Privacy Manifesto

Preamble

The purpose of this manifesto is to encourage and guide development of tools that enhance and extend people's ability to protect and project their privacy in the online world. We have used such tools in the natural world for as long as we've had the privacy technologies called clothing and shelter, and social norms for signaling and respecting personal intentions around privacy. We don't have those yet the online world, which most of us have inhabited for less than two decades.

In the absence of those technologies and norms, it is easy for those with power to violate our personal privacy, and to rationalize those violations as well. In fact it is so easy to do both that violating privacy has become worse than rampant: it is normalized by a lucrative and easily rationalized business model that Shoshana Zuboff calls surveillance capitalism, and by degrees of government surveillance which in some countries validate Orwell's worst fears. The effect of both is what Brett Frishman and Evan Selinger call "re-engineering humanity."

So far, most work toward creating personal privacy online is being done by two groups: 1) governments and 2) potential abusers in the private sector. Not by or for ourselves. The government work is regulatory, and the private sector work is mostly toward complying with (or, typically, working around) regulatory protections.

Nearly all companies have two ways to claim they protect the personal privacy of their users and customers. One is through privacy policies, which are easy for companies both to ignore and to change at any time and without notice. The other is through one-sided terms, proffered most commonly by "notice and consent" banners on websites and detailed in thousands of words in legalese. When conditions are offered, they are nearly always opt-out, and always provide no way for the individual to record or later audit for themselves. Terms and conditions are also as numerous and different as the websites we visit as well. There is also no way to improve this regime on its own. As long as all forms of agency respected by regulation are on the potential violators' side, all regulation can do is make those violations less bad.

The simple fact is that we need new forms of agency on our side, for each of us as individuals: privacy tech, and standards supporting that tech. Hence this manifesto.

