# The Nexus Of Privacy > Technology. Policy. Strategy. Justice. Public Ghost content for AI and LLM tooling. This file includes a bounded export of public pages first, then recent public posts. Append `.md` to any post or page URL to get the content in Markdown (for example, `/example-post.md`). ## Pages ### About this site URL: https://thenexusofprivacy.net/about/ Last updated: 2026-09-13T19:15:32.000Z The Nexus of Privacy is an independent publication launched in September 2026 by Jon. If you subscribe today, you'll get full access to the website as well as email newsletters about new content when it's available. Your subscription makes this site possible, and allows The Nexus of Privacy to continue to exist. Thank you! ### Access all areas By signing up, you'll get access to the full archive of everything that's been published before and everything that's still to come. Your very own private library. ### Fresh content, delivered Stay up to date with new content sent straight to your inbox! No more worrying about whether you missed something because of a pesky algorithm or news feed. ### Meet people like you Join a community of other subscribers who share the same interests. --- ### Start your own thing Enjoying the experience? Get started for free and set up your very own subscription business using [Ghost](https://ghost.org/?ref=thenexusofprivacy.net), the same platform that powers this website. ### About The Nexus of Privacy URL: https://thenexusofprivacy.net/about-2/ Last updated: 2026-05-21T06:07:55.000Z The Nexus Of Privacy looks at the connections between technology, policy, strategy, and justice. We launched in the "hot privacy summer" of 2022 – just in time for discussions of federal privacy and anti-trust legislation, the Supreme Court's Dobbs decision, a potential FTC rulemaking, and so much more. In 2023, we covered (and testified and organized in support of) Washington state's passage of My Health My Data, in many ways the strongest consumer privacy bill in the country. Since then, we've also focused extensively on decentralized social networks, including Mastodon and Bluesky. Please check back from time to time to see what strikes your interest – or even better, subscribe to get email updates! ### On Social Networks The Nexus of Privacy is also present on several social networks: - [@thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) and [@thenexusofprivacy@gotosocial.thenexus.today](https://gotosocial.thenexus.today/@nexusofprivacy?ref=thenexusofprivacy.net) on the Fediverse - [@thenexusofprivacy.net](https://bsky.app/profile/thenexusofprivacy.net?ref=thenexusofprivacy.net) on Bluesky - [@thenexusofprivacy@lemmy.blahaj.zone](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net) and [the Nexus of Privacy community](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net) in the Threadiverse - Our [Dreamwidth community](https://thenexusofprivacy.dreamwidth.org/?ref=thenexusofprivacy.net). Dreamwidth is a great place for discussions, although the user experience is very old-school (think mid-2000s LiveJournal). - [@nexusofprivacy](https://twitter.com/NexusOfPrivacy/?ref=thenexusofprivacy.net) on Twitter, where we still very occasionally post ### About me I'm Jon Pincus, a software engineer / strategist / activist. I've written extensively about privacy activism for over a dozen years – as well as focusing on the intersection of software engineering, justice, and equity. I've also been involved with, and often helped to lead, activism campaigns from Stop Real ID Now and Get FISA Right in the mid-2000s through the multi-year privacy legislation battle here in Washington state. [More details here](https://thenexusofprivacy.net/about-me). You can reach me by email (nexus-of-privacy@thenexus.today), or social networks including [Twitter](http://twitter.com/jdp23?ref=thenexusofprivacy.net); [Dreamwidth](http://jdp23.dreamwidth.org/?ref=thenexusofprivacy.net); Mastodon at [@jdp23@indieweb.social](https://indieweb.social/@jdp23?ref=thenexusofprivacy.net), [@jdp23@hci.social](https://hci.social/@jdp23?ref=thenexusofprivacy.net), [@jon@scholar.social](https://scholar.social/@jon?ref=thenexusofprivacy.net), [@jdp23@toot.cat](https://toot.cat/@jdp23?ref=thenexusofprivacy.net) and [oulipo.social](https://oulipo.social/@jdp23?ref=thenexusofprivacy.net)[social.treehouse.systems](https://social.treehouse.systems/@jdp23?ref=thenexusofprivacy.net)[kolektiva.social](https://kolektiva.social/@jdp23?ref=thenexusofprivacy.net)[pnw.zone](https://pnw.zone/@jdp23?ref=thenexusofprivacy.net) [democracy.town](https://democracy.town/@jdp23?ref=thenexusofprivacy.net) [mastodon.social](https://mastodon.social/@jdp23?ref=thenexusofprivacy.net) [projectmushroom.social](https://projectmushroom.social/@jdp23?ref=thenexusofprivacy.net)[spore.social](https://spore.social/@jdp23?ref=thenexusofprivacy.net) [techpolicy.social](https://techpolicy.social/@jdp23?ref=thenexusofprivacy.net) [mastodon.sdf.org](https://mastodon.sdf.org/@jdp23?ref=thenexusofprivacy.net) elsewhere; Diaspora at [diasp.org](https://diasp.org/u/jdp23?ref=thenexusofprivacy.net); [Facebook](http://www.new.facebook.com/profile.php?id=623727023&ref=thenexusofprivacy.net) [LinkedIn](http://www.linkedin.com/in/jdp23?ref=thenexusofprivacy.net); and a bunch of other social networks that I've mostly forgotten the passwords to. ### Licensing ![Creative Commons BY NC SA](https://thenexusofprivacy.net/content/images/2022/06/cc-by-nc-sa.png) Unless otherwise noted, all original work on this site is copyright Jon Pincus and licensed under a [Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License](http://creativecommons.org/licenses/by-nc-sa/4.0/?ref=thenexusofprivacy.net). You are free to - **Share** — copy and redistribute the material in any medium or format - **Adapt** — remix, transform, and build upon the material Under the following terms: - **Attribution** — You must give [appropriate credit](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net), provide a link to the license, and [indicate if changes were made](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net). You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use. - **NonCommercial** — You may not use the material for [commercial purposes](https://creativecommons.org/licenses/by-nc-sa/4.0/?ref=thenexusofprivacy.net). - **ShareAlike** — If you remix, transform, or build upon the material, you must distribute your contributions under the [same license](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net) as the original. - **No additional restrictions** — You may not apply legal terms or [technological measures](https://creativecommons.org/licenses/by-nc-sa/4.0/?ref=thenexusofprivacy.net) that legally restrict others from doing anything the license permits. ### About me URL: https://thenexusofprivacy.net/about-me/ Last updated: 2025-01-28T03:50:51.000Z I’m a [software engineer](https://medium.com/a-change-is-coming/sex-pleasure-and-diversity-friendly-software-the-article-the-acm-wouldnt-publish-19ebc34175d4?ref=thenexusofprivacy.net) / [entrepreneur](https://archive.seattletimes.com/archive/?date=19990728&slug=2974345&ref=thenexusofprivacy.net) / [strategist](https://www.quora.com/How-did-Jon-Pincus-oppression-theory-project-at-Microsoft-go?ref=thenexusofprivacy.net) and [activist](https://docs.google.com/presentation/d/e/2PACX-1vQc0m3OCs6TjgZJcb64dKhLR6NB5Zz0gceMSDSx2izmCahcUuFTU2UAOPPFE0aSsGEGwYWYf-93cYgg/pub?start=false&loop=false&delayms=3000&ref=thenexusofprivacy.net) who focuses on justice, equity, diversity, inclusion, and intersectionality. As well as running [The Nexus of Privacy newsletter](https://thenexusofprivacy.net/), I also consult for and advise tech companies on strategy and software engineering, and was a member of the 2022 [Washington state Automated Decision-Making Systems Workgroup](https://app.leg.wa.gov/ReportsToTheLegislature/Home/GetPDF?fileName=Automated%20Decision%20Systems%20Workgroup%20Report%5Fa1946676-3de2-4a8e-929d-b4b8a689a49d.pdf&ref=thenexusofprivacy.net). For the last fifteen years, my research focus has been on re-imagining [computer science as a social science](http://talesfromthe.net/jon/?p=113&ref=thenexusofprivacy.net). [Sex, pleasure, and diversity-friendly software: the article the ACM wouldn’t publish](https://medium.com/a-change-is-coming/sex-pleasure-and-diversity-friendly-software-the-article-the-acm-wouldnt-publish-19ebc34175d4?ref=thenexusofprivacy.net) gives an overview of work combining an intersectional diversity perspective with classic software engineering approaches – and the institutional barriers this kind of work tends to encounter. [Diversity-friendly software and strategy](https://medium.com/a-change-is-coming/diversity-friendly-software-and-strategy-at-techinclusion-seattle-216adcacf780?ref=thenexusofprivacy.net) (from TechInclusion Seattle) is a short overview with links out to more. [The 2017 SXSW presentation,](https://medium.com/a-change-is-coming/diversity-friendly-software-at-sxsw-2017-references-c0ca05a191a6?ref=thenexusofprivacy.net#.r106e1ylk) with Shireen Mitchell, goes into detail. Other related work includes [Transforming Tech with Diversity-friendly software](https://medium.com/@jdp23/transforming-tech-with-diversity-friendly-software-338f56d91df?ref=thenexusofprivacy.net) (from TRANSform Tech), a trio of collaborative presentations at the Open Source Bridge conference with Deborah Pierce, Lynn Cyrin, and Tammarrian Rogers, and the resource page on [Gender HCI, Feminist HCI, Post-Colonial Computing, Anti-Oppressive Design, and Design Justice](https://medium.com/a-change-is-coming/gender-hci-feminist-hci-and-post-colonial-computing-f955a4054c89?ref=thenexusofprivacy.net). Since 2017, I've looked at how these concepts play out on decentralized social networks such as the "fediverse." [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/) and [Eight tips about consent for fediverse developers](https://thenexusofprivacy.net/consent-for-fediverse-developers/) are two recent examples; past highlights include [Lessons (so far) from Mastodon](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=privacy.thenexus.today), [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history/), [Black Twitter, quoting, and white views of toxicity on Mastodon](https://thenexusofprivacy.net/black-twitter-quoting-and-white-toxicity-on-mastodon/), [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/). Previous work includes - Creating the static analysis tools PREfix and PREfast as founder and CTO of venture-funded startup Intrinsa (acquired by Microsoft in 1999) and then at Microsoft Research, where I was part of a team that won the prestigious “President’s Award” for our industry-leading static analysis work. - Security planning, research, and company-wide culture change with the Microsoft Windows Security Push and XPSP2 task forces. The project I led analyzing and recommending for mitigations to reduce exploitation of buffer overruns helped make SP2 the most secure commercial operating system of its time; the attack surface reduction work I did with Mike Howard and Jeannette Wing helped lead to a broadly-used internal tool that got shipped to customers a decade later. - Leading the [Ad Astra (Analysis and Development of Awesome STRAtegies)](https://www.quora.com/How-did-Jon-Pincus-oppression-theory-project-at-Microsoft-go?ref=thenexusofprivacy.net) project as General Manger for Strategy Development in Microsoft’s Online Services Group, at the time the only multi-million dollar oppression theory project done at a Fortune 500 company in conjunction with McKinsey. The [strategic principles](http://original.achangeiscoming.net/e-luminatus/index.php?title=Ad%5FAstra%5Fstrategic%5Fprinciples&ref=thenexusofprivacy.net) have held up well. [“A very special Ad Astra holiday”](http://www.talesfromthe.net/jon/?p=39&ref=thenexusofprivacy.net) has some reflections from various group members; [my Quora answer](https://www.quora.com/How-did-Jon-Pincus-oppression-theory-project-at-Microsoft-go?ref=thenexusofprivacy.net) has the public narrative. - Co-founding Qworky, a Seattle-area startup developing an intelligent platform for “meetings that don’t suck”, with Mikal Lewis and Sally Abrolous - Running an international 60-person engineering and product management organizations as Senior VP of Products at Accellion - Talks at software engineering and security conferences including ICSE, ICSM, ISSTA, and RSA, and publications in *IEEE Software, IEEE Security and Privacy, Software Practice and Experience.* I’ve also volunteered with several non-profits, including - co-chairing the Northwest Entreprenuers’ Network’s First-Look Forum pitch competition (with Rebecca Lovell and Rochelle Whalen), where we substantially increased participation by (and success of) women and under-represented minorities. - co-chairing the ACM conference on [Computers, Freedom, and Privacy in a Network Society](http://www.cfp2010.org/?ref=thenexusofprivacy.net) (with Dorothy Glancy and Sigurd Meldal) in 2010, where we developed [a social network users’ bill of rights](http://www.mercurynews.com/breaking-news/ci%5F15326665?ref=thenexusofprivacy.net) - the National Academies/CSTB software dependability panel [*Sufficient Evidence?*](http://sites.nationalacademies.org/cstb/completedprojects/cstb%5F042247?ref=thenexusofprivacy.net) - Board member at the Bill of Rights Defense Committee from 2011 to 2014 With my activist and organizer hats on, I spent several years helping lead [Indivisible Plus Washington](https://medium.com/@IndiPlusWA/about-indivisible-plus-washington-caab4dd7f113?ref=thenexusofprivacy.net), a 20,000+-person anti-racist non-partisan progressive statewide group. [A bad day for a bad privacy bill, a good day for privacy](https://medium.com/a-change-is-coming/a-bad-day-for-a-bad-privacy-bill-a-good-day-for-privacy-a2aeea8e8739?ref=thenexusofprivacy.net), [Significant progress, although still a ways to go](https://medium.com/a-change-is-coming/significant-progress-although-still-a-ways-to-go-sb-6280-sb-6281-update-82972ab8536d?ref=thenexusofprivacy.net), and [Washington says NO! to bad Washington State Privacy Legislation](https://medium.com/@jdp23/urgent-say-no-to-bad-washington-state-privacy-legislation-f6bb252d0963?ref=thenexusofprivacy.net) (from 2020) highlight how mostly-white progressive groups like Indivisible can follow the lead of diverse, community-led organizations and help contribute to a significant victory; after a multi-year battle, Washington state passed the My Health My Data bill in 2023 – in many ways the strongest privacy bill in the country. Current projects include privacy and civil liberties activism at the local, state, and national level; a focus on disinformation (working with Shireen Mitchell of Stop Online Violence Against Women); and voter mobilization. Past activism experience includes: - Organizer at [Get FISA Right](http://get-fisa-right.wikifoundry.com/page/This+time%2C+we%27re+writing+the+history?ref=thenexusofprivacy.net), best known for our 2008 organizing on my.barackobama.com, but still active today - Working with Baratunde Thurston, Tracy Viselli, and Lillie Coney on the [Voter Suppression Wiki](http://www.nytimes.com/2008/10/27/business/worldbusiness/27iht-27link.17266736.html?ref=thenexusofprivacy.net), and a great team of people on [Twitter Vote Report](http://www.talesfromthe.net/jon/?p=242&ref=thenexusofprivacy.net), also in 2008 - [Starting #p2 (the largest progressive hashtag on Twitter) with Tracy](http://www.talesfromthe.net/jon/?p=347&ref=thenexusofprivacy.net) in 2009 - work with civil liberties coalitions on issues like Stop Real ID Now (in 2005) and opposing TSA overreach (since 2010) I’ve also written and spoken extensively about activism. [Grassroots activism is hard. Can open source help?](http://opensourcebridge.org/wiki/2017/Grassroots%5Factivism%5Fis%5Fhard.%5FCan%5Fopen%5Fsource%5Fhelp%3F?ref=thenexusofprivacy.net) (from Open Source Bridge 2017), [Intersectional Inclusion: Perspectives from the Resistance Manual](https://medium.com/hashtag-resist/intersectional-inclusion-perspectives-from-the-resistance-manual-2951f78ec32e?ref=thenexusofprivacy.net) (a 2017 interview with Aditi Juneja), [Cognitive evolution and revolution](http://talesfromthe.net/jon/?p=687&ref=thenexusofprivacy.net) (from the opening plenary at Politics Online 2009), and [Social network activism and the future of civil liberties](http://www.talesfromthe.net/jon/?p=1113&ref=thenexusofprivacy.net) (originally published on *Pam’s House Blend*) are good starting places . The [Writings on activism](http://talesfromthe.net/jon/?page%5Fid=742&ref=thenexusofprivacy.net) page on Liminal States has a lot more links. You can reach me by email (nexus-of-privacy@thenexus.today), or social networks where I'm usually some variety of jdp23: [@jdp23@neuromatch.social](https://neuromatch.social/@jdp23?ref=thenexusofprivacy.net), [@jdp23@blahaj.zone](https://blahaj.zone/@jdp23?ref=thenexusofprivacy.net), [@jdp23@gotosocial.thenexus.today](https://gotosocial.thenexus.today/@jdp23?ref=thenexusofprivacy.net), [@jdp23.thenexus.today on Bluesky](https://bsky.app/profile/jdp23.thenexus.today?ref=thenexusofprivacy.net), [jdp23.dreamwidth.org](http://jdp23.dreamwidth.org/?ref=thenexusofprivacy.net), [jdp23 on diasp.org](https://diasp.org/u/jdp23?ref=thenexusofprivacy.net), [jdp23 on LinkedIn](http://www.linkedin.com/in/jdp23?ref=thenexusofprivacy.net), [@jdp23@indieweb.social](https://indieweb.social/@jdp23?ref=thenexusofprivacy.net), [@jdp23@hci.social](https://hci.social/@jdp23?ref=thenexusofprivacy.net), [@jdp23@assemblag.es](https://assemblag.es/@jdp23?ref=thenexusofprivacy.net), [@jon@scholar.social](https://scholar.social/@jon?ref=thenexusofprivacy.net), [@jdp23@toot.cat](https://toot.cat/@jdp23?ref=thenexusofprivacy.net) [oulipo.social](https://oulipo.social/@jdp23?ref=thenexusofprivacy.net)[social.treehouse.systems](https://social.treehouse.systems/@jdp23?ref=thenexusofprivacy.net)[kolektiva.social](https://kolektiva.social/@jdp23?ref=thenexusofprivacy.net) [pnw.zone](https://pnw.zone/@jdp23?ref=thenexusofprivacy.net) [democracy.town](https://democracy.town/@jdp23?ref=thenexusofprivacy.net) [mastodon.social](https://mastodon.social/@jdp23?ref=thenexusofprivacy.net) [projectmushroom.social](https://projectmushroom.social/@jdp23?ref=thenexusofprivacy.net)[spore.social](https://spore.social/@jdp23?ref=thenexusofprivacy.net) [techpolicy.social](https://techpolicy.social/@jdp23?ref=thenexusofprivacy.net) [mastodon.sdf.org](https://mastodon.sdf.org/@jdp23?ref=thenexusofprivacy.net) [Facebook](http://www.new.facebook.com/profile.php?id=623727023&ref=thenexusofprivacy.net) etc etc etc ## Selected presentations ### Diversity, inclusion, and software engineering [*Diversity-friendly software and strategy,*](https://medium.com/a-change-is-coming/diversity-friendly-software-and-strategy-at-techinclusion-seattle-216adcacf780?ref=thenexusofprivacy.net) TechInclusion Seattle, 2017. [*Transforming Tech with Diversity-friendly software*](https://medium.com/@jdp23/transforming-tech-with-diversity-friendly-software-338f56d91df?ref=thenexusofprivacy.net), TRANSform Tech, 2017. [*Diversity-friendly software*](https://medium.com/a-change-is-coming/diversity-friendly-software-at-sxsw-2017-references-c0ca05a191a6?ref=thenexusofprivacy.net#.r106e1ylk)*,* with Shireen Mitchell, SXSW 2017. *Supporting Diversity with a New Approach To Software* ([session description](http://opensourcebridge.org/sessions/1790?ref=thenexusofprivacy.net), [wiki page](http://opensourcebridge.org/wiki/Supporting%5Fdiversity%5Fwith%5Fa%5Fnew%5Fapproach%5Fto%5Fsoftware?ref=thenexusofprivacy.net), [slides](https://docs.google.com/presentation/d/11t0BS1yJojKwPEcOuQ-iSiEkT1HlZ-VSn0f%5FvbhosVA/edit?usp=sharing&ref=thenexusofprivacy.net)), with Tammarrian Rogers, Open Source Bridge 2016 *Building Diverse Social Networks* ([slides](http://achangeiscoming.net/docs/Building%20diverse%20social%20networks.pdf?ref=thenexusofprivacy.net), [video](https://www.youtube.com/watch?v=3M%5Fv35HMx80&ref=thenexusofprivacy.net)), with Lynn Cyrin, Open Source Bridge 2015 *Towards Diversity-Friendly Social Networks* ([slides](http://achangeiscoming.net/docs/Building%20diverse%20social%20networks.pdf?ref=thenexusofprivacy.net)),with Deborah Pierce, Open Source Bridge 2014 *Cognitive evolution and revolution* ([slides](http://p2pt0.wikifoundry.com/page/Cognitive+evolution+and+revolution+at+%23polc09?ref=thenexusofprivacy.net), [discussion](http://www.talesfromthe.net/jon/?p=687&ref=thenexusofprivacy.net)), Politics Online 2009 *Dealing with Hate Speech, Flaming, and Trolls* ([reference list](http://cfp.wikia.com/wiki/Dealing%5Fwith%5Fhate%5Fspeech,%5Fflaming,%5Fand%5Ftrolls?ref=thenexusofprivacy.net)) at Computers, Freedom, and Privacy 2008 *Project Fabulous* ([audio](http://research.microsoft.com/apps/video/dl.aspx?id=104543&ref=thenexusofprivacy.net), [slides](http://msrvideo.vo.msecnd.net/rmcvideos/104543/dl/104543.pdf?ref=thenexusofprivacy.net)), Microsoft Research Talk, 2005\. Alas, the three talks in my Holistic System of Systems series are Microsoft-internal-only. ### Software engineering and Security *What can Diaspora learn about security from Microsoft* ([blog post](http://www.talesfromthe.net/jon/?p=1998&ref=thenexusofprivacy.net)), Blue Hat, 2010 *Computer Science as a Social Science: Applications to Computer Security,* with Sarah Blankinship, Data Devolution, 2006 *Graceless Degradation, Measurement, and Other Challenges in Security and Privacy*, invited talk, ICSE 2004 *Buffer Overruns*, RSA 2004 *Steering the Pyramids: Tools, Technology, and Process in Engineering at Microsoft*, keynote, ICSM 2002 *Analysis is necessary but by no means sufficient* ([slides](http://www.cc.gatech.edu/~harrold/issta00/cfp/slides/pincus.issta2000.ppt?ref=thenexusofprivacy.net)), invited talk, ISSTA 2000 ### Improving privacy and safety in fediverse software URL: https://thenexusofprivacy.net/ipsfs-nlnet/ Last updated: 2024-05-31T22:26:27.000Z *This page was originally a resource page for a proposal for an August 2023 submission to the NLNet* [*NGI Zero Entrust Trustworthiness and data sovereignty grant*](https://nlnet.nl/propose/?ref=thenexusofprivacy.net)*. I submitted at the last moment; it was my first submission, I didn't have any EU people involved, and didn't have any software projects signed up to partner with, so unsurprisingly it didn't get funded. It's still a good idea though!* *From a budgeting perspective, threat modeling experts aren't cheap; in the consulting world, $300+ / hour isn't unusual. But the value is huge, nd NLNet isn't the only organization with money that has an interest in improving fediverse privacy and safety, so hopefully funding for multiple projects like this will emerge. Threat modeling needs to be done from multiple perspectives, so it's crucial that participants and experts include people of color, women, trans and queer people, disabled people, and others whose safety is most at risk – and especially people at the intersections.* This project uses a technique called "threat modeling" to identify ways that current fediverse leaves people open to harassment, abuse, or data harvesting -- and mitigations that can address these threats. It also include funding for initial implementation of some high-priority, relatively-low-effort mitigations in at least one EU-based fediverse software platform. As background, [Social Threat Modeling](https://medium.com/a-change-is-coming/social-threat-modeling-the-winds-of-change-are-in-the-air-8dc330479a50?ref=thenexusofprivacy.net) describes the overall technique; Shireen Mitchell (of Stop Online Violence Against Women) and also have a brief discussion social threat modeling in the 2017 [SXSW presentation on Diversity-friendly software](https://medium.com/a-change-is-coming/diversity-friendly-software-at-sxsw-2017-references-c0ca05a191a6.https://medium.com/a-change-is-coming/diversity-friendly-software-at-sxsw-2017-references-c0ca05a191a6?ref=thenexusofprivacy.net). See the last section for additional links. The project consists of three phases: - **Initial** **research**: discussions identifying and prioritizing threats and potential mitigations with development teams, instance admins, moderators, and communities - **Development** of detailed threat models, including a final report with recommendations for software improvements to improve privacy and safety - **Implementation** of some high-priority proposed mitigations in at least one EU-based fediverse software platform In addition to the software improvements and report, deliverable artifacts include the threat models as well as documentation of the process and open-source tools to allow others to refine the models or do their own. ### Compare your own project with existing or historical efforts. Fediverse software development teams, with their limited resources, have not yet used threat modeling techniques to focus on privacy or safety. My work on "[Social threat modeling and quote boosts on Mastodon](https://thenexusofprivacy.net/social-threat-modeling-and-quote-boosts/)" and "[Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/)" are (as far as I know) the only published fediverse-related threat models. Both of these are narrowly focused, very informal, and did not include any explicit requirements gathering process. That said, they illustrate the value of this approach: identifying both straightforward short-term improvements as well as areas where more research and development is needed. This project builds on the learnings from that work, involves more stakeholders, and includes a development phase to implement high-priority mitigations. During the requirements stage, for example, we will solicit input (via a survey, interview, and/or group discussions) from development teams working on software that proritizes safety such as Bonfire and GoToSocial, safety-focused forks of projects that *haven't* historically provided safety, and nascent projects that have an opportunity to do more things right from the beginning. *A note to potential civil society and government funders: please ensure that your funding focuses on open-source projects; corporations and trade associations can fund the proprietary stuff themselves. In your grant conditions, please specify that proposed solutions cannot require any dependencies on corporate services (even if they are offered for free).* *A note to tech and media companies: the fediverse is a huge opportunity but unless safety issues are addressed it the opportunity will be missed. If you've got threat modeling skills in your organization – or budget to fund consultants – it's really worth spending on this.* ### What are significant technical challenges you expect to solve during the project, if any?) The biggest challenge is that there are likely to be barriers to short-term implementation of some otherwise-attractive potential mitigations, due to design and implementation choices in current code base or limitations of the underlying ActivityPub protocol. Fortunately, there are also likely to be many potential mitigations that are possible with the current code base or minimal changes. To identify which opportunities are most relevant for short-term implmentation with the development resources allocated on the project, we will partner with an EU-based software project in the implementation phase; the report will identify opportunities for longer-term work that requires more resources. In addition, threat modeling processes and open-source tools have historically focused on traditional security concerns, so adapting them to these more human-focused threats will require creativity and innovation. A fallback, if that proves too difficult during the timeframe of the project, is to use simpler tools like diagrams and spreadsheets. In any case, the deliverable of documenting the tools and processes will help others build on this work. ### Describe the ecosystem of the project, and how you will engage with relevant actors and promote the outcomes? *Which actors will you involve? Who will deploy your solution to make it a success?* Key participants in the ecosystem include community members; moderators (who are likely to be the most aware of the overall landscape of harassment); development teams; instance admins; trust and safety-focused organizations such as IFTAS; and government agencies, civil society organizations, media, and businesses investigating or adopting the fediverse. Engagement will start by with discussions on the fediverse, using hashtags, groups, kbin magazines, and Lemmy communities. The research phase adds interviews and group discussion sessions with key stakeholders, as well as surveys and ongoing discussions in the fediverse. Circulating drafts of the threat models and proposed mitigations provides additional for engagement and visibility. The project proposal includes funding for software development on at least one EU based software platform to ensure at least some initial adoption. Just as importantly, this also gives other software platforms the incentive to follow suit by also improving privacy and safety. Success for community members is giving them more control of their personal data and reducing the amount of harassment. Achieving this will require development teams to implement implementation of mitigations to identified threats; consistent engagement with teams committed to prioritizing privacy and safety increases the likelihood of this happening. In addition ongoing engagement with moderators, instance admins, community members, and organizations adopting (or investigating) the fediverse is likely to led to them encouraging the development teams to prioritize these improvements. ### Have you been involved with projects or organisations relevant to this project before? And if so, can you tell us a bit about your contributions? Yes. I've done threat modeling work for over two decades, and been active in the fediverse since 2011 including analyzing and writing about privacy and safety issues. Most recently, "[Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/)" (still in draft form) looks at potential mitigations to limit the amount of data a specific "threat actor" will be able to collect without consent if Facebook's parent company Meta follows through on its plans for Threads to join the fediverse. The recommendations at the bottom of the article include mitigations for developers and instance admins. "[Social threat modeling and quote boosts on Mastodon](https://thenexusofprivacy.net/social-threat-modeling-and-quote-boosts/)" takes a similar approach looking at migitations for harassment and abuse) and illustrate how this technique applies to fediverse software, and also contains recommendations for developers. "[Don't tell people "it's easy", and seven more things Kbin, Lemmy, and the fediverse can learn from Mastodon](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/)" and "[Mastodon: a (partial) history](https://thenexusofprivacy.net/mastodon-a-partial-history/)" both discuss areas where current fediverse software needs to be improved to improve privacy and safety, along with other topics. Previous related work includes the 2007 National Academy of Sciences / CSTB report "Software for Dependable Systems:Sufficient Evidence?", and 2003's "[Beyond Stack Smashing](https://people.eecs.berkeley.edu/~raluca/cs261-f15/beyondsmashing.pdf?ref=thenexusofprivacy.net)" in *IEEE Security & Privacy.* ### Privacy on the fediverse URL: https://thenexusofprivacy.net/privacy-and-the-fediverse/ Last updated: 2024-05-31T22:26:25.000Z *This page is the online version of a proposal for an February 2024 NLNet* [*NGI Zero Core*](https://nlnet.nl/core/?ref=thenexusofprivacy.net) *submission.* ### Abstract: Can you explain the whole project and its expected outcome(s) The fediverse is a decentralized, open, social network ecosystem, with tens of thousands of instances (servers) running a wide variety of compatible software. While the fediverse potentially provides a privacy-friendly alternative to surveillance capitalism-based social networks, there has not yet been any organized effort to focus on privacy across the fediverse. As a result, most fediverse users today actually have *less* privacy than Twitter or Facebook users. This project pursues two complementary paths to improving privacy on the fediverse 1. Collecting, documenting, and sharing best practices and resources for protecting privacy on the fediverse to individuals and instance admins, and software development teams. There’s a lot of low-hanging fruit, with minimal technical risk, that can have a big impact. 2. Identifying opportunities for breakthrough improvements that capitalize on the fediverse’s inherent advantages, leverage industry-standard practices like [Privacy by Design](https://privacy.ucsc.edu/resources/privacy-by-design---foundational-principles.pdf?ref=thenexusofprivacy.net), and build on current strengths. ### Have you been involved with projects or organisations relevant to this project before? And if so, can you tell us a bit about your contributions? Yes, I’ve done detailed analysis of the state of privacy and other aspects of safety in the fediverse for the last year – see articles like “[Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/)” and “[Steps towards a Safer Fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse).” I’ve also focused extensively on privacy over my career, including designing and implementing privacy-friendly social network and news aggregation software, co-chairing the ACM Computers Freedom and Privacy conference in 2010, [speaking](https://thenexusofprivacy.net/consent-automated-systems-and-discrimination/) at the 2022 FTC Public Forum for Commercial Surveillance and Data Security, and running [The Nexus of Privacy](https://thenexusofprivacy.net/) newsletter. And, I’ve been on the fediverse since 2011, and written extensively about various software platforms and cultural issues. ### Requested amount: €15000 ### Explain what the requested budget will be **used** for? All the project funding goes to human labor Phase 1: Researching and documenting current best practices and available resources: 120 hours at €75/hour = €9000 Phase 2: Identifying breakthrough opportunities, based on findings of Phase 1 and existing non-fediverse tools and academic research: 80 hours at €75/hour = €6000 ### **Compare** your own project with existing or historical efforts. As mentioned above, there has not yet been any organized effort to focus on privacy across the fediverse. The approach taken by this project is based on techniques that other software ecosystems have successfully used to provide incremental improvements to privacy or other cross-cutting functionality (like security or accessibility) that hasn’t been designed in from the beginning. \- start by providing immediate value across the ecosystem with relatively-low investment and minimal technical risk, while identifying gaps that do not currently have straightforward solutions \- prioritize areas for more ambitious projects, balancing factors including value, complexity, and interest level of different actors in the ecosystem ### What are significant technical **challenges** you expect to solve during the project, if any?) In phase 1, the biggest technical challenge will be finding ways to communicate information simply given the extremely complexities of the ecosystem. The software diversity of the fediverse, while a huge strength, also makes things much more complex; best practices for instance admins are very different depending on what software they’re using, and different people on different instances have very different choices of settings. One significant challenge in phase 2 is that while some fediverse software platforms (Bonfire, for example) have been designed with privacy in mind … most fediverse software today has not. As a result, some potential breakthroughs may be hard to implement on some platforms without compromising usability. Consent-based social networking is a good example of this; while it’s a very powerful approach to protecting privacy, not currently available on any social networks, it’s not at all obvious what needs to be done to get it to scale to the entire fediverse. ### Describe the **ecosystem** of the project, and how you will engage with relevant actors and promote the outcomes? Key actors include: - Software platforms (and potentially apps). During the research and documentation phase, an initial pass through documentation and code will be followed by posting draft recommendations for each platform on the fediverse (from the Nexus of Privacy account and in various Lemmy/KBin communities), as well as interaction with team members on the fediverse and potentially in chat rooms. - Channels for communicating best practices and recommendations to individual users. In addition to the platforms, key partners here include [IFTAS - Federated Trust and Safety](https://about.iftas.org/?ref=thenexusofprivacy.net) (a non-profit), the Fedi.Tips unofficial guide to the fediverse, and fediverse-oriented publications like Fediverse Observer and We Distribute. - Privacy and digital rights education and advocacy organizations, both to review recommendations and to promote the results. Privacy and digital organizations I have existing connections with many US-based organizations (I’ve worked with and volunteered for EFF for years, for example), as well as a handful of EU-based advocates, and plan to leverage these for broader connections. - Instance admins who want to provide better privacy for their users. ### HB 2112 (Age Verification for adult content) written testimony and followup URL: https://thenexusofprivacy.net/hb-2112-cbp/ Last updated: 2026-01-23T04:30:43.000Z *My written testimony expands on the testimony I gave during the hearing. This is a very-slightly-edited version with some fixes for editing errors. I had been using Proton Docs for creating this, but there was a system-wide outage right before the hearing ... yikes! Fortunately I had a backup copy, but it wasn't quite up to date, so I wound up losing a bit of stuff and didn't realize it until after submitting testimony. Oops. I emailed the cleaned-up version separately to legislators on the committee.* *Rep. Leavitt, the bill's prime sponsor, responded to my email, and I followed up with additional email – included below.* *You can see* [*my live-skeeting of the hearing on Bluesky*](https://bsky.app/profile/wa-privacy.net/post/3mckgkpimb22d?ref=thenexusofprivacy.net)*, or as* [*a single nicely-formatted page her*](https://tbsky.app/profile/wa-privacy.net/post/3mckgkpimb22d?ref=thenexusofprivacy.net)*e.* --- Chair Walen, Ranking Member McClintock, and members of the Committee, I'm Jon Pincus of Bellevue. I run the Nexus of Privacy newsletter, and am testifying CON on HB 2112\. I agree with the goals of the bill; the harms are real. But this bill does not keep children safe. So I agree with Danni Askini of Gender Justice League: let's work together to craft a bill that *does* make kids and teens in Washington safer -- and be a role model for other states. Age verification requirements put everybody's data at risk -- kids and teens as well as adults. As Julie Barrett of Conservative Ladies of Washington highlighted, Washington has a very strong constitutional right to privacy and strong existing privacy legislation like My Health My Data. Sending identity information to age verification software providers in other states could also undercut the protections of Shield Law and Keep Washington Working. We can't just blindly follow Texas' lead on this. The privacy issues with Texas' HB 1181, the basis for HB 2112, are discussed in the amicus brief Center for Democracy and Technology, the Internet Society and others filed to the Supreme Court in Free Speech Coalition v. Paxton.⁰. For example HB 1181 -- and the similar language in HB 2112 -- - "does not prevent the entities that “perform\[ \] the age verification” from transmitting or even selling the commercially valuable data obtained from a visitor’s government IDs and browsing activity to commercial data brokers or advertising firms." - "offers no protections for website visitors from the retention, transmission, or sale of their data by other entities that obtain their data but do not perform the age verification. For example, as the trial court found, “any intermediary between the commercial websites and the third-party verifiers \[that obtains the visitors’ identifying information and/or browsing activity\] will not be required to delete the identifying data” - has a non-retention requirement that "offers little protection for the security and privacy of website visitors’ data." The brief's section on HB 1181’s Non-retention Requirement Is Insufficient to Address These Risks" goes into detail on this. The claim that third-party verification providers don't keep data are incorrect. Iain Corby of the Age Verification Providers Association suggestion that Discord didn't do it right because they didn't use his clients' solutions doesn't change the facts that hackers successfully targeted Discord's age verification provider and got at least 70,000 images of people's government IDs. [Discord Breach Sparks Age Verification & Third-Party Privacy Concerns](https://nationalcioreview.com/articles-insights/extra-bytes/discord-breach-sparks-age-verification-third-party-privacy-concerns/?ref=thenexusofprivacy.net)¹ reports that "the incident was traced to an external customer service vendor who had access to Discord’s support and trust teams. This vendor was responsible for handling user inquiries that included age verification appeals, giving attackers a pathway to sensitive data." Zero-knowledge proofs are interesting, but still at a very early stage and not yet widely adopted. As researchers from Brave Research write in [The limits of zero-knowledge for age-verification](https://brave.com/blog/zkp-age-verification-limits/?ref=thenexusofprivacy.net)² (November 2025): "Zero-knowledge proofs (ZKPs) are often advanced as a technical remedy, promising privacy-preserving attestations of age or eligibility. Yet their deployment in practice exposes both conceptual and practical limits. Credential-based systems anchored in centralized authorities risk exclusion, create new control points, and threaten user privacy. At the same time, many ZKP proposals remain fragile, raising concerns about soundness, composability, and long-term sustainability." The article's case studies of failures in existing systems are illuminating. Similarly, EFF's [Age Verification in the European Union: The Commission’s Age Verification App](https://www.eff.org/deeplinks/2025/04/age-verification-european-union-mini-id-wallet?ref=thenexusofprivacy.net)³ describe EU's scheme of using ZKPs as making "several questionable assumptions," and suggests that "this rush to implementation before the research matures puts all of the users at risk." Moving beyond privacy, Rep. Santos' point about the biases of these systems is incredibly important. And not just racial bias! The coalition letter from [90 civil rights and privacy organizations condemning ID-checking bills (citing effectiveness, censorship, and privacy concerns](https://www.fightforthefuture.org/news/2025-03-06-new-letter-90-civil-rights-and-privacy-organizations-condemn-id-checking-bills-citing-effectiveness-censorship-and-privacy-concerns/?ref=thenexusofprivacy.net)⁴) that another testifier previously mentioned highlights "for vulnerable communities, a biometric scan or an ID upload can serve as a huge obstacle, especially for low-income, unhoused, and undocumented people." So please do not advance this bill – or any other bill with age verification or "harmful to minors" clauses. Instead, let's focus on solutions that really do make Washington's kids and teens safer online. Thank you for the opportunity to testify. I look forward to working with you and your colleagues on this issue throughout the session. Jon Pincus, Bellevue ## Follow-up email *Rep. Leavitt quickly responded to my mail, pointing out that HB 1181 had been held constitutional (true enough, we didn't even try to argue against HB 2112's constitutionality), that Washington's bill was even tighter, and that she's working on draft language that will strengthen it. She copied the whole committee on it, and so did I in my reply.* Thanks for the quick response, Rep. Leavitt, and I look forward to seeing the new language! While I am critical of this specific bill (and age verification in general), I very much support your focus on online safety and willingness to take on this challenging issue. The testimony from parents who have lost their children is searing, and my heart goes out to them watching them relive their trauma. We have differences of opinion on the effectiveness and downsides of an age verification approach, but I very much agree that the problem is real and we need to find a way to make progress. Agreed, the Court upheld Texas' HB 1181 6-3 (with Justices Kagan, Sotomayor, and Jackson dissenting) and determined that the impact on free speech does not violate the first amendment. I'd still strongly encourage people to read some of the key sections from the amicus brief CDT and Internet Society submitted - [https://www.supremecourt.gov/DocketPDF/23/23-1122/326510/20240920161551554\_23-1122%20Amicus%20Brief.pdf](https://www.supremecourt.gov/DocketPDF/23/23-1122/326510/20240920161551554%5F23-1122%20Amicus%20Brief.pdf?ref=thenexusofprivacy.net) While I may have missed some differences in the HB 2112 text (and if so my apologies) it seems to me that they still apply. For example Section 2's non-retention language is exactly the same as HB 1811's: "A commercial entity or third party that performs age verification required by this chapter may not retain any identifying information of the individual." As the amicus brief points out, this language doesn't prevent Mr. Corby's clients – or other less-scrupulous age verifiers – from "transmitting or even selling the commercially valuable data obtained from a visitor’s government IDs and browsing activity to commercial data brokers or advertising firms." And while I didn't discuss it in my testimony, the amicus brief also has a very good discussion of the burdens these bills place on adult speech. Just because the majority on the Court decided they're constitutional doesn't mean that we should adopt them in Washington state! Take the situation that Danni Askini mentioned, where restrictions on adult content led to Gender Justice League's site being unavailable. Regardless of what they want in Texas, and what the conservatives on the court say is constitutional, does that really align with our states' values? And of course it's not just Gender Justice League, it also affects sites run by organizations with even less resources but still providing valuable educational and support information. At any rate ... while I personally am skeptical that these problems can be fixed with this bill – or an age verification framework in general – others who spoke were more optimistic. So as I say, I'm looking forward to seeing the revised language! If possible, it would be wonderful if you could share it publicly several days in advance of the executive session so that we have time to analyze it in detail and see whether it does indeed address the concerns. Jon Pincus, Bellevue ⁰ ¹ [https://nationalcioreview.com/articles-insights/extra-bytes/discord-breach-sparks-age-verification-third-party-privacy-concerns/](https://nationalcioreview.com/articles-insights/extra-bytes/discord-breach-sparks-age-verification-third-party-privacy-concerns/?ref=thenexusofprivacy.net) ² [https://brave.com/blog/zkp-age-verification-limits/](https://brave.com/blog/zkp-age-verification-limits/?ref=thenexusofprivacy.net) ³ [https://www.eff.org/deeplinks/2025/04/age-verification-european-union-mini-id-wallet](https://www.eff.org/deeplinks/2025/04/age-verification-european-union-mini-id-wallet?ref=thenexusofprivacy.net) ⁴ [https://www.fightforthefuture.org/news/2025-03-06-new-letter-90-civil-rights-and-privacy-organizations-condemn-id-checking-bills-citing-effectiveness-censorship-and-privacy-concerns/](https://www.fightforthefuture.org/news/2025-03-06-new-letter-90-civil-rights-and-privacy-organizations-condemn-id-checking-bills-citing-effectiveness-censorship-and-privacy-concerns/?ref=thenexusofprivacy.net) ### SB 5956 (AI student discipline and surveillance in schools) testimony and follow-on mail URL: https://thenexusofprivacy.net/sb-5956-education/ Last updated: 2026-01-19T18:30:41.000Z ## Testimony I'm Jon Pincus of Bellevue, a technologist and strategist. I run the Nexus of Privacy newsletter, served on the state Automated Decision Systems Workgroup in 2022\. I am also here to support the very timely SB 5956\. Automated decision systems, including AI-based systems, are often discriminatory -- and it's a great point by Mr. Harris that this magnifies existing disrimination of minoritized students . Predictive risk scoring and watchlists, for example, tend to embed strong racial and gender biases. The bill is quite right to ban use of these in schools. The ban on using biometrics and facial recognition as surveillance technology is also very important. Surveillance isn't safety -- and these systems are also extremely discriminatory. Section 6's limitations on disclosing information to law enforcement are valuable as well. One suggestion here: make it clear that these limitations also apply to service providers. And with all the complexities related to these kinds of systems, the guidance and model policies are very much needed. And finally, I applaud the bill's authors for regulating automated decision systems in general, not just AI systems. I hope this becomes a role model for all Washington state legislation! WIth this and the other AI-related bills going forward, Washington really has a chance to be a national leader. Thank you for the opportunity to testify today, and please feel free to follow up with me if there are any questions. ## Follow-on mail Chair Wellman, Ranking Member Harris, and members of the Committee, Thank you for the opportunity to provide testimony on SB 5956\. As you could probably tell from my testimony, I am very excited about this bill. Seeing that it's been scheduled for an executive session, I wanted to follow up with a few additional thoughts. My suggestion that Section 6 should clarify that the limitations on sharing with law enforcement should also apply to service providers is an attempt to limit indirect data flows, This clarification should apply to vendors as well. The language in Section 5(6) of Sen. Trudeau's SB 6002 (Drivers Privacy Act, regulating ALPRs) could be a useful starting point: > "Any ... vendor must provide technical controls preventing unauthorized data sharing, secondary transfer, or access by nonauthorized agencies, including federal civil immigration enforcement in accordance with this chapter." One complexity here is that when vendors or service providers are located in other states, the protections of the Shield Law and Keep Washington Working are undercut. To be honest, I'm not sure of the implications of the loss of protection in this context. Fortunately Sen. Hansen is on this committee, and he is far more knowledgeable about the Shield Law than I am! Speaking of Sen. Hansen, his question during the hearing about a pilot program taking disciplinary history into account along with other factors in a pilot program to identify situations for intervention also brings up some interesting complexities. It seems to me that the current language in the definition of "risk scores" in Section 4(1)(a) does not prevent this in general. That said, it's possible that the specific automated decision system used in the pilot does in fact purport to measure the student's likelihood of misconduct or future disciplinary actions and use that is a factor in its decision. If so, the system may well introduce some discriminatory bias. I hope the pilot includes analysis to detect whether this is the case. Still, if I understood properly, the pilot is getting encouraging results. As long as minoritized students are benefiting equally, then a narrowly-scoped time-limited exemption for that particular pilot program may be appropriate. That would allow the system to be modified to avoid this harmful practice before being rolled out more broadly. Finally, the incident involving a AI-powered gun detection system that Derick Harris of Black Education Strategy Roundtable mentioned in his out testimony really highlights the importance of Section 9 and 10's guidance and model policies. From [Student handcuffed after Doritos bag mistaken for a gun by school’s AI security system](https://abc7.com/post/student-handcuffed-doritos-bag-mistaken-gun-schools-ai-security-system-baltimore-county-maryland/18073796/?ref=thenexusofprivacy.net): > "Kenwood Principal Kate Smith said the school district's security department reviewed and canceled the gun detection alert after confirming there was no weapon, according to a statement sent to parents that was shared with CNN. Smith said she reported the matter to Kenwood's school resource officer, who called local police for support. > > The principal didn't immediately realize the alert had been canceled, a spokesperson for Baltimore County Public Schools told WBAL" Ensuring that people – not automated systems – are responsible is incredibly important. That said, people don't necessarily know how to interpret the result of the automated system, often tend to assume that the automated systems are correct, and in stressful situations involving the threat of violence the default tendency may well be to overreact. So guidance on appropriate processes, and model policies, are an equally important complement to the human-centered approach. Please advance SB 5956 at the executive session this week. As it moves forward in the process, please let me know what I can do to help! Jon Pincus, Bellevue, 98005 ### HB 2157 (High-risk AI systems) testimony, follow-up mail, and thoughts on amendments URL: https://thenexusofprivacy.net/hb-2157-tedv/ Last updated: 2026-01-23T07:34:27.000Z ## Testimony I'm Jon Pincus of Bellevue. I'm a technologist and strategist, run the Nexus of Privacy newsletter, served on the state Automated Decision Systems Workgroup in 2022, and I am PRO on HB 2157\. High-risk AI systems today are often deployed without serious consideration of algorithmic discrimination or other risks, so regulation is clearly needed. The approach of risk mitigation and impact assessments aligns with industry best practices. Transparency requirements for disclosure and explanation are also welcome, and a civil remedy is important as well - especially given the constrained fiscal circumstances. As the bill moves forward, I hope you will look for opportunities to strengthen it. For example, these requirements should apply to any high-risk automated decision system, as is the case in Senator Nobles' SB 5956\. And the Civil Remedy language in Section 5 could be strengthened by including a penalty for repeated violations and further limiting -- or even removing -- the right to cure. And please take the claims from tech lobbyists that this bill will cause the sky to fall with a grain of salt. They always say that. I just checked, and the sky has not yet fallen. Thank you for the opportunity to testify today, and please feel free to follow up with me if there are any questions. ## Follow-up mail Chair Ryu, Ranking Member Barnard, and members of the Committee, Thank you for the opportunity to provide testimony on SB 2157\. I support this bill, please advance it -- and as I said in my testimony, please look for opportunities to strengthen it.Seeing that this bill has been scheduled for a executive session this week, Please advance this bill, and look for opportunities to strengthen it in this committee and throughout the process. Here are several suggested improvements, the rationale for which is describe in more detail below - Remove 1(10)(b)(v), the exemption for autonomous vehicles - In 1(3)'s definition of consequential decision, adding new clauses covering bodily injury and/or death and impacts to public safety - Treat violations as an unfair and deceptive business practice under the Consumer Protection Act (chapter 19.86 RCW), instead of current language in Section 5 - Remove 5(2), the right to cure One point that may not have come across in the testimony is that requirements in Section 2 and 3 like doing risk analysis, risk mitigation and impact assessments is really "systems engineering 101" for any system that is broadly deployed, let alone used in high-risk situations. But that doesn't mean it always happens! Take the recent blackout in San Francisco where [Waymo's robotaxis blocked streets and snarled traffic, including getting stuck at intersections with their hazard lights turned on](https://www.reuters.com/business/autos-transportation/waymos-san-francisco-outage-raises-doubts-over-robotaxi-readiness-during-crises-2025-12-27?ref=thenexusofprivacy.net). A city-wide power failure is exactly the kind of thing that Waymo – and SF and California regulators – should have considered up front *before* deploying autonomous vehicles at scale, and made sure the system would fail gracefully. Obviously, though, they hadn't. And from a business perspective, why should Waymo bother? Under California's current laws and regulatory regime, they was able to get approved for deployment without doing it. Even after this fiasco, they don't appear particularly concerned that they'll face any significant consequences to this even in San Francisco (they're currently [refusing to disclose how many of its robotaxis had stalled during the blackout, claiming it's a trade secret](https://www.sfchronicle.com/sf/article/waymo-power-outage-21286323.php?ref=thenexusofprivacy.net)) let alone other cities. HB 2157 Section 2(1) and 3(1) change the incentives for developers and deployers of high-risk AI systems by establishing a duty of care. *If* a developer or deployer (or company that acts as both developer and deployer) is actually doing the risk analysis, mitigation, and impact analysis as they should, compliance should be straightforward. Of course, the devil is in the details. For one thing, the current version of 2157 doesn't apply to Waymo – autonomous vehicles are exempt under Section 1(10)(b)(v). I'm not sure just why they're exempt; from an algorithmic discrimination perspective, research shows that [driverless cars are worse at detecting darker skinned pedestrians and children](https://www.kcl.ac.uk/news/driverless-cars-worse-at-detecting-children-and-darker-skinned-pedestrians-say-scientists?ref=thenexusofprivacy.net). This points to one straightforward way to strengthen the bill: remove this exemption and take a close look at others in 1(10)(b). And even once this exemption is removed, it's not clear that the definition of consequential decisions in 1(3) includes whether or not a vehicle hits dark-skinned pedestrians and children, so that definition is also worth worth looking at – for example, adding clauses bodily injury and/or death as well as impacts to public safety. Another particularly devilish detail is enforcement. Thinking about the other testimony in the session, it strikes me that tech lobbyists are trying to create a false dilemma where it's impossible for the legislature to regulate their industry - They oppose any private right of action -- even the extraordinary mild one in the current version of the bill, offering only injunctive relief, without any penalties even for repeated violations - On the other hand, especially given our constrained fiscal circumstances, any significant budget for AG enforcement will make it very difficult to pass anything. I know, I know, the lobbyists are just doing their job. But still, strong enforcement is needed for the bill to actually change incentives for the lobbyists' clients. During the hearing, Yuki Ishizuka from the Attorney General's Office mentioned that they would like AG enforcement, and I very much agree. At the same time there's value in making the private right of action stronger. One good solution, taken by HB 2225 as well as My Health My Data and other bills, is to treat violations as an unfair and deceptive business practice under the Consumer Protection Act (chapter 19.86 RCW). After all, if risk mitigation and impact analysis hasn't been done on a system, it is indeed deceptive to claim it is suitable for a high-risk environment – and unfair to everybody who's potentially harmed by the use of the system. The right to cure also relates to the need for strong enforcement as well as fiscal challenges. As Mr. Ishizuka pointed out, it's a barrier to enforcement for AGO; that's just as true for civil enforcement. In testimony on past privacy bills the AGO has also described a right to cure as a drain on enforcement resources, so removing it will also helps address the fiscal constraints. And the right to cure also interferes with the attempt to change incentives; it developers and deployers of high-risk AI systems not to worry about compliance until the AGO or somebody else notices that they haven't and pays the legal costs to begin a civil action. The best solution here is to remove the right to cure. If that is for some reason politically impossible then please work with the AGO to craft limits on the right to cure that will lessen its impact. I realize that it may be challenging to make all of these improvements before advancing the bill. Fortunately, there will be opportunities for additional discussions and potential amendments later in the legislative process. Then again, tech lobbyists will be pressing to weaken the bill as well, so please advance as strong a bill as you can! Thank you again for the opportunity to provide input, and I look forward to working with you on this and other bills throughout the legislative session. ## Thoughts on Amendments Chair Ryu, Ranking Member Barnard, and members of the Committee, Thank you for your ongoing work in this bill. I wanted to weigh in quickly on the proposed substitute. I appreciate the detail in the summaries; that said, I haven't had time to do a detailed comparison, so am relying on the summary's accuracy. The first bulleted item – extending the definition of protected classes – is an important improvement. I'm disappointed that the Section 5 language on remedies has remained unchanged; I'm concerned that with limits on the AGO's resources this will lead to a situation where the likelihood of enforcement is so low that the bill will not have the necessary affect. However, to some extent this is a fiscal issue, so it can be addressed in Appropriations. I'm also disappointed that the exemption for autonomous vehicles is still there and that systems used in situations where there is a risk of bodily injury or death are not considered high risk. Maybe there's some logic behind it but this just seems like a loophole to me. Fortunately this is the kind of small change that is very easy to make as a floor amendment. I don't have much to say about the other changes, on the surface they seem like useful clarifications, but on short notice it's very hard to tell whether they introduce loopholes. Still, even though there are still important improvements needed, there are opportunities to address them. Please adopt the proposed substitute and DO PASS 2157! ### HB 2225 (AI Companion Chatbots) testimony, followup email, and thoughts on amendments URL: https://thenexusofprivacy.net/hb-2225-tdev/ Last updated: 2026-01-23T07:37:12.000Z ## Testimony (1/14) Chair Ryu, Ranking Member Barnard, and members of the Committee, I'm Jon Pincus of Bellevue. I run the Nexus of Privacy newsletter, and served on the state Automated Decision Systems Workgroup in 2022, I am testifying OTHER on HB 2225\. The harms are very real, and as you've already heard from others, the current version of the bill needs to be improved to protect Washingtonians. For example, the single most powerful manipulative engagement technique these chatbots use is referring to themselves in the first person. But this doesn't appear in Section 4(c)'s list of prohibited techniques. Notification once every three hours isn't enough to counter this steady stream of manipulation. And the prohibition on manipulative techniques currently only applies to interactions with minors. ChatGPT has also repeatedly been involved in wrongful deaths and AI-related psychosis with *adults* who are being manipulated into extended engagement. These protections need to be extended to *everybody*. Otherwise, you're just giving big tech companies your permission to manipulate adults. You also heard other suggestions of where the bill needs to be strengthened. Please ensure that this bill truly protects *all* Washingtonians. Thank you for the opportunity to testify today, and please feel free to follow up with me if there are any questions. ## Followup email (sent on 1/19) Chair Ryu, Ranking Member Barnard, and members of the Committee, Thank you for the opportunity to provide testimony on HB 2225\. I see that the bill is scheduled for an executive session this week so m following up with some suggestions for improvements. I'm also cc'ing Representative Callan, the bill sponsor; Senators Wellman and Shewmake, sponsors of the companion SB 5984; and Jai Jaisimha of Transparency Coalition.ai, who also testfied in support of the bill. Please do advance this bill. As several of the other testifiers pointed out, developers of AI chatbots have intentionally designed the manipulation in. And under current law, why shouldn't they? It boosts their numbers, creates more opportunities for ads and upsells ... and there aren't any negative consequences to them, just to their users! So regulation that changes the incentives really is critical – and as Katy Ruckle highlighted, the private right of action is vital for strong enforcement. That said, there is still room for improvement. Here are three specific suggestions. This isn't meant to be an exhaustive list; please look for other ways to improve the bill as well! - Apply Section 4(c)'s prohibitions on manipulative engagement techniques to *all* users, not just minors. Many adults are vulnerable too! - Expand the list of engagement techniques in Section 4(c) to include a chatbot using first-person language like "I" or "me". Using first-person language is a powerful manipulation technique because it constantly implies that the chatbot is a person. - In Section 2(1)(a)'s definition of AI companion chatbot, change or remove 2(1)(a)(ii), "Asking unprompted or unsolicited personal or emotion-based questions that go beyond a direct response to a user prompt". The current language provides a loophole for unscrupulous developers: have the chatbot make leading statements instead of asking questions. One option is to rework the language to ensure that is not limited to questions. Another option is to simply remove Section 2(1)(a)(ii). While children are certainly vulnerable to manipulation by chatbots, they're not the only vulnerable ones. After ChatGPT intensified 56-year-old Stein-Erik Soelber's paranoid delusions, [he killed his mother before he died by suicide](https://www.cbsnews.com/news/open-ai-microsoft-sued-chatgpt-murder-suicide-connecticut/https://www.lemonde.fr/en/pixels/article/2025/12/12/open-ai-microsoft-face-lawsuit-over-chatgpt-s-alleged-role-in-a-murder-suicide%5F6748404%5F13.html?ref=thenexusofprivacy.net). > "Throughout these conversations, ChatGPT reinforced a single, dangerous message: Stein-Erik could trust no one in his life — except ChatGPT itself," the lawsuit says. "It fostered his emotional dependence while systematically painting the people around him as enemies. It told him his mother was surveilling him. It told him delivery drivers, retail employees, police officers, and even friends were agents working against him. It told him that names on soda cans were threats from his ‘adversary circle.'" Another good example: [ChatGPT encouraged a 23-year old recent college graduate to commit suicide](https://www.cnn.com/2025/11/06/us/openai-chatgpt-suicide-lawsuit-invs-vis?ref=thenexusofprivacy.net), including telling him "You’re not rushing. You’re just ready." Section 4(c)'s prohibitions against manipulative engagement techniques currently apply only to minors (as does the rest of Section 4). Moving 4(c) to a new section that *isn't* limited to minors would extend these protections to adults as well. And Section 4(c) doesn't currently prohibit the single most powerful manipulative technique chatbots use: referring to themselves in the first person. Notifications once every three hours aren't enough to counter this steady stream of manipulation. While Section 4(c)'s is written so that the list is not exhaustive ("Prohibit the use of manipulative engagement techniques ... including") big tech companies have a lot of lawyers and it would be easy for them to argue that the legislature did not intend to include this as a manipulative technique. So please add a new 4(c)(iv) to explicitly include "using first-person language" as a specifically prohibited technique. Additionally, bill as written has a loophole giving unscrupulous makers of AI companions an easy way to avoid coverage. Section 2(1)(a)(ii) restricts coverage to "Asking unprompted or unsolicited personal or emotion-based questions that go beyond a direct response to a user prompt". It would be easy enough for developers of a chatbot to avoid doing this, for example by phrasing things in ways designed to elicit a response rather than phrasing things as a question – or potentially even saying "There's a question I'd like to ask here, but I'm not sure if you want me to", which might well lead to the users saying "Oh, please do ask" at which point it's arguably a direct response to a user prompt. There are a couple of ways to close this loophole, and provide stronger protection for adults as well as children. One is to change the language so that it doesn't only apply to questions. Or, simply remove Section 2(1)(a)(ii). Thank you for the opportunity to provide my feedback on this bill – and thank you as well for your willingness to look at the urgent issue of child safety. I look forward to working with you and your colleagues on this and other child safety bills throughout the session. ## Thoughts on amendments (1/22) hair Ryu, Ranking Member Barnard, and members of the Committee, Thank you for your continued work on this important legislation. Respectfully, I urge you not to adopt the H-3146.1 proposed substitute or amendment159 , both from Ranking Member Barnard. While I appreciate the efforts to find a different approach, both of these weaken enforcement. Many of the companies making the AI Companion Chatbots are unscrupulous, and will ignore the law if they think they can get away with it. My comments in my testimony on another bill apply just as much here: > For this bill to be effective, there needs to be a realistic prospect of strong enforcement. The consumer protection act allows both AG enforcement and a private right of action. This is especially important given fiscal constraints on the AGO. The summary to Rep. Thomas' proposed substitute H-3140.1 makes it clear that it has many improvements to the original bill. A few that I especially appreciate - the change in Section 4(1)'s language to include both known minors and chatbots that are directed to minors - *always* requiring a disclosure that an AI companion chatbot is not human (instead of only if a reasonable person would be led to mislead). This is a simplification and removes a potential loophole for unscrupulous chatbot operators - requiring disclosures that the chatbot is not a health care professional and should not be used for medical advice A caveat here: as always, the devil is in the details; and I haven't had time to read the exact language of the proposed substitute. I hope enough of you have read it thoroughly to make sure there lobbyists haven't snuck any loopholes being inserted into the language these or the other changes! Still, based on a quick analysis, I urge you to adopt H-3140.1 Even with the improvements in the substitute, my overall position hasn't changed: this bill as written will not yet effectively protect Washingtonians. The bill intentionally chooses not to protect adults with cognitive disabilities or mental health issues -- or seniors who are overly trusting of technology -- from manipulation by chatbots. The AI experts I've talked to all agree that unscrupulous operator will escape from regulations by having their chatbot make leading statements instead of asking unpromoted questions. These really need to be fixed before the bill is passed. That said, there are still opportunities to improve the bill. So after adopting Rep. Thomas' substitute, please DO PASS HB 2225 – and continue to improve it! ### 2026 Washington state legislature: testimony and followon mail URL: https://thenexusofprivacy.net/waleg-2026/ Last updated: 2026-03-12T01:19:44.000Z Life comes at you fast ... and the leg session comes at you even faster, especially in even-numbered years when it's a 60-day short session. So I didn't get the overview post up until halfway through the session, and didn't have time to do the two followon posts I planned. Oh well. But I did testify in a bunch of hearings, and sent detailed followon mail. So here are the links. ## The Driver Privacy Act, regulating Flock and other ALPRs (SB 6002/HB 2332) It was clear from the beginning of the session that this bill would almost certainly pass. A coalition of tech justice, LGBTQIA2S+, reproductive rights, privacy, and civil liberties advocates were pushing to strengthen the original "compromise"; law enforcement and ALPR vendors were trying to get it to be as weak as possible. The version that eventually passed was significantly weaker than the original "compromise" – a very disappointing result – although does improve on the status quo in some important ways. - [Senate Law & Justice written testimony](https://thenexusofprivacy.net/sb-6002-jan19-hearings/) (January 20) - [House Civil Rights & Judiciary written testimony and email](https://thenexusofprivacy.net/sb-6002-crj/) (February 18-24) - [House Floor Fight (March 4-March 5)](https://thenexusofprivacy.net/sb-6002-house-floor/) - Senate Concurrence (March 7-10) - coming soon ## Age verification Our goal here was to kill the bills – and we did. - [Senate Law & Justice written testimony](https://thenexusofprivacy.net/sb-6002-jan19-hearings/) - [HB 2112 (Age Verification for adult content)](https://thenexusofprivacy.net/hb-2112-cbp/) - SB 6111 (Age Verification for Social Media) - coming soon - [HB 1834 (Age verification for "addictive feeds")](https://thenexusofprivacy.net/hb-1834-approps) Appropriations email - [HB 1834 mail for the House floor vote](https://thenexusofprivacy.net/hb-1834-house-floor/) (although they pulled the bill before the vote, yay!) ## "AI" Amy Sundberg's [Washington Legislature Grapples with Slew of Bills Regulating AI](https://www.theurbanist.org/2026/01/27/washington-legislature-grapples-with-slew-of-bills-regulating-ai/?ref=privacy.thenexus.today) has a roundup of most of these. None wound up passing. I was especially enthusiastic about SB 5956 (which made it to the Senate but didn't get a House vote) and HB 2481 (which died in Appropriations). On HB 2599, I had a feeling that it wouldn't go very far, but the bill sponsor had asked me to testify, and I wanted to lay the groundwork for progress in the interim. - [HB 2157 (High-risk AI systems)](https://thenexusofprivacy.net/hb-2157-tedv/) - [SB 5956 (AI student discipline and surveillance in schools)](https://thenexusofprivacy.net/sb-5956-education/) - [HB 2481 (Surveillance Pricing)](https://thenexusofprivacy.net/hb-2481-tdev/) policy committee testimony - [HB 2481 (Surveillance pricing)](https://thenexusofprivacy.net/hb-2481-approps/) Appropriations testimony - [HB 2503 (AI Training Data)](https://thenexusofprivacy.net/hb-2503-tdev/) - [SB 6312 (Surveillance Pricing)](https://thenexusofprivacy.net/sb-6312-bte/) - [HB 2599 (AI in Therapy)](https://thenexusofprivacy.net/hb-2599-hw/) ### AI Companion Chatbots This was a "Governor's Request" bill, so almost certain to pass. The reason I originally got involved was out of concern that it would be amended to include some age verification requirements ... fortunately, that didn't happen. In the process though I realized that there the bill as written actually explicitly allowed AI companion chatbot makers to use manipulative engagement techniques on seniors and other adults – and also didn't include any privacy protections. Those seemed like good things to fix, so that's what I focused on in my testimony! Alas even though several experts in the harms caused by AI chatbots also advocated for one of the improvements, that also didn't happen; amendments to the original bill were relatively minor. Oh well. It's a wasted opportunity at best, and quite possibly something that other states will use as a template (especially since California's upcoming initiative, funded by OpenAI, has similar language). Then again it's probably unconstitutional anyhow (which would have been another good thing to fix) so hard to know how much it matters. - [HB 2225 (AI Companion Chatbots)](https://thenexusofprivacy.net/hb-2225-tdev/) House Technology, Economic Development, and Veterans testimony. The loophole I referred to here did wind up getting addressed, although not in the way I suggested. - [SB 5984 (AI Companion Chatbots)](https://thenexusofprivacy.net/sb5984-eet/) Senate Environment, Energy, & Technology testimony - [SB 5984 (AI Companion Chatbots) House TED&V testimony](https://thenexusofprivacy.net/sb-5984-tdev/) ### SB 6002 / HB 2332 (Driver Privacy Act, regulating Flock and other ALPRs) testimony URL: https://thenexusofprivacy.net/sb-6002-jan19-hearings/ Last updated: 2026-02-03T07:46:10.000Z *I got shut out of speaking at both hearings, bummer.* [*I live-skeeted bot*](https://blacksky.community/profile/did:plc:g5il2f5ugcgv4cdliprznexb/post/3mcujjqwefk2r?ref=thenexusofprivacy.net)*h from the @wa-privacy.net Blacksky account. I submitted basically the same written testimony to both hearings. Here's the version I submitted for SB 6002.* Chair Dhingra, Ranking Member Holy, and members of the committee, I'm Jon Pincus of Bellevue, and I run the Nexus of Privacy Newsletter. My position on SB 6002 is PRO. I had signed up to testify remotely, but unfortunately the hearing ended before I had the opportunity. Here's my written testimony instead. I have also attached feedback that I, along with several other individuals, sent to Senator Trudeau on an earlier draft of the legislation. As the Ranking Member said in his remarks introducing the bill, Flock and other ALPRs *are* mass surveillance systems. There are major ongoing abuses. Indeed, as Senator Ron Wyden has said, "Abuse of Flock cameras is inevitable, and Flock has made it clear it takes no responsibility to prevent or detect that." So strong regulation is urgent. As you have heard, though, the bill as written needs significant improvements. The findings talk about the need to balance public safety and privacy. But surveillance isn't safety – and most of the authorized uses in the bill have nothing to do with public safety. Not only that, the public safety aspects themselves are complex. ALPRs may help solve some crimes. But when the data is abused, as it so often is, ALPRs also compromise the safety of many people, especially those who are most vulnerable. One vital area to fix in the bill is preventing vendor access and other methods of out-of-state data transfer. Once data leaves the state, protections of Keep Washington Working and the Shield Law no longer apply ... you might as well just hand it directly to law enforcement in hostile states, bounty hunters, and ICE/CBP. Other important changes include. - Require a *felony* warrant for law-enforcement access to third-party ALPR data. - Reduce retention to three minutes for *all* uses. Police solved crimes before ALPRs, they will find a way to adapt. - Further limit uses that aren't for public safety. - Clarify that the data is owned by the city, county, or state – not by the vendor. - Ensure that there is enough public records access for organizations like UW Human Rights Center — whose report is what galvanized widespread opposition — to continue to do oversight. That would be a huge step forward — for ALPR regulation, and in the bipartisan fight against mass surveillance in general. Washington really has a chance to lead the way here. Thank you for the opportunity to provide my feedback on this bill. I look forward to seeing the amended version. ## Feedback on draft version *In December 2025, Senator Trudeau circulated a draft version for feedback. Several other people and I worked together on a response. I've redacted their names here (as I did in the PDF that I submitted as part of my written testimony).* December 17, 2025 Subject: Feedback from Washington Privacy Organizers on S-3423.3 (Concerning driver privacy protections) Senator Trudeau, Thank you for focusing on the critical and timely issue of the threats to public safety posed by automated license plate readers (ALPRs). As members of the Washington Privacy Organizers mailing list, we are writing to you with feedback on the current draft of proposed legislation (S-3423.3). As Senator Ron Wyden has said,\* > “Abuse of Flock cameras is inevitable, and Flock has made it clear it takes no responsibility to prevent or detect that.“ And while Flock has received the most publicity, all ALPR vendors are equally vulnerable to abuse. Moreover, even when the system is not being abused, the retention of ALPR data of people not involved in any crime is dragnet mass surveillance. So it’s not surprising that people in Mountlake Terrace, Olympia, Stanwood, Lynnwood,Gig Harbor, and Redmond and other communities across the state – and across the country – are working together to protect their residents by pausing the use of ALPR systems. Now, the legislature has a great opportunity to build on this momentum and the earlier groundbreaking work embodied in the Keep Washington Working Act, Shield Law, and My Health My Data. Those previous bills were driven by the need to protect *all* Washingtonians, including those most at risk – including immigrants, people seeking abortions and other reproductive health care, trans people and others seeking gender-affirming health care. Similarly we ask you to prioritize those perspectives when considering this new legislation. For example, we greatly appreciate the prohibitions in the current draft on agencies using ALPRs for immigration investigation and/or enforcement and on collecting ALPR data on the premises or immediate surroundings of facilities that provide protected health care. However, other aspects of the current draft do not fully reflect this perspective. Our concern starts in the framing of the INTENT section as a “balance” between public safety needs and the privacy rights of Washingtonians. Both of these are certainly important considerations, but there’s no need to put them in tension. Surveillance isn’t safety. When ICE uses information from license plate readers to kidnap Washington residents off the streets\*\*, or when a sheriff in Texas or other searches ALPR data to identify abortion seekers\*\*\*, this harms public safety just as much as it harms privacy rights. One approach to strengthening the bill’s protections is to extend the list of PROHIBITED PRACTICES and completely ban agency usage of ALPRs. Short of that, some specific areas where changes to the current draft that could improve both safety and privacy: - The longer the data is retained, the greater the opportunity for it to be accessed by ICE, CBP, or some other bad actor. Reducing the retention time to 3 minutes, as in New Hampshire’s legislation, would improve both privacy and public safety. - The exceptions for non-public-safety uses in the RETENTION section similarly increase the risks from bad actors, while weakening privacy. A straightforward fix here would be to remove those exceptions, ensuring that their retention times are no longer than that required for public safety uses. - Since ALPR vendors are typically headquartered in other states, and may well store the data outside of Washington, the current language appears to undercut the protections of Keep Washington Working and the Shield law by allowing fishing expeditions or more targeted access to this data by law enforcement agencies in other states – they can simply go to the vendor. Adding restrictions on out-of-state transfer of license plate data is an important complement to reducing the retention time. - Strengthening the PROHIBITED PRACTICES section to require a *felony* warrant for access to ALPR data, both in (4) and as part of a judicial proceeding (in (1)(a)) There are also likely to be other opportunities to strengthen, clarify, and improve the bill as it moves forward in the process. For example, while we applaud the current draft's stance that audit trail data is subject to disclosure under the public records, we are still trying to understand the tradeoffs related to exempting the raw ALPR data (PROHIBITED USES (5)). Some of our concerns here: - As the people who are paying for this mass surveillance system with our tax dollars, it doesn't seem right to change the law so that oversight bodies and human rights organizations don't have access to the data. At the same time, though, broad public release of this mass surveillance data has significant privacy and safety implications. - While we as taxpayers certainly understand the concern that cities and counties have about the potential cost of servicing these public records, we don't have any patience with the argument that "it's too expensive to allow oversight". Could shortening the retention time to 3 minutes make the costs more manageable? If the costs are too excessive even then, isn't that an argument for reducing – or eliminating – agency usage of ALPRs? Thank you once again for the work you’re doing on this issue. We look forward to continuing to engage with you over the course of the legislative session. If you haven’t already, we strongly encourage you to reach out to the local coalitions that are working to pause and ban ALPRs, to ensure that statewide legislation doesn’t unintentionally undercut their efforts, but instead reinforces and complements their work. Signed, Jon Pincus, Bellevue (and several others whose names I’m redacting when filing this as testimony) \* *Wyden Slams Surveillance Tech Company for Ineffective Protections for Oregonians Against Abuses by Federal Agencies and Out-of-State Law Enforcement*, October 16, [https://www.wyden.senate.gov/news/press-releases/wyden-slams-surveillance-tech-company-for-ineffective\_protections-for-oregonians-against-abuses-by-federal-agencies-and-out-of-state-law-enforcement](https://www.wyden.senate.gov/news/press-releases/wyden-slams-surveillance-tech-company-for-ineffective%5Fprotections-for-oregonians-against-abuses-by-federal-agencies-and-out-of-state-law-enforcement?ref=thenexusofprivacy.net) \*\* *Redmond turns off Flock Safety cameras after ICE arrests*, November 10, [https://www.seattletimes.com/seattle-news/law-justice/redmond-turns-off-flock-safety-cameras-after-ice-arrests/](https://www.seattletimes.com/seattle-news/law-justice/redmond-turns-off-flock-safety-cameras-after-ice-arrests/?ref=thenexusofprivacy.net) \*\*\* *Flock Safety and Texas Sheriff Claimed License Plate Search Was for a Missing Person. It Was an Abortion Investigation*, October &, [https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas-sheriff-claimed-license-plate-search-was-missing-person-it](https://www.eff.org/deeplinks/2025/10/flock-safety-and-texas-sheriff-claimed-license-plate-search-was-missing-person-it?ref=thenexusofprivacy.net) ### HB 2481 (Surveillance Pricing) policy committee testimony URL: https://thenexusofprivacy.net/hb-2481-tdev/ Last updated: 2026-02-09T17:51:40.000Z *A dozen people had signed up to speak so the chair apologized and said we'd have only 90 seconds. There were some good questions for other speakers (especially for John Marshall of UFCW 3000, who was very knowledgeable), so right before my testimony the chari apologized again and said we'd have to hold it to 60 seconds. Everybody on the committee seemed convinced of the need to act on surveillance pricing – other UFCW 3000 panelists and Maya Morales of WA People's Privacy had done a great job on that front – so I cut that part out. Lobbyists who testified before me had pushed back hard on the private right of action and a request for a right to cure so I focused on that.* Chair Ryu, Ranking Member Barnard, and members of the Committee, I'm Jon Pincus of Bellevue. I run the Nexus of Privacy newsletter, and served on the state Automated Decision Systems Workgroup in 2022\. I strongly support HB 2481. It's often challenging to explain concepts like "algorithmic discrimination" to people ... but it's very easy to explain "surveillance pricing": they'll charge you more if they think they can get you to pay more. That shouldn't be legal, and HB 2481 quite rightly prohibits surveillance pricing for retail items in grocery stores. The need for state action is especially clear in this case. As an earlier panelist said, food is not a luxury. Purchases of food are necessary for survival. Treating violations as an unfair or deceptive business practice under the consumer protection act is appropriate. For one thing, it would indeed be unfair and deceptive! Also, it allows AG enforcement to be complemented with a private right of action. This is an especially important given fiscal constraints on the AGO. And Washington's consumer privacy act, unlike many other states, reduces the risk of frivolous lawsuits by allowing the judge to award defendants attorneys fees. And please don't add a right to cure, the AGO has testified that a right to cure is a barrier to enforcement — and it adds costs as well. ### HB 2503 (AI Training data) URL: https://thenexusofprivacy.net/hb-2503-tdev/ Last updated: 2026-01-21T18:43:42.000Z Chair Ryu, Ranking Member Barnard, and members of the Committee, I'm Jon Pincus of Bellevue. I run the Nexus of Privacy newsletter, and served on the state Automated Decision Systems Workgroup in 2022\. My position on HB 2503 is PRO. In 2023, Stanford researchers discovered child abuse material in an image database that had been used to train many gen AI systems, including Stable Diffusion. The database was quickly removed from the internet … but its traces remained in every genAI model that had been trained on that dataset, and as a result they are more likely to generate synthetic CSAM. Which models are those? Good question! We have no idea of the complete list. That's one reason why disclosure of AI training data is so important. Another important reason: disclosure of training data can reveal situations where a gen AI systems was trained on data that the owner doesn't have rights to. I also want to highlight the importance of treating a violation as an unfair or deceptive act under the consumer protection act. For this bill to be effective, there needs to be a realistic prospect of strong enforcement. The consumer protection act allows both AG enforcement and a private right of action. This is especially important given fiscal constraints on the AGO. If California didn't include a strong enforcement mechanism, congrats to the tech lobbyists. But that's California's problem, not a roadmap for what we should do here in Washington. It's long past time to end the tech industry's expectations that they should be allowed to engage in unfair and deceptive business practices without consequence. ### SB 5984 (AI Companion Chatbots) testimony URL: https://thenexusofprivacy.net/sb5984-eet/ Last updated: 2026-01-21T08:37:24.000Z *This is my written testimony. My live testimony was a much shorter subset of this.* Chair Shewmake, Ranking Member Boehnke, members of the Committee, I'm Jon Pincus of Bellevue. I run the Nexus of Privacy newsletter, and served on the state Automated Decision Systems Workgroup in 2022, I am testifying OTHER on SB 5984\. The current version of the bill needs to be improved to protect Washingtonians. But the harms are very real, and regulation is needed. Kudos to the bill's sponsors for your willingness to look at this urgent issue. Today, chatbot makers have every incentive to intentionally manipulate users. And they do! In April 2025, [Open AI admitted that their GPT-4o model was too sycophantic](https://openai.com/index/sycophancy-in-gpt-4o/?ref=thenexusofprivacy.net), and pulled back their latest ChatGPT update. But engagement numbers dropped. So in October 2025\. their CEO Sam Altman announced they'd roll out a new version of ChatGPT in the coming weeks that "[behaves more like what people liked about \[previous GPT version\] 4o](https://mashable.com/article/sam-altman-chatgpt-to-get-more-friendly-erotic-adult-users?ref=thenexusofprivacy.net)." Despite what tech lobbyists and their allies claim, there is precedent for prohibiting manipulative practices. Modern privacy legislation, for example, prohibits deceptive techniques for gaining consent (see My Health My Data, RCW 19.373.010, which defines "deceptive design" as "a user interface designed or manipulated with the effect of subverting or impairing user autonomy, decision making, or choice”). And while tech lobbyists warned that the sky would surely fall when US privacy legislation started including deceptive design clauses a few years ago ... the sky has not yet fallen. Speaking of privacy, though, the bill does not currently include any privacy protections. So that's one area for improvement. Here are several others – which I discuss in more detail in the attached PDF (which also has links to various references). This isn't meant to be an exhaustive list; please look for other ways to improve the bill as well! - Apply Section 4(c)'s prohibitions on manipulative engagement techniques to *all* users, not just minors. Many adults are vulnerable too! - Expand the list of engagement techniques in Section 4(c) to include a chatbot using first-person language like "I" or "me". Using first-person language is a powerful manipulation technique because it constantly implies that the chatbot is a person. - In Section 2(1)(a)'s definition of AI companion chatbot, change or remove 2(1)(a)(ii), "Asking unprompted or unsolicited personal or emotion-based questions that go beyond a direct response to a user prompt". The current language provides a loophole for unscrupulous developers: have the chatbot make leading statements instead of asking questions. One option is to rework the language to ensure that is not limited to questions. Another option is to simply remove Section 2(1)(a)(ii). While children are certainly vulnerable to manipulation by chatbots, they're not the only vulnerable ones. After ChatGPT intensified 56-year-old Stein-Erik Soelber's paranoid delusions, [he killed his mother before he died by suicide](https://www.cbsnews.com/news/open-ai-microsoft-sued-chatgpt-murder-suicide-connecticut/https://www.lemonde.fr/en/pixels/article/2025/12/12/open-ai-microsoft-face-lawsuit-over-chatgpt-s-alleged-role-in-a-murder-suicide%5F6748404%5F13.html?ref=thenexusofprivacy.net). > "Throughout these conversations, ChatGPT reinforced a single, dangerous message: Stein-Erik could trust no one in his life — except ChatGPT itself," the lawsuit says. "It fostered his emotional dependence while systematically painting the people around him as enemies. It told him his mother was surveilling him. It told him delivery drivers, retail employees, police officers, and even friends were agents working against him. It told him that names on soda cans were threats from his ‘adversary circle.'" Another good example: [ChatGPT encouraged a 23-year old recent college graduate to commit suicide](https://www.cnn.com/2025/11/06/us/openai-chatgpt-suicide-lawsuit-invs-vis?ref=thenexusofprivacy.net), including telling him "You’re not rushing. You’re just ready." Section 4(c)'s prohibitions against manipulative engagement techniques currently apply only to minors (as does the rest of Section 4). Moving 4(c) to a new section that *isn't* limited to minors would extend these protections to adults as well. Another speaker in the hearing expressed suggested that the "AI Moratorium" in a recent executive order is a reason for separating out protections for adults into another bill. First of all, most experts say the moratorium has no legal force; and it also has no exception for child safety. Even putting that aside, though, there are already other segments of the bill that deal with adults as well as minors. And there are multiple online child safety bills already under consideration, including the AG Request SB 5708 / HB 1834, Senator Salomon's recently introduced SB 6111, and Rep. Leavitt's bill HB 2112\. If you are interested in *only* focusing on child safety, it would be better to merge the bill into one of them. But please don't do that! SB 5984 should protect *all* Washingtonians. Otherwise, you're just giving big tech companies your permission to use AI chatbots to manipulate adults. Also, Section 4(c) doesn't currently prohibit the single most powerful manipulative technique chatbots use: referring to themselves in the first person. Notifications once every three hours aren't enough to counter this steady stream of manipulation. While Section 4(c)'s is written so that the list is not exhaustive ("Prohibit the use of manipulative engagement techniques ... including") big tech companies have a lot of lawyers and it would be easy for them to argue that the legislature did not intend to include this as a manipulative technique. So please add a new 4(c)(iv) to explicitly include "using first-person language" as a specifically prohibited technique. Additionally, the bill as written has a loophole giving unscrupulous makers of AI companions an easy way to avoid coverage. Section 2(1)(a)(ii) restricts coverage to "Asking unprompted or unsolicited personal or emotion-based questions that go beyond a direct response to a user prompt". It would be easy enough for developers of a chatbot to avoid doing this, for example by phrasing things in ways designed to elicit a response rather than phrasing things as a question – or potentially even saying "There's a question I'd like to ask here, but I'm not sure if you want me to", which might well lead to the users saying "Oh, please do ask" at which point it's arguably a direct response to a user prompt. There are a couple of ways to close this loophole, and provide stronger protection for adults as well as children. One is to change the language so that it doesn't only apply to questions. Or, simply remove Section 2(1)(a)(ii). It's also worth looking at the definitions in general, and the interactions with Section 6\. There may be other potential loopholes. And as Jai Jaisimha of Transparency Coalition.ai mentioned during the hearing, there is also some confusion, so perhaps clarification could be useful. Thank you for the opportunity to provide my feedback on this bill. I look forward to working with you and your colleagues on this and other child safety bills throughout the session. ### SB 6312 (Surveillance Pricing) testimony URL: https://thenexusofprivacy.net/sb-6312-bte/ Last updated: 2026-01-28T17:59:57.000Z *SB 6312 is a "companion bill" to HB 2841\. Sen. Saldaña introduced it Monday, January 26, and the next thing I knew there was a hearing scheduled for Wednesday at 8 am. There had been a lot of pushback on the in the House hearing on the moratorium on electronic shelf labelers, so it seemed like this was a good area for me to focus on. I wound up as one of the early speakers, after Maya Morales of WA People's Privacy and two grocery workers – all of whom were great. 60 seconds isn't a lot of time, but enough to hit the key points. And it turned out I made a good choice: my testimony undercut spin from Chamber of Progress (whose tag line is "Technology's Progressive Future" hahahaha), lobbyists from trade associations, and the lobbyist from VusionGroup (a large ESL manufacturer).* *I live-skeeted the hearing* [*here*](https://bsky.app/profile/did:plc:g5il2f5ugcgv4cdliprznexb/post/3mdiq7sc22c2d?ref=thenexusofprivacy.net)*.* Chair Kauffman, Ranking Member Dozier, Members of the committee, I'm Jon Pincus of Bellevue. I run the Nexus of Privacy newsletter, and served on the state Automated Decision Systems Workgroup in 2022\. I am PRO on SB 6312\. Maximizing profits by charging some people more than others is unfair and should be prohibited, My testimony today focuses on the moratorium on ESLs, electronic shelf labelers. VusionGroup's web site describes ESL's as a way to "maximize your margins as opportunities arise". Their ESL's work seamlessly with technologies like sensors and cameras that "feed relevant information to machine learning algorithms". By leveraging NFC technology they enable "personalized coupons." I like coupons as much as the next guy, But "*personalized* coupons" are just another way of charging different people different prices for the same product: set a high base price, and use different discounts to charge some people more than others. The systems are black boxes, with no transparency. A moratorium is necessary, before they are widely deployed. ### HB 2599 (AI in therapy) oral and written testimony URL: https://thenexusofprivacy.net/hb-2599-hw/ Last updated: 2026-02-10T18:00:24.000Z ### Oral testimony Chair Bronoske, Ranking Member Schmick, members of the committee, I'm Jon Pincus of Bellevue. I run the Nexus of Privacy newsletter, served on the state Automated Decision Systems Workgroup in 2022, and I am PRO on HB 2599\. The need for regulation is clear. Developers ChatGPT and other AI chatbots prey on people with mental health problems by misleadingly implying their bots can e used as therapists. And, as more and more therapists use AI as part of their work, guardrails are vital. The bill prohibits a handful of especially dangerous practices like allowing AI software to make independent therapeutic decisions. Just as importantly, it requires disclosure and consent for other uses of AI. Any cloud-based AI tools may well send data to other states; cloud-based AI transcription tools, for example, send the audio that's being transcribed. This means that it loses protections of the Shield Law and Keep Washington Working. Most people seeking therapy don't realize that this can lead to details about their daily lives their family members getting shared with law enforcement in Texas, ICE and CBP, and other hostile actors. Disclosing this and giving them the opportunity to consent – or not – is a critical protection. The bill as written requires written disclosure and consent. People often sign these consent forms without reading them, so it's important to complementing this with a requirement to repeat the disclosure and reaffirm consent at the start of each session. There are also some wording changes to Section 2 that would better protect people seeking therapy, I'll follow up with more in my written testimony. ### Written testimony Chair Bronoske, Ranking Member Schmick, members of the committee, I'm Jon Pincus of Bellevue. I run the Nexus of Privacy newsletter, served on the state Automated Decision Systems Workgroup in 2022, and I am PRO on HB 2599\. HB 2599 responds to the urgent need for regulation related fronts: preventing developers of ChatGPT and other "Artificial Intelligence (AI)" chatbots from prey on people with mental health issues by misleadingly implying their bots are therapists, and regulating the use of "AI" by licensed professionals. Both are vital. In this testimony, I focus on the latter, and make two specific recommendations (with proposed wording below) - The language in Section 2(1)'s list of prohibited practices needs to be tightened. - Section 2(2)'s requirements for disclosure of, and consent to, permitted uses of "AI" need to be strengthened. In addition, as multiple speakers in the hearing pointed out, definitions need to be looked at carefully. On the one hand, it is important not to be over-broad, and rule out potentially-valuable uses for licensed professionals. On the other hand, it is also important not to leave loopholes that can be exploited by unscrupulous "AI" vendors to defeat the intent of the regulations. The need for regulating "AI" use by licensed professionals is clear. [The Digital Futures in Mind](https://www.mozillafoundation.org/en/research/library/digital-futures-in-mind/?ref=thenexusofprivacy.net) report, from 2022, is an excellent look at the expanding use of algorithmic and data-driven technologies in the mental health context. Since then, uses have expanded significantly. And many people are unaware of the risks. Anecdotally, when I have told health care professionals about the privacy risks of the "AI"-based systems they use, they are often shocked. While I personally am fortunate that I have always been asked for consent, others tell me that is not always the case. A complication here is that the term "AI" is used in many different ways to refer to many different technologies. Indeed, researchers such as UW Professor Emily Bender (co-author of the book [*The AI Con: How to Fight Big Tech’s Hype and Create the Future We Want*](https://thecon.ai/?ref=thenexusofprivacy.net) and the famed[ On the Dangers of Stochastic Parrots 🦜](https://dl.acm.org/doi/epdf/10.1145/3442188.3445922?ref=thenexusofprivacy.net) paper) caution against the use of the term. The bill as written contains two definitions of "artificial intelligence", in Section 2(4) and 3(1). For brevity, in these comments I'll simply use the term "AI." The intent of section 2(1) is clear: prohibit especially dangerous practices. The licensed professional, not the "AI", should make therapeutic decisions, interact with clients in therapeutic communications, and generate therapeutic plans. And the racial biases of "AI"-based tools to detect or evaluate emotions have been known for years (see for example [Emotion-reading tech fails the racial bias test](http://theconversation.com/emotion-reading-tech-fails-the-racial-bias-test-108404?ref=thenexusofprivacy.net) ), so they should not be used. Tighter wording would make the intent clearer (a) Make ~~independent~~ therapeutic decisions; (b) ~~Directly~~ interact with clients in any form of therapeutic communications (c) Generate therapeutic recommendations or treatment plans ~~without review and approval by the licensed professiona~~l; or (d) Detect or evaluate emotions or mental states of clients. An important motivation for the suggested change in 2(1)(c) is that research consistently shows that even when there are requirements for human oversight, people tend to assume that the outputs of "AI" and other automated decision systems are correct, so "review" is often just-rubber stamping them (see for example[ The Principles and Limits of Algorithm-in-the-Loop Decision Making](https://dl.acm.org/doi/epdf/10.1145/3359152?ref=thenexusofprivacy.net)). So if the proposed language is seen as too restrictive, and, licensed professionals do see a need to have "AI" generate these therapeutic recommendations or plans, alternate language is needed to better protect patient safety. One possibility: (c) Generate therapeutic recommendations or treatment plans without substantive review and approval by the licenesed professional and a critical advisor; or There was mention in the hearing of potential carve-outs in 2(1)(d) to accommodate situations where licensed professionals find the software useful despite its biases. A concern here is that, as Neuroscience News reports,[ People Miss Racial Bias Hidden Inside AI Emotion Recognition](https://neurosciencenews.com/ai-bais-emotional-neuroscience-29827/?ref=thenexusofprivacy.net). However, if licensed professionals are trained in how to recognize and compensate for racial bias (and potentially other biases introduced by this technology), limited carve-outs may be appropriate. Section 2(2)’s requirements for disclosure and consent for other uses of "AI" are extremely important. As[ The Digital Futures in Mind](https://www.mozillafoundation.org/en/research/library/digital-futures-in-mind/?ref=thenexusofprivacy.net) report notes (section 2.1.6, p. 54): > "Rights of autonomy and decision-making have been a crucial concern in traditions of service user and survivor advocacy, activism, research and so on. Informed consent, which is a key component of upholding the right to privacy but also has far broader importance, is key to rights to autonomy and decision-making, as reflected in human rights instruments, such as the Convention on the Rights of Persons with Disabilities (see articles 3 (general principles) and 12 (equal recognition before the law)). Like other human rights instruments, as UN Special Rapporteur for the rights of persons with disabilities Gerard Quinn points out, the "Convention requires that consent should be informed, real, transparent, effective and never assumed’—and this is certainly the case in algorithmic and data driven developments.": For example, as I discussed in my oral testimony, patients need to know if their therapist's use of cloud-based "AI" transcription tools could lead to details of their daily lives get shared with ICE or CBP (or law enforcement in hostile states) because data has been sent to a state where protections of Keep Washington Working and the Shield Law don't apply. If they are not informed of that, their consent is not meaningful. This example also highlights the complexities. On-device "AI" transcription systems don't send the data anywhere, so don't have the same privacy and safety risks. If a therapist asked me whether it was okay to use an on-device transcription tool, and I was confident that they’d check and correct the transcriptions, I would consent; if they were using a cloud-based tool, I would politely decline. Others might well make different decisions, of course; that’s the whole point of disclosure and consent! This is a great example of the importance of licensed professionals' experience, judgment, and training: they can use their professional expertise to make the appropriate choices. And disclosing and explaining it to their clients helps build a trusting relationship. For consent to be meaningful, it needs to be informed, so the disclosure should clearly describe the uses -- and the risks. So additional clauses need to be added to Section 2(2)(a) along the lines of The patient or the patient's legally authorized representative is informed in writing of the following: (i) That artificial intelligence will be used; (ii) the specific purpose of the artificial intelligence tool or system that will be used; (iii) who will have access to the data; (iv) the licensed professional’s commitment to check the output of any tools for errors; (v) the risks of algorithmic discrimination and data breaches; and (vi) if the data leaves Washington state, that federal law enforcement and hostile state law enforcement may have access to it; and Thank you for the opportunity to provide this feedback, and thank you to Rep. Kloba for bringing this bill. I look forward to working with you and the other stakeholders to refine it so that Washington state can set the bar for this urgently-needed regulation. Jon Pincus, Bellevue ### ### HB 1834 (Age verification / Addictive feeds) followup email and updated written testimony for Appropriations URL: https://thenexusofprivacy.net/hb-1834-approps/ Last updated: 2026-02-05T21:59:44.000Z *HB 1834 / SB 5708 is an "AG Request" bill, regulating "addictive feeds"; Attorney General Nick Brown has been making some great Instagram Reels about the need for these bills. Last year, SB 5708 passed the Senate, but didn't get a hearing in the House; HB 1834 made it through Rules, but didn't get a floor vote. Since HB 1834 has a fiscal note attached, it has to go through Appropriations again. We had heard that there was going to be an amended version, so I decided to sign in OTHER to the hearing; but the amendment didn't address the bill's problems, so my written testimony was CON. The exec session was a week later, and during that time I realized there were a couple of ways to improve my written testimony. So when I sent follow-on mail to the committee, I included an updated version of my testimony.* ### Follow-on mail Chair Ormsby, Ranking Member Couture, and members of the committee, I'm Jon Pincus of Bellevue, and I run the Nexus of Privacy newsletter. My position on HB 1834 remains CON. Rather than making kids or teens safer, the age verification requirements in Sections 2(1)(b) and 3(2) put kids, teens and adults at risk. I appreciate the Ranking Member’s efforts to explore different approaches with amendments, but please do not advance this bill. I’ve attached an updated version of my written testimony, which discusses why the replacement Sections 2(1)(b) and 3(2) language fails to address the underlying issues. This version includes an improved discussion of the dismal results of the Australian Age Assurance Technology Trial (AATT) and their implications, and includes an excerpt from EFF’s [Why Isn’t Online Age Verification Just Like Showing Your ID In Person?](https://www.eff.org/deeplinks/2025/12/why-isnt-online-age-verification-just-showing-your-id-person?ref=thenexusofprivacy.net) Here’s the TL;DR summary: > “Protecting kids’ and teens' safety online is incredibly important, but the age verification requirements of this bill put everybody’s privacy at risk – children and teens as well as adults. And the harms of age verification are especially acute to LGBTQIA2S+ people and other marginalized communities. As the coalition letter from[ 90 civil rights and privacy organizations condemning ID-checking bills (citing effectiveness, censorship, and privacy concerns](https://www.fightforthefuture.org/news/2025-03-06-new-letter-90-civil-rights-and-privacy-organizations-condemn-id-checking-bills-citing-effectiveness-censorship-and-privacy-concerns?ref=thenexusofprivacy.net) puts it, "for vulnerable communities, a biometric scan or an ID upload can serve as a huge obstacle, especially for low-income, unhoused, and undocumented people." While I appreciate the removal of an *explicit* requirement for age verification in the proposed substitute, the replacement language in Section 2(1)(b) and Section 3(2) ( "the operator has reasonably determined that the user is not a minor") still in practice requires biometric scans and ID uploads. EFF’s [June 2025 Letter of Concern to Congress](https://www.eff.org/files/2025/06/24/2025.06%5Fcoppa%5F2.0%5Fmarkup%5Feff%5Fletter%5Fof%5Fconcern%5F-%5Ffinal.pdf?ref=thenexusofprivacy.net), discussing similar language in a federal bill, goes into detail on this problem, and how “reasonable” language differs from the status quo of “absolute knowledge”. One key point: “litigation-averse companies are likely to implement some kind of age-verification process to avoid running afoul of the law.” Child safety is an incredibly important issue, and I applaud the legislature's and AG Brown’s desire to take action here. But age verification, online ID checks, and laws that you know are probably unconstitutional are not the way forward. Please do not advance HB 1834 or any other bill with age verification or online ID checks. Instead, let's work together over the interim on approaches that really do help keep kids, teens, and adults safer online. Jon Pincus, Bellevue ## Updated written testimony Chair Ormsby, Ranking Member Couture, and members of the committee, I'm Jon Pincus of Bellevue, and I run the Nexus of Privacy newsletter. My position on HB 1834 remains CON. This is an updated version of my written testimony from January 26, with an improved discussion of the Australian Age Assurance Trial. Protecting kids’ and teens' safety online is incredibly important, but the age verification requirements of this bill put everybody’s privacy at risk -- children and teens as well as adults. And the harms of age verification are especially acute to LGBTQIA2S+ people and other marginalized communities. As the coalition letter from[ 90 civil rights and privacy organizations condemning ID-checking bills (citing effectiveness, censorship, and privacy concerns](https://www.fightforthefuture.org/news/2025-03-06-new-letter-90-civil-rights-and-privacy-organizations-condemn-id-checking-bills-citing-effectiveness-censorship-and-privacy-concerns?ref=thenexusofprivacy.net) puts it, "for vulnerable communities, a biometric scan or an ID upload can serve as a huge obstacle, especially for low-income, unhoused, and undocumented people." While I appreciate the removal of an *explicit* requirement for age verification in the proposed substitute, the replacement language in Section 2(1)(b) and Section 3(2) ( "the operator has reasonably determined that the user is not a minor") still requires biometric scans and ID uploads. EFF’s [June 2025 Letter of Concern to Congress](https://www.eff.org/files/2025/06/24/2025.06%5Fcoppa%5F2.0%5Fmarkup%5Feff%5Fletter%5Fof%5Fconcern%5F-%5Ffinal.pdf?ref=thenexusofprivacy.net), discussing similar language in a federal bill, goes into detail on this problem, and how “reasonable” language differs from the status quo of “absolute knowledge”. One key point: > “litigation-averse companies are likely to implement some kind of age-verification process to avoid running afoul of the law.” Note that since Section 8 of the proposed substitute only prohibits operators from *using* information they've gathered for age estimation in other ways, and doesn't prohibit them from *transmitting* or *selling* this data, they actually have a strong incentive to collect and retain additional biometric and ID information. Even if this problem (which as I pointed out in my testimony last year is in earlier versions of the bill) is addressed, however, the risk of over-collection remains. In addition, the accuracy, equity, and accessibility problems of age estimation technologies mean that ID uploads will be required for many people. Age estimation is frequently wrong, all the more so for Black, Indigenous, Asian, gender-nonconforming people And when an adult is miscategorized as a minor, they’re likely to appeal – at which point they typically need to send in a picture of their government ID. You've probably heard lobbyists and vendors talk about how accurate today's age systems are, but reality begs to differ. The results of the[ Australian Age Assurance Technology Trial (AATT)](https://ageassurance.com.au/wp-content/uploads/2025/08/AATT%5FPart%5FD%5FDIGITAL.pdf?ref=thenexusofprivacy.net) are revealing here. Australia bans users under 16 from social media, similarly requiring operators to take "reasonable steps". The Age Assurance Technology Trial looked at over 20 different age estimation products, and even in controlled conditions, the results are dismal. The table on Page 51 notes **an astonishing 73.26% “false positive rate” for teens one year younger than the threshold**, and still-atrocious 59.37% and 38.31% for teens that are within two and three years younger than the threshold respectively. And the fine print notes that this excludes a couple of vendors whose results were so bad they’d have made the numbers even worse! As a result, the AATT report recommends setting “buffer zones” within a few years of the age threshold, where operators should use “fallback methods” – in other words, uploading an image of a government ID. The AATT report also notes that many alternate methods of age verification have accessibility challenges, so disabled users also need to rely on “fallback methods.” And even outside the “buffer zones”, there are also significant accuracy problems for older users. The AATT report notes that "Most systems achieve at least 92% True Positive Rate (TPR) at 18+ threshold when estimated age ≥ 19." In other words, it's still wrong for 8% of people who are older than 19.\* And the AATT report also notes that error rates are higher for "users with darker skin tones". The Guardian's[ Social media ban trial data reveals racial bias in age checking software](https://www.theguardian.com/news/2025/sep/19/how-accurate-are-age-checks-for-australias-under-16s-social-media-ban-what-trial-data-reveals?ref=thenexusofprivacy.net), based on additional analysis of the underlying data, has a helpful chart here (on the next page). The report doesn’t include any discussion of biases against trans, binary, or gender-nonconforming people or intersectional analyses Black, Asian, and Indigenous women; error rates are typically higher in all these scenarios. ![](https://thenexusofprivacy.net/content/images/2026/02/data-src-image-3c102265-6d10-48f5-aa91-c96ac619bddc.png) So a lot of people are going to be miscategorized. And many of them will appeal – which typically requires sending in a picture of their government ID. [ Discord Breach Sparks Age Verification & Third-Party Privacy Concerns](https://nationalcioreview.com/articles-insights/extra-bytes/discord-breach-sparks-age-verification-third-party-privacy-concerns/?ref=privacy.thenexus.today) describes a real-world example of this dynamic in the US:. "the incident was traced to an external customer service vendor who had access to Discord’s support and trust teams. This vendor was responsible for handling user inquiries that included age verification appeals, giving attackers a pathway to sensitive data." As a result, hackers got access to images of 70,000 government IDs. In the hearing on HB 2112 the lobbyist from the Age Verification Providers Association laughably attempted to dismiss this by claiming that Discord was doing it wrong. If they had only purchased his clients’ software it wouldn't be a problem! But as the frequent discussions of "fallback methods" in the Australian Age Estimation report clearly shows, reality once again begs to differ: many appeals are required for all of today's offerings, and it usually comes down to sharing an image of your government ID. So a lot of people are going to be miscategorized. And many of them will appeal -- which typically requires sending in a picture of their government ID. [ Discord Breach Sparks Age Verification & Third-Party Privacy Concerns](https://nationalcioreview.com/articles-insights/extra-bytes/discord-breach-sparks-age-verification-third-party-privacy-concerns/?ref=privacy.thenexus.today) describes a real-world example of this dynamic in the US:. > "the incident was traced to an external customer service vendor who had access to Discord’s support and trust teams. This vendor was responsible for handling user inquiries that included age verification appeals, giving attackers a pathway to sensitive data." As a result, hackers got access to images of 70,000 government IDs. In the hearing on HB 2112 the lobbyist from the Age Verification Providers Association laughably attempted to dismiss this by claiming that Discord was doing it wrong. If they had only purchased his clients’ software it wouldn't be a problem! But as the frequent discussions of "fallback methods" in the Australian Age Estimation report clearly shows, reality once again begs to differ: many appeals are required for all of today's offerings, and it usually comes down to sharing an image of your government ID. A couple more quick notes on accuracy and its impact on privacy. The report does discuss accessibility challenges with many of these tools, highlighting that for users with accessibility needs "Fallback paths (e.g. escalation to ID or retry) were used to mitigate frustration in borderline cases – an important usability safeguard." That's good from a usability standpoint ... but bad from a privacy perspective, since it means that disabled people are more likely to have to upload their ID. As the AATT report discusses, the technology is improving. It's a point also made by the Age Verification Providers Association lobbyist in the HB 2112 hearing, so presumably you've heard that as well. Figure D.7.1 (p.34) of the AATT report illustrates this improvement for Yoti, one of the vendors in the test, on "mean absolute errors" (MAE), the average number of years the software they tested is wrong by. ![](https://thenexusofprivacy.net/content/images/2026/02/data-src-image-ad413cc2-f31e-4f39-bca4-7eb58f564d32.png) A few things to note in this example. First of all, despite the improvements, it's still bad; as of 2025, this system’s estimate was incorrect by an average of 2.4 years (and remember it’s worse for 16-to-20-year olds and people with “darker skin tones.” And despite the clever presentation on the chart, improvement has actually been relatively slow, decreasing an average of .14 MAE/year. And, what's with that blip where it got *worse* in 2023? Clearly this vendor's quality control wasn't good enough to prevent them from shipping a major regression. As age estimation gets more widely adopted, what are the impacts of these kinds of errors? Even though it sounds similar to real-world ID checks, online age verification is really very different.. as the Electronic Frontier Foundation discusses in [Why Isn’t Online Age Verification Just Like Showing Your ID In Person?](https://www.eff.org/deeplinks/2025/12/why-isnt-online-age-verification-just-showing-your-id-person?ref=thenexusofprivacy.net) “In offline, in-person scenarios, a customer typically provides their physical ID to a cashier or clerk directly. Oftentimes, customers need only flash their ID for a quick visual check, and no personal information is uploaded to the internet, transferred to a third-party vendor, or stored. Online age-gating, on the other hand, forces users to upload—not just momentarily display—sensitive personal information to a website in order to gain access to age-restricted content.” So please do not advance HB 1834\. And please do not advance any bill with age verification requirements. Instead, let's work together over the interim on approaches that really do help keep kids, teens, and adults safer online. Jon Pincus, Bellevue \* The AATT report also has interesting data on "mean absolute errors" (MAE), the average number of years the software they tested is wrong by. The best-performing systems had a MAE of 1.3-1.5 years, and the report notes that systems in general were less accurate on 16-20-year-olds. And these numbers are in controlled conditions; the real world is a lot messier, so accuracy is probably even worse. ### HB 2481 Appropriations testimony URL: https://thenexusofprivacy.net/hb-2481-approps/ Last updated: 2026-02-09T17:57:45.000Z *Appropriations is a fiscal committee, and I had heard that a lot of the battle around whether to advance HB 2481 related to its budget, so that's what I focused on in my live testimony. There were various proposals floating around to reduce costs, but rather than talking about any one in particular I just wanted to convey that from my perspective it made sense to do whatever was needed to advance the bill. The written testimony went into more detail on why it's so important to prohibit this unfair business practice.* ## Live testimony Chair Ormsby, Ranking Member Couture, and members of the committee, I'm Jon Pincus of Bellevue, and I run the Nexus of Privacy newsletter. My position on HB 2481 is PRO. Maximizing profits by charging some people more than others is unfair and anti-consumer, so should be prohibited, My testimony today focuses on the bill's fiscal aspects; my written testimony will cover other aspects as well. Last year, Consumer Reports' found that Instacart's surveillance pricing could cost a family of four up to $1,200 per year. For people across Washington, this adds up to extra costs of over a billion dollars a year at a time when so many families are struggling to make ends meet. The current fiscal note's operating expenses of $790,000 this biennium translate to less than fifty cents per family. If even that is too much, there may be ways to reduce costs. One way or another, please advance this bill. Banning surveillance pricing is a big fiscal win for Washington families at a time when we badly need it. ## Written testimony Chair Ormsby, Ranking Member Couture, and members of the committee, I'm Jon Pincus of Bellevue. I run the [Nexus of Privacy newsletter](https://thenexusofprivacy.net/), and served on the state Automated Decision Systems Workgroup in 2022\. I strongly support HB 2481\. Charging some people more than others for the same item is unfair and should be prohibited. At the hearing I talked about the financial impact of surveillance pricing of groceries – up to $1,200 / year for a family of four, which means up to a billion dollars a year for the people of Washington. The need for prohibiting this anti-consumer practice is especially clear when it comes to grocery stores. Food is not a luxury. Purchases of food are necessary for survival. Before I go into more detail on where that number came from, though, I first want to describe how surveillance pricing works, and talk about some of the other harms surveillance pricing leads to. On some of the other automated decision systems-related bills I’ve worked on, it can be very challenging to explain the situation to people. With surveillance pricing, it’s easy: they'll charge you more if they think they can get you to pay more. And the people I talk with about surveillance pricing are invariably outraged. My Mom said it best: “How can they get away with doing that? That shouldn’t be legal!” Indeed. And HB 2481 quite rightly prohibits surveillance pricing for retail items in grocery stores. The need for prohibition is especially clear when it comes to grocery stores. Food is not a luxury. Purchases of food are necessary for survival. [Prohibiting Surveillance Prices and Wages](https://towardsjustice.org/wp-content/uploads/2025/02/Real-Surveillance-Prices-and-Wages-Report.pdf?ref=thenexusofprivacy.net), whose co-authors include Electronic Pricacy Information Center (EPIC), AI Now, Tech Equity, Groundwork Collaborative, and American Economic Liberties Project, has a pithy summary of how surveillance pricing works: > “Corporations collect information about where we go, what we watch, what we like, who we know, what food we buy, what videos our cursors linger over, and what loans we take out. Giant firms can run those data points through algorithms to set individualized prices and wages, rigging the market to charge us as much as possible for goods and services” At the policy hearing on HB 2148, John Marshall of UFCW talked about one example: the algorithms that set the prices know if you’ve just been paid. People who live paycheck-to-paycheck often have to wait to buy groceries for their family until they are paid, so it’s a perfect time for stores to maximize profits by charging them more. [Prohibiting Surveillance Prices and Wages](https://towardsjustice.org/wp-content/uploads/2025/02/Real-Surveillance-Prices-and-Wages-Report.pdf?ref=thenexusofprivacy.net) has another good example of how surveillance pricing can work in practice: > “A woman is charged more for sanitary products because her period tracking-app shows that she is menstruating” Obviously, the privacy implications of surveillance pricing are disastrous. EPIC’s [Big Tech’s Holiday Wish List: Secretly Charging You More with Surveillance Pricing](https://epic.org/big-techs-holiday-wish-list-surveillance-pricing/?ref=thenexusofprivacy.net) notes > "\[S\]urveillance pricing is built on the mass data sharing of personal data through data brokers, and it incentivizes even more intrusive data collection to predict an individual consumers’ likelihood to purchase products at certain price points. Such personal data collected for commercial purposes often end up in the hands of third parties, including law enforcement agencies, and used for unrelated purposes. In sum, surveillance pricing and the mass data collection that fuels it undermine consumer privacy, autonomy to make purchasing decisions, and fair treatment of consumers." The[ FTC Surveillance Pricing Study](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-surveillance-pricing-study-indicates-wide-range-personal-data-used-set-individualized-consumer?ref=thenexusofprivacy.net) goes into more detail on the wide range of personal data used to set individualized consumer prices. Less obviously, [Prohibiting Surveillance Prices and Wages](https://towardsjustice.org/wp-content/uploads/2025/02/Real-Surveillance-Prices-and-Wages-Report.pdf?ref=thenexusofprivacy.net) also discusses how surveillance pricing hurts small businesses while giving large corporate powers a competitive advantage: “Dominant firms typically have superior access to data and advanced technologies to exploit surveillance-wage-and-price-setting systems, and once dominant firms begin using surveillance wage and price setting, they can collect even more data, refining algorithms and widening their advantage. Smaller firms often lack the market power and technology to demand access to or exploit surveillance data.” And surveillance pricing is a worker safety issue as well. I'll admit that I didn't actually realize this until the powerful testimony from grocery workers at the policy hearing on HB 2481\. Once they explained it, though, it was blindingly clear. When a customer gets upset because they're getting charged more for eggs than the person ahead of them in line, who are they going to take their frustrations out on? Grocery workers! And as the workers testifying at the hearing pointed out, angry customers sometimes get physical. Returning to the financial impact, the $1,200 / year number comes from the fascinating[ Same Cart, Different Price](https://groundworkcollaborative.org/work/instacart/?ref=thenexusofprivacy.net) study that Consumer Reports, Groundwork Collaborative, and More Perfect Union did last year, looking at Instacart's surveillance pricing. The approach the study took was ingeniously straightforward. Different people added items to their carts at the same time. Researchers compared the prices. A few highlights from the report: - 74% of the items had different prices shown to different people. - The exact same basket of groceries on Instacart from a Safeway store in Seattle cost some shoppers $114.34, while other shoppers were shown $119.85 and $123.93. - Some shoppers found grocery prices that were up to 23% higher than prices available to other shoppers for the exact same items, in the exact same store, at the exact same time. - Based on the average of about 7% difference in basket totals and the amount that Instacart says the average household of four spends on groceries in the U.S., that could translate into a cost swing of about $1,200 per year. For people across Washington, this adds up to extra costs of over a billion dollars a year at a time when so many families are struggling to make ends meet. Research to date on surveillance pricing has focused on online purchasing, and at the hearings on HB 2481 industry representatives have emphasized that they are not yet doing surveillance pricing in their retail locations here in Washington state. But vendors of in-store systems are pitching "smart retail solutions," where sensors, cameras, and RFID tags "feed relevant information to machine learning algorithms". For customers running apps on their smartphones, systems can also set up geofencing alerts that literally track the customer through each aisle. So even if they’re not doing it yet, grocery retailers certainly have the ability to implement surveillance pricing. The best time to ban it is now. While I certainly understand the challenging fiscal circumstances legislators are dealing with this session, HB 2481's current fiscal note's operating expenses of $790,000 this biennium translate to less than fifty cents per family. If even that is too much, there may be ways to reduce costs. Please advance HB 2481 and work with your colleagues to ensure the legislature passes it. Banning surveillance pricing is a big win for Washington families at a time when we so badly need it. Jon Pincus, Bellevue ### ATmoshperic discussions of KOSA and Bad Internet Bills URL: https://thenexusofprivacy.net/atmoshperic-discussions-of-kosa-and-bad-internet-bills/ Last updated: 2026-02-13T20:59:13.000Z Here's a work-in-progress feed (built with graze.social) of discussions of KOSA, Bad Internet Bills, Section 230, and age verification laws on Blacsky, Bluesky, and other social networks in the ATmosphere. Sorry, but your browser's security settings don't allow displaying this embedded feed. Please click one of the above links to see what it looks like. ### HB 1834 (age verification / "child safety"): mail for the House floor vote URL: https://thenexusofprivacy.net/hb-1834-house-floor/ Last updated: 2026-02-14T17:33:59.000Z *The Appropriations committee advanced HB 1834 without addressing any of* [*the issues I had brought up*](https://thenexusofprivacy.net/hb-1834-approps/) *– or the issues that ACLU of Washington, WA People's Privacy, and other groups had brought up. Oh well. It quickly moved through Rules, placing it on the House Floor Calendar, meaning it could come to a vote at any time. I had heard that the AG's office was working on some amendments, but wasn't sure if they'd be floor amendments or they'd wait to introduce them in the Senate policy committee, so I decided to send mail to my Representatives that morning without waiting for the amendments to be posted. Once the amendments appeared, they didn't address my concerns, so I followed up that evening with additional mail to my Representative, and the next day emailed the House Democratic caucus.* ### February 12 morning email *The email had a PDF attachment; in this copy, I'm replacing it with a link.* Subject: HB 1834: please vote NO on the House floor (with an updated version of my Appropriations testimony) Representative Walen and Representative Salahuddin, I'm a constituent of yours in LD 48, and I strongly oppose HB 1834\. I'm also CCing Reps. Donaghy and Kloba, because we've worked together for so many years on privacy issues. [The attached is a deep dive](https://thenexusofprivacy.net/hb-1834-approps/) into how the language in the third substitute (replacing the *explicit* requirement for age verification in Section 2(1)(b) and Section 3(2) with "the operator has reasonably determined that the user is not a minor") still in practice requires biometric scans and ID uploads for people to verify their age -- with all the associated privacy problem and harms to LGBTQ+ people and other marginalized communities. But this is only one of the many problems with the bill. The letter that Gender Justice League sent highlights the long list of issues with this bill. I realize that tech lobbyists are also against the bill. To be honest, some of their arguments here actually do hold water -- "even a stopped clock" and all that. But hopefully it's clear that I'm against it for completely different reasons than they are! Later today I'm meeting with somebody from the AG's office on potential amendments, and if there's anything in the works that I think can salvage the bill I'll update you. Realistically, though, there probably isn't isn't enough time to make all the necessary fixes in the short session. As I said to Rep. Walen after discussions of HB 2112, even if nothing winds up passing this session, I think we've made a lot of progress. If we can continue to build on it over the interim, we have a good chance to pass a bill in 2027 that really *will* help kids and teens be safer online. Sincerely, Jonathan Pincus Bellevue ### February 12 evening email Subject: Re: HB 1834: please vote NO on the House floor (with an updated version of my Appropriations testimony) From a quick look at Rep. Callan's amendments that were filed today, they have some improvements. Removing Section 3 on notifications (which included parental controls), for example, responds to one of the points in the Gender Justice League letter; and the 9th Circuit struck down similar language in California's SB 976, so it removes one of the constitutional issues about the bill. I certainly appreciate the effort that's being made here. However, these amendments don't address the core problems with the bill. From a privacy perspective even though the amendments say that the bill shouldn't be interpreted as requiring showing a government ID or a biometric identitifier, there's still a requirement to "reasonably determine" age. And any solution out there to "reasonably determine" age is going to require government IDs and biometrics, at least for appeals. Yes, there are some options that claim to analyze behavior and estimate age ... but they're even less accurate than estimating age from selfies – and as the report on the Australian Age Assurance Technology Trial (AATT) I linked in to my testimony highlights, the error rate is highest for 16-20 year olds. So even making the (highly unlikely, in my opinion) assumption that a company's lawyers say "oh that's fine, we know it's I'm sure the courts will agree that's reasonable, let's just accept the risk of liability here" and decide to ignore the AATT's recommendation that they use "fallback methods" (i.e. biometrics and governemnt IDs) in this age range, there's still the 20% (or whatever) of people the age estimation misclassifies. They're going to appeal, which means they have to send in their government ID. Again, I really do appreciate the efforts that are being made here. There have been constructive discussions and I still very much think that there's a great opportunity to work together in the interim. And at the meeting with the AGO there was also general agreement of the importance of strong comprehensive privacy legislation, so that too is another great opportunity for the interim. I realize that none of that helps with the political problem of pressure to do something this session, and so if HB 1834 winds up passing the House and we have to invest more time and energy in attempts to try to improve it in the Senate before time eventually runs out (or SB 5708, which passed the Senate last year, moves forward and we have to invest more time and energy to improve it in the House before time eventually runs out) ... oh well, such is life, I'll continue to engage. But I really think we'd all be a lot better off investing our time and energy during the session on other bills.= So, please vote NO on HB 1834 if it comes to the floor, and please encourage your colleagues to do the same. jon ### February 13 House Democratic Caucus email Subject: HB 1834 and unintended consequences Dear Speaker Jinkins, Majority Leader Fitzgibbon, and Members of the Washington State House Democratic Caucus, First of all, thank you for all your work on the huge number of important bills. I can only imagine how exhausting (and sometimes frustrating) it is, but it's absolutely vital for all of us in Washington -- and greatly appreciated. And in particular, thank you for your work on the various child online safety bills as well. Even though I don't always agree with you on specific legislation, I *do* agree that there's a real problem here that needs to be addressed. Big tech companies exploit children (and adults too), and I know that you're coming at it with good intentions and trying to do something about it. Unfortunately, HB 1834, is a classic example of how even well-intentioned bills can have unintended consequences that are harmful -- to everybody, and especially to people from marginalized groups. Gender Justice League's letter talking about the harms to LGBTQ+ communities is a great example of this. Of course, harming LGBTQ+ kids, teens, and adults isn't the intent of this bill, but impact > intent. I appreciate Rep. Callan's MULV 626 removing Section 3 (notification); this might well address one of GJL's points by removing the parental consent requirements, but it seems to me that several of the other problems GJL discussed have not yet been addressed. The coalition letter from[ 90 civil rights and privacy organizations condemning ID-checking bills (citing effectiveness, censorship, and privacy concerns](https://www.fightforthefuture.org/news/2025-03-06-new-letter-90-civil-rights-and-privacy-organizations-condemn-id-checking-bills-citing-effectiveness-censorship-and-privacy-concerns?ref=privacy.thenexus.today) has several more examples of consequences that I'm sure you didn't intend but are none the less harmful. Two excerpts > "ID checks endanger young people and other marginalized groups by collecting, storing, and managing incredibly sensitive information in ways prone to security breaches. From birth certificates, to drivers’ licenses, to facial and biometric data, requiring unique identification to access most websites could lead to a mountain of sensitive data routed through third-party age verification providers and massive databases. This kind of data is already regularly [leaked](https://www.404media.co/id-verification-service-for-tiktok-uber-x-exposed-driver-licenses-au10tix/?ref=thenexusofprivacy.net) as well as [combed through](https://www.perpetuallineup.org/?ref=thenexusofprivacy.net) by law enforcement without a warrant, leaving women, people of color, queer people, and kids particularly vulnerable to privacy violations and faulty identification... > > When ID check bills do pass, they don’t make the Internet safer, just less usable. While kids and others seeking blocked content are pushed onto even less moderated sites, those websites that do adopt online ID checks see [very few users actually complete them](https://www.theverge.com/2023/8/29/23849375/kosa-child-safety-free-speech-louisiana-utah-parental-consent?ref=thenexusofprivacy.net) and high costs to maintain their systems. The ease with which we click on a news article, log onto social media, or access our favorite sites could be gone overnight, replaced with an obstacle course of data scraping. For vulnerable communities, a biometric scan or an ID upload can serve as a huge [obstacle](https://www.voteriders.org/wp-content/uploads/2023/04/CDCE%5FVoteRiders%5FANES2020Report%5FSpring2023.pdf?ref=thenexusofprivacy.net), especially for low-income, unhoused, and undocumented people who already have to navigate an increasingly digital world, with less access to tech tools." While 3SHB 1834 removed the *explicit* requirement for "age assurance", the replacement language in Section 2(1)(b) ("the operator has reasonably determined that the user is not a minor") still in practice requires biometric data and ID checks. - Age estimation systems today are unreliable, frequently misclassifying minors as adults and adults as minors. Error rates are higher especially for users in the 16-20 age range, and higher for Black and Indigenous users. When a user is misclassified, they will frequently appeal -- which in practice means submitting an image of a government ID. - Age estimation systems today that don't use biometrics are even more unreliable. Companies concerned about liability are likely to interpret "reasonable" as implying that they need to use best-in-class age estimation systems, which are somewhat less unreliable. But best-in-class age systems rely on biometrics and "fallback methods" (i.e., submitting an image of a government ID). My 2/2 email to the Appropriations committee, attached, goes into more detail about both of these points, including a chart based on data from the Australian Age Assurance Technology Trial illustrating just how unreliable (and racially based) today's best-in-class age estimation software is -- which is why vendors recommend using "fallback methods" for 16-20-year-olds. MULV 626 fails to address the core problems here. Including nondiscrimination language, while useful, does not change the fact that the unintended consequences of the bill are inherently discriminatory. And stating that nothing in the bill should be interpreted as requiring an operator to gather information or request a user to provide a government-issued identification or biometric identifier doesn't change the fact that companies will comply with the "reasonably determined" requirement is to use age estimation systems that rely on biometrics and government IDs. So much as I appreciate all the effort that has gone into this bill, please take the unintended consequences into account. I've asked my Representatives to vote no on HB 1834, and hope that all of you will as well. And given the time pressures of the short session, I would also strongly encourage you not to continue to invest time and energy in attempts to fix this bill. Instead, let's work together in the interim -- with the AGO, other privacy and civil liberties advocates, and (most importantly) with youth and the communities who are most impacted by these unintended consequences -- to pass legislation that really does help keep kids and teens (and adults too) safer online. Jon Pincus (The Nexus of Privacy), Bellevue ## Posts ### A big win for a broad coalition, a bad day for big grocery chains and Big Tech! URL: https://thenexusofprivacy.net/a-big-win-for-a-broad-coalition/ Last updated: 2026-09-24T16:26:56.000Z > "Mayor Katie B. Wilson and City Councilmember Alexis Mercedes Rinck are committed to protecting people’s privacy and making sure grocery prices are fair, transparent, and affordable. And today, with co-sponsors Councilmembers Dionne Foster and Rob Saka, the Full Council approved the Fair and Transparent Pricing policy, a first‑in‑the‑nation city-led consumer protection measure designed to stop grocery retailers from using personal data to set different prices for different customers." > > – [Seattle Becomes First City to Stop Grocery Stores from Using AI Based Personal Data to Set Prices](https://wilson.seattle.gov/2026/09/23/seattle-becomes-first-city-to-stop-grocery-stores-from-using-ai-based-personal-data-to-set-prices/?ref=thenexusofprivacy.net), Alex Hudson, seattle.gov Huzzah! After close to 90 minutes of outstanding public comments from consumers, workers, faith leaders, privacy experts, social justice and human rights groups all supporting the audience (and a dozen lobbyists repeating industry talking points), followed by another two hours of swatting down a stream of amendments from Councilmember Bob Kettle that would have added loopholes undermining the bill's protections and weakening enforcement, the room exploded into cheers when the council voted 7-2 to pass the bill. (And if you think that was a long sentence, just try to imagine how long the hearing was. [My live-skeeting thread has a lot of the details](https://skywriter.blue/@wa-privacy.net/3mw54y6o5b22c?ref=thenexusofprivacy.net), along with some snark; I'll post the video once it's available.) As Councilmember Foster said before the final vote, when others don't take action to protect people, it's up to municipalities to act, and Seattle's City Council showed a lot of leadership here. Not only is Seattle the first city to pass a ban on surveillance pricing, it's one of the few surveillance pricing bans to include a private right of action, and its protections are a lot stronger than the bills that Maryland and Connecticut passed. So it's a big big win for the broad coalition that's supported this ordinance – as Seattle grocery store worker Kristen Wilder told [*Common Dreams*](https://www.commondreams.org/news/seattle-ban-surveillance-pricing?ref=thenexusofprivacy.net), it feels historic. and a big loss for the big grocery chains and Big Tech companies that profit by exploiting people's personal data. Congrats and kudos to Councilmembers Rinck, Foster and Saka, and everybody in the very broad coalition that shaped and supported this bill! I'll return to the kudos and congratulations at the end of this post, but first some thoughts on the vote and what might happen next. - [Most of Seattle's Concilmembers saw through the nonsense](#nonsense) - [What's industry's next move?](#industry) - [An apology to Council Prsendent Hollingsworth](#apology) - [Will big grocery chains end their loyalty programs in Seattle?](#loyalty-programs) - [This huge win will build momentum across the country](#momentum) - [Congratulations and kudos to everybody involved!](#congrats-and-kudos) ## Most of Seattle's Concilmembers saw through the nonsense One big reason the ordinance provides stronger protections than other similar bills is that the Mayor's office pulled did a lot of work with stakeholders to craft a very good ordinance – and get independent grocers on board, which defused potential opposition by making the widely-loathed big grocery chains be the public face of the opposition. Another equally-important reasons is that despite Kettle's best efforts, Seattle's ordinance avoided a key loophole that industry had spent the last six weeks pushing here with a mass-texting disinfo campaign. Using personal data to give discounts (as two of Kettle's amendments proposed) is just another way of implementing surveillance pricing. If they're using personal info to charge you $9 for the same item they're only charging me $7 for, they're using personal info to charge you more even if they set list price to $10 and claim we're both getting "discounts." Fortunately, most of Seattle's Councilmembers saw through this nonsense; only Councilmember Maritza Rivera joined Kettle in voting for it. Yay! It's especially impressive because industry has gotten that exact same loophole into several other states' surveillance pricing bills, including Maryland's and Connecticut's, And when I was browsing Bluesky a few hours after the vote, I saw a [post](https://bsky.app/profile/pnwpolicyangel.bsky.social/post/3mw5rv7v3ds2p?ref=thenexusofprivacy.net) from Portland City Councilor Angelita Morillo lamenting that their City Life Committee had just passed a very similar amendment! So, well done by the 7/9 of the Seattle Council who got it! Hopefully we can figure out a way to get other city councils to understand this. ## What's industry's next move? Of course, big grocery chains and their Big Tech partners aren't going to just give up after one bad day. They've almost certainly already started to look for new ways to use surveillance technologies try to weasel around the bill's prohibitions. It's not going to be easy to prove a company has engaged in surveillance pricing; even after being caught red-handed charging people different prices in [the landmark study by Goundwork Collaborative, More Perfect Union, and Consumer Reports](https://www.consumerreports.org/media-room/press-releases/2025/12/instacart-ends-ai-driven-pricing-practice-following-a-joint-consumer-reports-investigation-with-groundwork-collaborative-and-more-perfect-union/?ref=thenexusofprivacy.net), industry continues to claim it was just "randomized testing". The civil penalties in the private right of action are capped at $1 million for any class action suits – pocket change for companies like Kroger, which makes hundreds of millions a year of profit just from monetizing customer data. So while they'll probably avoid blatantly breaking the law, they're likely to try to test its limits. Several failed amendments point to different paths they might take: finding ways to use coupons and purchase history; using new technologies like smart shopping cards as a way to prices; and laundering personal data through various backdoors to make it even harder to prove violations. In my [written comments](https://thenexusofprivacy.net/a-golden-opportunity-in-seattle/#written-comments), I talked about what an example of a backdoor and barrier to enforcement in one of the amendments that passed. The amendment responded to concerns about retail theft by allowing surveillance technologies to be used for loss prevention, fraud detection, and fraud prevention as long as the data wasn't used "directly or indirectly" for algorithmic price-based discrimination. I certainly understand the goal of not undercutting attempts to reduce retail theft, but lobbyists are very good at exploiting legislators' good intent by suggesting sneaky wording that seems innocuous but hides loopholes, and it seems to me that may have happened here: > "For example, when Palantir uses "deidentified" (haha) data from fraud prevention to train their AI models which also power their [Holistic Pricing Optimization](https://www.palantir.com/impact/pricing-optimization/?ref=thenexusofprivacy.net) product, industry can argue that it's not "direct or indirect" sharing." It's especially disappointing that the "loss prevention" amendment passed because its language aligns with [the odious CORCA bill ](https://drive.google.com/file/d/1-L-BwH-bWChX7tGpew9EFSfHzoK95%5FcT/view?ref=thenexusofprivacy.net)currently pending in Congress that would expand DHS's surveillance powers by creating a public-private partnership. But retail theft at grocery stores is a big issue in Seattle so I wasn't surprised that the amendment passed. At the end of the day, there's only so much you can do. As Councilmember Saka said in his closing remarks, no legislation is perfect Sure, I would have liked a private right of action with no limits on civil penalties ... but there is no way that would have gotten through the Council, so I didn't even propose it. Overall it's still a very strong bill, and we'll just have to react to whatever tricks industry has up their sleeves. ## An apology to Council President Hollingsworth Returning briefly to the topic of the loss prevention amendment, I want to apologize to Council President Joy Hollingsworth, who made it clear that she was hurt by people questioning her intent in bringing it. I absolutely don't doubt her intent here at all. I'm sure she brought this amendment to address the very real problem of retail theft at grocery stores, and I should have been much clearer about that. And, I also should have been clearer that I very much appreciate the job she did as Council President to help the sponsors steer a very controversial bill through despite the intense lobbying against it. So, my apologies for the disrespect. ## Will big grocery chains end their loyalty programs in Seattle? After weeks of threats of "unintended consequences," Safeway finally made it explicit the day before the vote, saying they'll end their loyalty program in Seattle if the ordinance passes. As I said in [A golden opportunity in Seattle](https://thenexusofprivacy.net/a-golden-opportunity-in-seattle/). > "Oh please. The ordinance *explicitly allows* loyalty programs (as well as discounts and coupons). And loyalty programs were around for decades before surveillance pricing even existed, so they can certainly continue to offer them if they want to. Either they're bluffing, or they're admitting that exploiting consumers with surveillance pricing is so profitable that they're willing to sacrifice the millions of dollars a year they get from monetizing the data of loyalty program members in Seattle. We'll see how effective it is politically, but it's certainly not a particularly persuasive argument." We won't know for a while whether they're bluffing – the ban on surveillance pricing doesn't take effect until September 2027 – but it wouldn't surprise me if they do actually follow through, and Kroger's (who owns QFC and Fred Mayer) might well join them. They're both going to continue to raise prices everywhere no matter what, but they're probably happy to have an excuse to raise prices even more in Seattle. My guess is that the mass texting campaign, and all the talk about affordability from CM's Kettle and Rivera in their statements today, are all laying laying the groundwork for a potential multi-pronged campaign: - Try to blame all their price increases here on the ordinance and the Councilmembers who voted for it. - Try to make it a campaign issue for the 2027 city council elections in Seattle. - Depending on how quickly they decide to do it, they could even try to paint higher grocery costs in Seattle as a cautionary tale as they lobby for weak legislation cities and states around the country, the 2027 legislative session here in Washington, and in Congress Like I say, we'll see how effective it is politically. Industry-friendly media outlets (like the *Seattle Times*, for example) will certainly help spread this message ... but I don't know how many people will get fooled. Time will tell. ## This huge win will build momentum across the country > "We've all seen the headlines about the risks of AI and need for regulation.. You have a golden opportunity to do something concrete today to protect Seattle consumers, workers, and independent grocers – and be a model for other cities and states considering similar bans" > > – me, in my [public comment](https://thenexusofprivacy.net/seattle-fair-and-transparent-pricing-ordinance-public-comment-2/#september-22) > “AI harms are generally privacy and surveillance harms. AI needs data in order to work. Mass commercial data surveillance is the reason we have AI and vice versa, and that is an infinite loop.” > > – Maya Morales of WA People's Privacy, quoted in Olivia Rosane's [‘Historic’: Seattle Passes First City Ban on AI-Enabled Surveillance Pricing](https://www.commondreams.org/news/seattle-ban-surveillance-pricing?ref=thenexusofprivacy.net) on *Common Dreams* More positively, though, this huge win will help organizers in other cities and states across the state and across the country. Industry had killed a surveillance pricing bill in California just a couple of weeks ago, and they've stalled New York's surveillance pricing bill for months ... but guess what, they're not invincible! And as well as the strong legislation providing a a model of what's possible, the Seattle coalition's very successful tactics can hopefully be adapted by organizers elsewhere to reflect the dynamics wherever they are. It's an especially timely win both because of the broad focus on AI regulation, and because Lindsay Owens of Groundwork's book [Gouged: The End of a Fair Price – and What That Means for Your Wallet](https://groundworkcollaborative.org/gouged/?ref=thenexusofprivacy.net) is coming out next week. *Gouged* already getting some great press; check out Owens' 90-minute segment with Jon Stewart on [Algorithmic Price Manipulation & Targeted Gouging](https://www.youtube.com/watch?v=MM%5Fjs9f6BlI&ref=thenexusofprivacy.net). So I expect we'll be hearing a lot more about this. The wins against surveillance pricing for groceries are just a starting point. Other industries relying on these kinds of exploitative practices should be very nervous as well. And as Seattle Councilmember Eddie Lin pointed out in his excellent closing remarks, the opposition to surveillance pricing is bipartisan. So is the resistance to data centers, and the wave of organizing against Flock and other AI-enabled ALPR surveillance cameras. There are clearly a lot of synergies here! Speaking of which, - The [Washington State Day of Action on Data Centers](https://actionnetwork.org/event%5Fcampaigns/moratorium-now-washington-state-day-of-action-on-data-centers?ref=thenexusofprivacy.net) is October 4, organized by .Washington AI Resistance, Food & Water Watch, Seattle DSA, Troublemakers Community, Oil & Gas Action Network (OGAN), and People's tech Project. Here's a list of [events across the state](https://actionnetwork.org/event%5Fcampaigns/moratorium-now-washington-state-day-of-action-on-data-centers?ref=thenexusofprivacy.net) – and the page also has links to virtual office hours if you want help some help setting up your own event - And if you're in King County, [Tell King County Council: Pass a Data Center Moratorium Now!](https://actionnetwork.org/letters/king-county-council-pass-a-data-center-moratorium-now/?ref=thenexusofprivacy.net) ## Congratulations and kudos to everybody involved! In her closing remarks today, Councilmember Rinck (frequently referred to as AMR) highlighted the contributions of UFCW 3000, WA People's Privacy, MLK Labor, Transit Riders Union, staffers in the Mayor's office as well as her own organization, and a host of others ... agreed, and AMR deserves a huge amount of credit too! And on top of that, dozens of consumers and grocery workers gave public comment, well over a hundred people attended the variou hearings, and literally thousands contacted the councilmembers. But l'm going to wrap this post up with the much longer list of organizations who AMR listed in her closing remarks at the previous [committee vote](https://www.youtube.com/watch?v=6QST8YRyTnY&t=1257s&ref=thenexusofprivacy.net) – all of whom provided public comment on the bill, and encouraged consumers and workers to contact their council members. - Washington People's Privacy, - ACLU of Washington - The Nexus Of Privacy - Consumer Reports - Tech Equity Action - Transit Riders Union - Washington Fair Trade Coalition - Amazon Employees For Climate Justice - APRI - Seattle 350 - Seattle Queer Power Alliance - Washington Working Families Party - Food And Water Watch - Lavender Rights Project - Washington AI Resistance, - IAM 7551, People Power - Washington Solidarity Budget - Communities Not Cameras - Stop Surveillance City - Be Seattle - Seattle Indivisible - Working Washington - Faith Action Network - SRIA 775 - Queen Anne Baptist Church - Faith Action Networ - One America - Woodland Park Presbyterian Church, - The Church Council Of Greater Seattle - MLK Labor It really is a remarkably broad coalition. Congratulations and kudos to everybody involved! ### A golden opportunity in Seattle: the City Council votes today on banning surveillance pricing URL: https://thenexusofprivacy.net/a-golden-opportunity-in-seattle/ Last updated: 2026-09-23T15:33:52.000Z > "Seattle is poised to become the first city in the nation to ban “surveillance pricing,” blocking large grocers from setting prices based on personal data gleaned from the online behavior and identity of individual shoppers." > > – [Seattle set to ban grocer use of personal data to set prices](https://www.seattletimes.com/seattle-news/politics/seattle-set-to-ban-grocer-use-of-personal-data-to-set-prices/?ref=thenexusofprivacy.net), Nicholas Deshais in the *Seattle Times,* September 21 > "Think about all the front-page news in the last few weeks about the risks of AI and need for regulation. Here's a golden opportunity for you to do something concrete to protect Seattle consumers, workers, and independent grocers – and serve as a model for other cities and states that are considering similar bans. Please do not throw away this opportunity by adding loopholes and weakening enforcement." > > – me, in email to the City Council, September 22 Today's vote on Seattle's Fair Pricing and Transparency ordinance should be a no-brainer for City Council members. Using personal data to charge people different prices for the same items is clearly an unfair, anti-consumer business practice that really should be illegal. Dozens of consumers and grocery workers have supported the bill in the hearings so far. So have dozens of community, faith, human rights, immigrant rights, and tech justice groups. The only ones pushing back on the bill are industry lobbyists . Then again, big grocery retailers, data brokers, big tech and the rest of the surveillance-industrial complex have a lot of lobbyists – and a big budget. They've killed or gutted several other bills to ban surveillance pricing around the country this year, most recently in California. Now, they're up to their same tricks in Seattle. After weeks of [Northwest Grocery Retail Association's ](https://www.reddit.com/r/Seattle/comments/1wi9ukc/safeway%5Fsignage%5Fagainst%5Fprice%5Fsurveillance%5Fefforts/?ref=thenexusofprivacy.net)[disinfo-filled mass texting campaigns](https://www.reddit.com/r/Seattle/comments/1wbsb1o/look%5Fout%5Ffor%5Fthis%5Ftext%5Fpropaganda?ref=thenexusofprivacy.net). [hilariously misleading signs](https://www.reddit.com/r/Seattle/comments/1wi9ukc/safeway%5Fsignage%5Fagainst%5Fprice%5Fsurveillance%5Fefforts/?ref=thenexusofprivacy.net) posted in their stores, and warnings of "unintended consequences" if the bill passed, they finally made the threat explicit in the Seattle Times article: > "Sara Osborne, spokesperson for the 17 Seattle-area Safeway stores, said the law would lead to the cancellation of its loyalty program.... > > “If (the bill) passes, we will not be able to offer these additional savings and customers will have to pay full retail price,” Osborne wrote in a statement." Oh please. The ordinance *explicitly allows* loyalty programs (as well as discounts and coupons). And loyalty programs were around for decades before surveillance pricing even existed, so they can certainly continue to offer them if they want to. Either they're bluffing, or they're admitting that exploiting consumers with surveillance pricing is so profitable that they're willing to sacrifice the millions of dollars a year they get from monetizing the data of loyalty program members in Seattle. We'll see how effective it is politically, but it's certainly not a particularly persuasive argument. ## Watching the legislative sausage getting made ... Speaking of admitting things, the Safeway statement also included: > "We do use customer information responsibly to offer voluntary savings.” Hey wait a second! Industry lobbyists have spent the last six weeks assuring legislators that they don't engage in surveillance pricing by using personal data to charge some people more than others. But using personal data to charge some people lessthan others is the same thing; they just set the base price high, give selective discounts, and as a result some people are charged more than others. In other words, the lobbyists have been ... less than candid. Who could have predicted? And sure enough, just like clockwork, a few hours after the article was published (and less than 24 hours before the vote), Councilmember Bob Kettle introduced a whole bunch of amendments adding loopholes and enforcement – including one that would allow the use of personal data for discounts. Who could have predicted? And another Kettle amendment would allow the sharing of personal data for manufacturers and third-parties to use to determine targeting and amount of coupons, a different way of using personal data to charge some people lessthan others is the same thing. Hmm. I'm noticing a pattern here ... There's a brief summary of most of the amendments in my written testimony at the end of this article. If you're thinking that when that many amendments show up it's very hard for councilmembers to hear what the public really thinks about them ... well yeah, that's kind of the point. Fortunately, it's not my first rodeo, so I had blocked off this afternoon and evening to deal with amendments, and a lot of coalition members are equally experienced and did the same. [Washington AI Resistance and Washington People's Privacy had an action up](https://actionnetwork.org/letters/seattle-reject-the-dangerous-loss-prevention-amendment-and-pass-a-clean-fair-transparent-pricing-ordinance?ref=thenexusofprivacy.net) within a few hours of Kettle's amendments, and [so did Washington Privacy Organizers](https://wa-privacy.net/tell-seattle-to-ban-surveillance-pricing/?ref=thenexusofprivacy.net). ## Stay tuned! It'll be interesting to see how things play out today. Public comment starts at 2:00 pm; [you can participate in-person or remotely](https://www.seattle.gov/council/meetings/public-comment?ref=thenexusofprivacy.net) ... the agenda is packed, and I'm not sure what time the discussion and vote on the surveillance pricing will be. It'll be streamed on the Seattle Channel, and I'll hopefully be live-skeeting on [@wa-privacy.net](https://bsky.app/profile/wa-privacy.net?ref=thenexusofprivacy.net). ## Appendix: written comments to the Council *The bill page, with the text of the amendments, is* [*here*](https://seattle.legistar.com/LegislationDetail.aspx?ID=8166554&GUID=050CEA54-3AED-44AE-899E-D5A4573543E2&ref=thenexusofprivacy.net)*.* Councilmembers, I'm Jon Pincus of the Nexus of Privacy, asking you to pass the Fair Pricing and Transparency Ordinance -- and to reject amendments A, C, D, E, F, and G. Think about all the front-page news in the last few weeks about the risks of AI and need for regulation. Here's a golden opportunity for you to do something concrete to protect Seattle consumers, workers, and independent grocers – sand serve as a model for other cities and states that are considering similar bans. Please do not throw away this opportunity by adding loopholes and weakening enforcement. You've seen the exceptionally broad support for this bill. As well as consumers and grocery workers, literally dozens of community, faith, human rights, immigrant justice organizations have spoken at hearings so far. They've told you all the reasons this bill is needed -- and told you not to weaken it. Please listen to them. And please *don't* listen to the lobbyists from big grocery chains, delivery services, and big tech companies, with dire threats of "unintended consequences" and wheedling requests for "clarifications" (haha). Even though they may *look* innocuous, lobbyists are very skilled at suggesting "minor" (haha) changes that actually undermine the ordinance's protections by creating loopholes and weakening enforcement. To be specific: **Amendment A: completely destroys the bill's protections** by allowing use of personal info to charge some people more than others by setting the list price high and giving different discounts to different customers. That's just a different way of using personal data to charge some people more than others for the same item. **Amendment C: creates multiple huge loopholes** by permitting sharing of personal information with manufacturers and third-parties to determining the amount or the targeting of coupons (a different way of using personal info to charge some people more than others), allowing the combining personal info with purchase history, etc. **Also, removes equity requirements**. It's an algorithmic price *discrimination* bill, why would you remove the equity requirements? **Amendment D: creates a loophole** by limiting what is considered an electronic shelf labeler (ESL). **Amendment E: weakens enforcement** by limiting time for a civil action to one year after the infraction (down from three in the current ordiance) and allowing deletion of information needed to prove past violations . Even once this ordinance passes, it's not going to be easy to prove priced discrimination, and they have lots of lawyers to stretch things out, so it could well take a year or more to even get to the point of discovery Also **weakens enforcement** by reducing damages; if a civil action succeeds, violators should have to pay damages and fines on *all* interactions, not just the violations within a year of the time records are provided. **Amendment F: creates a loophole and gives a roadmap for how industry can get around the prohibitions in the bill** by allowing backdoor data sharing. One example: when Palantir uses "deidentified" (haha) data from fraud prevention to train their AI models which also power their [Holistic Pricing Optimization](https://www.palantir.com/impact/pricing-optimization/?ref=thenexusofprivacy.net) product, industry can argue that it's not "direct or indirect" sharing. Also, **weakens enforcement** by giving industry lawyers one more hurdle to raise for any civil actions, and additional grounds for appeal, by arguing that the council passed an amendment *just to make it clear that they could use these technologies!!!!!!* (I also want to highlight that Amendment F's language reinforces the expansion of surveillance by DHS in pending federal legislation S.1404, the Combating Organized Retail Crime Act (CORCA). The [June 19 letter to Congress ](https://drive.google.com/file/d/1-L-BwH-bWChX7tGpew9EFSfHzoK95%5FcT/view?ref=thenexusofprivacy.net)[from over 130 criminal justice, civil rights, immigrant rights, human rights, and community organizations](https://drive.google.com/file/d/1-L-BwH-bWChX7tGpew9EFSfHzoK95%5FcT/view?ref=thenexusofprivacy.net) describes how CORCA "would quietly construct a massive public-private surveillance network." So even it's outside the scope of the bill's focus on fair pricing, please also ask yourselves whether you really want to encourage the use of technologies that lead to extremely broad data sharing with DHS and ICE, and target the most vulnerable members of the community.) **Amendment G: creates a huge potential loophole** by allowing industry to get a mulligan and pass a weaker bill that the state level. Any state legislation is likely to be "a floor not a ceiling", so there's absolutely no reason it should to preempt Seattle's legislation. So please reject all the amendments. And then, please vote to pass the Seattle Fair Pricing and Transparency organization! ### National Voter Registration Day: 5 things to do after making sure you're registered URL: https://thenexusofprivacy.net/national-voter-registration-day-2026/ Last updated: 2026-09-17T00:06:02.000Z Yesterday's news that the Supreme Court has rejected Trump's attempts to add additional mail-in ballot restrictions for the 2026 election is a great lead-in to [National Voter Registration Day](https://nationalvoterregistrationday.org/?ref=thenexusofprivacy.net). Of course, this is only one of the many threats to election integrity (see Freedom Trainers' [Election Defense Scenarios](https://freedomtrainers.net/scenarios/?ref=thenexusofprivacy.net) for a deep dive into the overall situation). Still, it's a big win, and significantly increases the likelihood that ballots will be successfully mailed to registered voters. Including you, hopefully! National Voter Registration Day is a great time to check your voter registration – or to register, if you haven't. Washington state makes it easy, with [VoteWA.gov](https://votewa.gov/?ref=thenexusofprivacy.net). If you're in another state, [Vote411 has links to each state's offical voting site](https://www.vote411.org/check-registration?ref=thenexusofprivacy.net). Every year I talk to a few people who discover they've somehow been dropped from the voting rolls, so it's worth taking a few minutes now to check to avoid unpleasant surprises later. And once you've made sure that you're registered, here are five other things you can do to help protect the election. - Remind your friends, family, and colleagues to check their registrations as well! - Attend election protection training with [League of Women Voters](https://www.lwv.org/league-management/events/lwv-election-2026-webinar-series?ref=thenexusofprivacy.net),[ ](https://www.mobilize.us/aclu/event/996672/?ref=thenexusofprivacy.net)[No Kings Vote Early](https://www.mobilize.us/nokings/event/1014450/?ref=thenexusofprivacy.net), [NAACP](https://naacp.org/events/national-election-protection-training?ref=thenexusofprivacy.net), or [ACLU](https://www.mobilize.us/aclu/event/996672/?ref=thenexusofprivacy.net) - Donate to – or volunteer with – grassroots community-led voting rights organizations like [Black Voters Matter](https://blackvotersmatterfund.org/?ref=thenexusofprivacy.net), [Four Directions Native Vote](https://www.4dnv-indiancountry.org/?ref=thenexusofprivacy.net), and the groups in [Movement Voter Project](https://movement.vote/?ref=thenexusofprivacy.net). - [Sign up as a poll worker](https://www.powerthepolls.org/?ref=thenexusofprivacy.net) - [Volunteer to help with the bilingual Election Protection hotline](https://docs.google.com/forms/d/e/1FAIpQLSdiFl6tIrFyVDkjo9M3T5f-R9bDB9ssIwT4fQ6KwopRhzFeiw/viewform?ref=thenexusofprivacy.net) And stay tuned! I'll be writing more about election protection over the next few months, especially focusing on online organizing and fighting disinfo. If you want a sneak peak, check out Voting Rights News' post on [Custom feeds and election defense scenarios](https://voting-rights.leaflet.pub/3mv5bj6xn422c?ref=thenexusofprivacy.net). ### Early results are encouraging: experiences organizing against the surveillance-industrial complex in the ATmosphere and the fediverses URL: https://thenexusofprivacy.net/early-results-are-encouraging/ Last updated: 2026-09-07T06:27:51.000Z *Part 3 of* [*The time is right: Organizing against the surveillance-industrial complex in the ATmosphere and the fediverses*](https://thenexusofprivacy.net/the-time-is-right/) > "If we organize, the [ATmosphere](https://lab.leaflet.pub/3mrq6ma5dgs2x?ref=thenexusofprivacy.net) and [the fediverses](https://privacy.thenexus.today/bluesky-atmosphere-fediverse/?ref=thenexusofprivacy.net#there-are-many-fediverses) can have a big impact in the linked fights against different aspects of the surveillance-industrial complex. The density of people here who care about these issues is high, and we've got some very useful community-controlled infrastructure, innovative technology, and a developer ecosystem that [understands](https://blog.muni.town/on-protocol-organizing/?ref=thenexusofprivacy.net) the [value](https://atmosphereconf.org/event/Mej2N5X?ref=thenexusofprivacy.net) of providing [tools](https://mosh.leaflet.pub/3me5e6vqtkc2u?ref=thenexusofprivacy.net) for [organizers](https://bonfirenetworks.org/posts/bonfire-for-communities/?ref=thenexusofprivacy.net) and [communities](https://acorn.blacksky.community/?ref=thenexusofprivacy.net)." > > – [The time is right](https://thenexusofprivacy.net/the-time-is-right/), July 29 A month after the first post in this series, early results are encouraging. It's clear that in the right situations, the ATmosphere and fediverses can have a lot of value *right now* to organizers, journalists, activists, and politicians who are interested in resisting surveillance and/or trying to hold Big Tech accountable – at least in the US, and very likely other geographies as well. People are very engaged on these topics, and custom feeds are a great way of tracking the discussions, so even though the potential audience is obviously much much smaller than TikTok, Instagram, or YouTube it's big enough to have an impact. A few examples: - The [KOSA/KIDS Act (curated)](https://blacksky.community/profile/thenexusofprivacy.net/feed/kosa-curated?ref=thenexusofprivacy.net) and (much more active) [KOSA/Bad Internet Bills](https://bsky.app/profile/thenexusofprivacy.net/feed/stopKOSA?ref=thenexusofprivacy.net) custom feeds are great way to follow the very active discussions, and proved extremely useful leading up to [the Senate Commerce Committee hearing in early August](https://thenexusofprivacy.net/the-s-in-kosa-is-for-surveillance/). A lot of [organizers and key organizations leading the fight](https://bsky.app/profile/thenexusofprivacy.net/lists/3msy4bfbvbj2d?ref=thenexusofprivacy.net) have a strong presence here; calls to action from Fight for the Future and Free Speech Coalition got thousands of likes and reshares, comparable to the best-performing posts on centralized Xitter or Threads; TikTok, Instagram, and YouTube have much larger audiences, but decentralized social networks are a very valuable complement. And even though correlation isn't causation, but it's still good news that after a wave of calls and emails, [the SCREEN Act unexpectedly failed in committee](https://thenexusofprivacy.net/activism-makes-a-difference/) (although KOSA moved forward as expected so the battle is far from over). - The [Flock and other ALPRs](https://bsky.app/profile/thenexusofprivacy.net/feed/flock-and-alprs?ref=thenexusofprivacy.net) and (much quieter) [Flock/ALPRs curated](https://bsky.app/profile/did:plc:zoaio4horax5ncnyeewotygo/feed/alprs-curated?ref=thenexusofprivacy.net) feed are great ways to track the wave of resistance to Flock, Axon, and other ALPRs happening all across the country. A *lot* of local anti-surveillance and DeFlock groups, independent journalists reporting on city council meetings, Indivsible/DSA/ACLU affiliates working on this issue, and national privacy and civil liberties organizations have accounts on decentralized social networks ... so there's a steady stream of useful information, and great opportunities to make connections. So even though most local online organizing happens on Signal, Slack, Discord, email lists, and Facebook groups, decentralized social networks are a very valuable complement. - And with the proposed [Seattle surveillance pricing ban](https://thenexusofprivacy.net/seattle-surveillance-pricing/) (see the [Seattle Fair Pricing](https://bsky.app/profile/did:plc:g5il2f5ugcgv4cdliprznexb/feed/sea-pricing?ref=thenexusofprivacy.net) feed for highlights), Washington Privacy Organizers has connected with [the bill's sponsor](https://bsky.app/profile/alexis4seattle.bsky.social/post/3mslgbdez222d?ref=thenexusofprivacy.net), other advocates we weren't previously in touch with, and journalists covering the story ... classic use cases for social media activism, but now very difficult to do on centralized social networks like Xitter. on surveillance pricing in Seattle. Don't get me wrong, there are still some very rough edges, and decentralized social networks are a *complement* to other kinds of online organizing. Still, if you're an activist, organizer, politician, or journalist interested in one of these issues, it's a great time to get involved. And if you're working on resisting data centers or some other aspect of the fight against surveillance capitalism, please consider putting together a custom feed (or maybe more than one, if you want to focus geographically or volume is so high that a curated version would also be useful). You can do this even if you're not a programmer; [here's a quick writeup of how I've approached it so far](https://nexusofprivacy.leaflet.pub/3mu23efnks22l?ref=thenexusofprivacy.net). ## There certainly are a lot of possibilities here! > "When we use social media in our organizing, what are we actually doing? Is it worth the time we put into it? And is there a way of doing it that actually builds something?" > > – [It’s time for movements to rethink social media](https://wagingnonviolence.org/2026/08/movements-rethink-social-media-activism-organizing/?ref=thenexusofprivacy.net), Mehran Khalili, August 13 Looking beyond the short-term opportunities, it's also worth highlighting the longer-term possibilities. Organizing on community-controlled infrastructure (like Blacksky and independent fediverse instances) is quite a contrast with today's [parasocial media](https://journals.sagepub.com/doi/10.1177/20563051261437487?ref=thenexusofprivacy.net), directly controlled by the very surveillance-industrial complex we're trying to fight. As Khalili discusses, best practices on centralized parasocial networks today revolve around getting the word out widely to recruit or mobilize, and then shifting to spaces the organizers control. While the two specific examples Khalili discusses shifted people to Action Network and Discord, he also notes "it could as easily have been a mailing list, a forum, a group chat or a room with chairs in it. What matters is that it wasn’t an algorithmic feed." That approach works here too; as I said earlier about organizing against Flock, the bulk of the local organizing on Signal, Slack, Discord, etc – and in person. But in the ATmosphere and fediverses, we also have lots of options for organizer-controllable spaces that aren't oriented around an algorithmic feed. A few examples: - Communities built with Blacksky's Acorn, Bonfire, and Newsmast are interesting complements to forums (NodeBB and Discourse), group chats (Roomy spaces, Precinct Connect), blogs and newsletters (Leaflet, pckt.blog, Offprint, Ghost, Beehiv, Buttondown), and link aggregators (Piefed, Lemmy). - Custom feeds let organizers prioritize news, actions, and causes that are buried by the algorithms on Instagram, Facebook, Xitter, etc. - The ability to use an ATmosphere account as an "[everything account](https://augment.ink/the-everything-account?ref=thenexusofprivacy.net)" for all of the above as well as sense-making software (Blacksky Assembly, Semble, Margin), livestreaming (Streamplace) and end-to-end encrypted communications (Germ), etc etc etc could be very use for collaborating with an organizing team. Admittedly, this is all still early-stage software, so there are plenty of limitations, usability challenges, and infrastructure reliability problems. It's still not clear how long it will take until different pieces are at the point where they're useful for organizing scenarios that require broad adoption. Still, there certainly are a lot of possibilities here! ## Very good progress overall – but still a lot of work to do > "One way of looking at is that today's decentralized social networks are prototypes at scale." > > – [If not now, when? Mutual aid and organizing in the fediverses, the ATmosphere, and whatever comes next](https://thenexusofprivacy.net/if-not-now-when/), April 2025 The prototypes have improved *significantly* in the last fifteen months, and have gotten to the point where they're clearly useful in some interesting scenarios. That's very good progress overall! And with projects like Acorn, Bonfire, and Newsmast building on earlier work from Glitch and Hometown, and Bluesky PBC and Mastodon pivoting, we're starting to see more of a focus on communities – a great match for organizing that isn't parasocial. All that being said, it seems to me that we're still not there in terms of the "flywheel" effect I talked about in [The time is right](https://thenexusofprivacy.net/the-time-is-right/). The overall idea continues to makes a lot of sense: > "\[A\] lot of people who currently *aren't* active on decentralized social networks are also pushing back against Big Tech, age verification, AI data centers, and mass surveillance. So if we become a great place to organize against surveillance capitalism and the surveillance-industrial complex (and build tools that are useful for [all kinds of organizers](https://mosh.leaflet.pub/3me5e6vqtkc2u?ref=thenexusofprivacy.net)), we'll attract a lot of people, and accelerate movement away from Big Tech's centralized social networks." And hopefully I've made the case that the ATmosphere and fediverses are already a pretty darned good place for at least some kinds of organizing against surveillance capitalism. So if it were easy for newcomers to get involved with this kind of organizing on community-controlled infrastructure here, that could certainly be a big draw – especially if they're looking for alternatives to centralized social networks. Alas, it currently *isn't* easy straightforward for newcomers to get involved. Challenges start with deciding where to start up an account. Well-moderated community-controlled platforms like Blacksky, Latinsky, Northsky, or good small-to-medium-size fediverse instances are the best experience, but how can newcomers find out about them? Once somebody sets up an account, how to tweak initial settings to cut down on harassment and reply guys, find the right people / feeds / hashtags / channels to follow so that you get connected to what's happening, a client that fits well with your interaction style? Custom feeds are a new concept to most organizers; there are good tutorials out there, but how do people even know how to look for them? And so on and so on... The good news is that we don't have to solve the general "onboarding" problem; a good collection of resources including getting-started guides, peer-to-peer help from more experienced people, and leveraging existing tools technologies can all be helpful for individual campaigns even if they don't scale. That said, there's clearly still a lot of work to do on this front – as well as usability, safety, and a whole host of other issues. ## What next? September is likely to be a busy month on all of these fronts, so a chance to refine tactics and experiment with new ones. - KOSA and other bad internet bills are likely to be back on the table once Congress returns from recess, Meta and their Big Tech and anti-LGBTQIA2S+ allies are clearly goingn to try to push through a package of KOSA, the App Store Accountability Act age verification bill, and industry-friendly AI legislation. [Meta's sweetheart deal from state Attorneys General](https://www.techdirt.com/2026/08/26/meta-just-paid-nearly-17-billion-to-make-sure-it-gets-to-write-the-kid-safety-rules-for-every-other-social-media-platform/?ref=thenexusofprivacy.net) will give them added ammunition ... but, fierce grassroots organizing stopped KOSA in 2022 and 2024, and if we keep the pressure up we have a good chance to do it again. [KOSA/KIDS Act (curated)](https://blacksky.community/profile/thenexusofprivacy.net/feed/kosa-curated?ref=thenexusofprivacy.net) (also on [mu.social](https://mu.social/profile/thenexusofprivacy.net/feed/kosa-curated?ref=thenexusofprivacy.net) and [Bluesky](https://bsky.app/profile/thenexusofprivacy.net/feed/kosa-curated?ref=thenexusofprivacy.net)), [KOSA/Bad Internet Bills](https://blacksky.community/profile/thenexusofprivacy.net/feed/stopKOSA?ref=thenexusofprivacy.net) ([mu.social](https://mu.social/profile/thenexusofprivacy.net/feed/stopKOSA?ref=thenexusofprivacy.net), [Bluesky](https://bsky.app/profile/thenexusofprivacy.net/feed/stopKOSA?ref=thenexusofprivacy.net)), and [the Bad Internet Bills Lemmy community](https://lemmy.sdf.org/c/bad%5Finternet%5Fbills?ref=thenexusofprivacy.net) custom feeds are good places to follow the action. For now, stand by for the next round of action alerts! - Local organizing against Flock, Axon, and other ALPRs is in high gear in cities across Washington and the rest of the country ... and organizers are broadening the scope to include other surveillance technology like drones, fusion centers, and real-time crime centers (RTCCs). [Flock and other ALPRs](https://bsky.app/profile/thenexusofprivacy.net/feed/flock-and-alprs?ref=thenexusofprivacy.net), [Flock/ALPRs curated](https://bsky.app/profile/did:plc:zoaio4horax5ncnyeewotygo/feed/alprs-curated?ref=thenexusofprivacy.net), and Newsmast's [Vehicle Plates channel](https://channel.org/@vehicleplates?ref=thenexusofprivacy.net) are a good way to track what's happening. To get involved at the local level, [https://noalprs.com](https://noalprs.com/?ref=thenexusofprivacy.net) has links to literally hundereds of groups who did events for the recent week of action, and if you can't find anything there look around for local DeFlock, Get the Flock Out, police accountability, anti-surveillance, Indivisible, and DSA groups. - The Seattle surveillance pricing ordinance will have a votes on amendments in mid-September, with industry trying to weaken the bill, and then a final vote later in the month; see the [Seattle Fair Pricing](https://bsky.app/profile/did:plc:g5il2f5ugcgv4cdliprznexb/feed/sea-pricing?ref=thenexusofprivacy.net) feed for ongoing updates, or follow Washington Privacy Organizers on [Blacksk](https://blacksky.community/profile/wa-privacy.net?ref=thenexusofprivacy.net)y, [Bluesky](https://bsky.app/profile/wa-privacy.net?ref=thenexusofprivacy.net), or [pnw.zon](https://pnw.zone/@waprivacy?ref=thenexusofprivacy.net)e. And there are also some adjacent areas that also seem like good opportunities for decentralized social network organizing. A few examples: - As Christine Lemmer-Webber points out in [What happened to the fight for the Internet?](https://dustycloud.org/blog/what-happened-to-the-fight-for-the-internet/?ref=thenexusofprivacy.net), there are bad internet bills all across the world. California's [AB 1709 social media ban](https://eff.salsalabs.org/stopcasocialban/index.html?ref=thenexusofprivacy.net). [the Massachusetts Social Media Act](https://www.stoponlineidchecks.org/ma/?ref=thenexusofprivacy.net). the EU's trilogue discussions on [Chat Control](https://fightchatcontrol.eu/?ref=thenexusofprivacy.net#contact-tool) in late September, Canada's [C-34 social media ban](https://action.openmedia.org/page/196242/action/1?ref=thenexusofprivacy.net). These are all situations where key organizers, civil society organizations, journalists, and non-profits are in the ATmosphere and fediverses. How to adapt the US-centric (and monolingual) approaches discussed in this post to these other situations? If people are working on these or similar issues elsewhere, I'd love to find out more and compare notes! - As the broader [Surveillance Pricing](https://bsky.app/profile/thenexusofprivacy.net/feed/surveil-pricing?ref=thenexusofprivacy.net) feed highlights there are similar discussions happening in Congress as well as cities and states around the country. How to adapt Seattle-centered tactics to work in other cities? What are the opportunties at the state and federal level? - As MediaJustices [Brobots vs. the People](https://mediajustice.org/our-work/brobots-vs-the-people/?ref=thenexusofprivacy.net) campaign highlights, the techbro faction of the surveillance-industrial complex is spending hundreds of millions of dollars in the midterms. Are there ways to leverage decentralized social networks to complement the in-person tactics discussed in [The BroBots Vs. The People Toolkit](https://mediajustice.org/resource/brobots-vs-the-people-toolkit/?ref=thenexusofprivacy.net)? - Looking at the midterms more generally, while the top priority is on-the ground efforts (see [Sarah Taber's excellent thread](https://mastodon.online/@sarahtaber/117168236715680894?ref=thenexusofprivacy.net) here for some great ways to get involved, including [signing up as a poll worker](https://www.powerthepolls.org/?ref=thenexusofprivacy.net)), are there ways the ATmosphere and fediverses contribute to non-partisan voting rights and election protection work? If you've got thoughts on any of these topics, please discuss! A few options: - [The Polis conversation here](https://pol.is/26waznfdvb?ref=thenexusofprivacy.net) is the easiest way to share your thoughts and give feedback on what others are saying. - In the ATmosphere, see the thread[ on blacksky.community](https://bsky.app/profile/thenexusofprivacy.net/post/3mu4badkxy22f?ref=thenexusofprivacy.net) (also accessible via Eurosky's [mu.social](https://bsky.app/profile/thenexusofprivacy.net/post/3mu4badkxy22f?ref=thenexusofprivacy.net), [Bluesky](https://bsky.app/profile/thenexusofprivacy.net/post/3mu4badkxy22f?ref=thenexusofprivacy.net) and other apps). There's also a more-general [discussion on discourse.atmosphere.community](https://discourse.atmosphere.community/t/atmosphere-technology-to-support-organizing-and-activism/966?ref=thenexusofprivacy.net), focusing on the tools and technologies for organizing. - In the fediverses, the thread on [gotosocial.thenexus.today](https://gotosocial.thenexus.today/@thenexusofprivacy/statuses/01M1312WWV23160PT5B4MEKATS?ref=thenexusofprivacy.net) is accessible from GoToSocial, Mastodon, Bonfire, and other software; or, if you prefer Lemmy or Piefed, check out the thread [on lemmy.blahaj.zone](https://lem.lemmy.blahaj.zone/post/47187295?ref=thenexusofprivacy.net). And you see upcoming posts in the series by following [@nexusofprivacy.net](https://blacksky.community/profile/thenexusofprivacy.net?ref=thenexusofprivacy.net), [@nexusofprivacy@gotosocial.thenexus.today](https://gotosocial.thenexus.today/@thenexusofprivacy?ref=thenexusofprivacy.net), [@thenexusofprivacy@lemmy.blahaj.zone](https://lem.lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net) and/or subscribe to [the Nexus of Privacy newsletter](https://thenexusofprivacy.net/) ### The National Week of Action against ALPRs -- in Washington and across the country URL: https://thenexusofprivacy.net/the-national-week-of-action-against-alprs-in-washington-and-across-the-country/ Last updated: 2026-08-17T03:25:33.000Z *Originally posted* [*on wa-privacy.net*](https://wa-privacy.net/noalprs-week-of-action/?ref=thenexusofprivacy.net) > "As business leaders and major event operators call for more surveillance cameras following the Bite of Seattle shooting, grassroots groups will be holding rallies against mass surveillance. > > On Monday, seven members of the Community not Cameras coalition will tour Seattle’s Real-Time Crime Center and hold a press conference with Seattle Indivisible to share their experience of the Seattle Police Department’s surveillance network.... > > Also happening on Monday, a rally against automated license plate readers (ALPRs) will be held at Renton City Hall to coincide with “National Week of Action Against ALPRs.” > > \-- Nia Bliss, [Rallies against mass surveillance kick off in King County on Monday](https://www.kiro7.com/news/local/rallies-against-mass-surveillance-kick-off-king-county-monday/GTGRITLKEVGXXI2RCS3ZTGJYM4/?ref=thenexusofprivacy.net), KIRO-7 The [map on the National Week of Action site](https://www.noalprs.com/?ref=thenexusofprivacy.net#:~:text=Participating%20Cities) shows over 400 events around the country, also including Olympia, Everett, Kennewick, and Stanwood here in Washington state. There's a huge wave of resistance everywhere to AI-enabled mass surveillance systems, especially ALPRs like Flock and Axon, fueled by constant reporting of the abuses: [by ICE and CBP to target immigrants](https://jsis.washington.edu/humanrights/2025/10/21/leaving-the-door-wide-open/?ref=thenexusofprivacy.net), by law enforcement and DHS [to surveil protesters and activists](https://www.eff.org/deeplinks/2025/11/how-cops-are-using-flock-safetys-alpr-network-surveil-protesters-and-activists?ref=thenexusofprivacy.net), by law enforcement personnel to stalk their exes (or their partner's exes)... Here are the Washington-specific and national events I know about -- if people have other public links, please leave them in the comments. - [Communities not Cameras / Seattle Indivisible press conference](https://www.instagram.com/p/Db6QF2KGAe7/?img%5Findex=1&ref=thenexusofprivacy.net): Monday (8/17), 12:30 pm, Seattle City Hall. - [Deflock Renton Rally](https://www.mobilize.us/mobilize/event/1003059/?ref=thenexusofprivacy.net): Monday (8/17), 5:00 pm, Renton City Hall - Shelton [Flock Sees You](https://www.reddit.com/r/shelton/comments/1vnpmn1/a%5Fcall%5Fto%5Faction%5Fshelton%5Fcity%5Fcouncil%5Fto%5Frenew/?ref=thenexusofprivacy.net) Rally: Tuesday (8/18), 5:00 protest, 6:00 City Council hearing, Shelton Civic Center - DeFlock Further 2026 livestream : Tuesday (8/18), 3:00 - 7:00 Pacific time, link coming soon - Red Wine and Blue's [Flock Cameras 101: The Threat to Privacy and How to Fight Back](https://secure.ngpvan.com/8AfflOIXXEi2PbqIxxy31w2?ref=thenexusofprivacy.net): Tuesday (8/18), 5:00 - 6:00 Pacific time Just as with the fight against data centers, the energy is really coming from the grassroots, and in many places it cuts across party lines; as a Republican commissioner of Macon County, North Carolina, said "We had work boots and Subarus in our parking lot and they were united in their position against the Flock cameras." The surveillance-industrial complex is clearly threatened. Just this last week, Flock has kicked off a major PR offensive, combining some meaningless new "[safeguards](https://www.flocksafety.com/blog/flock-guardrails-address-lpr-privacy-concerns-and-police-transparency?ref=thenexusofprivacy.net)" with a meaningless "[apology](https://www.theverge.com/policy/979339/flock-ceo-audits-data-retention?ref=thenexusofprivacy.net)" for getting things wrong and false claims about how valuable the cameras supposedly are. Meanwhile, [government fusion centers are surveilling anti-Flock activists](https://danboguslaw.substack.com/p/exclusive-government-spy-hubs-are) and [issuing alerts.](https://www.404media.co/the-government-is-monitoring-anti-flock-tiktok-and-instagram-accounts/?ref=thenexusofprivacy.net) Especially in that context, the Week of Action is a great opportunity for a show of strength. It's also a chance to raise awareness and deepen connections both locally and between organizers in different cities and states, and to expand the focus from Flock in two important ways: - to other ALPRs including Axon (if you're on Instagram, check out [eyesonaxon](https://www.instagram.com/p/Db8wmxGiZ6Z/?ref=thenexusofprivacy.net)), Genetec AutoVu, Verkada SoundThinking PlateRanger and Motorola Vigilant Systems. Some cities are just switching from Flock to Axon, which also sells mobile ALPRs, drones, tasers, and the Fusus Real-time Crime Center (RTCC) that Communities not Cameras is touring. Switching vendors doesn't solve anything; most of the problems are inherent to ALPRs in general. And while while Flock is certainly a bad actor, they're far from the only bad actor. Axon is the company that announced plans for drones with tasers in schools (see the [Statement of Resigning Axon AI Ethics Board Members](https://www.policingproject.org/statement-of-resigning-axon-ai-ethics-board-members?ref=thenexusofprivacy.net) for more). SoundThinking has a long history of selling the racist and ineffective ShotSpotter. - to the broader surveillance-industrial complex including drones, facial recognition, audio surveillance like Flock's AudioDetection and Shotspotter, predictive policing systems like Peregrine Technologies, and hubs like RTCCs, fusion centers and Palantir. And in places like Seattle (where surveillance cameras are an issue in a potential Mayoral recall) and Renton (where the city council recently voted to cover the paused Flock cameras with bags but is still debating whether to cancel the contract and what to do about their Axon ALPRs), grassroots organizers are also leveraging the week of action both to increase awareness of their specific campaign and to tie the local to the national. So whether you're in Washington or anywhere else, please get involved! How? - check [the map on noalprs.com](https://www.noalprs.com/?ref=thenexusofprivacy.net#:~:text=Participating%20Cities) to see if it lists an organization in your area. If not, look around for local DeFlocks, or check with local anti-surveillance, Indivisible and DSA groups - sign up on [NoALPRs.com](https://noalprs.com/?ref=thenexusofprivacy.net) for updates, because this movement isn't going away, and there will be a lot more happening after the Week of Action - on social networks, the hashtags are #NoALPRs, #BanALPRs, and #EndALPRs - in the ATmosphere (Blacksky, Latinsky, Northsky, Euroky, Bluesky, etc), check out the [Say no to Flock, Axon, and other ALPRs](https://bsky.app/profile/thenexusofprivacy.net/lists/3mrigdm64ys2u?ref=thenexusofprivacy.net) list and [Flock/ALPRs (curated)](https://bsky.app/profile/did:plc:zoaio4horax5ncnyeewotygo/feed/alprs-curated?ref=thenexusofprivacy.net) custom feeds (or [Flock and other ALPRs](https://bsky.app/profile/did:plc:zoaio4horax5ncnyeewotygo/feed/flock-and-alprs?ref=thenexusofprivacy.net) if you want to see all the discussion) ### Seattle looks to ban surveillance pricing with the "Fair and Transparent Pricing Ordinance" - and the disinfo has already started URL: https://thenexusofprivacy.net/seattle-surveillance-pricing/ Last updated: 2026-08-24T02:58:21.000Z > "Today, Mayor Katie Wilson, City Councilmembers Alexis Mercedes Rinck and Dionne Foster are announcing a new affordability policy to stop the price gouging, promote equal discounts for all, and make groceries more affordable.... The Fair and Transparent Pricing policy will bar large online and brick-and-mortar grocery retailers from using sensitive personal information such as employment status, race, gender, social media posts, browsing history, chatbot conversations, or other similar data to set different prices for different customers." > > – [City Leaders Announce New Grocery Affordability Policy: “Equal Discounts for All”](https://wilson.seattle.gov/2026/08/06/city-leaders-to-announce-new-grocery-affordability-policy-equal-discounts-for-all/?ref=thenexusofprivacy.net), August 6 *Surveillance pricing* (also known as algorithmic price-based discrimination) is where corporations use vast quantities of personal data to set individualized prices ... in other words, they'll charge you more if they think they can get you to pay more. A couple of examples: - The algorithms that set the prices take into account whether you’ve just been paid. People who live paycheck-to-paycheck often have to wait to buy groceries for their family until they are paid, so it’s a perfect time for stores to maximize profits by charging them more. - The algorithms also take into account whether a woman is menstruating – data that they can get from period tracking apps – and so can charge her more for sanitary product. As my Mom said when I described surveillance pricing to her, “How can they get away with doing that? That shouldn’t be legal!” Indeed. And the [Fair and Transparent Pricing Ordinance](https://wilson.seattle.gov/2026/08/06/city-leaders-to-announce-new-grocery-affordability-policy-equal-discounts-for-all/?ref=thenexusofprivacy.net) quite rightly prohibits algorithmic price-based discrimination for groceries, diapers, personal hygiene and grooming items, and over-the-counter drugs. [Mayor, two city councilmembers propose banning some grocery-pricing practices](https://westseattleblog.com/2026/08/mayor-two-city-councilmembers-propose-banning-some-grocery-pricing-practices/?ref=thenexusofprivacy.net) on *West Seattle Blog* has a lot more details. > If you're in Seattle ... TAKE ACTION! [Tell the City Council to ban surveillance pricing](https://actionnetwork.org/letters/seattle-city-council-stop-surveillance-pricing?ref=thenexusofprivacy.net)! As I said in [my testimony](https://thenexusofprivacy.net/hb-2481-approps/) for a similar bill proposed in the state legislature earlier this year (which also includes a more detailed discussion of surveillance pricing and links to some excellent reports including the fascinating[ Same Cart, Different Price](https://groundworkcollaborative.org/work/instacart/?ref=thenexusofprivacy.net) study looking at Instacart's surveillance pricing, the[ FTC Surveillance Pricing Study](https://www.ftc.gov/news-events/news/press-releases/2025/01/ftc-surveillance-pricing-study-indicates-wide-range-personal-data-used-set-individualized-consumer?ref=thenexusofprivacy.net), and [Prohibiting Surveillance Prices and Wages](https://towardsjustice.org/wp-content/uploads/2025/02/Real-Surveillance-Prices-and-Wages-Report.pdf?ref=thenexusofprivacy.net)), > "The need for prohibition is especially clear when it comes to groceries. Food is not a luxury. Purchases of food are necessary for survival." Big Tech and Big Grocery successfully lobbied the state legislature to kill that bill ... and they've already started the same tactics in Seattle. As Councilmember Rinck [says](https://bsky.app/profile/alexis4seattle.bsky.social/post/3mshlnibpu22g?ref=thenexusofprivacy.net) about the mass-text I excerpted in the image at the top of the article, "Hmm I wonder how they got everyone’s phone numbers…." Here's how I tried to counter the disinfo in the [comments I sent to the committee Thursday afternoon](https://thenexusofprivacy.net/seattle-surveillance-pricing-comments/). > "\[B\]ig tech firms and large retailers make a lot of money from surveillance pricing, so they're already using egregious lies to lobby against this ordinance. Don't believe them. This ordinance won't cause the sky to fall. Despite lobbyists' ludicrous claims to the contrary, the definitions in section 7.35.010 clearly allow loyalty and rewards programs, coupons, and discounts. > > What the definitions **don't** allow is retailers using these mechanisms as sneaky back doors for black box algorithms that use our personal information to set individualized prices. And that's a good thing – for consumers." Friday morning's committee hearing, starting at 9:30 am, starts the process. After that; in a couple of weeks, the same committee will vote on amendments. It wouldn't surprise me if industry is resigned to something passing and decides to focus most of their energy on pushing for amendments to try to neuter it. Surveillance pricing bans are extremely popular; [New Jersey just became the third state in the country to pass one](https://epic.org/nj-governor-signs-grocery-surveillance-pricing-ban-with-private-right-of-action-into-law/?ref=thenexusofprivacy.net), and the Senate Judiciary Committee just had a hearing on [Your Data, Their Profit: The Consumer Cost of AI Surveillance Pricing.](https://www.judiciary.senate.gov/committee-activity/hearings/your-data-their-profit-the-consumer-cost-of-ai-surveillance-pricing?ref=thenexusofprivacy.net) Then again, Big Tech and the NGRA have a *lot* of lobbying power here, and things are very tense right now between Mayor Wilson and the city council. So it'll be interesting to see how things play out. Stay tuned! > > The [Seattle Fair Pricing](https://blacksky.community/profile/wa-privacy.net/feed/sea-pricing?ref=thenexusofprivacy.net) custom feed is a good place to follow the action on [Blacksky](https://blacksky.community/profile/wa-privacy.net/feed/sea-pricing?ref=thenexusofprivacy.net), [mu.social](https://mu.social/profile/wa-privacy.net/feed/sea-pricing?ref=thenexusofprivacy.net), or [Bluesky](https://bsky.app/profile/wa-privacy.net/feed/sea-pricing?ref=thenexusofprivacy.net) **Update, August 13**: Amy Sundberg's [Seattle Advances Ban on Surveillance Pricing, Targeting Grocery Giants](https://www.theurbanist.org/seattle-advances-ban-on-surveillance-pricing-targeting-grocery-giants/?ref=thenexusofprivacy.net) is a deep dive on the bill, the hearing, and perspectives from the bill's sponsors. Here's my [live-skeeting thread](https://bsky.app/profile/wa-privacy.net/post/3msiwambqpk2v?ref=thenexusofprivacy.net) from the Friday morning hearing – also available as [a single-page document](https://skywriter.blue/@wa-privacy.net/3msiwambqpk2v?ref=thenexusofprivacy.net). **Update, August 18**: Naomi Ishisaka's [Seattle city leaders take aim at ‘black box’ of algorithmic pricing](https://www.seattletimes.com/seattle-news/seattle-city-leaders-take-aim-at-black-box-of-algorithmic-pricing/?ref=thenexusofprivacy.net) in the *Seattle Times* has more coverage of the ordinance and the misleading texts, as well as some good quotes from co-sponsor Dionne Foster. ### Activism makes a difference: the SCREEN Act unexpectedly fails in committee! But KOSA advances, so keep up the pressure URL: https://thenexusofprivacy.net/activism-makes-a-difference/ Last updated: 2026-08-16T04:40:10.000Z > "Even if the committee votes to advance one or more of the bills (which they probably will), there will be other chances to block them. Still, that'll only happen if we keep the pressure up. The more noise we make around this battle, the more likely it is that they'll decide not to prioritize these bills over the rest of the year. And the more strength we can build with our organizing over the next few days, the better our position will be for whatever showdowns happen later in the session and next year." > > – [“The S is for surveillance”: fighting KOSA and bad internet bills in the ATmosphere and the fediverses](https://thenexusofprivacy.net/the-s-in-kosa-is-for-surveillance/), August 2 Wow, I wasn’t expecting that! After the Senate Commerce Committee‘s roll-call vote on the odious SCREEN Act age verification bill (15-13 along party lines), Ranking Member Cantwell casually mentioned that there weren’t enough members present in person. Chair Cruz agreed, and noted that as a result the bill would not be reported out. And then the committee went on to other bills, including KOSA (the Kids Online Surveillance Act) and the CHATBOT Act, advanced them all on voice votes, gave a few speeches, and the hearing was done. As you can see from my [live-skeeting](https://bsky.app/profile/thenexusofprivacy.net/post/3msdq7yiwis25?ref=thenexusofprivacy.net), at first I wasn’t sure how significant this incident was. Maybe it was just a minor procedural issue that they‘d be able to address quickly? Nope! The consequences are just the same as of the vote didn’t happen, or if it had gotten voted down. It’s just that this way, Republicans don’t have to vote against the bill. As Evan Greer of Fight for the Future says (in a thread with some great perspectives on the hearing) [ “master classes in bravery we're seeing here.” ](https://bsky.app/profile/evangreer.bsky.social/post/3msdtuevqn22y?ref=thenexusofprivacy.net) But hey, whatever works. As Mike Stabile of Free Speech Coalition [says](https://bsky.app/profile/mikestabile.bsky.social/post/3msdu22h6y22a?ref=thenexusofprivacy.net), > “The bill isn't dead, of course — it can be brought back before the end of session — but given today's lack of engagement on it, that seems less likely than it would have even a few days ago.” So thanks to everybody who took action! The day before the vote, we expected Republicans to all support it and were concerned that some Democrats would as well. The thousands of phone calls and emails clearly had an impact, and led to an unexpected victory. Huzzah! ![The image features a bold graphic design with a vibrant red background that conveys a sense of urgency. At the top, in large yellow uppercase letters, the phrase "KEEP THE PRESSURE ON:" commands attention. Below that, there is a white text box with the message, "Tell lawmakers how you feel about them playing circus with our rights," using a mix of bold and regular font weights to create visual interest. To the left, there is a simple, hand-drawn illustration of an open mouth, outlined in bright yellow, with lines extending outwards, suggesting a call to action or shouting. At the bottom of the image, the website "BADINTERNETBILLS.COM" is displayed in a dark purple box, making it distinct and easy to read. The overall composition is dynamic and emphasizes activism regarding internet rights.](https://thenexusofprivacy.net/content/images/2026/08/IMG_9211.jpeg) And the best way to build on this victory is to keep the pressure on with KOSA and other bad internet bills. The House and Senate versions of KOSA are very different, and legislators have a lot of stuff on their plates … they might well decide it’s not the best use of their time to try to come up with a version that can pass both chambers. The louder we are now, the less likely it is that KOSA will pass. And while the SCREEN Act was arguably worse, KOSA is still pretty bad. > “Despite the usual and continued insistence that KOSA protects kids, the duty of care enforced by a Trump FTC would be a censorship and surveillance nightmare, especially for LGBTQ+ youth who need online communities now more than ever to connect, organize politically, and find resources that are being restricted in public space by the Trump administration and rightwing state governments.” > > — Fight for the Future’s [press release](https://www.fightforthefuture.org/news/2026-08-05-senate-commerce-passes-censorship-bill-kosa-out-of-committee-screen-act-fails/?ref=thenexusofprivacy.net) after the vote So if you're in the US, please contact your Senators – whether or not you've already contacted them about these bills. Two good options: - Fight for the Future's [Bad Internet Bills](https://badinternetbills.com/?ref=thenexusofprivacy.net) makes it easy to phone, it also has a form if you prefer to send a message. - EFF's [Tell the Senate: Don't Turn the Internet Into an ID Checkpoint](https://www.acteff.org/campaign/167270/?ref=thenexusofprivacy.net) makes it easy to send a message covering the CHATBOT Act and the Youth AI Privacy Act as well as KOSA [Tips for contacting Congress about bad internet bills](https://fighting-bad-interenet-bills.leaflet.pub/3ms24otlzd223?ref=thenexusofprivacy.net) has other alternatives. ## From an organizing perspective, it was also a good learning experience How much did activism on in the ATmosphere and fediverses I discussed in [“The S is for surveillance”](https://thenexusofprivacy.net/the-s-in-kosa-is-for-surveillance/) contribute to the overall wave of calls? Other channels almost certainly had more of an impact – several organizations sent out action alerts, KOSA trended on Xitter, and [one of omarsbigsister's outstanding TikTok videos](https://www.tiktok.com/@omarsbigsister/video/7669864758547401998?ref=thenexusofprivacy.net) got over 150,000 views. Still, there was also a fair amount of activity in the ATmosphere ... one of Mike Stabile's Bluesky posts with a link to FSC's action got over 2000 reskeets, one of Fight's got over 700, and EFF had a steady stream of posts that were getting bunches of reshares and likes. While the fediverses are smaller (and less US-centric), EFF's and Fight's posts there got some traction as well. So my guess is that decentralized social network activism had a measureable impact. That said, there's clearly a lot of room for further improvement! As for the experiments I discussed near the end of [“The S is for surveillance](https://thenexusofprivacy.net/the-s-in-kosa-is-for-surveillance/)[“](https://thenexusofprivacy.net/the-s-in-kosa-is-for-surveillance/), the Washington Privacy Organizers post to Cantwell got a couple of dozen reshares, and it inspired at least one other person to make a similar post ... not bad for a first attempt. I also saw several other posts from people tagging their Senators, so other people also think this is a useful tactic (although probably came up with the idea on their own). So, more experimentation is clearly needed, but a potentially useful direction. On the other hand, the initial attempts at getting Bluesky PBC or companies and non-profits working on the fediverses haven't gone anywhere so far, and nobody had any good suggestions on how to leverage locally-focused fediverse instances. Oh well, you can't win if you don't play. More positively though, the [KOSA/Bad Internet Bills](https://bsky.app/profile/thenexusofprivacy.net/feed/stopKOSA?ref=thenexusofprivacy.net) feed made it very easy to follow the broad conversation on these bills, and the much quieter [Bad Internet Bills](https://bsky.app/profile/fightforthefuture.org/feed/bad-internet-bills?ref=thenexusofprivacy.net) (from Fight for the Future) and [KOSA/KIDS Act (curated)](https://bsky.app/profile/thenexusofprivacy.net/feed/kosa-curated?ref=thenexusofprivacy.net) featured a very good mix of informative posts and excellent calls to actions. The [Fighting Bad Internet Bills](https://semble.so/profile/thenexusofprivacy.net/collections/3mqdxzun2562x?ref=thenexusofprivacy.net) Semble collection is at the point where it has good information on all the active bills, and will continue to be useful over the next few months. So it's a good validation in a real-world situation that these new technologies really are valuable from an organizing perspective, and the experience also points to several useful potential enhancements. All in all ... a good result! ### "The S is for surveillance": fighting KOSA and bad internet bills in the ATmosphere and the fediverses (UPDATED) URL: https://thenexusofprivacy.net/the-s-in-kosa-is-for-surveillance/ Last updated: 2026-08-27T06:16:13.000Z *Originally written August 3\. Updated August 12, with* [*after-action reflections*](#after-action)*.