Privacy Manifesto

Preamble

The purpose of this manifesto is to encourage and guide development of tools that enhance and extend people's ability to protect and project their privacy in the online world. We have used such tools in the natural world for as long as we've had the privacy technologies called clothing and shelter, and social norms for signaling and respecting personal intentions around privacy. We don't have those yet the online world, which most of us have inhabited for less than two decades.

In the absence of those technologies and norms, it is so easy for others to violate our personal privacy that to do so has become worse than rampant: it is normalized by a lucrative and easily rationalized business model that Shoshana Zuboff calls surveillance capitalism. Among its worst effects are what Brett Frishman and Evan Selinger call "re-engineering humanity."

So far, most work toward personal privacy in the online world is by and for governments and potential abusers. Not by and for ourselves. That work is all toward protecting us from abuse, or toward assuring us that we won't be abused. The government work is regulatory, and the private work is mostly toward complying with (or, more commonly, working around) regulatory protections.

Nearly all companies now have two ways of protecting the personal privacy of their users and customers, or at least promising to. One is through privacy policies. These are not agreements. Companies can also change them at any time and without notice. They are therefore no substitute for individuals' ability to protect and project their privacy intentions at scale: graces which all of us have in the natural world. The other is through terms and conditions to which users and customers might agree, and are proffered most commonly by "notice and consent" banners on websites. These are all one-sided contracts of adhesion over which individuals have no control, and no way to record or audit.

Neither government protections nor corporate privacy policies and terms will give individuals means of their own for protecting and projecting their privacy online. For that we need personal privacy tech, and standards supporting that tech. Hence this manifesto.