Manifesto

1. Privacy is personal. Technically speaking, it's a root right.
2. Privacy is also social and legal, but it is personal first.
3. We each experience privacy as a state: an essential feature of personal sovereignty, independence and agency.
4. Privacy is also a possession as personal as one's own body organs, and just as essential.
5. To control one's privacy is to selectively conceal, disclose or project information about one's self outward into the world — and to obtain respect from others for that.
6. Privacy is no less a right than those to life, liberty and the pursuit of happiness. (The right to privacy is also recognized in Aricle 12 of the United Nations' Universal Declaration of Human Rights.)
7. Our agency —the ability to act with effect in the word — depends on maintaining and managing our privacy. (We operate at full agency, for example, when we tie our shoes, ride a bike, write something down or drive a car.)
8. Privacy starts with what others don't know about us. To strangers we present first as human, but also as anonymous: literally nameless.
9. Getting to know another person is to experience selective control of personal privacy by both parties.
10. Through anonymity, personal privacy is a public grace. It's why we don't wear a name badge when we walk down a city street.
11. It helps everyone not to know private information about everyone we each see or meet.
12. Not knowing much about most other people is an economic and political grace as well as a social one.
13. All social, economic and political graces arising from personal privacy require personal independence, sovereignty and agency over what others can know about us, even though our control is far short of absolute.
14. Having control over what we selectively disclose to others, in ways we can generally trust, allows social norms to grow around how privacy works. Though these norms differ by culture, they exist in all cultures.
15. Like nature, the Internet came without privacy.
16. The first privacy technologies we invented in the natural world were clothing and shelter. We did this when we first became human, dozens of millennia ago.
17. The Internet we have today is barely more than two decades old, and we still lack the online equivalents of clothing and shelter. This is why most of us are still as naked and exposed on the Internet as we were in Eden. It's also why it has been easy for businesses and governments to exploit our exposed selves.
18. It is now the norm — even in the presence of laws clearly forbidding it — for nearly every commercial website we visit to plant tracking beacons in our devices, so our lives can be examined and exploited by companies and governments that extract personal data and manipulate our lives for their purposes. This diminishes our agency and is an affront to our personal dignity.
19. These problems must be solved with personal tech and standards supporting it. They cannot be solved only by government regulations and corporate privacy policies. We fully need technologies and methods for establishing private spaces for ourselves online, and for ways to signal others about what is acceptable in respect to our privacy, and what is not.
20. We each need to be able to operate privately at scale in the online world. This means we require standardized codes, protocols and practices that work the same for every entity we deal with. This shouldn't be hard. The common protocols of the Net and the Web (TCP/IP, HTTP/S, IRC, FTP, et. al.) give us a good base to build on, and a good model for how scale can work for each of us.
21. New laws and regulations for protecting personal privacy online (e.g. the GDPR and ePrivacy in the E.U. and A.B. 375 in California) were instituted in the absence of the personal privacy technologies and norms we should have had first. Thus they put the regulatory cart in front of the technology horse. Worse, they all rely on "notice and consent," a system by which the site or service is always the first party, issuing a "notice" to which the individual must "consent." This requires that the individual must always be the second party to all agreements involving consent. Besides locking individuals into countless subordinate roles, each controlled by others, this offends the peer-to-peer nature of the Internet itself.
22. Worse, because these laws and regulations are being developed in the absence of personal privacy tech and norms, they presume that human beings have no personal agency beyond "choices" provided by others (usually persisting as a record only in the form of cookies they give our browsers to carry around, many communicating to sites that the individual has "consented" to some "notice"). As long as that remains the status quo, we will have no true personal privacy online.
23. Even if today's online privacy laws are enforced, none will give us privacy any more than laws against indecent exposure will give us clothing. We need tech of our own.
24. Technologies and services that address corporate demand for claiming "GDPR compliance" (mostly obtaining "consents" through "this site uses cookies" notices that mask the site's true intent: to continue tracking people for marketing purposes), facilitate obedience to the letter the GDPR while still violating its spirit.
25. While "Privacy by Design" is good guidance for organizations, it doesn't address individuals' need to create privacy for themselves, using their own privacy tech.
26. The United States Federal Trade Commission's fair information practice principles (FIPPs), which date back to this list of rights from a July 1973 U.S. Government report also provides good guidance, as does [EPIC.org https://epic.org/privacy/consumer/code_fair_info.html]: • There must be no personal data record-keeping systems whose very existence is secret. • There must be a way for a person to find out what information about the person is in a record and how it is used. • There must be a way for a person to prevent information about the person that was obtained for one purpose from being used or made available for other purposes without the person's consent. •There must be a way for a person to correct or amend a record of identifiable information about the person. • Any organization creating, maintaining, using, or disseminating records of identifiable personal data must assure the reliability of the data for their intended use and must take precautions to prevent misuses of the data. To those we add,
27. There must be ways for individuals to secure and exercise all those rights, using standard and well-understood tools of their own.
28. We do have some early forms of tech to work with, such as crypto, onion routing, PKI and VPNs. But those are too few, and (with the exception of VPNs) too hard for non-experts to use. None yet give us what clothing and shelter afford in the natural world: lots of ways, easily available to everyone, for concealing and exposing private spaces selectively, signaling how we want those private spaces respected, making clear what information we would like others to keep secret or to reveal (and to whom) — and for keeping track of agreements about all those things.
29. The challenge then, for all tech developers, is to create personal privacy technologies, and means for establishing and enforcing norms based on those technologies.
30. Those technologies need to be, at their base, free and open.
31. When Archimedes said, "Give me a place to stand, and I can move the earth," he was talking about a place that did not exist in his time, but does in ours. That place is the Internet. TCP/IP, the free and open protocol at the Internet's base, is a fulcrum sturdy enough to make everyone an Archimedes, given the right levers. Our mission is to provide those levers.
32. None of those levers can be imagined without standing on the side of the individual, and without personal privacy as the first consideration.

Calls to Action

As with all free and open source code, every word in this manifesto is provisional and subject to improvement.

The first draft appeared at London Trust Media, here, and continues to improve off drafts on this page. As will others, we hope. To encourage that, the manifesto is open source dedicated to the public domain through Creative Commons licence CC0.

One way to contribute at this stage (in early 2019) is to post comments at the London Trust Media site through Coral, an open source commenting platform. Members of ProjectVRM with editing powers can also work on this copy of the manifesto, in this wiki, or by contributing through the ProjectVRM mailing list.

— Doc Searls