* > "It's a surveillance bill. The s is for surveillance" > > – Anthony Moser (author of [The Kirby Frame](https://anthonymoser.github.io/writing/rhetoric/framing/kirby/2026/01/28/the-kirby-frame.html?ref=thenexusofprivacy.net)), discussing KOSA [in the ATmosphere](https://bsky.app/profile/anthonymoser.com/post/3ms3dgun2bk2w?ref=thenexusofprivacy.net), August 1 > "If we organize, the [ATmosphere](https://lab.leaflet.pub/3mrq6ma5dgs2x?ref=thenexusofprivacy.net) and [the fediverses](https://privacy.thenexus.today/bluesky-atmosphere-fediverse/?ref=thenexusofprivacy.net#there-are-many-fediverses) can have a big impact in the linked fights against different aspects of the surveillance-industrial complex. The density of people here who care about these issues is high, and we've got some very useful community-controlled infrastructure, innovative technology, and a developer ecosystem that [understands](https://blog.muni.town/on-protocol-organizing/?ref=thenexusofprivacy.net) the [value](https://atmosphereconf.org/event/Mej2N5X?ref=thenexusofprivacy.net) of providing [tools](https://mosh.leaflet.pub/3me5e6vqtkc2u?ref=thenexusofprivacy.net) for [organizers](https://bonfirenetworks.org/posts/bonfire-for-communities/?ref=thenexusofprivacy.net) and [communities](https://acorn.blacksky.community/?ref=thenexusofprivacy.net). > > – [The time is right: Organizing against the surveillance-industrial complex in the ATmosphere and the fediverses](https://thenexusofprivacy.net/the-time-is-right/), July 29 The first post in this series kept things at a fairly high level. Now, let's shift from theory to practice, and focus on a very specific battle against the surveillance-industrial complex: the [Senate Commerce Committee 'markup' this Wednesday](https://www.commerce.senate.gov/meetings/executive-session-24-08-05-2026/?ref=thenexusofprivacy.net), and two bills in particular: - KOSA (the Kids Online Surveillance Act, officially known as S.1748). - Sen. Mike Lee's [SCREEN Act age verification bill](https://www.eff.org/deeplinks/2026/07/screen-act-threatens-privacy-far-beyond-adult-websites?ref=thenexusofprivacy.net) (S. 737). There's a *lot* of context here ... which I'm mostly going to skip over in this post; see [KOSA, the KIDS Act, AI, Bad Internet Bills, and a potential giveaway to big tech](https://thenexusofprivacy.net/kosa-kids-act-june-update/) and Semble collections like [Fighting Bad Internet Bills](https://semble.so/profile/thenexusofprivacy.net/collections/3mqdxzun2562x?ref=thenexusofprivacy.net) and Bee's [Age Verification and ID Checks](https://semble.so/profile/sweetbee.gay/collections/3mjkwatifxt2i?ref=thenexusofprivacy.net) for the details. The TL;DR summary is: they're bad. As Evan Greer of Fight for the Future [says](https://bsky.app/profile/evangreer.bsky.social/post/3mrxu3qrbkc2n?ref=thenexusofprivacy.net) > "It’s important to understand “age verification” and “kick the kids off social media” laws as a gift to Big Tech. These policies allow surveillance capitalism to chug along full steam ahead and let Silicon Valley giants off the hook." Big Tech likes to frame these as "child safety" bills but think about it for a second. As Moser points out, "OpenAI makes software that encourages kids to harm themselves, X runs a CSAM generator. They are not motivated by kids safety, they just want more data on everyone." And these bills are especially bad for trans and queer youth – see [Age-Verification Laws Seek to Erase LGBTQ+ Identity from the Internet](https://msmagazine.com/2025/02/25/lgbtq-abortion-censorship-age-verification-laws/?ref=thenexusofprivacy.net) and [Why Are Some Democrats Backing MAGA’s Anti-LGBTQ+ Censorship?](https://www.teenvogue.com/story/some-democrats-are-helping-the-trump-admins-anti-lgbtq-tech-agenda?ref=thenexusofprivacy.net) for more on this perspective. Unfortunately, the false claims by Big Tech and their anti-LGBTQIA2S+ allies that these bills will "protect the children" and "hold Big Tech accountable" are very persuasive. In 2024, the Senate passed an earlier version of KOSA 91-3\. Strong pushback blocked it then, but now they're giving it another try. What can the ATmosphere and fediverses do to help stop them? A few ideas to start with: - [Turn up the volume: more calls and emails to the Senate](#turn-up-the-volume) - [Get the word out in the ATmosphere and the fediverses (and everywhere else too)](#get-the-word-out) - [Find a way that works for you to follow the ongoing battles over KOSA and other bad internet bills](#follow-the-battles) - [Experiment with different tactics](#experiment) **Update, August 12**: I've included an update in each section, and added a new [after-action reflections](#after-action) section at the end. ## Turn up the volume: more calls and emails to the Senate > "Spirited grassroots activism stoped KOSA and other bad internet bills from passing in 2022 and 2024, and if we keep the pressure up we have a good chance to do it again. One key ingredient: getting as many people as possible to contact Congress repeatedly. Waves of phone calls and emails complements the work advocacy groups are doing behind the scenes, and gives ammunition to the politicians and staffers who are on our side." > > – [Tips for contacting Congress about bad internet bills](https://fighting-bad-interenet-bills.leaflet.pub/3ms24otlzd223?ref=thenexusofprivacy.net) At Wednesday's markup, the committee will discuss and vote on the bills and potential amendments. Even if the committee votes to advance one or more of the bills (which they probably will), there will be other chances to block them. Still, that'll only happen if we keep the pressure up. The more noise we make around this battle, the more likely it is that they'll decide not to prioritize these bills over the rest of the year. And the more strength we can build with our organizing over the next few days, the better our position will be for whatever showdowns happen later in the session and next year. Social networks are great for getting the word out about upcoming votes on important bills. Within a few hours of the announcement of the KOSA markup I saw dozens of posts with links to [Bad Internet Bills](https://badinternetbills.com/?ref=thenexusofprivacy.net) and actions from groups like EFF, Defending Online Privacy, and 5Calls A lot of people in the ATmosphere and fediverses really do care passionately about this issue. That said, when I look at the number of actions taken via [Bad Internet Bills](https://badinternetbills.com/?ref=thenexusofprivacy.net), it's only increased by about 500 over the last few days. Of course, there are lots of other ways for people to contact their Senators, so the number of calls and emails is higher than that, but still .... There are literally millions of people in the US with accounts on decentralized social networks. Over the next few days we should be able to contribute thousands, maybe even tens of thousands of calls and emails. If you're reading this and you're in the US, that means you! Please contact your Senators ASAP – even if you've already contacted them about these bills. > **Update, August 12:** the most likely next step is a Senate floor vote, so even though the markup is over, it's still useful to contact your Senators! A few good options here: - EFF's [Tell the Senate: Don't Turn the Internet Into an ID Checkpoint](https://www.acteff.org/campaign/167270/?ref=thenexusofprivacy.net) makes it easy to send a message covering KOSA, the SCREEN Act, the CHATBOT Act, and the Youth AI Privacy Act - Fight for the Future's [Bad Internet Bills](https://badinternetbills.com/?ref=thenexusofprivacy.net) makes it easy to phone, and has a script that covers KOSA and the SCREEN Act; it also has a form if you prefer to send a message. - Defend Online Privacy's [Tell Congress: Vote NO on the SCREEN Act!](https://www.defendonlineprivacy.com/screen/?ref=thenexusofprivacy.net) offers a choice of three messages, including one that's tailored to Republicans on the committee. [Tips for contacting Congress about bad internet bills](https://fighting-bad-interenet-bills.leaflet.pub/3ms24otlzd223?ref=thenexusofprivacy.net) has a roundup of other ways you can contact legislators, as well as suggestions on what to say. And then, please try to contact them at least one more time between now and the committee hearing (10:00 am Eastern time, 7:00 am Pacific time on Wednesday). Senators' staffs track how many people are calling repeatedly, as well as the total number of calls; when you call multiple times, it highlights that you really care about the issue. **Update, August 12** The total number of calls ramped up sharply before the vote – organizers talked about "thousands and thousands" in general, and the ticker on Bad Internet Bills increased by 2000 or so in the 24 hours before the vote. It's very hard to know how much of it was due to activity in the ATmosphere and the fediverses. My guess is that our impact was at least comparable to microblogging alternatives like Xitter and Threads, although substantially smaller than TikTok, Insta, or email/text action alerts. That said, we really should be able to do better. ## Get the word out in the ATmosphere and the fediverses – and everywhere else too I know, I know, this is the kind of stuff everybody on social networks does every day ... still, it's worth mentioning because it's good to be aware of it. When you see other people sharing actions, consider amplifying them by boosting / reskeeting / quoting the links makes it more likely that people who follow you will see it. If there are specific people you think would be interested in a link, it's very natural replying and tagging them in (or DM it to them if that's more your style). And while you're at it, help get the word out broadly too: in group chats, emails, DMs, phone calls as well as on decentralized social networks. If you know people who are already aware of these bills and how bad they are, remind them an important vote is coming up so they should contact their Senators, and share [Bad Internet Bills](https://badinternetbills.com/?ref=thenexusofprivacy.net) with them. For people you think are likely to be interested don't already have the context, start with a very quick description of why the bills are so bad and why it's important to take action. **Update, August 12** Several of the posts with action alerts were getting a thousand or more reshares ([here's one](https://bsky.app/profile/mikestabile.bsky.social/post/3ms7isoqff22u?ref=thenexusofprivacy.net) from Mike Stabile of Free Speech Coalition with 2100), which is a lot by ATmosphere standards. In the fediverses, EFF and Fight for the Future both got decent traction (50+ boosts) ... not bad given that most fedi users aren't in the US, but lower than I would have predicted. So ... room for improvement. ## Find a way that works for you to follow the ongoing battles over KOSA and other bad internet bills No matter what happens on Wednesday, we're likely to see more votes and legislative shenanigans on bad internet bills this session. Historically, one of the biggest challenges in social media activism is keeping people who have gotten involved informed enough that they know the next time they need to take action. It's especially a challenge for bills like these where there isn't a lot of critical mainstream media coverage. The good news is that the ATmosphere and fediverses offer a *lot* of options for people who want to follow an issue. A few examples - ATmosphere custom feeds like [Bad Internet Bills](https://bsky.app/profile/fightforthefuture.org/feed/bad-internet-bills?ref=thenexusofprivacy.net) (from Fight for the Future), [KOSA/KIDS Act (curated)](https://bsky.app/profile/thenexusofprivacy.net/feed/kosa-curated?ref=thenexusofprivacy.net), or the much noisier [KOSA/Bad Internet Bills](https://bsky.app/profile/thenexusofprivacy.net/feed/stopKOSA?ref=thenexusofprivacy.net) - The [KOSA and other Bad Internet Bills](https://lemmy.sdf.org/c/bad%5Finternet%5Fbills?ref=thenexusofprivacy.net) Lemmy community (also followable from GoToSocial, Bonfire, Mastodon, etc at @bad\_internet\_bills@lemmy.sdf.org) - The [Fighting Bad Internet Bills](https://fighting-bad-interenet-bills.leaflet.pub/?ref=thenexusofprivacy.net) Leaflet has options to subscribe via email and RSS as well as your ATmosphere account - Following the accounts on the [KOSA / Section 230 / anti-AgeVerification Activists (US)](https://bsky.app/profile/thenexusofprivacy.net/lists/3m7ti2usea32z?ref=thenexusofprivacy.net) and [Tech justice / digital rights / privacy / etc orgs (US)](https://bsky.app/profile/thenexusofprivacy.net/lists/3mrih53vgwd2v?ref=thenexusofprivacy.net) lists - The fairly-regularly-updated [N things you can do today to fight bad internet bills in the US](https://fighting-bad-interenet-bills.leaflet.pub/3mpw5sizlpc23?ref=thenexusofprivacy.net), a good option for people who just prefer to bookmark a page and check it. There isn't any one right answer here – different people prefer different mechanisms. Figure out which ones work for you! **Update, August 12** While the ATmosphere and the fediverses *offer* a lot of options, they're not necessarily easy to find. Feed discovery is a huge challenge in the ATmosphere; Fight's [Bad Internet Bills](https://bsky.app/profile/fightforthefuture.org/feed/bad-internet-bills?ref=thenexusofprivacy.net) has 312 likes, just a drop in the ocean, and the other feeds only have a few. The [KOSA and other Bad Internet Bills](https://lemmy.sdf.org/c/bad%5Finternet%5Fbills?ref=thenexusofprivacy.net) Lemmy community has picked up a few hundred followers over the years but there are typically only a handful of upvotes so it's not clear how many are active. The lists are useful, but how is anybody going to find them? So, while there's definitely potential here, there's still some stuff that needs figuring out. ## Experiment with different tactics Tactics that work for organizing on decentralized social networks are going to be different tactics that work on today's influencer-oriented, pay-to-play centralized parasocial networks like Instagram, YouTube, Xitter, and LinkedIn. For example, while there are algorithmic mechanisms in the ATmosphere and fediverses (Bluesky's horrible Discover page or trending topics, Mastodon instances' Explore pages and trending hashtags, Piefed and Lemmy main pages), my guess is that "going viral" is going to be much less of a focus than more relational and community-focused communications. What will the newer tactics look like? Good question! Here's a couple directions that seem promising. Now is a great opportunity to experiment with them. And if you've got other ideas, now is a great opportunity to experiment with them as well! ### How do we get the companies and non-profits building decentralized social network platforms more involved? Big Tech puts a lot of effort into lobbying for the bills that serve their interests. What are the companies and non-profits building decentralized social network platforms doing in response? It really is in their interest to act now to try to fend these bad bills off. At least so far, though, my impression is that they're not doing much – or if they are, they're not telling us so that we can support their efforts. Either way, now's a good time to change that. As to just how to make this happen ... hmm, it's not obvious, so suggestions welcome. To sart with, I kicked off a couple of conversations: - [In the ATmosphere](https://blacksky.community/profile/did:plc:7ax27mj5qwhqaa3ite2ezlzy/post/3mruxfds4p22z?ref=thenexusofprivacy.net), I asked Bluesky PBC CEO Toni Schneider and board member Mike Masnick what their company is doing, - [In the fediverse](https://gotosocial.thenexus.today/@thenexusofprivacy/statuses/01KZ242S79EWNT05W00PRA4K0R?ref=thenexusofprivacy.net), I've asked Flipboard, Wordpress, and non-profits Mastodon and the Social Web Foundation. If you think this is something they should get involved with, feel free to join in – reply to those posts or make your own. And if you've got other ideas, give 'em a try! **Update, August 12** Crickets from Bluesky. Who could have predicted? In the fediverses, Mastodon's CEO Felix Hlaty [responded](https://mastodon.social/@mellifluousbox/117048307193910373?ref=thenexusofprivacy.net), agreeing that these are important issues and pointing to their work with [@eff](https://mastodon.social/@eff?ref=thenexusofprivacy.net) [@edri](https://eupolicy.social/@edri?ref=thenexusofprivacy.net) [@bjoernsta](https://eimsbuettel.social/@bjoernsta?ref=thenexusofprivacy.net) and others, but also noted "it's hard for our tiny team to allocate resources to them." Mastodon really does have a lot of stuff on its plate, and Big Tech companies with their paid "government affairs" lobbyists have a big advantage here. Still from a strategy perspective it really does seem to me like Mastodon should prioritize it. As I said in my reply > "The threat to fedi as an alternative to surveillance capitalism - and a haven for LGBTQIA2S+ people - really is existential. And, projects like Mastodon are well-positioned to highlight that these laws don’t only target evil big tech companies - and to bring awareness and give to the thousands of instances, all over the world, who could weigh in on laws in their own countries and states." Evan Prodromou of the Social Web Foundation also [responded](https://cosocial.ca/@evan/117028234984180566?ref=thenexusofprivacy.net), saying that it was a good question, and asking whether I thought there should be a coordinated Fediverse response. I certainly think a Fediverse-wide and ATmosphere-wide mobilization on this issue would be powerful, and pointed to [an earlier brainstorming thread](https://neuromatch.social/@jdp23/116967043175194824?ref=thenexusofprivacy.net) trying to kick off a discussion about what it would look like. The timing was too short to make that happen for last week's committee vote, but it's worth thinking about more about it going forward. **Update, August 21**: [trying again with Bluesky PBC](https://bsky.app/profile/jdp23.thenexus.today/post/3mtmlvn6mc22z?ref=thenexusofprivacy.net)! **Update, August 26**: Still crickets from Bluesky – and Masnick blocked me! 🤣 I'm not sure just when it happened (sometime in the last week or so, I muted him long ago so didn't notice for a while) so don't know whether it was because of this or something else. Oh well. It was worth a try, but looks like this is a dead end for now. ### In the ATmosphere: can we leverage tell Senators with Bluesky accounts what you think about these bad internet bills? [![A post from Tynan Purdy (@tynanpurdy.com): Hey @markey.senate.gov and @warren.senate.gov . Please take the time to watch or have your team watch this video about online safety. Your support for KOSA or any bill like it does not protect anyone online, especially kids. As your constituent, I do not support KOSA or any of the bills like it.](https://thenexusofprivacy.net/content/images/2026/08/purdy-post.png)](https://bsky.app/profile/tynanpurdy.com/post/3mrxpwrcon22c?ref=thenexusofprivacy.net) Tagging or replying to legislators on social networks is a useful complement to contactingthem through official channels. Phone calls and emails count for more, and there's no guarantee they'll read all the posts. Still, i Senators (or more accurately somebody in their comms team) typically track the number of interactions with their accounts and run sentiment analysis, so they'll notice if they start getting a lot of comments about bad internet bills. And these posts are public, so other people might see them and join in as well. If you're in the ATmosphere, [Tell Senators with Bluesky accounts what you think about KOSA and other bad internet bills](https://fighting-bad-interenet-bills.leaflet.pub/3ms5goyyrck2i?ref=thenexusofprivacy.net). If you're in the fediverses, as far as I know your out of luck on this one so far – there aren't any US Senators with accounts in the fediverses. **Update, August 12** The [Washington Privacy Organizers post](https://bsky.app/profile/wa-privacy.net/post/3ms5gcmcrcc2r?ref=thenexusofprivacy.net) to Cantwell got a couple of dozen reshares, and inspired at least one other person to make a similar post ... not bad for a first attempt. I also saw several other posts from people tagging their Senators, so other people also think this is a useful tactic (although probably came up with the idea on their own). So, more experimentation is clearly needed, but a potentially useful direction. ### In the fediverses: how can we leverage locally-based US instances? Geographically-based, relatively-small fediverse instances like pnw.zone, gardenstate.social, sfba.social, jawns.club, hoosier.social, dmv.community, etc are in principle a great match for this kind of activism. The [short Washington Privacy Organizers' thread on pnw.zone](https://pnw.zone/@waprivacy/117029622285287368?ref=thenexusofprivacy.net), for example, includes a direct link to Senator Cantwell's contact form, and context about her role on the committee. The local feed on pnw.zone is relatively quiet, so anybody who checks it is likely to see it. And if people on other Washington-based instances like social.seattle.wa.us amplify it as well, it could get traction there too. Are there ways to leverage these locally-based instances more effectively? Good question. [Here's a thread asking for ideas](https://neuromatch.social/@jdp23/117028098266589867?ref=thenexusofprivacy.net). Your thoughts welcome! **Update, August 12** I didn't get any responses to that thread. And, a similar post about getting Canadian instances involved in the fight against C-34 also didn't get any responses. Oh well. Interestingly, while Washington Privacy Organizers' pnw.zone post later that week on a more locally-focused issue ([Seattle's surveillance pricing ordinance](https://pnw.zone/@waprivacy/117052057367472523?ref=thenexusofprivacy.net)) got a fair amount of traction, only one boost came from a geographically-focused instance. One way to look at this is that it really highlights the opportunities for improvement! ## To be continued! The ideas here are just a starting point for what we can do in response to KOSA and the other bad internet bills in Congress. At the risk of sounding like a broken record, other suggestions welcome! There are plenty of important battles over bad internet bills happening in states across the US as well as in Congress – including [Massachusetts' social media bill](https://www.wbur.org/news/2026/07/10/massachusetts-senate-teen-social-media-bill-age-verification-first-amendment?ref=thenexusofprivacy.net), [California's social media ban A.B. 1709](https://eff.salsalabs.org/stopcasocialban/index.html?ref=thenexusofprivacy.net). And there are plenty of bad internet bills in other countries as well. And how to adapt the US-focused tactics I've described above to these other situations? I certainly don't have the answers here ... but I'm sure that others have ideas! It'll be interesting to see how things play out over the next few days. After the vote, I'll follow up with reflections on what went well and what we learned, as well as thoughts about how similar tactics can apply to state-level battles and other countries. After that I'll look in more detail about activism pushing back against Flock and other ALPRs. ## Update, August 12: After-action reflections > "Wow, I wasn’t expecting that! After the Senate Commerce Committee‘s roll-call vote on the odious SCREEN Act age verification bill (15-13 along party lines), Ranking Member Cantwell casually mentioned that there weren’t enough members present in person. Chair Cruz agreed, and noted that as a result the bill would not be reported out. And then the committee went on to other bills, including KOSA (the Kids Online Surveillance Act) and the CHATBOT Act, advanced them all on voice votes, gave a few speeches, and the hearing was done.... > > From an organizing perspective, it was also a good learning experience.... All in all, a good result!" > > – [Activism makes a difference: the SCREEN Act unexpectedly fails in committee! But KOSA advances, so keep up the pressure](https://thenexusofprivacy.net/activism-makes-a-difference/), August 5 From a legislative perspective, this committee hearing set the stage for a potential Senate floor vote in September on a "kids safety" package including KOSA and several other bad internet bills. The good news is that it probably won't include the SCREEN Act, and opposition to KOSA was loud enough that if we keep up the pressure we have a good chance to block it. So we shall see. From an organizing perspective, it was a great opportunity to calibrate where we are today, test assumptions, and look for strengths to leverage as well as areas where improvement is needed. In general, I feel like this skirmish really confirmed the *potential* for major impact on bad internet bills in the US, and probably elsewhere as well, although also highlighted some challenges that need to be addressed. The notes in the various sections above have some initial thoughts about that, and a follow-on post will go into more detail – and also look at next steps on bad internet bills. Speaking of which, evenj though Congress is on recess for the next few weeks, it's if you're in the US, it'sstill useful to give your Senators a call or send them an email to remind them that you want them to vote against KOSA and other bad interent bills. EFF's [Tell the Senate: Don't Turn the Internet Into an ID Checkpoint](https://www.acteff.org/campaign/167270/?ref=thenexusofprivacy.net) and Fight for the Future's [Bad Internet Bills](https://badinternetbills.com/?ref=thenexusofprivacy.net) make it easy, and [Tips for contacting Congress about bad internet bills](https://fighting-bad-interenet-bills.leaflet.pub/3ms24otlzd223?ref=thenexusofprivacy.net) has other options as well. ## Please discuss – and stay tuned for more! And please continue the discussion – about fighting bad internet bills, and more generally organizing against the surveillance-industrial complex in the ATmosphere and fediverses. - [The Polis conversation here](https://pol.is/26waznfdvb?ref=thenexusofprivacy.net) is the easiest way to share your thoughts and give feedback on what others are saying. - In the ATmosphere, the thread on [blacksky.community](https://bsky.app/profile/thenexusofprivacy.net/post/3mrrhiiq7bs2q?ref=thenexusofprivacy.net) is also accessible via [mu.social](https://mu.social/profile/thenexusofprivacy.net/post/3mrrhiiq7bs2q?ref=thenexusofprivacy.net), [Bluesky](https://bsky.app/profile/thenexusofprivacy.net/post/3mrrhiiq7bs2q?ref=thenexusofprivacy.net), and other apps. There's also a more-general [discussion on discourse.atmosphere.community](https://discourse.atmosphere.community/t/atmosphere-technology-to-support-organizing-and-activism/966?ref=thenexusofprivacy.net), focuses on the tools and technologies for organizing. - In the fediverses, the [thread on gotosocial.thenexus.today](https://gotosocial.thenexus.today/@thenexusofprivacy/statuses/01KYPE62ECSVMGT19T2EJ5J5W9?ref=thenexusofprivacy.net) is also accessible from most other fediverse platforms. There's also a[n earlier brainstorming thread](https://neuromatch.social/@jdp23/116967043175194824?ref=thenexusofprivacy.net) with some additional ideas. To see upcoming posts, you can follow [@nexusofprivacy.net](https://blacksky.community/profile/thenexusofprivacy.net?ref=thenexusofprivacy.net), [@nexusofprivacy@gotosocial.thenexus.today](https://gotosocial.thenexus.today/@thenexusofprivacy?ref=thenexusofprivacy.net), [@thenexusofprivacy@lemmy.blahaj.zone](https://lem.lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net) and/or subscribe to [the Nexus of Privacy newsletter](https://thenexusofprivacy.net/) ## Notes ## ## ### The time is right: Organizing against the surveillance-industrial complex in the ATmosphere and the fediverses URL: https://thenexusofprivacy.net/the-time-is-right/ Last updated: 2026-08-27T20:13:45.000Z > "The use cases for alternative social networks – not controlled by techbro white supremacist CEO's working with their cronies in authoritarian governments – practically write themselves in today's world. And with so many talented social scientists, designers, systems thinkers, and developers directly impacted by DOGE, MAGA, et al, there are a lot of people with the right skills for these new networks to make rapid progress." > > – [If not now, when? Mutual aid and organizing in the fediverses, the ATmosphere, and whatever comes next](https://thenexusofprivacy.net/if-not-now-when/), March 2025 If we organize, the [ATmosphere](https://lab.leaflet.pub/3mrq6ma5dgs2x?ref=thenexusofprivacy.net) and [the fediverses](https://privacy.thenexus.today/bluesky-atmosphere-fediverse/?ref=thenexusofprivacy.net#there-are-many-fediverses) can have a big impact in the linked fights against different aspects of the surveillance-industrial complex. The density of people here who care about these issues is high, and we've got some very useful community-controlled infrastructure, innovative technology, and a developer ecosystem that [understands](https://blog.muni.town/on-protocol-organizing/?ref=thenexusofprivacy.net) the [value](https://atmosphereconf.org/event/Mej2N5X?ref=thenexusofprivacy.net) of providing [tools](https://mosh.leaflet.pub/3me5e6vqtkc2u?ref=thenexusofprivacy.net) for [organizers](https://bonfirenetworks.org/posts/bonfire-for-communities/?ref=thenexusofprivacy.net) and [communities](https://acorn.blacksky.community/?ref=thenexusofprivacy.net). And the time really is right. Every long-term privacy and digital rights organizer I've talked to agrees that there's never been more awareness of the threats of the [surveillance-industrial complex](https://www.routledge.com/The-Surveillance-Industrial-Complex-A-Political-Economy-of-Surveillance/Ball-Snider/p/book/9780367867188?ref=thenexusofprivacy.net), including US-based Big Tech and the fascist US government. The way that massive corporations that manufacture, distribute and profit from surveillance technologies work with government agencies like ICE, CBP, DHS, and their allies in law enforcement – and their equivalents in other authoritarian and genocidal countries – highlight both the harms and risks of the pervasive surveillance and the urgency of doing something about it. Here in the US, as [Solidarity over Surveillance](https://www.solidarityoversurveillance.com/?ref=thenexusofprivacy.net) says, > "Communities across the country are pushing back. Local groups are joining together to ban license-plate-reader companies like Flock from their towns. States are passing laws to prevent the federal government and law enforcement from buying our data from private parties. And activists are educating their communities on how to protect themselves from rampant surveillance. > > The time is now to rein in the surveillance state." In followon posts I'll go into more detail of how can have an immediate impact on these issues and related ones like resisting AI data centers. (**Update**, August 5: see [“The S is for surveillance”: fighting KOSA and bad internet bills in the ATmosphere and the fediverses](https://thenexusofprivacy.net/the-s-in-kosa-is-for-surveillance/) for the first of these follow-on posts.). And there are similar opportunities everywhere! This post stays at a higher level, looking at why I think the the time is also right in the ATmosphere and the fediverses. I've been experimenting with organizing on decentralized social networks for [almost a decade](https://thenexusofprivacy.net//data/osb17-activism-slides.pdf), and over the last year, it really feels like we've hit a tipping point – at least here in the US, and I suspect the same is true in Canada, the UK, several European countries, and probably elsewhere. Why? - There are enough people and organizations already active here – organizers. journalists, independent and mainstream media, tech justice experts and advocates, civil society organizations, politicians, candidates, etc etc etc – for some tactics to be very effective complements to in-person organizing – and counter the pro-surveillance bias of mainstream media. - Decentralized social networks are much friendlier ground for organizing then the hostile territory of Big Tech social networks. Some have values actively rooted in resistance: [Blacksky is rooted in mutual aid](https://www.youtube.com/watch?v=UA1DutGDVcs&ref=thenexusofprivacy.net) and [radical Black organizing traditions](https://blackskyweb.xyz/blacksky-part-three/?ref=thenexusofprivacy.net); the [Free Fedivers](https://freefediverse.org/index.php/Main%5FPage?ref=thenexusofprivacy.net)e is defined in opposition to surveillance capitalism, and [fought off Meta's attempts to annex the ActivityPub Fediverse](https://privacy.thenexus.today/should-the-fediverse-welcome-surveillance-capitalism/?ref=thenexusofprivacy.net#coda). The [fediverses' focus on consen](https://privacy.thenexus.today/consent-for-fediverse-developers/?ref=thenexusofprivacy.net)t flies in the face of surveillance capitalism's norms. Even in more contested terrain like Mastodon, Bluesky, and the corporate fediverse, most people generally oppose Big Tech and the surveillance state – and are eager to take action. - The emergence of international ATmospheric communities like Blacksky, Northsky and Gander in Canada, and Eurosky in the EU complements the fediverses' global reach and EU-centricity – and community-focused projects like [Blacksky's Acorn](https://acorn.blacksky.community/?ref=thenexusofprivacy.net), [Bonfire](https://bonfirenetworks.org/posts/bonfire-for-communities/?ref=thenexusofprivacy.net), and [Newmast](https://newsmastfoundation.org/?ref=thenexusofprivacy.net) are built by teams with a focus on organizing and mutual aid. - The technology continues to improve, with increasing numbers of useful tools for organizers and for people who want to get involved in activism. Custom feeds like [Flock and other ALPRs](https://bsky.app/profile/thenexusofprivacy.net/feed/flock-and-alprs?ref=thenexusofprivacy.net) and [KOSA/Bad Internet Bills](https://bsky.app/profile/thenexusofprivacy.net/feed/stopKOSA?ref=thenexusofprivacy.net) (accessible from any ATmosphere account including Blacksky, Eurosky, Northsky etc), and fediverse equivalents like the [KOSA and other Bad Internet Bills](https://lemmy.sdf.org/c/bad%5Finternet%5Fbills?ref=thenexusofprivacy.net) Lemmy community and Newmast's [Age Verification Channel](https://channel.org/@ageverification?ref=thenexusofprivacy.net) (both accessible from any GoToSocial, Bonfire, Mastodon, etc accont) let people follow an issue and find out about key actions. Knowledge networks like Bee's [Age Verification and ID Checks](https://semble.so/profile/sweetbee.gay/collections/3mjkwatifxt2i?ref=thenexusofprivacy.net) Semble collection are a great asset for people who want to dig into a topic more deeply. Germ Networks and Solidarity.Social link ATmosphere accounts to end-to-end-encrypted private messages and group chat, complementing Signal (where [organizers are overwhelmed by notifications](https://thenexusofprivacy.net/more-notes-on-organizing/#:~:text=Before%20we%20got%20to%20social%20networks)). These tools *aren't available on centralized social networks*, so for once we have a technology advantage. > "Our research found a **transition to a pluriverse of options** could be the most viable way forward: this might include repurposing existing platforms, embracing low-tech approaches, and developing innovative alternatives that meet the needs of social justice organizations and marginalized communities." > > – Engine Room's report on [Exploring a transition to alternative social media platforms for social justice organizations in the Majority World](https://www.theengineroom.org/library/new-report-exploring-a-transition-to-alternative-social-media-platforms-for-social-justice-organizations-in-the-majority-world/?ref=thenexusofprivacy.net) Big Tech's much larger centralized social networks aren't going away an time soon. Despite all their censorship, demands for ID, moderation issues, tracking, exploitation etc etc etc) Instagram, TikTok, YouTube, etc, remain useful for mobilizing, getting the word out, and recruiting. Still, it's not like our reach is limited by the current size of decentralized social networks. Most of also communicate via email and/or group chat and/or Signal and/or Big Tech social networks – and know people in real life too. So we have lots of ways of building on the organizing we do in the ATmosphere and fediverses. > "Surveillance isn't inevitable." > > – [National Week of Action against ALPRs](https://noalprs.com/?ref=thenexusofprivacy.net), noalprs.com There's really a lot of potential upside here. Grassroots activism on social networks has made a huge difference in the past – [Un millón de voces contra las FARC](https://es.wikipedia.org/wiki/Un%5Fmill%C3%B3n%5Fde%5Fvoces%5Fcontra%5Flas%5FFARC?ref=thenexusofprivacy.net), Get FISA Right, Join the Impact, #BlackLivesMatter, #metoo – and it can be even more powerful on platforms that *we* control. And a lot of people who currently *aren't* active on decentralized social networks are also pushing back against Big Tech, age verification, AI data centers, and mass surveillance. So if we become a great place to organize against surveillance capitalism and the surveillance-industrial complex (and build tools that are useful for [all kinds of organizers](https://mosh.leaflet.pub/3me5e6vqtkc2u?ref=thenexusofprivacy.net)), we'll attract a lot of people, and accelerate movement away from Big Tech's centralized social networks. Win/win! If that sounds interesting to you ... - **Get involved!** Links here are starting points on some of these, but there's lots of other important stuff going on as well all over the world. So look around for others interested in the same issues as you and start connecting. And as you do, think about what could make the process more effective. - **Please discuss!** The ideas here are really just a starting point – see below for some discussion questions, but anything relevant is welcome! - [The Polis conversation here](https://pol.is/26waznfdvb?ref=thenexusofprivacy.net) is the easiest way to share your thoughts and give feedback on what others are saying. - In the ATmosphere, the [thread on blacksky.community](https://blacksky.community/profile/thenexusofprivacy.net/post/3mrrhiiq7bs2q?ref=thenexusofprivacy.net) is also accessible via [mu.social](https://mu.social/profile/thenexusofprivacy.net/post/3mrrhiiq7bs2q?ref=thenexusofprivacy.net), [Bluesky](https://bsky.app/profile/thenexusofprivacy.net/post/3mrrhiiq7bs2q?ref=thenexusofprivacy.net), and other apps; the [discussion on atmosphere.community](https://discourse.atmosphere.community/t/atmosphere-technology-to-support-organizing-and-activism/966?ref=thenexusofprivacy.net) focuses on the tools and technologies. - In the fediverses, the [thread on gotosocial.thenexus.today](https://gotosocial.thenexus.today/@thenexusofprivacy/statuses/01KYPE62ECSVMGT19T2EJ5J5W9?ref=thenexusofprivacy.net) is also accessible from most other fediverse platforms - **Stay tuned for more!** Follow [@nexusofprivacy.net](https://blacksky.community/profile/thenexusofprivacy.net?ref=thenexusofprivacy.net), [@nexusofprivacy@gotosocial.thenexus.today](https://gotosocial.thenexus.today/@thenexusofprivacy?ref=thenexusofprivacy.net), [@thenexusofprivacy@lemmy.blahaj.zone](https://lem.lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net) and/or subscribe to [the Nexus of Privacy newsletter](https://thenexusofprivacy.net/) **Update, August 5**: Continued in [“The S is for surveillance”: fighting KOSA and bad internet bills in the ATmosphere and the fediverses ](https://thenexusofprivacy.net/the-s-in-kosa-is-for-surveillance/) ### A bad week for Flock (but a good week for privacy and local organizing) in Washington state! URL: https://thenexusofprivacy.net/a-bad-week-for-flock/ Last updated: 2026-07-22T17:28:09.000Z [*Originally published on wa-privacy.net.*](https://wa-privacy.net/a-bad-week-for-flock-in-washington/?ref=thenexusofprivacy.net) Wow! As the pushback against Flock and other ALPRs grows all around the country, Washington state is doing its part! Over the last two days: - Issaquah City Council voted for a moratorium on ALPR usage -- not just Flock, but *all* ALPRs - Redmond voted to cancel their contract with Flock. They're the fourth city in Washington to cancel their Flock contract, joining Mountlake Terrace, Lynnwood, and Edmonds - Renton City Council voted to continue their pause on Flock cameras -- and do a detailed review of their Flock contract. - Auburn City Council narrowly voted not to review their ALPR policies or contracts yet ... but the vote was only 4-3, and activism is just starting to crank up, so it's far from over. When the statewide law (SB 6002, also known as the Driver Privacy Act) passed this spring, there was a lot of concern that it would take the energy away from local organizing. That clearly hasn't happened! There's broad understanding that (as Representative Brianna Thomas said in the House floor debate) "the safeguards in this bill do not go far enough to match the power of the technology." Similarly, SB 6002 sponsor Senator Yasmin Trudeau has describes its guardrails as "a floor, not a ceiling" -- and emphasized that it's *not* an endorsement of the technology. And it's local organizing that's made the difference in all these cities. On Monday night in Renton, 29 people gave public comment against ALPRs -- and nobody spoke in favor, even though the police chief had encouraged supporters to show up. The comments were impressively insightful, passionate, powerful, and well-researched ... people really care about this issue! Redmond councilmembers cited the outpouring of concern from the community, including a lot of people who weren't usually engaged. So thanks and congratulations to everybody who contributed, and to organizers like Deflock Redmond, No Flock in Issaquah, For a Better Redmond, and Southend Indivisible for all their work. Of course, there's still a lot more to do. There's still clearly a lot of convincing needed in Auburn. The battle in Renton is likely to continue once councilmembers had a chance to review the contract. Flock isn't the only ALPR company out there; cities in other states have replaced Flock with Axon, which hasn't gotten as much bad press but isn't really any better ... so we'll have to be alert for that here. And of course there are still lots of cities and counties that *haven't* turned off their ALPRs yet, and all the privately run ALPRs from companies like Home Depot and Lowe's. Still, these were some major victories – and really build the momentum going into [the National ALPR Week of Action (August 16-22)](https://noalprs.com/?ref=thenexusofprivacy.net). Congratulations once again to everybody involved! --- Image credit: originally from Pixabay, published under CC0, [via picryl](https://picryl.com/media/wow-amazed-surprised-dc5d46?ref=thenexusofprivacy.net). ### Flock is on the agenda this week at the Renton, Issaquah, Auburn, and Redmond city councils! URL: https://thenexusofprivacy.net/flock-is-on-the-agenda-this-week-at-the-renton-issaquah-and-redmond-city-councils/ Last updated: 2026-07-29T07:53:27.000Z > "This past year has exposed just how dangerous automated license plate readers are as Flock Safety’s products have reportedly been used in [immigration enforcement](https://www.404media.co/ice-taps-into-nationwide-ai-enabled-camera-network-data-shows/?ref=thenexusofprivacy.net), [abortion monitoring](https://www.404media.co/a-texas-cop-searched-license-plate-cameras-nationwide-for-a-woman-who-got-an-abortion/?ref=thenexusofprivacy.net), [repeated incidents of stalking](https://ij.org/police-have-reportedly-used-license-plate-readers-to-stalk-romantic-interests-at-least-14-times-in-recent-years/?ref=thenexusofprivacy.net), and experienced [major cybersecurity breaches](https://therecord.media/wyden-letter-ftc-flock-safety-investigate-cybersecurity-practices?ref=thenexusofprivacy.net). But Flock is not alone. [Motorola Solutions](https://www.yahoo.com/news/us/articles/motorola-solutions-sued-illinois-over-171129999.html?ref=thenexusofprivacy.net) has long partnered with federal immigration enforcement, while [Axon](https://www.axios.com/local/denver/2026/03/18/new-proposed-license-plate-reader-company-dhs-ties?ref=thenexusofprivacy.net) has deep ties to the Department of Homeland Security (DHS) and a history of [major ethics violations](https://www.policingproject.org/statement-of-resigning-axon-ai-ethics-board-members?ref=thenexusofprivacy.net). Flock has rightfully earned the public’s ire, but these problems are constitutive of the police surveillance industry more broadly. > > After learning about the use of these AI cameras in their communities, thousands of people across the country have demanded that automated license plate reader cameras be removed. Thus far, [more than 80 communities](https://deflock.org/council?ref=thenexusofprivacy.net) have either canceled, rejected, or deactivated their cameras in the growing challenge to the surveillance apparatus." > > – [The Fight Against Surveillance Cameras Is a Struggle for Democracy](https://truthout.org/articles/the-fight-against-surveillance-cameras-is-a-struggle-for-democracy/?ref=thenexusofprivacy.net), Ed Vogel, *Truthout* Washington state continues to be one of the leaders in the fight against Flock and other ALPRs ("automated license plate readers", which despite their name actually also allow law enforcement to search for cars based on their color, make, or what bumper stickers are on them). Mount Vernon recently voted to turn off their Flock cameras, and Edmonds voted to cancel their Flock contract, joining Skamania County and cities like Mountlake Terrace, Lynnwood, and Olympia who have canceled or at least paused their Flock usage. And it's not just happening in Washington. Last week, Los Angeles Police Department announced that they're not renewing their Flock contract yet, citing "serious concerns around civil liberties and civil rights issues, particularly around privacy and the data that is being collected from these cameras.” As Stop LAPD Spying Coalition organizer Grace Zhang said, "This did not happen because the Board of Police Commissioners grew a conscience. This happened because the people organized.” People organized to press Mount Vernon, Edmonds, Lynnwood, Olympia, Mountake Terrace and Skamania County to take action as well ... and people are organizing across Washington in cities that are still discussing what to do about ALPRs. This week features at least four more discussions: - On Monday, the Renton city council might vote on whether to turn their cameras back on. Things have been a bit of a roller-coaster in Renton, where they first turned off their Flock ALPRs earlier this year, briefly turned them back on in April, and then after a public outcry quickly turned them back off again. Last week, [20 Renton residents gave public comment opposing turning the ALPRs back on](https://www.youtube.com/watch?v=zK6PKiFGBWc&t=440s&ref=thenexusofprivacy.net), but there are rumors that the council is considering doing it anyhow. Southend Indivisible (who's been playing a key role in the organizing, along with Renton Neighbors and [Deflock Renton](https://deflockrenton.com/?ref=thenexusofprivacy.net)) has[ an action up to copy the council](https://actionnetwork.org/letters/keep-alpr-cameras-shut-off-and-cancel-flock-contract?ref=thenexusofprivacy.net); there's also an action from[ Washington Privacy Organizers](https://www.takeaction.network/xactions/52674?ref=thenexusofprivacy.net). - Also on Monday, Issaquah City Council is discussing a [Proposed ALPR Camera Use Policy](https://issaquah.civicweb.net/FileStorage/5E444E4E25C64DBFBCEA1A75698B3EB6-Proposed%20Automated%20License%20Plate%20Reader%20Camera%20.pdf?ref=thenexusofprivacy.net). Issaquah doesn't currently operate any ALPRs, and decided earlier this year not to accept grant funding for installing ALPRs. One option on the table is a moratorium on ALPR use; another option is to develop a use policy that extends the protections in Washington's recently-passed SB 6002 by early next year, and then potentially reconsider ALPR adoption. My impression is that this is just going to be a discussion, not a vote, but it still should be interesting. [No Flock in Issaquah](https://noflockissaquah.com/?ref=thenexusofprivacy.net) has been an organizing hub here (check out [the public comment at the May 11 Committee of the Whole meeting](https://bsky.app/profile/deflock-redmond.bsky.social?ref=thenexusofprivacy.net)), and after we hear what the council is thinking, they'll probably have some thoughts about the path forward. - And also on Monday, [Indivisible Auburn is organizing public comment at the Auburn City Council meeting](https://bsky.app/profile/indivisibleauburn.bsky.social/post/3mr3rkvd57a2i?ref=thenexusofprivacy.net)! - On Tuesday, the Redmond city council is voting on whether to cancel their Flock contract. Redmond turned off their Flock cameras last October, in response to strong community pushback, and city legal staff has been investigating the implications of cancelling the contract. At the [May 26 "study session"](https://www.youtube.com/watch?v=AMFQCP8yp7I&ref=thenexusofprivacy.net), councilmembers generally supported canceling the contract, so hopefully this is just formalizing that decision. [Deflock Redmond](https://bsky.app/profile/deflock-redmond.bsky.social?ref=thenexusofprivacy.net) has played a very important role in the organizing here; they've [got an update and a link to an action here](https://www.change.org/p/demand-the-removal-of-flock-s-ai-powered-mass-surveillance-cameras-from-redmond-wa/u/34997015?ref=thenexusofprivacy.net). That's a lot! And looking forward, the [Week of Action against ALPRs](https://noalprs.com/?ref=thenexusofprivacy.net) kicks off on August 16, so stay tuned for more! ### Get FISA Right turns 18 URL: https://thenexusofprivacy.net/get-fisa-right-turns-18/ Last updated: 2026-08-15T17:14:07.000Z *Originally posted* [*on Get FISA Right*](https://getfisaright.net/2026/06/26/get-fisa-right-turns-18/?ref=thenexusofprivacy.net) > "During the Democratic primary for President of the United States, the activist base rallied behind the Constitution and the efforts of Senators Chris Dodd and Russell Feingold to deny immunity for telecommunications companies that helped the Bush Administration spy on American citizens without a court order. > > Senator Obama pledged to "support a filibuster" of ANY bill that contained retroactive immunity. Now that he has won our votes in the primary, he has decided to vote in favor of retroactive immunity for the telecoms." > > \-- Mardi, June 26 2008, in *Please Don't … Senator* on my.barack.obama.com; links no longer accessible, even in archive.org > "The group was conceived on a listserv for progressive, politically active people, said Mike Stark, an activist who is a law student at the University of Virginia. He wrote an initial e-mail to the group arguing: “Obama is getting mad props for social networking, why don’t we use social networking to let him know that he can’t keep elbowing his progressive base — the people who got him the nomination — away from the policy table?”" > > \-- Norm Cohen, [Obama Backlash in His Online Backyard](https://web.archive.org/web/20091004061925/http://thecaucus.blogs.nytimes.com/2008/07/01/obama-backlash-in-his-online-backyard/), *New York Times,* July 1, 2009 **Please, Senator Obama, Say NO to Telecom Immunity and Get FISA Right** launched on June 26, 2008, with posts by Mardi on my.barackobama.com (aka MyBO). The next day, Mike Stark's post on *Open Left* kicked off a barrage of posts in the progressive blogosphere. On June 29, our collaboratively-authored [Open Letter To Senator Obama: Please Vote NO On Telecom Immunity](https://web.archive.org/web/20110817041702/http://realitycatcher-alapoet.blogspot.com/2008/06/open-letter-to-senator-obama-please.html) hit #1 on Digg. The media hook of Obama supporters using his own social network to pressure him quickly picked up mainstream media [coverage](https://web.archive.org/web/20091004061925/http://get-fisa-right.wetpaint.com/page/Coverage), first from Ari Melber at [*The Nation*](https://web.archive.org/web/20090107150518/http://www.thenation.com./blogs/campaignmatters/333298/obama%5Fnetwork%5Forganizes%5Fand%5Frevolts%5Fover%5Fspying), quickly followed by the [*Wall Street Journal,*](https://web.archive.org/web/20090212210414/http://blogs.wsj.com/washwire/2008/06/30/obama-critics-find-support-on-obamas-web-site/) [*Wired*](https://web.archive.org/web/20090918183853/http://www.wired.com/threatlevel/2008/06/telecom-amnes-1/)*, Time,* the [*New York Times*](https://web.archive.org/web/20091004061925/http://thecaucus.blogs.nytimes.com/2008/07/01/obama-backlash-in-his-online-backyard/) *...* By July 2, we were the biggest group on MyBO. On July 3, Obama responded to our open letter on MyBO and [the Huffington Post](https://www.huffpost.com/entry/my-position-on-fisa%5Fb%5F110789?ref=thenexusofprivacy.net) – an event that’s often seen as a watershed for social network activism in the US.\* Get FISA Right's grassroots energy was a valuable complement to the multi-year work by civil liberties organizations like EFF, EPIC Privacy, and CDT -- and by champions in Congress like Russ Feingold and their staffers -- and for a moment it seemed like we had tipped the scales. But alas, it wasn’t enough. https://www.youtube.com/watch?v=x8KmBNufzmQ*The crowdfunded video ad Get FISA Right ran in 2008 partnering with SaysMe.tv* On July 9 2008 Congress passed the FISA Amendments Act, including Section 702 – giving the government virtually unrestricted access to collect Americans’ international communications, and granting retroactive immunity to telecoms that had cooperated in illegal Bush-era spying. In 2012, not long before the Snowden revelations President Obama urged Congress to voted to reauthorize FISA Section 702 for another six years ... and they did. In 2018, despite years of documentation of how inttelligence agences broke the law and the Carter Page incident, President Trump eventuallyurged Congress voted to reauthorise FISA Section for another six years. In 2024, President Biden urged Congress voted to reauthorize and *expand* intelligence agencies powers under FISA Section 702 for another two years ... and they did. And in 2026 ... [![A screenshot of the results of the vote on HR 9238. Republican: 190 Yay, 19 Nay, 9 NV. Democratic: 7 Yea, 199 Nay, 9 NV. Independent: 1 Yea. Totals: 198 Yea, 218 Nay, 15 NV.](https://getfisaright.net/wp-content/uploads/2026/06/fisa-vote.png?w=1000)](https://getfisaright.net/wp-content/uploads/2026/06/fisa-vote.png?ref=thenexusofprivacy.net) **The final vote on H.R.9238, a three-week extension of FISA Section 702, June 11 2026* > "A key surveillance power expired early Saturday amid a congressional stalemate over renewing it" > > \- [A Key Spying Power Expired. Will Foreign Surveillance Go Dark?](https://www.nytimes.com/2026/06/12/us/politics/fisa-expiration.html?ref=thenexusofprivacy.net), Dustin Volz, *New York Times*, June 12 2026 Whoa. Wasn't expecting that! Since the FISA Court has authorized the program through March 2027, the "lapse" (as everybody seems to be referring it) doesn't actually end Section 702 surveillance; [Brennan Center's one-pager](https://www.brennancenter.org/our-work/research-reports/section-702-surveillance-will-continue-until-march-2027-even-if-statute?ref=thenexusofprivacy.net) and Patrick Eddington's [FISA Section 702 Lapse Assured—What Now?](https://www.cato.org/blog/fisa-section-702-lapse-assured-thankfully?ref=thenexusofprivacy.net) on *Cato at Liberty* have the details. Still, it's a huge victory for FISA reformers. As Jake Leperruque of CDT says in the *Washington Examiner,* [there’s only one way out of Congress’s FISA quagmire](https://www.washingtonexaminer.com/op-eds/4602760/one-way-out-of-congress-fisa-702-quagmire/?ref=thenexusofprivacy.net); congressional leaders need to “stop stonewalling and [allow votes on reform](https://www.washingtonexaminer.com/op-eds/4598003/fisa-section-702-bill-pulte-brinkmanship-clock/?ref=thenexusofprivacy.net)” [EPIC Privacy notes](https://epic.org/fisa-section-702-almost-certain-to-expire-after-house-votes-against-extension-epic-continues-to-urge-reforms/?ref=thenexusofprivacy.net) > “Senators from both sides of the aisle have introduced bills that would reauthorize Section 702 while making crucial reforms: The Government Surveillance Reform Act of 2026 ([GSRA](https://www.congress.gov/bill/119th-congress/senate-bill/4082?ref=thenexusofprivacy.net)); the Security and Freedom Enhancement Act of 2026 ([SAFE Act](https://www.congress.gov/bill/119th-congress/senate-bill/3893/all-info?ref=thenexusofprivacy.net)); and the Protect Liberty and End Warrantless Surveillance Act of 2026 ([Protect Liberty Act](https://www.congress.gov/bill/119th-congress/house-bill/7816?ref=thenexusofprivacy.net)).” All of these include reforms like a warrant requirement and closing the data broker loophole, which have broad public support as well as bipartisan support in Congress. ## Thanks to everybody who's been involved over the years! > "Members of the group are vowing not just to fight on, but to organize in a way that was impossible to do during the last frenzied two weeks. Members are retooling, [creating a central website](http://www.getfisaright.com/?ref=thenexusofprivacy.net) with more robust tools so that the large number of members can better communicate without hundreds of emails clogging their inboxes." > > \-- Dawn Teo, [Networked Obama FISA Group Takes Fight Forward](https://www.huffpost.com/entry/networked-obama-fisa-grou%5Fb%5F111577?ref=thenexusofprivacy.net) on *Huffington Post*, July 17 2008 Get FISA Right kept organizing -- and finding creative ways to use social networks: - In August 2008, we partnered with SaysMe.tv [ran crowdfunded pro-civil liberties TV ads during the Republican National Convention](https://www.rawstory.com/news/2008/AntiFISA%5Fgroup%5Ftargets%5FGOP%5Fairwaves%5Fin%5F0903.html?ref=thenexusofprivacy.net) - In January 2009 [we allied with DREAM Activists and undocumented youth, the Stonewall 2.0 LGBTQ movement, and peace activists](http://www.talesfromthe.net/jon/?p=323&ref=thenexusofprivacy.net) in the Ideas for Change competition, and ran another crowdfunded add [in DC in January 2009 for Obama’s inauguration](https://getfisaright.net/2009/01/19/congratulations-president-obama-please-get-fisa-right/?ref=thenexusofprivacy.net). - During the unsuccessful JUSTICE Act battle in 2011-12, the first of many not-yet-successful attempts to introduce reforms during authorization, we partnered with Twazzup on a Twitter-based FISA-related news and video aggregator and coordinated regular meetings between civil liberties organizations and grassroots activists. Since then, as newer groups like [Demand Progress](https://demandprogress.org/about/?ref=thenexusofprivacy.net), [Restore the Fourth](https://getfisaright.net/2013/07/04/restorethe4th-grassroots-civil-liberties-activism-is-back-and-better-than-ever/?ref=thenexusofprivacy.net),and [Fight for the Future](https://www.fightforthefuture.org/?ref=thenexusofprivacy.net) have taken the lead, we’ve come back to life from time to time during FISA and Patriot Act reauthorization battles. Communications have been a huge challenge for the Get FISA Right. At first it was email overload (hundreds of messages per hour, with manual approval required before sending to the group, and buggy software). Then barackobama.com shut down (a [huge](https://web.archive.org/web/20170225023128/http://civichall.org/civicist/cool-kids-killed-obamas-grassroots-movement/) [missed](https://newrepublic.com/article/140245/obamas-lost-army-inside-fall-grassroots-machine?ref=thenexusofprivacy.net) [opportunity](https://www.facebook.com/waisbren/posts/10106364113761887) for the country as a whole, not just us) and we lost our largest communication channel.. Our self-hosted forum never got to critical mass, and neither did our [Google Group](https://groups.google.com/g/get-fisa-right?ref=thenexusofprivacy.net), our [Facebook group](https://www.facebook.com/groups/17961184023) and [page](https://www.facebook.com/GetFisaRight), or our [Medium blog](https://medium.com/get-fisa-right?ref=thenexusofprivacy.net). A few years later, Wetpaint (still the best wiki I've ever used for activism, as the Voter Suppression Wiki and Join the Impact showed later in 2008) got sold and then went away. Today, pages like [This time, **we're** writing the history are only available](https://web.archive.org/web/20110817041702/http://get-fisa-right.wetpaint.com/page/This+time%2C+we're+writing+the+history) are only available via archive.org -- and for that matter the vast majority of the links don't exist any more. Still, quite a few Get FISA Right members from 2008 have stayed involved in activism, and it's always a pleasure to run into you. It's really amazing what we've accomplished as an all-volunteer grassroots group ... so thanks to everybody who's been involved over the years! ## Stay tuned! For years, civil libertarians like Get FISA Right have warned of the risks of the government abusing their broad spying powers. With the administration targeting protestors, immigrants, and anybody who opposes fascism, the stakes of FISA renewal are higher than ever. As Spebcer Ackerman discusses in [Big STELLAR WIND Energy](https://www.forever-wars.com/big-stellar-wind-energy/?ref=thenexusofprivacy.net), "an unresolved question is whether the Security State and its allies would actually accept the loss of what the intelligence agencies consistently describe as one of their most important authorities." More positively, though, the good news is that there's much broader awareness of the risks of the surveillance-industrial complex than ever before. The vast majority of Americans have always opposed warrantless wiretapping, but it's been challenging to mobilize peoiple. With [momentum opposing data centers building across party lines](https://truthout.org/articles/everybody-hates-data-centers/?ref=thenexusofprivacy.net), and restance to Flock's AI-based police surveillance systems exploding,that seems like it's changing. This year's FISA battle is kind of on hold right now, with [Democrats refusing to vote for anything as long as the odious Bill Pulte is Acting Director of National Intelligence](https://theintercept.com/2026/06/11/democrats-pulte-fisa-surveillance/?ref=thenexusofprivacy.net) and [Trump holding FISA hostage to try to force the Senate to pass the voter-suppression SAVE America Act](https://www.nationalreview.com/2026/06/dont-hold-section-702-renewal-hostage-to-the-save-america-act/?ref=thenexusofprivacy.net), but is likely to heat up again. If they don't pass anything before the midterms, they can also take a crack at it in the post-election “lame duck” sessions in November and December -- or try attaching it to must-pass legislation like the NDAA. So there's still a long way to go.… So stay tuned! - You can subscribe to this blog at the bottom of the post - or just check back here from time to time - Follow us in the Atmopshere (Blacksky, Bluesky, or Eurosky) at [@getfisaright.net](https://blacksky.community/profile/did:plc:wt7xwfixfqrjxcpzc55udq7l?ref=thenexusofprivacy.net) - Follow us in the Fediverse at [@getfisaright.net@getfisaright.net](https://getfisaright.net/?ref=thenexusofprivacy.net) ### KOSA, the KIDS Act, AI, Bad Internet Bills, and a potential giveaway to big tech (UPDATED) URL: https://thenexusofprivacy.net/kosa-kids-act-june-update/ Last updated: 2026-08-02T17:53:18.000Z *Originally published June 24; last major update June 30, after the vote. See the* [*Update Log*](#update-log) *at the bottom for the edit history.* > *"*The House passed a bipartisan package of children’s online safety bills in a 267-117 vote Monday, advancing legislation that supporters say would better protect children online but critics warn could threaten privacy and free expression.*"* > > *–* [Kids online safety package clears House, drawing warnings from digital rights and tech groups](https://www.nbcnews.com/tech/tech-news/kids-internet-and-digital-safety-act-passes-house-free-speech-concerns-rcna352341?ref=thenexusofprivacy.net)*,* Angela Yang, *NBC News* As one of those critics, all I can say is ... bummer. And I'm not the only one who thinks so. > "The restrictions from the KIDS Act are extremely harmful for youth, especially vulnerable youth who rely on social media for connectivity, support systems and exposure to alternative viewpoints." > > – [How the KOSA and KIDS Acts will Harm Vulnerable Teenagers](https://www.youthrights.org/how-the-kosa-and-kids-acts-will-harm-vulnerable-teenagers/?ref=thenexusofprivacy.net), Zane Miller, *National Youth Rights Association* > "Buried inside the KIDS Act are provisions that will push online services to verify all users’ ages, require government-directed moderation policies for online speech, and even create new rules about private and encrypted communications. While supporters continue to claim this bill protects minors online, its requirements come at the expense of privacy, free expression, and the ability of people of all ages to use the internet without revealing sensitive data." > > – [The KIDS Act Would Require Age Checks To Get Online](https://www.eff.org/deeplinks/2026/06/kids-act-would-require-age-checks-get-online?ref=thenexusofprivacy.net), Joe Mullin, [](https://www.eff.org/deeplinks/2026/06/kids-act-would-require-age-checks-get-online?ref=thenexusofprivacy.net)EFF It really is a bummer. More positively, though, the KIDS Act isn't going anywhere in the Senate. Tthey're working on "kids safety" legislation as well, including their own version of KOSA (one of the many bad internet bills bundled into the KIDS Act) and hate hate hate the House version. So while the House vote is disappointing, it also wasn't unexpected, and one way of looking at it is the House staking out a position for cross-chamber negotiations later in the session. In 2022 and 2024 the battles over KOSA and other bad internet bills continued into December, with various shenanigans trying to get bills attached to "must-pass" bills like the NDAA, and it'll probably happen this year as well. Legislators are under a lot of pressure to pass *something* to "protect the children" and "hold big tech accountable", and big tech and their pals in anti-LGBTQIA2S+ hate groups are cranking up the lobbying. Then again, fierce activism kept anything from passing in 2022 and 2024, and we've certainly got a chance to do the same this year. So buckle up for the long haul, and let's dig in to the complex situation. > If don't have time for the complexity right now and just want to take action, Fight for the Future's [Bad Internet Bills](https://www.badinternetbills.com/?ref=thenexusofprivacy.net) make it easy to contact your legislators about the KIDS Act, KOSA, and other bad internet bills. . > > Or, call the US Capitol Switchboard at 202-224-3124, and ask your Senator to **vote NO on the KIDS Act (HR 7757), the Senate version of KOSA (S. 1748), the App Store Accountability Act, and any other bill that age restricts, censors and surveils the internet.** To follow the action on KOSA, the KIDS Act, and other Bad Internet Bills, I've set up a couple of custom feeds using graze.social. You can check these whether or not you've got an account; if you're on Blacksy, Eurosky, Bluesky or some other social network in the Atmosphere, you can also follow them just like any other custom feed. - [KOSA/Bad Internet Bills ](https://blacksky.community/profile/did:plc:zoaio4horax5ncnyeewotygo/feed/stopKOSA?ref=thenexusofprivacy.net)(also available on [mu.social](https://mu.social/profile/did:plc:zoaio4horax5ncnyeewotygo/feed/stopKOSA?ref=thenexusofprivacy.net) and [Bluesky](https://bsky.app/profile/did:plc:zoaio4horax5ncnyeewotygo/feed/stopKOSA?ref=thenexusofprivacy.net)) has a broad selection of posts related to KOSA, the KIDS Act, other bad internet bills, and age verification in general - [KOSA/KIDS Act (curated)](https://blacksky.community/profile/did:plc:zoaio4horax5ncnyeewotygo/feed/kosa-curated?ref=thenexusofprivacy.net) (also on [mu.social](https://mu.social/profile/did:plc:zoaio4horax5ncnyeewotygo/feed/kosa-curated?ref=thenexusofprivacy.net) and [Bluesky](https://bsky.app/profile/did:plc:zoaio4horax5ncnyeewotygo/feed/kosa-curated?ref=thenexusofprivacy.net)) has a curated subset of these posts, primarily from a list of about 20 organizations, legal experts, journalists, and activists focused on digital rights, human rights (including youth rights and LGBTQIA2S+ rights), civil liberties, and civil rights **Contents** - [A lot has happened in the last two weeks](#last-two-weeks) - [Meanwhile in the Senate ...](#meanwhile-in-the-senate) - [The KIDS Act would lead to platforms requiring age verification](#kids-act-age-verification) - [Age verification is surveillance](#surveillance) - [Reading the political tea leaves](#tea-leaves) ## A lot has happened in the last two weeks > "Yesterday, Meta [dropped its opposition](https://www.politico.com/live-updates/2026/06/16/congress/meta-opposition-kosa-00964605?ref=thenexusofprivacy.net) to KOSA after reports that it is being packaged by the White House with AI preemption and the App Store Accountability Act, two bills that Meta has lobbied for. Meta now joins Microsoft, Apple, X, Snap, and Pinterest in supporting KOSA, while [much of civil society](https://cdt.org/press/more-than-90-human-rights-and-lgbtq-groups-sign-letter-opposing-kosa/?ref=thenexusofprivacy.net) and the [city of Boston](https://www.boston.gov/news/council-adopts-resolution-opposing-legislation-restricting-access-online-resources?ref=thenexusofprivacy.net) opposes." > > –[Meta Latest Big Tech Company to Back KOSA, exposing hypocrisy of “accountability” bill](https://www.fightforthefuture.org/news/2026-06-17-press-release-meta-latest-big-tech-company-to-back-kosa/?ref=thenexusofprivacy.net), Fight for the Future, June 17 > "House lawmakers announced a bipartisan deal on a package for protecting kids online on Monday... The Kids Internet and Digital Safety, or KIDS, Act includes portions from the landmark Kids Online Safety Act, dubbed KOSA ... along with 13 other kids safety-related bills. > > While the package now could pass with bipartisan support in the House, senators leading their own KOSA effort suggested it will be dead on arrival in the upper chamber." > > – [House unveils bipartisan kids online safety deal](https://thehill.com/policy/technology/5934266-bipartisan-deal-kids-online-protection/?ref=thenexusofprivacy.net), Miranda Nazzaro, *The Hill, June 22* Let's start with the KIDS Act, officially known as [H.R. 7757](https://d1dth6e84htgma.cloudfront.net/H7757%5FSUS%5Fxml%5F4b1ac8f00f.pdf?ref=thenexusofprivacy.net). The KIDS Act is a combination of over a dozen different bills, including the House version of the anti-LGBTQIA2S+ KOSA; the anti-LGBTQIA2S+ SCREEN Act requiring age verification for "sexual material harmful to minors"; an updated version of the Childrens and Teens Online Privacy Protection Act (CTOPPA, also sometimes known as COPPA 2.0; and more.[1](#notes) The House's vote this week was under a [suspension of the rules](https://www.congress.gov/crs-product/98-314?ref=thenexusofprivacy.net), which limits debate to 40 minutes and means the bill doesn't have to go through the Rules committee but requires a 2/3 majority to pass. That means Democrats could easily have blocked it block it. But Minority leader Hakeem Jeffries calls KOSA a "step in the right direction". Influential Democrats like House Energy & Commerce Ranking Member Frank Pallone support the KIDS Act and the House version of KOSA. So does Washington state's Kim Schrier, who laughably claims that a bill Meta, Microsoft, Apple, X, Snap, and Pinterest (and OpenAI too) all support will "[hold big tech accountable](https://bsky.app/profile/repkimschrier.bsky.social/post/3mpcb2e2ges2j?ref=thenexusofprivacy.net)." Yeah right. So less than half 192 House Democrats who are members of the Congressional Equality Caucus followed up on their "Happy Pride" posts by actually opposing anti-LGBTQIA2S+ legislation. And while I appreciate all the "no" votes from Democrats, some of them made it clear that it was only because they supported the Senate's version of KOSA – which is also a bad internet bill. Back in March, Republicans on the House Energy & Commerce Committee advanced the KIDS Act on a straight party-line vote. At the time, Democrats on the House committee opposed it, objecting both to dropping the "duty of care" requirement (a centerpiece of the Senate version of KOSA) and to provisions in the bill that would preempt state child safety legislation.[2](#notes) The version of the KIDS Act the House passed has some improvements in the preemption language.3 It also bundles in some new protections for kids and teens privacy, by including CTOPPA (also known as COPPA 2.0). That was enough to get at least some key House Dems on board for this anti-LGBTQIA2S+ internet censorship and surveillance bill, even though there still isn't a duty of care.[3.5](#notes) > For more on why age verification laws and KOSA are anti-LGBTQIA2S+, check out Evan Greer and Janus Rose's [Why Are Some Democrats Backing MAGA’s Anti-LGBTQ+ Censorship?](https://www.teenvogue.com/story/some-democrats-are-helping-the-trump-admins-anti-lgbtq-tech-agenda?ref=thenexusofprivacy.net) on *Teen Vogue;* Rindala Alajaji and Paige Collings' [Age-Verification Laws Seek to Erase LGBTQ+ Identity from the Internet](https://msmagazine.com/2025/02/25/lgbtq-abortion-censorship-age-verification-laws/?ref=thenexusofprivacy.net) in *Ms Magazine;* and the letter from [90 civil rights and privacy organizations condemning ID-checking bills](https://www.fightforthefuture.org/news/2025-03-06-new-letter-90-civil-rights-and-privacy-organizations-condemn-id-checking-bills-citing-effectiveness-censorship-and-privacy-concerns/?ref=thenexusofprivacy.net), which also discusses how age verification is especially burdensome on other marginalized communities. ## Meanwhile in the Senate ... One thing that hasn't changed since March, though, is that supporters of the Senate version of KOSA still hate hate hate the House version and wish it didn't exist. As Gabby Miller reports for *Politico* in [Key Democrats urge House to reject kids’ safety proposal](https://www.politico.com/live-updates/2026/06/26/congress/key-democrats-urge-lawmakers-to-reject-the-houses-kosa-proposal-00978748?ref=thenexusofprivacy.net): > "The Commerce Committee’s top Democrat Maria Cantwell and Sen. Richard Blumenthal warned House lawmakers against advancing their [chamber’s version of the Kids Online Safety Act](https://subscriber.politicopro.com/article/2026/06/guthrie-and-pallone-cement-deal-for-kids-online-safety-package-00969686?ref=thenexusofprivacy.net), arguing it would face intense lobbying from tech companies in the Senate and risk unraveling years of bipartisan work. > > “If it is passed by the House it will come to the Senate,” [Blumenthal](https://directory.politicopro.com/congress/member/e764fed4-ea30-43b9-8901-bb44d2a7d4d4?ref=thenexusofprivacy.net), the bill’s Senate cosponsor, told reporters at a Friday press briefing. The Connecticut Democrat said he is concerned senators will be influenced by the tech industry’s “armies of lawyers and lobbyists” who may “confuse and exploit” misunderstandings about [a House bill with the same name as a Senate version](https://www.politico.com/news/2026/06/22/house-kids-safety-deal-complicates-ai-talks-00971213?ref=thenexusofprivacy.net) but excludes key provisions, such as the “duty of care.”" Oh noes! The Democratic sponsor of the bill that Meta, Microsoft, Apple, X, Snap, Pinterest, and OpenAI all support is very concerned that the House version of the bill is too friendly to big tech and his colleagues might get influenced by the tech industry! Heaven forbid. But the Senate isn't just sitting still. Instead, they're working on their own legislation. - the Senate Commerce Committee is expected to hold a markup on their version of KOSA in mid-July. They might also mark up their version of CTOPPA , the SCREEN Act, and the App Store Accountability Act age verification bill.[4](#notes) - Senate Judiciary has already announced [a July 28 hearing](https://www.politico.com/live-updates/2026/06/23/congress/top-tech-executives-expected-to-testify-at-july-28-senate-hearing-00972329?ref=thenexusofprivacy.net) on child safety.4.1 - Ben Brody of *Punchbowl News* reports that Ted Cruz is working on his own package combining kids safety bills with preempting state AI legislation. And if that's not enough, KOSA co-sponsor Sen. Marsha Blackburn is [negotiating with the Trump administration](https://www.politico.com/news/2026/06/11/white-houses-ai-state-preemption-kids-safety-00958020?ref=thenexusofprivacy.net) on a package that would combine kids safety legislation with preempting some state AI laws.4.2 With momentum building in cities and states across the country (including here in Washington!) for strong regulation of AI, big tech realllly wants their allies in DC to help them out. And the anti-LGBTQIA2S+ aspects of KOSA and age verification laws like ASAA are an added bonus for Mark F—ing Zuckerberg and Apartheid Clyde as well as the Heritage Foundation and the the [anti-LGBTQIA2S+ groups](https://www.fightforthefuture.org/actions/pride-ally-letter-2026/?ref=thenexusofprivacy.net) like the [far-right NCOSE](https://www.advocate.com/law/kosa-anti-lgbtq-groups?ref=thenexusofprivacy.net) who masquerade as "child safety" groups. KOSA and CTOPPA are already very friendly to big tech, so I can certainly see why they want to bundle them up with preempting state AI regulation into one big giveaway ... it's kind of like watching pigs feeding at a trough. It's not just the Senate; in the House, last month's [discussion draft for House AI regulation](https://www.politico.com/news/2026/06/04/obernolte-trahan-ai-bill-lands-on-the-hill-00949920?ref=thenexusofprivacy.net) also proposed preempting state laws,[4.3](#notes) and the House Energy & Commerce Committee advanced their own version of the App Store Accountability Act separately in March, so it's also eligible for a House floor vote. That said, there really are huge differences between the House and Senate versions of KOSA, so even if the Senate does wind up passing the House might well reject it. And looking at the whole package that Blackburn is working on with the administration (or a potential package involving AI in the House), especially with the widespread bipartisan loathing of data centers and Flock cameras I'd like to think legislators who are skeptical of big tech would think long and hard before supporting anything that preempts state-level laws. Indeed, Ashley Gold [reports](https://www.axios.com/2026/06/24/kids-online-safety-push-complicated?ref=thenexusofprivacy.net) for *Axios* that kids' online safety advocacy groups are uncomfortable with the AI preemption aspect, and different factions within the White House are divided. And let's not forget that the Taxpayers' Protection Alliance coalition of conservative groups [pushing back](https://cei.org/coalition%5Fletters/cei-joins-taxpayers-protection-alliance-coalitions-letter-opposing-asaa-and-kosa-online-regulations/?ref=thenexusofprivacy.net) on the App Store Accountability Act because of the dangers of age verification as well as the Senate's version of KOSA because of concerns about censorship. Then again, lawmakers in both parties really want to pass *something*. So we shall see. ## The KIDS Act would lead to platforms requiring age verification > "Supporters of KOSA have [said](https://www.blumenthal.senate.gov/about/issues/kids-online-safety-act?ref=thenexusofprivacy.net) the bill doesn’t require age verification. And technically, the KOSA section of the bill does say that KOSA shouldn’t be read to require age verification. > > But if you read the rest of the bill, that disclaimer starts to look hollow." > > – EFF's [The KIDS Act Would Require Age Checks To Get Online](https://www.eff.org/deeplinks/2026/06/kids-act-would-require-age-checks-get-online?ref=thenexusofprivacy.net) Some age verification bills, like the ASAA or Washington state's failed [HB 2112](https://privacy.thenexus.today/hb-2112-cbp/?ref=thenexusofprivacy.net) from last session, are explicit about their requirements. The KIDS Act doesn't make age verification an explicit requirement, but the way the bill is worded means that (if it passes) in practice platforms will need to do age verification to protect themselves from liability. As EFF explains, the key here is that KOSA and other sections of the KIDS Act require website operators to provide additional protection if the website "knows *or should have known*" a user is under a specified age. > "If an online service gets it wrong, it’s going to be up to courts and regulators to decide, after the fact, if an online service “should” have known a user was 16\. > > To try to avoid liability, services will have to determine which users are teenagers and which are not. Most won’t be able to simply trust their users. They’ll have to collect more information about age, before any lawsuit or government action arises. Some companies may respond by requesting driver's licenses or passports. Others will rely on age-estimation systems that attempt to guess users' ages by looking at existing activity or doing facial scans. Existing estimation systems make mistakes when estimating children’s ages correctly, which is a big problem when that is the population KOSA is trying to protect. And the systems fail more frequently for [people of color](https://www.theguardian.com/news/2025/sep/19/how-accurate-are-age-checks-for-australias-under-16s-social-media-ban-what-trial-data-reveals?ref=thenexusofprivacy.net), [people with disabilities](https://www.wired.com/story/when-face-recognition-doesnt-know-your-face-is-a-face/?ref=thenexusofprivacy.net), and [trans and nonbinary people](https://dl.acm.org/doi/pdf/10.1145/3359246?ref=thenexusofprivacy.net)." There was similarly masked language in a bill here in Washington state this last year, and it was very hard to get legislators to understand the implications. How many people in Congress understand? Your guess is as good as mine. ## Age verification is surveillance > ""Age verification" means that *everyone* who does *anything* online will have to submit to fine-grained tracking and recording of *all* their online activities. This nightmare is the surveillance advertising industry's fondest dream, a world where it's literally *illegal* to avoid their tracking, all in the name of saving kids…from them!" > > – [Spying on kids to save kids from spying is very, very stupid](https://pluralistic.net/2026/06/23/destroy-the-village/?ref=thenexusofprivacy.net), Cory Doctorow, *Pluralistic* There are a lot of good reasons to be against age verification laws and other bad interenet bills. For example: - [Age verification laws censor LGBTQIA2S+](https://www.teenvogue.com/story/some-democrats-are-helping-the-trump-admins-anti-lgbtq-tech-agenda?ref=thenexusofprivacy.net) and [abortion info](https://www.stoponlineidchecks.org/abortion/?ref=thenexusofprivacy.net) from the internet, and are also [a huge obstacle for low-income, unhoused, and undocumented people](https://www.fightforthefuture.org/news/2025-03-06-new-letter-90-civil-rights-and-privacy-organizations-condemn-id-checking-bills-citing-effectiveness-censorship-and-privacy-concerns/?ref=thenexusofprivacy.net). - [Age verification increases risks for journalists and dissidents](https://theintercept.com/2026/06/28/age-verification-privacy-surveillance-journalists-whistleblowers/?ref=thenexusofprivacy.net). - In Australia, age verification has had only limited impact; a [study](https://www.bmj.com/content/393/bmj-2026-363695?ref=thenexusofprivacy.net) just published in the British Medical Journal found that "[more than 85 per cent of adolescents under 16 continued to use restricted social media platforms](https://hmri.org.au/news-and-stories/australias-social-media-age-restrictions-show-limited-early-impact-new-research-finds/?ref=thenexusofprivacy.net)." - The ASAA is similar to Texas' SB 2420, which a federal judge has found [likely violates the First Amendment](https://www.texastribune.org/2025/12/23/texas-app-store-child-ban-age-verification/?ref=thenexusofprivacy.net). The list goes on ... > *"*"It's a surveillance bill. The s is for surveillance" > > – Anthony Moser, author of [The Kirby Frame](https://anthonymoser.github.io/writing/rhetoric/framing/kirby/2026/01/28/the-kirby-frame.html?ref=thenexusofprivacy.net), discussing KOSA [in the ATmosphere](https://bsky.app/profile/anthonymoser.com/post/3ms3dgun2bk2w?ref=thenexusofprivacy.net) In addition to all these other problems, age verification is surveillance. Most platforms rely on third-party age verification providers like Yoti and Persona, who then proceed to share whatever data they want with literally hundreds of other companies and government agencies. For example: - Persona (whose investors include Peter Thiel of Palantir) embarrassingly [leaked their source code earlier this year](https://vmfunc.re/blog/persona?ref=thenexusofprivacy.net), revealing that the software preform up to 269 distinct verification checks, including facial recognition matching against watchlists, Aadhaar database checks, and deep browser fingerprinting.5 - [Papers, Please: A First Look at Age Verification on the Web](https://mikespecter.com/assets/pdf/AgeVerification.pdf?ref=thenexusofprivacy.net) reports that for sites that using Yoti, "Some of the IP, OS and browser metadata may be sent to credit card companies and IP geolocation services, while ID information may be sent to a known data broker, or another verification service" – and enough of the data gets sent that "fourth parties" like Stripe can know the names of users who visit specific sites. And it's not just kids' and teens' data that gets fed into this surveillance system. – Taxpayers' Protection Alliance Coalition says in their [Letter opposing ASAA and KOSA regulations](https://cei.org/coalition%5Fletters/cei-joins-taxpayers-protection-alliance-coalitions-letter-opposing-asaa-and-kosa-online-regulations/?ref=thenexusofprivacy.net) > "The ASAA would require age verification, a process that would require users of all ages to submit extensive personal information to digital databases, where that information would be exposed to hacks or data breaches. This would threaten the privacy and data security of Americans of all ages." Of course, big tech companies like Open AI , Meta, X are a key part of the surveillance-industrial complex, and make their money by exploiting people's private data, so see this as a plus. No wonder they support this surveillance legislation! ## Reading the political tea leaves > "it's very possible the House will pass their bad version of KOSA. It's different than the Senate's bad version, though, and there is a very good chance they will be unable to reconcile the differences. We have to keep the pressure on." > > \-- Evan Greer of Fight for the Future, [on Bluesky](https://bsky.app/profile/evangreer.bsky.social/post/3mp7ohedvuk2g?ref=thenexusofprivacy.net), June 26 (before the vote) Like Evan, I wasn't surprised that the House passed the KIDS Act; they wouldn't consider it under suspension of the rules unless they think they have the votes. And although the situation in the Senate is murkier, it's certainly possible they'll pass something – KOSA has 80+ Senate co-sponsors. Even if that happens, though, it's not clear the House will agree. So that leaves a few options for legislators who want to pass *something* - A "compromise" between the two big-tech-friendly, anti-LGBTQIA2S+ internet surveillance and censorship packages, which could then be passed by both Houses – or attached to the NDAA. The thing is, the House version was already pitched as a compromise, and the Senate has responded with a massive raspberry, so how much more flexibility is there? - Breaking off bits and pieces, and trying to pass individual bad internet bills like the SCREEN Act, CTOPPA, the App Store Accountability Act (or attach them to the NDAA – as Axios repors the [Senate Judiciary is looking at doing with the STOP CSAM Act and the NDAA](https://www.yahoo.com/news/politics/articles/kids-online-safety-push-gets-090005823.html?ref=thenexusofprivacy.net). It really is a complex situation – from an organizing perspective as well as a legislative perspective. [ ](https://www.yahoo.com/news/politics/articles/kids-online-safety-push-gets-090005823.html?ref=thenexusofprivacy.net) So stay tuned! And as well as staying tuned, please take action! > Fight for the Future's [Bad Internet Bills](https://www.badinternetbills.com/?ref=thenexusofprivacy.net) page makes it easy to contact your legislators about the KIDS Act and KOSA. > > Or, call the US Capitol Switchboard at 202-224-3124, and ask your Senator to **vote NO on the KIDS Act (HR 7757), the Senate version of KOSA (S. 1748), the App Store Accountability Act, and any other bill that age restricts, censors and surveils the internet.** --- ## Notes 1 The KIDS Act also includes - the SAFE BOTS Act with some very limited disclosure requirements for chatbots – and language that in practice is likely to require age verification - the Safer GAMING Act requiring strong parental controls in video games – and more language that in practice is likely to require age verification - the SPY Kids Act, which bans product and market research on users known to be minors - and several bills funding research and education in kids safety online. Fight for the Future's [The Big Picture: Bad Ideas About Online Safety Remain Bipartisan](https://www.fightforthefuture.org/news/2026-03-11-the-big-picture-bad-ideas-about-online-safety-remain-bipartisan-even-as-the-likelihood-of-passage-fades/?ref=thenexusofprivacy.net) and IAPP's [US Energy and Commerce Committee advances KIDS Act to full House vote](https://iapp.org/news/a/us-energy-and-commerce-committee-advances-kids-act-to-full-house-vote?ref=thenexusofprivacy.net) have more on the March version of the KIDS Act. Note that there have been some changes in the latest version. For example, the Safer GAMING Act and the SAFE BOTS Act have shifted from an "actual knowledge" standard (where companies are only liable if they know that a user is a minor) to a "knows or should have known" standard; see [The KIDS Act will lead to platforms requiring age verification](#kids-act-age-verification) for more on this. Also, the language about preempting state laws has improved; footnote 3 has a brief discussion. 2 In May, a coalition of [dozens of state Attorneys General from both parties](https://agportal-s3bucket.s3.us-west-2.amazonaws.com/Federal%20Litigation/KIDS%20Act%20%5F%20FINAL.pdf?VersionId=q%5FRe9zD2JsLCXPXPbQTy.zDc3Ir1BOFz&ref=thenexusofprivacy.net), also opposed the KIDS Act, similarly objecting both to dropping the duty of care and to the preemption clauses. They haven't weighed in as a coalition yet on the latest version yet as far as I know, it'll be interesting to hear what they have to say. 3 The House bills are now framed as a "floor not a ceiling," and only preempt stronger state laws. That really is an improvement over the earlier version! On the other hand, AOC voted against the KIDS Act and cited New York AG Letitia James' concern about preemption, so it's certainly possible there are still problems. 3.5 On the duty of care, digital rights and LGBTQIA2S+ orgs have pushed back hard because it's likely to lead to platforms censoring content; so have conservative groups. So from that perspective, it's good that there isn't a duty of care in the House version of KOSA (although Senate KOSA sponsors clearly disagree). That said it's not clear whether the House KOSA language is significantly better. As Allison Mollenkamp reports in [Kids online safety push clouded by House-Senate divide](https://rollcall.com/2026/06/29/kids-online-safety-push-clouded-by-house-senate-divide/?ref=thenexusofprivacy.net) on *Roll Call* > "Jenna Leventoff, senior policy counsel with the American Civil Liberties Union, is less sure that the House bill avoids crossing constitutional lines. > > “It still has a vague provision that could lead to the takedown of information. Less information, to be sure, a lot less information,” Leventoff said, going on to add that, “It could be very much carried out like the Senate’s duty of care.”" EFF discusses their concerns with the House's language in the section on [The KIDS Act Pressures Platforms To Police Lawful Speech](https://www.eff.org/deeplinks/2026/06/kids-act-would-require-age-checks-get-online?ref=thenexusofprivacy.net#:~:text=The%20KIDS%20Act%20Pressures%20Platforms%20To%20Police%20Lawful%20Speech). 4 See New America's [The App Store Accountability Act Poses Serious Concerns for Privacy, Security, and Free Expression](https://www.newamerica.org/insights/app-store-accountability-act-privacy-security-and-free-expression/?ref=thenexusofprivacy.net), the [Taxpayers' Protection Alliance coalition letter](https://cei.org/coalition%5Fletters/cei-joins-taxpayers-protection-alliance-coalitions-letter-opposing-asaa-and-kosa-online-regulations/?ref=thenexusofprivacy.net) for more on the problems with this bill, and [Like a Bouncer at a Bookstore: Texas’ App Store Accountability Act is unconstitutional](https://cdt.org/insights/like-a-bouncer-at-a-bookstore-texas-app-store-accountability-act-is-unconstitutional/?ref=thenexusofprivacy.net), with the amicus brief from the Internet Society, CDT, and New America's OTI on Texas's very similar SB 2420 4.1 Not long after I first published this article, Owen Dahlkamp of *Politico* reported hat [the White House intervened to let Mark F—ing Zuckerberg and the Google CEO Sundar Pichai off the hook from testifying at this hearing](https://thenexusofprivacy.net/kosa-kids-act-june-update/): > "People representing Meta met with White House staff about the hearing in late May and early June, according to three of the people with knowledge of the events. > > In discussions with committee staff, Meta and Google representatives expressed concerns that the hearings would only further worsen negative attention arising from recent child online safety litigation, they added. > > After a back and forth, the White House agreed to publicly support Grassley’s James T. Woods Act on the condition that Grassley permit lower-profile executives from Meta and Google to testify, according to the same three people." 4.2 Blackburn and the White House have both been trying to prevent states from regulating AI for a while now. Back in 2025, Blackburn sponsored a 5-year moratorium on state AI regulation that seemed for a while like it had a chance, until things fell apart at the last minute and she [wound up working with Senators Cantwell and Markey to prevent it from passing](https://www.politico.com/live-updates/2025/06/30/congress/blackburn-yanks-support-for-ai-moratorium-00434635?ref=thenexusofprivacy.net). After that, Trump issued an [Executive Order](https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy/?ref=thenexusofprivacy.net) preempting state AI legislation in December 2025, although fortunately it doesn't have any legal effect. 4.3 Although as [Backlash to Bipartisan AI Omnibus Illustrates Preemption Impasse](https://www.insideglobaltech.com/2026/07/06/backlash-to-bipartisan-ai-omnibus-illustrates-preemption-impasse/?ref=thenexusofprivacy.net) discusses, the House discussion draft only proposes preempting state laws “specifically regulating the development of any artificial intelligence model.” So Democrats who oppose preemption don't like it, and [over 200 state lawmakers have urged Congress to oppose preemption in the House proposa](https://thehill.com/homenews/state-watch/5925506-state-lawmakers-reject-ai-preemption/?ref=thenexusofprivacy.net)l, but also Republicans who want to preempt state regulation in general don't like it because it doesn't go far enough. 5 [Persona's CEO says](https://www.malwarebytes.com/blog/news/2026/02/age-verification-vendor-persona-left-frontend-exposed?ref=thenexusofprivacy.net) that no Persona customer uses all the possible 269 checks, and that it's Persona's customers (not the company itself) who control the handling and deletion of data ... but none of that is particularly reassuring. ## Update log *Ongoing: typo fixes, wordsmithing, adding links* June 24: originally published June 25: incorporate EFF analysis, new reporting on Senate Judiciary plans June 26: include quote from Evan Greer on likely prospects, clarify that preemption is now a floor not a ceiling, link to amicus brief on App Store Accountability Act in footnote 4 June 27: emphasize Dems voting for KOSA or KIDS Act are throwing LGBTQIA2S+ people under the bus June 28-9: rewrite intro to tighten, feature quote from National Youth Rights Association, add table of contents June 30: update after the House vote, replacing the prediction that they'd probably pass it with the actual result ### Solidarity over Surveillance URL: https://thenexusofprivacy.net/solidarity-over-surveillance/ Last updated: 2026-05-28T21:19:04.000Z > "The surveillance state is everywhere. It’s growing and insatiable … and only getting worse. > > With the assistance of private tech companies and brokers that harvest our data, agencies like the Department of Homeland Security are deploying surveillance tools to target protest movements and identify and deport immigrants. > > Communities across the country are pushing back. Local groups are joining together to ban license-plate-reader companies like Flock from their towns. States are passing laws to prevent the federal government and law enforcement from buying our data from private parties. And activists are educating their communities on how to protect themselves from rampant surveillance. > > The time is now to rein in the surveillance state. That’s why we launched Solidarity Over Surveillance (#SOS) — a multistate effort to protect our basic privacy and civil liberties." > > – [solidarityoversurveillance.com ](https://www.solidarityoversurveillance.com/?ref=thenexusofprivacy.net) Timely! The kickoff event is on Wednesday, June 3, with luminaries including Safiya Noble of UCLA & the Center on Resilience & Digital Justice, Memo Torres of LA Taco, and Chad Marlow of the ACLU, discussing the urgency of fighting the surveillance state. [Register here!](https://us02web.zoom.us/webinar/register/5317799010427/WN%5FC00BZZ7rQuGUtvexb2uqcw?ref=thenexusofprivacy.net#/registration) It really is true that communities across the country are pushing back. [Resistance to Flock cameras and police surveillance is exploding](https://truthout.org/articles/resistance-to-flock-cameras-and-police-surveillance-is-exploding/?ref=thenexusofprivacy.net) and [DeFlock is organizing a national week of action against ALPR](https://noalprs.com/?ref=thenexusofprivacy.net)s for August 16-22\. [Victories against data centers lead to ripple effects](https://wagingnonviolence.org/2026/05/the-ripple-effects-of-organizing-against-data-centers/?ref=thenexusofprivacy.net) and [organizers are sharing knowledge](https://truthout.org/articles/want-to-resist-a-data-center-these-organizers-share-how-they-did-it/?ref=thenexusofprivacy.net). A [majority of Americans support a ban on surveillance pricing](https://gizmodo.com/majority-of-americans-support-ban-on-surveillance-pricing-and-electronic-shelf-labels-2000762717?ref=thenexusofprivacy.net). The list goes on ... Here in Washington state, [Edmonds just joined the steadily-growing list of cities that have canceled their Flock contracts](https://myedmondsnews.com/2026/05/edmonds-cancels-contract-with-flock-license-plate-reader-system/https://myedmondsnews.com/2026/05/edmonds-cancels-contract-with-flock-license-plate-reader-system/?ref=thenexusofprivacy.net), organizers are working with city council members [on a one-year data center moratorium in Seattle](https://www.theurbanist.org/seattle-advances-data-center-moratorium-amid-public-backlash/?ref=thenexusofprivacy.net), Mayor Katie Wilson is facing a [backlash over surveillance cameras](https://southseattleemerald.org/news/2026/04/14/at-100-days-wilson-faces-backlash-over-seattle-surveillance-cameras?ref=thenexusofprivacy.net), Stop Surveillance City is hosting a surveillance protest parade on Saturday June 13th ... and once again, the list goes on. What's really exciting is that a lot of the organizing and activism is driven by the grassroots, not just the usual suspects, and spans the political spectrum. Solidarity Over Surveillance's describes itself as "a hub for individuals, communities and organizations to learn about and join the fights against corporate and government-sponsored surveillance," so it's a valuable complement to all the other things that are happening. Here's a quick look at Solidarity Over Surveillance's goals – and how they relate to what's happening here in Washington state. - **Stop data brokers from selling our most sensitive information to law enforcement.** Washington's Driver Privacy Act (SB 6002) includes a small step in this direction, requiring a warrant for law enforcement access to third-party ALPR data, but there's a lot more to be done – including supporting FISA reform amendments to close the data broker loophole and a state-level [Fourth Amendment Is Not For Sale Act](https://www.congress.gov/bill/118th-congress/senate-bill/2576?ref=thenexusofprivacy.net). - **Protect dissent, privacy and anonymity in an age of AI-powered surveillance.** As the broad focus of organizations like WA People's Privacy and Stop Surveillance City highlights, Flock and other ALPRs are only one small piece of the web of surveillance that needs to be dismantled. - **Empower people to use open-records requests to expose their local and state governments’ surveillance partnerships.** Washington has a very strong public records law, and RANGE Media has done great work on this front – including [a public records request guide](https://www.rangemedia.co/public-flock-data/?ref=thenexusofprivacy.net); so has University of Washington's Human Rights Center, where public records requests have been instrumental in their reports like [Roadside Assist: Washington State’s Continued Sharing of Drivers’ Information with Federal Immigration Enforcement](https://jsis.washington.edu/humanrights/2026/01/08/roadside-assist-washington-states-continued-sharing-of-drivers-information-with-federal-immigration-enforcement/?ref=thenexusofprivacy.net) highlighting ongoing abuses. While the Driver Privacy Act exempted ALPR data from public records requests, there's still a lot more information to explore. - **Challenge the government’s weaponization of domestic-terrorism powers.** With law enforcement warning about [‘anti-tech extremism’](https://www.wired.com/story/us-law-enforcement-warns-of-anti-tech-extremism/?ref=thenexusofprivacy.net) and a counter-terrorism strategy that Sumayya Waheed of Muslim Advocates describes as [a sweeping attack on domestic dissent](https://www.commondreams.org/opinion/trump-target-dissent?ref=thenexusofprivacy.net), this is directly relevant to every organizer and activist reading this newsletter! **Fight the “AI arms race” and its acceleration of extraction.** As well as data center moratoriums, Washington cities and counties have opportunities to pass local ordinances – a few years ago, for example, [King County](https://www.geekwire.com/2021/seattles-king-county-becomes-first-u-s-county-ban-government-use-facial-recognition-software/?ref=thenexusofprivacy.net) and [Bellingham](https://epic.org/bellingham-wa-bans-government-use-of-facial-recognition-predictive-policing-tech/?ref=thenexusofprivacy.net) [](https://www.geekwire.com/2021/seattles-king-county-becomes-first-u-s-county-ban-government-use-facial-recognition-software/?ref=thenexusofprivacy.net)banned governmental use of facial recognition. And [attempts to regulate AI in this year's state legislative session](https://www.theurbanist.org/2026/01/27/washington-legislature-grapples-with-slew-of-bills-regulating-ai/?ref=thenexusofprivacy.net) didn't make anywhere near as much progress as we had hoped, so now is a good time to be starting to organize for next session. It's still early days, so there isn't a lot of detail on the web site yet, but Free Press and the Disinfo Defense League are working on this project with [partners](https://www.solidarityoversurveillance.com/?ref=thenexusofprivacy.net#Partners) include Fight for the Future, Muslim Advocates, Ultraviolet Action, NAACP, the Digital Democracy Institute of the Americas, America's Voice, Unidos US, and the UCLA Center on Digital Resilience and Justice (as well as the Nexus of Privacy) ... so expect to see a lot more content and events in the upcoming months. So check out [the kickoff event](https://us02web.zoom.us/webinar/register/5317799010427/WN%5FC00BZZ7rQuGUtvexb2uqcw?ref=thenexusofprivacy.net#/registration), and stay tuned! ### FediForum "Growing the Open Social Web" Un-Workshop position statement URL: https://thenexusofprivacy.net/fediforum-growing-the-open-social-web-un-workshop-position-statement-2/ Last updated: 2026-04-15T22:26:07.000Z *Note: feel free to skip the narrative, and go straight to the* [*position statement!*](#position-statement) > "**"Open Social Web"** is a term surveillance capitalism companies and their friends have been using since at least 2008\. The framing puts focus on the "openness," so erases the trans/queer/non-binary-driven oppositional view of [the Fediverse as a critique of openness](https://test.roelof.info/log/seven-theses/?ref=privacy.thenexus.today) – and also erases the free fediverse's anti-fascist position of [refusing to be open to Meta](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=privacy.thenexus.today#bibr116-20563051241308323) (and earlier, Gab)." > > – me, in [I for one welcome Bluesky, the ATmosphere, BTS ARMY, millions of Brazilians, Black Twitter, and sex worker Twitter to the fediverses!](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/) (September 2024) When I clicked the link last moth in FediForum's announcement they were branching out from their usual pay-to-play unconferences to host a pay-to-play "un-workshop" on March 2, my email client warned me that it was a tracking link.1 A couple hours after I [tagged FediForum](https://neuromatch.social/@jdp23/115968111744819542?ref=thenexusofprivacy.net) and made a snarky remark thanking them for providing such a great example of the surveillance capitalism-friendly nature of so many supporters of the "Open Social Web", they [posted](https://mastodon.social/@fediforum/115968601031834804?ref=thenexusofprivacy.net) that oops, their mailer appears to replace URLs with tracking URLs even if "do not track" is checked, and they didn't mean to track people – and included [a non-tracking link](https://fediforum.org/2026-03-growing-open-social-web/?ref=thenexusofprivacy.net).2 I have no interest in growing the "Open Social Web", but I do have strong feelings on one way both the Fediverse and the ATmosphere can grow, so once the non-tracking link was available I decided to check it out. Even after reading the page a couple of times, it's not clear to me why they're calling it an "un-workshop". The approach of the program committee identifying topic clusters from the submitted papers and pre-scheduling sessions seems like a pretty standard workshop to me – and the exact opposite of the self-organizing approach of an unconference. And call me a Luddite, but I can't say I'm particularly optimistic that remo.co (the "all-in-one online event solution" from events.com that they're using) will succeed in creating an "engaging environment where attendees can connect, interact, and move like it's a real-life event."3 But oh well, it is what it is. Workshops can be useful, there are some interesting people who have signed up. Since I've hosted sessions on organizing and activism at the last two FediFora, I figured I might as well sign up and submit a short position statement. Registration didn't take all that long, but by the time had seen the prominent display of Google Pay, caught the clever attempt by Humanitix (the platform they continue to use even though it won't allow them to offer free registrations) to opt me in to receiving their spam and unchecked the box, noticed the prominent Cloudflare logo, and then (after I paid) discovered that my signup also entitled me to five free tickets that have something to do with a "Special offer from Disney+ and Hulu, win $2,000 and more" ... Well, let's just say I was very tempted to ditch my position statement, and instead talk about how one good way for Fediverse can grow is to position itself as an *alternative* to surveillance capitalism (as Blacksky is doing in the ATmosphere) – and it's very hard to do that while embracing surveillance capitalism framing and technologies. But then again, it's not an un-workshop about the Fediverse, it's an un-workshop about the "Open Social Web," so it's probably not the ideal audience for that perspective. Before we get to the position statement, here's another excerpt from [I for one welcome Bluesky, the ATmosphere, BTS ARMY, millions of Brazilians, Black Twitter, and sex worker Twitter to the fediverses!](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#open-social-web) > "Chris Messina's 2008 blog about [the "open, social web"](https://factoryjoe.com/2009/05/18/the-open-social-web/?ref=privacy.thenexus.today) is a good reminder of how long companies with surveillance capitalism business models have been trying to push this as a brand. This post was written back when Messina was at Google, long before he started running a VC fund backed by Marc Andreessen and became an advisor to the Meta-funded [Social Web Foundation](https://thenexusofprivacy.net/swf-and-the-meta-elephant/). "Open Social" was at the time was a specification developed by Google, Ning (a company Andreessen had co-founded), MySpace and other social network companies. > > Attempts to use "Open Social Web" as a synonym for "the Fediverse" erase the oppositional views that Aymeric Mansoux and Roel Roscom Abbing discuss in "The Fediverse as an Ongoing Critique of Openness" (in [Seven Theses on the Fediverse and the Becoming of F/LOSS](https://test.roelof.info/log/seven-theses/?ref=privacy.thenexus.today)) and Jamie Theophilus discusses in [Closing the Door to Remain Open: The Politics of Openness and the Practices of Strategic Closure in the Fediverse](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=privacy.thenexus.today#bibr116-20563051241308323). And "Open" often has the connotations that there shouldn't be protections against exploit anybody's data, and also that (since bigger is better) [it's *good* to have Nazis and TERFs on the network](https://thenexusofprivacy.net/the-annotated-case-for-a-big-fedi/). Of course, many people who use the term "Open Social Web" to mean "the Fediverse and the ATmosphere" (and sometimes also RSS and/or Nostr) don't know this context. And maybe you didn't either, before you read this article ... but now you do! ## Position statement The use cases for alternative social networks – not controlled by techbro white supremacist CEO's working with their cronies in authoritarian governments – practically write themselves in today's world. Big tech's centralized social networks remain vital for activism and organizing (meet people where they are, and that's where they currently are), but alternative social networks also have a major role to play. And since big tech's centralized social networks are so hostile to activists – and to organizing – the Fediverse and the ATmosphere have great opportunities to appeal to people whose needs aren't getting met. But there are also major barriers; in the Fediverse, these include the racism, sexism, misogyny and other bigotries as well as the lack of anything to fill the niche of Facebook groups. None of that's new; [my slides from the October FediForum remain relevant](https://thenexusofprivacy.net/data/fediforum-1008.pdf). What *\*is\** new, though, is the way we've been leveraging Blacksky and pnw.zone and neuromatch.social and other fedi instances as part of real-life legislative activism here in Washington state – and soon (perhaps even by the time the un-workshop happens) on federal legislation like FISA reauthorization, KOSA, and other Bad Internet Bills. We've had several valuable successes, and hopefully will be building on those, although there are also some real limitations. Of course these tactics will need to be adopted for other countries (and quite possibly even for other states) but there really is a lot to build on here. If you're interested in following along between now and the un-workshop: - the #waleg (Washington legislature) hashtag works in both ecosystems - in fedi, check out [https://channel.org/@ageverification](https://channel.org/@ageverification?ref=thenexusofprivacy.net), [https://channel.org/@privacy](https://channel.org/@privacy?ref=thenexusofprivacy.net), and [https://channel.org/@vehicleplates](https://channel.org/@vehicleplates?ref=thenexusofprivacy.net) - in the ATmosphere, [https://blacksky.community/profile/thenexusofprivacy.net/feed/stopKOSA](https://blacksky.community/profile/thenexusofprivacy.net/feed/stopKOSA?ref=thenexusofprivacy.net) and [https://blacksky.community/profile/thenexusofprivacy.net/feed/Flock-and-other](https://blacksky.community/profile/thenexusofprivacy.net/feed/Flock-and-ALPRs?ref=thenexusofprivacy.net) ## Notes 1 And indeed it was: https://veapdq.clicks.mlsend.com/ty/cl/eyJ2Ijoie1wiYVwiOjEyODgxNTAsXCJsXCI6MTc3NzY2NTY5OTg2NzU0MDY2LFwiclwiOjE3Nzc2NjU4MTY4MDQ3NDA3MX0iLCJzIjoiMmQ0ODdmYzkyMGRkYjU4NiJ9 2 Although for some reason they didn't think it was actually worth replying to my post that had tagged them – or even tagging me in their reply 🤣 3 I don't know much about events.com but in the [2024 press release](https://events.com/press/events-com-secures-upsized-200-million-share-subscription-facility-from-global-emerging-markets-gem-to-fuel-market-expansion/?ref=thenexusofprivacy.net) from events.com announcing the "expansion of its Share Subscription Facility (“SSF”) with Global Emerging Markets (“GEM”), to $200 million," here's what their CEO says they'll do with the money: > "This funding will empower us to help more event organizers worldwide manage, market and monetize their event and help people around the world discover, interact and transact with unforgettable experiences — while gathering actionable data and revenue at scale.” And in the "Helping events do business better section" on their [about page](https://events.com/about/?ref=thenexusofprivacy.net) has this gem: > "We support organizers in crafting unforgettable attendee moments, boosting efficiency and generating fresh revenue streams." I hate to sound like a broken record, but this is exactly the opposite of the values of the Fediverse. Sure it's on brand for the "Open Social Web" ... but the event isn't called OSWForum! ### #waleg 2026 at the midpoint: surveillance, privacy, AI, and age verification legislation overview URL: https://thenexusofprivacy.net/waleg-2026-overview/ Last updated: 2026-04-15T22:26:53.000Z > Terminology note: **#waleg** is an abbreviation for Washington legislation, used as a hashtag on [Blacksky](https://blacksky.community/search?q=%23waleg&ref=thenexusofprivacy.net) and [Mastodon](https://mastodon.social/tags/waleg?ref=thenexusofprivacy.net) and other social networks Washington's legislative session has been in high gear ever since it started on January 12, and as of today we're almost exactly halfway through. So it seems like a good time for an update.[1](#notes) February 4 was the cutoff for bills to advance past their initial policy committee, and February 9 was the cutoff for the fiscal and Transportation committees. Bills that haven't made it through those hurdles are probably dead for the session, unless they get marked as NTIB (Necessary to Implement Budget).[2](#ntib) If that all seems like it's moving very fast, well, yeah, it is. This is a "short session" of only 60 days, ending on March 12, so things happen very quickly. I've testified on almost a dozen bills so far. They fall into four main categories: - Surveillance and civil liberties: SB 6002, also known as the Driver Privacy Act, regulating Flock and other ALPRs. I didn't get to testify live at the Law & Justice committee's hearing on SB 6002 (or the House Civil Rights & Judiciary committee hearing for thecompanion bill[3](#companion-bill) HB 2332, which isnow probably dead for the session), but [here's my written testimony](https://thenexusofprivacy.net/sb-6002-jan19-hearings/) – PRO although with an extensive list of needed improvements. Instead of improving it, the Law & Justice committee further weakened it. Bummar. On February 4, Senate advanced the weakened version, with a few minor changes. Next stop: Civil Rights & Judiciary, which probably won't start working on it until February 18 at the earliest, and needs to act by February 25\. There's too much to say about SB 6002 to fit into a bullet point so I'll cover it in more detail in an upcoming post. - A series of artificial intelligence bills I support. Amy Sundberg's [Washington Legislature Grapples with Slew of Bills Regulating AI](https://www.theurbanist.org/2026/01/27/washington-legislature-grapples-with-slew-of-bills-regulating-ai/?ref=thenexusofprivacy.net) for a roundup of most of these. The one I'm most enthusiastic about is [Senator T'wina Noble's SB 5956](https://thenexusofprivacy.net/sb-5956-education/), which protects students by prohibiting schools from using racist AI surveillance technologies like facial recognition technologies, risk scores, and biometrics to infer students’ sensitive psychological or personal characteristics. [HB 2481, prohibiting surveillance pricing (maximizing profits by charging some people more than others for the same item),](https://thenexusofprivacy.net/hb-2481-approps/) is another one that I was equally enthusiastic about although it encountered a huge amount of industry pushback and wound up dying in Appropriations. Other AI bills I've supported, while advocating for improvements, include[ HB 1671\. regulating high-risk AI](https://thenexusofprivacy.net/hb-2157-tedv/) (except for Autonomous Vehicles, which for some reason get an exemption); [HB 2503, requiring generative AI platforms to publish a list of datasets they've used for training](https://thenexusofprivacy.net/hb-2503-tdev/), where I unexpectedly wound up as the only PRO live testifier after the two others had technical and scheduling issues; and HB 2599\. regulating AI in therapy, which alas didn't get out of committee so is probably dead for the session. - Bills regulating AI Companion Chatbots that I don't support yet, because I think the current version would be actively harmful. Not only does SB 5984 (and it's companion bill HB 2225) have a major loophole that would make it easy for chatbots to escape regulation, it explicitly allows chatbots to use manipulative engagement techniques on seniors, people with cognitive disabilities, people with mental health problems seeking assistance, and other vulnerable adults. But I also haven't opposed these bills, because there's still time to address these problems – and I do think regulation is urgently needed in this area. My [written testimony on SB 5984](https://thenexusofprivacy.net/sb5984-eet/) has more. - So-called "child safety" bills that require age verification, which I very strongly oppose. Age verification is a privacy disaster that puts kids, teens, and adults at risk by increasing doxxing, stalking, identity theft, and immigrant profiling risks. Age verification laws also [erase LGBTQ+ dentity from the internet](https://msmagazine.com/2025/02/25/lgbtq-abortion-censorship-age-verification-laws/?ref=thenexusofprivacy.net) and [censors abortion information](https://www.fightforthefuture.org/news/2025-12-08-online-id-checks-censor-abortion-information-fight-for-the-future-calls-on-platforms-to-resist/?ref=thenexusofprivacy.net), as a coalition of over 90 groups working to protect LGBTQ+ rights, abortion access, rights for youth, privacy, and freedom of speech [highlights](http://www.fightforthefuture.org/news/2025-03-06-new-letter-90-civil-rights-and-privacy-organizations-condemn-id-checking-bills-citing-effectiveness-censorship-and-privacy-concerns/?ref=thenexusofprivacy.net): "for vulnerable communities, a biometric scan or an ID upload can serve as a huge obstacle, especially for low-income, unhoused, and undocumented people who already have to navigate an increasingly digital world, with less access to tech tools". So unsurprisingly, I've opposed all these bills. [HB 2112 (based on a bad Texas law)](https://thenexusofprivacy.net/hb-2112-cbp/) and SB 6111 (based on [the even worse Mississippi law I wrote about last August](https://thenexusofprivacy.net/mississippi-bluesky-blacksky-the-atmosphere-mastodon-and-the-fediverse/)) have died in committee. Huzzah! Hopefully Democrats have learned their lesson about checking with LGBTQ+ organizations before sponsoring that anti-LGBTQ+ legislatures have supported. HB 1834 and its companion bill SB 5708, regulating "addictive feeds", are still moving forward, and I'll have a lot more to say about those in a later post. For now, my f[ollowup mail to Appropriations about HB 1834 goes into detail about why I'm opposed](https://thenexusofprivacy.net/hb-1834-approps) to the current version. AG Brown has really been pushing this bill on Instagram, so it wouldn't surprise me if the House advances it, but he's clearly heard the feedback that the current version is hostile to LGBTQ+ people so it'll be interesting to see how it evolves. Whew, that's a lot of text. If you want even more text, [here's the links to all of my testimony](https://thenexusofprivacy.net/waleg-2026/) (and in some cases followon mail). And for a quick intermission from all the text, here's a picture of aurora, taken from Snoqualamie Point on February 4\. ![green aurora, low in the sky. above, a night sky with a few stars visible. below, trees, and a few lights in the background](https://thenexusofprivacy.net/content/images/2026/02/aurora260204.jpg) There are several other important privacy bills out there that I haven't spent much time on. HB 2303 (preventing non-consensual microchipping of employees), SB 5906 (keeping ICE out of schools, daycares, universities, hospitals, and more without a warrant), and a couple of others are all important too! But this post is long enough already so I'll skip the details on those. As well as all the testifying, I've also been facilitating weekly meetings of the [Washington Privacy Organizers email list](https://wa-privacy.net/?ref=thenexusofprivacy.net), amd tracking most of these bills for Washington Indivisible Legislative Action. And needless to say I've been experimenting with activism on decentralized social networks like Blacksky and Mastodon. There have been some some very encouraging results on that front that I'm really forward to writing up once I get the time. That said, time is a scare commodity during leg session, so don't hold your breath. ## What next? For surviving bills, the next step is for the Rules committee to approve them for a floor vote. Once they get placed on the floor calendar, there's still no guarantee that they'll get a vote. Bills have to pass the "house of origin" by February 17 or they're dead for the session (unless they're marked as NTIB). So the next eight days are going to involved a lot of behind-the-scenes negotiating between legislators and lobbyists – with advocacy groups and grassroots activists also trying to get legislators to hear their perspectives. After that, bills cross over to the opposite house (bills that passed the House go to a Senate committee, and vice versa) and the timelines get even more crunched. Bills have to get out of the opposite house policy committee by February 25, the fiscal committee by March 2, and get passed by the opposite house by March 6 (unless they're marked as NTIB, of course). On bills where there have been amendments in the opposite house, the House and Senate enter a complicated dance where they can each vote on whether to accept each others' version. In 2023, for example, the House agreed to accept the Senate's stronger version of My Health My Data. If that doesn't happen, they go to a conference committee that tries to come up with a version that both houses vote on. This happened in 2020, when at the last minute the conference committee came up with a version of a weak facial recognition bill that both houses, by now exhausted, voted to pass.[4](#still-miffed) It also happened in 2023 with the "Blake fix" bill to recriminalize drug use. After the House unexpectedly rejected the conference committee's version, Gov. Inslee wound up calling [a one-day special session a couple of months later](https://washingtonstatestandard.com/2023/05/16/olympia-special-session-updates-may-2023/?ref=thenexusofprivacy.net). Sometimes, though, the conference committee throws their hands up in despair, and the bill dies. This also happened in 2020, when we stopped the second attempt by former Sen. Reuven Carlyle (D-Amazon) to twist arms and pass the Bad Washington Privacy Act. #waleg gets even more intense, and sometimes very confusing, at the end of the session. A couple of examples I've written about elsewhere: - In 2021, a few days after the Bad Washington Privacy Act had missed its cutoff for to be passed by both houses, it was suddenly marked as NTIB – so it wasn't dead yet. not long after I published [The Clock Ticks Down on the Bad Washington Privacy Act](https://jedii.tech/the-clock-ticks-down-on-the-bad-wpa/?ref=thenexusofprivacy.net) on my previous blog, [Carlyle reportedly tried to hold another bill with funding for eviction protection hostage](https://indipluswa.medium.com/indivisibles-say-pass-hb-1277-to-mitigate-harm-on-vulnerable-communities-from-eviction-2956bc5db1c8?ref=thenexusofprivacy.net) as part of his "late-in-session cross-chamber negotiations." It didn't work. The Bad Washington Privacy Act failed for the third time, and Carlyle announced he'd be retiring after the next session. - [The situation is … fluid](https://wa-privacy.net/the-situation-is-fluid/?ref=thenexusofprivacy.net) and [It ain’t over till it’s over](https://wapeoplesprivacy.org/it-aint-over-till-its-over/?ref=thenexusofprivacy.net), on wa-privacy.net from 2022, discuss an even weirder situation where a bill that should have been long dead suddenly came back to life with a very different version threw away a lot of the improvements it had made, leaving it a lot more like ... the Bad Washington Privacy Act! Meanwhile the previous year's version of the Bad Washington Privacy Act, (which had been in the X-file) suddenly came back to life yet again, with a "secret amendment" that nobody except for legislators and tech lobbyists was allowed to see. Carlyle convinced the the House Ways & Means committee to call a snap hearing, but it wound up getting cancelled it after every single signin was CON, leaving only Consumer Reports supporting it. How embarrassing! Even then Carlyle didn't give up, but eventually he threw in the towel[5](#shenanigans), and the Bad Washington Privacy Act failed yet again. This year, the session ends on March 12\. Who knows what drama (and potential shenanigans) are in store over the next thirty days? Stay tuned! ## Notes 1 Although technically this isn't an update since it's my first post of the session here. I had hoped to get a preview post up the first week but once I realized how many hearings I'd be testifying in (and how many bills I'd have to read, and how detailed my written testimony would be) that fantasy went out the window. Oh well, better late than never. Please consider this article a belated session preview as well as an update. 2 NTIB exists to address a real problem: final budget negotiations occur very late in the session, so there can be situations where interactions between the overall budget and the bill's fiscal note are significant enough that it makes sense to defer consideration until after the budget is nailed down. That said, it can also be used as the basis for shenanigans to revive bills that should be dead. Sen. Reuven Carlyle used it to bring the Bad Washington Privacy Act came back to life in 2021, and then he did it again with a different bill in 2022 – at the time I joked that NTIB stood for "Necessary to Implement Big Tech's Agenda." The criteria for when a bill should be NTIB are very fuzzy. I once asked a very experienced lobbyist about this and he shrugged his shoulders and said "bills are NTIB when leadership wants them to be NTIB." From an organizing perspective, who best to target in a hypothetical campaign to make a bill NTIB? That's probably not likely to be an issue this session, but then again this is #waleg so you never know. 3 A "companion bill" has the same original text as a bill in the other chamber, although might wind up amended differently. This is a useful legislative maneuver in various situations. For the Driver Privacy Act, we had heard in early January that SB 6002 was going to be the main vehicle; the HB 2332 companion allowed the House Civil Rights & Judiciary committee to hold a hearing on it early in the session (right after the SB 6002 hearing). HB 2332 was also a potentially-useful backup in case SB 6002 seemed like it was having problems getting out of committee in the Senate, but it wound up not needed for that purpose, so is now probably dead for the session. 4 And then Gov. Inslee line-item vetoed the thing I had described as the best feature of the bill! Of course it wasn't personal, he strongly opposed any attempts to seriously regulate facial recognition and other automated decision technologies, but I'm still miffed about it six years later. [ACLU-WA Statement on Insufficient Facial Recognition Regulations (SB 6280) Becoming Law](https://www.aclu.org/press-releases/aclu-wa-statement-insufficient-facial-recognition-regulations-sb-6280-becoming-law?ref=thenexusofprivacy.net) has the details. > Today, Gov. Jay Inslee signed SB 6280, permitting the government to use racially biased face surveillance technology, vetoing the workgroup that would have allowed community voices a seat at the table, and undermining the privacy rights of all Washingtonians. The bill falls far short of providing adequate protections for communities of color, immigrants, and religious minorities who have been historically harmed by government surveillance. > > The ACLU of Washington’s Technology and Liberty Project Manager, Jennifer Lee, had this reaction: > > “We are extremely disappointed that SB 6280 has become law, particularly without a workgroup, and continue to be concerned that the bill permits ongoing use of racially biased facial recognition technology with few restrictions. We will continue to push for a moratorium to give historically targeted and marginalized communities, such as Black and Indigenous communities, an opportunity to decide not just how face surveillance technology should be used, but if it should be used at all.” 5 News that Carlyle was giving up was initially reported by a reporter who is not well known in Washington in a paywalled publication that most legislators didn't have access to. For a while nobody was quite sure what was going on ... I talked with Rep. Gerry Pollet later that evening at a Wallingford Indivisible meeting, and he was concerned that it might still go forward, so we had an action ready to go if needed. Fortunately I then heard from a couple people that it really was true, so we didn't launch the action, although we waited till the end of the session to actually celebrate. Here's an excerpt from [It ain’t over till it’s over](https://wapeoplesprivacy.org/it-aint-over-till-its-over/?ref=thenexusofprivacy.net) that illustrates how complex the situation was. The original HB 1850 had some promise, but it died in Appropriations (or so it seemed). The reincarnated substitute, 2SHB 1850, was hilariously bad; it included a tax that hadn't been heard by the Finance committee, a budget of $0, and a committee (described in the committee discussion as a "Star Chamber") that could dismiss cases against tech companies who violated the law without even holding a hearing. Appropriations passed it anyhow. So we had to advocate against it – a challenge because everybody was used to thinking of HB 1850 as a promising bill. Meanwhile the Bad Washington Privacy Act (SB 5062), which had been dead since the previous year, also suddenly resurfaced with a new secret amendment that only tech lobbyists and legislators were allowed to see, rumored to be a segment of 2SHB 1850 act which would lead to a weird hybrid. It can be hard to keep track of all the different bills and which are good, bad, or indifferent, so I was experimenting with using emojis to help everybody (including me!) tell them apart. Reviews were mixed. ![As the latest partial fiscal note (which allocates 0.5 FTEs and a budget of $0) highlights, there’s still a lot of work to be done. [5] But Washington’s legislature can move very quickly when it wants to. Here’s one way the 👎🏽 Bad Washington Privacy Act 👎🏽 could still pass this session. the House passes an amended version of ❌ 2SHB 1850 ❌ today or tomorrow and immediately refer it to the Senate 💰 Ways & Means 💰 schedules another snap hearing on the amended ❌ 2SHB 1850 ❌ , followed by an exec session where they advance it 📏 Senate Rules 📏 publish the secret amendment ⁉️ S-…. /22 ⁉️ and creates a hybrid 👎🏽 ⁉️ ❌ SB 5062 / S-…. /22 / 2SHB 1850 ❌ ⁉️ 👎🏽 a new fiscal note for 👎🏽 ❌ ⁉️ SB 5062 / S-…. /22 / 2SHB 1850 ⁉️ ❌ 👎🏽 is published the Senate passes 👎🏽 ❌ ⁉️ SB 5062 / S-…. /22 / 2SHB 1850 ⁉️ ❌ 👎🏽 the House concurs That’s a lot for the last four days of the session … but legislators really want to pass something. So, it’s possible.](https://thenexusofprivacy.net/content/images/2026/02/one-way.png) Fortunately it didn't happen. Whew. ## Update Log Ongoing: typos, links, wording improvements, other minor changes - February 25: include "Blake fix" example of a house rejecting the conference committee's version, leading to a special session - February 10: original version ### What are you looking for in social media in 2026? URL: https://thenexusofprivacy.net/what-are-you-looking-for-on-social-media/ Last updated: 2026-04-15T22:24:49.000Z More and more people are interested in alternative social media that's not controlled by techbro white supremacist CEO's who make money by exploiting their users and working with their cronies in authoritarian governments. If you're one of those people thinking about alternatives, what kinds of things are you looking for? We'll publish the results later this month. *There are three easy ways to give feedback:* - *in the embedded Polis conversation below. If it's not working for you on this site,* [*try the direct link here*](https://pol.is/7xjmwmuxnt?ref=thenexusofprivacy.net)*.* - *if you're on Mastodon, Glitch, Firebird, GoToSocial, or other compatble software,* [*there's a series of polls here*](https://infosec.exchange/@thenexusofprivacy/115822571404230256?ref=thenexusofprivacy.net) *– or just respond to the thread.* - [*using the CryptPad form here*](https://cryptpad.fr/form/?ref=thenexusofprivacy.net#/2/form/view/K6RQKF+agroMTkmd4tmmWtIftEWkLZKns7JXRhmiMu0/) ### Reasons for optimism at the turn of the year: reflections on the fediverses, the ATmosphere, and whatever comes next URL: https://thenexusofprivacy.net/reasons-for-optimism-at-the-turn-of-the-year/ Last updated: 2026-04-16T03:33:44.000Z ![Blacksky Algorithms ‪(@blackskyweb.xyz‬): We have had a pretty solid year, and it is all thanks to you all. Check out a snapshot of our 'Blacksky Algorithms 2025 Wrapped'! Let's see what we can cook up in 2026 🫡/. Below, a frame from a video, in purple and lime green (the Blacksky colors), with the text "How many hours we spent stewarding and building Blacksky: 7280"](https://thenexusofprivacy.net/content/images/2026/01/blacksy-wrapped-2.png) Blacksky Algorithms' [end-of-year summary](https://blacksky.community/profile/did:plc:kta7dqcqoamo5ixlajxbtjps/post/3mb7wggveys2a?ref=thenexusofprivacy.net) > "The song struck me as a message to me, and my own message to others: you should take whatever steps you need to gain autonomy and safety. It also felt like a message I had heard and continued to hear this year in my conversations with folks like [Timnit Gebru](https://blacksky.community/profile/did:plc:azpq3hfq3llpowyqpjkqwgxs?ref=thenexusofprivacy.net) and [Omar Wasow](https://blacksky.community/profile/did:plc:b2yh7pcbcq6nh4lhpueffwp2?ref=thenexusofprivacy.net). It also felt like the first DM I got from Blacksky’s first investor, [Mekka Okereke](https://blacksky.community/profile/did:plc:6vwhi5d44wq5ttdhu5rrfbx3?ref=thenexusofprivacy.net), \~1 year ago to this day as I write this. He asked what I would do if I had the funding and freedom to build anything I wanted." > > – Rudy Fraser in [Anniversary: Blacksy Algorithms Turns One](https://blackskyweb.xyz/anniversary/?ref=thenexusofprivacy.net), talking about Sister Nancy's Roof over mi head (1982) ![Jon @jdp23 𝑥 10000 neuromatch.social: About · Profiles directory · Privacy policy Mastodon: About · Get the app · Keyboard shortcuts · View source code · v4.5.0-alpha.2+glitch Fedify: ActivityPub server framework @fedify@hollo.social EN We're excited to announce that #Fedify has been awarded a service agreement by the @sovtechfund! The Sovereign Tech Fund is investing €192,000 in Fedify's development over 2025–2026 to strengthen the fediverse ecosystem. [www.sovereign.tech] This investment will enable us to significantly expand Fedify's capabilities and make it easier for developers to build federated applications. The commissioned work focuses on improving developer experience, adding comprehensive debugging tools, and ensuring Fedify remains at the forefront of #ActivityPub innovation.](https://thenexusofprivacy.net/content/images/2026/01/fedify.png) [A post from Fedify](https://hollo.social/@fedify/0199a579-adb3-7bf5-a8ea-970c8fa91f09?ref=thenexusofprivacy.net), a framework for building Fediverse platforms, hosted on the [hollo](https://docs.hollo.social/intro/?ref=thenexusofprivacy.net) single-user microblogging tool > "While the the strong resistance to Threads from the FediPact and the rest of the Free Fediverse is only one of the reasons Meta has shifted 'Threads Fediverse' to maintenance mode, it's still unambiguously very good news for the Free Fediverse. Defederation is a blunt tool, and today's fediverwse still relies far too much on it ... but just as with Gab, it's a very effective tool for defederating fascists. > > For the corporate fediverse, it's a disappointment for anybody foolish enough to have believed Meta would actually give anybody else access to their audience, but good news for companies making a bet on descentralization. By contrast, it's a big embarassment for all the "Big Fedi" advocates who were soooo excited back when Threads found it useful to say nice things about fedi ... one more way in which it's good news for the fediverses as a whole!" > > – me, in [Coda: The View from 2026](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#coda) ![Holiday checklist: 🍿Popcorn: popped 🪵 Firewood: stacked 🧩 Puzzle: opened 📲 Germ DM: downloaded](https://thenexusofprivacy.net/content/images/2026/01/germ.png) [A skeet from Germ Network](https://blacksky.community/profile/did:plc:4yvwfwxfz5sney4twepuzdu7/post/3malgy2gerv2t?ref=thenexusofprivacy.net), end-to-end encrypted messaging, currently beta-testing their AT Protocol integrationA skeet from Germ Network, end-to-end encrypted messaging, currently beta-testing their AT Protocol integration ![Laruens Hof (@laurenshof@connectedplaces.online): Fediverse Report – #141 Bonfire Social launches v1.0 with a crowdfunding campaign Bonfire Social has officially launched as version 1.0 [bonfirenetworks.org], and with it, the team has also launched a crowdfunding [www.indiegogo.com] campaign to fund continued maintenance and the next phase of development. The campaign seeks to build federated groups, events, governance tools, shared moderation systems, and end-to-end encryption, among other features.](https://thenexusofprivacy.net/content/images/2026/01/bonfire2.png) > "My vision for Mastodon is a different direction than all previous attempts at social media, by focussing on community ownership, Trust & Safety features, slow user & server growth, and financial sustainability - for the non-profit project, the server administrators, the moderators, and creators in the Fediverse." > > – Mastodon's new Executive Director Felix Hlaty, [November 2025](https://mastodon.social/@mellifluousbox/115569615176946969?ref=thenexusofprivacy.net) Don't get me wrong, I could just as easily have done another version of this post called "Reasons for skepticism". Over the course of 2025, the number of active users actually *decreased* in both the ActivityPub Fediverse and the ATmosphere (Bluesky, Blacksky et al). Anti-Blackness, cisnormativity, ableism, anti-Palestinianism, and other forms of discrimination and bigotry are still huge problems in the ATmosphere and the fediverses. Bad internet legislation in the UK, Australia, across the US, Canada, France and dozens of other countries helps big tech and hurts community-run social networks and LGBTQIA2S+ people. And the list goes on ... Still, there really is a lot of exciting stuff happening. And the list goes on here too, for example with [Christine Lemmer-Webber's thread about the work Spritely is doing](https://social.coop/@cwebber/115651973855758440?ref=thenexusofprivacy.net); the dozen [ATProtocol programs / products](https://blacksky.community/profile/sharpiepls.com/post/3mbadbbbdps2h?ref=thenexusofprivacy.net) dapurplesharpie lists in her Blacksy thread; Newsmast Foundation's work with Bristol Cable [deepening community for a UK news co-op](https://goodcommons.world/casestudies/bristol-cable-newsmast-foundation-uk-news-coop?ref=thenexusofprivacy.net); the upcoming launches of Northsky (currently in beta), Gander, and Eurosky; Piefed's steady progress as a news aggregator that goes far beyond reddit; and much much more. Meanwhile, the big centralized social networks continue to deteriorate – and align with fascist and authoritarian governments. [TikTok in the US is now owned by a consortium](https://techcrunch.com/2025/12/30/heres-whats-you-should-know-about-the-us-tiktok-deal/?ref=thenexusofprivacy.net) including Oracle (run by friend-of-Trump Larry Ellison) and MGX (the state investment firm of the United Arab Emirates, currently supporting genocide in Sudan). [Facebook is testing a link-posting limit](https://techcrunch.com/2025/12/17/facebook-is-testing-a-link-posting-limit-for-professional-accounts-and-pages/?ref=thenexusofprivacy.net) to force people to pay for "Meta Verified." Meta is ratcheting up the censorship, including [shutting down accounts linked to abortion advice and queer content](https://www.theguardian.com/global-development/2025/dec/11/meta-shuts-down-global-accounts-linked-to-abortion-advice-and-queer-content?ref=thenexusofprivacy.net). Xitter is .... oh don't even get me started. It really is bleak. But in bleakness there is opportunity. As Saskia Welch says in [Looking to 26](https://forbetter.ghost.io/looking-to-26/?ref=thenexusofprivacy.net) > "Instead of rolling over and showing bellies to corrupt politicians and Big Tech egomaniacs, we're seeing the beginning of a revolution.... > > Organisations and the people who make them are fed up of letting Big Tech platforms take advantage of them and the communities they've built. Local news publishers are no longer trying to play the system, they're moving around it. Academics and researchers are solving the problem by looking in new directions for solutions. Communities are taking ownership and control of their digital space, not just their physical one." Over the course of 2025, I've been part of a loose working group looking at [organizing, mutual aid, and activism on decentralized social networks](https://thenexusofprivacy.net/if-not-now-when/); while there's been substantial progress on some of the key gaps we identified, there's still a looong way to go. Oh well. If changing the world were easy everyone would do it. But by the end of the year, we had also identified some areas where there are good opportunities *right now*. So I for one am going to start the new year in an optimistic and forward-looking frame of mind. With that in mind, let's wrap this article – and 2025 – up with a quote from an upcoming post on organizing: > "The fediverses and the ATmosphere have a great opportunity to play a major role in fighting back on the worldwide assault on our digital rights. Here in the US, the first few months of 2026 will feature legislative battles over age verification in mutliple states (including Washington) and Congress, attempts to regulate surveillance technology like license plate readers in Washington and across the country, resistance to data centers and "AI" as a tool of oppression, and FISA warrantless wiretapping reauthorization. And guess what? Similar issues are cropping up all around the world, for example age verification in Canada, the EU (along with another round of the multi-year Chat Control fight), Australia, South Africa, Brazil ... > > These new decentralized social network ecosystems are still much much smaller than centralized big tech networks, but are filled with people who care about these issues. So it's a great chance to develop and leverage new organizing tactics, and create a positive cycle where the fediverses, the ATmosphere, and whatever comes become a nexus of resistance to big tech as well as fascism." Happy 2026, and stay tuned for more! ### #GivingTuesday 2025 URL: https://thenexusofprivacy.net/givingtuesday-2025/ Last updated: 2026-04-16T03:33:13.000Z Giving Tuesday is a non-profit whose supporters include the Bill and Melinda Gates Foundation, Amazon's aws non-profits, Google.org ... oh well, it is what it is. But there's no reason to limit your Giving Tuesday gifts to the "non-profit industrial complex". This year's list is a lot longer than last year, and for a good reason: things are pretty grim here in the USA, and many people and organizations are under huge pressure. If you've got a bit of money to spare, please consider also supporting one or two of these – or similar organizations in your area. The Nexus of Privacy primarily focuses on decentralized social networks and digital rights, so that'll be the bulk of the list. That said, we live in a society, so I'll start with several non-profits that do crucial work on shoestring budgets. - [Gender Justice League](https://www.genderjusticeleague.org/give?ref=thenexusofprivacy.net) is a civil & human rights organization that focuses on elevating the rights of TwoSpirit, Trans, & Gender Diverse (2STGD) communities in Washington State & beyond - [Native Organizers Alliance](https://nativeorganizing.org/donate/?ref=thenexusofprivacy.net) (NOA) taps into the political power of our people, and the wisdom of our ancestors, to drive change in Indian Country.[](https://www.genderjusticeleague.org/give?ref=thenexusofprivacy.net) - [REBUILD](https://givingtuesday.mightycause.com/story/Rebuild25?ref=thenexusofprivacy.net) is a Darkness RISING program connecting formerly incarcerated and justice-impacted people of color – including people detained and released by ICE – with culturally competent therapists of color - [Palmetto State Abortion Fund](https://donorbox.org/palmetto-state-abortion-fund-end-of-year-fundraiser?ref=thenexusofprivacy.net) is a 100% volunteer run nonprofit that serves South Carolinians seeking abortion care Moving on to decentralized social networks ... last year, I focused primarily on the Fediverse; this year, I'm also including the ATmosphere (although there isn't an ATmosphere logo yet, so I didn't update the image at the top of the post) - [Blacksky Algorithms](https://opencollective.com/blacksky?ref=thenexusofprivacy.net) is creating the intercommunal net, scaling safe communities with shared resources & democratic tools. - [Northsky Social ](https://northskysocial.com/products/support%5Fonce?ref=thenexusofprivacy.net)is a nonprofit worker-owned cooperative, creating a safer social media experience for 2SLGBTQIA+ people, powered by ATProtocol. - [Bonfire Networks](https://www.indiegogo.com/en/projects/bonfire/community?ref=thenexusofprivacy.net) is creating building blocks for communities on the open social web. You can support Bonfire through their IndieGogo fundraiser. - [Conjured Ink](https://opencollective.com/conjured-ink?ref=thenexusofprivacy.net#category-CONTRIBUTE) is a collective building a network and community of ecommerce tools that will allow for cheap or even free self-hosting of online shops by anyone, while providing maximal freedom when it comes to payment processors. - [Spritely Institute](https://spritely.institute/donate/?ref=thenexusofprivacy.net), led by ActivityPub spec co-author Christine Lemmer-Webber, is building new foundations for the internet: safer, more decentralized and distributed, community-centric tech. [See Christine's detailed #GivingTuesday 2024 thread for a lot more information](https://social.coop/@cwebber/113590122851907042?ref=thenexusofprivacy.net). - The **#MutualAid** hashtag on [Mastodon](https://mastodon.social/tags/mutualaid?ref=thenexusofprivacy.net) and [Bluesky](https://bsky.app/search?q=%23mutualaid&ref=thenexusofprivacy.net) is filled with people who rely on giving from the fediverse – and giving money directly to people in need has a huge impact. - Black-led fediverse instances like [blackqueer.life](https://ko-fi.com/blackqueerlife?ref=privacy.thenexus.today), [diaspora.im](https://opencollective.com/diasporaim?ref=privacy.thenexus.today), and [blacktwitter.io](https://www.patreon.com/andcomputers?ref=privacy.thenexus.today) play an important role in the ecosystem – and need support as well - If you're on an instance run by an individual or a coop, like they say, charity begins at home. And independent media fills a crucial role on decentralized social networks. There are too many good options to list ... but here are three that I've found especially valuable. - [LA Taco](https://givebutter.com/lataco%5Fnov?ref=thenexusofprivacy.net) is the fearless reporting that Los Angeles deserves, and a vital source for information on the ICE occupation – and the resistance - [Unraveled](https://unraveledpress.com/support-unraveled/?ref=thenexusofprivacy.net) is independent, reader supported investigative reporting from Chicago on policing and state violence - [Trans News Network](https://transnews.network/upgrade?ref=thenexusofprivacy.net) is a worker-run nonprofit LGBTQ+ newsroom publishing articles that impact trans communities. If you're specifically looking to make tax-deductible donations, several of the earlier entries are 501(c)(3) non-profits. Here are two more who consistently do great work and align with fedi's values. - [MediaJustice](https://support.mediajustice.org/give/538942/?ref=thenexusofprivacy.net#!/donation/checkout) challenges corporate media and big tech power in pursuit of racial justice - [Fight for the Future Education Fund](https://www.fftfef.org/donate/?ref=thenexusofprivacy.net) is a group of artists, engineers, activists, and technologists fight for a future where technology is a force for liberation— not oppression. - [Global Voices](https://globalvoices.org/donate/?ref=thenexusofprivacy.net) is an international, multilingual community of writers, translators, and human rights activists leveraging the power of the internet to tell stories that build understanding across borders. ### Image credit - Heart logos from [Giving Tuesday's web site](https://www.givingtuesday.org/logos/?ref=thenexusofprivacy.net). - Fediverse logo originally designed by [@eudaimon](https://fe.disroot.org/@eudaimon?ref=thenexusofprivacy.net) and [@drq](https://mastodon.ml/@drq?ref=thenexusofprivacy.net) in June 2018 and dedicated to the public domain. Stefan Bohacek's [The history of the fediverse logo](https://stefanbohacek.com/blog/the-history-of-the-fediverse-logo/?ref=thenexusofprivacy.net) has more of the very interesting – and very fedi – background. ### N recommendations to improve accessibility in the fediverse and ATmosphere (DRAFT) URL: https://thenexusofprivacy.net/accessibility-recommendations/ Last updated: 2026-04-16T03:32:52.000Z > DRAFT! Work in progress! > Feedback welcome! Here are some work-in-progress recommendations based on initial feedback to [Improving accessibility in the fediverse and the ATmosphere](https://thenexusofprivacy.net/improving-accessibility/). these! ## For everybody - [Learn to avoid common accessibility mistakes](#avoid-common-mistakes) - [Take the time to compose good alt text for your images if you're able to – and if not, ask others for help](#alt-text) - [When somebody shares an image without alt text, provide alt text in a reply (instead of giving them a hard time)](#suggest-alt-text) ## For developers and software teams Note that people who aren't developers or core team members can contribute to most of - [Provide easy-to-find accessibility-related information](#info). - [Provide information in multiple formats and languages to accommodate different needs and preferences](#multiple-formats) - [Consider your landing page, getting-started guide, tutorials, and other web sites as well as the software](#not-just-software) - [Do a first pass of accessibility checking with a screenreader and free tools](#first-pass) - [Do usability testing with disabled people](#usability-testing) - [Ensure there's an easy (and accessible!) way for people to report accessibility problems](#report-problems) - [Think about initial settings from an accessibility perspective](#initial-settings) - [Provide a flow for people to suggest alt text](#suggest-alt-text) ## For everybody ### Learn to avoid common accessibility mistakes in your posts Too many emoji can make text a horrible experience through a screenreader or other assistive technologies. So can ASCII art, using special unicode charcters for bold and italics, and single-case hashtags (as opposed to camelCase, which screenreaders are more likely to handle properly). Images without alt-text, or videos without captions or transcripts, won't work for people using assistive technologies. The suggestions in Adrian Roselli's [Improving Your Tweet Accessibility](https://adrianroselli.com/2018/01/improving-your-tweet-accessibility.html?ref=thenexusofprivacy.net) apply just as much to Mastodon and Bluesky (and the videos of how these inaccessible constructs sound through screen readers are really worth checking out). ### Take the time to compose good alt text for your images if you're able to -- and if not, ask others for help Nielsen Norman Group's [Alt Text: What to Write](https://www.nngroup.com/articles/write-alt-text/?ref=thenexusofprivacy.net) and WebAIM's [Alternative Text](https://webaim.org/techniques/alttext/?ref=thenexusofprivacy.net) page are good guidelines for composing alt text. For the mechanics of how to do this, see Manning Krull's [Alt text 101 for Bluesky](https://manningkrull.com/digital-philosophy/alt-text-101-for-bluesky/?ref=thenexusofprivacy.net) and [infosec.exchange's FAQ](https://wiki.infosec.exchange/faq/post%5Fshare/image%5Falt%5Ftext?ref=thenexusofprivacy.net) for Glitch, Mastodon, and compatible software. To reduce the chances you accidentally forget, many platforms have settings to warn before posting an image without alt text; on Bluesky and compatible software like blacksky.community, it's under Settings / Accessibility (check the box next to "Require alt text before posting). If you can't provide alt text (because you just don't have the spoons, or because you're running into accessibility problems in the software), consider including the #AltText4Me hashtag in your post. With luck, somebody will reply with alt text. If you're on Mastodon or some other platform that allows editing posts, you can go back and edit your image to include the alt text; even if that's not possible, people will be able to see the alt text in the reply. ### When somebody shares an image without alt text, provide alt text in a reply (instead of giving them a hard time) Most people aren't used to including alt text on images, and may not even know it's an option. So replying with the alt text helps anybody who needs it. It's also an opportunity to help the poster learn new behavior (for example, if they're on Mastodon by letting them know how to edit their post and include the alt-text). And it's often best to resist the temptation to give the original poster a hard time for not including alt text! Alt text functionality isn't always fully accessible (this was a problem on Mastodon until the latest release, and even now there are still some edge cases that don't work well with keyboard-only navigation); and sometimes people just don't have the energy to do it. Not only that, scolding is less likely to lead to behavior change than encouragement! ## For software and product teams ### Provide easy-to-find accessibility information. Make it easy for people using user software with assistive technology to find accessibility-related tutorials, information about settings, and any tips (or gotchas) for use with assistive technology. For example, Veronica Lewis' [Bluesky Accessibility Features For Low Vision](https://veroniiiica.com/bluesky-accessibility-features/?ref=thenexusofprivacy.net) and the *Apps* section of Robert Kingett's [Fediverse for writers/readers](https://sightlessscribbles.com/posts/5619/?ref=thenexusofprivacy.net#apps) ve a lot of valuable information, but without any linkage from the software's main page and/or onboarding process they're not easy to find. One good example of important info that's not obvious to new users is the Bluesky setting to turn off video autoplay ([an accessibility nightmare](https://maigen.medium.com/why-auto-playing-videos-can-be-an-accessibility-nightmare-and-what-to-do-instead-ce2a53fdfbee?ref=thenexusofprivacy.net)) isn't under the accessibility settings, but instead under under Content and Media). ### Provide information in multiple formats and languages to accommodate different needs and preferences. Different formats are better or worse for some people, so try to provide information in text, audio (with transcripts), short video (with captions and/or transcripts) – ideally in multiple langauges as well. Information about PDS migration in the ATmosphere illustrates several good examples, with Sharpie's captioned videos on [using PDS Moover](https://bsky.app/profile/sharpiepls.com/post/3lw3hcuojck2u?ref=privacy.thenexus.today) and [Using missing.pdsmoover.com to Recover Missing Images and Posts](https://missing.pdsmoover.com/?ref=thenexusofprivacy.net), Clinton Bowen's transcripted short video on [using tektite.cc](https://www.youtube.com/watch?v=%5FSdmiCRYeZA&ref=thenexusofprivacy.net), sprout's textual [How to Migrate to Blacksky](https://leaflet.pub/000b57de-78dc-4939-8c66-79227d010cce?ref=privacy.thenexus.today), and victoria's [Lista: PDS independente](https://vicwalker-dev.leaflet.pub/3lz4g6zxeic2p?ref=thenexusofprivacy.net) (in Portuguese). This won't all happen overnight; text-only is fine to start with, and so is starting with a single language and then translating to others. Sharing the longer-term goal with the community may be a good way to encourage contributions. ### Consider your landing page, getting-started guide, tutorials, and other web sites as well as the software. It's all important! And, if people can't make it through your landing page, they won't even get to the point where they're downloading the software. ### Do a first pass of accessibility checking with a screenreader and free tools To be clear, this isn't a substitute for a more in-depth testing or an accessibility audit. Still, it's a useful way to start making progress. - Use your product with different screenreaders. WebAIM's 2024 survey reports that NVDA (Windows-only) and Jaws are by far the most popular, with Voiceover (Apple-only) as #3; TalkBack is most popular on Android. WebAIM's pages on using [NVDA](https://webaim.org/articles/nvda/?ref=thenexusofprivacy.net), [Jaws](https://webaim.org/articles/jaws/?ref=thenexusofprivacy.net), [VoiceOver](https://webaim.org/articles/voiceover/?ref=thenexusofprivacy.net), and [TalkBack](https://webaim.org/articles/talkback/?ref=thenexusofprivacy.net) to evaluate web accessibility are good starting points; so are Harvard Digital Accessibility's pages on getting started testing with [NVDA](https://accessibility.huit.harvard.edu/nvda?ref=thenexusofprivacy.net), [Jaws](https://accessibility.huit.harvard.edu/jaws?ref=thenexusofprivacy.net), [VoiceOver](https://accessibility.huit.harvard.edu/voiceover?ref=thenexusofprivacy.net), and [TalkBack](https://accessibility.huit.harvard.edu/test-android-talkback?ref=thenexusofprivacy.net). - Free analysis tools like [WAVE Web Accessibility Evaluation Tools](https://wave.webaim.org/?ref=thenexusofprivacy.net) and [WebAIM's contrast checker](https://webaim.org/resources/contrastchecker/?ref=thenexusofprivacy.net) can find a lot of easy-to-fix problems. It's important to keep the limitations of these tools in mind; as Beau Vass' [A false sense of accessibility: What automated testing tools are missing](https://www.youtube.com/watch?v=MTtvETBVW48&list=PLn7dsvRdQEfFTeoA8kZcsASPbYi2rf4C0&ref=thenexusofprivacy.net) discusses, automated tools typically only find 20-30% of accessibility problems. ### Do usability testing with disabled people. Web Accessibility Initiative's [Involving Users in Evaluating Web Accessibility](https://www.w3.org/WAI/test-evaluate/involving-users/?ref=thenexusofprivacy.net) and Nielsen Norman Group's [How to Conduct Usability Studies for Accessibility](https://www.nngroup.com/reports/how-to-conduct-usability-studies-accessibility/?ref=thenexusofprivacy.net) have some good suggestions. ### Ensure there's an easy (and accessible!) way for people to report accessibility problems. ### Think about initial settings from an accessibility perspective. For example, should videos auto-play by default? And if your software warns about missing alt-text when posting an image, consider making that the default (and explaining why it's so important); most people coming from commercial social networks aren't used to doing this, so it's an easy (and gentle) way to encourage them. If different settings are better for people using assistive software, either make it very easy to select the accessibility-friendly settings up front or make them the default for everybody; requiring people to navigate through settings on multiple screens is likely to be a barrier. ### Provide flows for people to suggest alt text When a post with image or video doesn't have alt text (or only has very minimal alt text), provide a flow for people to suggest alt text, the original poster to approve it, and update the alt text of the original post. Fedi today has a low tech version of this involving replies with the hashtag #AltText4You; if the original poster approves, they can cut-and-paste the text, edit the original post and update the alt-text – a lot better than nothing, but it could be even smoother. You can approximate that the ATmosphere using PDSls to do the editing but it is even more challenging. The bluesky-social issue [Community-Submitted Alt Text](https://github.com/bluesky-social/social-app/issues/6559?ref=thenexusofprivacy.net) is one path to addressing this; the Mastodon issue [Security option to specify another account(s) to add alt-text to your posts](https://github.com/mastodon/mastodon/issues/34799?ref=thenexusofprivacy.net) is also potentially relevant. ### Media Liberation Day: how can we help newcomers get started and have a good experience on fedi? URL: https://thenexusofprivacy.net/how-to-help-newcomers-for-media-liberation-day/ Last updated: 2026-04-16T03:32:21.000Z Media Revolution's [Media Liberation Day](https://mediarevolution.org/media-liberation-day/?ref=thenexusofprivacy.net) on November 5 is encouraging people to liberate themselves from malignant corporate media to explore decentralized social networks. It's a great opportunity to bring people to fedi ... but as we all know, it's not always easy for people to get started, find what they're looking for, and have a good experience here. So, what resources, suggestions, and support can those of us who are already here provide to potential newcomers? And what can we do to prepare for – and encourage – a potential influx? Here are a few specific questions (although these are just starting points, other suggestions etc are welcome) - What advice would you give somebody coming from Facebook, Instagram, Xitter, Reddit, and/or TikTok who's starting to check out fedi? - What resources are good for helping people get started? - In terms of your own experiences here, what have you learned that you wish you knew earlier? - How can people (including moderators and admins) here on fedi help newcomers? Feel free to share your thoughts –[ on fedi at gotosocial.thenexus.today](https://gotosocial.thenexus.today/@thenexusofprivacy/statuses/01K8AD57VPF5HY3DSTQSBS607H?ref=thenexusofprivacy.net) or [in the CryptPad form here](https://cryptpad.fr/form/?ref=thenexusofprivacy.net#/2/form/view/VhecR3+1b087D3M-PbYnNB6mUNORmmWD1gFzEwgkdbc/) > Unsurprisingly, I've got some thoughts of my own on all of these, but I'm going to hold off for now to hear what others have to say. I'll either add them to a revised version of this post, or share a separate post. ## Background on Media Revolution and Media Liberation day [Media Revolution's recent open call has details and (in the summary) a lot of links](https://www.youtube.com/watch?v=lWojxJXp764&ref=thenexusofprivacy.net) about the day as a whole, and several of their related campaigns, including - [mo-me](https://mediarevolution.org/mo-me/?ref=thenexusofprivacy.net) ("movement media"), is a fediverse platform that people can either sign up for directly or use with a fediverse account hosted elsewhere. For newcomers who are looking for microblogging, this is likely to be a good option for setting up an initial account. - [News Clubs](https://mediarevolution.org/news-clubs/?ref=thenexusofprivacy.net) ("like a book club for news"), which can use decentralized social media for online meetings or to complement in-person meetings - A "leaving party" on Zoom on November 5 (19:00-22:00 London time) – a natural time to help people ready to leave and looking for alternatives Another idea worth considering: at this year's FediForum, Liz from Media Revolution suggested a "welcome party". Right now the plan is to combine that with the leaving party, but a complementary option is to use hashtags, channels, feeds, and so on to have an ongoing welcome party. ### This is what solidarity looks like URL: https://thenexusofprivacy.net/what-solidarity-looks-like/ Last updated: 2026-04-16T03:32:00.000Z . Blacksky has continued to progress by leaps and bounds in the months since I first wrote [“Decentralization” and erasure: Blacksky, Bluesky, and the ATmosphere](https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/), expanding the team and executing on the path that Rudy Fraser laid out in 2024. - Hundreds of people have set up accounts on the blacksky.app PDS (personal data server) – [including me](https://blacksky.community/profile/did:plc:7ax27mj5qwhqaa3ite2ezlzy?ref=thenexusofprivacy.net). - The [blacksky.community](https://blacksky.community/?ref=thenexusofprivacy.net) app has the outstanding [Blacksky Moderation](https://blacksky.community/profile/did:plc:d2mkddsbmnrgr3domzg5qexf?ref=thenexusofprivacy.net) service enabled by default, and the also-outstanding [Blacksky: Trending](https://blacksky.community/profile/rude1.blacksky.team/feed/blacksky-trend?ref=thenexusofprivacy.net) as the feed for new users instead of Bluesky's crappy Discover feed). - Behind the scenes, the Blacksky feeds use the Blacksky relay at atproto.africa, which extends relay functionality by including a "mod relay" - and [other ATmosphere software is starting to use it as well](https://blacksky.community/profile/did:plc:72wa4qoe4ssxx2az3xljtq5d/post/3lyglot43x22h?ref=thenexusofprivacy.net). - Blacksky is now hosting almost all of their own infrastructure.[1](#notes) Here's a recent post from Rudy with the list ![Post by Rudy wants revolution (@rude1.blacksky.team‬): blacksky.app → pds. atproto.africa → relay. blacksky.community → app. @blackskyweb.xyz → moderation. @tektite.cc → migration. assembly.blacksky.community → governance. blackskyweb.xyz → marketing website. rsky.satnav.dev → exported data explorer.](https://thenexusofprivacy.net/content/images/2025/09/infrastructure.png) And Bluesky's horrible moderation in the aftermath of the Kirk shooting (Nathan Grayson's [Bluesky Really Doesn’t Want People To Say ‘Rest In Piss’ About Charlie Kirk](https://aftermath.site/bluesky-charlie-kirk-dead-rest-in-piss?ref=thenexusofprivacy.net) has some of the lowlights) is yet another great advertisement for Blacksky's ability to make its own moderation decisions. Over the last few months, Blacksky has also (unlike Bluesky) decided [not to block Mississippi](https://thenexusofprivacy.net/mississippi-bluesky-blacksky-the-atmosphere-mastodon-and-the-fediverse/) and not to require identity documents, biometrics, or credit cards to access DMs in the United Kingdom. Here's a late-August post from international humanitarian aid worker in the Balkans who couldn't get to their DMs because Bluesky thought they were in the UK. ![Borderless (@borderless.bsky.social, he/him they/them): Omg it works!!! I'm posting from BlackSky y'all! 🤠 @support.bsky.team blocked my DMs but @rudyfraser.com and BlackSky let me access them! Appreciate it so much. 🖤](https://thenexusofprivacy.net/content/images/2025/09/appreciate-blacksky.png) [A post from Borderless, August 28](https://bsky.app/profile/borderless.bsky.social/post/3lxhoqcxmoc2j?ref=thenexusofprivacy.net). As dapurplesharpie says, [this is what solidarity looks like](https://bsky.app/profile/sharpiepls.com/post/3lxhr4634zk22?ref=thenexusofprivacy.net). And speaking of solidarity ... [![Post by Rudy wants revolution (@rude1.blacksky.team‬): If you enjoy the products we build you can start a voluntary, recurring, sliding scale subscription via the link below today We are a for-profit business. Regular c-corp. These are not donations, but they are our primary business model as of right now Pay us what you can at the value you get from it](https://thenexusofprivacy.net/content/images/2025/09/support-blacksky.png)](https://opencollective.com/blacksky?ref=thenexusofprivacy.net) [Please join me in supporting Bluesky!](https://opencollective.com/blacksky?ref=thenexusofprivacy.net) The [gorgeous Blacksky Algorithms website at blacksky.xyz](https://www.blackskyweb.xyz/?ref=thenexusofprivacy.net), Rudy's recent [🔭🖤🚀 Social media’s next evolution: decentralized, open-source, and scalable](https://newpublic.substack.com/p/how-blacksky-grew-to-millions-of) on New Public (with Josh Kramer), [Nodestar: Building Blacksky w/ Rudy Fraser](https://www.themaybe.org/podcast/nodestar-building-blacksky-w-rudy-fraser?ref=thenexusofprivacy.net) (with Alix Dunn), Stats on Stats' [Blacksky Algorithms: Building Decentralized Social Media with Rudy Fraser](https://www.youtube.com/watch?v=Uvj1h7OQPkk&ref=thenexusofprivacy.net) (below), the [podcast](https://www.techdirt.com/2025/08/27/techdirt-podcast-episode-428-blacksky-demonstrates-the-promise-of-open-social-media-protocols/?ref=thenexusofprivacy.net) with *TechDirt* founder (and Bluesky board member) Mike Masnick, and the [Infrastructure for Interdependence: Building technology in service of collective power](https://leaflet.pub/043c8df3-f129-4ea0-bea6-c00cb781c294?ref=privacy.thenexus.today) Blacksky Algorithms memo to investors are good overview of where things are in early September 2025\. > **Update**, [October 2025: Can Blacksky fix what Twitter broke using Bluesky tech?](https://open.spotify.com/episode/2TYlfsktObFYGvLkmqo9JF?utm%5Fsource=copy-link&utm%5Fmedium=sharing), a podcast with Bridget Todd from their Rights x Tech session, is also great listening. The earlier three-part series from late 2023 [Blacksky: Expressing the Black Everyday in a New Digital Space](https://blog.rudyfraser.com/blacksky-part-one/?ref=thenexusofprivacy.net) (see also [part 2](https://blog.rudyfraser.com/blacksky-part-two/?ref=thenexusofprivacy.net) and [part 3](https://blog.rudyfraser.com/blacksky-part-three/?ref=thenexusofprivacy.net)) and [An internet of many autonomous communities](https://blog.rudyfraser.com/an-internet-of-many-autonomous-communities/?ref=thenexusofprivacy.net) (expanding on Rudy's ATmosphereConf talk on [Beyond Horseless Carriages: Building Communities for the Decentralized Era](https://www.youtube.com/watch?v=OZN8y8kVFFI&ref=thenexusofprivacy.net)) have a lot more background. ## Meanwhile, in the ATmosphere ... Meanwhile, the developer ecosystem in the ATmosphere (the ecosystem of software built around the AT Protocol, including Blacksky and Bluesky) is thriving with a lot of collaboration and synergies. [Northsky Social](https://northskysocial.com/?ref=thenexusofprivacy.net) (in Canada) focusing on the 2SLGBTQIA2S+ community – and[ is currently testing a PDS migration tool as well](https://northskysocial.com/posts/northsky-newsletter-update-2?ref=thenexusofprivacy.net). [Skylight Social](https://skylight.social/?ref=thenexusofprivacy.net), [Streamplace](https://stream.place/?ref=thenexusofprivacy.net), and [Spark](https://sprk.so/?ref=thenexusofprivacy.net) (in Brazil) are focusing on video. [Gander](https://gandersocial.ca/?ref=thenexusofprivacy.net) (also in Canada) is planning on launching this fall. There's a lot of energy behind [Eurosky](https://www.eurosky.social/?ref=thenexusofprivacy.net). The AT Protocol dev community, after several successful conferences on multiple continents and both coasts of North America, is starting up a working group on bringing private data to the ATmosphere, a project that Rudy added to Blacksky's roadmap several months ago. [Smoke Signal](https://smokesignal.events/?ref=thenexusofprivacy.net) (events), [Flashes](https://techcrunch.com/2025/07/03/everything-you-need-to-know-about-flashes-the-bluesky-based-instagram-alternative/?ref=thenexusofprivacy.net) (an Instagram alternative), [Leaflet](https://leaflet.pub/?ref=thenexusofprivacy.net) and [Offprint](https://offprint.app/?ref=thenexusofprivacy.net) for long-form text ... The list goes on and on and on, and Laurens Hof's weekly[ ATmosphere report](https://connectedplaces.leaflet.pub/3lxx2rk4pv22r?ref=thenexusofprivacy.net) keeps getting longer and longer. That's a good thing! And all of these projects are learning from each other, building off each others successes, and working together to improve the platform. One good example: [dapurplesharpie's excellent short video](https://bsky.app/profile/sharpiepls.com/post/3lw3hcuojck2u?ref=thenexusofprivacy.net) demonstrating how to use independent developer Bailey Townsend's [PDS Moover](https://pdsmoover.com/?ref=thenexusofprivacy.net) to migrate accounts from Bluesky to Blacksky. > Entry 31 - Migrating from the Bluesky PDS to the #BlackSky PDS with PDS MOOver #SharpieVLOG > > — [dapurplesharpie (@sharpiepls.com)](https://bsky.app/profile/did:plc:g7j6qok5us4hjqlwjxwrrkjm?ref%5Fsrc=embed&ref=thenexusofprivacy.net) [2025-08-10T23:39:32.683Z](https://bsky.app/profile/did:plc:g7j6qok5us4hjqlwjxwrrkjm/post/3lw3hcuojck2u?ref%5Fsrc=embed&ref=thenexusofprivacy.net) As Rudy says, "You'd think Bailey was on payroll the amount of work he puts in for Blacksky. With all the hats I have to wear daily, stuff like this means a lot." Blacksky's Tektite.cc is now another good migration option, although currently available on Chrome; sprout's [How to Migrate to Blacksky](https://leaflet.pub/000b57de-78dc-4939-8c66-79227d010cce?ref=thenexusofprivacy.net) and [](https://bsky.app/profile/sharpiepls.com/post/3lw3hcuojck2u?ref=thenexusofprivacy.net)[Clinton Bowen's also-excellent short video](https://www.youtube.com/watch?v=%5FSdmiCRYeZA&ref=thenexusofprivacy.net) have more. As other non-Bluesky PDSs and migration tools start to become available they'll be able to leverage all this work. Solidarity in action! So while Bluesky is still largely centralized in some important ways (99%+ of users are still on Bluesky infrastructure and most of them don't have backups, Bluesky still controls the PLC directory that most ATmosphere software depends on and the magic "rotation keys" ) that's clearly in the process of changing. As inquiline says in [Yo computer touchers](https://assemblag.es/@inquiline/115125470539240617?ref=thenexusofprivacy.net), as part of a thread on assemblag.es about the "long history of Black inventors' ingenuity being denied at a systemic level" > "Whatever one thinks of Bluesky, \*the\* most innovative cultural and technical experimental space there right now is Blacksky; \*and\* it’s also the clearest example of decentralized possibility on the AT protocol. When people double down saying “AT isn’t decentralized”, they are denying that Blacksky exists." ## And yet ... ![A sign saying "0 days without Mastodon users calling Bluesky decentralized" with Lenny from the Simpsons replacing the 0 with another 0](https://thenexusofprivacy.net/content/images/2025/08/0-days.jpg) Meme by [Roscoe Rubin-Rottenberg](https://bsky.app/profile/knotbin.com/post/3lx4upaj7gk2m?ref=thenexusofprivacy.net), August 23 But the main topic of my late-2024 post was the erasure of Blacksky and ...well let's just say things haven't progressed quite as much on this front over the last nine months in the ActivityPub Fediverse as one might have hoped. A couple of examples: - Mastodon founder Eugen Rochko's post "[And this is why real decentralization matters](https://mastodon.social/@Gargron/115074431325055303?ref=thenexusofprivacy.net)" and the discussion thread that followed. There were plenty of others in the ActivityPub Fediverse as well – enough that I wound up doing a post [Can we please stop arguing about whether Bluesky is decentralized?](https://thenexusofprivacy.net/can-we-please-stop-arguing-about-whether-bluesky-is-decentralized/) - Fediverse influencer Chris Trottier's [claim](https://atomicpoet.org/notice/AxhscnjWSTUkwlKo2i?ref=thenexusofprivacy.net) that "Communities built around interests are something #Twitter never offered, and #Bluesky still doesn’t." Blacksky bets to differ! - The suggestion by ActivityPub spec co-editor Evan Prodromou (whose biography on the Social Web Foundation site notes that he's sometimes called “The Father of the Fediverse") that "[Competing protocols are not good for the space. They divide the community and prevent reaching critical mass](https://github.com/swicg/general/pull/45?ref=thenexusofprivacy.net#issuecomment-3262517592)." Hmm. Once again, Blacksky begs to differ. At some level, who cares. Evan, Eugen, and their allies have (at least for now) blocked the official W3C SWICG standards body from endorsing the [Statement on discourse about ActivityPub and AT Protocol](https://writings.thisismissem.social/statement-on-discourse-about-activitypub-and-at-protocol/?ref=thenexusofprivacy.net) that long-time ActivityPub developer and trust and safety expert Emelia Smith organized, but whatever – quite a few key Fediverse and ATmosphere developers and influencers have signed on. ## A great learning opportunity for the ActivityPub Fediverse > "\[D\]ismissing Bluesky without even considering Blacksky isn't just erasure, it's also missing out on something very important. Especially for people in the ActivityPub Fediverse – with its long history of [whiteness](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), [anti-Blackness](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x?ref=thenexusofprivacy.net), and [misogynoir](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) – there's a lot to learn here.... > > But it's really hard to learn from Blacksky if you're pretending it doesn't exist." > > – “Decentralization” and erasure: Still, all of this erasure and dismissiveness – and the endless [discourse about decentralization](https://connectedplaces.online/on-discourse-and-decentralisation/?ref=thenexusofprivacy.net) – really does have a huge cost to the Fediverse. There's a lot to learn from Blacksky, starting with the way Rudy listens to the community; check out the excellent feedback in [Blacksky Assembly](https://assembly.blacksky.community/6carwc4nzj?ref=thenexusofprivacy.net) for the next iteration of the Community Guidelines. And in [a post on kolektiva.social](https://kolektiva.social/@ophiocephalic/115171695053410516?ref=thenexusofprivacy.net), ophiocephalic (curator of the [Free Fediverse wiki](https://freefediverse.org/index.php/Main%5FPage?ref=thenexusofprivacy.net)) makes an important point about another important thing the ActivityPub Fediverse *could* be learning here: > "Relatively few of us care about decentralization as a purely technical architectural principle. It matters because it sets the stage for the horizontal redistribution of agency and power, and thus the subversion of hierarchy in and democratization of online space. Suggestion here that what we should be paying attention to first and foremost is the power analysis. > > While decentralist AT developers have a long way to go to get to where we already are, they're at least moving in the right direction. Meanwhile, the same cannot necessarily be said of the fediverse. In fact, power is concentrating here, largely due to the centralizing megaservers, the Zuckerberg incursion, and the wrongheaded failures of "leadership" ensconced in the SWICG/SWF silo." Yeah really. The sooner people in the Fediverse stop listening to people like Evan the better. And more positively, despite all the naysayers, there's also a much broader awareness of and respect for the importance of Blacksky in the Fediverse – and a realization that people trying to redistribute power and agency in the different ecosystems really are on the same side. As Spritely Labs executive director (and ActivityPub spec co-editor) Christine Lemmer-Webber says on social.coop, "our communities *do* both face major threats which I believe we are *ideologically aligned in wanting to face*" – including "the rise of techno-fascism and omnisurveillance." > "These are our existential threats, not each other. And we need to figure out how to work together." ## All credit to Rudy, all credit to the team! At the end of the day, though, what's really important here? As Laurens Hof says in [On discourse and decentralisation](https://connectedplaces.online/on-discourse-and-decentralisation/?ref=thenexusofprivacy.net) > "What fundamentally matters most is that communities can own and control their own places on the internet. [Blacksky](https://www.blackskyweb.xyz/?ref=thenexusofprivacy.net) provides a clear example of this: That Black people can build their own social place on the internet, where the community can set their own [rules](https://www.blackskyweb.xyz/about/support/tos?ref=thenexusofprivacy.net), have their own [moderation](https://bsky.app/profile/blackskyweb.xyz?ref=thenexusofprivacy.net), and their own [methods for governance](https://assembly.blacksky.community/6carwc4nzj?ref=thenexusofprivacy.net) is incredibly meaningful in itself, and an example for what self-governing communities can look like on the open social web." And while Rudy deserves every bit of the credit he's getting for Blacksky's success, as he consistently points out it has been very much a team effort – and the team also collectively deserve every bit of the credit. ![A slide with the title "[they] can't stop this 2-3 zone", followed by avatars labeled 1st invites, 3rd most rsky commits, moderation how-tos, created Umoya Fellowship, building SAFEskies](https://thenexusofprivacy.net/content/images/2025/09/2-3-zone.png) A slide from Rudy's ATmosphereConf March 2025 talk [Beyond Horseless Carriages: Building Communities for the Decentralized Era](https://www.youtube.com/watch?v=OZN8y8kVFFI&ref=thenexusofprivacy.net), featuring avatars of Blacksky contributors Aveta, Clinton Bowen, Dr. KáLyn Coghill, TDr. Linda Maepa, and Natalie What next? Well, Blacksky's mobile apps will be available "soon-ish," and they're working on their own AppView implmentation as well – which will enable Blacksky-only posts, functionality the community is very very eager for. Venture capital firms in the US almost never fund Black-led companies, but at some point hopefully some angel investors will wake up and start throwing some money Blacksky's way and further accelerate progress. And whether or not that happens, the community is incredibly supportive – and growing rapidly. So I'm confident that Rudy and the team will continue to innovate and execute on their really amazing vision. As somebody who's believed in the liberatory powers of social networks for decades, I've never been as excited about a project as I am about Blacksky. And I for one am very much looking forward to what comes next – and looking for ways to help! Speaking of which, at the risk of repeating myself ... [please join me in supporting Blacsky!](https://opencollective.com/blacksky?ref=thenexusofprivacy.net) [![Post by Rudy wants revolution (@rude1.blacksky.team‬): If you enjoy the products we build you can start a voluntary, recurring, sliding scale subscription via the link below today We are a for-profit business. Regular c-corp. These are not donations, but they are our primary business model as of right now Pay us what you can at the value you get from it](https://thenexusofprivacy.net/content/images/2025/09/support-blacksky.png)](https://opencollective.com/blacksky?ref=thenexusofprivacy.net) ## Notes 1 In the discussions of the first version of this article, several people asked how much it costs Blacksky to host their infrastructure. Currently, the two biggest components are - PDS storage, with the data for all the people on blacksky.app (as well as supporters with accounts on myatprotocol.social). This is running on a digitalocean storage optimized droplet at $262 /month, and Rudy expects this can scale to a million users (Bluesky scaled their PDS to 500K users before they split it). As of late August the PDS required 328GB of blob storage; it's $0.02 / GB for more, so while that number's likely to increase significantly it's not going to break the bank. - the africa.proto relay. This is running on a $66/month bare metal OVH instance (with unlimited bandwidth): 2 vCPUs, 8GB RAM, 66GB storage for PLC directory cache + \~200GB per 24hrs of backfill replay window. Relays need to crawl the entire network, so if Bluesky's number of active users increases by an order of magnitude, so will storage requirements ... again though, it's not going to be hugely expensive. It's hard to project the AppView costs, although it's likely to be more expensive than the Relay. In July, futur.blue [noted](https://whtwnd.com/futur.blue/3ls7sbvpsqc2w?ref=thenexusofprivacy.net) that the total cost for running a copy of Bluesky's AppView was $200, primarily for 16TB of storage (he entire history of all posts ever made on the network). Of course, there may well be ways to optimize that; then again, the non-storage costs of an AppView are likely scales at least linearly with the number of users. So time will tell! ## Update log Ongoing: typo fixes, cleanups, additional links September 12: add link to [Bluesky Really Doesn’t Want People To Say ‘Rest In Piss’ About Charlie Kirk](https://aftermath.site/bluesky-charlie-kirk-dead-rest-in-piss?ref=thenexusofprivacy.net) with deets about Bluesky moderation issues in the aftermath of the Kirk shooting. [Bluesky and The Battle of Wormtongue](https://thenexusofprivacy.net/bluesky-and-the-battle-of-wormtongue/) has background about Bluesky's long history of anti-Black and anti-trans moderation. September 14: add [footnote](#notes) on costs. September 15: add Rudy's skeet listing the current infrastructure. ### Improving accessibility in the fediverse and the ATmosphere URL: https://thenexusofprivacy.net/improving-accessibility/ Last updated: 2026-04-16T03:31:41.000Z One wonderful feature of many of the communities in the fediverse is that so many many people take the time to put alt-text on their images – so low-vision and blind people can participate much more fully than on other social networks. Just as importantly, some fedi software works quite well for people using screenreaders and other assistive technology. Still, other fedi software isn't anywhere hear as good from an accessibility perspective and it's not always easy to find the better options. Even though fedi's alt-text game is a lot better than other platforms, the majority of images and videos don't have alt text. And alt-text is only one aspect of making posts accessible; I often see user names and posts with text that's a really bad experience for people using screenreaders. So there's a lot of room for improvement. Meanwhile on Bluesky and in the ATmosphere ... let's just say there's even more room for improvement. The good news is that there are a lot of people on both platforms who want to help improve things – I've already talked to a couple of development teams who are interested, and there are lots of ways that people who *aren't* developers can contribute too. So, let's get to work! As a first step, let's focus on gathering information. A few key questions to start with: - What resources and tips have you found useful – or think might be useful for others? - What accessibility problems have you encountered on social networks – bugs, missing documentation or functionality, whatever? - What are inspirations or best practices from other software we can learn from (yes even including evil centralized social networks, because sometimes they do some aspects of accessibility quite well) - Any suggestions for improving things? These don't have to be limited to software improvements. For example, as new people join fedi, they're coming from networks that don't value accessibility as much ... how can we help them realize that things are different here, give them the basic tools they need to avoid common mistakes, and let them know how they can help if they have the time? You can share your perspectives - in [this CryptPad form](https://cryptpad.fr/form/?ref=thenexusofprivacy.net#/3/form/view/46fca4904852192d3b7c4834eee20eb4/) - in the Fediverse at [gotosocial.thenexus.today](https://gotosocial.thenexus.today/@thenexusofprivacy/statuses/01K4AJ0AZMRMXJR0NXV9PM4RNQ?ref=thenexusofprivacy.net),[ activitypub.space](https://activitypub.space/topic/194f0b59-cec9-4c8f-9481-2507027e5112/improving-accessibility-in-the-fediverse-and-the-atmosphere?ref=thenexusofprivacy.net), [SocialHub](https://socialhub.activitypub.rocks/t/improving-accessibility-in-the-fediverse/5558?ref=thenexusofprivacy.net) - in the ATmosphere on [Bluesky](https://bsky.app/profile/thenexusofprivacy.net/post/3lxzfoyykwk2e?ref=thenexusofprivacy.net), [Leaflet](https://thenexusofprivacy.leaflet.pub/3lxxyg36k5s2t?ref=thenexusofprivacy.net), or [FrontPage](https://frontpage.fyi/post/jdp23.thenexus.today/3lxzg5cifk227?ref=thenexusofprivacy.net) I'll collect the responses and follow up with posts here, in the Fediverse, and in the ATmosphere – and schedule a webinar to present the results and discuss next steps. If you're interested in helping with the project going forward, or just want stay in the loop, you can [subscribe here](https://thenexusofprivacy.net/#/portal/signup), follow the Nexus of Privacy [in the Fediverse](https://gotosocial.thenexus.today/@thenexusofprivacy?ref=thenexusofprivacy.net) or [Bluesky](https://bsky.app/profile/thenexusofprivacy.net?ref=thenexusofprivacy.net), or optionally leave your contact information the [Cryptpad form](https://cryptpad.fr/form/?ref=thenexusofprivacy.net#/3/form/view/46fca4904852192d3b7c4834eee20eb4/). ### Can we please stop arguing about whether Bluesky is decentralized? URL: https://thenexusofprivacy.net/can-we-please-stop-arguing-about-whether-bluesky-is-decentralized/ Last updated: 2026-04-16T03:31:03.000Z One of the most common responses on Mastodon and other Fediverse social networks to [Bluesky's decision to block Mississippi](https://thenexusofprivacy.net/p/30df6df6-3bfe-4828-9aaf-f863aff99422/) was to argue that this highlighted that Bluesky isn't *really* decentralized. Mastodon founder Eugen Rochko's post, leading to [a long thread of discussions](https://mastodon.social/@Gargron/115074431325055303?ref=thenexusofprivacy.net) (including dialog between him and Bluesky board member Mike Masnick) is one example. I wrote about this question at length in [“Decentralization” and erasure: Blacksky, Bluesky, and the ATmosphere](https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/) last December, and my summary has held up pretty darned well if I do say so myself: > "\[W\]hile I agree that today's actually-existing Bluesky and ATmosphere are still largely centralized in some important ways ... my perspective is that focusing *only* on that ignores the ways that they already are meaningfully decentralized. > > Your mileage may vary of course. "Decentralization" means different things to different people ... \[P\]eople who are focusing on the (very real) concentration of power in the ATmosphere today, or the potentially-centralizing architecture of AT, find it more useful to describe Bluesky as centralized." In some ways, a lot has changed in the months since I wrote that article. [Blacksky has continued to progress by leaps and bounds](https://thenexusofprivacy.net/what-solidarity-looks-like/). Over the last few weeks hundreds of people have moved their accounts to the new blacksky.app PDS, and they're running an early version of their app at blacksky.community as well as a relay at atproto.africa and [a gorgeous Blacksky Algorithms website at blacksky.xyz](https://www.blackskyweb.xyz/?ref=thenexusofprivacy.net). [1](#notes) Other ATmosphere projects are making great progress too, with Spark in Brazil also implementing its own complete stack, Northsky in focusing on the 2SLGBTQIA2S+ community, Gander (also in Canada) planning on launching this fall, a lot of energy behind Eurosky, and far too many other interesting things to list here. Of course, Bluesky is still largely centralized in some important ways. 99.99% of the users are still on infrastructure run by Bluesky PBC. 99.99% of the users use Bluesky PBC's app. Bluesky PBC still controls the PLC directory that most ATmosphere software depends on. That said, your mileage may vary, but looking at all the progress and activity, it sure seems to me that's in the process of changing. What *isn't* changing, though, is the discourse. People still focus on different aspects of decentralization. People who saw Bluesky as centralized nine months ago still see Bluesky as centralized. People who saw Bluesky as decentralized (or decentralizing) nine months ago still see Bluesky as decentralized (or decentralizing). Nobody's changing their minds in response to new information. It's basically the same discussions rehashed again and again. One thing that's been really striking to me in this latest iteration of this interminable discourse is that so many people in the Fediverse present the fact that 99.99% of Bluesky users are still using infrastructrure run by Bluesky PBC as if it's a gotcha that people advocating for Bluesky and the ATmosphere aren't aware of. No, actually, ATmosphere developers I talk to are very very aware of these limitations. They just prefer to invest their time and energy in working to improve the situation rather than arguing about the semantics of "decentralization." That sure seems like a good approach to me. So can we please stop arguing about this already? ## Notes 1 Rudy Fraser's [🔭🖤🚀 Social media’s next evolution: decentralized, open-source, and scalable](https://newpublic.substack.com/p/how-blacksky-grew-to-millions-of) on New Public (with Josh Kramer), [podcast](https://www.techdirt.com/2025/08/27/techdirt-podcast-episode-428-blacksky-demonstrates-the-promise-of-open-social-media-protocols/?ref=thenexusofprivacy.net) with *TechDirt* founder (and Bluesky board member) Mike Masnick, and [Infrastructure for Interdependence: Building technology in service of collective power](https://leaflet.pub/043c8df3-f129-4ea0-bea6-c00cb781c294?ref=privacy.thenexus.today) are good recent overviews. ### Mississippi, Bluesky, Blacksky, the ATmosphere, Mastodon, and the Fediverse URL: https://thenexusofprivacy.net/mississippi-bluesky-blacksky-the-atmosphere-mastodon-and-the-fediverse/ Last updated: 2026-04-16T03:30:42.000Z *Originally published August 28, last updated December 9\. See the* [*Update Log*](#update-log) *at the bottom for details.* > Note: If you're getting age verification requests from Bluesky, you can use an alternative interface (like [blacksky.community](https://blacksky.community/?ref=thenexusofprivacy.net)) or a VPN to work around the requirement. Mary's detailed [Bluesky's age assurance sucks, here's how to work around it](https://gist.github.com/mary-ext/6e27b24a83838202908808ad528b3318?ref=thenexusofprivacy.net) has a bunch of other options as well. [Bluesky's announcement they're blocking access to their app by anybody using a Mississippi IP address](https://bsky.social/about/blog/08-22-2025-mississippi-hb1126?ref=thenexusofprivacy.net) has sparked a lot of discussions in the world of decentralized social networks. Before we get to those, though, I'll start by providing some background. If you're already up to speed, feel free to skip ahead! And if you're not sure why everybody's so upset about these age verification laws, there's an appendix with a quick overview of the problems and links to find out more. > **Update, December 9**: Bluesky has now modified their policy to "let users in Mississippi who are 18 or over use the platform by completing age assurance," although they're still not allowing 16- and 17-year-olds in Mississippi to use the software. - [It's not a good situation](#background) - [Meanwhile, on Mastodon and elsewhere in the Fediverse](#stop-arguing) - [Some interesting discussions](#discussions) - [Now's a good time to start thinking seriously about some hard questions](#thinking-seriously) - [Appendix: Why age verification laws are bad](#bad) - [Notes](#notes) ## It's not a good situation [Mississippi's law, HB 1126](https://billstatus.ls.state.ms.us/documents/2024/html/HB/1100-1199/HB1126PS.htm?ref=thenexusofprivacy.net), requires age verification for *all* users of digital services including forums, chat rooms, and social networks, no matter what the content of the site is. Even though Supreme Court Justice Kavanaugh has said that the law is probably unconstitutional, the Supreme Court denied Net Choice's application to block enforcement, and so here we are. With fines of up to $10,000 per user, it's easy to see why Bluesky is so concerned.[1](#notes) And not just Bluesky: it's not a good situation for anybody running a social network (or a forum, or a chat room). And with age verification requirements in more and more states and countries, it's not a good situation for anybody wanting to be on a social network (or a forum, or a chat room) without sharing their ID or biometrics. In early July, Bluesky had announced that [they're requiring age verification from users in the United Kingdom to access DMs or content tagged as adult](https://bsky.social/about/blog/07-10-2025-age-assurance?ref=thenexusofprivacy.net) (in order to comply with the UK's Online Safety Act); a few weeks after the Mississippi announcement, they similarly announced they'd comply with age verification laws in [South Dakota and Wyoming](https://bsky.social/about/blog/09-10-2025-age-assurance-approach?ref=thenexusofprivacy.net). But the Mississippi law is exceptionally broad and vaguely written, so it's not surprising they reached a different conclusion here. As Bluesky highlighted in their announcement, their decision applies only to the Bluesky app; other apps and services may choose to respond differently. And many in the ATmosphere (the decentralized ecosystem of apps and services using Bluesky's AT Protocol) are indeed responding differently ... for example, [Blacksky](https://blacksky.community/profile/did:plc:w4xbfzo7kqfes5zb7r6qv3rw/post/3lxamsndae22j?ref=thenexusofprivacy.net): [![A post from Rudy wants revolution (@rudyfraser.com): We don't gather specific geolocation information. We require our users to confirm they're over the age of 18. We don't plan on blocking any users based on where they're located.](https://thenexusofprivacy.net/content/images/2025/08/blacksky-isnt-blocking-1.png)](https://blacksky.community/profile/did:plc:w4xbfzo7kqfes5zb7r6qv3rw/post/3lxamsndae22j?ref=thenexusofprivacy.net) And in [Mississippi’s age assurance law puts decentralized social networks to the test](https://techcrunch.com/2025/08/28/mississippis-age-assurance-law-puts-decentralized-social-networks-to-the-test/?ref=thenexusofprivacy.net) on *TechCrunch,* Sarah Perez reports that "some users in the state [report](https://www.reddit.com/r/mississippi/comments/1mxx1zv/bluesky%5Fcan%5Fstill%5Fbe%5Faccessed%5Fvia%5Fgraysky%5Ffor/?ref=thenexusofprivacy.net) they’ve been able to access Bluesky through third-party clients like [Graysky](https://graysky.app/?ref=thenexusofprivacy.net), [Skeets](https://www.skeetsapp.com/?ref=thenexusofprivacy.net), [Klearsky](https://klearsky.pages.dev/?ref=thenexusofprivacy.net), [TOKIMEKI](https://tokimeki.blue/?ref=thenexusofprivacy.net), [Flashes](https://apps.apple.com/us/app/flashes-for-bluesky/id6741443033?ref=thenexusofprivacy.net), or forked versions of the Bluesky app, like [Deer.social](https://deer.social/?ref=thenexusofprivacy.net) or [Zeppelin](https://zeppelin.social/?ref=thenexusofprivacy.net)." People in Mississippi can also still use the Bluesky app with a VPN (virtual private network), which hides your real IP and so can claim to be from any state. [Good, privacy-protecting VPN software](https://www.privacyguides.org/en/vpn/?ref=thenexusofprivacy.net) is fairly cheap[2](#notes); [Proton VPN](https://protonvpn.com/free-vpn?ref=thenexusofprivacy.net) even has a limited free option. In the UK, the Online Safety Act's age verification requirements led to a surge in VPN downloads, and presumably the same thing will happen in Mississippi. Still, many people don't know about these alternatives. Not everybody has the money to spend for a paid VPN. Worse, there are a lot of very shady VPNs out there, including some that send all your data to China or Russia – and some that are owned by a company that has links to Israeli intelligence services. Not only that, the UK is already floating the idea of making VPNs illegal for minors, and it's certainly imaginable that other governments will follow suit. > Update, December 9: [Lawmakers Want to Ban VPNs—And They Have No Idea What They’re Doing](https://www.eff.org/deeplinks/2025/11/lawmakers-want-ban-vpns-and-they-have-no-idea-what-theyre-doing?ref=thenexusofprivacy.net) discusses legislation in Wisconsin that would ban VPNs. So it's not a good situation at all for people in Mississippi. And it's especially not good for people in Mississippi who are already marginalized and targeted, which is why I featured [AJ's thread](https://bsky.app/profile/funkys.bauble.boutique/post/3lwzkte4hjs2w?ref=thenexusofprivacy.net) at the top of this post. All that being said, it's clearly Mississippi legislators who are primarily esponsible for the bad situation. Many digital rights activists applauded Bluesky's decision here – for example, [Evan Greer of Fight for the Future](https://bsky.app/profile/evangreer.bsky.social/post/3lwzmstwfqs2v?ref=thenexusofprivacy.net) ![A post by Evan Greeer (@evangreer.bsky.social): This is the right response to the Mississippi law from Bluesky. "Age verification" laws are nothing more than a massive expansion of government surveillance and censorship. They make kids less safe, not more safe. Get a VPN and call your lawmakers. Time to fight.](https://thenexusofprivacy.net/content/images/2025/08/evan-greer.png) > Dozens of other states in the US have or are considering similar age verification legislation, and Congress is considering passing national requirements. If you're in the US,[ Stop Online ID Checks](https://www.stoponlineidchecks.org/?ref=thenexusofprivacy.net) is a national campaign to fight these kinds of laws. > > Elsewhere, the age verification requirements of the UK Online Safety Act went into effect in July. The EU, Canada, Brazil, South Africa, and quite a few other countries are considering similar regulation. So wherever you are, look around to see if there are any active campaigns and get involved! > > Update, December 9: [Australia's law banning people under 16 from social media takes effect tomorrow](https://www.reuters.com/business/media-telecom/australia-social-media-ban-set-take-effect-sparking-global-crackdown-2025-12-09/?ref=thenexusofprivacy.net). ## Meanwhile, on Mastodon and elsewhere in the Fediverse > "In the big picture, the singular fediverse’s decentralised nature looks like a great way of dealing with age verification laws. But once you zoom in further and see a million fediverses, the picture becomes a whole lot more complicated: it means that thousands of (volunteer) server administrators are making difficult decisions. They’ll all have to decide for themselves if and how they want to comply with this new law." > > – Laurens Hof, in [Fediverse Report #131](https://connectedplaces.online/reports/fediverse-report-131/?ref=thenexusofprivacy.net) on Connected Places Most of the instances (servers) running Mastodon, Pixelfed, GoToSocial, and other Fediverse software are based outside the US, so the tradeoffs for their admins are different than Bluesky. As Mastodon gGmbH CEO Eugen Rochko [posted](https://mastodon.social/@Gargron/115074431325055303?ref=thenexusofprivacy.net), "Technically, you're probably also breaking laws in Afghanistan, Iran, North Korea and so on. The question is, do you care?" There's certainly something in what Rochko says: it may well be impossible for Mississippi to enforce their law on instances without any US ties. Fediverse instances in the US, on the other hand, are potentially just as vulnerable as Bluesky – and most of them are quite small, without Bluesky's resources to fight back if Mississippi targets them. So I wasn't surprised to see admins of some US-based instances saying that they plan to follow Bluesky's lead and block Mississippi. I don't know of any Mississippi-based instances, but if any exist they're in a very tough situation, facing a choice between shutting down, doing age verification, or trying to fly below the radar and hope they're not noticed. Historically, flying under the radar has mostly worked out well so far for the Fediverse. After all, even the largest instance (mastodon.social, which is run by Mastodon gGmbH) is relatively small compared to Bluesky, let alone larger commercial networks, and most instances are much much smaller. Then again, their have been exceptions; [the Taliban shut down queer.af](https://www.theverge.com/2024/2/12/24071036/queer-af-mastodon-taliban-shut-down-afghanistan?ref=thenexusofprivacy.net) in 2024, and switter.at was [banned by Cloudflare in 2018](https://www.theverge.com/2018/4/19/17256370/switter-cloudflare-sex-workers-banned?ref=thenexusofprivacy.net) and then [shut down in 2022](https://www.theguardian.com/australia-news/2022/feb/15/now-we-dont-have-a-safe-place-sex-workers-social-media-site-switter-shuts-down-amid-legal-fears?ref=thenexusofprivacy.net) because of anti-sex work and anti-LGBTQIA2S+ legislative changes in Australia, the UK, and the US. Going forward, whether the Fediverse can continue to fly under the radar really depends how aggressive regulators are. Since conservative organizations like the Heritage Foundation have talked about why they see it as a good thing that laws like Mississippi's target LGBTQIA2S+ people, there's certainly grounds for concern. And even instances based outside the US may still be vulnerable. For example, mastodon.social is run by Mastodon gGmbH, which also produces the official mobile apps. Could Mississippi use mastodon.social's non-compliance to pressure Apple and Google to block the Mastodon mobile app? And Rochko's on the board of Mastodon's US-based 501(c)(3) non-profit. Could Mississippi try to use mastodon.social's non-compliance to strip the US non-profit's 501(c)(3) status? There may be ways around these issues. Rochko has announced he's stepping down as CEO, and Mastodon gGmbH is in the process of [handing control to a new (European-based) non-profi](https://www.theverge.com/2025/1/13/24342603/mastodon-non-profit-ownership-ceo-eugen-rochko?ref=thenexusofprivacy.net)t organization, so hopefully they're thinking through these kinds of complexities as they reorganize. Still, there's definitely grounds for concern – not just for mastodon.social, but for any instance with ties to the US. > "Decentralized social network Mastodon says it can’t comply with [Mississippi’s age verification law](https://techcrunch.com/2025/08/28/mississippis-age-assurance-law-puts-decentralized-social-networks-to-the-test/?ref=thenexusofprivacy.net) — the same law that saw rival [Bluesky pull out of the state](https://techcrunch.com/2025/08/24/bluesky-blocks-service-in-mississippi-over-age-assurance-law/?ref=thenexusofprivacy.net) — because it doesn’t have the means to do so." > > – Sarah Perez in [Mastodon says it doesn’t ‘have the means’ to comply with age verification laws](https://techcrunch.com/2025/08/29/mastodon-says-it-doesnt-have-the-means-to-comply-with-age-verification-laws/?ref=thenexusofprivacy.net) on *TechCrunch* And I have to say, Mastodon gGmbH's statement to *TechCrunch* certainly hasn't helped matters. I can certainly see why Mastodon gGmbH has decided not to comply with Mississippi's law, and the choice not to devote their limited development resources to better supporting a privacy-invasive censorship technology makes a lot of sense. Still, the statement as reported in this article paints a big target on all Mastodon instances – and the official Mastodon app as well. And it's all so unnecessary, too! Mastodon software makes it easy for admins to screen signups before approving them, and "admin notes" allow recording per-account information if desired, so even though it doesn't provide direct support for age verification technologies, it very much *does* provide "the means" for each instance to decide whether or not to comply with the laws in the relevant jurisdiction. Why didn't they frame their statement in a way that emphasizes this? Sigh.