Manifesto

1. Privacy is personal. Technically speaking, it's a root right.
2. Privacy is also social and legal, but it is personal first.
3. We each experience privacy as a state: an essential feature of personal sovereignty, independence and agency.
4. Privacy is also a possession as personal as one's own body organs, and just as essential.
5. To control one's privacy is to selectively conceal, disclose or project information about one's self outward into the world — and to obtain respect from others for that.
6. Privacy is no less a right than those to life, liberty and the pursuit of happiness. (The right to privacy is also recognized in Aricle 12 of the United Nations' Universal Declaration of Human Rights.)
7. Our agency —the ability to act with effect in the word — depends on maintaining and managing our privacy. (We operate at full agency, for example, when we tie our shoes, ride a bike, write something down or drive a car.)
8. Privacy starts with what others don't know about us. To strangers we present first as human, but also as anonymous: literally nameless.
9. Getting to know another person is to experience selective control of personal privacy by both parties.
10. Through anonymity, personal privacy is a public grace. It's why we don't wear a name badge when we walk down a city street.
11. It helps everyone not to know private information about everyone we each see or meet.
12. Not knowing much about most other people is an economic and political grace as well as a social one.
13. All social, economic and political graces arising from personal privacy require personal independence, sovereignty and agency over what others can know about us, even though our control is far short of absolute.
14. Having control over what we selectively disclose to others, in ways we can generally trust, allows social norms to grow around how privacy works. Though these norms differ by culture, they exist in all cultures.
15. Like nature, the Internet came without privacy.
16. The first privacy technologies we invented in the natural world were clothing and shelter. We did this when we first became human, dozens of millennia ago.
17. The Internet we have today is barely more than two decades old, and we still lack the online equivalents of clothing and shelter. This is why most of us are still as naked and exposed on the Internet as we were in Eden. It's also why it has been easy for businesses and governments to exploit our exposed selves.
18. It is now the norm — even in the presence of laws clearly forbidding it — for nearly every commercial website we visit to plant tracking beacons in our devices, so our lives can be examined and exploited by companies and governments that extract personal data and manipulate our lives for their purposes. This diminishes our agency and is an affront to our personal dignity.
19. These problems must be solved with personal tech and standards supporting it. They cannot be solved only by government regulations and corporate privacy policies. We fully need technologies and methods for establishing private spaces for ourselves online, and for ways to signal others about what is acceptable in respect to our privacy, and what is not.
20. We each need to be able to operate privately at scale in the online world. This means we require standardized codes, protocols and practices that work the same for every entity we deal with. This shouldn't be hard. The common protocols of the Net and the Web (TCP/IP, HTTP/S, IRC, FTP, et. al.) give us a good base to build on, and a good model for how scale can work for each of us.
21. New laws and regulations for protecting personal privacy online (e.g. the GDPR and ePrivacy in the E.U. and A.B. 375 in California) were instituted in the absence of the personal privacy technologies and norms we should have had first. Thus they put the regulatory cart in front of the technology horse. Worse, they all rely on "notice and consent," a system by which the site or service is always the first party, issuing a "notice" to which the individual must "consent." This requires that the individual must always be the second party to all agreements involving consent. Besides locking individuals into countless subordinate roles, each controlled by others, this offends the peer-to-peer nature of the Internet itself.
22. Worse, because these laws and regulations are being developed in the absence of personal privacy tech and norms, they presume that human beings have no personal agency beyond "choices" provided by others (usually persisting as a record only in the form of cookies they give our browsers to carry around, many communicating to sites that the individual has "consented" to some "notice"). As long as that remains the status quo, we will have no true personal privacy online.
23. Even if today's online privacy laws are enforced, none will give us privacy any more than laws against indecent exposure will give us clothing. We need tech of our own.
24. Technologies and services that address corporate demand for claiming "GDPR compliance" (mostly obtaining "consents" through "this site uses cookies" notices that mask the site's true intent: to continue tracking people for marketing purposes), facilitate obedience to the letter the GDPR while still violating its spirit.
25. While "Privacy by Design" is good guidance for organizations, it doesn't address individuals' need to create privacy for themselves, using their own privacy tech.
26. The United States Federal Trade Commission's fair information practice principles (FIPPs), which date back to this list of rights from a July 1973 U.S. Government report also provides good guidance, as does [EPIC.org https://epic.org/privacy/consumer/code_fair_info.html]: • There must be no personal data record-keeping systems whose very existence is secret. • There must be a way for a person to find out what information about the person is in a record and how it is used. • There must be a way for a person to prevent information about the person that was obtained for one purpose from being used or made available for other purposes without the person's consent. •There must be a way for a person to correct or amend a record of identifiable information about the person. • Any organization creating, maintaining, using, or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take precautions to prevent misuses of the data. To those we add,
27. There must be ways for individuals to secure and exercise all those rights, using standard and well-understood tools of their own.
28. We do have some early forms of tech to work with, such as crypto, onion routing, PKI and VPNs. But those are too few, and (with the exception of VPNs) too hard for non-experts to use. None yet give us what clothing and shelter afford in the natural world: lots of ways, easily available to everyone, for concealing and exposing private spaces selectively, signaling how we want those private spaces respected, making clear what information we would like others to keep secret or to reveal (and to whom) — and for keeping track of agreements about all those things.
29. The challenge then, for all tech developers, is to create personal privacy technologies, and means for establishing and enforcing norms based on those technologies.
30. Those technologies need to be, at their base, free and open.
31. When Archimedes said, "Give me a place to stand, and I can move the earth," he was talking about a place that did not exist in his time, but does in ours. That place is the Internet. TCP/IP, the free and open protocol at the Internet's base, is a fulcrum sturdy enough to make everyone an Archimedes, given the right levers. Our mission is to provide those levers.
32. None of those levers can be imagined without standing on the side of the individual, and without personal privacy as the first consideration.

Calls to Action

As with all free and open source code, every word in this manifesto is provisional and subject to improvement.

The first draft appeared at London Trust Media, here, and continues to improve off drafts on this page. As will others, we hope. To encourage that, the manifesto is open source dedicated to the public domain through Creative Commons licence CC0.

One way to contribute at this stage (in early 2019) is to post comments at the London Trust Media site through Coral, an open source commenting platform. Members of ProjectVRM with editing powers can also work on this copy of the manifesto, in this wiki, or by contributing through the ProjectVRM mailing list.

— Doc Searls