy for herself that works the same everywhere she goes, and to signal what’s okay in ways that can be understood and obeyed in the same ways by all the websites she visits and all the services she engages online.
Providing privacy should not be a grace of others’ service terms and privacy policies. That not only prevents scale for individuals, but does so to a degree that is ludicrous in the extreme: it’s like requiring everybody to speak a different language for every entity they deal with. It also causes large social, legal and economic frictions for everyone involved.
This is why there is no job more important for developers today than providing individuals with privacy technologies that scale, and means for signaling personal privacy policies and intentions that scale as well.
Laws and regulations at this stage won’t do it. Worse, they put the regulatory cart in front of both the technology horse and the norms that follow widespread technology use. For lack of personal privacy technologies and norms, laws such as the the EU’s GDPR and California’s SB 315 presume little or no personal agency, and thus insist that personal privacy be only provided by others. These laws risk removing more personal agency than they might have secured, had we developed the personal privacy technologies first.
Early personal privacy technologies such as crypto, PKI, VPNs and onion routing are necessary but insufficient. We need to think and work long, hard and well to create privacy as complete and useful online as it is offline.
NOTE: This is the first in a series of blog posts I’ll be writing here, to accompany a Privacy Manifesto that is also in the works. Stay tuned for the rest. In the meantime, I welcome all the positive input you can provide in the comment section below. Thanks.