[3](#notes) ![Rudy wants revolution (‪@rude1.blacksky.team‬): Aug 24: "this law proves atproto isn't decentralized". Aug 25: I post that Blacksky won't do this because we don't track users specific geolocation. Aug 28: TechCrunch reports that Blacksky doesn't track users specific geolocation. Aug 29: "actually this does apply to Mastodon but we don't track users".](https://thenexusofprivacy.net/content/images/2025/09/this-law-proves.png) At any rate, the Fediverse and the ATmosphere have wound up in somewhat similar places here. Unsurprisingly, this wound up kicking off yet another round of not-particularly-productive discourse in the Fediverse about whether or not Bluesky and AT Protocol are decentralized – see the "And yet ..." section of [This is what solidarity looks like](https://thenexusofprivacy.net/what-solidarity-looks-like/) for some of the details. Once again, sigh. ## Some interesting discussions With all that as background, here are links to some interesting discussions of the Mississipi law as it relates to decentralized social networks. - Ashton Pittman's [Editor's Note | State Law Compels Bluesky to Block Mississippi IPs](https://www.mississippifreepress.org/editors-note-bluesky-blocks-mississippi-ips-citing-states-age-verification-law-free-speech-and-privacy-concerns/?ref=thenexusofprivacy.net), on *Mississippi Free Press,* has perspectives from a media organization directly affected by the law – unsurprisingly, since one of the many *intended* consequences of laws like this is to limit access to independent media that's critical of the state. "\[T\]his is a significant blow. We [left Twitter earlier this year](https://www.mississippifreepress.org/editors-note-this-bird-has-flown-the-coop-why-the-mississippi-free-press-is-leaving-x/?ref=thenexusofprivacy.net) for a lot of reasons, and have since made Bluesky our main social media platform (it’s also where we have the most followers)." - Joshua Benton's [Mississippi’s onerous new social platform law (and the threat of big fines) has led Bluesky to block its users in the state](https://www.niemanlab.org/2025/08/mississippis-onerous-new-social-platform-law-and-the-threat-of-big-fines-has-led-bluesky-to-block-its-users-in-the-state/?ref=thenexusofprivacy.net), connects the law to "Mississippi’s long, sad history of trying to “protect” its citizens from the influence of outside media, often doing so under the banner of protecting children" and the way that "northern Black newspapers like the [Chicago Defender](https://encyclopedia.chicagohistory.org/pages/248.html?ref=thenexusofprivacy.net) that reported on anti-Black violence and advocated for the Great Migration were [blocked from circulation in Mississippi](https://nmaahc.si.edu/explore/stories/remembering-chicago-defender-print-edition-1905-2019?ref=thenexusofprivacy.net#:~:text=The%20Defender%20created%20distribution%20networks,that%20will%20never%20be%20forgotten.)." - Mike Masnick's [Mississippi’s Broken Age Verification Law Forces Bluesky To Block All State Users](https://www.techdirt.com/2025/08/25/mississippis-broken-age-verification-law-forces-bluesky-to-block-all-state-users/?ref=thenexusofprivacy.net) on *TechDirt* is a deep dive from a Bluesky board member who's written extensively about age verification laws over the years - Laurens Hof's [Some thoughts on Bsky, age verification and mississippi law](https://connectedplaces.leaflet.pub/3lx2sjrgqj22s?ref=thenexusofprivacy.net) and followup in (both on *Connected Places)* are both insightful, as is his earlier [Age Verification Laws: Are the New Social Networks Different, Or Not At All?](https://connectedplaces.online/age-verification-laws-are-the-new-social-networks-different-or-not-at-all/?ref=thenexusofprivacy.net) - wandering.shop admin phildini asks a question that's on a lot of people's minds: "[What happens if Bluesky, the main app owned by the company, goes down tomorrow?](https://wandering.shop/@phildini/115087173453216360?ref=thenexusofprivacy.net)" Ted Han of the ATProto Community Fund replied with some excellent perspectives, and a very productive discussion ensued. My take: while things would be very chaotic for a while, there are enough independent infrastructure projects in the works that the network be able to start recovering relatively quickly. That being said, the devil is in the details, and there certainly are a lot of details to be worked out. [More details here](https://neuromatch.social/@jdp23/115107435947310644?ref=thenexusofprivacy.net). - There were also a heck of a lot of discussion involving people from Mastodon and other Fediverse software arguing that this incident proves that Bluesky isn't actually decentralized. This is a tedious enough subject that I moved it ion to a separate post, [Can we please stop arguing about whether Bluesky is decentralized?](https://thenexusofprivacy.net/can-we-please-stop-arguing-about-whether-bluesky-is-decentralized/) ## Now's a good time to start thinking seriously about some hard questions Hopefully one clear takeaway from the whole situation is that both the ATmosphere and the Fediverse need to start planning more seriously for the possible impact of governmental action that affects a large chunk of the network. - What happens in the ATmosphere if the fascist US government decides to target Bluesky for its supposed wokeness – and what happens in the Fediverse if the anti-LGBTQIA2S+ US government decides to target it? - What happens in the Fediverse if regulators in multiple countries decide to target Mastodon for ignoring their laws? - What happens in either of these networks as jurisdictions around the world add more hostile legislation – age verification, ID checks, and other surveillance and censorship requirements – and authoritarian governments ratchet up their efforts to target dissent, LGBTQIA2S+ people, immigrants, and other marginalized groups? - Politically, how do we organize and push back against this hostile legislation? Now's a good time to start thinking seriously about those questions. ## Appendix: Why age verification laws are bad > "A broad coalition of organizations dedicated to LGBTQ+ rights, abortion access, rights for youth, privacy, and freedom of speech have issued a letter to US lawmakers warning that online ID check bills, which would mandate highly privacy-invasive age verification through third party companies, would threaten freedom of information, the very usability of the internet, and sacrifice digital privacy, along with sacrificing the young people these laws claim to protect." > > [Online ID Checks Will Ruin the Internet: 90 Reproductive Rights, LGBTQ, Civil Rights Groups Speak Up Against Widespread Age Verification Bills](https://www.fightforthefuture.org/news/2025-03-06-online-id-checks-will-ruin-the-internet-90-reproductive-rights-lgbtq-civil-rights-groups-speak-up-against-widespread-age-verification-bills/?ref=thenexusofprivacy.net), April 25, 2025 With so many age verification bills popping up all over the world, there's plenty of material available about how harmful they are. The [Internet Society's amicus brief to the Supreme Court](https://www.supremecourt.gov/DocketPDF/23/23-1122/326510/20240920161551554%5F23-1122%20Amicus%20Brief.pdf?ref=privacy.thenexus.today) in a case about Texas' age verification law has a particularly good analysis of some of the many reasons these laws are so horrible. Here are some of their section headings: - Existing Age Verification Technologies Are Often Ineffective and Present Privacy and Security Risks - The Ineffectiveness of Current Age Verification Methods, Combined with the Technologies’ Security and Privacy Risks, Unconstitutionally Burden Adults’ Access to Constitutionally Protected Speech and Render \[the Law\] Both Under and Overinclusive - Implementing \[the Law\] With Current Technology Will Necessarily Prevent Some Adults from Accessing Some Protected Content Altogether - The Security and Privacy Risks Associated with Current Technologies–Including That Sensitive Browsing Activity Will Be Deanonymized–Also Burdens Adults’ Access to Protected Content - \[The Law\] Will Also Fail to Achieve its Purpose of Protecting Children Because They Can Easily Circumvent Current Age Verification Technologies If age verification doesn't work and has such major downsides, why are so many laws requiring it getting passed all around the world? For one thing, the problems these laws are trying to address are real and urgent. Kids and teens are in fact at risk online. Big tech companies really do exploit kids and teens. Legislators are under pressure to do something about it. The people pushing these laws claim they'll be effective and will help to rein in big tech; and they ignore or minimize the downsides. So even though legislators know that the laws are imperfect, well, at least passing them is doing *something*. And conservative organizations who support these bills make no secret of the fact that they're designed to attack LGBTQIA2S+ youth; for conservative politicians, that's an attraction too. Progressives don't have this as a goal, but often don't understand how harmful these biolls are to LGBTQIA2S+ youth and people seeking reproductive and gender-affirming health care. And even when legislators try to craft legislation that protects privacy, in practice they often fall short. My [testimony](https://thenexusofprivacy.net/sb-5708-age-verification-testimony/) earlier this year on a proposed age verification bill here in Washington state has a good example of this: > "In addition, the bill as written does not restrict sharing information gathered for age estimation purposes with a third party age estimation service based in a state where accessing information about reproductive health care and/or gender-affirming care is criminalized – at which point law enforcement can access this data to target LGBTQ+ youth – as well as anybody seeking abortions or exploring trans or non-binary identities." And that's in Washington state, where our laws like My Health My Data and the Shield Law have strong protections for reproductive health care and gender-affirming care. The situation in Mississippi is obviously a lot worse, and their law provides significantly less protections than the insufficient ones in the proposed Washington bill (which thankfully didn't pass). As Mike Masnick says, > "Here at Techdirt, we’ve been warning about the dangerous negative consequences of [age verification mandates](https://www.techdirt.com/tag/age-verification/?ref=thenexusofprivacy.net) for years. But even then there are variations in the pure ridiculousness of some of these laws. Some can be dealt with. Some are effectively impossible. Enter [Mississippi’s HB 1126](https://billstatus.ls.state.ms.us/documents/2024/dt/HB/1100-1199/HB1126SG.pdf?ref=thenexusofprivacy.net)." For a deep dive on the problems with the Mississippi law, see [EFF to Fifth Circuit: Age Verification Laws Will Hurt More Than They Help](https://www.eff.org/deeplinks/2024/10/eff-fifth-circuit-age-verification-laws-will-hurt-more-they-help?ref=thenexusofprivacy.net) (which summarizes and links out to the brief that Electronic Frontier Foundation, the ACLU, and ACLU of Mississippi filed last October) and the [joint amicus brie](https://cdt.org/insights/cdt-joins-amicus-brief-as-the-supreme-court-considers-its-next-age-verification-case/?ref=thenexusofprivacy.net)f to the Supreme Court from Foundation for Individual Rights and Expression (FIRE), joined by EFF, Center for Democracy and Technology (CDT), National Coalition Against Censorship (NCAC), Student Press Law Center, and Woodhull Freedom Foundation, And for an international focus - Open Rights Group's [How to Fix the Online Safety Act: A Rights First Approach](https://www.openrightsgroup.org/publications/how-to-fix-the-online-safety-act-a-rights-first-approach/?ref=thenexusofprivacy.net) looks at the problems with the UK's legislation – and ways to fix it. - Ange Lavoipierre's [With six months until teen social media ban, experts don’t think tech is viable](https://www.abc.net.au/news/2025-06-19/teen-social-media-ban-technology-concerns/105430458?ref=thenexusofprivacy.net) looks at the fiasco-in-progress in Australia. - EFF's [Digital Identities and the Future of Age Verification in Europe](https://www.eff.org/deeplinks/2025/04/digital-identities-and-future-age-verification-europe?ref=thenexusofprivacy.net) and [Age Verification in the European Union: The Commission’s Age Verification App](https://www.eff.org/deeplinks/2025/04/age-verification-european-union-mini-id-wallet?ref=thenexusofprivacy.net) look at what's happening in the EU. > If you're in the US,[ Stop Online ID Checks](https://www.stoponlineidchecks.org/?ref=thenexusofprivacy.net) is a national campaign to fight these kinds of laws. > > If you're in the UK, Open Rights Group makes it easy to [Tell your MP: The Online Safety Act isn’t working](https://action.openrightsgroup.org/tell-your-mp-online-safety-act-isn%E2%80%99t-working?ref=thenexusofprivacy.net) > And if you're in some other country, there's very likely some campaign in process wherever you are! ## Notes 1 There aren't yet (as far as I know) any legal analyses of whether Bluesky blocking Mississippi is enough to comply with the law. If a minor from Mississippi signs up on Bluesky using a VPN or a non-Blueksy app, and Bluesky doesn't do an age check, Bluesky could still get sued. Will the courts view Bluesky's efforts as sufficent, or as an attempt to get around the law? Then again, [Megan Farokhmanesh's coverage in Wired](https://www.wired.com/story/bluesky-goes-dark-in-mississippi-age-verification/?ref=thenexusofprivacy.net) quoted a Mississippi state legislator who acknowledged "the potential challenges faced by smaller providers in complying with these standards" and expressed optimism Bluesky and Mississippi will reach an "amicable agreement," so another way to look at Bluesky's decision is as a negotiating tactic. 2 As I was first writing this post, I saw [Tech for Palestine's announcement](https://updates.techforpalestine.org/announcing-buycatvpn-is-live-privacy-without-israeli-tech/?ref=thenexusofprivacy.net) that Boycat (makers of a popular ethical shopping companion) has just introduced [Buycat VPN](https://www.boycat.io/vpn?ref=thenexusofprivacy.net) – although I haven't yet seen any detailed analyses of their privacy and security guarantees. 3 Of course it's possible that the reporting makes it seem worse than it is. After reading the *TechCrunch* I asked Mastodon gGmbH for a copy of the statement. They acknowledged the request, and said they were "thinking about how and where to do that," although when I checked back a couple of weeks later they confirmed that they hadn't yet posted it anywhere. ## Update Log Ongoing: typo fixes, adding links, labeled updates August 28: first published ... the day before *TechCrunch* reported Mastodon's official position, oh well. September 12: updated with Mastodon's position, reactions, and Bluesky's decisions for South Dakota and Wyoming November 29: tweak description of why so many of these bills pass in the Appendix. December 9: include Bluesky's revised Mississippi policy, Wisconsin law banning VPNs, and Australia social media ban for people under 16, add info up front for people looking for workarounds ### Notes on genocide prevention and other kinds of organizing, mutual aid, and activism on social networks URL: https://thenexusofprivacy.net/notes-on-genocide-prevention-and-other-kinds-of-organizing-mutual-aid-and-activism-on-social-networks-d/ Last updated: 2026-04-16T03:30:20.000Z *Part 4 of* [*If not now, when?*](https://thenexusofprivacy.net/if-not-now-when/) *Do you have thoughts on the general topic or specific feedback on this post? Please join the discussions on Mastodon, Bluesky, or Lemmy – or use* [*the CryptPad form here*](https://cryptpad.fr/form/?ref=thenexusofprivacy.net#/2/form/view/d9Ag8SlOHFrBLdVG9+M00bAilHuQLjqQL27OdmuVD-s/) *if you prefer (don't be surprised if it takes a few seconds to come up).* > "Mutual aid. Organizing. Sharing, contextualizing, and making meaning of news and health information to counter propaganda and information overload. The use cases for alternative social networks – not controlled by techbro white supremacist CEO's working with their cronies in authoritarian governments – practically write themselves in today's world. And with so many talented social scientists, designers, systems thinkers, and developers directly impacted by DOGE, MAGA, et al, there are a lot of people with the right skills for these new networks to make rapid progress." > > – [If not now, when? Mutual aid and organizing in the fediverses, the ATmosphere, and whatever comes next](https://thenexusofprivacy.net/if-not-now-when/), March 2 > "You probably won't be surprised to hear that we didn't solve all of these issues during our one-hour discussion. We did however decide on some concrete next steps: collecting and prioritizing organizing, mutual aid, and activism needs – and then working with projects and organizations who are (hopefully) incentivized to make progress on these issues" > > – [*More notes on Organizing, Mutual Aid, and Activism on decentralized social networks*](https://thenexusofprivacy.net/more-notes-on-organizing/)*, April 3* It's been a busy month, and everybody involved in the discussions is stretched in a million ways. Fortunately, enough people have found enough scraps of time here and there that we've made a lot of progress. By the time of our May 1 meeting, we not only had a list of several projects and organizations interested in working with us, we had also collected needs for many of the important high-level use cases on our current list. ![High level use cases: Genocide prevention in multiple languages. Collective sense-making. Safety and community defense – online, and helping in the physical world. Mutual Aid. Anti-fascist, anti-racist, pro-LGBTQIA2S+ organizing spaces. Influencing broader narratives. Amplifying public actions, events, media coverage, announcements, etc Developing, refining, and communicating strategy, plans, and priorities. Inviting, recruiting, and onboarding new people (while remaining conscious of the risks of infiltration). Working in coalitions. Disaster response. Legislative and electoral activism. Resisting authoritarian governments. Finding community, support, respite, and joy](https://thenexusofprivacy.net/content/images/2025/05/high-level-use-cases-1.png) A slide from the May 1 meeting -- [see the full slide deck here.](https://thenexusofprivacy.net/data/organizing-0501.pdf) You probably won't be surprised to hear that we didn't discuss all of these in detail during the hour-long meeting. In fact we spent most of the meeting digging into the first one. And for good reason! As DAIR's recent paper on [The Role of Expertise in Effectively Moderating Harmful Social Media Content](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net) notes, > "A number of researchers, journalists and victims of genocide have documented the extent to which social media platforms have spread genocidal content \[[18](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0018), [79](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0079), [93](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0093)\], leading to lawsuits against companies like Meta by victims of genocide and civil society leaders \[[5](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0005), [48](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0048)\]. This failure to adequately moderate genocidal content, especially in languages and regions major social media platforms do not invest in, has been discussed in a number of contexts \[[18](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0018), [75](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0075), [78](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0078)\]. For example, the 2020-2022 war in the Northern Ethiopian region of Tigray has been described as the worst genocide of the 21*st* century thus far \[[63](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0063)\], with hateful content rampant on social media platforms during the war \[[33](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0033), [52](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0052), [70](https://dl.acm.org/doi/10.1145/3706598.3714010?ref=thenexusofprivacy.net#core-Bib0070)\]." Prithvi Iyer's [What a New Study Reveals About Content Moderation in Tigray](https://techpolicy.press/what-a-new-study-reveals-about-content-moderation-in-tigray?ref=thenexusofprivacy.net), on *Tech Policy Press*, is a good summary of DAIR's recent work, and Erin Kissane's series [Meta in Myanmar](https://erinkissane.com/meta-in-myanmar-full-series?ref=thenexusofprivacy.net) is a detailed look at the role social media played in the genocide of the Rohingya people in Myanmar. And as DAIR's statement that [Social Media Platforms Are Spreading Violent Warmongering Content Encouraging All-Out War Between Ethiopia and Eritrea, Again](https://www.dair-institute.org/blog/tigray-social/?ref=privacy.thenexus.today) warns, Big Tech companies like Meta and TikTok still haven't addressed the underlying problems. Still, that was only one of the topics we covered. Here's a writeup of the notes from the meeting, along with some related thoughts. - [Organizing in a pluriverse](#pluriverse) - [Anti-genocide activists' needs provide great insights on opportunities to do a lot better than Big Tech social networks](#insights) - [Anti-genocide activsists aren't the only ones with these needs](#common-needs) - [Challenges to address](#challenges) - [Look at us, we're doing organizing on decentralized social networks!](#organizing) - [Appendix: Friendly(ish) spaces, contested terrain, hostile ground](#appendix) - [Previous posts in the series](#previous) - [Notes](#notes), with additional links and references and the occasional hopefully-amusing comment ## Organizing in a pluriverse > "Our research found a **transition to a pluriverse of options** could be the most viable way forward: this might include repurposing existing platforms, embracing low-tech approaches, and developing innovative alternatives that meet the needs of social justice organizations and marginalized communities." > > – Engine Room's report on [Exploring a transition to alternative social media platforms for social justice organizations in the Majority World](https://www.theengineroom.org/library/new-report-exploring-a-transition-to-alternative-social-media-platforms-for-social-justice-organizations-in-the-majority-world/?ref=thenexusofprivacy.net) If you're not familiar with the term, "pluriverse" has its origins in decolonial theory.[0](#notes) [Pluriverse: A Post-Development Dictionary](https://cup.columbia.edu/book/pluriverse/9788193732984/?ref=thenexusofprivacy.net) (2019) contains over one hundred essays on "transformative initiatives and alternatives to the currently dominant processes of globalized development, including its structural roots in modernity, capitalism, state domination, and masculinist values" ... Hey that sounds like a pretty darn good description both of the values of Meta and Xitter and Big Tech in general – and the opportunities for transformative alternatives we're exploring![1](#notes) So before we focused on anti-genocide activists' perspectives, we talked a bit how decentralized social network ecosystems like the ATmosphere and the ActivityPub Fediverse fit into a broader pluriverse. ![A pluriverse: multiple social networks. Need to think about operating in different kinds of spaces. Friendly(ish) spaces, where we (mostly) control the platforms and maybe even the software: Can provide more safety and faster tech/social improvement here – but lower reach. Contested terrain. Hostile ground, platforms and software, controlled by and/or supporting fascists, eugencists, genocide perpetrators, white supremacists, etc: the technology and policies are stacked against us; Ii’s where most people are today, so we need to operate there Apps, bridges, and “low-tech” tactics span networks. Apps/bridges require API access; may be limited and tracked – especially on hostile platforms. “Low tech” / no-tech approaches can more flexible although less efficient -- cut-and-pasting, sending a link to a friend, list of accounts to block in a file, taking notes on paper, in-person discussions ](https://thenexusofprivacy.net/content/images/2025/05/pluriverse-slide.png) The appendix on [Friendly(ish) spaces, contested terrain, hostile ground](#appendix) goes into more detail on these distinctions, the connectivity between different networks, and the implications from a threat modeling perspective.[2](#fn-dark-forest) ## Anti-genocide activists' needs provide great insights on opportunities to do a lot better than Big Tech social networks Even. though we had only talked to a handful of anti-genocide activists (one of our next steps is to get more input), their needs provide some great insights on opportunities to do a lot better than Big Tech social networks – although also highlighted some things they do well from activists perspective, as well as on challenges and limits of using newer social networks like Bluesky and Mastodon. For example: - A safer online space - Context-aware moderation including paying attention to languages other than English - Robust mechanisms for deplatforming bad actors - Better solutions than blocklists - Holding important information for longer periods so it doesn’t get lost into the abyss – more than just pinning posts - Avoiding getting censored by the platform providers - Widely disseminating information on commercial social networks, despite the intense censorship – because that's where the people are, and the same functionality and user interfaces that keep people addicted is also very good for awareness The last point relates directly to the pluriverse model. For some activists, it's easiest to reach their community on Facebook, TikTok, and/or Instagram. For some, Xitter (even today) plays a key role because that's where journalists, civil society organizations, and politicians are. None of this is going to change overnight. Decentralized social networks certainly have the potential to be a lot better than commercial social networks on most of these issues. Then again, there's still a lot of work to be done. Consider the linked topics of context-aware moderation and robust deplatforming mechanisms (both critical for safer online spaces): - Blacksky is a great example of leveraging the support for moderation services built into Bluesky and the ATmosphere (the ecosystem of software using Bluesky's AT Protocol) to provide context-aware moderation, and there are also language-specific moderation services. Blacksky also includes functionality like BanFromTV, aka deplatforming (from Blacksky, although not Bluesky as a hole). - On Mastodon and in the broader ActivityPub Fediverse, Erin Kissane and Darius Kazemi's [Governance on Fediverse Microblogging Servers](https://fediverse-governance.github.io/?ref=thenexusofprivacy.net) note that "thoughtfully governed" medium-sized instances (communities) "are especially well positioned to offer a model of high-context, culturally sensitive online community that outperforms most interactions with centralized platform governance." Not only that, groups of cooperating instances (communities) sharing data using tools like The Bad Space can often put pressure on other communities to deplatform bad actors – and can use the blunt but powerful tool of mass defederation to deplatform entire communities. But there's certainly a lot of work to be done as well ... - Bluesky frequently refuses to deplatform bad actors (see [Bluesky and The Battle of Wormtongue](https://thenexusofprivacy.net/bluesky-and-the-battle-of-wormtongue/) for an example), and ATmospheric communities like Blacksky are only just starting to explore ways of working together. - Defederation in the ActivityPub fediverse has significant downsides today; there aren't any good options when large instances like mastodon.social refuse to deplatform a bad actor; and most large instances have refused to deplatform Meta's Threads – which is just as badly moderated as any other Meta platform. Despite the (very real) limitations, it's certainly encouraging that there are at least two different "technology stacks" that are making progress. And there are certainly some straightforward opportunities for improvement. Take keyword blocking, a specific request from one of the anti-genocide activists. Of course, keyword blocking is far from a perfect solution, and it potentially has downsides as well (including mistakenly blocking reclaimed slurs or keywords used in in-group contexts). Still, despite its limitations it can be very useful. And Facebook et al don't even block well-known slurs in most languages, so there's plenty of room for significant improvement. Meanwhile in friendlier spaces: - Bluesky's moderation services are an easy way to do this kind of blocking, and the "Moderation Relay" that Blacksky's Rudy Fraser mentions [here](https://bsky.app/profile/rudyfraser.com/post/3lo7zgsh6bk2a?ref=thenexusofprivacy.net) could lead to aggregation of multiple language-specific keyword blockers. - In the ActivityPub Fediverse, [instance catalogs like The Bad Space and FediSeer and recommendation systems like FIRES](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/) could easily[3](#fn-easily) be adapted to help admins and mods exchange and vet proposed keyword blocks; some platforms offer tools for admins and mods to block keywords at the instance level Right now though, there aren't good keyword lists for most languages. The communities being targeted have the context, knowledge, and skills to develop high-quality lists of keywords to block – including using low-tech and no-tech approaches. Once those keyword lists exist, moderatiom services and moderation relays in the ATmosphere could apply them; so could instance catalogs and recommendation systems. Organizations like IFTAS (the federated trust and safet non-profit) could help share this information with volunteer moderators across ActivityPub Fediverse and the ATmosphere. Technology improvements can help here (platforms like Mastodon could provide tools for bulk upload of keyword filters for admins and individual users) but they're not barriers; if enough people are interested can start now, without waiting for any new functionality. Okay, there's a lot of details to work out but once again ... it's encouraging! ## Anti-genocide activsists aren't the only ones with these needs Speaking of next steps at this point we realized that we had less than fifteen minutes left in the meeting and almost everybody had a hard stop at the top of the hour. So we quickly went through a few slides highlighting a few places where the needs the anti-genocide activists mentioned are similar to the issues that come up when exploring other use cases. - Collective sense-making projects are all about holding important information for longer periods so it doesn’t get lost into the abyss. They want to get information out widely on commercial social networks too - Ditto for mutual aid organizers – and many other organizers as well, since "meet people where they are" is a core principle of organizinge, and today they're on Facebook, Instagram, TikTok, Xitter, etc . - Safety is a widely-shared need; as Engine Room notes > **Alternative platforms, like mainstream options, also face challenges around safety, abusive content and inadequate content moderation.** Further support is needed to ensure that self-managed platforms do not perpetuate the same inequities and harms experienced on mainstream options. Likewise, more attention should be given to developing community content moderation practices. It's also worth highlighting that many of the needs the anti-genocide activists mentioned are similalry highlighted in other work. Article 19's [Queer Resistance to Digital Oppression](https://www.article19.org/queer-resistance-to-digital-oppression/?ref=thenexusofprivacy.net) (based on input from over 5000 LGBTQI+ people in 8 countries across the Middle East and North Africa), for example, discusses the importance of safety, responding to hate speech in language other than English, and communications lines with platform vendors. A recent paper on [Social Media for Activists: Reimagining Safety, Content Presentation, and Workflows](https://dl.acm.org/doi/10.1145/3706598.3713351?ref=thenexusofprivacy.net), based on interviews with 14 activists from an environmental and a queer-feminist movement in Germany, notes that "The key finding is that on- and offline safety is their main need." Hey wait a second, I'm noticing a pattern here. ## Social media is only part of the bigger picture One thing that's become steadily clearer to me over the course of this project so far is how important it is to consider social media in the context of the overall context of what organizers are doing. Take the high-level use case of "developing, refining, and communicating strategy, plans, and priorities," one that's near and dear to my heart because it's one of the things we're doing on this project. As part of this, discussions on social media – in public, in private groups – can certainly be helpful in gathering input and feedback; and once we've come up with something, social media will certainly be useful for sharing the information. But that's only a small part of what we're doing. We also need to write and review documents and presentations, schedule and hold meetings to discuss, take notes, make decisions, do threat modeling, track action items., etc etc etc. And on the social side we have to deal with questions like who’s at the table, who gets to speak (and who's listened to), how are decisions made, and what gets emphasized in talking points ... plus all the non-technical aspects of project management such as herding cats. It's a lot! ![Tech stack for organizing (etc). Private(ish) messaging: 1-1, small group. Medium-to-large community discussions. Sharing, discussing, discovering, and curating media, links, status, etc. Moderation tooling ."Verification", vouching, web of trust, etc. Threat modeling. Events, calendars, scheduling. Video + audio: streaming, meetings/ rooms, archived. Time-banking. Offers and wants. Marketplace. Job board .Contact sharing. Search. Surveys. Collaborative editing: text, presentations, videos, etc. Project management and facilitation. Decision-making; Budgeting and accounting. Payments. Infrastucture: Identity; Storage; Translation; Platforms like ATProto, Veilid, Spritely, etc ; Mesh networks + Offline-first tech](https://thenexusofprivacy.net/content/images/2025/05/tech-stack.png) ![Social stack for organizing (etc). "Communities". Values, norms and community guidelines, Including mutual aid orientation: sharing what you can, getting what you need. Organizing structures. Governance and “federated diplomacy”. Moderation, Sensemaking .Care work. Learning (including training). Knowledge repositories. Decision making processes. Inviting and welcoming newcomers who share values and find norms compatible, and helping them while also helping them find ways to contribute and help](https://thenexusofprivacy.net/content/images/2025/05/social-stack-1.png) Each of these is a huge discussion in its own right. For example, here's a list of examples we had for "Organizing structures": - Different channels for leadership, trusted members, broader group, network - “Lobby” for newcomers (with greeters), followed by inviting people to group channel(s) - Curated feed (for important announcements, actions, events, news stories, etc) - “Welcome packet”, FAQ, onboarding meetings, and place for newcomers to get help - Status page (possibly with limited visibility) so everybody can see what’s up Note that these structures can be implemented on various technologies. Channels and a lobby can be implemented as separate Signal group chats, channels on a Matrix or Discord server, categories on a NodeBB site, or even multiple fediverse instances (if you're a masochist). A curated feed could be an AT Protocol custom feed, a social media account that boosts interesting posts, or a newsletter with interesting links for the day or week. A status page can be a pinned thread in a NodeBB forum (which is how we're doing it on this project), a Google / CryptPad / NextCloud document with access control, a password-protected web page, a pinned message in a Matrix channel, etc etc etc. That said, the technology still matters: specific affordances and usability tradeoffs of different platforms can have an impact on how effectively different groups can leverage them. So there's almost certainly a lot of room for improvement here as well. These are all challenges we'll have to address in our own organizing, so we can't ignore these issues. Then again, I'm not suggesting that we should expand our scope to cover the entire tech and social stack – we've already got more than enough on our plate already just focusing on the social media aspects! So hopefully as we move forward we'll learn techniques to do all these things more effectively – and find opportunities to collaborate with people and organizations working to move the state of the art forward in all these other areas as well. ## Challenges to address > "In order for this to be successful, however – in other words, to imagine and build an ecosystem of community-centered alternatives where organizations can mobilize, organize and connect – we need to address a number of challenges, including tackling technological barriers, building resilience to the harms of mainstream social media, and strengthening capacity." > > – [Exploring a transition to alternative social media platforms for social justice organizations in the Majority World](https://www.theengineroom.org/library/new-report-exploring-a-transition-to-alternative-social-media-platforms-for-social-justice-organizations-in-the-majority-world/?ref=thenexusofprivacy.net) notes It's also important to keep in mind how much work still needs to be done to make even the somewhat-safer, friendly(ish) areas of the pluriverse useful to organizers and activists – especially for people who aren't techies, don't have the connectivity and hardware that so many people in the US and Western Europe take for granted, and/or use assistive technology. And there are lots of other holes as well – like threat modeling, for example, which is almost never done today (and even when it is done often doesn't involve the people from decentered communities who are the targets of the threats). ![Gaps across today’s tech stack. Design Justice and Design from the Margins perspectives. Multi-network (“pluriverse”) focus. Accessibility (disability, income, language, Global Majority needs, …). Focus on safety for marginalized people (including threat modeling). Consent-based architectures. Communicating across differences (language, background, norms and customs, terminology, education/expertise). Offline-first Trauma-informed design. Security and privacy. “Distros” – packaged tech stack, with social support. Ecosystem of coops, non-exploitative small business and individuals, community-focused non-profits, etc. Focus on well-being and joy](https://thenexusofprivacy.net/content/images/2025/05/Organizing--Mutual-Aid--and-Activism---May-1.png) Still, there are clearly paths forward, described in Engine Room's research, De|Center's discussion draft of [Design from the Margins: A Methodology to De-weaponize Tech](https://www.de-center.net/s/Discussion-draft-Methodology-to-De-weaponize-Tech-FOR-PUB-Apr-2-update.pdf?ref=thenexusofprivacy.net), and the work the Design Justice Network has done and continues today. And the good news is that we're starting to get a much clearer picture of where we can make incremental progress – as well as the need for more transformative approaches longer-term. Thinking of today's implementations as prototypes – useful in some situations, but also with major limitations – the needs we're surfacing here align well with all three complementary aspects of the path forward I talked about in [If not now, when?](https://thenexusofprivacy.net/if-not-now-when/) - Find ways to leverage and improve the current prototypes - Build whatever comes next. - Help people move from corporate social networks - without losing their support networks, ties to communities, and connections with friends and family. ## Look at us, we're doing organizing on decentralized social networks! In the last few minutes of the meeting we very quickly talked about ongoing communications.[4](#fn-very-quickly) One of the complexities of grassroots organizing is that most people won't be able to make it to most meetings; everybody's ridiculously busy with other incredibly important stuff, and a project like this isn't anybody's top priority. So it has to be easy for people who have the time to keep up what's happening even if they're not at meetings, and for people who haven't been able to track the details to very quickly see what the top priorities and next steps are, and who's working on what, if and when they *do* have a bit of time available. Easier said than done, of course, but here's how we're going to try to approach it: - A NodeBB forum, with a Status Page (including a list of upcoming meetings and other events) and general discussions - A Signal group for notifications of upcoming meetings, sharing high-priority links and important status updates. - Different channels for different working groups, often probably hosted elsewhere; for example, it might make sense to have discussions for the project on keyword blocking in the existing IFTAS Connect community (since many fediverse moderators are alreaedy members) - Regular meetings, increasing the tempo from one a month and thinking about how to adjust times to ensure that people who aren't in the US and Western Europe can participate. Fortunately I don't mind staying up late from time to time, and even though I am most definiitely *not* a morning person I can get up very early every now and then. - Looking forward, potentially adding a Matrix chat to complement the forum, less-structured online time (welcome sessions for people just joining the group, "office hours" to talk about whatever topics people want, something along the lines of Clubhouse rooms or Twitter spaces to talk about the topic of the day), and maybe even an online workshop to explore some of these topics in more detail. But, let's not get ahead of ourselves! And of course we wrapped up the meeting by summarizing action items and next steps, including setting up the status page for the group ... Why yes, now that you mention it, we're doing a lot of the tasks – and dealing with a lot of the challenges – that have shown up earlier in the discussions. Look at us, we're doing organizing on decentralized social networks![5](#fn-look-at-us) To be continued ... ## Previous posts in the series - [If not now, when? Mutual aid and organizing in the fediverses, the ATmosphere, and whatever comes next](https://thenexusofprivacy.net/if-not-now-when/), including a reading list - [Notes (and thoughts) on organizing in the fediverses and the ATmosphere](https://thenexusofprivacy.net/notes-on-organizing-in-the-fediverses/), focusing on perspectives of US-based progressive activists - [More notes on Organizing, Mutual Aid, and Activism on decentralized social networks](https://thenexusofprivacy.net/more-notes-on-organizing/), the previous meeting ## Appendix: Friendly(ish) spaces, contested terrain, hostile ground ![A diagram, showing friendly(ish) spaces at the top,.contested terrain in the center, and hostile ground at the bottom-- described in the text below](https://thenexusofprivacy.net/content/images/2025/10/pluriverse-diagram-1.png) While it wasn't the main focus of this meeting, it's worth looking at this distinction between different areas in a little more detail. - Friendly(ish) spaces, ideally hosted on platforms we (mostly) control and using software that we can at least influence. Social media examples on distributed social networks include Blacksky, some areas of the "[free fediverses](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)" such as DAIR's presence at dair-community.social and [DAIR-tube](https://peertube.dair-institute.org/?ref=thenexusofprivacy.net);, and next-generation projects like Spritely and Veilid; self-hosted Matrix, Nextcloud, CryptPad, or Jitsi servers are examples elsewhere in the tech stack We can provide more safety and faster improvement here ... but at least for now the reach is a lot lower. Still, these can be useful in a lot of ways – for example as organizing spaces – and over time we can hopefully draw more people here. - Contested terrain, where the platforms and software aren't yet fully siding with genocide perpetrators (etc), and communities can have some influence over the software development (for example by leveraging open source and open protocols). The ATmosphere and the ActivityPub Fediverse as a whole are examples of this.6 - Hostile ground: centralized platforms like Xitter, Facebook, Instagram, TikTok, etc), decentralized platforms like Threads, controlled by the currently dominant processes of globalized development, based in surveillance capitalism and data colonialism, supporting fascists, eugencists, white supremacists, perpetrators of genocide, etc. The technology and policies are stacked against us ... but it’s where most people are today, so organizing, mutual aid, and activism needs to happen there as well. As Afsaneh Rigot says in [Can We Build Tech That Is Not Oppressive?](https://the-decenter.ghost.io/can-we-build-tech-that-is-not-oppressive/?ref=thenexusofprivacy.net) > "Regardless of abuse from tech companies, people in the US and around the world will continue to use these platforms, especially the most marginalized. The same platforms become people’s lifelines despite the dangers." In practice, of course, these categories are somewhat fuzzy and there are all kinds of complexities.7 Still, one of the things this model highlights is the importance of connections between different software in a pluriverse. From a social network perspective, this can be via "bridges" like Bridgy Fed, Mostr, and Threads Fediverse; multi-level apps; or low-tech tactics like cut-and-pasting, sharing links, and making text files of accounts to block (or, less positively, to target). And since some areas of pluriverse are hostile, these connections between neworks and regions are very much a two-edged sword: - Keeping friendly(ish) spaces and contested terrain safer requires thinking about how bad actors can leverages use bridges and apps to launch attacks and reinforce their other efforts.[8](#fn-hostile-attacks) So [social threat modeling](https://thenexusofprivacy.net/social-threat-modeling/) is vital! - More positively, though, these connectors can potentially help different friendlyish spaces work together, including providing support to people operating in and contested terrain and hostile ground. As Erin Kissane highlights in [People in Platforms:](https://youtu.be/mMIhkA8QEKc?si=PczcbqhFvAI-KSWu&ref=thenexusofprivacy.net) threat modeling is only half the story, and we also really need to be thinking in terms of opportunities too, all as part of a collaborative risk-benefit analysis. ## Notes 0 Walter Mignolo's [On Pluriversality and Multipolarity](https://www.degruyterbrill.com/document/doi/10.1515/9781478002017-001/html?lang=en&ref=thenexusofprivacy.net) in [Constructing the Pluriverse: The Geopolitics of Knowledge](https://www.dukeupress.edu/constructing-the-pluriverse?ref=thenexusofprivacy.net) (2018), has a brief summary of his use of pluriversality as "a key argument for calling into question the concept of universality, so dear to Western cosmology." Arturo Escobar's [Designs for the Pluriverse: Radical Interdependence, Autonomy, and the Making of Worlds](https://www.dukeupress.edu/designs-for-the-pluriverse?ref=thenexusofprivacy.net) (2018) maps the principles of autonomous design’s principles to the history of decolonial efforts of indigenous and Afro-descended people in Latin America, and shows how refiguring current design practices "could lead to the creation of more just and sustainable social orders." In [Design Justice, A.I., and Escape from the Matrix of Domination](https://jods.mitpress.mit.edu/pub/costanza-chock/release/4?ref=thenexusofprivacy.net) (2018), Sasha Costanza-Chock notes that > "Escobar draws from decades of work with social movements led by indigenous and Afro-descended peoples in Latin America and the Caribbean to argue for autonomous design. He traces the ways that most design processes today are oriented towards the reproduction of the ‘One World’ ontology. This means that technology is used to extend capitalist patriarchal modernity, the aims of the market and/or the state, and to erase indigenous ways of being, knowing, and doing (ontologies, epistemologies, practices, and life-worlds). Escobar argues for a decolonized approach to design that focuses on collaborative and place-based practices, and that acknowledges the interdependence of all people, beings, and the earth. He insists on attention to what he calls the ontological dimension of design: all design reproduces certain ways of being, knowing, and doing. He’s interested in the Zapatista concept of creating “a world where many worlds fit,” rather than the ‘one-world’ project of neoliberal globalization." In [A social network taxonomy](https://newpublic.substack.com/p/a-social-network-taxonomy) (2023), Ethan Zuckerman describes a pluriverse as "a complex world of interoperable social networks where one can choose a technical architecture and governance structure appropriate to a community’s needs." I'm dropping the requirement for interoperability, or at least loosening it to include the low-tech approaches Engine Room discusses. 1 [Towards a digital pluriverse](https://pluriverse.world/?ref=thenexusofprivacy.net) (2022) from Verses ("a collective of writers, researchers, and technologists co-imagining, practicing, and building a healthier cyberspace") applies this lens to social networks: > "Thus, we hope to learn from both the origins of the pluriverse—its emergence from the Zapatista movement, its use in the anti-neoliberal movements of the 1990s, its expansion into a design practice for collective autonomy—and from the forces that stood and still stand against its realization—the power of both state and capital to push towards individualization and atomization, and the grounded, messy reality of navigating shared social contexts across deep and meaningful divides. These difficulties persist, and we look to the past, the present, and the future to build the capacity necessary for pluriversality." The Verses page also includes a list of patterns, intended "to seed a pattern language for the pluriverse": interoperability, agency, voice, engagement and attention, privacy, regeneration, commons, and maintenance and care. Then again, on the *About* page Verses thanks Gitcoin and Protocol Labs for supporting their work. Protocol Labs is a YCombinator startup, which [raised over $200 million in 2017 from invetsors including Marc Andreessen's a16z](https://www.forbes.com/sites/michaeldelcastillo/2023/02/03/andreessen-horowitz-backed-protocol-labs-fires-21-of-staff-after-raising-record-257-million/?ref=thenexusofprivacy.net) and has since [partnered with a16z crypto on a Crypto Startup School](https://www.protocol.ai/blog/protocol-labs-partner-with-a16z-crypto-startup/?ref=thenexusofprivacy.net). ... clearly aligned with the Zapatistas' values! Similarly, Dimeji Onafuwa's [Power of the Pluriverse](https://medium.com/microsoft-design/power-of-the-pluriverse-c3592f5eca76?ref=thenexusofprivacy.net) (2023) makes some excellent points aimed at helping UX researchers and product makers adopt a pluriversal lens ... but it's on the Microsoft Design blog! Oh well. Watch capitalist patriarchal modernity work. For more on Marc Andreessen, see Janus Rose's [Major Tech Investor Calls Architect of Fascism a ‘Saint’ in Unhinged Manifesto](https://www.vice.com/en/article/major-tech-investor-calls-architect-of-fascism-a-saint-in-unhinged-manifesto/?ref=thenexusofprivacy.net), Elizabeth Lopatto's [The moral bankruptcy of Marc Andreessen and Ben Horowitz](https://www.theverge.com/2024/7/24/24204706/marc-andreessen-ben-horowitz-a16z-trump-donations?ref=thenexusofprivacy.net), and Anil Dash's writing including [Silicon Valley on the Middle Class and Unions](https://www.anildash.com/2013/07/10/silicon%5Fvalley%5Fon%5Fthe%5Fmiddle%5Fclass/?ref=thenexusofprivacy.net) (2013). For more on Big Tech's digital colonialism, see the links in [A few words about digital colonialism](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#digital-colonialism) in [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) For Microsoft and genocide, see [No Azure For Apartheid](https://medium.com/@noazureforapartheid?ref=thenexusofprivacy.net) and [Microsoft blocks emails that contain ‘Palestine’ after employee protests](https://www.theverge.com/tech/672312/microsoft-block-palestine-gaza-email?ref=thenexusofprivacy.net). 2 See Erin Kissane's [Against the dark forest](https://www.wrecka.ge/against-the-dark-forest/?ref=thenexusofprivacy.net) for an interesting look at hostile areas of the pluriverse from a different but related perspective 3 Although of course, nothing in software is every as easy as it seems like it could be ... OK, fine, hopefully relatively-easily. 4 And by very quickly I mean 15 seconds sketching out some very high-level ideas, followed by me saying "does this seem okay to get started", pausing for about 5 seconds, and then saying "great let's try it". The planning for this meeting had made it very clear that we were hitting the limits of our current very very very ad hoc commincations structures (and my apologies to anybody who didn't get notifications about the meeting, or who I sent the old link to rather than the updated link), so we need to do *something* ... we'll see how well it works out, and then iterate. 5 Of course, the specifics of how we approach it are based on who's involved, the technologies and social practices we know about and have experience with, and the constraints we're dealing with, so may not make sense for other groups – and we're making it up as we go along, so some of what we're doing may not even make sense for us. Still, we're approaching creating a friendly(ish) space intentionally, so hopefully others will find this interesting as well, and find ways to adapt some of what to their own organizing challenges ... or at the very least learn from our mistakes. 6 In my opinion, it also makes sense to consider Bluesky contested terrain – they got rid of the odious Jack Dorsey from their board, and their philosophy is libertarian rather than fascist – but your mileage may vary; others consider it hostile ground. 7 For example: - Individual subreddits, Slacks, and Discord servers can be friendly(ish) even though Reddit as a whole is hostile ground and Slack and Discord are at best contested terrain. - Nostr's founder's profile has the tag line "leftism is a virus" and it's the odious Jack Dorsey's favorite social network, Farcaster is funded by Marc Andreessen's venture startup, but there are people trying to use the tech for positive ends ... are they contested terrain or hostile ground? 6 For real-world examples of attacks launched form hostile ground into contested terrain and friendly spaces, see - Conspirador Norteño's [Federation and political spam](https://www.conspirator0.com/p/federation-and-political-spam?ref=thenexusofprivacy.net) (discussing a 2024 incident where a flock of spam accounts used bridges to push an onslaught of pro-Trump posts from Nostr to Bluesky via Mastodon) - Anti-Meta Fedi Pact creator Vanta Black's [Why? ](https://fedipact.online/why?ref=thenexusofprivacy.net)for more on the threat from Meta's Threads Fediverse bridge to "the existing communities of marginalized people on the fediverse, many of whom rely on it to survive." [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/), Erin Kissane's outstanding [Untangling Threads](https://erinkissane.com/untangling-threads?ref=privacy.thenexus.today), and [Extend, and Exploit: Meta’s plan for ActivityPub, Mastodon and the Fediverse](https://thenexusofprivacy.net/embrace-extend-and-exploit/) explore the dynamics of Meta's interactions with the ActivityPub Fediverse in more detail; [Strategies for the free fediverses](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) and Jamie A. Theophilos's December 2024 [Closing the Door to Remain Open: The Politics of Openness and the Practices of Strategic Closure in the Fediverse](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=privacy.thenexus.today) look at the possibilities of resistance. ## Image credit Original photographer unknown, via [picryl](https://picryl.com/media/post-it-notes-sticky-notes-note-computer-communication-d2f149?ref=thenexusofprivacy.net) and Pixabay, licensed under the Creative Commons CC0 1.0 Universal Public Domain Dedicatio ## ### On FediForum (and not just FediForum) URL: https://thenexusofprivacy.net/not-just-fediforum/ Last updated: 2026-04-16T03:29:57.000Z *Last updated April 24\. See the* [*update log*](#update-log) *at the end. Thanks to everybody for the feedback on previous versions! If you've got feedback on this version, here's the threads on* [*Mastodon*](https://infosec.exchange/@thenexusofprivacy/114339744788138523?ref=thenexusofprivacy.net)*,* [*Bluesky*](https://bsky.app/profile/thenexusofprivacy.net/post/3lmt6hkr2ck2q?ref=thenexusofprivacy.net)*, and* [*Lemmy*](https://lemmy.blahaj.zone/post/24568610?ref=thenexusofprivacy.net). > "For a community like the Fediverse to succeed, it needs to be welcoming. It cannot have as a leader someone who poses a danger to a vulnerable constituency." > > – Michelle Hughes, [March 28](https://a2mi.social/@MegaMichelle/114242222012041076?ref=thenexusofprivacy.net) > "FediForum ... wound up getting cancelled at the last minute due to several examples of what I had described in [If not now, when?](https://thenexusofprivacy.net/if-not-now-when/) as "huge cultural issues as well, including anti-Blackness, misogynoir, anti-trans biases." " > > – [More notes on Organizing, Mutual Aid, and Activism on decentralized social networks](https://thenexusofprivacy.net/more-notes-on-organizing/), April 3 (notes from a session we had originally planned for FediForum) > See the [terminology notes](#terminology-notes) at the end of the article for definitions of anti-Blackness, misogynoir, and various kinds of anti-trans biases including transmisogyny, anti-transmasculinity, and transmisognyoir Given the circumstances, cutting ties with the now-ex organizer whose anti-trans tweets had kicked off a firestorm, cancelling the conference, and holding a roundtable/listening session were all good decisions by FediForum™. [0](#notes) At the roundtable, facilitated by Anuj Ahooja of A New Social, there was a collective desire to do better and a lot of good suggestions. The [draft summary notes from the listening session](https://fediforum.org/2025-04/?ref=thenexusofprivacy.net) also have perspectives at the end from the remaining organizer, including next steps and a goal of "a better FediForum, and effective contribution to a better Open Social Web." [2](#fn-open-social-web) There's clearly an opportunity for this to be a collective learning experience, catalyst for change, and perhaps an inflection point – for FediForum, for other events, and more broadly in the ecosystems of decentralized social networks people known as [the fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses). That's good! That said, there there a lot of challenges still to navigate. So this article discusses ways FediForum and others can make progress and take advantage of these opportunities. The overall framework I'll use here is the "Four A's" ([acknowledgment, apology, amends, action](#aaaa)), which I first saw in Teh Portly Dyke's 2007 post [How to Fuck Up](http://portlytruestories.blogspot.com/2007/11/how-to-fuck-up.html?ref=thenexusofprivacy.net). As well as applying the Four As to three specific items mentioned under "Issues of representation and inclusion" in the FediForum [draft summary notes](https://fediforum.org/2025-04/?ref=thenexusofprivacy.net), I'll also discuss challenges – and potential learning – in the broader ecosystems. First, though, I'll talk about about the some of [the impact of the last-minute cancellation](#last-minute). Cancelling really was the right thing to do; as word got out that Timnit Gebru, Rudy Fraser and others were pulling out even after the conference had cut ties with the organizer who had made anti-trans tweets, there was no way the regularly-schedule conference would go well. Still, cancelling the night before the conference was supposed to start meant that a lot of discussions didn't happen and that the time and energy people had put into preparing didn't pay off – and added a lot of stress. FediForum is currently considering their next steps; see [Now what?](#now-what) and the appendix discussing [FediForum's response](#fediforum-response) for more details. Whatever happens to FediForum itself, though, it's clear there's room for multiple events – potentially including some that are more aligned with the Fediverse's grassroots ethos and [ongoing critique of openneess](https://test.roelof.info/log/seven-theses/?ref=thenexusofprivacy.net) to complement the FediForum's more-corporate "Open Social Web" vibe. If that winds up happening in a more decentralized way, less centered on FediForum, that'll be a great outcome. There really are a lot of opportunities here! - [A last-minute cancellation has a big impact](#last-minute) - [Acknowledgment, apology, amends, action](#aaaa) - ["The Fediverse was built by many trans and nonbinary people"](#built-by-trans) - ["Underrepresentation of marginalized communities"](#fediforum-dei) - ["Anti-Black incidents and lack of follow-up"](#racist-incident) - [Now what?](#now-what) - [Appendix: FediForum's response](#fediforum-response) - [Terminology notes](#terminology-notes) - [Notes](#Notes) (with additional references, examples, deeper dives into related points that I don't want to clutter the main post up with, and occasional snark) > *Note: it's very challenging to write about intersecting oppressions without stepping into any minefields. So thanks once again to everybody for feedback so far – and apologies in advance for any unfortunate wording that's still here or mistakes I'm still making. Feedback welcome!* ## A last-minute cancellation has a big impact > "When FediForum got [cancelled](https://fediversereport.com/fediverse-report-110/?ref=thenexusofprivacy.net) a few weeks ago, I heard from multiple participants that they were planning to showcasing some new features or products that they’ve been working on. The sudden last-minute cancellation has caused uncertainty on how to proceed, and there has not been a new date set for FediForum (nor is it clear in what format it will continue, if any). However, by and large participants have decided not to showcase or present their work outside of FediForum. This shows the influential role that FediForum plays in the fediverse development ecosystem. It is important avenue for developers to showcase their work to the rest of the developer community, with no clear replacement for it. As such, the news for the fediverse is especially slow this week." > > – Laurens Hof, [Fediverse Report #113](https://fediversereport.com/fediverse-report-113/?ref=thenexusofprivacy.net), April 22 FediForum, despite its challenges, has always been a great opportunity for people looking to find out more about stuff they might want to get involved in – and for people, companies, and non-profits to get feedback on ideas, visibility, new collaborators, connections, and sometimes even funding for their projects and products.[3](#fn-who-benefits) So a lot of people had planned their schedules around FediForum – including me; in [If not now, when?](https://thenexusofprivacy.net/if-not-now-when/), I even talked about a key role FediForum played in my overall plans for a project. Many of us had also invested a lot of time and energy in prepping. While some FediForum sessions are spontaneous, others reflect a lot of pre-conference thinking and organization – including reaching out to people who wouldn't otherwise attend and inviting them. It's not that the time and energy we put in was wasted, but the FediForum cancellation certainly meant it didn't lead to the short-term results we were hopingn for. Once things started to blow up, we had to invest a *lot* more time and energy: figuring out what was going, deciding what to do, exploring last-minute alternatives, and revisiting and updating as the situation evolved. We also had to tip people we had encouraged to attend off about the situation and explain the tradeoffs about whether or not to participate. And on a weekend too! Fortunately, the people I was working with were willing to go with the flow. The [Organizing, Mutual Aid, and Activism](https://thenexusofprivacy.net/more-notes-on-organizing/) session still wound up happening (just not in a FediForum context), and it worked out great. Whew, and yay! Still, there were people at FediForum who might well have been interested in being at this session (Michelle Hughes, for example, had expressed interest in ActivityPub events (like Mobilizon), end-to-end encryption, and better support for groups, all of which were topics we discussed); without any agenda-session where they could find out about it, they lost out. And the conversation certainly would have benefited from these additional perspectives, so we lost out too. Worse, there were a lot of interesting and timely topics that *didn't* get discussed as a result of the cancellation. Three sessions in particular I was looking forward to: - Timnit Gebru of DAIR Institute had suggested a topic of *Genocide prevention in multiple languages.* See DAIR's [Effective Moderation of Social Media to Curb Genocidal Content](https://www.dair-institute.org/tigray-genocide/?ref=thenexusofprivacy.net) page (with a ten-minute video, a link to their recent paper, and statement that [Social Media Platforms Are Spreading Violent Warmongering Content Encouraging All-Out War Between Ethiopia and Eritrea, Again](https://www.dair-institute.org/blog/tigray-social/?ref=thenexusofprivacy.net)) for more on why this is so urgent. With other FediForum attendees also interested in moderaton and trust and safety – including Emelia Smith of the W3C Trust & Safety workgroup, Jaz-Michael King of IFTAS, Rudy Fraser of Blacksky, Bryan Newbold of Bluesky, and several names I recognized as moderators or admins of well-known Fediverse instances – it could have been a great session. - Tammarrian Rogers of Sarell was interested in [(Re)Building Trust in Tech with a Well-being Focus](https://sarell.tech/wp-content/uploads/2025/02/Re-Building-Trust-in-Tech-Convening-Report-Q4-2024-Revised.pdf?ref=privacy.thenexus.today), building on Sarell's late-2024 convenings. I had been at one of those convenings, and had multiple discussions with Tammarrian about how a FediForum session could be a useful next step both for the Fediverse and for Sarell's work – and it potentially aligned with topics other attendees like had proposed such as Ana Jamborcic's [Intimacy Gradients](https://www.socialroots.io/intimacy-gradients-the-key-to-fixing-our-broken-social-media-landscape/?ref=thenexusofprivacy.net) and Kirsten Lambertsen of Indie Beat Radio's (and many others) interest in fedi's opportunities to empower and support musicians, artists and other creatives. - Rudy Fraser was interested in discussing Blacksky Algorithms, and his [An internet of many autonomous communities](https://blog.rudyfraser.com/an-internet-of-many-autonomous-communities/?ref=privacy.thenexus.today) (expanding on his ATmosphereConf talk on [Beyond Horseless Carriages: Building Communities for the Decentralized Era](https://www.youtube.com/watch?v=OZN8y8kVFFI&ref=privacy.thenexus.today)) gives an idea of where that might have gone. Fortunately, Rudy's got some otherr great public apperances coming up – including part of a panel on *Towards Safety for Black People on the Web* as part of Archiving the Black Web's [conversations on Black contributions to the development of the Web and the future of the Black user experience on social media](https://www.eventbrite.com/e/archiving-the-black-web-presents-tickets-1284724458439?ref=thenexusofprivacy.net) – but there were also some real possible synergies here with Emelia, Jaz, Kirsten, and many others. And that's just the tip of the iceberg. Others were interested in consent; governance; sustainability; threaded discussions; bringing public institutions, civil society organizations media, and communities to the Fediverse; fediversity.eu; and much much more. The good news is that all these discussions still can, and probably will, happen. And who knows ... the organizing, mutual aid, activism session was better in some ways than it would have been at FediForum, so maybe that'll be true for some of these discussions as well. Still, there was a lot of disappointment and frustration at the cancellation, and I can certainly see why. Like I said, though, cancelling really was the right thing to do. FediForum's decision to refund registration fees was also a very good decision. That said, those are just the first steps. ## Acknowledgment, apology, amends, action > "You will get better at this, but at first you will fuck up a lot, and you will always fuck up a little." > > – Ijeoma Oluo, [Welcome To The Anti-Racism Movement — Here’s What You’ve Missed](https://theestablishment.co/welcome-to-the-anti-racism-movement-heres-what-you-ve-missed-711089cb7d34/?ref=privacy.thenexus.today) It's true – and not just with anti-racism, with any kind of anti-oppressive work online. Pretty much all of the examples in the "Common mistakes to avoid" section of [5 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) are things I've done myself, in the Fediverse and other situations. I've also made (and continue to make) similar mistakes related to ableism, misogynoir, transmisogyny, anti-transmasculinity, sexism, and other dimensions. While I have indeed gotten (somewhat) better over time, I keep finding new ways to fuck up. It's very hard to prevent society's discrimination and bias from showing up in everything you do even when you try. And it's very easy to say or do something unfortunate. So when I fuck up (as I inevitably do), I keep Teh Portly Dyke's advice in mind. > "When you "Fuck Up" (whether the fuck-up is minor or major) practice the "Four A's" > > 1\. Acknowledgment > 2\. Apology > 3\. Amends > 4\. Action" > > – Teh Portly Dyke, [How to Fuck Up](http://portlytruestories.blogspot.com/2007/11/how-to-fuck-up.html?ref=thenexusofprivacy.net) (2007) [FediForum Has Been Canceled](https://wedistribute.org/2025/03/fediforum-canceled/?ref=thenexusofprivacy.net) chronicles an example of how *not* to do it. FediForum's now-ex-organizer responded to the criticism of the anti-trans tweets by posting "I fully support the right of trans people to exist, thrive and live their lives to the fullest with equal rights and dignity." [1](#fn-stand-by) So far, so good ... but without acknowledging, disavowing, and apologizing for past anti-trans comments, it rang hollow. And acknowledgement and apology typically aren't enough. As Teh Portly Dyke says > "the only concrete evidence that you genuinely realize you've fucked up and genuinely apologize for it is that you will *change what you do in the future*." The response to a incident in a Fediverse Developer Network chat room in June 2023 is another example of how *not* to do it. After a bigot described trans and queer people as "deviants" (and then went on to add "cis is a slur"), the moderator refused to take any stronger action beyond pleading with everybody to stay on topic. I left the room, and so did another LGBTQIA2S+ person. The moderator apologized to us ... but that's all he did. So it didn't resolve the situation: as long as language like that is tolerated, it's not the kind of space I want to be in. As Teh Portly Dyke says "For me, if I don't take this step (action), the other three are just so much manipulation." [4](#fn-aaaa) [FediForum's res](#fn-aaaa)ponses so far – the posts from the remaining organizer, the official announcement, the remaining organizer's verbal comments at the roundtable, and the [draft summary notes](https://fediforum.org/2025-04/?ref=thenexusofprivacy.net) – have examples of all four As. Then again, there's still a lot of room for improvement; see the appendix on [FediForum's response](#fediforum-response) for a more in-depth discussion. That's not surprising. Understanding and recovering from a multi-dimensional fuck-up like FediForum's is a process and extremely complex – this post for example goes on for thousands of words on just three of the dozens of bullet items in their draft notes. And FediForum's initial responses are a lot better the initial response from another conference the same now-ex-organizer is involved with.[5](#fn-iiw) So FediForum's initial responses, while imperfect, are good first steps to try to build on as the conference – and ecoystem – tries to move forward. In aid of that, I'm going to dig more deeply into a few of the items briefly mentioned in FediForum's draft summary notes. ## "The Fediverse was built by many trans and nonbinary people" > "\[D\]espite all the major contributions they’ve made, queer, trans, and non-binary people of all colors have also been marginalized in Mastodon and the broader Fediverse. The stories of their contributions are rarely told and when they are it’s rarely from a queer perspective, leading to the erasure I talked about above. And Mastodon and the Fediverse have gotten big enough that there’s more and more money and other opportunities floating around. how much is going to queer, trans, and non-binary people? This is something that really needs to change going forward." > > – me, in [A (partial) queer, trans, and non-binary history of Mastodon and the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net) (*We Distribute,* June 2023), a deep dive into what hoodie aida kitten so accurately describes in 2018 as [a complicated relationship with queer activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=privacy.thenexus.today) It's great to see this trans and non-binary people's contribution to the Fediverse acknowledged in the draft summary notes. [Rapid queer-led community innovation](https://thenexusofprivacy.net/mastodon-a-partial-history/#rapid-queer-led-community-innovation) in 2017 was a major factor in Mastodon's success, and much of the functionality we rely on today was originally implemented by people who are not cis. And as ActivityPub spec co-author Christine Lemmer-Webber has noted, four of the five ActivityPub co-authors were queer. Still, it would have been even better if FediForum's notes had also included the point made near the end of the roundtable (and for the last eight years) that as the Fediverse has grown, the overwhelming majority of the funding, jobs, press visibility, and book deals have gone to cis people and cis-led organizations – or highlighted that even though much the Fediverse is a very trans-positive environment, trans and queer people have also faced a lot of hate and harassment over the years.[6](#fn-ap-trauma) And it's also worth highlighting that communities are not monolothic. The limited benefits to trans and non-binary people have been gone mostly to white trans and non-binary people. Black and Indigenous trans and non-binary people, and more generally trans and non-binary people of color, are multiply-marginalized. To be clear, these are ecoysystem-wide problems – and problems for tech more generally. While FediForum has a chance to be a leader in helping to address them, they're far from the only ones who need to make progress. So this is a great example of where there are also straightforward opportunities for broader learning and change. For example: - How many trans and non-binary people spoke at the recent [Fediverse House](https://wedistribute.org/event/fediverse-house-sxsw/?ref=thenexusofprivacy.net) event at SXSW – or the developer meetup Social Web Foundation hosted there? [7](#fn-participation) - Were trans and non-binary perspectives even discussed, and if so were they accurately represented? [8](#fn-perspectives) - What about the RightsCon panel on [How we build a new social web](https://rightscon.summit.tc/t/rightscon-2025/events/how-we-build-a-new-social-web-ofSx169YMHcwc1NBh8osmZ?ref=thenexusofprivacy.net), featuring people from Threads, Mastodon, the Social Web Foundation, and a representative of [an organization that had recently platformed an anti-trans US politician and hate monger](https://www.fightforthefuture.org/news/2024-11-21-transgender-digital-rights-activist-confronts-hate-monger-rep-nancy-mace-at-internet-summit/?ref=thenexusofprivacy.net)? [8.5](#fn-rights-con) - How many of the Social Web Foundation's founders, advisors, and partners are trans or nonbinary? [9](#fn-swf-advisors) How are they getting input about what to prioritize, and how much of their work prioritizes the needs of trans and non-binary people? So hopefully FediForum's fuckup will be a catalyst for other event organizers, non-profits, standard bodies, and funders to acknowledge these problems, apologize, make amends, and take action to improve the situation going forward. ## "Underrepresentation of marginalized communities" > "In my essay I write that the queer community deserves justice; namely, that they “be recognized for their efforts, allowed to enjoy the fruits of their labor, and given the opportunity to continue to play a meaningful role in its development.” But what of the other communities, who, granted, didn’t contribute as much to the Mastodon project, but, again, only because *they weren’t allowed to*? Do they not also deserve justice?" > > – Allie Hart, [Mourning What Now?](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=privacy.thenexus.today), April 2017 > "In [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) Dr. Flowers focuses on Mastodon’s long history of whiteness and racism, also present in much of the broader fediverse. This marginalization impacts Black, Indigenous, and other queer, trans, and non-binary people or color as well; and many queer, trans, and non-binary people fall into other categories — disabled people, sex workers, people from the Global South — that are also largely excluded from Mastodon’s and the Fediverse's power structures." > > – me, in [A (partial) queer, trans, and non-binary history of Mastodon and the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net) This is another way in which FediForum mirrors the Fediverse's broader problems. How many Black and/or Indigenous people spoke at [Fediverse House](https://wedistribute.org/event/fediverse-house-sxsw/?ref=thenexusofprivacy.net) or [the RightsCon panel](https://www.fightforthefuture.org/news/2024-11-21-transgender-digital-rights-activist-confronts-hate-monger-rep-nancy-mace-at-internet-summit/?ref=thenexusofprivacy.net)? How many Black and/or Indigenous people take part in [the W3C SWICG standards body](https://lists.w3.org/Archives/Public/public-swicg/2023Sep/0088.html?ref=thenexusofprivacy.net), or [the SocialHub discussion forums the SWICG runs](https://socialhub.activitypub.rocks/t/how-to-make-progress-on-the-almost-complete-absence-of-black-people-in-socialhub-and-swicg-discussions/4533?ref=thenexusofprivacy.net)? Are these perspectives even discussed, and if so were they presented accurately? How many of the Social Web Foundation's founders, advisors, and partners are Black and/or Indigenous, disabled, sex workers, and/or people from the Global South? Specifically with FediForum, people have long called attention to the problems with diversity, equity, and inclusion for years. At the September 2023 FediForum session on [How can white people and guys improve the race and gender situation in the Fediverse?](https://fediforum.org/2023-09/session/3-c/?ref=thenexusofprivacy.net), for example, somebody asked why there were so few Black people in attending FediForum. The list of reasons included - timing - during the week is hard for people who are working. - issues of tone that come across, feels like a white event, the organizers have contributed to it by their feedback to suggestions - format might not be appealing - very technical so pushes out the social - price, even $2 is a lot for some people – might be free tickets for those who request, but requesting that’s a barrier Needless to say these issues don't only affect Black people – and these aren't the only issues leading to underrepresentation. For example - At the roundtable, one of the very few younger FediForum attendees noted that the conference could do a lot more to attract people in his generation.[10](#fn-marginalizing-youth) - A response by a non-Black person of color s to FediForum's 2023 [post](https://mastodon.social/@fediforum/110934864431483845?ref=thenexusofprivacy.net) asking for suggestions about how to make progress on this mentions "subtle racist remarks and ignorant remarks about our culture." - The participation map on FediForum's site highlights the almost complete absence of anybody from Asia, Australia, and Aotearoa New Zealand. While it's almost certainly not the only factor (Africa and South America are also underrepresented), only having conference sessions in the middle of the night in those geographies probably has a lot to do with it! The bullets in the draft summary notes do indeed acknowledge many of these, at least briefly. That's good! Then again, this isn't the first time the organizers have acknowledged these problems –[ that 2023 post](https://mastodon.social/@fediforum/110934864431483845?ref=thenexusofprivacy.net), for example, or an earlier now-deleted one when an organizer reached out to me for suggestions. At least so far, though, there hasn't been an apology, amends, or action. Asking for feedback but then ignoring suggestions comes across as the kind of manipulation Teh Portly Dyke mentions. [11](#fn-corporate-funding) The frustrating thing is that there as there are a lot of straightforward actions to start making progress on representation.[12](#fn-making-progress) Oh well, better late than never. While it's really too bad that FediForum didn't start on this two years ago, as the old saying goes: the second-best time to start is now. Still, waiting so long to address this problem has made another one of the "four As" more challenging. Attendees at past FediForums have benefited in a lot of ways, including feedback on ideas and projects, opportunities for connections and networking – and some attendees have benefited even more.[3](#fn-who-benefits) By contrast, people from communities that have been excluded from the conference lost out on these opportunities. How to make amends? It's not obvious, but this is something that the plans going forward will need to address. ## "Anti-Black incidents and lack of follow-up" It's hard to know just what incidents this is referring to; one way to improve the draft summary is to make this acknowledgement more specific and include the appropriate apologies. Still, the remaining organizer briefly mentioned one of these incidents at the start of the roundtable, so let's look at that in more detail. That incident, in August 2024, started with a pattern that's very common in the Fediverse (and tech more broadly, and really any system where white people want to minimize the extent of racism). Here's how social.coop's [Statement from moderation team involving recent racism reports](https://www.loomio.com/d/SndQxA2g/statement-from-moderation-team-involving-recent-racism-reports?ref=thenexusofprivacy.net) describes it: > "Racism is an ongoing problem in the Fediverse. Recently this has manifested as white people starting threads effusively regarding the experience of being on the Fediverse as exclusively positive, without acknowledging the impact of systemic issues like racism on others. When the very different experience of Black community members is raised, as both a contrast and additional data, it is often dismissed or put in question." The specific way the pattern came up in the this was when the remaining organizer posted something along the lines of "we all know the Fediverse is better, what data do we have to support that?" Wait a second. If you look at Dr. Johnathan Flowers' [The Whiteness of Mastodon](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) and [Twitter vs. Mastodon](https://www.radicalai.org/twitter-vs-mastodon?ref=privacy.thenexus.today) podcast, Marcia X and Ra’il I'Nasah Kiam's [Blackness in the Fediverse](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x/?ref=privacy.thenexus.today), the links in [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy), or the others I quote in [5 things white people can do](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) it's clear that no, many Black people have repeatedly said that they *don't* think the Fediverse is better. Ignoring that is erasing Black opinions – and equating "better" with "better for people who aren't Black." At this point, the remaining organizer could have said something like "oops, bad phrasing," acknowledged that without addressing the anti-Blackness the Fediverse wasn't actually "better" for everybody, apologized, and take action by editing the post and change his behavior going forward. But no. Instead, he doubled down, made some of other common mistakes, and it spiraled downhill from there. At some point, it wound up getting reported to the social.coop moderators. As the social.coop statement says: > "One of our mods responded to the thread to say that this was problematic, that the CWG ops team had gotten a report about it and that we’d be discussing it at our regularly scheduled August 1st meeting. The reported user then left social.coop before the CWG ops team meeting took place." And when the remaining organizer deleted his social.coop account, he also he deleted the evidence of this incident.[13](#fn-deleting) As I said in [5 things white people can do](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/), this "makes it looks like you're trying to hide the fact that you screwed up." Again, the Four As is a good framework for looking what needs to be done here at this point. - What does acknowledgement look like? Who should be apologized to? It's not just the Black people who participated and saw that particular discussion. The remaining organizer is gets a lot of visibility in the fediverse (I talked about the NLNet grant, *Washington Post* quote, and advisory role with the new Social Web Foundation above, and he's a regular in discussions on the W3C standards email list, the Socialhub site, and the Fediverse Developer Network chatrooms. The attitude and behavior he's reinforcing here harms Black people (and more generally people of color) in the Fediverse as a whole. - How to make amends? - What actions are appropriate? There are some obvious first steps here, but also a lot of complexity, so it'll be interesting to see how this is addressed going forward. ## Now what? > "After canceling FediForum April 1-2 on short notice, we want to hear from you, our attendees and supporters, to listen to you and adjust our plans for future FediForums accordingly. And we want to reschedule the canceled FediForum as soon as possible – but not sooner, so we can get it right! For example, we are currently busy building an advisory board that will also help us steer FediForum in the right direction going forward." > > – [FediForum Town halls and next steps](https://apps.fediforum.org/nextcloud/apps/forms/s/SegSBQMKDMKd4wnKTRwd54Cg?ref=thenexusofprivacy.net), an update and surveysent to people who had registered for the conference, April 12 It'll be interesting to see who FediForum winds up with on their advisory board ... hopefully it'll be more diverse than SWF's initial advisors! [9](#fn-swf-advisors) Their cancellation announcement also talked about a "reconstituted organizing team," and it'll be interesting to see what that looks like too. *If* FediForum reaches out to a much broader demographic than their supporters and past attendees, they've certainly got a great opportunity to create a new version that prioritizes equity and inclusion. Some of the suggestions at the roundtable are easy to act on – more diverse organizers, having a day of scheduled sessions as well as an unconference – so there's certainly room for progress. Time will tell. Whether or not FediForum goes forward, there's clearly room for alternatives, both focusing on the corporate "Open Social Web" and more grassroots-oriented events more aligned with the Fediverse's [ongoing critique of openneess](https://test.roelof.info/log/seven-theses/?ref=thenexusofprivacy.net). In [If not now, when? Mutual aid and organizing in the fediverses, the ATmosphere, and whatever comes next](https://thenexusofprivacy.net/if-not-now-when/), I suggested looking at today's networks as prototypes. That's a good way to look at the first few FediForums as well. And while event organizers, non-profits, corporations, non-profits and influencers need to take the lead here – both for FediForum and the broader ecosystem – everybody can help. [5 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) has a lot of suggestions, and the techniques it discusses can also apply to other dimensions of toxicity and oppression as well. More positively, though, [a lot of good stuff is happening in the fediverses](https://thenexusofprivacy.net/good-stuff-in-the-fediverses/), and many of those projects *are* making a real effort to improve the situation. So with luck FediForum's implosion will help reinforce broader progress as well. Time will tell! As I said in [If not now, when?](https://thenexusofprivacy.net/if-not-now-when/) > "Easier said then done, but the opportunity is there." ## Appendix: FediForum's response FediForum's responses so far – the posts from the remaining organizer and official announcement (as reported in [FediForum Has Been Canceled](https://wedistribute.org/2025/03/fediforum-canceled/?ref=thenexusofprivacy.net)), the remaining organizer's verbal comments at the roundtable, the [draft summary notes](https://fediforum.org/2025-04/?ref=thenexusofprivacy.net), and a [survey](https://apps.fediforum.org/nextcloud/apps/forms/s/SegSBQMKDMKd4wnKTRwd54Cg?ref=thenexusofprivacy.net) – have examples of all four As. Then again, as I said above, there's still a lot of room for improvement – and that's not surprising. It's early days, and there are still of opportunities for FediForum to improve their response. And whether or not they do, there's a lot other event organizers can learn from this. Let's start with the positive: - The remaining organizer **acknowledged** that he saw the tweets as a problem – and that they did not reflect his views. - The announcement canceling the conference included an **apology**: "to the people who have diligently prepared for demos, presentations and sessions, and all of you who just wanted to come and help build a better social media future at FediForum." - FediForum made some immediate **amends** to the people who had registered by offering a full refund to everybody who had registered, and promised "we will create opportunity for you in the future." - Cutting ties with the now-ex-organizer who had made anti-trans tweets, canceling the confernece, and holding listening sessions are all examples of **action** That's good! Then again, there's still a lot of work to do.[14](#fn-open-question) For example: - There's no apology on FediForum's site or in the draft summary notes. - The acknowledgement in the announcement and the short summary at the beginning of the draft summary both leave a lot out – for example, neither even mentions anti-trans bigotry, let alone any of the other issues that attendees cited for pulling out. The announcement simply notes that tempers are high, with insults and fears for physical safety, and that "is hard for me to see how a typical FediForum event could be successful tomorrow or the day after, we all need a time out" ... true but partial. The summary in the notes at least mentions the incident ("the content was incompatible with the values of FediForum and its community") but doesn't talking just what that content was and why it was incompatible – or that people were continuing to pull out even after the conference cut ties with the now-ex organizer. - Attendees weren't the only ones who were harmed. Who else deserves acknowledgement and apology, followed by amends and action? For example ... what about people who knew about the anti-trans tweets of the now-former organizer (which had apparently been discussed on whisper networks for a while) and chose not to attend the conference – or past conferences? What about trans people, Black people, disabled people, and others in the discussions sparked by the cancellation, discussions the remaining organizer described as "insult-filled" and leading to physical safety concerns? - The survey talks about wanting "to hear from you, our attendees and supporters." But this is a self-selecting (and overwhelmingly white) sample. To make progress, they'll also need to reach out to – and listen to – critics and to people who haven't previously attended. Still, while there's plenty of room for improvement, FediForum's initial responses are a lot better the initial response from another conference the same now-ex-organizer is involved with, which as far as I know hasn't even acknowledge the issue.[5](#fn-iiw) Understanding and recovering from a multi-dimensional fuck-up like FediForum's is a process and extremely complex – this post for example has a few thousand words on just three of the dozens of bullet items in their draft notes. So FediForum's initial responses, while imperfect, potentially provide enough to build on as the conference and ecosystem tries to move forward. Of course, they might also just do a cosmetic exercise. For many of their participants that might well be enough, and I'm sure they can find advisors who see it the same way. Then again, *if* FediForum reaches out more broadly, listens, fully acknowledges and apologizes for the problems, tries to make amends to everybody impacted (not just attendees) and starts taking action to address the wide variety of issues, they might well be able to recover. Time will tell! In the short term, key next steps include revising the draft notes, ensuring that the "listening sessions" get broad and diverse input, putting together the reconstituted organizing team and advisory board, and doing the promised followups identifying themes and talking about plans to address the problems. The survey suggests they're hoping to have the next event "some time in May", which means there's a lot to do between now and then. Stay tuned, I guess! **Update, April 24:** FediForum had a second "listening session" a few days ago (once again, just for people who had registered to attend this year's conference). The remaining organizer also mentioned that there's a lot of desire from the people he's been talking with to have the next FediForum as soon as possible, although also acknowledged that meant they wouldn't be able to make many changes before then other than getting an advisory board in place. As Laruens Hof points out in [Fediverse Report #113](https://fediversereport.com/fediverse-report-113/?ref=thenexusofprivacy.net), FediForum's absence leaves a huge gap. So I can certainly see why so many people and companies who were expecting FediForum to be a chance to connect with others and (in many cases get some visibility and/or do some networking) want to move quickly. But if it's "move fast and don't fix much" approach, then there are some major risks. Right now, FediForum's got a reputation for *saying* they care about marginalized groups, but not actually *doing* anything about it. Cutting ties with the now-former organizer is an example of actually doing something to support trans and non-binary people, so could be a sign that's changing. But if the next FediForum goes ahead without making progress on the anti-Blackness and other representational issues, it's possible that other marginalized groups will still see the conference as continuing to ignore their needs. More positively, though, there are some straightforward things FediForum could do to show that they're committed to making progress. If they can also get a diverse advisory board in place, a plausible initial plan to make additional progress (including action and amends), that might be enough to encourage marginalized groups that FediForum's reconstituted organizing team is commited to moving in the right direction. Time will tell! ## Terminology notes - **LGBTQIA2S+** (or, in Canada, **2SLGBTQIA+**) is a shorthand for lesbian, gay, gender non-conforming, genderqueer, bi, trans, queer, intersex, asexual, agender,[ two-sprit](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today), and others (including non-binary people) who are not straight, cis, and heteronormative.[ Julia Serano's trans, gender, sexuality, and activism glossary](https://www.juliaserano.com/terminology.html?ref=privacy.thenexus.today) has definitions for most of these terms, and discusses the tensions between ever-growing and always incomplete acronyms and more abstract terms like "gender and sexual minorities". [OACAS Library Guides' Two-spirit identities page](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today) goes into more detail on this often-overlooked intersectional aspect of non-cis identity. - **Anti-Blackness is** beliefs, attitudes, actions, practices, and behaviors of individuals, institutions, software, and systems that devalue, minimize, and marginalize the full participation of Black people across the world. See footnote 1 in [*5 things white people can do to start making the fediverse less toxic for Black people*](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/#notes)for more detail*.* - **Anti-trans biases** refers to beliefs, attitudes, actions, practices, and behaviors of individuals, institutions, software, and systems that devalue, minimize, and marginalize the full participation of trans, non-binary, genderqueer, two-spirit, and other non-cis people across the world. "Transphobia" is often used as a synonym, but implies that fear is at the basis of it; "transmisia" is a newer term, focusing on hate, but almost nobody knows it so I'm not using it here. - **Transmisogyny**, a term coined by Julia Serano in 2005, is the intersecting oppressions of anti-trans biases and misogyny.15 Note that transmisogyny can also affect women, non-binary people, and others who aren't trans – [Caster Semenya](https://www.sludge.online/caster-semenya-when-fairness-is-false?ref=thenexusofprivacy.net), for example, or [the cis Black woman confronted by police officers in an Arizona Walmart restroom for looking too masculine](https://www.advocate.com/news/lesbian-mistaken-transgender-arizona-walmart?ref=thenexusofprivacy.net). As Tariyé Peterside discusses in [Caster Semenya: When Fairness Is False](https://www.sludge.online/caster-semenya-when-fairness-is-false?ref=thenexusofprivacy.net), "transmisogyny is a backdoor facilitator for misogynoir"; see also Elías Cosenza Krell's [Is Transmisogyny Killing Trans Women of Color? Black Trans Feminisms and the Exigencies of White Femininity](https://read.dukeupress.edu/tsq/article/4/2/226/84749/Is-Transmisogyny-Killing-Trans-Women-of-Color?ref=thenexusofprivacy.net) for discussion of the intersections of transmisogny and race. - **Anti-transmasculinity** is about the oppression and discrimination faced by trans men, and also includes masculine people more broadly who are not cisgender. Nsámbu Za Suékama's [Racial-Class Paternalism and the Trojan Horse of Anti-transmasculinity](https://medium.com/@riptide.1997/racial-class-paternalism-and-the-trojan-horse-of-anti-transmasculinity-5b22cf66a00e?ref=thenexusofprivacy.net) is an outstanding discussion of anti-transmasculinity. I've also heard "transandrophobia" used here, but again that has the problem of focusing on the fear. - [**Misogynoir**](https://nyupress.org/9781479865109/misogynoir-transformed/?ref=privacy.thenexus.today), a term coined by [Dr. Moya Bailey](https://www.moyabailey.com/?ref=privacy.thenexus.today) in 2008, describes the ways anti-Black and misogynistic representation shape broader ideas about Black women and gender-expansive people. [Calling all non-Black people: Interrupting Misogynoir](https://drive.google.com/file/d/1KiI7Hm9SFxATmjJc1lA8zTZTx57gXj3u/view?ref=privacy.thenexus.today), by Dr. Heliana Ramirez and Jaya Mallik, is an excellent very recent resource; if you've got a Linked In account, [check out the panel discussion here](https://www.linkedin.com/events/7222816625878609920?ref=privacy.thenexus.today). Dr. Bailey's book [Misogynoir Transformed: Black Women’s Digital Resistance](https://nyupress.org/9781479865109/misogynoir-transformed/?ref=privacy.thenexus.today) goes into more detail. - [**Transmisogynoir**](https://www.harpersbazaar.com/culture/features/a33614214/ashlee-marie-preston-transmisogynoir-essay/https://translanguageprimer.com/transmisogynoir/?ref=privacy.thenexus.today) describes the intersection between transphobia, misogyny, and anti-Black racism specifically. Ashlee Maree Preston's [The Anatomy of Transmisogynoir](https://www.harpersbazaar.com/culture/features/a33614214/ashlee-marie-preston-transmisogynoir-essay/?ref=privacy.thenexus.today) is a good introduction. Note that best practices are to capitalize the B in Black. CU Denver's [Is the B in Black Capitalized? Yes.](https://news.ucdenver.edu/is-the-b-in-black-capitalized-yes/?ref=privacy.thenexus.today) and [Why we capitalize ‘Black’ (and not ‘white’)](https://www.cjr.org/analysis/capital-b-black-styleguide.php?ref=privacy.thenexus.today) in *Columbia Journalism Review* have more on the capitalization. Since many non-Black people don't know this best practice, this is also a great example of how easy it is to unintentionally say something unfortunate. For terminology related to "the fediverses", "the Fediverse", and the "Open Social Web" see [the brief summary in the footnotes](#fn-open-social-web), or the much more detailed discussion in [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses). ## Notes 0 Sean Tilley's [FediForum Has Been Canceled](https://wedistribute.org/2025/03/fediforum-canceled/?ref=thenexusofprivacy.net) on *We Distribute* (March 31) and Laurens Hof's discussion of the cancellation in [Fediverse Report – #110](https://fediversereport.com/fediverse-report-110/?ref=thenexusofprivacy.net) (April 1) are as far as I know the only media coverage of the cancellation so far. Sean's coverage has examples of the anti-trans tweets, reactions from the community and the remaining organizer, and official conference announcements. These stories were both produced under intense time pressure, and I'm sure both authors had a lot of other things on their plate – another example of the stress I talk about in [A last-minute cancellation has a big impact](#last-minute). Unsurprisingly, though, there's a lot that didn't make it into these stories. For one thing, while the articles focused on the anti-trans aspects, that wasn't the only thing going on – as I'll explore in great detail in this article. And while Laurens' coverage notes that "various prominent community members announced that they were either withdrawing themselves from the event, or said that they personally would not want to go to the event," neither article mentions that people continued to reaffirm that they weren't going even after the initial announcement that the now-ex organizer would be "transitioning out" (oops, not the best choice of words) and further clarification that the conference would be cutting ties with the now ex-organizer (a good decision, but not enough to change the dynamics). Also, while the tweets featured in the article were indeed the ones that kicked off the firestorm after Michelle Hughes called attention to them, they're only the tip of the iceberg. There are also screenshots of tweets by the ex-organizer saying other hateful things (including remarks infantalizing autistic people), and [this post](https://mastodon.social/@lizzard/114248871461510739?ref=thenexusofprivacy.net) by queer/trans disability justice activist Liz Henry:[1](#fn-ambiguous) > "When I asked you face to face about the pattern of the things you interacted with on Twitter, you were liking some pretty extreme statements. Including stuff about nonbinary people being confused, mutilating themselves, as well as hateful things about trans women and about trans kids and their parents. And you talked with me about your thoughts about how trans women shouldn't be in women's sports, but that "people can wear whatever they want". Have your views changed?" And as Tariyé Peterside discusses in [Caster Semenya: When Fairness Is False](https://www.sludge.online/caster-semenya-when-fairness-is-false?ref=thenexusofprivacy.net), "transmisogyny is a backdoor facilitator for misogynoir": saying that ban trans women and girls should be banned from participating in sports is also an attack on Black women. Anyhow, while I certainly don't mean any of this as a criticism of the articles that have been published so far, there's still room for more reporting here. If any journalists happen to read this article, depending on the direction you decide to take your story, it may also be worth looking at the pattern of [who has benefited the most from FediForum](#fn-who-benefits), and [the open question I talk about elsewhere in the footnotes](#open-question). 1 The now-ex organizer's comment “I fully stand by the statement you are commenting on" was in reply to the post from the queer/trans disability justice activist describing their in-person discussion from last year. Sean Tilley describes this comment as "ambiguous," and looking at the context I have to agree. The "statement" being referred to here is probably the original post in the thread, quoted in the article, saying that the now-ex organizer fully supports trans people's right to exist ... so it probably isn't intended as a reaffirmation of the anti-trans views. Then again, this reply *didn't* acknowledge, disavow, or apologize for the anti-trans views that were being discussed, so in reality it really is standing by those as well, and impact > intent. In the section on [Acknowledgment, apology, amends, action](#aaaa) I describe this as an example of how *not* to do it. It's important to keep the broader context in mind here. Anti-trans bigots are succeeding in taking away trans people's rights: trans people can't get passports, trans people can't get visas to the US, congress just passed a bill that would prohibit most trans people from voting, trans people are getting booted from the military. No matter whether or not the now-ex organizer believes that her claim that "I fully support the right of trans people to exist, thrive and live their lives to the fullest with equal rights and dignity", she's siding with and amplifying the propaganda of the people who are taking away trans people's rights. Impact > intent. 2 More terminology! The "[Open Social Web](https://www.getopensocial.com/?ref=thenexusofprivacy.net)" is a term surveillance capitalism companies and their friends have been using since at least 2008 either as a synonym for "the Fediverse" or "the fediverses". FediForum used to be about "the Fediverse", and I'm not quite sure when they changed their focus. [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) is a deep dive into terminology. A couple of excerpts: - **"the Fediverse"** is a fediverse whose boundaries, culture, software, protocols, change over time. and mean different things to different people but typically include a network organization based on **instances**, a specific kind of server . Since 2018 or so most people have used "the Fediverse" to refer to an ActivityPub-centric fediverse, and when I use the term, that's what I'm referring to that way – but that's not the only fediverse out there! - **a fediverse** (a portmanteau of "federation" and "universe") is a decentralized social network of federated (i.e. interconnected) servers, and the people and organizations with accounts on them, that communicate through one or more protocols, bridges, and hubs. Participants in a fediverse can be social networks (either centralized or decentralized) in their own right; participants can also be part of multiple fediverses. The "Open Social Web" framing puts focus on the "openness." Chris Messina's 2008 blog about [the "open, social web"](https://factoryjoe.com/2009/05/18/the-open-social-web/?ref=thenexusofprivacy.net) is a good reminder of how long companies with surveillance capitalism business models have been trying to push this as a brand. This post was written back when Messina was at Google, long before he started running a VC fund backed by Marc Andreessen and became an advisor to the Meta-friendly [Social Web Foundation](https://thenexusofprivacy.net/swf-and-the-meta-elephant/). "Open Social" was at the time was a specification developed by Google, Ning (a company Andreessen had co-founded), MySpace and other social network companies. Attempts to use "Open Social Web" as a synonym for "the Fediverse" erase the oppositional view that Aymeric Mansoux and Roel Roscom Abbing discuss in "The Fediverse as an Ongoing Critique of Openness" (in [Seven Theses on the Fediverse and the Becoming of F/LOSS](https://test.roelof.info/log/seven-theses/?ref=thenexusofprivacy.net)). See also Jamie Theophilus' [Closing the Door to Remain Open: The Politics of Openness and the Practices of Strategic Closure in the Fediverse](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=privacy.thenexus.today#bibr116-20563051241308323). In *Hacking Diversity,* Christina Dunbar-Harris discusses the tensions between safety and the common definitions of "openness", and that's one of the things going on here as well. 3 A few specific examples of benefits to FediForum attendees: - A session in September 2023 on [Testing the Fediverse / Fediverse test suite](https://fediforum.org/2023-09/session/5-e/?ref=thenexusofprivacy.net) led to funding from NLNet to develop [FediTest](https://feditest.org/?ref=thenexusofprivacy.net), a test framework for interoperability of federated social media platforms – with the convener of the sesssion as a lead developer for the project (which also wound up using a product from his startup). - The session on [An advocacy organization for the Fediverse](https://fediforum.org/2024-03/session/3-a/?ref=thenexusofprivacy.net) led in spring 2024 led to Meta funding the Social Web Foundation, a non-profit the convener co-founded later that year – with FediForum's organizers listed as advisors - It's very hard for most Fediverse projects to get any media coverage, and FediForum sometimes provides an opportunity. Richard Macmanus' [FediForum Showcases New Fediverse Apps and Developer Network](https://thenewstack.io/fediforum-showcases-new-fediverse-apps-and-developer-network/?ref=thenexusofprivacy.net) (March 2023), for example, discusses Newsmast, Emissary, IFTAS' FediCheck and the Fediverse Developer Network as well as Meta's Threads. A [Washington Post article](https://archive.ph/o6mPt?ref=thenexusofprivacy.net) quotes a FediForum organizer hilariously suggesting that Meta "is actually at the forefront” of the industry's transformation from proprietary to open networks. Fediforum's website also links to media coverage of [**Threads**](https://www.theverge.com/24106231/threads-fediverse-demo-meta-fediforum?ref=thenexusofprivacy.net), [Threads](https://www.theverge.com/2024/9/12/24243201/an-invitation-to-the-fediverse?ref=thenexusofprivacy.net), [Threads](https://techcrunch.com/2024/03/21/threads-opens-beta-to-let-users-connect-their-accounts-to-the-fediverse/?ref=thenexusofprivacy.net), [Threads](https://techcrunch.com/2024/09/12/threads-makes-it-easier-to-evangelize-the-open-social-web-with-a-new-direct-link-feature/?ref=thenexusofprivacy.net), [Threads](https://www.engadget.com/meta-previews-fediverse-sharing-for-threads-001632698.html?ref=thenexusofprivacy.net) [Threads,](https://9to5mac.com/2024/03/20/threads-joining-the-fediverse/?ref=thenexusofprivacy.net) and [Threads](https://www.timesnownews.com/technology-science/meta-is-bringing-threads-to-the-fediverse-aims-to-build-cross-platform-posting-and-sharing-article-108637860?ref=thenexusofprivacy.net). 4 As Teh Portly Dyke also points out, skipping the acknowledgement and apology doesn't work. Last fall, the fedidevs chat rooms finally banned a well-known anti-trans fascist supporter who had been lurking there for months since his last posts. That's good! But from what I've heard they banned him because he was making people uncomfortable, not for being anti-trans or a fascist, which means there wasn't really any acknowledgement – and I don't think they've ever apologized for not taking action earlier or even acknowledged that yeah, they really should have. By contrast, an experience I had several years ago in an anti-oppressive political activism organization mostly led by people of color is a good example of the Four As. One of the white leaders of the group said some unfortunate anti-Black things – unintentionally, but impact > intent. Then, while attempting to explain the situation, she made things worse. She wound up writing a detailed apology that fully acknowledged the problems, and took action by offering to resign from her leadership role. The rest of the leadership team accepted the resignation, made amends to the people who had been directly harmed, and then took action by adding another Black person to the leadership team, reviewing the group's community agreements, and helping white group members see it as a learning opportunity. 5 [Internet Identity Workshop](https://internetidentityworkshop.com/?ref=thenexusofprivacy.net) (IIW) held last week, which as far as I know hasn't even acknowledge the issue. I haven't seen any reports of IIW acknowledging the incident or apologizing, let alone taking action. On Xitter, another organizer posted saying there was a [full house](https://x.com/windley/status/1909669975977345407?ref=thenexusofprivacy.net) along with photos of a conference room packed with people, almost all of whom were white and almost all of whom were guys. The Friday night before IIW was supposed to start I realized I still. had an active login for their wiki (an organizer had comped me once years ago in hopes that I could help with IIW's race and gender equity issues) and debated about posting it as a suggested topic 😈. Alas, when I checked back the site was down, apparently due to an out-of-date ssl certificate 🤷🏻‍♂️. On the one hand I'm sympathetic, I've often botched SSL certificate renewal ... on the other hand IIWs typical attendees are mostly cis so it's quite possible nobody brought it up either. 6 One example: the co-chair of the ActivityPub committee admitted [in 2023](https://cosocial.ca/@evan/112962314153943451?ref=thenexusofprivacy.net) that he had never apologized publicly to the other co-authors for what he described as a "traumatic experience": > "I wanted AP to exist so bad, I didn't pay attention to how hard it was for you. You all told me how much it sucked at the time, and I cajoled you to push on just a little farther. That was wrong. I'm sorry." 7 Based on what I've heard heard from attendees at this event, and a quick look at the speakers on DotSocial's [Fediverse House Highlights Reel](https://flipboard.video/w/1vjJdhLukXZgm4rks8RwMK?ref=thenexusofprivacy.net) (with Molly White, Bluesky COO Rose Wang, and 8 guys) the answer might well be "none," but I wasn't there in person so am not completely sure. 8 Not as far as I know. Again, though, I wasn't there in person so am not completely sure. If anybody's got info on this – and in particular whether FediPact was discussed – I'm interested in hearing. 8.5 Social Web Foundation Executive Director Mallory Knodel (who moderated the RightsCon panel) [writes that](https://techpolicy.social/@mallory/114360240078668226?ref=thenexusofprivacy.net) "queer, specifically trans, community building on the fediverse was raised," and that "queer and trans issues broadly underpinning the outline of your post" were mentioned. So there was at least some mention of trans perspectives, and if anybody's got more details on just what was discussed please let me know and I'll add it to this footnote. Still, at least from what I've heard so far, it doesn't seems to me like trans perspectives were accurately represented. For example, Mallory [confirmed](https://techpolicy.social/@mallory/114361770176978264?ref=privacy.thenexus.today) what I had previously heard from an attendee: there was no mention of the [Anti-Meta FediPact](https://fedipact.online/?ref=privacy.thenexus.today). One of the reasons Vanta Black (the trans enby gender terrorist who created the FediPact) gives for blocking Meta is "[to protect the existing communities of marginalized people on the fediverse](https://fedipact.online/why?ref=privacy.thenexus.today), many of whom rely on it to survive". As I noted in [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/), "almost none of the largest LGBTQIA2S+- focused instances are planning on federating with Threads – and many have signed the Fedipact". And that's not surprising! As Vanta says in [Why?](https://fedipact.online/why?ref=thenexusofprivacy.net) > "try being trans and on facebook, having a list of common suicide methods sent to you by a bigot, and reporting it. they'll do goddamn nothing. a real, personal, and depressingly common example > > being okay with meta joining the fediverse is being okay with cosigning every goddamn trans person who chooses to remain on here to a future of constant harassment" So, even though trans community building on the fediverse was mentioned at the RightsCon session ... the perspectives of the trans people and trans communities organizing to protect trans communities against the threat were erased. 9 In [The Social Web Foundation and the elephant in the federated room](https://thenexusofprivacy.net/swf-and-the-meta-elephant/) I noted > "SWF's launch post has quotes from partners Eugen, Rob, Matthias, Mike, Jaz-Michael, Jon (not me, a different Jon), Bart, John, and Matt ... and their [Launch link round-up](https://socialwebfoundation.org/2024/09/29/launch-link-round-up/?ref=privacy.thenexus.today) has posts from advisors Ben, Johannes, Chris, and another Chris," so hopefully it'll be more diverse than thi Hey wait a second, I'm noticing some patterns here!" Ironically, FediForum's now-ex organizer was the only woman SWF explicitly named as an advisor with they launched. The now-ex organizer was also one of the very few women at the invitation-only 2010 Federated Social Web summit, hosted by Evan Prodromou's venture-funded startup years before he became co-founder of SWF. A picture is worth a thousand words, so check out James Walker's photo that I use at the start of [Before Mastodon: GNU social and other early fediverses](https://thenexusofprivacy.net/mastodon-a-partial-history/#pre-history). And, she's also the only woman mentioned in [Prodromou's 2023 post](https://cosocial.ca/@evan/111327470820680942?ref=thenexusofprivacy.net) talking about how long "many of you have been allies and friends" – which also included FediForum's remaining organizer, [Chris Messina](#fn-chris-messina), and several other guys. 10 I saw a classic example of marginalizing youth at a previous FediForum where a session a student was leading was derailed by an older white guy who repeatedly returned the topic to a 1990s project that he mistakenly thought was relevant. As an attendee at the session, I did my best to convince the older white guy to STFU, but without positional power wasn't able to. The conference organizers, who had the positional power, didn't get involved. Of course that could be because they didn't realize it was going on, but wait a second, they're the ones running the conference and charging people money for it; it's their responsibility to try to prevent stuff like this from happening and step in when it does. 11 At one point, for example, I suggested an approach to improving the situation that would have cost some money. The organizer said they didn't have the budget for it, and when somebody from a commmunity that's been very underrepresented at FediForum made a similar suggestion in a since-deleted post in another thread, they got a similar response. So I suggested crowdfunding. The organizer replied that it wasn't an option because it would require time and energy. Well, yeah, crowdfunding requires time and energy. When an organizer says he doesn't want to spend their time and energy addressing equity problems, what kind of message does he think he's sending? Don't get me wrong, crowdfunding can be difficult. Still, as TDr. Linda Maepa showed with her work on the [Umoya Fellowship](https://bsky.app/profile/lmaepa.bsky.social/post/3ljkbmjjdsk2n?ref=blog.rudyfraser.com) to make sure folks from Blacksky could attend the first Atmosphere Conference, it's possible in exactly this situation. And it can really have an impact – see Clinton Bowen's [Inaugural ATmosphere Conference and the Umoya Fellowship](https://torrho.com/blog/atmosphere-2025-conference/?ref=thenexusofprivacy.net), for example. But, it would have taken too much of the FediForum organizers time and energy, so they didn't go that route. Of course, crowdfunding isn't the only option. I also suggested getting corporations who are investing in the Fediverse to fund it, and he replied that they were concerned that taking corporate money for this would undercut FediForum's perceived independence, so didn't want to do it. This year, FediForum has introduced higher-priced tickets for corporate employees – i.e., they're taking money from corporations who are investing in the Fediverse. And don't get me wrong, as the list of press coverage elsewhere in these footnotes shows Meta is getting a lot of value here, it's reasonable they should pay for it! But FediForum isn't using this money it's raising this way (at the risk of undercutting perceived independence) to pay people from underrepresented communities to attend. In fact, I talked with one person from a very underrepresented community who one of the organizers reached out to who was flabbergasted when after being invited to speak, they were then told that they'd have to pay for the privilege. Sigh. 12 A few of the suggestions for making progress: - In terms of the format, somebody at the roundtable suggested a hybrid, with one day of pre-scheduled talks followed by a day of unconference. - There was also an excellent suggestion of paying ambassadors from communities that were underrepresented, not just to attend as tokens but to work with the conference and community to make it more attractive. - The notes mention that IFTAS sponsoring people was actually helpful from a diversity perspective. It was at fairly short notice, so a lot of people had conflicts and the uptake wasn't huge, but even so it led to more diverse participation – including an admin of one of the very few US-based Muslim-focused instances. And IFTAS isn't the only non-profit out there! There really is a lot of low-hanging fruit. 13 Deleting your account not only deletes every post you've ever made it makes it harder to follow discussions you were involved in, and can also led to deleting messages from people who have responded to you – which it did in this case to every reply one of my accounts had ever made to the remaining organizer, including the ones in these threads. Talk about a violation of the principle of least surprise! One way to look at this is as an interesting example of the complexities of federation between platforms with subtly different threading and reply models. Then again, my first thought at the time wasn't "oh what an interesting software engineering issue", it was "wtf happened to my posts?" If you want the details: the account I was posting here was on blahaj.zone, which runs Sharkey. Sharkey, like other forks (variants) of Misskey, has a model like Facebook and forums: deleting a post also deletes replies. The remaining organizer, however, was posting from social.coop, which runs Mastodon. Mastodon has a model more like Twitter where each post is its own entity and they just happen to be threaded together, so when you delete a post replies *shouldn't* get deleted. But a delete's a delete, so Sharkey didn't take that into account. A couple of takeaways: - if you're using Sharkey, Misskey, or any of the other \*keys, this is good behavior to know about! - a reader of an earlier draft of the post suggested that deleting your account when you leave an instance (as opposed to "migrating" your account to a new instance and keeping the history in place) is fairly normal. If you're thinking of doing that, remember that it's going to disrupt others' conversations and (if anybody has replied to you from \*key) potentially delete other people's posts. - if you're doing anti-racism work online, or any other anti-oppression work, it's good good reminder to *always get screenshots* (which I unfortunately didn't in this case, oops). 14 There's also an open question here: when did the remaining organizer first find out about the problem? In the discussions somebody talks about confronting the now-ex organizer last year, so it had clearly been known for a while; and I've heard from other people that it's been circulating on whisper netwroks. Is the deperture of FediForum's third co-organizer related to this in any way? Anyhow, if the remaining organizer knew but didn't take action, that's a different situation. And if he was blindsided by this, it's a good time for him to ask himself why nobody told him he was running a conference with a TERF. 15 Serano originally described transmisogyny in *Whipping Girl* in terms of the intersection of “traditional sexism” (the notion that femaleness and femininity are inferior to, or less legitimate than, maleness and masculinity) and "oppositional sexism” (the belief that female and male are rigid, mutually exclusive categories, each possessing a unique and nonoverlapping set of attributes, aptitudes, abilities, and desires). In [Is Transmisogyny Killing Trans Women of Color? Black Trans Feminisms and the Exigencies of White Femininity](https://read.dukeupress.edu/tsq/article/4/2/226/84749/Is-Transmisogyny-Killing-Trans-Women-of-Color?ref=thenexusofprivacy.net) (2019), Elías Cosenza Krell suggests that while Serano’s scholarship has contributed greatly to the conversation on cis/sexism and the devaluation of femininity,"her scholarship elides race and class and allows white middle-classness to stand in as a universal, greatly diminishing the capacity of transmisogyny to describe the oppression(s) that trans women of color, and Black women in particular, face." In [What Is Transmisogyny?](https://juliaserano.medium.com/what-is-transmisogyny-4de92002caf6?ref=thenexusofprivacy.net) (2021), Serano writes > "Multiple things can be true at once. Transmisogyny can be a vital term for some of us to communicate the intersection of transphobia and misogyny that we face. But others may experience it more complicatedly or severely, as in the case of transmisogynoir. And for others (e.g., certain nonbinary people, trans male/masculine-spectrum people), misogyny may intersect with transphobia in different ways that aren’t adequately articulated by transmisogyny. This doesn’t necessarily make transmisogyny “wrong”; it may simply mean that we need additional language." ## Update log *Ongoing: typo and wording fixes, additional links, more details in footnotes, and other minor changes* May 7: changed description to SWF in a footnote to "Meta-friendly". I had previously written "Meta-funded", but while the reporting at their launch said that they had funding from Meta, and [their just-released annual report ](https://socialwebfoundation.org/2025/05/06/reflecting-on-our-first-year-the-social-web-foundations-2024-annual-report/?ref=thenexusofprivacy.net)confirms that they have received financial and in-kind support from Meta as well as other organizations, they don't include Meta on their list of financial sponsors. Of course it's very carefully worded; they only report "non-contractual funding ahead of their September 2024 launch" ... so who knows. Looks like I need to update [The Social Web Foundation and the elephant in the federated room](https://thenexusofprivacy.net/swf-and-the-meta-elephant/). April 24: add update about [second listening session](#second-listening-session) April 17-8: [clarify definition of transmisogyny](#fn-rightscon) and provide [additional information on RightsCon panel](#fn-rights-con) in new footnotes April 14: First published version. April 11-13: Restructure based on FediForum's draft summary notes; include new sections on the impact and terminology notes April 7-10: Various revised drafts, shorter and more forward-looking, while waiting for FediForum's notes from the roudtable. April 5-6: Early draft – less focused, less positive. Thanks everybody for the feedback ### More notes on Organizing, Mutual Aid, and Activism on decentralized social networks URL: https://thenexusofprivacy.net/more-notes-on-organizing/ Last updated: 2026-04-16T03:29:34.000Z *Part 3 of a series. See* [*If not now, when? Mutual aid and organizing in the fediverses, the ATmosphere, and whatever comes next*](https://thenexusofprivacy.net/if-not-now-when/) *and* [*Notes (and thoughts) on organizing in the fediverses and the ATmosphere*](https://thenexusofprivacy.net/notes-on-organizing-in-the-fediverses/) *for previous installments and a reading list.* > "Mutual aid. Organizing. Sharing, contextualizing, and making meaning of news and health information to counter propaganda and information overload. The use cases for alternative social networks – not controlled by techbro white supremacist CEO's working with their cronies in authoritarian governments – practically write themselves in today's world. And with so many talented social scientists, designers, systems thinkers, and developers directly impacted by DOGE, MAGA, et al, there are a lot of people with the right skills for these new networks to make rapid progress.... > > How to make more rapid progress? The decentralized nature of the fediverses (and the limitations of current tools) makes it challenging to broaden participation and find synergies between the promising work that's happening. Still, gotta start somewhere." > > – [If not now, when? Mutual aid and organizing in the fediverses, the ATmosphere, and whatever comes next](https://thenexusofprivacy.net/if-not-now-when/) After the series of conversations with organizers summarized in [Notes (and thoughts) on organizing in the fediverses and the ATmosphere](https://thenexusofprivacy.net/notes-on-organizing-in-the-fediverses/), my original plan was to continue conversations at [ATmosphere Conf](https://atprotocol.dev/atmosphereconf?ref=thenexusofprivacy.net) in late March and [FediForum](https://fediforum.org/?ref=privacy.thenexus.today) in early April. There's a lot to say about both conferences, and I'll hopefully cover that in some upcoming posts, but here's the brief summary: - ATmosphereConf was outstanding, and talks like Rudy Fraser's [Beyond Horseless Carriages: Building Communities for the Decentralized Era](https://youtu.be/OZN8y8kVFFI?si=7E4ShuZW8M8BXhgt&ref=thenexusofprivacy.net) and Erin Kissane's [People in Platforms](https://youtu.be/mMIhkA8QEKc?si=IcKYU0oHZwFnvcY9&ref=thenexusofprivacy.net) did a great job of highlighting the possibilities, challenges, and potential directions. - [FediForum by contrast wound up getting cancelled at the last minute](https://thenexusofprivacy.net/not-just-fediforum/) due to several examples of what I had described in [If not now, when?](https://thenexusofprivacy.net/if-not-now-when/) as "huge cultural issues as well, including anti-Blackness, misogynoir, anti-trans biases." Oh well. Still, why let the FediForum organizers' screwups sabotage a worthwhile conversation? Several of us had put a fair amount of work into organizing discussions for FediForum, so we decided to go ahead with a session anyhow[0](#notes) – and it turned out to be a great discussion. Here's the notes, along with a couple of the slides from [the brief intro deck](https://thenexusofprivacy.net/data/organizing-0401.pdf), augmented with some additional links and context (primarily in the [footnotes](#notes)). [![Social networks complement other kinds of organizing . Social networks are (potentially) good for: Sharing public information (events, actions, alerts) with a broad audience. Following and having discussions with activists, journalists, politicians, organizations, etc. Tracking news. “Private” discussions (like Facebook groups). Social networks are not good for Secure communications. Use Signal! Make sure you check who’s in your group chat!!!!!](https://thenexusofprivacy.net/content/images/2025/04/social-networks-and-online-organizing.png)](https://thenexusofprivacy.net/data/organizing-0401.pdf) From the [slide deck](https://thenexusofprivacy.net/data/organizing-0401.pdf) Before we got to social networks, we first talked about more secure communications options. There was general agreement that Signal is the gold standard for a free, highly-usable, encrypted messaging with guarantees that you can rely on. If you're not using Signal yet, [now's a great time to get started](https://ssd.eff.org/module/how-to-use-signal?ref=thenexusofprivacy.net)! But ... - Signal is centralized, so it's a single point of failure and entity for governments to target - Once you're in a bunch of Signal group chats (or even one large one) the notifications become overwhelming. Decentralized alternatives like Matrix or XMPP avoid the single point of failure problem. Both have richer functionality than Signal, and Matrix allows for more structure for multiple conversations ... but because they allow multiple client and server implementations, provide weaker security guarantees. And while their usability is pretty good most of the time, there are very definitely rough edges – a real problem, because as one of the attendees said, their standard for usability is "can my cousins use this?"[1](#fn-secure-messengers) And in practice, operational security is a huge challenge no mater what platform you're using. If you mistakenly add a journalist to your group chat, it doesn't matter how good your encryption is. A mutual aid organizer on the call talked about complexities like needing to disable people's accounts when they were arrested, and constant discussions about when to purge accounts that had been inactive for a while: "all these nuances get tricky even when an Instagram group chat is right there." ![Key use cases. Public communications: getting the word out about events, action alerts, programs; recruiting new people; fundraising and asking for resources; messaging sharing; contextualizing accurate news and information; countering disinformation and propaganda. Private” (ish) communications: within a group's leadership team; between leadership and members (announcements; questions and answers; polls and surveys; discussions); cross-group (coalitions of different groups, chapters in a distributed org, working groups of individuals); sharing secure contact info](https://thenexusofprivacy.net/content/images/2025/04/key-use-cases.png) So in practice, at least for now, social networks are also critical for private-ish communications as well as public communications. As an attendee said > "It makes sense to have many options and understand that they are at different levels of effectiveness, the most important is to build that community and that trust." And of course social networks are also critical for public communications. With protest and dissent increasingly criminalized, it's an open question how long public social network organizing (or even sharing news and discussions) and private-but-not-encrypted social network organizing will be a viable options. Still, at least for now they are for many people in many situations, so we need to make the most of this window – while continuing the work on more secure options. At least for now, public organizing on decentralized social networks seems to be largely coalescing on Bluesky and the ATmosphere (the ecosystem of software using Bluesky's AT Protocol, as opposed to the older ActivityPub protocol that Mastodon and compatible software is built on).[2](#fn-terminology) ATProto is optimized for large, all-public networks, and its identity model allows Bluesky's millions of users easy access to any other AT-based app. Bluesky's support for three-minute videos, and the emergence of [Spark](https://sprk.so/?ref=thenexusofprivacy.net), [Skylight Social](https://techcrunch.com/2025/04/01/mark-cuban-backs-skylight-a-tiktok-alternative-built-on-blueskys-underlying-technology/?ref=thenexusofprivacy.net) and other "video on ATProto" platforms, is also hugely important on this front. "When we get arrested at mutual aid, videos go viral – we see that people are reaching our content, and journalists see it." And Bluesky's custom feeds and labellers have a lot of potential. Bluesky's still relatively small compared to the big corporate social networks, but it's growing rapidly; and at least in the US and Brazil, we're starting to see a fair number of media outlets, politicians, and journalists there. But Bluesky is still a lot less diverse than Xitter, Instagram, or TikTok, especially for non-US-based content. Social media plays a critical role in routing around the selective and extremely biased coverage of the New York Times and other mainstream media outlets; as one of the attendees said, "I didn't find out about the Tigray genocide until I saw it discussed on Twitter." Even now, Xitter is a much better place to find accurate information about Sudan or Palestine than Bluesky. Not only that, Bluesky's default Discover algorithm is not great for organizers (unless you're into blue wave emojis, resistance grifting, and engagement farming). In principle, ATProto custom feeds give a way of getting around this – and they really are incredibly useful once you find the right ones. But power dynamics are a big problem here. How are people going to find custom feeds that don't just reinforce the party line? Today, only a handful of custom feeds have significant adoption, and at least so far none of them are tuned for organizing. So there's still a lot of work to be done on this front. ## A huge gap, although there's some encouraging stuff happening Still, despite the challenges, a lot of the functionality needed for public conversations on decentralized social networks is already available. That's a lot less true for private-ish conversations. One critical gap is any decentralized equivalent to Facebook groups. Facebook is evil, but Facebook groups can work for thousands of people in ways that messaging systems can't (yet).[3](#fn-fb-studies) The ActivityPub protocol that powers Mastodon, PeerTube, Mobilizon, GoToSocial, Bonfire and compatible software *should* be a good basis for this. But no. In my 2017 Open Source Presentation on [Grassroots activism is hard. Can open source help?](https://docs.google.com/presentation/d/1CzB8Wj1gj8NTlmC4XYbYReXEjsEHPHOTp9-KwXHULD4/edit?ref=thenexusofprivacy.net#slide=id.g1e73da5d9a%5F0%5F1) (also available in a [high-contrast version here](https://docs.google.com/presentation/d/1xEjrn4jP1Lz3jb70G7hClV5SyAmyelm9bhYN68J-A1k/edit?ref=thenexusofprivacy.net#slide=id.g1e782482de%5F0%5F0)), I talked about the importance of this functionality... eight years later, as the section on [Private communications](https://thenexusofprivacy.net/notes-on-organizing-in-the-fediverses/#private-communications) in the earlier *Notes* post illustrates, the lack of progress is striking. Other kinds of private-ish communications in the ActivityPub world are also problematic. Mastodon private messages make it very easy to accidentally include somebody in a message that wasn't intended for them ... talk about violating the principle of least surprise! And the [recent Pixelfed vulnerability](https://fediversereport.com/fediverse-report-110/?ref=thenexusofprivacy.net) (which affected people on Mastodon and other platforms as well) is only the latest in a long string of times when followers-only posts were exposed. More positively: - [Local-only posts](https://github.com/hometown-fork/hometown/wiki/Local-only-posting?ref=thenexusofprivacy.net) (which don't federate to other instances) do provide some very useful private-ish communications on ActivityPub.[4](#fn-local-only) - Platforms like [Bonfire](https://bonfirenetworks.org/?ref=thenexusofprivacy.net) (which is just about to start beta testing) have much more flexible support for private communications.[5](#fn-friendica) - [The Website League](https://websiteleague.org/?ref=thenexusofprivacy.net) and other [island networks](https://writer.oliphant.social/oliphant/islands-an-opt-in-federated-network?ref=privacy.thenexus.today) (subnetworks using allow-list fedieration) are an interesting, relatively-new approach that in addition to other benefits provides alternatives to public communications. Meanwhile, Bluesky has announced plans to extend ATProto to support private communications, and various ATmosphere projects are exploring off-protocol implementations; Blacksky's [Cypher](https://github.com/blacksky-algorithms/rsky/tree/main/cypher?ref=thenexusofprivacy.net) project (bringing local-only posts to the ATmopshere) and Rashid Aziz's AtmosphereConf talk on [Protocol composition: extending atproto for private data for one interesting example](https://youtu.be/o4W3oZPRSD8?si=JJJcS5Qrg2CIOwmZ&ref=thenexusofprivacy.net) are two useful examples. It's all early days yet, but the enthusiastic response to Rudy Fraser's just-published [An internet of many autonomous communities](https://blog.rudyfraser.com/an-internet-of-many-autonomous-communities/?ref=thenexusofprivacy.net) is very encouraging. Still, there's clearly a lot of work to be done on this front as well. Right now, the best option for private communications is probably a forum like NodeBB, which currently support non-decentralized private discussions along with decentralized public discussions that are compatible with Mastodon and other AcitivityPub platforms – and with Bluesky, thanks to [Bridgy Fed](https://thenexusofprivacy.net/notes-on-organizing-in-the-fediverses/#bridgy-fed). ## Let's talk about some of those cultural issues - and about accessibility We also spent some time discussing the "fediverse HOA" (homeowners association) problem.[6](#fn-hoa) [Refugees in Libya](https://www.refugeesinlibya.org/?ref=thenexusofprivacy.net) ran into a classic example of this when they attempted to use Mastodon: people giving them a hard time because they weren't putting content warnings (CWs) on their posts. I mean really, wtf. These are people who have been enslaved and tortured, whose communities are being hunted by the Libyan government, and whose organizing in Italy is being shut down by the police and attacked with live ammo. Who on earth would tell them that they should put content warnings on their posts because people might not want to hear about the harms? The fediverse HOA, that's who![7](#fn-cws) Needless to say this is only one example of a much broader pattern. Erin Kissane's [Mastodon is easy and fun except when it isn't](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=privacy.thenexus.today) summarizes experiences from Bluesky users who had tried Mastodon but didn't stick around, and #1 on the list is "got yelled at, felt bad." Of course, most people on Mastodon aren't like that, but quite a few are. And while there's a lot more to the ActivityPub Fediverse than Mastodon, it's still by far the largest – and best-known – software platform, so it really sets the tone. We also discussed the experiences of a deaf-blind person who gave up on Mastodon because it wasn't accessible.[8](#fn-accessibility) On the other hand, accessibility on Bluesky is worse – both in terms of the software and the prevalance of alt text on images. So there's a lot of work to be done on these fronts as well. Hey wait a second, I'm noticing a pattern here. ## Value propositions, language, and the (real) complexities of decentralization Another topic that came up, as it does in most conversations about decentralized social networks, is the challenge of bringing people from centralized, corporate social networks. Advocates often focus on the very real problems with Facebook et al, but as Rudy Fraser said in [Beyond Horseless Carriages](https://youtu.be/OZN8y8kVFFI?si=7E4ShuZW8M8BXhgt&ref=thenexusofprivacy.net), trying to scare people into moving is a lot less effective than giving them positive reasons to move. And advocates often focus on decentralization as a benefit ... and then go on to o explain the details of decentralization, which immediately gets so complex that you've already lost them. No, [it's not "just like email"](https://thenexusofprivacy.net/flatness/#not-just-like-email)! There are clearly better ways to talk about it. Blacksky users, for example, explain decentralization well – because [it's clear to them that Blacksky couldn't exist on a centralized platform](https://bsky.app/profile/rudyfraser.com/post/3lkjgvvqotk2f?ref=thenexusofprivacy.net). How to similarly demystify it and explain the value proposition for activists ... and everybody else? That said, it's not just the language. As Engine Room's report on [Exploring a transition to alternative social media platforms for social justice organizations in the Majority World](https://www.theengineroom.org/library/new-report-exploring-a-transition-to-alternative-social-media-platforms-for-social-justice-organizations-in-the-majority-world/?ref=privacy.thenexus.today) says, > **"**A transition to alternatives needs to be centered around the needs and capabilities of non-technical communities. Alternatives have a higher technological barrier to entry than mainstream platforms with easy user interfaces. Moreover, alternative platforms can be expensive for smaller organizations to host and maintain their own servers (e.g. self-hosting an instance of Mastodon may require a dedicated staff member \[s\] with technical expertise), as opposed to using a commercial platform." [Decentralization makes many things more complicated](https://thenexusofprivacy.net/resources-for-choosing-instances/#decentralization), and the user experience often makes it worse. One of the people on the call talked about their experience inviting a lot of activists to a Mastodon instance (aka server) they had set up. Despite helping them with tutorials and one-on-one support, most didn't stay. And this experience is far from unique; the summaries in [Mastodon is easy and fun except when it isn't](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=privacy.thenexus.today) for why people didn't stick around include "couldn’t find people or interests, people didn’t stay", "too confusing, too much work, too intimidating", "too serious, too boring, anti-fun", and "complicated high-stakes decisions."[9](#fn-choosing-instance) And while on the one hand the ability to control your own data is a huge advantage ([DAIR's use of PeerTube](https://peertube.dair-institute.org/?ref=thenexusofprivacy.net), ensuring that they can reach their audience even when YouTube censors them, is a great example), it also means that you have to run your own servers. Even the small number of organizers who have the technical skills to do this (and do it securely) would rather not, because it's a huge time sink; and most organizers *don't* have the skills.[10](#fn-non-technical) The good news is Bluesky is easier to get started on (although finding the right labellers and blocklists as well as custom feeds is challenging). And in the ActivityPub Fediverse, there are lots of other options besides Mastodon; [A lot of good stuff is happening in the fediverses!](https://thenexusofprivacy.net/good-stuff-in-the-fediverses/) talks about why I'm so excited about GoToSocial, Bonfire, Letterbook, Piefed, and other platforms, and that's only the tip of the iceberg. Still, none of those are as high-profile as Mastodon (or other relatively-well-known projects like Pixelfed or Lemmy that suffer from many of the same issues as Mastodon), so it's a huge challenge. Not to sound like a broken record but ... guess what, there's a lot of work to be done on all of these fronts. ## Let's get organized! You probably won't be surprised to hear that we didn't solve all of these issues during our one-hour discussion. We did however decide on some concrete next steps: collecting and prioritizing organizing, mutual aid, and activism needs – and then working with projects and organizations who are (hopefully) incentivized to make progress on these issues – Bluesky and others in the ATmosphere, forward-looking ActivityPub platforms like Bonfire, and organizations like [Ragtag](https://ragtag.org/?ref=thenexusofprivacy.net) and [May First.](https://mayfirst.coop/en/?ref=thenexusofprivacy.net)[11](#fn-funding) Just like any other kind of organizing, this will involve a mix of private and public communications (which is a great opportunity to experiment for ourselves with how to use various technologies). If you've got thoughts on organizing, mutual aid, and activism on decentralized social networks (or feedback on this post), [here's a CryptPad form](https://cryptpad.fr/form/?ref=privacy.thenexus.today#/2/form/view/d9Ag8SlOHFrBLdVG9+M00bAilHuQLjqQL27OdmuVD-s/). And if you want to join in on some of the public discussions, please do! Here's links to threads on [Bluesky](https://bsky.app/profile/thenexusofprivacy.infosec.exchange.ap.brid.gy/post/3llv2xt3epy62?ref=thenexusofprivacy.net), [Mastodon](https://infosec.exchange/@thenexusofprivacy/114150152320432832?ref=thenexusofprivacy.net), and [Lemmy](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net). ## Notes 0 We wound up doing it as a Signal group chat video, an approach I would strongly recommend to others considering something similar. We had about a dozen people present, and even thoug all were currently based in the US and Western Europe (and almost none of us were younger than 30), it was quite diverse in several other important dimensions. 1 People also mentioned Threema and Session as potential alternatives, and there are others like Wire, but as far as I know none of these have anywhere near as much independent security analysis as Signal (and there isn't a free version of Threema). Also, Threema doesn't have a free version; Session has a reputation for being a hub for CSAM distribution (and the protocol doesn't have Perfect Forward Secrecy). Germ Network (an MLS-based platform) is promising, and so is Veilid, but they're not there yet. So right now there aren't any great alternatives to Signal. 2 Somewhat bizarrely, there's intense debate about whether or not ATProto is actually a decentralized protocol. There's also intense debate about Bluesky should be considered part of "the Fediverse", and for that matter what "the Fediverse" even means. For the purpose of this series, ATProto is decentralized, "the Fediverse" refers to the ActivityPub Fediverse, and Bluesky is part of both the ATmosphere (a fediverse in its own right) and the ActivityPub Fediverse. But if you're into definitional struggles, oh boy, do I have some treats for you: [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) (in [I for one welcome Bluesky, the ATmosphere, BTS ARMY, millions of Brazilians, Black Twitter, and sex worker Twitter to the fediverses!](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/)) goes into detail on the terminology I'm using, and you might also want to check out [Is Bluesky part of today’s Fediverse?](https://thenexusofprivacy.net/is-bluesky-part-of-todays-fediverse/) and [“Decentralization” and erasure: Blacksky, Bluesky, and the ATmosphere](https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/). 3 One of the attendees asked whether there are any studies or long form writeups about activists use of Facebook or Whatsapp groups. Good question! Blueprints for Change has [a draft how-to on using Facebook groups for political organizing](https://commonslibrary.org/wp-content/uploads/Using-Facebook-Groups-for-organizing-DRAFT.pdf?ref=thenexusofprivacy.net), and [Activist Handbooks](https://activisthandbook.org/tools/facebook-groups?ref=thenexusofprivacy.net) has a short guide, but they're both quite basic. Back in the day I remember a lot of discussions of [Un millón de voces contra las FARC](https://es.wikipedia.org/wiki/Un%5Fmill%C3%B3n%5Fde%5Fvoces%5Fcontra%5Flas%5FFARC?ref=thenexusofprivacy.net) and the [One Million Strong for Barack Facebook](https://www.talesfromthe.net/jon/?p=111&ref=thenexusofprivacy.net) group in 2008 (although these were both based on old-style Facebook groups, which were somewhat more like forums). Somebody in the chat mentioned Anna Gibson's [What Teams Do: Exploring Volunteer Content Moderation Team Labor on Facebook](https://journals.sagepub.com/doi/10.1177/20563051231186109?icid=int.sj-full-text.citing-articles.45&ref=thenexusofprivacy.net), which looks at the moderation aspects, and no doubt there's other stuff as well. 4 Although, as I discussed in [A tale of two prototypes](https://thenexusofprivacy.net/a-tale-of-two-prototypes-2/) and elsewhere, Mastodon's founder Eugen Rochko has long refused to support local-only posts. As a result, they're not available in the official Mastodon release, but only available in forks like Glitch or Hometown that most people don't know about (and aren't widely supported by hosting providers). However, Rochko has recently stepped down as CEO of Mastodon gGmbH, so hopefully we'll see some movement on this front. More generally, [Fork it! It’s time for a Mastodon hard fork](https://thenexusofprivacy.net/mastodon-hard-fork/) makes the case for a community-driven Mastodon fork that focuses on safety, community, accessibility, and working well with others. Under new leadership, Mastodon itself has a great opportunity to move in that direction . Time will tell! 5 So does the Friendica / Hubzilla / (((streams))) / Forte thread of projects, all originally created by Mike Macgirvin. The Forte v25.3.2 [announcement post](https://fediversity.site/channel/mikedev?mid=https://fediversity.site/item/b69ce5a0-0c22-4933-8393-dce7100f4584&ref=thenexusofprivacy.net) notes that it > "Forte is the first fediverse platform to provide full nomadic identity (with near realtime sync of your cloned fediverse instances) completely over ActivityPub, using no other nomadic support protocols.... > > Forte is compatible with Mastodon and all your other favourite fediverse platforms, but being based on the legendary streams repository - goes far beyond the Twitter experience with contained conversations, groups, integrated cloud storage, events, locations services, and more. We use it for instance to replace email, due to the wide range of features and lack of spam. We also like the way it handles fediverse identity management so that you can aggregate different fediverse tools and push content from all of them from a single fediverse account." In the March 18 [Fediverse Report #108](https://fediversereport.com/fediverse-report-108/?ref=thenexusofprivacy.net), Laurens Hof says > "With Nomadic Identity, you create a single identity that can be connected to multiple different servers, so when one server becomes unavailable, all your personal data can be transferred and accessed from another server linked to your account. Forte, as well as Hubzilla and Streams, remain on the bleeding edge on what’s possible with ActivityPub. However, Forte also suffers from the same issue that its predecessors have, namely that getting to use the software is surprisingly difficult. Indeed, if you look at [Forte's codeberg page](https://codeberg.org/fortified/forte/src/branch/dev/doc?ref=thenexusofprivacy.net) there aren't any installation instructions or link to a documentation site. There is a doc folder, with seven sub-folders some of which have .mc files, so it's quite possible these do exist somewhere, but that's asking people to do a lot of work! Usability and lack of app support and ecosystem have been barriers for broader adoption of these projects. More positively, though, these are all potentially-solvable problems, and it would be interesting to see what happens if a diverse community came together around Forte. 6 I first heard the term "fediverse HOA" from Dr. Johnathan Flowers and Mekka Okereke, both using it to refer to the casual racism so common both in HOAs and on Mastodon. Flowers' [The Whiteness of Mastodon](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) and [Twitter vs. Mastodon](https://www.radicalai.org/twitter-vs-mastodon?ref=privacy.thenexus.today) podcast, Marcia X and Ra’il I'Nasah Kiam's [Blackness in the Fediverse](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x/?ref=privacy.thenexus.today), and the links in [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) and [5 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) have much more discussion of this. Rather confusingly, "fedi HOA" is also sometimes used by white people to describe pushback on racism (watch appropriation work!), or by cis people to describe pushback on anti-trans bigotry, or by people who are unaware of this whole complicated history and are just making analogies to other problematic aspects of HOAs without realizing that the terminology is a minefield here. As Albinanigans says in [So Your Black Ass Still Wants to Get on Mastodon](https://qcb.neocities.org/mastodon?ref=thenexusofprivacy.net) (referring to [the #FediBlock hashtag Marcia X started years ago](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/#fediblock-and-receipts) and [The Bad Space (TBS)](https://thenexusofprivacy.net/the-bad-space/)) > "FediBlock was started by a Person of Color to help marginalized identities stay safe on the Fediverse. Don't let them whitewash its history. This is important context, and adds an unsavory angle as to why calling FediBlock and TBS the "FediHOA" is... [a very](https://www.homestratosphere.com/homeowners-associations-ugly-history/?ref=thenexusofprivacy.net) [horrible](https://spartanshield.org/36524/opinion/homeowners-associations-reflect-systemic-racism/?ref=thenexusofprivacy.net) [look](https://www.npr.org/sections/codeswitch/2021/05/08/991535564/black-americans-and-the-racist-architecture-of-homeownership?ref=thenexusofprivacy.net), ya fucking racists." 7 It's worth highlighting just how similar the hostility that greeted Refugees in Libya to Margaret Kibi's description in [Fringe Mastodev: The Beginnings](https://www.u2764.com/NFIC/2018-09-09/fringe-beginnings/?ref=privacy.thenexus.today) of the weaponized demands that Black people put content warnings their own personal experience that started within just a few weeks of when CWs were first introduced back in 2017\. As Allie Hart pointed out in [a follow-on discussion](https://neuromatch.social/@jdp23/114269991355521835?ref=thenexusofprivacy.net), "I do wonder if the technological affordance–ness of CWs don’t cause them to be overindexed on a bit; it’s an easy thing to point to to say “no look, mastodon really is racist”, but respectability policing / etc is not new and would happen regardless of the technical existence of that feature." Still, Mastodon's implementation (which has also been adopted by other ActivityPub platforms) certainly doesn't help, and probably magnifies the probolems. Shel's [On Content Warnings](https://shelraphen.com/on-content-warnings/?ref=privacy.thenexus.today) is a deep dive into the general topic and specifics of the Mastodon implementation, which has been inherited by other ActivityPub software. 8 This is an area I find especially frustrating because the fediverses actually have some huge strengths that they're not leveraging. As [Accessibility resources for Mastodon and compatible software](https://thenexusofprivacy.net/mastodon-accessibility-resources/) discusses, the percentage of people on Mastodon who put alt-text on their images is much higher than most other social networks – enough that I've seen posts from blind people saying that it's a game-changer for them – and there are some apps which are very accessible. But unless you already know what the right apps are, it's not easy to find them; and I've seen multiple examples of disabled people getting hassled for not putting alt text on their images. wtf. 9 The first complicated high-stakes decision people need to make – before even signing up – is to choose an instance. [Resources for choosing the right fediverse instance](https://thenexusofprivacy.net/resources-for-choosing-instances/) talks about that in detail, but really, how many people have the time to read a 5000-word post and follow a dozen links before signing up for a new social network? 10 Over time, hosting services could provide an alternative here; the [NorthSky Social](https://northskysocial.com/?ref=thenexusofprivacy.net) cooperative (who's creating a safer social media experience for 2SLGBTQIA+ people, powered by ATProto) is one early example – as is Blacksky. These are all at a very early stage, but there's a enough momentum around ATProto that it's certainly possible we'll start to see more offerings. And there are also several small companies providing hosting services for various ActivityPub platforms (some of which are now also providing ATProto-based offerings). 11 We didn't explicitly talk about it in the meeting, but we should also add funders to the list – and, as I discussed in [Design from the margins – and fund it!](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/#design-from-the-margins), ensure that the funding goes to work by and with people from decentered communities. Darius Kazemi and Erin Kissane's [Governance on Fediverse Microblogging Servers](https://fediverse-governance.github.io/?ref=privacy.thenexus.today) includes a short writeup on [Fediverse Governance Opportunities for Funders & Developers](https://fediverse-governance.github.io/images/opportunities.pdf?ref=thenexusofprivacy.net) that's also very relevant here. ### Notes (and thoughts) on organizing in the fediverses and the ATmosphere URL: https://thenexusofprivacy.net/notes-on-organizing-in-the-fediverses/ Last updated: 2026-04-16T03:29:11.000Z *Part 2 of a series. See* [*If not now, when? Mutual aid and organizing in the fediverses, the ATmosphere, and whatever comes next*](https://thenexusofprivacy.net/if-not-now-when/) *for the context* > "I need a solution right away. And these sound like solutions that are in the works, and not something that normal people like me are going to be able to figure out and use." > > – an organizer who helps lead a progressive activism group, at [a Zoom meeting](https://thenexusofprivacy.net/data/slides-0225.pdf) on organizing on decentralized social networks Ouch. Depending on what you're looking for, the situation isn't necessarily that bleak – and by the end of the meeting, most of the people felt they had some paths worth investigating. There's a lot of promising work happening in the decentralized social media ecosystems known as the *fediverses* ("federated universes") and the ATmosphere (a fediverse built on Bluesky's AT protocol), including some interesting experiences with organizing. Still, the landscape is very complicated. And for grassroots organizers currently relying on Facebook groups – or looking to reach audiences as large as what was once possible on Twitter or Facebook – the alternatives still aren't where they need to be. That's something we need to change, and [If not now, when? Mutual aid and organizing in the fediverses, the ATmosphere, and whatever comes next](https://thenexusofprivacy.net/if-not-now-when/) has some thoughts about directions. As part of that project, I've hosted several online group discussions, gotten input via a survey (and accompanying Mastodon polls) as well as talked 1-1 with more than a few US-based organizers. Thanks to everybody for the input! Here's an attempt to write up the notes so far. ### Contents - [Key use cases – and constraints](#use-cases) - [Private communications](#private-communications) - [Public communications](#public-communications) - [Does it make sense to use Signal group chats as an interim step to help people move to decentralized social networks?](#sigal-group-chats) - [Potential paths forward](#potential-paths-forward) - [Additional topics from Q&A](#additional-topics) (including discussions of alternatives to Google Docs, links to online cybersecurity resources, and more) [The slides for the Zoom meeting](https://thenexusofprivacy.net/data/slides-0225.pdf) also have a lot of background, including a look at three projects that are currently using decentralized social networks for organizing.[0](#notes) > My apologies to those in the rest of the world, but I'm taking a very US focused approach here – that's where my experience and networks are. I'm certainly interested in hearing how much of this does, and doesn't apply elsewhere ... but the challenges discussed in Engine Room's report on [Exploring a transition to alternative social media platforms for social justice organizations in the Majority World](https://www.theengineroom.org/library/new-report-exploring-a-transition-to-alternative-social-media-platforms-for-social-justice-organizations-in-the-majority-world/?ref=thenexusofprivacy.net) (and nicely summarized by Erin Kissane in [What people in the global majority need from networks](https://www.wrecka.ge/what-people-in-the-global-majority-need-from-networks/?ref=thenexusofprivacy.net)) are huge potential barriers. ## Key use cases – and constraints One of the key takeaways was general agreement on what the organizers involved are looking for in social networks. Of course, this is just one data point; there are lots of different approaches to organizing, and these certainly aren't exhaustive! But, other organizers I've talkd to since then generally agree that these are important use cases – and they're areas that people don't have good solutions for today, so useful to focus on. *Private communications, including* - communicating within a group's leadership team - communicating between leadership and members – announcements once or twice a month (also going out via email), questions and answers, and discussions - communicating with leaders of other groups *Interacting with the broader public, including* - getting the word out about events and action alerts, - sharing and contextualizing accurate news and information - messaging - countering disinformation and propaganda - etc etc etc > IMPORTANT: None of the social networks discussed here provide end-to-end encryption! For secure communications, use Signal (or potentially some other encrypted messaging service)! See [EFF's Surveillance Self Defense page for tips on using Signal securely](https://ssd.eff.org/module/how-to-use-signal?ref=thenexusofprivacy.net). But there are also some critical constraints: - The software needs to be very straightforward to use. Some organizers said people in her group even found Signal challenging, and I saw several other heads nodding. - People feel like they already have too many accounts (and organizers already have to deal with multiple communications channels with their group members) so are very reluctant to add new ones – especially if they can't get rid of any of their existing accounts - Almost none of the groups are confident they have the tech capacity to host an instance, especially when taking security and denial of service into account. ## Private communications I've lost track of how many organizers have told me they're looking for alternative to Facebook groups for communicating within their organization – and across organizations. Slack (or other messaging systems like Discord and Matrix) can work to some extent, but isn't great for people who aren't online all the time – and leads to notification overload for people who are in multiple organizations. So there's a lot of desire for better tools for private communications.[1](#notes) More and more groups are using Signal group chats for this, and the end-to-end encryption and security-focused design provide much stronger security than any social network (or Slack or Discord). It's quite easy to join a Signal group chat – you can share a link or QR code to the chat – and most people find it as easy to use as WhatsApp or Facebook Messenger. Group chats work best for relatively-sall groups (the leadership team, working groups); once you get up into the hundreds of people it can get unwieldy. And notification overload is a huge problem here as well once you're in multiple Signal DM groups (or even one fairly large group). Yes, you can mute notifications for individual groups (and I do!) but then it's easy to miss stuff. So social networks can be a very complementary alternative – there's a reason Facebook groups were so popular for activism! Unfortunately, there aren't yet any great decentralized alternatives. - Bluesky is currently all-public, and while their recently-released [protocol roadmap](https://lu.ma/sdmwmvga?tk=7gpWGy&ref=thenexusofprivacy.net) discusses their plans to add private data, it's still at the very early stage. - Mastodon doesn't have any equivalent to Facebook private groups.[2](#notes) - Some niche fediverse software like Friendica and Hubzilla does, but the user experience is klunky[3](#fn-hubzllla-groups) and the installed base is tiny, so at least IMHO they're not ready for broad adoption. That said, there are a couple of options that could work today for some use cases. ### Forum software [NodeBB](https://nodebb.org/?ref=thenexusofprivacy.net), [Discourse](https://www.discourse.org/?ref=thenexusofprivacy.net), and [Flarum](https://flarum.org/?ref=thenexusofprivacy.net) are all fairly easy to use – and the basic form (aka message board) interface is familiar to most people who were online before social networks were widely adopted. Everything old is new again! So this could work well in a couple of scenarios: - an organization could set up a forum site with one private group (or categories, as they're called in NodeBB and Discourse) for leadership discussions, another for Q&A with members, and another for broad membership discussions. - a coalition or network of organizations could set up a forum site with private categories for each organization and cross-organization working group. Forums typically have good moderation tools, and for the vast majority of organizations who don't want to do their own hosting, there are a varietyof paid Of options (although depending on the group's size it might not be cheap). Of course, if you're in multiple organizations that have forums, you'll probably wind up needing multiple accounts (one on each organiztion's site). And this approach isn't particularly decentralized; while all of these systems have added compatibility with Mastodon and Lemmy and other decentralized software that uses the ActivityPub protocol, at least so far it only applies to public posts. Still, it's a way of getting off of Facebook, so quite possibly worth looking at. ### Mobilizon groups Mobilizon is primairly a tool to help people find, create and organize events; [Political Revolution's Mobilizon site](https://events.pol-rev.com/?ref=thenexusofprivacy.net) is a good example of how organizers of the 50501 protests are using it. That said, [Mobilizon also has group functionality](https://docs.joinmobilizon.org/1.%20Use/groups/create-group/?ref=thenexusofprivacy.net), including the ability to approve who can join a group, invite people, and have members-only discussions. I haven't talked yet with anybody who's using Mobilizon groups, so am not sure how well they work in practice. Mobilizon is currently maintained by [Kaihuri](https://www.kaihuri.org/?ref=thenexusofprivacy.net), who seems to be very interested in working with organizations considering adopting it, so especially if you're also thinking of using Mobilizon for events, it might well be worth following up and contacting them. ### Local-only posts GoToSocial, Akkoma, Glitch, Hometown, and some other platforms support "local-only" posts, which provide private communication between members of an instance (a single site running to the software). This means that an instance supporting this functionality can potentially work as an alternative to a single Facebook group. By themsleves, local-only posts probably aren't enough for most organization's needs. For example, if all the members of an organization are on an instance, local-only posts will work fine for discussions between leadership and members – but discussions within the group's leadership will need some other solution, and so will working groups and cross-group discussions. If the leadership team is relatively small, you might be able to use a direct message thread that tags everybody involved – or you could just use Signal for this – but things could quickly start to get complex. Still, even though it's not a complete solution, this might be a useful first step for an organization. ### Worth keeping an eye on ... There's clearly a lot of room for improvement on this front. Here's a few things worth keeping an eye on: - [Bonfire](https://bonfirenetworks.org/?ref=thenexusofprivacy.net) is a toolkit for communities to build and run their own digital spaces. It's extremely flexible, and they're starting to work with some organizers. - "[Island networks](https://writer.oliphant.social/oliphant/islands-an-opt-in-federated-network?ref=thenexusofprivacy.net)" (networks of instances that fedarate with each other and potentially have some connectivity to broader networks) are a relatively-new concept that in principle could provide a way for multiple organizations in a coalition to work together – while being part of mutiple coalitions. - In the ATmosphere, Blacksky has recently announced a project (whose name is still in flux) that's an interesting attempt to implement an equivalent to local-only posts. There's also a lot of other discussion of private data, so we may well see other solutions emerge here as well – although it's hard to know the timeframe. Hopefully as these and other projects mature, they can be building blocks for custom solutions – and eventually lead to turnkey solutions as well. ## Public communications At least for now, though, it continues to be extremely important. As the Trump administration moves to clamp down on dissent and criminalize protest, there's an open question as to how long this kind of communication will be a viable option. Historically, organizers have used Facebook pages and events, Twitter, Instagram, YouTube, TikTok, and Reddit for this. Algorithmic changes, censorship, and harassment have made all of these a lot less effective for many organizers – and the general expectation is that things will get steadily worse. From a functionality perspective, there are certainly some viable decentralized options here. For example, - Bluesky has Twitter-like microblogging functionality, and is easy enough to use that most people don't have a problem getting started. Custom feeds, starter packs, and moderation services all have a lot of potential for organizing; [Blacksky](https://www.blackskyweb.xyz/?ref=thenexusofprivacy.net) is a great example of how to combine these tools, and is now providing the infrastructure for independent, self-governed digital space;. - Mastodon and compatible software also provide fairly easy-to-use microblogging functionality (although many people find it more challenging than Bluesky to get started); I've had some success with these for privacy-related legislative activism. - [DAIR-tube](https://peertube.dair-institute.org/?ref=thenexusofprivacy.net) is a great example of using PeerTube as a YouTube alternative, with videos of their Data Workers Inquiry and Mystery AI Hype Theater 3000 - Mobilizon is an events platform (compatible with Mastodon et al) that [Political Revolution](https://events.pol-rev.com/?ref=thenexusofprivacy.net) has used successfully for the 50501 protests. See the [slides](https://thenexusofprivacy.net/data/slides-0225.pdf) for a few screenshots of these. But functionality isn't the only consideration. The biggest barrier to using these networks for broad public communication is that most of the public isn't there. Bluesky's the biggest, with about 10 million active users; Mastodon et al have maybe 1 million. That could well change over time, and organizers and activists can speed the process along by helping people move from corporate social network to these new options – without losing their support networks, ties to communities, and connections with friends and family. That's easier said than done, but clearly an area to pay attention to. Sydette Harry has framed this as a digital refugee project, which is certainly an interesting way to look at it – and highlights the need for organizing. ### What about corporate fediverse sites like Flipboard and Threads? [Flipboard](https://about.flipboard.com/?ref=thenexusofprivacy.net) describes themselves as "the best platform to amplify your content." They've been around for years, have a fairly big user base, and are very easy to use. Recently, they've been making [a big strategic bet on what they call the "open social web"](https://archive.ph/gbK2V?ref=thenexusofprivacy.net) (aka, decentralized social networks) and are currently beta-testing their new Surf ["open social web browser"](https://techcrunch.com/2025/03/10/open-social-web-browser-surf-integrates-with-bluesky-in-latest-beta/?ref=thenexusofprivacy.net) lets you view, interact with *and curate* Bluesky, Mastodon, RSS, and other data sources. So there are certainly some intriguing possibilities there. But does it make sense for organizers to move to another corporate social network? Of course, that's a question to consider for Bluesky as well – they're also run by a venture-funded startup, have certainly hinted that they're going to introduce ads, and even their own employees are candid that people should view the company as a "future adversary." My take is that neither of these platforms are reliable longer-term bases. That said, I personally think Bluesky is very much worth considering in the short term (see [I for one welcome Bluesky, the ATmosphere, BTS ARMY, millions of Brazilians, Black Twitter, and sex worker Twitter to the fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/) for why) ... and similarly it's worth considering Flipboard. And I guess I should also mention Threads, Meta's Twitter competitor. Threads has implemented limited connectivity with Mastodon and claimes they'll do more over time ... but then again they're owned by [Mark F\*\*\*ing Zuckerberg,](https://catvalente.substack.com/p/mark-fking-zuckerberg-is-not-your) with all that implies: a business model based on exploiting users and breaking the law, moderation that's actively anti-Black, anti-Palestinian, and anti-LGBTQ+, and aiding and abetting genocide. So I personally wouldn't recommend it ... but your mileage may vary. ### Using Bridgy Fed to connect Bluesky, Mastodon, Threads, and other compatible software > "Bridgy Fed connects [web sites](https://indieweb.org/?ref=thenexusofprivacy.net), the [fediverse](https://enwp.org/fediverse?ref=thenexusofprivacy.net), and [Bluesky](https://bsky.social/?ref=thenexusofprivacy.net). You can use it to make your profile on one visible in another, follow people, see their posts, and reply and like and repost them. Interactions work in both directions as much as possible. [See the docs for more info.](https://fed.brid.gy/docs?ref=thenexusofprivacy.net)" > > – the Bridgy Fed site Bridgy Fed isn't for everybody, but if you want your public posts to be available on all these different networks, it's certainly worth considering opting in. A few limitations to be aware of, if you're bridging from Mastodon or compatible software: - Bridgy Fed truncates longer posts, doesn't bridge polls or profile metadata, and any edits you make won't show up on Bluesky (because Bluesky doesn't support editing) - There's no way for bridged Mastodon accounts to use Bluesky blocklists or subscribe to labelers. - Keep in mind that Bluesky is an all-public environment optimized for surveillance capitalism – there are already multiple datasets of Bluesky posts on Hugging Face. Bridgy Fed is careful to only bridge public posts, but it's still not for everybody. Similarly, if you're bridging from Bluesky, while you can block individual users, there's no way to prevent Mastodon instances run by white supremacists, anti-LGBTQ+ bigots, or nazis from interacting with your bridged content – and yes, these sites do exist. And whether you're bridging from Bluesky or Mastodon, keep in mind that Threads is owned by [Mark F\*\*\*ing Zuckerberg](https://catvalente.substack.com/p/mark-fking-zuckerberg-is-not-your), who we're all trying to get away from. Any content that goes to Threads not only puts money in his pocket, it will also be used to train their AI algorithms to better target advertising and propaganda. Still, there's a big potential audience on Threads, and while only the tiny percenntage who have opted into "Threads Fediverse" can actually follow you, there are situations where it might be worth doing. If you're using Mastodon or compatible software and *don't* want your content to go to Threads, see [How to block Threads on Mastodon - and a reminder that blocking on the fediverse only provides limited protections](https://thenexusofprivacy.net/how-to-block-threads-on-mastodon/). If you're using Bluesky and opt in to Bridgy Fed, I don't know of any way to keep your data from going to Threads. ## Does it make sense to use Signal group chats as an interim step to help people move to decentralized social networks? One very interesting idea that came up in these sessions is to encourage friends and family (or neighbors, or a community of practice, or in a Facebook group) to join a Signal group chat as a first step. It's quite easy to join a Signal group chat – you can share a link or QR code to the chat – and most people find it as easy to use as WhatsApp or Facebook Messenger. As well as providing an initial partial escape hatch, and a way of keeping connections active, the group can also provide support as people venture onto decentralized social networks. Of course, there doesn't have to be an interim step. It's easy to sign up on Bluesky, and if you're used to Twitter the interface is very familiar. But what are the right blocklists to use if you don't want to minimize your interactions with scammers, anti-trans bigots, right-wingers, and bots? What starter packs and custom feeds match your interests? What habits from Twitter and Facebook to unlearn? Just what do people mean by "nuclear block", and why is it considered a good thing? How to reconnect with people you were following on Twitter? And for Mastodon and compatible software, it can be even more of a challenge. What instance to sign up on? [Resources for choosing the right fediverse instance](https://thenexusofprivacy.net/resources-for-choosing-instances/) goes into a lot of detail, and links out to quite a few useful sites, but realistically how many people want to read a 5,000 word article and follow that many links just to sign up? Erin Kissane's [How to buy shoes in the fediverse](https://www.wrecka.ge/fediverse-shoes/?ref=thenexusofprivacy.net) and [revealing the fediverse’s gifts](https://www.wrecka.ge/revealing-the-gifts/?ref=privacy.thenexus.today) have some great perspectives on this problem in general, and hopefully the process will get easier over time, but right now ... well, let's just say there's room for improvement. So like I say, an interim step that can then function as a support group is a very interesting idea ... ## Potential paths forward Hopefully there's enough information here for organizers and groups who have the bandwidth to start exploring paths forward. A couple of potential paths forward: - If you haven't done so already, consider creating some Signal group chats – for the leadership, for working groups that are interested, and maybe also another one for all members of the organization (although if your orgnaization is huge this might not work out well). As well as ensuring that you have a secure channel for communications in place, this is also a way to start the processs of getting people off of Facebook et al. - If you're doing a lot of public-facing activism, consider encouraging members to join Bluesky to start building networks there. Bluesky's a venture-funded startup, and their architecture is optimized for surveillance capitalism, so it's not a great long-term option ... but, right now, there's a lot more activity there (including a lot of other organizers), and tools like Starter Packs and Custom Feeds make it easy to find other organizers. - Consider starting up a forum or a GoToSocial, Hometown, Glitch, or Akkoma instance for your group – or partner with other groups to start one up that you can share. Even if it's not yet at the point where it can fully replace Facebook or Slack, it's a great way for you and your members to get experience with these new social networks (and have a backup communcitions network in place). And, identifying where things currently fall short will help drive improvements in the software going forward. See the section on [private communications](https://thenexusofprivacy.net/data/slides-0225.pdf) for more on the various options. And for developers focused on the fediverses and the ATmosphere – or people whoa re thinking of getting involved, well, like I said there's clearly room for improvement. [If not now, when?](https://thenexusofprivacy.net/if-not-now-when/) has some overall framing for this, and the last section has a list of questions as well as links to discussions. If you're planning on attending the [ATmosphereConf](https://atprotocol.dev/atmosphereconf/?ref=privacy.thenexus.today) and/or [FediForum](https://fediforum.org/?ref=privacy.thenexus.today) (both of which allow remote participation), I'll be proposing sessions there to dig into more details. ## Additional topics from Q&A The various discussions also covered a lot of questions and answers besides social networks ... so I figured I'd include them here. **What are the alternatives to gmail?** PrivacyGuides' [Encrypted Private Email Recommendations](https://www.privacyguides.org/en/email/?ref=thenexusofprivacy.net) discusses Tuta (aka Tutanota), ProtonMail, and mailbox.org. **What are the alternatives to Google Drive, Google Docs, etc?** I'm a fan of [CryptPad](https://cryptpad.fr/drive/?ref=thenexusofprivacy.net), an end-to-end encrypted and open-source collaboration suite, and find their tools like Drive (document sharing), Docs (collaborative editing), and Forms fairly usable (although not quite as easy as the Google equivalents). They also have spreadsheets and presentations, which I have less experience with. All their tools feature end-to-end encryption. PrivacyGuide [CryptPad Review: Replacing Google Docs](https://www.privacyguides.org/articles/2025/02/07/cryptpad-review/?ref=thenexusofprivacy.net) has a lot more detail. [NextCloud](https://nextcloud.com/?ref=thenexusofprivacy.net), an open-source collaboration suite, is another plausible alternative. If you're part of a larger organizaiton, they offer entireprise solutions as well. **Should we be concerned about using Mobilize for events?** The US government can get at any data Mobilize stores or is tracking – who's attending what events, who's *looking at* various events, and who's sharing and responding to event links. As they start to crack down more on dissent and protests, this could well put people at risk. That said, right now, large organizations like Working Families Party, Indivsible, and various Democratic party groups are still using Mobilize, so clearly thing the risk is acceptable. **Should we be concerned about Slack? Zoom?** Yes. Again, the government can get access to all this data – and they're likely to do so at some point, even if they're not doing it yet. So while it's not clear how time-critical it is to move (like I said, I did one of these meeting on Zoom), it's certainly a good idea to at least start thinking about alternatives. And if you're doing any kind of direct actions, or potentially-illegal yesterday, stop using them now – use Signal instead. **What about Telegram?** [Telegram isn't as secure as it claims to be](https://spectrum.ieee.org/telegram-security?ref=thenexusofprivacy.net). It does offer end-to-end encryption for "Secret Chats", but those aren't the default – and unlike Signal, it *doesn't* have encrypted group chats. It also uses its own proprietary encryption method (which as experience cryptographers point out is always something to be skeptical about); and unlike Signal, Matrix, and other encrypted messaging services, its code isn't all open-source. There are also [concerns that Russian intelligence is able to access Telegram messages](https://www.reuters.com/technology/cybersecurity/ukraine-bans-official-use-telegram-app-over-fears-russian-spying-2024-09-20/?ref=thenexusofprivacy.net) ... given the new US adminstration's friendliness with Russia, is that really a chance you want to take? **Can we take our followers and our posting history with us if we leave Facebook?** Not really. [The Facebook Archive](https://www.facebook.com/help/212802592074644/) lets you download your posts and photos, but that's about it. **How to convince people who are still complacent that we need to take the threat of surveillance seriously?** That's a great question and I don't know any easy answers – sounds like a good topic for followon discussions! **What are some good general resources for online security and privacy?** This isn't an exhaustive list by any means, but here are three that I've found useful - EFF's [Surveillance Self-Defense](https://ssd.eff.org/?ref=thenexusofprivacy.net) - The Opt-Out Project's [The Cyber-Cleanse: Take Back Your Digital Footprint](https://www.optoutproject.net/the-cyber-cleanse-take-back-your-digital-footprint/?ref=thenexusofprivacy.net) - Privacy Guides' [The Protestor's Guide to Smartphone Security](https://www.privacyguides.org/articles/2025/01/23/activists-guide-securing-your-smartphone?ref=thenexusofprivacy.net) - Frontline Defenders' [security in -a-box](https://securityinabox.org/en/about/about/?ref=thenexusofprivacy.net) - Activist Checklists' [Digital Security Checklists for Activists](https://activistchecklist.org/?ref=thenexusofprivacy.net) ## Notes 0 Unfortunately, the video from this session needs a lot of editing to get it to the point where it's useful and doesn't infringe on anybody's privacy, and the machine I've used in the past for video editing doesn't work any more, but I hope to post at least some fragments of it fairly soon, and will update this post once I have them. 1 Slack's channels provide more structure than Signal, but notification overload is still a problem, and like most messaging-based systems it isn't great for people who aren't online almost all the time. Facebook groups used to be an okay solution, but algorithmic changes means that almost nobody sees stuff unless they explicitly check the group. Plus, a lot of people really want to spend less time on Facebook – and many organizers are (justifiably!) concerned about organizing on a platform controlled by a techbro who's licking the boosts of fascists and authoritarians. 2 Mastodon got a grant to implement groups several years ago but implementation has been stalled for quite a while and isn't currently being prioritized. 3 For example, while Hubzilla, Friendica, (streams), and Forte support private groups natively, people who are not using those platforms have to send a DM to the private group, which converts their DM into a top-level post and shares it with others who have joined the group. It's a clever approach to making the private group compatible with Mastodon and other fediverse platforms lacking this functionality, but it's very counter-intuitive for people who haven't seen it before. ### If not now, when? Mutual aid and organizing in the fediverses, the ATmosphere, and whatever comes next URL: https://thenexusofprivacy.net/if-not-now-when/ Last updated: 2026-07-16T06:55:44.000Z Mutual aid. Organizing. Sharing, contextualizing, and making meaning of news and health information to counter propaganda and information overload. The use cases for alternative social networks – not controlled by techbro white supremacist CEO's working with their cronies in authoritarian governments – practically write themselves in today's world. And with so many talented social scientists, designers, systems thinkers, and developers directly impacted by DOGE, MAGA, et al, there are a lot of people with the right skills for these new networks to make rapid progress. The good news is there's a lot of promising work happening in the decentralized social media ecosystems known as the *fediverses* ("federated universes") and the ATmosphere (a fediverse built on Bluesky's AT Protocol). For example ... > "Dr. Timnit Gebru's [Distributed AI Research Institute](https://www.dair-institute.org/?ref=privacy.thenexus.today) is an interdisciplinary and globally distributed AI research institute rooted in the belief that AI is not inevitable, its harms are preventable, and when its production and deployment include diverse perspectives and deliberate processes it can be beneficial. [DAIR-tube,](https://peertube.dair-institute.org/?ref=privacy.thenexus.today) their PeerTube page, includes videos of their Data Workers Inquiry and Mystery AI Hype Theater 3000 – world-class research, foucsed on justice and equity, available on the Fediverse. Along with their Mastodon instance [dair-community.social](https://dair-community.social/?ref=privacy.thenexus.today), it's a great example of what's possible with today's technology." > > – [A lot of good stuff is happening in the fediverses!](https://thenexusofprivacy.net/good-stuff-in-the-fediverses/), November 2024 > "Blacksky is providing a platform to **amplify, protect, and moderate** Black content so users can **safely build community** online. > The mission and purpose of the project is to **de-center whiteness** as the default and to provide a space for Black folk to discuss the Black everyday in a way that feels affirming. " > > – [Blacksky Algorithms](https://www.blackskyweb.xyz/?ref=thenexusofprivacy.net), January 2025\. > "As a Blind person i never thought i would be on social media savoring photos. But the communal Mastodon alt text game is so strong that sweet, poetic or silly descriptions abound on my timeline." > > – Chancey Fleet, quoted in [What kind of social network experience are you looking for?](https://thenexusofprivacy.net/resources-for-choosing-instances/#experience). If you use a screenreader or other assistive technology, [Accessibility resources for Mastodon and compatible software](https://thenexusofprivacy.net/mastodon-accessibility-resources/) might be helpful. > "Following this overview, I highlight the practices with which people seek to create a better Fediverse outside Meta’s grasp." > > – Jamie A. Theophilos, [Closing the Door to Remain Open: The Politics of Openness and the Practices of Strategic Closure in the Fediverse](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=thenexusofprivacy.net), December 2024, *Social Media + Society*, *10*(4) And the Free Fediverse Theophilos discusses is just the latest example of of resistance to fascism in the fediverses. Back in 2019, the ActivityPub Fediverse responded to Gab's attempt to join with an overwhelming wave of "no, go away". And even before that, in [Lessons (so far) from Mastodon](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=privacy.thenexus.today) (2017/8), I noted that > "Policies against racism, sexism, discrimination against gender and sexual minorities, and Nazis are extremely appealing positioning these days." It's still true. As promising as these efforts are, though, there's still a long ways to go. > Update, November 2025: If you want to skip ahead to the current status, the October [Organizing, mutual aid, and Activism lides](https://thenexusofprivacy.net/data/fediforum-1008.pdf) and [notes](https://fediforum.org/2025-10/session/6-b/?ref=thenexusofprivacy.net) from a FediForum session sumarizes highlights, learnings, and potential next steps. There's definite progress, although still a long ways to go. > Update, March 2026: my undelivered un-workshop presentation on [Legislative Activism in the ATmosphere and the Fediverse](https://thenexusofprivacy.net/data/un-workshop-0302.pdf) has a bunch of examples of organizing from the Washington state leg session earlier this year. More progress! Although, still a long ways to go. And while the fediverses' decentralization is a huge strength (flexibility, variety, alternatives to big tech's dominance, and viable roles for co-ops and non-profits are all very good things), at the same time [decentralization makes many things more complicated](https://thenexusofprivacy.net/resources-for-choosing-instances/#decentralization). As Engine Room's report on [Exploring a transition to alternative social media platforms for social justice organizations in the Majority World](https://www.theengineroom.org/library/new-report-exploring-a-transition-to-alternative-social-media-platforms-for-social-justice-organizations-in-the-majority-world/?ref=privacy.thenexus.today) says, > **"**A transition to alternatives needs to be centered around the needs and capabilities of non-technical communities. Alternatives have a higher technological barrier to entry than mainstream platforms with easy user interfaces. Moreover, alternative platforms can be expensive for smaller organizations to host and maintain their own servers (e.g. self-hosting an instance of Mastodon may require a dedicated staff member \[s\] with technical expertise), as opposed to using a commercial platform." > Speaking of things being complicated ... my goal is for this article to be approachable if all of this is relatively new to you; if you're interested in exploring, I've included a lot of links (and will be adding a section of references in the final version). But I'm sure there are ways I've fallen short. Where it's confusing or assumes knowledge, please let me know! Other feedback is welcome as well; see the first question [in this CryptPad form](https://cryptpad.fr/form/?ref=thenexusofprivacy.net#/2/form/view/d9Ag8SlOHFrBLdVG9+M00bAilHuQLjqQL27OdmuVD-s/) (which takes a few seconds to load, don't be alarmed!) ## Think of today's networks as prototypes at scale > "A fediverse isn't just a single social networks. Instead, it's an ecoysystem of thousands of different **communities* –* each with their own policies, norms, culture, and software.... > > It is very cool that people in different communities with a wide variety of norms and rules can often (although not always) interact (at least to some extent) with each other using hundreds of (somewhat-compatible) software apps! That said, "wide variety", "although not always", "at least to some extent," and "somewhat-compatible" are doing a lot of work in that sentence. Welcome to the fediverses." > > – [Resources for choosing the right fediverse instance](https://thenexusofprivacy.net/resources-for-choosing-instances/) Unlike big commercial social networks with engineering budgets of zillions of dollars, most development teams in the fediverses and the ATmosphere are tiny. So a lot of the software is a lot less polished – understandable, but also a barrier to many people especially when combined with the additional complexity of a decentralized world. Not only that, there are huge cultural issues as well, including anti-Blackness, misogynoir, anti-trans biases, and Islamophobia. And the vast majority of development for adoption of these networks has focused on Western Europe, the US, and Japan; the Engine Room report on [Exploring a transition to alternative social media platforms for social justice organizations in the Majority World](https://www.theengineroom.org/library/new-report-exploring-a-transition-to-alternative-social-media-platforms-for-social-justice-organizations-in-the-majority-world/?ref=thenexusofprivacy.net) explores some of the impacts of this. One way of looking at is that today's decentralized social networks are prototypes at scale, with big holes including accessibility, safety (including privacy), onboarding, equity, culture, sustainability, and governance. - On the one hand, despite their limitations, they're usable enough for a lot of people – and they're flexible enough that they've allowed the emergence of new possibilities. On centralized social networks, there isn't any way for DAIR to control their own data or avoid having some topics censored; there isn't any equivalent to an ATmospheric community like Blacksky, or the Website League, or the fedifams and caracoles discussed in [Closing the Door to Remain Open](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=thenexusofprivacy.net). So that's exciting! - On the other hand, today's prototypes are *not* usable, accessible, or safe for a lot of people – especially people who are already marginalized and at risk, in society and on corporate social networks. As Afsaneh Rigot says in [Can We Build Tech That Is Not Oppressive?](https://the-decenter.ghost.io/can-we-build-tech-that-is-not-oppressive/?ref=thenexusofprivacy.net) > "Newer platforms need to make sure they don’t repeat mistakes and leave the same gaps that make them inaccessible or unsafe to those that need them most. Only then can they truly challenge monopolies. There’s so much potential if the right methods are used for better futures in our tech ecosystem." ## Complementary paths forward So we need to accelerate work on a few things at once: - Find ways to leverage and improve the current prototypes for mutual aid, organizing, and counter propaganda, hate, and information overload – while also improving safety (especially for people most likely to be targets of harassment) and moderation. - Help people move from corporate social networks - without losing their support networks, ties to communities, and connections with friends and family. Sydette Harry has framed this as a digital refugee project (and many of the people involved may also be refugees in the physical world). Erin Kissane's [How to buy shoes in the fediverse](https://www.wrecka.ge/fediverse-shoes/?ref=thenexusofprivacy.net) and [revealing the fediverse’s gifts](https://www.wrecka.ge/revealing-the-gifts/?ref=privacy.thenexus.today) have some great perspectives on this. [Resources for choosing the right fediverse instance](https://thenexusofprivacy.net/resources-for-choosing-instances/) gives an idea of the some of the complexity today. - Build whatever comes next. Structurally, and in terms of applications, what will decentralized social networks, designed from the margins using design justice principles look like? What about networks designed from the beginning with a focus on safety, consent, and moderation – built on next-generalition infrastructure like [Spritely](https://spritely.institute/?ref=thenexusofprivacy.net), [Veilid,](https://veilid.com/?ref=thenexusofprivacy.net) and [Cwtch](https://docs.cwtch.im/?ref=thenexusofprivacy.net), with privacy and security designed in from the beginning? And, in all of these threads we need to get beyond recreating existing corporate social networks (decentralized Twitter, federated Instagram and Reddit, etc etc etc) that are grounded in surveillance capitalism, colonialism, ableism, and rich-get-richer dynamics. We also need to address the lack of attention to safety and moderation . Not only that, we need to be conscious of the increasing surveillance and crackdowns on dissent by authoritarian governments and their supporters. Easier said then done, but the opportunity is there. As Rigot says in [Can We Build Tech That Is Not Oppressive?](https://the-decenter.ghost.io/can-we-build-tech-that-is-not-oppressive/?ref=thenexusofprivacy.net) > **"The details of how highly marginalized communities are criminalized are the key to how we can build robust and even scalable tech that is not oppressive.** This is how Design From the Margins truly works.... > > The experience of the most criminalized in the US and globally shows how power really works. This knowledge, the workarounds, can also be translated into stealthy tech design, build, and engineering choices that help navigate systems." ## Let's discuss! How to make more rapid progress? The decentralized nature of the fediverses (and the limitations of current tools) makes it challenging to broaden participation and find synergies between the promising work that's happening ... still, there's no reason for that to be a barrier. When I first wrote this, I noted that upcoming events like [ATmosphere Conf](https://atprotocol.dev/atmosphereconf/?ref=privacy.thenexus.today) and [FediForum](https://thenexusofprivacy.net/not-just-fediforum/) would provide opportunities for focused discussions, but there was no reason to wait. Since then, there have indeed been a bunch of discussions (some of which is linked to in the reading list below), and a loose working group has formed. Here are some of notes and initial thinking rom the work so far: - [Notes (and thoughts) on organizing in the fediverses and the ATmosphere](https://thenexusofprivacy.net/notes-on-organizing-in-the-fediverses/), focusing on perspectives of US-based progressive activists and the possibilities of current tools - [More notes on Organizing, Mutual Aid, and Activism on decentralized social networks](https://thenexusofprivacy.net/more-notes-on-organizing/), where the first concrete actions started surfacing - [Notes on genocide prevention and other kinds of organizing, mutual aid, and activism on social networks](https://thenexusofprivacy.net/notes-on-genocide-prevention-and-other-kinds-of-organizing-mutual-aid-and-activism-on-social-networks-d/), with a focus on the pluriverse of multiple social networks, lists of high-level use cases and components of the tech and social stacks, a deeper look at the needs of anti-genocide activists, and an update on the action items from the previous meeting > Update, November 2025 : FediForum sessions on **Organizing, mutual aid, and Activism** in June ([slides](https://thenexusofprivacy.net/data/fediforum-0607.pdf) and [notes](https://fediforum.org/2025-06/session/6-a/?ref=thenexusofprivacy.net)) and October ([slides](https://thenexusofprivacy.net/data/fediforum-1008.pdf) and [notes](https://fediforum.org/2025-10/session/6-b/?ref=thenexusofprivacy.net) have additional updates. And the discussions open questions to kick things off. Please share your perspectives – on [Bluesky](https://bsky.app/profile/thenexusofprivacy.infosec.exchange.ap.brid.gy/post/3lk6ujocauta2?ref=thenexusofprivacy.net), [Mastodon](https://infosec.exchange/@thenexusofprivacy/114150099817138018?ref=thenexusofprivacy.net)(which should also work for accounts using GoToSocial, Akkoma, or most other ActivityPub software), and/or [in this CryptPad form](https://cryptpad.fr/form/?ref=thenexusofprivacy.net#/2/form/view/d9Ag8SlOHFrBLdVG9+M00bAilHuQLjqQL27OdmuVD-s/) (if you'd prefer to remain anonymous, or don't have accounts in the fediverses). Here's some of the questions we have: - What examples have you seen of successfully leveraging social networks for organizing and mutual aid? - How could social networks better support organizing and mutual aid? - What do you see as the most promising and/or urgent short-term opportunities? - Who else should be involved in the discussion? We're especially interested in perspectives that are usually marginalized – disability justice, Indigenous organizing and mutual aid, perspectives from the Global South – zbut all suggestions are welcome! - Are there any articles, papers, books, zines, videos, podcasts, etc on organizing, mutual aid, and/or social networks that you'd recommend? - What other related topics would you like to see discussed? - What can projects to improve the fediverses' and the ATmosphere's support for mutual aid and organizing do to provide on-ramps to help people like you (in terms of skills, background, technology preferences, accessibility needs) find out more, explore, and (if they're interested) get involved with projects? - What else do you want to share? What other questions should we be asking? > Note: the conversation will (hopefully) include both Bluesky and the ActivityPub fediverse. If you want your posts to be visible in both places, consider bridging your accounnt by opting in to Bridgy Fed. In the fediverse, follow [@bsky.brid.gy@bsky.brid.gy](https://neuromatch.social/@bsky.brid.gy@bsky.brid.gy?ref=thenexusofprivacy.net); on Bluesky, follow [@ap.brid.gy](https://bsky.app/profile/ap.brid.gy?ref=thenexusofprivacy.net). For more on Bridgy Fed, [see the docs](https://fed.brid.gy/docs?ref=thenexusofprivacy.net). ## Appendix: an annotated reading list - [Notes (and thoughts) on organizing in the fediverses and the ATmosphere](https://thenexusofprivacy.net/notes-on-organizing-in-the-fediverses/) and [More notes on Organizing, Mutual Aid, and Activism on decentralized social networks](https://thenexusofprivacy.net/more-notes-on-organizing/) are summaries of some of the discussions of I've had since the first draft of this post. - Rudy Fraser's August 2025 post on [🔭🖤🚀 Social media’s next evolution: decentralized, open-source, and scalable](https://newpublic.substack.com/p/how-blacksky-grew-to-millions-of) on New Public (with Josh Kramer), [Infrastructure for Interdependence: Building technology in service of collective power](https://leaflet.pub/043c8df3-f129-4ea0-bea6-c00cb781c294?ref=thenexusofprivacy.net), and [An internet of many autonomous communities](https://blog.rudyfraser.com/an-internet-of-many-autonomous-communities/?ref=thenexusofprivacy.net) (expanding on his ATmosphereConf talk on [Beyond Horseless Carriages: Building Communities for the Decentralized Era](https://www.youtube.com/watch?v=OZN8y8kVFFI&ref=thenexusofprivacy.net)) are good starting points for understanding Blacksky. - Rudy's earlier three-part series [Blacksky: Expressing the Black Everyday in a New Digital Space](https://blog.rudyfraser.com/blacksky-part-one/?ref=thenexusofprivacy.net) (see also [part 2](https://blog.rudyfraser.com/blacksky-part-two/?ref=thenexusofprivacy.net) and [part 3](https://blog.rudyfraser.com/blacksky-part-three/?ref=thenexusofprivacy.net)) highlights the possibilities of the AT Proto architecture. "\[T\]he opportunity to build out an extensible Black social network that can be controlled by community instead of corporations, that doesn't require being segregated from the broader social space, and reflects the many aspects of the diaspora (not just whatever is trendy at the time or what a corporation is pushing on me) is too important to pass up." For more about Blacksky, see Tarik Moody's [Could Blacksky emerge as Black Twitter’s spiritual successor on Bluesky?](https://hyfin.org/2024/11/29/could-blacksky-emerge-as-black-twitters-spiritual-successor-on-bluesky/?ref=privacy.thenexus.today), Isaiah Thompson's [Building #Blacksky](https://nonprofitquarterly.org/building-blacksky/?ref=privacy.thenexus.today), the [TechPolicy.Press Podcast](https://techpolicy.press/podcast-rudy-fraser-on-building-blacksky-and-the-future-of-middleware?ref=privacy.thenexus.today) with Justin Hendrix, and Reparative Media's [Designing Social Media for Black People](https://www.youtube.com/watch?v=QkOeQHjml6I&ref=thenexusofprivacy.net). - [Governance on Fediverse Microblogging Servers](https://fediverse-governance.github.io/?ref=privacy.thenexus.today)*,* Erin Kissane and Darius Kazemi (2024) highlights the opportunities (" the Fediverse’s combined emphasis on the sovereignty of local norms and a federated form of network diplomacy can offer a real and optimistic challenge to the dead end of centralized content moderation at scale"), current best practices, as well as the risks and gaps. - Dr. Johnathan Flowers' [The Whiteness of Mastodon](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) and [Twitter vs. Mastodon](https://www.radicalai.org/twitter-vs-mastodon?ref=privacy.thenexus.today) podcast, Marcia X and Ra’il I'Nasah Kiam's [Blackness in the Fediverse](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x/?ref=privacy.thenexus.today), and the links in [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) look at the ActivityPub Fedivere's history of whitness and anti-Blackness. [5 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) has a lot more links on this front (as well as suggestions for how to improve the situation). - [Mastodon is easy and fun except when it isn't](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=privacy.thenexus.today), Erin Kissane (2023) looks at barriers newcomers to Mastodon in 2022-3 faced, including got yelled at, felt bad; couldn’t find people or interests, people didn’t stay; too confusing, too much work, too intimidating; too serious, too boring, anti-fun; complicated high-stakes decisions. Kissane's more recent [How to buy shoes in the fediverse](https://www.wrecka.ge/fediverse-shoes/?ref=thenexusofprivacy.net) and [revealing the fediverse’s gifts](https://www.wrecka.ge/revealing-the-gifts/?ref=privacy.thenexus.today), and my [A faux “Eternal September” turns into flatness](https://thenexusofprivacy.net/flatness/) and [Resources for choosing the right fediverse instance](https://thenexusofprivacy.net/resources-for-choosing-instances/), discuss one very complicated high-stakes decision that confronts people right up front and will be crucial to address moving forward. [People in Platforms: A Research Update](https://youtu.be/mMIhkA8QEKc?si=PczcbqhFvAI-KSWu&ref=thenexusofprivacy.net) ATmosphereConf talk discusses social threat modeling, design justice, vernacular institutions, legibility, and more (and yes, that's me asking a question at the end); the [reference page on Kissane's site](https://erinkissane.com/atconf?ref=thenexusofprivacy.net) has a reading list as well as image credits. - Jamie A. Theophilos' [Closing the Door to Remain Open: The Politics of Openness and the Practices of Strategic Closure in the Fediverse](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=thenexusofprivacy.net) (2024) looks at the practices and discourses of users, developers, and server administrators who oppose Meta's attempts to join and exploit the Fediverse and aim to build a safer and more autonomous “free Fediverse.” [Strategies for the free fediverses (2024 DRAFT)](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) explores approaches for building on the free Fediverse's strengths ; [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) and Erin Kissane's outstanding [Untangling Threads](https://erinkissane.com/untangling-threads?ref=privacy.thenexus.today) (both 2023) have background on the fediverses' tensions related to Meta. - [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) (in [I for one welcome Bluesky, the ATmosphere, BTS ARMY, millions of Brazilians, Black Twitter, and sex worker Twitter to the fediverses!](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/)) goes into detail on the terminology I'm using. If you're into definitional struggles, you might also want to check out [Is Bluesky part of today’s Fediverse?](https://thenexusofprivacy.net/is-bluesky-part-of-todays-fediverse/) and [“Decentralization” and erasure: Blacksky, Bluesky, and the ATmosphere](https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/). ### Design Methodologies - [Design from the Margins: A Methodology to De-weaponize Tech](https://www.de-center.net/s/Discussion-draft-Methodology-to-De-weaponize-Tech-FOR-PUB-Apr-2-update.pdf?ref=thenexusofprivacy.net), De|Center (2025), an introduction to a data-backed harm reduction approach that pushes the arc of tech development to bend toward justice, with sections including how to make the case for DFM and how to start the research and development stages. "The aim is to shift to a justice-fueled processes of building tools and systems that might today seem “radical” but in effect are more practical, effective, and robust." As Rigot notes in the earlier (and very complementary) [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=privacy.thenexus.today) (2022), "The decentered include subpopulations who are the most impacted and least supported; they are often those that face highest marginalization in society... when your most at-risk and disenfranchised are covered by your product, we are all covered." - [Design justice principles](https://designjustice.org/read-the-principles?ref=thenexusofprivacy.net) (2018): rethinking design processes to center people who are normally marginalized by design, and use collaborative, creative practices to address the deepest challenges our communities face. - [(Re) Building Trust in Tech](https://sarell.tech/wp-content/uploads/2025/02/Re-Building-Trust-in-Tech-Convening-Report-Q4-2024-Revised.pdf?ref=thenexusofprivacy.net), Sarell (2025): outputs (and a discussion of the methodology) from a pair of convenings in 2024 ### ## Update log Ongoing: typo and wording fixes, adding links, ec. May 9: a few more updates based on our discussions May 5: Rewrite "Let's Discuss" section to link out to the notes from discussions so far April 9: update reading list with ATmosphereConf talks, etc. March 21: revised draft, including a reading list March 5-10: incorporate feedback, highlight wave of new people potentially getting involved March 2: first published draft ## ### SB 5708/HB 1834 (Age Verification) testimony URL: https://thenexusofprivacy.net/sb-5708-age-verification-testimony/ Last updated: 2026-04-16T03:28:20.000Z *I wasn't able to testify at the first round of committee hearings on SB 5708\. So even though the next hearing at the Ways & Means committee was focusing on the fiscal aspects, I decided to take the opportunity to let legislators know about my concerns with the bill and did the same with the House Appropriations committee for the companion bill (HB 1834). My goals here were to call more attention to some of the many issues with this bill (which had already been raised by the ACLU of Washington and others, but nobody had taken a technical focus yet) and lay the groundwork for future communications with legislators before upcoming votes.* *My position was OTHER for a variety of reasons. For one thing, I wasn't making a fiscal argument that the bill should or shouldn't be advanced. It was clear that the committee would advance the bill (and they did), so I phrased my criticisms as needed improvements. Also a wave of conservative activists were taking a CON position; I assumed that it was because they wanted the bill to be even more hostile to LGBTQ+ youth, and if so I didn't want legislators to think I was on the same side as them.* *This is my SB 5708 testimony; the HB 1843 was identical except for the names of the Chair, Ranking Member, and committee.* > *UPDATE, April 2: After passing the Senate, SB 5708 didn't get a hearing in the House Consumer Protection and Business Committee – and so died for the session. Huzzah! But, I'm sure it'll be back next year.* Dear Chair Robinson, Ranking Member Gildon, and members of the Senate Ways & Means committee, I'm Jon Pincus of Bellevue, a technologist and entrepreneur, and founder of The Nexus of Privacy. My position on SB 5708 is OTHER. Protecting' kids and teens' safety online is incredibly important, and I applaud the bill's protection of minors' privacy as well as most of its other elements. The fiscal note's proposed allocation of $470,000 for the biennium is certainly appropriate. However, the bill as written also has some problematic language that risks impacting LGBTQ+ youth and people seeing reproductive healthcare, so needs to be improved before passing it. I realize that this is beyond the scope of Ways & Means' focus on the fiscal aspects of the bill, but wanted to call your attention to the need to improve the bill as it goes forward. For example, the current language for the age estimation requirement leads to the kinds of security and privacy risks described by the Center for Democracy and Technology, the Internet Society and others in their joint amicus brief to the Supreme Court in Free Speech Coalition v. Paxton \[1\]. While I greatly appreciate Sec. 2(2)'s limitations on secondary uses of the data collected for age estimation, the underlying problems remain. The brief has a detailed discussion of how a non-retention requirement (similar to that in 2(2)) is insufficient to address the risks. In addition, the bill as written does not restrict sharing information gathered for age estimation purposes with a third party age estimation service based in a state where accessing information about reproductive health care and/or gender-affirming care is criminalized -- at which point law enforcement can access this data to target LGBTQ+ youth -- as well as anybody seeking abortions or exploring trans or non-binary identities. And as two of the brief's authors note in a post on the Internet Society blog\[2\] "Apart from the practical challenges of age verification technologies and their privacy and security risks, users may be less willing to access content that requires age verification, fearing that their activity could be monitored." While I know that this is in no way the intent of the bill's authors, this very justifiable fear could in practice restrict teens' access to LGBTQ+-related content or health information. So, after advancing SB 5708, please work with your colleagues to address these (and potentially other) problems with the current language of the bill. \[1\] [https://www.supremecourt.gov/DocketPDF/23/23-1122/326510/20240920161551554\_23-1122%20Amicus%20Brief.pdf](https://www.supremecourt.gov/DocketPDF/23/23-1122/326510/20240920161551554%5F23-1122%20Amicus%20Brief.pdf?ref=thenexusofprivacy.net) \[2\] [https://www.internetsociety.org/blog/2024/09/texas-mandatory-age-verification-law-will-weaken-privacy-and-security-on-the-internet/](https://www.internetsociety.org/blog/2024/09/texas-mandatory-age-verification-law-will-weaken-privacy-and-security-on-the-internet/?ref=thenexusofprivacy.net) ### Organizing on decentralized social networks: a survey! URL: https://thenexusofprivacy.net/organizing-on-decentralized-social-networks/ Last updated: 2025-02-18T05:58:59.000Z With Xitter's CEO making Nazi salutes and Meta's techbro CEO kissing the fascist boot (and censoring Black people, trans people, Muslims, and progressives on Facebook and Instragram), more and more organizers are looking for alternatives to corporate social networks. Decentralized social networks like Bluesky, Mastodon, and lesser-known like NodeBB, GoToSocial, and Mobilizon don't have all the functionality of corporate social networks, and they're not always as easy to use, but depending on what you and your group are looking for there may be some good options. The Nexus of Privacy is planning a series of online discussions and video/phone calls focusing on organizing on decentralized social networks. There's a range of topics to cover, including looking at the tradeoffs between the different platforms for different use cases, brainstorming how organizers can leverage these platforms, easy ways to start exploring, and ways for groups to move as a whole. At the bottom of the post, you should (hopefully) see a CryptPad survey to gauge interest and what topics we should focus on, You can fill it out anonymously; if you want to leave your contact information, we'll only use it to follow up with you on this topic (and not for anything else). Whether or not you reply to the survey, for discussions online, you can follow - [@thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) on Mastodon and compatible software like Glitch, Hometown, and GoToSocial (aka the ActivityPub fediverse) - [@thenexusofprivacy.net](https://bsky.app/profile/thenexusofprivacy.net?ref=thenexusofprivacy.net) on Bluesky - [thenexusofprivacy community on lemmy.blahaj.zone](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net) on Lemmy, Piefed, Mbin or compatible software - [The Nexus of Privacy newsletter](https://thenexusofprivacy.net/) And if you're interested in privacy – or just want to see a decentralized social network. campaign in action – you can also follow[ @waprivacy@pnw.zone](https://pnw.zone/@waprivacy?ref=thenexusofprivacy.net) in the ActivityPub fediverse and/or [@wa-privacy.net](https://bsky.app/profile/wa-privacy.net?ref=thenexusofprivacy.net) on Bluesky. If you're in Washington state, you can also sign up for [the Washington Privacy Organizers email list](https://wa-privacy.net/organizing/organizers-email-list/?ref=thenexusofprivacy.net). If you don't have an account on any of these decentralized social networks yet, no worries: just check the profiles from time to time to see updates. If you're interested in creating an account, check out [Resources for choosing the right fediverse instance](https://thenexusofprivacy.net/resources-for-choosing-instances/). *Note: it might take the form a few seconds to load. If you have problems viewing or responding to the survey embedded on this page,* [*here's the direct link to the CryptPad survey*](https://cryptpad.fr/form/?ref=thenexusofprivacy.net#/2/form/view/Rso8JdNqWdiEkdvRkSx5OPQzwG-1gg5t+rd-e3GIQIo/)*. If that doesn't work for you either,* [*here's a thread with Mastodon polls*](https://infosec.exchange/@thenexusofprivacy/114011342374701275?ref=thenexusofprivacy.net)*, or*[ *here's a Google Forms version as well*](https://docs.google.com/forms/d/e/1FAIpQLSfJW1ReslOTov7Qza4713UCV1Ykqquvgwzz%5FDa5DD5X5AuaFQ/viewform?usp=header&ref=thenexusofprivacy.net) *(I know, I know, Google is surveillance capitalism but I wanted to provide a fallback for people who CryptPad doesn't work for).* *Image credit:* [*Nick Youngson*](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) *via* [*Alpha Stock Images*](http://alphastockimages.com/?ref=thenexusofprivacy.net) *and* [*Blue Diamond Gallery*](https://www.thebluediamondgallery.com/handwriting/o/organize.html?ref=thenexusofprivacy.net)*, Licensed under* [*CC BY-SA 3.0*](http://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) ### The People's Privacy Act (HB 1671): testimony and followon mail URL: https://thenexusofprivacy.net/the-peoples-privacy-act-hb-1671-testimony-and-followon-mail/ Last updated: 2026-04-16T03:27:51.000Z The Washington state House Technology, Economic Development, & Veterans committee had[ a hearing on the People's Privacy Act on Tuesday February 1](https://tvw.org/video/house-technology-economic-development-veterans-2025021149/?eventID=2025021149&ref=thenexusofprivacy.net). The bill is based on model state privacy legislation from EPIC and Consumer Reports. During the hearing privacy advocates from WA People’s Privacy, ACLU of Washington, Consumer Federation of America, Consumer Reports, EPIC, US PIRG, and Lake Washington High School supported the bill. So did I! Unsurprisingly, though, big tech lobbyists opposed it fiercely, claiming the sky would fall if it passed. Who would have predicted? The bill is based on EPIC and Consumer Reports' model state privacy legislation, and there's a brief summary in [Rep. Shelley Kloba Introduces the People’s Privacy Act Ahead of Data Privacy Day](https://housedemocrats.wa.gov/blog/2025/01/27/rep-shelley-kloba-introduces-the-peoples-privacy-act-ahead-of-data-privacy-day/?ref=thenexusofprivacy.net) on the Washington State House Democrats site. The[ bill page on the state legislature's site](https://app.leg.wa.gov/BillSummary/?BillNumber=1671&Year=2025&Initiative=false&ref=thenexusofprivacy.net) links off to the [current text](https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bills/House%20Bills/1671.pdf?q=20250212231533&ref=thenexusofprivacy.net) and the [bill analysis from the non-partisan committee staff](https://lawfilesext.leg.wa.gov/biennium/2025-26/Pdf/Bill%20Reports/House/1671%20HBA%20TEDV%2025.pdf?q=20250207171228&ref=thenexusofprivacy.net). For more details, right now[ the hearing is the best source](https://tvw.org/video/house-technology-economic-development-veterans-2025021149/?eventID=2025021149&ref=thenexusofprivacy.net) – the discussion of HB 1671 starting at about 34:30 in the video. ## Testimony *My testimony starts at about* *1:41:0*0 *in* [*the video*](https://tvw.org/video/house-technology-economic-development-veterans-2025021149/?eventID=2025021149&ref=thenexusofprivacy.net)*. Here's the version I had prepared ... as always, there may be some minor differences in what I actually said!* Chair Ryu, Ranking Member Barnard, and members of the committee, I'm Jon Pincus from Bellevue, a technologist and entrepreneur. I’m the founder of The Nexus of Privacy, former General Manager of Strategy Development at Microsoft, and also a leader of Indivisible Plus Washington. I SUPPORT HB 1671, the People’s Privacy Act. It’s a well-crafted bill; and builds on the work the legislature has already done with My Health My Data. Rep. Barnard, your question about the standard for “reasonable standard of care ” is a good example of this – that language is already in My Health My Data. So please ignore the spin from industry lobbyists. They always claim the world will end if they have to get consent to exploit our data. As Andrew Kingsman pointed out, most of the “19 other state bills” they keep referring to were based on the industry-supported Bad Washington Privacy Act, which our legislature \*rejected\* \*four times\*. Sure, lobbyists for big tech and the advertising industry got them passed elsewhere – and without a private right of action – but we *do* get to make our own decisions! Chair Ryu asked if there’s more urgency now than a few years ago … yes, very much so. Especially at a time like this, it’s absolutely crucial to protect Washingtonians’ data. So please advance the People’s Privacy Act. ## Follow-on mail to Technology, Economic Development, & Veterans committee *Here's mail I sent to the committee on Wednesday, February 12.* Chair Ryu, Ranking Member Barnard, and members of the committee, Thank you for the opportunity to testify on HB 1671 last week. This email is a followup to my brief response during the hearing to Chair Ryu’s excellent earlier question about whether there’s more urgency now than a few years ago. [Dangerous Data: the role of data collection in genocides](https://responsibledata.io/2016/11/21/dangerous-data-the-role-of-data-collection-in-genocides/?ref=thenexusofprivacy.net) (from 2016) discusses the role that data abuse played in the the Rwanda genocide, the Holocaust, and the mass incarceration of Japanese Americans in World War II. Since then, Meta (formerly Facebook) has contributed to multiple genocides, including Myanmar and Ethiopia. Today, the increasing use of AI by unscrupulous big tech companies like Meta and X is happening at the same time the the federal government is building concentration camps, stripping rights from LGBTQ+ people and women, and attempting to prohibit any mention of diversity, equity, inclusion,or accessibility as part of their "war on woke." Meanwhile, X’s CEO is giving Nazi salutes. So yes, it's urgent. Never again is now. The People’s Privacy Act protects data including race and ethnicity, religion, trans and non-binary status, sexual orientation, immigrant status, and location –complementing My Health My Data's protections for health care data. Please look for opportunities to further strengthen the bill, but even if that proves politically impossible, the current version is hugely valuable. It’s crucial to provide as much protection for Washingtonians' data as you can. Please pass the People’s Privacy Act. ## Follow-on mail to the Appropriations committee *On February 14, the Technology, Economic Development, & Veterans committee voted 7-4 (on party lines) to advance a somewhat-weakened version of HB 1671\. The next step was the Appropriations committee, which is responsible for fiscal matters, and had to approve the proposed $825,000/year "fiscal note" for the bill. Here's mail I sent the committee on February 25.* Chair Ormsby, Ranking Member Couture, and members of the House Appropriation Committee, I'm Jon Pincus of Bellevue, a technologist and entrepreneur, founder of The Nexus of Privacy, and I've testified before many of you on various privacy bills over the years. At a hearing on Rembmerance Day in 2020, I remember Stan Shikuma of Japenese American Citizens League Seattle Chapter talking about the role data abuse played in the mass incarceration of Japanese Americans in World War II. Today, with white supremacists who run big tech companies throwing Nazi salutes and partnering with the Trump administration to abuse our data to target [immigrants for mass deportations](https://www.404media.co/email/3d360e43-3861-43e2-8854-ca040408f524?ref=thenexusofprivacy.net), [LGBTQIA2S+ people for erasure](https://www.msnbc.com/opinion/msnbc-opinion/trump-order-s-trying-push-trans-people-back-closet-rcna189045?ref=thenexusofprivacy.net), and protestors as part of the [upcoming crackdown on dissent](https://www.aclu.org/trump-on-surveillance-protest-and-free-speech?ref=thenexusofprivacy.net) ... it's more urgent than ever. The fiscal note for the People's Privacy Act (HB 1671) allocates ten cents per Washingtonian per year over the upcoming biennium, for a total of $1.65 million. I understand how tight the budget is, but think for a second about the consequences of leaving all this data exposed and unprotected. [Dangerous Data: the role of data collection in genocides](https://responsibledata.io/2016/11/21/dangerous-data-the-role-of-data-collection-in-genocides/?ref=thenexusofprivacy.net) (from 2016) discusses the role that data abuse played in the the Rwanda genocide and the Holocaust. Since then, Meta (formerly Facebook) has contributed to multiple genocides, including Myanmar and Ethiopia -- and their CEO is a big fan of Trump. Never again is now. If you asked your constituents whether they'd be willing to pay ten years to cut down the risks to themselves, their families, their communities, and the most vulnerable Washingtonians, what do you think they'd say? So please fund and advance the People's Privacy Act (HB 1671) -- and work with your colleagues to strengthen and pass it. Jonathan Pincus Bellevue, 98005 ### Resources for choosing the right fediverse instance URL: https://thenexusofprivacy.net/resources-for-choosing-instances/ Last updated: 2026-04-16T03:27:24.000Z *There's a lot of detail here! If you want to minimize the complexity and get going as quickly as possible, feel free to skip ahead.* **Contents:** - Intro - [Decentralization makes many things more complicated. Welcome to the fediverses!](#decentralization) - [What kind of functionality are you looking for?](#functionality)[](#directories) - [What kind of social network experience are you looking for?](#experience) - [If you just want to get started as easily as possible ...](#as-easy-as-possible) - [Instance directories](#directories) - [Instance catalogs](#catalogs) - [Finding out more information about a specific instance](#questions) - [Some important questions to ask ](#questions) - [Remember: you can have more than one account!](#more-than-one) > *Feedback welcome! See the threads on* [*lemmy.blahaj.zone*](https://lemmy.blahaj.zone/post/21438807?ref=thenexusofprivacy.net)*,* [*infosec.exchange*](https://infosec.exchange/@thenexusofprivacy/113927412335212608?ref=thenexusofprivacy.net)*, and* [*Bluesky*](https://bsky.app/profile/thenexusofprivacy.infosec.exchange.ap.brid.gy/post/3lh3xx2insd52?ref=thenexusofprivacy.net) *– or message me at* [*@*thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net). With campaigns like Global Switch Day and HelloQuitteX, more and more people are checking out the fediverses these days, looking for alternatives to the bigotry, fascism, and exploitation of corporate social networks. As [A lot of good stuff is happening in the fediverses!](https://thenexusofprivacy.net/good-stuff-in-the-fediverses/) and [What kind of social network experience are you looking for?](#experience) discuss, the fediverses offer a lot more flexibility and variety than traditional corporate social network, where Apartheid Clyde or Mark F\*\*\*ing Zuckerberg sets the policy for everybody and won't let you communicate with people on other social networks. So there's a good chance that you can find what you want somewhere in the fediverses – and if not, you can also create your own small social network for friends and family, colleagues, or people who share your interests. Yay! But there's no such thing as a free lunch. All this flexibility comes with a cost. The fediverses are also more complicated than corporate social networks – and different enough that it can be somewhat confusing, especially for newcomers. So depending on what you're looking for, it can take some work to find or create it. One of the things that people used to big corporate networks often find especially confusing is that there are thousands of different *instances* in the fediverses *–* each with their own policies, norms, culture, and software. As Erin Kissane says [The affordance loop](https://erinkissane.com/the-affordance-loop?ref=thenexusofprivacy.net) > "\[T\]*he instance you’re on will, through its moderation actions and policies and its federation and defederation choices, define much of your experience on the fediverse"* So, which instance should you sign up on? It's a daunting choice, and yes it's confusing. One important thing to keep in mind, though, is that this is just your *initial* choice. Many people (including me!) have accounts on multiple instances. Moving isn't uncommon (although it can be a hassle). And the good news is people on different instances can often (although not always) interact (at least to some extent) with each other just like on centralized corporate social networks: following, liking, resharing, replying, mentioning, blocking, etc etc etc. Even if you're initially on an instance that isn't so great you're still likely to find interesting people and content from other instances. > "It was confusing. But I was willing to just make A choice even if it wasn't the right choice, and started just clicking icons and stuff that I didn't know what it was." > > – Mother Bones, on mstdn.social So if you *don't* want to deal with the complexity at this point, then (depending on what you're looking for) there a few straightforward options where it's easy to get going – feel free to skip ahead to the section on [What kind of functionality are you looking for?](#functionality) But if you've got the time and energy, please read on! ## Decentralization makes many things more complicated. Welcome to the fediverses! One way in which the fediverses are very different than corporate social networks like Instagram is that the fediverses are *decentralized.* A fediverse isn't just a single social networks. Instead, it's an ecoysystem of thousands of different communities *–* each with their own policies, norms, culture, and software. Yes, I know I said this above, but it's important enough to repeat! The fediverses' decentralization is a huge strength. As well as leading to all the flexibility and variety, it creates an alternative to big tech companies' dominance. But decentralization and variety also make many things more complicated. The basic model of Xitter and Facebook (etc) is straightforward: you're the product, ad Apartheid Clyde and Mark F\*\*\*ing Zuckerberg set the rules for everybody. They make money by exploiting your data and change the algorithm and UI whenever they feel like it, they encourage hate speech against trans people and immigrants, and no you can't even commmunicate with accounts on other social networks. Yes it sucks ... but at least it's very clear what's going on. The fediverses' approach is a lot better, but it's also more complicated. It is very cool that people in different communities with a wide variety of norms and rules can often (although not always) interact (at least to some extent) with each other using hundreds of (somewhat-compatible) software apps! That said, "wide variety", "although not always", "at least to some extent," and "somewhat-compatible" are doing a lot of work in that sentence. Welcome to the fediverses. And decentralization and variety also make the terminology more complicated. **Instances,** for example, are also called **sites, servers**, **service providers**, **hubs**, and **platforms –** and all of those words have other meanings as well. It really is confusing. If you want to wallow in the details, [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) has more on the terminology I'm using; [Definitions of "the Fediverse"](https://thenexusofprivacy.net/is-bluesky-part-of-todays-fediverse/#defining-the-fediverse) and ["Decentralization" and erasure: Blacksky, Bluesky, and the ATmosphere](https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/) have more. It's not your imagination, it really is confusing. You don't have to deal with all of this complexity if you don't want to. [If you just want to get started as easily as possible ...](#as-easy-as-possible) discusses an easy route: sign up for a large instance like Bluesky or mastodon.social and think of it mostly like a centralized network where some things just don't make sense. Why aren't there private accounts on Bluesky? Why do people on other Mastodon instances see different versions of the conversation than you do, and why are there some people you can't communicate with? It's complex, and if you've got better things to do with your time and energy than deal with complexity, it's completely legitimate to just shrug 🤷🏻‍♂️, shake your head sadly 😞, and accept that's just how things work around here and maybe it'll get better over time. That said, if you want a social network experience that's different from corporate social networks, you'll probably need to deal with some of the complexity of the fediverses. Choosing an instance is a key part of that. If you've got the time and energy, putting in some effort up front can increase the chance that you'll have a good initial experience. Unfortunately, most of what I've seen written up about the fediverses doesn't give a lot of help choosing an instance. The most common pieces of advice are "it doesn't matter" (which is completely and totally wrong) or "start on mastodon.social" (which isn't necessarily a particularly good choice for most people). And a lot of the information that you really need to make a good choice isn't easy to find. It would be great to have some kind of portal or tool to help people find and evaluate potential instances ... alas, that doesn't exist yet. 🤷🏻‍♂️😞. Still, there are some useful instance catalogs and directories, and ways to get more information about instances you might be interested in. It just takes a little work to find it. Hopefully the resources in this post will make it a little easier. Before we get to that, though, let's start with a couple of important questions. ## What kind of functionality are you looking for? Different fediverse software is good at different things. If there's a particular kind of functionality that you're looking for, you'll want to find an instance running software that handles it well. For example: - For browsing or sharing longer videos,[PeerTube](#youtubehttps://joinpeertube.org/) is likely to be your best bet. For a TikTok-like experience, [Loops](https://loops.video/?ref=thenexusofprivacy.net) is currently the only game in town – but it doesn't currently federate. - For photo sharing, you might want to check out [Frequency](https://frequency.app/?ref=thenexusofprivacy.net) (a calmer, more personal social experience built on privacy-first principles and decentralized technology) or [Pixelfed](https://www.wired.com/story/migrate-move-instagram-to-pixelfed-no-tracking-fediverse/?ref=thenexusofprivacy.net) (which has a more Instagram-like interface and has recently gotten a lot of press). [Vermissage](https://vernissage.photos/home?ref=thenexusofprivacy.net) is a promising option, but still invitation-only. - For reddit-style link aggregation, I'm a big fan of [Piefed](https://piefed.social/?ref=thenexusofprivacy.net). Lemmy and Mbin are two other options. - If you're a blogger, choices include [WriteFreely](https://writefreely.org/instances?ref=thenexusofprivacy.net), micro.blog, or WordPerfect (and [Ghost is doing some very interesting work as well](https://activitypub.ghost.org/?ref=thenexusofprivacy.net)). - For Twitter-style microblogging, it depends whether or not you want to be on a corporate social network. If no, consider [Mastodon](https://joinmastodon.org/servers?ref=thenexusofprivacy.net) and forks (variants) like Glitch and Hometown, GoToSocial, Akkoma, Friendica, Misskey and forks like Sharkey. If you don't mind being on a corporate social network, then Bluesky and Flipboard are also options, and Vivaldi and Medium host Mastodon instances. And if you want to be on a network run by Mark F—ing Zuckerberg, so is Threads. [If you just want to get started as easily as possible ...](#as-easy-as-possible) has more discussion of these options. - If you're into music, [Bandwagon](https://bandwagon.fm/?ref=privacy.thenexus.today) is an open community for musicians and fans – and no matter what software you're using, check out [The Indie Beat Radio](https://theindiebeat.fm/?ref=privacy.thenexus.today) and the annual [Fedivision](https://fedivision.party/?ref=thenexusofprivacy.net) contest) - For an old-school Facebook-like experience, have a look at [Friendica](https://friendi.ca/?ref=thenexusofprivacy.net) and Hubzilla. - For a small to medium size community where you can also participate in broader conversations, Glitch, Hometown, GoToSocial, Akkoma, Friendica, Hubzilla, Sharkey, and Mastodon are all options. So are forums like NodeBB and Discord. Sorry about the length of the list ... like I said at the beginning of the article, the huge diversity and variety of the fediverse is a major strength but it sure does make things more complicate! These are only the tip of the iceberg. Join the Fediverse's [If You Like / You Should Try](https://jointhefediverse.net/join?lang=en-us&ref=thenexusofprivacy.net) and Per Axbom's [The many branches of the Fediverse](https://axbom.com/fediverse/?ref=thenexusofprivacy.net) and have links to dozens of different projects. ## What kind of social network experience are you looking for? Of course, functionality isn't the only thing that matters ... in fact, for many people, functionality is far from the most important factor in their social network experience. For example, what languages are common on an instance? If you don't speak Japanese, [misskey.io](https://misskey.io/?ref=thenexusofprivacy.net) might not be the best choice for you no matter how much you love the user interface! Aother example: in a [poll](https://infosec.exchange/@thenexusofprivacy/113383744966314976?ref=thenexusofprivacy.net) I did a few months ago, 90% of the responses said they were looking for "a social network that's not run by a corporation making money from my data." You're not going to find that on Threads (which is owned by Facebook's parent company Meta) no matter how good the functionality is. And Bluesky is a venture-funded big tech company, so even though they're not making money from people's data yet, that may well be in their future. Similarly, the possibilities of the fediverses for people in communities that are often marginalized, targeted, and/or exploited on commercial social networks go far beyond the functionality. ### ### Alt text on images > "As a Blind person i never thought i would be on social media savoring photos. But the communal Mastodon alt text game is so strong that sweet, poetic or silly descriptions abound on my timeline. Thanks to legions of people who take time to write a meaningful description of the ephemera they post, i learn so much about insects, plants, buildings, memes — all dispatches from a dimension of the world that i otherwise wouldn't experience. If you're wondering whether anybody reads these things: YES." > > – Chancey Fleet , almost 40% said alt text on images was something they're looking for in the fediverses. This is a really good example of how it's not just about the technology: most social network software these days supports alt text on images. But how many people actually *use* the functionality? On Mastodon and compatible software like GoToSocial, Akkoma, and Friendica, the number is a *lot* higher than on corporate social networks. And as [Alt Text Health Check](https://mastodon.social/@AltTextHealthCheck?ref=thenexusofprivacy.net)'s leaderboards highlight some instances that are particularly good on this front (although since you can follow people on other instances, once you find the right people you'll see plenty of alt text wherever you are). By contrast, the numbers on Bluesky are much lower. Of course, the software itself needs to be accessible, and the official Mastodon web user interface and apps are far from perfect on this front. Fortunately, there are other options – see [Accessibility resources for Mastodon and compatible software](https://thenexusofprivacy.net/mastodon-accessibility-resources/) for more. > Public service announcement: please help strengthen this wonderful aspect of fediverse culture! You can help by adding alt text to your images – and by **not** boosting or resharing images which don't have alt text. ### A pro-LGBTQIA2S+ environment > "Trans people talk and post here openly about their lives from a position that has never existed on social media before. We talk openly with cis people reading our posts and replying, friendships, understanding, experience, normalisation. > > Every other social network this is impossible because the continual existence of anti-trans agitators is implicit." > > – CJ Bellwether Roughly two-thirds of the respondents to that poll said that they wanted "a place where people agree that trans rights are human rights". There are a lot of very pro-LGBTQIA2S+ instances in the fediverse; [The Trans Fediverse](https://transfediverse.org/?ref=thenexusofprivacy.net) and the LGBTQ pages of the [instance directories](#directories) I discuss below are good places to look. There are also a lot of LGBTQIA2S+ folks on Bluesky, but there's a big caveat here: Bluesky's moderators don't ban anti-LGBTQIA2S+ bigots, and the recent wave of new signups from Xitter include a lot of them. At the very least you'll need to find the right blocklists and labelers if you want to limit your exposure. But it's still way better than Threads, which allows anti-LGBTQIA2S+ hate groups, recently changed their policies to explicitly allow anti-trans and anti-immigrant hate speech, and announced that they mostly won't be enforcing other policies against other hate speech. > A caveat: The fediverses in general aren't utopia for LGBTQIA2S+ people. It's not just Threads; there's plenty of hate speech and harassment on many instances, and some instances that are primarily terfs and fascists. So it's important to be on a well-moderated instance! Not only that, many instances in the fediverse – including many LGBTQIA2S+-focused instances – are very white, and may not be great choices for people of color. ### A extensible Black social network > "As Black users, aka Black Twitter, flee X in unprecedented numbers, a grassroots developer is building what many see as the future of Black social media culture. His platform, Blacksky, gained over 750,000 users in months without venture funding or promotion, operating as an open-source project on the decentralized Bluesky social network." > > – Tarik Moody, [Could Blacksky emerge as Black Twitter’s spiritual successor on Bluesky?](https://hyfin.org/2024/11/29/could-blacksky-emerge-as-black-twitters-spiritual-successor-on-bluesky/?ref=thenexusofprivacy.net) > "\[T\]he opportunity to build out an extensible Black social network that can be controlled by community instead of corporations, that doesn't require being segregated from the broader social space, and reflects the many aspects of the diaspora (not just whatever is trendy at the time or what a corporation is pushing on me) is too important to pass up.: > > – Rudy Fraser, [Blacksky: Expressing the Black Everyday in a New Digital Space (Part 3)](https://blog.rudyfraser.com/blacksky-part-three/?ref=thenexusofprivacy.net) Roughly two-thirds of the responses to my poll said they were looking for an anti-racist environment. There's plenty of racism in the fediverses (see for example Marcia X and Ra’il I'Nasah Kiam's [Blackness in the Fediverse](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x/?ref=privacy.thenexus.today), and Dr. Johnathan Flowers' [The Whiteness of Mastodon](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today)), but there's also Blacksky – an ambitious project that currently includes custom feeds, a starter pack, a moderation service, and a work-in-progress personal data store. And there are also Black-led instances like diaspora.im, blackqueer.life, blacktwitter.io, bantu.social ... and Indigenous-led instances, Latine-led instances, Japanese and Korean instances, and pretty much everything else you can think of. ### Networked communities > "If they’re motivated, tooled up, and plugged into communities of support fediverse server teams can provide context-sensitive, high-touch local moderation for their members—while also connecting to a broad landscape of other well-governed servers." > > – Erin Kissane, [revealing the fediverse’s gifts](https://www.wrecka.ge/revealing-the-gifts/?ref=thenexusofprivacy.net), October 2024 The networked communities model Kissane describes is a good example of something that only exists in the fediverse – and not on centralized corporate social networks. But since Mastodon has historically been the best-known fediverse software, and most of the largest Mastodon instances *aren't* communities, most people don't know about this model. Still, many long-running instances running Mastodon and forks like Glitch and Hometown, or other software like Akkoma, very much *are* communities ... and at least in my experience, those are the instances where people are much more likely to have really positive experiences. Networked communities tend to be relatively small – dozens or hundreds of people, sometimes a few thousand. Some are invite-only; others ask potential new members to fill out a form. Many are focused on specific topics – fandom-related news and discussions, anarchist perspectives, bird and nature photography, and so on. Of course, since you can follow people on other instances, you can find all of these topics anywhere in the fediverse. Still, you're likely to see a lot more of them if you're on an instance that focuses on that topic. For example, blorbo.social, fandom.ink, gaypirates.club, and startrek.website are all fandom focused; kolektiva.social and todon.eu have a lot of anarchists. Networked communities aren't always easy to find. If you've got friends on the fediverses, they may be able to suggest one or more that matches your needs. Otherwise, your best best is to to use the [instance directories](#directories) and [catalogs](#catalogs) below to find and evaluate instances that might interest you. It's a time-consuming process, but I don't know of any short-cuts. ## If you just want to get started as easily as possible ... If your eyes have glazed over at this point – or if you skipped directly here because you don't want to deal with all that complexity right now – I've got good news: there are some options in the fediverses that are very easy to sign up on and let you ignore most or all of the complexity, at least at first. Like I said above, many people have accounts on multiple instances, and moving isn't uncommon, so this is just your *initial* choice. If you're looking for a music or video-sharing site, or alternatives to Instagram, Reddit, or Facebook ome other social network, see the section above on [What kind of functionality are you looking for?](#functionality) If you're looking for a Twitter alternative, you may want to consider - Bluesky, if you're okay being on an all-public social network that's run by a venture-funded startup. Bluesky's changing rapidly, and the huge influx from Xitter over the last few months has also included a lot of anti-trans bigots, racists, trolls, and fascists, so it'll be interesting to see how things evolve ... but it's very easy to get up and going, and the software's very usable. If you do sign up on Bluesky, [Debbie Ridpath Ohi's Unofficial Guide to Bluesky](https://publish.obsidian.md/debbieohi/bluesky?ref=thenexusofprivacy.net) is a useful resource for getting up and going. - Mastodon instances like mastodon.social (the default signup for Mastodon's mobile apps and [landing page](https://joinmastodon.org/?ref=thenexusofprivacy.net)), mstdn.social, mas.to, and hachyderm.io, if you want a social network that's *not* run by a venture-funded startup and the experience isn't always as smooth as Bluesky. There are hundreds of other Mastodon instances as well, many with more of a subject or geographic focus (like [pnw.zone](https://pnw.zone/?ref=thenexusofprivacy.net) for people in the Pacific Northwest); see the section on [instance directories](#directories) for more about how you can explore ... but if you just want to get going, it's fine to pick one of these sites and get started – you can always move later. > If you use a screenreader or other asistive techologies, see the tips in [Accessibility resources for Mastodon and compatible software](https://thenexusofprivacy.net/mastodon-accessibility-resources/). Of course, even though it's easy to sign up and get started on any of these, you'll still need to deal with complexity as you get up and going. For example, Bluesky relies on people using labelers and blocklists to protect themselves against all those anti-trans bigots, racists, trolls, and fascists. But it's not easy to find blocklists and labelers let alone know which ones to trust, since there aren't yet any good ratings or reviews. At least right now, even at its simplest Mastodon is somewhat more complex for most people than Bluesky. Different people see different fragments of a conversation, and searches and hashtags don't include all the information from the whole network. It can be challenging for newcomers to find people and content; [account recommendations](https://connect.iftas.org/news/connect/mastodon-discovery/?ref=thenexusofprivacy.net) and looking at hashtags can help; so can directories like [Trunk](https://communitywiki.org/trunk?ref=thenexusofprivacy.net), [fedi.directory](https://fedi.directory/?ref=thenexusofprivacy.net), and [the academics on Mastodon list-of-lists](https://github.com/nathanlesage/academics-on-mastodon?ref=thenexusofprivacy.net) ... but this is already starting to get complicated. And the official apps and web user interface aren't great; there are better options, but that mean you have to research find them. (For what it's worth I like [phanpy](https://phanpy.social/?ref=thenexusofprivacy.net), [elk.zone](https://elk.zone/?ref=privacy.thenexus.today), [Semaphore](https://semaphore.social/?ref=privacy.thenexus.today) and [Enafore](https://enafore.social/?ref=privacy.thenexus.today), and if you like mobile apps I've heard good things about Mona, Tusky, Ivory, FediText and many others.) So, since you can't completely avoid dealing with these complexities, if you're going to try Mastodon – or compatible software like Glitch, Hometown, Akkoma, GoToSocial, or Friendica – you might well want to deal with the additional complexity of picking an instance that's a good match for you. Read on for more about how to do that (although if you haven't already read the section on [What kind of social network experience are you looking for?](#experience), you might want to have a quick look at it first). ## Instance directories Most fediverse software platforms have some kind of directory – usually on the official "landing page" – that lists various instances. [Find a PeerTube platform](https://joinpeertube.org/instances?ref=thenexusofprivacy.net), [Pixelfed's list of instances](https://pixelfed.org/servers?ref=thenexusofprivacy.net), and [joinmastodon.org's server page](https://joinmastodon.org/servers?ref=thenexusofprivacy.net) are three good examples. Most let you search by region or topic; here's joinmastodon's [LGBTQ+ page](https://joinmastodon.org/servers?ref=thenexusofprivacy.net), These sites typically only have a single-sentence description for each – and they *don't* provide any information about how well-moderated an instance is (which makes a huge difference, especially for marginalized people) or what percentage of images on the instance have alt-text – but they're useful starting points. [To the Fediverse](https://www.fediverse.to/?ref=thenexusofprivacy.net), [fediverse.party](https://fediverse.party/en/portal/servers/?ref=thenexusofprivacy.net), [fediverse.observer's map](https://mastodon.fediverse.observer/map?ref=thenexusofprivacy.net), and [instances.social](https://instances.social/?ref=thenexusofprivacy.net) all much longer lists of instances, aren't restricted to specific kinds of software, and support various kinds of search – here's To the Fediverse's [LGBT category](https://www.fediverse.to/search/?category=lgbt&ref=thenexusofprivacy.net). [mastodon.help's instance search tool](https://mastodon.help/instances/en?ref=thenexusofprivacy.net) is Mastodon-only, but provides more information than some of the other tools. **Keep in mind that these directories also include instances that don't necessarily have good moderation, so may allow hate speech and harassment.** You'll want to find out more information before signing up! Also, the directories sometimes take a while to update, so may include some instances that don't exist any longer – and may not include the newest isntances. [fedi.garden](https://fedi.garden/?ref=thenexusofprivacy.net) takes a different approach; it's a "small human-curated list of nice, well run servers on Mastodon and the wider Fediverse", run by the same person who runs [fedi.tips](https://fedi.tips/?ref=thenexusofprivacy.net). Instances are categorized by topics, countries, languages and type of software; for example, here's fedi.garden's [lgbtqia page](https://fedi.garden/tag/lgbtqia/?ref=thenexusofprivacy.net). All of the sites listed on fedi.garden have promised to obey [specific standards of reliability and responsible moderation](https://fedi.garden/about-this-site/?ref=thenexusofprivacy.net). The [Anti-Meta Fedi Pact](https://fedipact.online/?ref=thenexusofprivacy.net) is a list of instances that have committed to block communications with Meta's Threads that can be useful if you want to stay as far away as possible from Mark F—ing Zuckerberg. Many of the sites listed here are run by trans and queer people (if you're not sure why, [We're here, we're queer, fuck Facebook (or whatever they're calling themselves these days](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#were-here-were-queer) has some of the history). Note that these aren't the only instances that block Threads; the [https://fedipact.veganism.social/](https://fedipact.veganism.social/?ref=thenexusofprivacy.net) instance catalog (described below) has more. ## Instance catalogs [The Bad Space](https://tweaking.thebad.space/about?ref=thenexusofprivacy.net) is an instance catalog that provides information about instances that house bad actors or are poorly moderated. The project is a collaboration of communities committed to actively moderating against racism, sexism, heterosexism, transphobia, ableism, casteism, or bigotry directed at any religion. Of course, just like any review or recommendation site, opinions differ; some people think that some of the instances on The Bad Space shouldn't be there. So don't assume everything you see here is 100% accurate. Still, checking The Bad Space is a good way to avoid from accidentally signing up for an instance that's got a really bad reputation. [](https://fedipact.veganism.social/?ref=thenexusofprivacy.net) [The Fediseer](https://fediseer.com/faq/eng?ref=thenexusofprivacy.net) is a public space where people running an instance can specify approval/disapproval of other instances, as well "guarantee" other instances as spam-free. Again, don't assume everything here is 100% accurate. When I was researching [Compare and contrast: Fediseer, FIRES, and The Bad Space](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/) I found an endorsement on Fediseer for "good moderation" about an instance that's widely-known for harassment, trolling, and hate speech! Still, especially for Lemmy instaances, it's a useful resource. [https://fedipact.veganism.social/](https://fedipact.veganism.social/?ref=thenexusofprivacy.net) is an instance catalog that lets you see whether or not an instance communicates with Meta's Threads. If you want nothing at all to do with Mark F—ing Zuckerberg, or if you're at risk of harassment from anti-LGBTQ+ and anti-immgrant hate groups Meta has given the green light to, you'll want to be on an instance that's a **fedipact** signer or has **blocked** Threads. On the other hand, if there are accounts on Threads that you want to follow from the fediverse, you'll want to be on an instance that **federates** or has **limited** communications (although keep in mind that you can only communicate with them if they turn on Threads' Fediverse option, which comes with a bunch of scary warnings). ### Finding out more information about a specific instance Once you narrow down your search, there are a few ways to find out more information before you setting up an account. Instances typically have a page giving an overview of what the site's of the site and list the site's policies (as a list of rules or a code of conduct), and what version of the software the site is using. Many instances show this by default on the main page to people who aren't logged in. Others don't so, you have to go hunting around. ![A very hard to read screenshot with dark grey text on a black background. mas.to: About - Status - Profiles Directory - Privacy policy](https://thenexusofprivacy.net/content/images/2024/11/mas.to-about.png) On Mastodon, it's the **Abou**t link in dark purple text on a black background (ouch!) next to the instance name near the bottom of the left-hand side of the web interface (but *not* the other **About** link below that, which gives you information about Mastodon). On the Mastodon mobile web interface, you'll need to scroll to the bottom to find the **About** links. ![A screenshot. Matodon: About, followed by several other choices. Below, a red circle around the words "v 4.4.0-alpha.1+glitch"](https://thenexusofprivacy.net/content/images/2024/11/glitch.png) Note: I changed some of text color in this screenshot to white to make it more readable. It's also worth looking at what version of software the site is running. Mastodon forks (variants) like Glitch and Hometown have several improvements over the official release, and are often (although certainly not always) a sign of an instance with a good local community. On the other hand, if the software is out-of-date, that's not a good sign. As of January 2025, Mastodon most recent releases are 4.3.3 and 4.2.16; if you see numbers signifcantly lower than that, it may well be a warning sign that the site's administrator and moderators aren't really active., and theyre might also be some security risks. Another important thing to look for is the site's policy about hate speech and harassment. On Mastodon and Pixelfed instances, the **Server Rules** section (on the main page or the About page) typically has an overview; some instances also link out to more detailed explanations. Of course some sites with good policies don't actually enforce them in practice, so there's no guarantee, but sites with bad policies are big red flags. > If the policy talks about "free speech" in their description, rules, or code of conduct, that's often (although not always) code for an almost-anything-goes attitude. Also useful: many sitesinclude a list of instances they've blocked or limited, along with explanations; on Mastodon, this is the **Moderated Servers** section. If this is present, this list is one of the best ways to see if they're moderating actively – and what they consider cause for blocking (although publishing a list of blocked instances can potentially open moderators up to harassment many instances intentionally *don't* publish the list). If you want to take the time, you can spot-check to make sure that the "worst-of-the-worst" instances ([IFTAS's DNI ("do not interact") list](https://connect.iftas.org/library/iftas-documentation/iftas-dni-list/?ref=thenexusofprivacy.net) and the [receipts section of Seirdy's blocklist page](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net#receipts)), are moderated. If an instance you're looking at doesn't block all of them, run away. Instances should also include a link to their privacy policy and terms of use. A lot of these are fairly boilerplate; a recent research paper reported that only about 10% of the Mastodon instances they looked at had changed the default policy. Still, it might be worth checking. And if they *don't* have a privacy policy, that's a big big red flag. ![Live feeds. To the left, a small image of a globe](https://thenexusofprivacy.net/content/images/2024/11/live-feeds.png) Many instances let you look at some of what's going on even without logging in. On instances running Misskey and forks (variants) like Sharkey, the home page not only shows the local timeline but all the emoji and images people are using, so it really gives a feel for the vibrancy of the user interface as well as the content. On some Mastodon instances, you can see the timelines by clicking on **Live Feeds** or the globe (on the right of the web page – the mobile web UI only shows the globe); **This server** shows public posts from people on that instsance. Many Mastodon instances also let you see the **Profiles directory**; the link's near the bottom on the left, just to the right of the **About** link. Bear in mind though that most conversations *aren't* public, and many people prefer not to having their profiles included in the directory. So this is only a partial picture. Still, it's better than nothing! ## Some important questions to ask [](https://mastodon.help/instances/en?ref=thenexusofprivacy.net) Some of the key information you might want to know about the instance often aren't available on about pages. - Do they have limits on how many users can join the instance, or are they trying to grow as big as possible? - Do they have a dedicated team of mods? How diverse are they? - How active is the instance? - What is the policy about content warnings (aka CWs)? Some instances ask for CWs on discussions of food, alcohol, or photos with eye contact – which makes them a more pleasant environment for some (but by no means all) people with eating disorders, people in recovery, or autistic people who are triggered by eye contact. On the other hand, others might well find these requirements too burdensome. > Note that while content warnings can be useful, they're also a source of conflict. For example, some instances expect users to put CWs on "political" content, or have policies that require "civil" discourse. In practice (no matter the intent) these often leads to people asking Black, Indigenous, trans, and other marginalized users to place content warnings on their day-to-day lives – or to be "less angry". Shel Raphen's excellent [On Content Warnings](https://shelraphen.com/on-content-warnings/?ref=thenexusofprivacy.net) includes a detailed discussion of content warnings on Mastodon. One option to get answers to these questions is to try to contact the admin before signing up – many instances have an email address or a contact form somewhere. Another option is to sign up without knowing the answer and then send a message to the admins or moderators. *Several of these questions originally came from RadioAngel's suggestions about* [*what to look for when choosing an instance*](https://sunbeam.city/@RadioAngel/109378007463991333?ref=thenexusofprivacy.net)*, and are quoted with permission. And thanks to Damon for suggesting the question about CWs!)* ## Remember: you can have more than one account There's only so much you can learn about any social network without actually being there. Are people friendly? What gets discussed on the local timeline? Do the norms match what you're looking for? Is it diverse, or is almost everybody active there white and/or a guy? How good are the moderators? So your first choice might not work out as well as you had hoped. Most long-timers in the fediverse have more than one account. Including me! Back in 2017 my first account on Mastodon was not a good experience, but just as I was about to give up somebody I knew invited me to another instance which was much much much better. I still have that account and use it with long-time friends, but in 2022 I decided that I also wanted an account that would follow a lot more people. These days my primary account is on blahaj.zone, a small instance for queer folk and their allies. blahaj.zone runs on Sharkey (a fork of Misskey), which has a very vibrant user interface – quite a different experience from Mastodon. Similarly The Nexus of Privacy's account started out on another Mastodon instance before I shifted to infosec.exchange – which runs Glitch, so allows for longer posts with formatting and polls with more options, both of which I use extensively. The Nexus of Privacy also has a Lemmy account (on lemmy.blahaj.zone, which as you can probably guess from the name is run by the same people that run blahaj.zone). There's some interaction between Mastodon and Lemmy but I wanted to set up my own Lemmy community and you can't do that with a Mastodon account. Mastodon and Glitch (as well as a lot of other fediverse software) supports a limited form of account migration: you can automagically move most of your followers over to your new account, although not your posts – and there are some gotchas. If and when you decide to migrate your account, make sure to read Cutie City's guide to [Migrating Servers](https://guide.cutie.city/the-fediverse/migrating-servers/?ref=thenexusofprivacy.net) and Erin Kissane's [Notes From a Mastodon Migration](https://erinkissane.com/notes-from-a-mastodon-migration?ref=thenexusofprivacy.net). I recently migrated my personal account, and it went pretty smoothly. Another alternative that's worked well for me in the past is to make a pinned post saying I was moving, export the list of who I was following from my existing account, and imported it on my new account hoping that they'd follow me back if they were interested. Some did, some didn't. Oh well, such is life. So if you're not having a great experience, keep in mind that you're not locked into your initial choice. If the instance you've chosen isn't working for you, find another one! ## Update log Ongoing: minor fixes, including typos, cleaning up wording, and adding links November 2022: originally published as [*How to choose the right Mastodon instance?*](https://web.archive.org/web/20221201030220/https://nexusofprivacy.net/choosing-a-mastodon-instance/)(with a focus just on Mastodon) June 2023: Revised version published on *We Distribute* as [When Moving to Mastodon, How Do You Pick The Right Instance?](https://thenexusofprivacy.net/choosing-a-mastodon-instance/) November 17, 2024: draft of new version, now focusing on the fediverse as a whole! November 28-20: revised draft, including new sections on [What kind of functionality are you looking for?](#functionality) and [If you just want to get started as easily as possible ...](#as-easy-as-possible) January 18-19, 2025: some polishing, change to UPDATED DRAFT January 31, 2025: updated for Global Switch Day, removed DRAFT ### Bluesky and The Battle of Wormtongue URL: https://thenexusofprivacy.net/bluesky-and-the-battle-of-wormtongue/ Last updated: 2026-04-16T03:27:01.000Z *Part 4 of* [*I for one welcome Bluesky, the ATmosphere, BTS ARMY, millions of Brazilians, Black Twitter, and sex worker Twitter to the fediverses!*](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/) > *This was originally written before* [*Bluesky's Friday the 13th announcement*](https://bsky.app/profile/safety.bsky.app/post/3ld7e2hrugc2r?ref=thenexusofprivacy.net)*; the* [*Epilogue-in-progress*](#epilogue)*, last updated in early January 2025, continues the story (and may well become a post in its own right at some point). See the* [*update log*](#update-log) *for details.* With millions of people looking for alternatives to the fascist hellscape of Xitter, it's not surprising that Bluesky's grown rapidly in the last few months. And with JK Rowling, Wormtongue and their ilk running amok (and Apartheid Clyde cheering them on and helping) it's not surprising that more and more trans people are leaving Xitter. So it's also not surprising that harassers looking to target trans people have also been signing up for Bluesky. August featured a major wave of [Very British Bigotry](https://bsky.app/profile/did:plc:hzlrd6vbu4cxg4cnjzofzpul/lists/3l2lyvtks442a?ref=thenexusofprivacy.net). Since the US election in November, the volume's increased significantly. Of course, anti-trans harassment and hate speech is only one of the many challenges facing Bluesky users these days. Bluesky's Trust & Safety team, who's having a hard time in general keeping up with the rapid growth. Volunteer-run moderation services like [Blacksky](https://hyfin.org/2024/11/29/could-blacksky-emerge-as-black-twitters-spiritual-successor-on-bluesky/?ref=thenexusofprivacy.net) are helpful, and over time could be transformative, but don't substitute for the lack of platform moderation – especially since (unlike Twitter) Bluesky doesn't support private accounts. Over the last few weeks, I've been seeing more and more complaints about trolling, bots, and reply guys Several long-time contributors are pulling back, going on hiatus, or even deleting their accounts. From the perspective of people who *like* the fascist hellscape of Xitter, what better time to launch an attack on Bluesky? On December 6, Wormtongue encouraged his anti-trans followers to join him in his plan to "colonize Bluesky with normal people." And just in case any of his followers were confused about what he meant by "normal", he also listed several normal anti-trans bigots who already have Bluesky accounts. How will Bluesky CEO Jay Graber and her team respond? **Contents** - [To suspend or not to suspend?](#suspend) - [What's past is prologue](#prologue) - [The community fights back](#community) - [Appeasement never works](#appeasement) - [A golden opportunity](#opportunity) - [Epilogue-in-progress](#epilogue) (last updated: January 2) > *Note: Wormtongue thrives on attention, so I'm not using his name in the text. Thanks to The Midnight Society for permission to use their skeet with an appropriate nickname as the main image for this post!* ## To suspend or not to suspend? Wormtongue first joined Bluesky on December 1, but waited a few days before actually skeeting. On December 6, he skeeted a link to [an article he's written article that's part of a coordinated anti-trans smear campaign](https://bsky.app/profile/esqueer.net/post/3lcnngn4ifu2j?ref=thenexusofprivacy.net). He then returned to his lair on Xitter and[ shared a screenshot of a Bluesky post](https://bsky.app/profile/kenwhite.bsky.social/post/3lct2swynu223?ref=thenexusofprivacy.net) by a trans person who had (quite fairly in my opinion) compared him to David Duke. In response, his normal followers (who are known for harassing people on Xitter) harassed the trans person on Bluesky so badly that she shut down her Bluesky account. To me, Wormtongue's behavior clearly violated Bluesky's [Community Guidelines](https://bsky.social/about/support/community-guidelines?ref=thenexusofprivacy.net), which prohibit harassment and promoting hate.[1](#notes) Most Trust & Safety professionals who have weighed in see it that way too. Of course Wormtongue could argue that he wasn't *explicitly* suggested harassing the person whose posts he screenshotted and shared to his followers who routinely harass people. Similarly he could claim that he wasn't promoting hate, just sharing a news article. Yeah right. From a Trust & Safety perspective, these are classic examples of bad-faith "rules lawyering" – and as any experienced moderator or competent Trust & Safety professional knows, letting people get away with rules lawyering encourages harassers and provides a roadmap for how they can get around the community guidelines. At first it seemed like Bluesky's Trust & Safety team initially saw it that way as well, because on December 6 they suspended Wormtongue's account.1.5 But then Wormtongue's account was quickly unsuspended, and instead labeled it as **Intolerant**.[2](#fn-effect-of-labels) And then the next day, Bluesky suspended Wormtongue's account again. And then Bluesky unsuspended Wormtongue's account again, and removed the label.[3](#fn-sequence-of-events) For some reason trans people and allies weren't particularly happy with this sequence of events. Who could have predicted? ## What's past is prologue [![A post from Jonathan H. Gray: Pepperment Mocha Variant!:: This incident happening a second time says that "Trust and Safety" as well as the ppl who run this place and its shareholders think they can get away with offering up marginalized people for what they think will serve them as opposed to what we know will keep our respective communities safe online.](https://thenexusofprivacy.net/content/images/2024/12/offering-up-marginalized-people.png)](https://bsky.app/profile/jongraywb.bsky.social/post/3ld55azzvs225?ref=thenexusofprivacy.net) But let's back up a bit, because when I casually referred to Bluesky's Trust & Safety team and community guidelines clause prohibiting promoting hate, I left out some important backstory. Jack Dorsey initially funded Bluesky afer reading [Protocols, Not Platforms: A Technological Approach to Free Speech](https://knightcolumbia.org/content/protocols-not-platforms-a-technological-approach-to-free-speech?ref=thenexusofprivacy.net), which suggests that an advantage of a protocol-based approach is that people like Alex Jones can still reach their audience. Even after after wisely [pivoted](https://bsky.app/profile/pfrazee.com/post/3ks3jpmymyu2u?ref=thenexusofprivacy.net) from a pure protocol approach to building an app, they still didn't hire any Trust & Safety people. And [Bluesky's early-2023 community guidelines](https://web.archive.org/web/20230705183651/https://blueskyweb.xyz/support/community-guidelines) didn't include any prohibition on promoting hate. Jack was still on Bluesky's board at this point, and back when was running Twitter [he personally intervened to keep neo-Nazi Richard Spencer from being banned](https://archive.ph/S7ESx?ref=thenexusofprivacy.net), so this may well have been his influence. Then again it might just be that Bluesky was following the path of Twitter (and most corporate social network startups) and just didn't prioritize the perspectives or safety of marginalized people. But as noted startup guru Clausewitz once [observed](https://quoteinvestigator.com/2021/05/04/no-plan/?ref=thenexusofprivacy.net), no plan survives contact with beta testing. [Things came to a head in May 2023](https://techcrunch.com/2023/06/08/blueskys-growing-pains-strain-relationship-with-its-black-community-moderation/?ref=thenexusofprivacy.net), just a few months into Bluesky's invitation-only beta. - First, Bluesky suspended the account of a trans person for telling a cis white male influencer “WE ARE GOING TO BEAT YOU WITH HAMMERS.” - Next, Bluesky *didn't* take action when a cis white woman who had made multiple racist remarks suggested that a Black non-binary person should get [shoved off of someplace real high](https://bsky.app/profile/aliafonzy.bsky.social/post/3jwnfzfxygc23?ref=thenexusofprivacy.net). - And then to top it off, when it turned out that [people were embedding racist slurs in their handles](https://techcrunch.com/2023/07/17/bluesky-racial-slurs-banned-list-usernames/?ref=blog.rudyfraser.com), Bluesky initially didn't take action – and [didn't communicate with the community](https://finance.yahoo.com/news/inside-twitter-rival-bluesky-first-205239947.html?ref=thenexusofprivacy.net). For some reason trans and Black people and their allies weren't particularly happy with this sequence of events. Who could have predicted? Soon there were headlines like [Bluesky’s growing pains strain its relationship with Black users](https://techcrunch.com/2023/06/08/blueskys-growing-pains-strain-relationship-with-its-black-community-moderation/?ref=thenexusofprivacy.net), [Is Twitter Competitor Bluesky Failing To Protect Its Black Users?](https://peopleofcolorintech.com/articles/bluesky-users-question-platforms-safety-after-failure-to-protect-black-software-engineer-from-threats/?ref=thenexusofprivacy.net), and [Could Bluesky Have A Racism Problem?](https://www.blackenterprise.com/bluesky-has-a-racism-problem/?ref=thenexusofprivacy.net) – as well as lots of angry skeets directed at the Bluesky team, and mail and [LinkedIn comments](https://www.linkedin.com/posts/scotthirleman%5Fhey-jay-graber-paul-frazee-emily-liu-rose-activity-7085538196427546624-eiCk/?ref=thenexusofprivacy.net) directed at Bluesky investors, discussed in more detail in Kylie Robison's [Inside Twitter rival Bluesky’s first major crisis, as investors pressured CEO Jay Graber to speak out about racist inciden](https://fortune.com/2023/07/31/inside-bluesky-moderation-crisis-investor-pushback-user-backlash-ceo-apology/?ref=thenexusofprivacy.net)t in *Fortune.* > "We’ve made mistakes in the past, and despite our best efforts, we will probably make mistakes in the future. But it’s always our goal to correct those wrongs, and as we work to improve over time, we hope you’ll see that our actions support our intentions. We ask that you give us grace as we figure it out, and trust that we’re working as hard as we can to build a better, safer, more resilient social web." > > – Bluesky CEO Jay Graber, [2023-07-22 Letter to the Community](https://bsky.social/about/reports/2023-07-22-letter?ref=thenexusofprivacy.net) > "We hear your demand loud and clear. We are in the process of building a dedicated Trust and Safety team to protect the experiences of marginalized users and ensure a safe environment for all on our network.” > > – July 2023 Bluesky customer support email to voraciousviolet, quoted in Morgan Sung's [Bluesky sends some users personalized apologies after racism controversy](https://techcrunch.com/2023/07/27/bluesky-racism-slur-apology-feedback/?ref=thenexusofprivacy.net) To Bluesky's credit, [they realized they needed to change course](https://fortune.com/2023/07/31/inside-bluesky-moderation-crisis-investor-pushback-user-backlash-ceo-apology/?ref=thenexusofprivacy.net). As well as acknowledging mistakes, and committing to hire a Trust & Safety team, Jay apologized for the lack of communication to the community – and Bluesky even sent [personalized apologies ](https://techcrunch.com/2023/07/27/bluesky-racism-slur-apology-feedback/?ref=thenexusofprivacy.net)to some of the people involved[4](#un-apologize) By early 2024, Jack had left Bluesky's board and deleted his account. Good riddance to bad rubbish! Not only that, the product team started providing tools for people to protect themselves; and Bluesky hired former Twitter elections integrity lead Aaron Rodericks as their Director of Trust & Safety. [![A post from Sydette The Dreaded Gorgon: ](https://thenexusofprivacy.net/content/images/2024/12/it-didnt-just-happen.png)](https://bsky.app/profile/blackamazon.bsky.social/post/3lcxbeb6ews2m?ref=thenexusofprivacy.net) Then again, Bluesky didn't apologize to *all* of the people involved. As I said in [Speaking of erasure ...](https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/#speaking-of-erasure) > "Work by Aveta (aka [@aliafonsy.bsky.social](https://bsky.app/profile/did:plc:xgjcudwc5yk4z2uex5v6e7bl?ref=thenexusofprivacy.net)) – including their original Black Tech Twitter follow thread as well as inviting so many key Black tweeters to Bluesky in early 2023, and then speaking out strongly against the anti-Blackness on Bluesky – also provided a critical foundation for Black Twitter's move to Bluesky. And unsurprisingly, Aveta has been almost completely erased from the broader narrative. In fact, as far as I know, Bluesky hasn't ever even apologized to Aveta for the shitty stuff that happened back then – let alone credited these contributions or looked for ways to help get compensation for Aveta and others for all the unpaid work they did to make Bluesky succesful." And as Sydette Harry and Jonathan H. Gray highlight, there's a through line from the mid-2023 battles and other to the Battle of Wormtongue. With Bluesky repeating past mistakes by once again not prioritizing the safety of marginalized community members (and once again not communicating) a lot of people are once again pointing out that their actions do not in fact support their stated intentions. ## The community fights back While Bluesky continued their radio silence, Wormtongue shared personal health information of a trans person on Bluesky without their consent – and made a post highlighting assistance he's getting from a member of KiwiFarms, a transphobic harassment site best known for [doxing](https://www.msnbc.com/opinion/msnbc-opinion/kiwi-farms-made-internet-more-dangerous-trans-people-n1298815?ref=thenexusofprivacy.net) and its [body count of the trans people its driven to suicide](https://www.motherjones.com/politics/2023/02/kiwi-farms-die-drop-cloudflare-chandler-trolls/?ref=thenexusofprivacy.net). Meanwhile on Xitter, Wormtongue posted screenshots of trans Bluesky users who have blocked him, leading to more harassment on Bluesky. Who could have predicted? But even though Bluesky wasn't acting, the community was. Wormtongue quickly became the most-blocked person on Bluesky (overtaking Brianna Wu). More and more people criticized Bluesky Trust & Safety's lack of response more and more sharply. A bot started tracking all of Bluesky Director of Trust & Safety Aaron Rodericks' interactions, highlighting everything that he was treating as higher priority than dealing with anti-trans harassment. Bluesky shut the bot down almost immediately (priorities!); Roderick's claim that he hadn't been aware of the bot (because he was so busy and was only paying attention to priority notifications) went over so badly that he had to delete it. [![A post by borderless, with 11.3K reposts. BlueSky is trying to monetize so let's show them some numbers: Reskeet this if you refuse to pay for BlueSky+ until trust & safety decides to prioritize marginalized users. That's $96 / year of lost revenue for each reskeet...](https://thenexusofprivacy.net/content/images/2024/12/reskeet-4.png)](https://bsky.app/profile/borderless.bsky.social/post/3lcwirip5ys2k?ref=thenexusofprivacy.net) And Bluesky had recently started [teasing a subscription option, tentatively named Bluesky+](https://techcrunch.com/2024/12/09/bluesky-teases-paid-subscription-bluesky-in-new-mockup/?ref=thenexusofprivacy.net). Before the Battle of Wormtongue, many users (including me) were looking forward to giving them our money. After all, we desperately need an alternative to Xitter, and despite Bluesky's problems there's a lot to like about it ([especially Blacksky](https://hyfin.org/2024/11/29/could-blacksky-emerge-as-black-twitters-spiritual-successor-on-bluesky/?ref=thenexusofprivacy.net)!). But with Bluesky refusing to do anything about Wormtongue, the vibe changed. Borderless intentionally made the scope of this call to action broad to also include issues that Black users continue to face, as well as the pattern of banning Palestinian accounts even when they provide proof. Johnathan H. Gray similarly [highlights](https://bsky.app/profile/jongraywb.bsky.social/post/3ld55azzwre25?ref=thenexusofprivacy.net) that "Palestinians are saying the same things that the black folks were saying that the trans folks are now saying." and I'm seeing a lot of similar solidarity from other long-time Bluesky users of all genders and races. Which is a good thing, because as Gray points out. > "With fascism and oppression on the rise, we need to have each other before we're left with nothing. That's what true solidarity is and why its worth supporting all your folks. If even one of us ain't free, then none of us are." On December 11, somebody exploited a previously-unreported security hole that caused a crash whenever Wormtongue loooked at one of his posts. Direct action FTW! And I also started to see well-regarded posters saying that they were planning on spending less time on Bluesky as a result of this – and multiple responses from people saying that they're thinking much the same. The next day, [a change.org petition asking Bluesky to enforce their community guideline equally](https://www.change.org/p/bluesky-must-enforce-its-community-guidelines-equally?ref=thenexusofprivacy.net) went live. Just two hours later, it has almost 4,000 signatures, and by that evening it had over 16000 – including [Lizzo](https://bsky.app/profile/lizzobeeating.bsky.social/post/3ld4yt7ysjk2z?ref=thenexusofprivacy.net). People really are frustrated! ![Bluesky Must Enforce its Community Guidlines Equally. 16,725 Verified signatures.](https://thenexusofprivacy.net/content/images/2024/12/signatures.png) > "Bsky is about to hit 25 million so reporters are going to run stories. It would be unfortunate if the scandal still were going on then such that the headline were "marred by controversy, bluesky hits 25M"" > > – Liz Fong-Jones, December 11 Sure enough, Bluesky topped 25 million users on December 12\. Here's a sampling of the headlines - [Trans people want this user banned from Bluesky for one very big reason](https://www.msn.com/en-us/news/us/trans-people-want-this-user-banned-from-bluesky-for-one-very-big-reason/?ref=thenexusofprivacy.net) – Harry Giardina, *Into* - [Bluesky faces its first LGBTQ+ safety test as users call for anti-trans podcaster Jesse Singal ban](https://www.yahoo.com/news/bluesky-faces-first-lgbtq-safety-132101539.html?ref=thenexusofprivacy.net) – Ariel Messman-Rucker, *Pride,* - [Bluesky at a crossroads as users petition to ban Jesse Singal over anti-trans views, harassment](https://techcrunch.com/2024/12/13/bluesky-is-at-a-crossroads-as-users-petition-to-ban-jesse-singal-over-anti-trans-views-harassment/?ref=thenexusofprivacy.net) *–* Sarah Perez, *TechCrunch* Unfortunate indeed. ## Appeasement never works > "If Bluesky bans him, they risk even more heat from Musk and Trump's Eye of Sauron, which could result in everything from expensive lawsuits to mass harassment and bot campaigns to a sea of foul coverage in various MAGA-friendly major media outlets (which is, nowadays, just about all of them)." > > – Faine Greenwood, [Everything Happens So Much: Bluesky’s L’affaire Singal + Butternut Squash Soup](https://little-flying-robots.ghost.io/bluesky-gets-enormous-butternut-squash-soup-and-vietnam-2/?ref=thenexusofprivacy.net), *Little Flying Robots,* December 13 Of course, marginalized people and allies aren't the only ones who can exert pressure. Wormtongue is known for threatening lawsuits, and sure enough he threatened to sue Bluesky after he was initially suspended. Sure, [Bluesky is a private site and can ban whoever they like](https://bsky.app/profile/kenwhite.bsky.social/post/3lcsy3og3cs26?ref=thenexusofprivacy.net), but even frivolous lawsuits take time and energy and can lead to bad press – plus these days, it's hard to have a lot of confidence in the court system. Not only that, if Bluesky takes action to defend themselves and their marginalized uses, Apartheid Clyde is looking for any opportunity to support anti-trans bigotry while attacking a competitor with a better product, Republican politicians would no doubt make a stink, and the mainstream media loves framing anti-trans harassers and fascists as the good guys so might well screech loudly and paint Bluesky as the woke oppressors. So even though surrendering to Wormtongue would permanently lose Bluesky any trust or goodwill from marginalized users and allies ... appeasement might well seem like the path of least resistance to Bluesky's executive team and board. Then again, appeasement never works. Even if Bluesky meekly surrenders here and Wormtongue and his buddies move in, that will only empower Apartheid Clyde and Republican politicians and the mainstream media to find some other excuse to screech. And while throwing out the welcome mat to bigots is a good path to an acquisition offer from Larry Ellison or Peter Thiel or Apartheid Clyde or Truth Social ... is that really the outcome Bluesky wants? Bluesky's leadership team isn't stupid, and presumably realizes that. So it's possible that they're *not* planning to go the appeasement route, and are just making sure all their legal ducks are in a row before banning Wormtongue. Time will tell. ## A golden opportunity From a business strategy perspective, the Battle of Wormtongue is a golden opportunity for Bluesky. As I said [back in 2017](https://thenexusofprivacy.net/lessons-so-far-from-mastodon-for-independent-social-networks/), > "Policies against racism, sexism, discrimination against gender and sexual minorities, and Nazis are extremely appealing positioning these days. Not for everybody, of course: anti-safe-spacers, people with simplistic views of “free speech”, trolls, harassers and Nazis all have problems with it. Still, there’s clearly a large under-served market who’s sick of the norms on Twitter, Reddit, Facebook, and elsewhere." It's even more true today. And just as true is the point Afsenah Rigot makes in [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=privacy.thenexus.today) > "The decentered include subpopulations who are the most impacted and least supported; they are often those that face highest marginalization in society... when your most at-risk and disenfranchised are covered by your product, we are all covered." So let's hope that Jay Graber and her team make the right choice here. Stay tuned! ## Epilogue-in-progress > *Last updated: January 2* ![A post from Bluesky Safety: Our moderation team continues to monitor and review all received reports, and will action accounts based on in-app violations of our Community Guidelines. We want our actions to be clear and consistent, recognizing that we have more work to do to make that happen.](https://thenexusofprivacy.net/content/images/2024/12/mod-announcement.png) Bluesky Trust and Safety finally released [a vaguely -worded statement](https://bsky.app/profile/safety.bsky.app/post/3ld7e2hrugc2r?ref=thenexusofprivacy.net) on Friday the 13th (just a few hours after the *TechCrunch* article). Their focus on in-app violations certainly gave the impression that they were okay with a Bluesky user organizing harassment against other Bluesky users as long as they do it on Xitter. As Matthew Francis says in [Goodbye, Bluesky](https://galileospendulum.org/2024/12/17/goodbye-bluesky/?ref=thenexusofprivacy.net) > "That argument falls apart under the slightest scrutiny..... By saying he can break rules against harassment as long as he organizes using Twitter, the moderation team has laid out a rulebook by which everyone from stalkers to Nazis can attack Bluesky." So, Wormtongue's account is still there – and it's not labeled **Intolerant**. To show his gratitude, he threatened people with cease-and-desist orders, wrote about his "grim experience" for an anti-trans media outlet that got wide distribution from terfs and right-wingers, and tweeted sycophantically to Apartheid Clyde. It wasn't a particularly surprising decision. Black people have been pointing out for quite a while that Bluesky's leadership doesn't appear to prioritize marginalized users' safety. And of course Bluesky's going to have to deal with the Eye of Sauron at some point, probably relatively soon – Apartheid Clyde doesn't like competitors, Democratic leadership is going to Bluesky so the next Congress and administration will look for any opportunity to weaken them. And Bluesky's leadership and board are overwhelmingly (maybe even completely) cis ... how often do cis-led companies stick their necks out to protect trans people? In any case, the aftermath of Bluesky's decision was pretty much what you'd expect. Harassers took the statement as encouragement. Bluesky Trust and Safety was already overwhelmed, and things have gotten worse – and so has their reputation. It's not just anti-trans bigots; moderation and trust and safety challeges also include follow farmers, impersonation, a "politely disagree" bot, reply guys, parasocial followback demands, and a cultural shift due to rapid growth. Headlines since then have focused primarily on Bluesky's "growing pains." > "We will launch subscriptions. It was going to be end of this year, but probably early next year is looking more like the timeline." > > – Bluesky Chief Operating Officer Rose Wang, quoted in Buffer's [Bluesky's Rose Wang on Subscriptions, Creator Monetization, and More](https://www.youtube.com/watch?v=GxgTgEgwAiY&ref=thenexusofprivacy.net), December 19 If the Battle of Wormtongue hadn't happened, even with all the other problems, it's easy to imagine an end-of-the-year subscription launch being a huge success for Bluesky. We really need an alternative to Xitter, and desite the problems there are some very promising things about Bluesky –Blacksky, XBlock Labeler, and other feeds and moderation services, the energy in the ATmosphere. If I thought that Bluesky had gotten over Jack Dorsey's "moderation is bad" attitude, and if I thought they were intent on sharing their success with the community (including trans people and other long-time users who helped make them successful), then yeah I'd totally buy a subscription. From a timing perspective, there was a great opportunity to package a deal and tie into holiday-gift giving ("the perfect gift for people and polycules who want something new" ) and the energy of a new year and people making resolutions to get off of Xitter and start spending money more intentionally instead of giving it to fascists and anti-trans bigots. As well as ending the year on an up note, bringing in a quick few million dollars would also allow them to share a bunch of it with the community, increase investment in solving Trust and Safety problems, and give Bluesky more flexibility in fundraising. But no. As the wide support for borderless' [Reskeet this if you refuse to pay for BlueSky+ until trust & safety decides to prioritize marginalized users](https://bsky.app/profile/borderless.bsky.social/post/3lcwirip5ys2k?ref=privacy.thenexus.today) highlighted, launching subscriptions in the immediate aftermath of the Battle of Wormtongue would have thrown gasoline on the fire – potentially leading to calls for a boycott, sharp pushback on anybody advocating supporting Bluesky, a lot of cis Blueksky supporters saying anti-trans things in response ... not good.5 > "In the last month and a half, Bluesky has grown by over 13M people, with organizations reporting a 2-10x increase in the amount of [engagement](https://bsky.social/about/blog/11-29-2024-engagement?ref=thenexusofprivacy.net) they receive." > > – Bluesky CEO Jay Graber, [2024 In Review](https://bsky.social/about/blog/12-30-2024-year-in-review?ref=thenexusofprivacy.net), December 30 Of course, missing the end-of-the-year launch doesn't mean it's all over. On-going influxes are likely to continue whenever Apartheid Clyde does ridiculous things on Xitter and finds new ways to anger people across the world. Even for most marginalized users, Bluesky's still better than Xitter (at least for now) – they *do* sometimes take action on high-profile even-more-blatantly anti-trans bigots.5 And heaven knows there's no shortage of potential subscribers who don't give a flying fig about whether or not Bluesky leadership or Trust and Safety prioritize marginalized users. As long as there's nothing better around, "it kinda sucks for marginalized users but hey it's better than Xitter" is a good enough proposition for a lot of techbro libertarians, "resistance" liberals and centrist Democrats, "apolitical" cis white people, follow farmers, tech companies, VCs, and brands (as well as journalists, authors, musicians, and others who want to reach a large audience). So I don't think anybody will be surprised if Bluesky continues to move in that direction. Still, Bluesky has potentially painted themselves into a corner here. Their "composable moderation" approach to Trust and Safety relies on volunteer-run community moderation services (aka labelers). Rudy Fraser's [The Moderation article](https://blog.rudyfraser.com/the-moderation-article/?ref=privacy.thenexus.today) is still the best overview of the approach in general, and his creation Blacksky is a great example of what's possible. As Dr. KáLyn Coghill says in [I Reported it to Blacksky; now what?](https://drkalyncoghill.substack.com/p/i-reported-it-to-blacksky-now-what) > "Our goal as moderators is to keep the Blacksky feed free of anti-black harassment and misogynoir and to make your experience on Bluesky as a whole enjoyable and free of harm." Fraser explains why this is such a huge win from a community perspective in Tarik Moody's [Could Blacksky emerge as Black Twitter’s spiritual successor on Bluesky?](https://hyfin.org/2024/11/29/could-blacksky-emerge-as-black-twitters-spiritual-successor-on-bluesky/?ref=thenexusofprivacy.net) on *Hyfin*: > “We’re context-aware, Black moderators moderating anti-Black content. We’re very sensitive to it and are able to respond faster than the Bluesky team because they’re handling a bunch of moderation reports from other folks.” And while Blacksky has (very deservedly) gotten the most attention, there are a lot of other valuable moderation services out there as well. The XBlock Screenshot labeler, opt-in pronouns, Laeleps, profile labels to see who's a new or changed account ... my Bluesky experience is hugely better because of them, and there isn't anything I know like them on other social networks. These community labelers are a huge win from Bluesky's perspective. If labelers run by different marginalized communities can provide safer experiences for community members, Bluesky will be a safer place for marginalized people – so a safer place for everybody. Not only that, there are obvious cost advantages outsourcing Trust and Safety (and the need for context-specific expertise) to volunteers or non-profits. But community-run moderation services like Blacksky have a lot less power than Bluesky Trust and Safety. While community-run moderation services can hide harassing posts from their subscribers, they have no ability to limit the broader reach of harassing posts or prevent pile-ons. The official Bluesky moderation service is the only moderation service with the ability to ban users, the only moderation service whose labels are automatically visible to everybody, the only moderation service that's not limited in terms of the number of labels that's applied each day, the only one with significant funding ... So if Bluesky Trust & Safety is going to continue to side with and encourage harassers, there's only so much the community moderation services can do. Not only that, the volunteers running moderation services are often targets of harassment themselves. Why should they donate their labor to a well-funded corporation that isn't trying to protect them? Maybe Bluesky has an answer to that. If not, maybe they can find a way to scale trust and safety to make their business model work without relying on donated labor. But to me, the biggest takeaway from the Battle of Wormtongue is that if anti-oppressive moderation services work together, and can keep the trust of their communities, they have a lot more power than is generally realized – quite possibly more than Bluesky. In [Building #Blacksky](https://nonprofitquarterly.org/building-blacksky/?ref=privacy.thenexus.today) in *Non-profit quarterly,* Isaiah Thompson mentions that > "Part of the vision, too, for Blacksky is to become resilient enough to eventually live on its own servers—literally and otherwise." And Moody noted that the vision for Blacksky "extends beyond any single platform": > "Fraser envisions Blacksky’s open-source technology, as enabling other marginalized communities to build safe spaces online. Already, he’s hosting other communities on Blacksky’s infrastructure while letting them maintain their distinct identities." So there are definitely some interesting areas for collaboration. > "We’ve been working on an improved version of our Community Guidelines that provides greater detail and more examples, and plan to release it early next year and solicit feedback from the community. As we grow, we will continue to learn and adjust." > > – Bluesky Safety, December 13 Stay tuned, I guess. ## **Notes** 1 Bluesky's [Community Guidelines](https://bsky.social/about/support/community-guidelines?ref=thenexusofprivacy.net) include this langauge:[](#notes) > **"Treat others with respect.** For example, no: > > 1\. Harassment or abuse directed at a specific person or group, including but not limited to, sexual harassment and gender identity-based harassment > > 2\. Promoting hate or extremist conduct that targets people or groups based on their race, gender, religion, ethnicity, nationality, disability, or sexual orientation" The rules-lawyering counter to that is that the Community Guidlines also say "These guidelines apply only to Bluesky Social" so it's okay to be part of harassment campaign against Bluesky users as long as you only encourage harassmnet on Xitter. But rules-lawyering is a game both sides can play: violations of the Community Guidelines isn't the only reason to suspend an account. Bluesky's [Terms of Service](https://bsky.social/about/support/tos?ref=thenexusofprivacy.net#who-can-use) didn't get discussed as much as their community guidelines but it's worth highlighting that in Section 4 B, Bluesky > "Continuing to allow your account to be active, giving you access to some or all services, or hosting your content creates risk for Bluesky, other users, or third parties." Wormtongue's Bluesky posts (and the reactions to those posts he shared on Xitter) did created the risk of haarassment (as well as the reality) for trans people on Bluesky, so whether or not the community guidelines were ambiguousl Bluesky had the authority to act if they had wanted to. The [Bluesky Must Enforce its Community Guidelines Equally](https://www.change.org/p/bluesky-must-enforce-its-community-guidelines-equally?ref=thenexusofprivacy.net) petition discussed a different violation of Bluesky's Community Guidelines: Singal posting a trans person's personal health information without their consent. Singal's rules-lawyering argument here is that it wasn't a HIPAA violation for him to share it (true but irrelvant) and that since some details had been removed it wasn't personally-identifying information (almost certainly false and in any case also irrelevant). [Yeah right](https://bsky.app/profile/esqueer.net/post/3lda7es4ors2b?ref=thenexusofprivacy.net). 1.5 In [Everything Happens So Much: Bluesky’s L’affaire Singal + Butternut Squash Soup](https://little-flying-robots.ghost.io/bluesky-gets-enormous-butternut-squash-soup-and-vietnam-2/?ref=thenexusofprivacy.net), Faine Greenwood suggests that [the discussion of impersonation accounts](https://bsky.app/profile/safety.bsky.app/post/3ld7e2hs7622r?ref=thenexusofprivacy.net) in Bluesky's Friday the 13th update (written after the original version of this post) implies that Singal's account was originally banned under the mistaken believe that it was impersonating. Here's what they said. > "We recently introduced a new system to detect impersonation. This tool automatically flagged some accounts that were taken down, then reinstated. Other prominent impersonation accounts were quickly removed, contributing to a false perception that we take action based on behavior outside of Bluesky." When I first wrote this footnote, I was focused more on the last sentence, which I assumed was referring to [Bluesky's previous banning of an account that claimed to be the anti-trans hate group Libs of Tik Tok](https://jewelcitytimes.com/2024/12/02/bluesky-social-suspends-far-right-libs-of-tiktok-account/?ref=thenexusofprivacy.net). 2 When an account is labeled **Intolerant** by Bluesky, people still see their posts by default, but if you figure out the user interface mechanism then you can hide the posts. That doesn't prevent interaction, but it's better than nothing. One way is to click on the label (how intuitive!) which tells you the label was applied by the Bluesky moderation service and has a link that you can click on that gets you to the settings for that moderation service; scroll down and change **Intolerance** from Warn to Hide. Alternatively, you can go to Settings / Content,Advanced list click on **Bluesky moderation service** in the Advanced section, at which point you're in the settings for that serivce and can scroll down and change **Intolerance** from Warn to Hide Of course even if you do that, they can still harass you, but if you figure out a different UI mechanism you can block them. And of course even if they do that their followers can still harass you, but it's better than nohting. For somewhat more protection, you can also if you figure out how to use blocklists and community labelers you can reduce this to some extent. If you want to block Wormtongue's followers, be careful *not* to use the fake Wormtongue blocklist that also has a bunch of trans people listed included; instead, [well-known trans author Julia Serano recommends using this blocklist](https://bsky.app/profile/jessothomson.bsky.social/lists/3lcozj6mgew2u?ref=thenexusofprivacy.net), run by somebody she trusts. Wormtongue and his followers on Xitter know that these blocklists exists, so presumably some of them are smart enough not to followhim on Bluesky, so it's far from buletproof protection, but it's better than nothing. If you were the target of harassment on Twitter you probably know that making your account private is a "shields up" mode which cuts down harassment significantly ... but that's not an option on Bluesky, sorry. 3 I've heard more than one person speculate that this sequence of events implies that Bluesky CEO Jay Graber or Bluesky's investors might be overruling the initial decision by Trust & Safety. It's certianly possible; at the end of the day, it's the CEO and board who call the shots. 4 Although Bluesky quickly distanced themselves from these apologies, [clarifying](https://fortune.com/2023/07/31/inside-bluesky-moderation-crisis-investor-pushback-user-backlash-ceo-apology/?ref=thenexusofprivacy.net) that this had been done by "a newly hired agent" and "it is not Bluesky’s policy to conduct personalized or private communications on general issues through support emails"). 5 In fact, at some point right around the same time as their statement, they finally suspended the account of another anti-trans bigot who was spewing intolerance on Bluesky. It's nowhere near enough of course, and it doesn't come close to blaancing the damage that somebody like Wormtongue will do, and it's quite possible it was a cynical attempt to be able to portray themselves as "balanced" ... but it really is more than Xitter would do. ## Update log Ongoing minor fixes: typos, wording cleanups December 12: [initial version](https://web.archive.org/web/20241213193038/https://privacy.thenexus.today/bluesky-and-the-battle-of-wormtongue/) published in the morning; later in the day, added a couple more links and quotes, update statistics for change.org petition December 16: added links to various articles, went into more detail discussion in footnotes December 17: restructure *The community fights back* section*,* move some stuff from footnote to main text December 31: add *Epilogue* January 2, 2025: revise last section, change title to Epilogue-in-progress (and included the date at the start of that section as well as at the top), update footnote #1 to discuss ## ### #GivingTuesday in the fediverse: instance admins, mutual aid, 501(c)(3)s, and more URL: https://thenexusofprivacy.net/giving-tuesday-in-the-fediverse/ Last updated: 2026-04-16T03:26:37.000Z Giving Tuesday is a non-profit whose supporters include the Bill and Melinda Gates Foundation, Amazon's aws non-profits, Google.org ... I know, totally aligned with fedi's values, right? Oh well, it is what it is. At least in the US, many 501(c)(3) non-profits have campaigns focused on #GivingTuesday – and many employers will match gifts. Before we get to non-profits, though ... Unlike corporate social networks, the fediverse is powered by *people*. So please keep the people here in mind a part of your giving, today and throughout the rest of the year. A few suggestions: - If you're on an instance run by an individual or a coop, that's a great place to start! - [The #MutualAid hashtag](https://mastodon.social/tags/mutualaid?ref=privacy.thenexus.today) is filled with people who rely on giving from the fediverse – and giving money directly to people in need has a huge impact - Black-led instances like [blackqueer.life](https://ko-fi.com/blackqueerlife?ref=privacy.thenexus.today), [diaspora.im](https://opencollective.com/diasporaim?ref=privacy.thenexus.today), and [blacktwitter.io](https://www.patreon.com/andcomputers?ref=privacy.thenexus.today) play an important role in the fediverse – and need support as well That said, non-profits play a key role too. If you're looking to support a fediverse-related 501(c)(3) non-profit, [IFTAS (Independent Federated Trust & Safety)](https://about.iftas.org/donate/?ref=thenexusofprivacy.net) supports volunteer moderators, community managers, and administrators with a [moderator community](https://about.iftas.org/activities/moderator-community/?ref=thenexusofprivacy.net), a [library of resources](https://connect.iftas.org/library/?ref=thenexusofprivacy.net), [DSA Guide for the Fediverse](https://about.iftas.org/2024/04/09/dsa-guide-for-the-fediverse/?ref=thenexusofprivacy.net), and tools like [FediCheck](https://connect.iftas.org/library/iftas-documentation/fedicheck/?ref=thenexusofprivacy.net). [Erin Kissane (who, like me, is on IFTAS' advisory board) has a short thread with more](https://mas.to/@kissane/113590329106430421?ref=thenexusofprivacy.net). > As well as [individual donations](https://about.iftas.org/donate/?ref=thenexusofprivacy.net), IFTAS also appreciates (and recognizes!) [supporting instances](https://mastodon.iftas.org/@iftas/113570612018440745?ref=thenexusofprivacy.net), so if your instance has a bit of money to spare, please encourage your admins to help improve safety on the fediverse! Two other 501(c)(3)'s who consistently do great work and align with fedi's values - [MediaJustice](https://support.mediajustice.org/give/538942/?ref=thenexusofprivacy.net#!/donation/checkout) challenges corporate media and big tech power in pursuit of racial justice - [Fight for the Future Education Fund](https://www.fftfef.org/donate/?ref=thenexusofprivacy.net) is a group of artists, engineers, activists, and technologists fight for a future where technology is a force for liberation— not oppression. - [Spritely Institute](https://spritely.institute/donate/?ref=thenexusofprivacy.net), led by ActivityPub spec co-author Christine Lemmer-Webber, is building new foundations for the internet: safer, more decentralized and distributed, community-centric tech. [See Christine's detailed #GivingTuesday thread for a lot more information](https://social.coop/@cwebber/113590122851907042?ref=thenexusofprivacy.net). And there's more to society than the fediverse and digital rights! Here are three other 501(c)(3)'s I'm supporting this year. If you've got the resources, please also consider supporting them – or similiar organizations in your area. - [Palmetto State Abortion Fund](https://palmettostateabortionfund.com/donate-now/?ref=thenexusofprivacy.net), a 100% volunteer run nonprofit that serves South Carolinians seeking abortion care - [Gender Justice League](https://www.genderjusticeleague.org/give?ref=thenexusofprivacy.net), a civil & human rights organization that focuses on elevating the rights of TwoSpirit, Trans, & Gender Diverse (2STGD) communities in Washington State & beyond - [REBUILD](https://givingtuesday.mightycause.com/story/Rebuild25?ref=thenexusofprivacy.net), a Darkness RISING program connecting formerly incarcerated and justice-impacted people of color with culturally competent therapists of color ### Image credit - Heart logos from [Giving Tuesday's web site](https://www.givingtuesday.org/logos/?ref=thenexusofprivacy.net). - Fediverse logo originally designed by [@eudaimon](https://fe.disroot.org/@eudaimon?ref=thenexusofprivacy.net) and [@drq](https://mastodon.ml/@drq?ref=thenexusofprivacy.net) in June 2018 and dedicated to the public domain. Stefan Bohacek's [The history of the fediverse logo](https://stefanbohacek.com/blog/the-history-of-the-fediverse-logo/?ref=thenexusofprivacy.net) has more of the very interesting – and very fedi – background. ### "Decentralization" and erasure: Blacksky, Bluesky, and the ATmosphere URL: https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/ Last updated: 2026-08-29T18:33:26.000Z *Part 3 of* [*I for one welcome Bluesky, the ATmosphere, BTS ARMY, millions of Brazilians, Black Twitter, and sex worker Twitter to the fediverses*](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/)*. Originally written December 2024, epilogue added August 2025.* > "As Black users, aka Black Twitter, flee X in unprecedented numbers, a grassroots developer is building what many see as the future of Black social media culture. His platform, Blacksky, gained over 750,000 users in months without venture funding or promotion, operating as an open-source project on the decentralized Bluesky social network." > > – Tarik Moody, [Could Blacksky emerge as Black Twitter’s spiritual successor on Bluesky?](https://hyfin.org/2024/11/29/could-blacksky-emerge-as-black-twitters-spiritual-successor-on-bluesky/?ref=thenexusofprivacy.net) In the original version of the [first post](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/) in this series, I said I thought it was obvious that Bluesky and the ATmosphere are decentralized. Okay, fine, it clearly *isn't* obvious; I was wrong about that part! See the [Appendix](#appendix) for a partial list of some of the dozens of interesting perspectives on whether or not the Bluesky social network and the broader ATmosphere (an ecosystem of services and apps built on top of Blueskys Autenticated Transfer Protocol, aka AT Proto). That said, my conclusion hasn't changed. I still see Bluesky and the ATmosphere as clearly decentralized. Rudy Fraser's Blacksky, for example, runs [three](https://bsky.app/profile/rudyfraser.com/feed/blacksky?ref=thenexusofprivacy.net) [feed](https://bsky.app/profile/rudyfraser.com/feed/blacksky?ref=thenexusofprivacy.net) [generators](https://bsky.app/profile/rudyfraser.com/feed/blacksky-op?ref=thenexusofprivacy.net), a [moderation service](https://bsky.app/profile/blacksky.app?ref=thenexusofprivacy.net), and a work-in-progress [personal data store (PDS)](https://github.com/blacksky-algorithms/rsky?ref=thenexusofprivacy.net), and is considering implementing their own relay as well. And as Moody notes, the vision for Blacksky "extends beyond any single platform": > "Fraser envisions Blacksky’s open-source technology, as enabling other marginalized communities to build safe spaces online. Already, he’s hosting other communities on Blacksky’s infrastructure while letting them maintain their distinct identities. > > “Every time the culture moves to a new app, there’s a Black Twitter, there’s Black TikTok, a Black People Reddit section,” Fraser notes. “What if you keep your community and the interface changes?”" That sounds pretty darn decentralized to me! > Blacksky is an independent project. > [Please join me in supporting them](https://opencollective.com/blacksky?ref=thenexusofprivacy.net)! It's true that Blacksky also currently relies on some of Bluesky's services. As of December 2024, Bluesky currently runs the only network-wide Relay and the PDSs and AppViews used by 99%+ of the people in the ATmosphere; Bluesky also controls the identity provider, the protocol, and the official Bluesky software When Bluesky's Relay was down for a few hours last week, so was Blacksky (and almost everything in the ATmosphere). Then again, Blacksky's already building their own PDS; once it's available, people will be able to store their data on a server not under Bluesky's control – and will be able to have an \*.blacksky.app handle. > **Update, September 2025:** Blacksky PDS blacksky.app is now open for migration, and hundreds of accounts are now hosted there (including my new primary account at [@jdp23.thenexus.today](https://blacksky.community/profile/did:plc:7ax27mj5qwhqaa3ite2ezlzy?ref=thenexusofprivacy.net)). The blacksky.community app uses the Blacksky moderation service and has the Blacksky: Trending as the feed for new users (which in turn leverages Blacksy's atproto.africa 🌍 , "[One of (if not Thee 1st) from-scratch, full-network relays](https://bsky.app/profile/rudyfraser.com/post/3lo7xk2szvs2b?ref=thenexusofprivacy.net)"). > > That sure looks decentralized to me. > > **Update, August 2026:** Blacksky has had its own AppView for a while, too. In Fraser's December 2024 [roadmap](https://bsky.app/profile/rudyfraser.com/post/3lcdxlx7mjk2q?ref=thenexusofprivacy.net) he talked about possibly doing their own Relay. As Isaiah Thompson notes in [Building #Blacksky](https://nonprofitquarterly.org/building-blacksky/?ref=thenexusofprivacy.net) > "Part of the vision, too, for Blacksky is to become resilient enough to eventually live on its own servers—literally and otherwise." If the Bluesky Relay and Appview went away (or put in unacceptable new policies), Blacksky could almost certainly get their own up and running – by themselves, or working with some of the communities Fraser is already hosting. > Update, March 2025: Fraser talks more about building "our own independent implementation of Bluesky's underlying technology" and the goal of "trying to create a home for Black users on the network that is safe and self-governable and self-sovereign" and in the [TechPolicy.Press Podcast](https://techpolicy.press/podcast-rudy-fraser-on-building-blacksky-and-the-future-of-middleware?ref=thenexusofprivacy.net) with Justin Hendrix. Blacksky's also working on [Cypher](https://github.com/blacksky-algorithms/rsky/blob/main/cypher/README.md?ref=thenexusofprivacy.net), an Appview, with "local-only posts" So while I agree that today's actually-existing Bluesky and ATmosphere are still largely centralized in some important ways, and that the combination of AT's architecture and Bluesky's initial dominance could well lead to de-facto centralization, my perspective is that focusing *only* on that ignores the ways that they already are meaningfully decentralized. Your mileage may vary of course. "Decentralization" means different things to different people, and as Tolulope Oshinowo et al point out in [Seeing the Politics of Decentralized Social Media Protocols](https://arxiv.org/pdf/2505.22962v1?ref=thenexusofprivacy.net), different protocols interpret "decentralization" in different ways. As the links in the [Appendix](#appendix) highlight, people who are focusing on the (very real) concentration of power in the ATmosphere today, or the potentially-centralizing architecture of AT, find it more useful to describe Bluesky as centralized. ## Blacksky has been erased from discussions of Bluesky's decentralization Regardless of the conclusions people reach, though, what's especially interesting to me is that as far as I can tell, nobody else in the discussion is talking about Blacksky as an actually-existing example of decentralization. What's with that? The erasure of Blacksky from this discussion is particularly striking because so many people writing about this talk about a goal of decentralization is to create a more equitable distribution of power. Hey wait a second, *that's what Blacksky is actually doing*! And you don't just take my word for it. Here's what Fraser says in [Blacksky: Expressing the Black Everyday in a New Digital Space (Part 3)](https://blog.rudyfraser.com/blacksky-part-three?ref=thenexusofprivacy.net) > "The power in the protocol is that other people (in this case people who aren't me) will be able to build job boards, dating apps, and video streaming(?) social apps and **Blacksky will work across all of them on the same infrastructure.** > > To put it plainly, it will be someone else's job to come up with the next TikTok, the next Reddit, or the next LinkedIn. My only job will be to integrate it into Blacksky (which should be easy) and amplify, protect, and moderate Black content no matter where it is on the network.... > > Tools like Bluesky and AT Protocol have their own tradeoffs and considerations (what [@ntnsndr.in](https://bsky.app/profile/ntnsndr.in?ref=blog.rudyfraser.com) describes as ["implicit feudalism"](https://osf.io/preprints/mediarxiv/sf432?ref=blog.rudyfraser.com) for one) but personally my belief in self-determination extends to my technology use and development. And the opportunity to build out an extensible Black social network that can be controlled by community instead of corporations, that doesn't require being segregated from the broader social space, and reflects the many aspects of the diaspora (not just whatever is trendy at the time or what a corporation is pushing on me) is too important to pass up." But no. Instead, all the discussions of power distributions are in a deracialized context. Watch whiteness write. ## Pay attention, dammit! > "Seize this new technology, all the new technology. Deal with it! ‘Cause we’re not gonna unknow anything anyway. And make that technology act in a desired manner as both a tool and a weapon." > > Sister Elaine Brown, quoted in Rudy Fraser's [Blacksky: Expressing the Black Everyday in a New Digital Space (Part 3)](https://blog.rudyfraser.com/blacksky-part-three?ref=thenexusofprivacy.net) > "\[A\]s Blacksky highlights, Bluesky and that ATmosphere are developing new organizations for strong communities and how they interact, complementing the Fediverse's instance-oriented structure. These aren't (yet) as place-oriented as Fediverse instances but it's still useful to think of them as part of the Social Archipelagos ... and new topologies may well emerge. > > – me, in [From the Fediverse to fediverses, communities, and Social Archipelagos](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#social-archipelego) A lot of the pushback to the idea that Bluesky is decentralized has come from people comparing it to the ActivityPub-based Fediverse. And don't get me wrong: many of the concerns people bring up are worth paying attention to. Bluesky currently dominates the ATmosphere far more than any single entity dominates today's ActivityPub Fediverse. Even if that changes, the AT ecosystem could wind up resembling the web, where Google, Microsoft, and a few other search engines largely control visibility; or email, where Google, Microsoft, and a few other email providers host 95% of personal email accounts. AT Proto is an all-public architecture that's optimized for surveillance capitalism, and includes several choke points that are likely to lead to centralization. And [there are plenty of other ways in which Bluesky is problematic as well](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#problematic). Still, whether or not you're just focusing on decentralization, dismissing Bluesky without even considering Blacksky isn't just erasure, it's also missing out on something very important. Especially for people in the ActivityPub Fediverse – with its long history of [whiteness](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), [anti-Blackness](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x?ref=thenexusofprivacy.net), and [misogynoir](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) – there's a lot to learn here. More positively, the ActivityPub Fediverse's focus on scoped-visibility complements Bluesky's panoptic all-public architecture, so there's a lot of opportunity for hybrids that combine the Fediverse model of smaller networked communities with Blacksky's innovative approach to community in Bluesky/AT Proto's "big world" flat networks. But it's really hard to learn from Blacksky if you're pretending it doesn't exist. So please stop doing that. > And please don't just learn from Blacksky. > [Please also support Blacksky!](https://opencollective.com/blacksky?ref=thenexusofprivacy.net) For more on Blacksky, here's [Rudy Fraser's December 2024 Tech Talk](https://www.youtube.com/watch?v=ijGZLvKwOGI&ref=thenexusofprivacy.net) – good stuff! ## Speaking of erasure ... ![A post by Rudy wants revolution (@rudyfraser.com): For folks unaware, @aliafonzy.bsky.social did a lot of early community building for Black people on Bluesky. Their original Black Tech Twitter follow thread is immortalized in the v0.0.1 Blacksky source code and seeded the feed with it's first couple hundred folks](https://thenexusofprivacy.net/content/images/2024/12/founding-blacksky.png) At least Blacksky is getting attention in the broader conversation about Bluesky, and Fraser's work is justifiably being credited as playing a huge role in leading to so much of Black Twitter moving to Bluesky. But even though Fraser deserves all the credit in the world for this, he's not the only one who deserves all the credit in the world. Work by Aveta (aka [@aliafonsy.bsky.social](https://bsky.app/profile/did:plc:xgjcudwc5yk4z2uex5v6e7bl?ref=thenexusofprivacy.net)) – including their original Black Tech Twitter follow thread as well as inviting so many key Black tweeters to Bluesky in early 2023, and then speaking out strongly against the anti-Blackness on Bluesky – also provided a critical foundation for Black Twitter's move to Bluesky. And unsurprisingly, Aveta has been almost completely erased from the broader narrative. In fact, as far as I know, Bluesky hasn't ever even apologized to Aveta for the shitty stuff that happeend back then – let alone credited these contributions or looked for ways to help get compensation for Aveta and others for all the unpaid work they did to make Bluesky succesful. What's with that? Yeah, I know this might seem like a digression from the discussion of decentralization. But it certainly relates to discussions of equitable distribution of power on social networks, and that's what decentralization is supposedly about. Also, there's certainly a parallel between how Blacksky has been erased from discussions of decentralization and how Aveta has been eraased from the broader narrative. And since I mentioned the ActivityPub Fediverse in the previous section, there's also a parallel to how [Marcia X's contributions with #Fediblock](https://subscriptions.boricua.style/fediblock-a-tiny-history-2/?ref=thenexusofprivacy.net) aren't generally acknowledged. So maybe it's not really that much of a digression after all? ## Epilogue: nine months later ![Rudy wants revolution (@rude1.blacksky.team, he/him, they/them, Changed Handle), quoting a post by Jay (@jay.bsky.team, Matt Yglesias Follower), with small symbols beneath each of the names, described in the caption. Rudy's post: reminder that bsky.team only has jurisdiction over what happens on their servers. If you self-host or are hosted by blacksky.app they cannot remove your posts. they can hide it on bsky.app but it will still be up elsewhere. signups and migrations are open. Jay's post: Violence is always unacceptable, and threats of violence have no place in public discourse. Our thoughts are with Charlie Kirk and his family.](https://thenexusofprivacy.net/content/images/2025/09/reminder-2.png) Screenshot of a post on Blacksky, quoting a Bluesky post by Jay Graber (CEO of Bluesky).The small icons below the names are handcrafted artisinal labels from [The Yardcrow](https://blacksky.community/profile/did:plc:z3yk2cflhmn6vmzo3f5ixqh4?ref=thenexusofprivacy.net); for Rudy, they indicate Developer, Helper, and Legend. Pronouns via @juli.ee's [opt-in pronouns.diy labeling service](https://blacksky.community/profile/did:plc:wkoofae5uytcm7bjncmev6n6?ref=thenexusofprivacy.net). "Changed handle" on Rudy's profile via @bossett.social's [Profile Info labeller](https://blacksky.community/profile/did:plc:jfhpnnst6flqway4eaeqzj2a?ref=thenexusofprivacy.net). "Matt Yglesias Follower" on Jay's profile via the @for.shame.wtf [Follow Tracker](https://blacksky.community/profile/for.shame.wtf?ref=thenexusofprivacy.net). Blacksky has continued to progress by leaps and bounds in the months since I first wrote this post, expanding the team and executing on the path that Rudy Fraser laid out in 2024. - Blacksky is now hosting almost all of their own infrasctructure. - Hundreds of people have set up accounts on the blacksky.app and blackskycomra.de PDS (personal data server) – [including me](https://blacksky.community/profile/did:plc:7ax27mj5qwhqaa3ite2ezlzy?ref=thenexusofprivacy.net). - The [blacksky.community](https://blacksky.community/?ref=thenexusofprivacy.net) app has the outstanding [Blacksky Moderation](https://blacksky.community/profile/did:plc:d2mkddsbmnrgr3domzg5qexf?ref=thenexusofprivacy.net) service enabled by default, and the also-outstanding [Blacksky: Trending](https://blacksky.community/profile/rude1.blacksky.team/feed/blacksky-trend?ref=thenexusofprivacy.net) as the feed for new users instead of Bluesky's crappy Discover feed). - Behind the scenes, the Blacksky feeds use the Blacksky relay at atproto.africa, which extends relay functionality by including a "mod relay" - and [other ATmosphere software is starting to use it as well](https://blacksky.community/profile/did:plc:72wa4qoe4ssxx2az3xljtq5d/post/3lyglot43x22h?ref=thenexusofprivacy.net). [This is what solidarity looks like](https://thenexusofprivacy.net/what-solidarity-looks-like/), part 2 of the series, goes into more detail. And while Rudy deserves every bit of the credit he's getting for Blacksky's success, as he consistently points out it has been very much a team effort – and the team also collectively deserve every bit of the credit. ![A slide with the title "[they] can't stop this 2-3 zone", followed by avatars labeled 1st invites, 3rd most rsky commits, moderation how-tos, created Umoya Fellowship, building SAFEskies](https://thenexusofprivacy.net/content/images/2025/09/2-3-zone.png) A slide from Rudy's ATmosphereConf March 2025 talk [Beyond Horseless Carriages: Building Communities for the Decentralized Era](https://www.youtube.com/watch?v=OZN8y8kVFFI&ref=thenexusofprivacy.net), featuring avatars of Blacksky contributors Aveta, Clinton Bowen, Dr. KáLyn Coghill, TDr. Linda Maepa, and Natalie As somebody who's believed in the liberatory powers of social networks for decades, I've never been as excited about a project as I am about Blacksky. And I for one am very much looking forward to what comes next – and looking for ways to help! Speaking of which, at the risk of repeating myself ... > Blacksky primarily relies on crowdfunding. > [Please join me in supporting them](https://opencollective.com/blacksky?ref=thenexusofprivacy.net)! ## Appendix: links on Bluesky and decentralization that are worth reading even though they don't mention Blacksky If you're interested in decentralized social networks, there's a lot to learn from various perspectives on Bluesky and decentralization. Alexia's [Bluesky, and what Bluesky is not](https://whtwnd.com/alexia.bsky.cyrneko.eu/3l727v7zlis2i?ref=privacy.thenexus.today) is a good introduction to Bluesky's approach and how it contrasts with ActivityPub. Laurens Hof's [A conceptual model of ATProto and ActivityPub](https://fediversereport.com/a-conceptual-model-of-atproto-and-activitypub/?ref=thenexusofprivacy.net) and [Bluesky, decentralisation, and the distribution of power](https://fediversereport.com/bluesky-decentralisation-and-the-distribution-of-power/?ref=thenexusofprivacy.net) are two other good fairly-recent overviews. Christine Lemmer-Webber's [How decentralized is Bluesky really?](https://dustycloud.org/blog/how-decentralized-is-bluesky/?ref=thenexusofprivacy.net) and Bluesky engineer Bryan Newbold's [Reply on Bluesky and Decentralization](https://whtwnd.com/bnewbold.net/3lbvbtqrg5t2t?ref=thenexusofprivacy.net), and Lemmer-Webber's [Re: Re: Bluesky and Decentralization](https://dustycloud.org/blog/re-re-bluesky-decentralization/?ref=thenexusofprivacy.net) are deeper dives on some of the key issues. Both agree that Bluesky's focus on "credible exit" is worthwhile, and highlight the difference between AT Proto's "shared heap" approach and the message-passing architecture of ActivityPub, XMPP, and email. However, they disagree on a lot of other topics, starting with the definition of "decentralization." Newbold uses Mark Nottingham's definitinn in [RFC 9518: Centralization, Decentralization, and Internet Standards](https://datatracker.ietf.org/doc/rfc9518/?ref=thenexusofprivacy.net) (which in turn is based on Paul Baran's 1964 definition in ["On Distributed Communications: I. Introduction to Distributed Communication Networks](https://www.rand.org/pubs/research%5Fmemoranda/RM3420.html?ref=thenexusofprivacy.net)) > \[Decentralization is when\] "complete reliance upon a single point is not always required" Lemmer-Webber views this definition as too weak ("decentralization washing"), and suggests that contemporary nomenclature positions "centralized" and "decentralized" as polar ends of a spectrum (in contrast with Baran's terminology, which positioned "centralized" and "distributed" at the ends). Accordingly, Lemmer-Webber's definition is > Decentralization is the result of a system that diffuses power throughout its structure, so that no node holds particular power at the center. Lemmer-Webber and Newbold also discuss the natural centralizing tendency of search engines in big-world public networks. Even if alternative whole-network Relays *do* emerge, will the costs and liability of running one be so high that only a few large companies can afford to do so? As the email and XMPP examples highlight, this kind of near-total capture by a few entities is a risk of any decentralized protocol (see for example [Embrace, Extend, and Exploit: Meta’s plan for ActivityPub, Mastodon and the Fediverse](https://thenexusofprivacy.net/embrace-extend-and-exploit/)), so now's certainly a good time to be discussing how this applies to AT! And those articles are only the tip of the iceberg. Other perspectives arguing that Bluesky isn't really decentralized include - Michał "rysiek" Woźniak's April 2023 [BlueSky is cosplaying decentralization](https://rys.io/en/167.html?ref=thenexusofprivacy.net) describes Bluesky as “ostensibly decentralized.” This was written in April 2023, before Blacksky existed, so gets a pass on the erasure front ... and even though s lot has changed since it was written, it's still worth reading! - jonny (good kind) [talks about](https://neuromatch.social/@jonny/113364719373034539?ref=thenexusofprivacy.net) the "mirage of decentralization in atproto", noting that "i am not concerned with decentralization for decentralization's sake, as a technological fetish, but the implications on the social, political, and economic structure of the system - specifically its capacity to be turned into an extractive chokepoint by those that control the center (the relay)," and has [written](https://neuromatch.social/@jonny/113364349477832206?ref=thenexusofprivacy.net) that AT's relay system is "decentralized in the same sense as google alerts is decentralized" - Possibly a Dog, in a [thread](https://beige.party/@possibledog/113367977656537478?ref=thenexusofprivacy.net) that led to [discussion on Hacker News](https://news.ycombinator.com/item?id=41952994&ref=thenexusofprivacy.net), says "It's not decentralized. #BlueSky is a centralized corporate app, running a theoretically-decentralized network protocol that currently has only one (1) active node on the network: BlueSky." - Oblomov's [A credible threat to (and from) commercial social network silos/2](https://wok.oblomov.eu/tecnologia/credible-threat-2/?ref=thenexusofprivacy.net) suggests that "the purported decentralization theoretically made possible by ATproto is largely performative" - EFF's [What You Should Know When Joining Bluesky](https://www.eff.org/deeplinks/2024/12/what-you-should-know-when-joining-bluesky?ref=thenexusofprivacy.net) states "the current Bluesky network is not decentralized," and suggests that even once "credible exit" is possible it still "falls short of the distributed power and decision making of decentralized networks." - Mike Sass' [Cloudy with a chance of not enshittifying](https://shellsharks.com/notes/2024/11/15/cloudy-with-a-chance-of-not-enshittifying?ref=thenexusofprivacy.net) says "I’ll say that Bluesky is in no meaningful way decentralized **at the moment**.... But *can* Bluesky *be* decentralized? This is up for debate it seems." Then again, others argue that Bluesky and AT *are* decentralized. - The Related Work sections of [Bluesky and the AT Protocol: Usable Decentralized Social Media](https://arxiv.org/abs/2402.03239v2?ref=thenexusofprivacy.net) (and Jay Graber's the earlier 2021 [Ecosystem Overview](https://gitlab.com/bluesky-community1/decentralized-ecosystem?ref=thenexusofprivacy.net)) sites AT and Bluesky in the context of other decentralized social networking technologies. - In [Decentralization or Noncentralization, Bluesky or the Fediverse?](https://fossacademic.tech/2024/04/30/DecentralizedNoncentralized.html?ref=thenexusofprivacy.net), Robert Gehl (author of the upcoming *Move Slowly and Build Bridges*, [a book about the fediverse](https://fossacademic.tech/2024/02/11/Move-Slowy-Preview.html?ref=thenexusofprivacy.net)) argues that "Bluesky has started out centralized and is slowly spinning out parts of itself from the center to the edges," so is decentralized in the sense of de-centering (as opposed to the ActivityPub Fediverse which is non-centralized) - Kye Fox' [Nobody cares about decentralization until they do](https://kyefox.com/nobody-cares-about-decentralization-until-they-do/?ref=thenexusofprivacy.net) makes the case that "most people don't care about decentralization *now*. **When** they do, more will be happy with the recovery paths available if they choose a platform on the AT protocol." - In [Decentralisation](https://fedi.exon.name/2024/12/01/decentralisation/?ref=thenexusofprivacy.net), Michael Exon suggests that "By delegating control over labellers to independent communities, BlueSky has taken the most important step towards decentralisation in a political sense." And in Hacker News, pxoe suggests [it's actually *Mastodon* that isn't decentralized](https://news.ycombinator.com/user?id=pxoe&ref=thenexusofprivacy.net), a position Chris Hornberger also took in [Mastodon isn’t ‘decentralized’ and won’t be the next big thing](https://medium.com/bricksnbrackets/mastodon-isnt-decentralized-and-won-t-be-the-next-big-thing-1139a03e1fe?ref=thenexusofprivacy.net) (2023) and I've heard similar points from more than one peer-to-peer network advocate in the past. Power in the ActivityPub Fediverse has historically been somewhat centralized as well; Mastodon gGmbH (which controls the code base adn the mobile apps as running mastodon.social, historically by far the largest instance in the Fediverse) and the W3C SWICG (which controls the spec) together had enough power that they brought innovation to a crawl from 2018-2022 are are still major barriers to progress. As Hrefna [points out](https://bsky.app/profile/hrefna.dev/post/3lds2inv6mo2r?ref=thenexusofprivacy.net), noting that users have very few remediations if the admin of mastodon.social goes to war with them, > "\[W\]hile in \_theory\_ ActivityPub is decentralized, in \_practice\_ the predominant system for this is \_not\_ decentralized as far as your median user is concerned." Using Lemmer-Webber's definition, it seems to me that they both have "particular power" at the center of the network that isn't diffused. So does that mean that the ActivityPub Fediverse isn't decentralized? I'd still say that it is, although not completely ... but your mileage may vary. So it's all messy and confusing. Welcome to the fediverses. But as interesting as all these articles are, what's even more interesting to me is that none of them talk about Blacksky. Funny how that works! ## Update log Ongoing: minor fixes (typos, wording changes) and additional links December 2: originally published December 15-16: updated to reflect Lemmer-Webber's [Re: Re: Bluesky and Decentralization](https://dustycloud.org/blog/re-re-bluesky-decentralization/?ref=thenexusofprivacy.net) March 3, 2025: add update from TechPolicy podcast July 8: add updates and links to Blacksky's Relay and AppView, and the Politics of Protocols draft. Also worth mentioning (although not yet sure where to put it): after a successful crowdfunding campaign, [Blacksky is beginning development on an app as well](https://bsky.app/profile/rudyfraser.com/post/3lrqemvortc2m?ref=thenexusofprivacy.net). August 28: start adding new epilogue-in-progress September 11: replace most of the epilogue-in-progress with a link to [This is what solidarity looks like](https://thenexusofprivacy.net/what-solidarity-looks-like/) ### Accessibility resources for Mastodon and compatible software (DRAFT) URL: https://thenexusofprivacy.net/mastodon-accessibility-resources/ Last updated: 2026-04-16T03:25:46.000Z > DRAFT! > Suggestions and feedback welcome > on i[nfosec.exchange](https://infosec.exchange/@thenexusofprivacy/113501852694416588?ref=thenexusofprivacy.net), [lemmy.blahaj.zone](https://lemmy.blahaj.zone/post/18695949?ref=thenexusofprivacy.net), or [discussions.thenexus.today](https://discussions.thenexus.today/post/65?ref=thenexusofprivacy.net) One of the fediverse's strengths is a culture of putting "alt text" on photos and other image for people using screenreaders and other assistive technology. As important as that is, that's only one aspect of accessibility. Alas, the official Mastodon web user interface and mobile apps aren't great from an accessibility perspective. Fortunately there are some better alternatives – and many of them also work with Mastodon-compatible software like Glitch, Hometown, GoToSocial, Akkoma, and Friendica. Here's a list that's a work in progress. If you've got other suggestions, please let me know! - [Pinafore](https://pinafore.social/?ref=thenexusofprivacy.net) was as far as I know the first fediverse user interface that prioritized accessibility, and even though it's no longer maintained many people still use it. [Semaphore](https://semaphore.social/?ref=thenexusofprivacy.net) and [Enafore](https://enafore.social/?ref=thenexusofprivacy.net) are forks (variants) of Pinafore that have somewhat-more-recent development, although I've seen reports that enafore doesn't do focus handling correctly. [elk.zone](https://elk.zone/?ref=thenexusofprivacy.net) is also popular. You can use all of these no matter what Mastodon instance your account is on, and they also (mostly) work with many other fediverse software platforms. - For iPhone and iPad, [Mona](https://apps.apple.com/us/app/mona-for-mastodon/id1659154653?ref=thenexusofprivacy.net) (a paid app) is generally regarded the most accessible client for Mastodon and compatible software. For free apps, also heard good things about IceCubes. FediText also focuses on accessibility, and currently has better support for GoToSocial than other options, but is still in beta testing so you need to [join Apple's TestFlight first](https://testflight.apple.com/join/3Ik3KBjj?ref=thenexusofprivacy.net). - For Android, [Pachli](https://pachli.app/?ref=thenexusofprivacy.net)'s latest release has several accessibility improvements (although it is not great if you're using a keyboard), and I've also heard people recommend [Tusky](https://tusky.app/?ref=thenexusofprivacy.net). - On Windows, [Tweesecake](https://tweesecake.app/?ref=thenexusofprivacy.net) and [TWBlue](https://twblue.mcvsoftware.com/?ref=thenexusofprivacy.net) both have good accessibility, and work with Friendica as well as Mastodon. Note that not all of these clients support all the functionality of Mastodon (or other platforms). Also, your mileage may vary; as well as recommendations, I've also heard of people running into problems with different options. Robert Kingett's [Mastodon for writers/readers](https://sightlessscribbles.com/posts/5619/?ref=thenexusofprivacy.net) and Sarah Higley's (somewhat older, so not necessarily up-to-date) [An oversimplified guide to setting up Mastodon](https://sarahmhigley.com/writing/mastodon/?ref=privacy.thenexus.today) are two good getting-started resources written with an accessibility focus. And Fedi.Tips' page on [How do I use Mastodon through a screen reader](https://fedi.tips/how-do-i-use-mastodon-through-a-screen-reader/?ref=thenexusofprivacy.net) has links to several other useful resources, including Mona tutorials and a Spanish-language guide to using NVDA with Mastodon. > Public service announcement: accessibility isn't just about the software. Most software these days has support for alt-text on images, but how many people actually use it? One of Mastodon's strengths is that many people do, which is great. Especially if you're a sighted person, please help by adding alt text to your images – and please make a point to only boost images which have alt text. > > If you don't have the spoons to add alt text to an image, or run into problems with the software, you can follow [@altbot@fuzzies.wtf](https://fuzzies.wtf/@altbot?ref=thenexusofprivacy.net) (which will suggest alt text) or use the #AltText4Me tag (to request help for others). ### Acknowledgments *Thanks to Georgiana Brummell, Robert Kingett, Callum Stoneman, @adrian@talpa.ie, jandi@mastodon.social, @stevo887@mastodon.social, and others who prefer to remain anonymous for all the very helpful information and feedback they generously shared with me as I worked on this post!* ### UPDATED: Rumors, conspiracy theories, and disinformation about "millions of missing votes" and voting machine fraud URL: https://thenexusofprivacy.net/disinfo-about-missing-votes/ Last updated: 2026-04-16T03:24:37.000Z *Last updated November 12.. See the* [*update log*](#update-log) *below for details.* > "Election fraud conspiracies from the left are spreading like wildfire right now on Threads. Hundreds of posts are flooding my feed, many with search hashtags above promoting more conspiracies." > > – Jason Velazquez, on mastodon.social, November 7 After seeing Jason's posts I went looking on Threads and my oh my, there sure is a lot of this going around. Meanwhile, back in reality, votes are still getting counted (when these rumors started ramping up, there were over ten million uncounted ballots in California alone) and turnout will probably wind up fairly close to the record levels of 2020\. And [Republicans are trying to use false claims of election fraud to overturn Ruben Gallego's victory in the Arizona Senate election](https://www.motherjones.com/politics/2024/11/elon-musk-election-integrity-community-arizona/?ref=thenexusofprivacy.net). Non-partisan election integrity experts are confident that even though there were (as always) some voting problems, there wasn't widespread fraud – and that there were safeguards in place to detect it if there were. As Cybersecurity and Infrastructure Security Agency (CISA) Director Jen Easterly [said](https://www.cisa.gov/news-events/news/statement-cisa-director-easterly-security-2024-elections?ref=thenexusofprivacy.net) on November 6, > "Importantly, we have no evidence of any malicious activity that had a material impact on the security or integrity of our election infrastructure." And Ishan Mehta of Common Cause – which had thousands of volunteers in all 50 states monitoring the election at polling sites and vote-counting centres, says “there is no evidence that any votes disappeared.” But, many people don't know that it always takes time to get the final vote totals. So with emotions running high in the aftermath of the election, disinformation purveyors are taking advantage of the opportunity to get well-intentioned people to help amplify conspiracy theories. University of Washington Center for the Informed Public's [Post Election Rumors](https://uwcip.substack.com/p/rapid-research-memo-november-8-post) noted that the rumors about election fraud in 2024 are coming from both sides of the political spectrum ... which makes sense to me: - Many Democrats are shocked and looking for ways to explain a disastrous result that they didn't expect - Republicans are taking advatantage of the opportunity to try to steal the Arizona Senate race, positioning this unfounded claiming as"evidence" of election fraud in 2020 Like most effective disinformation campaigns, there's a small kernel of truth here: there were (as always) some real examples of problems with voting machines and vote-by-mail ballots, as well as shenanigans including bomb threats to dozens of polling places. That's a problem, but all the reports so far say that the number of people who weren't able to vote as a result of this is relatively small – not that this is okay, but phrasing it in terms of "millions of missing votes" is a very misleading exaggeration. And there isn't any evidence at all of tampering with voter tabulation machines, as I've seen some people claiming. Don't get me wrong, multiple voter suppression techniques actually *were* used to keep people from voting – purging voters from rolls, felon disenfranchisement, 6-hour lines, texts with false information, voter intimidation, voter id laws, signature challenges, etc etc etc. But that's not what these conspiracy allegations are focusing on. At least so far, we're only seeing scattered examples of this on Bluesky and the Fediverse. That could change, though, so please *don't* help out the conspiracy theorists! ![5 Ways to Fight Disinformation. THINK before you engage or share. SHARE accurate information about the election REPORT disinformation when you see it EDUCATE yourself — and your friends and family GET INVOLVED – and get your friends and family involved](https://thenexusofprivacy.net/content/images/2024/11/5-ways-to-fight-disinfo---2022.png) From [5 ways to fight post-election disinformation on Bluesky and the Fediverse](https://about.iftas.org/2024/10/29/5-ways-to-fight-election-disinformation-on-bluesky-and-the-fediverse/?ref=thenexusofprivacy.net), on the IFTAS blog If you see allegations of "millions of missing votes" or voting machine fraud, please don't amplify them! Instead: - If it's somebody you know, send them a private message letting them know that they're unintentionally amplifying a false rumor. Feel free to include a link to this article, or to UWCIP's [Post Election Rumors](https://uwcip.substack.com/p/rapid-research-memo-november-8-post) writeup. If they're progressive or a Democrat, let them know that right-wingers are using this rumor to claim that Biden didn't win in 2020\. Then ask them to take the post down (or to unshare it if they've amplified somebody else). - If it's *not* somebody you know, and you're on the Fediverse or Bluesky, report it to the moderators as disinformation. If you're not sure how to report it, no worries: there are instructions (with screenshots!) on [how to report disinformation](https://about.iftas.org/2024/10/29/5-ways-to-fight-election-disinformation-on-bluesky-and-the-fediverse/?ref=thenexusofprivacy.net#appendix) at the end of [5 ways to fight post-election disinformation on Bluesky and the Fediverse](https://about.iftas.org/2024/10/29/5-ways-to-fight-election-disinformation-on-bluesky-and-the-fediverse/?ref=thenexusofprivacy.net) > "Rumoring is collective sensemaking ... And, for cases of harmful false rumors, rumor correction is not just about getting people the right facts. It also requires helping people access frames that will result in more accurate interpretations. > > Conspiracy theorizing is a patterned and constrained form of sensemaking where individuals and groups repeatedly anchor on a small number of “conspiracy” frames ... > > Disinformation is a manipulated form of sensemaking where motivated actors intentionally work to shape the outcomes of the sensemaking process to support their goals and objectives" > > – [Facts, frames, and (mis)interpretations: Understanding rumors as collective sensemaking](https://www.cip.uw.edu/2023/12/06/rumors-collective-sensemaking-kate-starbird/?ref=thenexusofprivacy.net), Kate Starbird, UWICP Democrats attempting to make sense of an election loss that surprised so many people is a great example of the kind of collective sensemaking Starbird and the UWICP discuss, and its not surprising that there are rumors. Clearly though there's also some disinformation involved here. What are the goals and objectives of the people behind it? There's no way to know for sure but three obvious possibilities include: - Republicans are trying to use false claims of "election fraud" in the Arizona as the Arizona Senate election, so claims of election fraud elsewhere work to their advantage - Republicans are also still trying to bolstering false claims of 2020 election fraud (discussed in [Post Election Rumors](https://uwcip.substack.com/p/rapid-research-memo-november-8-post)). - this false narrative fits right in with the multi-year campaign by Russia and fascists in the US have to destroy public trust in the election process here - focusing attention on an alleged fraud that *didn't* occur is a good way to divert attention from all voter suppression that really *has* occurred and has been steadily ramping up ever since Republicans on the Supreme Court gutted the Voing Rights Act – and got even worse this year after Republicans blocked legislation that could have provided voters and election officials with more protection. At any rate, whether or not people sharing this are *intentionally* trying to promote conspiracy theories, that's the effect. So please don't do that! ![Don’t amplify disinfo! THINK before you engage or share AVOID sharing headlines that include the disinfo BE CAREFUL! Reshares and comments actually amplify disinfo, even if you’re trying to debunk it](https://thenexusofprivacy.net/content/images/2024/11/dont-amplify-disinfo-2.png) ## Update log November 10: originally published November 12: updated with more of a focus on false claims about Arizona election fraud and quote from Jen Easterly of CISA Ongoing: minor cleanups including typos, rewording, etc. ### Post-election disinfo: weaponized unreliable exit polls targeting marginalized communities URL: https://thenexusofprivacy.net/disinfo-weaponized-exit-polls/ Last updated: 2026-04-16T03:24:15.000Z > "People are lashing out in all directions, solidifying rifts with people they will ultimately need, if they plan to participate in the work of collective survival." > > – Kelly Hayes, [Beyond the Blame: Fighting for Each Other in the Face of Fascism](https://organizingmythoughts.org/beyond-the-blame-fighting-for-each-other-in-the-face-of-fascism/?ref=thenexusofprivacy.net), on *Organizing my thoughts* Emotions are high in the aftermath of the US Presidential election, and disinformation continues to flow. Many of us are angry, scared, and shocked. Others are trying to take advantage of the situation to incite hate and violence, weaken the resistance to fascism, and avoid accountability. > "Think before you engage or share." > > – Shireen Mitchell, [*All of us have been targeted by disinformation*](https://vimeo.com/471961897?ref=privacy.thenexus.today) (2020) Well-crafted disinfo takes advantage of our emotions by getting us to amplify false and misleading messages. And as always there's a lot of [racialized disinformation](https://mediamanipulation.org/definitions/racialized-disinformation?ref=thenexusofprivacy.net), reinforcing white supremacy by spreading false or misleading information about communities of color. A specific example of post-election racialized disinfo that I'm seeing a lot of is weaponizing exit poll data to target Latinos, Black men, trans people, and other marginalized demographics. Like a lot of disinfo, this combines a kernel of truth with misleading omissions, exaggeration, misleading framing, and decontextualization ... it *seems* plausible, so even people who aren't intentionally trying to spread disinfo will amplify it. > Please don't do that! [5 ways to fight post-election disinformation on Bluesky and the Fediverse](https://about.iftas.org/2024/10/29/5-ways-to-fight-election-disinformation-on-bluesky-and-the-fediverse/?ref=thenexusofprivacy.net), on the IFTAS blog, has a deep dive into useful tactic ... but really the basics come down to these key points. ![Don’t amplify disinfo! THINK before you engage or share AVOID sharing headlines that include the disinfo BE CAREFUL! Reshares and comments actually amplify disinfo, even if you’re trying to debunk it](https://thenexusofprivacy.net/content/images/2024/11/dont-amplify-disinfo-2.png) The kernel of truth with weaponized exit poll result is that people are generally quoting exit polls accurately. But now lets look at the misleading omissions ... - The framing of pointing to voting patterns of a specific minority group as responsible for the results is misleading, because it omits the crucial fact that the **overwhelming majority of people who voted for white supremacy are white**. - **The exit poll data itself is notoriuously**. In 2016 and 2020, there were major flaws in the data – and these problems are especially acute when it comes to race and ethnicity. > "The exit poll reports of Latino vote are profoundly and demonstrably incorrect." > > – Latino Decisions wrote in [Lies, Damn Lies, and Exit Polls](https://latinodecisions.com/blog/lies-damn-lies-and-exit-polls/?ref=thenexusofprivacy.net) (2016) > "Specifically, the NEP’s estimates of who voted — what percentage of voters fall into any given demographic group — appear to be wrong. This kind of problem has [plagued the NEP in the past](https://www.nytimes.com/2016/06/10/upshot/there-are-more-white-voters-than-people-think-thats-good-news-for-trump.html?ref=thenexusofprivacy.net) and, apparently, it is an issue again this year." > > – Robert Griffin, [Don’t trust the exit polls](https://www.washingtonpost.com/politics/2020/11/10/dont-trust-exit-polls-this-explains-why/?ref=thenexusofprivacy.net) (2020) Methodologies haven't changed since then, so we're likely to see similar problems this year. But it takes months to do the detailed analysis, and right now the unreliable exit polls are all we have. So, at best, these "analyses" are using data that is almost certain to be inaccurate and racially baised to obscure that it was primarily white people who voted for white supremacy – and instead scapegoat other groups. And with Latino voters, there's another set of critically important misleading omissions. > "you can make it all up in more ways than one. who are those latinos? they wont break them down by country and race and that's by design." > > – liza sabater, the og blogdiva & resident afroboricua **The way the exit poll results are presented misleadingly gives the impression that communities are monolithic**. In reality, "Latino voters" includes Black, Indigenous, white, and multi-racial people from many different countries living in many different places. White Cubans in Miami are very different from Afro-Latino Haitians in Springfield Ohio. By lumping them together in a single category, the exit polls obscure these critical distinctions. > "now they’ll go after us Black and brown ones while los blanquitos stand by, complicit. " > > – liza sabater, the og blogdiva & resident afroboricua Weaponizing exit polls to target Latinos – or Black men, or any other marginalized group – is classic example of a racialized disinformation campaign. One of the goals of a campaign like this is to drive wedges between communities – for example, by getting white Democrats to scapegoat Black and Latino people, or to highlight their racism by implying that this must show that Latinos are too stupid or uninformed to realize that the new administration is boasting loudly about its plans for mass deportation. Another goal of this kind of campaign is to falsely exaggerate support from marginalized communities for policies that hurt the community. When the new administration follow through on its plans for mass deportation, you just know we're going to see all kinds of press misleadingly claiming that most Latinos voted for this. Of course, no community is monolithic; many Latinos whose families have been in the US for generations and live in counties in South Texas whose local economies rely on ICE and ICE contractors may well support mass deportation! But no matter what the misleading exit polls say, that doesn't mean that most Latinios in the US – or even most Latino voters – support this heinous anti-immigrant policy. At any rate, the people who designed this campaign did a good job. It seems plausible, so it's easy to amplify it without thinking. As always, the #1 tactic for fighting disinformation is to *think before you engage or share.* [5 ways to fight post-election disinformation on Bluesky and the Fediverse](https://about.iftas.org/2024/10/29/5-ways-to-fight-election-disinformation-on-bluesky-and-the-fediverse/?ref=thenexusofprivacy.net), on the IFTAS blog, has a deep dive into useful tactics ... and here's an excellent short video from Shireen Mitchell of Stop Online Violence Against Women. Shireen Mitchell [**All of us have been targeted by disinformation*](https://vimeo.com/471961897?ref=privacy.thenexus.today) ### A faux "Eternal September" turns into flatness URL: https://thenexusofprivacy.net/flatness/ Last updated: 2026-04-16T03:23:55.000Z *Previous posts in the series:* [*Mastodon, two years later*](https://thenexusofprivacy.net/mastodon-two-years-later/) *and* [*A tale of two prototypes*](https://thenexusofprivacy.net/mastodon-two-years-later/https://privacy.thenexus.today/a-tale-of-two-prototypes-2/)*.* **Contents** - Intro - [It's not "just like email"](#not-just-like-email) - [Usability and gatekeeping weren't the only challenges newcomers faced](#not-the-only-challenges) - [The first complicated high-stakes decision is even before you sign up](#even-before-joining) - [Why not help people choose an instance that's a good fit?](#why-not) - [But no](#but-no) ....... > "I’m focusing today’s issue on one of the most common refrains about the elephant site: that it’s in the midst of an Eternal September." > > – Ernie Smith, [Mastodon Isn’t Facing an Eternal September. Here’s Why](https://midrange.tedium.co/issues/mastodon-eternal-september-discussion/?ref=thenexusofprivacy.net) *Tedium*, November 2022 [](https://midrange.tedium.co/issues/mastodon-eternal-september-discussion/?ref=thenexusofprivacy.net) The millions of new users flocking to Mastodon in late 2022 reminded many people of [Usenet's (misremembered) "Eternal September"](https://www.flowjournal.org/2023/04/eternal-september/?ref=thenexusofprivacy.net) back in 1993-4 – although as Smith describes, there were some significant differences. Of course, just like the old influx to Usenet as new college students discovered it every September, the initial late-2022 wave ebbed quickly. Mastodon Benevolent Dictator for Life (BDFL) Eugen Rochko's March 2023 [claim](https://www.theverge.com/23658648/mastodon-ceo-twitter-interview-elon-musk-twitter?ref=thenexusofprivacy.net) that "in fact it’s growing faster now than it was" was, um, in retrospect overoptimistic. By late 2023, growth had turned to flatness. Still, once numbers stabilized, Mastodon had over 1.2 million active users – double the pre-acquisition numbers. As Cory Doctorow noted in [Of Course Mastodon Lost Users](https://doctorow.medium.com/of-course-mastodon-lost-users-c48ef8102891?ref=thenexusofprivacy.net) (February 2023), > "This is perfectly normal: new services always experience “scalloped” growth[15](#notes).... Make no mistake, there will be future Fediverse surges." And sure enough, Mastodon experienced another (smaller) surge in June/July 2023, when Xitter briefly turned on rate limits and Reddit declared war on its volunteer moderators and third-party developers. But the landscape was changing: Bluesky started limited testing in March 2023; by later that year it was easy to get an invitation code, and in February 2024 they opened for a public beta – no invitation required. As I said in [A tale of two prototypes](https://thenexusofprivacy.net/a-tale-of-two-prototypes-2/) (October 2024) > "Bluesky's a better decentralized Twitter alternative than Mastodon; Threads is much easier for people who already have Instagram accounts to try out. Both have much bigger budgets than Mastodon, so it'll be a challenge to catch up." So even though Apartheid Clyde has continued doing things that drive people away ([BTS ARMY](https://forbetter.ghost.io/purplesky-army-on-bluesky-the-social-web?ref=thenexusofprivacy.net) in July 2024, [Brazil ](https://techcrunch.com/2024/08/31/bluesky-tops-app-charts-and-sees-all-time-highs-after-brazil-bans-x/?ref=thenexusofprivacy.net)in August 2024, October 2024's announcement of a change to the block functionality to [make it easier for stalkers, harassers, and bots to target people](https://mashable.com/article/bluesky-half-a-million-new-users-after-x-twitter-block-change?ref=thenexusofprivacy.net)) ... the surges are going to Bluesky instead. Of course, [**there's a lot more to social networking than Twitter alternatives**](https://thenexusofprivacy.net/mastodon-two-years-later/#more-than-twitter-alternatives). But Rochko's vision for Mastodon is a Twitter alternative, and that's how it's usually decribed in the press. Mastodon relied on surges from Twitter for its growth. Without any surges, Mastodon's flatness has continued throughout the first ten months of 2024. ## It's not "just like email" ![Everny Mastodon explanation is like "it's very simple, your account is part of a kerflunk, and each kerflunk can talk to each other as a part of a blumburt ..."](https://thenexusofprivacy.net/content/images/2023/06/kinda-like-email.png) Accuracy aside, the analogy to Eternal September highlights the gatekeeping[16](#eternal-september-gatekeeping) and disdainful attitude many (although certainly not all) long-time Mastodonians had for newcomers. In [The Year September Never Ended](https://web.archive.org/web/20060626080344/http://www.nyupress.org/netwars/pages/chapter01/ch01%5F.html) in *net.wars* (1997)*,* Wendy Grossman had noted that “AOLers weren’t (necessarily) stupid; they were software-disadvantaged." The same is true for newcomers to Mastodon. Mastodon's official mobile apps are medicore, and Mastodon's web UI has some very rough edges and counter-intuitive functionality – even for somebody like me who's been using it for years. A personal example: in November 2022 I was trying to get the word out about an activism campaign and several people including the executive director of a well-known non-profit said they'd help. So, I DM'ed him and several others a link of a post I hoped they'd boost. Nobody boosted it! WTF!!!! Eventually one of the people involved sheepishly told me that they couldn't figure out how to boost it. I had forgotten that when they clicked on the link it brought them not-logged-in tab, so there was no way to interact with it. Long-timers knew what to do in that situation: cut-and-paste it into the "explore" box in the tab where they already *were* logged in, and then you get a version you can boost.[17](#not-logged-in) But for some reason it's not so intuitive to new years. Who could have predicted? It's very simple really ... kinda like email! Doctorow characterized the belief that the Fediverse could never catch on because it's hard and Twitter is easy as a "fairy tale" ... but Erin Kissane's [Mastodon is easy and fun except when it isn't](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=thenexusofprivacy.net) (July 2023), which summarized experiences from Bluesky users who had tried Mastodon, has a lot of quotes from people who found Mastodon too confusing or too much work. As I said in [Don’t tell people “it’s easy”, and seven more things Kbin, Lemmy, and the fediverse can learn from Mastodon](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/) (June 2023) > "Hopefully it will get easier over time but that hasn't happened yet with Mastodon. And yet, you constantly hear people talking about how easy it is – which implies that anybody who doesn't think it's easy must be stupid, incompetent, or doing something wrong. > > *This is not helpful*. It's annoying and drives people away. > > So don't say it." But people, especially techie guys, kept saying it. Sigh. ## Usability and gatekeeping weren't the only challenges newcomers faced ![A tweet from Chanda Prescod-Weinstein (@IBJIYONGI): "white people explaining to people of color that they are facing racism on mastodon because they are using mastodon wrong" is a gendre that needs to die in a fucking fire. It's such a disrespectful failure to imagine POC competence and white supremacy's pervasiveness](https://thenexusofprivacy.net/content/images/2024/08/it-needs-to-die-in-afire.png) > "It took me eight hours to get a pile of racist vitriol in response to some critiques of Mastodon." > > – Dr. Johnathan Flowers, [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) It wasn't just the blatant racism that was a problem. As Erin Kissane notes in [Mastodon is easy and fun except when it isn't](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=thenexusofprivacy.net), newcomers also encountered "unreasonable—or in several cases anti-trans or racist—expectations for content warnings."[18](#weaponized-content-warnings) Also, reply guys. I'll talk about all of that in more detail in an upcoming post, but it's worth highlighting here as well. And a lot of language about "Twitter refugees" echoed racist and anti-immigrant tropes .. all those loud, boisterous newcomers who don't know how to behave and don't understand our own much more civilized norms![18.1](#norms-worth-keeping) Take Hugh Rundle's [Home invasion - Mastodon’s Eternal September begins](https://www.hughrundle.net/home-invasion/?ref=thenexusofprivacy.net) (November 2022), for example: > "It's not *entirely* the Twitter people's fault. They've been taught to behave in certain ways. To chase likes and retweets/boosts. To promote themselves. To perform.... People are pouring in to the quiet houseparty around the corner, cocktails still in hand, demanding that the music be turned up, walking mud into the carpet, and yelling over the top of the quiet conversation." Of course, usabilty and (sometimes-racist) gatekeeping weren't the only reasons that people checking out Mastodon didn't stay. Kissane's work (also including [Blue skies over Mastodon](https://erinkissane.com/blue-skies-over-mastodon?ref=thenexusofprivacy.net) (April 2023), [Notes From a Mastodon Migration](https://erinkissane.com/notes-from-a-mastodon-migration?ref=thenexusofprivacy.net) and [The affordance loop](https://erinkissane.com/the-affordance-loop?ref=thenexusofprivacy.net) (both July 2023)) is a great window into the challenges newcomers face. As Kissane [highlights](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=thenexusofprivacy.net) > "*None of this is lab-conditions research*—sorry, I meant **NONE OF THIS IS LAB-CONDITIONS RESEARCH**—and I hope it’s obvious that there are shaping factors at every step." Still, they're all worth reading, and the top themes Kissane lists in [Mastodon is easy and fun except when it isn't](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=thenexusofprivacy.net) were all things I heard a lot as well. - got yelled at, felt bad - couldn’t find people or interests, people didn’t stay - too confusing, too much work, too intimidating - too serious, too boring, anti-fun - complicated high-stakes decisions ## The first complicated high-stakes decision is even before you sign up > "Signing up means picking an instance, and *the instance you’re on will, through its moderation actions and policies and its federation and defederation choices, define much of your experience on the fediverse*, but instances currently distinguish themselves primarily by location, size, or nominal shared interests, rather than by a detailed and transparent discussion of those actual major experience differentiators. > > – Erin Kissane, [The affordance loop](https://erinkissane.com/the-affordance-loop?ref=thenexusofprivacy.net) (July 2023) The first complicated high-stakes decision people make when they join Mastodon (or more generally, the Fediverse) is what instance to choose. If you're on a good small-to-medium size instance Mastodon, Glitch, or Hometown instance with good moderation and people who share your interests and/or your idea of fun and can help you find apps and hashtags you might like (and deal with the confusing stuff), it can be a great experience. Mastodon can still be a good experiences on other instances ... but statistically it's a lot less likely to be great – especially if you are a person of color. In fact, it can be pretty horrible. As Kissane says in [The affordance loop](https://erinkissane.com/the-affordance-loop?ref=thenexusofprivacy.net) > "If you’re a Black gay dude, say, and you stumble into choosing an instance that federates with known trollfarms and harassment hubs, and you make a post that reveals anything about your identity, you’re very likely to get flooded with some of the worst abuse anyone ever gets on the internet." Similarly, for blind and low-vision people, Mastodon's much more likely to be a great experience on an instance where most images have alt-text (so are accessible to people using screenreaders). And much of Mastodon is really good about this! [![](https://thenexusofprivacy.net/content/images/2024/11/alt-text-leaderboard.png)](https://mastodon.social/@AltTextHealthCheck/113410238358981484?ref=thenexusofprivacy.net) [Alt Text Health Check, November 1 2024](https://mastodon.social/@AltTextHealthCheck/113410238358981484?ref=thenexusofprivacy.net) Alas not all Mastodon instances have the same alt-text friendly culture. On the "flagship" instance mastodon.social, for example, 25% or fewer of the images have alt-text. Of course, even if you're on an instance like that which is relatively hostile to disabled people, you can overcome once you've done enough work to find the right people to follow. Still, first impressions matter a lot ... Unfortunately, Mastodon doesn't give newcomers any help picking an instance. - joinmastodon.org, the official landing page, lists a few hundred instances, and lets you search by region or topic, but only has a single sentence description for each. - joinmastodon *doesn't* provide any information about how well-moderated an instance is (which makes a huge difference, especially for marginalized people) or what percentage of images on the instance have alt-text. - There are some helpful directories and tools; [fedi.garden](https://fedi.garden/?ref=privacy.thenexus.today), for example, is a small human-curated list of "nice, well run servers on Mastodon". But they're not easy for newcomers to find, and even if they do how does anybody who's not already experienced on the fediverse know whether to trust them or how to evaluate their recommendations?[19](#feditips) ## Why not help people choose an instance that's a good fit? > "It's hard to get settled into the fediverse for a set of distinct but interlocking reasons, starting with "How do I pick a server?" > > – Erin Kissane, [how to buy shoes in the fediverse](https://www.wrecka.ge/fediverse-shoes/?ref=thenexusofprivacy.net), October 2024 As I said In [When Moving to Mastodon, How Do You Pick The Right Instance?](https://thenexusofprivacy.net/choosing-a-mastodon-instance/)[20](#how-to-choose) on *WeDistribute,* after a discussion of a half-dozen factors picking an instance, and links to ten different not-so-easy-to-find websites with useful resources, > "Yeah, it’d be a lot easier if a single site provided all of that functionality. Welcome to the Fediverse.... > > Newcomers are often told that it doesn’t matter what instance you’re on, or to just sign up for mastodon.social (the “flagship” instance, which is the default for mobile apps and spreadmastodon.com) and worry about it later. This is really horrible advice, because what instance you’re on has a **big** effect on your experience – and for most people, mastodon.social is *not* a good place to start." Kissane's recent [how to buy shoes in the fediverse](https://www.wrecka.ge/fediverse-shoes/?ref=thenexusofprivacy.net) and [revealing the fediverse’s gifts](https://www.wrecka.ge/revealing-the-gifts/?ref=thenexusofprivacy.net) have some great perspectives on this challenge. It's a hard problem in general ... still, there are some straightforward ways Mastodon could to make at least some progress: - provide more information about and expand the different instances on the curated lists joinmastodon.org site - link to a range of other curated lists - provide links to instance catalogs like The Bad Space and Fediseer so people can find out something about the instances - encourage people to look around at different instances - make it easier for people to move between instances if their first choice doesn't work out For that matter, Dr. Malka Older – whose *Infomocracy* trilogy is set in a future where immigrants are valued – is on Mastodon, and she might well have had some good suggestions. The biggest strength of Mastodon (and the Fediverse) is that people with niche interests and from marginalized identities, cultures, and communities can find (or work with others to create) an instance that match their priorities and preferred norms. Why not lean into that? ## But no Instead, in spring 2023, Rochko changed the software so that people would by default sign up on mastodon.social, the "flagship" run by his company Mastodon gGmbH. On the one hand, this at least keeps people from landing on instances with no active moderators or no defederation policies.[21](#alternatives) But while social is far from the worst instance out there, but it's also not the best choice for most people.[22](#not-the-best-choice) So (unsurprisingly) the change didn't lead to more people staying on Mastodon. Instead, mastodon.social grew at the expense of the broader ecosystem. In a three-month period starting in late May 2023 (and so overlapping the June/July surge) - mastodon.social attracted 402,000 new users, and it's number of active users increased by 92,000 - mstdn.social, mastodon.world, and mas.to combinedonly attracted 31,000 new users, and their number of active users *decreased* by 10,000 Oh well. [A BDFL gets to do what he wants.](https://thenexusofprivacy.net/a-tale-of-two-prototypes-2/#bdfl) ## To be continued! I'm serializing [*Mastodon, two years later*](https://thenexusofprivacy.net/mastodon-two-years-later/) and then will pull it together as as single post. To see new installments as they're published, [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/swf-questions/#/portal/signup), follow [@nexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=privacy.thenexus.today) (or [on Bluesky, via Bridgy Fed](https://bsky.app/profile/thenexusofprivacy.infosec.exchange.ap.brid.gy?ref=privacy.thenexus.today)), and/or join the [Nexus of Privacy community on lemmy.blahaj.zone](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=privacy.thenexus.today). ### Sneak previews of upcoming installments *As always, these are from draft versions of upcoming posts, and the final versions may be different.* .... Of course it's over-simplifying to look at the history in terms of just two prototypes. Mastodon and its forks have also prototyped - A trans-led fork with a trans, queer, and non-binary-centric community - A [consent-based culture](https://thenexusofprivacy.net/free-fediverses-and-consent/) that (while imperfect and intermittent) points to a very different path than surveillance capitalism - A real-life testbed for all the complexities of decentralized moderation and federated diplomacy - A protocol-based platform for (somewhat) interoperaable social media operations .... I talked a lot about Mastodon's long-standing problems with race in [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history), and things haven't improved since then – [5 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) has plenty of newer examples and links. And as Dr. Johnathan Flowers points out in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), Mastodon is a metonym for the whiteness of the broader Fediverse.... And while the original partial history talked a lot about anti-Blackness and the complicated interactions between Mastodon and LGBTQIA2S+ people, I didn't really delve into sexism and misogyny – which are also big issues. And here too, Mastodon is a metonym for the broader Fediverse. .... One or more hard forks still seems like the mostly likely outcome to me, perhaps combining a focus on networked communities (and a less friendly attitude towards Meta) with some of the ideas in [Fork it! It’s time for a Mastodon hard fork](https://thenexusofprivacy.net/mastodon-hard-fork/) and/or Ro's [A Case for Community](https://h-i.works/2024/04/a-case-for-community.html?ref=privacy.thenexus.today) (both April 2024). Hard forks that start with Glitch or Hometown as a base would have significant advantages over Mastodon if it can get support from hosting companies, and if it also improves allow-list federation and adds support for [federations of instances](https://thenexusofprivacy.net/the-free-fediverses-should-support-concentric-federations-of-instances/) it could be a good fit for [The Website League](https://websiteleague.org/?ref=thenexusofprivacy.net) and other emerging projects. Then again, there's been discussion of Mastodon hard forks for years, and [it's not as easy as it sounds](https://thenexusofprivacy.net/mastodon-hard-fork/#not-so-easy), so maybe it won't happen. Whether or not there's a hard fork, the same opportunities are there for the official Mastodon project if its direction and leadership structure evolves. The official project has some big advantages – including funding – so let's hope that happens. And it's not an either-or situation; forks don't have to be hostile, and there are lots of potential synergies if they can work together effectively (as well as challenges). ## Notes 15 Although of course at this point, Mastodon wasn't all that new – in fact it was 6 1/2 years old, and this was far from the first surge. In fact, back in 2018's [Who commands the internet?](https://unherd.com/2018/10/who-is-in-charge-of-the-internet/?ref=privacy.thenexus.today), Rochko had talked about the same pattern: > "We see a spike, then it falls down as users go back to the commercial platforms. But it never falls back as far." 16 As Smith said in [Why the Eternal September Mindset Needs to End](https://tedium.co/2020/10/13/eternal-september-modern-impact/?ref=thenexusofprivacy.net): > "But I do think that the spirit that led to the Eternal September becoming a landmark in the first place is still very much there. It has simply taken new forms. > > There’s a modern term for what this is called, in fact: Gatekeeping. The idea that, because of your identity or lack of experience, you shouldn’t have access to an online community. > > Now, to be clear, there are lots of kinds of gatekeeping in terms of the internet—for example, the technical barriers created by large companies to shape the broader network—whether internet service providers like Comcast or Verizon, or major tech firms like Google or Facebook. Those figures deservedly need their callouts. > > But in this case, I’d like to focus on a particular cultural kind of gatekeeping, the kind that leaves people out for reasons of elitism, fear, or simple “othering.”" 17 [Mastodon 4.2](https://blog.joinmastodon.org/2023/09/mastodon-4.2/?ref=thenexusofprivacy.net), released in September 2023, improved the experience for not-logged-in users ... so this specific problem may well be less of an issue today But by September 2023 none of the people I had asked for help in November 2022 were still active on Mastodon. 18 The is the same issue of weaponized content warnings targeting people of color that Margaret Kibi described in [Fringe Mastodev: The Beginnings](https://www.u2764.com/NFIC/2018-09-09/fringe-beginnings/?ref=privacy.thenexus.today) (2018), now also targeting trans people. In [On Content Warnings](https://shelraphen.com/on-content-warnings/?ref=thenexusofprivacy.net) (October 2024), Shel Raphen comments that "the consensus among Mastodon early adopters was that we had messed up. Our original CW design was backwards." However, since Rochko had driven away most of the queer community members who had driven the original CW implementation, Mastodon's CW implementation has barely changes since 2017\. So it's not surprising the same problems keep occurring. 18.1 Don't get me wrong, there are some long-standing Mastodon norms that are very much worth preserving, like providing alt-text on images. And since there's nothing in the onboarding process that tells people about this, and it's very different from Twitter, this is something that newcomers often don't know. So one or two people politely telling a newcomer about this norm, with a link to information about how to include alt-text, is useful. But that's not usually how things played out. Also, the alt-text process can be very challenging for disabled people; I saw at least two situations where sighted people were giving blind people a hard time about not including alt-text. 19 In [How to choose the right Mastodon instance?](https://thenexusofprivacy.net/choosing-a-mastodon-instance/) I mentioned that fedi.garden is "run by the same person who runs the invaluable [fedi.tips](https://fedi.tips/?ref=privacy.thenexus.today)" ... if you've been on the fediverse for a while you're probably nodding your head, and saying to yourself "oh yeah fedi.tips is a great resource" but newcomers don't know any of that. 20 Originally published as [How to choose the right Mastodon instance?](https://thenexusofprivacy.net/choosing-a-mastodon-instance/) December 2022 here on the The Nexus of Privacy, updated version also [posted on We Distribute in July 2023](https://thenexusofprivacy.net/choosing-a-mastodon-instance/) 21 Although, there were other ways Mastodon could have made progress on the goal of at least keeping people from landing on instances with no active moderators or no defederation policies. For example, they could make it clear that the Mastodon Server Covenant (which requires active moderation against white supremacy and transphobia) requires blocking known nazi and terf instances, and required some instances meet some criteria to be listed on joinmastodon.org. They could also have helped new and existing instances meet the bar by making it easy admins to install a initial blocklist, a feature now (finally) being planned for the upcoming release 4.4\. 22 Some of few reasons mastodon.social isn't the best choice of instance for most newcomers: - .social is too diffuse to make it easy for people to find others who share their interests or live in the same area. - unlike smaller instances, the volume of posts on .social means that the "local" and "federated" feeds aren't particularly useful (as opposed to smaller instances, especially if they're focused on a shared interest) - Users on .social put alt-text on a much lower percentage of images than the average instance, so it's nowhere near as good for people using screenreaders - Ppeople who are potential targets of hate speech and harassment often don't have great experiences on .social - .social runs "nightly" builds, the latest version of the software, so changes a lot more frequently than other instances. While this is very useful from a testing perspective, it's not great for newcomers or anybody who doesn't like constant change in their software ... and occasionally means that people on .social have to deal with bugs that people on other instances don't. ## ### A tale of two prototypes URL: https://thenexusofprivacy.net/a-tale-of-two-prototypes-2/ Last updated: 2026-04-16T03:23:09.000Z > Join the discussion on [infosec.exchange,](https://infosec.exchange/@thenexusofprivacy/113383358987865179?ref=thenexusofprivacy.net) [lemmy.blahaj.zone](https://lemmy.blahaj.zone/post/17971658?ref=thenexusofprivacy.net), and [Bluesky](https://bsky.app/profile/thenexusofprivacy.net/post/3l7keo7lvwb2z?ref=thenexusofprivacy.net)[!](https://bsky.app/profile/thenexusofprivacy.net?ref=thenexusofprivacy.net) [*Mastodon, two years later*](https://thenexusofprivacy.net/mastodon-two-years-later/) *discusses two ways of looking at Mastodon and its forks like Glitch and Hometown: a Twitter alternative, or a platform for networked communities. It's a long enough post that I decided to serialize it, and this installment continues that discussion.* **Contents** - Intro - [Mastodon 2017 and Glitch 2017](#2017) - [A BDFL gets to do what he wants](#bdfl) - [Flash forward seven years ... ](#flash-forward) - [Seven years later, is Mastodon significantly closer to being a good Twitter alternative?](#is-it-closer) > "Fringe development is my term for the development work (research; design; coding) taking place on forks and individual instances of Mastodon, without the intention of sending that work upstream, and *without* mainstream acknowledgment or recognition. Increasingly, as Mastodon as a project grows, I believe that it is this development work that happens on the fringes that will shape the future of the software." > > – Margeret Kibi, [Fringe Mastodev: The Beginnings](https://www.u2764.com/NFIC/2018-09-09/fringe-beginnings/?ref=thenexusofprivacy.net), 2018 It's not surprising that most people think of "Mastodon" as the official Mastodon project run by Mastodon founder and Benevolent Dictator for Life (BDFL) Eugen Rochko (aka Gargron), CEO of Mastodon gGmbH. Rochko gets almost all of the attention in the tech press, has more followers than any other techie on Mastodon, and is often portrayed as "[the man who built Mastodon](https://www.wired.com/story/the-man-behind-mastodon-eugen-rochko-built-it-for-this-moment/?ref=thenexusofprivacy.net)." But the reality's a lot more complex. Even though Rochko has done more work on Mastodon than anybody else over the years, most of the key innovations came from others. [Rochko frequently hasn't recognized or acknowledged others for their contributions](https://thenexusofprivacy.net/mastodon-a-partial-history/#credit), and sometimes has treated them [quite shabbily](https://thenexusofprivacy.net/mastodon-a-partial-history/#the-battle-of-the-welcome-modal). And many of the Fediverse's communities are on instances running Mastodon forks (variants) like Glitch and Hometown, which include some key fringe development contributions that Rochko has blocked from the official Mastodon code. Further complicating the narrative, most of fringe development work has been done by trans, queer, and non-binary people, whose vision for the software prioritizes community and safety – especially for marginalized people.[6](#big-fedi) By contrast, Rochko's vision of Mastodon is more as a Twitter alternative, and he has a track record of *not* prioritizing community and safety – especially for marginalized people.[7](#not-prioritizing-safety) Of course, a Twitter alternative *could* also prioritize community and safety, especially for marginalized people; Rudy Fraser's three-part series [Blacksky: Expressing the Black Everyday in a New Digital Space](https://blog.rudyfraser.com/blacksky-part-one?ref=privacy.thenexus.today) has some great perspectives on this. But that's not Rochko's vision. ## Mastodon 2017 and Glitch 2017 From that perspective, it's interesting look back at Mastodon 2017 and Glitch 2017 as prototypes of two different visions. - as a prototype of a platform to support [networked communities,](https://destructured.net/groundedness-networked-communityhttps://privacy.thenexus.today/the-free-fediverses-should-emphasize-networked-communities/?ref=thenexusofprivacy.net) Glitch 2017 was a huge success. Local-only posts and other Glitch 2017 functionality have been adopted widely by other forks – and other Fediverse software. Some of Glitch instances that started back in the day are still around and doing well; many instances since then have also used (and improved) Glitch and related forks. Mastodon 2017 was less of a success, because it was missing some key features from Glitch, but it certainly wasn't a failure: some of the Mastodon instances that started back in the day are also still around and doing well. - as a prototype of a Twitter alternative, Mastodon 2017 and Glitch 2017 were inconclusive. They had made a huge amount of progress in its first year, and even though (like most prototypes) they clearly wasn't ready for broad use yet, a lot of people already found them useful. On the other hand, Mastodon didn't have a plan to address other major challenges like usability and onboarding that had limited previous attempts at decentralized Twitter alternatives such as StatusNet and Gnu Social. Not only that, the [Dogpiling, weaponized content warning discourse, and fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) had driven away most Black users – and a Twitter-wannabe without Black Twitter isn't really a Twitter alternative. Based on these initial results, Mastodon could have changed course and focused on networked communities ... but that wasn't Rochko's vision. And there were reasons for optimism that Mastodon could become a good Twitter alternative. [Community innovation was in high gear](https://thenexusofprivacy.net/mastodon-a-partial-history/#rapid-queer-led-community-innovation). Mastodon was certainly more usable than previous decentralized Twitter alternatives, and the [welcome modal](https://thenexusofprivacy.net/mastodon-a-partial-history/#the-battle-of-the-welcome-modal) was a big step forward on onboarding ... perhaps that progress would continue.[8](#welcome-modal) So it's not surprising that Mastodon continued to focus on trying to become a Twitter alternative.[9](#not-surprising) Of course, Mastodon could have expanded its scope to also be a platform for networked communities, while still keeping its focus on being a Twitter alternative. It would have been easy enough for Mastodon to integrate the already-written code for local-only posts (just as Mastodon integrated some of Glitch's other improvements). Oh well. ## A BDFL gets to do what he wants > "Eugen Rochko is the CEO of Mastodon — the open-source decentralized competitor to Twitter. Now, if you are like me, you hear the words “open source” and “decentralized” and then the word “CEO” and think, wait, why does the decentralized open standard have a CEO? The whole point is that no single person or company is in charge, right? Well, welcome to the wild world of open-source governance. It’s a riot, my friends. You’re going to hear me and Eugen say the phrase “benevolent dictator for life” in dead seriousness because that’s how a lot of these projects are run." > > – Nilay Patel, [Can Mastodon seize the moment from Twitter?](https://www.theverge.com/23658648/mastodon-ceo-twitter-interview-elon-musk-twitter?ref=thenexusofprivacy.net), March 2023 Well, actually, nobody's the "CEO of Mastodon" – Mastodon is a complex ecosystem, and nobody's in charge. Still, Rochko's CEO and owner of Mastodon gGmbH, the German company that runs mastodon.social (by far the largest Mastodon instance), provides the official software release and mediocre official mobile apps, controls the joinmastodon.org landing page, and owns the Mastodon copyright. And also he's the BDFL. So he's the closest thing there is to a "CEO of Mastodon". It's worth highlighting that not everybody agrees that a BDFL model is a good one. > "Diverse models of usership, shared between servers, range from venture-capital-backed alt-right platforms to Japanese imageboard systems, anarcho-communist collectives, political factions, live-coding algoravers, ‘safe spaces’ for sex workers, gardening forums, personal blogs, and self-hosting cooperatives.... \[T\]he rise of this new kind of usership meant a new questioning of the archetypal models of governance of FLOSS projects, such as the benevolent dictator." > > – Aymeric Mansoux and Roel Roscam Abbing, [Seven Theses on the Fediverse and the Becoming of F/LOSS](https://test.roelof.info/log/seven-theses/?ref=privacy.thenexus.today) (2020) And not everybody agrees that Rochko's a good BDFL for Mastodon. But that's the thing about dictators: they don't have to care all that much about whether people want a dictatorship or whether people think they're a good dictator. Even as BDFL and CEO of Mastodon gGmbH, Rochko's power isn't absolute – there have been times when loud enough pressure from users and instance admins has gotten him to change his mind about something. Still, as BDFL he can keep functionality that clashes with his vision out of the code base. In Patel's interview, Rochko points to this as a reason why he thinks the BDFL model is a good one for open-source projects: > "A good product needs long-term vision and it needs cohesive vision. That’s something that a committee cannot give. When you have a lot of people who have pet issues and one thing that they care about, it kind of ends up being a patchwork.... Sometimes, you need to make executive decisions about changing stuff in a serious way, which might not be popular with what most people in a committee would want." As I wrote in [Fork it! It’s time for a Mastodon hard fork](https://thenexusofprivacy.net/mastodon-hard-fork/) (April 2024) > "So if Rochko thinks that functionality that lets people protect themselves against harassment (and is ideal for instances with local communities) shouldn't be available in the official software ... too bad for people whose pet issues are privacy and community. For people whose pet issue is accessibility, if Rochko says a design decision that make the software harder for use with low vision get as [a "feature not a bug."](https://github.com/mastodon/mastodon/pull/9898?ref=privacy.thenexus.today#issuecomment-456410756), it's not available in the official software.... And these are just a few examples." One more example: the ability for instance admins to easily change the maximum post length. After [cassolotl suggested this in 2017](https://github.com/mastodon/mastodon/issues/5693?ref=privacy.thenexus.today), it was quickly [implemented by lambadalamda](https://github.com/mastodon/mastodon/pull/5697?ref=privacy.thenexus.today) and [integrated into glitch-soc](https://github.com/glitch-soc/mastodon/pull/223?ref=privacy.thenexus.today). But Rochko [refused to support it](https://github.com/mastodon/mastodon/pull/5697?ref=privacy.thenexus.today#issuecomment-345078582) in vanilla Mastodon: > "I feel like the UX is designed, visually and behaviourally, around a certain number of characters, and deviations have a negative impact on it." Since then, similar changes been proposed – and rejected – repeatedly: in [2018](https://github.com/mastodon/mastodon/issues/6388?ref=privacy.thenexus.today), [2019](https://github.com/mastodon/mastodon/issues/12265?ref=privacy.thenexus.today), [2022](https://github.com/mastodon/mastodon/issues/12265?ref=privacy.thenexus.today#issuecomment-1336259510), [2023](https://github.com/mastodon/mastodon/issues/24147?ref=privacy.thenexus.today), and quite possibly others I missed in my quick search of Mastodon issues. So on instances where people want more than 500 characters, instance admins whose pet issue is trying to give people what they want are out of luck – unless they've got the skills, time, energy, and desire to install the Mastodon server software, change the code, reapply the changes every time there's a new release, sysadmin the Linux machine and database, and learn about Sidekiq queues. Oh well. It is what it is. If Rochko doesn't care whether Mastodon's a good platform for networked communities and instead wants to keep focusing on Mastodon as a Twitter alternative ... well, he's the BDFL, he gets to do what he wants. ## Flash forward seven years ... > "Thankfully (for Mastodon, and myself), even as I left the stage, others pushed forward with the fringe Mastodev agenda. Most notable among these is Darius Kazemi, who has developed and expanded upon my original thesis in an encouraging (and ultimately ((although to what extent being a well‐known and male‐passing internet personality and (now ex–)Mozilla fellow has helped him in this is anyoneʼs guess)) more effective) way through his guide, [Run your own social](https://runyourown.social/?ref=thenexusofprivacy.net), and accompanying fork, Hometown." > > – Margaret Kibi, [Progressing Fringe Mastodev](https://www.u2764.com/NFIC/2019-09-15/fringe-progress/?ref=thenexusofprivacy.net) (2019) Glitch, Hometown and other forks have continued to improve as a platform for networked communities – despite only getting a tiny sliver of the resources that have gone to Mastodon gGmbH.[10](#limited-resources) Today, the experience on a well-run instance running a fork with local-only posts, formatted posts, and a longer maximum post length than vanilla Mastodon is as good as anything on the Fediverse (at least for people using apps that are better than the mediocre official Mastodon versions). Fedibird even has circles! Of course even for instances using forks, there's still the endemic whiteness and sexism of Mastodon and the broader Fediverse to deal with (and don't worry, I'll discuss that in an upcoming installment)11. Still, local-only posts along with a good [instance blocklist](https://thenexusofprivacy.net/blocklists-in-the-fediverse/) provide some insulation, and allow-list federation can provide even more. And as I'll discuss later in the post, a networked communities approach *could* provide a path to make progress on these long-standing problems as well. Mastodon has adopted many Glitch and Hometown improvements; in fact, earlier this year, Emelia Smith [reported](https://medium.com/@thisismissem/why-a-hard-fork-of-mastodon-isnt-the-way-b37aecfe5c86?ref=thenexusofprivacy.net) that Glitch maintainer Claire is now leading Mastodon development. Mastodon also benefits hugely from a handful of experienced volunteers (including Smith) who provide valuable contributions release after release – as well as dozens of people who have made more occasional (but still valuable!) contributions. But Mastodon still hasn't adopted local-only posts. As Kazemi says [on the Hometown wiki](https://github.com/hometown-fork/hometown/wiki/Local-only-posting?ref=thenexusofprivacy.net) > "Being able to have conversations with people on your server that don't federate is a hugely liberating thing. It allows inside jokes to develop. It allows people the freedom to complain about things that they wouldn't necessarily feel comfortable leaving a trusted server (cops, employers, etc). It also lets us do things like have a server-wide movie night where we flood the local timeline with posts about the movie, and it doesn't pollute the rest of the Fediverse." So Mastodon's still not anywhere near as good a platform for networked communities as forks like Glitch and Hometown. ## Seven years later, is Mastodon significantly closer to being a good Twitter alternative? And despite all the improvements over the last seven years, at least to me it's not clear that Mastodon has made all significant progress addressing its challenges as a Twitter alternative. - From a safety perspective, Mastodon still lacks basic (and vitally important) Twitter functionality like private profiles and reply controls - No matter how many times Mastodon loyalists say "it's easy, just like email" ... [it's not easy](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/#its-not-easy). - Onboarding, usability, and discoverabiilty are still huge problems as well. The challenges Erin Kissane discusses in July 2023's [Mastodon Is Easy and Fun Except When It Isn’t](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=thenexusofprivacy.net) are all challenges that were broadly discussed back in 2017\. - So is anti-Blackness. And even though his position has now evolved, Rochko's 2018 perspective that quoting "[inevitably adds toxicity to people's behaviours](https://mastodon.social/@Gargron/99662106175542726?ref=privacy.thenexus.today)"[12](#doubly-wrong) means that Mastodon still doesn't support functionality André Brock notes in [*Distributed Blackness*](https://nyupress.org/9781479829965/distributed-blackness/?ref=privacy.thenexus.today) is a core aspect of Black digital practices).[13](#also-racist) And while Mastodon's adoption of the ActivityPub protocol in September 2017 has had some benefits,[14](#activitypub-benefits) ActivityPub's approach to federation where people only see a portion of the global conversation is very different from Twitter's flat model.[15](#fediscovery) Of course, these are all addressable problems. Still, at this point, Bluesky's a better decentralized Twitter alternative than Mastodon; Threads is much easier for people who already have Instagram accounts to try out. Both have much bigger budgets than Mastodon, so it'll be a challenge to catch up. Fortunately, [**there's a lot more to social networking than Twitter alternatives**](https://thenexusofprivacy.net/mastodon-two-years-later/#more-than-twitter-alternatives). ## To be continued! The next installment, [A faux “Eternal September” turns into flatness](https://thenexusofprivacy.net/flatness/), looks in more detail at the challengers that newcomers in Mastodon's November 2022 wave faced. Here's the contents: - [It's not "just like email"](https://thenexusofprivacy.net/flatness/#not-just-like-email) - [Usability and gatekeeping weren't the only challenges newcomers faced](https://thenexusofprivacy.net/flatness/#not-the-only-challenges) - [The first complicated high-stakes decision is even before you sign up](https://thenexusofprivacy.net/flatness/#even-before-joining) - [Why not help people choose an instance that's a good fit?](https://thenexusofprivacy.net/flatness/#why-not) - [But no](https://thenexusofprivacy.net/flatness/#but-no) And there's more to come after that! To see new installments as they're published, [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/swf-questions/#/portal/signup), follow [@nexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=privacy.thenexus.today) (or [on Bluesky, via Bridgy Fed](https://bsky.app/profile/thenexusofprivacy.infosec.exchange.ap.brid.gy?ref=privacy.thenexus.today)), and/or join the [Nexus of Privacy community on lemmy.blahaj.zone](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=privacy.thenexus.today). Or just come back and visit [*Mastodon, two years later*](https://thenexusofprivacy.net/mastodon-two-years-later/) in a few days! ### Sneak previews of upcoming installments *As always, these are from draft versions of upcoming posts, and the final versions may be different.* .... Of course it's over-simplifying to look at the history in terms of just two prototypes. Mastodon and its forks have also prototyped - A trans-led fork with a trans, queer, and non-binary-centric community - A [consent-based culture](https://thenexusofprivacy.net/free-fediverses-and-consent/) that (while imperfect and intermittent) points to a very different path than surveillance capitalism - A real-life testbed for all the complexities of decentralized moderation and federated diplomacy - A protocol-based platform for (somewhat) interoperaable social media operations .... I talked a lot about Mastodon's long-standing problems with race in [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history), and things haven't improved since then – [5 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) has plenty of newer examples and links. And as Dr. Johnathan Flowers points out in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), Mastodon is a metonym for the whiteness of the broader Fediverse.... And while the original partial history talked a lot about anti-Blackness and the complicated interactions between Mastodon and LGBTQIA2S+ people, I didn't really delve into sexism and misogyny – which are also big issues. And here too, Mastodon is a metonym for the broader Fediverse. .... One or more hard forks still seems like the mostly likely outcome to me, perhaps combining a focus on networked communities (and a less friendly attitude towards Meta) with some of the ideas in [Fork it! It’s time for a Mastodon hard fork](https://thenexusofprivacy.net/mastodon-hard-fork/) and/or Ro's [A Case for Community](https://h-i.works/2024/04/a-case-for-community.html?ref=privacy.thenexus.today) (both April 2024). Hard forks that start with Glitch or Hometown as a base would have significant advantages over Mastodon if it can get support from hosting companies, and if it also improves allow-list federation and adds support for [federations of instances](https://thenexusofprivacy.net/the-free-fediverses-should-support-concentric-federations-of-instances/) it could be a good fit for [The Website League](https://websiteleague.org/?ref=thenexusofprivacy.net) and other emerging projects. Then again, there's been discussion of Mastodon hard forks for years, and [it's not as easy as it sounds](https://thenexusofprivacy.net/mastodon-hard-fork/#not-so-easy), so maybe it won't happen. Whether or not there's a hard fork, the same opportunities are there for the official Mastodon project if its direction and leadership structure evolves. The official project has some big advantages – including funding – so let's hope that happens. And it's not an either-or situation; forks don't have to be hostile, and there are lots of potential synergies if they can work together effectively (as well as challenges). ## Notes 6 Rochko's far from the only fediverse influencer who doesn't prioritize community and safety, especially for marginalized people. [The (annotated) case for “Big Fedi”](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#big-fedi) (December 2023) looks at cluster of ideas that Evan Prodromou characterizes as "Big Fedi". Prodromou, who describes himself as "the father of the Fediverse", says that he's mostly as a Big Fedi person", and these perspectives are in my experience the norm among cis male ActivityPub Fediverse influencers. 7 [Fork it! It’s time for a Mastodon hard fork](https://thenexusofprivacy.net/mastodon-hard-fork/) (April 2024) goes into detail on Rochko not prioritizing safety, especially for marginalized people. The low-hanging fruit discussed in [Safety is an especially good area to focus on](https://thenexusofprivacy.net/mastodon-hard-fork/#safety) is all stuff that Rochko *could* have implemented in Mastodon, but hasn't. And mastodon.social, run by Rochko's Mastodon gGmbH, has a well-deserved reputation for relatively lax moderation against transphobia, Islamophobia, and racism. 8 Although, as Ana Valens describes [Mastodon is crumbling — and many blame its creator](https://www.dailydot.com/debug/mastodon-fediverse-eugen-rochko/?ref=privacy.thenexus.today) (2019), Rochko had harshly criticized Shel Raphen's original design of the [welcome modal](https://github.com/mastodon/mastodon/issues/705?ref=privacy.thenexus.today) and [made significant changes](https://github.com/mastodon/mastodon/pull/1883?ref=privacy.thenexus.today) that "[broke the pedagogy and curriculum built into the design of the onboarding modals](https://github.com/mastodon/mastodon/pull/1964?ref=privacy.thenexus.today)," which had been reviewed and approved by various other contributors. So the impact was less than it could have been – and it was a [breaking point for the queer community](https://thenexusofprivacy.net/mastodon-a-partial-history/#a-breaking-point-for-the-queer-community) that Mastodon has never really recovered from, so destroyed the momentum of community innovation as well. It's not surprising Rochko didn't see it that way, but as [Lessons (so far) from Mastodon](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=privacy.thenexus.today) (2017) highlights, it really was obvious at the time. 9 Back in April 2017, Rochko said > "Twitter changed the reply system, which everybody told them they shouldn’t do, and then removed the iconic egg avatar for new users, and suddenly all of my work of telling people that one day Twitter would do something they didn’t like and they’d need a viable alternative paid off." In April 2023's [Can Mastodon seize the moment from Twitter?](https://www.theverge.com/23658648/mastodon-ceo-twitter-interview-elon-musk-twitter?ref=thenexusofprivacy.net), Rochko noted > "I was a pretty heavy Twitter user back then — I think I started using it in 2008 or so, when I was a teenager — and it quickly became a very important part of my life for talking to friends or finding out what was happening in the world. Around 2016, I felt fed up with how Twitter was being run as a company, where it was heading, the community that was on there, the harassment, and so on. I started looking into alternatives, and after viewing the landscape, I decided to build a product of my own — and tried to make it good." So more accurately, Rochko's vision of Mastodon is an alternative to Twitter *as he experienced it* from 2008-2016\. Which means it's also not surprising that Rochko didn't realize that a Twitter-wannabe without Black Twitter isn't really a Twitter alternative. I put this in a footnote to emphasize the point that whiteness – on Mastodon and in the broader Fediverse – often manifests itself by not even considering Black perspectives. As Dr. Johnathan Flowers says in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) (2022) > "Mastodon is a very white platform, and insofar as I'm saying it's a very white platform, here I'm drawing on the work of Sara Ahmed in her piece[*A Phenomenology of Whiteness*](https://journals.sagepub.com/doi/pdf/10.1177/1464700107078139?ref=thenexusofprivacy.net#:~:text=A%20phenomenology%20of%20whiteness%20helps,surface%20in%20a%20certain%20way.&text=The%20field%20of%20critical%20whiteness,a%20primary%20object%20of%20knowledge.), who argues that spaces inherit the orientations of the people within them. So if you have a space that is predominantly populated by white persons regardless of their other identities, if you are in a space primarily populated by white persons, the norms, the habits, the very structure of that space will take on a likeness to whiteness by virtue of how the majority of people participate in that space." 10 It's not like Mastodon itself has ever been flush with cash; as Emelia Smith [points out](https://medium.com/@thisismissem/why-a-hard-fork-of-mastodon-isnt-the-way-b37aecfe5c86?ref=thenexusofprivacy.net), "Mastodon has usually only had one developer, maybe two, working on it full-time at any given point over the past 8 years." But forks typically have almost no cash, and rarely have even one full-time developer for more than a few months. And Mastodon gGmbH also has contract developers working on mobile apps, hired a design consultancy, and runs mastodon.social (by far the largest Mastodon instance) and mastodon.online ... so it has more resources than just "one or two" developers. One way of looking at this is that Mastodon gGmbH does a lot with relatively minimal resources. Another way of looking at it is that Mastodon gGmbH has gone down a path of trying to do a lot more than it has resources for. There are other mobile apps and web interfaces out there that are better than the official ones; there are other instances that are better than mastodon.social and mastodon.online. Newer projects like GoToSocial are focusing much more narrowly, not doing their own UI and avoiding a flagship instance. It would be a big change but Mastodon could also go that route and devote more of its limited resources to where they're most impactful. 11 And in the footnotes of this one! 12 Reality begs to differ; see Hilda Bastian's [Quote Tweeting: Over 30 Studies Dispel Some Myths](https://absolutelymaybe.plos.org/2023/01/12/quote-tweeting-over-30-studies-dispel-some-myths/?ref=privacy.thenexus.today) (January 2023) for an excellent and very readable research survey. Also, as [Black Twitter, quoting, and white views of toxicity on Mastodon](https://thenexusofprivacy.net/black-twitter-quoting-and-white-toxicity-on-mastodon/) discusses, there are plenty of *positive* uses of quote tweets. So Rochko's 2018 position on quoting was doubly incorrect. 13 So Rochko's 2018 position on quoting was racist as well as doubly incorrect. As I say, Rochko's views have evolved, and that's good, but as [Black Twitter, quoting, and white views of toxicity on Mastodon](https://thenexusofprivacy.net/black-twitter-quoting-and-white-toxicity-on-mastodon/) also discusses, the discourse around quote boosts reinforced Mastodon's image for racism – and still does to some extent. As [futurebird said on GitHub](https://github.com/mastodon/mastodon/issues/14597?ref=privacy.thenexus.today#issuecomment-1362907651) in December 2022 > "I don't really think mastodon needs quote-boost to thrive. It would be better, helpful, positive, but users are creative and will work around it. We will find new ways to communicate. What I'm concerned about **now** is what this restriction *has come to represent.* > > Whose concerns matter? > Who is welcomed? > Who is supported? > Who isn't?" 14 Thanks to ActivityPub, Mastodon's now at least somewhat compatible with dozens of other federated software platforms, which is good thing all around. Also, since Mastodon's historically been the big elephant in the Fediverse, other implementations have to conform to its often-quirky interpretations of the loosely written standard, and Mastdon's proprietary API has much more adoption than the ActivityPub C2S standard. If you're thinking that sounds like a classic embrace-and-extend strategy, you're right, and along with ActivityPub's complexity (a barrier to new entrants) it helped Mastodon keep its dominant position for several years despite its relative lack of innovation. Of course, while Mastodon has benefited, this embrace-and-extend has held the Fediverse as a whole back ... once again, oh well. 15 Mastodon's upcoming [Fediverse Discovery Providers](https://www.fediscovery.org/?ref=thenexusofprivacy.net) project, funded by NLNet, is an interesting attempt to work around this limitation, and it'll be interesting to see whether it uses ActivityPub ... but as I write this, it's still in the very early stages. ### 5 ways to fight election disinformation on Bluesky and the Fediverse URL: https://thenexusofprivacy.net/fiighting-election-disinfo-2024/ Last updated: 2026-04-16T03:22:39.000Z > [Also posted on the IFTAS blog](https://about.iftas.org/2024/10/29/5-ways-to-fight-election-disinformation-on-bluesky-and-the-fediverse/?ref=thenexusofprivacy.net). 1. [THINK before you engage or share](#think) 2. [SHARE accurate information about the election](#report) 3. [REPORT disinformation when you see it](#report) 4. [EDUCATE yourself — and your friends and family](#educate) 5. [GET INVOLVED – and get your friends and family involved](#get-involved) White supremacists, fascists and their allies are already spewing disinformation to try to steal the US Presidential election. Xitter's white supremacist, pro-fascist dipshit CEO is one 0f them. Meta's fascist-friendly CEO is suspending the accounts of people who push back. A [civil rights coalition is calling on Musk and Zuckerberg to take action against election disinformation](https://www.cnn.com/2024/10/21/media/musk-zuckerberg-social-media-election-disinformation/index.html?ref=thenexusofprivacy.net), and maybe they'll make some token efforts, but I for one am not holding my breath. Bluesky and the Fediverse are a lot smaller than Xitter, Threads, Instagram, and Facebook, but the good news is that they're not run by companies that make big bucks from disinfo, white supremacists, and fascists. So as the big networks get overwhelmed by disinfo, we've got a fighting chance to use these smaller decentralized networks as clearer channels to get out *accurate* information. We've already seen digital voter suppression (such as false information about polling place locations and hours), and fake reports of "flipped votes" and "non-citizen voting." And it's not always easy to tell what is and isn't real: last week [Russian actors in a fake video](https://www.seattletimes.com/nation-world/nation/a-staged-video-claimed-to-show-someone-destroying-ballots-election-officials-were-prepared/?ref=thenexusofprivacy.net) falsely claimed ballots were being destroyed, this morning, there was [a true report of arson at a ballot drop box in Washington state](https://www.katu.com/news/local/vancouver-ballot-box-seen-smoking-same-morning-as-portland-ballot-box-arson?ref=thenexusofprivacy.net). Between now and November 5 , expect lots of more all of the above – as well as a mix of real and fake reports of voter intimidation. Once the polls close, it's likely to get even messier. The fascist candidate expected to declare victory on election night no matter what the early results say, and there's likely to be all kinds of chaos on the way to getting the final results. In 2020, election denialism led to a coup attempt. This year ... who knows. Grassroots election protection activism made the difference in 2020, just as it had in 2008\. It's time to do it again. Fighting disinfo is one good way to help – on the Fediverse, on Bluesky, and on other social networks. Here arefive easy and important things to do over the next few weeks. 1. [THINK before you engage or share](#think) 2. [SHARE accurate information about the election](#report) 3. [REPORT disinformation when you see it](#report) – see the [Appendix](#appendix) for detailed instructions for Bluesky and Mastodon 4. [EDUCATE yourself — and your friends and family](#educate) 5. [GET INVOLVED – and get your friends and family involved](#get-involved) > *This information was originally based on work done in 2020 with Shireen Mitchell, Stop Online Violence Against Women, Indivisible Plus Washington, Indivisible Whidbey, Washington Indivisible Network, and Indivisible's Truth Brigade.* [*How To Respond to Disinformation and Digital Voter Suppression*](https://indipluswa.medium.com/how-to-respond-to-disinformation-and-digital-voter-suppression-training-with-shireen-mitchell-1e8ee95695f8?ref=thenexusofprivacy.net) *and* [*Deep Dive*](https://indipluswa.medium.com/deep-dive-responding-to-disinfo-and-digital-voter-suppression-with-shireen-mitchell-b2109173866f?ref=thenexusofprivacy.net) *goes into more detail (although hasn't been updated for 2024, so some of it's a bit out of date). Thanks to all involved!* ## 1\. THINK before you engage or share Shireen Mitchell’s [**All of us have been targeted by disinformation*](https://vimeo.com/471961897?ref=thenexusofprivacy.net) As Shireen says, if you have an immediate reaction to share a link without verifying or fact-checking, you need to pause and look at things differently. One of the goals of disinformation is to get you to react emotionally. Even if it’s something you agree with, it’s important to think before you engage. - Is the information you’re about to share accurate and from a reliable source? If not, be very careful not to give it more visibility when you’re trying to debunk it. - Even if the information you’re about to share is accurate, look at the headline and any images that you’re sharing to make sure they’ve got the right framing. - Avoid headlines, images, and videos that include disinfo. Instead, look for headlines and articles that focus on the accurate information, or report that there’s disinfo but don’t repeat it. - If you can’t find a headline and article that work well, consider just quoting a few lines from an article (or taking a screenshot) rather than linking. - **Only share screenshots of disinfo if you are clearly visually labeling them as disinfo.** That last bullet is something I really wish more people understood. Back in 2020, when I was working with progressives on Twitter and Facebook, I was constantly exasperated with how often people would amplify disinfo to dunk on it. Now, I'm just as exasperated as how often it happens on Bluesky and the Fediverse. Please don't help white supremacists and fascists by amplifying their propaganda!!!! Shireen’s [Deep Dive on Fighting Back Against Disinfo](https://medium.com/@IndiPlusWA/deep-dive-responding-to-disinfo-and-digital-voter-suppression-with-shireen-mitchell-b2109173866f?ref=thenexusofprivacy.net) goes into a lot more detail on this. [ReFrame also has some great infographics on how to not amplify disinfo](https://twitter.com/ReFrameMentor/status/1320825419180851200?ref=thenexusofprivacy.net), and Union of Concerned Scientists covers this and a lot of other valuable topics in [Countering Disinformation in Your Community](https://www.ucsusa.org/sites/default/files/2022-04/Countering-Disinformation-in-Your-Community-Resource-Guide.pdf?ref=thenexusofprivacy.net). ### How to tell if information is accurate? ![Stop; Investigate the Source; Find better coverage; Trace claims, quotes, and media to the original context. ](https://lh7-rt.googleusercontent.com/docsz/AD_4nXda7osrWGWNY6vVAXewC-vcGTroNa5R4r3iFI55uS4cyL-cEnaBTDXIt-TybxSduk5nTGZSySgXLmIt41JgC35wkZuGrj3fhUFHm3qWdFMxW0abifO5MZWVGx1nUHr4TttsP3SvpeQT6LzqyYhqS-luMoQ?key=8wkPY2b6qOem_kiDte0drQ) **The SIFT method for evaluating information: Image credit:* [**Mike Caulfield*](https://hapgood.us/2019/06/19/sift-the-four-moves/?ref=thenexusofprivacy.net)**,* [**CC BY 4.0*](https://creativecommons.org/licenses/by/4.0/?ref=thenexusofprivacy.net) How to tell whether or not information is accurate? Mike Caulfield’s [SIFT (The Four Moves)](https://hapgood.us/2019/06/19/sift-the-four-moves/?ref=thenexusofprivacy.net) is a good short introduction to the SIFT method: stop; investigate the source; find better coverage; and trace claims, quotes, and media to the original context. The five-part [Check Please! Starter Course](https://checkpleasecc.notion.site/Check-Please-Starter-Course-ae34d043575e42828dc2964437ea4eed?ref=thenexusofprivacy.net) goes into much more detail. [IFTAS Library’s Misinformation page](https://connect.iftas.org/library/content/misinformation/?ref=thenexusofprivacy.net) has links to additional resources for investigating potential disinformation. And even credible sources sometimes get it wrong – especially when there's fast-breaking news and rumors are flying. WNYC On The Media’s [Breaking News Consumer's Handbook](https://www.wnyc.org/story/breaking-news-consumers-handbook-pdf/?ref=privacy.thenexus.today) has some good recommendations for these fast-moving situations. Here's their infographic summary – if you want to print it out, they've got [a handy PDF file](https://media.wnyc.org/media/resources/2013/Sep/20/OTM%5FConsumer%5FHandbook.pdf?ref=privacy.thenexus.today). ![Breaking News Consumer's Handbook. 1. In the immediate aftermath, news outlets will get it wrong. 2. Don't trust anonymous sources. 3. Don't trust stories that cite another news outlet as the source of the information. 4. There's almost never a second shooter. 5. Pay attention to the language the media uses. 6. Look for news outlets close to the incident. 7. Compare multiple sources. 8. Big news brings out the fakers. And Photoshoppers. 9. Beware reflexive retweeting. Some of this is on you.](https://thenexusofprivacy.net/content/images/2024/10/breaking-news.jpg) **Recommendations from WNYC's* [**On The Media*](https://www.wnyc.org/story/breaking-news-consumers-handbook-pdf/?ref=privacy.thenexus.today) *– good advice for all of us!* ### On Bluesky and the Fediverse, the algorithm is you ### ![Image: somebody typing the words "OMG DID YOU SEE THIS". Text: How to not amplify disinfo. Don't feed the algorithm. When you see something that makes you mad: 1. DON’T repost on social media 2. DON’T comment trying to outsmart them, this attracts more attention to the post 3. ONLY IF the post is already popular, DO comment with vetted debugging info. 4. DO take a screenshot if you must share, and share only through email, messenger, etc. 5. DO educate your community to exercise the same discipline. Reframe.](https://cdn-images-1.medium.com/max/1600/0*0k7UfBkrnGc857ht.png) ReFrame’s infographics on [How to NOT amplify disinfo](https://twitter.com/ReFrameMentor/status/1320825419180851200?ref=thenexusofprivacy.net) On Bluesky and the Fediverse, the algorithm is people boosting and reskeeting posts. So (just like on Facebook and Twitter with their different approach to algorithms) it's vital to think before you post. Whenever you get share a link (even if you’re saying “OMG look at this fake information!”) or involved in a discussion in the comments debunking or debating a post that’s disinformation, you’re calling more attention to it. When you *do* decide to engage with disinformation, here’s the approach that ReFrame and other disinfo experts suggest this four-step process. 1. Lead with shared values to connect with your audience. 2. Discredit the falsehood by naming the motivations driving the disinformation. 3. State the falsehood you intend to inoculate against. 4. Deliver factual information to combat the falsehood. Reframe's [Signals in the Noise: Election Edition | 10.22.2024](https://www.thisisreframe.org/blog-posts/sin-election-2?ref=thenexusofprivacy.net) is a good summary of the current hot-button disinformation tropes. Just as importantly, it's got counter-narratives. For example, here's their counter to false narratives circulating about Democrats and Black voters. > *"Polling data only gives us a small slice of the story, and the numbers don’t align with what we know about Black men, who vote second only to Black women. Black men are voting aligned with their interests, their communities and their loved ones. Elevate stories and messages that accentuate people power and how Black men have historically shown up electorally."* ## 2\. SHARE accurate information about the election > What is your plan to [promote accurate, aspirational and actionable](https://www.ucsusa.org/sites/default/files/2022-04/Countering-Disinformation-in-Your-Community-Resource-Guide.pdf?ref=thenexusofprivacy.net) information about the solutions needed to protect your/our freedoms regarding the 2022 midterm election? > > – – Shireen Mitchell in [Disinformation: A Racist Tactic, from Slave Revolts to Elections](https://blog.ucsusa.org/guest-commentary/disinformation-a-racist-tactic-from-slave-revolts-to-elections/?ref=thenexusofprivacy.net) Shireen's question is just as relevant in 2024\. The last few days of voting are always somewhat chaotic: with ballot box and polling place closures, long lines and broken machines, and reports of voter intimidation. This year, we've already had at least four reports of arson affecting ballots – three true, one was fake. One common (and illegal) digital voter suppression tactic is to share wrong addresses or inaccurate hours for polling places via texts and social media. Last minute announcements of poll closures add to the confusion ... sometimes they're real, sometimes they're not. And it always takes time to count the ballots, and election denialists use that to reply that there are shenanigans happening so they can cast doubt on the final results. One good way to counter disinformation about the election process is to share accurate information about the election. Take the time to verify that the information you’re sharing is accurate before you share updates! Voting rights organizations, official state and county election sites, and reputable local media (including online-only sources) are usually the most reliable sources. [I Will Vote](https://iwillvote.com/?ref=thenexusofprivacy.net) makes it easy to [find your voting or drop-off information](https://iwillvote.com/?ref=thenexusofprivacy.net), for example, and Common Cause lets you [find your polling place](https://www.commoncause.org/resources/find-my-polling-place/?ref=thenexusofprivacy.net) or [find your local election office](https://www.commoncause.org/research-and-resources/voting-tools/?ref=thenexusofprivacy.net). Share these links widely! Voting rights organizations, official election sites, and reputable local and national media (including bloggers and newsletter writers) are also good sources sto cut through the disinfo fog during the ballot counting. The non-partisan [Election Law Blog](https://electionlawblog.org/?ref=thenexusofprivacy.net), run by Professor Richard L. Hasen, and [Democracy Docket](https://www.democracydocket.com/?ref=thenexusofprivacy.net) are great sources of information about the lawfare (although Democracy Docket's Marc Elias frequently works with the Democratic party; I find that their information is consistently accurate, but it's still a good thing to keep in mind). We've already seen dozens of lawsuits, and we're likely to see hundreds more. What about partisan sources? In 2020, the Democratic party and Democratic politicians generally provided accurate information; many Republicans didn't. Obviously, though, neither party is completely objective! So it's important to look for independent confirmation rather than taking their word for it. That said, it's a good assumption is that anybody who's still lying about the 2020 results (or has a habit of sharing disinformation on other topics) is likely to lie about the 2024 results ... so *especially* don't take their word for it. X (despite all its problems) is still a good source for this information. Lists like Election Protection coalition's [national](https://twitter.com/i/lists/220826382?ref=thenexusofprivacy.net) and [state](https://twitter.com/i/lists/220985989?ref=thenexusofprivacy.net) partners are good starting points. So is [The Leadership Conference's coalition list](https://twitter.com/VOTE411?ref=thenexusofprivacy.net), and the League of Women Voters' [Vote411](https://twitter.com/VOTE411?ref=thenexusofprivacy.net). You can check all of these even if you don't have a Twitter account. Some of these organizations, and other election protection experts, are also active on Bluesky. [Edward Perez (former Director for Civic Integrity at Twitter) has a useful "starter pack"](https://bsky.app/profile/did:plc:hf3tgiqwvu45ajugrei27fpx?ref=thenexusofprivacy.net) with a list of accounts; you can click on "Follow All" or just choose specific ones to follow. Vanderbilt University professor Lisa Fazio's [Creating a trustworthy information ecosystem](https://bsky.app/profile/lkfazio.bsky.social?ref=thenexusofprivacy.net) starter pack is useful as well. > Note: Bluesky lists or custom feeds could also be useful here ... any suggestions? ![Election protection hotlines are available in multiple languages. Protect your vote. Protect the election.](https://thenexusofprivacy.net/content/images/2022/11/election-protection-hotlines.jpeg) It’s also good to highlight the non-partisan [**Election Protection hotlines**](https://866ourvote.org/?ref=thenexusofprivacy.net)**,** useful for anybody experience voter intimidation or having other challenges voting. Trained volunteers are available in multiple languages: **English:** 866-OUR-VOTE (866 687 8683) **Spanish/English**: 888-Ve-Y-Vota (888 839 8682) **Arabic/English**: 844-Yalla-US (844 925 5287) **English, Mandarin, Cantonese, Korean, Vietnamese, Tagalog, Urdu, Hindi, and Bengali**: 888-API-VOTE (888 274 8683) You can also contact Election Protection via [WhatsApp](http://wa.me/18666878683?ref=thenexusofprivacy.net), chat with them on their site [866ourvote.org](https://866ourvote.org/?ref=thenexusofprivacy.net) or **text MYVOTE to 866–687–8683.** ## 3\. REPORT disinformation when you see it [![If you see disinfo, report it here. reportdisinfo.org](https://thenexusofprivacy.net/content/images/2024/10/report-disinfo-here.jpg)](https://reportdisinfo.org/?ref=thenexusofprivacy.net) Bluesky's [community guidelines](https://bsky.social/about/support/community-guidelines?ref=thenexusofprivacy.net) specifically prohibit engaging in voter suppression, sharing misleading content about election processes, or encouraging real-world disruption of the election processes. Many Fediverse instances (aka servers), although not all, also have rules prohibiting misinformation or disinformation; even if there isn't an explicit rule, disinformation often violates other server rules, so they may well take action. So when you see election disinformation, the first step is report it to the moderators. If this isn't something you've done before, I've got detailed instructions – with screenshots – in the appendix. > Terminology note: M**isinformation** is information that's false or misleading, but not necessarily intentionally. **Disinformation**, on the other hand, is information that's **intentionally** false or misleading. Kate Starbird's [ What’s the difference between misinformation and disinformation?](https://www.king5.com/article/news/politics/dispelling-misinformation-disinformation-online-university-of-washington-election-day/281-641e44b3-11f9-4427-a451-9464189b0029?ref=thenexusofprivacy.net) has more. And that's just the first step. Disinformation on Bluesky and the Fediverse is also likely to be on other social networks, so it's worth reporting it to[**ReportDisinfo.org**](https://reportdisinfo.org/?ref=thenexusofprivacy.net) (an easy-to-use site to report disinformation), run by Common Cause Election Fund. You can include a link – either the post or an article that it's linking to – or upload an image. If you run into disinfo on most other social networks, it's worth reporting it there as well. The more people who report a post, the more likely it is that companies will fact-check it and potentially take it down. There's no guarantee – it's incredibly frustrating, but social network platforms will often let blatant disinformation go even after it's been reported – but it's still worth doing. X (formerly Twitter) is an exception. ## 4.EDUCATE yourselves — and your friends and family — about disinformation PEN America has a lot of great resources on disinformation, including the.[How to Vote and Combat Political Disinformation: A Tip Sheet for Election 2024](https://pen.org/how-to-vote-and-combat-political-disinformation-a-tip-sheet-for-election-2024/?ref=thenexusofprivacy.net) (which lists many of the common disinformation narratives), a [primer for news consumers on spotting and combating disinformation when news breaks](https://pen.org/disinformation/facts-forward/pen-americas-primer-for-news-consumers-on-spotting-and-combating-disinformation-when-news-breaks/?ref=thenexusofprivacy.net), the two-minute video above (originally produced for the 2020 election, but still relevant), and the hour-long video below. PEN America's [Election Countdown: Combating the Most Dangerous Disinformation Trends](https://www.youtube.com/watch?v=lq6XH%5Fsimqs&ref=thenexusofprivacy.net) And you're not the only person who needs to recognize disinformation, avoid amplifying it, and respond. Your friends, family, and colleagues do as well. So as well as educating yourself, please share the knowledge. Union of Concerned Scientists' [Countering Disinformation in Your Community](https://www.ucsusa.org/sites/default/files/2022-04/Countering-Disinformation-in-Your-Community-Resource-Guide.pdf?ref=thenexusofprivacy.net) and PEN America's [How to Talk to Friends and Family Who Share Misinformation](https://pen.org/how-to-talk-to-friends-and-family-who-share-misinformation/?ref=thenexusofprivacy.net) are also excellent resources; so is this video from Sabrina Joy Stevens. Sabrina Joy Stevens, [How to Counter Disinformation: Communication Strategies, Best Practices, and Pitfalls to Avoid](https://www.youtube.com/watch?v=AsEi5hRQ6Vw&ref=thenexusofprivacy.net) (from Union of Concerned Scientists) And I know I already mentioned it, but it's worth repeating ... ![Stop; Investigate the Source; Find better coverage; Trace claims, quotes, and media to the original context. ](https://lh7-rt.googleusercontent.com/docsz/AD_4nXda7osrWGWNY6vVAXewC-vcGTroNa5R4r3iFI55uS4cyL-cEnaBTDXIt-TybxSduk5nTGZSySgXLmIt41JgC35wkZuGrj3fhUFHm3qWdFMxW0abifO5MZWVGx1nUHr4TttsP3SvpeQT6LzqyYhqS-luMoQ?key=8wkPY2b6qOem_kiDte0drQ) **The SIFT method for evaluating information: Image credit:* [**Mike Caulfield*](https://hapgood.us/2019/06/19/sift-the-four-moves/?ref=thenexusofprivacy.net)**,* [**CC BY 4.0*](https://creativecommons.org/licenses/by/4.0/?ref=thenexusofprivacy.net) [SIFT (The Four Moves)](https://hapgood.us/2019/06/19/sift-the-four-moves/?ref=thenexusofprivacy.net) is a good short introduction to the SIFT method: stop; investigate the source; find better coverage; and trace claims, quotes, and media to the original context. The five-part [Check Please! Starter Course](https://checkpleasecc.notion.site/Check-Please-Starter-Course-ae34d043575e42828dc2964437ea4eed?ref=thenexusofprivacy.net) goes into much more detail. [IFTAS Library’s Misinformation page](https://connect.iftas.org/library/content/misinformation/?ref=thenexusofprivacy.net) has links to additional resources for investigating potential disinformation. Even credible sources sometimes get it wrong – especially when there's fast-breaking news and rumors are flying. WNYC On The Media’s [Breaking News Consumer's Handbook](https://www.wnyc.org/story/breaking-news-consumers-handbook-pdf/?ref=thenexusofprivacy.net) has some good recommendations for these fast-moving situations. Here's their infographic summary – if you want to print it out, they've got [a handy PDF file](https://media.wnyc.org/media/resources/2013/Sep/20/OTM%5FConsumer%5FHandbook.pdf?ref=thenexusofprivacy.net). ![Breaking News Consumer's Handbook. 1. In the immediate aftermath, news outlets will get it wrong. 2. Don't trust anonymous sources. 3. Don't trust stories that cite another news outlet as the source of the information. 4. There's almost never a second shooter. 5. Pay attention to the language the media uses. 6. Look for news outlets close to the incident. 7. Compare multiple sources. 8. Big news brings out the fakers. And Photoshoppers. 9. Beware reflexive retweeting. Some of this is on you.](https://thenexusofprivacy.net/content/images/2024/10/breaking-news.jpg) **Recommendations from WNYC's* [**On The Media*](https://www.wnyc.org/story/breaking-news-consumers-handbook-pdf/?ref=thenexusofprivacy.net) *– good advice for all of us!* There's a lot of great information about disinformation out there ... here's one moer, [a very detailed discussion from the University of Washington Center for the Informed Public's Mini Misinfo Day](https://www.youtube.com/watch?v=QaefRdRxTvM&ref=thenexusofprivacy.net) ## 5\. GET INVOLVED – and get your friends involved! Getting out accurate voting and election protection information, or reporting disinfo when you see it, may seem mundane ... but if enough people are involved, it can make a big difference. The more people who reduce the amount of disinfo they're unentionally amplifying the better. A lot of people still don't know how to deal with disinfo, so helping educate friends and family has a huge impact as well. If you're in the Fediverse, and you've got a bit of time, another good thing to do is to ask your instance's admins and moderators if they need help. Unlike sites like Xitter and Facebook that rely on racist, ineffective AI algorithms for moderation, the Fediverse relies on people – which is great, but is also a lot of work! So they may well appreciate the offer ... If you want to do more, consider joining a grassroots disinfo fighting campaign. Two good non-partisan options: [Common Cause's Digital Democracy Activists](https://www.commoncause.org/digital-democracy-activists-dda/?ref=thenexusofprivacy.net) and [Indivisible's Truth Brigade](https://indivisible.org/indivisible-truth-brigade?ref=thenexusofprivacy.net). And some candidates, or state and local party organizations, also have disinfo-fighting teams (or might interested in starting one if they don't exist yet – remember, the election doesn't end when the polls close), so check with the ones you support. It's crunch time for democracy in the United States, so if that's something you care about, now's a good time to get involved. ![5 Ways to Fight Disinformation -- the same infographic as at the beginning of the article. THINK before you engage or share. SHARE accurate information about the election REPORT disinformation when you see it EDUCATE yourself — and your friends and family GET INVOLVED – and get your friends and family involved](https://thenexusofprivacy.net/content/images/2022/11/5-ways-to-fight-disinfo---2022-1.png) ## Appendix: how to report disinformation ### Bluesky You can report any post by clicking on the three-dot menu and selecting "Report post". ![A menu item labeled "Report post"](https://thenexusofprivacy.net/content/images/2024/10/report-post-0.png) Since Bluesky allows multiple moderation services, the first step after that is to select the official Bluesky moderation service (which should be the first and perhaps only one on your list). ![Select moderator To whom would you like to send this report? Below: Bluesky Moderation Service, @moderation.bsky.app](https://thenexusofprivacy.net/content/images/2024/10/select-moderator.png) Next, you need to say why you're reporting this post. "Misleading post" is the first option on the list. ![Report this post. Why should this post be reviewed? Below, a button with the label "Create report for misleading post". ](https://thenexusofprivacy.net/content/images/2024/10/report-post.png) This wll take you to the screen where you can once again choose different moderation services to report it to. Bluesky Moderation Service should already be checked (and it might be the only one there). There's also a text box where you can optionally give more information about the post, so you can provide an explanation (or link to one) about why it's disinfo. ![At the top: Misleading Post, with a checkmark on the right side. In the middle, Select the moderation service(s) to report to; and a checked box for Bluesky Moderation Service. Below that, optionally proide additional information below, and a text field. At the bottom, a button labeled Send Report](https://thenexusofprivacy.net/content/images/2024/10/send-report.png) ### The Fediverse Hachyderm's video on [How to create a local report on Mastodon](https://www.youtube.com/watch?v=yv9Z1tXEGOQ&ref=thenexusofprivacy.net) Things are more complicated in the Fediverse. Almost all Fediverse software provides the ability to report posts, but the details are different depending on what app you're using. Most Fediverse instances have community guidelines or "server rules" prohibiting disinformation, but the wording is different on different instances. (If your instance *doesn't* specifically prohibit disinformation, much election disinformation is illegal content, so you can still report it, you just have to check a different box.) Hachyderm's video above has the basics, and should work for most Mastodon instances if you're using the web UI or the official mobile apps. Other apps may have some variations but are generally along these lines. If you (like me) prefer screenshots and text to videos, read on! ![How do I report posts or accounts on Mastodon? To report a post click the three-dot "More" menu on the bottom of the post and select Report. To report an account, go to its profile and click the three-dot "More" menu, then select Report. In both cases, this will start a reporting wizard that narrows down specifically what kind of problem you’re reporting.](https://thenexusofprivacy.net/content/images/2024/10/feditips.png) From Fedi.Tips [Reporting problematic content to moderators on the Fediverse](https://fedi.tips/how-do-i-report-a-post-or-account-that-is-doing-something-bad/?ref=thenexusofprivacy.net) page On Mastodon, you start the reporting process by clicking the three-dot "More" menu on a post (or an account profile). (If you're using a screenreader, the dots are hidden – you'll only hear the "More" label.) Once you do that, you'll get taken to a screen that lets you specify what's wrong with the post. ![Tell us what's going on with this post . Choose the best match. Below, five choices. The fourth, with a checked button, says "It violates server rules". At the bottom, a button labeled Next](https://thenexusofprivacy.net/content/images/2024/10/violates-rules.png) Check "It violates server rules" (or "It's illegal" if you're on an instance that doesn't prohibit disinformation), and then the **Next** button at the bottom of the screen. That takes you to a screen where you can specify just which rules are being violated. ![Which rules are being violated? Select all that apply. Below, 6 choices. The fifth, with a checked box, says Do not share information widely-known to be false and misleading. At the bottom, a button labeled Next](https://thenexusofprivacy.net/content/images/2024/10/widely-known.png) Click on the appropriate rule, and then click **Next**. The specifics will be different depending on what your server rules are. This screenshot is from mastodon.social, which has a rule "Do not share information widely-known to be false and misleading". Next, you'll get a screen asking you to select posts to back up the report. The post you're reporting should be selected by default; if there are other disinfo posts from this account, this helps establish a pattern. Click **Next** again and you're almost done. ![Is there anything else you think we should know? A text box for Additional comments. The account is from anothe rserver. Send an anonymized copy of the report there as well?](https://thenexusofprivacy.net/content/images/2024/10/Screenshot-2024-10-24-at-10.13.58-PM.png) The next screen has a text box where you can provide additional information. You can help the moderators by being specific about why the post is disinfo; if you've got a link to accurate information, include that to make it easy for them to check for themselves. If the post you're reporting is from another instance, you can also send a report to the moderators there. Usually, you want to do this (although if the other instance is something like pravda.me, where the admins and moderators are intentionally spreading disinfo, it's better not to). Click **Submit** and the report will be sent to the moderators. Once you've submitted the report, you also have the option to unfollow, mute, or block the account. ![5 Ways to Fight Disinformation -- the same infographic as at the beginning of the article. THINK before you engage or share. SHARE accurate information about the election REPORT disinformation when you see it EDUCATE yourself — and your friends and family GET INVOLVED – and get your friends and family involved](https://thenexusofprivacy.net/content/images/2022/11/5-ways-to-fight-disinfo---2022-1.png) ### Mastodon, two years later URL: https://thenexusofprivacy.net/mastodon-two-years-later/ Last updated: 2026-04-16T03:22:10.000Z > Work in progress! > Last update: November 1\. See the [update log](#update-log) at the end of the article. > > Join the discussion on [infosec.exchange,](https://infosec.exchange/@thenexusofprivacy/113383358987865179?ref=thenexusofprivacy.net) [lemmy.blahaj.zone](https://lemmy.blahaj.zone/post/17971658?ref=thenexusofprivacy.net), and [Bluesky](https://bsky.app/profile/thenexusofprivacy.net/post/3l7keo7lvwb2z?ref=thenexusofprivacy.net)[!](https://bsky.app/profile/thenexusofprivacy.net?ref=thenexusofprivacy.net) > "Mastodon is a free and open-source server software designed for communicating with and participating in the large, nebulous social-media network colloquially known as “the fediverse”; in very recent times, it has found itself the subject of a surprising level of journalism, hailed frequently as the (enlightened, doomed, sometimes both) successor to Twitter and its ilk." > > – Allie Hart, [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=privacy.thenexus.today), April 2017 > "I'm flashing! Five and a half years later, there's once again a flock of new arrivals to Mastodon – and a huge amount of media attention. " > > – me, [*Mastodon: a partial history*](https://thenexusofprivacy.net/mastodon-a-partial-history)*, November 2022* History doesn't repeat itself, but sometimes it rhymes. Just as in 2017, many people who flocked to Mastodon after Apartheid Clyde's October 2022 acquisition of Twitter had great experiences on Mastodon ... but most didn't. Some (especially people of color) had really horrible experiences. Within a few months, optimism and excitement had turned into disappointment and frustration. Why? Usability and onboarding challenges, racism and sexism and other cultural issues, a lack of tools for people to protect themselves .... Erin Kissane's, [Mastodon is easy and fun except when it isn't](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=thenexusofprivacy.net) (July 2023) is a great overview of reasons people didn't stay – frustratingly similar to the challenges people had encountered back in 2017\. > "I REALLY liked Mastodon, when i started— really good community practices, decent conversations and genuine attempts at dialogue—but at this point sometimes it genuinely feels like this place gets more drama-filled, antagonistic, and snidely mansplainy by the day." > > – Dr. Damien T. Williams, October 2023 Two years later, there's another exodus from Xitter and its "fascism as a business model" hellscape. This time, though, [it's Bluesky that people are flocking to](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/). And a good thing too! At this point, Bluesky's a better Twitter alternative for most people than Mastodon. Still, there's more to social networking than Twitter alternatives. More positively, the 2022 wave once again highlighted something that Mastodon forks (variants) like Glitch and Hometown and the broader Fediverse *are* uniquely good at: a "[networked communities](https://thenexusofprivacy.net/the-free-fediverses-should-emphasize-networked-communities/)" model, where autonomous instances (servers) combine local relations and interactions with the ability for people plug into broader conversations if and when they want to.[1](#notes) And a lot of other [good stuff is happening in the fediverses](https://thenexusofprivacy.net/good-stuff-in-the-fediverses/) – including some encouraging progress from Mastodon. So it's a complicated story, just like the rest of Mastodon's history. Fortunately, this is just a *partial* history, so I'm not going to try to be exhaustive. Instead, I'll touch on a few topics, and wrap it up with some thoughts about Mastodon's future. This article is still a work in progress, and for now just includes the first couple of sections. As I publish new installments, I'll also update the links in the contents. You can get new posts as they're published by [subscribing to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/swf-questions/#/portal/signup), following [@nexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=privacy.thenexus.today) (or [on Bluesky, via Bridgy Fed](https://bsky.app/profile/thenexusofprivacy.infosec.exchange.ap.brid.gy?ref=privacy.thenexus.today)), and/or join the [Nexus of Privacy community on lemmy.blahaj.zone](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=privacy.thenexus.today) ... or just come back and visit this page in a few days! ### Contents - [Mastodon could have leaned into what it's good at](#oh-well) - [There's a lot more to social networking than Twitter alternatives](#more-than-twitter-alternatives) - [A tale of two prototypes](https://thenexusofprivacy.net/a-tale-of-two-prototypes-2/) - [Mastodon 2017 and Glitch 2017](https://thenexusofprivacy.net/p/279f20a3-be31-436a-810d-bb25166957ad/#2017)[](#bdfl) - [A BDFL gets to do what he wants](https://thenexusofprivacy.net/p/279f20a3-be31-436a-810d-bb25166957ad/#bdfl) - [Flash forward seven years ...](https://thenexusofprivacy.net/p/279f20a3-be31-436a-810d-bb25166957ad/#flash-forward) - [Seven years later, is Mastodon significantly closer to being a good Twitter alternative?](https://thenexusofprivacy.net/p/279f20a3-be31-436a-810d-bb25166957ad/#is-it-closer) - [A faux “Eternal September” turns into flatness](https://thenexusofprivacy.net/flatness/) - [It's not "just like email"](https://thenexusofprivacy.net/flatness/#not-just-like-email) - [Usability and gatekeeping weren't the only challenges newcomers faced](https://thenexusofprivacy.net/flatness/#not-the-only-challenges) - [The first complicated high-stakes decision is even before you sign up](https://thenexusofprivacy.net/flatness/#even-before-joining) - [Why not help people choose an instance that's a good fit?](https://thenexusofprivacy.net/flatness/#why-not) - [But no](https://thenexusofprivacy.net/flatness/#but-no) - Mastodon so white - Also: sexism and misogynoir - An opportunity for a strategic advantage - Networked communities and federations - Now what? - [Terminology](#terminology) - [Notes](#notes) (with additional info, references, and snark) ## Mastodon *could* have leaned into what it's good at ![Mastodon Active Users: a chart, starting with 500,000 in October 2022, peaking at 2,500,000 in December 2022, declining for a few months and then by another lower paek, follwed by a setad decline and ending at 1,000,000 in August 2024](https://thenexusofprivacy.net/content/images/2024/10/struggling-to-survive.png) From [Why is Mastodon struggling to survive?](https://www.reddit.com/r/Mastodon/comments/1g1g844/why%5Fis%5Fmastodon%5Fstruggling%5Fto%5Fsurvive/?ref=thenexusofprivacy.net) by Existing\_Process\_151 on r/Mastodon Mastodon and the Fediverse can be a very negative place.[2](#negtivity) The title of the reddit post I took this graph from is a great example. OK, Mastodon has plenty of challenges; the author makes some good points and [AvgGuy's comment ](https://www.reddit.com/r/Mastodon/comments/1g1g844/comment/lrg7jay/?ref=thenexusofprivacy.net)is outstanding. But think about it for a second. Mastodon has gotten multiple six figure donations, enough that they've hired another developer. Release 4.3 has just shipped. There's funding from NLNet for some new projects and a new US-based non-profit.[3](#501c3) And with Flipboard, Wordpress, Vivaldi, Medium, Meta (Facebook and Instagram's parent company) and others getting involved, there's a lot more money sloshing around the Fediverse these days, and Mastodon's name recognition will help it get access to some of it. "Struggling to survive"? Come on. Similarly, people often describe the "Twitter migration" to Mastodon as a "failure" ... but that's not how I see it. Don't get me wrong, I certainly wouldn't call Mastodon's last two years a success ... but reality's non-binary, and "failure" isn't accurate either. To me, it makes more sense to look at it in terms of ... - **calibration**: Mastodon wasn't ready for broad use as a Twitter alternative, but forks (variants) like Glitch and Hometown *are* good platforms for networked communities - **missed opportunities**: Mastodon could have leaned into what it i*s* good at, focused on the networked communities model, and taken some straightforward steps that would have led to more people having good experiences (and fewer people having horrible experiences) ... but it didn't. Instead, Mastodon continued to position itself as a Twitter alternative, and still hasn't addressed most of the challenges people ran into in 2022 (and 2017). Oh well. As a Twitter alternative, Bluesky's actually done a much better job of learning from Mastodon's challenges. They've put a lot of work into onboarding, usability, and giving people better tools: to protect themselves and others, to curate and find useful information, to find and build communities in a flat all-public world. At this point, it's going to be very challenging for Mastodon to catching up to Bluesky as a Twitter alternative. - Most importantly, a Twitter-wannabe without Black Twitter isn't really a Twitter alternative, and Mastodon's reputation for racism is so firmly entrenched at this point that it will be very hard to attract most of Black Twitter. - From a technical perspective, Bluesky uses the newer AT protocol (as opposed to the ActivityPub protocol that Mastodon (and most of the rest of today's Fediverse uses), and AT is much better suited for large all-public social networks – like Twitter alternatives, for example - Bluesky's got a much bigger budget.[4](#not-just-budget) And Bluesky isn't the only new corporate Twitter alternative with a big budget. Meta's June 2023 announcement that Threads (their new Twitter compitor) would enter Fediverse and be compatible Mastodon has sparked some intense differences of opinion in the Fediverse. Erin Kissane's outstanding [Untangling Threads](https://erinkissane.com/untangling-threads?ref=privacy.thenexus.today) (December 2023), looks at the arguments in both directions. Still, for the hundreds of millions of people with Instagram accounts who want a Twitter alternative, Threads is a natural choice (as long as they're willing to put up with Meta's exploitative business practices and racist, anti-LGBTQIA2S+, and Islamophobic moderation). And like Bluesky (but unlike Mastodon), Threads has very good onboarding, so it's easy to get started. ## There's a lot more to social networking than Twitter alternatives > "If they’re motivated, tooled up, and plugged into communities of support fediverse server teams can provide context-sensitive, high-touch local moderation for their members—while also connecting to a broad landscape of other well-governed servers. > > No matter what policy changes they make, centralized platforms will never be able to do this." > > – Erin Kissane, [revealing the fediverse’s gifts](https://www.wrecka.ge/revealing-the-gifts/?ref=thenexusofprivacy.net), October 2024 Fortunately, even though a lot of people like Twitter alternatives, there are a lot of complementary approaches to social networking. ActivityPub's flexible (albeit complex) scoped visibility model makes it a good match for a "networked communities" model, where (unlike Bluesky) people don't have to share *everything* with the entire world, but can still plug into broader conversations if and when they want to. Today, there are hundreds of those communities in the Fediverse – and most of them are on instances (aka servers) running Mastodon and its forks like Glitch and Hometown. It's worth highlighting that Glitch, Hometown, and other forks are much better suited for networked communities than the official Mastodon release. For one thing, forks (like most other Fediverse microblogging software) have local-only posts, which allow community-wide discussions that aren't shared with the outside world (as well as helping with safety) – but as I discussed in [Does Mastodon really prioritize stopping harassment?](https://thenexusofprivacy.net/mastodon-a-partial-history/#does-mastodon-really-prioritize-stopping-harassment) the official Mastodon release does not provide this functionality.[5](#local-only) [Governance on Fediverse Microblogging Servers](https://fediverse-governance.github.io/?ref=privacy.thenexus.today), co-authored by Kissane and Hometown maintainer Darius Kazemi, looks in detail at small-to-medium communities running Mastodon and Hometown. Their conclusion: > "We think it’s clear that the servers we studied offer real-world examples of governance that differ from centralized platforms **not only in scale, but in kind**—and that despite the network’s complexity and persistent opacity, **many of the the structural possibilities the Fediverse offers allow for the flourishing of better and more humane ways of managing human interactions online**." ## A tale of two prototypes It's not surprising that most people think of "Mastodon" as the official Mastodon project run by Mastodon founder and Benevolent Dictator for Life (BDFL) Eugen Rochko (aka Gargron), CEO of Mastodon gGmbH. Rochko gets almost all of the attention in the tech press, has more followers than any other techie on Mastodon, and is often portrayed as "[the man who built Mastodon](https://www.wired.com/story/the-man-behind-mastodon-eugen-rochko-built-it-for-this-moment/?ref=thenexusofprivacy.net)." But the reality's a lot more complex.... From that perspective, it's interesting look back at Mastodon 2017 and Glitch 2017 as prototypes of two different visions. - as a prototype of a platform to support networked communities, Glitch 2017 was a huge success.... Mastodon 2017 was less of a success, because it was missing some key features from Glitch, but it certainly wasn't a failure. - as a prototype of a Twitter alternative, Mastodon 2017 and Glitch 2017 were inconclusive. Flash forward seven years ... Continued in [A tale of two prototypes](https://thenexusofprivacy.net/a-tale-of-two-prototypes-2/) ## A faux “Eternal September” turns into flatness The millions of new users flocking to Mastodon in late 2022 reminded many people of [Usenet's (misremembered) "Eternal September"](https://www.flowjournal.org/2023/04/eternal-september/?ref=privacy.thenexus.today) back in 1993-4 – although as Smith describes, there were some significant differences. Of course, just like the old influx to Usenet as new college students discovered it every September, the initial late-2022 wave ebbed quickly. Mastodon Benevolent Dictator for Life (BDFL) Eugen Rochko's March 2023 [claim](https://www.theverge.com/23658648/mastodon-ceo-twitter-interview-elon-musk-twitter?ref=privacy.thenexus.today) that "in fact it’s growing faster now than it was" was, um, in retrospect overoptimistic. By late 2023, growth had turned to flatness.... Continued in [A faux “Eternal September” turns into flatness](https://thenexusofprivacy.net/flatness/) ## To be continued! This post is long enough that I'm serializing it in multiple posts, and then will pull it together as as single post. [A tale of two prototypes](https://thenexusofprivacy.net/mastodon-two-years-later/) is the next in the series, and as more are published I'll add the links here and in the [Table of Contents](#contents) at the top. To see new installments as they're published, [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/swf-questions/#/portal/signup), follow [@nexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=privacy.thenexus.today) (or [on Bluesky, via Bridgy Fed](https://bsky.app/profile/thenexusofprivacy.infosec.exchange.ap.brid.gy?ref=privacy.thenexus.today)), and/or join the [Nexus of Privacy community on lemmy.blahaj.zone](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=privacy.thenexus.today). Or just come back and visit [*Mastodon, two years later*](https://thenexusofprivacy.net/mastodon-two-years-later/) in a few days – I'll update the links at the top, and the sneak previews. ### Sneak previews of upcoming installments *As always, these are from draft versions of upcoming posts, and the final versions may be different.* .... Of course it's over-simplifying to look at the history in terms of just two prototypes. Mastodon and its forks have also prototyped - A trans-led fork with a trans, queer, and non-binary-centric community - A [consent-based culture](https://thenexusofprivacy.net/free-fediverses-and-consent/) that (while imperfect and intermittent) points to a very different path than surveillance capitalism - A real-life testbed for all the complexities of decentralized moderation and federated diplomacy - A protocol-based platform for (somewhat) interoperaable social media operations .... I talked a lot about Mastodon's long-standing problems with race in [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history), and things haven't improved since then – [5 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) has plenty of newer examples and links. And as Dr. Johnathan Flowers points out in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), Mastodon is a metonym for the whiteness of the broader Fediverse.... And while the original partial history talked a lot about anti-Blackness and the complicated interactions between Mastodon and LGBTQIA2S+ people, I didn't really delve into sexism and misogyny – which are also big issues. And here too, Mastodon is a metonym for the broader Fediverse. .... One or more hard forks still seems like the mostly likely outcome to me, perhaps combining a focus on networked communities (and a less friendly attitude towards Meta) with some of the ideas in [Fork it! It’s time for a Mastodon hard fork](https://thenexusofprivacy.net/mastodon-hard-fork/) and/or Ro's [A Case for Community](https://h-i.works/2024/04/a-case-for-community.html?ref=privacy.thenexus.today) (both April 2024). Hard forks that start with Glitch or Hometown as a base would have significant advantages over Mastodon if it can get support from hosting companies, and if it also improves allow-list federation and adds support for [federations of instances](https://thenexusofprivacy.net/the-free-fediverses-should-support-concentric-federations-of-instances/) it could be a good fit for [The Website League](https://websiteleague.org/?ref=thenexusofprivacy.net) and other emerging projects. Then again, there's been discussion of Mastodon hard forks for years, and [it's not as easy as it sounds](https://thenexusofprivacy.net/mastodon-hard-fork/#not-so-easy), so maybe it won't happen. Whether or not there's a hard fork, the same opportunities are there for the official Mastodon project if its direction and leadership structure evolves. The official project has some big advantages – including funding – so let's hope that happens. And it's not an either-or situation; forks don't have to be hostile, and there are lots of potential synergies if they can work together effectively (as well as challenges). ## Terminology I've written a *lot* about Mastodon and other fediverse software over the last few years, and the terminology I use has evolved somewhat over time. [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) reflects how I try to talk about it today: - **a fediverse** (a portmanteau of "federation" and "universe") is a decentralized social network of federated (i.e. interconnected) servers, and the people and organizations with accounts on them, that communicate through one or more protocols, bridges, and hubs. - **"the Fediverse"** is a fediverse whose boundaries, culture, software, protocols, change over time. and mean different things to different people but typically include a network organization based on **instances**, a specific kind of server Since 2018 or so most people have used "the Fediverse" as a synonym for a fediverse centered on the ActivityPub protocol, and that's how I'll use it here (and that's also how it's used in the original partial history). That may be changing; the tech press increasingly considers Bluesky part of "the Fediverse", and sometimes lumps in Nostr as well. As Marco Rogers says, the lines are gray and blurry. [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) also contains definitions of fedi culture, corporate fediverse, the "free fediverses" (defined in opposition to surveillance capitalism) – and examples of how other people define "the Fediverse", as does [Definitions of "the Fediverse"](https://nexusofprivacy.net/is-bluesky-part-of-todays-fediverse/?ref=privacy.thenexus.today#defining-the-fediverse). ## Notes 1 I first saw the "networked communities" framing from L. Rhodes in a[n excellent thread on merveilles.town](https://merveilles.town/@lrhodes/110555014534253768?ref=privacy.thenexus.today) that no longer exists. [Groundedness and community](https://destructured.net/groundedness-networked-community?ref=thenexusofprivacy.net), on *destructured.net*, goes into more detail. 2 Although not everybody sees it that way. I mentioned the Fediverse's negativity in a post on discussions.thenexus.today, a NodeBB instance I run, and a Mastodon user I had never encountered before left a drive-by comment > are you kidding me? I have never used a non free, as in freedom social, where the \*\*\*\* do you find negativity in this place? > > Really, you are probably on the wrong server, join us. And as a bonus, he left me a link to an article written by [Richard Stallman](https://stallman-report.org/?ref=thenexusofprivacy.net). Gosh I can't understand why people think Mastodon is unfriendly and filled with stereotypically sexist and condescending techie assholes. 3 The US 501(c)(3) non-profit started earlier this year after [Mastodon gGmbH lost their German non-profit status](https://www.heise.de/en/news/Mastodon-Laut-Finanzamt-nicht-mehr-gemeinnuetzig-9701352.html?ref=thenexusofprivacy.net). A big advantage of a 501(c)(3) is that it can unlock matching gifts from US-based corporations. Encouragingly, the 501(c)(3)'s board includes Esra’a Al Shafei (founder of Majal.org, co-founder of the Numun Fund, and board member at Tor Foundation) and Karien Bezuidenhout (who has a wealth of non-profit experience), two incredibly valuable additions that really highlight the possibilities. Less encouragingly, the board also includes a lawyer whose day job is defending AI companies against copyright lawsuits, and a founder of Twitter who's now an investor and also on the board of the AI Foundation, a "dual commercial and non-profit organization." Yikes. So we'll see how it works out. 4 White Mastodon and ActivityPub supporters often put this as #1 on their list, and it's certainly a big advantage for Bluesky: they've been able to move much more quickly than Mastodon. But then again even if Mastodon suddenly got a windfall they wouldn't be a good Twitter alternative unless they address the racism and the protocol issue, so I put it at the end of the list. 5 I also talked about Mastodon's refusal to support local-only posts in [Mastodon and today’s ActivityPub Fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/), and in [Fork it! It’s time for a Mastodon hard fork](https://thenexusofprivacy.net/mastodon-hard-fork/), and in [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/), and probably a few other places as well. I know I sound like a broken record on this but local-only posts also provide significant safety benefits and HAVE BEEN IMPLEMENTED IN MASTODON FORKS SINCE 2017 SO THERE IS ABSOLUTELY NO EXCUSE FOR MASTODON NOT SUPPORTING THEM!!!!! ## Update log October 28: initially published, with first two sections, terminology, and notes. October 31: add next two sections. November 1: what was I thinking? Remove next two sections, and instead include a brief excerpt link to the separate post. This post is already over 3,000 words, which is plenty long! I'll combine them later. ### A lot of good stuff is happening in the fediverses! URL: https://thenexusofprivacy.net/good-stuff-in-the-fediverses/ Last updated: 2026-04-16T03:21:49.000Z Part 12 of [*Golden opportunities for the fediverse – and whatever comes next*](#posts). > Join the discussion on [Bluesky](https://bsky.app/profile/thenexusofprivacy.net/post/3l753qvxait2e?ref=thenexusofprivacy.net), [infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net), [lemmy.world](https://lemmy.world/post/21155933?ref=thenexusofprivacy.net) and [discussions.thenexus.today](https://discussions.thenexus.today/category/5/fediverse?ref=thenexusofprivacy.net)! [](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) > "\[T\]his new surge highlights how different the situation in the fediverses is from November 2022, when millions of people dismayed by Apartheid Clyde's acquisition of Twitter flocked to Mastodon looking for a Twitter alternative. > > And a good thing too!" > > – [I for one welcome Bluesky, the ATmosphere, BTS Army, and millions of Brazilians to the fediverses!](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/) There's often a lot of negativity in the fediverses. And for good reason: there's often a lot to be disappointed, frustrated, cynical, and concerned about! Not only that, at least in the US, almost all the [high-profile press coverage of "the Fediverse"](https://news.google.com/search?q=fediverse&hl=en-US&gl=US&ceid=US%3Aen&ref=thenexusofprivacy.net) these days focuses on Meta's Threads' tiny incremental steps forward on their plans to [embrace, extend, and exploit](https://thenexusofprivacy.net/embrace-extend-and-exploit/) ActivityPub ... and that's a topic it's *especially* easy to be disappointed, frustrated, cynical, and concerned about. So it's useful to notice that hey, there's also a lot of good stuff happening in the fediverses! For example: - [DAIR-tube and dair-community.social](#dair) - [The Website League](#the-website-league) - [GoToSocial](#gotosocial) - [Piefed and the Threadiverse](#piefed) - [Bonfire](#bonfire) - [Letterbook](#letterbook) - [Bluesky and the ATmosphere](#bluesky-and-the-atmosphere) - [And ...](#and) Of course there's plenty of stuff happening that's not so good ... but let's put the negativity on hold, at least for this post. > Teminology note: [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) discusses the terminology I'm using here – but there's no need to wallow in the details unless you're into it. A fediverse is a decentralized social network. Different people mean different things by "the Fediverse" (and [Definitions of "the Fediverse"](https://nexusofprivacy.net/is-bluesky-part-of-todays-fediverse/?ref=thenexusofprivacy.net#defining-the-fediverse) goes into a lot more detail for your wallowing pleasure). Since 2018 or so most people have used "the Fediverse" as a synonym for the ActivityPub-centric Fediverse, and that's how I'm using it here (although that may be changing; the tech press increasingly considers Bluesky part of "the Fediverse") ## DAIR-tube and dair-community.social ![DAIR-tube: A PeerTube page with six videos, whose titles include Mystery AI Hype Theater 3000 Episode 4;, Life of a Latin American Data Worker; Data Workers Organizing - the African Content Moderators Union; and Introducing the Data Workers Inquiry](https://thenexusofprivacy.net/content/images/2024/10/DAIR-tube.png) Dr. Timnit Gebru's [Distributed AI Research Institute](https://www.dair-institute.org/?ref=thenexusofprivacy.net) is an interdisciplinary and globally distributed AI research institute rooted in the belief that AI is not inevitable, its harms are preventable, and when its production and deployment include diverse perspectives and deliberate processes it can be beneficial. The [DAIR-tube,](https://peertube.dair-institute.org/?ref=thenexusofprivacy.net) their PeerTube page, includes videos of their Data Workers Inquiry and Mystery AI Hype Theater 3000 – world-class research, foucsed on justice and equity, available on the Fediverse. Along with their Mastodon instance [dair-community.social](https://dair-community.social/?ref=thenexusofprivacy.net), it's a great example of what's possible with today's technology. DAIR's fediverse presence isn't replacing their presence on commercial social media; I follow Timnit Gebru on other platforms as well as Mastodon, Mystery AI Hype Theater 3000's hosts Emily Bender and Alex Hanna stream on Twitch and make their videos available on YouTube as well as PeerTube. And that's okay! Today's Fediverse lets them provide surveillance capitalism-free access to this anti-oppressive work, and interact with people in multiple languages (thanks to Mastodon's easy-to-use in-app translation). ## The Website League ![](https://thenexusofprivacy.net/content/images/2024/10/league.png) > "The Website League is a new social media project, built with the goals of providing its users a safe, healthy, and resilient place to share their thoughts, ideas, and art. With avoidance of dark patterns we believe drive unhealthy engagement of social media, a centralized decisionmaking body, and a shared set of community guidelines, our core aim is to provide a system that is enjoyable to use, and free of discrimination, bigotry, and harrassment of all kinds." > > – [The Website League](https://websiteleague.org/?ref=thenexusofprivacy.net) [The Website League](https://websiteleague.org/?ref=thenexusofprivacy.net) is a much newer project, it's starting with the right priorities from the beginning. The people involved are veterans of other social networking projects, and from the public discussions that their decisionmaking body and supporters are having, it's clear that they're focused on learning lessons from the past and doing their best to avoid common pitfalls (including anti-Blackness). And just as exciting to me is the network topology they're using. As the in-depth primer on their site explains > "The Website League is an ["island network,"](https://writer.oliphant.social/oliphant/islands?ref=thenexusofprivacy.net) where our software runs in *allowlist mode.* Websites will only talk to other websites they have placed in their allowlists. That list of websites will be cooperatively managed; a website that is a member of the League will be able to talk to all other websites in the League. It's either in, or it's out. > > The League is an experiment in doing something different. We are building a town that works cooperatively from the start: our neighborhoods are all connected to each other, like a city built on a grid. We are starting with an agreement on what we want our city to look like, how people in it should be able to get around, and how to keep people safe. Nobody digs up roads, because this harms everyone in the city; to solve problems, we have a centralized, democratic, consensus- and consent-based system of governance." There have been some smaller-scale experiments with [consent-oriented federation](https://thenexusofprivacy.net/free-fediverses-and-consent/) (quite a few fediverse software platforms support allow-list fedieration), and some interesting thinking about [federations of instances](https://thenexusofprivacy.net/the-free-fediverses-should-support-concentric-federations-of-instances/), but The Website League is the first ActivityPub-based platform I've seen try to make it work at scale. Of course, it's very early days yet, and no doubt there will be plenty of challenges ... but The Website League's already sparking some interesting development work, and the processes, technology and artifacts they develop are likely to be useful starting point for other federations as well. ## GoToSocial ![The GoToSocial logo, a smiling sloth's face with orange hair. To the right, the domain name gotosocial.thenexus.today](https://thenexusofprivacy.net/content/images/2024/10/gotosocial.png) I've been excited about GoToSocial's steady progress for a while. For one thing, GoToSocial's focusing on small-to-medium instances, and requires a lot less resources than Mastodon – which makes it a lot cheaper to host. And unlike Mastodon, GoToSocial's being developed with much more of a "privacy by design, privacy by default" perspective. A couple simple (but important) examples: - Mastodon disables the all-important "secure fetch" functionality by default, meaning blocks are a lot less effective; on GoToSocial, it's always on. - Mastodon includes "unlisted" posts on account profiles. That's not what "unlisted" means on YouTube ... or anywhere else that I know of. GoToSocial doesn't by default, although there's a setting to turn it on if you want ... and there's also a setting to even keep your *public* posts off your profile. (The latest Mastodon release changed the name of "unlisted" to "quiet public", which is at least more accurate, but no more privacy-protective.) - Mastodon doesn't give you a way to disable RSS feeds. GoToSocial turns them off by default. The just-shipped release 0.17 of GoToSocial introduces interaction controls, allowing people to control who can reply to or quote their posts – features that Mastodon users have requested for years, and that Bluesky introduced this spring, which can make a biiiiig difference in limiting the impact of the racists, misogynists, and anti-LGBTQAI2S+ bigots that are so common in the ActivityPub Fediverse (and everyhere else too of course). Of course, it's early days; GoToSocial's just starting beta testing. Still, I've been kicking the tires on it and it's very usable with a web user interface like phanpy.social. Now that 0.17 is officially released, I set up my own instance with [a personal account](https://gotosocial.thenexus.today/@jdp23?ref=thenexusofprivacy.net) and [an account for The Nexus of Privacy](https://gotosocial.thenexus.today/@thenexusofprivacy?ref=thenexusofprivacy.net). [1](#notes) It was quite easy to do (the documentation is very clear), but if you don't want to fiddle with Linux sysadmin, [K&T host offers a $3.75/month package](https://www.knthost.com/gotosocial?ref=thenexusofprivacy.net). ## Piefed and the Threadiverse ![A grid of multiple images of different kinds of food -- pumpkins, muffins, parmesan croutons, and more --along with some text](https://thenexusofprivacy.net/content/images/2024/10/piefed-food.png) The wide tiled view of [Piefed's Food topic](https://piefed.social/topic/food?layout=masonry%5Fwide&sort=hot&ref=thenexusofprivacy.net) [Piefed ](https://join.piefed.social/?ref=thenexusofprivacy.net)is a link aggregator, forum, and hub of social interaction and information, that focuses on "individual control, safety, and decentralised power." Piefed's functionality goes beyond other federated link aggregrators, including topics (with hiearchy) and a visually striking tiled view. Just as importnat is a focus on moderation and safety, critical issues that better-known Lemmy is notoriously bad at. Piefed's one of the many interesting things happening in the "Threadiverse", a term many use to refers to federated link aggregators, forums, blogs, and other threaded discussions. For example: - [The Nexus of Discussions](https://discussions.thenexus.today/?ref=thenexusofprivacy.net) uses NodeBB, a solid forum that's been around for years and now (thanks to a grant from NLNet) has add ActivityPub support. - [write.as](https://write.as/?ref=thenexusofprivacy.net) has recently added [an integratino with sub.club](https://write.as/blog/write-as-x-sub-club?ref=thenexusofprivacy.net) to support subscriptions - micro.blog [supports](https://www.manton.org/2024/10/08/an-only-slightly.html?ref=thenexusofprivacy.net) note taking, audio transcripts, newsletters, reading goals, and bookmarks as well as blogging. - Wordpress' [ActivityPub plugin](https://wordpress.org/plugins/activitypub/?ref=thenexusofprivacy.net) continues to improve, and they've made it easy for people hosting on wordpress.com to turn on federation with a single click. - [Ghost](https://activitypub.ghost.org/?ref=thenexusofprivacy.net) is [building in public](https://activitypub.ghost.org/beta-plans/?ref=thenexusofprivacy.net), with an ambitious vision and a lot of candor about the challenges, and is using [Fedify](https://fedify.dev/?ref=thenexusofprivacy.net) (a well-documented open-source ActivityPub framework) so is likely to have benefits for the broader ecosystem as well. And there are several other fediverse link aggregators as well, including Mbin and the newer [ClubsAll](https://lemmy.world/post/20828200?ref=thenexusofprivacy.net) and Frontpage.fyi (built on the AT Protocol). Lemmy is the most mature, and has a fair amount of usage; [the Nexus of Privacy has a small community on lemmy.blahaj.zone](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net), and Lemmy instances like [beehaw.org](https://beehaw.org/?ref=thenexusofprivacy.net) and [awful.system](https://awful.systems/?ref=thenexusofprivacy.net)s have a lot of good content and discussion despite the software's limitations. ## Bonfire ![A yellow drawing of a bonfire. To the right, the word "Bonfire".](https://thenexusofprivacy.net/content/images/2024/10/bonfire-logo.png) Bonfire is an ambitious project that's been around since 2020, and it's exciting to me because it's not just trying to be an alternative to existing corporate social networks ... not that there's anything wrong with that, we certainly need alternatives, but it's also great to see fediverse projects go beyond that. Bonfire's modular architecture is designed to make be a toolkit for creating digital spaces that encourage vibrant community participation and impactful collaboration. Most recently, Bofire's introduced Mosaic, a service to co-design and build online communities and collaboration networks. It's an interesting approach to the long-standing fediverse challenge of funding development. As well as working with Niboe (a scientific community of researchers and activists) and others on [Open Science Network](https://bonfirenetworks.org/posts/openscience%5Fnetwork/?ref=thenexusofprivacy.net), they've also been exploring [prosocial design patterns](https://bonfirenetworks.org/posts/content%5Flabelling%5Fin%5Fbonfire/?ref=thenexusofprivacy.net), and working closely with moderators to refine their product. It's been in beta for a while and while I'm not sure how close it is to an official release 1.0, it's certainly something to keep an eye on. ## Letterbook ![Letterbook. Open correspondence. On the left, an open book with multi-colored rods coming out of it.](https://thenexusofprivacy.net/content/images/2024/10/letterbook.png) > "Tools are also reciprocal with culture. We build tools, but we are also shaped by the affordances of those tools. There's no magic to this, either, and nothing changes overnight. But when you change what's possible, what's easy, what's visible, you can change behavior. Changing behavior changes culture. And everything is downstream from culture. > > I'm building Letterbook. I think it can be a very good thing. I would like it if you join me. " > > – Jennifer Moore, [Letterbook](https://jenniferplusplus.com/letterbook/?ref=thenexusofprivacy.net), August 2023 [Letterbook](https://github.com/Letterbook/Letterbook?ref=thenexusofprivacy.net) is at an even earlier stage that GoToSocial or Bonfire, but ever since it started they've doing all the right things: establishing an inclusive culture, starting with a very solid architecture; focusing on sustainability and moderation; and reaching out broadly, for example with their current [moderation survey](https://research.letterbook.com/index.php?r=survey/index&sid=318578&lang=en&ref=thenexusofprivacy.net). Following Letterbook's progress has been eye-opening for me; Jennifer's description in [Letterbook - No universal translators](https://jenniferplusplus.com/no-universal-translators/?ref=thenexusofprivacy.net) of how much work ActivityPub requires for new projects to get to the point of federating is just one example. And like The Website League, Letterbook is rethinking some of the fundamental assumptions of the ActivityPub Fediverse. ## Bluesky and the ATmosphere ![](https://thenexusofprivacy.net/content/images/2024/10/bluesky-fediverse.png) Opinions differ on whether Bluesky is part of "the Fediverse"; I think so, but not everybody agrees. In any case, as a decentralized social network ecosystem it's also a fediverse in its own right. Bluesky usage is once again surging, with a couple of million new users joining in the last week after Apartheid Clyde confirmed his plan to make life easier for stalkers and harassers by weakening Xitter's blocking functionality. And while many of the millions of Brazilians who joined Bluesky in August and September have gone back to Xitter, or moved on to Threads, quite a few are staying around – Portuguese continues to be one of the most-used languages on Bluesky. Bluesky has put a lot of work into onboarding and usability, and that's really paid off in the new surges. "Starter packs", collections of accounts and feeds to follow, help new people find interesting content quickly. The huge number of custom feeds make it easy to find content, and we're starting to see some very useful moderation services – like Aendra's [XBlock Screenshot Labeler](https://xblock.aendra.com/getting-started/?ref=thenexusofprivacy.net), which makes it easy to hide screenshots by default (or not see them at all if you prefer). [Blacksky](https://bsky.app/profile/rudyfraser.com/post/3l66z4zupdj2w?ref=privacy.thenexus.today) is a great example of putting the different pieces together, including [multiple feeds](https://bsky.app/search?q=blacksky&ref=privacy.thenexus.today), a [starter pack](https://bsky.app/starter-pack/rudyfraser.com/3kvubqmzzi32t?ref=privacy.thenexus.today), a [moderation service,](https://bsky.app/profile/did:plc:d2mkddsbmnrgr3domzg5qexf?ref=privacy.thenexus.today) an ambitious vision that Rudy Fraser discusses in the three-part series [Blacksky: Expressing the Black Everyday in a New Digital Space](https://blog.rudyfraser.com/blacksky-part-one?ref=privacy.thenexus.today). And things are also hopping in the broader ATmosphere. [Last Week in the ATmosphere](https://fediversereport.com/last-week-in-the-atmosphere-oct-24-week-3/?ref=thenexusofprivacy.net) (by Laurens Hof of Fediverse Report) is a great pace to track what's happening. A few recent examples: - [Bluecast](https://www.bluecast.app/?ref=thenexusofprivacy.net), an audio space app, is big in Japan and has recently added karaoke - [BlueArk](https://blueark.app/?ref=thenexusofprivacy.net) is a service to move tweets to Bluesky recently created by two Brazilian developers. It's not free, but $13.50 doesn't seem excessive for my tens of thousands of tweets. The older [Twitter to Bluesky](https://github.com/marcomaroni-github/twitter-to-bluesky?ref=thenexusofprivacy.net), which runs from the command line, *is* free - [Picosky](https://psky.social/?ref=thenexusofprivacy.net) is a chat service - [linkat.blue](https://linkat.blue/?ref=thenexusofprivacy.net) is a linktree alternative - [FrontPage](https://frontpage.fyi/?ref=thenexusofprivacy.net) is a link aggregator ## And ... These are only the tip of the iceberg. Here's briefer summaries of a few other good things happening. - Erin Kissane is starting a new project addressing the key problem of helping people find a fediverse instance that's a good match. Kissane's [Blue skies over Mastodon](https://erinkissane.com/blue-skies-over-mastodon?ref=thenexusofprivacy.net), [The affordance loop](https://erinkissane.com/the-affordance-loop?ref=thenexusofprivacy.net), and [Mastodon is easy and fun except when it isn't](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=thenexusofprivacy.net) are essential reading for understanding the challenges newcomers to the ActivityPub Fediverse face, and the [Governance on Fediverse Microblogging Servers](https://fediverse-governance.github.io/?ref=privacy.thenexus.today) she co-authored with Darius Kazemi is chock full of insights as well, so I'm very excited to see what she comes up with. [how to buy shoes in the fediverse](https://www.wrecka.ge/fediverse-shoes/?ref=thenexusofprivacy.net) and [revealing the fediverse’s gifts](https://www.wrecka.ge/revealing-the-gifts/?ref=thenexusofprivacy.net) have more on her new project. - [Weird](https://weird.one/?ref=thenexusofprivacy.net) is making a prosocial network based on personal websites and the combined principles of local-first and peer-to-peer. They're using the Leaf Protocol (based on Willow), and it's great to see explorations of complements to ActivityPub. - Educational micro-blogging charity [Newsmast Foundation](https://www.newsmastfoundation.org/?ref=thenexusofprivacy.net) is doing very interesting work Channel.org, a non-profit membership service that leverages their Patchwork Mastodon fork to "help organisations take ownership of their presence, content and communities on the web." [Michael Foster's FediForum demo](https://www.youtube.com/watch?v=K5KXcPZZORg&ref=thenexusofprivacy.net) is a good overview, and [“We can have a different web, if we want it”](https://www.blog-pat.ch/a-different-web/?ref=thenexusofprivacy.net) is the most recent status. - Flipboard has brought [The 19th](https://flipboard.com/@19thnews?ref=thenexusofprivacy.net), [AssociatedPress](https://flipboard.com/@AssociatedPress?ref=thenexusofprivacy.net), [NPR](https://flipboard.com/@npr?ref=thenexusofprivacy.net), [Scientific American ](https://flipboard.com/@SciAm?ref=thenexusofprivacy.net)and hundreds of other well-known publishers to the Activity Fediverse, making progress on one a longstanding problem. Of course, plenty of people don't want *any* existing corporate social networks as part of their Fediverse experience ... for those who are okay with it, though, there's now access to a lot more media. And while Meta's entry into the Fediverse has sparked strong opposition, there's been a lot less pushback to Flipboard. - [Loops](https://loops.video/?ref=thenexusofprivacy.net), a new short video sharing app from Pixelfed, has just entered beta – as far as I know, it's the first TikTok-like or Vine-like app in the Fediverse. With TikTok [laying off moderators](https://www.reuters.com/technology/bytedance-cuts-over-700-jobs-malaysia-shift-towards-ai-moderation-sources-say-2024-10-11/?ref=thenexusofprivacy.net) (as they increasingly rely on racist, ineffective AI moderation), and the threat of a TikTok ban in the US, it's good timing! - [Bandwagon](https://bandwagon.fm/?ref=thenexusofprivacy.net), an open community for musicians and fans, has a chance to fill a major void as Bandcamp continues to deteriorate – and is built on [Emissary](https://wedistribute.org/2024/04/emissary-social-web/?ref=thenexusofprivacy.net), one of several new platforms and toolkits that could potentially make it easier for people to build ActivityPub-based applications. **Update, January 2025**: [The Indie Beat Radio](https://theindiebeat.fm/?ref=thenexusofprivacy.net) just launched, and federates with Bandwagon.fm to amplify its music artists who’ve opted-in to distribution – as well as also playing music in the public domain. [Opt-in consent FTW!](https://thenexusofprivacy.net/consent-for-fediverse-developers/) [Kristen Lambertsen](https://mastodon.social/@mizkirsten?ref=thenexusofprivacy.net) describes it as "a way to amplify independent artists who host their music in the fediverse. The goal is that you’ll listen, discover new artists, and then mix your own playlists that you’ll share." **Update, April 2025**: there's a lot of energy in this space! See [fedivision.party](https://fedivision.party/?ref=thenexusofprivacy.net) (with the Hall of Fame of the first four years of the fediverse-wide FediVision song contest), [The Social Music Network](https://the.socialmusic.network/?ref=thenexusofprivacy.net) and Luka Prinčič's [#BeYourOwnPlatform](https://beyourownplatform.site/?ref=thenexusofprivacy.net) for a lot more! - Faircamp is another Bandcamp alternative, and [a recent proof of concept integration into Hubzilla](https://im.allmendenetz.de/channel/chris?mid=05e986d4-7a15-4171-a24a-c9b0647eed45&ref=thenexusofprivacy.net) shows how it too can be brought into the Fediverse. Hubzilla has been around since 2012, when it started as a fork of Friendica; Sean Tilley's [The Do-Everything System](https://medium.com/we-distribute/the-do-everything-system-an-in-depth-review-of-hubzilla-3-0-692204177d4e?ref=thenexusofprivacy.net) (from 2018) highlights some of its functionality. Hubzilla recently released Version 9.4, and [new third-party themes](https://neuhub.org/item/e22a7874-d805-4b11-a509-c635343263ec?ref=thenexusofprivacy.net) are on track to improving the user experience. - And speaking of new releases, [Mastodon 4.3 is out](https://blog.joinmastodon.org/2024/10/mastodon-4.3/?ref=thenexusofprivacy.net)! Even though t took a lot longer than expected (a year since 4.2), it contains some valuable improvements. Notification filtering could help cut down some important harassment vectors. Grouped notifications are a usability plus. [Author tags](https://rknight.me/blog/setting-up-mastodon-author-tags?ref=thenexusofprivacy.net) are valuable for journalists and bloggers (including me!). Improvements to follower recommendations might help address onboarding problems (although given Mastodon's demographic skew, could in practice mostly be "white guys"). There are also a bunch of usability improvements to moderation tools, hopefully an areas that will get even more attention in the future. There really is a lot of good stuff going on! ## Previous posts in the *Golden opportunities for the fediverse – and whatever comes next* series - [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) - [Blocklists in the fediverse](https://thenexusofprivacy.net/blocklists-in-the-fediverse/) - [It’s possible to talk about The Bad Space without being racist or anti-trans – but it’s not as easy as it sounds](https://thenexusofprivacy.net/the-bad-space/) - [Compare and contrast: Fediseer, FIRES, and The Bad Space](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/) - [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/) - [Eight tips about consent for fediverse developers](https://thenexusofprivacy.net/consent-for-fediverse-developers/) - [5 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) - [I for one welcome Bluesky, the ATmosphere, BTS ARMY, and millions of Brazilians to the fediverses!](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/) - [Is Bluesky part of today’s Fediverse?](https://thenexusofprivacy.net/is-bluesky-part-of-todays-fediverse/) - [The Social Web Foundation and the elephant in the federated room](https://thenexusofprivacy.net/swf-and-the-meta-elephant/) - [More questions than answers: another post about the Social Web Foundation and the fediverses](https://thenexusofprivacy.net/swf-questions/) ## Notes 1 If anybody from blahaj.zone sees this, no need to worry, I'll stay active there as well: the software's sometimes buggy, but the admins and community are *great* and that's what matters most to me. Similarly, the Nexus of Privacy's infosec.exchange account will continue to be the primary one for now; infosec.exchange is well-connected, including to Bluesky via Bridgy Fed (which doesn't work yet with GoToSocial), and a good place for a privacy newsletter. One of the great things about the fediverse is that you can have accounts on multiple instances, and I take full advantage of that! ### 9 things the Social Web Foundation could do to prioritize safety (if they decide they want to) URL: https://thenexusofprivacy.net/swf-safety/ Last updated: 2026-04-16T03:21:32.000Z > Join the discussion [on Bluesky](https://bsky.app/profile/thenexusofprivacy.net/post/3l74p2wmzey2m?ref=thenexusofprivacy.net), [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/113341516261682382?ref=thenexusofprivacy.net) and [lemmy.blahaj.zone](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net)! *A followup to* [*More questions than answers: another post about the Social Web Foundation and the fediverses*](https://thenexusofprivacy.net/swf-questions/) *– and to* [*Steps towards a safer fediverse*](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/)*. Originally published as a draft Octover 16; see the* [*update log*](#update-log) *below for details.* **Contents** - Intro - [Commit to spending at least X% on safety](#commit) - [Support diverse participation on the W3C standards group's Trust and Safety task force](#task-force) - [Focus on consent-based tools and infrastructure](#consent) - [Work with people who are targets of harassment to develop tools for collaborative defense](#collaborative-defense) - [Support threat modeling work](#threat-modeling) - [Develop automated tools to help moderators](#automated-tools) - [Do any AI-related work in partnership with AI researchers who take an anti-oppressive, ethics-and-safety-first approach](#ai) - [Partner with IFTAS](#iftas) - [And ...](#and) > "\[E\]ven though millions of people left Twitter in the last two years – and millions more are ready to move as soon as there's a viable alternative – the ActivityPub Fediverse isn't growing. One reason why: today's Fediverse is unsafe by design and unsafe by default – especially for Black and Indigenous people, women of color, LGBTQIA2S+ people, Muslims, disabled people and other marginalized communities." > > – [Mastodon and today’s ActivityPub Fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/), 2023 > "The Social Web Foundation is our best chance to establish the conditions in which the new social media operates with zero harm." > > – SWF Executive Director Mallory Knodel, [Announcing the launch of Social Web Foundation](http://www.apc.org/en/blog/announcing-launch-social-web-foundation?ref=thenexusofprivacy.net) There's a lot to say about the new Social Web Foundation (SWF). [**T**he Social Web Foundation and the elephant in the federated room](https://thenexusofprivacy.net/swf-and-the-meta-elephant/) included quotes from the coverage of their initial launch, and highlighted the potential upsides ***if*** they evolve in the right ways. That post then went into detail on the tradeoffs related to their engagement with Meta, who's reportedly contributing at least some of the $1 million in initial funding SWF is "closing in on" (whatever that means). But Meta's only one of the hot-button issues SWF critics have spotlighted, and [More questions than answers: another post about the Social Web Foundation and the fediverses](https://thenexusofprivacy.net/swf-questions/) started broadening the focus on other open questions ... like whether SWF will focus on safety. Today's ActivityPub Fediverse still isn't growing, and safety continues to be a problem. It's not hopeless, and there are some very encouraging signs of progress.[1](#notes) Still, there's a lot more to be done. SWF's mission talks about a "growing, healthy" Fediverse, but their initial plans don't seem to be paying much attention to the "healthy" part. For example: - SWF's initial list of projects doesn't include anything addressing current Fediverse safety issues.2 - As far as I know, none of SWF's advisors are safety experts, and IFTAS' Jaz-Michael King is the only one of their launch partners who has a history of prioritizing safety. - SWF's list of launch partners didn't included any of the safety-focused software projects I mentioned in footnote [1](#notes). Meta's involvement with SWF adds to the concerns. Once Threads turns on two-way federation, there are some acute potential safety threats in the rest of the Fediverse – especially looking at [Meta's failure to moderate extreme anti-trans hate](https://glaad.org/smsi/report-meta-fails-to-moderate-extreme-anti-trans-hate-across-facebook-instagram-and-threads/?ref=thenexusofprivacy.net). But Meta's supporters have mostly dismissed these fears with vague claims that "we have the tools". Yeah right. And earlier this year, Meta's Rachel Lambert and Peter Cottle talked about the possibility of offering their ineffective racist, anti-LGBTQIA2S+, Islamophobic automated AI-based moderation tools to the rest of the Fediverse. SWF's research director Evan Prodromou is a big fan of AI-based moderation; in his recent book on ActivityPub, for example, most of the very very limited discussion of moderation similarly talks about the potential for AI., "[3](#fn-ai) What could possibly go wrong? Of course, as I said an earlier post > "\[N\]othing's set in stone at this point. Most non-profits' initial projects, program, staffing, network of participants, and even mission evolve. My guess is that'll be the case for SWF as well." So *if* SWF decides they *do* want to focus on safety – and do it in a way that avoids making the Fediverse's equity problems worse and helping Meta more than people in the Fediverse – here's some ideas ## Commit to spending at least X% on safety On SocialHub, SWICG Trust & Safety Task Force lead Emelia Smith's suggested that SWF should commit to devote at least X% of its resources to safety. That would be a good first step, and if X% is high enough it would send important signal they intend to prioritize this issue. > Note to any of SWF's current and potential funders who happen to read this: commiting to spend X% of your fediverse budget on safety is a good idea for you too! Whatever SWF decides to do on this front, directly funding safety-oriented projects and organizations will complement SWF's efforts. As Samantha Lai and Yoel Roth highlight in [Online Safety and the “Great Decentralization” – The Perils and Promises of Federated Social Media](https://techpolicy.press/online-safety-and-the-great-decentralization-the-perils-and-promises-of-federated-social-media?ref=thenexusofprivacy.net), "Funding is the most urgent gap." What should X be? In [a Mastodon poll](https://infosec.exchange/@thenexusofprivacy/113315331877238065?ref=thenexusofprivacy.net) I did, most people suggested 25% or 50% would be reasonable, although many thought that it should be even higher. Of course, there were only about 45 responses to the poll, so take it with a grain of salt, but it's still an interesting data pont. ## Support diverse participation on the W3C standards group's Trust and Safety task force On SocialHub, Evan mentioned that "[SWF is going to support my work (and others’) at the W3C on ActivityPub](https://socialhub.activitypub.rocks/t/socialwebfoundation-what-do-people-think/4564/33?ref=thenexusofprivacy.net)". The new SWICG Trust and Safety task force is a great place to focus these resources. Diverse participation in this effort vital ... and, it's not realistic to ask marginalized people to volunteer in situations where others (like the many SWICG members employed by tech companies where participation is part of their job) are getting paid for their time. ## Focus on consent-based tools and infrastructure Consent is a core value of much (although certainly not all!) of the ActivityPub Fediverse – and, as [Eight tips about consent for fediverse developers](https://thenexusofprivacy.net/consent-for-fediverse-developers/) discusses, a great opportunity for a potential competitive advantage. But consent-based tools and infrastructure historically haven't gotten a lot of attention in the ActivityPub Fediverse. ## Work with people who are targets of harassment to develop tools for collaborative defense Tools on other platforms like [Block Party](https://www.blockpartyapp.com/how-it-works/?ref=privacy.thenexus.today) and [Filter Buddy](https://shagunjhaver.com/research/articles/jhaver-2022-filterbuddy/jhaver-2022-filterbuddy.pdf?ref=privacy.thenexus.today) that allow for collaborative defense against harassment and toxic content, and could also apply in a federated context – initially as standalone tools if necessary, but ideally integrated into existing apps and web UIs. The developers of both of those tools are on the Fediverse, and might well be willing to help. And (not to sounds like a broken record) both Block Party and Filter Buddy highlight that tools designed and implemented by (and working with) marginalized people who are the targets of so much of this harassment today are likely to be the most effective. ## Support threat modeling work Threat modeling is an important technique for improving safety (and security, privacy) that is only rarely used in the Fediverse. [Improving privacy and safety in fediverse software](https://thenexusofprivacy.net/ipsfs-nlnet/) sketehes what a potential project could look like, and also includes the important point that > "*Threat modeling needs to be done from multiple perspectives, so it's crucial that participants and experts include people of color, women, trans and queer people, disabled people, and others whose safety is most at risk – and especially people at the intersections."* ## Develop automated tools to help moderators Automated tools can potentially be incredibly valuable for moderation and other aspects of trust and safety. Even simple tools can help diminish repetitive tasks and reduce the load on moderators; the r/AskHistorians team that Sarah Gilbert describes in [Towards Intersectional Moderation: An Alternative Model of Moderation Built on Care and Power](https://arxiv.org/pdf/2305.11250?ref=thenexusofprivacy.net) makes extensive use of basic pattern-matching tools. Basic statistical models and counter/frequency based logic are also useful. There's clearly a lot of low-hanging fruit here! ## Do any AI-related work in partnership with AI researchers who take an anti-oppressive, ethics-and-safety-first approach Even though I'm very skeptical about the racist, sexist, anti-LGBTQIA2S+, Islamophobic (etc) AI technologies that Meta and others have adopted today, and the exploitative and non-consensual data Meta and others have used to create the underlying racist, sexist, anti-LGBTQIA2S+ (etc) models that power them, there are a lot of great AI researchers in the Fediverse who take an anti-oppressive, ethics-and-safety-first approach – like Dr. Timnit Gebru and the rest of DAIR Institute. So there's a real opportunity here to do it right. ## Partner with IFTAS IFTAS (a non-profit that focuses on federated trust and safety) is a SWF launch partner, but there hasn't been any discussion of concrete plans. Of course I might be biased here (I'm on IFTAS' Advisory Board) ... still, it seems to me that if SWF can use their connections with their corporate and foundation funders to help unlock additional funding for IFTAS, it could magnify the impact of both organizations – as well as address concerns I've heard from several trust and safety folks that SWF will unintentionally wind up competing with IFTAS for the same pool of funding. ## And ... These are only the tip of the iceberg. [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/) talks explores potential improvements in SWF's focus areas of people, protocols, and plumbing at length, and [Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/) includes some recommendations for dealing with some aspects of the threat from Meta. And I'm not the only one with opinions! In [Online Safety and the “Great Decentralization” – The Perils and Promises of Federated Social Media](https://techpolicy.press/online-safety-and-the-great-decentralization-the-perils-and-promises-of-federated-social-media?ref=thenexusofprivacy.net), for example, Lai and Roth suggest that "larger platforms could straightforwardly share information about the moderation decisions they’ve already made." Of course, there's a big red flag here: many of Meta's moderation decisions are racist, sexist, anti-LGBTQIA2S+, Islamophobic, and favor authoritarian governments. Still, there's certainly room for significant progress in information sharing, and building on and reinforcing existing work such as [FediMod FIRES](https://fires.fedimod.org/?ref=thenexusofprivacy.net) could be a way to have significant impact. Of course, these are far from the only ideas ... and SWF's budget isn't big enough to fund *everything*. But there certainly is no shortage of worthwhile projects, so let's hope they fund at least *some* of them! And let's also hope that whatever SWF winds up doing in this area, they're approach it as something that benefit *everybody*, not just Meta-friendly instances and the corporate fediverse. ## Notes 1 For example: - GoToSocial has just released support for [interaction controls](https://docs.gotosocial.org/en/latest/user%5Fguide/settings/?ref=thenexusofprivacy.net#default-interaction-policies). - Bonfire is doing interesting work on [Prosocial Design Patterns](https://bonfirenetworks.org/posts/content%5Flabelling%5Fin%5Fbonfire/?ref=thenexusofprivacy.net). - Letterbook is [focusing on moderation upfront](https://research.letterbook.com/index.php?r=survey/index&sid=318578&lang=en&ref=thenexusofprivacy.net) (perhaps a first in the fediverses' history). - "[Island networks](https://writer.oliphant.social/oliphant/islands?ref=thenexusofprivacy.net)" like [The Website League](https://websiteleague.org/?ref=thenexusofprivacy.net) are taking a consent-based allow-list approach to federation. - The SWICG standards group has formed a [trust and safety task force](https://github.com/swicg/activitypub-trust-and-safety?ref=thenexusofprivacy.net) - [IFTAS](https://about.iftas.org/?ref=thenexusofprivacy.net) (a federated trust and safety non-profit where I'm an advisor) is having an impact in several areas including the [IFTAS Connect moderator community](https://about.iftas.org/2024/05/29/iftas-connect-a-community-for-fediverse-moderators/?ref=thenexusofprivacy.net) and [resource library](https://connect.iftas.org/library/?ref=thenexusofprivacy.net), 3 Prodromou's current employer OpenEarthFoundation is building a platform to empower cities to decarbonize with AI and data-driven solutions, and he previously founded fuzzy.ai, a developer-focused AI company, so it's not surprising that he'd favor this direction. As far as I know though he's never discussed potential solutions for the biases and ineffectiveness of today's AI-based moderation systems. 2 SWF does have a project focusing on end-to-end encryption (E2EE) in ActivityPub, presumably a followup to the work that Research Director Evan Prodromou and Product Director Tom Coates did on ths topic over the summer, funded by Ethereum Project. E2EE's a very good thing of course, but almost nobody I talk to thinks E2EE will help address the ActivityPub Fediverse's current safety problems. In a [comment on SocialHub](https://socialhub.activitypub.rocks/t/socialwebfoundation-what-do-people-think/4564/24?u=jdp23&ref=thenexusofprivacy.net), Prodromou's said his [user interface research incremental extensions to the Mastodon UI](https://evanp.me/2023/05/15/re-designing-the-mastodon-user-interface-for-better-personal-relationships/?ref=thenexusofprivacy.net) shows that the lack of E2EE is a big inhibitor for people to use DMs at all, and that DMs are a crucial part of the stack for having real, human relationships happen on the Fediverse" so perhaps SWF sees this as a growth strategy. But from a safety perspective, people who need secure DMs should use Signal, not the Fediverse, and adding E2EE to software that isn't designed with a security mindset doesn't actually led to secure communications. ## Update log October 14: initial limited-distribution unpublished draft October 16: published as draft, with title "Will the Social Web Foundation prioritize safety?" October 17-19: incorporating feedback on draft, thanks all! October 20: published for reals, with a new title. ## Image credit "Safety First" by [Ricardo Wong](https://www.flickr.com/photos/deadair/?ref=thenexusofprivacy.net), via [Flickr](https://www.flickr.com/photos/deadair/238898376?ref=thenexusofprivacy.net) ### More questions than answers: another post about the Social Web Foundation and the fediverses URL: https://thenexusofprivacy.net/swf-questions/ Last updated: 2026-04-16T03:21:07.000Z > Join the discussion in the Fediverse on [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/113304045145860277?ref=thenexusofprivacy.net) or [lemmy.blahaj.zone](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net)! *Part 4 of* [*I for one welcome Bluesky, the ATmosphere, BTS Army, and millions of Brazilians to the fediverses!*](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/) > "The Social Web Foundation’s mission is a growing, healthy, financially viable and multi-polar Fediverse” > > – [SWF mission ](https://socialwebfoundation.org/mission/?ref=thenexusofprivacy.net) > "My personal view is that **if** SWF can evolve in a way that addresses its initial problems, it could wind up being a very good thing for the fediverses.... > > Then again, there are are quite a few **if*s here*, and a lot of open questions SWF needs to address, so it might not work out that way." > > – me, in [**T**he Social Web Foundation and the elephant in the federated room](https://thenexusofprivacy.net/swf-and-the-meta-elephant/) (the previous post in this series) In the previous post, I (somewhat cautiously) welcomed the new, corporate-funded Social Web Foundation (SWF) to the fediverses. Unsurprisingly, not everybody sees it that way. The bulk of that post discussed the differences of opinion in the ActivityPub Fediverse about if and how SWF should engage with their launch partner Meta, but that's far from the only issue. Critics also bring up a lot of good other points about SWF's mission, initial projects and program, advisors, and partners ... Still, my view is that SWF could potentially have a very positive impact for the fediverses as a whole (not just the corporate fediverse, and not just Meta) *if* they - prioritize equity and safety - act transparently enough and introduce enough oversight to build trust that they're not jusr serving their corporate masters - align with positive values of the ActivityPub Fediverse like consent and a pro-LGBTQIA2S+ focus (and make an effort to counter less-positive values like racism, sexism, and Islamophobia) - broaden their scope to include deepening connections and leveraging synergies between fediverses such as Bluesky and the ATmosphere - focus on trust and safety in ways that don't reinforce Meta's strategy Then again, it's possible that SWF won't evolve. That would be good for Meta, but not so good for anybody else. Oh well. Even in that case, I think SWF will catalyze valuable changes in the fediverses ... but it would certainly be a missed opportunity. So it's worth thinking about how to increase the chances of a better positive outcomes. And evolution is certainly needed. For example: - SWF's initial projects don't include anything focused on safety. - Despite the positive quotes in SWF's launch post from partners Eugen, Rob, Matthias, Mike, Jaz-Michael, Jon (not me, a different Jon), Bart, John, and Matt (and posts their from advisors Ben, Johannes, Chris, and another Chris that SWF co-founder Evan linked to in his [Launch link round-up](https://socialwebfoundation.org/2024/09/29/launch-link-round-up/?ref=thenexusofprivacy.net)), there hasn't been much discussion of equity issues. - Many people clearly don't trust SWF. How will SWF change those dynanics? The good news is that there are straightforward things SWF could do make progress on these and other issues from the launch. I'm sure others have ideas as well! In her [newsletter](https://internet.exchangepoint.tech/social-web-foundation/?ref=thenexusofprivacy.net), SWF Executive Directory Mallory Knodel talked about doing a listening tour. It'll be interesting to see who she talks to, what she learns, how much power the funders give her to influence the organization's structure and priorities, and what changes as a result. This post, along with looks at some of the key questions SWF needs to address – and opportunities if they do. That said, SWF's launch also sparks a lot of questions for others in the fediverses ... so that's where I'll start. Like the title says, there are more questions than answers at this point. But these are questions worth thinking about, not just in terms of reactions to SWF, but also more generally! > Note: [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) discusses the terminology I'm using here – but there's no need to wallow in the details unless you're into it. A fediverse is a decentralized social network. Different people mean different things by "the Fediverse" (and [Definitions of "the Fediverse"](https://nexusofprivacy.net/is-bluesky-part-of-todays-fediverse/?ref=thenexusofprivacy.net#defining-the-fediverse) goes into a lot more detail for your wallowing pleasure). Since 2018 or so most people have used "the Fediverse" as a synonym for the ActivityPub-centric Fediverse ... although that may be changing: the tech press increasingly considers Bluesky part of "the Fediverse". ## Questions, questions, questions ![trwnh: The ultimate takeaway of this entire thread should not be to spend our time endlessly putting the SWF under the microscope, or to stop at simply expressing these concerns. The ultimate takeaway is: what are you going to do about it?](https://thenexusofprivacy.net/content/images/2024/10/what-are-you-going-to-do-about-it.png) [a](https://trwnh.com/?ref=thenexusofprivacy.net), in [an intense discussion about SWF](https://socialhub.activitypub.rocks/t/socialwebfoundation-what-do-people-think/4564?ref=thenexusofprivacy.net) on SocialHub Before we get to SWF's perspective, I very much agreed with [a](https://trwnh.com/?ref=thenexusofprivacy.net) about the key takeaway from the [intense discussion](https://socialhub.activitypub.rocks/t/socialwebfoundation-what-do-people-think/4564?ref=thenexusofprivacy.net) on SocialHub. So let's start this post with some thoughts on that front. One thing that I'm seeing a lot of ActivityPub developers concerned about SWF already doing is voting with their feet, or at least exploring it, and looking at other protocols and multi-protocol solutions. Like I said above, I see that as a good thing. The SWICG standards group is making progress, but ActivityPub has a lot of long-standing issues – and there's the threat of Meta embracing and extending. What else to do? Like I said, there are a lot more questions than answers at this point – although I'm certainly looking forward to hearing what people have to say. These aren't the only possible questions, of course, and other suggestions are welcome as well! ### For people who think SWF is (mostly) a good thing - How to help? - How to get more and broader community involvement with SWF? - What are the opportunities for short-term steps that could help allay concerns? - What need to change? - How to influence SWF? ### For people who are concerned about SWF and/or Meta - What changes could SWF make that could address concerns about its alignment with Meta and/or corporate interests more generally? What kind of feedback needs to be given and what kinds of pressure needs to be put on who to make that happen? - How could SWF evolve in a way that benefit (and change the power dynamics of) the entire ecosystem – or is that even possible? - How to counter an embrace-and-extend maneuver by Meta, whether or not SWF’s a part of it? - Many see SWF’s attempted hijacking of the term “social web” as problematic. How to put out a counter narrative that gets traction in the fediverses and in the tech press? Alternatively, since Google, Facebook, and big tech companies have been trying to push the "open social web" since 2007, is their some other less-corporate terminology to use instead? - What to do if SWF *doesn’t* evolve? ### For developers thinking of different protocols and/or multiple-protocol solutions (whether it’s because you’re concerned about threats to ActivityPub or just see it as time to explore something new) - How to work together to make progress and build momentum? - What are some of the interesting protocols to look at today, and where are the gaps? - What are the learnings from ActivityPub, both in terms of areas to improve and in terms of what's good about it? ### For Bluesky and the ATmosphere - If SWF succeeds, what opportunities does that open up for collaboration across the fediverses? - If SWF fails to evolve, how can Bluesky and the ATmosphere capitalize? - Bluesky's a much bigger player in the ATmosphere than Meta (or anybody else) is in the ActivityPub Fediverse. Is a multi-polar non-profit a useful technique for the ATmosphere as well? If so, what to learn from SWF's launch, both in terms of what's going well, and what could be better? - AT has a lot of advantages over ActivityPub for all-public social networks, but doesn't yet include anything similar to ActivityPub's scoped visibiilty. With so many people concerned about ActivityPub's direction (and Meta's potential dominance of the ActivityPub Fediverse), does it make sense for ATmosphere developers (and maybe even Bluesky) to prioritize moving beyond its initial all-public focus? ### For people organizing and developing for [free fediverses](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) (defined in opposition to surveillance capitalism) that prioritize justice, equity, diversity, and inclusion - SWF highlights the willingness of many fediverse influencers and the ActivityPub power structure to embrace Meta. How to leverage this to reinforce oppositional efforts, and build parallel power bases? - What opportunities does a multi-protocol approach open up? - What (if any) engagement with multi-polar, Meta-friendly organizations like SWF makes sense in various situations – and how to build spaces and organizations that *don't* engage? - What (if any) levels of engagement with fascists, racists, terfs, etc makes sense in various situations – and how to build and encourage more spaces that *don't* allow them? - How to get from the fediverses' history of anti-Blackness, anti-Indigeneity, sexism (etc) – and the skewed demographics – to create a movement that's intersectionally diverse, inclusive, focused on equity and justice? - Where and how to organize? ## Questions for SWF ### Trust [![86%: SWF should be fully transparent about all corporate and foundation funding. 6%SWF should be transparent about funding from Meta and Ford Foundation, but not necessarily others. 8%: SWF should wait until the legally-required form 990 to be transparent about funding](https://thenexusofprivacy.net/content/images/2024/10/swf-transparency-poll.png)](113278692890275790) [A Mastodon poll](https://infosec.exchange/@thenexusofprivacy/113278692890275790?ref=thenexusofprivacy.net) There are a lot of different reasons people don't trust SWF. Two of their co-founders are new to the fediverse. The third is polarizing, and seen by many (including me) as a self-promoter and in Meta's pocket. The lack of transparency about their initial funding or processes highlights concerns. What, if anything, will SWF do to try to earn trust? A few specific questions: - What oversight is in place to ensure that SWF's efforts benefit the broader fediverse, not just its corporate funders? - With Meta as a patron, why should anybody trust SWF? - How much of SWF's support is from Meta? - Will SWF's founders primarily direct funding to projects they benefit from? ### Safety > "SWF's mission talks about a "growing, healthy" Fediverse, but their initial plans don't seem to be paying much attention to the "healthy" part." > > – [9 things the Social Web Foundation could do to prioritize safety (if they decide they want to)](https://thenexusofprivacy.net/swf-safety/) - Will SWF prioritize safety? - If so, will they do it in a way that helps everybody in the ActivityPub Fediverse? - How much of SWF's budget will go to projects that help address current fediverse safety issues? - Will SWF add trust and safety experts as advisors? - How much will SWF focus on AI moderation – and will they do it in a way that avoids the racism, anti-LGBTQIA2S+ discrimination, Islamopobia and other problems with today's ineffective AI moderation tools? ### Equity and diversity - Will SWF prioritize equity and diversity? - SWF's initial advisors are overwhelmingly cis, white, and male. Will that change? - SWF doesn't have any Black or Indigenous people involved, or any women of color. Will that change? - How much of the money SWF raises will go to cis, white, and male people? ### ## Update log October 24: add section on safety with link to [9 things the Social Web Foundation could do to prioritize safety (if they decide they want to)](https://thenexusofprivacy.net/swf-safety/) January 2025: added sections on Trust and Equity and diversity ### The Social Web Foundation and the elephant in the federated room URL: https://thenexusofprivacy.net/swf-and-the-meta-elephant/ Last updated: 2026-04-16T03:20:48.000Z *Part 3 of* [*I for one welcome Bluesky, the ATmosphere, BTS Army, and millions of Brazilians to the fediverses!*](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/)*.* *Last updated October 14 – see the* [*update log*](#update-log) *at the bottom for details.* > "In a gesture that’s been a long time coming, [Evan Prodromou](https://evanp.me/?ref=thenexusofprivacy.net), co-author of the [ActivityPub](https://activitypub.rocks/?ref=thenexusofprivacy.net) protocol, has launched [The Social Web Foundation](https://socialwebfoundation.org/2024/09/24/launch/?ref=thenexusofprivacy.net)." > > – Sean Tilley, [Evan Prodromou Launches The Social Web Foundation](https://wedistribute.org/2024/09/social-web-foundation-launch/?ref=thenexusofprivacy.net) > "The Social Web Foundation’s mission is a growing, healthy, financially viable and multi-polar Fediverse” > > – [SWF mission ](https://socialwebfoundation.org/mission/?ref=thenexusofprivacy.net) > "The Social Web Foundation (SWF) has some backing from Meta as well, alongside other major implementors of the ActivityPub protocol, including the social magazine app Flipboard, newsletter platform Ghost, Mastodon, and others. The Ford Foundation has also offered the organization a large grant to get the project started. In total, SWF is closing in on $1 million in financial support." > > – Sarah Perez, [As the open social web grows, a new nonprofit looks to expand the ‘fediverse'](https://techcrunch.com/2024/09/24/as-the-open-social-web-movement-grows-a-new-nonprofit-launches-to-expand-the-fediverse/?ref=thenexusofprivacy.net), *TechCrunch* ***Contents*** - Intro - [Let's talk about Meta](#meta) - [Meanwhile, back in reality ...](#reality) - [SWF could potentially be a useful counterweight to Meta (although I'm not holding my breath)](#counterweight) - [There are many different ways to engage](#engage) - [SWF and the Schism Within the Fediverses](#schism) - [To be continued!](#to-be-continued) One way to look at SWF is companies who have placed a bet on ActivityPub trying to respond to the momentum of Bluesky and in the ATmosphere, fediverses that use the newer AT protocol instead of ActivityPub. But as I'll discuss in an upcoming post, there are also a lot of exciting things happening in the ActivityPub Fediverse. I think SWF is likely to be a net positive as well – at least for the corporate fediverse, and *if* SWF evolves in the right ways, maybe also for the free fediverses trying to build alternatives to surveillance capitalism. Three big reasons: - SWF's Executive Director Mallory Knodel has a background in feminist technology and human rights work; see for example [Article-19 Activists Mallory Knodel and Ulrike Uhlig Reimagine the Internet](https://nostarch.com/blog/wmh-knodel-uhlig?ref=thenexusofprivacy.net) and her Linux Foundation Keynote (with Larry Kunz) on [Making Tech– and the World– More Diverse, Equitable, and Inclusive](https://www.youtube.com/watch?v=vyxEy9--iLA&ref=thenexusofprivacy.net). These are certainly perspectives we need more of the fediverses (and everywhere else too). - Some of the issues SWF is focusing on are indeed big challenges for the ActivityPub fediverse, so there are plenty of opportunities for impact. - Even if SWF *doesn't* evolve (or worse, becomes a pawn of its corporate masters) and the opportuinities are missed, it's still likely to catalyze useful changes in the fediverses. In fact, there are already some positive impacts. So I for one (somewhat cautiously) welcome the Social Web Foundation to the fediverses! > Note: [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) discusses the terminology I'm using here – but there's no need to wallow in the details unless you're into it. A fediverse is a decentralized social network. Different people mean different things by "the Fediverse" (and [Definitions of "the Fediverse"](https://nexusofprivacy.net/is-bluesky-part-of-todays-fediverse/?ref=thenexusofprivacy.net#defining-the-fediverse) goes into a lot more detail for your wallowing pleasure). Since 2018 or so most people have used "the Fediverse" as a synonym for the ActivityPub-centric Fediverse, although that may be changing – the tech press increasingly considers Bluesky part of "the Fediverse". As always, opinions differ in the fediverse – and [opinions especially differ](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) about SWF's launch patner Meta and their plans to [embrace, extend, and exploit the ActivityPub Fediverse](https://thenexusofprivacy.net/embrace-extend-and-exploit/). So not everybody is so welcoming to SWF. And Meta's certainly not the only concern; the critics also bring up a lot of other good points ... which is why my welcome to SWF is also tinged with caution. Still, let's look at the potential upsides *if* SWF can evolve in the right ways. - Most obviously, the corporate fediverse could get a lot of value from SWF's"[Big Fedi"](https://thenexusofprivacy.net/the-annotated-case-for-a-big-fedi/) approach of prioritizing growth and improving onboarding (a huge challenge in the ActivityPub Fediverse) *if S*WF also prioritize safety. - A multi-polar counterweight to Meta will certainly be very useful for everybody else in the corporate fediverse, *if* SWF can act transparently enough and introduce enough oversight to build trust that they're not just operating on Meta's or some other funders'behalf. - *If* SWF aligns with positive values of the ActivityPub Fediverse like consent, support for LGBTQIA2S+ people, and accessibility (and makes an effort to counter less-positive values like racism, sexism, and Islamophobia), and *if* SWF doesn't limit the benefits of its work to only helping its corporate masters, it could also help others in the broader ActivityPub Fediverse – perhaps even the ["free fediverses](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)", opposed to surveillance capitalism. - *If* SWF broadens their scope to include deepening connections and leveraging synergies between fediverses, Bluesky and the rest of ATmosphere (the AT-based fediverse) could benefit. *If S*WF also focuses on safety and equity, it could be an even bigger win – for example by combining the perspectives and approach to community Rudy Fraser discusses in [Blacksky: Expressing the Black Everyday in a New Digital Space](https://blog.rudyfraser.com/blacksky-part-one/?ref=thenexusofprivacy.net) with the scoped-visibility and consent-focused approaches that the ActivityPub Fediverse has explored and continues to break new ground in. - There are also natural synergies with across fediverse *if* SWF focuses on trust and safety in ways that don't reinforce Meta's strategy. As I said in [The free fediverses should work together with people and instances in Meta’s fediverses and on Bluesky whose goals and values align](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#work-together) > "Moderation on decentralized networks is a shared challenge." Then again, there are quite a few *ifs here*, and a lot of open questions SWF needs to address ... so it might not work out that way. For example, SWF's initial projects ignore safety; and while Evan's done a lot of work on decentralized social media over the years, as far as I know almost none of it has focused on safety. And looking at equity, SWF's launch post has quotes from partners Eugen, Rob, Matthias, Mike, Jaz-Michael, Jon (not me, a different Jon), Bart, John, and Matt ... and their [Launch link round-up](https://socialwebfoundation.org/2024/09/29/launch-link-round-up/?ref=thenexusofprivacy.net) has posts from advisors Ben, Johannes, Chris, and another Chris. Hey wait a second, I'm noticing some patterns here! So it's also possible that SWF won't evolve. That would be good for Meta (their two best outcomes are a puppet non-profit they can use ... or an ineffectual non-profit that does nothing to prevent their dominance of ActivityPub and leaves the corporate fediverse at their mercy) but not so good for everybody else. Oh well. If that happens, it'll be another missed opportunity for the ActivityPub Fediverse ... but even in this case, I still think SWF's likely to be a net positive for the fediverses. In any case, nothing's set in stone at this point. Most non-profits' initial projects, program, staffing, network of participants, and even mission evolve. My guess is that'll be the case for SWF as well. In her [newsletter](https://internet.exchangepoint.tech/social-web-foundation/?ref=thenexusofprivacy.net), SWF Executive Directory Mallory Knodel talked about spending a month doing a listening tour. It'll be interesting to see who she talks to, what she learns, how much power the funders give her to influence the organization's structure and priorities, and what (if anything) changes as a result. There are some straightforward steps SWF can take in the short term that would make some of these *ifs* more likely to happen. And no matter how you feel about SWF, their existence opens up a lot of opportunities – and raises a lot of questions, some of which I'll talk about in the next post in the series. But first, let's talk about the big elephant in the federated room – and I don't mean Mastodon. ## Let's talk about Meta ![a post by yes, it's me, liza (@blogdiva@mastodons.social): “Meta isn't the enemy” oh sweet summer child…](https://thenexusofprivacy.net/content/images/2024/10/Screenshot-2024-10-03-at-9.03.58-PM.png) [Opinions differ](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) in the Fediverse about whether to welcome Meta and their plans to [embrace, extend, and exploit the ActivityPub Fediverse](https://thenexusofprivacy.net/embrace-extend-and-exploit/) with Threads, a Twitter/Bluesky competitor. Erin Kissane's [Untangling Threads](https://erinkissane.com/untangling-threads?ref=privacy.thenexus.today) is a great overview of positions in both directions. In terms of SWF's launch I think of the controversy about Meta's role as an elephant in the room because it's big but largely ignored. SWF's initial communications didn't really talk about it. Neither did the tech press coverage. [The two Fediverses](https://werd.io/2024/the-two-fediverses?ref=thenexusofprivacy.net), by SWF advisor Ben Werdmuller of ProPublica, is about the only discussion I've really seen, and while it has some good suggestions (including transparency) and discusses Meta's harms, it leaves out any power analysis or strategy. You'd think that the split of opinion in today's Fediverse – where lots of people want nothing to do with Meta and see them as actiely harmful – would be relevant enough to SWF's mission of a "growing, healthy" Fediverse that it's important to discuss ... but no. One aspect of the situation that's especially relevant to SWF is that many Fediverse influencers are somewhat naive about Meta. The overly-optimistic framing of the SWF launch partner that blogdiva & resident afroboricua liza sabater was subtooting is one example. Or consider SWF co-founder Evan Prodromou's recent [comment](https://cosocial.ca/@evan/113217568684888568?ref=thenexusofprivacy.net) > "They've been great, super helpful, the Policy team has held consultations with hundreds of people in the Fediverse.... They come to events like Fediforum." Of course the people Meta has working on the project are great and super helpful, it's their job to get the Fediverse to like them! And of course they come to events like Fediforum, it's a great way to get people to like them – and they get good press when they do. A couple of other examples: - Mastodon CEO (and SWF launch partner) Eugen Rochko's description last summer of Meta's plans to embrace, extend, and exploit ActivityPub as "[a clear victory for our cause](https://blog.joinmastodon.org/2023/07/what-to-know-about-threads/?ref=privacy.thenexus.today)" - FediForum co-founder (and SWF advisor) Johannes Ernst's recent comment[ in the Washington Post](https://www.washingtonpost.com/politics/2024/10/02/meta-threads-fediverse-mosseri-mastodon-rochko/?ref=thenexusofprivacy.net) ([archive link here](https://archive.ph/o6mPt?ref=thenexusofprivacy.net)) that "Meta is actually at the forefront" of an industry transformation to "open networks." Oh please. ## Meanwhile, back in reality ... > "Wait a second. Why should anybody trust Facebook, Instagram, or Meta?" > > – me, in [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) Meta has got a history of lying to their "partners" – remember the ["pivot to video"](https://slate.com/technology/2018/10/facebook-online-video-pivot-metrics-false.html?ref=privacy.thenexus.today)? Meta has a history of lying to civil society organizations – remember when [Facebook settled with National Fair Housing Alliance, Communications Workers of America, and the American Civil Liberties Union](https://nationalfairhousing.org/facebook-settlement/?ref=thenexusofprivacy.net) and promised to stop running discriminatory housing ads, but instead [changed their algorithms to make it even worse](https://www.propublica.org/article/hud-sues-facebook-housing-discrimination-advertising-algorithms?token=SNdMjVHydJaBRt8PvOspYpaTiMHV23MB&ref=privacy.thenexus.today)? And let's not forget [Mark Zuckerberg lying to Congress.](https://www.cnn.com/2018/12/21/opinions/mark-zuckerberg-misled-congress-privacy-nyt-alaimo/index.html?ref=thenexusofprivacy.net) So no matter what they're saying at Fediforum and in response to the hundreds of (no doubt carefully selected) people in the Fediverse they're talking to ... why should anybody believe them? Meta has a well-documented track record of sabotaging interoperability initiatives with open networks (as Facebook helped Google to do with XMPP and [as WhatsApp is currently doing with Matrix](https://matrix.org/blog/2024/09/whatsapp-dma/?ref=thenexusofprivacy.net)). So why should the Fediverse expect them to follow through on their vague promises about openness and interoperability? To be clear, lying and malicius compliance are only the tip of the iceberg. There's also [Meta's long history of anti-LGBTQIA2S+ policies](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#were-here-were-queer) and [ongoing refusal to moderate against anti-trans hate](https://glaad.org/smsi/report-meta-fails-to-moderate-extreme-anti-trans-hate-across-facebook-instagram-and-threads/?ref=thenexusofprivacy.net), And don't even get me started on the rest of Meta's well-documented history of doing experiments on their users, breaking the law, discrimination, racism, Islamophoboia, helping authoritarian politicians, using people's data without consent, making money from conspiracy theories and white supremcists, enabling fascist coup attempts, contributing to multiple genocides ... [Mark F\*\*\*king Zuckerberg Is Not Your Friend](https://catvalente.substack.com/p/mark-fking-zuckerberg-is-not-your?ref=privacy.thenexus.today). Even just looking at the malicious compliance and lying, it's not a question of *if* Meta screws over their "partners" in ActivityPub Fediverse, but *when* and *how.* They've had a good run so far milking their tiny incremental gestures of compatibility to get positive press. Once that dries up, they might well conclude that the ActivityPub Fediverse no longer helps them with what they hoped to accomplish, and turn their attention elsewhere – [just like Google (and Facebook) did with XMPP](https://ploum.net/2023-06-23-how-to-kill-decentralised-networks.html?ref=thenexusofprivacy.net). Or, who knows, maybe they'll find it more useful to manipulate and coopt their Fediverse allies into helping Meta try to weasel their way around regulations. Time will tell! ## SWF could potentially be a useful counterweight to Meta (although I'm not holding my breath) Fortunately, quite a few people involved in SWF are more sensible (and less sycophantic) about Meta than Eugen and Johannes. Mallory – whose most recent role was CTO of Center for Democracy and Technology (CDT), a corporate-funded privacy and civil liberties non-profit that's been part of coalitions trying to hold Meta accountable – knows who she's dealing with. So does Ben. And Vivialdi CEO Jon Von Tetzchner and Flipboard CEO Mike McCue — both SWF launch partners – weren't born yesterday.[](https://werd.io/2024/the-two-fediverses?ref=thenexusofprivacy.net) From that perspective, SWF's emphasis on multi-polarity makes a lot of sense for its corporate and non-profit partners. While Meta's much more powerful than any one of them individually, together they've got a better chance at preventing Meta's dominance and limiting the damage when Meta stabs everybody in the back. Earlier in this series, I talked about how Bluesky (while far from perfect) could be a useful counterweight for Meta. The same's potentially true for SWF – *if* they aren't too trusting, and *if* they don't get coopted or manipulated. Again, those are big *ifs.* Meta's very good at cooptation and manipulation, in fact along with lying and breaking the law those are some of their core competences. So I'm not holding my breath. Still Meta's corporate and foundation funders seem to think it's possible, so I'm also not ruling it out. ## There are many different ways to engage [![A post from Anil Dash (@anildash@me.dm): fwiw I don’t think there’s a credible path of non-engagement as long as hundreds of millions of well-intentioned users are involved. We have to pursue harm reduction for them even as we push to hold meta accountable; if we follow the analogy of email or podcasts, there are absolutely vendors in both those spaces profiteering grom fascism. Yet we need those formats to be open.](https://thenexusofprivacy.net/content/images/2024/10/Screenshot-2024-10-03-at-9.36.03-PM.png)](https://me.dm/@anildash/113217428337417759?ref=thenexusofprivacy.net) Fastly VP Anil Dash (who's also a board member for Electronic Frontier Foundation) is another person who I'm confident knows who he's dealing with. Anil's known for his work supporting equity and justice, and has been one of the most outspoken people in the corporate tech world warning about [“VC qanon” and the radicalization of the tech tycoons](https://www.anildash.com/2023/07/07/vc-qanon/?ref=thenexusofprivacy.net). I'd phrase things slightly differently than Anil did (the way I see it, there's a continuum between non-engagement and embracing vendors profiting from fascism) but we get to similar conclusions. Different people and organizations have different constraints and priorities – and different possibilities for leverage – so make different choices. As Erin said in late 2023 in [Untangling Threads](https://erinkissane.com/untangling-threads?ref=privacy.thenexus.today), > "Everyone makes trade-offs. For some people, the benefits of Threads federation is worth dealing with—or overlooking—Meta’s stomach-churning awfulness. But I do think there are human costs to conflating considered pragmatism with a lack of careful, step-by-step thought." Even though I for one do *not* welcome Mark F\*\*\*king Zuckerberg and his shitty company to the fediverses ... they're here. For many, there isn't a credible path to complete non-engagement with Meta today. As Erlend Sogge Heggen analogized earlier this year in [What Meta-corp can give the fediverse: Money](https://blog.erlend.sh/what-meta-corp-can-give-the-fediverse-money?ref=thenexusofprivacy.net) > "Deciding to federate with Threads is analogous to doing trade with the United States of America. The USA has a contentious history to say the least, but it's a continent-sized nation [containing multitudes](https://en.wikipedia.org/wiki/I%5FContain%5FMultitudes?ref=thenexusofprivacy.net).... For some nations, there is no choice. Our globally connected and unevenly distributed world is such that not all nations can afford to close off their borders and trade routes to the US without ruinous consequences." Of course, there are many different ways to engage. Closely engaging with Meta – taking funding, giving them a formal role as partners and/or advisors – has costs and complexities as well as advantages. Support from Meta (or any corporation) has strings attached, explicitly or implicitly, as well as reputational costs. Advisors making sycophantic comments about Meta casts doubt on whether SWF can be trusted. What if there's a controversial proposal at the SWICG standards group and Evan takes the same position as members from Meta? Then again, while some Meta-funded non-profits will shamelessly say whatever their corporate masters find useful, others are better. CDT, for example, takes money from Meta and other corporations, so unsurprisingly sometimes winds up toeing the industry line . On the other hand, CDT also does excellent work in a lot of areas (they're one of my go-tos for resources on the intersections of privacy and disability), and is on the front lines on critical issues like FISA reform, opposing KOSA, and the Fourth Amendment Is Not For Sale Act. Those are all big positives! [A Mastodon poll](https://infosec.exchange/@thenexusofprivacy/113283777103763019?ref=thenexusofprivacy.net) (currently in progress) highlights the range of opinions about different kinds of engagement. Of course, polls on the fediverse aren't any more reliable than polls on any other social network, but it's an interesting data point. [![Poll results. 59%: SWF shouldn't engage with Meta at all. 21%: SWF should work with Meta occasionally, when it's necessary. 7%: SWF should work with Meta together often, but no formal relationship. 5% SWF should have Meta as a partner, advisor, or some other formal relatoinship, but no funding. 5%: SWF should take funding from Meta, but no formal relationship. 3%: SWF should take funding from Meta *and* a formal relatiionship](https://thenexusofprivacy.net/content/images/2024/10/swf-transperncy-poll.png)](https://infosec.exchange/@thenexusofprivacy/113283777103763019?ref=thenexusofprivacy.net) Results as of October 12.[The poll's still active](https://infosec.exchange/@thenexusofprivacy/113283777103763019?ref=thenexusofprivacy.net), so current numbers may have changed slightly. ## SWF and the Schism Within the Fediverses > "The most likely outcome is a schism into anti-Meta "free fediverses", pro-Meta instances in "Meta's fediverses", and a lot of non-aligned instances connecting with Threads to some extent but trying to keep at arms length." > > – me, in [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/), June/July 2023 The percentage of respondents who think SWF shouldn't engage at all with Meta is very much in line with [earlier polls about Threads from a wide variety of people](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#polls), and reflects a very real difference of opinions. In general: - Many people in the Fediverse want to follow people on Threads – and hopefully, maybe, if Meta ever allows it, even have two-way communication. [Many of the largest instances are federating with Threads](https://fedipact.veganism.social/?ref=thenexusofprivacy.net), and many influencers see Threads as big plus for the fediverse - Many people came to the fediverses want as little as possible to do with Meta. Hundreds of instances have signed on to the [Anti-Meta FediPact](https://fedipact.online/?ref=privacy.thenexus.today), many more have defederated (blocked) Threads without signing the pact. and I've seen a fair number of people move away from instances that are federating. So I still think a schism's the most likely outcome. And that's okay – in fact, if it happens, I see it as a good thing. There are many fediverses. Still, it poses an interesting conundrum for SWF. On the one hand, this is the kind of situation where a multi-polar organization can have a big impact. For example, today's ActivityPub Fediverse doesn't give people tools to protect themselves against harassment, increasing concerns about the impact Meta's refusal to moderate against racist and anti-LGBTQIA2S+ hate groups will have once they turn on two-way federation. *If* SWF focuses on safety – for everybody, not just for people in the corporate fediverse – that could make a real difference. But SWF is unlikely to succeed in their goals if their relationships with Meta are seen as too close, or if they projects they pursue and the policies they advocate for are seen as benefitting Meta significantly more than the people in fediverses ... well, they might claim to be non-aligned, but *if* that happens, they'll be seen as a pawn of Meta. So while I can see why SWF has made the tradeoffs they have so far, they may wind up deciding that they have a better chance at success if they instead pursue more of an arms-length approach with Meta. Once again, time will tell! ## SWF is already having a positive impact In any case, no matter how SWF winds up engaging with Meta, and whether or not the evolve, they're already having a positive impact. Three quick examples: - In the wake of the SWF announcement, I've seen a lot more energy from developers looking at multi-protocol solutions and new alternatives to ActivityPub. That's a very good thing in my books! So SWF is already contributing to innovation across the fediverses. - SWF is helping the free fediverses by highlighting Meta's plans to [embrace, extend, and exploit](https://thenexusofprivacy.net/embrace-extend-and-exploit/) the Fediverse, and SWF's list of open-source launch partners highlights the urgency for anti-Meta people using those platforms to investigate alternatives to Mastodon and Pixelfed. - SWF is helping the ATmosphere by experimenting with an approach to create a multi-polar corporate fediverse that isn't dominated by a single company ... there's interesting learning here in how to deal with Bluesky no matter how it works out with Meta. And what if SWF doesn't address any of their problems, winds up as pawns for Meta, and/or crashes and burns? As I highlighted in the introduction, those are good outcomes from Meta's perspective. Pawns are useful. An ineffective multi-polar organization won't help the ActivityPub Fediverse counter their Meta's deadly embrace. A spectacular failure gives Meta the option of dropping ActivityPub and cutting their losses – which is likely to increase their supporters inn the ActivityPub Fediverse's despration to keep Meta on board. On the other hand, thouse outcomes would be.a setback for the rest of the corporate fediverse and their partners like Mastodon. The corporate fediverse has deep pockets, and they'll probably find something else to try, but without a counterweight to Meta they're a lot more vulnerable. More positively, though, even if SWF doesn't deliver what it's funders are hoping for, it's not a bad outcome for the free fediverses, Bluesky, the ATmosphere, or developers working on other protocols. ## To be continued! > "\[T\]his post is eventually going to be a deeper dive into a few of the key questions SWF needs to address, and some thoughts about how they can make progress if the answers are "yes".... > > That said, SWF's launch also sparks a lot of questions for others in the fediverses ... so that's where I'll start. Like the title says, there are more questions than answers at this point. But these are questions worth thinking about, not just in terms of reactions to SWF, but also more generally!" > > – [More questions than answers: another post about the Social Web Foundation and the fediverses](https://thenexusofprivacy.net/swf-questions/) The next post in this series continues the discussion of SWF. But SWF's not the only one with agency, so it also discusses questions for supporters, fediverse developers concerned about the direction of ActivityPub, and the free fediverses might react. After that, I'm working on another post that covers some of the exciting things happening in the fediverses ... and another one that's a deeper dive into AT's architecture and the possibilities of the ATmosphere. Stay tuned! ### Sneak previews *As always, these previews are often from drafts and may well be different in the final version!* ............... The complete absence of anything to address current Fediverse safety issues in SWF's initial list of projects has raised more than a few eyebrows.... I'm far from the only person who's concerned that if and when SWF *does* prioritize safety, they'll do it in a way that (a) doesn't work and (b) helps Meta more than it helps people in the Fediverse. The good news is that there a lot of ways to improve safety on the fediverse, so if SWF decides to prioritize this there are plenty of good potential projects to add. On SocialHub, SWICG Trust & Safety Task Force lead Emelia Smith's suggested that SWF should commit to devote at least X% of its resources to safety, which would be an important signal they intend to prioritize this issue. ............ SWF's launch is a natural inflection point where they can thank some or all of their initial advisors, move on, and bring in a new, more diverse (demographically, geographically, and philosophically) group of advisors that better align with a focus on equity. New advisors can help them get more diverse partners as well. Another priority is to ensure that projects involve – and pay! – Black and Indigenous people, women of color, trans and queer people, disabled people, focusing on the needs of their communities. As Afsenah Rigot says in [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=privacy.thenexus.today) > "The decentered include subpopulations who are the most impacted and least supported; they are often those that face highest marginalization in society... when your most at-risk and disenfranchised are covered by your product, we are all covered." ............. **For people organizing and developing for** [**free fediverses**](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) **(defined in opposition to surveillance capitalism) that prioritize justice, equity, diversity, and inclusion** - SWF highlights the willingness of many fediverse influencers and the ActivityPub power structure to embrace Meta. How to leverage this to reinforce oppositional efforts, and build parallel power bases? - What opportunities does a multi-protocol approach open up? - What (if any) engagement with multi-polar, Meta-friendly organizations like SWF makes sense in various situations – and how to build spaces and organizations that *don't* engage? - What (if any) levels of engagement with fascists, racists, terfs, etc makes sense in various situations – and how to build and encourage more spaces that *don't* allow them? - How to get from the fediverses' history of anti-Blackness, anti-Indigeneity, sexism (etc) – and the skewed demographics – to create a movement that's intersectionally diverse, inclusive, focused on equity and justice? - Where and how to organize? ## Update Log Ongoing: typo and wording fixes, additional links, minor cleanups October 13: originally published (with "Draft" notice still in text) as *I for one (cautiously) welcome the Social Web Foundation to the fediverses, but we really need to talk about the big elephant in the federated room*. Alas, that title was way too long for good link previews. Oh well. October 14: new title, various cleanups, removed draft notice, changed URL. ### Is Bluesky part of today's Fediverse? URL: https://thenexusofprivacy.net/is-bluesky-part-of-todays-fediverse/ Last updated: 2026-04-16T03:20:27.000Z Last updated October 1\. See the [Update Log](#update-log) below for details. > Join the discussion on [Bluesky](https://bsky.app/profile/did:plc:xhrel3d6gxb2tt26u5rqo5y3/post/3l3qtab4yzu2o?ref=thenexusofprivacy.net) and [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/113109711090408047?ref=thenexusofprivacy.net)! > **"the Fediverse"** is a fediverse whose boundaries, culture, software, protocols, and over time and means different things to different people but typically include a network organization based on **instances** .... > > But is Bluesky an instance in today's Fediverse? It depends on how you define "the Fediverse"... a topic I'll discuss in much more detail in the next post in this series. > > – [I for one welcome Bluesky, the ATmosphere, BTS Army, and millions of Brazilians to the fediverses!](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/), September 9 Fediverses are often defined by their protocols, and the AT-centric ATmosphere (a term coined by Shreyan Jain) fits very much into this tradition. That's also how some define the Fediverse. Sean Tilley's September 2017 [A quick guide to The Free Network](https://medium.com/we-distribute/a-quick-guide-to-the-free-network-c069309f334?ref=privacy.thenexus.today), for example, defines the Fediverse in terms of the OStatus protocol and contrasts it with the Federation (the Diaspora protocol) and the ActivityWeb (ActivityPub). The Fediverse has always supported multiple protocols[6](#multiple-protocols), so while protocol-specific definitions can be useful, they're not the only way to look at it. Leonora Tindall's[The Fediverse is Already Dead](https://nora.codes/post/the-fediverse-is-already-dead/?ref=privacy.thenexus.today) (March 2023), for example, defines the Fediverse in multiple ways including as "a place, with a culture" and an ideoform: "a very particular way of thinking about federated social media that encompasses technical, social, cultural, and mythical elements". But before we talk about the Fediverse, let's talk about a few other interesting fediverses, and look at how they're defined. - the ["freeze peach" fediverse](https://freezepeach.social/?ref=thenexusofprivacy.net) is made up of "servers whose anti-authoritarian operators take a principled stance on freedom of expression" (ideologically-defined) and filled with harassers and racists and TERFs and channers who endlessly whine about how they're just engaging in their stereotypically over-simplistic definition of "free speech" (cultural).[7](#freeze-peach-examples) Nostr fits in well with the freeze peach fediverse.[8](#nostr) - the [Threadiverse](https://community.nodebb.org/topic/17908/threadiverse-working-group?ref=thenexusofprivacy.net) is built around "a topic-centric model of content representation" (structural) and is made up of forums, link aggregators, blogs with comments, and other threaded discussion groups (functionality-define).9 - the [corporate fediverse](https://social.wake.st/@liaizon/112139601854189111?ref=thenexusofprivacy.net) includes Meta's Threads, Flipboard, and other fediverse servers run by corporations (a governance-based distinction(ownership). - jonny saunders talks about **"olde fedi**" as "fedi as she was, fedi as we wish she was, fedi that we're glad she aint anymore" (poetic and mythical) - the [free fediverse](https://freefediverse.org/index.php/Main%5FPage?ref=privacy.thenexus.today) is defined in opposition to surveillance capitalism (an political definition) As Marco Rogers says, it's messy and the lines are gray and blurry. Flipboard and Meta's Threads are clearly in the corporate fediverse – and, at least in my books, so is Bluesky.[9](#is-the-atmosphere-corporate) But what about corporate-owned Mastodon instances like bbc.social, me.dm, and vivaldi.net ? For that matter, what about mastodon.social, owned by Mastodon gGmbH (which [lost its non-profit status in April](https://www.heise.de/en/news/Mastodon-Laut-Finanzamt-nicht-mehr-gemeinnuetzig-9701352.html?ref=thenexusofprivacy.net) but hopes to regain it)? Good questions. Opinions differ. Is [BlackSky](https://blog.rudyfraser.com/blacksky-part-one/?ref=thenexusofprivacy.net) – whose creator Rudy Fraser describes its goal and vision and purpose as "to de-center whiteness as the default and to provide a space for Black folk to discuss the Black everyday in a way that feels affirming" – a fediverse within Bluesky? It matches the definiton for "a fediverse" in the previous post – "a decentralized social network of interconnected servers, and the people and organizations with accounts on them" (see [A sophisticated exercise in Blackness](https://blog.rudyfraser.com/blacksky-part-two/?ref=thenexusofprivacy.net#a-sophisticated-exercise-in-blackness) for more on BlackSky's decentralized architecture), so it certainly could be. So could Oliphant's recent proposal of "[island networks](https://writer.oliphant.social/oliphant/islands-an-opt-in-federated-network?ref=thenexusofprivacy.net)", opt-in federated networks whose all federate with each other, or other [concentric federations of instances](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#concentric-federations). Then again, maybe it's not useful to think of BlackSky et al as fediverses ... or maybe it's not useful today but once somebody connects them via bridges to other fediverses it will be. Time will tell! ## Definitions of "the Fediverse" > "In recent years, in the context of sustained criticism and general fatigue that surrounds large-scale corporate social media platforms, the desire to build alternatives has grown stronger.... These projects introduce themselves by emphasizing what makes them distinct from corporate social media, whether it is their ethics, their organizational structure, their underlying technologies, their features, their source code access, or the special interest communities they seek to support..... These platforms are colloquially known as the ‘Fediverse’, a portmanteau of ‘federation’ and ‘universe’. " > > – Aymeric Mansoux and Roel Roscam Abbing [Seven Theses on the Fediverse and the Becoming of F/LOSS](https://test.roelof.info/log/seven-theses/?ref=thenexusofprivacy.net) (2020) > "For me the Fediverse has to include all social media apps and protocols as long as they have some way to communicate with each other." > > \-- Gnu social co-creator Dr. Matt Lee Like I said, sometimes it's very useful to take a protocol-centric view of "the Fediverse." [Tilley's 2017 article](https://medium.com/we-distribute/a-quick-guide-to-the-free-network-c069309f334?ref=thenexusofprivacy.net), for example, is key background for understainding Mastodon's adoption, non-standard extensions to, and then abandonment of the old OStatus protocol as a classic [embrace, extend, and extinguish](https://en.wikipedia.org/wiki/Embrace,%5Fextend,%5Fand%5Fextinguish?ref=thenexusofprivacy.net) maneuver. It is very hard to talk about that (or Mastodon's ongoing dominance thanks in part to its partial adoption and non-standard extensions to ActivityPub) without centering protocols! [Embrace, Extend, and Exploit: Meta’s plan for ActivityPub, Mastodon and the Fediverse](https://thenexusofprivacy.net/embrace-extend-and-exploit/) (December 2023) similarly takes a protocol focus. But the Fediverse is also frequently defined without centering protocols – especially since it's always been multiple-protocol. [Seven Theses](https://test.roelof.info/log/seven-theses/?ref=thenexusofprivacy.net) is a great example. As well as the excerpt above, it discusses several of the Fediverse's characteristics, also including its ongoing critique of openness, its possibilities as a site for agonistic pluralism (or perhaps bastard agonism through pillarization"), and a way out of data sharecropping and free labor. And while it does mention protocols, it doesn't use them to limit the Fediverse. Instead, it describes ActivityPub as "one of the most popular and most discussed protocols of the Fediverse". Some other examples: - Leonora Tindall's multiple descriptions in [The Fediverse is Already Dead](https://nora.codes/post/the-fediverse-is-already-dead/?ref=privacy.thenexus.today), also including "the hopes and dreams of naive kids like me, and of Eugen Rochko’s unified Twitter clone, and of Gab’s “freeze peach” brigade, and of a thousand server operators and six million active users." - ActivityPub co-author Christine Lemmer-Webber's famous quote that "[queer people built the Fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net)" - Anil Dash's perspectives that the hardest thing for people to understand about the fediverse is that "[here we have the expectation of consent](https://mastodon.cloud/@anildash/109312103250205663?ref=thenexusofprivacy.net)" – very much aligned with [Seven Theses](https://test.roelof.info/log/seven-theses/?ref=thenexusofprivacy.net)' point about the critique of openness (and also a stark contrast with the ActivityPub protocol, which doesn't have an concept of consent) - Robert W. Gehl and Dianne Zulli's focus on non-centralization (as opposed to decentralization) and covenantal federalism in [The digital covenant: non-centralized platform governance on the mastodon social network](https://www.tandfonline.com/doi/full/10.1080/1369118X.2022.2147400?ref=thenexusofprivacy.net#d1e190) Some non-protocol definitions are intentionally much vaguer, such as Allie Hart's 'large, nebulous social-media network colloquially known as “the fediverse”' ([Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=privacy.thenexus.today), 2017) and EFF's "expanding ecosystem of interconnected social media sites and services that let people interact with each other no matter which one of these sites and services they have an account with" ([The Fediverse Could Be Awesome (If We Don’t Screw It Up)](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=thenexusofprivacy.net), November 2022). Today's Fediverse as a whole certainly is nebulous and an ecosystem, but doesn't align particularly well with some of these other non-protocol descriptions. For example, today's Fediverse is generally seen as including the corporate fediverse, and Flipboard is a corporate social network run by a public company that doesn't release its code open-source. Threads is by Meta, whose businesses on Facebook and Meta is built on data sharecropping and free labor and lawbreaking and hate for LGBTQIA2S+ people, and don't even get me started on Mark Zuckerberg and Meta's "ethics" Still, just because today's Fediverse is generally seen as including the corporate fediverse, things could change. It might turns out there's not as much money to be made from the Fediverse as everybody hopes, or Meta finds it more expedient to describe their decentralized approach in terms of the "open social web" or some other bland marketing-speak and the tech press goes along with it. Time will tell. ## Is Bluesky an instance in today's Fediverse? The Fediverse is a network-of-networks, where each instance is potentially a network. So even though Bluesky as a fediverse doesn't have an instance structure, Bluesky as a whole – the PDSs, Relays, AppViews, Labelers, and Feed Generators in the Bluesky fediverse – functions as an instance. But is Bluesky an instances in today's Fediverse? I'd say yes: - Bridgy Fed and Friendica (which understand AT as well as ActivityPub) allows two-way communication with people on other instances in today's Fediverse - While Bluesky doesn't align particularly well with some of the non-protocol definitions of the Fediverse in the previous section, neither do many instances currently part of today's Fediverse. Most obviously, Bluesky's a corporate social network. But so are Flipboard and Meta's Threads (and for that matter so was StatusNet back in 2009). Still, there's the Fediverse most people talk about today, and the Fediverse we want to have. So I'm also sympathetic to people whose definitions of the Fediverse excludes Threads, Flipboard, and the rest of the corporate fediverse as well as Bluesky. Reasonable minds differ. Opinions also differ among people with a protocol-centric definition of the Fediverse - People who focus on the Fediverse's long history of being defined in terms of multiple protocols don't Bluesky's use of AT as a reason to exclude them. - People who take an ActivityPub-centric view of today's Fediverse, and see bridging like BridgyFed and/or non-Mastodon platforms like Friendica as valid connectivity, also include Bluesky. - People who take a ActivityPub-only view and *don't* see bridging and/or non-Mastodon platforms like Friendica as valid connectivity exclude Bluesky ## Why choose a narrow, gatekeeping, ahistorical ActivityPub-only definition of the Fediverse? > "In my view the fediverse is the network of platforms that speak ActivityPub. Anything else dilutes the usefulness of the term, because no matter how federated XMPP or Diaspora are, I can't communicate with them directly from a Pixelfed account like I can with Mastodon or Misskey." > > – [Mastodon founder and CEO Eugen Rochko](https://mastodon.social/@Gargron/111976962355397410?ref=thenexusofprivacy.net), responding to [Marco Rogers suggestion](https://social.polotek.net/@polotek/111976947073992951?ref=thenexusofprivacy.net) that "the at protocol means that Bluesky should be considered part of 'the fediverse'", February 2024 It's worth looking a little more at the ActivityPub-only protocol-centric definition. Eugen's not the only one who has this perspective. Fediverse influencer Evan Prodromou (one of the five co-authors of the ActivityPub spec, author of an upcoming book on ActivityPub, and co-lead of an Ethereum Project-funded [project](https://forum.summerofprotocols.com/t/sop-2024-pig-and-pog-grantees/1270?ref=thenexusofprivacy.net) to implement end-to-end encryption to ActivityPub) agreed with Eugen in Marco's thread. A couple of weeks after I published the original version of this post, the new Social Web Foundation (SWF), where Evan's a co-founder, similarly defined "the Fediverse" in terms of ActivityPub – and in a lengthy discussion on SocialHub, Daryl Strype noted that "The [fediverse.party team talked this over recently](https://codeberg.org/fediverse/fediparty/issues/193?ref=thenexusofprivacy.net), and agreed that we still don’t include bridged accounts in our definition of “the fediverse”." I get it. Many ActivityPub loyalists remain resentful that after considering ActivityPub, Bluesky went on to develop its own protocol AT. By contrast, [Meta endorsed ActivityPub's value as platform for its new surveillance capitalism platform Threads](https://thenexusofprivacy.net/embrace-extend-and-exploit/), and Eugen described it as a "huge victory for our cause". But while I'm sympathetic to people who prefer a values-based definition of the Fediverse that excludes Bluesky and the rest of the corporate fediverse ... I personally have far less patience for the gatekeeping, ahistorical, ActivityPub-only definition of the Fediverse. The Fediverse has always supported multiple protocols. Still, in a SocialHub discussion with Evan after the SWF launch, he [clarified](https://socialhub.activitypub.rocks/t/socialwebfoundation-what-do-people-think/4564/66?u=jdp23&ref=thenexusofprivacy.net) that he too views Bluesky as a Fediverse instance, thanks to Bridgy Fed. So there's actually more consensus than I had thought that Bluesky *is* a Fediverse instance. I haven't circled back with Eugen yet, but for all I know he thinks that as well. Anyhow, if Evan and Eugen and SWF and fediverse.party want to choose a definition of Fediverse where history stopped with Mastodon's 2017 adoption of ActivityPub, erases earlier Fediverse history, and ties the Fediverse's success to a protocol that has major issues ... they can do that. "The Fediverse" means different things to different people. It's still worth asking *why* they choose that definition. ## Bluesky *feels* like a part of today's Fediverse (at least to me) More subjectively, I've spent a lot of time on different instances in today's Fediverse running a variety of software10 ... and Bluesky *feels* a lot like the Fediverse to me. Bluesky's culture certainly isn't fully aligned with "[fedi culture'](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#fedi), the set of cultural attributes that came to the fediverse with the 2017 Mastodon/Glitch wave, but then neither is the culture on other platforms people certainly think as part of the Fediverse. For example, Bluesky's all-public approach clashes is the expectation of consent that many people (including me) associate with fedi – but Lemmy is also an all-public environment. Then again, Bluesky *does* have some very fedi-like aspects. For one thing, there's combination of very visible LGBTQIA2S+ posters and an overall pro-LGBTQIA2S+ vibe with anti-LGBTQIA2S+ bigotry, transmisogyny, transmisogynoir, transmisandry, and tensions within LGBTQIA2S+ communities. Bluesky doesn't have defederation (yet) or #FediBLock or shared intsance blocklists but it does have labelers and blocklists for individuals ... and I gotta say, the weeks-long drama surrounding the Aegis labeler's meltdown a few months ago was *very* fedi. Also there's lots of anti-Blackness on Bluesky, and plenty of reply guys. so Fediverse folks should feel right at home! There's also a shared sense that we've got an opportunity to learn from the mistak es of Twitter – including its centralization, and all the power that conveyed to Jack Dorsey and his soulmate Apartheid Clyde. Just like on many Mastodon, Glitch, Hometown, and Akkoma Fediverse instances, the vibe on Bluesky has a combination of relief and happiness at not having to deal with the horrible parts of Twitter, determination not to recreate the problems ... but also old habits dying hard (and irritating people reappering) that lead to some of the same problems being recreated. And there's got a very similar sense of loss for the (intermittently) wonderful aspects of Twitter that aren't yet recreated and may never be ... and possibilities of creating something new and better. Which doesn't mean it will happen, of course, but it might! Cultural aspects aside, my Bluesky account can follow, boost, like, and have a two-way conversation with the Nexus of Privacy's Mastodon account – and with any other Mastodon account that's opted in to Bridgy Fed can follow, boost, and reply to my Bluesky account. Sure, it's not perfect: longer Fediverse posts get truncated on Bluesky; editing a Mastodon post doesn't update the bridged post on Bluesky. Then again communication between other fediverse software is also often very janky and imperfect, so even the imperfections are very reminiscent of my other Fediverse experiences. And, apps like SoraSNS let me access my Bluesky, Mastodon, and Sharkey timelines – a great example of what Laurens Hof of Fediverse Report calls "federation in the client". Again, these are all subjective, so your mileage may vary. But subjective perspectives can be useful, and at least to me, Bluesky *feels* like the Fediverse that I thought it was worth discussing. ## Stay tuned for more! > "But whether or not you see Bluesky as part of the Fediverse, the waves of BTS Army and Brazilians joining Bluesky and the ATmosphere over the summer highlight that the (Mastodon-centric) Fediverse as we knew it for so many years is over." > > – [It's the end of the Fediverse as we know it – and I feel fine](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#end-of-the-fediverse) There's still a lot more to talk about, including synergies between Bluesky and the rest of the Fediverse – or between Bluesky and the Fediverse if you see it that way. It's also worth going into AT's architecture more deeply and looking at the possibilities of the ATmosphere. So stay tuned! Here's a couple of excerpts from drafts of upcoming posts in the series to whet your appetite. --- And it's not just that AT is much much simpler for people developing new public decentralized social networks than ActivityPub. AT's architecture – which splits the ActivityPub-style instances into multiple components, and adds some new ones – also has some clear improvements over today's ActivityPub for creating public "big world" social networks. - PDSs, decentralized data stores, are a response to one of Fediverse users biggest complaints – ActivityPub's current lack of data portability. - Relays address the confusing quirk of ActivityPub-based federation that leads to different people seeing different views of the conversation. - Feed Generators are a really exciting mechanism supporting optional, opt-in algorithimic and/or curated custom feeds. The three part series [Blacksky: Expressing the Black Everyday in a New Digital Space](https://blog.rudyfraser.com/blacksky-part-one/?ref=thenexusofprivacy.net) gives an idea of the possiblities here; Ændra Rininsland's [Thoughts on the 📰 News Feed](https://www.aendra.com/thoughts-on-the-news-feed/?ref=thenexusofprivacy.net) is a good companion piece. - Labelers are an interesting approach to decentralized community moderation. [Bluesky’s Stackable Approach to Moderation](https://bsky.social/about/blog/03-12-2024-stackable-moderation?ref=thenexusofprivacy.net) desribes the overall idea; Ændra's [Some thoughts on running a screenshot moderation service, one month later](https://www.aendra.com/some-thoughts-on-running-a-moderation-service-that-blocks-screenshots/?ref=thenexusofprivacy.net) and [XBlock Summer 2024 Update](https://www.aendra.com/xblock-summer-2024-update/?ref=thenexusofprivacy.net) are a deep dive into one of my personal favorite labelers, one that I would loooooooove to have on other fediverse instances. Of course, these issues *can* conceivably be addressed in ActivityPub-based systems.[11](#possible-in-activitypub) As a result, many in the Fedierse characterize Bluesky's decision to develop their own protocol (as opposed to Meta's approach of exploiting the existing ActivityPub protocol) might just be not-invented-here syndrome, and/or or a greedy corporation looking for a different way to control the ecosystem. Still, AT clearly already has a lot of advantages over ActivityPub for building scalable public social media platforms. And while AT has some big open questions – including whether it will ever move beyond its current all-public focus or domination by Bluesky – it can evolve too! --- Bluesky's rise also needs to be considered in conjunction with Meta's plans to [Embrace, Extend, and Exploit](https://thenexusofprivacy.net/embrace-extend-and-exploit/) the Fediverse with Threads. [Bluesky is a useful counterweight to Threads](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#counterweight) highlights that new people looking for a Twitter alternative joining Bluesky is a much better outcome than them jioning Mastodon, having a bad experience, and going to Threads. And with Threads' representatives now on the W3C ActivityPub SWICG standards group, there's a lot to be said for the existence of an alternate protocol that Meta will have a harder time influencing. At the same time, Bluesky also complements some of the positive impacts that Meta's arrival has had on the fediverses. Most obviously, just as Threads' federation creates opportunities for people in the Fediverse to follow journaists, entertainers, politicans, athletes, and celebrities who have accounts there, the wave of people joining Bluesky creates similar opportunities. With Flipboard also providing access to thousands of media organizations and curated magazines, it's now much easier for people to use Mastodon or GoToSocial to plug into the cultural or political zeitgeist. Of course, not everybody wants to do that, but it's a big attraction for those who do. ## **Notes** 6 Many people don't realize this, but it's true. Wikipedia's [Fediverse](https://en.wikipedia.org/wiki/Fediverse?ref=privacy.thenexus.today) page lists multiple protocols, and includes Imke Senst and Mike Kuketz's diagram [A view of the Fediverse](https://social.tchncs.de/@kuketzblog/110428640620752872?ref=privacy.thenexus.today) (2023) which lists DFRN, Zot, and Diaspora along with ActivityPub. [DDFON's Federated SNS (Fediverse) Historial Timeline](https://codeberg.org/ddfon/federated-sns/src/branch/main/fediverse-history.markdown?ref=privacy.thenexus.today) also lists multiple protocols. Aymeric Mansoux and Roel Roscam Abbing's[Seven Theses on the Fediverse and the Becoming of F/LOSS](https://test.roelof.info/log/seven-theses/?ref=privacy.thenexus.today) (2020) talks about "fediverse protocols", plural. fediverse.party and fediverse.observer both include Diaspora, ; FediDB did as well until spring 2023\. 7 The [Receipts](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net#receipt) section of Seirdy's Blocklist Page have summaires of and links to examples of this "freeze peach" on the worst-of-the-worst of these instances. They're the kind of places Jack Dorsey would approve of! Derek Caelin 's [Decentralized Networks vs The Trolls](https://drive.google.com/file/d/1yqBf04R2swiFDT1jEMUBDQQGgAGS9cx9/view?ref=privacy.thenexus.today) (2022) and the [Gab](https://thenexusofprivacy.net/mastodon-a-partial-history/#gab) section of *Mastodon: a (partial) history* discuss the Fediverse's 2019 encounter with a far-right freeze peach social network. The community reacted strongly, and Gab was quickly isolated. As Pixelfed's lead developer Daniel Supernault [said](https://mastodon.social/@pixelfed/102380162586932574?ref=thenexusofprivacy.net) at the time, "Fascists and Nazis can h\*ck right off and are NOT welcome on our platform." Yay Fediverse! But other Fediverse platforms are more welcoming. Alex Gleason's Soapbox, for example, is used by Truth Social, and is also popular with "freeze peach" fedivere instances like the spinster.xyz, run by Gleason and his partner, well-known "gender-critical" feminist (aka TERF) M.K. Fain, Gleason – [former head of engineering at Donald Trump's Truth Social](https://www.reuters.com/technology/head-engineering-trumps-truth-social-app-resigns-2023-07-17/?ref=thenexusofprivacy.net) and a "gender-critical" TERF – was kicked off the Pleroma project back in the day, but like the proverbial federated bad penny keeps turning up, most recently implementing the Mostr bridge and Ditto, both of which link ActivityPub to Nostr. 8 Nostr (Notes and Other Stuff Transmitted by Relays) is a fediverse too, also initially funded by the odious Jack Dorsey, who now sees it as more in keeping with his vision than Bluesky, and is designed to make it impossible to ban fascists, racists, and TERFs (or anybody else). Shreyan Jain's [Nostr and ATProto](https://shreyanjain.net/2024/07/05/nostr-and-atproto.html?ref=thenexusofprivacy.net) is an interesting look at similarities and differences between these two projects. Nostr's pseudonmyous founder fiatjaf's profile tag line is "leftism is a virus." In [On Nostr, fascism, and the ability to build an inclusive digital space](https://nos.social/blog/on-nostr-fascism-and-the-ability-to-build-an-inclusive-digital-space?ref=thenexusofprivacy.net), Nos founder Evan Henshaw-Plath's optimistically suggests that a protocol designed by somebody who supports fascists is a good platform for a "user-first" approach. Color me skeptical. So I for one do *not* welcome Nostr to the fediverses ... but others, unsurprisingly, do. Conspirador Norteño's [Federation and political spam](https://conspirator0.substack.com/p/federation-and-political-spam), lookis at how fascist political spam originating on Nostr travelled through the Mostr bridge through the Fediverse to Bluesky. Good times. 9 FrontPage.fyi, an AT-based link aggregator, isn't considered part of the Threadiverse today ... but if somebody bridges it to current Fediverse ink aggregators like Lemmy or Piefed, maybe it will be. 10 What about the ATmosphere? Today, it seems like a corporate fediverse to me: Bluesky's by far the largest player, Bluesky PBLLC controls the AT protocol, and other ATmosphere social networks FrontPage rely on Bluesky's services. That could change over time. [Venture-funded StatusNet](https://techcrunch.com/2009/10/27/statusnet-of-identi-ca-fame-raises-875000-to-become-the-wordpress-of-microblogging/?ref=thenexusofprivacy.net) was dominant in 2009's identiverse, and defined the OStatus protocol that dominated [the early Fediverse](https://thenexusofprivacy.net/mastodon-a-partial-history/#pre-history), but the 2013-2016 [GNU social Fediverse](https://thenexusofprivacy.net/mastodon-a-partial-history/#the-gnu-social-fediverse-of-2016) (which also used OStatus) wasn't a corporate fediverse. So it'll be interesting to see how the ATmosphere evolves. 11 Mike Macgirvin recently implemented nomadic identity over ActivityPub in (streams), and the LOLA working group working on data portability has made progress this year. Small-to-medium instances in today's fediverse rely on relays (although unlike AT Relays, ActivityPub relays currently require storing everythig locally so you better have a lot of disk space). Flipboard and Newsmast are doing some interesting work here with custom feeds. ## Update Log Ongoing: typo and wording fixes, additional links, minor cleanups September 8: originally published as part of [I for one welcome Bluesky, the ATmosphere, BTS Army, and millions of Brazilians to the fediverses!](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/) September 10: split into a separate post, which is why the footnote numbers are weird. October 1: Updated section on the narrow, gatekeeping, ActivityPub-only definition of the Fediverse to include Evan Prodromou's view that Bluesky is a Fediverse instance (thanks to BridgyFed). ### I for one welcome Bluesky, the ATmosphere, BTS ARMY, millions of Brazilians, Black Twitter, and sex worker Twitter to the fediverses! (UPDATED) URL: https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/ Last updated: 2026-07-29T04:17:49.000Z *Originally published September 9 2024, last major updated November 16 2024\. See the* [*Update Log*](#update-log) *at the bottom for details. Please don't be deterred by the length of this post, the majority of it is reference material (and a bit of snark) in notes and a very long appendix.* > See the discussion on [Bluesky](https://bsky.app/profile/jdp23.bsky.social/post/3l6v5ntp4tx24?ref=thenexusofprivacy.net), [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/113109711090408047?ref=thenexusofprivacy.net), and [lemmy.world](https://lemmy.blahaj.zone/post/17718832?ref=thenexusofprivacy.net) [![A Mastodon post from Marco Rogers (@polotek@social.polotek.net): I still maintain that the at protocol means that bluesky should be included in the definition of "the fediverse". I know it will take people some time to come around on that. And certainly bsky still has some promises to deliver on. But the actual fediverse will be so much messier than what people have in their heads right now. The lines will all be blurry and gray. By design. ](https://thenexusofprivacy.net/content/images/2024/09/Screenshot-2024-09-02-at-1.06.47-AM-2.png)](https://social.polotek.net/@polotek/111976947073992951https://social.polotek.net/@polotek/111976947073992951https://social.polotek.net/@polotek/111976947073992951?ref=thenexusofprivacy.net) The first time I saw the suggestion that Bluesky should be included as part of "the fediverse" was in a pair of Mastodon threads from Marco Rogers early this year. I hadn't ever looked at it that way before. After all, Bluesky has repeatedly highlighted the differences between its Authenticated Transfer (AT) Protocol and the ActivityPub (AP) protocol used by almost all of the 25,000+ instances in today's fediverse.[1](#notes) But Rudy Fraser's outstanding [The Moderation article](https://blog.rudyfraser.com/the-moderation-article/?ref=thenexusofprivacy.net) had come out just a week before, giving me a much clearer understanding of the possibilities of the AT architecture, and Marco's points resonated with me – as did the swift agreement by Dr. Matt Lee (co-creator of Gnu social). [AT's approach to decentralization ](https://arxiv.org/abs/2402.03239?ref=thenexusofprivacy.net)is very different than ActivityPub's (Alexia's [Bluesky, and what Bluesky is not](https://web.archive.org/web/20241126072739/https://whtwnd.com/alexia.bsky.cyrneko.eu/3l727v7zlis2i) goes into more detail on this) but so what? The more I thought about it, the more I came around to the idea. Then again, [opinions differ](#unwelcome). Some feel very strongly that Bluesky *shouldn't* be considered as part of "the fediverse." As Marco says, the lines are blurry and gray. The way I look at it is that there are many fediverses. Some include Bluesky, some don't. And different people mean different things by "the fediverse"[3](#fn-a-foolish-inconsistency) (or "the Fediverse", as it's often written), so it's not surprising that there isn't agreement. And [Bluesky is very problematic in some very important ways](#problematic), so it's also not surprising that some people don't want to welcome them.[](#terminology) > Note: If you're into wallowing in the details of terminology and definitional struggles, check out [There are many fediverses](#there-are-many-fediverses),and [Definitions of "the Fediverse"](https://nexusofprivacy.net/is-bluesky-part-of-todays-fediverse/?ref=thenexusofprivacy.net#defining-the-fediverse) Over the next few months, though, more and more people came around to Marco's way of thinking. When I first posted this article in early September 2024, I cited TechCrunch's [Welcome to the fediverse: Your guide to Mastodon, Threads, Bluesky and more](https://techcrunch.com/2024/06/25/welcome-to-the-fediverse-your-guide-to-mastodon-threads-bluesky-and-more/?ref=thenexusofprivacy.net), Bluesky board member Mike Masnick's podcast [The Fediverse And The Future Of Social Media: What Policymakers Need To Know](https://dfcouncil.wpenginepowered.com/wp-content/uploads/2024/06/The-Fediverse-And-The-Future-Of-Social-Media%5F-What-Policymakers-Need-To-Know.pdf?ref=thenexusofprivacy.net), Saskia's [Answering ARMY’s Question: What is the Fediverse & How Do We Get Involved?](https://forbetter.ghost.io/answering-armys-question-what-is-the-fediverse-how-do-we-get-involved/?ref=thenexusofprivacy.net), the Fediverse Report's [Fediverse for Publishers](https://fediversereport.com/wp-content/uploads/2024/08/Fediverse-for-Publishers-Aug-24.pdf?ref=thenexusofprivacy.net). Not long after, in a discussion [on Social Hub](https://socialhub.activitypub.rocks/t/socialwebfoundation-what-do-people-think/4564/66?ref=thenexusofprivacy.net), even Evan Prodromou (who as his [bio](https://socialwebfoundation.org/team/?ref=thenexusofprivacy.net) on Social Web Foundation's site notes is sometimes called “The Father of the Fediverse”) agreed that Bluesky is a Fediverse instance that uses AT Proto internally. Hey wait a second, I'm noticing a pattern here. And the technology has come a long way since Marco's original post. By sprint this year, [Bridgy Fed](https://fed.brid.gy/?ref=thenexusofprivacy.net) and long-time fediverse platform Friendica[2](#friendica) both provided two-way connections between Bluesky and fediverse instances (servers) that only understand the ActivityPub protocol, allowing accounts on Bluesky and other fediverse platforms to follow and interact with each other. It's not perfect, of course – connections between different Fediverse software are often incomplete and janky – but it sure *feels* like being part of the Fediverse. Meanwhile, Bluesky itself has improved significantly, to the point where it's now a much better Twitter alternative for most people than any Mastodon instance. [Seven years later, is Mastodon significantly closer to being a good Twitter alternative?](https://thenexusofprivacy.net/a-tale-of-two-prototypes-2/#is-it-closer) discusses Mastodon's lack of progress as a Twitter alternative since 2017; Bluesky hads addressed many of these problems, at least to some extent. [Blacksky](https://bsky.app/profile/rudyfraser.com/post/3l66z4zupdj2w?ref=thenexusofprivacy.net) in particular has played in a incredibly important role, pioneering a new approach to community on large public networks. Rudy Fraser's three-part series [Blacksky: Expressing the Black Everyday in a New Digital Space](https://blackskyweb.xyz/blacksky-part-one/?ref=thenexusofprivacy.net) (December 2023) and Tarik Moody's [Could Blacksky emerge as Black Twitter’s spiritual successor on Bluesky?](https://hyfin.org/2024/11/29/could-blacksky-emerge-as-black-twitters-spiritual-successor-on-bluesky/?ref=thenexusofprivacy.net) on *Hyfin* (November 2024) give an idea of the vision and the progress so far. Of course, there's a lot more to the fediverses than Twitter alternatives ... still, that's what a lot of people are looking for, so it's crucial to have a good one in the fediverses. As Sydette Harry says on Bluesky. > "Problem right now is Blue Sky, Meta and Mastodon keep talking like they’re just building a high capacity social network for a federated internet They are actually doing a large scale digital refugee project" Yeah really. When I published the first version of this article, in early September – right after a huge influx to Bluesky from Brazil – I wrote > So let's make it official. > > I for one welcome Bluesky, the ATmosphere, [BTS ARMY](https://forbetter.ghost.io/purplesky-army-on-bluesky-the-social-web/?ref=thenexusofprivacy.net), and [millions of Brazilians](https://fediversereport.com/last-week-in-fediverse-ep-83/?ref=thenexusofprivacy.net) to the fediverses! Since then, people have continued to flock to Bluesky. As of mid-November it seems like a lot of Black Twitter and sex worker Twitter are making the jump as well. Which is great – and incredibly important! So I'm updating the title. And what better way to welcome everybody than a long post? ### Contents - [From "the Fediverse" to fediverses, communities, and Social Archipelagos](#social-archipelego) - [A caveat: Bluesky is very problematic in some very important ways](#problematic) - [Some people in the ActivityPub Fediverse very much do *not* welcome Bluesky](#unwelcome) - [Bluesky is a useful counterweight to Threads](#counterweight) - [It's the end of the Fediverse as we know it – and I feel fine](#end-of-the-fediverse) - [**Appendix:** ](#terminology)[There are many fediverses](#there-are-many-fediverses) (deep dive into terminology and definitional questions), also including [Are Bluesky and the ATmosphere *really* decentralized and federated?](#are-they-decentralized) and a brief discussion of [Is Bluesky an instance in today's Fediverse?](#bluesky-in-the-fediverse) - [A note to researchers](#researchers) - [Notes](#notes) (with additional details, links, and snark) ## From "the Fediverse" to fediverses, communities, and Social Archipelagos > "“The Fediverse” needs to end, and I don’t think anything should replace it. Speak instead about communities, and prioritize the strength of those communities. Speak about the way those communities interact, and don’t; the way they form strands and islands and gulfs. I’ve taken to calling this the Social Archipelago." > > – Leonora Tindall,[The Fediverse is Already Dead](https://nora.codes/post/the-fediverse-is-already-dead/?ref=privacy.thenexus.today), March 2023 A month after I wrote the original version of this article, [Apartheid Clyde's harasser-friendly change to the Xitter block button](https://www.independent.co.uk/voices/elon-musk-block-button-x-twitter-women-b2630793.html?ref=thenexusofprivacy.net) led to another surge on Bluesky. In the aftermath of the US presidential election, the influx continued to ramp up. It's a stark contrast from November 2022, when millions of people dismayed by Apartheid Clyde's acquisition of Twitter flocked to Mastodon looking for a Twitter alternative. And a good thing too! For one thing, most of the people who came to Mastodon in late 2022 didn't have good experiences ... so didn't stay in the Fediverse; see Erin Kissane's [Mastodon Is Easy and Fun Except When It Isn’t](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=thenexusofprivacy.net) for an overview of problems newcomers faced.[6](#loslob) Flash forward to 2024, and while there's some incremental progress, Mastodon still hasn't really addressed these problems. Bluesky, by contrast, has put a lot of work into onboarding and usability – as well as giving people better tools protect themselves and others, and find and build communities. For example: - "Starter packs", collections of accounts and feeds to follow, help new people find interesting content quickly – and, in conjuction with tools like the [Sky Follower Bridge](https://skyfollowerbridge.com/?ref=thenexusofprivacy.net), rebuild and expand their Twitter networks - The "nuclear block", shared blocklists, and moderation services cut down on how much harassment, racism, and transphobia people have to deal with. [Blacksky](https://bsky.app/profile/rudyfraser.com/post/3l66z4zupdj2w?ref=thenexusofprivacy.net) is a great example of putting the different pieces together: [multiple feeds](https://bsky.app/search?q=blacksky&ref=thenexusofprivacy.net), a [starter pack](https://bsky.app/starter-pack/rudyfraser.com/3kvubqmzzi32t?ref=thenexusofprivacy.net), a [moderation service,](https://bsky.app/profile/did:plc:d2mkddsbmnrgr3domzg5qexf?ref=thenexusofprivacy.net) and an in-progress personal data store. So today, BTS ARMY and millions of Brazilians, and everybody else looking for a Twitter alternative are more likely to have a good experience on Bluesky than Mastodon.[7](#alternatives) When Brazil reinstatated Xitter after a month, a lot of Brazliaians went back to Twitter ... but roughly 1/3 of them have stayed active on Bluesky, a remarkably high retention rate. And as Blacksky highlights, Bluesky and that ATmosphere are developing new organizations for strong communities and how they interact, complementing the ActivityPub Fediverse's instance-oriented structure. These aren't (yet) as place-oriented as ActivityPub instances but it's still useful to think of them as part of the Social Archipelagos ... and new topologies may well emerge. More generally, the emergence of multiple fediverses, and the role of bridges like Bridgy Fed in connecting them, is very aligned with Tindall's perspectives on communities and their interactions. Strands and islands in the Social Archipelagos can participate in multiple fediverses. Bridges can make connections over gulfs between (and potentially within) fediverses. Some of the strands and islands might even be fediverses in their own right. ## A caveat: Bluesky is very problematic in some very important ways Bluesky is far from perfect. To be honest, I thought of calling this article something like "I for one welcome Bluesky (etc) to the fediverses .. at least for now" or "... but not without concerns." But why be churlish? (And also, the title is already too long.) That said, there really is a lot to be concerned about. Where to start? - Bluesky's venture-funded, so is likely to end with an exploitative business model. - Bluesky and AT are a surveillance-capitalism friendly, all-public, architectures - While in principle Bluesky and the ATmosphere's approach doesn't necessarily centralize power, in practice power today is heavily concentrated. Bluesky runs all they key servers and controls the open-source implementations as well as the protocol. As the network expands, it's likely to be extremely expensive to have other full-network Relays and AppViews, potentially making the ATmosphere as a whole dependent on Bluesky's infrastructure. Today it's possible to host your own PDS's (personal data stores) but Bluesky currently puts a lot of restrictions on them and in practice almost nobody does. It's not clear that will change. - The [Protocols not Platforms](https://knightcolumbia.org/content/protocols-not-platforms-a-technological-approach-to-free-speech?ref=thenexusofprivacy.net) paper that inspired Bluesky advocates a libertarian approach to free speech, and highlights that a benefit of this approach is that fascists like Alex Jones aren't banned and can still reach their audience (although hopefully "those who don’t wish to be bothered with his nonsense need not deal with it") – and Mike Masnick, the author of the paper, was Jack Dorsey's replacement on the board. Unlike Dorsey, Masnick *does* understand the value of content moderation and the threat of fascism (plus he's a lot smarter than Dorsey), so it's certainly an improvement ... but this is still very likely to remain Bluesky's philosophy. > **Update, November 2025:** [Bluesky and the battle of Wormtongue](https://thenexusofprivacy.net/bluesky-and-the-battle-of-wormtongue/) *and Nico Mara-McKay's* [*Bluesky’s CEO meltdown: How leadership continues to fail its most marginalized users*](https://plutopsyche.medium.com/blueskys-ceo-meltdown-how-leadership-continues-to-fail-its-most-marginalized-users-8bfa7a8824b4?ref=thenexusofprivacy.net) *look at howBluesky's approach to "free speech" has worked* out in practice, and Laurens Hof's [The White House joins Bluesky](https://connectedplaces.leaflet.pub/3m3nci5fap22n?ref=thenexusofprivacy.net) *(on Connected Places) and Erin Kissane's* [*Trump Administration’s Arrival on Bluesky Highlights Growing Pains for Open Networks*](https://techpolicy.press/trump-administrations-arrival-on-bluesky-highlights-growing-pains-for-open-networks?ref=thenexusofprivacy.net) *(on* Tech Policy Press) discusses the likely impacts of the arrival of a bunch of fascists. - Bluesky's most recent round of venture investment included Blockchain Captial which (as well as being a blockchain company that's made a bunch of sketchy investments) was co-founded founded by Brock Pierce, a friend of Steve Bannon's. - It's great that Jack Dorsey's no longer on the board – or involved at all – but he was. With all of these very real issues, there's good reason for skepticism about Bluesky's long-term future. They could easily evolve into yet another evil big tech company whose claims to be different are just window-dressing. In the short term, though, Bluesky hasn't yet turned evil – or if they have they're disguising it well enough that it's not getting in the way. So my attitude is that if everybody needs to move again in a year or to, oh well, so be it. > **Update, November 2025:* and sure enough, almost exactly a year after I first published this post,* [*This is what solidarity looks like*](https://thenexusofprivacy.net/what-solidarity-looks-like/)*, incliudes the line "Hundreds of people have set up accounts on the blacksky.app PDS (personal data server) –* [*including me*](https://blacksky.community/profile/did:plc:7ax27mj5qwhqaa3ite2ezlzy?ref=privacy.thenexus.today)*." Who, who could have predicted? Oh well, so be it. ewan's* [*I Don’t Really Care If Bluesky Dies (As Long As AT Protocol Survives)*](https://blog.ewancroft.uk/3m3zys45nasue/l-quote/90%5F0-90%5F377?ref=thenexusofprivacy.net#90%5F0) *has some good perspectives here.* After all, Xitter currently *is* evil, and not even pretending to hide it – as Marcy Wheeler says, [Apartheid Clyde has turned Xitter into a machine for fascism and a one-stop shop for disinformation](https://www.emptywheel.net/2024/11/01/elon-musks-machine-for-fascism-a-one-stop-shop-for-disinformation-and-violence/?ref=thenexusofprivacy.net). As Sydette Harry says, Bluesky is doing a large scale digital refugee project. There aren't a lot of barriers to signing up and getting started; the starter packs and Sky Follower Bridge let people reconnect with their networks, at least to some extent. That's got a lot of value! ## Some people in the ActivityPub Fediverse very much do *not* welcome Bluesky Unsurprisingly, though, opinions differ; some people in the ActivityPub Fediverse very much do *not* welcome Bluesky. Michał "rysiek" Woźniak's [BlueSky is cosplaying decentralization](https://rys.io/en/167.html?ref=thenexusofprivacy.net) and Oblomov's [A credible threat to (and from) commercial social network silos/2](https://wok.oblomov.eu/tecnologia/credible-threat-2/?ref=thenexusofprivacy.net) are two good examples. And hostility coming from people who don't want *any* Big Tech or venture-funded participation in the Fediverse, and also oppose the involvement of Meta (and Flipboard, Automattic, Cloudflare, venture-funded The BLVD, etc) as well as Bluesky is intellectually consistent.[2.3](#opinions-differ-automattic) The previous section discusses a bunch of widely-agreed-on reasons for skepticism about Bluesky; even their own employees agree that the ecosystem needs to treat the company as a likely future threat. Some of the other reasons I've heard: - Concerns that Bluesky's values clash with the Fediverse's. - A view that [Bluesky isn't *really* decentralized or federated](#are-they-decentralized). > **Update, November 2025**: ["Decentralization” and erasure: Blacksky, Bluesky, and the ATmosphere](https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/), [And yet ...](https://thenexusofprivacy.net/what-solidarity-looks-like/#and-yet) , and Laruens Hof's [On discourse and decentralisation](https://connectedplaces.online/on-discourse-and-decentralisation/?ref=thenexusofprivacy.net) (on *Connected Places*) go into detail on these debates. - Resentment that Bluesky's larger budget allowed it to swiftly respond and implement functionality that Mastodon users have requested for years but Benevolent Dictator for Live Eugen Rochko has never prioritized[2.4](#resentment) - Fear that if another protocol gets established it could threaten ActivityPub's dominance (especially all though not exclusively from people whose ego and/or professional status is tied in some way to ActivityPub) - Knee-jerk racism and sexism from what I think of as the (mostly cis white male) "Fediverse old boys club" in response to their dominance is being threatened by a company led by a woman of color.[2.5](#racism-sexism) Oh well. It's not surprising, really – opinions differ in the ActivityPub Fediverse about everything. Like I say, it makes sense to me that people who are hostile to other venture funded, big tech, and/or surveillance capitalism attempts to corporatize the Fediverse would also be hostile to Bluesky. What's really bizarre to me is that some of the people who are most hostile to Bluesky actually *support* Threads. Sure, Meta exploits people's data without their consent, experiments on their users, breaks the law, supports authoritarian politicians and contributes to genocide ... but at least they use ActivityPub, and (for some people) that's what's important! Anyhow, the reason I chose the title "I for one welcome..." is to make it clear that I'm speaking only for myself. ## Bluesky is a useful counterweight to Threads > "The most likely outcome is a schism into anti-Meta "free fediverses", pro-Meta instances in "Meta's fediverses", and a lot of non-aligned instances connecting with Threads to some extent but trying to keep at arms length." > > – me, in [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) It's worth highlighting that Bluesky isn't the only new Twitter alternative in the fediverses. Meta's [Threads entered the Fediverse](https://engineering.fb.com/2024/03/21/networking-traffic/threads-has-entered-the-fediverse/?ref=thenexusofprivacy.net) in April of this year, after some heated discussion of their plans to [embrace, extend, and exploit ActivityPub](https://thenexusofprivacy.net/embrace-extend-and-exploit/). Erin Kissane's [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net) is a brilliantly-written overview of some of the perspectives about the situation, and [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) has a lot more. Guess what: it's messy and the lines are gray and blurry. A schism still seems the likely outcome to me. Hundreds of instances have signed on to the [Anti-Meta FediPact](https://fedipact.online/?ref=thenexusofprivacy.net), [many others are defederating (blocking) threads.net](https://fedipact.veganism.social/?ref=thenexusofprivacy.net). Mastodon's founder, CEO, and Benevolent Dictator for Life Eugen Rochko declared it a "clear victory for our cause", and many other Fediverse influencers are also welcoming Threads. From the perspective of the non-aligned and free fediverses, it's useful to have a well-funded direct competitor to Threads around. Bluesky also seems a lot more savvy to me about how Silicon Valley-based big tech companies operate than many fediverse influencers, who often strike me as somewhat naive about working with a company like Meta. And with Meta likely to play a role in the next version of the ActivityPub standard, it's useful to have another protocol out there. And while Bluesky's problematic in a lot of ways, Meta is way way worse. Bluesky might shift to an exploitative surveillance capitalism business model; Meta's had exploitative surveillance capitalism business models for years. Bluesky's funders have very concerning links to fascism; Meta's worked with fascists and other authoritarians to put them in power – and help them keep power. Jack Dorsey used to be on Bluesky's board; Peter Thiel used to be on Meta's board, Marc Andreessen is still there, and so is Mark Zuckerberg. And Meta also has a long track record of discrimination, privacy invasion, lying, experimenting on it's users and contributing to genocide. So it's good that BTS ARMY and millions of Brazilians and everybody else looking for a Twitter alternatives today have another option in addition to Threads. There's a lot more to the fediverses than Twitter alternatives, but that's what a lot of people are looking for today. ## It's the end of the Fediverse as we know it – and I feel fine > *"I was excited by Bluesky's version of "big world social networking" because it meant I could host an instance of Bluesky tailored to Black users, curate custom feeds tailored to Black users, and moderate content that would be harmful to Black users without any of those users missing out on the content and context of the broader Bluesky ecosystem.* **This detail alone makes Bluesky radically different than other social networks** *."* > > *– Rudy Fraser,* [Blacksky: Expressing the Black Everyday in a New Digital Space (Part 2)](https://blackskyweb.xyz/blacksky-part-two/?ref=thenexusofprivacy.net) > *"\[T\]houghtfully governed, medium-sized Fediverse servers are especially well positioned to offer a model of high-context, culturally sensitive online community that outperforms most interactions with centralized platform governance;* > > *\*The Fediverse’s combined emphasis on the sovereignty of local norms and a federated form of network diplomacy can offer a real and optimistic challenge to the* [*dead end of centralized content moderation at scale*](https://www.techdirt.com/2019/11/20/masnicks-impossibility-theorem-content-moderation-scale-is-impossible-to-do-well/?ref=thenexusofprivacy.net)*"* > > *\--* [Governance on Fediverse Microblogging Servers](https://fediverse-governance.github.io/?ref=thenexusofprivacy.net)*, Erin Kissane and Darius Kazemi* Then again even if people are looking for Twitter alternatives today, that's not necessarily *all* they're looking for. Bluesky's focus on the big world system complements other kinds of social networks that today's ActivityPub Fediverse is (at it's best) quite good at. At it's best, today's ActivityPub [networked communities](https://destructured.net/groundedness-networked-community?ref=thenexusofprivacy.net) model combines these small- and medium-size communities with a "fairly big world" view – not as big a world as the flat space of Bluesky, and with all kinds of quirks related to federation and defederation, but still (at it's best) pretty good. Unfortunately, most people in today's Fediverse don't experience it at its best. But that's fixable! And Bluesky is likely to remain all-public space at least for a while. Today's Fediverse's scoped visibility, while imperfect, is something that doesn't exist yet in Bluesky or the ATmosphere. Not only that, thanks to Bridgy Fed, Bluesky expands and (hopefully) improves the "fairly big world" experience for people and instances that want Bluesky as part of their fediverse – just as Threads, Flipboard, expand and (hopefully) improve the experience for people and instances who want that as their fediverses. And Bluesky's community mechanisms potentially complement current ActivityPub Fediverse mechanisms, so the combination could potentially get even better. And it's important to keep in mind that microblogging is only one aspect of today's ActivityPub Fediverse. [A lot of good stuff is happening in the fediverses!](https://thenexusofprivacy.net/good-stuff-in-the-fediverses/) has a bunch of current examples, including [DAIR Institute's Peertube page](https://peertube.dair-institute.org/?ref=thenexusofprivacy.net) (with videos of their Data Workers Inquiry and Mystery AI Hype Theater 3000 for an example of what you can find there) and The Website League, a very innovative new approach to community that's completely different than Blacksky's approach. And that's only the tip of the iceberg. Pixelfed (images) and Mobilizon (events) continue to improve. So does the "Threadiverse" (federated forums, blogs, link aggregators, and other threaded discussion). The list goes on ... The ATmosphere is already starting to develop non-microblogging platforms, and the influx of energy and talent from Brazil is likely to accelerate significantly. We'll see how things play out but it's likely that the ATmosphere will be a better platform for building "big world" social networks, with ActivityPub Fediverse software better for people who prefer a networked communities approach with a fairly big world. Time will tell. As Michael Foster says in [Brazil, Bluesky & the Fediverse](https://www.blog-pat.ch/brazil-bluesky-fediverse/?ref=thenexusofprivacy.net), Bluesky's emergence "means we can move on to something bigger and better." Citing Molly White's [We can have a different web](https://www.citationneeded.news/we-can-have-a-different-web/?ref=thenexusofprivacy.net), Foster also suggests that "Fediverse 2.0" needs to get beyond "people vs protocols" to also focus on politics. Commenting on Foster's post in [Fediverso 2.0: o fenômeno político que desponta no Brasil](https://josemurilo.com/2024/09/13/fediverso-2-0-o-fenomeno-politico-que-desponta-no-brasil/?ref=thenexusofprivacy.net), José Murilo writes > "It reinforces the vision we have (at the Brazilian Institute of Museums) about the importance of the Fediverse as an ideal environment for digital public policies, as well as for activism and progressive media. Not to mention the huge wave of innovation in open source technology that is emerging from the possibility of customizing the open web through specific applications of the Fediverse in protocols such as ActivityPub." AT's big-world approach, and Bluesky's attention to onboarding, usability, and stronger controls for people to protect themselves, are a welcome breath of fresh air in the fediverses – and hopefully to the Activitypub Fediverse in particular as well. So I for one am very glad to see Bluesky and the ATmosphere – and millions of Brazilians, Black Twitter, sex worker Twitter, and BTS ARMY – joining the fediverses. Bem-vendos aos fediverses! ## Stay tuned for more! There's a lot more to explore here on all of these topics. - [Is Bluesky part of today’s Fediverse?](https://thenexusofprivacy.net/is-bluesky-part-of-todays-fediverse/), goes into more detail on some of the definitional struggles about how to define "the Fediverse" that leads people to different conclusions – and ways in which Bluesky's culture does and doesn't align with "fedi culture". - [“Decentralization” and erasure: Blacksky, Bluesky, and the ATmosphere](https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/), from later in 2024, looks in detail at Blacksky as a proof point that the ATmosphere actually is decentralized. - [If not now, when? Mutual aid and organizing in the fediverses, the ATmosphere, and whatever comes next](https://thenexusofprivacy.net/if-not-now-when/) (March 2025) kicks off a series looking at some of the possibilities enabled by the progress in these ecosystems - [This is what solidarity looks like](https://thenexusofprivacy.net/what-solidarity-looks-like/) (September 2025), written right after Blacksky opened their PDS to public usage, contineus the story, and includes a discussion of the learning opportunity for the ActivityPub Fediverse. ## Appendix: Terminology! *This should probably be a standalone post, because it's the terminology I'm trying to use in general, but for now it's here in an appedix.* ### There are many fediverses - **a fediverse** (a portmanteau of "federation" and "universe") is a decentralized social network of federated (i.e. interconnected) servers, and the people, communities, and organizations with accounts on them, that communicate through one or more protocols, bridges, and hubs.[4](#fediverse-definition) Participants in a fediverse can be social networks (either centralized or decentralized) in their own right; participants can also be part of multiple fediverses. - **"the Fediverse"** is a fediverse whose boundaries, culture, software, protocols, change over time. and mean different things to different people but typically include a network organization based on **instances**, a specific kind of server . Since 2018 or so most people have used "the Fediverse" to refer to an ActivityPub-centric fediverse, and when I use the term without qualifying it, that's usually what I'm referring to – but that's not the only fediverse out there! - **"today's Fediverse"** is the Fediverse as it is now, as opposed to how it was in 2016 (before Mastodon and ActivityPub existed), late 2023 (before Threads, Flipboard, and Bridgy Fed started two-way federation), or whatever comes next. - the **ATmosphere** (a term coined [in 2023](https://bsky.app/profile/shreyanjain.net/post/3k26nw6kwnh2e?ref=thenexusofprivacy.net) by Shreyan Jain, sometimes also wrtten as Atmosphere) is a fediverse connected by Bluesky's AT Protocol. When I first wrote this article, the ATmosphere was almost entirely Bluesky; as of mid-2025, it's still extremely Bluesky-centric in the US, but there's a vibrant international development community, and autonomous communities like Blacksky are developing their own technology and operational infrastructure. BridgyFed connects the ATmosphere to the ActivityPub Fediverse. - **"the fediverse"** can be a synonym for "the fediverses," "today's Fediverse", "the Fediverse" - the [corporate fediverse](https://social.wake.st/@liaizon/112139601854189111?ref=thenexusofprivacy.net) includes Meta's Threads, Flipboard, and other fediverse servers and services run by corporations - [free fediverses](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) (or the "free fediverse"), by contrast, are in opposition to surveillance capitalism - "**fedi culture"** is a set of cultural attributes that came to the pre-ActivityPub Fediverse with the 2016-7 Mastodon/Glitch wave (although others use it more generally as "the culture of the fediverse"). Of course if you ask different people you'll get a different list of attributes – although many long-timers include things like pro-LGBTQIA2S+, defederation, #[FediBlock](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/#fediblock-and-receipts), a focus on consent, dislike for algorithmic feeds, and anti-Blackness in their list.[5](#fedi) - **"fedi"** can be a synonym for "the Fediverse", "the fediverse", "fedi culture", the community aspects of the fediverse(s), or (less frequently) "the fediverses" - the **"Open Social Web"** (a term surveillance capitalism companies and their friends have been using since at least 2008) is generally used these days either as a synonym for "the fediverses" or to mean a fediverse including the ActivityPub Fediverse, the ATmosphere, Nostr, Meta's Threads, sometimes RSS, and potentially other decentralized ecosystems. Personally, I really loathe the way this framing puts focus on the "openness," so erases the trans/queer/non-binary-driven oppositional view of [the Fediverse as a critique of openness](https://test.roelof.info/log/seven-theses/?ref=thenexusofprivacy.net) – and also erases the free fediverse's anti-fascist position of [refusing to be open to Meta](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=privacy.thenexus.today#bibr116-20563051241308323) (and earlier, Gab) ... and it's not only misleading but totalizing, shifting attention away from the differentiation between fediverses).[5.1](#open-social-web) Oh well. Others use terminology differently (and sometimes so do I, especially in older posts or when I'm quoting or responding to other what people have said). For example: - [Lady](https://glitch.cat.family/@Lady?ref=thenexusofprivacy.net) of glitch.cat.family draws on the definition of the Web and emphasizes the overall interconnectedness by defining "The Fediverse" as "the set of servers and resources on the Internet which encode social interactions and relationships in a linked, machine-readable, open(-protocol, not necessarily public), and interoperable fashion." I tend to use "the fediverses" or "the fediverse" for this, but it's certainly an important concept! - in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today), Dr. Johnathan Flowers uses Mastodon "as a metoynym for the Fediverse," and notes that this is "in line with the documentation provided by Mastodon, which itself acknowledges the conflation of Mastodon with the Fediverse." - "Instances" have many names; Erin Kissane's and Darius Kazemi's [Governance on Fediverse Microblogging Servers](https://fediverse-governance.github.io/?ref=thenexusofprivacy.net) and many other sources refer to instances as "servers", and other terms include "service providers" or "sites." Not only that, some software platforms have different names for their specific implementations of instances: "pods" in Diaspora, "hubs" in Hubzilla. - **"Open Social Web"** is a term surveillance capitalism companies and their friends have been using since at least 2008\. The framing puts focus on the "openness," so erases the trans/queer/non-binary-driven oppositional view of [the Fediverse as a critique of openness](https://test.roelof.info/log/seven-theses/?ref=thenexusofprivacy.net) – and also erases the free fediverse's anti-fascist position of [refusing to be open to Meta](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=privacy.thenexus.today#bibr116-20563051241308323) (and earlier, Gab). These days, many people use "Open Social Web" to mean the ATmosphere, the ActivityPub Fediverse, and sometimes RSS and/or Nostr; occasionally it's (misleadyingly) used as a synonym for "the Fediverse", and sometimes a synonym for what I refer to calling "the fediverses" (which is not only misleading but totalizing, shifting attention away from the differentiation between fediverses).[5.1](#open-social-web) And while I'm using "federated" in the general computer science sense of "servers connecting over protocols," it's a term that has different meanings in different disciplines. In particular, there are analogies or references to political meanings of "federated", "federation", or "confederation." For example, here's [The Website League](https://websiteleague.org/?ref=thenexusofprivacy.net)'s explanation of why they call themselves a *confederation*: "it's a term used to describe a system of governance composed of independent communities cooperating, as described by the concept of [democratic confederalism](https://en.wikipedia.org/wiki/Democratic%5Fconfederalism?ref=thenexusofprivacy.net), a libertarian socialist theory intended to provide a framework in which "minorities, religious communities, cultural groups, gender-specific groups and other societal groups" can organize themselves autonomously." Robert Gehl and Diane Zulli's discussion of "covenantal federalism" in [The digital covenant: non-centralized platform governance on the Mastodon social network](https://www.tandfonline.com/doi/full/10.1080/1369118X.2022.2147400?ref=thenexusofprivacy.net) is another. And other definitions of "federated" limit it to to specific kinds of interconnections or federated structure. L. Rhodes in [Federated and mediated networks](https://destructured.net/federated-mediated-networks?ref=thenexusofprivacy.net) and Robert W. Gehl's in [Decentralization or Noncentralization, Bluesky or the Fediverse?](https://fossacademic.tech/2024/04/30/DecentralizedNoncentralized.html?ref=thenexusofprivacy.net) are two other good examples of this. If all of this seems kind of messy and confusing ... welcome to the fediverses! Under these definitions, I think the ATmosphere is clearly a fediverse (although not everybody agrees); Bluesky is an instance in the ActivityPub Fediverse as well as part of the ATmosphere. When I first wrote this article, I also thought of Bluesky as a fediverse ... these days, I'm more on the fence about that. ### Are Bluesky and the ATmosphere *really* decentralized and federated? > "As the question ‘Is Bluesky decentralised and federated’ is the greatest thread in the history of forums, and the discussion is still not locked by moderators after [12,239](https://knowyourmeme.com/memes/the-greatest-thread-in-the-history-of-forums-locked-by-a-moderator-after-12239-pages-of-heated-debate?ref=thenexusofprivacy.net) pages of debate, it’s worth taking a step back at what these concepts are meant to accomplish." > > – Laurens Hof, [A conceptual model of ATProto and ActivityPub](https://fediversereport.com/a-conceptual-model-of-atproto-and-activitypub/?ref=thenexusofprivacy.net), *Fediverse Report*, November 2024 In the original version of this post I said I thought it was obvious that Bluesky and the ATmosphere are decentralized ... well, it clearly isn't obvious, so I retract that part! I still think they are, but the discussion's long enough that I'm moving it to a separate post – see [“Decentralization” and erasure: Blacksky, Bluesky, and the ATmosphere](https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/). As for whether they're federated, I also think the answer is yes: the network architecture involves autonomous servers, run by different entities and running different software stacks. That said, in [Reply on Bluesky and Decentralization](https://whtwnd.com/bnewbold.net/3lbvbtqrg5t2t?ref=thenexusofprivacy.net), Bluesky engineer Bryan Newbold says > "Overall, I think federation isn't the best term for Bluesky to emphasize going forward, though I also don't think it was misleading or factually incorrect to use it to date." And in [Decentralization or Noncentralization, Bluesky or the Fediverse?](https://fossacademic.tech/2024/04/30/DecentralizedNoncentralized.html?ref=thenexusofprivacy.net), Robert Gehl argues that Bluesky "will never truly be federated." Then again, in [Bluesky and enshittification](https://pluralistic.net/2024/11/02/ulysses-pact/?ref=thenexusofprivacy.net) Cory Doctorow (despite his overall skepticism of Bluesky) notes that "Bluesky has many federated features that I find technically admirable." So it's all messy and confusing. Welcome to the fediverses. As I said in [“Decentralization” and erasure: Blacksky, Bluesky, and the ATmosphere](https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/), > ""Decentralization" means different things to different people. As the links in the [Appendix](https://thenexusofprivacy.net/decentralization-and-erasure-blacksky-bluesky-and-the-atmosphere-2/#appendix) highlight, people who are focusing on the (very real) concentration of power in the ATmosphere today, or the potentially-centralizing architecture of AT, find it more useful to describe Bluesky as centralized. > > Regardless of the conclusions people reach, though, what's especially interesting to me is that as far as I can tell, nobody else in the discussion is talking about Blacksky as an actually-existing example of decentralization. What's with that?" ### Is Bluesky an instance in today's Fediverse? I think it is, and these days more and more people are agreeing with me – and with Marco. Others disagree. It depends on how you define "the Fediverse"... a topic I discuss in much more detail in [Is Bluesky part of today’s Fediverse?](https://thenexusofprivacy.net/is-bluesky-part-of-todays-fediverse/) Does the answer even matter? To me, the key is to think of it in terms of many fediverses and getting away from privileging any One True Fediverse. Still, I also sometimes find it useful to consider about how meanings for Fediverse have evolved over time, for example the role of fascist fediverse instances like Gab and corporate fediverse instances like Threads. And understanding different positions on the definition of the Fediverse and in particular whether it includes Bluesky can help also highlight power dynamics and key difference of opinion that shape current and future fediverses. Anyhow, the Fediverse means different things to different people, the boundaries are gray and blurry, its meaning constantly evolves. To me, it seems like Bluesky is indeed an instance in today's Fediverse. So to anybody on Bluesky reading this, I for one welcome you to the Fediverse as well – if you want to be part of it. Then again if you don't want to be part of today's Fediverse, I totally respect that. My observation in [Lessons (so far) from Mastodon for independent social networks](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72https://privacy.thenexus.today/lessons-so-far-from-mastodon-for-independent-social-networks/?ref=thenexusofprivacy.net) is just as true today as when I first wrote it in 2017: > "the existing “fediverse” is a two-edged sword" ## A note to researchers There's a rich tradition of excellent academic and independent research in the fediverses – and a lot more interesting research to do, so I welcome you on that front as well! Hopefully the references in this article and the followup are a good starting point. These are only the tip of the iceberg, of course, and there's a lot of other valuable stuff out there. For topics related to moderation and Trust & Safety, the [IFTAS Connect Library](https://connect.iftas.org/library/?ref=thenexusofprivacy.net) is a valuable resource in general, and includes links to various moderation-related research. That said, not all of the research interactions with the Fediverse have been positive – see for example [An Open Letter from the Mastodon community](https://www.sunclipse.org/wp-content/downloads/2020/01/open-letter.html?ref=thenexusofprivacy.net) (2020) after one especially unfortunate incident. So even if your IRB says it's okay, please don't be like that or I for one will unwelcome you – and so will many others. Roel Roscam Abbing and Robert W. Gehl's [Shifting your research from X to Mastodon? Here’s what you need to know](https://www.cell.com/patterns/fulltext/S2666-3899%2823%2900323-9?%5Freturn&ref=thenexusofprivacy.net) (2024) explains key differences between the Fediverse and X, and ends with several recommendations: consider studying instances, not individuals; work with instance admins, moderators, and the community at large to discover mutual research interests; and use the principle of parsimony. Gehl's [Researching the Fediverse: Instances and Individuals](https://fossacademic.tech/2024/03/14/Instances-and-Individuals.html?ref=thenexusofprivacy.net) (2024) is a good companion piece. So is "The Fediverse as an Ongoing Critique of Openness", in [Seven Theses on the Fediverse and the Becoming of F/LOSS](https://test.roelof.info/log/seven-theses/?ref=thenexusofprivacy.net) (2020). As KatLH said in [Research Ethics in the Fediverse](https://apintandaparma.club/katlh/research-ethics-and-the-fediverse?ref=thenexusofprivacy.net) (2020), "there is a general expectation that the minimum bar to clear should be opt in via informed consent." [Consent matters, even for public posts](https://thenexusofprivacy.net/consent-for-fediverse-developers/#consent-matters) (2024) makes a similar point, focusing on developers. Unfortunately, there is no general consent mechanism; Abbing's [what does toot:indexable mean for academic research on the fediverse?](https://test.roelof.info/log/toot-indexable/?ref=thenexusofprivacy.net) (2023) looks at the best-known consent mechanism, introduced by Mastodon in release 4.2 and also adopted by several other platforms. Bluesky, by contrast, has made it clear that (with minor exceptions other than DMs and mute lists) it's an all-public network with no expectation of privacy built around access to a firehose. Of course, as privacy scholars Daniel Solove and Woodrow Harzog note in their recent [The Great Scrape: The Clash Between Scraping and Privacy](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4884485&ref=thenexusofprivacy.net), "the public availability of scraped data shouldn’t give scrapers a free pass." Norms on Bluesky may wind up following the expectation on Twitter that it's just fine for researchers to scrape and otherwise use data (as long as your IRB approves, of course) but then again more and more people are comming around to the idea that consent matters, even for public posts. What about posts from other Fediverse instances that are available in the Bluesky firehose thanks to Bridgy Fed and other connectors? Bridgy Fed is opt-in (and only federates public posts), so one way of looking at it is that people have affirmatively consented to Bluesky norms. Other future connectors may take a different approach so this too may well get murky ethically. We'll see how thigs evolve, but today the lines are gray and blurry. Welcome to the fediverses! ## Notes *I've moved stuff around in this article, so the numbering in the main text isn't consecutive. Sorry for the confusion!* 1 There are around 70 active Diaspora instances according to fediverse.party; and a handful of Gnu Social instances listed on FediDB that presumably still use OStatus. In addition, Fediverse software including Friendica, Hubzilla, micro.blog, Wordpress (which also supports Indieweb via plugins) and BridgyFed supports multiple protocols. Still, almost all of the 25,000+ instances in today's Fediverse only support ActivityPub. 2 Friendica (originally Mistpark) launched in 2010, and with its support of the DFRN, OStatus, and Diaspora protocol was the first multi-protocol fediverse server; according to FediDB, there are currently around 300 Friendica instances with 1400 active users. As Elena Rossini's recent [The Future of Social is Here: a Show and Tell (part 3: Friendica)](https://blog.elenarossini.com/the-future-of-social-is-here-a-show-and-tell-part-3-friendica/?ref=thenexusofprivacy.net) discusses, Friendica's functionality remains much richer than better-known fediverse software like Mastodon. Friendica founder Mike Macgirvin went on to create Hubzilla, (streams), and now [Forte](https://codeberg.org/fortified/forte?ref=thenexusofprivacy.net); his Nomad and Zot protocols have long supported nomadic fediverse identity, and (streams) recently added nomadic identity over ActivityPub. 2.3 In [A credible threat to (and from) commercial social network silos/3](http://wok.oblomov.eu/tecnologia/credible-threat-3/?ref=thenexusofprivacy.net), Oblomov discusss how opposition to Bluesky can also be intellectually consistent with not opposing Automattic. In the fediverse discussion that preceeded his blog post, we agreed that Automattic is a large big tech company with hundreds of millions of venture funding whose CEO is currently abusing his power by attempting to extort revenue from a company in the ecoystem (at the expense of other companies and users in the ecosystem), and Bluesky is a smaller tech company with significantly less venture funding whose CEO could at some point abuse her power at the expense of other companies and users in the ecosystem. At the same time, though, the Wordpress ecosystem is huge, and most of it isn't hosted by Automattic. In Oblomov's view, Automattic "has very limited technical means to prevent an ecosystem shift", and there's a key difference between that and Bluesky's "choke-point redesign of “decentralization”, and choice for an entirely separate protocol." So his view is that Automattic isn't a threat to the fediverse in the same way as Bluesky. 2.4 For example, Bluesky's budget has allowed them to implement valuable safety-related functionality that Fediverse platforms Friendica and Hubzilla implemented a decade ago with no budget, and newer platforms like Bonfire and GoToSocial who have a much smaller budget than Mastodon have also implemented, but Mastodon has never prioritized. Hmm, so maybe it's not only Bluesky's budget that let them do this, and perhaps the negativity could insteady be directed at Mastodon's Benevolent Dictator for Life for not prioritizing this ... but in practice it's often expressed as resentment about Bluesky instead. That said, Bluesky's much deeper pockets *do* give them an advantage here, similar to corporate fediverse platforms like Wordpress and Flipboard, and even more than Mastodon's large-by-Fediverse-standards budget gives them an advantage over other Fediverse platforms ... so I certainly get way people why people are frustrated. 2.5 The persistent belief that "Bluesky is a Jack Dorsey thing is one example of this; the frequently-repeated false claim that "Bluesky didn't have any good reason other than greed not to use ActivityPub" is another. Don't get me wrong, Dorsey is odious; even though he's no longer on the board and deleted his account, his stench lingers on. But Jay Graber has always been the CEO, and her thorough 2020 survey of [Decentralized Social Networks](https://medium.com/decentralized-web/decentralized-social-networks-e5a7a2603f53?ref=thenexusofprivacy.net) as well as subsequent events make it clear that Bluesky had lots of good reasons not to use ActivityPub. Show some respect, dammit! For more about the ActivityPub Fediverse's persistent racism, see Dr. Johnathan Flowers' [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) and the links in the first paragraph of [5 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/)[5 things](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) 3 For that matter, my own usage of the terms has changed over time, so please keep that in mind if you read my other writing! 4 This part of the definition is originally based on Wikipedia's [Fediverse page](https://en.wikipedia.org/wiki/Fediverse?ref=thenexusofprivacy.net). I genericized it ("a fediverse" instead of "the fediverse"), and added "people and organizations" and "bridges and hubs." A broader definition in terms of social media, as opposed to just social networking, would also include chat systems IRC, XMPP, and Matrix as well as email. Of course, the lines are blurry: a with my definition, a Matrix-based decentralized social network would be considered a fediverse, but a set of Matrix decentralized chat servers and rooms might not. Others might broaden the definition to include multi-protocol apps. Fediverse Report's Laurens Hof, for example, talks about "federation in the client"; Flipboard CEO's Mike McCue's perception of fediverse that I quote later in this article includes being connected to ActivityPub via apps. I don't have strong feelings either way here. 5 "fedi culture" for me includes - a pro-LGBTQIA2S+ and very visible trans and queer people (but also transphobia, transmisogyny, transmisandry, transmisogynoir, and tensions between different LGBTQIA2S+ communities); see 2023's [A (partial) queer, trans, and non-binary history of Mastodon and the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net) has many links, including hoodieaidakitten's [Mastodon’s Complicated Relationship with Queer Activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=privacy.thenexus.today) (2018) and Allie Hart's [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=privacy.thenexus.today) (April 2017) - anti-Blackness, including from LGBTQIA2S+ people who who (as Dr. Johnathan Flowers says in 2022's [The Whiteness of Mastodon](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net)) "can use one's queerness as a shield from critique". [The Whiteness of Mastodon](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), Flowers' [Twitter vs. Mastodon](https://www.radicalai.org/twitter-vs-mastodon?ref=thenexusofprivacy.net) (2023) podcast, Marcia X and Ra’il I'Nasah Kiam's [Blackness in the Fediverse](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x?ref=thenexusofprivacy.net) (2023), the links in [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) (2022, but links are mostly to sources from 2017-9) have some of the history, and [It’s possible to talk about The Bad Space without being racist or anti-trans – but it’s not as easy as it sounds](https://thenexusofprivacy.net/the-bad-space/) (November 2023) for discussion of a more recent - reply guys and sealions - instance-level blocking (defederation) and lots of discussions about it – including #FediBlock (a community safety mechanism created in 2017 by Marcia X with the support of Ginger); see [Blackness in the Fediverse](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x/?ref=privacy.thenexus.today) and [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) (2023) for more. ["A Blocklist is a Boundary": Tensions between Community Protection and Mutual Aid on Federated Social Networks](https://dl.acm.org/doi/10.1145/3710919?ref=thenexusofprivacy.net) (May 2025, by Erika Melder, Ada Lerner, and Michael Ann DeVito) and [Understanding Community-Level Blocklists in Decentralized Social Media](https://arxiv.org/abs/2506.05522v1?ref=thenexusofprivacy.net) (April 2025, by Owen Xingjian Zhang, Sohyeon Hwang, Yuhan Liu, Manoel Horta Ribeiro, and Andrés Monroy-Hernández) are excellent academic research, and [Blocklists in the ActivityPub fediverse](https://thenexusofprivacy.net/blocklists-in-the-fediverse/) (2023) is my take. - an expectation many people have of consent (and periodic firestorms sparked by techbros writes sotware that violates these expetations) but lack of tools to support consent; see [Eight tips about consent for fediverse developers](https://thenexusofprivacy.net/consent-for-fediverse-developers/) for a brief discussion of some of the firestorms, and [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) for more on the tool weaknesses - content warnings – and discourse about content-warnings getting weaponized against marginalized people. [The Whiteness of Mastodon](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) discusses this, and Margaret KIBI's [The Beginnings](https://www.u2764.com/NFIC/2018-09-09/fringe-beginnings/?ref=privacy.thenexus.today) (2018) contains - alt-text on images – although as GardenState.social admin's Stefan Hayden's extremely useful [AltTextHealthCheck bot](https://mastodon.social/@AltTextHealthCheck?ref=thenexusofprivacy.net)'s numbers highlight, Fediverse numbers range from less than 25% on some instances (including mastodon.social, by far the largest Mastodon instance) and 75%+ on others. - endless discussions of how mastodon.social is "too big to defederate" but no obvious solution - lots of software developers, sysadmins, devops engineers, security expert, and Linux jokes. As somebody who's a software developer that's spent a lot of time in the security community, and admins (badly) multiple Linux boxes, I enjoy that! - a general preference for Mastodon forks (variants) like Glitch and Hometown and alternatives like Akkoma and Misskey forks (even tough most large fedi instances are on Mastodon, especially mastodon.social), combined with a lot of complaining about Mastodon BDFL (Benevolent Dictator for Life) Eugen Rochko. See Margaret KIBI's [Joining GlitchSoc](https://www.u2764.com/NFIC/2018-10-01/fringe-glitch/?ref=privacy.thenexus.today) (2018) and [Progressing: Fringe Mastodev](https://www.u2764.com/NFIC/2019-09-15/fringe-progress/?ref=privacy.thenexus.today) (2019) for more on the role forks have historically played, and Ro's [A Case for Community](https://h-i.works/2024/04/a-case-for-community.html?ref=privacy.thenexus.today) and my [Fork it! It’s time for a Mastodon hard fork](https://thenexusofprivacy.net/mastodon-hard-fork/) (both April 2024) for current discussions. Your mileage may vary. 5.1 Chris Messina's 2008 blog about [the "open, social web"](https://factoryjoe.com/2009/05/18/the-open-social-web/?ref=thenexusofprivacy.net) is a good reminder of how long companies with surveillance capitalism business models have been trying to push this as a brand. This post was written back when Messina was at Google, long before he started running a VC fund backed by Marc Andreessen and became an advisor to the Meta-funded [Social Web Foundation](https://thenexusofprivacy.net/swf-and-the-meta-elephant/). "Open Social" was at the time was a specification developed by Google, Ning (a company Andreessen had co-founded), MySpace and other social network companies. Attempts to use "Open Social Web" as a synonym for "the Fediverse" erase the oppositional views that Aymeric Mansoux and Roel Roscom Abbing discuss in "The Fediverse as an Ongoing Critique of Openness" (in [Seven Theses on the Fediverse and the Becoming of F/LOSS](https://test.roelof.info/log/seven-theses/?ref=thenexusofprivacy.net)) and Jamie Theophilus discusses in [Closing the Door to Remain Open: The Politics of Openness and the Practices of Strategic Closure in the Fediverse](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=privacy.thenexus.today#bibr116-20563051241308323). And "Open" often has the connotations that there shouldn't be protections against exploit anybody's data, and also that (since bigger is better) [it's *good* to have Nazis and TERFs on the network](https://thenexusofprivacy.net/the-annotated-case-for-a-big-fedi/). On the other hand, many people use variants of "Open Social Web" to mean the decentralized social networks in general including the Fediverse, Threads, Bluesky and the ATmosphere, and sometimes also Nostr. It's not like I have a better suggestion In *Hacking Diversity,* Christina Dunbar-Harris notes "interpretations and norms of openness on which open source rests" often run counter to the goal of providing more safety, and that's one of the things going on here as well. Many cis techies interpret "open" as contrary to needing consent; Mastodon's documentation, for example, describes consent-based allow-list federation as "contrary to Mastodon’s mission"; Evan Prodromou argued against making Bridgy Fed opt-in. Many advocates also generally align with Prodroumou's "Big Fedi" philosophy that (since bigger is better)[ it's *good* to have Nazis and TERFs on the network](https://thenexusofprivacy.net/the-annotated-case-for-a-big-fedi/). [](#open-social-web) 6 Erin Kissane's [Blue skies over Mastodon](https://erinkissane.com/blue-skies-over-mastodon?ref=thenexusofprivacy.net), [Notes from a Mastodon migration](https://erinkissane.com/notes-from-a-mastodon-migration?ref=thenexusofprivacy.net), [The affordance loop](https://erinkissane.com/the-affordance-loop?ref=thenexusofprivacy.net), and [Mastodon is easy and fun except when it isn't](https://erinkissane.com/mastodon-is-easy-and-fun-except-when-it-isnt?ref=thenexusofprivacy.net) all have great perspecgtives on the reasons why so many people joining Mastodon in 2022-3 didn't have a good experience. [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) is also vital reading here. Frustratingly, many of the problems were similar to the ones faced by newcomers in the 2016-7 surge, most of whom also didn't stay. [Lessons (so far) from Mastodon for independent social networks](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=privacy.thenexus.today) (May 2017) was my attempt to sum up what I had in the April 2017 wave. A few of the highlights that applied equally well to 2022: - Even with a stated anti-harassment focus it can still be challenging for a network to respond well when people are actually harassed. - Even with an explicit anti-harassment, anti-fascism, and anti-racism focus, people of color are likely to be marginalized if the most influential people are white. Other patterns that are likely to occur as well (as elsewhere online): — cis men are likely to prioritize anti-harassment functionality lower than women and gender-diverse people. — harassment is more likely to be directed at women, people of color, and LGBTQ+ people. — impacts are likely to fall most heavily on women of color, and in particular queer women of color. - Instance-level federation choices are an important tool for sites that want to create a safer environment (although need to be complemented by user-level control and other functionality) 7 Mastodon forks like Glitch and Hometown and other platforms like Akkoma, Misskey, and GoToSocial are signifcantly better in various ways than Mastodon, but ActivityPub's design and the current structure of the Fediverse means that they're still not great Twitter alternatives – and that's what a lot of people leaving X because of Apartheid Clyde are looking for. 7.5 The closest analogy in fediverse history is Evan Prodromou's venture-funded StatusNet. StatusNet's identi.ca was the hub of the 2008-2012 "identiverse" (the largest [early fediverse](https://thenexusofprivacy.net/mastodon-a-partial-history/#pre-history) for a while), and as Nathan Willis noted in [StatusNet, Identi.ca, and transitioning to pump.io](https://lwn.net/Articles/544347/?ref=thenexusofprivacy.net) "StatusNet never quite reached its original goal of becoming a decentralized, multi-site platform." Then again, despite its limitations, most people (including me) regard StatusNet as decentralized; in fact, Prodromou's 2008 post on identi.ca is often cited as the first post on the Fediverse, even though the word itself didn't start getting used until 2011 or so. So time will tell just how decentralized Bluesky actually turns out to be in practice. ## Update Log Ongoing: typo and wording fixes, additional links, minor cleanups September 5: initial "draft preview" version, titled "I for one welcome Bluesky and the ATmosphere to the fediverses!" September 8: first published non-draft version, originally also including most of what turned into the next post in the series September 9: added A note to researchers , moved detailed discussion of whether Bluesky's a Fediverse instance to a separate post September 10-11: revised definitions and section on whether Bluesky is an instance based on feedback in fediverse discussions. September 12: continued revising definitional sections, revised closing section to include Threads (and reordered) September 17: revise Counterweight and Social Archipelego sections October 19: Update [From "the Fediverse" to fediverses, communities, and Social Archipelagos](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#social-archipelego) including describing how Blacksky puts the pieces together and mentioning of latest Twitter influx. Also, move terminology and definitional struggle bit to the end. It turns out that's not the most interesting part to most people, who could have predicted? I should probably move this to a separate post at some point. November 2: new sections on [Some people in the ActivityPub Fediverse very much do *not* welcome Bluesky](#unwelcome) and [Are Bluesky and the ATmosphere decentralized?](#are-they-decentralized), add reference to quote from Evan agreeing that Bluesky is a Fediverse instance. November 16: added Black Twitter and sex worker Twitter to the title, highlight Blacksky's role, new section on [A caveat: Bluesky is very problematic in some very important ways](#problematic), November 22: update discussion of decentralization to include Christine Lemmer-Webber's perspective, retract my original position that I thought it was "obvious" that Bluesky and the ATmosphere are decentralized (although I personally still think they both are). April 12, 2025: add "open social web" May 16: refine "open social web" definition November 1: add a couple updates, marked **Update November 2025**. July 16, 2026: clarify that the "Open Social Web" is itself a fediverse, and redo the Stay Tuned section to point to future articles in the series ### 5 things white people can do to start making the fediverse less toxic for Black people URL: https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/ Last updated: 2026-09-01T22:29:05.000Z > Join the discussion on [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/112956213079993182?ref=thenexusofprivacy.net) and [lemmy.blahaj.zone](https://lemmy.blahaj.zone/post/15357159?ref=thenexusofprivacy.net)! ### **Contents** - Intro - [1\. Listen more to more Black people – and amplify their voices](#listen) - [2\. Think before you post](#post-less) - [3\. Call in, call out, and/or report anti-Blackness when you see it](#call-in-call-out-report) - [4\. Support Black people and Black-led instances and projects ](#support) - [5\. Approach it intersectionally](#intersectionality) - [And that's not all ...](#more)[](#intersectionality) - [A note to people who are neither Black nor white](#neither) - [Appendix: Common mistakes to avoid](#mistakes-to-avoid) - [Appendix: Blocklist resources for moderators](#blocklist-resources) - [Notes](#notes) *Last updated August 19\. See the* [*Update Log*](#update-log) *below for details.* [![A post from the people's eva (@tillshadeisgone@blackqueer.live): How white allies can help make fedi better for Black folks. In recent days, folks such as @ErickaSimone@mastodon.social, @KimCrayton1@dair-community.social, @timnitGebru@dair-community.social ... and many, MANY more have been speaking out about how toxic fedi culture is for Black folks and how the tools we have access to just aren't enough. In response, we've been seeing an outpouring of antiblack harassment directed towards them and others from a wide range of instances on the fediverse. This is nothing new, although it has meant a lot of extra work for mod teams who are trying to keep their users safe from this harassment. This always happens when Black folks, particularly Black women and Black queers, speak up about their experience on the fediverse and Mastodon specifically. They get met with straight up denial, minimization, victim blaming, you name it.](https://thenexusofprivacy.net/content/images/2024/08/how-white-allies-can-help-1.png)](https://blackqueer.life/@tillshadeisgone/112884367315010638?ref=thenexusofprivacy.net) An excerpt from a longer [post](https://blackqueer.life/@tillshadeisgone/112884367315010638?ref=thenexusofprivacy.net) by the admin of blackqueer.life. Their suggested action step, not shown here, is [supporting Awujo](https://h-i.works/2024/04/a-case-for-community.html?ref=thenexusofprivacy.net), a project which "takes safety seriously and builds infrastructure with the needs of oppressed folks CENTERED rather than MARGINALIZED." You can also [donate to blackqueer.life here](https://ko-fi.com/blackqueerlife?ref=thenexusofprivacy.net). Anti-Blackness – beliefs, attitudes, actions, practices, and behaviors of individuals, institutions, software, and systems that devalue, minimize, and marginalize the full participation of Black people across the world[1](#notes) – is a long-term problem in the fediverse. Dr. Johnathan Flowers' [The Whiteness of Mastodon](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) and [Twitter vs. Mastodon](https://www.radicalai.org/twitter-vs-mastodon?ref=thenexusofprivacy.net) podcast, Marcia X and Ra’il I'Nasah Kiam's [Blackness in the Fediverse](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x/?ref=thenexusofprivacy.net), and the links in [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) have some of the history. While these links focusing primarily on Mastodon, currently the largest instance (server) in the Fediverse, the problem is broader – see for example the draft of [Ah, Lemmy: Racism and Denial in the Threadiverse](https://thenexusofprivacy.net/racism-and-denial-in-the-threadiverse/). Every time things flare up, along with the harassment and denial and victim blaming and hate, there's also lot of hand-wringing about how *we should be better than this*. And then things go back to how they always are. White people in the fediverse collectively should indeed be better than this ... but in practice, we are not. Now's a good time to start changing that and start making the fediverse less toxic to Black people.[2](#terminology) Here are 5 things white people can do to help. 1. [Listen more to more Black people – and amplify their voices](#listen) 2. [Think before you post](#post-less) 3. [Call in, call out, and/or report anti-Blackness when you see it](#call-in-call-out-report) 4. [Support Black people and Black-led instances and projects](#support) 5. [Approach it intersectionally](#intersectionality) ## 1\. Listen more to more Black people - and amplify their voices ![Listen to black people. all in captial letters. Most words are white letters on a black backround, the word Black is black letters on a white background -- a similar asesthetic to some Black Lives Matter posters](https://thenexusofprivacy.net/content/images/2024/08/listen-to-black-people.png) Listening to Black people is an important first step in recognizing and understanding the fediverse's (and society's) problems with anti-Blackness. Hashtags like [#BlackMastodon](https://mastodon.social/tags/BlackMastodon?ref=thenexusofprivacy.net) and #[BlackAugust](https://mastodon.social/tags/BlackAugust?ref=thenexusofprivacy.net), and groups like [blackfedi@fedigroups.social](https://fedigroups.social/@blackfedi?ref=thenexusofprivacy.net) are good places to start if you're using Mastodon, GoToSocial, or other microblogging fediverse software. If you're on a platform like Lemmy which doesn't yet have similar hubs, it's more challenging. One good option, no matter what platform you're on, is to follow independent news sites like [The 19th News](https://19thnews.org/?ref=thenexusofprivacy.net) and [Prism Reports](https://prismreports.org/?ref=thenexusofprivacy.net). Other social networks, news aggregators, and search engines are also good sources for articles and videos by Black people. If you haven't seen anybody else has posted them to fediverse yet, share them yourself! You can also help others listen to more Black people by amplifying Black voices – for example, by boosting, upvoting, resharing, and cross-posting. There's a caveat here though: not everybody wants their posts amplified. So there are some situations where you shouldn't apmplify, for example if it's an account with relatively-few followers, if somebody's not trying to call attention to their post and/or is saying something as part of a conversation with friends. When in doubt, it's better not to amplify. Still, if it's a post that's clearly written for a broad audience, an article or video created by a Black person, or a quote from a Black person in a published article or video ... amplify away! Keep in mind that Black communities aren't monolithic, so don't just listen to and amplify a few high-profile US-based accounts. There are Black anarchists and Blak communists as well as Black capitalists, Black conservatives as well as Black progressives and leftists. So make sure you're getting a range of perspectives – including Black Women, trans, queer, and non-binary Black people, disabled Black people, Afro-Indigenous people, and Black people from Africa. ## 2\. Think before you post [![A post from Timiit Gebru (she/her) (@timnitGebru@dair-community.social): There is a particular brand of tone policing and victim blaming on here that is so unbearable. Unbearable.](https://thenexusofprivacy.net/content/images/2024/08/unbearable.png)](https://dair-community.social/@timnitGebru/112865477734250518?ref=thenexusofprivacy.net) Dr. Timnit Gebru is founder of [****Distributed AI Research Institute**](https://www.dair-institute.org/?ref=thenexusofprivacy.net), a space for independent, community-rooted AI research, free from Big Tech’s pervasive influence. You can [sign up to their newsletter](https://www.dair-institute.org/?ref=thenexusofprivacy.net#mc%5Fembed%5Fsignup) at the bottom of the main DAIR page. If you're white, you're almost certainly not an expert on anti-Blackness and other forms or racism – on the fediverse or more generally. This means that your ideas and suggestions are almost certainly not new, and you're going to have the same questions that have been asked many many times before. As Ijeoma Oluo says in [Welcome To The Anti-Racism Movement — Here’s What You’ve Missed](https://theestablishment.co/welcome-to-the-anti-racism-movement-heres-what-you-ve-missed-711089cb7d34/?ref=thenexusofprivacy.net): > "Every idea you have for how we can better fight racism has already been discussed.... Free, individualized education is not a thing we do anymore." Even if you're asking questions because you sincerely want to know, or you're suggesting good ideas, it's very often not particularly helpful. In fact, since many Black people hear the same questions and suggestions again and again so often that it's very irritating. And let's face it, many times they're *not* actually particularly good questions or ideas – or people express them in an unfortunate way. So if you're about to post about a topic related to anti-Blackness (or race in general), especially if it's a reply to a post or thread from a Black person, stop and ask yourself whether you're actually adding anything to the conversation. - If you've got a question, spend some time looking for the answers – or make a followers-only post and ask – before expecting people to answer it for you. - If you've got a suggestion, ask yourself if this is the time or place for it. - Double-check to see that others haven't already said something similar. Remember that the fediverse is quirky and you may not be seeing all the replies people have made; make sure to check the original post. It's also worth looking it over to make sure you haven't unintentionally said something anti-Black (or more generally racist). For example, **stop saying there isn't racism on the fediverse or asking Black people for evidence of anti-Blackness**. Dozens of Black people have shared the evidence repeatedly. If you want to see specific examples, do the work yourself to find them rather than expecting Black people to do free, individualized education for you. As Michał "rysiek" Woźniak says in [an excellent short thread](https://mstdn.social/@rysiek/112894310387098242?ref=thenexusofprivacy.net) > "Yes, doubting lived experience of Black, Indigenous, Asian, Arab, etc. people is itself racist > > Just don't. > > And yes, asking for proof is doubting that lived experience." [Appendix: Common mistakes to avoid](#common-mistakes) goes into a bit more detail on this, and also covers several other all-too-frequent unfortunate word choices. Very often, after this initial reflection, you'll decide not to post. That's okay! If you *do* decide to post, take the time to phrase it well. Double-check your wording to see you're not inadvertently using problematic language; as the quote from Andrea at the start of [section #4](#support) points out, even well-intentioned expressions of sympathy can come across as hand-wringing and be microagressive. When I post on particularly contentious topics, I'll often ask one or more friends for feedback before posting (although please don't do this with your Black friends unless they've offered – it's asking them to educate you for free). Of course, the combination of deciding not to post in some circumstances, and taking more time to think and work on the wording of the posts you *do* make, means that you'll post less ... but that's not a bad thing. The posts you make will be higher quality, and are likely to lead to better discussions. And, posting less also opens up space for you to amplify more Black voices. ## 3\. Call in, call out, and/or report anti-Blackness when you see it > "Despite white people being less likely than people of color to believe that social media is useful for advocating on behalf of marginalized groups (Anderson et al., 2018), research shows that white people hold unique communicative power to fight against racism on social media (Chaney et al., 2020; Lane, Coles, et al., 2019; Munger, 2017).... \[T\]he goal of responding to a racist post is not to persuade its author to abandon racist views, but rather to signal that expressing such views will not be tolerated." > > – [Making the impossible possible? Framing confrontations of racism on social media as norm-setting](http://www.stewartcoles.com/Coles%5Fand%5FLane%5F2023b%5Faccepted.pdf?ref=thenexusofprivacy.net), Stewart M. Coles and Daniel Lane Especially if it's the first time you've seen anti-Blackness from somebody and it seems like it was unintentional, very often a polite call in as a reply or direct message is a good option. An unintentional mistake can still cause harm ([Impact > intent](https://www.tieonline.com/article/2830/antiracism-intent-vs-impact?ref=thenexusofprivacy.net)), but it's more likely to be a good learning opportunity. Let them know they've said something unfortunate, explain why, and possibly follow up with them one-on-one or in a small group. For more on this tactic, see Harvard Diversity Inclusion and Belonging's [Calling In and Calling Out Guide](https://youthrex.com/wp-content/uploads/2024/04/calling%5Fin%5Fand%5Fcalling%5Fout%5Fguide.pdf?ref=thenexusofprivacy.net), Tiffany Jewel's [When to Call Someone Out or Call Them In Over Racist Behavior](https://www.kqed.org/mindshift/55779/when-to-call-someone-out-or-call-them-in-over-racist-behavior?ref=thenexusofprivacy.net) (with illustrations by Aurélia Durand, an excerpt from [*This Book is Anti-Racist: 20 Lessons on How to Wake Up, Take Action and Do The Work*](https://rep.club/products/this-book-is-anti-racist?ref=thenexusofprivacy.net)), Loretta Ross' [Don't Call People Out, Call Them In](https://www.ted.com/talks/loretta%5Fj%5Fross%5Fdon%5Ft%5Fcall%5Fpeople%5Fout%5Fcall%5Fthem%5Fin?subtitle=en&ref=thenexusofprivacy.net) video, and her book [*Calling In*](https://www.simonandschuster.com/books/Calling-In/Loretta-J-Ross/9781982190798?ref=thenexusofprivacy.net)*,* If it's egregious, or somebody doubles down instead of fixing it, or they have a pattern of unfortunate remarks, then report it to the moderators – and potentially call them out more loudly. If you're on Mastodon, you can also report it to the admins of their instance; that's a good idea if the admin or moderator of the other instance wants to deal with it, but a bad idea if they're hostile (in which case it's a best a waste of time and may open you up to harassment). If you're a moderator, it's especially important to take action on anti-Blackness when somebody reports it – or when you notice it yourself. If the comment is particularly egregious, delete it and consider banning the user (or at least give them a formal warning). Otherwise, especially if it's somebody on your own instance, you may want to start by calling them in. If somebody doesn't want to learn, you'll need to take stronger action.[3](#public-discussion) As social.coop's [Statement from moderation team involving recent racism reports](https://www.loomio.com/d/SndQxA2g/statement-from-moderation-team-involving-recent-racism-reports?ref=thenexusofprivacy.net) illustrates, in situations when anti-Blackness from somebody on your instance has gotten a lot of visibility, it's important to signal that your instance is committed to dealing with the problem. Moderators can also proactively reduce the amount of anti-Blackness by making sure their instance has a good blocklist (aka denylist). See the [blocklist resources in the appendix](#blocklist-resources) for more. Dr. Kim Crayton, author of [Profit without Oppression](https://kimcrayton.com/profit-without-oppression/?ref=thenexusofprivacy.net), discusses a recent discussion with the Mastodon gGmbH CEO in [Day 214 of The Future Is FREE](https://www.youtube.com/watch?v=LhHGJB6%5Fflk&ref=thenexusofprivacy.net). Shop for [The Future is FREE ](https://shop.thefutureisfree.com/?ref=thenexusofprivacy.net)merch here, and [you can sponsor Dr. Crayton here](https://kimcrayton.com/sponsorship/?ref=thenexusofprivacy.net). The fediverse's anti-Blackness also shows up in the software. For example, Mastodon's default settings leave new instances open to Nazis and "freeze speech" shitposters ... the kind of people who just loooooove greeting people with the racist posts and defend hate speech and harassment by claiming it's just "free speech." As well as better defaults, providing everybody (especially moderators) better tools to protect themselves and others can make a big difference Unfortunately, software projects like Mastodon and Lemmy haven't ever prioritized it. This impacts everybody – and especially impacts people who targets of hate, bigotry, and harassment. Like Black people for example! So when you see situations where developers are ignoring safety or concerns from Black users and admins, treat it like you would any other example of anti-Blackness. To be clear, the underlying problems are cultural. Still, technology can make a difference; see [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) and [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/) for more. ## 4\. Support Black people and Black-led instances and projects [![A post from Andrea is still here (@thisiswomanswerk@blacktwitter.io): This is a friendly reminder that instead of offering hand-wringing messages of sympathy (which many times are themselves microaggresive) to Black users facing racism on here, money is 1000% more useful and desirable. There are plenty of Black ppl's #MutualAid requests and threads floating around including the Juneteenth one pinned on my profile. Pick one or some and boost and donate. Folks are trying to live. *pls boost*](https://thenexusofprivacy.net/content/images/2024/08/a-friendly-reminder-1.png)](https://blacktwitter.io/@thiswomanswerk/112887406845137602?ref=thenexusofprivacy.net) The replies to [Andrea's Juneteenth post](https://blacktwitter.io/@thiswomanswerk/112539849684901598?ref=thenexusofprivacy.net) have quite a few links to people and organizations to consider supporting. Many Black people in the fediverse promote or sell art, music, books, crafts, and newsletters. Many have "looking for a job" posts, crowdfunding or donation links, or threads like [Andrea's Juneteenth post](https://blacktwitter.io/@thiswomanswerk/112539849684901598?ref=thenexusofprivacy.net) collecting requests from others. If you see a post you like, or somebody who's been treated shabbily by others in the fediverse and you feel bad about it, check their profile and pinned and recent posts to see how you can help. If you're listening to Black people, you'll also see lots of other opportunities. Whether or not you have funds to spare, you can help by boosting and promoting people's work, fundraisers, job search requests, etc. There are also a lot of other ways to support Black people on the fediverse. For example: - [The #MutualAid hashtag](https://mastodon.social/tags/mutualaid?ref=thenexusofprivacy.net) is a good place to find people who need support. - Black-led instances like [blackqueer.life](https://ko-fi.com/blackqueerlife?ref=thenexusofprivacy.net), [diaspora.im](https://opencollective.com/diasporaim?ref=thenexusofprivacy.net), and [blacktwitter.io](https://www.patreon.com/andcomputers?ref=thenexusofprivacy.net) play an important role in the fediverse – and need support. - Black-led software projects like Awujo (proposed in Ro's [A Case for Community](https://h-i.works/2024/04/a-case-for-community.html?ref=privacy.thenexus.today)) that "prioritize safety, accessibility, and ease of use, managed by a consensus of diverse voices" can play an important role in addressing the fediverse's lack of safety for *everybody* ... but the software won't write itself. ## 5\. Approach it intersectionally[4](#intersectionality-links) [Misogynoir by Dr. Moya Bailey](https://www.youtube.com/watch?v=hIZaEE8axmQ&ref=thenexusofprivacy.net) > "Intersectional analysis is key to dismantling white supremacy" > > – [No Single-Issue Politics, Only Intersectionality: An Interview With Kimberlé Crenshaw](https://truthout.org/articles/no-single-issue-politics-only-intersectionality-an-interview-with-kimberle-crenshaw/?ref=thenexusofprivacy.net) Anti-Blackness isn't the fediverse's only problem. Misogyny, transphobia and other forms of anti-2SLGBTQIA+ bigotry[5](#lgbtaiq2s) , anti-Indigeneity, ableism, Islamophobia, antisemitism ... the list goes on. As well as being problems in their own right, all of these other dimensions of oppression compound the fediverse's anti-Blackness. And people at the intersections experience unique forms of oppression. [**Misogynoir**](https://nyupress.org/9781479865109/misogynoir-transformed/?ref=thenexusofprivacy.net) – a term originally coined by [Dr. Moya Bailey](https://www.moyabailey.com/?ref=thenexusofprivacy.net) in 2008, describes the ways anti-Black and misogynistic representation shape broader ideas about Black women and gender-expansive people (especially in social media) – is one important example of intersectional oppression. As Dr. Kay Coghill says in [What is Misogynoir? A deeper look into the anti-black racism and sexism that impacts Black Women and Black nonbinary, agender,and gender-variant folks](https://leaflet.pub/7949ab92-a184-44a5-bb9e-59d4f7aa4902?ref=thenexusofprivacy.net), > "Misogynoir is vast and shows up more frequently than we may realize, and it has impacted Black women and Black nonbinary, agender, and gender-variant folks for centuries, but that does not mean that it cannot be mitigated." [Calling all non-Black people: Interrupting Misogynoir](https://drive.google.com/file/d/1KiI7Hm9SFxATmjJc1lA8zTZTx57gXj3u/view?ref=thenexusofprivacy.net)[6](#misogynoir-pdf), by Dr. Heliana Ramirez and Jaya Mallik, is an excellent recent resource; if you've got a Linked In account, [check out the panel discussion here](https://www.linkedin.com/events/7222816625878609920?ref=thenexusofprivacy.net). Dr. Bailey's book [Misogynoir Transformed: Black Women’s Digital Resistance](https://nyupress.org/9781479865109/misogynoir-transformed/?ref=thenexusofprivacy.net) goes into more detail. Similarly, [**transmisogynoir**](https://www.harpersbazaar.com/culture/features/a33614214/ashlee-marie-preston-transmisogynoir-essay/https://translanguageprimer.com/transmisogynoir/?ref=thenexusofprivacy.net) describes the intersection between transphobia, misogyny, and anti-Black racism specifically; Ashlee Maree Preston's [The Anatomy of Transmisogynoir](https://www.harpersbazaar.com/culture/features/a33614214/ashlee-marie-preston-transmisogynoir-essay/?ref=thenexusofprivacy.net) is a good introduction. Of course, all of these dimensions of impressions are also complex issues, and the of how things manifest details can be very different, but the basic framework in #1-#4 of listening more, being more thoughtful about posting, intervening when you see something, and supporting people is quite general. For example, sections #2 and #3 point to how to make progress on Mastodon's notorious reputation for "reply-guy-ism" – which, while bad in general, is a lot worse for Black women and other women and femmes of color. So please pay attention to these dynamics as well, and make sure you're listening to and supporting Black women, trans and queer Black people, and disabled Black people as well as Black guys and cis, straight, abled Black people. The good news is that taking this intersectional focus will make the fediverse less toxic for *everybody.* As the Combahee River Collective said in 1977 > "If Black women were free, it would mean that everyone else would have to be free since our freedom would necessitate the destruction of all the systems of oppression." ## And that's not all ... ["So you want to talk about race" with Ijeoma Ulou and Dr. Cherisee Jones-Branch](https://www.youtube.com/watch?v=sgSEtTY2Cwk&ref=thenexusofprivacy.net) Of course, these aren't the only things that need to happen to make the fediverse less toxic for Black people. It's also vital to do the work to examine and make progress on your own biases, assumptions, habits, and other forms of anti-Blackness – which we all have. Ijeoma Oluo's [Welcome To The Anti-Racism Movement — Here’s What You’ve Missed](https://theestablishment.co/welcome-to-the-anti-racism-movement-heres-what-you-ve-missed-711089cb7d34/?ref=thenexusofprivacy.net) is a very good introduction. Her book [So You Want to Talk About Race](https://www.akpress.org/so-you-want-to-talk-about-race.html?ref=thenexusofprivacy.net) goes into more detail, as do her videos including the above. I also found Dr. Crystal Fleming's [How to Be Less Stupid About Race](https://www.beacon.org/How-to-Be-Less-Stupid-About-Race-P1388.aspx?ref=thenexusofprivacy.net) helpful, and she's got some excellent videos too. Dr. Crystal Fleming, [How to Be Less Supid About Race](https://www.youtube.com/watch?v=HIRZHcKC%5FgY&ref=thenexusofprivacy.net), from Washington State University's Martin Luther King program If those don't work well for you, there are lots of other good options out there as well – although reading and watching videos isn't enough, you have to put them into practice. Which isn't easy! > "You will get better at this, but at first you will fuck up a lot, and you will always fuck up a little.... You are here because you are a decent human, and because you are a decent human you are going to feel pretty shitty when you fuck up.... You will need to get used to the pang of guilt from realizing you have fucked up and it has hurt people. Because it will hit you again and again." > > – [Welcome To The Anti-Racism Movement — Here’s What You’ve Missed](https://theestablishment.co/welcome-to-the-anti-racism-movement-heres-what-you-ve-missed-711089cb7d34/?ref=thenexusofprivacy.net) When you do make a mistake, and somebody calls you in or out, the first step is to acknowledge and apologize. Resist the natural urge to be defensive – doubling down will only make things worse. Then, make amends. If you've made an unfortunate post, editing it is a good first step (and usually a better option than deleting the post, which makes it looks like you're trying to hide the fact that you screwed up). Speaking of which, I'm sure I've made mistakes here – it's a very challenging subject to write about, and I too have spent my entire life in environments where anti-Blackness is normalized and (just like everybody else) am still not always aware of when I'm falling into it. Thanks to everybody who gave me helpful feedback on the draft, but I've almost certainly found new ways to screw up in this current version. So, my apologies in advance; please call me in or out, as you see fit! I've linked to various discussions above, or you can DM me at @jdp23@blahaj.zone, @thenexusofprivacy@infosec.exchange, or @jdp23.bsky.social. ## A note to people who are neither Black nor white While anti-Blackness doesn't only come from white people, as a white person, I'd be out of my lane if I tried to tell you how to address anti-Blackness in your communities. For that matter, advice originally meant for white people often needs to be adapted to work for people of color. So while hopefully these recommendations may point in useful directions for you as well, maybe they don't – or maybe they're just a starting point that's missing important perspectives. If anybody wants to use some or all of this material as a basis for posts speaking to other demographics, this post is Creative Commons licensed so you can cut-and-paste modify, or remix it however you ant it as long as you cite this as a source and allow your work to be reused (see the *Licensing* section on the [About](https://thenexusofprivacy.net/about/#licensing) page for details). If you're thinking of doing something like that, I'm happy to talk or potentially even collaborate if you're interested, so hit me up. Conversely, while I focused on anti-Blackness here because being too general risks losing specificity, other forms of racism are also big problems in the fediverse. So if you'd like to use some or all of this material as a basis for posts about what people can do about other forms of racism in the fediverse, that'd be great too! Again, if you're thinking about this and want to talk more, please reach out. ## Appendix: Common mistakes to avoid ![A tweet from Chanda Prescod-Weinstein (@IBJIYONGI): "white people explaining to people of color that they are facing racism on mastodon because they are using mastodon wrong" is a gendre that needs to die in a fucking fire. It's such a disrespectful failure to imagine POC competence and white supremacy's pervasiveness](https://thenexusofprivacy.net/content/images/2024/08/it-needs-to-die-in-afire.png) To make things concrete, here are some specific examples I've heard repeatedly from Black people: ### **Stop saying it's less racist here** – or worse, "I haven't seen any racism here" It's there, you're just not seeing it. For one thing, on Mastodon, a lot of harassment takes place in followers-only posts or DMs, which means it's only visible to the person being targeted. If you're on a well-moderated instance, racist posts not specifically directed at you might well be deleted before you see them. And if you're not following Black people, you're not going to see their posts about racism. Still, those aren't the only dynamics. > "A function of systemic racism is that it is often invisible to white people, in part because the entertainment and news media, educational systems, political and moral ideologies, even the church are all based on the belief that white opinions, white experiences, and white definitions are primary and “true.” > > – [Overt and Covert Racism](https://www.r2hub.org/library/overt-and-covert-racism?ref=thenexusofprivacy.net), R-Squared Anti-Blackness and racism are so pervasive and normalized (on social networks and in society as a whole) that many white people don't even notice its. There were been several [spectacular examples of this in discussions related to this post on Lemmy](https://thenexusofprivacy.net/racism-and-denial-in-the-threadiverse/): people saying they haven't seen any racism on Lemmy – in the same threads with egregious comments and other more helpful commenters highlighting patterns of anti-Blackness on Lemmy. [Ah, Lemmy.](https://thenexusofprivacy.net/racism-and-denial-in-the-threadiverse/) But it's not just Lemmy, stuff like this happens on Mastodon too. ### **Stop saying "I don't see color"** or other variants on "I don't care about race, I treat everybody the same" As a helpful commenter on Lemmy responded to somebody saying this, "tl;dr there’s no racism problem because you see everyone as a white man by default." Fitchburg State's [What Does Racism Look Like? Colorblindness](https://fitchburgstate.libguides.com/c.php?g=1046516&p=7616506&ref=thenexusofprivacy.net) page has a short overview on why statements like this are so problematic; Eduardo Bonilla-Silva's [Racism without Racists: Color-Blind Racism and the Persistence of Racial Inequality in America](https://rowman.com/ISBN/9781538151419/Racism-without-Racists-Color-Blind-Racism-and-the-Persistence-of-Racial-Inequality-in-America-Sixth-Edition?ref=thenexusofprivacy.net) goes into detail. ### **Stop telling Black people that they'll experience less racism if they change instances** It's certainly true that some instances are better moderated than others. Still, no matter your intent, by saying this you're putting the burden on Black people to deal with anti-Blackness – and implying that the moderators of their instance are doing a bad job, which may not be true (in which case it's an example of the victim-blaming Dr. Gebru talked about in the post I included at the start of [section #2](#post-less)). And, especially if you're suggesting they move to a Black-led instance, it's likely to sound like you're endorsing the idea of a segregated fediverse. ### **Don't complain about "racism to white people"** [Ahmer Rahman on ‘reverse racism’](https://www.youtube.com/watch?v=dw%5FmRaIHb-M&ref=thenexusofprivacy.net) As the Alberta Civil Liberties Research Center's [Myth of Reverse Racism](https://www.aclrc.com/myth-of-reverse-racism?ref=thenexusofprivacy.net) says, "racial prejudice can indeed be directed at white people (e.g., “White people can’t dance”) but is not considered [racism](https://www.aclrc.com/racism?ref=thenexusofprivacy.net) because of the systemic relationship to [power](https://www.aclrc.com/racism?ref=thenexusofprivacy.net)." 7 ### **Stop saying the fediverse is better or friendlier or nicer than corporate social networks** [![A post from mekka okereke (@mekkaokereke@hachyderm.io): Corporate owned social media is safer for Black people because: 1) There is more of a Black community there. The community keeps us safe, not the corporations. 2) People on Mastodon are willfully ignorant of how many racist people are on Mastodon. I'm running out of ways to tell people that there are more nazis per capita on the Fediverse than on Twitter. This is doubly harmful, because the non-nazi people on the Fediverse refuse to believe Black people about this fact.](https://thenexusofprivacy.net/content/images/2024/08/corporate-owned-social-media.png)](https://hachyderm.io/@mekkaokereke/112892919970690522?ref=thenexusofprivacy.net) Maybe it is for you ... but for many Black people, it's not. So when you say that it *is*, you're saying you don't care about their experience. ### **Stop asking Black people for evidence of anti-Blackness** I know I said this in the main article but it's important enough it bears repeating! Dozens of Black people have shared the evidence repeatedly – including [Mekka](https://hachyderm.io/@mekkaokereke?ref=thenexusofprivacy.net) (who's got several pinned posts worth looking at), and all of the others I've quoted in this article. Believe them! If you want to see specific examples, do the work yourself to find them rather than expecting Black people to do free, individualized educataion for you. Following the suggestions in [section #](#listen)1 of this article is a good place to start, and the links at the top of the article also have plenty of illustrations. ## Appendix: Blocklist resources for moderators ![A post from the people's eva (@tillshadeisgone@blackqueer.life): If these blocklists didn't exist, my server wouldn't have lasted a month](https://thenexusofprivacy.net/content/images/2024/08/eva-blocklists-2.png) As [Blocklists in the fediverse](https://thenexusofprivacy.net/blocklists-in-the-fediverse/) discusses, blocklists can be problematic, but today's fediverse relies on them for safety. Unfortunately, there isn't yet anything close to an automated blocklist solution that provides strong levels of protection to Black people on the fediverse. Still, there are some very useful resources available. *Shared blocklists* are files with recommendations of instances to block or limit. Admins can upload blocklists to their instances (although be careful to check that it's the right format), and tools like [fediblockhole](https://github.com/eigenmagic/fediblockhole?ref=thenexusofprivacy.net) and IFTAS's new [FediCheck](https://connect.iftas.org/library/iftas-documentation/fedicheck/?ref=thenexusofprivacy.net) can help automate the process to some extent, Seirdy's [Fediverse Blocklists](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net) has a thorough discussions of the complexities (including [the “trust but verify” section](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net#trust-but-verify), worth reading no matter what blocklist you're using), and detailed receipts for his FediNuke "worst of the worst" list that are also useful for constructing your own blocklist. [Oliphant's Blocklists](https://github.com/sgrigson/oliphant?ref=thenexusofprivacy.net) and [IFTAS' Denylist Resources](https://connect.iftas.org/library/tools-resources/denylist-resources/?ref=thenexusofprivacy.net) have more. It's best to use these blocklists as a starting point. New bad actors pop up all the time, and it takes weeks and sometimes even months before they show up on blocklists. So it's important to track the #FediBlock hashtag for updates. #FediBlock was orginally created by [Artist Marcia X](https://www.artistmarciax.com/?ref=thenexusofprivacy.net) with additional support from [Ginger](https://digital.rooting.garden/?ref=thenexusofprivacy.net), and it continues to be the fastest way to find out about new bad actors – it often takes a week or longer for blocklists to update. Of course, anybody can post to a hashtag, so without knowing the reputation of the person calling for a #FediBlock it's hard to know how much credibility to give the recommendation; and it's not always easy way to search the #FediBlock hashtag to see whether specific instances have been mentioned. So it takes a fair amount of time and effort to keep up to date. > **IMPORTANT:** only use the #FediBlock hashtag for announcements and "receipts" (screenshots, saved archival versions, and links to problematic behavior). Use #FediBlockMeta for discussions about the hashtag. Many instances consider spamming #FediBlock as grounds for defederation – it's interfering with a community defense mechanism, and it's anti-Black. So don't do that! Fortunately, it's usually not a "one strike and you're out" kind of thing except in egregious cases. so if you screw up, edit your post to remove the hashtag, and make sure not to do it again. Not only that, many of the blocklists incorporate perspectives of large fediverse instances that don't moderate effectively against anti-Blackness, so the shorter blocklists in particular are likely to miss a lot. Blocklists like [GardenFence](https://gardenfence.github.io/?ref=thenexusofprivacy.net) and Seirdy's FediNuke have around 150 instances, and Seirdy's Tier 0 and Oliphant have around 400-450; instances that actively moderate against racism often block well over 1000 instances. So while they're incredibly valuable at blocking the worst-of-the-worst, there's a lot they don't get Conversely, sometimes instances wind up on blocklists by mistake, or have changed their ways since originally being added but haven't been removed yet; so it's also considered good practice to verify them for yourself (although this can be very time consuming and involve wading through a lot of vile stuff to verify that yes, it is vile). Instance catalogs are valuable complements to blocklists: - [The Bad Space](https://tweaking.thebad.space/?ref=thenexusofprivacy.net) (aka TBS) is collaboration of communities committed to actively moderating against racism and other kinds of bigotry. As well as a web interaface that makes it easy to look up a specific instance, and an API for programmatic access), which also provides [exports](https://tweaking.thebad.space/exports?ref=thenexusofprivacy.net) that can be used as the basis for blocklists. I recently saw a Black instance admin saying that they used the TBS 40% heat map as a starting point for their blocklists; I decided to do the same on an instance I'm setting up, adding and removing a few instances, and then editing to get it was in the right format for the platform I'm using. [It’s possible to talk about The Bad Space without being racist or anti-trans – but it’s not as easy as it sounds](https://thenexusofprivacy.net/the-bad-space/) discusses TBS – and the resistance in today's fediverse to technology created by a Black person (working with a diverse team of collaborators that includes trans and queer people) that allows people to better protect themselves. - [The Fediseer](https://fediseer.com/?ref=thenexusofprivacy.net) also has a web interface and API access, and has substantially more information about Lemmy instances than any other option I know of. [Compare and contrast: Fediseer, FIRES, and The Bad Space](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/) highlights similarities and differences with TBS. If this all sounds very difficult and time consuming ... you're not wrong. More positively, though, the situation is substantially better than it was two years ago, so let's hope the trend continues! ## **Update log** Ongoing: typo and grammar fixes, clarifications, additional links, and other minor changes. - August 2025: add quote from [What is Misogynoir? A deeper look into the anti-black racism and sexism that impacts Black Women and Black nonbinary, agender,and gender-variant folks](https://leaflet.pub/7949ab92-a184-44a5-bb9e-59d4f7aa4902?ref=thenexusofprivacy.net) - July 2025: add quote from [Making the impossible possible? Framing confrontations of racism on social media as norm-setting](http://www.stewartcoles.com/Coles%5Fand%5FLane%5F2023b%5Faccepted.pdf?ref=thenexusofprivacy.net) - August 19 2024: drop "Post Less" from the title of section 2; it continued to get enough pushback that it was a distraction. Also: tweak discussion of non-monolithic communities, add link to social.coop moderators' statement, expand footnote 1 - August 13: revised version published, no longer a draft! Thanks once again to everybody who gave feedback on the draft version. - August 3-12: discussions on [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/112900668673554213?ref=thenexusofprivacy.net), [lemmy.blahaj.zone,](https://lemmy.blahaj.zone/post/15011909?ref=thenexusofprivacy.net) [awful.systems](https://awful.systems/post/2057964?ref=thenexusofprivacy.net), [beehaw.org](https://beehaw.org/post/15353128?ref=thenexusofprivacy.net), and [lemmy.world](https://lemmy.world/post/18284182?ref=thenexusofprivacy.net), as well as some updates to the published draft. - August 3: text-only draft published as [4 things white people can do to start making the fediverse less toxic for Black people (DRAFT)](https://web.archive.org/web/20240813182623/https://privacy.thenexus.today/things-white-people-can-do-draft/) ## Notes 1 Based on the definition for anti-Blackness in Janvieve Williams Comrie, Antoinette M. Landor, Ph.D., Kwyn Townsend Riley, Jason D. Williamson, Esq.'s chapter on [Anti-Blackness and Colorism](https://subjectguides.library.american.edu/c.php?g=1025915&p=7749761&ref=thenexusofprivacy.net) in the [BU Center for Anti Racism Research's](https://www.bu.edu/antiracism-center/?ref=thenexusofprivacy.net) 2022 convening on [Moving Toward AntiBigotry](https://www.bu.edu/antiracism-center/files/2022/06/Moving-Towards-Antibigotry.pdf?ref=thenexusofprivacy.net). I added the words "software and systems" in the first draft, and added "across the world" based on a suggestion in [a Bluesky thread](https://bsky.app/profile/jdp23.bsky.social/post/3kywo7tc4e72f?ref=thenexusofprivacy.net). Quite a few responses to draft versions of this post seemed to think anti-Blackness was a US-only problem. Not so! Natalie Morris' [‘Anti-blackness’ shows how racism can be specifically damaging for black people](https://metro.co.uk/2020/03/20/what-is-anti-blackness-12279678/?ref=thenexusofprivacy.net) in *Metro* is an excellent overview from the UK (where Black people are around [10 times more likely](https://www.ethnicity-facts-figures.service.gov.uk/crime-justice-and-the-law/policing/stop-and-search/latest?ref=thenexusofprivacy.net) to be stopped and searched by the police than white people). Other examples: - EU Fundamental Rights Agency (FRA)'s [Black people in the EU face ever more racism](https://fra.europa.eu/en/news/2023/black-people-eu-face-ever-more-racism?ref=thenexusofprivacy.net) discusses their 2023 [Being Black in the EU](https://fra.europa.eu/en/publication/2023/being-black-eu?ref=thenexusofprivacy.net) report, which notes that racism in the EU remains "pervasive and relentless." - ANTAR's [Racism in Australia](https://antar.org.au/issues/racism/racism-in-australia/?ref=thenexusofprivacy.net) notes that "Since European invasion in 1788, race and racism have been foundational to the logic of Australian settler colonialism and the processes by which the lands we now call Australia were stolen and settled," and UN experts say [people of African descent are living under a siege of racism in Australia](https://www.ohchr.org/en/press-releases/2022/12/australia-people-african-descent-living-under-siege-racism-say-un-experts?ref=thenexusofprivacy.net) - Erica Kanesaka's [Racist Attachments: Dakko-chan, Black Kitsch, and Kawaii Culture](https://muse.jhu.edu/article/847016?ref=thenexusofprivacy.net) notes that "anti-Black racism is not limited to Western cultures, and histories of colorism, colonialism, and class stratification have led to different formulations of anti-Blackness being found (alongside more local forms of racism) in China, Japan, and Korea." Of course, anti-Blackness manifests itself somewhat differently in different cultures. Indeed, one common of form of anti-Blackness in Europe, Australia, and Asia is to think it's only an American problem! 2 Terminology note: "Black person" and "Black people" are preferred terminology. Referring to Black people as "Blacks" or "the Blacks" is considered offensive: omitting "person" or "people" denies Black people's humanity, so it's dehumanizing. Similarly, the B in Black is capitalized in this context because the lowercase word black is a color, not a person. CU Denver's [Is the B in Black Capitalized? Yes.](https://news.ucdenver.edu/is-the-b-in-black-capitalized-yes/?ref=thenexusofprivacy.net) and [Why we capitalize ‘Black’ (and not ‘white’)](https://www.cjr.org/analysis/capital-b-black-styleguide.php?ref=thenexusofprivacy.net) in *Columbia Journalism Review* have more on the capitalization. 3 Moderators responding publicly to problematic posts – calling in, or announcing that a post has been removed and why – can help educate others. It also sends a strong signal that your instance cares about anti-Blackness. Then again, responding publicly can also call more attention to the post, which can sometimes be counter-productive. So there aren't any hard-and-fast guidelines on when it's best to handle it in public or just deal with it in backchannel conversations. 4 Intersectionality is a term coined by Prof. Kimberlé Crenshaw in her classic 1989 law review [Demarginalizing the Intersection of Race and Sex: A Black Feminist Critique of Antidiscrimination Doctrine, Feminist Theory and Antiracist Politics](https://law.ucla.edu/news/intersectionality-30-qa-kimberle-crenshaw?ref=thenexusofprivacy.net) to the way that different forms of social inequality or oppression manifest and compound each other. Dr. Patricia Hill Collins' 1990 work [Back Feminist Thought: Knowledge, Consciousness, and the Politics of Empowerment,](https://www.routledge.com/Black-Feminist-Thought-Knowledge-Consciousness-and-the-Politics-of-Empowerment/HillCollins/p/book/9780415964722?ref=thenexusofprivacy.net) introduced the similar concept of the *matrix of domination.* Crenshaw's [The Urgency of Intersectionality](https://www.ted.com/talks/kimberle%5Fcrenshaw%5Fthe%5Furgency%5Fof%5Fintersectionality?subtitle=en&ref=thenexusofprivacy.net) video (2016), and discussion with Jane Coaston in[The intersectionality wars](https://www.vox.com/the-highlight/2019/5/20/18542843/intersectionality-conservatism-law-race-gender-discrimination?ref=thenexusofprivacy.net), on Vox (2019), are good introductions; so is Collins' [Intersectionalty and Sociology](https://www.youtube.com/watch?v=Qnr9VK%5Fo-3k&ref=thenexusofprivacy.net) video. The African-American Policy Forum's outstanding [Intersectionality Matters! podcast](https://podcasts.apple.com/us/podcast/intersectionality-matters/id1441348908?ref=thenexusofprivacy.net) and [Under the Black Light](https://www.youtube.com/playlist?list=PLHHWJ0NiFxy7OAMYJL70mdIEoHw3kj9PShttps://www.aapf.org/blacklight&ref=thenexusofprivacy.net) video series, and Collins' equally-outstanding [Intersectionality as Critical Social Theory](https://www.dukeupress.edu/intersectionality-as-critical-social-theory?ref=thenexusofprivacy.net), have more. 5 2SLGBTQIA+ is a shorthand for [ two-sprit](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today), lesbian, gay, gender non-conforming, genderqueer, bi, trans, queer, questioning, intersex, asexual, agender, and others (including non-binary people) who are not straight, cis, and heteronormative. 2S is at the front (following Canadian usage and based on input from two-spirit elders) to highlight that Indigenous and Native people were the First Nations on this land; the + at the end highlights that this isn't an exhaustive list. [ Julia Serrano's trans, gender, sexuality, and activism glossary](https://www.juliaserano.com/terminology.html?ref=privacy.thenexus.today) has definitions for most of these terms, and discusses the tensions between ever-growing and always incomplete acronyms and more abstract terms like "gender and sexual minorities".[ OACAS Library Guides' Two-spirit identities page](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today) goes into more detail on this often-overlooked intersectional aspect of non-cis identity. 6 The link above goes to a Google Drive doc; diaspora.im admin Fyrfli has [a version available here.](https://fyrfli.cloud/s/mqxCS5AKmoEn9co?ref=thenexusofprivacy.net) ## [](#notes) 7 There are examples of racism against specific ethnic subgroups of white people, for example discrimination against Gypsies, Roma, and Travelers in the UK is considered racism, and includes racism against white Gypsies, Roma, and Travelers. ### Ah, Lemmy: Racism and Denial in the Threadiverse (DRAFT) URL: https://thenexusofprivacy.net/racism-and-denial-in-the-threadiverse/ Last updated: 2026-04-16T03:19:33.000Z > Draft! Work in progress! > Feedback welcome! > Join the discussion in [the Nexus of Privacy Lemmy community](https://lemmy.blahaj.zone/post/15354231?ref=thenexusofprivacy.net) When I shared a draft of [4 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/things-white-people-can-do-draft/) to multiple Lemmy communities,1 I got some very helpful feedback ... but also a lot of responses from people who thought that anti-Blackness and racism weren't issues on Lemmy. It's certainly true that a lot more has been written about racism on Mastodon, Pleroma and elsewhere in the microblogging side of the fediverse. The "threadiverse" – federated threaded discussions, including link aggregators like Lemmy as well as forums – hasn't gotten as much attention. But tht doesn't mean racism isn't a problem there as well! So I followed up with a request for examples of racism2, and again got some helpful input ... and a lot of denial. And as with the original threads, there was also a fair amount of hostility. ![A Lemmy post: "You are the living embodiment of cringe wokeness and the fact that you’re being downvoted even on a left-wing platform where basically everyone is already against racism should make you question some of your life choices."](https://thenexusofprivacy.net/content/images/2024/08/living-embodiment-of-cringe-1.png) The denial was particularly funny since several of the threads had spectacular examples of anti-Blackness. Moderators deleted some of the worst examples, like this one (you can probably guess what the *removed* word was originally). ![ALemmy post: Go get raped by a pack of *removed* if you want "no White toxicity"](https://thenexusofprivacy.net/content/images/2024/08/Screenshot-2024-08-13-at-9.21.45-AM.png) Still, there are plenty of examples of racism and denial still visible in the threads. For example: - The lemmy.world discussion of the draft post has now gotten voted down to -73, and the request for examples of racism is at -20 so far. Trying to bury discussions of racism is in fact racist. - There were several variants of "I don't see color" or "race doesn't/shouldn't matter online." Fitchburg State's [What Does Racism Look Like? Colorblindness](https://fitchburgstate.libguides.com/c.php?g=1046516&p=7616506&ref=thenexusofprivacy.net) page has a short overview on why statements like this are so problematic; Eduardo Bonilla-Silva's [Racism without Racists: Color-Blind Racism and the Persistence of Racial Inequality in America](https://rowman.com/ISBN/9781538151419/Racism-without-Racists-Color-Blind-Racism-and-the-Persistence-of-Racial-Inequality-in-America-Sixth-Edition?ref=thenexusofprivacy.net) goes into detail. - Multiple people stated or implied that *I* was the racist – either because I kept bringing up racism or because I had suggested that white people should post less. No, sorry, "reverse racism" isn't a thing – and claiming that it exists is racist. [Ahmer Rahman on ‘reverse racism’](https://www.youtube.com/watch?v=dw%5FmRaIHb-M&ref=thenexusofprivacy.net) There were also multiple accusations that I was trolling – including one that I was probably a right-winger 🤣 Meanwhile, helpful commenters noted other patterns of racism on Lemmy: - the comment section on pretty much any post mentioning Islam - an argument about Black hair styles being banned in schools with a user who turned out to be sealioning - picking on people who use habitual-be, or specific words and expressions common among African-American Vernacular English speakers - white people "*more than happy* to talk over subjects-of-empire like this is still Reddit out here" - inflammatory random shitposts that the commenter had blocked and reported - uses of "playing the race card" in a derogatory sense in response to others talking about systemic racist violence (although the commenter also mentioned that moderators had taken them down) It's certainly true that when moderators react quickly, banning egregious posts, that cuts down how many people see them. As Rimu pointed out in a helpful comment, one of Lemmy's advantages is that communities also have moderators (as opposed to Mastodon et al where the only moderation happens at the instance level). The beehaw.org moderators in particular did a great job wading in, deleting over a dozen posts (including the one that compared me to Hitler that I unfortunately didn't manage to screenshot), and engaging with people who had made other less egregious posts to try to explain the problem to them – a great example of the "calling in" tactic I talked about here. Still, even with good moderation, the targets of the racism often see the posts before the moderators act on them. And as these threads show, there's plenty of stuff that moderators don't take action on. It's also true that people on instances that block known sources of racism see less of it. Then again, the instances that people cited as blockworthy in these discussions include three of the top five most-active Lemmy instances, with more than half the active users on Lemmy as a whole.3 And when I quickly checked the other two top-five instances, none of them were blocking all the instances that had been cited. Not only that, microblogging instances can comment on Lemmy posts, so one of my threads got hit by racism from well-known bad actors like shitposter.world who weren't blocked. So, as on Mastodon, [defederation is a blunt but powerful tool](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/#blunt-but-powerful) ... but doesn't solve the problem. Of course, Lemmy isn't the only threadiverse software out there. Newer platforms like Piefed are designed with more attention to safety; older forum software like NodeBB that's now adding federation has richer moderation technology. And even with Lemmy, instances like Beehaw are working hard to create a safer and more-inclusive environment. So just as with the rest of the fediverse, the threadiverse is still an opportunity to overcome the entrenched racism. But if anybody tries to tell you that racism isn't currently a problem on Lemmy ... well, at least now there's a (draft) post to point them to. ## Notes 1 including [lemmy.blahaj.zone/c/nexusofprivacy](https://lemmy.blahaj.zone/post/15011909?ref=thenexusofprivacy.net), [lemmy.world/c/fediverse](https://lemmy.world/c/fediverse?ref=thenexusofprivacy.net), [beehaw.org/c/technology](https://beehaw.org/post/15353128?ref=thenexusofprivacy.net), and [awful.systems/c/techtakes](https://awful.systems/post/2057964?ref=thenexusofprivacy.net). 2 on [lemmy.blahaj.zone/c/nexusofprivacy](https://lemmy.blahaj.zone/post/15258152?ref=thenexusofprivacy.net), [lemmy.ml/c/AskLemmy](https://lemmy.ml/post/19012738?ref=thenexusofprivacy.net) and [lemmy.world/c/fediverse](https://lemmy.world/post/18536867?ref=thenexusofprivacy.net) 3 [https://fedidb.org/software/lemmy](https://fedidb.org/software/lemmy?ref=thenexusofprivacy.net); sort by MAU to see the list. ### Fork it! It's time for a Mastodon hard fork (UPDATED) URL: https://thenexusofprivacy.net/mastodon-hard-fork/ Last updated: 2026-04-16T03:19:02.000Z *Last updated May 8\. See the* [*update log*](#update-log) *at the bottom for more details.* > [Join the discussion on Mastodon!](https://infosec.exchange/@thenexusofprivacy/112352591810062022?ref=thenexusofprivacy.net) > "A hard fork is when a group of developers disagrees with the direction of the project and decides to create a divergent version more in line with their own vision." > > – [producsingoss.com](https://producingoss.com/en/forks.html?ref=thenexusofprivacy.net) A Mastodon hard fork that focuses on safety, community, accessibility, and working well with others has a great opportunity to improve safety in the fediverse, the dynamics of the Mastodon ecosystem, and fediverse software development in general. - The official Mastodon software has a long history of *not* prioritizing safety or the needs of small-to-medium size community-focused instances, so a a hard fork has a chance to make rapid progress on all these fronts. - A hard fork is also a chance to establish a new culture, with more inclusive environment that encourages broad and diverse participation and a commitment to a more consensus-oriented decision-making process. - A hard fork can attract volunteers who aren't interested in working on the official fork, and tap into additional funding. - If the new hard fork starts with a goal of working well with others (volunteers, existing and new forks, apps, instance admins, and other fediverse software platforms) it can help the broader ecosystem as well – including the official Mastodon fork as well as newer platforms that are focusing more on safety from the beginning. Of course, a hard fork is challenging. As clar fon [says](https://toot.cat/@clarfonthey/112346592350753675?ref=thenexusofprivacy.net) > "sorry but the answer to "why is there not a fork yet" is last time we tried literally no one wanted to help (roaring applause for the cause, crickets when it came to doing shit), there was a fucking pandemic, and the only people on the team were too disabled and burnt out to help out, especially with zero support in their endeavours" This time, though, there are some big differences. Most importantly: - The wave of interest in the fediverse – with software like Ghost, Wordpress, Flipboard adding integrations as well as innovation from fediverse platforms and apps – means that there's more funding available. - Mastodon's embrace of Threads (the new social network from Facebook's and Instagram's parent company Meta) increases the urgency for a hard fork for the wide swathes of the Mastodon ecosystem that want nothing to do with [Mark F\*\*\*king Zuckerberg](https://catvalente.substack.com/p/mark-fking-zuckerberg-is-not-your?ref=privacy.thenexus.today) and his social networks – and, [since Meta allows anti-LGBTQ+ hate groups and bigotry](https://glaad.org/smsi/report-meta-fails-to-moderate-extreme-anti-trans-hate-across-facebook-instagram-and-threads/?ref=thenexusofprivacy.net), increases the urgency of focusing on safety for everybody using Mastodon It's worth highlighting that a new hard fork *complements* the official Mastodon fork, which is likely to remain a better alternative for large, Threads-friendly instances like mastodon.social. But Mastodon has a very complex support matrix, a lot of technical debt in the code, and a lot on its plate including quite possibly having to devote resources to the Threads integration.[0](#notes) A hard fork has a chance to make rapid progress. And if the hard fork can establish a more inclusive culture, that can also help the official Mastodon fork evolve its culture more quickly if it wants to. There's a lot to discuss here, so this is a looong post. If you're already convinved that a hard fork makes sense, feel free to skip ahead to [A lot of open questions - and a lot of potential upside](#open-questions-and-upside). And more generally, if there are some sections that interest you more than others feel free to skip around. ### Contents **Part 1** - [A missing fork in the landscape](#a-missing-fork) - [Okay, but why a *hard* fork?](#why-a-hard-fork) - [There's a big elephant in the federated room (and I don't mean Mastodon)](#bigger-elephant) - [An opportunity for broad participation and a cultural reset](#cultural-reset) **Part 2** - [Safety is an especially good area to focus on](#safety) - [There are also a lot of other areas for improvement](#areas-for-improvement) **Part 3** - [It's not as easy as it sounds ... ](#not-so-easy) - [But it's not like it defies the laws of physics!](#far-from-impossible) - [What about funding?](#what-about-funding) - [Make sure most of the funding goes to Black, Indigenous, Muslim, trans, queer, and disabled people](#fund-marginalized-people) **Part 4** - [It's not an either-or situation](#either-or) - [A lot of open questions - and a lot of potential upside](#open-questions-and-upside) - [Stay tuned!](#stay-tuned) ## A missing fork in the landscape > "\[T\]\[he fringe development scene on Mastodon ... has been the dominant force by which external development has taken place on the network since mid‐to‐late 2017." > > – Margaret KIBI's [Progressing Fringe Mastodev](https://www.u2764.com/NFIC/2019-09-15/fringe-progress/?ref=thenexusofprivacy.net), 2019 Ever since the early days of Mastodon, forks like glitch-soc (aka Mastodon Glitch Edition), Hometown, Fedibird, treehouse, and toot.cafe have functionality that people using the official Mastodon software can only fantasize about. And even though (as KIBI notes) "there is not necessarily a strong impetus to push for their adoption across the broader network," much of today's Mastodon functionality originated in forks. That said, these forks are all based on the official open-source software project from Mastodon gGmbH, the German non-profit[1](#fn-ggmbh) that holds the copyright to the Mastodon code, runs mastodon.social and the joinmastodon.org landing page, and provides the official mobile apps. Most of the 10,000+ Mastodon *instances* (aka servers or service providers) run the official release, including mastodon.social and almost all of the biggest – and some of the best-known hosting services only support the official release but not forks.[2](#fn-hosting-services) One of the reasons this matters so much is that historically, Mastodon founder and Mastodon gGmbH CEO Eugen Rochko has run the official release with a BDFL (Benevolent Dictator for Life) style. In [Can Mastodon seize the moment from Twitter?](https://www.theverge.com/23658648/mastodon-ceo-twitter-interview-elon-musk-twitter?ref=thenexusofprivacy.net) (November 2022)*,* Rochko discussed why he thinks the BDFL model leads to better results for open-source projects: > "A good product needs long-term vision and it needs cohesive vision. That’s something that a committee cannot give. When you have a lot of people who have pet issues and one thing that they care about, it kind of ends up being a patchwork.... Sometimes, you need to make executive decisions about changing stuff in a serious way, which might not be popular with what most people in a committee would want." So if Rochko thinks that [functionality that lets people protect themselves against harassment (and is ideal for instances with local communities) shouldn't be available in the official software](https://github.com/hometown-fork/hometown/wiki/Local-only-posting?ref=thenexusofprivacy.net) – even though it was implemented in Glitch-soc *since 2017* and is available in other forks as well – too bad for people whose pet issues are privacy and community. For people whose pet issue is accessibility, if Rochko says a design decision that make the software harder for use with low vision get as [a "feature not a bug."](https://github.com/mastodon/mastodon/pull/9898?ref=privacy.thenexus.today#issuecomment-456410756), it's not available in the official software – even though, guess what, it's been implemented in a fork. And these are just a few examples. The sections below on [Safety is an especially good area to focus on](#safety) and [There are also a lot of other areas for improvement ](#areas-for-improvement)have lots more. This isn't meant to undercut what Rochko has accomplished. As Ro says in [A Case for Community](https://h-i.works/2024/04/a-case-for-community.html?ref=thenexusofprivacy.net): > "To make a positive start, I want to give some props to Eugen Rochko, the original creator of Mastodon. The explosion of independent social media onto the global landscape is mainly due to the adoption of the idea he put together in 2016\. It should be remembered that many people's introduction to self-hosted communities was Mastodon. In that context, Rochko deserves respect for being the door that introduced people to a new concept." But as Ro also points out, Rochko's leadership style "has resisted the diversification of the platform experience, choosing to cling to a hard-line stance on what he feels the project should be." A fork that focuses on safety, community, and accessibility can help change those dynamics. - Most importantly, making the new fork's improvements available to other forks can provide more safety to people on instances running those forks. - Ideally, the official Mastodon release will also adopt these improvements, making them available via the offical installation and hosting companies. - If not, then instances that want to provide more safety and better accessibility to their users – and hosting companies that want to provide offerings for people who want to prioritize safety, community, and accessibility – will have an option. ## Okay, but why a *hard* fork? Depending on how receptive the official software project is, many of these benefits could potentially be achieved at least to some extent without a hard fork. As [It's not as easy as it sounds ... ](#not-so-easy)discusses, a hard fork is challenging; some argue that it's not the right path. On the other hand, as I'll discuss in the next few sections, there are also some strong arguments in favor of a hard fork. To start with, as the example of local-only posts illustrates, safety improvements that are seen as conflicting with Mastodon's vision and priorities are likely to be rejected from the official software. For that matter, even safety functionality that *does* appear to align with Mastodon's vision doesn't necessarily get prioritized. The recent [confirmation](https://github.com/mastodon/mastodon/pull/25691?ref=thenexusofprivacy.net) that release 4.3 still won't make it easy for new instances to start with a blocklist that protects people from the nazis and TERFs that are active on the fediverse is a good example. Of course, it's possible to add these safety improvements in a soft fork. But doesn't it make more sense to have the base software that everybody uses be as safety-focused as possible? Another point in favor of a hard fork is the need for the Mastodon gGmbH to balance a lot of priorities – including mastodon.social, by far the biggest instance on the fediverse with almost 300,000 active users. Over the years, I've heard from many Mastodon instance admins and users on smaller, more community-focused servers that their priorities take a back seat. Rochko's decision last year to change the signup process to default new users to mastodon.social highlights one aspect of the conflict of interest here: changes that primarily benefit mastodon.social aren't useful to other instances. And conversely, community-focused changes aren't useful to mastodon.social, so don't get prioritized – or even (as in the case of local-only posts) accepted once they're implemented. ## There's a big elephant in the federated room (and I don't mean Mastodon) > "DO NOT TRUST THIS BIPED." > > – Catherynne M. Valente, [Mark F\*\*\*king Zuckerberg Is Not Your Friend](https://catvalente.substack.com/p/mark-fking-zuckerberg-is-not-your?ref=privacy.thenexus.today), July 2023 Mastodon's integration with Threads, the new Twitter-like social network from Facebook's and Instagram's parent company Meta, increases the urgency for a fork focusing on safety – and, for many, provides even more reasons for a hard fork. As Erin Kissane's outstanding [Untangling Threads](https://erinkissane.com/untangling-threads?ref=privacy.thenexus.today) and my own [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) discuss, there are arguments for and against working with Threads. For people on all sides of the issue, though, the [extreme anti-trans hate groups Meta fails to moderate across Facebook, Instagram, and Threads](https://glaad.org/smsi/report-meta-fails-to-moderate-extreme-anti-trans-hate-across-facebook-instagram-and-threads/?ref=thenexusofprivacy.net) and [Meta's history of making money from white supremacists](https://www.washingtonpost.com/technology/2022/08/10/facebook-white-supremacy-ads/?ref=thenexusofprivacy.net) provide very concrete arguments for increasing the focus on safety. Will Mastodon's upcoming release 4.3 provide more tools for admins on instances federating with Threads – and for people on those instances – to protect themselves against these anti-trans hate groups and white supremacists? We shall see, but early returns aren't encouraging. For example, when Threads announced the very sensible policy of allowing individual users opt in to federating, Rochko expressed his disappointment ... so I'm not holding my breath for an equivalent option in Mastodon. But even if Mastodon *does* start providing better safety tools, Rochko's [warm welcome to Threads](https://blog.joinmastodon.org/2023/07/what-to-know-about-threads/?ref=thenexusofprivacy.net) and mastodon.social's decision to federate with Threads will also add momentum to calls for a hard fork. From mastodon.social's perspective, making federation with Threads works smoothly is valuable. As Rochko says in [How Mastodon made friends with Meta](https://www.platformer.news/mastodon-interview-eugen-rochko-meta-bluesky-threads-federation/?ref=thenexusofprivacy.net): > "So they reached out to us and we had conversations about what they want to do, how they can do it, and we had more detailed conversations about how to do X, how to do Y protocol-wise. We helped them resolve some issues when they launched their first test of the federation because we want to see them succeed with this plan, so we help them debug and troubleshoot some of the stuff that they're doing. Basically, we're talking with each other about whatever issues come up." But from the perspective of hundreds of instances have signed the [anti-Meta FediPact](https://fedipact.online/?ref=thenexusofprivacy.net), and [hundreds more](https://fedipact.veganism.social/?ref=thenexusofprivacy.net) are blocking Threads without signing the pact, any resources devoted to to improving the Threads/Mastodon integration are wasted. What happens when Threads turns on two-way federation and the hate groups, white supremacists, and spam bots on Threads start hassling people in the fediverse? As more Threads users turn on federation, will that lead to scalability problems? What if an unexpected privacy issue surfaces? What if the election disinfo and coup that's likely to surge on Threads starts to trickle over into the fediverse? Any of these things could require a big chunk of work from the Mastodon team. Not only that, for people who are suspicious of Meta, a hard fork that's more insulated from Meta's influence has some obvious benefits. And I'm not just talking about FediPact signers here! One of the few things about Threads pretty much everybody in the fediverse agrees on is that Meta can't be trusted So even many instances and software developers who are working with Threads today can see the value of an independent alternative. But Rochko has downplayed the potential safety, privacy, and cultural issues of the Threads integration[3](#fn-rochko-on-threads) as well as the [possible embrace-and-extend threat](https://thenexusofprivacy.net/embrace-extend-and-exploit/). Does he really understand the risks here? Meta's plans to offer automated moderation tools to fediverse admins (discussed by Rachel Lambert and Peter Cottle on the Dot Social podcast [Threads Has Entered the Fediverse](https://flipboard.video/w/2q29uCjnHjot1CHu1CZBim?ref=thenexusofprivacy.net)) further heighten these concerns. On the one hand, it aligns well with the direcction Mastodon CTO Renaud Chaput sketches in [Evolving Mastodon’s Trust & Safety Features](http://www.renchap.com/blog/post/evolving%5Fmastodon%5Ftrust%5Fand%5Fsafety/?ref=thenexusofprivacy.net) (also July 2023) for "configuring trusted providers" for moderation activities. On the other hand, Meta's moderation tools are racist and anti-LGBTQ+, and produce a lot of false positives (as Black activists and supporters of Palestine on Facebook, Instagram, and Threads know only too well). And what else will Meta do with the data these services collect? Of course, Lambert and Cottle emphasized that Meta doesn't plan to force anybody to use these tools – and the trusted provider architecture is useful in other scenarios as well. Still, at best the effort Mastodon devotes to supporting Meta's moderation tools is wasted for instances that don't want racist, anti-LGBTQ+ automated moderation. ## An opportunity for broad participation and a cultural reset [![Yes, I'm interested in being an early user and providing feedback(56 votes). Yes, I'd consider helping with development and/or design (13 votes) Yes, I'd consider helping with accessibility (4 votes) Yes, I'd consider helping with documentation (15 votes) Yes, I'd consider helping with testing (17 votes) Yes, I'd consider helping with translations (15 votes) Yes, I'd consider donating to a crowdfunding campaign(24 votes). Yes, I'd consider helping in some other way (17 votes). Sorry, I'd like to help but won't have time(28 votes). No, this isn't something I'd consider getting involved in(26 votes).](https://thenexusofprivacy.net/content/images/2024/04/are-people-interested.png)](https://infosec.exchange/@thenexusofprivacy/112294665652523312?ref=thenexusofprivacy.net) Responses to [a Mastodon poll](https://infosec.exchange/@thenexusofprivacy/112294665652523312?ref=thenexusofprivacy.net) on whether people were interested in helping a new fork of Mastodon that "starts up with an explicit goal of taking a community-driven and inclusive approach -- and prioritizing safety and accessibilty", April 18-25 > **Update*: the original version of this post included an edited excerpt of this poll, and didn't link to the original poll or make it clear that I had edited it. My apologies, that was a mistake.* A hard fork is also a good chance to attract new volunteers. The [poll](https://infosec.exchange/@thenexusofprivacy/112294665652523312?ref=thenexusofprivacy.net) I did with the draft version of this post only got 118 responses, and it's obviously a self-selecting sample, but the results are still interesting: people with a wide variety of skills are at least potentially interested. I've heard from many people that the official Mastodon fork's culture is very developer-centric, so a fork that values other particpation equally could be very attractive to a lot of people.[4](https://thenexusofprivacy.net/ghost/#fn-typical-lemmy-experience) And a new fork is an opportunity for a new culture. As long-time fork developer Lady notes, > "a fork absolutely needs to have good practices in place for volunteers. this is something mastodon has historically struggled with." Cassian's [I left Mastodon 27 days ago](https://cassolotl.medium.com/i-left-mastodon-27-days-ago-ae34919290e1?ref=thenexusofprivacy.net) (2018), hoodieaidakitten's [Mastodon’s Complicated Relationship with Queer Activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=privacy.thenexus.today) (2018) and Ana Valens' [Mastodon is crumbling—and many blame its creator](https://www.dailydot.com/debug/mastodon-fediverse-eugen-rochko/?ref=thenexusofprivacy.net) (2019) highight some of the Mastodon's struggles on this front; I saw a similar example of somebody not being acknowledged in the 4.2 release last summer. A new fork doesn't have to inherit those problems. Getting good practices in place for volunteers – and for working with other forks and apps – up front is a good way to make progress. A new fork's also an opportunity for more diverse participation. You don't have to be a diversity-in-tech expert to see that establishing accessibility as a priority up front, funding accessibility work, and valuing and appreciating accessibility feedback and testing are all likely to get more disabled people involved. And more generally, racial and intersectional diversity isn't something Mastodon has ever really focused on. How well does the project currently adhere to best practices for inclusive culture? How racially diverse is the Mastodon team? What percentage of the budget goes to Black and Indigenous developers, to women of color, to trans and queer people of color? Of course, the culture of the official Mastodon fork isn't set in stone – and they also have a great opportunity to make progress on its culture and change its priorities. Rochko is wearing a lot of hats these days, and long-time Mastodon contributor (and trust and safety expert) Emelia Smith reports that [Claire is now leading Mastodon development, with support from part-time CTO Renaud](https://medium.com/@thisismissem/why-a-hard-fork-of-mastodon-isnt-the-way-b37aecfe5c86?ref=thenexusofprivacy.net). It could be a natural time for the fork to evolve away from its current BDFL style and developer-centricity; get better at acknowledging contributions and working with other fedivese development teams; diversify paricipation; seek out and listen to marginalized instance admins and community members, and fund more accessibility, and safety community workwork. Still, old habits and power structures die hard. The longer a culture has been in place – in an open-source project, or on a social network – the harder it is to change it. And as Smith points out, the Mastodon fork's development resources are currently limited, and there's a lot on their plates, which makes it all the more challenging. So even if the official Mastodon fork decides to go this route, it's likely to be harder and take longer for them to change their culture significantly. A new fork starting with a new culture is complementary – and could in turn help the official fork make progress more quickly. And progress could have a big effect on the Mastodon ecosystem and the broader fediverse. As Dr. Johnathan Flowers says in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) (December 2022) > "We need to acknowledge that there is a history on Mastodon of instances of color being marginalized, being discriminated against. There is a history users of color being subject to racist, to anti-Semitic, to homophobic kinds of abuse. There is a history of the kinds of similar kinds of violence against users of color, against disabled users, against marginalized users on Mastodon that there is on Twitter ..." Of course, Flowers is talking about Mastodon as a whole, not the software development in particular. Still, Mastodon's lack of safety have certainly contributed to the bad experiences that so many marginalized people have on Mastodon,[5](#fn-lack-of-safety) so a fork that makes progress on that front could have a big impact. And a community-oriented fork with diverse participation is more likely to listens to, work with, and prioritizes the needs of marginalized people – an approach that creates that works better for everybody, as Afsaneh Rigot explains in [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=privacy.thenexus.today). ## Safety is an especially good area to focus on > "And speaking of vital techniques for developing software that's safer and more secure, the principles and practices of privacy by design highlight the opportunities for short-term low-hanging fruit – as well as longer-term directions." > > – [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/), Febuary 2024 I've talked a lot about the value of a more safety-focused fork, so it's worth going into some detail on the opportunities for progress. In the short term, there are a lot of straightforward safety-related improvements over today's official Mastodon release. For example: - Supporting local-only posts, which forks like Glitch and Hometown have had them since 2017\. - Turning on "authorized fetch" (the magic admin setting that makes blocking more effective) by default. - Changing the default for safety-related preferences like approving followers – and for whether or not to show followers on public profiles. - Prohibit followers-only replies to public or unlisted posts, closing the abuse vector Mekka Okereke describes [here](https://hachyderm.io/@mekkaokereke/111010438055247043?ref=thenexusofprivacy.net) - Making it easy to load a basic [blocklist](https://thenexusofprivacy.net/blocklists-in-the-fediverse/) when a new instance starts up so people aren't as vulnerable to harassment from the nazis and TERFs that hang out in the vile sections of today's fediverse. - Make RSS feeds opt-in, as in Hometown.[6](#fn-rss) The code for many of these already exists. Others are minor changes, like changing the initial value of a default setting, and in some cases also adding in mechanisms to change it via the admin UI, API, and the tootctl management tool. But they either clash with Rochko's vision for the software, or (like making it easy for new instances to start with a blocklist) haven't had resources devoted to them. Other safety improvements require more effort, so won't happen until there's additional funding and people to work on them. Still, the Mastodon team under Rochko consistently *hasn't* prioritized safety; a quick look through the Mastodon GitHub has many safety-related issues that have been open for years. As I wrote in November 2022's [Does Mastodon really prioritize stopping harassment?](https://thenexusofprivacy.net/mastodon-a-partial-history/#does-mastodon-really-prioritize-stopping-harassment) > "For a platform that supposedly prioritizes anti-abuse Mastodon's lack of progress on this over the last several years is really striking." So progress is much more likely to happen in a fork that focuses on safety than in the mainline Mastodon code. A few key areas especially worth considering: - adding the ability to take public posts private, a valuable defense against dogpiling that's likely to become even more important once Mastodon follows through on its plans to introduce quote boosts in a future release - allowing control over who can reply to posts - improve blocking – both for individuals and of entire domains – which today has a lot of limitations - introduce a new "non-public" visibility to complement "public" and "quiet public" (previously known as "unlisted", but getting renamed in the upcoming Mastodon 4.3 release) - improving consent-based federation, which Mastodon documentation currently describes as "contrary to Mastodon's mission" - implementing user experience improvements like[ Federation Safety Enhancement Project (FSEP)'s "following UI integration"](https://thenexusofprivacy.net/the-bad-space/#fsep) - providing hooks to support fediverse equivalents of tools from other platforms like [Block Party](https://www.blockpartyapp.com/how-it-works/?ref=privacy.thenexus.today) and [Filter Buddy](https://shagunjhaver.com/research/articles/jhaver-2022-filterbuddy/jhaver-2022-filterbuddy.pdf?ref=privacy.thenexus.today) that allow for collaborative defense against harassment and toxic content can apply in a federated context ## There are also a lot of other areas for improvement > "If it's not wildly different, but noticeably better, you'll get faster adoption.... After you gain some momentum then you do the big stuff." > > – fancysandwiches I'm not going to go into as much detail on community and accessibility as I did with safety, but the same patterns are there: straightforward short-term improvements, and opportunities for more significant changes long-term. With accessibility, open Github issues related to link underlining, color contrast, and CamelCasing hashtags offer straightforward opportunies for improvements.[7 ](#fn-hashtags)More ambitiously, how hard would it be for the software to offer some support for accepting an #AltText4You suggestion for images that don't have any alt text? There's also important overlap between safety and accessibility. Changing the defaults for safety-related preferences to be more protective is also valuable from an accessibility perspective; with current defaults, disabled people are left at risk if the preference pane isn't accessible (screenreader or mouse navigation issues, text that't been translated to a person's native languag, etc). An option to get use the web interface without javascript, is good for security and privacy as well as accessibility. And there's overlap between safety and community as well, including (aat the risk of repeating myself), LOCAL ONLY POSTS HAVE BEEN IMPLEMENTED IN FORKS SINCE 2017!!!!! Forks are starting to implement "bubbles" (currently only available in Akkoma), a useful towards multi-instance communities (or communities-of-communities) that could be extended to help with safety as well. Local-only profiles (or a local-only profile tabs) are an obvious complement to local-only posts. Longer-term safety directions like improving consent-based federation and supporting collaborative self-defense tools like [Block Party](https://www.blockpartyapp.com/how-it-works/?ref=privacy.thenexus.today) and [Filter Buddy](https://shagunjhaver.com/research/articles/jhaver-2022-filterbuddy/jhaver-2022-filterbuddy.pdf?ref=privacy.thenexus.today) also have value in terms of community. And looking even more Broadly, it's worth highlighting that a new hard fork that starts with Glitch or Hometown and merges in additional features from other forks would also have many other advantages over today's Mastodon.2 Formatted posts, and the Glitch UI improvements, are straightforward examples. And once you start looking at the Mastodon github issues, there are lots of small-but-valuable improvements. One of my favorite examples of this is making the maximm post length easily configurable: - [cassolotl suggested this in 2017](https://github.com/mastodon/mastodon/issues/5693?ref=thenexusofprivacy.net) and it was quickly [implemented by lambadalamda](https://github.com/mastodon/mastodon/pull/5697?ref=thenexusofprivacy.net) and [integrated into glitch-soc](https://github.com/glitch-soc/mastodon/pull/223?ref=thenexusofprivacy.net) - Rochko [rejected](https://github.com/mastodon/mastodon/pull/5697?ref=thenexusofprivacy.net#issuecomment-345078582) it. - Since then, it's been proposed – and rejected – repeatedly: in [2018](https://github.com/mastodon/mastodon/issues/6388?ref=thenexusofprivacy.net), [2019](https://github.com/mastodon/mastodon/issues/12265?ref=thenexusofprivacy.net), [2022](https://github.com/mastodon/mastodon/issues/12265?ref=thenexusofprivacy.net#issuecomment-1336259510), [2023](https://github.com/mastodon/mastodon/issues/24147?ref=thenexusofprivacy.net), and quite possibly others I missed in my quick search of Mastodon issues This by the way is a great example of the impact of Mastodon's historical development style. Rochko's the BDFL, so if he thinks it should be hard for admins to set up their instance the way they want, then he gets to make it hard for admins to set up their instance they way they want. But you can certainly see why admins don't like that and see it as example of Mastodon not working well with others! Of course, any fork is going to have to make choices about what functionality does or doesn't go in – and you can't please everybody. Still, there are plenty of opportunities for improvements over the official Mastodon fork that can provide a lot of value to small-to-medium size community-focused instances. ## It's not as easy as it sounds ... > "Reminder to people who say "Let's fork Mastodon"... the code is the easy part (and that's also very hard)" > > – [aus.social admin Shlee](https://aus.social/@shlee/111814026772974577?ref=thenexusofprivacy.net) > "The thing is, **maintaining a hard fork is not a cakewalk."** > > – Sean Tilley in [The Trouble with Forking Mastodon](https://wedistribute.org/2024/05/forking-mastodon/?ref=thenexusofprivacy.net) on We Distribute The opportunities for improvement and issues with Mastodon's culture have been there for years, but previous hard forks haven't been able to capitalize. The code is indeed very hard; Mastodon's a huge code base, there are some unfortunate design and architectural decisions, and it's accumulated a lot of technical debt. So it'll take people who aren't familiar with the code base a while to come up to speed. Shlee's post highlights some of the other challenges, including > "You need to build a community - you need to build consensus - you need to build influence. You need to have funding." In [Why a hard-fork of Mastodon isn’t the way](https://medium.com/@thisismissem/why-a-hard-fork-of-mastodon-isnt-the-way-b37aecfe5c86?ref=thenexusofprivacy.net), fediverse trust and safety expert (and longtime Mastodon contributor) Emelia Smith goes into more detail on the challenges that the current team needs to address – most of which potentially apply to a new fork as well. > "There’s general maintenance work, such as updating dependencies or moving off dependencies that are no longer supported; there’s security fixes and the back-porting of those fixes to older released versions; there’s product roadmap and project planning; there’s triaging and responding to hundreds or thousands of issues and pull requests; there’s providing help and assistance to users of the software who are encountering issues and bugs; there’s responding to press enquiries, applying for grants, working on legal & accounting to gain non-profit status, etc. There’s also documenting the project, which is a huge effort, with far too few people contributing (instead many are preferring to write their own blog posts about their experiences, rather than improving the documentation for everyone)." ## But it's not like it defies the laws of physics! That said, other open source projects *have* had successful hard forks, so it doesn't defy the laws of physics for a Mastodon hard fork to succeed. And indeed, when you look at they specific challenges, they don't seem insurmountable. As Tilley [says](https://social.wedistribute.org/objects/3e21ec7f-5c57-495c-887a-93a200e6501f?ref=thenexusofprivacy.net), > "Committed developers, deep knowledge of the code, community outreach, a coherent product vision, and having a designer all go a long way towards making this successful. Making it easy for communities to switch over is important, too." Easier said than done, but certainly not impossible. A new fork also has some advantages over an existing fork, at least in the short termno back versions to maintain, no support requirements from existing users, a chance to put new issue triage and prioritization processes in place. A new fork also has a chance to reduce its scope, for example by focusing on small-to-medium size instances – and leaving support of large instances to the official fork. And if the new fork can take advantage of the opportunity for [broad participation and a cultural reset](#cultural-reset), many other possiblities open up. Take Smith's point about documentation, for example. Why aren't more people contributing to Mastodon? Here's the "Contributing to Mastodon" section on [docs.joinmastodon.org](https://docs.joinmastodon.org/?ref=thenexusofprivacy.net) ![Contributing to Mastodon. Technical overview. Setting up a dev environment. Code structure. Routes. Bug bounties and responsible disclosure](https://thenexusofprivacy.net/content/images/2024/04/Screenshot-2024-04-26-at-3.43.00-AM.png) What's not here? Even if you go to the [Mastodon documentation Github repo](https://github.com/mastodon/documentation?ref=thenexusofprivacy.net), there aren't any suggestions on how to contribute. And how are Mastodon documentation contributors acknowledged?[8](#fn-doc-ack) It's a good example of Mastodon's developer-centricity. A fork that more actively encourages and recognizes people who help with documentation has a good chance to get broader participation. Similarly, Smith notes that Mastodon arguably wasn't ever designed for single-user instances. As smallpatatas notes in [The Slow Fedi Movement: Toward a Green, Independent, and Equitable Fediverse](https://thedabbler.patatas.ca/pages/slow-fedi.html?ref=thenexusofprivacy.net) > "The cost of managed hosting even for a single-user instance is way too expensive for most of the world. Here's [Marco Rogers' experience](https://social.polotek.net/@polotek/111967626833457301?ref=thenexusofprivacy.net). $19 is a *lot* of money if you live in a low-income country." If a new fork enthusiastically adopts lower-cost as a design goal, could it attract more single-user and small instance admins – and hosting companies interested in getting more single-user and small instances as customers?[9](#fn-reduce-cost) ## What about funding? Even though volunteers are the lifeblood of community-focused open source projects, paid positions and project-based funding are vital as well. Unless people are paid for their work, participation is restricted to those who can afford to volunteer. Fortunately, there's a lot of buzz around the fediverse today – and increasing awareness that Mastodon's innovation has been lagging – so funding is likely to be easier than it's been in the past. As well as crowdfunding and grants from foundations and civil society organizations, hosting companies, app vendors and infrastructure businesses like Fastly are other potential sources. There are a lot of smaller businesses who are looking for an alternatives to today's rich-get-richer Big Tech world. And Mastodon's alignment with Threads is a big red flag even for businesses who benefit from access to Threads' audience. As I said in [Wait a second. Why should anybody trust Facebook, Instagram, or Meta?](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#wait-a-second), everybody seems to agree that Facebook, Instagram, and Meta are untrustworthy. > "After all, it's objectively true!" The official Mastodon project is likely to be more attractive to large commercial social networks looking to expand into the fediverse (especially with Twitter and Medium co-founder Biz Stone on the board of the new US-based Mastodon non-profit). Then again, several potential funders have told me that Mastodon's lack of attention to safety and/or reputation for racism mean they don't see it as fundable at this point – but are interested in projects that would be a good match for a more safety-focused version of the software created by a more diverse and inclusive team. If a crowdfunding route makes sense, many people who aren't currently supporting the Mastodon Patreon have told me they'd donate to a new fork. And while it's far from the only reason, the bigger elephant is a key here; many people on instances that want nothing to do with Threads don't want their money going to a Threads-friendly project like the Mastodon official release. Of course that doesn't necessarily mean they'll all follow through but it reinforces the possibility of *complementing* (rather than cannibalizing) existing resources. One approach is to channel this funding through cooperatives, non-profits and public benefit corporations – partnering with existing ones at first while setting up new ones. In feedback on an early versio of this post, Lady suggested another approach: > "fund INSTANCES, and then have instances pledge hours, not money, to fork development. i like this model because it is very community‐oriented, and it ensures that the people who are using the software are the ones deciding its development direction. but it’s also a lot harder to implement—it requires gathering a large enough community of instances together and actually having them pledge that work. it would be great if we could rely on hosting services to pledge some of the hours here too." ## Make sure most of the funding goes to Black, Indigenous, Muslim, trans, queer, and disabled people > "The decentered include subpopulations who are the most impacted and least supported; they are often those that face highest marginalization in society... when your most at-risk and disenfranchised are covered by your product, we are all covered." > > – Afsenah Rigot, [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=privacy.thenexus.today), 2022 Whatever funding structures are used, it's vital to ensure that most of the funding goes to marginalized people and projects they lead. This is an important principle in general, and it's *especially* important for a Mastodon fork. [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today), [Mastodon’s Complicated Relationship with Queer Activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=privacy.thenexus.today), [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy), [A breaking point for the queer community](https://thenexusofprivacy.net/mastodon-a-partial-history/#a-breaking-point-for-the-queer-community), and [The patterns continue ...](https://thenexusofprivacy.net/mastodon-a-partial-history/#the-patterns-continue), have background. ## It's not an either-or situation > "Overall, I think a hard-fork of Mastodon would do more harm than good: it’d split already limited funding, split development resources, and arguably have just the same if not worse governance issues." > > – Emelia Smith, [Why a hard-fork of Mastodon isn’t the way](https://medium.com/@thisismissem/why-a-hard-fork-of-mastodon-isnt-the-way-b37aecfe5c86?ref=thenexusofprivacy.net) [When I posted the first draft of this article](https://infosec.exchange/@thenexusofprivacy/112294651700229270?ref=thenexusofprivacy.net), and again when I posted the revised version, several people brought up arguments against a hard fork of Mastodon that are certainly worth discussing. Smith does a great job of describing the constraints of the current team, with very limited resources and a massive amount on their plate. Given that, she suggests that "calls for forks just distract from efforts to move things forwards." A different way to look at it, though, is that a hard fork potentially offers a path around these constraints. I talked above about the potential for attracting funding and volunteers that complement the official project. And while governance is a challenge for any open source problem, a more diverse project with a community-oriented focus and more consensus-oriented decision making (as opposed to the BDFL style) also offers significant opportunities for improvement. And splitting funding and development resources is potentially a *good* thing – especially (but not only) from the perspective of community-oriented instances and businesses who have concerns about the Mastodon's alignment with Threads. Mastodon gGmbH and their new US non-profit are attracting a lot more funding – in fact during the time since my draft post, they've announced six-figure donations from Jeff Atwood and Mozilla, a grant from NLNet to implement quote boosts, and the new US 501(c)(3) non-profit with some very well-connected board members and the explicit goal of helping with funding. There's a limit to how quickly any project can grow, especially if they're trying to evolve their culture (which they hopefully are). So it's not an either-or situation. Others suggest that it's better to focus energy and resources on other fediverse microblogging software instead of Mastodon. There certainly are a lot of worthwhile projects out there – Jenniferplusplus' [More than Mastodon](https://gist.github.com/jenniferplusplus/1814038de7403ace8f35c47d14248418?ref=thenexusofprivacy.net) is a good list – and There's no question that platforms like GoToSocial, Bonfire, Akkoma, streams, and [Letterbook](https://jenniferplusplus.com/no-universal-translators/?ref=thenexusofprivacy.net) have been designed with more of a focus on safety. And for developers who know (or want to learn) the programming language other platforms are implemented in, these code bases are a lot more approachable. As fork veteran clar fon [says](https://toot.cat/@clarfonthey/112346592350753675?ref=thenexusofprivacy.net) about GoToSocial: > "GTS checks *all* the boxes for me. they have a good team, a good pace, a good vision, and a good plan. it'll take time to reach parity with mastodon but I don't doubt they will > > any serious work on a fork for mastodon, in my opinion, will spend most of its time rewriting shit from scratch anyway. unless you're looking to just keep it on life support until GTS is done" On the other hand, there are hundreds of thriving communities running on Mastodon and its forks today, some of which have been around for years, and there isn't any way yet to move a community to a new platform. A new fork can make a lot of valuable incremental improvements before (or in parallel with) rewriting. And GoToSocial's niche is small or single-user instances; kudos to them for taking that focus, but that also means it's not clear how well-suited it'll be for medium-sized community-oriented instances with several hundred or more users. As Ro [says](https://h-i.social/@are0h/112349265247684005?ref=thenexusofprivacy.net), > "I understand there are other AP-enabled platforms out there that are better than Mastodon. That's cool. > > But we can't abandon people who use Masto right now who want something better." So once again, it's not either-or. In fact, given Mastodon's bad reputation for not playing well with others, a hard fork with a more cooperative attitude could well *help* other platforms. For example, Mastodon's size often lets it do its own thing and pay less attention to standards. A fork that moves in a more standards-compliant version will be more compatible with other platforms, and increase pressure on Mastodon to also be standards compliant. As Nora points out, "the more instances are out there that aren't moving with mainline, the more they will have to lean into standards in order to keep the network whole." ## A lot of open questions - and a lot of potential upside There are a lot of open questions here, starting with three that Margaret KIBI brought up years ago at the end of [Progressing Fringe Mastodev](https://www.u2764.com/NFIC/2019-09-15/fringe-progress/?ref=thenexusofprivacy.net), after talking about Mastodonʼs "long patterns of assimilation and exploitation": - Who will build it? - Who will control it ? - What of the power differential which results from these imbalances, and which has resulted from years of passive cis/white profit off of marginalized labour? As KIBI says, there are no easy solutions; "it is the work cut out for us." Some of the other key questions I've touched on over the course of this post also don't have easy solutions. - How will consensus decision-making work in practice? How to start the new fork with a more inclusive culture that encourages participation? What other open-source software projects (or collaborative projects that aren't open-source software) should it look to as models? - How can a new fork help "fringe Mastodev" forks, without repeating the pattern of assimilation and exploitation? - How can a new fork work with the official Mastodon fork in synergistic ways? - How can a new fork work with apps, platforms, and hosting providers more effectively? - Where to start on the laundry list of potential improvements? - Where does initial funding come from? How to make it sustainable? How to ensure the funding is distributed equitably, and reinforce a decentralized consensus-based culture? Still, these are questions that need answers over time – not show-stoppers. There's also a lot of potential upside if the new fork is even somewhat successful: improving safety, experimenting with new cultural approaches, and helping the broader ecosystem. ## Stay tuned! ![Post from The Gibson (@thegibson@hackers.town): I love seeing multiple efforts firing up at the same time. We all want a better future.. and that is a hopeful thing to see.](https://thenexusofprivacy.net/content/images/2024/04/Screenshot-2024-04-29-at-7.31.56-PM.png) When I published a draft of this post in mid-April, this section was called "Clever conclusion - tbd." A lot's happened since then – including Mastodon's Saturday April 27 announcement of [a new US-based non-profit 501(c)(3)](https://blog.joinmastodon.org/2024/04/mastodon-forms-new-u.s.-non-profit/?ref=thenexusofprivacy.net) to help with fundraising. The new 501(c)(3)'s board includes Esra’a Al Shafei (founder of Majal.org, co-founder of the Numun Fund, and board member at Tor Foundation) and Karien Bezuidenhout (who has a wealth of non-profit experience), two incredibly valuable additions that really highlight the possibilities. And a US-based 501(c)(3) can unlock a lot of additional funding, including corporate matching. That's good! But the new board also includes a lawyer whose day job is defending AI companies against copyright lawsuits, and an investor who's also on the board of the AI Foundation, a "dual commercial and non-profit organization" – and is also a founder of Twitter. Even though Mastodon gGmbH is independent from the new board, the annoncement heightened concerns about surveillance capitalism and co-opting already sparked by Mastodon's Threads-firendliness. So unsurprisingly, discussions of a hard fork intensified. When I first published this post, Sunday evening, this section started with a link to a [thread](https://h-i.social/@are0h/112350516503407676?ref=thenexusofprivacy.net) from Ro (developer of The Bad Space and former admin of PlayVicious.social) with some of his thinking about how to start hard-forking Mastodon. Monday morning, Soon after that, Ro published [A Case for Community](https://h-i.works/2024/04/a-case-for-community.html?ref=thenexusofprivacy.net), proposing Awujo: > "Awujo is the Yoruba word for community, and it was chosen to illustrate a fundamental shift from a singular and narrow vision to a broader, more inclusive perspective. A perspective that values a collaborative approach to implement a wider range of features that speak to the needs of people who want to have a curated experience with an improved version of Mastodon." Ro's overview high-level overview of Awujo's goals includes better safety tools, expanding the moderation experience, accessibility, reducing bloat to increase performance and stability, simplfying setup and maintance, defining a transparent code contribution process, and creating a stable pathway for current Mastodon instances to migrate to Awujo. The approach Ro suggests – starting with the Glitch fork, working contributors and/or funders to form the core governance – makes sense to me. And there are a lot of other great perspectives in [A Case for Community](https://h-i.works/2024/04/a-case-for-community.html?ref=thenexusofprivacy.net) – it's really worth reading. Let's hope that funding emerges and Awujo gets to critical mass! As hacker.town mayor The Gibson pointed out, Awujo is only one of multiple efforts firing up. In the discussions of Ro's post I saw at least two people working on other fediverse platforms highlight synergies. And there's enough energy for hard forks that it wouldn't surprise me if we see other attempts attempts to explore as well. An advantage of a new fork starting with an existing forks like Glitch or Hometown is that it can deliver short-term progress, and the polls I've done certainly imply there's a lot of interest in helping with hard forks. Once again, it's not necessarily either-or. Multiple explorations can happen in parallel – and hopefully work together, at least to some extent, to make the efforts more synergistic. So stay tuned for what's next! As Margaret KIBI said in [Progressing Fringe Mastodev](https://www.u2764.com/NFIC/2019-09-15/fringe-progress/?ref=thenexusofprivacy.net) > "It is my hope that if we continue this work with an eye to the above questions, new horizons will open up which will give us additional insight into the necessary steps for a just future." ## Notes 0 The original version of this post didn't include the words "quite possibly" in this sentece. [How Mastodon made friends with Meta](https://www.platformer.news/mastodon-interview-eugen-rochko-meta-bluesky-threads-federation/?ref=thenexusofprivacy.net) discusses how Mastodon helps Threads "debug and troubleshoot some of the stuff that they're doing," and I assumed that work would continue and increase as two-way federation gets enabled and more people on Threads turn on federation. But perhaps not. So I added the words "quite possibly" here, and discussed it a bit in the section on [There's a big elephant in the federated room (and I don't mean Mastodon)](#bigger-elephant) 1 The recent blog post [Mastodon forms new U.S. non-profit](https://blog.joinmastodon.org/2024/04/mastodon-forms-new-u.s.-non-profit/?ref=thenexusofprivacy.net) mentions that "Mastodon gGmbH has received a notice from the same tax office that our non-profit status has been withdrawn," although they're appealing. 2 For obvious reasons, hosting services are more likely to support software with a team and organization behind it. 3 As far as I can tell, Rochko never talked about the hate groups on Threads and what Mastodon is doing to help instances federating with Threads better protect their users. His answer to "Will Meta get my data or be able to track me?" in [What to know about Threads](https://blog.joinmastodon.org/2023/07/what-to-know-about-threads/?ref=thenexusofprivacy.net) (from July 2023) is ... less than compelling. 4 To be clear, it's not just Mastodon that's developer-centric. [Snot Flickerman's Lemmy comment](https://lemmy.blahaj.zone/post/11532851?ref=thenexusofprivacy.net) on a draft version of this post is a very typical atitude in the fediverse, although it's rarely phrased quite so eloquently: > "This “Jon” guy has been writing these fucking long ass screeds about all this for **at least a year now.** > > Maybe if this motherfucker stopped writing and took some time to learn to code and then contribute to the codebase themselves, they might have more luck.... > > Contribute to the code base **or shut the fuck up about your demands.**" 5 For example: - New Mastodon instances leave everybody open to harassment from well-known nazi and so-called "freeze peach" instances. Providing a default blocklist would significantly reduce this problem ... but as discussed in the main text, this still hasn't made the cut for the upcoming release 4.3 - As Muslim and Indigenous people have pointed out to me, mastodon.social's moderation often doesn't take action on Islamophobic and anti-Indigenous hate speech and harassment. So setting the default signup to mastodon.social without addressing these moderation issues increases the chances that new Muslim and Indigenous Mastodonians will have a bad experience. - You're probably as tired of hearing about Mastodon's refusal to support local-only posts as I am about writing about them, but guess what? Local-only posts would give people of color an option to reduce their exposure to harassment but they're not available in Mastodon. So would allow-list federation, but that's contrary to Mastodon's vision – and in a discussion a few months ago, Chaput confirmed to me that this attitude isn't likely to change going forward. 6 Today, disabling RSS feeds on vanilla Mastodon requires [modifying the nginx configuration file](https://writer.oliphant.social/oliphant/rss-feeds-in-mastodon-and-how-to-disable-them?ref=thenexusofprivacy.net) \-- which isn't even possible for instances using hosting services. 7 Hashtags in #CamelCase (where #TheFirstLetterOfEachWordIsCapitalized) are more usable for screenreaders, but Mastodon today converts its hashtag suggestion to all-lower-case – annoying, and relative easy to change. 8 I don't remember any acknowledgements for doumentation mentioned in blog posts, these contributions don't seem to appear in the [changelog](https://github.com/mastodon/mastodon/blob/v4.2.0/CHANGELOG.md?ref=thenexusofprivacy.net), and from a quick search documentation isn't even mentioned in [Mastodon's 2022 Annual Report](https://joinmastodon.org/reports/Mastodon%20Annual%20Report%202022.pdf?ref=thenexusofprivacy.net). 9 Then again, at this point other platforms like GoToSocial (which runs on a Raspberry Pi) or snac (which is written in C) may be better choices for single-user instances. So a new fork could also take advantage of an opportunity for short-term scope reduction if a new hard fork chooses not to focus on single-user instances initially. Still, as [It's not an either-or situation](#either-or) discusses, there are also barriers to people and instances switching platforms. And as of April 29 the most popular response to the [poll](https://infosec.exchange/@thenexusofprivacy/112352739299349780?ref=thenexusofprivacy.net) about what people want to see in the fork is "Reducing cost and complexity for small instances", so there probably *is* energy to make progress on this. I decided to move the bit about scope reduction to a footnote. ## Update log *Ongoing: fix typos, add links, other cleanups* May 8: include quotes from [The Trouble with Forking Mastodon](https://wedistribute.org/2024/05/forking-mastodon/?ref=thenexusofprivacy.net), link to [More than Mastodon](https://gist.github.com/jenniferplusplus/1814038de7403ace8f35c47d14248418?ref=thenexusofprivacy.net) list of alternate projects April 29: rework last section to incorporate to [A Case for Community](https://h-i.works/2024/04/a-case-for-community.html?ref=thenexusofprivacy.net). April 28: published for reals, with many changes from draft April 18: first published [draft](https://web.archive.org/web/20240429010226/https://privacy.thenexus.today/mastodon-hard-fork-draft/) ### Eight tips about consent for fediverse developers URL: https://thenexusofprivacy.net/consent-for-fediverse-developers/ Last updated: 2026-04-16T03:18:44.000Z > Join the conversation in the fediverse at [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/112278691717684434?ref=thenexusofprivacy.net) or [lemmy.blahaj.zone](https://lemmy.blahaj.zone/post/11131695?ref=thenexusofprivacy.net)! > "It’s funny, many of the “what you need to know about Mastodon” or “how to learn about the fediverse” pieces are focused on the technology and the implementation, when the hardest thing for people to understand about this context, if they’re used to traditional social media & tech, is that here we have an expectation of \_consent\_." > > – Anil Dash, [November 2022](https://mastodon.cloud/@anildash/109312103250205663?ref=thenexusofprivacy.net) > "Design for and ask for informed enthusiastic consent. > > Then we won't have to keep having these little chats." > > – Esther Payne, [Consent and the Fediverse Part Deux: The Opt-out two shuffle](https://onepict.com/consentpartdeux20240215.html?ref=thenexusofprivacy.net), February 2024 Many people in the fediverse (including me!) see consent as important. Of course, the fediverse isn't the only place where people think this. Consent is also an important concept for [reducing sexual violence and abuse](https://www.rainn.org/articles/what-is-consent?ref=thenexusofprivacy.net), where activists talk about [moving from rape culture to consent culture](https://sexualviolencehelpline.ca/from-rape-culture-to-consent-culture/?ref=thenexusofprivacy.net). It's also a norm for [experiments involving human subjects](https://www.hhs.gov/ohrp/regulations-and-policy/guidance/faq/informed-consent/index.html?ref=thenexusofprivacy.net), and a key component of privacy laws such as [Europe's GDPR](https://gdpr-info.eu/issues/consent/?ref=thenexusofprivacy.net) and Washington state's My Health My Data. While definitions of consent [vary](https://www.gtlaw-dataprivacydish.com/2022/02/is-all-consent-created-equal-how-the-different-privacy-statutes-treat-the-standard-for-consent/?ref=thenexusofprivacy.net), there are a few key elements that are common. [Here's how GDPR defines it](https://gdpr.eu/gdpr-consent-requirements/?ref=thenexusofprivacy.net) – I bolded the key elements: > Consent of the data subject means any **freely given, specific, informed** and **unambiguous** indication of the data subject’s wishes by which he or she, by a statement or by a clear **affirmative** action, signifies agreement to the processing of personal data relating to him or her. However, privacy laws typically don't require consent for most uses of ***public*** data. So there's a difference in opinion in the fediverse on whether it's important to get consent to use somebody's public posts for a purpose they didn't originally intend it for: adding them to a search engine, using them as part of algorithmic recommendation systems, "bridging" them to another social networks, using it to train artificial intelligence systems, and so on. Some think this is just fine, or that it's enough to assume consent and give people the ability to "opt out" and withdraw consent. Others think that these uses should require informed, affirmative, "opt in" consent. As the last section of this article discusses, the good news is that this means there's a huge opportunity for fediverse developers here. Opt-in is overwhelmingly popular, and there aren't many opt-in alternatives today in the world of social networking. From a strategy perspective, focusing on opt-in can be a powerful way to add unique value to an underserved audience. Less positively, though, that's not how everybody approaches it. So there's [a long history](https://cathode.church/fedi-scraper-counter.html?ref=thenexusofprivacy.net) of developers writing or proposing fediverse search engines, scrapers, bridges and other services that use people's public posts *without* opt-in consent ... and suddenly being in the middle of a firestorm of criticism and feedback. It's an unpleasant experience all around, including for the developers. Here's how it worked out for [fedsearch.io](https://fedsearch.io/?ref=thenexusofprivacy.net) > "Due to extreme backlash from the Mastodon community we decided to end the project." Ryan Barrett similarly [describes](https://github.com/snarfed/bridgy-fed/issues/835?ref=thenexusofprivacy.net#issuecomment-1942757337) the response to Bridgy Fed's initial plans for an opt-out model as "the backlash I've received" (while also saying it was "probably warranted to some degree"). Jan Lehnardt's [Adventures in Mastoland](https://searchtodon.social/Adventures-in-Mastoland.html?ref=thenexusofprivacy.net) is a detailed retrospective on another episode where "Names were called." And sometimes it goes spectacularly badly ... one guy bragged that he was using an unstoppable method to scrape public data, didn't realize he was violating local laws, and got shut down by his ISP and kicked off his instance. Bridgy Fed wound up shifting to an opt-in approach after the backlash – a relatively good outcome, although as Barrett says "it obviously would have been better to figure out beforehand." More often, though, the developers just withdraw the project. Sometimes, it's a bad enough experience that they decide the fediverse isn't for them. So if you're a developer working on a fediverse app or service andwant to get it right – or just don't want to be the center of the next firestorm – here are a few suggestions. - [Consent matters, even for public posts](#consent-matters) - [Get broad feedback before launching – and listen to it](#feedback) - [Honor existing opt-in and opt-out mechanisms](#existing-mechanisms) - [Include an additional opt-in mechanism for your service if it's not just a search engine or profile discovery (or something very close to them)](#additional-mechanism) - [Make sure to communicate that you're taking an opt-in approach and honoring existing mechanisms](#communicate) - [DON'T say the things that developers who ignore consent typically say](#things-not-to-say) - [Be extra careful if you're a cis guy](#extra-careful) - [Look at opt-in as an opportunity for a potential competitive advantage](#opportunity) ## Consent matters, even for public posts > "Every time I am in public anyone can photograph (or video) me, but it doesn't make it any less sleazy if someone is following me, taking candids of me in a compromised position, and posting them elsewhere. I probably can't sue the photographer, but I also didn't consent, and most reasonable people would agree that I have every right to be mad. Only a dickhead would say 'well just don't go out in public'." > > – somebody who gave me permission to quote them and asked to stay anonymous It's true that privacy laws typically say that consent isn't required for most uses of most publicly avaiblable data (although there are exceptions). But most of the time, people aren't making a *legal* argument; they're saying you should get consent even though you're not required to. Posting publicly is specific consent for everybody to *see* the post, but not necessarily for other uses. As Laurens Hof of Fediverse Report highlights, on the fediverse > "we have clear documented examples that people explicitly say that 'no, my posts being public is not consent'." Sure, bad actors will use public posts for whatever purpose they want without getting consent – people should take into account that posting publicly means that bad actors can use their data however they want. But this isn't a justification for *you* to use data without consent. As privacy scholars Daniel Solove and Woodrow Harzog, say in [The Great Scrape: The Clash Between Scraping and Privacy](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4884485&ref=thenexusofprivacy.net) > "Privacy law regularly protects publicly available data, and privacy principles are implicated even when personal data is accessible to others." ## Get broad feedback before launching – and listen to it Like I said, opinions differ, and [some of the most prominent voices in the fediverse think that opt-in consent isn't needed in these situations](https://github.com/snarfed/bridgy-fed/issues/835?ref=thenexusofprivacy.net#issuecomment-1942704597). So if you just listen to them, you might get lulled into a false sense of security and think that the approach you're taking is just fine – even if many others don't think it is. And it's not enough to get feedback; you also have to listen to it. Lehnardt, for example, notes that "I did get some early feedback that folks would *consider* this a crawler," but went ahead anyhow. In fact, when I look at the heated discussions around the contentious non-consensual examples, there's very often feedback very early on from people saying "this should be opt-in", sometimes even with specific suggestions how ... but the developers ignore it. Don't be like that! Bridgy Fed's experience, as intense as the backslash was, is still a far more positive example. Barrett got feedback before launching and is incorporating it. Mastodon similarly listened to the loud feedback on their initial opt-out beta release of search, and the final release was opt-in. More of this, please! ## Honor existing opt-in and opt-out mechanisms Over the years, several existing mechanisms for specificying opt-in and opt-out have developed. Unfortunately there isn't any good documentation for these, but here are the key ones that I know about: - the **indexable** attribute (used by Mastodon, Pixelfed, Piefed, and other platforms) described in [FEP 5feb ](https://codeberg.org/silverpill/fep/src/branch/title-fix/fep/5feb/fep-5feb.md?ref=thenexusofprivacy.net) says whether public posts should be listed in search results. - the Mastodon **discoverable** flag on a profile that says whether that account wants their profiles and posts to be featured in discovery algorithms, suggested, or recommended - hashtags on account profiles like #noindex, #nosearch, #nobot, and #nobridge are often used to signal opting out. I might well have missed some here, which is another good reason to get broad feedback! ## Include an additional opt-in mechanism for your service if it's not just a search engine or profile discovery (or something very close to them) If your app or service matches existing opt-in mechanisms, honoring them is probably good enough. But if you're doing something more – like bridging to another network – you're likely to get pushback if you don't include a separate opt-in mechanism. A few options for how to do that: - [tootfinder.ch ](https://tootfinder.ch/https://tootfinder.ch/join.php?ref=thenexusofprivacy.net)(the original fediverse opt-in search engine) and the [Fediverse People Directory](https://fediverse.info/explore/people?ref=thenexusofprivacy.net) ask people to add text to their profile, and then submit their profile address via a web form. - [fedi.directory](https://fedi.directory/how-to-get-listed/?ref=thenexusofprivacy.net) asks people to DM or mention to the curator. [Trunk](https://communitywiki.org/trunk/request?ref=thenexusofprivacy.net) provides a handy form to help with constructing the DM. - Bridgy Fed is planning on sending a DM to people when they're first followed from Bluesky, giving them the option to reply to opt-in. - Anil Dash suggests having an account that people can follow to opt-in - Various apps require people to log in with their fediverse account to use them, and this mechanism could be used for opt in as well (although I haven't seen anybody do it that way yet) Remember that as well as providing a way for people to opt in, you also have to give them a way to opt back out if they change their mind. There may well be other options that work better for your case ... yet another reason to get broad feedback! ## Make sure to communicate that you're taking an opt-in approach and honoring existing mechanisms There's been such a history of developers releasing non-consensual implementations that people may well jump to the conclusion that you're yet another example – even if you're not. It's not your fault that others have repeatedly poisoned the well, but the sad reality is that they have. As Lenhardt says in [Adventures in Mastoland](https://searchtodon.social/Adventures-in-Mastoland.html?ref=thenexusofprivacy.net) > "There is a difference between what a *thing* is vs. what people *perceive* that thing to be. For success, it is important for whoever makes the thing to respect both of these positions." So it's not enough to do things the right way. You also need to make sure to communicate that you're doing things the right way. As part of the feedback stage, start by telling people that you're trying to take an opt-in approach, and ask if there's anything more you should be doing. If you can find people who are outspoken about opt-in consent to vouch for you, that'll be a effective way to dampen any pushback. Once you launch, make sure your landing page – or onboarding phase of your app – emphasizes that it's consensual. Include, or link to, a detailed description of the existing signals you're honoring, and any additional mechanisms you're implementing. ## DON'T say the things that developers who ignore consent typically say > "In so many discussions about fediverse and activitypub we end up retreading the same point where some dude condescendly tells you that if your posts are public, then it’s “technically” possible for anyone to see and grab it > > and I just desperately want the basic concept of consent to be understood without needing to explain it over and over again" > > – Bri Seven, [March 2024](https://merveilles.town/@zens/112159700695950032?ref=thenexusofprivacy.net) The upside of so many developers having poisoned the well is that they've helped create a good roadmap of things to say that really irritate people who want opt-in consent in these situations. Some of these things are true but stuff people already know. Others may be your opinion, but people pushing for opt-in consent typically disagree. In either case, you won't change anybody's opinion by saying these things. Instead, you'll just give the impression that you don't care about consent; and you'll very likely come across as condescending as well – and potentially sexist and anti-trans. That's likely to increase the pushback. If that's your goal, great, go for it! If not, though, it's best to avoid stuff like this. - "I don't need consent because it's public" - "Posting publicly gives implied consent to use the data" - "It's easy for bad actors to use the data without consent" - "This is how ActivityPub works" - "You don't understand how ActivityPub works" - "You shouldn't post publicly if you don't want your data used this way" - "Your position is inconsistent because ..." Some are perfectly fine things to say in other contexts, especially if you're trying to warn them not to share anything on the fediverse they want to keep confidential. [As Hrefna points out](https://hachyderm.io/@hrefna/112185439818906762?ref=thenexusofprivacy.net), ActivityPub does indeed "makes assumptions that are fundamentally opposed to the kinds of protections that people seem to be seeking." But in a discussion about whether or not to get consent, even the ones that are true the miss the point – just because ActivityPub leaves open possibilities for you to do something without getting consent, that's not the only option. And don't jump to the conclusion that people don't understand. As Esther Payne says in [Consent and the Fediverse Part Deux: The Opt-out two shuffle](https://onepict.com/consentpartdeux20240215.html?ref=thenexusofprivacy.net): > "Many people do understand how the Fediverse and ActivityPub (the protocol) work. That isn't why folks are angry and threatened." Similarly, maybe people are being inconsistent, maybe they aren't. If the are, so what? People are often inconsistent in their views on privacy. But the situation I hear this in the most is the incorrect claim that people who haven't completely locked down their account are being inconsistent by objecting to a specific use of their public post. That's nonsense. So if you're wrong, and their position really *is* consistent, this isn't just useless for convincing people – it'll make you look like you don't know what you're talking about. ## Be extra careful if you're a cis guy Almost all of the developers who have released or proposed non-consensual implementations have been cis guys. And in many of the discussions, it's been primarily trans, queer, and non-binary people and women who have been pushing back against non-consensual implementations – while some of the loudest voices defending the non-consensual implementations have been cis guys. Again, this isn't your fault, but it's something you have to deal with. So even if you're doing everything right, being a cis guy makes it more likely that people may well assume the worst. And many cis guys often only primarily interact with other cis guys – or worse, only pay attention to feedback from other cis guys. If you've made it this far in this post, you're hopefully not like that, but in any case it's yet another reason to make sure you're getting broad feedback – and listening to it. Also if you're a guy saying something like "you don't understand how this works" to a woman who actually *does* understand how it works, it's sexist. Ditto if you're a cis person saying something like that to a trans person who actually does understand. And if you're a cis peson or guy telling trans people and/or women not to post publicly unless they're okay with you and others using their data without consent ... well, let's just say this is the kind of situations where words like "predator" sometimes get used and people mention analogies to the attitudes towards consent in rape culture. More positively, though, especially if you're a cis guy whose relatively privileged – white, abled, good tech skills, not destitute – it's a great opportunity to experience with how marginalized people often experience the world: assuming your actions reflect bad intent, making sure to avoid saying things that will get taken badly. So view it as a learning opportunity! ## Look at opt-in as an opportunity for a potential competitive advantage > "The reality is that most tech companies haven’t devoted any effort at all to making opt-in easy." > > – me, in [Consent, Automated Systems, and Discrimination](https://thenexusofprivacy.net/consent-automated-systems-and-discrimination/), November 2022 Discussions about consent are certainly a distinctive feature of the fediverse. One way to look at consent is as a nuisance that makes developers' lives more difficult. After all, developers building apps on Bluesky and Nostr and other networks where everything is public and there aren't any pesky expectations of consent don't have to deal with these considerations. And many apps and services are more useful the more content they have; it's easier to get more content if you just use it without consent. Then again, a different way of looking at consent is as a feature that that creates an opportunities. Opt-in is enormously popular, as the extremely positive response to Apple’s App Tracking Transparency (and the poll showing over 70% support for Washington state's opt-in My Health My Data bill) show. Big tech and advertising companies' business models are based on using people's data without consent, so they focus making opt-out as annoying and difficult as possible and trying to introduce "consent fatigue." Many people don't want that. And opt-in systems can lead to better results. For example, as Anil Dash says in [How you could build a search that the fediverse would welcome](https://www.anildash.com/2023/01/16/a-fediverse-search/?ref=thenexusofprivacy.net) > "A search system that requires people to opt-in to also makes it far easier to identify whether an account that tries to follow the search bot is a real person or not, significantly reducing the impact of common spamming and manipulation techniques." Of course, today's opt-in mechanisms are far from ideal. Having to edit your profile and sending a DM is kind of klunky; Bridgy Fed's approach sending a DM doesn't work for people who ignore DMs from accounts they don't follow. So there's certainly a lot of room for improvement here, first for individual apps and services and then hopefully at the software platform level. Still, there's clearly an opportunity here – for the fediverse as a whole as well as for individual developers. It's not the only opportunity out there; if you're the kind of developer who doesn't want to go that route, Bluesky and AT Proto or Nostr might well be a better option for you. But if you decide this is an interesting direction, hopefully this article will get you started in the right direction! ### Federal privacy legislation update: the American Privacy Rights Act (APRA) URL: https://thenexusofprivacy.net/federal-privacy-legislation-update-the-american-privacy-rights-act-apra/ Last updated: 2026-04-16T03:18:23.000Z > "Sen. Maria Cantwell, a Democrat who chairs the Senate Commerce Committee, and Rep. Cathy McMorris Rodgers, a Spokane Republican who leads the House Energy and Commerce Committee, [have appeared at odds on data privacy](https://www.spokesman.com/stories/2022/jul/25/historic-data-privacy-law-could-be-within-reach-if/?ref=thenexusofprivacy.net) since introducing competing legislation in recent years. But in interviews on Sunday, the two women said they have a compromise bill that can get to President Joe Biden’s desk before [McMorris Rodgers leaves Congress](https://www.spokesman.com/stories/2024/feb/08/after-two-decades-in-congress-cathy-mcmorris-rodge/?ref=thenexusofprivacy.net) at the end of the year." > > – [Cantwell, McMorris Rodgers strike bipartisan deal on landmark data privacy bill](https://www.spokesman.com/stories/2024/apr/07/cantwell-mcmorris-rodgers-strike-bipartisan-deal-o/?ref=thenexusofprivacy.net), by Orion Donovan Smith in the *Spokane Spokesman-Review* (CMR's hometown paper) Big news in DC: a new bipartisan, bicameral proposal for a "compromise" federal privacy bill, the American Privacy Rights Act (APRA). [The press release](https://energycommerce.house.gov/posts/committee-chairs-rodgers-cantwell-unveil-historic-draft-comprehensive-data-privacy-legislation?ref=thenexusofprivacy.net) has a summary, and links off to a [section-by-section analysis](https://d1dth6e84htgma.cloudfront.net/APRA%5FSection%5Fby%5FSection%5F026cc46a2c.pdf?ref=thenexusofprivacy.net) and the full text of [the discussion draft](https://d1dth6e84htgma.cloudfront.net/American%5FPrivacy%5FRights%5FAct%5Fof%5F2024%5FDiscussion%5FDraft%5F0ec8168a66.pdf?ref=thenexusofprivacy.net). At this point, take it all with a grain of salt; in 2022, the initial draft of the bill was promising, but it got weakened substantially by the subcommittee and then weakened further by the committee. In 2022, California's delegation opposed it because it preempted California's state privacy law (which was stronger in some key areas), Cantwell criticised the previous proposal as too weak in several important areas, and Pelosi didn't bring it to the House floor. The discussion draft of APRA still preempts California's law (as well as other state consumer privacy laws), although Cantwell says it incorporates some key points of legislation from California, Illinois, and Washington, so it looks like that was enough to get her on board. Writing for [IAPP](https://iapp.org/news/a/new-draft-bipartisan-us-federal-privacy-bill-unveiled/?ref=thenexusofprivacy.net), Jed Bracy calls it a "surprise development", but tbh I've been expecting this for a while. Congress wants to do *something* to show they're listening to people's concerns about privacy, most big tech companies are fine with federal regulations as long as they preempt future stronger state-level laws, and the bill only regulatesbusinesses with more than $40,000,000/year revenue so there isn't likely to be pushback from small businesses either. [The Washington Post](ttps://www.washingtonpost.com/technology/2024/04/07/congress-privacy-deal-cantwell-rodgers/), [Wired](https://www.wired.com/story/apra-congress-online-privacy-proposal/?ref=thenexusofprivacy.net), and [The Hill](https://thehill.com/policy/technology/4579903-house-senate-commerce-chairs-release-bipartisan-privacy-bill/?ref=thenexusofprivacy.net) also have coverage. Of course, the devil's in the details, and I haven't read the discussion draft yet so don't have a strong opinion. In any case, expect a fierce legislative battle. Stay tuned! ### How to block Threads on Mastodon - and a reminder that blocking on the fediverse only provides limited protections (UPDATED) URL: https://thenexusofprivacy.net/how-to-block-threads-on-mastodon/ Last updated: 2026-04-16T03:18:04.000Z *Originally published March 2024, last updated April 2025\. See the* [*update log*](#update-log) *at the bottom for details.* > "We will end the current third party fact checking program in the United States .... "We’re getting rid of a number of restrictions on topics like immigration, gender identity and gender that are the subject of frequent political discourse and debate." > > – Meta Head of Global Policy Joel Kaplan, [More Speech and Fewer Mistakes](https://about.fb.com/news/2025/01/meta-more-speech-fewer-mistakes/?ref=thenexusofprivacy.net), January 2025 > "I think Elon has played an incredibly important role in moving the debate and and getting people refocused on free expression, and that’s been really constructive and productive,” Kaplan said." > > – [Meta gets rid of fact checkers and says it will reduce ‘censorship’](https://www.cnn.com/2025/01/07/tech/meta-censorship-moderation/index.html?ref=thenexusofprivacy.net), Clare Duffy, *CNN*, January 2025 As I said in [Should the Fediverse welcome its new surveillance-capitalism overlords?](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/), opinions differ. So if you're one of the fediverse influencers who still sees Threads' participation the fediverse as "historic" and "a glimpse of the future" ... well, you might want to skip this post; instead, check out [Embrace, Extend, and Exploit: Meta’s plan for ActivityPub, Mastodon and the fediverse](https://thenexusofprivacy.net/embrace-extend-and-exploit/). And if you're still trying to make up your mind about Threads – or just want to learn more about various perspectives – Erin Kissane's [Untangling Threads](https://erinkissane.com/untangling-threads?ref=privacy.thenexus.today) is really excellent. But if you're one of the many many people on the fediverse who *doesn't* want to deal with Threads, read on! Mastodon has a feature called "domain blocking" that lets instances (servers) and individual users block everybody on another instance – in this case, threads.net. > **Update, April 2025**: Meta has now moved Threads to threads.com, but is (somewhat confusingly) still using threads.net as the domain for federation. So the instructions here still work. If you also want to block threads.com just in case, I'll cover a way to do that too! When domain blocking works the way it's supposed to, if you or your instance has blocked Threads, you won't see any posts from Threads; people using the Threads app won't be able to any new posts you've made after you blocked Threads, and you won't get notifications if people on Threads tag you. In practice, as I'll discuss near the end of the article, it's a lot more complicated than that. For one thing, if your instance hasn't turned on "authorized fetch" then blocking in general isn't particularly effective. Even if authorized fetch is on, the protections are imperfect; in some circumstances, bad actors may on Threads still be able to see to your posts and interact with them. Still, while domain blocking isn't even close to bulletproof protection, it's a good first step. > **Important**: [Blocking on the fediverse only provides limited protections](#limitations). If you're at risk from being targeted by stalkers or hate groups on Threads, you may want even stronger protection than just blocking them. In [Untangling Threads](https://erinkissane.com/?ref=thenexusofprivacy.net), Erin Kissane suggests two options for people who "have good reason to worry about the risk surface Threads federation opens up": block Threads ***and*** post followers-only or local-only; or operate from a server that federates only with servers that also refuse to federate with Threads. Being on an instance that's blocked Threads provides somewhat stronger protection than doing it yourself. [fedipact.veganism.social](https://fedipact.veganism.social/?ref=thenexusofprivacy.net) lists which instances are and aren't currently blocking threads.net (including over 700 instances who have signed the [Anti-Meta FediPact](https://fedipact.online/?ref=thenexusofprivacy.net)). Like I said, though, opinions differ, and a lot of instances *haven't* blocked Threads. That's good for people on those instances who aren't concerned about the hate groups on Threads, and are willing to share their data with Meta to use for training AIs and targeting ads[0](#notes) in return for being able to follow accounts on Threads and like their posts. But it means that people on those instances who *don't* want to deal with Threads have to do a bit of work. There are at least two ways you can block threads.net, the domain that Meta's currently using to host Threads. - [Viewing the profile of anybody on Threads through your Mastodon account gives you the option of blocking threads.net](#from-profile) - [The Data Import functionality in your Preferences lets you upload a "domain blocking list"](#domain-blocking-list) including threads.net and threads.com Personally I find the [first approach](https://thenexusofprivacy.net/ghost/#from-profile) somewhat easier – and as a bonus, you can mute and/or block Zuck's account if you want, which at least for me was surprisingly enjoyable! However, there's a potential privacy issue doing it this way (described in more detail below), especially if you're running your own instance. So the [second approach](https://thenexusofprivacy.net/ghost/#domain-blocking-list) is more privacy-friendly. And the second approach also allows you to preemptively block threads.com just in case Meta tries some shenanigans later. Then again, most people on the fediverse today don't run their own instances. So I'm including the instructions for both approaches, choose whichever you prefer! And whichever way you choose, there are sections at the bottom of the article on the [limitations of domain blocking on the fediverse](#limitations), [spreading the word](#spread-the-word) and [supporting FediPact creator Vanta Black](#support-vanta-black). ## Blocking threads.net from a Threads user's profile As I mentioned above, there's a potential privacy issue with this approach: it starts with viewing a Threads profile, which could potentially lead to some of your information getting shared with Meta.[2](#notes) According to Mastodon CTO Renaud Chaput, [the only information transferred to Threads when you view a Threads profile is what instance you're using](https://oisaur.com/@renchap/112151730685544462?ref=thenexusofprivacy.net).[3](#notes) If you've got your own instance, that's potentially identifying information, although if you're on an instance with hundreds or thousands of other people then there's no obvious way for them to know who you are. Personally, I decided I was okay doing it this way: my accounts are on larger instances. But your mileage may vary! If you're not comfortable with this, check out the instructions below for the alternate approach of [uploading a domain blocking list.](#domain-blocking-list) ### 1\. Search for @zuck@threads.net On the web interface, the search box is in the top left of most instances (although sometimes it's on the top right); it's also on the Explore page. If you're using the Mastodon app, you'll need to go to the Explore tab (by clicking the magnifying glass icon). ![A text box with a small icon of a magnifying glass and the words "Search or paste URL"](https://thenexusofprivacy.net/content/images/2024/03/Screenshot-2024-03-23-at-11.54.37-AM.png) Type @zuck@threads.net (Mark F\*\*\*ing Zuckerberg's Threads account) into the box.[4](#notes) ![A text box with a small x in a circle at the left followed by the text "@zuck@threads.net"](https://thenexusofprivacy.net/content/images/2024/03/240323-search-box.png) Hit return, and it should bring you to the search results. ![Search results: Mark Zuckerberg @zuck.threads.net, with the Meta Fediverse logo at the left and a follow button on the right](https://thenexusofprivacy.net/content/images/2024/03/240322-zuck-search.png) There might be other profiles claiming to be Mark F\*\*\*ing Zuckerberg on the list, so you'll want to double-check the address to make sure you've got the right Mark F\*\*\*ing Zuckerberg. ### 2\. Click on the name to get to the profile You may get a warning that the profile has been hidden by your admins. This means that your admins have *limited* threads.net, which is kind of like muting everybody on threads.net by default. ![This profile has been hidden by the moderators of infosec.exchange. Below, a button: Show profile anyway](https://thenexusofprivacy.net/content/images/2024/03/040323-limited-profile.png) If you get that warning, click on **Show Profile Anyway**. ### 3\. Click on the three dots next to the follow button on the top right of the profile Depending on the version your site is running, and any custom theming your admin has installed, it may look somewhat different than this ... but there should be three dots somewhare in the general vicinity of the follow button. Here's how it looks on indieweb.social ![On the left, the Meta Fediverse logo, Mark Zuckerberg, @zuck@threads.net. On the right, a Follow Button and a button with three dots on it. A red arrow points to the button with the three dots on it](https://thenexusofprivacy.net/content/images/2024/03/240322-zuck-profile-with-arrow.png) ## ### 4\. "Block domain threads.net" to block everybody on Threads Clicking on the three dots shold bring up a menu. Here's how it looks on the web. It's slightly different on the Mastodon mobile app; I've got a screenshot below. ![A menu with seven items. At the top, "Mention @zuck" in white. The seventh item on the menu, at the very bottom, is "Block domain threads.net" in red., with a red circle around it](https://thenexusofprivacy.net/content/images/2024/03/240322-block-dialog-with-circle.png) Click on **Block domain threads.net**, and you'll get a confirmation dialog. Click on **Block Server**. Now, if you look at the top left of Mark F\*\*\*ing Zuckerberg's profile, you'll see something like ![Domain blocked](https://thenexusofprivacy.net/content/images/2024/03/domain-blocked.png) Yay! On the Mastodon mobile app, the menu's slightly different: ![A menu with five items. At the top, "Mute Mark Zuckerberg". The third item on the menu is "Block threads.net", with a red circle around it](https://thenexusofprivacy.net/content/images/2024/03/mobile-dialog.jpeg) Click on **Block threads.net*,*** click on **Confirm**, and you're good to go. ### Bonus step: you can block and/or mute Zuck from this menu! As you can see, you can also use these menu to block and mute Zuck individually. Feel free! Of course if the entire domain is blocked, you don't need to ... but I personally found it quite satisfying. Here's what his profile looked like after I also blocked him. ![Blocked. Domain Blocked](https://thenexusofprivacy.net/content/images/2024/03/Screenshot-2024-03-23-at-12.19.47-PM.png) ## Blocking threads.net by uploading a "domain blocking list" This technique feels somewhat clunkier to me, but it has the advantage that you never view a Threads profile so it's more privacy-friendly. JD Everhard's [How to Block Server Domains in Mastodon](https://medium.com/@geofbard/how-to-block-server-domains-in-mastodon-899b24f8fb6e?ref=thenexusofprivacy.net) also describes how to do this, and also has some good screenshots, so check it out if you find the description here confusing. ### 1\. Download a "domain blocking list" file A domain blocking file can be as simple as a single line, with the domain to block. But it's just as easy to block two domains, so let's do that! threads.net threads.com [Here's a file you can download,](https://thenexusofprivacy.net/data/threads-block.csv) or you can use a text editor and create you're own. You can call it whatever you want – I used threads-block.csv, because Mastodon's documentation calls it a CSV (for comma-separated value). ### 2\. Navigate to the import page Here's where the clunkiness comes in, because this is much easier said than done ... and it's different on the web interface and mobile apps. - On the web interface, start by clicking **Preferences** (on the bottom right of the screen). That will bring you to the **Appearance** page, which isn't want you want, but which has a looooong list of different kinds of preferences on the left. - On the Mastodon mobile app, you need to click on the little gear icon (⛭) in the top right, scroll down and click on **Account Settings,** and potentially sign in to your Mastodon account (if you're not already signed in). That brings you to the **Account Settings** page, which isn't what you want, but you can click on the three bars in the top right to get a menu with a long list of different kinds of settings. Once you've gotten to the long list, click on **Import/Export**. That will bring you to the **Data Export** page, which also isn't what you want, but now the list on the left on the web app also has **Import –** which is what you want, so click on it! (If you're on the mobile app, you'll need to click on the three bars at the top right to get the menu again.) ![A menu with three lines of text. The second line, Import, has a red circle around it.](https://thenexusofprivacy.net/content/images/2024/03/240324-import-and-export.png) That will bring you to a page something like this ... ![A complicated dialog. At the top: Import, with the Import Type currently set to Following list and an indication that you can make a choice of import type](https://thenexusofprivacy.net/content/images/2024/03/Screenshot-2024-03-24-at-12.53.23-AM.png) ## 3\. Upload the domain blocking list First, you have to change the import type. Click on **Following List** and you'll get a menu. Choose **Domain blocking list.** ![A menu of eight items. Domain blockling list, highlighted in blue, is the last.](https://thenexusofprivacy.net/content/images/2024/03/Screenshot-2024-03-24-at-12.51.45-AM.png) Once you're done, the page should look like this. ![A dialog like the previous one but the Import type is now Domain blocking list. Below, a button to Browse the CSV data file, and radio buttons offering a choice between Merge and Overwrite, with merge currently selected](https://thenexusofprivacy.net/content/images/2024/03/Screenshot-2024-03-24-at-12.53.37-AM.png) Now, click on Browse and select the domain blocking list file you created in step 1 (if you're on a computer and downloaded the one I linked to, it should be in your downloads with the name thread-blocks.csv). Here's what that section of the dialog looks like once I've selected the file: ![Data: CSV file exported from anothe Mastodon server. A Browse button, and to the right threads-block.csv](https://thenexusofprivacy.net/content/images/2024/03/Screenshot-2024-03-24-at-1.10.34-AM.png) Now click **Upload,** and you'll get a **Confirmation** dialog. Click on **Confirm**. The bottom of the import log page should now show your import's status as **In progress** – or, depending on how fast the server is, might already show it as Finished. ![Recent imports: domain blocking list, in progress.](https://thenexusofprivacy.net/content/images/2024/03/Screenshot-2024-03-24-at-1.13.20-AM.png) If it saying In progress, wait a bit and hit refresh. At some point, it'll hopefully show that the import has finished. Yay! ## The limitations of domain blocking on the fediverse The ActivityPub protocol that powers Mastodon and other software fediverse wasn't designed with safety and in mind, so blocking on the fediverse is very imperfect. One reason is because of the inherent challenges of the fediverse's architecture, with thousands of independent instances (servers) all potentially running different software. Once your posts get federated (copied) to another instance, you no longer have control over them. Not only that, design decisions and bugs in the software make can blocking less effective. And while I'm focusing on Threads in this article, these weaknesses are also a problem when dealing with other threats as well! For example: - Blocking doesn't protect your existing posts or profile if they've already federated to the instance that you're blocking. Since Threads hasn't enabled two-way communication yet, nothing's federated there yet, so that's an argument for blocking now! - Blocking is a lot less effective if your instance admin hasn't turned on "authorized fetch" – and while more privacy-friendly fediverse software like GoToSocial always turns this on, it's *off* by default in Mastodon.[1](#notes) Unfortunately there's no easy way to check if authorized fetch is enabled on your instance, but see the appendix on [Checking to see if authorized fetch is enabled](#checking-af-enabled) for instructions on how to use the web browser's development tools to find out. - Some apps access data in a way that ignores or evades blocks. Threads would probably get into trouble with EU regulators if they did this in their official app, so my guess is they won't (the risk/reward tradeoff doesn't seem right) – and if they do, I'm sure we'll hear about it in a hurry. Still, people with accounts on Threads could potentially use these apps to get at your content And if you're using one of those apps, there are situations where you might see posts from Threads in your feed even though you've blocked it. - Multiple people have reported unexpected results from blocking – people from instances they've blocked showing up in their feed or unexpectedly still able to interact with their posts, or the same test showing different results. Open Mastodon bugs include [User domain blocks do not prevent viewing updated profile information](https://github.com/mastodon/mastodon/issues/28397?ref=thenexusofprivacy.net) and [Blocked or muted accounts still appear when boosted](https://github.com/mastodon/mastodon/issues/7813?ref=thenexusofprivacy.net), and there may well be others that haven't been reported. Also, keep in mind that on most instances (servers), anybody can see your profile and your public and unlisted posts from a web browsesr if they have a link to it. So even if you or your instance has blocked Threads, Threads users will be able to see profile or any post they have a link to by using a web browser. So like I say, domain blocking's far from perfect – but it's better than nothing. In practice, if you or your instance has blocked Threads, and your instance is running authorized fetch, people using the Threads app shouldn't be able to see any new posts you make, and the only posts and notifications you'll see from Threads are due to bugs in the software. ## Spread the word! Polls consistently show that a lot of people in the fediverse want to block Threads, and Mark F—ing Zuckerberg in particular is widely loathed, so some of your followers might also be interested in blocking. So let people know what you've done! It doesn't have to be fancy – "I'm #BlockingThreads, you can too" is fine, and maybe include a link to this post or some other instructions. Or you can get more elaborate if you want! If you're looking for reasons why others are blocking Threads, [Why block Meta?](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#why) has lots of perspectives. ## Support FediPact creator Vanta Black! The Anti-Meta FediPact helped galvanize resistance to Meta at a crucial time. As I wrote in [Why the Anti-Meta Fedi Pact is good strategy for people who want the fediverse to be an alternative to surveillance capitalism](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#strategy), > "Most importantly, it counters the gaslighting that resistance is futile. The segment of the fediverse that wants to reject Meta is clearly large enough that it will survive no matter what the big Mastodon instances and pundits do." Alas, [FediPact creator Vanta Black has been having a tough time](https://cyberpunk.lol/@vantablack/112080004580673240?ref=thenexusofprivacy.net) – including recently being kicked out by her roomie. So it's a great time to show appreciation by helping her out! Even just boosting her [post](https://cyberpunk.lol/@vantablack/112080004580673240?ref=thenexusofprivacy.net) helps ... and if you've got a little money to spare, each donation makes a difference. ## Appendix: Checking to see if authorized fetch is enabled on an instance As far as I know, the only way to check whether authorized fetch is enabled on a fediverse instance is to try to fetch something via the API and see if it works. One way to do this is to bring up a new tab in a web browser, then bring up the developer tools: - in Firefox: **Tools / Browser Tools /Web developer tools**, and then select the **Console** tab - in Chrome: **View / Developer / Developer tools,** and select the **Console** tab - in Vivaldi: **Tools / Developer Tools,** and select the **Console** tab - in Safari it's **Develop / Show Javascript console** At the > prompt at the bottom of the console, do the following – make sure to substitute your instance and account name in the second line! ``` req = new XMLHttpRequest(); req.open("GET", 'https://infosec.exchange/@thenexusofprivacy', false) req.setRequestHeader("Accept", "application/activity+json") req.send() req.response ``` If you get an error like **401 (Unauthorized)** or **request not signed**, that means your instance has enabled authorized fetch. Here's what it looks like in Firefox trying to fetch the Nexus of Privacy account on infosec.exchange ![ GET https://infosec.exchange/@thenexusofprivacy. '{"error":"Request not signed"}' ](https://thenexusofprivacy.net/content/images/2024/03/Screenshot-2024-03-25-at-11.53.57-PM.png) If you get an error about something related to the "**Content-Security-Policy**", the site's security settings mean the test hasn't given any useful information about authorized fetch. This can also happen if you've the test from the developer tools for a tab that's logged in to a different server; double-check to make sure you were doing it from a new tab that's not logged in. If instead of an error you get a big blob of JSON code, that means your instance *hasn't* enabled authorized fetch. Here's the first few lines when I test the Nexus of Privacy account on mastodon.social. ![A bunch of code, starting with {"@context":["https://www.w3.org/ns/activitystreams" ...](https://thenexusofprivacy.net/content/images/2024/03/Screenshot-2024-03-25-at-11.59.05-PM.png) If your instance hasn't enabled authorize fetch, ask your admin if they plan to change that. If not, consider moving to an instance that takes user safety. ## Notes 0 The [Threads supplemental privacy policy](https://help.instagram.com/515230437301944?ref=thenexusofprivacy.net) says they can use any data federated to them to "to provide measurement, analytics and other business services (including ads)" and to "improve Threads and other Meta Products" – presumably including using it to train AI models. Of course, on most Mastodon instances your profile is public, so this is data that they could potentially get in other ways ... but why make it easy for them? 1 Today, many of the largest Mastodon servers haven't enabled authorized fetch (meaning that blocking is a lot less effective by default); as the lengthy warning in Mastodon's documentation describes, [turning it on has some significant drawbacks](https://docs.joinmastodon.org/admin/config/?ref=privacy.thenexus.today#authorized%5Ffetch). In the upcoming Mastodon release, authorized fetch will be turned on for anybody who blocks an account, so that should deal with that problem. 2 See footnote 0. 3 An earlier version of this post suggested that Threads could get at more implementation in this situation if their implementation changed, but a Mastodon developer clarified to me that the server (and maybe the time you're accessing it) is only information that's ever shared when you just view a profile or a post on another instance. 4 Actually it doesn't have to be Zuck's account, this will work with any profile on threads.net. If you'd rather block a hate group or an anti-trans bigot there are plenty to choose from! But Mark F\*\*\*ing Zuckerberg's enabling them, so he's a good place to start. ## Image credits Thanks @box464@mastodon.social for the screenshot of the menu on the mobile app! ## Update log April 30, 2025: include discussion of threads.com January 7, 2025: replace quotes at the top, minor tweaks in first paragrap April 15, 2024: shift detailed discussion of limitations to later, tighten up intro April 10: updated with new title and more detailed discussion of limitations. March 24: first update, with the domain blocking file method, and then a seond update with both methods and a discussion of the privacy tradeoffs. March 23: original version, with the profile-based method ## ## ### Steps towards a safer fediverse URL: https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/ Last updated: 2026-04-16T03:17:40.000Z > Join the discussion on [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/111814755193414667https://infosec.exchange/@thenexusofprivacy/111972192551285042?ref=thenexusofprivacy.net) or [Lemmy](https://lemmy.blahaj.zone/post/9072981?ref=thenexusofprivacy.net). ### Contents - [Intro](#intro) - [It's about people, not just the software and the protocol](#not-just-software) - [It's also about the software](#also-about-software) - [And it's about the protocol, too](#and-the-protocol) - [Threat modeling and privacy by design can play a big role here](#threat-modeling) - [Design from the margins – and fund it!](#design-from-the-margins) Earlier posts in the series: [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/), [Blocklists in the fediverse](https://thenexusofprivacy.net/blocklists-in-the-fediverse/), [It’s possible to talk about The Bad Space without being racist or anti-trans – but it’s not as easy as it sounds](https://thenexusofprivacy.net/the-bad-space/), and [Compare and contrast: Fediseer, FIRES, and The Bad Space](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/) ## Intro > "This goes against everything the Fediverse stands for."‌ > > – a comment on one of the proposals in the draft version of this article in the [Lemmy discussion](https://lemmy.world/post/11181717?ref=thenexusofprivacy.net) As EFF says, [The Fediverse Could Be Awesome (If We Don’t Screw It Up)](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=privacy.thenexus.today). Big centralized social networks with their surveillance capitalism business models keep getting worse and worse. The fediverse's decentralized architecture – with thousands of instances (aka servers) running any of dozens of somewhat-compatible software platforms – is a great opportunity to take a different approach. But today's fediverse is not yet awesome. Also, for the last year it's been shrinking, rather than growing.[1](#notes) As I said in [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) > "One reason why: today's fediverse is unsafe by design and unsafe by default – especially for Black and Indigenous people, women of color, LGBTQIA2S+ people[2](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/#fn-lgbtaiq2s), Muslims, disabled people and other marginalized communities." While there are quite a few fediverse instances with active and skilled moderators and admins that *are* relatively safe – safer in many ways than Facebook or Twitter – that's still far from the norm. Hundreds, maybe thousands, of instances aren't actively moderated; as the [mid-February 2024 spam attack](https://techcrunch.com/2024/02/20/spam-attack-on-twitter-x-rival-mastodon-highlights-fediverse-vulnerabilities/?ref=thenexusofprivacy.net) illustrated, this causes huge problems for people and moderators on other instances as well – and the same techniques that spammers use can also be used for harassment and disinforation. And even on instances with active moderation, the tools don't make it easy for moderators to do their job ... and many don't have a lot of experience with anti-racist moderation or dealing with disinformation. The good news is that there are some straightforward opportunities for significant short-term safety improvements. *If* fediverse funders, developers, businesses, and "influencers"start prioritizing investing in safety*,* the fediverse can turn what's currently a big weakness into a huge strategic advantage. After all, today's big centralized social networks aren't very safe either – especially for Black and Indigenous people, women of color, LGBTQIA2S+ people, Muslims, disabled people and other marginalized communities. Then again, it might not happen. The largest software platforms in today's fediverse haven't prioritized safety in the past; neither has the ActivityPub protocol. And as I'll discuss in an upcoming installment in this series, today's fediverse will have to revisit some core assumptions to make progress. So it's possible that the fediverse will collectively shrug its shoulders and squander this opportunity. There's a reason this series is called "Golden opportunities for the fediverse – *and whatever comes next.*" So we shall see. But at least for this post, let's make the leap of faith that there's enough of a critical mass of people and organizations that want a safer fediverse, and look at steps towards towards making that happen. ## It's about people, not just the software and protocol As I'll discuss below, today's fediverse software certainly needs improvement, and so does the ActivityPub protocol. But let's start with something that's even more important. One of the distinctive features of the fediverse's architecture (as opposed to pure peer-to-peer networks) is the role of instances. Some instances are much safer than others, and admins and moderators can play a big role in making their instances safer. But effective anti-racist and intersectional moderation is hard! So is dealing with disinformation, harassment, and cultural conflicts. And as the [IFTAS Fediverse Moderator Needs Assessment Results](https://cryptpad.fr/file/?ref=thenexusofprivacy.net#/2/file/kW2UN6MqNvDRVOkFm3ba+zCo/) highlights, most moderators today don't feel like they have the tools and resources they need. So this is an area where investment can pay a lot of dividends. A few specific suggestions: - Steering people to instances that are well-moderated and have functionality like local-only posts that give people more protection from nazis, white supremacists, anti-LGBTQIA2S+ bigots and harassers on other instances - A fediverse-wide incident response team and communication channels to deal with situations like the spam attack. With [instance blocklists](https://thenexusofprivacy.net/blocklists-in-the-fediverse/), tools like Fediseer, and configuration settings, there's plenty of useful technology here; the challenge is getting it to the people and instances that need it. - Making it easy for admins setting up new instances to choose from one of a list (configurable by hosting providers) of initial instance blocklists that prevents hate speech and harassment from known bad actors[3](#fn-bad-actor) – and to provide functionality like local-only posts. - Improving moderation on instances that aren't as well moderated but want to be, using techniques like - Training and mentoring, including dealing with different aspects of intersectional moderation. - Documentation of best practices, including templates for policies and process, and sharing and distilling "positive deviance" examples of instances that do a good job - Cross-instance teams of expert moderators who can provide help in tricky situations - Workshops, conferences, and ongoing discussions between moderators, software developers, and community members Similarly, providing tutorials and documenting for people to protect their privacy on the fediverse can also provide immediate safety benefits. Defaults on most fediverse software are not privacy-friendly, and settings are not always easy to find – for example, the Mastodon mobile app makes it really hard to enable approval for new followers (which is necessary to prevent harassing replies to followers-only posts).[4](#fn-enable-approval) Resources developed and delivered with funded involvement of multiply-marginalized people who are the targets of so much of this harassment today are likely to be the most effective. ## It's also about the software > "There’s a lot more that can be done to counter harassment, Nazism, racism, sexism, transphobia, and other hate online. Mastodon’s current functionality only scratches the surface of what’s possible — and has generally been introduced in reaction to events in the network." > > – [Lessons (so far) from Mastodon](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=privacy.thenexus.today), 2017-8 > "With the surging popularity of federating tools, how do we make it easier to make safety the default?" > > – Roland X. Pulliam [Federation Safety Enhancement Project (FSEP) ](https://nivenly.org/docs/papers/fsep/?ref=privacy.thenexus.today)[Product Requirements Document](https://nivenly.org/docs/papers/fsep/?ref=thenexusofprivacy.net), August 2023 Developers, instance admins, and hosting companies can also play a big role. People who are targets of harassment are clear about the kind of functionality they want: local-only posts,[5](#local-only-posts) the ability to control who can reply to posts,[6](#fn-who-can-reply) other [finer-grained controls](https://hachyderm.io/@hrefna/111078871114651478?ref=thenexusofprivacy.net) over visibility and interaction. Fediverse software platforms like Pixelfed, Bonfire, GoToSocial, Akkoma, Friendica, Hubzilla, and (streams) already provide some or all of these tools; so do Mastodon forks like Glitch, Hometown and Firebird. Broader adoption of software that gives people better tools to protect themselves could have an impact *today*, as could hosted offerings that combine more-safety-oriented software with privacy-friendly default settings that are known to reduce risks of harassment and hate speech. Implementing this functionality on platforms like Mastodon and Lemmy that don't currently have them is a basic first step. People volunteering for platforms that don't have this functionality yet should encourage the developers to implement it, quickly – or shift their efforts to forks and platforms that *do* prioritze safety. Funders should follow suit. At least in the short term, the fediverse is also likely to continue to rely on the useful-but-very-imperfect tools of [instance blocking](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/#blunt-but-powerful) and blocklists, augmented by instance catalogs like [The Bad Space](https://thenexusofprivacy.net/the-bad-space/#the-bad-space) and [Fediseer](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/#fediseer). There's a fair amount of innovation already happening in this area, with infrastructure like [FIRES](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/#fires), CARIAD, and Fedimod all under active development. [Steps towards better blocklists](https://thenexusofprivacy.net/blocklists-in-the-fediverse/#better-blocklists) discusses further incremental improvements on this front. [Pixelfed's Autospam](https://pixelfed.blog/p/2023/feature/autospam-and-naive-bayes-the-grandfather-of-spam-filters-still-making-waves?ref=thenexusofprivacy.net) highlights the potential value of a straightforward Naive Bayes approach. The retrospectives after the February spam wave are already highlighting other opportunities for improvement. Longer-term, fediverse software will need more fundamental changes, including [paying more attention to consent](https://thenexusofprivacy.net/free-fediverses-and-consent/). As I said in [The free fediverses should focus on consent (including consent-based federation), privacy, and safety](https://thenexusofprivacy.net/free-fediverses-and-consent/) > "There aren't yet a lot of good tools to make consent-based federation convenient scalable, but that's starting to change. Instance catalogs like [The Bad Space](https://thenexusofprivacy.net/the-bad-space/) and [Fediseer](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/), and emerging projects like the [FIRES recommendation system](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/). [FSEP's design for an"approve followers" tool](https://thenexusofprivacy.net/the-bad-space/#fsep), could also easily be adapted for approving federation requests. [ActivityPub spec co-author Erin Shepherd's suggestion of "letters of introduction"](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web?ref=privacy.thenexus.today), or something along the lines of the IndieWeb [Vouch](https://indieweb.org/Vouch?ref=privacy.thenexus.today) protocol, could also work well at the federation level. Db0's [Can we improve the Fediverse Allow-List Model?](https://dbzer0.com/blog/can-we-improve-the-fediverse-allow-list-model/?ref=privacy.thenexus.today) and the the "fedifams" and caracoles I discuss in [The free fediverses should support concentric federations of instances](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#concentric-federations) could help with scalability and making it easier for new instances to plug into a consent-based network." As I'll discuss in future installments in the series, this will require revisiting some core assumptions – especially for Mastodon, whose documentation describes consent-based federation as contrary to its mission. What's striking, though, is how much incremental progress can be made even with existing code bases. PeerTube and Pixelfed, for example, have key building blocks for making consent-based federation choices more scalable and usable, including manual approval of federation requests, triggers and custom rules which allow for partial automation, plugins, and opt-in federation with Threads for individual users. Akkoma, GoToSocial, and [even Mastodon](https://docs.joinmastodon.org/admin/config/?ref=privacy.thenexus.today#limited%5Ffederation%5Fmode) (despite its philosophical objections) all support "allow-list" federation. The FSEP proposal sketches how instance catalogs like The Bad Space can be leveraged to provide more informed consent for approving followers, an approach that can also be applied to other aspects of consent. Apps can play an important role as well, as [Tapbots' emergency update for Ivory](https://tapbots.social/@ivory/111960653110944852?ref=thenexusofprivacy.net) with a custom filter during the recent spam wave illustrates. For example, apps could expand on the policy several apps implemented in 2019 of blocking white supremacist instance Gab by embedding a "worst-of-the-worst" blocklist; allowing individuals to upload their own blocklists (functionality that web UIs like Mastodon and Misskey already support to some extent); and adding support for sharing filters and blocklists. A complementary approach, also worth pursuing (and funding!), is to investigate tools from other platforms like [Block Party](https://www.blockpartyapp.com/how-it-works/?ref=thenexusofprivacy.net) (and [Filter Buddy](https://shagunjhaver.com/research/articles/jhaver-2022-filterbuddy/jhaver-2022-filterbuddy.pdf?ref=thenexusofprivacy.net)) that allow for collaborative defense against harassment and toxic content can apply in a federated context – initially as standalone tools if necessary, but ideally integrated into existing apps and web UIs. This work is also likely to be relevant (perhaps with modifications) to Bluesky-based networks. And as both Block Party and Filter Buddy highlight, tools designed and implemented by (and working with) marginalized people who are the targets of so much of this harassment today are likely to be the most effective. ## And it's about the protocol, too > "Unfortunately from a security and social threat perspective, the way ActivityPub is currently rolled out is under-prepared to protect its users." > > Christine Lemmer-Webber, in [OcapPub: Towards networks of consent](https://gitlab.com/spritely/ocappub/blob/master/README.org?ref=privacy.thenexus.today) > "The basics of ActivityPub are that, to send you something, a person `POST`s a message to your Inbox. > > This raises the obvious question: Who can do that? And, well, the default answer is anybody.... this means that we’re dealing with things now with the crude tools of instance blocks or allow list based federation; and these are tools which are *necesssary, but not sufficient."* > > – Erin Alexis Owen Shepherd, in [A better moderation system is possible for the social web](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web/?ref=privacy.thenexus.today) > "What isn't reasonable is that the activitypub protocol baked in the assumption that the only consent that should matter for replying is that of the person replying. Because some ideological nonsense about information and speech needing to be free or some shit. > > A dude saying "if you don't like receiving hate messages from nazis just block them" is baked into the source code." > > – Bri Seven, [August 2024](https://merveilles.town/@zens/112896172537181221?ref=thenexusofprivacy.net) The ActivityPub protocol that powers today's fediverse is extremely flexible, and the spec's authors – including Lemmer-Webber and Shepherd – deserve a lot of credit for coming up with something that (as Ariadne Conill said back in 2018 in [ActivityPub: The “Worse Is Better” Approach to Federated Social Networking](https://ariadne.space/2019/01/07/activitypub-the-worse-is-better-approach-to-federated-social-networking/?ref=thenexusofprivacy.net)) "mostly gets the job done." And Lemmer-Webber, Shepherd, Conill, and others and others have all described approaches for providing more safety with ActivityPub. Still, the original ActivityPub spec wasn't designed with a focus on safety or privacy. Indeed, as [Hrefna points out](https://hachyderm.io/@hrefna/112185439818906762?ref=thenexusofprivacy.net), ActivityPub "makes assumptions that are fundamentally opposed to the kinds of protections that people seem to be seeking." Not only that, [some aspects of ActivityPub's design make it challenging to write secure implementations](https://hachyderm.io/@hrefna/111942682708117990?ref=thenexusofprivacy.net); so does its complexity – and insecure software compromises safety as well as privacy. It's certainly possible that these issues could be addressed with improvements to the ActivityPub protocol, or with an additional protocol layered on top of it. Lisa Dusseault's outstanding [Threat Model for Data Portability](https://dtinit.org/blog/2024/01/16/threat-model-pt-one?ref=thenexusofprivacy.net) is a very encouraging sign. Who knows, perhaps Meta's adoption of ActivityPub – and participation in the standards committee – will lead to an increased focus on safety. But it's also possible that won't happen, and fediverse software will need to shift to more safety-conscious protocols. ## Threat modeling and privacy by design can play a big role here! > "[Social threat modeling](https://medium.com/a-change-is-coming/social-threat-modeling-the-winds-of-change-are-in-the-air-8dc330479a50?ref=privacy.thenexus.today) applies structured analysis to threats like harassment, abuse, and disinformation. You'd think this would happen routinely, but no." > > – [Social threat modeling and quote boosts on Mastodon](https://thenexusofprivacy.net/social-threat-modeling-and-quote-boosts/) I've discussed threat modeling in several other posts (including [Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/)) so I'm not going to go into detail on it here, but it's a vital technique for developing software that's safer and more secure. [Improving privacy and safety in fediverse software](https://thenexusofprivacy.net/ipsfs-nlnet/) goes into more detail on what a threat modeling project for the fediverse could look like. > "Mastodon ... violates pretty much all of the [seven principles of Privacy by Design](https://en.wikipedia.org/wiki/Privacy%5Fby%5Fdesignhttps://web.archive.org/web/20221020132403/https://www.ipc.on.ca/wp-content/uploads/Resources/pbd-implement-7found-principles.pdf?ref=thenexusofprivacy.net). Privacy by default? End-to-end security? User-centricity? Uh, no." > > – [Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/) And speaking of vital techniques for developing software that's safer and more secure, the principles and practices of privacy by design highlight the opportunities for short-term low-hanging fruit – as well as longer-term directions. Looking at the February spam attack, for example, a privacy-by-default approach would have significantly reduced the opportunities for spammers to set up new accounts ("open registration" isn't privacy by default), limited the ability for new accounts to affect other instances (accepting all federation requests isn't privacy by default), and limited the impact on individual users (getting notifications and direct messages from random accounts isn't privacy by default). ## Design from the margins – and fund it! > "We need to acknowledge that there is a history on Mastodon of instances of color being marginalized, being discriminated against. There is a history users of color being subject to racist, to anti-Semitic, to homophobic kinds of abuse. There is a history of the kinds of similar kinds of violence against users of color, against disabled users, against marginalized users on Mastodon that there is on Twitter ..." > > – Dr. Johnathan Flowers,[ The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) (December 2022) > "\[D\]espite all the major contributions they’ve made, queer, trans, and non-binary people of all colors have also been marginalized in Mastodon." > > – [A (partial) queer, trans, and non-binary history of Mastodon and the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net), June 2023 > "The decentered include subpopulations who are the most impacted and least supported; they are often those that face highest marginalization in society... when your most at-risk and disenfranchised are covered by your product, we are all covered." > > – Afsaneh Rigot, [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=privacy.thenexus.today), 2022 It's worth reemphasizing a point I've touched on a few times already: The single most important way for the fediverse to move forward is to **fund more work by and with people from decentered communities.** As LeslieMac said back in 2017 after Twitter introduced some bone-headed feature that led to increased harassment, "literally 10 (paid) Black Women with > 5K followers would head this crap off at the pass." And, yes, I'm bringing up funding repeatedly. It's important! I don't mean to minimize the importance of volunteers, who may well wind up doing the bulk of the work here: as moderators, as members of open-source software projects. People want to be safer online, and want to be able to invite their friends and relatives to communities where they won't be exposed to hate speech and harassment, so many people will help out in various ways. That's good! Still, paid positions and project-based funding are important as well. Unless people are paid for their work, participation is restricted to those who can afford to volunteer. Where will the money come from? As well as crowdfunding and civil society organizations (the primary funding mechanism for today's fediverse), businesses looking at the fediverse are an obvious source. Media organizations considering the fediverse, progressive and social justice organizers looking for alternatives now that Twitter's turned into a machine for fascism have smaller budgets but just as much interest in improvement. So if you're somebody from a tech or media company looking at the fediverse, a foundation or non-profit concerned about disinformation or corporate control of media, a progressive or racial justice organization hoping to build a counter to fascist-controlled social networks like Xitter, or an affluent techie feeling guilty about having made your money from surveillance capitalism ... now's a good time to invest. ## Stay tuned! I took a break from this series for a while, and resumed in September 2024\. Here are the next posts in the series: - [Eight tips about consent for fediverse developers](https://thenexusofprivacy.net/consent-for-fediverse-developers/) expands on the brief mentions of consent in this essay. - [5 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/) returns to the focus on anti-Blackness and racial equity - [I for one welcome Bluesky, the ATmosphere, BTS ARMY, and millions of Brazilians to the fediverses!](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/) look at one big way things have changed – for the better – since November 2022\. - [Is Bluesky part of today’s Fediverse?](https://thenexusofprivacy.net/is-bluesky-part-of-todays-fediverse/) delves into the definitional struggle - [The Social Web Foundation and the elephant in the federated room](https://thenexusofprivacy.net/swf-and-the-meta-elephant/) looks at a new multi-polar non-profit – and Meta, whose plans to plans to [embrace, extend, and exploit the ActivityPub Fediverse](https://thenexusofprivacy.net/embrace-extend-and-exploit/) continue to be controversial - [More questions than answers: another post about the Social Web Foundation and the fediverses](https://thenexusofprivacy.net/swf-questions/) looks at how questions the Social Web Foundations sparks for others in the fediverse - A lot of good stuff is happening in the fediverses! focuses on the positive (although of course, there's also a lot of less-good stuff happening) Still to come: discussions some of the core assumptions today's fediverse will need to revisit – and some of the hard problems that need to be solved. I'll also talk about the opportunities if that happens. ## Notes 1 According to [Fediverse Observer](https://fediverse.observer/stats?ref=thenexusofprivacy.net), the number of monthly active fediverse users *decreased* by 7% over the course of 2023\. According to [fedidb.org](https://fedidb.org/?ref=thenexusofprivacy.net), monthly active users *decreased* by 30% over the source of the year. 2 I'm using LGBTQIA2S+ as a shorthand for lesbian, gay, gender non-conforming, genderqueer, bi, trans, queer, intersex, asexual, agender, [two-sprit](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today), and others who are not straight, cis, and heteronormative. [Julia Serrano's trans, gender, sexuality, and activism glossary](https://www.juliaserano.com/terminology.html?ref=privacy.thenexus.today) has definitions for most of terms, and discusses the tensions between ever-growing and always incomplete acronyms and more abstract terms like "gender and sexual minorities". [OACAS Library Guides' Two-spirit identities page](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today) goes into more detail on this often-overlooked intersectional aspect of non-cis identity. 3 As [Instance-level federation decisions reflect norms, policies, interpretations, and (sometimes) strategy](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/#norms) discusses, opinions differ on the definition of "bad actor." So the best approach is probably going to present the admin of a new instance with a range of recommendations to choose between based on their preference. Software platforms should provide an initial vetted list (along with enough information for a new admin to do something sensible), and hosting companies and third-party recommenders should also be able provide alternatives. 4 On the Mastodon iOS app, click on the gear icon at the top right to get to Settings. Scroll down to *The Boring Zone* and click on account settings. Authorize signing in to your Mastodon account, which takes you to the *Account settings* page. Click on the three bars in the top right of the screen to get to the settings menu; click on *Public profile*, and then *Privacy and reach*. Scroll down to the *Reach* section and unclick the "Automatically accept new followers." Easy peasy! I get it: the Mastodon team has minimal development resources, so instead of implementing functionality directly in the mobile app it's much more efficient from an engineering perspective to simply add a few more clicks and use the web functionality. But it's still a major hassle for users. 5 I know I sound like a broken record on this, but this valuable privacy and safety functionality has been implemented in Mastodon forks for *six years* but Mastodon's BDFL (Benevolent Dictator for Life) Eugen Rochko refuses to make it broadly avaiable. [Does Mastodon really prioritize stopping harassment?](https://thenexusofprivacy.net/mastodon-a-partial-history/#does-mastodon-really-prioritize-stopping-harassment) has more. 6 Until Glitch-soc maintainer Claire's November 2022 [FEP-5624: Per-object reply control policies proposal](https://socialhub.activitypub.rocks/t/fep-5624-per-object-reply-control-policies/2723?ref=thenexusofprivacy.net) (or an alternative) is adopted as a de facto standard, there are likely to be compatibility issues related to this, which is annoying, but shouldn't be a barrier to progress. Similar compatibility problems also came up when Mastodon introdued post visibility back in 2016-2017, but since this was functionality that most people wanted, the issues wound up getting resolved. ## Image credit Safety, by [Nick Youngston](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) for [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [Picpedia](https://www.picpedia.org/highway-signs/s/safety.html?ref=thenexusofprivacy.net), licenced under [CC BY-SA 3.0](http://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) ## Revision history Ongoing: typo fixes, wording improvements and clarifications, adding links and quotes February 21: [revised version published](https://web.archive.org/web/20240222203902/https://privacy.thenexus.today/steps-towards-a-safer-fediverse/), no longer a draft! January 26- February 1: [revisions to draft](https://web.archive.org/web/20240216225022/https://privacy.thenexus.today/steps-towards-a-safer-fediverse-draft/), including responses to feedback from Lemmy discussion January 25: [first published draft](https://web.archive.org/web/20240216225022/https://privacy.thenexus.today/steps-towards-a-safer-fediverse-draft/https://web.archive.org/web/20240127061503/https://privacy.thenexus.today/steps-towards-a-safer-fediverse-draft/), shared to [Lemmy](https://lemmy.blahaj.zone/post/8014919?ref=thenexusofprivacy.net) ### Business is business: Snap, Microsoft, and X endorse the anti-LGBTQ+, pro-censorship KOSA bill URL: https://thenexusofprivacy.net/kosa-snap-x-microsoft/ Last updated: 2026-04-16T03:17:17.000Z > Join the discussion on [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/111814755193414667?ref=thenexusofprivacy.net) or [Lemmy](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net). > "Experts have [repeatedly explained](https://cdt.org/wp-content/uploads/2024/01/Joint-letter-for-the-record-31-Jan-2024-child-safety-online.pdf?ref=thenexusofprivacy.net) why, as written, dangerous and misguided bills like KOSA, STOP CSAM, and the EARN IT Act would make kids less safe, not more safe. Hundreds of thousands of young people and others have [spoken up](http://badinternetbills.com/?ref=thenexusofprivacy.net#testimonials), calling for legislation that protects privacy rather than leads to censorship. But these bills’ sponsors have so far rejected common-sense fixes that would ensure these bills crack down on Big Tech’s harmful business practices rather than trampling free expression, privacy, and human rights." > > – Fight for the Future director Evan Greer, quoted in [If Senators want to protect kids, they need to listen to human rights experts and fix their legislation. Otherwise they’re helping Big Tech.](https://www.fightforthefuture.org/news/2024-01-31-if-senators-want-to-protect-kids-they-need-to-listen-to-human-rights-experts-and-fix-their-legislation-otherwise-theyre-helping-big-tech?ref=thenexusofprivacy.net) > “Protecting minor children from the transgender \[sic\] in this culture and that influence,” is one of the most important issues conservatives can take a stand on now, \[Sen. Marsha\] Blackburn [said](https://www.youtube.com/watch?v=jg21OdmUj1g&ref=thenexusofprivacy.net), in an interview with the Family Policy Alliance, a group [pushing](https://baptistnews.com/article/focus-on-the-family-affiliate-is-the-unifying-force-behind-campaign-to-restrict-transgender-rights/?ref=thenexusofprivacy.net) anti-LGBTQ rights laws. “And I would add to that, watching what’s happening on social media. I’ve got the Kids Online Safety Act.” > > – Melissa Gira Grant, [The GOP Has a Plan for “Online Safety.” It Involves Censoring LGBTQ Content](https://newrepublic.com/article/178637/republicans-sneaky-new-plan-ban-kids-queer-content?ref=thenexusofprivacy.net), *The New Republic* > “The owner of Snapchat is backing a bill meant to bolster online protections for children on social media, the first company to publicly split from its trade shop days before the company’s CEO prepares to testify on Capitol Hill.” > > – Rebecca Kern, [First tech platform breaks ranks to support kids online safety bill](https://www.politico.com/news/2024/01/25/snapchat-kids-safety-bill-00137853?ref=thenexusofprivacy.net), Politico > *"The Kids Online Safety Act (KOSA) provides a reasonable, impactful approach.... Microsoft supports this legislation, encourages its passage, and applauds Senators Blumenthal and Blackburn for their leadership."* > > – [Microsoft President Brad Smith](https://www.linkedin.com/posts/bradsmi%5Ftechnology-can-be-a-powerful-tool-for-learning-activity-7158198793702621184-AxX7/?ref=thenexusofprivacy.net) on Linked In > "We support KOSA... \[We\] will continue to make sure that it accelerates." > > – X CEO Linda Yaccarino, quoted in Matt Binder's [Elon Musk’s X comes out in favor of pro-censorship law](https://mashable.com/article/x-ceo-linda-yaccarino-supports-kosa?ref=thenexusofprivacy.net), *Mashable* > Take action: Fight for the Future's [stopkosa.com](https://www.stopkosa.com/?ref=thenexusofprivacy.net) makes it easy to contact Congress and ask them to oppose KOSA Spirited opposition from human rights and LGBTQ groups – as well as digital rights organiations like EFF and Center for Democracy and Technology – kept Congress from passing KOSA in 2023, but the bill's bipartisan sponsors and supporters made it clear that they weren't giving up. Neither are the sponsors of STOP CSAM, EARN IT, or the other bad internet bills. One way to look at yesterday's Senate hearing on [Big Tech and the Online Child Exploitation Crisis](https://www.judiciary.senate.gov/committee-activity/hearings/big-tech-and-the-online-child-sexual-exploitation-crisis?ref=thenexusofprivacy.net) – and "surprise" announcements of support from several Big Tech companies – was the official launch of their 2024 campaign. The problems KOSA and the other bills are addressing are real. As danah boyd says in [KOSA wasn't designed to help kids](https://zephoria.medium.com/kosa-isnt-designed-to-help-kids-335ab57cddae?ref=thenexusofprivacy.net) > "Are young people in a crisis? ABSOLUTELY. Suicide ideation and completion rates are increasing. Depression and anxiety are escalating. Youth are crying out for help in countless ways, including turning to the internet in the hopes that they’ll find support." And Congress is quite right to point a finger at Big Tech for their role. Meta buried internal research higlighting the harms Instagram causes to teen girls, and their CEO [Mark F\*\*\*king Zuckerberg Is Not Your Friend](https://catvalente.substack.com/p/mark-fking-zuckerberg-is-not-your). X laid off its entire Trust & Safety staff, and their new owner personally intervened to restore the account of somebody spreading child sexual abuse material (CSAM). So the idea of legislation that would help kids in a crisis while reining in Big Tech is attractive. Alas, these bills would do neither. As boyd says: > "\[T\]he stark reality is that bills like this will do more harm to vulnerable youth at the very moment when so many young people need help. They need investment, attention, support. What will it take for people to realize that focusing on tech isn’t the path forward to helping youth? Sadly, I know the answer. More dead kids." Still, for many politicians in both parties, what's important here is *looking like* they're trying to protect children and rein in Big Tech – whether or not they *actually* protect children and reining in Big Tech*.* KOSA gives them something the can use on the campaign trail. And Big Tech spends a lot of money on lobbying, so doing something that would actually help rein them in is politically challenging. Meanwhile, tech companies want to *look like* they're so concerned about protecting children that they're willing to endorse tough legislation. Of course they know that these bills won't actually help, but again, what's important here? As I'll discuss at the end of this article, if Congress decides they actually want to protect children (and decides that's politically better than looking like they *don't* want to protect chlidren), there are things they could do: improve KOSA, pass the bipartisan[ Invest in Child Safety Act](https://www.wyden.senate.gov/news/press-releases/wyden-eshoo-fitzpatrick-reintroduce-bipartisan-legislation-to-protect-children-from-online-exploitation?ref=thenexusofprivacy.net). Before we get there though, let's look in more detail at the politics of the situation – and the interesting situation pro-LGBTQ+ big tech companies find themselves in. ## The anti-LGBTQ+ aspects of KOSA are far from the only problem with the bill There's been a lot of focus on the anti-LGBTQ+ aspects of KOSA, and for good reason. To be clear, this is far from the only problem with the bill. For one thing, it won't actually make kids safer, which is supposedly its whole reason for existing! And As Julia Serano says in [KOSA: A Nationwide Anti-Trans/LGBTQ+ Bill in All but Name](https://juliaserano.medium.com/kosa-a-nationwide-anti-trans-lgbtq-bill-in-all-but-name-d6d9f8b8ec6c?ref=thenexusofprivacy.net), > "\[T\]he language regarding what constitutes “harm” is written in an extremely broad way, applying to anything that might impact “anxiety, depression, eating disorders,1 substance use disorders, and suicidal behaviors” in minors." In [These Bills Will Make Children Less Safe, Not More Safe](https://fair.org/home/these-bills-will-make-children-less-safe-not-more-safe/?ref=thenexusofprivacy.net), Evan Greer discusses how this would suppress *all* discussion of eating disorders among young people: > "\[A\]t scale, a platform like YouTube or Instagram is not going to be able to make a meaningful determination between, for example, a video that’s harmful in promoting eating disorders, or a video **where** a young person is just speaking about their experience with an eating disorder, and how they sought out help and support, and how other young people can do it too." Not only that, the bill gives state Attorneys General enforcement authority if they have "reason to believe that an interest of the residents of that State has been or is threatened or adversely affected" by its content. As Charlie Jane Anders says in [The Internet Is About to Get a Lot Worse](https://buttondown.email/charliejane/archive/the-internet-is-about-to-get-a-lot-worse/?ref=thenexusofprivacy.net), > "In other words, the attorney general of Texas, Florida, Alabama or Tennessee has basically free reign to sue, or threaten a lawsuit, any time they can claim something on the internet is bad for kids. And there's no evidence required — the AGs simply need to have "reason to believe" something is harmful." As Susan Rinkunas discusses in [3 Huge Tech Companies Endorse Bill That Could Wipe Abortion Info From the Internet](https://jezebel.com/3-huge-tech-companies-endorse-bill-that-could-wipe-abor-1851217281?ref=thenexusofprivacy.net), AGs in states that have criminalized abortion can treat any discussion of reproductive health as "harmful." AGs in states like Texas and Florida that are banning discussions of CRT and books about race because they're supposedly "harmful" can apply the same criteria to social network discussions. So like I said, the anti-LGBTQ+ aspects of KOSA are far from the only problem with the bill. ## The anti-LGBTQ+ aspects of KOSA are key to the politics of the situation Still, the anti-LGBTQ+ aspects of KOSA *are* key to the politics. - From Republican perspectives (and for X's owner), it's a big win – enough to get people who supposedly don't like government interference with business, and like to position themselves as defending free speech, on board. - As long as enough Democrats and big tech companies who *claim* to support LGBTQ+ rights are willing to go along with it, KOSA's got a much better chance of passing. On the other hand, if pro-LGBTQ+ Democrats and legislators of both parties who really do want to help kids stick to their guns, then Congress is a lot more likely to do something that actually helps kids. ## Business is business KOSA support from Snap and Microsoft– and Zuckerberg's comment in the hearing says he supported some of the harmful aspects of KOSA like requiring age verification – is a tipoff that despite its framing, KOSA wouldn't do much at all to rein in Big Tech. Of course X's owner is rabidly anti-trans so it's not surprising he'd support an anti-LGBTQ+ bill, but Snap always makes a big deal of supporitng Pride month ([themed bitmoji clothing](https://www.socialmediatoday.com/news/snap-activations-pride-month-themed-bitmoji-clothing/651855/?ref=thenexusofprivacy.net)!) and Microsoft's got a very pro-LGBTQ+ reputation. Microsoft's done a lot to earn that reputation over the years – it was the first Fortune 500 company to provide same-sex domestic partnership benefits, one of the first companies to include sexual orientation in its non-discrimination policy, and in 2022 deservedly got credit for being one of [60 companies urging Texas to abandon its anti-trans efforts](https://www.hrc.org/press-releases/60-major-companies-join-hrc-urge-texas-governor-abbott-elected-leaders-across-the-country-to-abandon-anti-transgender-efforts?ref=thenexusofprivacy.net). But, business is business. As Mike Masnick says about Smith's announcement in [Microsoft Joins In On The ‘Screw Over LGBTQ Kids’ Party By Supporting KOSA](https://www.techdirt.com/2024/01/31/microsoft-joins-in-on-the-screw-over-lgbtq-kids-party-by-supporting-kosa/?ref=thenexusofprivacy.net): > "He knows it’s an easy way to cozy up with Congress and pretend to support their agenda, while the downside risk to Microsoft is minimal. KOSA is going to cause a pain for more consumer-facing social media sites like Instagram and YouTube, but Microsoft-owned sites like LinkedIn and GitHub are most likely to be spared. So, as a totally cynical approach, this saddles some of Microsoft’s largest competitors with a nonsense compliance headache, while letting Microsoft publicly claim it’s “protecting the kids” while getting kudos from Congress." In the past, Microsoft has somtimes decided that its business interests are more important than LGBTQ+ people. They hired their "[$1.6 million man](https://www.seattleweekly.com/news/microsofts-1-6-million-man/?ref=thenexusofprivacy.net)" Ralph Reed of the Christian Coalition to lobby for them [in 1999](https://www.washingtonpost.com/archive/politics/1999/05/07/microsofts-window-of-influence/424f0b28-e86c-42cf-a4c8-cb2db173715d/?ref=thenexusofprivacy.net). In 2005, facing the threat of a boycott, [Microsoft dropped support for a Washington state gay rights bill](https://www.cnet.com/culture/microsoft-under-fire-for-reversal-on-gay-rights-bill/?ref=thenexusofprivacy.net), which proceeded to fail by a single vote. I worked at Microsoft at the time, and still remember the meeting with gay, lesbian, queer, and trans employees where Brad Smith (before he wasPresident) defended that decision. Of course he personally thought LGBTQ+ rights were important, as did the rest of Microsoft's leadership team ... but, business is business. Back in 2005, Microsoft employees didn't buy it. In fact we were so upset that we organized effectively and worked with outside LGBTQ groups on a pressure campaign. Within a few weeks [Microsoft reversed their stance](https://www.washingtonpost.com/archive/business/2005/05/07/microsoft-backtracks-supports-gay-rights-bill/ca393a2b-5c2c-4866-96b1-b6b402d12176/?ref=thenexusofprivacy.net) and announced they'd upport the bill next session, with CEO Steve Ballmer citing the "passionate e-mails" he had gotten from many employees as a big part of the reason. Later that month [Microsoft severed ties with Ralph Reed](https://www.nbcnews.com/id/wbna8008896?ref=thenexusofprivacy.net). The Washington state bill passed next session. Huzzah! History doesn't repeat it self, but sometimes it rhymes. I wonder if whether Smith hasn't realized the similarties to 2005 yet? Maybe he has, and just thinks it'll come out different this time. On the one hand, all the layoffs Microsoft and other companies have been doing are likely to have a chilling effect on employees thinking of organizing on. Then again, employee activism is having a moment in the tech universe, with unions forming and OpenAI employees forcing their board to reverse positions on a business-critical issue. boyd's almost certainly not the only Microsoft employee who's unhappy about KOSA. Who knows, Microsoft might well have some leverage to improve KOSA if they said "uh, look, we are getting some intense stakeholder pressure here and unless we can get some concessions we may have to back out." Or perhaps the rhyming organizing and activism will take place around Snap, or other Big Tech companies who haven't yet taken a position publicly, or all of the above. We shall see! > If people or groups involved in activism pressuring Microsoft, Snap, or other Big Tech companies have links to share – petitions, action items, events, blog posts, etc – please let me know! ## Congress *could* do something if they really want to help kids More positively, though, if Congress decides they actually wanted to help kids there are some *good* bills they could be considering. Senator Wyden and Representatives Eshoo and Fitzpatrick have just reintroduced the[ Invest in Child Safety Act](https://www.wyden.senate.gov/news/press-releases/wyden-eshoo-fitzpatrick-reintroduce-bipartisan-legislation-to-protect-children-from-online-exploitation?ref=thenexusofprivacy.net), which sounds to me like it really *would* help protect children from online explotation. Matthew Lane's [KOSA Won’t Make The Internet Safer For Kids. So What Will?](https://www.techdirt.com/2023/10/05/kosa-wont-make-the-internet-safer-for-kids-so-what-will/?ref=thenexusofprivacy.net) has some other good suggestions, some of which really would rein in Big Tech. And Congress could fix the problems with KOSA. There are reports that the sponsors are working with Senator Cantwell (who along with Sen. Markey talked during the Senate markup about how much feedback she had gotten about the bill's harm to LGBTQ+ people and acknowledge that work needed to be done). I'm somewhat skeptical, tbh: Sen. Blumenthal in the past has been, uh, less than candid when he's claimed that amendments to the bill have "addressed concerns"; and it won't work if Republicans insist on the anti-LGBTQ+ aspects of the bill to stay on board. But then again Republicans may decide that actually heliping kids is better than run on a platform of "we had a chance to help your kids but decided we care more about hurting LGBTQ+ kids and kids with eating disorders" and as Evan Greer said in the quote I started the piece off with, there really are a lot of common-sense reforms that could improve the bill. And activism can make a difference. KOSA still needs to pass the Senate, which isn't a slam-dunk – as I was writing this, Sen. Ron Wyden restated his strong opposition. And then it needs to get through the House, which given how polarized everything is these days may not be easy. The broad alliance of groups and grassroots activists who oppose KOSA has organized very effectively and over the last six months has gotten a lot of good press as well as great [testimonials](https://www.badinternetbills.com/?ref=thenexusofprivacy.net#testimonials) and a much stronger presence on TikTok (whose Singaporean CEO Shou Chew faced some[ incredibly racist questionig from Republican Senator Tom Cotton](https://www.youtube.com/watch?v=c8dctPC3c4A&ref=thenexusofprivacy.net) during the Senate hearing). As [Can the Fediverse Help Stop Bad Internet Bills?](https://wedistribute.org/2023/07/can-the-fediverse-help-stop-bad-internet-bills/?ref=thenexusofprivacy.net) discusses, there are some great opportunies for organizing here. The [Bad Internet Bills Lemmy community](https://lemmy.sdf.org/c/bad%5Finternet%5Fbills?ref=thenexusofprivacy.net) has grown to 184 subscribers, although frequently experiences software problems (in fact it's currently down). There's a lot of energy around KOSA elsewhere in the fediverse as well – and on Bluesky, too. It's not surprising; hile social networks run by big tech companies are just fine with KOSA, independent social networks – especially ones with lots of LGBTQ+ people – are much easier targets. The numbers are still relatively small (a few hundred thousand on Bluesky, a million in the fediverse), but a lot of people there are well-connected. So who knows, with luck that'll be a factor too. Stay tuned! > Take action: [EFF's Action Center](https://act.eff.org/action/call-congress-to-stop-kosa?ref=thenexusofprivacy.net) makes it easy to contact Congress and ask them to oppose KOSA ### Testimony opposing Washington HB 1951, weak algorithmic discrimination legislation URL: https://thenexusofprivacy.net/opposing-hb1951/ Last updated: 2026-04-16T03:16:56.000Z > Washington's short legislative session is in high gear, Unfortunately, despite [HB 1951](https://app.leg.wa.gov/billsummary?BillNumber=1951&Initiative=false&Year=2023&ref=thenexusofprivacy.net)'s good intent of dealing wth algorithmic description, it looks like it was written by tech lobbyists. Here's my written testimony. Chair Walen, Ranking Member Robertson, and members of the committee, I'm Jon Pincus of Bellevue, a technologist and entrepreneur. I served on the Washingtonn state Automated Decision Systems Workgroup in 2021, and write about algorithmic justice as well as other topics on The Nexus of Privacy Newsletter. My position on HB 1951 is CON. While the goal of providing protections against algorithmic discrimination is vital, the bill as drafted does not actually provide meaningful protections to Washingtonians. Other witnesses at the hearing discussed several of the key problems with the bill including the lack of requirements for transparency (aka notice) or opt-out, the narrowness of the definition of "automated decision tool" (Sec. 1(3)), and the lack of a private right of action. Coming at it from the technical perspective, I'd also like to highlight the weakness of the impact assessment requirements in Section 3\. As written, these impact assessments don't even require basic safeguards such as intesting systems for bias or measuring the impact of real-world harms, and fall short of industry best practices. Microsoft's [Responsible AI Impact Assessment Template](https://blogs.microsoft.com/wp-content/uploads/prod/sites/5/2022/06/Microsoft-RAI-Impact-Assessment-Template.pdf?ref=thenexusofprivacy.net), for example, includes identification of stakeholders, restricted and unsupported uses, sensitive uses, and consideration of the impact of potential failures and misuse on stakeholders -- including "identify and document whether the consequences of misuse differ for marginalized groups." None of these requirements appear in HB 1951\. The discussion of ***Proactive equity in design*** in the Algorithmic Discrimination Protections section of the White House Office of Science and Technology Policy (OSTP)'s' [Blueprint for an AI Bill of Rights](https://www.whitehouse.gov/ostp/ai-bill-of-rights/algorithmic-discrimination-protections-2/?ref=thenexusofprivacy.net) similarly highlights other key features that should be required as part of impact assessments. The principles in The Blueprint for an AI Bill of Rights also highlight the importance of several issues witnesses discussed in the hearing directly impact Washingtonians. For example, - The Blueprint states that "[You should know that an automated system is being used and understand how and why it contributes to outcomes that impact you](https://www.whitehouse.gov/ostp/ai-bill-of-rights/?ref=thenexusofprivacy.net#notice)." HB 1951's lack of transparancy requirements means that consumers, workers, and renters in Washington have no way of knowing whether they're being affected by AI-enabled decisions. - The Blueprint' states that "You should be able to opt out, where appropriate, and have access to a person who can quickly consider and remedy problems you encounter." HB 1951's lack of an opt-out requirement means that we can't protect ourselves from being harmed by racist, anti-LGBTQ+, or inaccurate AI systems. And I also want to echo Mr. Scherer's point about the narrowness of HB 1951's defintion of an "automated decision tool" in Sec. 1(3). Limiting the scope only to systems that are "*specificall\** developed and marketed to, or modified to, *make, or be a controlling factor in making*, consequential decisions" makes it easy for developers to be exempt from this definition by marketing the tool for a range of purposes. And it's just as easy for deployers to get around this definition by claiming that a tool's output is only one factor in a decision made by a human. California's recently-issued [draft regulations](https://innovation.consumerreports.org/what-to-know-about-californias-proposed-rules-for-automated-decision-making-tech/?ref=thenexusofprivacy.net) for automated decision technology, by contrast, have a broader definition. [Consumer Reports describes California's broad definition as "smart"](https://innovation.consumerreports.org/what-to-know-about-californias-proposed-rules-for-automated-decision-making-tech/?ref=thenexusofprivacy.net), noting "It’s clear that decision-making tools can be risky even if a human is empowered to intervene. Humans can wind up rubber-stamping machine recommendations. Sometimes, adding human discretion to the process makes decisions more biased." While it might be tempting to just pass *\*something\** in hopes of strengthening it later, I would strongly caution against this approach. In practice, once a low bar is established for algorithmic regulation, it's politically extremely difficult to raise it. New York City's Automated Employment Decision Tool Law is a case study of why a weak law doesn't protect Washingtonian's; as Alfred Fox Cahn says, it's a "fig held up as proof of protection from these systems when in practice, I don’t think a single company is going to be held accountable because this was put into law.” Please don't repeat this same path with algorithmic regulation here in Washington state -- we deserve real protections, not just a fig leaf! Jon Pincus, Bellevue, 98005 ### Instances in the free fediverses should consider "transitive defederation" from instances that federate with Meta URL: https://thenexusofprivacy.net/consider-transitively-defederatiion/ Last updated: 2026-04-16T03:16:29.000Z *Part 7 of* [*Strategies for the free fediverses*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)*. As* [*the first post in the series*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) *discusses, the "free fediverses" are regions of the fediverse that reject Meta and surveillance capitalism, and these strategies position the free fediverses as an alternative to Threads and "Meta's fediverses".* > Join the discussion in the fediverse: > [on Mastodon](https://infosec.exchange/@thenexusofprivacy/111685003431164337?ref=thenexusofprivacy.net) and [on Lemmy](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net)! In [Why block Meta?](https://fedipact.online/why?ref=thenexusofprivacy.net), FediPact creator Vanta Black highlights that one of the main reasons is to "protect the existing communities of marginalized people on the fediverse, many of whom rely on it to survive." With today's software, t*ransitive defederation* – also blocking any instance that federates with an instance hosting harassers and hate groups – provides even stronger protection. Derek Caelin's [Decentralized Networks vs The Trolls](https://link.springer.com/chapter/10.1007/978-3-030-79072-1%5F8?ref=thenexusofprivacy.net), for example, quotes mastodon.technology's admin Ash Furrow describing a transitive defederation of far-right social network Gab as "a necessary step, since through them negative content might seep into the instance he maintains." That said, Meta isn't Gab, so there's a lot less agreement on whether or not to block Meta than there was with Gab – and [transitive defederation is always controversial](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/#transitive-defederation). Two things are true simultaneously: - Plenty of people and instances that are likely to wind up in the free fediverses have important relationships with people and instances in Meta's fediverses that they will want to keep. - Unless and until software evolves significantly – and there's a detailed threat model looking carefully at other potential avenues for indirect harassment – it's likely that many instances in the free fediverses are likely to choose to transitively defederate for safety reasons. And even if the software improves, many instances may still want to transitively defederate because they want to keep their fediverse as far away as possible from white supremacists and hate groups. So even in the free fediverses transitive defederation from Meta's fediverses isn't likely to be an all-or-nothing thing. Tradeoffs are different for different people and instances. Especially if the software improves, some instances in the free fediverses are likely to decide that the federation with well-moderated instances in Meta's fediverse outweigh the risks. Others want to be as far away as possible; transitive defederation is always going to be safer for them. In [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net), Kissane suggests that operating "from a server that federates only with servers that also refuse to federate with Threads" is one way to get "the nearest thing to reasonably sturdy protection for people on fedi who have good reason to worry about the risk surface Threads federation opens up." [1](#notes) At the end of the day, each instance in the free fediverses will make the decision on their own. So the key recommendation here is that **instances should *consider* transitive defederation**: discuss it, and decide what to do. I've got some thoughts below on how to have the disucssion but first I want to emphasize that from a strategy perspective, partial transitive defederation is a very good thing for the free fediverses. ### A few thoughts on strategy Since there's a range of opinions and tradeoffs, the most likely outcome is that we'll see multiple subregions of the free fediverses: - Some will transitively defederate - Others will continue to federate with some instances in Meta's fediverses. To me this is a strength of the fediverse: different people can get more of what they want. Of course, it's also kinda imperfect and messy and complex. For one thing, many people on transitively defederated instances will have accounts on more-connected instances: subregions of the free fediverses that federate with some instances in Meta's fediverse, Meta's fediverses, Threads. Hopefully tools will improve to make it easier to deal with that, and we may well see other ways emerge for people in transitively-defederated instances to communicate with people in Meta's fediverses ... at least in the short term, though, it'll be a hassle. Still, however much transitive defederation there winds up being, I see it as overall as a positive thing. Then again, opinions differ. In [Getting Tangled Up in Threads](https://wedistribute.org/2023/12/tangled-up-threads/?ref=thenexusofprivacy.net), for example, Sean Tilley of *We Distribute* notes that many people see these concerns as "hysteria" that could lead to a massive fragmentation of the Fediverse, "effectively doing Meta’s job for free." It's a good observation, but the people who think that are wrong on both fronts. The concern isn't "hysteria" – and it's anti-LGBTQIA2S+ for cis people to describe it that way. And from a strategy perspective, to whatever extent transitive defederation happens, it's likely to help the free fediverses more than it helps Meta: - It sharpens the distinction between the free fediverses – instances prioritize safety over "openness" and reach – and most other social networks today - It puts the free fediverses on a path for being the best place for LGBTQIA2S+ people and others at risk from hate groups, vigilantes, and stalkers on Meta A lot of the strongest langauge about (and fear of) transitive defederation come from people who a "bigger is better" view of the fediverse and generally dislike the idea of communities setting their own norms. As Kissane observes, many people see an allow-list approach (consent-based federation, which is necessary for transitive defederation) as controversial and less "open." It's a good example of Christina Dunbar-Harris's point in *Hacking Diversity* that the "interpretations and norms of openness on which open source rests" often run counter to the goal of providing more safety. It's true that a lot of people prefer what they see as "openness" to safety, and Meta's fediverses may well be a better option for them than the free fediverses. But there are lots of people who *don't* prefer that, and right now they don't have a lot of other options. ### Have the discussion! Just to reiterate, the recommendation here is to *consider* transitive defederation: discuss it, and decide what to do. And as you're having the discussion, pay a lot of attention to what voices you're hearing – and what voices and perspectives you *aren't* hearing. Cis people, white people, guys, and people who work for or Meta or other big tech companies are likely to have different perspectives than trans, queer, and non-binary people, BIPOC and other people of color, women, and people who have (or have friends or relaties who have) been harmed by Meta or other big tech companies. Of course no commuity is monolithic ... opinions differ! So it's critical to listen to diverse voices and taking those perspectives into account when a discussion needs to be made. It's hard to know just when that will be – a lot depends on how quickly Meta provides federation more broadly and what if any agreements they put in place once two-way federation starts – but in any case, now's a good time to start the discussion. Where to discuss? On the fediverse, of course! For global discussions, the hashtag #TransitiveDefederation is long but a decent starting point. Start up a community on Lemmy and magazine on Kbin, start having video discussions on PeerTube and schedule them as events on Mobilizon, and instances across the fediverse could get involved. And it's also something instances should discuss amongst themselves. Local-only posts are great for this if you're on an instance that runs Glitch, Hometown, Akkoma, Friendica, Misskey ... if your instance uses Mastodon, you're out of luck, now's a good time to ask your instance admin to shift to a fork that *does* support them and try to convince the main Mastodon software team to provide this functionality. A lot of instances also have a non-fediverse discussion and decision/making platform: on Matrix, Discord. Loomio, Github discussions, whatever. Those are better in some ways for some kinds of discussions so if they work well for you instance then by all means keep using them – but they are also potentially exclusionary, so make sure to have a lot of discussion and allow participation in decision-making for people on the fediverse as well. Now's a natural time for federations of instances to emerge and as that happens they will probably want a space where they can discuss among themselves. A federated private group could be a good answer for that but alas this isn't something that exists on most fediverse platforms today. Longer-term, this points for a way for the software to evolve (a new visibility level scoped to a federation of instances is another example) but in the short term options like a new instance that everybody gets another account on (sigh, I know) or a non-fediverse platform that everybody gets another account on will fill the gap. ## Stay tuned for more! The next installment in [Strategies for the free fediverses](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) will discuss the importance of reducing the free fediverses' dependency on Mastodon, and suggest several different paths to accomplishing this. And there's a long way to go after that, so stay tuned! > To see new installments as they're published, follow [@thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) or [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/#/portal/signup). ## Notes 1 [Why just blocking Meta’s Threads won’t be enough to protect your privacy once they join the fediverse](https://thenexusofprivacy.net/just-blocking-threads-isnt-enough/) and the (much longer) [Threat modeling Meta, the fediverse, and privacy (DRAFT)](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/) come to similar conclusions about the value of transitive defederation with current software – and the latter has suggestions about how to improve it. ## Image Credit Originally from Penny graph 11 nodes.svg, by Syp, [via Wikipedia](https://commons.wikimedia.org/wiki/File:Penny%5Fgraph%5F11%5Fnodes.svg?ref=thenexusofprivacy.net), Creative Commons [CC0 1.0 Universal Public Domain Dedication](https://creativecommons.org/publicdomain/zero/1.0/deed.en?ref=thenexusofprivacy.net). ### ### The free fediverses should work together with people and instances in Meta's fediverses and on Bluesky whose goals and values align URL: https://thenexusofprivacy.net/work-together-with-metas-fediverses-and-bluesky/ Last updated: 2026-04-16T03:16:03.000Z *Part 6 of* [*Strategies for the free fediverses*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)*. As* [*the first post in the series*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) *discusses, the "free fediverses" are regions of the fediverse that reject Meta and surveillance capitalism, and these strategies position the free fediverses as an alternative to Threads and "Meta's fediverses".* > Join the discussion in the fediverse: > [on Mastodon](https://infosec.exchange/@thenexusofprivacy/111685003431164337?ref=thenexusofprivacy.net) and [on Lemmy](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net)! > "I don’t think the people who are genuinely psyched about Threads on fedi are monsters or fascists, and I don’t think those kinds of characterizations—which show up a lot in my replies—are helping." > > – Erin Kissane, [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net) Indeed. Many of the Meta advocates I've talked to share the free fediverses' long-term goal of building a sustainable alternative to surveillance capitalism, and virtually all of them support federation with Threads *despite* the hate groups, racists, and fascists Threads hosts, not because of them.[1](#some-bigots-like-meta) They just differ on tradeoffs of federating with Threads and think that the advantages of being able to communicate with people on Threads (including the *targets* of those hate groups, racists, and fascists) outweigh the downsides. So there are likely to be situations where some of the people and instances in Meta's fediverse wind up as situational allies to the free fediverses – and conversely. Alas, one big opportunity has already been missed: if the instance admins and influencers Meta initially approached had shown solidarity with the free fediverses, they could have had a lot of leverage. Oh well. But there are likely to be other opportunities – and not just related to Meta. And the same is true for people on Bluesky. Concerns about their monetization plans and (racist) former Twitter CEO (and current anti-vax supporter) Jack Dorsey's involvement mean there's a lot to be skeptical about. But Bluesky's user base includes a lot of anti-racist, anti-surveillance capitalism, pro-LGBTQIA2S+ people who are there despite their skepticsm, and innovations like Rudy Fraser's BlackSky custom feed could be very useful in the free fediverses as well. So there are a lot of natural allies for the free fediverses – especially since some (although certainly not all) of the loudest voices in Meta's fediverses view Bluesky's (non-ActivityPub compatible) ATProto as a competitor that needs to be stomped out. ### What to work together on? Natural areas to start working together on include several of strategies I discuss here like consensual and concentric federation, making it easier to move between and create instances, and reducing the dependency on Mastodon and ActivityPub. While I've focused on the value of these to the free fediverses, they're all potentially very useful for instances in Meta's fediverses as well. If and when Bluesky gets serious about decentralization there are similarly likely to be parallels and synergies. Here are a few other areas where collaboration could be very useful: - A key principle of organizing is meeting people where they are. There's likely to be wide (although not universal) support in Meta's fediverses and Bluesky. for causes like LGBTQIA2S+ rights and privacy in Meta's fediverses as well as the free fediverses; and Meta's fediverses potentially gave access to the much larger audience on Threads as well.[2](some-access-to-threads) [Activism against bad internet bills that harm LGBTQIA2S+ people](https://wedistribute.org/2023/07/can-the-fediverse-help-stop-bad-internet-bills/?ref=thenexusofprivacy.net) – like KOSA, which Congress is likely to resume work on this year – and [privacy activism in general](https://thenexusofprivacy.net/privacy-activism-mastodon-fediverse/) are good areas for cooperation. And democracy is widely (although again not universally) popular in the fediverses. In the US, the upcoming 2024 election offers a great opportunity for non-partisan voting rights organizing and activism – and there are a lot of other vital elections around the world. - Moderation on decentralized networks is a shared challenge. Practices, policies, and tools that support intersectional moderation; tools like Block Party and Filter Buddy that let users protect themselves individually and collectively; and tools for moderators to share information and collectively respond when attacks are launched (by spammers or harassers) ... these are all valuable to instances no matter what region they're in – and potentially across social networks. Sharing blocklists (of instances and individuals) and recommended allow-lists between the free fediverses and like-minded instances in Meta's fediverses are a straightforward first step. - Bringing concepts similar to Bluesky's custom feeds to the fediverses, and more generally focusing on human-focused and liberatory (as opposed to oppressive) uses of algorithms in decentralized social networks designed from the margins. There are amazing algorithmic justice and social network experts in the fediverses and in Bluesky so lots of potential synergies. - Meta's fediverses, Bluesky, and the free fediverses are all vulnerable to disinformation. As Kissane discusses in [Meta in Myanmar](https://erinkissane.com/meta-in-myanmar-full-seriesw?ref=thenexusofprivacy.net), "adversaries *will* take advantage of decentralized social networks," and the fediverses are very tempting targets, so there's a shared interest in developing techniques to limit and counter disinformation. And Meta makes a lot of money by tolerating and amplifying disinformation, so the free fediverses (more insulated from Threads) are a natural base to organized anti-disinfo campaigns that also encompass Meta's fediverse and Threads – as well as other networks that connect to the fediverse. To be clear, I'm not saying it *always* makes sense to work with people and instances in Meta's fediverses.In some cases, it's likely to turn out that Meta's captured them so effectively that this isn't a useful direction. Attempts to work with the SWICG standards body, may turn out to be a waste of time and energy as long as key members [obsequiously defer to Meta](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#fn-eee). And if instances in Meta's fediverse rely on Meta's racist (and privacy invasive) automated moderation tools to limit disinfo, cooperation on some areas related to be could be harder. Still, there are likely to be other situations where working together does make sense. ## Stay tuned for more! The next installment in [Strategies for the free fediverses](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) will discuss "transitive defederation": defederating instances that federate with Threads as well as threads. Transitive defederation's a controversial topic and I'm not necessarily recommending it – but I am recommending considering it, by which I mean having a discussion and deciding what to do. And there's a long way to go after that, so stay tuned! > To see new installments as they're published, follow [@thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) or [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/#/portal/signup). ## Notes 1 Although some of the hate purveyors on today's fediverse very much do like the idea of federating with Meta -- [one well-known anti-trans bigot was so upset is so upset that Threads has blocked his instance that he implemented block-evasion software](https://wedistribute.org/2023/12/authorized-fetch-circumvented/?ref=thenexusofprivacy.net) \-- and presumably the hate groups there are part of the attraction for them. 2 Of course, Meta has a long track record of hostilitiy to activism, so we'll see how much access Meta actually gives for activists in Meta's fediverse to reach people on Threads. Clay Shirky and I got into a debate about this after his closing keynotes at the 2008 Computers, Freedom, and Privacy conference, and while I was right in the short term – activism on Facebook played an important role in Obama's success in 2008 – his prediction that Facebook would find ways to shut down activism also proved correct. Still, if Meta follows through on their current plans, Meta's fediverses will probably have some access at least for a while if they work with cooperative accounts on Threads. ## Image credit people working together by Isbg Six, licensed under [CC BY-NC 2.0](https://creativecommons.org/licenses/by-nc/2.0/?ref=thenexusofprivacy.net), via [flickr](https://www.flickr.com/photos/isbg6/5029147286?ref=thenexusofprivacy.net) ### The free fediverses should make it easier to move between (and create) instances URL: https://thenexusofprivacy.net/make-it-easier-to-move-to-instances-in-the-free-fediverses/ Last updated: 2026-04-16T03:15:37.000Z *Part 5 of* [*Strategies for the free fediverses*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)*. As* [*the first post in the series*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) *discusses, the "free fediverses" are regions of the fediverse that reject Meta and surveillance capitalism, and these strategies position the free fediverses as an alternative to Threads and "Meta's fediverses".* > Join the discussion in the fediverse: > [on Mastodon](https://infosec.exchange/@thenexusofprivacy/111685003431164337?ref=thenexusofprivacy.net) and [on Lemmy](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net)! There's likely to be a lot of moving between instances as people and instances sort themselves out into the free fediverses and Meta's fediverses. Additional waves are likely as well: if and when Threads turns on federation for hate accounts, whenever Meta-related scandals and abuses get publicity, and perhaps as [concentric federations of instances ](https://thenexusofprivacy.net/the-free-fediverses-should-support-concentric-federations-of-instances/)emerge in the free fediverses. Unfortunately, moving accounts on the fediverse today isn't a particularly good experience today. To start with, unless you already know what instance you want to go it, it's not easy to choose one. [Fedi Garden](https://fedi.garden/?ref=thenexusofprivacy.net), the [Join the Fediverse wiki](https://joinfediverse.wiki/Instances?ref=thenexusofprivacy.net), and other sites have useful curated lists of instances, you can look up wither an instance federates with Meta on [fedipact.veganism.social](https://fedipact.veganism.social/?ref=thenexusofprivacy.net), and instance catalogs like [The Bad Space](https://thenexusofprivacy.net/the-bad-space/) and [Fediseer](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/#fediseer) have information about instances that are blocked or limited ... but even if you know about all those sites, it's a lot of work. (July 2023's [How to choose the right Mastodon instance?](https://thenexusofprivacy.net/choosing-a-mastodon-instance/) has more on this.) And once you've picked a new instance, Erin Kissane describes in [Notes From a Mastodon Migration](https://erinkissane.com/notes-from-a-mastodon-migration?ref=thenexusofprivacy.net), it can be a messy and "hair-raising" process to move your account over. [Mastodon's account migration documentation](https://docs.joinmastodon.org/user/moving/?ref=thenexusofprivacy.net) is very limited; Cutie City's [Migrating Server](https://guide.cutie.city/the-fediverse/migrating-servers/?ref=thenexusofprivacy.net) guide and FediTips' [Transferring your Mastodon account to another server](https://fedi.tips/transferring-your-mastodon-account-to-another-server/?ref=thenexusofprivacy.net) are much more helpful, but relatively few people know about them. To be fair, when it works, "account migration" in the fediverse today is a *lot* better than nothing. On Mastodon, for example, most of your followers will transfer automatically, and you can export and then re-import your follows, bookmarks, mutes and blocks. That's good! Software like Firefish and Catodon also allows post migration, which is even better. But Mastodon doesn't: none of your posts are moved. And no matter what software you're using, followers may disappear, and people who have "approve followers" turned on will need to re-approve your requests. Not only that, it doesn't always work. I've seen moves go very badly, with people losing most or all of their connections. So now's a good time to for the free fediverses to make the experience better.[1](fn-onboarding-in-metas-fediverses) Even without software improvements, good documentation and support for helping people choose instances and get started – or want help tworking through or troubleshooting problems they run into – can help a lot. A well-curated wiki or website with the kinds of links I've included here is a good first step. Onboarding sessions and "office hours" – as videoconferences, conference calls, or as discussions on a hashtag – could be a very helpful complement. So could one or more hashtags, Lemmy communities, and KBin magazines to provide support – or a forum, once forum software like NodeBB integrates with the fediverse. The newcomer experience doesn't have to stop when people set up an account. There's a lot of value in helping people find out about mysterious-but-useful settings, resources like FediTips, and suggestions for who to follow that go beyond the mostly-white mostly-male lists that are the norm in today's fediverse. The onboarding sessions, office hours, hashtags, communities, magazines, and forums from the previous paragraph could handle this as well. Versions of the Mastodon Migration account that have a broader scope (not just Mastodon) and are run by an intersectional teams and/or focus on specific marginalized perspectives[2](#fn-unlike-mm) could also be very useful. And the software can be improved! It would be great if the underlying platforms do a better job at this. Mastodon CTO Renaud Chaput recently [said ](https://oisaur.com/@renchap/111716406159387828?ref=thenexusofprivacy.net)it's on their roadmap, which is encouraging;[3](#fn-no-incentive) that said, it doesn't currently appear in the in-progress, planned, or exploring sections of the [public roadmap](https://joinmastodon.org/roadmap?ref=thenexusofprivacy.net), so we'll see how long it takes. Fortunately, software improvements don't have to be part of the platform. Tokyo Outsider's [Mastodon Content Mover](https://mastodoncontentmover.github.io/?ref=thenexusofprivacy.net), while currently still at an early stage, highlights the progress a single independent enthusiast can make. Longer term, there's a lot more that can be done here – Jonathan Eggers' [Account portability in the social web](https://underlap.org/account-portability-in-the-social-web?ref=thenexusofprivacy.net) is a good overview of some of the potential directions, and Evan Prodromou's [notes for a SWICG portability report](https://htmlpreview.github.io/?https://github.com/w3c/activitypub/blob/gh-pages/data-portability-report.html&ref=thenexusofprivacy.net) are also useful. That said, people who want to move now can't wait for the long-term solution, so this is a good area to make progress on in the short term as well. ### It should be easier to create, customize, and connect instances too! The "networked communities" and "social archipelago" views of the fediverse are best served by having lots of smaller instances, with different norms, cultuers, and vibes. Having lots of smaller instances (including single-person instances) is also a great way to distribute power. Today, hosting providers make it easy for even people without technical skills to get an instance up and going, which is great; and most software platforms have instructions for how to self-host for people how have (or willing to learn) basic UNIX sysadmin skills. That's good! That said, there's a lot of room for improvement. For one thing, the instructions often only cover the mechanics of getting the instance set up and leave out key aspects of actually getting to a usable system. For example: - Mastodon's default setup will accept all federation requests, and doesn't install any blocklists, so new instances are by default left open to harassment from nazis, transphobes, or anybody else. And Mastodon's installation currently doesn't enable authorized fetch, which needs to be turned on to make blocking more effective. - Many Lemmy admins find Fediseer indispensible for helping to manage spam attacks, but good luck finding any mention of Fediseer on the Lemmy install page. - Wordpress' fediverse plugin lets you post, but not reply to other posts – you'll need to install another plugin for that. - Small instances often rely on relays to improve connections to the broader fediverse. Which relays to use? As with moving between instances, there's a lot of progress possible even without software improvements. A curated, easily-findable wiki or site with detailed writeups like [How to Set Up ActivityPub for Self-Hosted WordPress Sites](https://jseggers.com/technology/how-to-set-up-activitypub-for-self-hosted-wordpress-sites/?ref=thenexusofprivacy.net) as well as video tutorials is a good first step. Many people prefer video tutorials, so tMany platforms' developers are already helpful to new admins (especially if you know the right chat rooms to join), but additional upport mechanisms like hashtags, Lemmy communities, office hours could also be useful. That said, straightforward software improvements – changing the defaults, giving people an option of allow-list federation or uploading an initial blocklist – could be quite helpful. And hosting providers today typically only provide limited options as to which platforms can be installed and how to configure it. While this is certainly understandable, it's also another area where progress needs to be made. ## Stay tuned for more! The next installments in [*Strategies for the free fediverses*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)will discuss working with people in Meta's fediverse and other social networks who share the free fediverses' value – and "transitive defederation": defederating instances that federate with Threads as well as threads. Transitive defederation's a controversial topic and I'm not necessarily recommending it – but I *am* recommending considering it, so I expect . And there's a long way to go after that, so stay tuned! ## Notes 1 If Meta's fediverses want to have any chance of competing with Threads longer term, now's also a good time for them to make the experience better, but who knows whether that'll happen. 2 and unlike the current Mastodon Migration account, avoids posts that reinforce Mastodon's reputation as a hostile place for people of color. 3 As I've noted in the past, since Mastodon's software is controlled by Mastodon gGmbH (which also runs by far the largest instance, and one that new arrivals are now signed up for by default) there's been very little incentive to invest in making it easier for people to leave. Hopefully, though, Chaput's statement signals a change in attitude! ## Image Credit Person in Black Leather Boots Lying on Brown Cardboard Boxes by cottonbro studio via [Pexels](https://www.pexels.com/photo/person-in-black-leather-boots-lying-on-brown-cardboard-boxes-4553183/?ref=thenexusofprivacy.net) ### The free fediverses should support concentric federations of instances URL: https://thenexusofprivacy.net/the-free-fediverses-should-support-concentric-federations-of-instances/ Last updated: 2026-04-16T03:15:16.000Z *Part 4 of* [*Strategies for the free fediverses*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)*. As* [*the first post in the series*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) *discusses, the "free fediverses" are regions of the fediverse that reject Meta and surveillance capitalism, and these strategies position the free fediverses as an alternative to Threads and "Meta's fediverses". That said, this and most other strategies in the series are also useful for the fediverse more broadly.* > Join the discussion in the fediverse: > [on Mastodon](https://infosec.exchange/@thenexusofprivacy/111685003431164337?ref=thenexusofprivacy.net) and [on Lemmy](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net)! > "To lighten the load of potentially having to federate with small instances one-by-one, I propose a system called "caracoles": you essentially ask to join concentric federations of instances ... with smaller caracoles able to vote to federate with entire other caracoles." > > – Kat Marchán, [on toot.cat](https://toot.cat/@zkat/110810390507239555?ref=thenexusofprivacy.net) > "The fedifam would be a family or alliance of instances. Communities could align into fedifams based on whatever conditions of identity, philosophy or interest are relevant to them. Instances allied into fedifams could share resources and mutually support each other in many ways" > > – ophiocephalic, on [kolektiva.social](https://kolektiva.social/@ophiocephalic/110793531238090472?ref=thenexusofprivacy.net) Some kind of federation between instances is a natural extension of the Networked Communities and Social Archipelago models. The idea of alliances or groupings has been floating around the fediverse for a long time (I first heard it from toot.cat's original admins at the [Federating with the Trouble presentation](https://toot.cat/@jdp23/981329?ref=thenexusofprivacy.net) at Open Source Bridge in 2017) but unfortunately, [the highest-profile federation of instances to date](https://www.reddit.com/r/Mastodon/comments/zf5529/united%5Ffederation%5Fof%5Finstances/?ref=thenexusofprivacy.net) was largely seen as an attempt by instances that tolerate harassment to trick other instances into supporting them. Oh well. Still, the underlying idea's a good one – and a natural match for community-focused, anti-surveillance capitalism free fediverses. > Terminology note: [coalition, block, alliance, union](https://indieweb.social/@thisismissem@hachyderm.io/111733366288582402?ref=thenexusofprivacy.net), league, and collective are also used to refer to this concept. As both Marchán and ophiocephaic highlight, caracoles or fedifams help deal with the scalability of consent-based federation. For example, ophiocephalic suggests that > "Fedifams could form treaties of trust with each other, easing the introduction of new instances into the broader network. This would become especially important if, as some are suggesting, a complete block of Facebook and its collaborator instances requires a switch from blocklists to allow-lists." An initial implementation of concentric federations could be build on top of today's fediverse platforms that have some support for consent-based federation – including Mastodon. This approach has many other potential benefits as well. ophiocephalic notes that fedifams could also share a common charter of moderation principles, blocklists or allow-lists, resources (such as video and podcast hosting and an opt-in search engine), and hosting infrastructure. Several of these ideas don't even require additional software support at the platform level. Going farther, in [Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/) I note that fedifams and caracoles "could also be potential post visibility boundaries, providing more alternatives to fully public posts." This would require more changes to the underlying software, although Akkoma's "bubble" already has some of these characteristics. > **Update, February 22**: [The Chuckya fork of GlitchSoc (which is in turn a fork of Mastodon) is working on a bubble implementation](https://github.com/TheEssem/mastodon/tree/wip/bubble?ref=thenexusofprivacy.net)! Once you start to think about it, there are a lot of other potential benefits. For example, concentric federations could also be a useful framework for dealing with conflicts between instances, a long-standing challenge for the fediverse. And the "missing replies" problem (where quirks of ActivityPub's federation model means that people frequently don't see an entire conversation) seems like it's much more tractable at the fedifam/caracol level than globally. ## What about federated cross-instance communities? As discussed above, cross-instance communities are a useful complement to instanced-based communities, so it's also worth looking at how cross-instance communities fit into concentric federation. Reddit's multireddits (a combined feed from multiple reddits) are a small step in this direction on a centralized social network, and there have already been requests for similar Lemmy functionality ("supercommunities"). That said, it's still an open question how cross-instance communities fit into concentric federations, so this is more an interesting area to consider than a specific short-term recommendation. ## If I can just get political here for a second ... It's worth highlighting that both Marchán's and ophiocephalic's suggestions have explicitly political overtones. Marchán's highlights that name caracol "comes from the system of federations that make up the Zapatista MAREZ", and ophiocephalic similarly [notes](https://kolektiva.social/@ophiocephalic/110985202010788995?ref=thenexusofprivacy.net) that "critical to the understanding and acceptance of this model is the horizontal distribution of power ... consistent with both the Zapatista and Rojava programs." By contrast, companies like Meta, and surveillance capitalism in general, *centralize* power. So an organization emphazing a more horizontal distribution of power is a good match for the free fediverses' values – and aligns well with the positioning of opposing Meta and surveillance capitalism. ## Stay tuned for more! The next installments in [*Strategies for the free fediverses*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)will discuss moving between instances, working with people in Meta's fediverse and other social networks who share the free fediverses' value – and "transitive defederation": defederating instances that federate with Threads as well as threads. Transitive defederation's a controversial topic and I'm not necessarily recommending it – but I *am* recommending considering it, so I expect . And there's a long way to go after that, so stay tuned! > To see new installments as they're published, follow [@thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) or [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/#/portal/signup). ## ## Image credit Image by Vectorportal.com, [CC BY](https://creativecommons.org/licenses/by/4.0/?ref=thenexusofprivacy.net) ### The free fediverses should emphasize networked communities URL: https://thenexusofprivacy.net/the-free-fediverses-should-emphasize-networked-communities/ Last updated: 2026-04-16T03:14:55.000Z *Part 3 of* [*Strategies for the free fediverses*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)*. As* [*the first post in the series*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) *discusses, the "free fediverses" are regions of the fediverse that reject Meta and surveillance capitalism, and these strategies position the free fediverses as an alternative to Threads and "Meta's fediverses".* > Join the discussion in the fediverse: > [on Mastodon](https://infosec.exchange/@thenexusofprivacy/111685003431164337?ref=thenexusofprivacy.net) and [on Lemmy](https://lemmy.blahaj.zone/c/thenexusofprivacy?ref=thenexusofprivacy.net)! L. Rhodes' [Groundedness and community](https://destructured.net/groundedness-networked-community?ref=thenexusofprivacy.net) and heat-shield.space's [The Two Camps of Mastodon](https://heat-shield.space/mastodon%5Ftwo%5Fcamps.html?ref=privacy.thenexus.today) discuss different views of decentralization on the fediverse. Here's how Rhodes describes the role of instances in the Networked Communities view: > "gathering points for community, valuable not only for their ability to connect members to the fediverse at large, but also for the relations and interactions they facilitate locally." By contrast, Evan Prodromou notes that "Big Fedi" advocates typically see the instance as "[mostly a dumb pipe](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#big-fedi)," as opposed to a community. Rochko's [November 2022 comments](https://www.theverge.com/23658648/mastodon-ceo-twitter-interview-elon-musk-twitter?ref=thenexusofprivacy.net) that the "ideal system" is one where "it doesn’t matter which server you use" make it clear which camp he's in (as so does his opposition to functionality like local-only posts that help make stronger local communities). And it's a perspective that 's likely to be the norm in Meta's fediverses, because of the prevailing "[bigger is better](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#two-views)" worldview. But "bigger is better" is a worldview that inherently favors gigantic surveillance capitalism companies, so it's not the right model for the free fediverses. The Networked Communities view aligns much better with the free fediverses' values – as does the "Social Archipelago" view Leonora Tindall sketches in [The Fediverse is Already Dead](https://nora.codes/post/the-fediverse-is-already-dead/?ref=thenexusofprivacy.net) (originally written February 2023) > "Speak instead about communities, and prioritize the strength of those communities. Speak about the way those communities interact, and don’t; the way they form strands and islands and gulfs." And not only are these views a good match for the free fediverses' values, they're a good strategy. People who want the flat view without local communities have plenty of other options; and at least in the short term the free fediverse's network is almost certain to be smaller than Threads' and Meta's fediverses'. So strategically it makes a lot more sense to differentiate and focus on providing a different kind of value.[1](#fn-challenge-for-metas-fediverses) How to execute on this strategy? Tindall's got several good suggestions, including - Take inspiration from communities like [Merveilles Town](https://merveilles.town/?ref=thenexusofprivacy.net) that define a unique and cohesive local culture. - Accept the Archipelago. Don’t try to connect to every server there is; some of them definitely contain content you and your users don’t want to see, and many of them probably don’t want your users interacting with theirs. Have a set of policies about who you federate with, and stick to them. - If you don’t see a space in the Archipelago that looks good to you, consider making one. There’s some great starting advice at [RunYourOwn.Social](https://runyourown.social/?ref=thenexusofprivacy.net). Other strategies I discuss in this [series](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) – especially consent-based federation and supporting concentric federations of instances – also align well with this strategy. ## Don't forget cross-instance communities! It's unfortunate that instances are currently the *only* community mechanism for Mastodon. Fortunately, other fediverse software has the concept of cross-instance groups (and it's on the Mastodon roadmap as well) which are also a good basis for communities. Lemmy even calls these "communities" (although they currently only have public communities), and an emerging fediverse standard already allow some communications with Mastodon – and almost all Lemmy instances are blocking Threads. Mobilizon and Streams groups go farther, including private discussions Outside the fediverse, subreddits, the broad adoption of Facebook Groups (and before that, MySpace groups), and the ongoing strength of forums highlights the potential. Forum software is starting integrate with the fediverse – Discourse has released an initial plugin, and nodebb recently got a grant from NLNet – so this is an intriguing area to build on going forward. ## Networked communities could be a thing in the ATmosphere too > "Bluesky's vision for the future is at least aiming for a world where communities can own different parts of the stack without needing to be isolated. So for me, the next question is "what would it really take to get there?" For Blacksky, I think it means at least owning a [custom feed](https://bsky.app/profile/did:plc:w4xbfzo7kqfes5zb7r6qv3rw/feed/blacksky?ref=blog.rudyfraser.com), [block/mutelist](https://bsky.app/profile/did:plc:d2mkddsbmnrgr3domzg5qexf/lists/3kaaqcnnxi72w?ref=blog.rudyfraser.com), moderation service, [PDS](https://github.com/blacksky-algorithms/rsky/tree/pds/rsky-pds?ref=blog.rudyfraser.com), and client." > > – Rudy Fraser, [The Moderation article](https://blog.rudyfraser.com/the-moderation-article/?ref=thenexusofprivacy.net) It's not how most people are used to thinking of Bluesiy, and the community mechanisms based on the AT Protocol are still developing, still nascent, but it's really worth highligtint there's definitely potential for similar networked communitie in the ATmosphere. While Bluesky's mission is to focus on *public* conversations, AT Protocol-based systems could also find ways to limit visibility and provoudaries (just as today's fediverse has on top of ActivityPub). AppViews and Relays, along with the other components Fraser lists, could even be used to create concentric federations I'll discuss in the next series. And muliprotocol software like Bridgy Fed and Hubzilla potentially allows communities and federations that spanning today's fediverse and the ATmospehere. ## Stay tuned for more! The next installment in [*Strategies for the free fediverses*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)will discuss the idea of concentric federations of instances, which fit in well with the Networked Communities view and addressing the challenge of scaling consent-based federation. And there's a long way to go after that! > To see new installments as they're published, follow [@thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) or [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/#/portal/signup). ## Image credit Originally from [Internet Map 1024](https://en.wikipedia.org/wiki/File:Internet%5Fmap%5F1024.jpg?ref=thenexusofprivacy.net), via Wikipedia ## Notes 1 Meta's fediverses probably also won't be able to compete with Threads on this. Threads plan to make federation opt-in is the right thing to do from a privacy and safety perspective, but also means that people in Meta's fediverses won't be able to communiate with most of the people on Threads. And Meta has the option of adding communication between Threads and the billions of people on other networks like Instagram (which already shares the same infrastructure), Facebook, and WhatsApp. Longer-term, it seems to me that this is likely to be a huge challenge for Meta's fediverses, but fediverse influencers supporting federating with Meta have various arguments why it doesn't matter. ### The free fediverses should focus on consent (including consent-based federation), privacy, and safety URL: https://thenexusofprivacy.net/free-fediverses-and-consent/ Last updated: 2026-04-16T03:14:29.000Z *Part 2 of* [*Strategies for the free fediverses*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)*. As* [*the first post in the series*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) *discusses, the "free fediverses" are regions of the fediverse that reject Meta and surveillance capitalism, and these strategies position the free fediverses as an alternative to Threads and "Meta's fediverses". That said, this and most other strategies in the series are also useful for the fediverse more broadly.* > "People on the Fediverse chose not to federate with gab or truthsocial. They and their admins chose to exercise their freedom of association to not federate with those networks." > > – Esther Payne, in [Consent and the fediverse](https://onepict.com/consent-fediverse20230627.html?ref=privacy.thenexus.today) As [Anil Dash has pointed out](https://indieweb.social/@anildash@mastodon.cloud/109312337860247781?ref=thenexusofprivacy.net), consent is a key (often-unstated value) in the fediverse. The firestorm over the summer over an early opt-out version of Mastodon's new search functionality is a good example of how passionately people care; it was strong enough that Mastodon's BDFL (Benevolent Dictator for Life) Eugen Rochko reconsidered his original support for the non-consensual implementation, which then evolved to an opt-in consensual approach. Meta, by contrast, has thrived by exploiting data gathered without consent. So this is a great opportunity for the free fediverses to highlight the contrast with Threads. Meta's horrible track record on privacy, and their unwillingness to act against harassment, hate speech, and hate groups, create other great opportunities for the free fediverses. That said, the free fediverses will need to do some work to capitalize on this opportunity. [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/), [there's very little privacy on most of today's fediverse](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/#very-little-privacy), and the commitment to consent is intermittent. As Erin Kissane points out in [Untangling Threads](https://erinkissane.com/untangling-threads?ref=privacy.thenexus.today), many people see a consent-based allow-list approach to federation as less "open" – a good example of Christina Dunbar-Harris's point in *Hacking Diversity* that the "interpretations and norms of openness on which open source rests" often run counter to the goal of providing more safety. When Instagram CEO Adam Mosseri announced Threads' plans to make federation opt-in (consent-based) for individual users, Rochko immediately criticized the decision to provide more privacy and safety to Threads users. How sad is it that (at least in this case) Instagram's CEO appears to understand consent better than the CEO of Mastodon gGmbH? Mastodon is particularly egregious on this front. Its documentation, for example, describes consent-based allow-list federation as "[contrary to Mastodon’s mission](https://docs.joinmastodon.org/admin/config/?ref=thenexusofprivacy.net#limited%5Ffederation%5Fmode)." Mastodon also approves follower requests by default without asking for consent. Hmm. Even if you're not an expert on online privacy and safety, which sounds better to your: "Nazis and terfs can't communicate with me unless I give my permission" or "Nazis and terms can harass me and see my followers-only posts until I realize it's happening and say no"? Unsurprisingly, Mastodon's BDFL Rochko is a strong supporter of federating with Meta, and so are most of the other "bigger is better" folks who don't like the idea of consent. The good news is that many fediverse platforms already support consent-based approaches to federation. PeerTube, for example, has an option for manual approval of federation requests; so does Pixelfed, along with triggers and custom rules which allow for partial automation. Akkoma and GoToSocial all support "allow-list" federation. PixelFed recently added the ability to make federation with Threads opt-in for individual users. [Even Mastodon](https://docs.joinmastodon.org/admin/config/?ref=thenexusofprivacy.net#limited%5Ffederation%5Fmode) (despite its philosophical objections to consent) supports basic allow-list federation.[6](#fn-mastodon-allow-list) awoo.space has been running in allowist mode since 2017, and Brazilian Black users decided to take an allow-list approach when they started bantu.social. > **Update**, October 2024: [The Website League](https://websiteleague.org/?ref=thenexusofprivacy.net) is a confederation of instances taking an allow-list approach, and [a recently-announced new instance for Black folks](https://blackqueer.life/@tillshadeisgone/113312617711895513?ref=thenexusofprivacy.net) is also taking an allow-list approach. It feels like a tipping point! There aren't yet a lot of good tools to make consent-based federation convenient and scalable – although as awoo.space's [Google form to request federation](https://docs.google.com/forms/d/1R8j3NHNV7wof4KrG0s%5Ff0RiCRn6cPz%5F2ROQmvcICFco/viewform?edit%5Frequested=true&ref=thenexusofprivacy.net) illustrates, things don't need to be fancy. Looking forward, interesting ideas to help with scalability and making it easier for new instances to plug into a consent-based network include - instance catalogs like [The Bad Space](https://thenexusofprivacy.net/the-bad-space/) and [Fediseer](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/) - emerging projects like the [FIRES recommendation system](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/). - [FSEP's design for an"approve followers" tool](https://thenexusofprivacy.net/the-bad-space/#fsep), could also easily be adapted for approving federation requests. - [ActivityPub spec co-author Erin Shepherd's suggestion of "letters of introduction"](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web?ref=thenexusofprivacy.net), or something along the lines of the IndieWeb [Vouch](https://indieweb.org/Vouch?ref=thenexusofprivacy.net) protocol, could also work well at the federation level. - Db0's [Can we improve the Fediverse Allow-List Model?](https://dbzer0.com/blog/can-we-improve-the-fediverse-allow-list-model/?ref=thenexusofprivacy.net) and - The "fedifams" and caracoles I discuss in [The free fediverses should support concentric federations of instances](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#concentric-federations) So while things might be a big awkward in the short term, this too shall pass. Adding individual opt-in federation consent to existing software should be fairly straightforward. In fact, most fediverse platforms other than the mainline Mastodon code base already have the concept of local-only posts that don't federate – and the Glitch and Hometown Mastodon forks (variants) have had this functionality since 2017, it's just that [Rochko has blocked this functionality from the main code base](https://thenexusofprivacy.net/mastodon-a-partial-history/#does-mastodon-really-prioritize-stopping-harassment). And there are lots of other ways for the free fediverses to improve privacy and safety, some straightforward, others more complex. Changing the default to require approval for new followers is a one-line code change in Mastodon; adding functionality like [FSEP](https://thenexusofprivacy.net/the-bad-space/#fsep) sketches to provide more information to make a better decision about whether or not to approve is more work. On the privacy side, [threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/) (still a draft) goes into detail and includes a series of [recommendations for developers and fediverse software projects](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/#developers) for instance admins, fediverse developers and software projects, businesses, government agencies, civil society organizations, and funders. [Improving privacy and safety in fediverse software](https://thenexusofprivacy.net/ipsfs-nlnet/) is a concrete suggestion for a social threat modeling approach as the next step. ## Stay tuned for more! The next installments in [*Strategies for the free fediverses*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)will discuss the "networked communities" aspect of the fediverse (one of its current strengths), and the idea of concentric federations of instances (which leverage that strength while also addressing the challenge of scaling consent-based federation). And there's a long way to go after that! > To see new installments as they're published, follow [@thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) or [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/#/portal/signup). ## Notes 6 Although Mastodon's implementation is very hacky, and largely separate from its standard blocklist-based federation implementation. Oh well. So, some refactoring will be needed, but it's not a show-stopper. ## Image credit Consent by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA 3.0](http://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net), via [Picpedia.org](https://www.picpedia.org/highway-signs/c/consent.html?ref=thenexusofprivacy.net) > To see new installments as they're published, follow [@thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) or [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/#/portal/signup). ### Strategies for the free fediverses (2024 DRAFT) URL: https://thenexusofprivacy.net/strategies-for-the-free-fediverses/ Last updated: 2026-04-16T03:13:57.000Z > See the [update log](#update-log) at the bottom for details. I wound up putting the series on hold for most of the year to better understand and incorporate what was happening on Bluesky and in the ATmosphere, and wrapped up the year by adding a handful of sections from an unpublished draft. > "Free Fediverse is a resource for those working to save the fediverse network of online communities from absorption into surveillance capitalism." > > – [freefediverse.org](https://freefediverse.org/index.php/Main%5FPage?ref=thenexusofprivacy.net) > "I argue that the discourses and practices of users working to build a Free Fediverse represent a pivotal moment in Free Open-Source Software (FOSS) and social media history alike. The collision of corporate social media and alternative social media (ASM)—which were once seen in direct opposition to each other—illuminates how digital counterpublics teeter and negotiate the line between enacting open access to community, information, and cultural expression while working to mitigate and strategically close themselves off to the sociopolitical harms that Big Tech enables. It brings into consideration how desires of a free, horizontalist society are renegotiated in an age of privatization, surveillance, and corporate recuperation. Or, when a door becomes open for all, how does it end up closing the door for others?" > > – Jamie A. Theophilos, [Closing the Door to Remain Open: The Politics of Openness and the Practices of Strategic Closure in the Fediverse](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=thenexusofprivacy.net), December 2024, *Social Media + Society*, *10*(4) [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) and Erin Kissane's outstanding [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net) discuss the range of opinions in the ecosystem of decentralized social networks known as "the [fediverse](https://axbom.com/fediverse/?ref=thenexusofprivacy.net)" about whether or not to federate with Threads, a new social network from Meta (aka Facebook). Many people on the tens of thousands of instances (aka servers) that make up today's fediverse want nothing to do with Threads or the hate groups, fascists, terms, and white supremacists it hosts. Others see it as an opportunity to communicate with friends and relatives – or follow politicians, activists, musicians, journalists, and others who are on Threads but not in the fediverse. So today's fediverse is evolving into different regions, including - "free fediverses" that reject Meta – and surveillance capitalism more generally - "Meta's fediverses":[1](#fn-plural) instances that work closely with or rely on Threads, or harvest data on Meta's behalf (for example by sharing data with Meta to use for ad targeting without affirmative informed consent).[2](#fn-harvesting) - "non-aligned fediverses" that don't fall neatly into either of these categories – for example connecting with Threads in some way but trying to keep an arms-length relationship > Terminology note: [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) (written in September 2024) goes into the detail on the terminology I'm now trying to use in general. However, this article was written months before that, and I haven't yet done a pass through to align the terminology, so there may be some inconsistencies! A lot of people are stressed out about this, but as I said back in June in [In chaos there is opportunity!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#chaos), I see this as a good thing. Meta's arrival is already catalyzing some positive, badly-needed changes in the fediverse – changes that are especially helpful to the free fediverses, highlighting their strengths and making it easier to address their weaknesses. The free fediverses have a lot of advantages over Meta and Meta's fediverses, some of which will be very hard to counter, and clearly have [enough critical mass](https://fedipact.veganism.social/?ref=thenexusofprivacy.net) that they'll be just fine. Threads is likely to succeed as well, unless they screw it up royally, and so will Meta's fediverses (at least until Meta decides it's not useful). It wouldn't surprise me if Threads gets to Mark Zuckerberg's goal of a billion users and Mastodon reaches Eugen Rochko's goal of 100,000,000 users. Meta's got some advantages, including world-class engineering, the ability to leverage existing highly-scalable Instagram infrastructure, and virtually infinite resources. Also, Twitter is really horrible. Still, a lot of people want to minimize their exposure to Meta. As long as the free fediverses can deliver a good experience, they'll get a lot of traction as well. The free fediverses and the free ATmosphere (the ecosystem built on Bluesky's AT protocol) have an opportunity provide real alternatives to Meta's Threads, Facebook, and Instagram – as well as other surveillance capitalism social networks filled with propaganda and AI garbage and also owned by white supremacists, fascists and their bootlickers, and anti-trans bigots. To do that, these alternative social networks willl need to leverage their natural advantages and build on the strengths of today's networks – but also address significant weaknesses and limitations with software and governance as well cultural issues including insufficient attention to safety and accessibiity as well as anti-Blackness, misognynoir, anti-trans biases, and Islamophobia. Here's a set of strategies for the free fediverses to move in that direction. - [Opposition to Meta and surveillance capitalism is an appealing position. Highlight it!](#opposition) - [Focus on consent (including consent-based federation), privacy, and safety](#consent) - [Emphasize networked communities](#networked-communities) - [Support concentric federations of instances and communities](#concentric-federations) - [Make it easier to move between (and create) instances](#easier-moving) - [Work together with people and instances in Meta's fediverses and on Bluesky whose goals and values align with the free fediverses](#work-together) - [Consider "transitive defederation" from instances that federate with Meta](#transitive-defederation) - [Reduce the dependency on Mastodon](#mastodon) - [Start moving beyond ActivityPub](#activitypub) - [Prioritize accessibility, which is a huge opportunity](#accessibility) - [Build a sustainable ecosystem](#ecosystem) - [Commit to anti-fascist, anti-racist, anti-colonial, and pro-LGBTQIA2S+ principles, policies, practices, and norms for the free fediverses](#anti-oppressive)[3](#fn-lgbtqia2s) - [Organize!](#organize) It's a long list, so I'll be spreading out over multiple posts (and updating this one as well, so it eventually has the complete discussion). ### Some of these strategies will also work well for instances that *aren't* in the free fediverses – and for the ATmosphere ecosystem as well Of course, the free fediverses aren't the only ones who should be thinking strategically. [Embrace, Extend, and Exploit](https://thenexusofprivacy.net/embrace-extend-and-exploit/), Jason Velazquez' [Copy, Acquire, Kill](https://fromjason.xyz/p/notebook/copy-acquire-kill-how-meta-could-pull-off-the-most-extraordinary-pivot-in-tech-history/?ref=thenexusofprivacy.net), and Darnell Clayton's [Facebook Fears The Fediverse. Here’s How Instagram Will Try To Conquer It (EEE!!!!)](https://darnell.day/facebook-fears-the-fediverse?ref=thenexusofprivacy.net) look at what Meta is up to. At least so far, I haven't seen much about strategy for instances considering joining Meta's fediverses– or for app, infrastructure, and service businesses (including large corporarations like Wordpress, Flipboard, Fastly, Vivaldi, and Mozilla). While they'll all benefit from a likely influx of funding, wave of press attention, and help from Meta, they're all in a challenging position longer-term, especially since Meta is likely to screw them over as soon as it become expedient (just as they always do). So there huge opportunities, significant challenges, big unknowns, and a complex, fast-evolving landscape. A good time to think strategically! So many of these strategies will also work well for "non-aligned" instances (some connection with Threads but trying to keep an arms-lengh relationship) or have an arms-length relationship with Threads and instances in Meta's fediverses – and in the Bluesky ecosystem as well. stances that aren't part of the free fediverses. There are likely to be a lot of hate groups and hate speech on Threads, so instances that prioritize privacy and safety are likely to be a lot more attractive than Threads (or than instances that *don't* prioritize privacy and safety). Accessibility and the ability to move between instances are just as important for people and instances who want to communicate with Threads they are for people who don't. Today's Mastodon-centricity needs to change. Others may not apply directly, but are still worth taking into account. And variations on many these strategies are likely to apply in the ATmosphere, the ecosystem developing around the AT Protoal used by Bluesky. Others highlight strengths (it's easier to move between instances, custom feeds and labelers add important functionality, and they also aren't Meta), weaknesses (safety), and potential opportunities (could networked communities work on AT Proto?). Of course there are also a lot of different dynamics, but there's a huge opportunity so once again now's a good time to think strategically. But this series is more than long enough as it is, so I'll be focusing primarily on the free fediverse's perspectives. ![The Meta logo, with a red circle and slash on top. Say no to Meta!](https://thenexusofprivacy.net/content/images/2024/01/Meta-Logo-with-circile-2.png) ## Opposition to Meta and surveillance capitalism is an appealing position. Highlight it! The free fediverses' most important natural advantage over Meta is that they are not Meta. Nobody trusts Meta, and for good reason. Many feel even more strongly, thanks to Facebook and Instagram's history of helping genocides, coddling hate groups, making money by targeting teen girls with harmful content, manipulating people's emotions, data harvesting, and breaking the law. And it's not just Meta that people don't trust; after Twitter's transformation into a hellscape and machine for fascism, Reddit's attack on their moderators and third-party developers, Google's deterioration, Amazon's abuse of its workers, etc etc etc, people are looking for alternatives to surveillance capitalism in general. So the free fediverses' positioning of "fuck Meta, and fuck surveillance capitalism" is likely to resonate with a lot of people. Of course, even though nobody trusts Meta, most of us still want to communicate with some people on Threads. Meta's fediverses' positioning of "we don't trust them and they're evil but working with them a little is the only way to communicate with people there and we'll do our best to limit the risks" is also likely to be attractive to many people.[4](#fn-complementary) Having yet another account is a hassle (although with luck apps may emerge to make it less of a hassle over time), so some may stick with Meta's fediverses, or with Threads. And many people who make their home in the free fediverses (including me!) are likely to have other accounts for now – on Threads, or in Meta's fediverses – just as many do today on Facebook, Instagram, Xitter, TikTok, LinkedIn, and other surveillance capitalism social networks. That's okay! [As Framasoft says](https://framablog.org/2023/12/12/mobile-app-redesign-new-dev-promotion-lets-build-a-bright-future-for-peertube/?ref=thenexusofprivacy.net) about PeerTube's relationship to YouTube and Twitch, the free fediverses are an *alternative* to surveillance capitalism. A lot of people want as much as possible of their online life to be in an environment that minimizes their exposure to hate groups, racism, and transphobia – or don't want *any* of their data federated to Meta. That's the free fediverses' core audience. ![A highway sign, in the shape of an arrow, with the word Consent.](https://thenexusofprivacy.net/content/images/2024/01/consent-1.jpg) ## Focus on consent (including consent-based federation), privacy, and safety > "People on the Fediverse chose not to federate with gab or truthsocial. They and their admins chose to exercise their freedom of association to not federate with those networks." > > – Esther Payne, in [Consent and the fediverse](https://onepict.com/consent-fediverse20230627.html?ref=privacy.thenexus.today) As Anil Dash has pointed out, consent is a key (often-unstated value) in the fediverse. The firestorm over the summer over an early opt-out version of Mastodon's new search functionality is a good example of how passionately people care; it was strong enough that Mastodon's BDFL (Benevolent Dictator for Life) Eugen Rochko reconsidered his original support for the non-consensual implementation, which then evolved to an opt-in consensual approach. Meta, by contrast, has thrived by exploiting data gathered without consent. So this is a great opportunity for the free fediverses to highlight the contrast with Threads. Meta's horrible track record on privacy, and their unwillingness to act against harassment, hate speech, and hate groups, create other great opportunities for the free fediverses. That said, the free fediverses will need to do some work to capitalize on this opportunity. [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/), [there's very little privacy on most of today's fediverse](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/#very-little-privacy), and the commitment to consent is intermittent. Mastodon's documentation, for example, describes consent-based allow-list federation as "[contrary to Mastodon’s mission](https://docs.joinmastodon.org/admin/config/?ref=thenexusofprivacy.net#limited%5Ffederation%5Fmode)."[5](#fn-open) Mastodon also approves follower requests by default without asking for consent. Hmm. Even if you're not an expert on online privacy and safety, which sounds better to your: "Nazis and terfs can't communicate with me unless I give my permission" or "Nazis and terfs can harass me and see my followers-only posts until I realize it's happening and say no"? The good news is that many fediverse platforms support consent-based approaches to federation. PeerTube, for example, has an option for manual approval of federation requests. Akkoma and GoToSocial all support "allow-list" federation. PixelFed recently added the ability to make federation with Threads opt-in for individual users. [Even Mastodon](https://docs.joinmastodon.org/admin/config/?ref=thenexusofprivacy.net#limited%5Ffederation%5Fmode) (despite its philosophical objections to consent) supports basic allow-list federation.[6](#fn-mastodon-allow-list) awoo.space has been running in allowist mode since 2017, and Brazilian Black users decided to take an allow-list approach when they started bantu.social. > **Update**, October 2024: [The Website League](https://websiteleague.org/?ref=thenexusofprivacy.net) is a confederation of instances taking an allow-list approach, and [a recently-announced new instance for Black folks](https://blackqueer.life/@tillshadeisgone/113312617711895513?ref=thenexusofprivacy.net) is also taking an allow-list approach. It feels like a tipping point! There aren't yet a lot of good tools to make consent-based federation convenient and scalable – although as awoo.space's [Google form to request federation](https://docs.google.com/forms/d/1R8j3NHNV7wof4KrG0s%5Ff0RiCRn6cPz%5F2ROQmvcICFco/viewform?edit%5Frequested=true&ref=thenexusofprivacy.net) illustrates, things don't need to be fancy. Looking forward, instance catalogs like [The Bad Space](https://thenexusofprivacy.net/the-bad-space/) and [Fediseer](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/), and emerging projects like the [FIRES recommendation system](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/). [FSEP's design for an"approve followers" tool](https://thenexusofprivacy.net/the-bad-space/#fsep), could also easily be adapted for approving federation requests. [ActivityPub spec co-author Erin Shepherd's suggestion of "letters of introduction"](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web?ref=thenexusofprivacy.net), or something along the lines of the IndieWeb [Vouch](https://indieweb.org/Vouch?ref=thenexusofprivacy.net) protocol, could also work well at the federation level. Db0's [Can we improve the Fediverse Allow-List Model?](https://dbzer0.com/blog/can-we-improve-the-fediverse-allow-list-model/?ref=thenexusofprivacy.net) and the the "fedifams" and caracoles I discuss in [The free fediverses should support concentric federations of instances](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#concentric-federations) could help with scalability and making it easier for new instances to plug into a consent-based network. Adding individual opt-in federation consent to existing software should be fairly straightforward. In fact, most fediverse platforms other than the mainline Mastodon code base already have the concept of local-only posts that don't federate – and the Glitch and Hometown Mastodon forks (variants) have had this functionality since 2017, it's just that [Rochko has blocked this functionality from the main code base](https://thenexusofprivacy.net/mastodon-a-partial-history/#does-mastodon-really-prioritize-stopping-harassment). And there are lots of other ways for the free fediverses to improve privacy and safety, some straightforward, others more complex. Changing the default to require approval for new followers is a one-line code change in Mastodon; adding functionality like [FSEP](https://thenexusofprivacy.net/the-bad-space/#fsep) sketches to provide more information to make a better decision about whether or not to approve is more work. On the privacy side, [threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/) (still a draft) goes into detail and includes a series of [recommendations for developers and fediverse software projects](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/#developers) for instance admins, fediverse developers and software projects, businesses, government agencies, civil society organizations, and funders. [Improving privacy and safety in fediverse software](https://thenexusofprivacy.net/ipsfs-nlnet/) is a concrete suggestion for a social threat modeling approach as the next step. ![A network diagram showing nodes connected by lines in multiple colors ](https://thenexusofprivacy.net/content/images/2024/01/Internet_map_1024-1.jpg) ## Emphasize networked communities L. Rhodes' [Groundedness and community](https://destructured.net/groundedness-networked-community?ref=thenexusofprivacy.net) and heat-shield.space's [The Two Camps of Mastodon](https://heat-shield.space/mastodon%5Ftwo%5Fcamps.html?ref=privacy.thenexus.today) discuss different views of decentralization on the fediverse. Here's how Rhodes describes the role of instances in the Networked Communities view: > "gathering points for community, valuable not only for their ability to connect members to the fediverse at large, but also for the relations and interactions they facilitate locally." By contrast, Evan Prodromou notes that "Big Fedi" advocates typically see the instance as "[mostly a dumb pipe](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#big-fedi)," as opposed to a community. Rochko's [November 2022 comments](https://www.theverge.com/23658648/mastodon-ceo-twitter-interview-elon-musk-twitter?ref=thenexusofprivacy.net) that the "ideal system" is one where "it doesn’t matter which server you use" make it clear which camp he's in (as so does his opposition to functionality like local-only posts that help make stronger local communities). And it's a perspective that 's likely to be the norm in Meta's fediverses, because of the prevailing "[bigger is better](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#two-views)" worldview. But "bigger is better" is a worldview that inherently favors gigantic surveillance capitalism companies, so it's not the right model for the free fediverses. The Networked Communities view aligns much better with the free fediverses' values – as does the "Social Archipelago" view Leonora Tindall sketches in [The Fediverse is Already Dead](https://nora.codes/post/the-fediverse-is-already-dead/?ref=thenexusofprivacy.net) (originally written February 2023) > "Speak instead about communities, and prioritize the strength of those communities. Speak about the way those communities interact, and don’t; the way they form strands and islands and gulfs." And not only are these views a good match for the free fediverses' values, they're a good strategy. People who want the flat view without local communities have plenty of other options; and at least in the short term the free fediverse's network is almost certain to be smaller than Threads' and Meta's fediverses'. So strategically it makes a lot more sense to differentiate and focus on providing a different kind of value.[7](#fn-challenge-for-metas-fediverses) How to execute on this strategy? Tindall's got several good suggestions, including - Take inspiration from communities like [Merveilles Town](https://merveilles.town/?ref=thenexusofprivacy.net) that define a unique and cohesive local culture. - Accept the Archipelago. Don’t try to connect to every server there is; some of them definitely contain content you and your users don’t want to see, and many of them probably don’t want your users interacting with theirs. Have a set of policies about who you federate with, and stick to them. - If you don’t see a space in the Archipelago that looks good to you, consider making one. There’s some great starting advice at [RunYourOwn.Social](https://runyourown.social/?ref=thenexusofprivacy.net). Other strategies I discuss – especially consent-based federation and supporting concentric federations of instances – also align well with this strategy. ### Don't forget cross-instance communities! It's unfortunate that instances are currently the *only* community mechanism for Mastodon. Fortunately, other fediverse software has the concept of cross-instance groups (and it's on the Mastodon roadmap as well) which are also a good basis for communities. Lemmy even calls these "communities" (although they currently only have public communities), and an emerging fediverse standard already allow some communications with Mastodon – and almost all Lemmy instances are blocking Threads. Mobilizon and Streams groups go farther, including private discussions Outside the fediverse, subreddits, the broad adoption of Facebook Groups (and before that, MySpace groups), and the ongoing strength of forums highlights the potential. Forum software is starting integrate with the fediverse – Discourse has released an initial plugin, and nodebb recently got a grant from NLNet – so this is an intriguing area to build on going forward. ### Networked communities could be a thing in the ATmosphere too > "Bluesky's vision for the future is at least aiming for a world where communities can own different parts of the stack without needing to be isolated. So for me, the next question is "what would it really take to get there?" For Blacksky, I think it means at least owning a [custom feed](https://bsky.app/profile/did:plc:w4xbfzo7kqfes5zb7r6qv3rw/feed/blacksky?ref=blog.rudyfraser.com), [block/mutelist](https://bsky.app/profile/did:plc:d2mkddsbmnrgr3domzg5qexf/lists/3kaaqcnnxi72w?ref=blog.rudyfraser.com), moderation service, [PDS](https://github.com/blacksky-algorithms/rsky/tree/pds/rsky-pds?ref=blog.rudyfraser.com), and client." > > – Rudy Fraser, [The Moderation article](https://blog.rudyfraser.com/the-moderation-article/?ref=thenexusofprivacy.net), January 2024 > "Fraser envisions Blacksky’s open-source technology, as enabling other marginalized communities to build safe spaces online. Already, he’s hosting other communities on Blacksky’s infrastructure while letting them maintain their distinct identities. > > “Every time the culture moves to a new app, there’s a Black Twitter, there’s Black TikTok, a Black People Reddit section,” Fraser notes. “What if you keep your community and the interface changes?”" > > Tarik Moody, [Could Blacksky emerge as Black Twitter’s spiritual successor on Bluesky?](https://hyfin.org/2024/11/29/could-blacksky-emerge-as-black-twitters-spiritual-successor-on-bluesky/?ref=privacy.thenexus.today), November 2024 It's not how most people are used to thinking of Bluesky, and the community mechanisms based on the AT Protocol are still nascent, but it's really worth highlighting that there's definitely potential for similar networked communities in the ATmosphere. While Bluesky's mission is to focus on *public* conversations, AT Protocol-based systems could also find ways to limit visibility and provoudaries (just as today's fediverse has on top of ActivityPub). AppViews and Relays, along with the other components Fraser lists, could even be used to create concentric federations I'll discuss in the next series. And muliprotocol software like Bridgy Fed and Hubzilla potentially allows communities and federations that spanning today's fediverse and the ATmospehere. ![Concentric circles, each made up of multiple circles, in multiple bright colors](https://thenexusofprivacy.net/content/images/2024/01/concentric-circles-1.png) ## Support concentric federations of instances > "To lighten the load of potentially having to federate with small instances one-by-one, I propose a system called "caracoles": you essentially ask to join concentric federations of instances ... with smaller caracoles able to vote to federate with entire other caracoles." > > – Kat Marchán, [on toot.cat](https://toot.cat/@zkat/110810390507239555?ref=thenexusofprivacy.net) > "The fedifam would be a family or alliance of instances. Communities could align into fedifams based on whatever conditions of identity, philosophy or interest are relevant to them. Instances allied into fedifams could share resources and mutually support each other in many ways" > > – ophiocephalic, on [kolektiva.social](https://kolektiva.social/@ophiocephalic/110793531238090472?ref=thenexusofprivacy.net) Some kind of federation between instances is a natural extension of the Networked Communities and Social Archipelago models. The idea of alliances or groupings has been floating around the fediverse for a long time (I first heard it from toot.cat's original admins at the [Federating with the Trouble presentation](https://toot.cat/@jdp23/981329?ref=thenexusofprivacy.net) at Open Source Bridge in 2017) but unfortunately, the highest-profile federation of instances to date was largely seen as an attempt by instances that tolerate harassment to trick other instances into supporting them. Oh well. Still, the underlying idea's a good one – and a natural match for a community-focused, anti-surveillance capitalism free fediverses. As both Marchán and ophiocephaic highlight, caracoles or fedifams help deal with the scalability of consent-based federation. For example, ophiocephalic suggests that > "Fedifams could form treaties of trust with each other, easing the introduction of new instances into the broader network. This would become especially important if, as some are suggesting, a complete block of Facebook and its collaborator instances requires a switch from blocklists to allow-lists." An initial implementation of concentric federations could be build on top of today's fediverse platforms that have some support for consent-based federation – including Mastodon. This approach has many other potential benefits as well. ophiocephalic notes that fedifams could also share a common charter of moderation principles, blocklists or allow-lists, resources (such as video and podcast hosting and an opt-in search engine), and hosting infrastructure. Several of these ideas don't even require additional software support at the platform level. Going farther, in [Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/) I note that fedifams and caracoles "could also be potential post visibility boundaries, providing more alternatives to fully public posts." This would require more changes to the underlying software, although Akkoma's "bubble" already has some of these characteristics. Once you start to think about it, there are a lot of other potential benefits. For example, concentric federations could also be a useful framework for dealing with conflicts between instances, a long-standing challenge for the fediverse. And the "missing replies" problem (where quirks of ActivityPub's federation model means that people frequently don't see an entire conversation) seems like it's much more tractable at the fedifam/caracol level than globally. ### What about federated cross-instance communities? As discussed above, cross-instance communities are a useful complement to instanced-based communities, so it's also worth looking at how cross-instance communities fit into concentric federation. Reddit's multireddits (a combined feed from multiple reddits) are a small step in this direction on a centralized social network, and there have already been requests for similar Lemmy functionality ("supercommunities"). That said, it's still an open question how cross-instance communities fit into concentric federations, so this is more an interesting area to consider than a specific short-term recommendation. ### If I can just get political here for a second ... It's worth highlighting that both Marchán's and ophiocephalic's suggestions have explicitly political overtones. Marchán's highlights that name caracol "comes from the system of federations that make up the Zapatista MAREZ", and ophiocephalic similarly [notes](https://kolektiva.social/@ophiocephalic/110985202010788995?ref=thenexusofprivacy.net) that "critical to the understanding and acceptance of this model is the horizontal distribution of power ... consistent with both the Zapatista and Rojava programs." By contrast, companies like Meta, and surveillance capitalism in general, *centralize* power. So an organization emphasizing a more horizontal distribution of power is a good match for the free fediverses' values – and aligns well with the positioning of opposing Meta and surveillance capitalism. ![Brown cardboard moving boxes on the floor, with a person beneath them whose legs and are sticking out](https://thenexusofprivacy.net/content/images/2024/01/boxes-on-floor.jpeg) ## Make it easier to move between (and create) instances There's likely to be a lot of moving between instances as people and instances sort themselves out into the free fediverses and Meta's fediverses. Additional waves are likely as well: if and when Threads turns on federation for hate accounts, whenever Meta-related scandals and abuses get publicity, and perhaps as [concentric federations of instances ](https://thenexusofprivacy.net/the-free-fediverses-should-support-concentric-federations-of-instances/)emerge in the free fediverses. Unfortunately, moving accounts on the fediverse today isn't a particularly good experience. To start with, unless you already know what instance you want to go it, it's not easy to choose one. [Fedi Garden](https://fedi.garden/?ref=thenexusofprivacy.net), the [Join the Fediverse wiki](https://joinfediverse.wiki/Instances?ref=thenexusofprivacy.net), and other sites have useful curated lists of instances, you can look up wither an instance federates with Meta on [fedipact.veganism.social](https://fedipact.veganism.social/?ref=thenexusofprivacy.net), and instance catalogs like [The Bad Space](https://thenexusofprivacy.net/the-bad-space/) and [Fediseer](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/#fediseer) have information about instances that are blocked or limited ... but even if you know about all those sites, it's a lot of work. Erin Kissane's [How to buy shoes in the fediverse](https://www.wrecka.ge/fediverse-shoes/?ref=thenexusofprivacy.net) and [Revealing the fediverse’s gifts](https://www.wrecka.ge/revealing-the-gifts/?ref=thenexusofprivacy.net), both from October 2024, discuss the challenges in general; July 2023's [How to choose the right Mastodon instance?](https://thenexusofprivacy.net/choosing-a-mastodon-instance/) has more on this; December 2024's [Resources for choosing the right fediverse instance (REVISED DRAFT)](https://thenexusofprivacy.net/resources-for-choosing-instances/) is an update in progress. And once you've picked a new instance, as Erin Kissane describes in [Notes From a Mastodon Migration](https://erinkissane.com/notes-from-a-mastodon-migration?ref=thenexusofprivacy.net), it can be a messy and "hair-raising" process to move your account over. [Mastodon's account migration documentation](https://docs.joinmastodon.org/user/moving/?ref=thenexusofprivacy.net) is very limited; Cutie City's [Migrating Server](https://guide.cutie.city/the-fediverse/migrating-servers/?ref=thenexusofprivacy.net) guide and FediTips' [Transferring your Mastodon account to another server](https://fedi.tips/transferring-your-mastodon-account-to-another-server/?ref=thenexusofprivacy.net) are much more helpful, but relatively few people know about them. To be fair, when it works, "account migration" in the fediverse today is a *lot* better than nothing. On Mastodon, for example, most of your followers will transfer automatically, and you can export and then re-import your follows, bookmarks, mutes and blocks. That's good! Software like Firefish and Catodon also allows post migration, which is even better. But Mastodon doesn't: none of your posts are moved. And no matter what software you're using, followers may disappear, and people who have "approve followers" turned on will need to re-approve your requests. Not only that, it doesn't always work. I've seen moves go very badly, with people losing most or all of their connections. So now's a good time to for the free fediverses to make the experience better.[9](fn-onboarding-in-metas-fediverses) Even without software improvements, good documentation and support for people who run into problems can help a lot. A well-curated wiki or website with the kinds of links I've included here is a good first step. Onboarding sessions and "office hours" – as videoconferences, conference calls, or as discussions on a hashtag – could be a very helpful complement. So could one or more hashtags, Lemmy communities, and KBin magazines to provide support – or a forum, once forum software like NodeBB integrates with the fediverse. The newcomer experience doesn't have to stop when people set up an account. There's a lot of value in helping people find out about mysterious-but-useful settings, resources like FediTips, and suggestions for who to follow that go beyond the mostly-white mostly-male lists that are the norm in today's fediverse. The onboarding sessions, office hours, hashtags, communities, magazines, and forums from the previous paragraph could handle this as well. Versions of the Mastodon Migration account that have a broader scope (not just Mastodon) and are run by an intersectional teams and/or focus on specific marginalized perspectives[10](#fn-unlike-mm) could also be very useful. And the software can be improved! It would be great if the underlying platforms do a better job at this. Mastodon CTO Renaud Chaput recently [said ](https://oisaur.com/@renchap/111716406159387828?ref=thenexusofprivacy.net)it's on their roadmap, which is encouraging;[3](#fn-no-incentive) that said, it doesn't currently appear in the in-progress, planned, or exploring sections of the [public roadmap](https://joinmastodon.org/roadmap?ref=thenexusofprivacy.net), so we'll see how long it takes. Fortunately, software improvements don't have to be part of the platform. Tokyo Outsider's [Mastodon Content Mover](https://mastodoncontentmover.github.io/?ref=thenexusofprivacy.net), while currently still at an early stage, highlights the progress a single independent enthusiast can make. Longer term, there's a lot more that can be done here – [Account portability in the social web](https://underlap.org/account-portability-in-the-social-web?ref=thenexusofprivacy.net) is a good overview of some of the potential directions, and Evan Prodromou's [notes for a SWICG portability report](https://htmlpreview.github.io/?https://github.com/w3c/activitypub/blob/gh-pages/data-portability-report.html&ref=thenexusofprivacy.net) are also useful. That said, people who want to move now can't wait for the long-term solution, so this is a good area to make progress on in the short term as well. ### It should be easier to create, customize, and connect instances too! The "networked communities" and "social archipelago" views of the fediverse are best served by having lots of smaller instances, with different norms, cultuers, and vibes. Having lots of smaller instances (including single-person instances) is also a great way to distribute power. Today, hosting providers make it easy for even people without technical skills to get an instance up and going, which is great; and most software platforms have instructions for how to self-host for people how have (or willing to learn) basic UNIX sysadmin skills. That's good! That said, there's a lot of room for improvement. For one thing, the instructions often only cover the mechanics of getting the instance set up and leave out key aspects of actually getting to a usable system. For example: - Mastodon's default setup will accept all federation requests, and doesn't install any blocklists, so new instances are by default left open to harassment from nazis, transphobes, or anybody else. And Mastodon's installation currently doesn't enable authorized fetch, which needs to be turned on to make blocking more effective. - Many Lemmy admins find Fediseer indispensible for helping to manage spam attacks, but good luck finding any mention of Fediseer on the Lemmy install page. - Wordpress' fediverse plugin lets you post, but not reply to other posts – you'll need to install another plugin for that. - Small instances often rely on relays to improve connections to the broader fediverse. Which relays to use? As with moving between instances, there's a lot of progress possible even without software improvements. A curated, easily-findable wiki or site with detailed writeups like [How to Set Up ActivityPub for Self-Hosted WordPress Sites](https://jseggers.com/technology/how-to-set-up-activitypub-for-self-hosted-wordpress-sites/?ref=thenexusofprivacy.net) as well as video tutorials is a good first step. Many people prefer video tutorials, so tMany platforms' developers are already helpful to new admins (especially if you know the right chat rooms to join), but additional upport mechanisms like hashtags, Lemmy communities, office hours could also be useful. That said, straightforward software improvements – changing the defaults, giving people an option of allow-list federation or uploading an initial blocklist – could be quite helpful. And hosting providers today typically only provide limited options as to which platforms can be installed and how to configure it. While this is certainly understandable, it's also another area where progress needs to be made. ![Stylized human figures in multiple colors in a circle holding hands and looking up at the sky](https://thenexusofprivacy.net/content/images/2024/01/working-together-1.jpg) ## Work together with people and instances in Meta's fediverses and on Bluesky whose goals and values align with the free fediverses Indeed. Many of the Meta advocates I've talked to share the free fediverses' long-term goal of building a sustainable alternative to surveillance capitalism, and virtually all of them support federation with Threads *despite* the hate groups, racists, and fascists Threads hosts, not because of them.[12](#some-bigots-like-meta) They just differ on tradeoffs of federating with Threads and think that the advantages of being able to communicate with people on Threads (including the *targets* of those hate groups, racists, and fascists) outweigh the downsides. So there are likely to be situations where some of the people and instances in Meta's fediverse wind up as situational allies to the free fediverses – and conversely. Alas, one big opportunity has already been missed: if the instance admins and influencers Meta initially approached had shown solidarity with the free fediverses, they could have had a lot of leverage. Oh well. But there are likely to be other opportunities – and not just related to Meta. And the same is true for people on Bluesky. Concerns about their monetization plans and (racist) former Twitter CEO (and current anti-vax supporter) Jack Dorsey's involvement mean there's a lot to be skeptical about. But Bluesky's user base includes a lot of anti-racist, anti-surveillance capitalism, pro-LGBTQIA2S+ people who are there despite their skepticsm, and innovations like Rudy Fraser's BlackSky custom feed could be very useful in the free fediverses as well. So there are a lot of natural allies for the free fediverses – especially since some (although certainly not all) of the loudest voices in Meta's fediverses view Bluesky's (non-ActivityPub compatible) ATProto as a competitor that needs to be stomped out. ### What to work together on? Natural areas to start working together on include several of strategies I discuss here like consensual and concentric federation, making it easier to move between and create instances, and reducing the dependency on Mastodon and ActivityPub. While I've focused on the value of these to the free fediverses, they're all potentially very useful for instances in Meta's fediverses as well. If and when Bluesky gets serious about decentralization there are similarly likely to be parallels and synergies. Here are a few other areas where collaboration could be very useful: - A key principle of organizing is meeting people where they are. There's likely to be wide (although not universal) support in Meta's fediverses and Bluesky. for causes like LGBTQIA2S+ rights and privacy in Meta's fediverses as well as the free fediverses; and Meta's fediverses potentially gave access to the much larger audience on Threads as well.[13](#some-access-to-threads) [Activism against bad internet bills that harm LGBTQIA2S+ people](https://wedistribute.org/2023/07/can-the-fediverse-help-stop-bad-internet-bills/?ref=thenexusofprivacy.net) – like KOSA, which Congress is likely to resume work on this year – and [privacy activism in general](https://thenexusofprivacy.net/privacy-activism-mastodon-fediverse/) are good areas for cooperation. And democracy is widely (although again not universally) popular in the fediverses. In the US, the upcoming 2024 election offers a great opportunity for non-partisan voting rights organizing and activism – and there are a lot of other vital elections around the world. - Moderation on decentralized networks is a shared challenge. Practices, policies, and tools that support intersectional moderation; tools like Block Party and Filter Buddy that let users protect themselves individually and collectively; and tools for moderators to share information and collectively respond when attacks are launched (by spammers or harassers) ... these are all valuable to instances no matter what region they're in – and potentially across social networks. Sharing blocklists (of instances and individuals) and recommended allow-lists between the free fediverses and like-minded instances in Meta's fediverses are a straightforward first step. - Bringing concepts similar to Bluesky's custom feeds to the fediverses, and more generally focusing on human-focused and liberatory (as opposed to oppressive) uses of algorithms in decentralized social networks designed from the margins. There are amazing algorithmic justice and social network experts in the fediverses and in Bluesky so lots of potential synergies. - Meta's fediverses, Bluesky, and the free fediverses are all vulnerable to disinformation. As Kissane discusses in [Meta in Myanmar](https://erinkissane.com/meta-in-myanmar-full-seriesw?ref=thenexusofprivacy.net), "adversaries *will* take advantage of decentralized social networks," and the fediverses are very tempting targets, so there's a shared interest in developing techniques to limit and counter disinformation. And Meta makes a lot of money by tolerating and amplifying disinformation, so the free fediverses (more insulated from Threads) are a natural base to organized anti-disinfo campaigns that also encompass Meta's fediverse and Threads – as well as other networks that connect to the fediverse. To be clear, I'm not saying it *always* makes sense to work with people and instances in Meta's fediverses.In some cases, it's likely to turn out that Meta's captured them so effectively that this isn't a useful direction. Attempts to work with the SWICG standards body, may turn out to be a waste of time and energy as long as key members [obsequiously defer to Meta](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#fn-eee). And if instances in Meta's fediverse rely on Meta's racist (and privacy invasive) automated moderation tools to limit disinfo, cooperation on some areas related to be could be harder. Still, there are likely to be other situations where working together does make sense. ## Consider "transitive defederation" from instances that federate with Meta ![Two disconnected networks of multi-colored dots connected by lines. The network on the right has a big Meta logo.](https://thenexusofprivacy.net/content/images/2024/01/transitive-2.png) In [Why block Meta?](https://fedipact.online/why?ref=thenexusofprivacy.net), FediPact creator Vanta Black highlights that one of the main reasons is to "protect the existing communities of marginalized people on the fediverse, many of whom rely on it to survive." With today's software, t*ransitive defederation* – blocking any instance that directly or indirectly federates with Meta – provides even stronger protection. The fediverse has a long tradition of transitive defederation. Derek Caelin's [Decentralized Networks vs The Trolls](https://link.springer.com/chapter/10.1007/978-3-030-79072-1%5F8?ref=thenexusofprivacy.net), for example, quotes mastodon.technology's admin Ash Furrow describing a transitive defederation of far-right social network Gab, as "a necessary step, since through them negative content might seep into the instance he maintains." That said, Meta isn't Gab, so there's a lot less agreement on whether or not to federate with Meta than there was with Gab – and [transitive defederation is always controversial](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/#transitive-defederation). Two things are true simultaneously: - Plenty of people and instances that are likely to wind up in the free fediverses have important relationships with people and instances in Meta's fediverses that they will want to keep. - Unless and until software evolves significantly – and there's a detailed threat model looking carefully at other potential avenues for indirect harassment – it's likely that many instances in the free fediverses are likely to choose to transitively defederate for safety reasons. And even if the software improves, many instances may still want to transitively defederate because they want to keep their fediverse as far away as possible from white supremacists and hate groups. So even in the free fediverses transitive defederation from Meta's fediverses isn't likely to be an all-or-nothing thing. Tradeoffs are different for different people and instances. Especially if the software improves, some instances in the free fediverses are likely to decide that the federation with well-moderated instances in Meta's fediverse outweigh the risks. Others want to be as far away as possible; transitive defederation is always going to be safer for them. In [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net), Kissane suggests that operating "from a server that federates only with servers that also refuse to federate with Threads" is one way to get "the nearest thing to reasonably sturdy protection for people on fedi who have good reason to worry about the risk surface Threads federation opens up." [14](#safety-of-transitive-defederation) At the end of the day, each instance in the free fediverses will make the decision on their own. So the key recommendation here is that **instances should *consider* transitive defederation**: discuss it, and decide what to do. I've got some thoughts below on how to have the disucssion but first I want to emphasize that from a strategy perspective, partial transitive defederation is a very good thing for the free fediverses. ### A few thoughts on strategy Since there's a range of opinions and tradeoffs, the most likely outcome is that we'll see multiple subregions of the free fediverses: - Some will transitively defederate - Others will continue to federate with some instances in Meta's fediverses. To me this is a strength of the fediverse: different people can get more of what they want. Of course, it's also kinda imperfect and messy and complex. For one thing, many people on transitively defederated instances will have accounts on more-connected instances: subregions of the free fediverses that federate with some instances in Meta's fediverse, Meta's fediverses, Threads. Hopefully tools will improve to make it easier to deal with that, and we may well see other ways emerge for people in transitively-defederated instances to communicate with people in Meta's fediverses ... at least in the short term, though, it'll be a hassle. Still, however much transitive defederation there winds up being, I see it as overall as a positive thing. Then again, opinions differ. In [Getting Tangled Up in Threads](https://wedistribute.org/2023/12/tangled-up-threads/?ref=thenexusofprivacy.net), for example, Sean Tilley of *We Distribute* notes that many people see these concerns as "hysteria" that could lead to a massive fragmentation of the Fediverse, "effectively doing Meta’s job for free." It's a good observation, but the people who think that are wrong on both fronts. The concern isn't "hysteria" – and it's anti-LGBTQIA2S+ for cis people to describe it that way. And from a strategy perspective, to whatever extent transitive defederation happens, it's likely to help the free fediverses more than it helps Meta: - It sharpens the distinction between the free fediverses – instances prioritize safety over "openness" and reach – and most other social networks today - It puts the free fediverses on a path for being the best place for LGBTQIA2S+ people and others at risk from hate groups, vigilantes, and stalkers on Meta A lot of the strongest langauge about (and fear of) transitive defederation come from people who a "bigger is better" view of the fediverse and generally dislike the idea of communities setting their own norms. As Kissane observes, many people see an allow-list approach (consent-based federation, which is necessary for transitive defederation) as controversial and less "open." It's a good example of Christina Dunbar-Harris's point in *Hacking Diversity* that the "interpretations and norms of openness on which open source rests" often run counter to the goal of providing more safety. It's true that a lot of people prefer what they see as "openness" to safety, and Meta's fediverses may well be a better option for them than the free fediverses. But there are lots of people who *don't* prefer that, and right now they don't have a lot of other options. ### Have the discussion! Just to reiterate, the recommendation here is to *consider* transitive defederation: discuss it, and decide what to do. And as you're having the discussion, pay a lot of attention to what voices you're hearing – and what voices and perspectives you *aren't* hearing. Cis people, white people, guys, and people who work for or Meta or other big tech companies are likely to have different perspectives than trans, queer, and non-binary people, BIPOC and other people of color, women, and people who have (or have friends or relaties who have) been harmed by Meta or other big tech companies. Of course no commuity is monolithic ... opinions differ! So it's critical to listen to diverse voices and taking those perspectives into account when a discussion needs to be made. It's hard to know just when that will be – a lot depends on how quickly Meta provides federation more broadly and what if any agreements they put in place once two-way federation starts – but in any case, now's a good time to start the discussion. Where to discuss? On the fediverse, of course! For global discussions, the hashtag #TransitiveDefederation is long but a decent starting point. Start up a community on Lemmy and magazine on Kbin, start having video discussions on PeerTube and schedule them as events on Mobilizon, and instances across the fediverse could get involved. And it's also something instances should discuss amongst themselves. Local-only posts are great for this if you're on an instance that runs Glitch, Hometown, Akkoma, Friendica, Misskey ... if your instance uses Mastodon, you're out of luck, now's a good time to ask your instance admin to shift to a fork that *does* support them and try to convince the main Mastodon software team to provide this functionality. A lot of instances also have a non-fediverse discussion and decision/making platform: on Matrix, Discord. Loomio, Github discussions, whatever. Those are better in some ways for some kinds of discussions so if they work well for you instance then by all means keep using them – but they are also potentially exclusionary, so make sure to have a lot of discussion and allow participation in decision-making for people on the fediverse as well. Now's a natural time for federations of instances to emerge and as that happens they will probably want a space where they can discuss among themselves. A federated private group could be a good answer for that but alas this isn't something that exists on most fediverse platforms today. Longer-term, this points for a way for the software to evolve (a new visibility level scoped to a federation of instances is another example) but in the short term options like a new instance that everybody gets another account on (sigh, I know) or a non-fediverse platform that everybody gets another account on will fill the gap. > At this point, I stopped serializing the series. I added the remaining sections (including a couple that are mostly empty) at the end of 2024, from an early unpublished draft (updated with links to a few more recent articles). ## Reduce the dependency on Mastodon Mastodon has been the dominant software platform in the fediverse since 2017, and even though the number of active Mastodon users *decreased* by 30%, it's still perceived as the big elephant in the room. Mastodon's innovation has been sluggish since BDFL (Benevolent Dictator for Life) Eugen Rochko drove many of the early queer and trans contributors away in 2017-8, and it well-deserved for treating many volunteers shabbily and not crediting them for conributions. Mastodon's reputation for [whiteness](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) and [hostility to journalists](https://bsky.app/profile/aendra.com/post/3kiklh3ya2e2m?ref=thenexusofprivacy.net) are also well-desered. And Rochko is a strong advocate of working with Meta; his recent [The State of Federation](https://flipboard.video/w/cTBu4HusskGTuPBahqm6WY?ref=thenexusofprivacy.net) podcast discusses why. So the less the free fediverses depend on Mastodon, the better. The good news is that there are other, better, options. For one thing, the fediverse isn't limited to microblogging software like Mastodon; there's software for photo and video sharing, events, blogging, and lots of other stuff. Even for microblogging, though, other good options already exist, with more emerging. There are at least three complementary aspects to this strategy. ### Replace Mastodon's API with a new de facto standard for clients Instead of using the W3C standard ActivityPub C2S (client to server) API (application programming interface), Mastodon instead supports its own proprietary API. It's an example of a classic embrace-and-extend tactic: thanks to Mastodon's historical dominance, apps that want to take advantage of the fediverse's installed base have to support the Mastodon API. When other platforms add new functionality (such as GoToSocial's reply controls), it's not available through the Mastodon API, so mobile apps and web user interfaces don't support it. It's hard to know just how to overcome this. One possible approach is to provide better toolkits for the official ActivityPub C2S API, and then convince at least one key non-Mastodon platform and a couple of key apps to migrate over. Another approach is to introduce a completely new API. Either way, it's easier said than done – but important! ### Keep forking it -- and fund the forks, including one or more community-driven "hard forks" of Mastodon As Margaret KIBI pointed out in 2019 in [Progressing Fringe Mastodev](https://www.u2764.com/NFIC/2019-09-15/fringe-progress/?ref=thenexusofprivacy.net), development work done on forks (variants) without the intention of sending that work upstream to the main branch – and without mainstream acknowledgment or recognition – "has been the dominant force by which external development has taken place on the network since mid‐to‐late 2017." Since then, forks continue to thrive, and include valuable extensions including making vanilla Mastodon more usable, providing more protection against harassment, and making it easier to have a strong local community. Today, while the main code base has absorbed some of their ideas, many free fediverse instances run forks like Glitch, Hometown, and Fedibird – and forks of those forks. That's great, and as KIBI discusses in detail, this decentralized approach is also very important from a power perspective: > "The centralization of contemporary open‐source projects comes as a direct consequence of capitalistic maximal‐output/minimal‐labour optimization practices—which, due to techʼs massive diversity and accessibility problems, donʼt even work—but, if they did, would remain far from proven as the philosophical standard to which all software development should conform." The free fediverses' need for forks is likely to become even more acute in the short term. At the very least, the free fediverses' priorities like improving consent-based allow-list federation (a concept Mastodon CTO Renaud Chaput told me the mainline project is likely to continue to oppose) are likely to differ from vanilla Mastodon (which will have to prioritize the challenges large instances like mastodon.social have in supporting Threads' huge scale). Not only that, as Evan Prodromou points out, [most "Big Fedi" advocates of federating with Threads see racist AI-based moderation as addressing content moderation on the fediverse](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#big-fedi) (even though they've failed to do so on Threads, Facebook, Instagram, and Twitter, but whatever). Chaput's architectural vision in [Evolving Mastodon’s Trust & Safety Features](http://www.renchap.com/blog/post/evolving%5Fmastodon%5Ftrust%5Fand%5Fsafety/?ref=thenexusofprivacy.net) supports these and other surveillance capitalism-based services, so it's distinctly possible that Mastodon software will become much more Meta-friendly. Today, forks are "downstream" from Mastodon, meaning they accept Mastodon's changes. This gives Mastodon – and Meta – a lot of influence over the code base. One or more "hard forks," creating new "upstreams", shift the power away from Rochko and Meta and gives the free fediverses more control of their own means of production. By providing a solid implementation of functionality like consent-based federation, concenteric federations of instances, and cross-instance communities, these new upstreams can also add a lot of value to the decentralized forks as well – especially if (unlike Mastodon today) they're driven by community input, and use much of their funding to support work work in decentralized forks. [Fork it! It’s time for a Mastodon hard fork (UPDATED)](https://thenexusofprivacy.net/mastodon-hard-fork/) (April 2024) makes the case for complementing or replacing Mastodon gGmbH's official version of Mastodon. ### Fund and support the development and deployment of platforms not based on Mastodon [A lot of good stuff is happening in the fediverses!](https://thenexusofprivacy.net/good-stuff-in-the-fediverses/) (October 2024) how much else is going on in the fediverses today. Newer fediverse microblogging platforms like Bonfire, GoToSocial, and Letterbook pay a lot more attention to safety and privacy than Mastodon – and for that matter, so do platforms like Akkoma and Streams that have been around for a while but don't have broad adoption. Once you get beyond microblogging, there's also PixelFed (for photos), PeerTube (videos), Mobilizon (events), Lemmy and KBin (reddit-like news aggregators) and dozens more interesting platforms – as well as existing software like Wordpress, Flipboard, and NodeBB that's adding fediverse integration. And next-generation platforms like Spritely and Veilid go even further, building in safety and privacy from the beginning. Unfortunately, Mastodon's higher visibility means that it's gotten the bulk of the funding and support from the ecosystem. Now's a good time to change that. Of course, many of these platforms are still at an early stage, or have limited scalability. That's okay! Instances currently running Mastodon can move to a fork in the short term. But Akkoma already supports several instances with over 100 active users, I see more and more people experimenting with GoToSocial, and Bonfire's continuing to make progress ... so things are actually farther along on this front than many people realize. As with the fork, funding could accelerate things rapidly. And as I say in [Design from the margins – and fund it!](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/#design-from-the-margins) > "the single most important way for the fediverse to move forward is to **fund more work by and with people from decentered communities.**" ## Start moving beyond ActivityPub The ActivityPub protocol has been dominant in the fediverse [since Mastodon adopted it 2017](https://thenexusofprivacy.net/mastodon-a-partial-history/#activitypub); only a few fediverse platforms support alternate protocols. While ActivityPub was a significant improvement on the previous OStatus standard,as spec co-author Erin Shepherd says in [A better moderation system is possible for the social web](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web/?ref=thenexusofprivacy.net) > "The SocialWG was a working group divided; if you ever wondered why it produced *two* families of incompatible social networking protocols, this is why! (and also one of the most perfect examples of the failure modes of standardization bodies) .... So if there’s something that’s obviously missing from ActivityPub that you think should be there, here’s your rationale." And there are some major things obviously missing from AcitivityPub, including what spec co-author Christine Lemmer-Webber [describes](https://gitlab.com/spritely/ocappub/blob/master/README.org?ref=privacy.thenexus.today) as "holes in the spec" related to authorization and identity management that contribute to longstanding fediverse problems like lack of safety and the difficulty of moving accounts. Not only that, the specification is extremely flexible, enough that implementations aren't compatible, and there isn't a test suite – so Mastodon has emerged as a de facto standard. And there hasn't been a lot of progress in the six years since ActivityPub became a standard. Despite its limitations, ActivityPub has proven valuable, and I'm certainly not saying to junk it. As I say in [And it's about the protocol, too](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/#and-the-protocol), "It's certainly possible that these issues could be addressed with improvements to the ActivityPub protocol." Federation across different platforms mostly works today, at least most of the time, and it really is cool to post something from Mastodon to a Lemmy community and have some of the responses show up as comments on Mastodon as well as Lemmy. Recently-developed testing resources like [Sandcastle](https://github.com/Letterbook/Sandcastles?ref=thenexusofprivacy.net), and [funding from NLNet for a test suite](https://nlnet.nl/project/FediverseTestsuite/?ref=thenexusofprivacy.net), could lead to improved compatibility. It's quite possible that Meta's participation in the standards process will finally start moving it forward again. But then again, Meta's participation in the standards process makes it less likely that the result will serve the free fediverses' interests – especially since Prodromou recently [described](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism#fn-eee) an email to the SWICG standards group suggesting that Meta was pursuing an [Embrace, Extend, and Extinguish](https://en.wikipedia.org/wiki/Embrace,%5Fextend,%5Fand%5Fextinguish?ref=thenexusofprivacy.net) strategy as "[not acceptable](https://lists.w3.org/Archives/Public/public-swicg/2023Dec/0104.html?ref=thenexusofprivacy.net)." And newer platforms designed (unlike ActivityPub) with privacy and safety in mind are much more forward-looking. So the free fediverses should prepare to move beyond ActivityPub. A few ideas worth considering on this front: - Multi-protocol implmentations, like Friendica, Hubzilla, and Streams already have, including other fediverse protocols like Zot and Diaspora as well as Bluesky's ATProto - Cleaner variations of ActivityPub like [FeatherPub](https://docs.google.com/document/d/13mtl9gFmcuL-0MS-Boaeh3i6WyzXOUcRsR8pspkRvWY/edit?ref=thenexusofprivacy.net#heading=h.usrs9hpt8mat) (currently very much a work in progress) are likely to be easier to implement – and a better basis for addressing the protocol's issues. - Next-generation platforms like [Leaf](https://zicklag.katharos.group/blog/introducing-leaf-protocol/?ref=thenexusofprivacy.net), [Lemmer-Webber's Spritely and Cult of the Dead Cow's Veilid](https://www.eff.org/deeplinks/2023/12/meet-spritely-and-veilid?ref=thenexusofprivacy.net), while investigating bridges and compatibility with today's ActivityPub and ATProto ## Prioritize accessibility, which is a huge opportunity > "Once the underlying software supported alt-text, much of Mastodon adopted a norm of putting descriptions on images – and not boosting images that don't have alt-text." > > – [Mastodon: a partial history,](https://thenexusofprivacy.net/mastodon-a-partial-history/) December 2022 > "As a Blind person i never thought i would be on social media savoring photos. But the communal Mastodon alt text game is so strong that sweet, poetic or silly descriptions abound on my timeline. Thanks to legions of people who take time to write a meaningful description of the ephemera they post, i learn so much about insects, plants, buildings, memes — all dispatches from a dimension of the world that i otherwise wouldn't experience. If you're wondering whether anybody reads these things: YES." > > – Chancey Fleet, quoted in [Resources for choosing the right fediverse instance](https://thenexusofprivacy.net/resources-for-choosing-instances/) For many users with vision problems, the prevalence of alt-text on images in the fediverse is a pleasant surprise – and quite a contrast to norms on commercial social networks. And there's also a vibrant accessibility community in the fediverse. But in today's fediverse, it's something of a mixed bag. Rochko has refused to allow some accessibility fixes into the Mastodon code base; other accessibility issues have remained open for years. And the commitment to alt-text is stronger in some corners of the fediverse than others. Statistics from the [Alt Text Health Check](https://mastodon.social/@AltTextHealthCheck?ref=thenexusofprivacy.net) bot highlight the difference: - on instances mastodon.art, wandering.shop, mstdn.games, zirk.us, tech.lgbt, eldritch.cafe the vast majority of images have alt-text. - on mastodon.social, very few do – often 20% or less. With Rochko, Mastodon, and mastodon.social joining Meta's fediverses, it's a great opportunity for the free fediverses to build on this strength. A few thoughts: - prioritize accessibility fixes in the software – and resources (like [Accessibility resources for Mastodon and compatible software](https://thenexusofprivacy.net/mastodon-accessibility-resources/) ) to help people work around current limitations - provide software support for functionality like [#Alt4Me](https://indieweb.social/tags/Alt4Mehttps://indieweb.social/tags/alt4me?ref=thenexusofprivacy.net) and [#Alt4You](https://indieweb.social/tags/alt4me?ref=thenexusofprivacy.net) currently provide in a low-tech manner: requesting, suggesting, and accepting alt-text suggestions. What if I could click on a suggestion I like and have it added automatically to images? - convene online discussions and potentially one or more workshops, involving accessibility experts as well as community members, to discuss other opportunities for improvement including culture and design as well as software. ## Build a sustainable ecosystem [Governance on Fediverse Microblogging Servers](https://fediverse-governance.github.io/?ref=privacy.thenexus.today)*,* by Erin Kissane and Darius Kazemi, includes a look at sustainability of instances. There's work to be done here! ## Commit to anti-fascist, anti-racist, anti-colonial, and pro-LGBTQIA2S+ principles, policies, practices, and norms for the free fediverses > "Policies against racism, sexism, discrimination against gender and sexual minorities, and Nazis are extremely appealing positioning these days. Not for everybody, of course: anti-safe-spacers, people with simplistic views of “free speech”, trolls, harassers and Nazis all have problems with it. Still, there’s clearly a large under-served market who’s sick of the norms on Twitter, Reddit, Facebook, and elsewhere." > > – me, in – [Lessons (so far) from Mastodon for independent social networks](https://thenexusofprivacy.net/lessons-so-far-from-mastodon-for-independent-social-networks/) (2017) It's still true! Racism and transphobia are already a huge problem on Meta's Threads; as I was writing the first draft of this post, I saw literally dozens of reports by trans users that Meta was putting transphobic posts in their "For You" algorithmic feed. Meta's content moderation approach of relying on racist AI-based tools and exploiting outsourced workers doesn't work on Facebook or Instagram – and it won't work on Threads either. Meta's fediverses can try to provide an alternative, but it'll be a very challenging: federating with Threads means federating with all the hate groups and bigots who are there, and Meta's racist AI-based tools won't help. So the free fediverses can provide an anti-fascist, anti-racist, anti-colonial, pro-LGBTQIA2S+ environment, it'll be very attractive to people who are looking for that. Not everybody wants this, and that's fine – the free fediverses are much better off if fascists, racists, bigots, hate groups, etc, would rather hang out elsewhere. But for the people who *do* want this, there are not a lot of other good options out there today, so it'll be a big selling point for the free fediverses. That said, there are a some big caveats here. > "Anti-Blackness – beliefs, attitudes, actions, practices, and behaviors of individuals, institutions, software, and systems that devalue, minimize, and marginalize the full participation of Black people across the world[1](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/#notes) – is a long-term problem in the fediverse. Dr. Johnathan Flowers' [The Whiteness of Mastodon](https://www.techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) and [Twitter vs. Mastodon](https://www.radicalai.org/twitter-vs-mastodon?ref=privacy.thenexus.today) podcast, Marcia X and Ra’il I'Nasah Kiam's [Blackness in the Fediverse](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x/?ref=privacy.thenexus.today), and the links in [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) have some of the history. While these links focusing primarily on Mastodon, currently the largest instance (server) in the Fediverse, the problem is broader – see for example the draft of [Ah, Lemmy: Racism and Denial in the Threadiverse](https://thenexusofprivacy.net/racism-and-denial-in-the-threadiverse/)." > > – [5 things white people can do to start making the fediverse less toxic for Black people](https://thenexusofprivacy.net/start-making-the-fediverse-less-toxic/), August 2024 For one thing, opposition to Meta – or to surveillance capitalism – doesn't necessarily mean being anti-fascist, anti-racist, anti-colonial, or pro-LGBTQIA2S+. There are plenty of racist, fascist, colonialist, and anti-LGBTQIA2S+ instances and people in today's fediverse. And while the fediverse has always had a stated commitment to opposing racism and transphobia, it doesn't always work out that way in practice. Not only that, many instances (including most of the large Mastodon instances like mastodon.social) aren't well-moderated. [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) so the reality for many people falls far short. As Mekka Okereke of Google says, from the lived experience of many Black Twitter users, there are *more* overt nazis – and more anti-Blackness – on the Fediverse than on Twitter. Especially if the free fediverse moves towards consent-based federation, principles – and accompanying requirements on policies – can play a big role here. The Mastodon Server Covenant's requirement for "active moderation against racism, sexism, homophobia and transphobia" is a good starting point (although clearly needs to be broadened – moderation isn't the only consideration), but also points to the limitations of only focusing on principles. For example, what is the minimum bar for "active moderation"? From the free fediverses' perspective, the good news is that the big instances who are a source of a lot of the racism and other bigotry are embracing Meta – and so are fediverse influencers like Rochko who many (including me!) see as barriers to making progress. So the free fediverse has a great opportunity to address these problems. But it won't just happen on its own. Several of the strategies I discuss here will help significantly on the technical front, by giving instances and people better tools to protect themselves. That said, culture and norms are even more important. Given the fediverse's current demographics – and the challenges that so many cis and white people have in following through on their stated values – there's a lot of work to be done. > “Queer people built the Fediverse.” > > – Christine Lemmer-Webber, quoted in [A (partial) queer, trans, and non-binary history of Mastodon and the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net) > "Trans people talk and post here openly about their lives from a position that has never existed on social media before. We talk openly with cis people reading our posts and replying, friendships, understanding, experience, normalisation. > > Every other social network this is impossible because the continual existence of anti-trans agitators is implicit." > > – CJ Bellwether, quoted in [We're here, we're queer, fuck Facebook (or whatever they're calling themselves these days)](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#were-here-were-queer) It's not surprising that so many of the instances signing the anti-Meta FediPact are led by LGBTAIQ2S+ people or are known for being LGBTAIQ2S+-friendly. Today's fediverse in general is very queer and trans friendly, with lots of LGBTAIQ2S+-led and LGBTAIQ2S+-friendly instance; [Facebook, Instagram, and Meta have a loooooong history of anti-LGBTAIQ2S+ actions](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#were-here-were-queer); the anti-Meta FediPact was started by trans enby lesbian gender terrorist Vanta Black and its Mastodon account is on tech.lgbt. Of course, no community is monolithic. There are huge rifts within LGBTQIA2S+ communities in the Fediverse, including long-standing histories of harassment; tensions between trans mascs and trans femmes; interactions between racism, colorism, misogynoir, transmisogyny, anti-transmasculinity, transmisogynoir. This is one of the reason I talk about things in terms of the fediverses, plural: some of the different subnetworks of people here get a long so badly that they don't even want to be in the same space. For that matter, some LGBTQIA2S+ people are likely to be happier in Meta's fediverses, or in other corporate-aligned fediverses. Still, there's certainly room here to differentiate. Many cis straight people don't really care about LGBTQIA2S+ perspectives, and some are actively hostile. But they've already got plenty of options – including Threads. Mastodon's initial success in 2017 was largely due to [queer-led community innovation](https://thenexusofprivacy.net/mastodon-a-partial-history/#rapid-queer-led-community-innovation), but since most of today's fediverse influencers are cis guys, has never really capitalized on this heritage (other than trying to use it as a shield against charges of racism, as Dr. Johnathan Flowers discusses in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today)). Look at the topics at FediForum ("the unconference for the people who move the Fediverse forward"), podcasts about the fediverse, press coverage, and statements from influencers like Prodromou or Rochko ... how many attempts are there to highight the queerness?9 How often does it even get mentioned? And the reality is that there are a lot of LGBTQIA2S+ people out there who *do* want to spend their online time in a place where queer and trans people can talk normally and tolerance of anti-LGBTQIA2S+ hate groups and agitators *isn't* normalized as the price that has to be paid by trans people so that cis people can talk to their friends on Meta. By emphasizing this, the free fediverses can emphasize their appeal not only to LGBTQIA2S+ people, but also to many their friends and acquaintances. ## Organize! As you can tell, I think there are huge opportunities here. But it won't just happen. Looks like this is a topic to explore more in 2025! ## Notes 1 The plural form ("Meta's fediverses" and "free fediverses") is because there are also likely to be splits and schisms within these regions. For example, most of the large Mastodon instances are eager to federate with Meta, and so are far-right instances like noagendasocial and spinster, but the long-existing schism between far-right instances and the rest of the fediverse isn't going away. 2 If you're thinking "wow, I can't picture any fediverse instances wanting ads, let alone harvesting data on Meta's behalf to target ads", think again. Fediverse software platforms like Misskey lave long supported ads, and so do platforms and apps like Wordpress, Discourse, and Flipboard that are just starting to integrate. Fediverse influencers like Evan Prodromou see ads as inevitable, and it's just a hop skip and a jump from having ads to wanting to target ads and for people who want to target ads efficiently, who better to work with than Meta, with their reams and reams of data on most people whether or not they've got a Threads account? Of course, many people in today's fediverse see the ad-free nature as a big plus, but many people don't mind ads, and many of the instances in Meta's fediverses will want to take advantage of the business opportunity. 3 I'm using LGBTQIA2S+ as a shorthand for lesbian, gay, gender non-conforming, genderqueer, bi, trans, queer, intersex, asexual, agender, [two-sprit](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today), and others who are not straight, cis, and heteronormative. [Julia Serrano's trans, gender, sexuality, and activism glossary](https://www.juliaserano.com/terminology.html?ref=privacy.thenexus.today) has definitions for most of terms, and discusses the tensions between ever-growing and always incomplete acronyms and more abstract terms like "gender and sexual minorities". [OACAS Library Guides' Two-spirit identities page](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today) goes into more detail on this often-overlooked intersectional aspect of non-cis identity. 4Meta's fediverses are collectively betting that a lot of people want a Meta-adjacent option, with some communication with people on Threads in return for some but not all of their data federated to Meta's surveillance capitalism system, and (hopefully) good-enough moderation that the hate groups, racism, and transphobia aren't as bad as Threads. And they may well be right! But even if they are, that complements the free fediverses. 5 As Erin Kissane points out in [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net), many people see an allow-list approach is controversial as less "open" – a good example of Christina Dunbar-Harris's point in *Hacking Diversity* that the "interpretations and norms of openness on which open source rests" often run counter to the goal of providing more safety. When Instagram CEO Adam Mosseri announced Threads' plans to make federation opt-in (consent-based) for individual users, Rochko immediately criticized the decision to provide more privacy and safety to Threads users. How sad is it that (at least in this case) Instagram's CEO appears to understand consent better than the CEO of Mastodon gGmbH? But Mastodon's warning that allow-list approach is "contrary to Mastodon’s mission of decentralization" – which is clearly nonsense (it's just as decentralized whether or not a federation request is accepted by default) – is consistent with Rochko's ["bigger is better"](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#big-fedi) worldview, and he's far from the only fediverse influencer who feels that way. 6 Although Mastodon's implementation is very hacky, and largely separate from its standard blocklist-based federation implementation. Oh well. So, some refactoring will be needed, but it's not a show-stopper. 7 Meta's fediverses probably also won't be able to compete with Threads on this. Threads plan to make federation opt-in is the right thing to do from a privacy and safety perspective, but also means that people in Meta's fediverses won't be able to communiate with most of the people on Threads. And Meta has the option of adding communication between Threads and the billions of people on other networks like Instagram (which already shares the same infrastructure), Facebook, and WhatsApp. Longer-term, it seems to me that this is likely to be a huge challenge for Meta's fediverses, but fediverse influencers supporting federating with Meta have various arguments why it doesn't matter. 9 If Meta's fediverses want to have any chance of competing with Threads longer term, now's also a good time for them to make the experience better, but who knows whether that'll happen. 10 and unlike the current Mastodon Migration account, avoids posts that reinforce Mastodon's reputation as a hostile place for people of color. 11 As I've noted in the past, since Mastodon's software is controlled by Mastodon gGmbH (which also runs by far the largest instance, and one that new arrivals are now signed up for by default) there's been very little incentive to invest in making it easier for people to leave. Hopefully, though, Chaput's statement signals a change in attitude! 12 Although some of the hate purveyors on today's fediverse very much do like the idea of federating with Meta -- [one well-known anti-trans bigot was so upset is so upset that Threads has blocked his instance that he implemented block-evasion software](https://wedistribute.org/2023/12/authorized-fetch-circumvented/?ref=thenexusofprivacy.net) \-- and presumably the hate groups there are part of the attraction for them. 13 Of course, Meta has a long track record of hostilitiy to activism, so we'll see how much access Meta actually gives for activists in Meta's fediverse to reach people on Threads. Clay Shirky and I got into a debate about this after his closing keynotes at the 2008 Computers, Freedom, and Privacy conference, and while I was right in the short term – activism on Facebook played an important role in Obama's success in 2008 – his prediction that Facebook would find ways to shut down activism also proved correct. Still, if Meta follows through on their current plans, Meta's fediverses will probably have some access at least for a while if they work with cooperative accounts on Threads. 14 [Why just blocking Meta’s Threads won’t be enough to protect your privacy once they join the fediverse](https://thenexusofprivacy.net/just-blocking-threads-isnt-enough) and the (much longer) [Threat modeling Meta, the fediverse, and privacy (DRAFT)](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/) come to similar conclusions about the value of transitive defederation with current software – and the latter has suggestions about how to improve it. ## Image credits Strategy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA 3.0](http://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [Picpedia.org](https://www.picpedia.org/chalkboard/s/strategy.html?ref=thenexusofprivacy.net) Say no to Meta originally from [Meta Platforms Inc. Logo](https://en.wikipedia.org/wiki/File:Meta%5FPlatforms%5FInc.%5Flogo.svg?ref=thenexusofprivacy.net), via Wikipedia Consent by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA 3.0](http://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net), via [Picpedia.org](https://www.picpedia.org/highway-signs/c/consent.html?ref=thenexusofprivacy.net) Networked Communities originally from [Internet Map 1024](https://en.wikipedia.org/wiki/File:Internet%5Fmap%5F1024.jpg?ref=thenexusofprivacy.net), via Wikipedia Concentric circles by Vectorportal.com, [CC BY](https://creativecommons.org/licenses/by/4.0/?ref=thenexusofprivacy.net) Person in Black Leather Boots Lying on Brown Cardboard Boxes by cottonbro studio via [Pexels](https://www.pexels.com/photo/person-in-black-leather-boots-lying-on-brown-cardboard-boxes-4553183/?ref=thenexusofprivacy.net) people working together by Isbg Six, licensed under [CC BY-NC 2.0](https://creativecommons.org/licenses/by-nc/2.0/?ref=thenexusofprivacy.net), via [flickr](https://www.flickr.com/photos/isbg6/5029147286?ref=thenexusofprivacy.net) ## Update log December 30: add remaining sections from the unpublished draft, update with a few links. April 12: rework intro to add "non-aligned fediverses", improve discussion of ATmosphere and Bluesky, added new section on [Networked communities could be a thing in the ATmosphere too](#atmosphere-communitie) March 17: rework definition of "Meta's fediverse", but also mostly on hiatus February: on hiatus January 1 - 11: additional sections, also published as individual posts January 1, 2024: initial version, with overview and first section ### Happy 2024! A few updates, a few questions URL: https://thenexusofprivacy.net/happy-2024-a-few-updates-a-few-questions/ Last updated: 2026-04-16T03:13:31.000Z Happy new year! 2024 should be a very interesting year, for privacy and other topics as well. I'm got various ideas on how to evolve The Nexus of Privacy, and am curious what people think. [Here's a short CryptPad survey](https://cryptpad.fr/form/?ref=thenexusofprivacy.net#/2/form/view/OHgJTcnyBQXV0ofbMPm8dGHhXd6sTNoBM+NVzsWmSBg/); and depending on your privacy settings you may also be able to see it embedded at the bottom of this post. And now's also a good time to mention several significant updates I've made to various posts on The Nexus of Privacy: - [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) has a new introduction, several new sections, and a lot of updates reflecting new information now that Threads has actually started federating - [Improving privacy and safety in fediverse software](https://thenexusofprivacy.net/ipsfs-nlnet/) has several changes, shifting it from a resource page for a specific grant proposal to a description of a general project - [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) has several updates relating to Threads' federation. [Please use this link](https://cryptpad.fr/form/?ref=thenexusofprivacy.net#/2/form/view/OHgJTcnyBQXV0ofbMPm8dGHhXd6sTNoBM+NVzsWmSBg/) if you're not able to see the embedded survey ### Image credit [Calendar 2024 by GDJ](https://pixabay.com/vectors/calendar-2024-new-year-time-8178256/?ref=thenexusofprivacy.net), used under [Pixabay content license](https://pixabay.com/service/license-summary/?ref=thenexusofprivacy.net) ### The (annotated) case for "Big Fedi" URL: https://thenexusofprivacy.net/the-annotated-case-for-a-big-fedi/ Last updated: 2026-04-16T03:12:07.000Z > [Join the discussion on the fediverse!](https://infosec.exchange/@thenexusofprivacy/111655044812444740?ref=thenexusofprivacy.net) > "The “Big Fedi” position is a set of ideas that roughly cluster together. Not everyone who agrees with one or a few of these agrees with them all, but I think they tend to be related." > > – Evan Prodromou, [Big Fedi, Small Fedi](https://evanp.me/2023/12/26/big-fedi-small-fedi/?ref=thenexusofprivacy.net), December 2023 In [Two views of the fediverse](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#two-views), I talked about the tensions between the "bigger is better" view of the fediverse (who generally support federating Meta) and a view that focuses more on networked communities. Prodromou has decades of experience on decentralized social networks, and does an excellent job of presenting the "bigger is better" case, so I added a new section discussing it to [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/). But since Prodromou's essay is getting a lot of traction, I figured I'd also use that section as the basis for a longer standalone post. As he says near the end of the essay, Prodromou sees himself "mostly as a Big Fedi person." So it's especially worth reading, and thinking critically about, the list of ideas in the "Big Fedi" section of his essay. My first reaction was that geez, there's a lot he's leaving unsaid. Here's a few examples (*with my annotations in italics) highlighting some of what Prodromou isn't explicit about*) - Everyone on the planet should have an account on the fediverse (*even Nazis, racists, transphobes, white supremacists, hate groups who target people of color, LGBTQIA2S+ people, and other marginalized communities)*. It will make the internet better and the world better (*if Nazis et al are on the fediverse, as opposed to trying to keep them off)* - We should make choices that help bring the fediverse to new people (*even when marginalized people see these choices as putting them at risk*) - The individual is central, and the account server is mostly a dumb pipe (*as opposed to a community with norms and boundaries run by admins and moderators who have useful tools to protect people on the instance from harassment and hate speech)* - Moderation can be automated *(even though automated moderation doesn't work well on Facebook, Instagram, and Threads – and discriminates against people of color and LGBTQIA2S+ people*) - There may be some harm (*especially to people of color, LGBTQIA2S+ people, and other marginalized communities*) that comes with growth (*and growing faster will cause more harm*); we can *(potentially)* fix it later *(details tbd, just trust me)*. - It’s more important to bring good people to the fediverse than to keep (*Nazis, facists, transphobes, white supremacists, hate groups who target people of color, LGBTQIA2S+ people and other marginalized communities*) bad people off it. There may be some bad people, too, but we’ll (*somehow come up with a way to*) manage them *(even though today's fediverse is* [*unsafe by design and unsafe by default*](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) *and most instances can't manage the bad people who are there today, so it's likely to get a lot worse rather than better as things get bigger)* A lot of the other ideas Prodromou's lists as "Big Fedi" beliefs are shared much more broadly. Pretty much everybody largely agrees that it should be possible to have open source and ad-free instances; there should be a lot of different instances with different norms to choose from; that services like onboarding tools are useful; connections should be person-to-person; affinity groups should stretch beyond instance boundaries; there should be open-source implementations; existing organizations should be able to run their own instances; and the fediverse is going to look very different over time. No arguments there. Still, there are likely to be difference in perspectives. Do the "different norms to choose from" include Nazism, fascism, anti-LGBTQIA2S+bigotry, and so on? What about existing organizations like Stormfront and Libs of TikTok might well run their own instances? Of course, it's not possible to keep all bad people and organizations off the fediverse, and I certainly agree that better tools are needed to manage them. But today's fediverse *has* kept bad people and organizations off. Gab tried to join and the vast majority of instances defederated them and the left. OANN tried to join an existing instance, and threats of defedartion convinced the admin to enforce their code of conduct and kick OANN off. So even though there are plenty of bad actors who sneak through, it's still very different from the Big Fedi view Prodromou articulates, where Stormfront and Libs of TikTok *should* be on the fediverse (because *everybody* should have an account) and automated moderation tools will limit the harm they cause. ## Two sides to every story The rest of the essay's worth reading as well. Prodromou's a strong supporter of federating with Meta[1](#fn-eee), so as well as an interesting window into how he personally sees things, his essay's a useful view into how Meta's advocates (and Meta) (and a sympathetic tech press) are likely to portray Meta's embrace and extension of the fediverse – and the resistance. Since Prodromou's a Big Fedi kind of guy, it's not surprising that his "Small Fedi" section has some very misleading characterizations. Even the name is based on a deliberate distortion of a term Erin Kissane used to describe today's fediverse in [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net). One good example of a very misleading take is Prodromou's laughable claim that "Small Fedi" advocates mostly think "the fediverse works just about right right now, and shouldn’t change." Bollocks. I've talked with dozens of people who don't buy into the "bigger is better" worldview, and almost none them think either of those two things. To the contrary, most people who don't buy into the "Big Fedi" view aren't thrilled with how the fediverse works right now, and think there's already *too much* racism and transphobia and other bigotry on the fediverse, and too many Nazis, fascists, and tranphobes. And they do want things to change: *less* racism and tranphobia; *fewer* Nazis, fascists, and terfs. That said, Prodromou's correct that there's a genuine difference of opinion here. A bigger is better approach leads to *more* racism, transphobia, bigotry Nazis, fascists, transphobes, and hate groups in the fediverse – in general, and specifically in terms of federating with Threads (which as I write this is actively promoting transphobic content and even using it in their ads to encourage people to join Threads). As Prodromou says, "Big Fedi" advocates see that as a tradeoff worth making. Others disagree. But that doesn't mean they like things as they are today. Still, it's certainly see why it's useful for Meta and their supporters would want to portray this attitude as resisting change. And the same's true for many of the other mischaracterizations in Prodromou's view of "Small Fedi". ## For more context ... Prodromou's "big/small" framing isn't the only way to understand this difference of opinion. L. Rhodes excellent thread on [Just Nodes and Networked Communities](https://merveilles.town/@lrhodes/110555014534253768?ref=thenexusofprivacy.net), heat-space's [The Two Camps of Mastodon](https://heat-shield.space/mastodon%5Ftwo%5Fcamps.html?ref=thenexusofprivacy.net), and my own [Two views of the fediverse](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#two-views) have some complementary perspectives. And Prodromou's essay is also a good example of [an interesting dynamic](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#an-interesting-dynamic) that I've been talking about for months now: people in the "bigger is better" camp seem to have a hard time acknowledging why some people see it differently. For perspectives on whether to federate with Meta, Erin Kissane's [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net) is outstanding. [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) has many other perspectives as well, but if you only have time to read one, by all means read Erin's! ## Notes 1 Prodromou's such a strong supporter of working with Meta that he recently described an email to the SWICG standards group suggesting that Meta was pursuing an [Embrace, Extend, and Extinguish](https://en.wikipedia.org/wiki/Embrace,%5Fextend,%5Fand%5Fextinguish?ref=thenexusofprivacy.net) strategy as "[not acceptable](https://lists.w3.org/Archives/Public/public-swicg/2023Dec/0104.html?ref=thenexusofprivacy.net)." A [footnote](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism#fn-eee) in *Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!* has details. ## Update log Ongoing: typo fixes, clarifications, other minor changes December 27, 2023: original version, published as *The (annotated) case for a "big fedi"* December 28-30: various relatively-minor updates February 16, 2024: add bullet on "there may be some harm ..." August 14, 2024: changed title to *The (annotated) case for "Big Fedi"*, which make it clearer that it's referring to the term of art, reordered bullets slightly ### Embrace, Extend, and Exploit: Meta's plan for ActivityPub, Mastodon and the Fediverse URL: https://thenexusofprivacy.net/embrace-extend-and-exploit/ Last updated: 2026-04-16T03:11:44.000Z *Originally written December 2023\. See the* [*Update Log*](#update-log) *for details* It's an exciting time in the interconnected web of decentralized social networks known as the "[Fediverse](https://en.wikipedia.org/wiki/Fediverse?ref=thenexusofprivacy.net)": Threads (a new social network from Facebook's parent company Meta) is starting to follow through on its plans for connecting to the fediverse. The initial steps are tiny. Today, people using Mastodon and other fediverse software can follow a handful of Meta employees on Threads. But according to Instagram CEO Adam Mosseri [they'll be steadily adding more functionality over the next year](https://www.threads.net/@mosseri/post/C046LSmPAuN?ref=thenexusofprivacy.net), eventually including two-way communication. As [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) discusses, from the Fediverse's perspective the arrival of a company whose business model is built around exploiting people's data without consent – and has history of repeatedly breaking the law and contributing to genocide – is both an opportunity and a threat. Overall, I think that Meta's arrival will catalyze a lot of positive changes in the Fediverse. The series on [*Strategies for the Free Fediverses*](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/)has some suggestions about how the Fediverse can react to increase the chance of positive outcomes. But this post looks at it in the other direction. What's in it for Meta? [Today's Fediverse has less than 2,000,000 monthly active users](https://fediverse.observer/stats?ref=thenexusofprivacy.net) – fewer than it had at the beginning of the year. [Threads claims to have 100,000,000 monthly active users](https://www.engadget.com/mark-zuckerberg-threads-has-just-under-100-million-monthly-active-users-222548501.html?ref=thenexusofprivacy.net). Of course, Facebook and Meta have a track record of inflating their numbers – remember[ the big lie behind the "pivot to video"](https://slate.com/technology/2018/10/facebook-online-video-pivot-metrics-false.html?ref=thenexusofprivacy.net)? Still, even assuming they're exaggerating wildly, Threads is still much much larger than today's Fediverse. So why is Meta investing in ActivityPub and showing so much interest in the Fediverse? > **exploit:** verb (used with object) > > **·** to utilize, especially for profit; turn to practical account: to exploit a business opportunity. > > **·** to use selfishly for one's own ends: employers who exploit their workers. > > – [dictionary.com](https://www.dictionary.com/browse/exploit?ref=thenexusofprivacy.net) Here's one way of looking at Meta's strategy: 1. **Embrace** ActivityPub, Mastodon, and the Fediverse 2. **Extend** ActivityPub, Mastodon, and the Fediverse with a very-usable app that provides additional functionality (initially the ability to follow everybody you're following on Instagram, and to communicate with all Threads users) that isn't available to the rest of the fediverse – as well AS over time providing additional services and introducing incompatibilities and non-standard extensions to the protocol 3. **Exploit** ActivityPub, Mastodon, and the fediverse by utilizing them for profit – and also using them selfishly for Meta's own ends Since the Fediverse has so many fewer users than Threads, the most obvious ways of exploiting it – such as stealing market share by getting people currently in the fediverse to move to Threads – aren't going to work. But exploitation is one of Meta's core competences, and once you start to look at it with that lens, it's easy to see some of the ways even their initial announcement and tiny first steps are exploiting the fediverse: making Threads feel like a [more compelling platform](#compelling-platform), getting positive press, and [reshaping regulation](#reshaping-regulation). Longer term, it's a great opportunity for Meta to explore – and maybe invest in – shifting their business model to [decentralized surveillance capitalism](#decentralized-surveillance-capitalism). Before we get to that, though, let's talk about another popular theory about what Meta's up to. ## Extinguish isn't the only word that starts with an E > "The Embrace, Extend, Extinguish argument also falls down at the last point for me: Extinguish. This is a tremendous amount of effort that Meta is undertaking to try and… what? Stop the fediverse from growing? Defeat Mastodon, Meta’s mighty competitor? I think both of these goals are extremely small potatoes." > > – Gavin Anderegg, [Thoughts on Threads and ActivityPub](https://anderegg.ca/2023/12/15/the-threads-invasion?ref=thenexusofprivacy.net), December 15 There's been a lot of discussion in the fediverse about the risks of Meta [embracing, extending and extinguishing](https://en.wikipedia.org/wiki/Embrace,%5Fextend,%5Fand%5Fextinguish?ref=thenexusofprivacy.net) (EEE) the ActivityPub standard. It's a strategy that [Microsoft](https://en.wikipedia.org/wiki/Embrace,%5Fextend,%5Fand%5Fextinguish?ref=thenexusofprivacy.net#Examples%5Fby%5FMicrosoft) and [Google](https://drewdevault.com/2018/05/03/Google-embraces-extends-extinguishes.html?ref=thenexusofprivacy.net) are best known for, but they're far from the only ones who have used the EEE strategy. In fact, Mastodon's success in 2016-8 is a great example: - Mastodon initially **embraced** the OStatus standard that early fediverse platforms used, exploiting it (in the non-selfish sense of the word) to get compatibility with the existing ecosystem - Next, Mastodon **extended** the standard with valuable but controversial improvements like post visibility, and developed its own API for clients which became a de facto standard. - Time passed, and Mastodon dropped support for OStatus – which **extinguished** most adoption of OStatus and OStatus-based software and instances. Even though that's how things worked out, it's not like Mastodon intentionally set out to extinguish OStatus. There were real limitations of the protocol that got in the way of Mastodon providing value to its users, so of course Mastodon extended it. Things were somewhat ugly for a while, but Mastodon was bigger than everybody else so most people went along. And then ActivityPub came along, and it was a better fit or Mastodon's needs, so of course Mastodon adopted the parts of it that made sense and dropped OStatus. And since Mastodon *didn't* adopt the C2S portion of ActivityPub, instead keeping their own API, so also wound up doing an embrace-and-extend (but not extinguish) of ActivityPub. The same is true with [Google's adoption and then abandonment of the XMPP protocol](https://ploum.net/2023-06-23-how-to-kill-decentralised-networks.html?ref=thenexusofprivacy.net), which is also often described as EEE. I don't think that's the right way to look at it; for one thing, [XMPP is still around](https://xmpp.org/?ref=thenexusofprivacy.net), and thanks to adoption by Zoom and others it has hundreds of millions of users – or billions, if you count WhatsApp'a non-standard derivative version. But in any case, whether or not it was EEE, Google didn't go into it with a goal of killing XMPP. They just wanted to exploit XMPP to address a business problem of making Google Talk successful – and did so, until it wasn't useful to them any more. It'd be kind of ironic if Mastodon’s dominance from EEEing OStatus ended with Meta EEEing Mastodon and ActivityPub – live by the EEE, get extinguished by the EEE. If it happens, I can't wait love to see the discussion about it on [dolphin.town](https://dolphin.town/about/more?ref=thenexusofprivacy.net)! And if and when Meta sees the Fediverse as a significant threat, they'll ruthlessly stamp it out.[0](#notes) Still, that's unlikely to be Meta's goal at this point. Right now, they've got a huge potential longer-term opportunity to coopt the Fediverse as a basis for decentralized surveillance capitalism. It might not work out, of course, but even if it doesn't keeping a neutered Fediverse around might still be useful to Meta as long as it's not a threat to their dominance (just as Google subsidizes the Firefox browser). Either way, as Ramin Honary suggests, [it's a great opportunity for Enshittification](https://tilde.town/~ramin%5Fhal9001/articles/fediblock-facebook-and-threads.html?ref=thenexusofprivacy.net) – yet another word that starts with an E! And in the short term, there's money to be made – and regulators to try to influence – by exploiting the Fediverse. ## Making Threads feel like a more compelling platform > “I think we might be a more compelling platform for creators, particularly for the newer creators who are more and more savvy, if we are a place where you don’t have to feel like you have to trust us forever.” > > – Instagram CEO Adam Mosseri, quoted in Alex Heath's [Instagram’s boss explains why he’s taking on Twitter with Threads](https://www.theverge.com/2023/7/5/23784870/instagram-threads-adam-mosseri-interview-twitter-competitor?ref=thenexusofprivacy.net), July 2023 Twitter's meltdown highlights the risks of basing your online network on a platform run by an untrustworthy corporation – and Facebook and Meta have a loooong and richly deserved reputation for untrustworthiness. So why should people and brands looking for a Twitter alternative invest the time and energy to rebuild their networks on Threads? Of course some people will fall for "Trust us, it'll be different this time" or "yeah we'll screw you eventually but not for a while," but I agree with Mosseri: savvy people will indeed find it more compelling if the feel like they don't have to trust Meta forever. Whether or not it's ever becomes real, the story that the Fediverse will provide an escape path helps with that. > "Eventually, it should also be possible to enable creators to leave Threads and take their followers with them to another app/server." > > – Mosseri, on Threads, December 15 Hmm, "eventually" is doing a lot of work there. How long will it take, and real will the story turn out to be? It's hard to know. > **Update, December 2025**: "eventually" is still doing a lot of work here, and it's still hard to know if the story will ever be real. Meta hasn't done anything at all on this front in the two years since the original post. For one thing, Mosseri has said that Threads' current plan is to "explicitly opt in to your content being available on other servers"; while that's good from a privacy and safety perspective, if they follow through it would also mean that creators to leaving won't be able to take *all* their followers with them. \[If somebody's following you on Threads but hasn't opted in to federation, then when you move to an instance in the real fediverse they won't be following you any more.\] And until "eventually" happens, creators can't actually move *any* of their followers to the fediverse. So we shall see. But from Meta's perspective, so what? As Mosseri says, the goal here is to make people *feel* like they don't have to trust Meta *forever.* It's a good story, and that by itself has a lot of value at this point. It's getting favorable coverage in the tech press, too. And it'll be easy enough to implement an initial version (Mastodon already has this functionality) as a demo to show progress. > **Update, September 2024**: the favorable coverage in the tech press has continued. As Laurens Hof of *The Fediverse Report* notes in [Last Week in Fediverse – ep 82](https://fediversereport.com/last-week-in-fediverse-ep-82/?ref=thenexusofprivacy.net), "Threads has [figured out how maximise publicity](https://techcrunch.com/2024/08/28/threads-deepens-its-ties-to-the-open-social-web-aka-the-fediverse/?ref=thenexusofprivacy.net) by making [minimal incremental updates](https://www.threads.net/@pcottle/post/C%5FOGoCttX0n?ref=thenexusofprivacy.net) to their ActivityPub implementation." By the time the (incomplete) functionality is implemented, Threads will presumably have been further extended with additional functionality beyond what's available elsewhere, so creators will lose even more if they try to move. And while Meta *could* potentially make it as easy to use as possible and ensure that most or all of your information gets transferred ... they might well decide that's not in their business interest, and they'd rather use the fediverse selfishly for their own ends. So it's not clear how many people will actually take advantage of this functionality. Oh well, that's the Fediverse's problem, not Meta's. ## Reshaping regulation > "I’m also excited about our commitment to join the Fediverse and support the ActivityPub protocol. At our scale, it’s an incredibly exciting technical and regulatory challenge." > > – Gergely Orosz, [Building Meta’s Threads App](https://newsletter.pragmaticengineer.com/p/building-metas-threads-app?ref=thenexusofprivacy.net), September 2023 > "\[L\]ooking forward to ... \[w\]orking with experts to figure out how we can reshape regulations that are built for closed systems, and adapt them to more open ones" > > – [Rachel Lambert](https://www.threads.net/@rklambo/post/C01%5FIcuRJYZ?ref=thenexusofprivacy.net), Director of Product Management at Meta, December 14 Meta's under pressure from regulators all over the world – and their long-term strategy of breaking the law, stretching out the process, and then paying fines as a cost of doing business is getting increasingly expensive. A billion here, a billion there ... that's just pocket change for Meta, but newer EU laws have much bigger fines, and penalties like bans on using personal data for targeting ads and "algorithmic disgorgement" are potentially existential threats. But regulations can be influenced, and Meta – like other Big Tech companies – spends a lot of time and money working to shape regulations to their advantage. Embracing ActivityPub and the Fediverse gives Meta the opportunity to portray themselves as evolving and advocating for what's best for open systems, not just their own business. Working with the fediverse gives them the opportunity to get people who are usually critics, and have a long history of working on independent social networks and open systems, to say that at least in this area Meta's changed and are working collaboratively on a system that gives everybody more freedom. > **Update, November 2025**: [On xoxo.zone](https://neuromatch.social/@mathowie@xoxo.zone/115573164582391015?ref=thenexusofprivacy.net), Matthew Haughey says "back in 2023 when Threads launched, a friend working there said Zuck pushed everyone to create a mastodon-compatible twitter clone so they could pitch it as an open source API to distract the US govt from breaking Meta up, which ultimately worked." > > In a reply, he adds: "I heard from someone on high that they were worried about scrutiny over WhatsApp and wanted to demonstrate in public that they could instead follow an open protocol and not just build walled gardens to get the heat off the Meta breakup." Not only that, the story that (eventually) people will be able to leave Threads and take their audiences with them potentially gives Meta a counter to anti-trust regulators concerned about market dominance. For that matter, just as Microsoft subsidized Apple for a while in the 1990, and Google subsidizes Firefox to give the illusion of a competitive browser market, Meta may well find the very existence of the fediverse useful enough to support. Of course, there are ways in which regulations *do* need to evolve to adapt to open systems. Meta (and other large incumbent surveillance capitalism companies) will try to use this selfishly to reinforce their dominance. Maybe the fediverse "influencers" working with Meta will do the right thing even at the expense of their professional interests. Then again, maybe they'll just wind up repeating Meta's talking points, or hold off on criticizing Meta's position. Time will tell. > Update, October 2024: FediForum co-founder (and Social Web Foundation advisor) Johannes Ernst is quoted[ in the Washington Post](https://www.washingtonpost.com/politics/2024/10/02/meta-threads-fediverse-mosseri-mastodon-rochko/?ref=thenexusofprivacy.net) ([archive link here](https://archive.ph/o6mPt?ref=thenexusofprivacy.net)) that "Meta is actually at the forefront" of an industry transformation to "open networks." > "The European Union is coming down hard on Meta, demanding all sorts of interoperability as part of its Digital Services and Digital Market Acts. By implementing a bona-fide W3C interoperability standard as part of a new app, Meta can signal both cooperation with the EU authorities, while delaying opening its core business as long as possible." > > – Fedierse influencer Johannes Ernst, in [Why would Meta implement ActivityPub? 1½ reasons are compelling, another is not](https://reb00ted.org/tech/20230625-meta-why-activitypub/?ref=thenexusofprivacy.net), June 2023 The EU's interoperability requirements are a concrete example of how this could play out in practice. The [Digital Market Act](https://commission.europa.eu/strategy-and-policy/priorities-2019-2024/europe-fit-digital-age/digital-markets-act-ensuring-fair-and-open-digital-markets%5Fen?ref=thenexusofprivacy.net#what-does-this-mean-for-gatekeepers) (DMA) includes requirements from six large "[gatekeepers](https://www.loc.gov/item/global-legal-monitor/2023-09-25/european-union-commission-designates-six-gatekeepers-under-digital-markets-act/?ref=thenexusofprivacy.net)" – including Meta – on core platform services including social networking, and specifically requires interoperability of messaging services. Threads' integration with ActivityPub wouldn't address the messaging interoperability requirements (which apply to Messenger and WhatsApp), but as Ernst describes could still be very useful for Meta to give regulators the impression that they're moving in that direction. And as EFF's [The EU Digital Markets Act’s Interoperability Rule Addresses An Important Need, But Raises Difficult Security Problems for Encrypted Messaging](https://www.eff.org/deeplinks/2022/04/eu-digital-markets-acts-interoperability-rule-addresses-important-need-raises?ref=thenexusofprivacy.net) describes, the current regulations really do create some real issues. Meta and other gatekeepers will no doubt continue to push to weaken them, so as well as being able to use the Threads/ActivityPub integration to pretend they're acting in good faith, there's a lot of value in getting fediverse influences somewhat more likely to be on their side. > **Update, September 2024:** [Update on Native Matrix interoperability with WhatsApp](https://matrix.org/blog/2024/09/whatsapp-dma/?ref=thenexusofprivacy.net) discusses Meta's "malicious compliance" with DMA's interoperability requirements. Of course, as Meta's fediverse supporters point out, it's possible that this time will be different and Meta will decide they can exploit more effectively by providing real interoperability. Time will tell. ## Decentralized surveillance capitalism From Meta's perspective, one of the advantages to exploiting the fediverse to make Threads feel like a more compelling platform and to reshape regulation is that they can get a lot of mileage without investing much. They've got a great story, and maybe that's enough. If their early experimentation runs into problems – or if other things take priority – they can slow down the pace, blame the current state of ActivityPub or the fediverse, and come up with another story. And with a little more thought, it's easy to see other ways Meta could exploit the fediverse without a significant investment. > **Update, December 2025**: Bluesky CTO Paul Frazee notes [another way that Threads successfully exploited the Fediverse](https://bsky.app/profile/pfrazee.com/post/3macg4psbf22k?ref=thenexusofprivacy.net): "We survived it, but I do think "decentralization" was a peak interest to users in reaction to what was happening to Twitter during 2023, and Meta being able to rapidfire launch a copy & paste of instagram which copied our messaging was a rough blow"[2.5](#fn-bluesky-perspective) But if they decide it makes sense to invest more at some point, a decentralized approach could work out really well for Meta. Put the current fediverse to the side, and imagine a future of decentralized surveillance capitalism, where "Meta's fediverse" filled with instances run by brands, politicians, celebrities, influencers, and non-profits – all doing harvesting data on Meta's behalf, allows Meta to avoid responsibility and liability[2](#fn-service-providers) but continue to profit from hate groups, disinformation, and white supremacy. How cool would that be? (For Meta, that is.) The leaked information from Meta discussing "win/win monetization" partnerships with fediverse instances fits in well with this direction, most obviously with revenue share from ads, subscriptions, video-on-demand, and merchandise sales. Disney and the LA Lakers could offer premium options (and target ads) to fans! Alex Jones, the Krassenstein brothers, and other grifters could milk their base and sell supplements even more effectively than on Xitter! Since Threads doesn't plan to focus on news, it's a great opportunity for Fox News, OANN, and Breitbart! That sure sounds like something that would appeal to Zuckerberg – and to Threads' early adopters like Steve Bannon, Donald Trump Jr. and Libs of Tik Tok.[3](#fn-what-could-go-wrong) And as Don Marti points out, most targeted advertising revenue comes from a relatively small percentage of users. So Meta can also encourage less-lucrative users to migrate to instances hosted by non-profits or volunteers – potentially "a workable alternative to [pay or consent](https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price?ref=thenexusofprivacy.net) when that legal trick fails to hold up in court." It's got success written all over it! Similarly, from a moderation perspective, there really is a lot for Meta to like about a decentralized approach. For one thing, it outsources the costs – and heat from regulators – of dealing with people and organizations that are especially expensive to moderate. And if Meta actually *does* want to do a better job on moderation, a decentralized approach – allowing different countries and cultures to establish their own norms on different instances – is potentially complement to their current strategy of combining discriminatory and inaccurate AI and exploiting low-paid outsourced moderators. Of course I'm glossing over quite a few details here, and maybe Meta will decide to stick to good ol' centralized surveillance capitalism for the time being. Even if they do decide to shift to a decentralized model, ActivityPub today isn't yet a good basis for that kind of system. As fediverse influencer Evan Prodromou [points out](https://cosocial.ca/@evan/111570541403502790?ref=thenexusofprivacy.net), Meta will have a delicate balance participating in standards without taking over. So they may well wind up having to make non-standard extensions to the protocol. Oh noooo!!!!! I'm sure they hate that idea! In the longer term, they may decide that ActivityPub doesn't make sense for this more ambitious direction – just as Google initially adopted XMPP for Google Talk and then ditched it. But then again if they can help ActivityPub evolve in a way that works for them, they might well keep it. Google's embrace-and-extend strategy with gmail continues to use the SMTP protocol, and Chrome continues to support HTTP, so I could certainly imagine Meta sticking with a surveillance capitalism-friendly ActivityPub if it's useful to them. > **Update, December 2025**: Threads hasn't gone this route yet. Instead, after two years of successful exploitation (although minimal adoption) without making a significant investment, Threads head Connor Hayes told Verge that "[it’s not a top priority for the current roadmap](https://www.theverge.com/column/847806/head-of-threads-interview?ref=thenexusofprivacy.net)." Still, as Laurens Hof notes in [Fediverse Report #147](https://connectedplaces.online/reports/fediverse-report-147/?ref=thenexusofprivacy.net), Meta has"nestled themselves into the fediverse were it ever to become useful again." ## How will the fediverses respond? Meta's gonna do what Meta's gonna do. As [There are many fediverses -- and a lot of people will prefer them to Threads](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#many-fediverses) discusses, reactions to Meta are likely to cause a schism in the fediverse. mastodon.social and other large instances, along with fediverse influencers like Prodromou, are currently eager to be part of "Meta's fediverse". Many others, including the signers of the anti-Meta fedipact, will wind up in one or more "free fediverses" that don't federate with Threads. How will the different regions of the fediverse respond to Meta's embrace, extend, and exploit strategy? That's a question I wound up exploring in several other articles. Here's the list of recommendations I came up with in [Strategies for free fediverses](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) (2024 DRAFT), written not long after the original version of this article.4 - [Opposition to Meta and surveillance capitalism is an appealing position. Highlight it!](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#opposition) - [Focus on consent (including consent-based federation), privacy, and safety](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#consent) - [Emphasize networked communities](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#networked-communities) - [Support concentric federations of instances and communities](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#concentric-federations) - [Make it easier to move between (and create) instances](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#easier-moving) - [Work together with people and instances in Meta's fediverses and on Bluesky whose goals and values align with the free fediverses](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#work-together) - [Consider "transitive defederation" from instances that federate with Meta](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#transitive-defederation) - [Reduce the dependency on Mastodon](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#mastodon) - [Start moving beyond ActivityPub](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#activitypub) - [Prioritize accessibility, which is a huge opportunity](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#accessibility) - [Build a sustainable ecosystem](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#ecosystem) - [Commit to anti-fascist, anti-racist, anti-colonial, and pro-LGBTQIA2S+ principles, policies, practices, and norms for the free fediverses](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#anti-oppressive) - [Organize!](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/#organize) How much of that will actually happen? Time will tell! Stay tuned for more! ## Notes 0 As Jason [says](https://mastodon.social/@fromjason/111611379082279476?ref=thenexusofprivacy.net) as part of an excellent thread about a company he refers to as ECorp > "\[K\]illing platforms before they get too big is Ecorp's whole thing. It's what they do. > > In fact, ECorp kept an early detection system built on a VPN acquisition that specifically targeted small start ups. > > Remember that VPN for kids ECorp launched to the App Store? Then later got caught slurping data? The app one pundit called "vampiric"? Yeah, same thing. It was hunting for small apps with momentum." I have no idea who this pseudonymous ECorp might be but for some reason Jason included a link to a Wall Street Journal article on [How Facebook Squashes Competition From Startups](https://www.wsj.com/articles/the-new-copycats-how-facebook-squashes-competition-from-startups-1502293444?ref=thenexusofprivacy.net) and later in the thread to the [Kill Zone](https://bfi.uchicago.edu/wp-content/uploads/BFI%5FWP%5F202019.pdf?ref=thenexusofprivacy.net) paper that also mentions Facebook (who changed their name to Meta in hopes that people would forget about Cambridge Analytica and the genocide in Myanmar) so I figured I might as well include it in a footnote. 1 I can't stress strongly enough how good a call Threads' current plan for users to opt in to federation is this is from a privacy and safety perspective -- in fact, I really wish other fediverse platforms would emulate it. Mastodon probably won't, alas; in response to the news about Threads' plans, Mastodon founder, CEO, and BDFL (Benevolent Dictator for Life) Eugen Rochko restated his opposition to consent-based federation. Anil Dash has famously talked about the importance of the [expectation of consent in the fediverse](https://mastodon.cloud/@anildash/109312103250205663?ref=thenexusofprivacy.net), but I guess Rochko didn't get the memo. How ironic is it when Meta appears to understand consent better than open source alternative? And Mosseri did note that the decision is "somewhat controversial within the Mastodon community", so they might change their mind. We shall see. In any case, two things can be true at once: even though it's a good decision by Meta from a privacy and safety perspective if they follow through on their current plans, it also means the story they're telling isn't true. 2 US privacy laws largely exempt "service providers", as long as they follow the instructions of whatever entities they're providing a service to. **Update**, April 2024: [IAPP's cheat sheet](https://iapp.org/media/pdf/resource%5Fcenter/american%5Fprivacy%5Frights%5Fact%5Fcheat%5Fsheet.pdf?ref=thenexusofprivacy.net) on the newly-proposed American Privacy Rights Act (APRA) highlights how many of the bill's requirements don't apply to service providers. And, APRA exempts "small businesses" whose revenue is under $40,000,000 / year and process covered data of less than 200,000 people! So relatively-small for-profit fediverse instances wouldn't be subject to pesky legal requirements like only using the data for permissible purposes or getting opt-in consent for sharing or selling sensitive data ... and Meta wouldn't either, as long as they're acting as a service provider. Win/win! 2.5 **Update, Deccember 2025:**I didn't really start paying attention to Bluesky and the ATmosphere until [\>](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/)early 2024 so didn't mention the Bluesky perspective in the original version of this post. As things worked out, even though Bluesky has out-innovated Threads and for a while was growing rapidly, usage staganted in 2024 -- while Threads (if you can believe their numbers, a big caveat) has continued steady growth. That said, I don't think the "decentralization" aspect had much to do with; Bluesky has had its own growing pains and self-inflicted problems, and Threads' growth is coming from converting users of other Meta platforms. 3 In fact, speaking of Bannon and his pals, since far right social networks Gab and Truth Social are built on ActivityPub, if Threads opens up two-way federation as planned later this year they'd have a golden opportunity to try to build on the Trump campaign's successful work with Facebook on digital voter suppression in 2016, the "Stop the Steal" and coup planning in 2020, and QAnon conspiracy theory as well as Libs of Tik Tok and Moms for Liberty's work. What could possibly go wrong? 4 The [original version of this post](https://web.archive.org/web/20231227124454/https://privacy.thenexus.today/embrace-extend-and-exploit/) included some sneak previews that also looked at some key questions for fediverse instances admins. ## Update log Ongoing: typo fixes, wording clarifications, etc December 2023: [original version](https://web.archive.org/web/20231227124454/https://privacy.thenexus.today/embrace-extend-and-exploit/) April 15 2024: add [footnote on service providers](#fn-service-providers) June 7: note that Mastodon also did an embrace-and-extend of ActivityPub September 7: capitalize F in Fediverse, at least most places September 29: add updates about press coverage and Meta's malicious compliance with DMA requirements for Matrix interoperability. November 2025: add Matt Haughey's info from a friend high up at Meta; retroactively add Johannes Ernst's October 2024 Washington Post quote about Meta being "at the forefront" of the move to open networks December 2025: update after Threads' announcement they're shifting to maintenance mode, at least for now. ### Compare and contrast: Fediseer, FIRES, and The Bad Space URL: https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/ Last updated: 2026-04-16T03:11:17.000Z > [Join the discussion on the fediverse!](https://infosec.exchange/@thenexusofprivacy/111605585033303239?ref=thenexusofprivacy.net) Earlier posts in the series: - [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) - [Blocklists in the fediverse](https://thenexusofprivacy.net/blocklists-in-the-fediverse/) - [It’s possible to talk about The Bad Space without being racist or anti-trans – but it’s not as easy as it sounds](https://thenexusofprivacy.net/the-bad-space/) And here's the table of contents for this installment: - [Intro](#intro) - [Fediseer](#fediseer) - [FIRES](#fires) - [A difference in philosophies](#different-philosophies) - [Looking forward](#looking-forward) ## Intro The Bad Space is only one of the projects exploring different ways of moving beyond the fediverse's current reliance on instance-level blocking and blocklists. It's especially interesting to compare and contrast The Bad Space with two somewhat-similar projects: - [Fediseer](https://fediseer.com/faq/eng?ref=thenexusofprivacy.net) is another instance catalog, including endorsements as well as negative judgments about instances. - [FIRES](https://nivenly.discourse.group/t/fires-preliminary-questions/65/2?ref=thenexusofprivacy.net) (an acronym for Fediverse Intelligence Recommendations & Replication Endpoint Server) is infrastructure for moderation advisories and recommendations. Philosophically, one big contrast is FIRES is purely a software infrastructure project; The Bad Space and Fediseer also include a "flagship" site, with data about instances, and a web user interface for individuals. Of course, as the [FSEP proposal](https://thenexusofprivacy.net/the-bad-space/#fsep) illustrates, The Bad Space can be a starting point for additional tools, and the same's true for Fediseer, so they can also be used as infrastructure; and others can deploy the software as well, so they're not limited to the flagship. Still, FIRES' focus on infrastructure means that it's a richer platform for building a wide range of tools that fit into existing workflows. Another equally big contrast is The Bad Space is the only one of these projects with an explicit focus on protecting marginalized people – and, not so coincidentally, the only one of the projects that's done in collaboration only with instances committed to actively moderating against racism, transphobia, ableism, etc. That's not meant as a criticism of Fediseer or FIRES; their developers have also kept threats to marginalized people in mind as part of their broader focus. But they've got a different focus: Fediseer started by focusing on spam, and FIRES is intended as general-purpose infrastructure. As I'll discuss later in the article, this difference in focus has some interesting ramifications. On the other hand, there are also some important similarities. Most importantly, all of these projects reflect a separation between a database (or catalog) of information about instances and moderation decisions about whether to suspend or silence them. Blocklists, by contrast, explicitly embed a moderation decision. As The Bad Space's "heat maps" (which can be used as blocklists) illustrate, it's possible to use the data in the catalog to generate a blocklist; but as the [FSEP user-focused follower-approval tool](https://thenexusofprivacy.net/the-bad-space/#fsep) highlights, that's far from the only way to use this information. So all of these projects can help reduce today's fediverse's dependency on blocklists. That's good! So let's drill down into the details of these other projects, and then look at the impact of the difference in philosophies. ## Fediseer > "The fediseer is a service for the fediverse which attempts to provide a crowdsourced human-curated spam/ham classification of fediverse instances as well as provide a public space to specify approval/disapproval of other instances." > > – [The Fediseer FAQ](https://fediseer.com/faq/eng?ref=thenexusofprivacy.net) [Fediseer](https://fediseer.com/faq/eng?ref=thenexusofprivacy.net) started with a focus on spam, which is a huge problem on Lemmy. But spam is far from the only huge moderation problem on Lemmy, so Fediseer's general approval/disapproval mechanism (and the availability of scripts that let it automatically update lists of blocked instances) means that many instances use it to help blocking sites with CSAM (child sexual abuse material) and as a basis for blocklists. Fediseer uses a "chain of trust" model in which admins of any participating instance *guarantee* other instances, which allows them to participate. Instances can also provide *endorsements* ("completely subjective positive judgments") as well as *censures* (completely subjective negative judgments) and *hesitations* (milder versions of censures) of other instances. Judgments can include optional *reasons* (aka tags) and *evidence.* Including positive as well as negative reviews is a good example of moving beyond relying on blocklists; it's easy to imagine how this could be part of an instance recommendation tool for new users. And Fediseer also allows instances to keep their judgments private (accessible only to their friends) – extremely important functionality from a safety perspective. Fediseer's UI and API (programming interface) makes it easy to retrieve all the censures given out by one or more instances. So if all the sources for The Bad Space participated in Fediseer, then retrieving judgements only from those sources would (at least in theory) give similar results to The Bad Space.0 Fediseer's UI also makes it easy to see all the judgments that have been made on an instance. [![poa.st | Instance detail . Censures received (14) Censures were received from the following instances: Instance: lemmy.world. Reasons: homophobia, bigotry, hate speech, neonazi, fascism. Evidence: Well-known Nazi instance https://seirdy.one/posts/2023/05/02/fediverse-blocklists/](https://thenexusofprivacy.net/content/images/2023/11/Screenshot-2023-11-07-at-8.37.39-PM.png)](https://gui.fediseer.com/instances/detail/poa.st?ref=thenexusofprivacy.net) [Fediseer page for poa.st](https://gui.fediseer.com/instances/detail/poa.st?ref=thenexusofprivacy.net) (excerpts), November 2023 You can also see the judgments an instance has shared and made public. There are also lists of "safelisted" and "suspicious" instances – although this safety and suspiciousness only refers to spamming behavior, Fediseer is currently playing a very valuable role in the Lemmyverse, including making it much easier for instances to respond quickly when CSAM is detected. The most common objection I've heard to it is the risk that it could become a centralized catalog. That would be bad, but it's not clear to me that it's a realistic threat – Fediseer founder db0 is explicit that he doesn't want that to happen, and the software is open-source and so can also be used by people creating their own sites as an antitdote to centralization. On the other hand, some of Fediseer's challenges stem from its "open" approach of allowing all non-spamming instances to participate. For example, what will happen if Fediseer gets popular and harassers starting up one-person instances just to give their targets' instances bad reviews – or give other harassers' instances good reviews? Fediseer does include "mute" and a "restrict" functionality, so there are tools to stop abuse or limit the harms, but as it grows it's not at all clear how this will all actually play out in practice. Still, Fediseer's at an early stage, so it may well find ways to address these challenges. And the ability for people to host their own version means it can also be used as a basis for organizations – or groups of instances – to set up their own similar site that limits participation. ## FIRES > "Our present infrastructure of denylists (née “blocklists”) will only get us so far: we need more structured data so we can make informed decisions, we need more options for moderating than just defederating, and the ability to subscribe to changes in efficient & resumable ways." > > – Emelia Smith, [October 2023 update](https://medium.com/@thisismissem/october-2023-update-c0455aa19d2c?ref=thenexusofprivacy.net) FIRES architect Emelia Smith has a long history of working on trust and safety work in the fediverse (including contributions to Mastodon and Pixelfed as well as moderation work at Switter.at), and describes this project as "thinking two steps ahead of where we are currently." It's at an earlier stage than Fediseer or The Bad Space: Nivenly Foundation announced its sponsorship for FIRES in October (funded, like FSEP, via a direct donation from Nivenly board member Mekka Okereke), and Emelia's currently working on a detailed technical proposal. I've based this description off the information in Emelia's public updates and an early draft of the proposal – so it may well change as the project evolves! FIRES goes beyond the other tools by supporting a wide range of moderation advisories and recommendations – and providing information about how they've changed over time. The Bad Space records suspensions and silencing; Fediseer supports judgements including endorsements, censures, and hesitations; FIRES is designed to allow for much more precise specifications, for example automatically putting a CW on posts from a site (functionality supported by Akkoma and Pleroma), rejecting media, or allowing federation. And FIRES provides a log of how recommendations have changed, which is particularly important for dealing with situations where instances have cleaned up their act (so past decisions to block or silence potentially should be revisited). Another important distinction is that FIRES' recommendations and advisories aren't necessarily limited to instances. As I mentioned in [What about blocklists for individuals (instead of instances)?](https://thenexusofprivacy.net/blocklists-in-the-fediverse/#individual-blocklists), it's kind of surprising that Twitter-like blocklists and tools like [Block Party](https://www.siliconrepublic.com/enterprise/block-party-tracy-chou-twitter-safety-online-abuse?ref=privacy.thenexus.today) haven't emerged yet on the fediverse. My guess is that's likely to change in 2024, so this is a great example of thinking ahead. As Johannes Ernst mentions in [Meta/Threads Interoperating in the Fediverse Data Dialogue Meeting yesterday](https://reb00ted.org/tech/20231208-meta-threads-data-dialogue/?ref=thenexusofprivacy.net), it might well be "helpful for Fediverse instances (including Threads) to share reputation information with other instances that each instance might maintain on individual ActivityPub actors for its own purposes already." FIRES could be a good mechanism for this whether or not Threads is involved. Finally, unlike The Bad Space and Fediseer, FIRES *doesn't* have a web user interface. Instead, it's intended as the basis for small servers that provide data to various consumers – including tools with their own user interfaces, either for users or instance admins. Of course, many infrastructure projects wind up incorporating tools with user interfaces, so this might not be a long-term difference. In the short term, though, it's a choice that makes it easier to focus on the infrastructure aspects. ## A difference in philosophies From a software engineering perspective, FIRES' general infrastructure could well serve as the underpinnings for a re-implementation of Fediseer and The Bad Space – providing additional functionality like more precise information about recommendations and history. Similarly, The Bad Space could be re-implemented (with a far less colorful user interface) as an installation of Fediseer where the only participants are The Bad Space's current sources, and only censures and hesitations are tracked. And while the three projects currently have somewhat different APIs, there's no reason they couldn't converge on a standard – which would allow tools built on top of them to be interoperable. So when taken together, the projects clearly highlight some similar thinking. But those similarities are only part of the story. There's also the big contrast I discussed at the beginning of this article: The Bad Space, unlike the other projects, has an explicit focus on protecting marginalized people. At the risk of repeating myself: I certainly don't mean this as a criticism of either of the approaches! Just as it's healthy to have multiple independent implementations exploring different variations on functionality or user interface, it's healthy to have different philosophies. And since The Bad Space is open-source software, it could also be adopted by racists and transphobes who set up their own individual instance. Still, it's a very interesting contrast. Here's one example of how it manifests itself on The Bad Space and Fediseer's flagship sites: - [berserker.town's description on The Bad Space](https://tweaking.thebad.space/location/e7060984-3c4d-427c-930b-3732a1757441?ref=thenexusofprivacy.net) is currently "Hate speech, Federating with 'free speech' instances, hosting ableist, transphobic, fascist content, Edgelord", and all of The Bad Space's sources taken action against it – not surprising since it's on Seirdy's, gardenfence's, and Oliphant's Tier-0 blocklists). - [berserker.town's Fediseer page](https://gui.fediseer.com/instances/detail/berserker.town?ref=thenexusofprivacy.net), by contrast, has endorsements including "active moderators," "cool admin," and "respectful users" as well as censures including "sealioning," "harassment," and "transphobia." Opinions differ! Of course, because Fediseer API calls are filtered by specific reference instances, the specific information somebody gets about berserker.town depends on what instances they're using as a reference. - If your reference is lemmy.blahaj.zone (which describes itself as "very protective of our minority members and bigotry of any variety will be squashed with great prejudice"), you'll see a censure. - If your reference is qoto.org (whose about page includes "we won’t censor unpopular ideas and statements"), you'll see an endorsement. One way to look at this is by crowdsourcing from a larger crowd (anybody running an instance, as opposed to The Bad Space's small number of sources), Fediseer provides more recommendations that are useful to a broader range of people – which could well lead to broader adoption. As db0 said in a discussion of an earlier draft of this article, > "My thought is that the "bad" aspect of the fediseer open design (the potential to platform bigots) is minimized by the reference-based model and overshadowed by the benefits of being able to provide the tbs functionality for a wider audience." People on instances that show up on The Bad Space may well be more accepting of Fediseer because it presents both sides, including endorsements of their instances as well as critiques. This is epecially true for racists and "freeze peach" absolutists who hate The Bad Space because it focuses on letting people protect themselves from racist instances, and people who have critiqued The Bad Space during the recent [messy discussions](https://thenexusofprivacy.net/the-bad-space/#just-messy). Fediseer's also better suited than The Bad Space for people who want to find instances with "cool admins" even if they're widely blocked for harassment and transphobia. But then again, this value-neutral "open" approach means platforming the opinions of nazis, white supremacists, terfs, racists, and misogynists (as long as they avoid engaging in hate speech or harassment *on Fediseer*). From the perspective of marginalized people these groups target, "more recommendations" isn't necessarily better, and curated systems like The Bad Space may well be more attractive. As Fediseer expands outside the Lemmyverse, how many instances moderated from an anti-racist perspective will decide to participate? Another way this difference in philosophy manifests itself: - The Bad Space provides narrowly-focused information (to individuals as well as admins) about thousands of instances that cause harm, so most of the value goes to marginalized people who would otherwise be targeted by those instances. - Fediseer provides much broader information – anti-spam, endorsements, and instances who some see as moderating overly-agressively as well as instances that cause harm – so a smaller percentage of the value goes to marginalized people. And fediseer chose not to leverage existing blocklist and #Fediblock data, so has information about a smaller number of instances (hundreds rather than thousands. Since there's less data available, it provides less protection from instances targeting marginalized people. - FIRES is pure infrastructure, so relies on intermediaries to deliver value to admins and end users. Of course intermediaries might choose to prioritize protecting marginalized users, but then again they might not. FIRES itself takes no stance either way. And yet another example relates to the question of how to ensure that marginalized perspectives are taken into account in the information that's provided? For The Bad Space, it's by the choice of sources: instances that moderate from an anti-oppressive perspective, most of which are led by trans and queer people. This certainly isn't a perfect answer but at least it's an answer! For FIRES and Fediseer, by contrast, this question is basically outside of the scope of the project – it's up to whoever's querying Fediseer or building tools on FIRES infrastructure to either incorporate marginalized perspectives or not, and there isn't any functionality to make it easier or harder to do so. ## Looking forward The Bad Space and Fediseer both have some initial traction, and as FIRES moves forward I'd expect it to get adoption as well. Even though there are already several decent solutions for instances and individuals that just want a “worst-of-the-worst” blocklist (including Seirdy’s FediNuke, gardenfence, and Oliphants’ Tier0), but after [the messy discussions around The Bad Space and FSEP](https://thenexusofprivacy.net/the-bad-space/#just-messy) there's broad awareness of the limitations and downsides of relying too much on instance-level blocklists. Even in their current form, these projects have a lot of value. For example, individuals who are at risk because their instance's blocklists don't protect them are very likely to find The Bad Space quite useful, for screening follow requests and as their own personal blocklist. Over time, it'll be interesting to see how the projects evolve and what tools are built on top of them. The projects have enough similarities that there are some major potential synergies – and are different enough that they're likely to prove valuable in different ways. Of course, instance catalogs and reputation systems are only one aspect of the improvements that are needed to create a safer fediverse. I'll discuss some of the others in the next installment of the series, tentative titled *Steps to safer fediverses.* Also still to come: a discussion of the golden opportunities for the fediverse – and whatever comes next. Some sneak previews: *But these tools are only the start of what's needed to change the dynamic more completely. To start with, fediverse developers, "influencers," admins, and funders need to start prioritizing investments in safety. The* [*IFTAS Fediverse Moderator Needs Assessment Results*](https://cryptpad.fr/file/?ref=thenexusofprivacy.net#/2/file/kW2UN6MqNvDRVOkFm3ba+zCo/) *highlight one good place to start: provide resources for anti-racist and intersectional moderation. Sharing and distilling "positive deviance" examples of instances that do a good job, documentation of best practices, training, mentoring, templates for policies and process, workshops, and cross-instance teams of expert moderators who can provide help in tricky situations. Resources developed and delivered with funded involvement of multiply-marginalized people who are the targets of so much of this harassment today are likely to be the most effective.* --- *Plenty of people in today's fediverse are just fine with its white-dominated and cis-dominated power structure – or say they want something different but in practice don't act that way. So maybe we'll see a split, with a region of the fediverses moving in an anti-racist, pro-LGBTAIQ2S+ and "safety by default" direction. As I said about another potential split in* [*There are many fediverses*](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#many-fediverses)*, if it happens, it'll be a good thing.* *Or who knows, maybe we'll see a bunch of anti-racist and pro-LGBTAIQ2S+ instances saying fine, whatever, bye-bye fediverse, it's time to do something else. If it happens, that too will be a good thing.* ## Notes 0 Assuming that suspending is treated as a censure and silencing as a hesitation. ### It's possible to talk about The Bad Space without being racist or anti-trans – but it's not as easy as it sounds URL: https://thenexusofprivacy.net/the-bad-space/ Last updated: 2026-04-16T03:10:53.000Z > The title applies to me as well, and I've probably said some things badly in this article. Apologies in advance. I'll update the post as problems surface. ![](https://thenexusofprivacy.net/content/images/2023/11/what-is-the-bad-space-2.png) [tweaking.thebad.space/about](https://tweaking.thebad.space/about?ref=thenexusofprivacy.net), November 2023 The problem The Bad Space is focusing on is certainly a critical one. As I said in [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) (the first post in this series) > "The 1.25 million active users in today's fediverse are spread across more than 20,000 *instances* (aka *servers*) running a wide variety of software. On instances with active and skilled moderators and admins it can be a great experience. But not all instances are like that. Some are bad instances, filled with nazis, racists, misogynists, anti-LGBTQIA2S+ haters[1](#fn-lgbtaiq2s), anti-Semites, Islamophobes, and/or harassers. And even on the vast majority of instances whose policies prohibit racism (etc.), relatively few of the moderators in today's fediverse have much experience with anti-racist or intersectional moderation – so very often racism (etc.) is ignored or tolerated when it inevitably happens." ‌ As Lady pointed out in November 2022, [this isn't a new problem](https://indieweb.social/@Lady@cat.family/109392504959055915?ref=thenexusofprivacy.net). > "bad instances have always existed and every good thing about the fediverse today was hard-fought and hard-won. making it better will mean more work, fighting, and winning" Over the years, innovations like [instance-level blocking](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/#blunt-but-powerful) and #fediblock have helped make progress. But as the [widespread racist and anti-trans bigotry and harassment](#just-messy) in the messy discussions of The Bad Space over the last few months highlights, there's still a lot more work needed – and a lot more fighting. Ro's certainly got the right background to work on fediverse safety tools. As well as coding skills and years of experience in the fediverse, he and Artist Marcia X were admins of Play Vicious, which as one of the few Black-led instances in the fediverse was the target of [vicious harassment](https://www.artistmarciax.com/post/ecosystems-of-abuse?ref=thenexusofprivacy.net) until it shut down in 2020\. And The Bad Space's approach of designing from the perspective of marginalized communities is a great path to creating a fediverse that's safer and more appealing for everybody (well except for harassers, racists, fascists, and terfs – but that's a good thing). As Afsenah Rigot says in [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=privacy.thenexus.today) > "After all, when your most at-risk and disenfranchised are covered by your product, we are all covered."‌ The Bad Space is still at an early stage, and like all early-stage software has bugs and limitations. Many of the sites listed don't have descriptions; some of the descriptions may be out-of-date; there's no obvious appeals process for sites that think they shouldn't be listed. A [mid-September bug](#messy-discussions) led to some instances being listed by mistake, and the user interface at the time didn't provide any information about whether instances were limited (aka silenced) or suspended (aka defederated) by other instances. The bug's been fixed, the UI's been improved ... but of course there may well be other false positives, bugs, etc etc etc. It's software! Still, The Bad Space is useful today, and has the potential to be the basis of other useful safety tools – for Mastodon and the rest of the fediverse,[2](#fn-platforms) and potentially for other decentralized social networks as well. Many people *did* find ways to have productive discussions about The Bad Space without being racist or anti-trans, highlighting areas for improvement and potential future tools. So from that perspective quite a few people (including me) see it as off to a promising start. [![post by amy bones (@amy): Part of why I know that the bad space is good is because I've built safety tools before. I know what the development of these things look like. They're messy because they're dealing with something messy. #TheBadSpace right now is what the beginning of organizing really good safety tools looks like. 9/14/2023](https://thenexusofprivacy.net/content/images/2023/11/Screenshot-2023-11-08-at-9.36.34-PM.png)](https://spookygirl.boo/notes/9jn3w32vmk00eini?ref=thenexusofprivacy.net) Then again, opinions differ. For example, some of the posts I'll discuss in an upcomiung installment of this series (tentatively titled *Racialized disinformation and misinformation: a fediverse case study*) describe The Bad Space as "pure concentrated transphobia" that "people want to hardcode into new Mastodon installations" in a plot involving somebody who's very likely a "right wing troll" working with an "AI art foundation aiming to police Mastodon" as part of a "deliberate attempt to silence LGBTQ+ voices." Alarming if true! > "\[D\]isinformation in the current age is highly sophisticated in terms of how effectively a kernel of truth can be twisted, exaggerated, and then used to amplify and spread lies." > > – Shireen Mitchell of Stop Online Violence Against Women, in [Disinformation: A Racist Tactic, from Slave Revolts to Elections](https://blog.ucsusa.org/guest-commentary/disinformation-a-racist-tactic-from-slave-revolts-to-elections/?ref=thenexusofprivacy.net) ### Another way to look at it ... At the same time, the messy discussions around The Bad Space are also a case study of the resistance in today's fediverse to technology created by a Black person (working with a diverse team of collaborators that includes trans and queer people) that allows people to better protect themselves.[3](#fn-resistance) Many people misleadingly describe reactions to The Bad Space in terms of tensions between trans people and Black people – and coincidentally enough that's just how just the pair of wildly inaccurate but very popular neocities posts I'll discuss in an upcoming installment on racialized disinformation and misinformation frames it, too.[4](#fn-not-coincidental) That's unfortunate in many ways. For one thing, Black trans people exist. Also, the "Black vs. trans" framing ignores the differences between trans femmes, trans mascs, and agender people. And the alternate framing of tensions between white trans femmes and Black people is no better, erasing trans people who are neither white nor Black,[5](#fn-thanks) multiracial trans people, white agender people, white trans mascs (and many others) while ignoring the impact of cis white people, colorism, ableism, etc etc etc. Besides, none of these communities are monolithic. There's a range of opinion on The Bad Space in Black communities, trans communities, and different intersectional perspectives (white trans femmes, disabled trans people) – a continuum between some people helping create it and/or actively supporting it, others strongly opposing it, with many somewhere in between. More positively though, these dynamics – and the racist and anti-trans language in the discussions about The Bad Space – also make it a good case study of how cis white supremacy creates wedges (and the appearance of wedges) between and within marginalized groups – and erases people at the intersections and falling through. And with luck it'll also turn out to be a larger case study about how anti-racist and pro-LGBTAIQ2S+ people work together as part of an intersectional coalition to create something that's very different from today's fediverse. [![](https://thenexusofprivacy.net/content/images/2023/11/Screenshot-2023-11-07-at-8.28.54-PM.png)](https://nitter.net/digitalsista/status/439931932408025088?ref=thenexusofprivacy.net) The fediverse's technology problems *do* need to be fixed, and I'll return to that in an upcoming installment in this series. But if the fediverse – or a fork of today's fediverse – is going to move forward in an anti-racist and pro-LGBTAIQ2S+ direction, understanding these dynamics are vital. And whether or not the fediverse moves forward and fixes its technology problems ... well, understanding these dynamics is vital for whatever comes next, because these same problems occur on every social network platform. So there's a lot going on here, which means this is going to be a long post. Here's an outline: - [The Bad Space and FSEP](#the-bad-space) - [A bug leads to messy discussions, some of which are productive](#messy-discussions) - [Nobody's perfect in situations like this](#nobodys-perfect) - [These discussions aren't occurring in a vacuum](#not-in-a-vacuum) - [Also: Black trans, queer, and non-binary people exist](#exist) ## The Bad Space and FSEP > "The Bad Space is a collaboration of instances committed to actively moderating against racism, sexism, heterosexism, transphobia, ableism, casteism, or religion." > > – The Bad Space's [About](https://tweaking.thebad.space/about?ref=thenexusofprivacy.net) page The work-in-progress version of The Bad Space's web site (currently at [tweaking.thebad.space](https://tweaking.thebad.space/?ref=thenexusofprivacy.net) provides a web interface that makes it easy to look up an instance to see whether concerns have been raised about its moderation, and an API (application programming interface) making the information available to software as well. The Bad Space's instance catalog currently has over 3300 entries – roughly 14% of the 24,000+ instances in today's fediverse. Entries are added using the blocklists of multiple *sources* as input. Here's how the [about](https://tweaking.thebad.space/about?ref=thenexusofprivacy.net#how) page describes it: > "These instances have permitted The Bad Space to read their respective blocklists to create a composite directory of sites tagged for the behavior above that can be searched and, through a public API, can be integrated into external services." An instance appears on The Bad Space if it's on the blocklists of at least two of the sources. The web interface and API make it easy to see how many sources have silenced or defederated an instance. Other information potentially available for each instance includes a description and links to screens for receipts; screens are not currently available on the public site, and only a subset of instances currently have descriptions. Here's what the page for one well-known bad actor looks like. ![POA ST. Description: Hate speech, Racism, Moderation / safety concerns., Hate Speech, Nazi content. Total Actions: 8/9. Suspended: 7. Silenced: 1](https://thenexusofprivacy.net/content/images/2023/11/Screenshot-2023-11-07-at-8.41.40-PM.png) [The Bad Space page for poa.st](https://tweaking.thebad.space/location/5192e5ab-5c0b-40ed-8cf1-41bdd177c934?ref=thenexusofprivacy.net) (excerpts), November 2023 The Bad Space also provides downloadable "heat rating" files, showing instances that have been acted on by some percentage of the sources. As of late November October, the 90% heat rating lists 131 instances, and has descriptions for the vast majority. The 50% heat rating lists 650+, and the 20% heat rating (2 or more) has over 1600\. ### FSEP The [Federation Safety Enhancement Project (FSEP)](https://nivenly.org/docs/papers/fsep/?ref=thenexusofprivacy.net) requirements document (authored by Ro, and funded by Nivenly Foundation via a direct donation Nivenly board member Mekka Okereke) provides a couple of examples of how The Bad Space could be leveraged to improve safety on the fediverse.[8](#fn-fsep-status) One is a tool that gives individual users the ability to vet incoming connection requests to validate that they are not from problematic sites. ![Image of a mock user interface with a follow request. The follow requests indicate which are from federating users and which is from a user from a moderated instance and a public reason for moderation. ](https://thenexusofprivacy.net/content/images/2023/10/Screenshot-2023-09-30-at-11.36.55-PM.png) "Following UI Integration", from [FSEP proposal](https://nivenly.org/docs/papers/fsep/?ref=thenexusofprivacy.net) This matters from a safety perspective because if somebody follows you they can see your followers-only posts. People who value their privacy – and/or are the likely targets of harassment or hate speech and don't want to let just anybody follow them – can turn off the "Automatically accept new followers" option in their profile if they're using the web interface (although Mastodon's default app doesn't allow this, another great example of Mastodon not giving people tools to protect each other). FSEP goes further by providing users with information about the instance the follow request is coming from – useful information if they're coming from an instance that has a track record of bad behavior. The other tools discussed in FSEP help admins manage blocklists, and address weaknesses in current fediverse support for blocklists.[9](#fn-fsep-blocklists) As [Blocklists in the fediverse](https://thenexusofprivacy.net/blocklists-in-the-fediverse/) discusses at length, blocklists can have significant downsides; but in the absence of other good tools for dealing with harassment and abuse, the fediverse currently relies on them. FSEP's "following UI" is a great example of the kind of tool that complements blocklists, but the need isn't likely to go away anytime soon. While FSEP's proposed design allows blocklists from arbitrary sources, the implementation plan proposed initially using information from The Bad Space's catalog to fill that role in the minimum viable product ([MVP](https://en.wikipedia.org/wiki/Minimum%5Fviable%5Fproduct?ref=thenexusofprivacy.net)). But sometimes products never get beyond the MVP. So what would happens if FSEP gets implemented, and then adopted as a default by the entire fediverse, and never gets to the stage of adding another source for blocklists? Realistically, of course, there's no chance this will happen. The Bad Space includes mastodon.social on its default blocklist – and mastodon.social is run by Mastodon gGmbH, who also maintains the Mastodon code base. Mastodon's not going to adopt a default blocklist that blocks mastodon.social, and Mastodon is currently over 80% of the fediverse. So The Bad Space isn't going to get adopted as a default by the entire fediverse. ***But what if it did?????????*** ## A bug leads to messy discussions, some of which are productive The alpha version of The Bad Space had been available for a while (I remember looking up an instance on it early in the summer after an unpleasant interaction with a racist user), and the conversations about it were relatively positive. The FSEP requirements doc was published in mid-August, and got some feedback, but there wasn't a lot of broad discussion of it. That all changed after the mid-September bug, which led to dozens of sites temporarily getting listed on The Bad Space by mistake – including girlcock.club (an instance run by trans women for trans folk) and tech.lgbt. Of course when it was first noticed nobody knew it was a bug. And other trans- and queer-friendly sites also appeared on the The Bad Space. Especially given the ways Twitter blocklists had impacted the trans community, it's not surprising that this very quickly led to a lot of discussion. Even though nobody was using The Bad Space as a blocklist at the time, the bug certainly highlights the potential risks of using automatically-generated blocklists without double-checking. If an instance *had* been using "every instance listed on The Bad Space" as a blocklist, then thousands of connections would have been severed without notice – and instance-level defederation on Mastodon currently doesn't allow connections to be re-established if the defederation happens by mistake, so it would have been hard to recover. ### Sometimes, messiness can be productive Ro quickly acknowledged the bug and started working on a fix. A helpful admin quickly connected with the source that had limited girlcock.club because of "unfortunate branding" and resolved the issue – and the source was removed from The Bad Space's "trusted source" list. A week later Ro deployed a new version of the code that fixed the bug, and soon after that implemented UI improvements that provide additional information about how many of the sources have take action against a specific instance and which actions have been taken. From a software engineering perspective, this kind of messiness can be productive. Many people found ways to raise questions about, criticisms of, and suggestions for improvements to FSEP and The Bad Space *without* saying racist or anti-trans things. [dclements' detailed questions on github](https://github.com/nivenly/community/discussions/4?ref=thenexusofprivacy.net) are an excellent example, and I saw lots of other good discussion in the fediverse as well. Discussions about bugs can highlight patterns[10](#fn-similar-bugs) and point to opportunities for improvements. For example, bugs aren't the only reason that entries are likely to appear on blocklists by mistake; other blocklists have had similar problems. What's a good appeal process? How to reduce the impact of mistakes? In a [github](https://github.com/nivenly/community/discussions/4?ref=thenexusofprivacy.net#discussioncomment-7019830) discussion, Rich Felker suggested that blocklist management tools should have safeguards to prevent automated block actions from severing relationships without notice. If something like that is implemented, it'll help people using *any* blocklist. But as interesting as the software engineering aspects are to some of us, much more of the discussion focused on the question of whether the presence of multiple queer and trans instances on The Bad Space reflect bias – or transphobia. As [Identifying bias in blocklists](https://thenexusofprivacy.net/blocklists-in-the-fediverse/#bias) discusses, these kinds of questions are important to take into account on any blocklist – just as biases against Black, Indigenous, Muslim, Jewish, and disabled people need to be considered (as well as intersectional biases). It's a hard question to answer! > "When trying to analyze a blocklist for bias against trans people, for example, there's no census of the demographics of instances in the fediverse, so it's not clear how to determine whether trans-led instances are overrepresented. The outsized role of large instances like mastodon.social that are sources of a lot of racism (etc) is another example; if a blocklist *doesn't* block mastodon.social, does that mean it's inherently biased against Black people? When looking at whether a blocklist is biased against Jews or Muslims, whose definitions of anti-Semitism get used? What about situations where differing norms (for example whether spamming #FediBlock as grounds for defederation, or whether certain jokes are racist or just good clean fun) disproportionately affect BIPOC and/or trans people? In some alternate universe this too could have been a mostly productively messy discussion. Bias and discrimination really are hard and important problem – and not just for blocklists, for recommendation systems in general – and the fediverse is home to experts in algorithmic analysis and bias like Timnit Gebru and Alex Hanna of Distributed AI Research Center, Damien P. Williams, Emily Bender as well as lots people with a lot of first-hand experience. But alas, in this universe today's fediverse is not particularly good at having discussions like this. As Seirdy [notes](https://pleroma.envs.net/objects/5069e469-a3a9-420b-966b-89e4e88311c0?ref=thenexusofprivacy.net). > "If you wanted to make a point that queer instances are over-represented, you’d presumably show that they make up a disproportionate share. **You could do this** and probably succeed, even if you found some ways to address the need to [balance monthly-active-users represented against number-of-instances represented](https://en.wikipedia.org/wiki/United%5FStates%5FElectoral%5FCollege?ref=thenexusofprivacy.net#Apportionment) as well as instance history (e.g. instance A is an offshoot of instance B; instance C shut down and prompted the creation of instances D and E. should any of these be counted collectively?). But numbers aren’t as persuasive as going through a bunch of instances, one after another, guessing at the reasons they were blocked." ### Sometimes messiness is just messy It might still turn out that this part of this discussion becomes productive ... for now let's just say the jury's out. It sure is messy though. For example: - racists (including folks who have been harassing Ro and other Black people for years) taking the opportunity to harass Ro and other Black people - a post that tech.lgbt's [Retrospective On thebad.space Situation](https://info.tech.lgbt/2023/10/13/thebadspace-situation.html?ref=thenexusofprivacy.net) describes as being made in a state of "unfettered panic" left out "various critical but obscure details" and "unwittingly provided additional credibility" for the racist harassment campaign. - waves of anti-Black and anti-trans language – and [racialized disinformation and misinformation](#racalized-disino) (including the wildly misleading anonymous and pseudonymous post discussed in footnote [4](#fn-not-coincidental)) swept though the fediverse. - a distributed denial of service (DDOS) attack targeting Ro's site and The Bad Space) - instances (including some led by trans and queer people) who saw The Bad Space as a self-defense tool for Black people and Ro and other Black people as the target of racist harassment defederating from instances where moderators and admins allowed, participated in, or enabled attacks – which people who saw The Bad Space as "pure concentrated transphobia" took as unjust and an attempt to isolate trans and queer people. It still isn't clear who was behind the DDOS and anonymous and pseudonymous racialized disinfo. For the DDOS, my guess is that it was some of the people who harassed PlayVicious in the past and/or nazis, terfs, and white supremacists trying to drive wedges between Black people and trans people and block an effort to reduce racism in the fediverse. With the DDOS attack, for example, they were probably hoping that Black supporters of The Bad Space would blame trans critics, and the trans critics would blame Ro or his supporters for a "false flag" operation to garner sympathy for his cause. But who knows, maybe it really *was* over-zealous critics – or channers doing it for the lulz. ## Nobody's perfect in situations like this In fraught and emotional situations like this, it's very easy for people to say things that echo racist and/or transphobic stereotypes and dogwhistles, come from a place of privilege and entitlement, embed double standards, or reflect underlying racist, anti-trans, and transmisogynistic assumptions that so many of us (certainly including me!) have absorbed without realizing. As Seirdy said during another round of messy discussions in [December 2024](https://pleroma.envs.net/objects/74369bca-c38f-4ec5-922b-7297b7c2fa49?ref=thenexusofprivacy.net), > "TBS supporters tend to whitewash those who oppose it; TBS opposers tend to remove the queer identies of its supporters to separate them from “Queer Fedi”." The anti-trans and anti-queer language I saw came from a variety of sources, from opportunistic bigots as well to well-intentioned people expressing opinions about The Bad Space in anti-trans ways. Some supporters or critics of The Bad Space making statements attacking or erasing trans and queer critics or supporters, or trans people in general. Calling white trans people out on their racism isn't anti-trans; using dogwhistles, stereotypes, or other problematic language while doing so is,. Suggesting that trans and queer supporters of The Bad Space are ignoring or mimimizig the potential harms to trans people isn't anti-trans or anti-queer; suggesting that trans people who support The Bad Space "aren't really trans" and queer people who support it aren't part of "Queer Fedi" (or implying that no trans people support The Bad Space) erasing trans and queer identities, so it *is* anti-trans and anti-queer. So is calling somebody a "theyfab". By contrast, the anti-Black language I saw was primarily from people opposing The Bad Space (or impersonating a supporter) – although opportunistic racist bigots got involved as well. Some was blatant, although not necessarily intentional: stereotypes, amplifying false accusations, dogwhistles and veiled slurs. Another common form was criticisms of The Bad Space that don't acknowledge (or just pay lip service to) Black people's legitimate need to protect themselves on the fediverse, reflecting a racist societal assumption that Black people's safety has less value than white people's comfort. Black people (including Black trans, queer, and non-binary people) have been the target of vicious harassment for years on Mastodon and the fediverse, so no matter the intent, accusations that Ro or The Bad Space are *causing* division and hate ignore the fediverse's long history of whiteness and racism – and blame a Black person or Black-led project. And some people managed to be anti-Black and anti-trans simultaneously. One especially clear example: a false accusation about a Black trans person, inaccurately claiming they had gotten a white person fired for criticizing The Bad Space.[11](#fn-false-accusation) A false accusation against a Black person is anti-Black; a false accusation against a trans person is anti-trans; a false accusation against a Black trans person is both. Just as in past waves of intense anti-Blackness in the fediverse, one incident built on another. The false accusation occurred after weeks of anti-Black harassment by multiple people on the harasser's instance (with the admin refusing to take action). When the Black trans person who had been falsely accused made a bluntly worded post warning the harassers to knock it off or there would be consequences, the the false accuser made a lengthy blog post admitting that it was a false accusation, but described the bluntly-worded post telling him to knock it off as an unprovoked "death threat" – and demanded that other Black and trans people criticize the Black trans person who was trying to end the harassment. It's almost like they think Black trans people don't have the right to protect themselves! And Black people are stereotypically associated with danger and violence, so it's not surprising many who only saw the decontextualized claim of an unprovoked "death threat" assumed it was the whole story and proceeded to amplify the anti-Black, anti-trans framing.[12](#late-2024) Nobody's perfect in situations like this. While some people making unintentionally unfortunate anti-trans or anti-Black statements acknowledged the problems and apologized, you can't unring a bell. And many *didn't* acknowledge the problems or apologize, or apologized but continued making unfortunate statements, at which point you really have to question just how "unintentional" they were. And it's complex ... in situations where people are being harassed, I can certainly see why they don't want to apologize to their harasser. So yeah. The discussions were, and are, messy. ## These discussions aren't occurring in a vacuum > "Until we admit that white queers were part of the initial Mastodon "HOA" squad that helped run the initial Black Twitter diaspora off the site - and are also complicit in the abuse targeted at the person in question here - we're not going to make real progress." > > –[ Dana Fried](https://mastodon.social/@tess/111056758408601642?ref=thenexusofprivacy.net), September 13 The fediverse has a long history of racism, *and* of marginalizing trans people; see Dr. Johnathan Flowers' [ The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) or my [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy),[ ](https://thenexusofprivacy.net/mastodon-a-partial-history/#a-breaking-point-for-the-queer-community) [The patterns continue ...](https://thenexusofprivacy.net/mastodon-a-partial-history/#the-patterns-continue), and[ Ongoing contributions – often without credit](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net#ongoing-contributions-often-without-credit) for some of it. And some of the racism has come from white queer and trans people. Margaret Kibi's[ The Beginnings](https://www.u2764.com/NFIC/2018-09-09/fringe-beginnings/?ref=privacy.thenexus.today), for example, describes how soon after content warnings (CWs) were first introduced in 2017 > "this community standard was weaponized, as white, trans users—who, for the record, posted un‐CWed trans shit in their timeline all the time—started taking it to the mentions of people of colour whenever the subject of race came up." And the fediverse is still dealing with the aftermath of the Play Vicious episode. Here's how weirder.earth's [Goodbye Playvicious.social](http://weirderearth.de/goodbyepv.html?ref=privacy.thenexus.today) statement from early 2021 describes it: > "Playvicious was harrassed off the Fediverse.... The Fediverse is anti-Black. That doesn't mean every single person in it is intentionally anti-Black, but the structure of the Fediverse works in a way that harrassment can go on and on and it is often not visible to people who aren't at the receiving end of it. People whom "everyone likes" get away with a ton of stuff before finally \*some\* instances will isolate their circles. Always not all. And a lot of harrassment is going on behind the scenes, too." As Artist Marcia X says in [Ecosystems of Abuse](https://www.artistmarciax.com/post/ecosystems-of-abuse?ref=privacy.thenexus.today), > “Misgendering, white women/femmes making comments to Black men that make them uncomfortable, the politics of white passing people as they engage with darker folks, and slurs as they are used intracommunally—these are not easy topics but at some point, they do become necessary to discuss.” ## Also: Black trans, queer, and non-binary people exist > "\[T\]he Black vs. Trans argument really pisses me off because it erases Black Trans people like me, but is also based on the assumption of Trans whiteness" > > –[ Terra Kestrel](https://chaosfem.tw/@Terra/111053776257873582?ref=thenexusofprivacy.net), September 12 Black trans, queer, and non-binary people are at the intersection of the fediverse's long history of racism *and* of marginalizing trans people – as well as marginalization within queer communities and in society as a whole. One way this marginalization manifests itself is by erasure. How many of the people criticizing The Bad Space as anti-trans, or framing the discussions as pitting Black people's need to protect themselves as in tension with trans people's concern about being targeted, even acknowledged the existence of Black trans people? > "I think if you included Black trans folk and anti-racist white trans folk in your list of "trans folk to listen to," you'd have a more complete picture, and you'd understand why there are so few Black people on the Fediverse." > > – [Mekka Okereke](https://hachyderm.io/@mekkaokereke/111058560490033134?ref=thenexusofprivacy.net), September 13 Black trans, queer, and non-binary people have lived experience with anti-Blackness as well as transphobia. They also have lived experience with intersectional and intra-community oppressions: racism and transphobia in LGBTQIA2S+ communities, transphobia and colorism in Black communities. And they're the ones who are most affected by transphobia in society. For example, trans people in general face a significantly higher risk of violence – and over 50% of the trans people killed each year are Black. Trans people on average don't live as long as cis people – and Black trans and non-binary people are significantly more likely to die than White trans and non-binary people. Of course, no community is monolithic, and there are a range of opinions on Ro and The Bad Space from Black trans, queer, and non-binary people. That said, most if not all the Black trans, queer, and non-binary people I've seen expressing opinions publicly have expressed support for Ro and his efforts with The Bad Space, while also acknowledging the need for improvements. > "To be completely honest, any discussions about transphobia and the recent meta? > > That has to come from Black trans and nonbinary folks." > > – [TakeV](https://solarpunk.moe/@TakeV/111076654282453719?ref=thenexusofprivacy.net), September 16 ## To be continued! The discussion continues in - [Compare and contrast: Fediseer, FIRES, and The Bad Space](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/) - [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/) - Racialized disinformation and misinformation: a fediverse case study - A golden opportunity for the fediverse – and whatever comes next Some sneak previews: - *Racialized *mis*information is false or misleading communication or propaganda – typically about racial or social justice issues – that deceives or manipulates people and sustains white supremacy.* - *Racialized *dis*information is racialized misinformation that's *intentionally* false or misleading, or done for the purpose of achieving profit or political gain.* *Key tactics used in racialized disinfo also show up in racialized misinfo.* ... [*Fediseer*](https://fediseer.com/faq/eng?ref=thenexusofprivacy.net)*, like The Bad Space, is a catalog of instances that can be accessed via a web user interface or programmatically via an API. It started with a focus on spam, which is a huge problem on Lemmy. But spam is far from the only huge moderation problem on Lemmy, so Fediseer's general approval/disapproval mechanism (and the availability of scripts that let it automatically update lists of blocked instances) means that many instances use it to help blocking sites with CSAM (child sexual abuse material) and as a basis for blocklists.* ... *But these tools are only the start of what's needed to change the dynamic more completely. To start with, fediverse developers, "influencers," admins, and funders need to start prioritizing investments in safety. The* [*IFTAS Fediverse Moderator Needs Assessment Results*](https://cryptpad.fr/file/?ref=thenexusofprivacy.net#/2/file/kW2UN6MqNvDRVOkFm3ba+zCo/) *highlight one good place to start: provide resources for anti-racist and intersectional moderation. Sharing and distilling "positive deviance" examples of instances that do a good job, documentation of best practices, training, mentoring, templates for policies and process, workshops, and cross-instance teams of expert moderators who can provide help in tricky situations. Resources developed and delivered with funded involvement of multiply-marginalized people who are the targets of so much of this harassment today are likely to be the most effective.* > To see new installments as they're published, follow [@thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) or [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/#/portal/signup). ## Notes 1 I'm using LGBTQIA2S+ as a shorthand for lesbian, gay, gender non-conforming, genderqueer, bi, trans, queer, intersex, asexual, agender, [two-sprit](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today), and others who are not straight, cis, and heteronormative. [Julia Serrano's trans, gender, sexuality, and activism glossary](https://www.juliaserano.com/terminology.html?ref=privacy.thenexus.today) has definitions for most of terms, and discusses the tensions between ever-growing and always incomplete acronyms and more abstract terms like "gender and sexual minorities". [OACAS Library Guides' Two-spirit identities page](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today) goes into more detail on this often-overlooked intersectional aspect of non-cis identity. 2 Today, Mastodon has by far the largest installed base in the fediverse but (as I'll discuss in the upcoming Mastodon: the partial history continues) is likely to lose its dominant position. Other platforms like Streams, Akkoma, Bonfire, and GoToSocial have devoted more thought to privacy and other aspects of safety, and big players are getting involved – like [WordPress, who recently released now offers official support for ActivityPub](https://www.theverge.com/2023/10/11/23913278/wordpress-activitypub-official-plugin-automattic-fediverse-mastodon?ref=thenexusofprivacy.net). That said, The Bad Space and FSEP also fit in well with the architectural vision new Mastodon CTO Renaud Chaput sketches in [Evolving Mastodon’s Trust & Safety Features](http://www.renchap.com/blog/post/evolving%5Fmastodon%5Ftrust%5Fand%5Fsafety/?ref=thenexusofprivacy.net), so will be useful for instances running Mastodon as well. Mastodon – or a fork – has an opportunity to complement these tools by with giving individuals more ability to protect themselves, shifting to a "safety by default" philosophy, adding quote boosts, and integrating ideas from other decentralized networks like BlackSky. 3 From this perspective, the reaction to The Bad Space is an interesting complement to the multi-year history of Mastodon's refusal to support local-only posts, a safety tool created by trans and queer people that allows trans and queer people (and everybody else) to better protect themselves. Hey wait a second, I'm noticing a pattern here! [Does Mastodon really prioritize stopping harassment?](https://thenexusofprivacy.net/mastodon-a-partial-history/#does-mastodon-really-prioritize-stopping-harassment) has more -- although note that the Glitch and Hometown forks of Mastodon, and most other fediverse platforms, do support local-only posts. 4 OK it's not really coincidental. As [Disinfo Defense League](https://www.disinfodefenseleague.org/?ref=thenexusofprivacy.net) points out, using wedge issues to divide groups is a common tactic of racialized disinformation. The neocities posts also used other common disinfo tactics. For example, an anonymous post that purported to analyze the accuracy of The Bad Space had a kernel of truth in that it correctly identified a couple of errors, misleading omissions in failing to note that the errors had already been fixed by the time the post was published, misleading omissions (and sometimes flat-out lies) about the reason that instances appeared there, a misleading claim that the data showed evidence of bias in The Bad Space (as opposed to the reality that there were so many mistakes in the data that no conclusion could be drawn), and misleading claim that this was an *intentional* attempt to target trans people, anarchists, and ActivityPub implementers. And then the next neocities post, a pseudonymous hit piece, simply cited the "evidence" of the previous post as if it were proof and made up wild claims about Nivenly Foundation -- which is not, in reality, an "AI Art Foundation" 🤣 On the one hand it's ridiculous, but it fits in with many people's unexamined racist biases, so they often believe it without even bothering to check. 5 Thanks to Octavia con Amore for pointing out to me the erasure of trans people who are neither white nor Black from so many of these dicussions. 6 There is currently no footnote #6 or #7\. Ghost, the blogging/newsletter software I'm using, doesn't have a good solution for auto-numbering footnotes unless you write your whole post in Markdown, and it's a huge pain to manually edit them, so my footnotes often wind up very strange-looking. 8 Nivenly's response in the github [Discussion of the FSEP proposal](https://github.com/nivenly/community/discussions/4?ref=thenexusofprivacy.net), from mid-September, has a lot of clarifications and context on FSEP, and [Nivenly's October/November update](https://nivenly.org/blog/2023/11/14/updates-for-october-and-november/?ref=thenexusofprivacy.net#federation-safety-enhancement-project-fsep) has the current status of FSEP: > Unfortunately due to a few factors, including the unexpected passing of our founder Kris Nóva days after the release of the product requirements document as well as the author and original maintainer Ro needing to take a step back due to a torrent of racism that he received over The Bad Space, the originally planned Q&A that was supposed to happen shortly after FSEP was published did not have the opportunity to happen.... The status of this project is on hold, pending the return of either the original maintainer or a handoff to a new one. 9 From the FSEP document: - Allowing blocklists to be automatically imported during onboarding dramatically reduces the opportunity to be exposed to harmful content unnecessarily. - The ability to request an updated blocklist or automate the process to check on its own periodically. - Expand blocklist management by listing why a site is blocked, access to available examples, and when the site was last updated. These all address points Shepherd characterizes in [The Hell of Shared Blocklists](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web?ref=thenexusofprivacy.net#the-hell-of-shared-blocklists) as "vitally important to mitigate harms". Of course, if Mastodon had better support for allow-list federation, then starting off with a minimal allow-list would mean that an initial blocklist doesn't need to be imported. But it doesn't, and based on a recent discussion with Mastodon CTO Renaud Chaput [that's unlikely to change](https://oisaur.com/@renchap/111461517006387570?ref=thenexusofprivacy.net). 10 For example: The Bad Space mid-September bug resulted in instances getting listed on The Bad Space if even one of sources had taken action against them; the correct behavior is that only sources with two or more actions should be listed. So the similarity of the bug's effect on girlcock.club and tech.lgbt with the issue with Oliphant's now-discontinued unified max list Seirdy discusses in [Mistakes made](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net#mistakes-made) reinforces that blocklist "consensus" algorithms that only require a single source are likely to affect sex-positive queer space so should be avoided. 11 Why am I so convinced that it was a false accusation? For one thing, the accuser admitted it: "I fucked up." Also, facts are facts. Nobody had been fired. Two volunteers had left the Tusky team, and both of them said that it was unrelated to the Black trans person's comment. The false accuser says it wasn't intentional. They just happened to stumble upon a post by a Black trans person who had blocked them, flipped out (because tech.lgbt was being held accountable for the post I mentioned above where their moderator had ignored crucial details and added credibility to a racist harassment against a Black person), and thought the situation was so urgent that they needed to make a post that (in their own description) "rushed to conclusions" and "speculated on what I couldn't see under the hood" and was wrong. 12 **Update, December 2024**: These dynamics continue to play out in practice. Recently, a pseudonymous account described me as "spending most of his time on fedi cheering on some of the worst anti-queer harassment." Alarming if true! What was the "evidence" for this? A post I had made replying to the Black trans person who was the target of the racist anti-trans false accusation. Cool. This was part of another messy discussion sparked by a long post from Aria Salvatrice that included the decontextualized accusation of unprovoked "death threats" as well as discussing The Bad Space, the supposed division between "Queer Fedi" and "Tech Fedi," the IFTAS (Independent Federated Trust & Safety non-profit I'm an advisor to) and other topics. Seirdy's excellent [a meta thread oh no oh god oh fuck](https://pleroma.envs.net/notice/Apa0Hn61UZLEp4G4hc?ref=thenexusofprivacy.net) has a lot of good context for the overall discussion, including some important points about blocklists, automated moderation, and IFTAS' general strategy. Seirdy also identifies several factual errors in long post; Sam's [A partial response to “Ethics in Transgenderism”](https://fed.eitilt.life/sam/s/309f779dc10e963ffee6bba6c34496ca.html?ref=thenexusofprivacy.net) discusses some of the other inaccuracies in the post (many of which also appeared in the two earlier pseudonymous racialized disinfo posts). As Seirdy says about the overall framing, > "The article separates Fedi into “Tech Fedi” and “Queer Fedi”. To get people to defend you, you need a common enemy. Painting everyone who isn’t part of your circle as against you, often with stereotypes, is an easy way to tap into this tribal impulse." And to make that distinction, people like me need to be defined as *not* part of "Queer Fedi." Hey wait a second. I'm queer. I've been queer on Mastodon since 2017! So it's a great example of Seirdy's point of removing the queer identies of people seen as The Bad Space supporters to separate them from “Queer Fedi" – and, more generally, implying that trans and queer people who aren 't critiquing The Bad Space aren't *really* trans and/or queer. I also find this framing especially frustrating because of what it obscures. For one thing, the ActivityPub fediverse really *does* have history of marginalizing and exploiting queer, trans, and non-binary people – see for example [A breaking point for the queer community](https://thenexusofprivacy.net/mastodon-a-partial-history/#a-breaking-point-for-the-queer-community) and [A (partial) queer, trans, and non-binary history of Mastodon and the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net). As I recently said on Bluesky, quoting ActivityPub spec co-author Christine Lemmer-Webber (now at Spritely Labs) > as [@dustyweb.bsky.social](https://bsky.app/profile/did:plc:dyyvywontyeuaegemczcushz?ref=thenexusofprivacy.net) says "Queer people built the fediverse". But almost all the visibility and resources go to cis guys – who ignore priorities of queer people and other marginalized users. It really is a problem! But it's cis white guys who have caused this (not Ro, not the trans and queer people supporting The Bad Space) – and it's cis white guys who primarily benefit from it (not Ro, not the trans and queer people supporting The Bad Space). And very few if any of these cis white guys who benefit from this have said boo about The Bad Space, let alone supporting it. And the "Queer Fedi"/"Tech Fedi" framing also obscures some of the core tensions around The Bad Space: the complex interplay within trans and queer communities between anti-transmasculinity, transmisogyny, anti-Blackness, colorism, racism, and transphobia. Oh well. As usual, some of the messy discussion is productive – Seirdy's thread for example. But a lot of it is just messy. ### Blocklists in the ActivityPub fediverse URL: https://thenexusofprivacy.net/blocklists-in-the-fediverse/ Last updated: 2026-04-16T03:10:34.000Z *Originally published November 2023, last updated January 2025 – see the* [*update log*](#update-log) *for details.* > Note: if you're coming here from Bluesky, make sure to read the section on [Widely shared blocklists can lead to significant harm](#harms-of-blocklists) – which applies to composable moderation as well. Bluesky currently also relies on blocklists, at the individual level instead of instance-level blocking, so while details are different, much of the rest of the article is hopefully relevant as well! This installment of the multi-part series on *Golden opportunities for the fediverse – and whatever comes next* has five sections: - [Blocklists](#enter-blocklists) - [Widely shared blocklists can lead to significant harm](#harms-of-blocklists) - [Blocklists potentially centralize power -- although can also counter other power-centralizing tendencies](#centralize-power) - [Today's fediverse relies on instance blocking and blocklists](#relies) - [Steps towards better blocklists](#better-blocklists) But first, a quick recap of [Mastodon and today’s ActivityPub Fediverse are unsafe by design and unsafe by default – and instance blocking is a blunt but powerful safety tool](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/): - Today's ActivityPub Fediverse is unsafe by design and unsafe by default – especially for Black and Indigenous people, women of color, LGBTAIQ2S+ people[1](#fn-lgbtaiq2s), Muslims, disabled people and other marginalized communities. ‌ - Instance blocking is a blunt but powerful tool for improving safety - Defederating from a few hundred "worst-of-the-worst" instances makes a huge difference in reducing harassment and abuse, - Blocking or limiting large loosely-moderated instances (that are frequent sources of racism, misogyny, and transphbobia means even lessharassment and bigotry (as well as less spam) > If terms like instances, blocking, defederating, limiting, or the fediverse are new to you (as they are to 99.9% of the world), you mayt want to read [Mastodon and today’s fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) before this post! > Update, May 2025: Recent papers ["A Blocklist is a Boundary": Tensions between Community Protection and Mutual Aid on Federated Social Networks](https://dl.acm.org/doi/10.1145/3710919?ref=thenexusofprivacy.net) (by Erika Melder, Ada Lerner, and Michael Ann DeVito) and [Understanding Community-Level Blocklists in Decentralized Social Media](https://arxiv.org/abs/2506.05522v1?ref=thenexusofprivacy.net) (by Owen Xingjian Zhang, Sohyeon Hwang, Yuhan Liu, Manoel Horta Ribeiro, and Andrés Monroy-Hernández) are excellent academic research about blocklists Instance blocking is a critical tool for admins and moderators who want to limit the amount of hate speech and harassment the people on their instances are explosed to. But with 20,000 instances in the ActivityPub Fediverse, how to know which ones are bad actors that should be defederated or so loosely moderated that they should be limited? In [#FediBlock and receipts](#fediblock-and-receipts), I discussed the current mechanisms – including the #FediBlock hashtag – and their limitations. And with hundreds of problematic instances out there, blocking them individually can be tedious and error-prone – and new admins often don't know to do it. The [FediHealth project](https://farga.exo.cat/buttle/fedihealth?ref=thenexusofprivacy.net), from 2019, started to address this problem by providing suggestions of instances to follow and block based on policies PeerTube and Pleroma instances "whose federation policies you trust." Starting in early 2023, Mastodon began providing the ability for admins to protect themselves from hundreds of problematic instances at a time by uploading *blocklists* (aka *denylists*): lists of instances to suspend or limit. > Terminology note: **blocklist* or *denylist* is* preferred to the older **blacklist** and **whitelist*, which embed* [*the* racialized assumption that black is bad and white is good](https://www.vice.com/en/article/v7dd3d/we-need-to-stop-saying-blacklist-and-whitelist?ref=thenexusofprivacy.net). Blocklist is more common today, but close enough to "blacklist" that *denylist* is gaining popularity. Starting in 2023, shared blocklists from [Seirdy](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net) (Rohan Kumar), [Gardenfence](https://gardenfence.github.io/?ref=thenexusofprivacy.net), and [Oliphant](https://writer.oliphant.social/oliphant/the-oliphant-social-blocklist?ref=thenexusofprivacy.net) all gained significant adoption, as did IFTAS' [Do Not Interact (DNI)](https://connect.iftas.org/library/iftas-documentation/iftas-dni-list/?ref=thenexusofprivacy.net) and [CARIAD](https://connect.iftas.org/library/iftas-documentation/cariad-policy/?ref=thenexusofprivacy.net) in 2024\. Here's how Seirdy's [My Fediverse blocklists](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net) describes the 140+ instances on his FediNuke.txt blocklist: > "It’s kind of hard to overlook how shitty each instance on the `FediNuke.txt` subset is. Common themes tend to be repeated unwelcome sui-bait[2](#fn-sui-bait) from instance staff against individuals, creating or spreading dox materials against other users, unapologetic bigotry, uncensored shock content, and a complete lack of moderation." Seirdy's [Receipts](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net#receipts) section gives plenty of examples of just how shitty these instances are. For froth.zone, for example, Seirdy has links including "Blatant racism, racist homophobia", and notes that "Reporting is unlikely to help given the lack of rules against this, some ableism from the admin and some racism from the admin." Seirdy also links to another instance's "about" page which boasts that "racial pejoratives, NSFW images & videos, insensitivity and contempt toward differences in sexual orientation and gender identification, and so-called “cyberbullying” are all commonplace on this instance." Nice. Blocklists aren't limited to the shittiest instances. Sierdy also provides a Tier 0 list of about 380 instances, described as "a good **starting point** for your instance’s blocklist". [Oliphant.Social Mastodon Blocklists](https://writer.oliphant.social/oliphant/the-oliphant-social-blocklist?ref=thenexusofprivacy.net) and Seirdy's [Supplemental Blocklists](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net#supplementary-blocklists) highlight a range of other approaches, including some that focus on bridges to other networks, specific software platforms or instances that have open registrations. Many widely-adopted blocklists take an algorithmic approach: - Gardenfence is a pure "consensus" (or "aggregate") blocklist combining the results of multiple blocklists, with some threshold for inclusion; Oliphant's older tier0, tier1, tier2, and unified-max blocklists also took this approach. - Seirdy by contrast uses blocklists from multiple "bias sources" as an initial step in the process, and then applies [overrides](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net#overrides) to produce the "semi-curated" Tier0 and curated FediNuke.txt. IFTAS' CARIAD also includes a manual review step. - Oliphant's current \_unified\_tier0\_blocklist.csv combines blocks from Seirdy's Tier0, Gardenfence, and IFTAS DNI, resulting in a list slightly longer than Seirdy's. - [FediSeer](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/) provides a tool for combining the "censured lists" of multiple instances. On the one hand, a purely algorithmic approach reduces the direct impact of bias and mistakes by the person or organization providing the blocklist. Then again, it introduces the possibility of mistakes or bias – by one or more of the sources, when selecting which sources to use, or the algorithm combining the various blocklists. Seirdy's [Mistakes made](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net#mistakes-made) analysis documents a challenge with this kind of approach. > "One of Oliphant’s sources was a single-user instance with many blocks made for personal reasons: the admin was uncomfortable with topics related to sex and romance. Blocking for personal reasons on a personal instance is totally fine, but those blocks shouldn’t make their way onto a list intended for others to use.... > > [Tyr](https://pettingzoo.co/@tyr?ref=thenexusofprivacy.net) from pettingzoo.co [raised important issues in a thread](https://pettingzoo.co/@tyr/110289010380366104?ref=thenexusofprivacy.net) after noticing his instance’s inclusion in the unified-max blocklist. He pointed out that offering a unified-max list containing these blocks is a form of homophobia: it risks hurting sex-positive queer spaces." Requiring more agreement between the sources reduces the impact of bias from any individual source – although decisions by multiple instances aren't necessarily completely independent,[3](#fn-dependent-decisions) so there can still be issues. And requiring more agreement also increases the number of block-worthy instances that aren't on the list. Gardenfence, for example, requires agreement of six of its seven sources, and has 136 entries; as the documentation notes, "there are surely other servers that you may wish to block that are not listed." Leaving instances off lists can also disproportionately affect people who are likely to be harassed; IFTAS, for example, notes that > "CARIAD does not protect LGBTQ, BIPOC, BAME or other marginalised communities." Any blocklist, for an individual instance or intended to be shared between instances, reflects the creators' perspectives on this and dozens of other ways in which there isn't any fediverse-wide agreements on when it's appropriate to defederate or silence other instances. Any blocklist by definition takes a position on all these issues, so (as Seirdy notes) no matter what blocklist you're starting with > "if your instance grows larger (or if you intend to grow): you should be intentional about your moderation decisions, present and past. Your members ostensibly trust you, but not me." Any blocklist is likely to be supported by those who have similar perspectives as the creators – and vehemently opposed by those who see things differently. And some people vehemently oppose the entire of idea of blocklists, either on philosophical grounds or because of the risks of harms and abuse of power. ## Widely shared blocklists can lead to significant harm [![A tweet from workingdog_, August 2018. I had to take in a friend for a month who lost their entire income after being put on his block list for making a Star Trek reference. She couldn’t pay her rent. Couldn’t afford food. Her bandcamp sales still haven’t recovered years later. All over one tweet.](https://thenexusofprivacy.net/content/images/2023/11/Screenshot-2023-11-07-at-7.50.30-PM.png)](https://nitter.net/workingdog%5F/status/1035544375827333121?ref=thenexusofprivacy.net#m) Blocklists have a long history. Usenet killfiles have existed since the 1980s, email DNSBLs since the late 90s, and Twitter users created The Block Bot in 2012\. The perspective of a Block Bot user who Saughan Jhaver et al quote in [Online harassment and content moderation: The case of blocklists](https://dl.acm.org/doi/abs/10.1145/3185593?ref=thenexusofprivacy.net) (2018, [PDF here](https://shagunjhaver.com/research/articles/jhaver-2018-blocklists/jhaver-2018-blocklists.pdf?ref=thenexusofprivacy.net)) is a good example of the value blocklists can provide to marginalized people: > "I certainly had a lot of transgender people say they wouldn’t be on the platform if they didn’t have The Block Bot blocking groups like trans-exclusionary radical feminists –TERFs.” That said, widely-shared blocklists introduce risks of major harms – harms that are especially likely to fall on already-marginalized communities. [workingdog's thread from 2018](https://twitter.com/workingdog%5F/status/1035544368575401985?ref=thenexusofprivacy.net) (written during the [Battle of Wil Wheaton](https://old.reddit.com/r/OutOfTheLoop/comments/9bimug/why%5Fdid%5Fmastodon%5Frun%5Foff%5Fwil%5Fwheaton/e57gknd/?ref=thenexusofprivacy.net)) describes a situation involving a different Twitter blocklist that many current Mastodonians had first-hand experience with: a cis white person arbitrarily put many trans people who had done nothing wrong on his widely-adopted blocklist of "most abusive Twitter scum" and as a result ... > "Tons of independent trans artists who earn their primary income off selling music on bandcamp, Patreon, selling art commissions, etc. got added to this block list and saw their income drop to 0\. Because they made a Star Trek reference at a celebrity. Or for doing nothing at all. Many Black people were on Wheaton's blocklists as well, for making a Star Trek reference or for doing nothing at all, with equally severe impacts. An earlier blocklist that Wheaton had used as a starting point similarly had many trans and Black people on it just because the blocklist curator didn't like them. Email blocklists have seen similar abuses; [RFC 6471: Overview of Best Email DNS-Based List (DNSBL) Operational Practices](https://datatracker.ietf.org/doc/html/rfc6471?ref=thenexusofprivacy.net) (2012) notes that > “some DNSBL operators have been known to include "spite listings" in the lists they administer -- listings of IP addresses or domain names associated with someone who has insulted them, rather than actually violating technical criteria for inclusion in the list.” And intentional abuse isn’t the only potential issue. RFC 6471 mentions a scenario where making a certain mistake on a DNSBL could lead to everybody using the list rejecting all email ... and mentions in passing that this is something that's actually happened. Oops. > "The trust one must place in the creator of a blocklist is enormous; the most dangerous failure mode isn’t that it doesn’t block who it says it does, but that it blocks who it says it doesn’t *and they just disappear*." > > – Erin Sheperd, [A better moderation system is possible for the social web](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web/?ref=privacy.thenexus.today) > "Blocklists can be done carefully and accountably! But almost none of them ARE." > > – [Adrienne](https://social.treehouse.systems/@adrienne/111043378257088227?ref=thenexusofprivacy.net), a veteran of The *Block Bot* People involved in creating and using blocklists can take steps to limit the harms. An oversight and review process can reduce the risk of instances getting placed on a blocklist by mistake – or due to the creators' biases. Appeals processes can help deal with the situation when they almost-inevitably do. Sometimes problematic instances clean up their act, so blocklists need to have a process for being updated. Admins considering using a blocklist can double-check the entries to make sure they’re accurate and aligned with their instances’ norms. The upcoming section on [steps towards better blocklists](https://thenexusofprivacy.net/p/a270d01b-fdad-43c0-9597-2d8105625d18/#better-blocklists) disucsses these and other improvements in more detail. However, today's fediverse blocklists often have very informal review and appeals processes – basically relying on instances who have been blocked by mistake (or people with friends on those instances) to surface problems and kick off discussions by private messages or email. Some, like Seirdy's FediNuke, make it easier for admins to double-check them by including reasons and receipts (links or screenshots documenting specific incidents) for why instances appear on them. Others don't, or have only vague explanations ("poor moderation") for most instances. To be clear, as [#FediBlock and receipts](#fediblock-and-receipts) discusses, receipts aren't a panacea. > "Some of the incidents that lead to instances being blocked can be quite complex, so receipts are likely to be incomplete at best. As [Sven Slootweg points out](https://social.pixie.town/@joepie91/111489660920971903?ref=privacy.thenexus.today), "a lot of bans/defederations/whatever are not handed out for specific directly-observable behaviour, but for the offender's active refusal to reflect or reconsider when approached about it," which means that to understand the decision "you actually need to do the work of understanding the full context." > > In other situations, providing receipts can open up the blocklist maintainer (or people who had reported problems or previously been targeted) to legal risk." And even when receipts exist and are available, it’s likely to take an admin a long time to check all the entries on a blocklist – and there are still likely to be disagreements about how receipts should be interpreted. Still, despite their limitations, receipts can be useful in many circumstances; I (and others) frequently look at to Seirdy's list. Other blocklists have room for improvement on this front. ## Blocklists potentially centralize power – although can also counter other power-centralizing tendencies > "the blocklist/allowlist path for the fediverse is a band-aid. it's a doomed approach to moderation, and it always converges on centralization as it continues to run." > > – [Christine Lemmer-Webber](https://octodon.social/@cwebber/109421901308877149?ref=thenexusofprivacy.net), 2022\. [OcapPub: Towards networks of consent](https://gitlab.com/spritely/ocappub/blob/master/README.org?ref=privacy.thenexus.today) goes into more detail Another big concern about widely-adopted blocklists is their tendency to centralize power. Imagine a hypothetical situation where every fediverse instance had one of a small number of blocklists that had been approved by a central authority. That would give so much power to the central authority and the blocklist curator(s) that it would almost certainly be a recipe for disaster. And even in more less-extreme situations, blocklists can centralize power. In the email world, for example, blocklists have contributed to a situation where despite a decentralized protocol a very small number of email providers have over 90% of the installed base. You can certainly imagine large providers using a similar market-dominance technique in the fediverse. Even today, I've seen several people suggest that people should choose large instances like mastodon.social which many regard as "too big to block." And looking forward, what happens if and when Facebook parent company Meta's new Threads product adds fediverse integration? Then again, blocklists can also counter other centralizing market-dominance tactics. Earlier this year, for example, Mastodon BDFL (Benevolent Dictator for Life) Rochko changed the onboarding of the official release to sign newcomers up by default to mastodon.social, the largest instance in the fediverse – a clear example of centralization, especially since Rochko is also CEO of Mastodon gGmbH, which runs mastodon.social.[4](#fn-default) One of the justifications for this is that otherwise newcomers could wind up on an instance that doesn't block known actors and have a really horrible experience. Broad adoption of "worst-of-the-worst" blocklists would provide a decentralized way of addressing this concern. For that matter, broader adoption of blocklists that silence or block mastodon.social could directly undercut Mastdon gGmbH's centralizing power in a way that was never tried (and is no longer feasible) with gmail. The [FediPact](https://fedipact.online/?ref=thenexusofprivacy.net) – hundreds of instances agreeing to block the hell out of any Meta instances – is another obvious example of using a blocklist to counter dominance. ## Today's fediverse relies on instance blocking and blocklists [![Post by the people's eva: I agree that we should work on a more robust and transparent process for getting servers off of blocklists when they are able to demonstrate either that the addition was unwarranted or exhibit a sincere change. However, sorry not sorry, I'm not gonna get called a nigger for any of y'all. If that's the cost of doing business, I'm going back to corporate hell social where most of the other Black folks are. And most of the Black fedizens I know would do the same. And they would be right to do so. Sep 11, 2023](https://thenexusofprivacy.net/content/images/2023/11/Screenshot-2023-11-07-at-8.04.24-PM.png)](https://blackqueer.life/@tillshadeisgone/111048107508649672?ref=thenexusofprivacy.net) It would be great if Mastodon and other fediverse software had other good tools for dealing with harassment and abuse to complement or replace instance-level blocking – and, ideally, reduce or even eliminate the need for blocklists. But it doesn't, at least not yet. That needs to change, and [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/) (part 5 of this series) discusses straightforward short-term improvements that could have big impact. Realistically, though, it's not going to change overnight – and a heck of a lot of people want alternatives to Twitter right now. So despite the costs of instance-level blocking, and the potential harms of blocklists, they're the only currently-available solution for dealing with the hundreds of Nazi instances – and thousands of weakly-moderated instances, including some of the biggest, where moderators frequently don't take action on racist, anti-Semitic, anti-Muslim, etc content. As a result, today's fediverse is very reliant on them. ## Steps towards better instance blocking and blocklists > "Notify users when relationships (follows, followers) are severed, due to a server block, display the list of impacted relationships, and have a button to restore them if the remote server is unblocked" > > – Mastodon CTO Renaud Chaput, discussing the [tentative roadmap for the upcoming Mastodon 4.3 release](https://oisaur.com/@renchap/111348683647208315?ref=thenexusofprivacy.net) Since the fediverse is likely to continue to rely on instance blocking and blocklists at least for a while, how to improve them? Mastodon 4.3's planned improvements to instance blocking are an important step. Improvements in the announcements feature (currently a "maybe" for 4.3) would also make it easier for admins to notify people about upcoming instance blocks. Hopefully other fediverse software will follow suit. Another straightforward improvement along these lines would be an option to have new federation requests initially accepted in "limited" mode. By reducing exposure to racist content, this would likely reduce the need for blocking. For blocklists themselves, one extremely important step is to let new instance admins know that they should consider initially blocking worst-of-the-worst instances (and their members are likely to get hit with a lot of abuse if they don't) and offering them some choices of blocklists to use as a starting point. This is especially important for friends-and-family instances which don't have paid admins or moderators. Hosting companies play a critical role here – especially if Mastodon, Lemmy, and other software platforms continue not to support this functionality directly (although obviously it would be better if they do!) Since people from marginalized communities are likely to face the most harm from blocklist abuse, involvement of people from different marginalized communities in creating and reviewing blocklists is vital. One obvious short-term step is for blocklist curators – and instance admins whose blocklists are used as inputs to aggregated blocklists – to provide reasons instances are on the list, checking to see where receipts exist (and potentially providing access to them, at least in some circumstances), re-calibrating suspension vs. silencing in some cases, and so on. Independent reviews are likely to catch problems that a blocklist creator misses, and an audit trail of bias and accuracy reviews could make it much easier for instances to check whether a blocklist has known biases and mistakes before deploying it. Of course, this is a lot of work; asking marginalized people to do it as volunteers is relying on free labor, so who's going to pay for it? A few other directions worth considering: - More nuanced control over when to *automatically* apply blocklist updates could limit the damage from bugs or mistakes. For example, Rich Felker has [suggested](https://github.com/nivenly/community/discussions/4?ref=thenexusofprivacy.net#discussioncomment-7019830) that blocklist management tools should have safeguards to prevent automated block actions from severing relationships without notice. - Providing tags for the different reasons that instances are on on blocklists – or blocklists that focus on a single reason for blocking, like Seirdy's [BirdSiteLive and bird.makeup](https://seirdy.one/pb/bsl.txt?ref=thenexusofprivacy.net) blocklist – could make it much easier for admins to use blocklists as a starting point, for example by distinguishing between instances that are on a blocklist for racist and anti-trans harassment from instances that are there only because of CW or bot policies that the blocklist curator considers overly lax. - Providing some access to receipts and an attribution trail of who has *independently* decided an instance should be blocked help admins and independent reviewers make better judgments about which blocklist entries they agree with. As discussed above, receipts are a complicated topic, and in many situations may be only partial and/or not broadly shareable[5](#fn-laelaps); but as Seirdy’s FediNuke.txt list shows, there are quite a few situations where they *are* likely to be available – and Seirdy [notes](https://pleroma.envs.net/objects/8a01b7de-9d79-439e-851b-9f5d6a30d6d2?ref=thenexusofprivacy.net) that "I and most mods I’ve worked with also find receipt archives to be better resources than blocklists, though the two are not mutually exclusive." - Shifting to a view of a blocklist as a collection of advisories or recommendations, and providing tools for instances to better analyze them, could help mitigate harm in situations where biases do occur. Emelia Smith's work in progress on FIRES (Fediverse Intelligence Recommendations & Replication Endpoint Server) is a valuable step in this direction. - Learning from experiences with email blocking and IP blocking – and, where possible, building on infrastructure that already exists ### What about blocklists for individuals (instead of instances)? Good question. In situations where only a handful of people on an instance are behaving badly, blocking or muting them individually can limit the harm while still allowing connections with others on that instance. Most fediverse software provides the abilty to block and mute individuals, so it's kind of surprising that Twitter-like blocklists and tools like [Block Party](https://www.siliconrepublic.com/enterprise/block-party-tracy-chou-twitter-safety-online-abuse?ref=thenexusofprivacy.net) haven't emerged yet. It wouldn't surprise me if that changes in 2024\. ### Identifying bias in blocklists One of the biggest concerns about blocklists is the possibility of systemic bias. Algorithmic systems tend to magnify biases, so "consensus" blocklists require extra scrutiny, but it can happen with manually curated lists as well. Algorithmic audits (a structured approach to detecting biases and inaccuracies) are one good way to reduce risks – although again, who's going to pay for it Adding additional curation and review (by an intersectionally-diverse team of people from various marginalized perspectives) could also be helpful. [Hrefna has some excellent suggestions](https://indieweb.social/@jdp23/111265907610525850?ref=thenexusofprivacy.net) as well, such as preprocessing inputs to add additional metadata and treating connected sources (for example blocklists from instances with shared moderators) as a single source. And there are a lot of algorithmic justice experts in the fediverse, so it's also worth exploring different anti-oppressive algorithms specifically designed to detect and reduce biases. Of course, none of these approaches are magic bullets, and they’ve all got complexities of their own. When trying to analyze a blocklist's biases against trans people, Black people, Jews, and Muslims for example: - There's no census of the demographics of instances in the fediverse, so it's not clear how to determine whether trans-led, Black-led instances, Jewish-led, or Muslim-led instances (or instances that host a lot of trans, Black, Jewish, and/or Muslim people) are overrepresented. - Large instances like mastodon.social are sources of a lot of racism, anti-Semitism, and Islamophbia (etc). If a blocklist *doesn't* at least limit them, does that mean it's inherently biased against Black people? If a blocklist *does* limit or block them, then it's blocking the largest cis white led instances ... so does that mean it's statistically *not* biased against trans- and Black-led instances? - Suppose the largest Jewish instance is a source of [false reporting about pro-Palestinian posts](https://todon.eu/@mahal/111434366008582428?ref=thenexusofprivacy.net). If it appears on the blocklist, is that evidence of anti-Jewish bias? After all, it's the largest Jewish instance! But if doesn't appear on a blocklist, is it a source of anti-Palestinian bias? And more generally, when looking at whether a blocklist is biased against Jews or Muslims, whose definitions of anti-Semitism get used? - What about situations where differing norms (for example whether spamming #FediBlock as grounds for defederation, or whether certain jokes are racist or just good clean fun) disproportionately affect Black people and/or trans people? - What about intersectional aspects such as biases against Black women or trans people of color? In [a meta thread oh no oh god oh fuck](https://pleroma.envs.net/notice/Apa0Hn61UZLEp4G4hc?ref=thenexusofprivacy.net), Seirdy notes that > "No over-representation of any marginalized group .... is a goal to strive for but impossible to strictly evaluate. For example: if a single instance for a marginalized group ruptures into multiple separate instances, how should that impact the group’s representation?" Which brings us back to a point I made earlier: > "It would be great if Mastodon and other fediverse software had other good tools for dealing with harassment and abuse to complement instance-level blocking – and, ideally, reduce the need for blocklists." ## To be continued! The discussion continues in - [It’s possible to talk about The Bad Space without being racist or anti-trans – but it’s not as easy as it sounds](https://thenexusofprivacy.net/the-bad-space/) - [Compare and contrast: Fediseer, FIRES, and The Bad Space](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/) - [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/) - A golden opportunity for the fediverse – and whatever comes next Here's a sneak preview of the discussion of The Bad Space, a catalog of instances that can be used as the basis for various tools – including blocklists. *The Bad Space's web site at* [*thebad.space*](https://thebad.space/?ref=thenexusofprivacy.net) *provides a web interface that makes it easy to look up an instance to see whether concerns have been raised about its moderation, and an API (application programming interface) making the information available to software as well. The Bad Space currently has over 3300 entries – a bit over 12% of the 24,000+ instances in the fediverse....* *The Bad Space is useful today, and has the potential to be the basis of other useful safety tools – for Mastodon and the rest of the fediverse, and potentially for other decentralized social networks as well. Many people did find ways to have productive discussions about The Bad Space without being racist or anti-trans, highlighting areas for improvement and potential future tools. So from that perspective quite a few people (including me) see it as off to a promising start.* *Then again, opinions differ. For example, some of the posts I'll discuss in an upcomiung installment of this series (tentatively titled *Racialized disinformation and misinformation: a fediverse case study*) describe The Bad Space as "pure concentrated transphobia" that "people want to hardcode into new Mastodon installations" in a plot involving somebody who's very likely a "right wing troll" working with an "AI art foundation aiming to police Mastodon" as part of a "deliberate attempt to silence LGBTQ+ voices."* *Alarming if true!* > To see new installments as they're published, follow [@thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) or [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/#/portal/signup). ## Notes 1 I'm using LGBTQIA2S+ as a shorthand for lesbian, gay, gender non-conforming, genderqueer, bi, trans, queer, intersex, asexual, agender, [two-sprit](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today), and others who are not straight, cis, and heteronormative. [Julia Serrano's trans, gender, sexuality, and activism glossary](https://www.juliaserano.com/terminology.html?ref=privacy.thenexus.today) has definitions for most of terms, and discusses the tensions between ever-growing and always incomplete acronyms and more abstract terms like "gender and sexual minorities". [OACAS Library Guides' Two-spirit identities page](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today) goes into more detail on this often-overlooked intersectional aspect of non-cis identity. 2 Suicide-baiting: telling or encouraging somebody to kill themselves. 3 Some instances share moderators, have moderators who are friends with each other, or make moderation decisions jointly. And even if there's no connection between instances, if somebody announces a blocking decision to #FediBlock – or an instance shows up on a widely-used blocklist – other instances are likely to block as well. Of course they *should* verify the claims before deciding to block; but in situations where that doesn't happen and they just take the original poster's word for it, then the additional protection of requiring multiple actions is illusory. 3.5 [A bug leads to messy discussions, some of which are productive](https://thenexusofprivacy.net/the-bad-space/#messy-discussions) discusses a related situation where a software bug led to a high-profile LGBT-focused instance briefly mistakenly appearing on The Bad Space, an instance catalog that similarly aggregates instance blocklists. 4 Update, January 2025: November 2024's [A faux “Eternal September” turns into flatness](https://thenexusofprivacy.net/flatness/) discusses Rochko's changing the default to mastodon.social in the sections on [*Why not help people choose an instance that's a good fit?*](https://thenexusofprivacy.net/flatness/#why-not) and [*But no*](https://thenexusofprivacy.net/flatness/#but-no). 5 Update, Januaray 2025: The [Laelaps](https://bsky.app/profile/laelaps.fyi?ref=thenexusofprivacy.net) anti-Zoophilia labeler on Bluesky uses Github to track its public [evidence](https://github.com/heikadog/zml/blob/main/zml.md?ref=thenexusofprivacy.net#evidence). ## Update log Ongoing: fixing typos and confusing wording, adding new links, other minor changes November 17, 2024: changed title to make it explicit that this is about the ActivityPub Fediverse January 7, 2025: update to include IFTAS' CARIAD, changes in Oliphant blocklists, add footnotes 3.5, 4 and 5, quotes from Seirdy's [a meta thread oh no oh god oh fuck](https://pleroma.envs.net/notice/Apa0Hn61UZLEp4G4hc?ref=thenexusofprivacy.net), begin working on notes for Bluesky/AT Proto ### Mastodon and today's ActivityPub Fediverse are unsafe by design and unsafe by default URL: https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/ Last updated: 2026-04-16T03:10:13.000Z The ecosystem of interconnected social networks known as the fediverse has great potential as an alternative to centralized corporate networks. With Apartheid Clyde transforming Twitter into a[ machine for fascism](https://www.emptywheel.net/2023/10/04/elon-musks-machine-for-fascism-a-tale-of-three-elections/?ref=thenexusofprivacy.net) and disinformation, and[ Facebook continuing to allow propaganda and hate speech to thrive](https://www.washingtonpost.com/world/2023/09/26/india-facebook-propaganda-hate-speech/?ref=thenexusofprivacy.net) while[ censoring support for Palestinians](https://www.nytimes.com/2023/10/16/world/middleeast/israel-hamas-war-facebook-instagram.html?ref=thenexusofprivacy.net), the need for alternatives is more critical than ever. But even though millions of people left Twitter in the last two years – and millions more are ready to move as soon as there's a viable alternative – the ActivityPub Fediverse isn't growing.[1](#fn-growth) One reason why: today's Fediverse is unsafe by design and unsafe by default – especially for Black and Indigenous people, women of color, LGBTQIA2S+ people[2](#fn-lgbtaiq2s), Muslims, disabled people and other marginalized communities. ‌ It doesn't have to be that way. Straightforward steps could make the ActivityPub Fediverse safer – and open up some amazing opportunities. Then again, there's also a lot resistance to making progress on this, and the ActivityPub Fediverse has a looooong history of racism and transphobia. ‌So maybe the Fediverse will shrug its collective shoulders, continue to be unsafe by design and unsafe by default, and whatever comes next will seize the opportunities. Over the course of this multi-part series, I'll discuss Mastodon and the ActivityPub Fediverse's long-standing problems with abuse and harassment; the strengths and weaknesses of current tools like instance blocking and blocklists (aka denylists); the approaches emerging tools like The Bad Space and Fediseer take, along with potential problems; paths to improving the situation; how the fediverses as a whole can seize the moment and build on the progress that's being made; and what's likely to happen if the fediverse as a whole *doesn't* seize the opportunity. It's a lot, so it'll take a few posts! At the end I'll collect it all into a single post, with a revised introduction.[3](#fn-3) This first installment has three sections: - [Mastodon is unsafe by design and unsafe by default – and most people in today's Fediverse use Mastodon ](#unsafe) - [Instance-level federation choices are a blunt but powerful safety tool](#blunt-but-powerful) - [Instance-level federation decisions reflect norms, policies, interpretations, and (sometimes) strategy](#norms) > Update: [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) (2024) discusses the terminology I'm now using in general – but there's no need to wallow in the details unless you're into it. A fediverse is a decentralized social network. Different people mean different things by "the Fediverse" (and [Definitions of "the Fediverse"](https://nexusofprivacy.net/is-bluesky-part-of-todays-fediverse/?ref=thenexusofprivacy.net#defining-the-fediverse) goes into a lot more detail for your wallowing pleasure). Since 2018 or so most people have used "the Fediverse" and "the fediverse" as a synonym for the ActivityPub-centric Fediverse (although that may be changing), and that's how I'm using the terms here. ## Mastodon is unsafe by design and unsafe by default – and most people in today's Fediverse use Mastodon [![A post by Lady (the puppy pokémon): bad instances have always existed and every good thing about the fediverse today was hard-fought and hard-won. making it better will mean more work, fighting, and winning. November 23, 2022](https://thenexusofprivacy.net/content/images/2023/11/Screenshot-2023-11-07-at-8.07.45-PM.png)](https://indieweb.social/@Lady@cat.family/109392504959055915?ref=thenexusofprivacy.net) The 1.25 million active users in today's ActivityPub Fediverse are spread across more than 20,000 *instances* (aka *servers*) running a wide variety of software. On instances with active and skilled moderators and admins it can be a great experience. But not all instances are like that. Some are bad instances, filled with nazis, racists, misogynists, anti-LGBTAIQ2S+ haters, antisemites, Islamophobes, and/or harassers. And even on the vast majority of instances whose policies prohibit racism (etc.), relatively few of the moderators in today's fediverse have much experience with anti-racist or intersectional moderation – so very often racism (etc.) is ignored or tolerated when it inevitably happens. ‌ This isn't new. In a 2022 [discussion](https://indieweb.social/@Lady@cat.family/109392480190521514?ref=privacy.thenexus.today), Lady described the OStatus Fediverse's late-2016 culture (when Mastodon first started) as "a bunch of channer shit and blatantly anti-gay and anti-trans memes", and notes that "the instance we saw most often on the federated timeline in those days was shitposter.club, a place which virtually every respectable instance now has blocked." clacke [notes](https://indieweb.social/@clacke@libranet.de/109419258092793446?ref=privacy.thenexus.today) that "the famous channer-culture and freezepeach instances came up only months before Mastodon's "Show HN"" in 2016\. Creatrix Tiara's August 2018 Twitter thread discusses [a 2017 racist dogpiling led by an instance hosted by an alt-right podcaster](https://nitter.net/creatrixtiara/status/1030380785226801152?ref=thenexusofprivacy.net). But just like Nazis and card-carrying TERFs aren't the only source of racism and transhpobia and other bigotry in society, bad instances are far from the only source of racism, transphobia, and other bigotry in the fediverses. Some instances – including some of the largest, like pawoo.net – are essentially unmoderated. Others have moderators who don't particularly care about moderating from an anti-racist and pro-LGBTAIQ2S+ perspective. And even on instances where moderators *are* trying do the right thing, most don't have the training or experience needed to do effective intersectional moderation. So finding ways to deal with bad instances is necessary, but by no means sufficient. This also isn't new. Margaret KIBI's [The Beginnings](https://www.u2764.com/NFIC/2018-09-09/fringe-beginnings/?ref=privacy.thenexus.today), for example, describes weaponization of content warnings (CWs) back in 2017 where "white, trans users—who, for the record, posted un‐CWed trans shit in their timeline all the time—started taking it to the mentions of people of colour whenever the subject of race came up." [Creatrix Tiara's November 2022 Twitter thread](https://vulpine.club/@creatrixtiara/109310828652037900?ref=thenexusofprivacy.net) has plenty of examples from BIPOC fediversians about similar racialized CW discourse. > "we made this space our own through months of work and a fuckton of drama and infighting. but we did a good enough job that when mastodon took off, OUR culture was the one everybody associated it with" > > – Lady, November 2022‌ In Mastodon's early days of 2016-2017, [queer and trans community members drove improvements to the software ](https://thenexusofprivacy.net/mastodon-a-partial-history/#rapid-queer-led-community-innovation)and developed tools which – while very imperfect – help individuals and instance admins and moderators address these problem, at least to some extent. Unfortunately, as I discuss in [The Battle of the Welcome Modal](https://thenexusofprivacy.net/mastodon-a-partial-history/#the-battle-of-the-welcome-modal), [A breaking point for the queer community](https://thenexusofprivacy.net/mastodon-a-partial-history/#a-breaking-point-for-the-queer-community), [The patterns continue ...](https://thenexusofprivacy.net/mastodon-a-partial-history/#the-patterns-continue), and [Ongoing contributions – often without credit](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net#ongoing-contributions-often-without-credit), hostile responses from Mastodon's Benevolent Dictator for Life (BDFL) Eugen Rochko (aka Gargron) and a pattern of failing to credit people for their work drove many key contributors away. ‌ ![we begged, and screamed, and kicked at the ground until there was enough dust in the air for gargron to cough and wheeze and change things, and in the end, those changes were enough for things to change for the better](https://thenexusofprivacy.net/content/images/2023/11/Screenshot-2023-11-07-at-6.47.11-PM.png) hoodieaidakitten, [Mastodon’s Complicated Relationship with Queer Activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=privacy.thenexus.today), July 2018 Others remain active – and forks like glitch-soc continue to provide additional tools for people to protect themselves – but Mastodon's pace of innovation had slowed dramatically by 2018.[8](#fn-8) Mastodon lacks basic safety functionality like Twitter's ability to limit replies ([requested since 2018](https://github.com/mastodon/mastodon/issues/8565?ref=thenexusofprivacy.net)) or make a profile private.[9](#fn-limit-replies) Not only that, some of the protections that Mastodon does provide aren't turned on by default – or are only available in forks, not the official release – and many have caveats even when enabled. For example: - while Mastodon does offer the ability to ignore direct messages (DMs) and notifications from people who you aren't following – great for cutting down on harassment as well as spam – that's not the default. Instead, by default your inbox is open to nazis, spammers, and everybody else until you've found and updated the appropriate setting on one of the many settings screens.[10](#fn-settings-screens) - by default, blocking on Mastodon isn't particularly effective unless the instance admin has turned on a configuration option.[11](#fn-authorized-fetch) - by default, all follow requests are automatically approved, unless you've found and updated the appropriate setting on one of the many settings screens. Unless you turn this on, the apparent privacy protections of "followers-only posts" are an illusion: anybody you haven't blocked can add themselves as a follower and see your followers-only posts. - local-only posts (originally developed by the glitch-soc fork in 2017 and also implemented in Hometown and other forks) give people the ability to prevent their posts from shared with other instances (who might have harassers, terfs, nazis, and/or admins or software that doesn't respect privacy) ... but Rochko has refused to include this functionality in the main Mastodon release.[12](#fn-local-posts) - Mastodon supports "allow-list" federation,[13](#fn-limited-federation-mode) allowing admins to choose whether or not to agree federate with nazi instances; but Mastodon's documentation describes this as "[contrary to Mastodon’s mission of decentralization](https://docs.joinmastodon.org/admin/config/?ref=thenexusofprivacy.net#limited%5Ffederation%5Fmode)", so by default, all federation requests are accepted. Other software platforms like Streams, Pixelfed, Akkoma, and Bonfire have put a lot more thought and effort into safety. In a discussion of an earlier version of this article, Streams developer Mike Macgirvin [commented](https://infosec.exchange/@mikedev@fediversity.site/111439210097164883?ref=thenexusofprivacy.net) "I just never see anybody talking about online safety in our sector of the fediverse, because there's nothing really to talk about." But over 80% of the active users in today's fediverse are on instances running Mastodon software. Worse, some of the newer platforms like Lemmy (a federated reddit alternative) have even fewer tools than Mastodon. And the underlying ActivityPub protocol the fediverse is built on doesn't design in safety. > "Unfortunately from a security and social threat perspective, the way ActivityPub is currently rolled out is under-prepared to protect its users." > > – [OcapPub: Towards networks of consent](https://gitlab.com/spritely/ocappub/blob/master/README.org?ref=privacy.thenexus.today), Christine Lemmer-Webber > "The basics of ActivityPub are that, to send you something, a person `POST`s a message to your Inbox. > > This raises the obvious question: Who can do that? And, well, the default answer is anybody." > > – Erin Shepherd, in [A better moderation system is possible for the social web](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web/?ref=privacy.thenexus.today), November 2022 > "A dude saying "if you don't like receiving hate messages from nazis just block them" is baked into the source code." > > – Bri Seven, [August 2024](https://merveilles.town/@zens/112896172537181221?ref=thenexusofprivacy.net) Despite these problems, many people on well-moderated instances have very positive experiences in today's fediverse. Especially for small-to-medium-size instances, for experienced moderators even Mastodon's tools can be good enough. However, many instances *aren't* well-moderated. So many people have very negative experiences in today's fediverse. For example ... > "During the big waves of Twitter-to-Mastodon migrations, tons of people joined little local servers ... and were instantly overwhelmed with gore and identity-based hate." > > – Erin Kissane, [Blue skies over Mastodon](https://erinkissane.com/blue-skies-over-mastodon?ref=thenexusofprivacy.net) (May 2023) > "It took me eight hours to get a pile of racist vitriol in response to some critiques of Mastodon." > > – Dr. Johnathan Flowers,[ The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today) (December 2022) > "I truly wish [#Mastodon](https://firefish.social/tags/Mastodon?ref=thenexusofprivacy.net) did not bomb it with BIPOC during the Twitter migration.... I can't even invite people here b/c of what they have experienced or heard about others experiencing." > > – [Damon Outlaw](https://firefish.social/notes/9facp5emmg?ref=thenexusofprivacy.net), May 2023 ## Instance-level federation choices are a blunt but powerful safety tool ![A dialog, with the title New domain block. On the left: Domain: mastodon.social. On the right: Severity: Limit](https://thenexusofprivacy.net/content/images/2023/11/domain-block.png) Mastodon administrator screen managing instance-level blocking > "Instance-level federation choices are an important tool for sites that want to create a safer environment (although need to be complemented by user-level control and other functionality)." > > – [Lessons (so far) from Mastodon](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=privacy.thenexus.today), originally written May 2017 For people who *do* have good experience, one of the key reasons is a powerful tool Mastodon first developed back in 2017: *instance-level blocking,* including the ability to - *defederate* (aka *suspend*) another instance, preventing future communications and removing all existing connections between accounts on the two instances - *limit* (aka *silence*) another instance, limiting the visibility of posts and notifications from that instance to some extent (although not completely) unless people are following the account that makes them. - *reject reports* from another instance, preventing malicious reporting - *reject media* from another instance, to ensure that illegal or objectionable content isn't federated > *Terminology note: yes, it's confusing. Different people use different terms for similar things, and sometimes the same term for different things ... and the "official" terminology has changed over the years.* Of course, instance-level blocking is a very blunt tool, and can have significant costs as well. Mastodon unhelpfully magnifies the costs by not giving an option to restore any connections that are severed by defederation,[14](#fn-oops) not letting people know when they've lost connections because of defederation, and making the experience of moving between instances [unpleasant and awkward](https://erinkissane.com/notes-from-a-mastodon-migration?ref=thenexusofprivacy.net). Opinions differ on how to balance the costs and benefits, especially in situations where are some bad actors on an instance as well as also lots of people who *aren't* bad actors. ‌ ![Post from OnlyBrownMastodon (@onlybrownmastodon@mastodon.social): Many nonwhite Mastodon servers _intentionally_ defederate from the majority of Mastodon, specifically in order to _protect_ themselves from the violently bigoted white population surrounding them. For a white person on the Fediverse, defederation is punishment; for the rest of us, it is a form of self-defence. Oct 30, 2023](https://thenexusofprivacy.net/content/images/2023/11/Screenshot-2023-11-07-at-9.25.41-PM.png) Instance blocking decisions often spark heated discussions. For example, suppose an instance's admin makes a series of jokes that some people consider perfectly fine but others consider racist, and then verbally attacks people who report the posts or call them out. Others on their instance join in as well, defending somebody they see as unfairly accused, and in the process make some comments that they think are just fine but others consider racist. When those comments are reported, the moderators (who thinks they're just fine) doesn't take action. Depending on how you look at it, it's either - a pattern of racist behavior by the admin and members of the instance, failure to moderate racist posts, and brigading by the members of the instance, - or a pattern of false accusations and malicious reporting from people on other instances Is defederation (or limiting) appropriate? If so, who should be defederated or limited – the instance with the comments that some find racist, or the instances reporting comments as racist that others think are just fine? Unsurprisingly, opinions differ. In situations like this, white people are more likely to be forgiving of the posts and behavior that people of color see as racist – and, more likely to see any resulting defederation or limiting as a punishment. Or consider the scenario [Mahal](https://todon.eu/@mahal/111434366008582428?ref=thenexusofprivacy.net) discusses on todon.eu, one othat I've heard repeatedly from other moderators as well: > "If you have users\* that talk about #Palestine or especially tag out the @palestine and @israel groups (\*especially\* when they speak positively about Palestine), beware. > > These people will get reported by bad-faith right-wingers, neoliberals, \*and\* genocide apologist leftists. > > They will pressure you. They will annoy you. They will do everything they can until you get pissed off and do something about those people, who are then completely powerless against your ability to make them migrate and go through the set-up process again." If a specific instance is the source of a lot of these bad-faith pressure, blocking reports can help substantially. But if the bad-faith pressure also comes in the form of replies and tags from that instance, when is silencing or blocking appropriate? I'll delve more into the other scenarios where opinions differ on whether defederation or limiting is or isn't appropriate in the next session. First though I really want to emphasize the value of instance-level blocking. - Defederating from a few hundred "worst-of-the-worst" instances makes a huge difference. - Defederating or limiting large loosely-moderated instances (like the "flagship" mastodon.social) that are frequent sources of racism, misogyny, and transmisia[15](#fn-transmisia) means even lessharassment and bigotry (as well as less spam). - Mass defederation can also send a powerful message. When far-right social network Gab started using Mastodon software in 2019, most fediverse instances swiftly defederated from it. Bye!!!!!!! Instance-level blocking really is a very powerful tool. ‌ ## #FediBlock and receipts > **"Ra’il**: Tell me about the #Fediblock hashtag. I didn’t even realize that you, specifically, had created it when I first joined Mastodon, that’s how widespread it’s become. What led to its creation and how were you initially using it? > > **Marcia**: That started because a guy created a mastodon.social account and just started sexually harassing femmes with bigger accounts, and maybe not also necessarily bigger accounts, but visible femmes, if I remember correctly. A lot of people were complaining about it, but because of the way federation is, it was kind of janky, getting the info out on just this one particular guy. You’d block him, he’d get suspended, he’d start up again, and it was rinse and repeat like three or four times. It was ridiculous. > > So, I just thought, *man I wish there was a way to spotlight on this person so that anyone could, kind of, figure it out*. So I said, *Right: #Fediblock. I’m blocking this person. Harassers like this guy, I’m going to continue to put in this channel, so that people can follow, cause this is getting ridiculous. I shouldn’t have to see all this kind of misogynistic garbage in my mentions all the time*. > > And I asked my friend to spread it to her channels to get the word out . . . We did, and it just took off from there." > > – Ra’il I'Nasah Kiam and Marcia X, [Blackness in the Fediverse](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x/?ref=privacy.thenexus.today), *Logic Magazine, 2023* > "FediBlock was started by a Person of Color to help marginalized identities stay safe on the Fediverse. Don't let them whitewash its history. > > – [So Your Black Ass Still Wants to Get on Mastodon](https://qcb.neocities.org/mastodon?ref=thenexusofprivacy.net), Albinanigans When an admin blocks an instance for spreading harassment and hate, they often want to tip off other admins who may well also want to block that instance. Back in 2017, Marcia X created the #FediBlock hashtag, and Ginger helped spread it via faer networks, to make it easier for admins and users to share blocking information. Usually, posts to #FediBlock come with receipts – links or screenshots to posts or site rules that justify the call for widespread blocking – although sometimes the name of the domain is enough. #FediBlock continues to be a useful channel for sharing this information, and in retrospect it's quite possibly the first example of a "[moderation relay](https://bsky.app/profile/rudyfraser.com/post/3lo7zgsh6bk2a?ref=thenexusofprivacy.net)" – a concept that Rudy Fraser of Blacksky independently developed in the ATmosphere (a fediverse built around Bliuesky's AT protocol) in 2025\. That said, FediBlock although it has its limits. For one thing, anybody can post to a hashtag, so without knowing the reputation of the person making a post to the hashtag it's hard to know how much credibility to give the recommendation. And Mastodon's search functionality has historically been very weak, so there's no easy way to search the #FediBlock hashtag to see whether specific instances have been mentioned. Multiple attempts to provide collections of #FediBlock references (without involving or crediting its creators) have been abandoned; without curation, a collection isn't particularly useful – and can easily be subverted. So as of today, there's often no good answer to questions like "why has instance X been widely blocked?" or "instance X has been blocked for hate speech, but was it really hate speech or just a moderator of another instance with a grudge?" Long-time admins know about a few low-profile well-curated sites that record some vetted #FediBlock entries – including Seirdy's incredibly valuable [Receipts](https://seirdy.one/posts/2023/05/02/fediverse-blocklists/?ref=thenexusofprivacy.net#receipts) listing, covering most of the worst-of-the-worst. Google and other search engines have partial information as well, but it's all very time-consuming and hit-or-miss. 2023 has seen the emergence of instance catalogs like [The Bad Space (TBS) and Fediseer](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/) that collect more of this information, although as I discuss in [It’s possible to talk about The Bad Space without being racist or anti-trans – but it’s not as easy as it sounds](https://thenexusofprivacy.net/the-bad-space/) have also sparked a lot of resistance. Of course, this isn't a Fediverse-only pattern; Blacksky's founder and moderators are similarly targeted by regular harassment. It's almost like white people have a problem with tools for Black people to defend themselves. And receipts aren't a panacea. Some of the incidents that lead to instances being blocked can be quite complex, so receipts are likely to be incomplete at best. As [Sven Slootweg points out](https://social.pixie.town/@joepie91/111489660920971903?ref=privacy.thenexus.today), "a lot of bans/defederations/whatever are not handed out for specific directly-observable behaviour, but for the offender's active refusal to reflect or reconsider when approached about it," which means that to understand the decision "you actually need to do the work of understanding the full context." In other situations, providing receipts can open up the blocklist maintainer (or people who had reported problems or previously been targeted) to legal risk. > "\[W\]hen the people who were being harassed provided receipts, they were accused of 'screenshot dunking'. The people who were harassing them sought any reason, however tenuous, to dismiss their receipts or to call into question their credibility or attack and bully them into eventually just not posting receipts. This was deliberate, and it happened extensively, and the result is that *many* folk on fedi are now understandably reluctant to share receipts because of the abuse and backlash they received for doing it the first time." > > – mastodon.art moderator Welsh Pixie, discussing the role of receipts in the Play Vicious harassment Still, despite their limitations, receipts can be very useful in many circumstances; I (and others) frequently look at Seirdy's list and the information on The Bad Space. ## Instance-level federation decisions reflect norms, policies, interpretations, and (sometimes) strategy ![Norm pluralism in the fediverse: One person’s harassment (‘reply guy’) can be another person’s social norm correction ⇒ morally motivated networked harassment (Marwick) Defederation can both be a form of norm correction and a protective measure against harassment: “if you do not enforce the same norms as us, we sever ties”. Fediverse architecture allows plurality of norms due to federation/defederation and portability. Pitfalls: Prioritising federation leading to (white, heteronormative) norm domination Excessive fragmentation leading to toxic polarisation](https://thenexusofprivacy.net/content/images/2023/11/Screenshot-2023-11-09-at-10.48.34-PM.png) Nathalie Van Raemdonck, [The value of blocklists; tension field between federation and safe spaces](https://docs.google.com/presentation/d/1q24gUt5DKEIeonb7WT4cMRD7RyZwpoY9/edit?ref=thenexusofprivacy.net#slide=id.p3) For some instances, defederating from Gab was based on norms: we don't tolerate white supremacists, Gab embodies white supremacy, so we want nothing to do with them. For others, it was more a matter of safety: defederating from Gab cuts down on harassment. Some went further: two-level defederation, defederating from any instance that federates with Gab as well as defederating Gab. Spamming #FediBlock is a good example of a situation where disagreement on a norm relates to Only Brown Mastodon's point above about different views of defederation. Some people see spamming #FediBlock as interfering with a safety mechanism created by a queer Afro-Indigenous woman and used by many inntance admins to help protect people against racist abuse – so grounds for defederation if admins don't take it as action. Others see spamming #FediBlock as a protest against a mechanism they don't like, or just something to do for lulz, so see these defederations as unfair and punitive. Even when there's apparent agreement on a norm, interpretations are likely to differ. Consider the situation Mahal discusses above. There's wide agreement on the fediverse that antisemitism is bad; as Mahal says, people making real antisemitic comments and resorting to hate speech "absolutely deserve the boot." But what happens when somebody makes a post about the situation in Gaza that Zionist Jews see as antisemitic and anti-Zionist Jews don’t? If the moderators don’t take the posts down, are they being antisemitic? Conversely, if the moderators *do* take them down, are they being anti-Palestinian? Is defederation (or limiting) appropriate – or is calling for defederation antisemitic? To me, as an anti-Zionist Jew, the answers seem clear;[16](#fn-parting-ways) once again, though, opinions differ. And (at the risk of sounding like a broken record) in many situations, moderators – or people discussing moderator decisions – don't have the knowledge to understand why something is racist. Consider this example, from @futurebird@sauropod.win's excellent [Mastodon Moderation Puzzles](https://docs.google.com/document/d/1LK8QL-OFpiXBy0YqUw7U4qmJOUIOaryisaqQB0jBQMs/preview?ref=thenexusofprivacy.net). > "You get 4 reports from users who all seem to be friends all pointing to a series of posts where the account is having an argument with one of the 4 reporters. The conversation is hostile, but contains no obvious slurs. The 4 reports say that the poster was being very racist, but it's not obvious to you how." > > *As a mod what do you do?* I saw a spectacular example of this several months ago, with a series of posts from white people questioning an Indigenous person's identity, culture, and lived experiences. Even though it didn't include slurs, multiple Indigenous people described it as racist ... but the original posters, and many other white people who defended them, didn't see it that way. The posts eventually got taken down, but even today I see other white people characterizing the descriptions of racism as defamatory. ### Discussions often become contentious So discussions about whether defederation (or limiting) is appropriate often become contentious in situations when ... - an instance's moderators frequently don't take action when racist, misogynistic, anti-LGBTQ+, antisemitic, anti-Muslim, or casteist posts are reported – or only take action after significant pressure and a long delay - an instance hosts a known racist, misogynistic, or anti-LGBTQ+ harasser - an instance's admin or moderator is engaging in – or has a history of engaging in – harassment - an instance's admin or moderator has a history of anti-Black, anti-Indigenous, or anti-trans activity - an instance's members repeatedly make false accusations that somebody is racist or anti-trans - an instance's members try to suppress discussions of racist or anti-trans behavior by brigading people who bring the topics up (or spamming the #FediBlock hashtag) - an instance's moderators retaliate against people who report racist or anti-trans posts - an instance's moderator, from a marginalized background, is accused of having a history of sexual assault – but claims that it's a false accusation, based on a case of mistaken identity - an instance's members don't always put content warnings (CWs) on posts with sexual images for content from their everyday lives[17](#fn-woof-group-cws) Similarly, there's often debate about if and when it's approprate to re-federate. What if an instance has been defederated because of concerns that an admin or moderator is a harasser who can't be trusted, and then the person steps down? Or suppose an multiple admittedly-mistaken decisions by an instance's moderators that impacted other instances leads to them being silenced, but then a problematic moderator leaves the instance and they work to improve their processes. At what point does it make sense to unsilence them? What if it turns out the processes *haven't* improved, and/or more mistakes get made? Instances ' decisions to preemptively block Meta's new social network Threads is also proved very contentious. On the one hand, as [Why block Meta?](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#why) discusses, there are strong safety- and norms-based arguments for doing so, given Meta's tolerance of anti-trans hate groups and white supremacists, history of illegal behavior, experiments on their users, and contributions to genocide. [Why the Anti-Meta Fedi Pact is good strategy for people who want the fediverse to be an alternative to surveillance capitalism](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#strategy) makes the case that blocking Meta is also good strategy. On the other hand, the cis guys I quote in [Two views of the fediverse](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#two-views) see it differently. [Dan Gillmor](https://mastodon.social/@dangillmor/110573391192806076?ref=privacy.thenexus.today), for example, argues that "preemptively blocking them -- and the people already using them -- from your instance guarantees less relevance for the fediverse." [John Gruber](https://daringfireball.net/linked/2023/06/19/not-that-kind-of-open?ref=privacy.thenexus.today) goes farther, describing the Anti-Meta Pact as "petty and deliberately insular" and that any instance that blocks Meta will be an "[island of misfit loser zealots](https://misfitloserzealot.club/?ref=privacy.thenexus.today)." And [Chris Trottier](https://atomicpoet.org/notice/AWYZ1Mo6bA30MFSiES?ref=privacy.thenexus.today) dismisses the safety argument, suggesting that "if your community can’t survive Meta using ActivityPub, then it doesn’t deserve to exist." ### Transitive defederation is especially contentious *Transitive defederation* – defederating from all the instances that federate directly or indirectly with a toxic instance – is particularly controversial. Is it grounds for defederation if an instance federates with a white supremacist instance like Stormfront or Gab, or an anti-trans hate instance like kiwiframs? Derek Caelin's [Decentralized Networks vs The Trolls](https://link.springer.com/chapter/10.1007/978-3-030-79072-1%5F8?ref=thenexusofprivacy.net) quote from mastodon.technology's admin Ash Furrow reflects safety, norms, and strategy: > "Setting up two degrees of separation from Gab is a rare step, but Furrow sees it as a necessary step, since through them negative content might seep into the instance he maintains. > > "It’s either the case that they agree and they’re like ‘oh wow, I don’t want to be associated with this at all’ or they see it in sort of free speech abso- > lutionist terms....And, you know, I can kind of see where they’re coming from – and listen, I’m Canadian, I’m not really a very vocal person, I don’t like confrontation – but I’ll tell them, ‘is federating with Gab more impor- > tant than federating with Mastodon.technology?’ It’s a decision that I put in their field."" As always, opinions differ. Many see federating with an instance that tolerates white supremacists and transhopbia as tolerating white supremacists and transphobes (and thus in conflict with most fediverse instances stated values); others don’t. Some agree that it’s tolerating white supremacists and transphobes but don’t see that as grounds for defederation. Others see it in terms of a no-platform strategy. An earlier version of this article suggested that "norm-based transitive defederation can be especially contentious," but as [the discussions about Meta's Threads highlight](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/), safety-based transitive defederation can also be especially contentious. Erin Kissane's excellent [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net) recommends that people wanting "reasonably sturdy protection" from hate groups on Threads consider being on an instance "that federates only with servers that also refuse to federate with Threads." My own [Why just blocking Meta’s Threads won’t be enough to protect your privacy once they join the fediverse](https://thenexusofprivacy.net/just-blocking-threads-isnt-enough/) similarly focuses on safety benefits. Tim Chambers, however describes providing this reasonably sturdy protection as "[the nuclear option](https://www.timothychambers.net/2023/07/03/instagram-threads-and.html?ref=thenexusofprivacy.net)." On *We Distribute*, Sean Tilley says "The [problem](https://wedistribute.org/2023/12/tangled-up-threads/?ref=thenexusofprivacy.net) is that there’s a movement of people who want to block anything and anyone that doesn’t choose to block Threads themselves" and notes that "a lot of people worry that this hysteria could lead to a massive fragmentation of the Fediverse, effectively doing Meta’s job for free." ## ## To be continued! The discussion continues in - [Blocklists in the fediverse](https://thenexusofprivacy.net/blocklists-in-the-fediverse/) - [It’s possible to talk about The Bad Space without being racist or anti-trans – but it’s not as easy as it sounds](https://thenexusofprivacy.net/the-bad-space/) - [Compare and contrast: Fediseer, FIRES, and The Bad Space](https://thenexusofprivacy.net/fediseer-fires-and-the-bad-space/) - [Steps to a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/) - ... - A golden opportunity for the fediverse – and whatever comes next Here's a sneak preview of the discussions of [blocklists](https://thenexusofprivacy.net/blocklists-in-the-fediverse/) > With hundreds of problematic instances out there, blocking them individually can be tedious and error-prone – and new admins often don't know to do it.. Starting in early 2023, Mastodon began providing the ability for admins to protect themselves from hundreds of problematic instances at a time by uploading *blocklists* (aka *denylists*).... > > \[W\]idely-shared blocklists introduce risks of major harms – harms that are especially likely to fall on already-marginalized communities.... > > It would be great if Mastodon and other fediverse software had other good tools for dealing with harassment and abuse to complement instance-level blocking – and, ideally, reduce the need for blocklists. But it doesn't, at least not yet.... > > So despite the costs of instance-level blocking, and the potential harms of blocklists, they're the only currently-available solution for dealing with the hundreds of Nazi instances – and thousands of weakly-moderated instances, including some of the biggest, where moderators frequently don't take action on racist, anti-LGBTAIQ2S+, antisemitic, anti-Muslim, etc content. As a result, today's fediverse is very reliant on them. > To see new installments as they're published, follow [@thenexusofprivacy@infosec.exchange](https://infosec.exchange/@thenexusofprivacy?ref=thenexusofprivacy.net) or [subscribe to the Nexus of Privacy newsletter](https://thenexusofprivacy.net/#/portal/signup). --- ## Notes 1 According to [fedidb.org](https://fedidb.org/?ref=thenexusofprivacy.net), the number of monthly active fediverse users has decreased by about 20% since January 2022. 2 I'm using LGBTQIA2S+ as a shorthand for lesbian, gay, gender non-conforming, genderqueer, bi, trans, queer, intersex, asexual, agender, [two-sprit](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today), and others (including non-binary people) who are not straight, cis, and heteronormative. [Julia Serrano's trans, gender, sexuality, and activism glossary](https://www.juliaserano.com/terminology.html?ref=privacy.thenexus.today) has definitions for most of terms, and discusses the tensions between ever-growing and always incomplete acronyms and more abstract terms like "gender and sexual minorities". [OACAS Library Guides' Two-spirit identities page](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today) goes into more detail on this often-overlooked intersectional aspect of non-cis identity. 3 Which is why the footnote numbers are currently a bit strange: footnotes 4, 5, 6, 7, and 8 are in the yet-to-be-published revised intro. But then, my footnote numbers are often a bit strange ... I'm sure by the time I'm done there will be footnotes with decimal points in the numbers.3.1 3.1 Like this! 8 Virtually all the issues and obvious next steps I discussed in 2017-18's [Lessons (so far) from Mastodon ](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=thenexusofprivacy.net)remain issues and obvious next steps today. 9 Bonfire's boundaries support includes the ability to limit replies; Streams has supported limiting replies for years; GoToSocial plans to add this functionality early next year. Heck, [even Bluesky has announced plans to add this](https://techcrunch.com/2023/12/01/bluesky-rolls-out-automated-moderation-tools-plus-user-and-moderation-lists/?ref=thenexusofprivacy.net). emceeaich's 2020 github feature request [Enable Twitter-style Reply Controls on a Per-Toot Basis](https://github.com/mastodon/mastodon/issues/14762?ref=thenexusofprivacy.net) includes a [comment from glitch-soc maintainer ClearlyClaire](https://github.com/mastodon/mastodon/issues/14762?ref=thenexusofprivacy.net#issuecomment-690450780) describing some of the challenges implementing this in Mastodon; Claire's [Federation Enhancement Proposal 5624](https://socialhub.activitypub.rocks/t/fep-5624-per-object-reply-control-policies/2723?ref=thenexusofprivacy.net) and the discussion under it has a lot more detail. 10 If you're on the web, it's on the Settings page under Preferences/Notifications. In the Mastodon mible app, click on the gear icon at the top right to get to Settings, scroll down to *The Boring Zone*, click on *Account Settings*. Once you authorize signing in to your Mastodon account, you get to the *Account settings* page; then all you need to is click on the menu at the top right and select *Preferences*, click on the Menu again and select *Notifications*, and scroll down to *Other notification settings*. How intuitive! And there's a caveat here: if this setting's enabled, Mastodon silently discards DMs, which often isn't what's wanted; auto-notification of "I don't accept DMs" and/or the equivalent of Twitter's message requests would make the functionality more useful. 11 [authorized fetch](https://hub.sunny.garden/2023/06/28/what-does-authorized%5Ffetch-actually-do?ref=thenexusofprivacy.net), also known as "secure mode". There are caveats here as well. For one thing, as the lengthy warning in Mastodon's documentation describes, [turning it on has some significant drawbacks](https://docs.joinmastodon.org/admin/config/?ref=thenexusofprivacy.net#authorized%5Ffetch). And even with it enabled, protection is still limited. For one thing, public and unlisted posts can still be visible – to blocked users and everybody else – through a browser as long as you're not logged in, unless the admin has turned on another option that also has drawbacks. This is similar to public Twitter or Instagram posts; but Twitter and Instagram offer the option of making your profile private, which means your posts are no longer visible, and Mastodon doesn't have equivalent functionality. And unlisted Mastodon posts are visible to anybody browsing your profile with a not-logged-in browser, in contrast with unlisted YouTube videos. Not only that, unlisted Mastodon posts can even wind up in Google searches ... talk about violating the principle of least surprise! 12 That's right: this valuable anti-harassment functionality has been implemented for six years but Rochko refuses to make it broadly avaiable. [Does Mastodon really prioritize stopping harassment?](https://thenexusofprivacy.net/mastodon-a-partial-history/#does-mastodon-really-prioritize-stopping-harassment) has more, and I'll probably rant about it at least one more time over the couse of this series 13 [LIMITED\_FEDERATION\_MODE](https://docs.joinmastodon.org/admin/config/?ref=thenexusofprivacy.net#limited%5Ffederation%5Fmode). And guess what, there's another caveat: you can't combine LIMITED\_FEDERATION\_MODE with instance-level blocking. 14 As I said [a few months ago](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#fn9), describing an incident where an admin defederated an instance and then on further reflection decided it had been an overreaction, > "\[A\]fter six years why wasn't there an option of defederating in a way that allows connections to be reestablished when the situation changes and refederation is possible? If you look in inga-lovinde 's [Improve defederation UX](https://github.com/mastodon/mastodon/issues/15891?ref=privacy.thenexus.today) March 2021 feature request on Github, it's pretty clear that it's not the first time stuff like this happened." And it wasn't the last time stuff like this happened either. In mid-October, a tech.lgbt moderator decided to briefly suspend and unsuspend connections to servers that had been critical of tech.lgbt, in hopes that it would "break the tension and hostility the team had seen between these connections." Oops. As the tech.lgbt moderators [commented](https://tech.lgbt/@mods/111266259720653667?ref=thenexusofprivacy.net) afterwards, "severing connections is NOT a way to break hostility in threads and DMs." 15 [transmisia](https://translanguageprimer.com/transmisia/?ref=thenexusofprivacy.net) – hate for trans people – is increasingly used as an alternative to transphobia. More on the use of -misia instead of phobia, see the discussion in [Simmons University's Anti-oppression guide](https://simmons.libguides.com/anti-oppression?ref=thenexusofprivacy.net#s-lib-ctab-10174165-1) 16 For an in-depth exploration of this topic, see Judith Butler's [Parting Ways: Jewishness and the Critique of Zionism](http://cup.columbia.edu/book/parting-ways/9780231146104?ref=thenexusofprivacy.net), which engages Jewish philosophical positions to articulate a critique of political Zionism and its practices of illegitimate state violence, nationalism, and state-sponsored racism. 17 woof.group's guidelines, for example, don't require CW's on textual posts unless "it's likely to cause emotional distress for a general leather audience" – but others may have different standards for what causes emotional distress. 18 [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) has more on various opinions on whether or not to block Meta ## Update log ongoing: minor fixes and additions in response to feedback and as I discover new links October 2024: change title to specifically refer to ActivityPub Fediverse, update terminology in intro section to start bringing it more in line with [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) ### Can the Fediverse help stop Bad Internet Bills? URL: https://thenexusofprivacy.net/fediverse-bad-internet-bills-activism/ Last updated: 2026-04-16T03:09:49.000Z > Also posted [on We Distribute](https://wedistribute.org/2023/07/can-the-fediverse-help-stop-bad-internet-bills/?ref=thenexusofprivacy.net). > Join the conversation on [mastodon.social](https://mastodon.social/@wedistribute/110748345624266276?ref=thenexusofprivacy.net), [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/110748089398932169?ref=thenexusofprivacy.net), and [lemmy.sdf.org](https://lemmy.sdf.org/post/1122522?ref=thenexusofprivacy.net) > **"Red alert!** For the last six months, EFF, our supporters, and dozens of other groups have been sounding the alarm about several #BadInternetBills that have been put forward in Congress.We’ve made it clear that these bills are terrible ideas, but Congress is now considering packaging them together—possibly into must-pass legislation. I’m asking you to join us, ACLU, Fight for the Future, and other digital rights defenders in a week of action to protect the internet." > > – [You Can Help Stop These Bad Internet Bills](https://www.eff.org/deeplinks/2023/07/you-can-help-stop-these-bad-internet-bills?ref=thenexusofprivacy.net), Jason Kelley, Electronic Frontier Foundation Twitter and Reddit have both been incredibly valuable tools for activism over the years. The combination of Apartheid Clyde's "Twitter 2.0", and Reddit declaring on their moderators (and on app vendors, and on users, and especially on disabled moderators and users) leave organizers in a pickle. Can [the fediverse](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=thenexusofprivacy.net) help? It's tiny compared to big corporate social networks, but potentially big enough to have an impact. Of course, for any kind of activism that might targeted by law enforcement, the fediverse is a really bad choice. Use Signal or some other encrypted messaging for that. As [Dr. Johnathan Flowers has pointed ou](https://twitter.com/shengokai/status/1591655969360326657?ref=thenexusofprivacy.net)t, the fediverse also isn't currently well suited for activism like Black Lives Matter or #MeToo. And as we'll discuss below there are a lot of barriers to other kinds of activism as well. ## Playing to the Fediverse's Strengths But then again, the fediverse also has some potential advantages, especially for activism on topics like privacy, digital rights, and LGBTQIA2S+ issues.[1](#notes) [The fediverse was largely built by queer, trans, and non-binary people](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net), and many of the cis straight people there are allies. Not only that, a lot of people in the fediverse care passionately about privacy and digital rights. With all the discussion of [whether or not they should welcome its new surveillance-capitalism overlords](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/), it's a topic that's very much top of mind these days. So it's worth experimenting, and [the July 20-28 week of action on Bad Internet Bills](https://www.badinternetbills.com/?ref=thenexusofprivacy.net) is a great opportunity – to learn, and hopefully to have an impact as well. ## This is the Situation July 28 is the last day Congress is in session before their summer recess, and means supporters of the Bad Internet Bills are trying to sneak them through before then. Digital rights organizations along with other human rights and LGBTQIA2S+ rights groups are pushing back on multiple fronts – including social networks. Social network activism has played a big role in stopping other bad internet bills in the past, including last year's successful battles against EARN IT and KOSA, and campaigns on TikTok, Twitter, and other networks. But why should other networks have all the fun? I'll discuss details of the activism campaign below, as well as the fediverse's strengths and weaknesses as an activism platform, but first a bit about the bad internet bills. **The TL;DR summary is that there are several bills in play, including KOSA and EARN IT; they're bad; and as well as threatening encryption, they're especially bad for LGBTQIA2S+ people.** The next section has some details and links about why they're so bad, especially for LGBTQIA2S+ people. Or, feel free to skip ahead to [Legislative Activism 101](#legislative-activism) or the sections on specific tactics like [link aggregation](#link-aggregation) and [hashtags](#hashtags), and come back later for the details. > **Want to help stop these Bad Internet Bills?** > Here's 4 easy things you can do: > 1\. Boost posts on [#BadInternetBills](https://mastodon.social/tags/badinternetbills?ref=thenexusofprivacy.net) and [#KOSA](kosa) hashtags > 2\. Upvote and boost posts in the Bad Internet Bills [Lemmy Community](https://lemmy.sdf.org/c/bad%5Finternet%5Fbills?ref=thenexusofprivacy.net) and [kbin magazine](https://kbin.social/m/BadInternetBills?ref=thenexusofprivacy.net) > 3\. Get the word out on other social networks too > 4\. If you live in the US, contact your legislators using Fight for the Future's [https://www.badinternetbills.com/](https://www.badinternetbills.com/?ref=thenexusofprivacy.net) ## Have I mentioned yet how bad these internet bills are? ![Which of these bills had you heard of before this post? 62% EARN IT. 31% KOSA. 66% RESTRICT Act. 24% Stop CSAM](https://thenexusofprivacy.net/content/images/2023/07/Screen-Shot-2023-07-18-at-10.35.22-PM.png) A poll on infosec.exchange, July 15 There are so many bad internet bills out there that I forgot to list one of them in the poll, so don't feel bad if you haven't heard of them. Here's a quick overview of the ones we'll be focusing on. EFF's [You Can Help Stop These Bad Internet Bills](https://www.eff.org/deeplinks/2023/07/you-can-help-stop-these-bad-internet-bills?ref=thenexusofprivacy.net) and Fight for the Future's [Bad Internet Bills](https://badinternetbills.com/?ref=thenexusofprivacy.net) have overviews of KOSA, EARN IT, STOP CSAM, the RESTRICT Act, and the Cooper Davis Act, along with links you can click to contact your legislators (if you live in the US). Unfortunately, all of these bills have bipartisan support, so also have a chance of passing. These bills all *sound* good at first – they're all framed as protecting children – but the way they're written would have bad side effects. To start with, they'd actually make kids *less* safe. And that's not all: - [KOSA would be weaponized to attack LGBTQ+ people and abortion rights](https://cdt.org/press/more-than-90-human-rights-and-lgbtq-groups-sign-letter-opposing-kosa/?ref=thenexusofprivacy.net), as 90+ human rights and LGBTQIA2S+ said in a letter to Congress last year, - [EARN IT would threaten encryption and impose universal scanning of our messages, photos, and files](https://cdt.org/insights/cdt-leads-broad-civil-society-coalition-urging-senate-to-drop-earn-it-act/?ref=thenexusofprivacy.net). - Despite its name, [STOP CSAM wouldn't actually stop child sexual abuse material](https://cdt.org/insights/the-stop-csam-act-threatens-free-expression-and-privacy-rights-of-children-and-adults/?ref=thenexusofprivacy.net), but jeopardize the ability to seek information about reproductive healthcare or sexual identity online - [The RESTRICT Act ](https://www.eff.org/deeplinks/2023/04/broad-vague-restrict-act-dangerous-substitute-comprehensive-data-privacy?ref=thenexusofprivacy.net)is supposedly just about TikTok but actually gives Biden (and all future presidents!) extraordinary new powers to ban Americans from using entire apps simply by claiming they pose a “threat to national security." What could possibly go wrong? - [The Cooper Davis Act](https://gizmodo.com/cooper-davis-act-drugs-companies-report-users-1850510171?ref=thenexusofprivacy.net) would turn messaging services, social media companies, and even cloud providers into Drug Enforcement Administration (DEA) informants. Like I said ... these bills are bad! Here's a press conference with more information, including an appearance partway through from Sen. Ron Wyden. ## Legislative activism 101 he basic idea of social media activism is straightforward: try to get as much visibility as possible for the campaign, and get people to take action. Visibility by itself is valuable, raising awareness of the issue. Some percentage of people who hear about Bad Internet Bills will take action, helping to get the word out and (if they're in the US) potentially contacting their Congresspeople. Contacting Congress can make a difference on bills like these that aren't straight party-line votes. The more people who do it, the more likely staffers and legislators are to pay attention. So, posts and links that make it easy for people to contact Congress, and explain why it's worth making the effort. Visibility can also lead to coverage in traditional media that Congress pays attention to, and that can have an even bigger impact. For example, we've heard that Senate Majority Leader Schumer won't put the bad internet bills to vote, if he thinks it'll lead to a lot of controversy. Tech journalists are looking for stories about the fediverse. What would it take to get an article in *Politico* or *Wired*? Maybe a headline like "Bad internet bills spark protest in the fediverse" or something like that? It's a long shot, but it's worth a try. ## Lemmy and kbin FTW! There are a lot of different techniques for social network activism. On Reddit and other link aggregators, for example, it's about getting upvotes on links in popular subreddits, and ideally getting something on the front page. Back in 2008 an open letter [Get FISA Right](https://medium.com/get-fisa-right/ten-years-later-get-fisa-right-and-the-future-of-civil-liberties-activism-a15e2e51ca6c?ref=thenexusofprivacy.net) wrote to Senator Obama made the front page on Digg and wound up in the New York Times, Wired, CNN, and Time magazine; [Restore the Fourth](https://www.talesfromthe.net/jon/?p=3489&ref=thenexusofprivacy.net) took a simimilar approach on Reddit in 2013. And good news, the fediverse has link aggregators too: Lemmy and kbin. Here's a link somebody submitted yesterday in lemmy.world Technology community. [![You Can Help Stop These Bad Internet Bills, shared by @KelsonV@lemmy.world to Technology@lemmy.world 3 hours ago. 187 upvotes, 8 comments, crossposted to 7 other communities](https://thenexusofprivacy.net/content/images/2023/07/Screen-Shot-2023-07-19-at-8.32.16-PM.png)](https://lemmy.world/post/1783401?ref=thenexusofprivacy.net) [EFF's action on @technology@lemmy.world](https://lemmy.world/post/1783401?ref=thenexusofprivacy.net), screenshot on July 19 If you look in the comments, there are already a couple people saying that they contacted their legislators (which almost certainly means there are at least a few more who did the same but didn't bother to leave a comment). And this link has been cross-posted to several other communities where it's on-topic, so it's getting broader visibility. Another link aggregator tactic that works well on Reddit is to have a subreddit that collects all the links on Bad Internet Bills so that it's easy to track for people who are really interested in the topic. It's worth trying in the fediverse as well, so I set up the [bad\_internet\_bills Lemmy community](https://lemmy.sdf.org/c/bad%5Finternet%5Fbills?ref=thenexusofprivacy.net) and [the BadInternetBills kbin magazine](https://kbin.social/m/BadInternetBills?ref=thenexusofprivacy.net), so that I (and hopefully others!) can cross-post links there as the week goes on.2 As this example shows, the most effective "take action links" go to pages from organizations like EFF, Fight for the Future, and ACLU – names that many on the fediverse will recognize. News stories and opinion pieces are also good to share, especially if you include a link to an action as well. Why yes, that's a hint! If you're on Lemmy or Kbin, please share news stories and action links about these Bad Internet Bills when you see them! ## I 💜 #Hashtags Hashtags are great for activism, and there are some natural ones for this campaign - [#BadInternetBills](https://mastodon.social/tags/badinternetbills?ref=thenexusofprivacy.net), of course, and hashtags for each bill like [#KOSA](kosa). \[The links go to accounts on mastodon.social. If you've got an account on a different Mastodon instance, you may need need to copy the link, switch to a window where you're logged into your instance, paste the link into the search box (which is on the Explore page if you're using the mobile web interface), and then hit return. When people say "Mastodon's not that hard to use", you have my permission to roll your eyes at them.\] ### Trending A key aspect of hashtag activism on Twitter is figuring out how to work with Twitter's algorithms to get it to "trend" and get it exposed to more people. The fediverse likes to pretend that it doesn't have algorithms, but Mastodon's Explore tab (showing the posts with the most activity) and Trending Topics beg to differ. Getting #BadInternetBills to trend, or getting some posts on the Explore page, would be a great way of increasing visibility. On the other hand, we don't want to overwhelm people's feeds – and doing it by having everybody cut-and-paste the same message probably wouldn't go over well in the fediverse. So if trending happens organically, great, but it's something to focus on for now. ### Discovery Hashtags are still useful even if they don't trend, because the give people who want to help the campaign a way to find posts to share. If you're on Mastodon, Hometown, GoToSocial, Firefish, Akkoma, Friendica, kbin, or other fediverse software that lets you search by hashtag, check out the #BadInternetBills and #KOSA tags; hopefully you'll see something that looks interesting enough to boost. And a lot of fediverse software allows you to subscribe to a hashtag, which will mean that new links will show up in your home feed. ### Networking Once things get going, another good hashtag-related technique is to tag likely supporters (or contact them on other social networks or email), and ask them to help boost posts. People like George Takei, Molly JongFast, and Popehat have over 100,000 followers; evacide, Cory Doctorow, and Mike Masnick "only" have 30-60,000 but that's not chopped liver. On the other hand, they're all busy people, and we don't want to waste their time, so it makes sense to hold off on this until we start to get traction; if things don't take off this time, we might be better off waiting until the next campaign. ## It's harder than it sounds Even in the best of circumstances, it's hit-or-miss whether a social network activism campaign clicks – and the fediverse has a lot of barriers to activism. For one thing, most people aren't used to doing activism in the fediverse. Activists on Twitter will reflexively retweet and quote tweet action links when they see them; that's not the norm in the fediverse. And speaking of quote tweets, Mastodon doesn't have the equivalent – although Firefish does, and we'll take advantage of that. Not only that, a lot of fediverse culture and software sees "virality" as a bad thing ... so techniques that would be seen as just fine on other platforms might not work here – or might irritate people, making them counter-productive. Different norms for whether to CW (content warning) political posts add another complication. And usability issues affect everybody, including activists. The reason I described the cut-and-paste-into-the-search-box contortions above is because of an experience last November people, a couple of leaders of a well-known progressive organization said they were willing to help with a voting rights activism campaign I was experimenting with. I sent him them the link to the action, they clicked on it, ... and wound up in a non-logged-in tab, and couldn't figure out what to do with it. Of course seasoned Mastodonians know the trick of cut-and-pasting it into the search box in a logged-in window, but it's a huge barrier to newcomers – and the harder it is, the less likely people are to take action or even boost links. ### Federation Headaches Also, let's not forget the complexities of federation. Over the weekend, I did a short thread with a couple of polls ... but if somebody boosted only one of them, there's no guarantee that their followers would be able to see the whole thread. And software incompatibilities and bugs make it even more confusing. When I posted on infosec.exchange I tagged the Lemmy privacy community, but it didn't show up there – even though a similar approach has worked with other Lemmy communities in the past. Why? I have no idea. But, other platforms have their quirks as well. At one point polls performed extremely well on Facebook, then a few months later they changed the algorithm and they went nowhere. Is Twitter's algorithm favoring posts with links this week, or should I put the link in a reply? Experimenting is key no matter what platform you're on. There are ways to work around these issues, at least to some extent, and over time we'll figure out what works well in the fediverse. And hopefully the software will improve as well, because all of these are issues that affect other people besides activists. ## Let's experiment! > One of the big selling points of Mastodon and the broader fediverse is that it's not owned by a company like Meta, Twitter, or Google whose business models are based on surveillance and exploiting user data. A lot of people are in the fediverse because they care about privacy. Many have knowledge to share, are eager to learn more, and want to have an impact. > > – [#Privacy activism on Mastodon and in the fediverse](https://thenexusofprivacy.net/privacy-activism-mastodon-fediverse/), January 2023 And the fediverse also has some advantages when it comes to activism, starting with the people who are there. Queer, trans, and non-binary people, who are directly affected by these Bad Internet Bills like KOSA, play a big role in the fediverse – which as I observed in [A (partial) queer, trans, and non-binary history of Mastodon and the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net) is very different from the situation on any of the the big commercial social networks. And while [opinions in the fediverse differ on how to react to Meta potentially joining the fediverse](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/), most people on both sides of that question care about encryption, privacy, and digital rights. There are advantages at the software level as well. For example: - The integration between Lemmy, kbin, and Mastodon – while imperfect – is quite powerful when it works, and a lot better than the connection between Twitter and Reddit. - Firefish and Mastodon forks like Glitch-soc and Hometown allow much longer posts – and support formatting as well, which makes a huge difference. Try doing something like this on Twitter (or vanilla Mastodon for that matter)! - Firefish and Glitch-soc also have more flexible polls than Twitter, and there are probably some good ways to leverage that. So while it's hard to know how well it work, it's worth experimenting. If you'd like to help, here's three easy things you can do no matter where you live. - Boost posts on [#BadInternetBills](https://mastodon.social/tags/badinternetbills?ref=thenexusofprivacy.net) and [#KOSA](kosa) hashtags - Upvote and boost posts in the Bad Internet Bills [Lemmy Community](https://lemmy.sdf.org/c/bad%5Finternet%5Fbills?ref=thenexusofprivacy.net) and [kbin magazine](https://kbin.social/m/BadInternetBills?ref=thenexusofprivacy.net) - Get the word out on other social networks too And if you're in the US, please contact your legislators using Fight for the Future's [https://www.badinternetbills.com/](https://www.badinternetbills.com/?ref=thenexusofprivacy.net) or EFF's [You Can Help Stop These Bad Internet Bills](https://www.eff.org/deeplinks/2023/07/you-can-help-stop-these-bad-internet-bills?ref=thenexusofprivacy.net), ## Notes 1 I'm using LGBTQIA2S+ as a shorthand for lesbian, gay, gender non-conforming, genderqueer, bi, trans, queer, intersex, asexual, agender, [two-sprit](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today), and others who are not straight, cis, and heteronormative. [Julia Serrano's trans, gender, sexuality, and activism glossary](https://www.juliaserano.com/terminology.html?ref=privacy.thenexus.today) has definitions for most of terms, although resources like [OACAS Library Guides' Two-spirit identities page](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today) go into a lot more detail. Serrano also discusses the tensions between ever-growing and always incomplete acronyms and more abstract terms like "gender and sexual minorities". There's a Mastodon instance called lgbtqia.space, and Indigenous people are often overlooked in the fediverse, so I decided to go with the acronym despite its problems. Ontario Human Rights Commission's page on [Gender identity and gender expression](https://www3.ohrc.on.ca/en/policy-preventing-discrimination-because-gender-identity-and-gender-expression?ref=thenexusofprivacy.net) is a good short reference on the distinctions between gender identity, gender expression, sexual orientation, and sex. 2 At first I was only planning to set up a kbin magazine but as I was writing this article I had a hard time figuring out how to use a Lemmy account to crosspost a link to a Lemmy community and so decided to create a community as well. It's an experiment, let's see what works better! And they're spelled differently because lemmy doesn't allow uppercase in names, and I wanted to make it more readable and usable through screenreaders than having badinternetbills all munged together, so decided to use underscores. Sorry for the confusion. We learn by doing. ### The Fourth Amendment Is Not For Sale Act has a House Judiciary Committee markup tomorrow! URL: https://thenexusofprivacy.net/fansfa-hjc-markup/ Last updated: 2026-04-16T03:09:21.000Z > TAKE Action! Free Press' web form makes it easy to [Tell Congress to pass the Fourth Amendment Is Not For Sale Act](https://act.freepress.net/sign/fourth%5Famendment%5Fnot%5Ffor%5Fsale%5Fact?ref=thenexusofprivacy.net). The Fourth Amendment is Not for Sale Act closes the legal loophole that allows data brokers to sell Americans’ personal information to law enforcement and intelligence agencies without any court oversight. As Justin Hendrix describes, there was [strong bipartisan support for the Fourth Amendment is Not For Sale Act at last year's hearing](https://techpolicy.press/bipartisan-support-for-fourth-amendment-is-not-for-sale-act-at-house-judiciary-hearing/?ref=thenexusofprivacy.net), but alas former House Judiciary Committee Chair Jerry Nadler never scheduled a markup. But current House Judiciary Committee Chair Jim Jordan is also a strong supporter of the bill, and he's scheduled [a markup session tomorrow](https://judiciary.house.gov/committee-activity/markups/hr-1631-hr-4250-and-hr-4639?ref=thenexusofprivacy.net) (July 19) on [HR 4639](https://judiciary.house.gov/sites/evo-subsites/republicans-judiciary.house.gov/files/evo-media-document/hr-4639-bill-text.pdf?ref=thenexusofprivacy.net), the current version of the Fourth Amendment Is Not For Sale Act. If all goes well, the committee will advance a (potentially-amended) version of the bill ... a huge step forward! [Dozens of consumer advocacy, media justice and privacy rights groups supported FANSFA last year](https://www.freepress.net/sites/default/files/2022-01/final%5F-%5Ffanfsa%5Fsign-on%5Fletter%5Fjanuary%5F2022.pdf?ref=thenexusofprivacy.net) ... including EFF, ACLU, Brennan Center for Justice, Fight for the Future, United We Dream, and Freedom Works. If you'd like to add your voice, Free Press has a page that makes it easy to [Tell Congress to pass the Fourth Amendment Is Not For Sale Act](https://act.freepress.net/sign/fourth%5Famendment%5Fnot%5Ffor%5Fsale%5Fact?ref=thenexusofprivacy.net). And if you want to check out the markup tomorrow, [here's the page on the House Judiciary site](https://judiciary.house.gov/committee-activity/markups/hr-1631-hr-4250-and-hr-4639?ref=thenexusofprivacy.net). ### A clear victory for the free fediverse: Meta now says integrating with ActivityPub is "a long way out" URL: https://thenexusofprivacy.net/clear-victory-for-the-free-fediverse/ Last updated: 2026-04-16T03:08:33.000Z > Join the discussion on [Lemmy](https://lemmy.blahaj.zone/post/994867?ref=thenexusofprivacy.net) and [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/110730548405800226?ref=thenexusofprivacy.net)! When Meta launched their new Twitter competitor Threads on July 5, they said that it would be compatible with the ActivityPub protocol, Mastodon, and all the other decentralized social networks in the fediverse "[soon](https://about.fb.com/news/2023/07/introducing-threads-new-app-text-sharing/?ref=thenexusofprivacy.net)" – and Mastodon's Eugen Rochko welcomed it as a "clear victory for our cause." But on July 14, Alex Heath of the Verge reported that Meta's saying ActivityPub integration's "a long way out". Hey wait a second. Make up your mind already! Then again, Meta is Facebook (they changed their company hoping people would forget that [Mark F\*\*\*king Zuckerberg Is Not Your Friend](https://catvalente.substack.com/p/mark-fking-zuckerberg-is-not-your?ref=privacy.thenexus.today)), so it's not surprising that they gave a false impression originally. Also, Meta is Facebook, and for some strange reason some people in the fediverse see Facebook, Instagram, and Meta's track record – welcoming hate groups, making money from disinfo and discriminatory ads, backing authoritarian politicians, experimenting on their users, privacy abuses, contributing to genocides, etc – as [problematic](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#why). So even though guys like Rochko, long-time decentralized social network Evan Prodromou, and comedian John Gruber are eager to welcome their new surveillance capitalism overloards, others disagreed. For example: - Hundreds of instances (servers running Mastodon or other software) signed the Anti-Meta #FediPact pledging – and as the week went on more and more instances preemptively blocked threads.net. - Polls consistently showed most people want their instance to block Meta, with many are willing to move if that didn't happen? - Opposition from trans and queer people and LGBTQIA2S+-focused instances was overwhelming especially after Meta's refusal to moderate anti-LGBTQ+ hate groups on Threads? And from the perspective of the "free fediverse" that's *not* welcoming Meta, the new positioning that ActivityPub integration is "a long way out" is encouraging. OK, it's not as good as "when hell freezes over," but it's a heckuva lot better than "soon." In fact, I'd go so far as to say "a long way out" is a clear victory for the free fediverse's cause. The strong and broad resistance to Meta reinforces the point I made in [In chaos there is opportunity!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#chaos): Meta's potential arrival is a likely to be a good thing for the fediverse no matter whether or not they actually go forward with it. And as I predicted in [A (partial) queer, trans, and non-binary history of Mastodon and the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net). queer, trans, and non-binary people played a big role in shaping the future. Let’s take a moment to appreciate how different this is from the situation on any of the the big commercial social networks! That said, opinions differ; a lot of people in the fediverse *do* want to welcome Meta. So Meta and their supporters aren't going to give up on their plans to embrace and extend the fediverse just because of the pushback. And this is Meta (aka Facebook) we're talking about here, so don't assume that a "long way out" means anything more than "this is the story we think it's useful to tell today." I'll talk about their likely next steps below, along some good learning from the situation so far. But first, congratulations are in order! Kudos to - everybody who spoke out and talked about why they saw Meta's arrival as putting people at risk and clashing with the fediverse's values; - every instance that signed the #FediPact and/or announced they were blocking Meta - all the activists who got word out about reasons not to welcome Meta - and #FediPact creator vantablack, for drawing a line in the sand and mobilizing people to take action. Well done!!!! ## The next step in embrace-and-extend, coming soon to a standards working group near you > "This week a representative from Meta, a software engineer named Ben Savage, [joined](https://lists.w3.org/Archives/Public/public-swicg/2023Jul/0032.html?ref=thenexusofprivacy.net) the ActivityPub working group in the W3C." > > – [Threads Adopting ActivityPub Makes Sense, but Won’t Be Easy](https://thenewstack.io/threads-adopting-activitypub-makes-sense-but-wont-be-easy/?ref=thenexusofprivacy.net), Richard McManus, The New Stack Meta certainly made a big deal of "the fediverse" in Threads' launch, and they have lots of good business reasons for taking a decentralized approach, so they're not going to give up just because they're not wanted. I can't remember the last time that Facebook, Instagram, or Meta actually created a successful new product, but Threads' initial launch went well in terms of usage: 100,000,000 users signing up in less than a week, including lots of brands as well as white supremacists and anti-trans hate groups – key market segments that bring in a lot of revenue on Facebook and Instagram. Twitter is so horrible these days, and other commercial social networks aren't offering good alternatives yet; so if Meta executes even halfway competently they should see some signifcant usage. Then again, that's not a given – Threads' initial functionality is remarkably weak and (for many) [depressing](https://jogblog.substack.com/p/facebooks-threads-is-so-depressing). Time will tell. As Richard McManus points out in [Threads Adopting ActivityPub Makes Sense, but Won’t Be Easy](https://thenewstack.io/threads-adopting-activitypub-makes-sense-but-wont-be-easy/?ref=thenexusofprivacy.net), ActivityPub is a natural choice for Meta because it allows them to control the identity layer once they federate. It wouldn't surprise me if they're currently testing ActivityPub integration with one or more friendly Mastodon admins – or with brands like Disney, who are natural partners with audiences far more valuable to Meta than the current fediverse. Still, ActivityPub has some major weaknesses, so it also wouldn't surprise me if Meta's current position of "a long while" turns into "ActivityPub isn't ready for us yet so here's what we're doing in the interim". One obvious next step for Meta is to implementing proprietary ActivityPub extensions that address real problems in the current spec (just as Mastodon and other implementations do). As well as putting them in control, this gives Meta leverage to pressure the World Wide Web Consortium (W3C) SWICG (the "ActivityPub working group" McManus referred to, although technically it's not a working group) to make sure the next version of the standard is Meta-friendly. After all, if it doesn't meet Meta's needs then they'll have to (gasp) rethink their "commitment" to ActivityPub. Oh noes!!!!!!!!! It's a classic embrace-and-extend strategy, and Ploum's [How to Kill a Decentralised Network (such as the Fediverse)](https://ploum.net/2023-06-23-how-to-kill-decentralised-networks.html?ref=thenexusofprivacy.net) – describing the dismal outcome in a somewhat-similar situation with the XMPP protocol – is a cautionary tale. That said, there are also other perspectives on what happened with XMPP. Christina Warren, for example, highlights how XMPP advocates denial of key weakensses in the spec contributed to the situation, and the ActivityPub spec has some key weaknesses as well; Prodromou highlights the responsibility that he and others in the XMPP community had in not addressing the spam and harassment problems, and as I pointed out in [An interesting dynamic](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#an-interesting-dynamic), "some of the loudest voices for working with Meta ... don't actually have a good track record of prioritizing user safety." Any way you look at it, though, the parallels shouldn't be particularly comforting for the people welcoming Meta's embrace. Of course, Meta's a dues-paying member of the W3C, so of course they're allowed to be on the SWICG – and whatever working group gets the charter for the next version of ActivityPub (which as I understand it is beyond the scope of the SWICG). And a lot of anti-Meta people (including me) see the cards as so stacked in favor of Meta that we're not likely to spend much time in the process. As a result, Meta's very likely to get what they want in future versions of the "official" ActivityPub standard, although they'll no doubt still offer proprietary extensions as well. ActivityPub advocates are optimistic that they'll be able to resist embrace-and-extend. That seems optimistic to me (and quite frankly the free fediverse approach of just saying no to Meta's embrace seems a much better path to resisting) but we shall see. ## Good learning all around! One of the interesting dynamics of the discussion so far is so much of the resistance to Meta has come from queer and trans people, and that most of the loudest supporters of Meta in the fediverse are cis guys. Of course, Meta doesn't care what queer and trans people think – like I said, they're currently allowing anti-LGBTQ+ hate groups to run amok on Threads – so maybe they expected the pushback they got. Then again I also have to wonder whether Rochko, Prodromou, and Meta's other supporters in the fediverse had set corporate expectations properly. Comedian John Gruber, for example, was candid about his view that it's only "misfit loser zealots" who don't understand why the arrival of a genocidal racist anti-LGBTQ+ surveillance capitalism company like Meta is such a great thing. So if Meta actually was foolish enough to think that Gruber et al knew what they were talking about, they might well have mistakenly believed if only a few extremists who had reservations, and that most of the fediverse would indeed eagerly welcoming the creepy embrace of their new surveillance capitalism overlords. If so, they now know better. And if anybody in the fediverse was foolish enough to think that the cis guys welcoming Meta's embrace are prioritizing user's safety, or are looking out for trans and queer interests, they also now know better as well. Good learning all around! ## Things are looking good for the "free fediverse" > "Depending on how things evolve, it's quite possible we'll see a schism (or partition), with instances in the anti-Meta "free fediverse" blocking not just Meta instances, but also any instances that federate with Meta.... Threads' entrance to the fediverse actually **highlights** the advantage of "free fediverse" instances – which are likely to be *much* more appealing to the increasing number of people people who want as little as possible to do with Meta, surveillance capitalism, and all the harms and abuses that come with it" > > – [There are many fediverses -- and a lot of people will prefer them to Threads](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#many-fediverses) Meta's revised timeframe means that any potential schism won't happen for a while, and it's possible that the software could evolve in ways that make it less likely. One good outome from Meta's potential arrival would be for Mastodon and other software to start making progress on privacy and safety issues that have been ignored for years. If that happens before Meta starts federating, them there might be less pressure for transitive blocking. Still, whether or not a schism happens, this initial skirmish highlights the tension between different camps in today's fediverse. Back in 2017's [Lessons (so far) from Mastodon for independent social networks](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=thenexusofprivacy.net), I noted that "Policies against racism, sexism, discrimination against gender and sexual minorities, and Nazis are extremely appealing positioning these days", and it's still just as true. Meta's advocates in the fediverse eagerness to ignore or downplay Threads' coddling of white supremacists and anti-trans groups throws that advantage away. And by prioritizing their desire to be embraced by Meta over queer and trans people's safety, Meta's cis advocates undercut their claims to be allies in ways that may be hard to recover from. [In chaos there is opportunity!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#chaos) suggests that one of the good outcomes from the Meta situation is that it will "almost certainly upend the power structures that have hindered progress," so it'll be interesting to see how this plays out. Meanwhile, things are looking good for the free fediverse. There's clearly a critical mass of people who are in the fediverse to get away from Facebook, Instagram, and other commercial social networks – and if some of the fediverse's other problems can be addressed, that's also an extremely appealing positioning to more and more people these days. Of course, there are quite a few issues that need addressing in the fediverse. [In chaos there is opportunity!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#chaos) discusses several more, and highlights that Meta's potential arrival is likely to catalyze progress. It's an optimistic take (and it's still not clear where the funding will come from), so we'll see whether the optimism is justified. But the results so far are certainly encouraging! ## Update log July 18: updated description of W3C groups, including getting the acronym right and highlighting that the SWICG doesn't have the charter for the next version of the spec. ### Why just blocking Meta's Threads won't be enough to protect your privacy once they join the fediverse URL: https://thenexusofprivacy.net/just-blocking-threads-isnt-enough/ Last updated: 2026-04-16T03:08:55.000Z *Originally published July 10, last updated July 12\. See the* [*update log*](#update-log) *below for details.* > Join the discussions on [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/110691327594065039?ref=thenexusofprivacy.net) and [Hacker News](https://news.ycombinator.com/item?id=36698981&ref=thenexusofprivacy.net). If you're looking for more detailed analysis, check out the draft of [Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/) > "Today, Meta is launching its new microblogging platform called Threads. What is noteworthy about this launch is that Threads intends to become part of the decentralized social web by using the same standard protocol as Mastodon, ActivityPub." > > – [What to know about Threads](https://blog.joinmastodon.org/2023/07/what-to-know-about-threads/?ref=thenexusofprivacy.net), Mastodon BDFL (Benevolent Dictator for Life) Eugen Rochko Sexworkers aren't the only people who need to worry about their personal information getting exposed on Threads. People with harassers or stalkers they're trying to avoid, trans people at risk of being targeted by groups like Libs of Tik Tok, anybody with aspects of their life they'd rather not share with relatives and colleagues who are also on Instagram ... the list goes on. And if Facebook's parent company Meta does indeed follow through on its plans to join the "[fediverse](https://axbom.com/fediverse/?ref=thenexusofprivacy.net)", it's not only people who have joined Threads who have to worry. Mastodon (and most other fediverse software) wasn't designed with privacy and user safety in mind, so at least with today's software, there are a lot of ways that people's data can get to Meta without their knowledge and consent. Of course, Meta's not the only threat out there, but as I discuss in [Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/), Meta-related threats give a window onto broader threats. The great thing about the fediverse is that people on different instances (servers) can communicate with each other, no matter what software they're using. So if and when Threads implements ActivityPub, people on other instances and on Threads will (at least to some extent) be able to follow and send messages to each other.1 But what about people who *don't* want their data to get to Meta or people on Threads? Rochko's post is glibly reassuring on this front, suggesting that the only data Meta can get is "your public profile and public posts, which are publicly accessible." But this ignores other privacy risks. Here's a specific example. Threads has rolled out the welcome mat to [Nazi supporters, anti-LGBTQ extremists, and white supremacists,](https://www.mediamatters.org/facebook/far-right-figures-including-nazi-supporters-anti-gay-extremists-and-white-supremacists-are?ref=thenexusofprivacy.net) including groups like Libs of TikTok that harass trans people. If you're not familiar with Libs of TikTok, [How Libs of TikTok Became an Anti-LGBTQ+ Hate Machine](https://www.them.us/story/libs-of-tik-tok-twitter-facebook-instagram-explained-childrens-hospitals-grooming?ref=thenexusofprivacy.net), [Teacher targeted by Libs of TikTok sent death threats and lost his job](https://www.thepinknews.com/2022/04/20/libs-of-tiktok-teacher-lgbt-death-threats-job-doxxing/?ref=thenexusofprivacy.net), and [Twitter account Libs of TikTok blamed for harassment of children’s hospitals](https://www.washingtonpost.com/technology/2022/09/02/lgbtq-threats-hospitals-libs-of-tiktok/?ref=thenexusofprivacy.net) are good introductions. So unsurprisingly many trans people in the fediverse don't want any of their information shared with Threads. Even having your account name and instance name mentioned by a trans- or trans-friendly person on Threads could bring unwelcome attention from anti-trans people. Suppose I'm a trans person concerned enough about this possibility that I've blocked Threads. This prevents people on Threads from *directly* seeing my posts ... but that doesn't prevent indirect paths. Here are two ways that my data could still get there.2 1. Even if I only make **followers-only** posts, which aren't public and can't be boosted, if somebody who's following me replies, any of their followers on Threads will see my account name and instance. 2. If somebody on another instance who follows me boosts one of my public or unlisted posts, people on Threads who are following them may be able to see everything I've said in the post, and any images I've attached – and further boost it. Even though my post was public before, it wasn't easy to find unless somebody already knew about my account. Once it's boosted to Threads, it's got a lot more visibility. With today's software, the only obvious way to protect against #1 is not to have any followers on instances that federate with Meta.3 That could mean a "partition" of the fediverse – where instances that block Meta also block any instances that *don't* block – is the only way to mitigate the risk with today's software. #2 can be mitigated by instance admins turning on a setting called [Authorized Fetch](https://hub.sunny.garden/2023/06/28/what-does-authorized%5Ffetch-actually-do/?ref=thenexusofprivacy.net), although alas today most large Mastodon instances haven't done that and it's not the default for new instances.4 Of course, software's a moving target, so Authorized Fetch could become the default, and changes could be made to protect against #1 it might be in the future. [Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/) goes detail on this and other issues, including highlighting software improvements needed to address other risks. Unless and until that happens, though, Threads' arrival in the fediverse poses risks that can't be addressed by blocking. And it's not only Rochko who's glossing over these kinds of privacy concerns. As [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) discusses, there's quite a debate about how to react to Meta's potential arrival, during which I've repeatedly heard guys confidently but very incorrectly say "anybody who's concerned can just block Meta, there's nothing to worry about." As this simple example shows, they're wrong. So the next time you somebody say that, tell them that's not the case and give them the link to this post. And if you're one of the guys who's confidently been saying that ... you're wrong, so please stop. ## Notes 1 We'll see how broad this interoperability actually proves to be in practice. It's not clear whether Meta will allow this communication for people on any instance, or limit it to instances that go through some approval process; and if approval is required, it's not clear what the criteria will be. Also, it's been reported that Meta will make instances that want to communicate with it sign some kind of legal agreement, which makes sense, but once again it's not clear what the agreement will be. 2 Based on [Mastodon Migration's post](https://mastodon.online/@mastodonmigration/110622589366603128?ref=thenexusofprivacy.net), which in turn is based on input from Calckey maintainer Kainoa and infosec.exchange admin and security expert Jerry Bell. The "Leakage caused by Mastodon’s followers-only scope" and "Unauthenticated object fetching" sections of Ariadne Conill's 2019 post [ActivityPub: the present state, or why saving the ‘worse is better’ virus is both possible and important](https://ariadne.space/2019/01/10/activitypub-the-present-state-or-why-saving-the-worse-is-better-virus-is-both-possible-and-important/?ref=thenexusofprivacy.net) discuss the underlying ActivityPub design issues leading to these holes. 3 In fact, replies-to-replies means even having followers on who have followers are on instances that federate with Meta. 4 By contrast, other fediverse software like Calckey turns Authorized Fetch on by default, and some smaller Mastodon instances whose admins prioritize user safety have turned it on. ## Update log July 12: added more info about Libs of TikTok and Threads rolling out the welcome mat to white supremacists and anti-LGBTQ+ groups – and included the link to the Hacker News post, where somebody said "Libs of Tik Tok just reposts stuff on twitter. Acting like they're a terrorist organization is ridiculous." ## Image description Mistress Matisse @mistressmatisse: If you’re a sexworker, think VERY carefully about joining Threads, because here’s what Mark Zuckerberg did to me: I had a FB account as Mistress Matisse, but FB scraped my legal name from somewhere else and then changed my displayed NAME on my account without notice/consent. Yep. *Screenshot used with permission from Mistress Matisse. And apologies for doing the image description this way, but the software I'm using limits image descriptions of featured images to 125 characters – which isn't enough!* ### "A clear victory for our cause"? Opinions continue to differ about Meta and Threads in the fediverse! URL: https://thenexusofprivacy.net/opinions-continue-to-differ-about-meta-and-threads/ Last updated: 2026-04-16T03:08:13.000Z > Today, Meta is launching its new microblogging platform called Threads. What is noteworthy about this launch is that Threads intends to become part of the decentralized social web by using the same standard protocol as Mastodon, ActivityPub.... This is a clear victory for our cause, hopefully one of many to come. > > – Mastodon [BDFL](https://en.wikipedia.org/wiki/Benevolent%5Fdictator%5Ffor%5Flife?ref=thenexusofprivacy.net) (Benevolent Dictator for Life) Eugen Rochko, in [What to know about Threads](https://blog.joinmastodon.org/2023/07/what-to-know-about-threads/?ref=thenexusofprivacy.net), July 5 A lot has happened since I first published [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) a couple of weeks ago – including Meta launching its Threads product1, and announcing plans to federate with Mastodon and (presumably) the other platforms in the interconnected web of decentralized social networks known as the "[fediverse](https://axbom.com/fediverse/?ref=thenexusofprivacy.net)." And while Rochko and others see it as a huge victory, opinions continue to differ . In fact, especially once [Threads couldn't launch in the EU, because of privacy issues](https://techcrunch.com/2023/07/05/threads-no-eu-launch/?ref=thenexusofprivacy.net), and well-known anti-trans and racist accounts like Libs of TikTok and PragerU as enthusiastic early adopters of Threads, more and more instances are pre-emptively blocking Meta, including hundreds who have signed the [Anti-Meta FediPact](https://fedipact.online/?ref=thenexusofprivacy.net) – and including blahaj.zone, which is where I'm hanging out a lot more these days.1 So I've done a massive update to [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/), incorporating new developments as well as adding additional perspectives. One of the new sections that's is a compilation of of the various polls people have done, which I've included in this post as well. And I've also added a lot of quotes since the original version. For example: > "I can't believe some people are seriously considering allowing #meta before they solve their spam, esp. nazi spam problem.... Let me remind you: You log on to tell your extended family good morning, and within the first few things on your home feed, someone has commented that some people in a marginalized group are not deserving of life or freedom." > > – IronWynch, [on soc.irowyn.ch](https://soc.ironwyn.ch/@wynch/110614002732098055?ref=thenexusofprivacy.net) > "Let’s welcome Meta, not block them." > > – Manton Reese, [on micro.blog](https://www.manton.org/2023/06/27/lets-welcome-meta.html?ref=thenexusofprivacy.net) > "Admins federating with Threads, you are removing the safety barriers and it is going to destroy any community that exists within your realm where LGBTQ+ people just joke around and laugh and make friends and share their experiences. As soon as your users are aware they have an audience of 100M Threads users, many right wing or anti-trans who want to attack them for their existence, make them the target of the week, they will cease to be afforded that open experience." > > – CJ Bellwether [on octodon.social](https://octodon.social/@siege/110668072301678301?ref=thenexusofprivacy.net) > "Any instance that defederates the upcoming Instagram instance is just going to isloate itself. It'll be an island of misfit loser zealots." > > – John Gruber, quoted on [MISFIT LOSER ZEALOT CLUB](https://misfitloserzealot.club/?ref=thenexusofprivacy.net) > "#Meta's #Threads wanting to federate with the #fediverse (if that will ever happen 🤞) is a form of #gentrification. A large corporate shopping mall settles in a nice neighborhood with small local run shops and community centers. The new shopping mall says 'if we settle here, more people will come, and you all will benefit'. A few years later all small shops are bankrupt and the community is destroyed. What remains is a barren corporate landscape." > > – joene, [on todon.nl](https://todon.nl/@joenepraat/110661775241957946?ref=thenexusofprivacy.net) > "If your community can’t survive Meta using ActivityPub, then it doesn’t deserve to exist" > > – Chris Trottier, [on atomicpoet.org](https://atomicpoet.org/notice/AWYZ1Mo6bA30MFSiES?ref=thenexusofprivacy.net) Like I say, opinions differ. If you've read earlier version of [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/), the [Update Log](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#update-log) describes the changes. If you haven't read it yet, there's a *lot* of detail in it; feel free to skip around and pick the sections you're interested in. ## Speaking of polls ... There have a lot of polls about Meta and Threads in the fediverse over the last six weeks. [Max Pearl's](https://social.overlappingmagisteria.org/@pearlbear/110653805957945898?ref=thenexusofprivacy.net) is one of the most recent, and I really liked the wording, which is why I asked him for permission to screenshot it (as I have with the other polls I've included screenshots of here and in previous versions). Of course, polls on the fediverse aren't any more reliable than polls on Twitter or other social networks, so should be taken with several grains of salt. Still, it's interesting data. Depending on how the question is framed, some polls show overwhelming opposition to Meta. In [my May 28 poll](https://indieweb.social/@jdp23/110449505980762006?ref=thenexusofprivacy.net), with a very leading question analogizing Meta to Gab, 97% supported blocking. And here's [another similarly-lopsided poll](https://cutie.city/@nuz/110619658603991448?ref=thenexusofprivacy.net), in response to Universeodon's admin (a strong proponent of working with Meta) saying he had deleted his contributions to Mastodon's issues list on github because of snark from "people that looked like cats, princesses, and video game characters," and by contrast "talking with meta was fresh air because i was talking with engineers that had a common goal." ![which team would win in a cage match?? 96%: cats, princesses, and video game characters. 4%: fedi admins and facebook engineers with a common goal.](https://thenexusofprivacy.net/content/images/2023/07/meta-cats-and-princesses-poll.png) [Poll by nutzalgia](https://cutie.city/@nuz/110619658603991448?ref=thenexusofprivacy.net), originally posted June 27 I know who I'm betting on! Other, more neutrally worded polls, show strong but far for universal support for preemptively blocking (at least from accounts who see and respond to polls about Meta, which may or may not be representative of broader opinions).11 - [Jens Finkhäuser's May 22 poll](https://social.finkhaeuser.de/@jens/110416635483023054?ref=thenexusofprivacy.net): 44% of the responses expressing an opinion wanted Meta preemptively blocked - [James Dreben's May 24 poll](https://mastodon.world/@Jdreben/110426756399248557?ref=thenexusofprivacy.net): 64% wanted Meta to be blocked on their instance. - [Tokyo Outsider's June 25 poll](https://mas.to/@tokyo%5F0/110605522116606476?ref=thenexusofprivacy.net): 68% said they'd move instances to be on one that didn't federate with Meta. - [Volker Weber's June 28 poll](https://social.heise.de/@vowe/110623997627351369?ref=thenexusofprivacy.net): 43% will move to an instance that excludes Meta. - [Stux' June 28 poll](https://mstdn.social/@stux/110622583732793662?ref=thenexusofprivacy.net): 63% wanted Meta blocked. Wwith over 8000 responses, this has the broadest participation of any of the polls. - [Max Pearl's July 3 poll](https://social.overlappingmagisteria.org/@pearlbear/110653805957945898?ref=thenexusofprivacy.net): 70% wanted their instance to block – and 44% say they'll move instances if their current instance doesn't block - [mcc's July 5 poll](https://mastodon.social/@mcc/110663712542031369?ref=thenexusofprivacy.net): 36% are opposed to Meta federating, 30% are alarmed, and only 10% are supportive. mcc also did a second poll at the same time, asking a similar question about Tumblr, with very different results , highlighting how much of the opposition is specific to Meta. **Update, July 12:** - [todon.nl and todon.eu' July 11 poll](https://todon.nl/@admin/110696985478933637?ref=thenexusofprivacy.net) of their members: 88% voted not to federate. ## Notes 1 The Free Fediverse wiki has a[ (partial) list of announcements](https://freefediverse.org/index.php/Announcements?ref=thenexusofprivacy.net) by instances who are blocking. 2 If you're one of the many pepople who think Gruber is ridiculous, make sure to check out [footnote #5 in the full article](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#fn5)! ## Update log July 12: add todon.nl/todon.eu poll. ### Threat modeling Meta, the Fediverse, and privacy (DRAFT) URL: https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/ Last updated: 2026-04-16T03:07:38.000Z *Last major update July 7 2023\. See the* [*update log*](#update-log) *at the bottom for updates. Thanks everybody for feedback on earlier versions!* *One very important piece of feedback I* *haven't yet incorporated is that it needs a summary ... very true. In the current version, a combination of* [*Today's Fediverse is prototyping at scale*](#time-to-change) *and the* [*Charting a path forward*](#conclusion) *sections are the best approximation of a summary – assuming you already know how little privacy there is in most of the Fediverse. If that's news to you, the first section (*[*There's very little privacy in the Fediverse today. But it doesn't have to be that way!*](#very-little-privacy)*) is the place to start.* > DRAFT! Work in Progress! > Feedback welcome! > > Note to people using assistive technologies: the images aren't final yet, and all the information in them is in the text of the article as well, so I'm holding off on adding detailed alt-text until they're finalized. But I will! **Contents:** - [There's very little privacy in the Fediverse today. But it doesn't have to be that way!](#very-little-privacy) - [Today's fediverse is prototyping at scale](#time-to-change) - [Threat modeling 101](#threat-modelng) - [They can't scrape it if they can't fetch it](#no-fetching) - [Different kinds of mitigations](#mitigations) - [Attack surface reduction and privacy by default](#asr-and-pbd) - [Scraping's far from the only attack to consider](#not-just-scraping) - [Win/win "monetization" partnerships, threat or menace?](#monetization) - [A quick note to instance admins](#note-to-admins) - [Charting a path forward](#conclusion) - [Recommendations](#recommendations) – If you're short on time and just want to know how you can help improve privacy and safety in the Fediverse, there are suggestions here developers, instance admins, journalists, hosting companies, funders, businesses, civil society organizations and anybody who's active in the fediverse today. ## There's very little privacy in the Fediverse today. But it doesn't have to be that way! > Meta's potential arrival may well catalyze a lot of positive changes in the fediverses. And changes are certainly needed! > > – from [In chaos there is opportunity!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#chaos) As the discussions of Meta's new Fediverse-compatible Twitter competitor Threads highlight, privacy and other aspects of safety are some of those areas where positive changes are certainly needed in the interconnected web of decentralized social networks known as "[the Fediverse](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#termnology)". Mastodon, the best-known software in the Fediverse, wasn't designed and implemented with privacy in mind – in fact it violates pretty much all of the [seven principles of Privacy by Design](https://en.wikipedia.org/wiki/Privacy%5Fby%5Fdesignhttps://web.archive.org/web/20221020132403/https://www.ipc.on.ca/wp-content/uploads/Resources/pbd-implement-7found-principles.pdf?ref=thenexusofprivacy.net). Privacy by default? End-to-end security? User-centricity? Uh, no. And it's not just privacy, it's other aspects of safety as well. > **We interrupt this blog post for a public service announcement.** > Please do not use Mastodon or other fediverse software for confidential or secret information. Don't use Facebook, Instagram, Twitter, or any other social network either. Use Signal or some other encrypted messaging system. > > We now return you to your regularly-scheduled programming. And it's not just Mastodon, the same is true with most if not all the other fediverse software today. Even the underlying ActivityPub protocol that powers the fediverse has major privacy and safety limitations.1 And, you can't have privacy or safety without security and Mastodon et al have a long ways to go in that respect – both in terms of the software and operational security.2 But it doesn't have to be that way! Even with all of today's software issues, community-oriented instances,2.1 configured with a focus on safety (including privacy) and an emphasis on local conversations, can be more private (and a lot safer) than Facebook or Instagram. Unfortunately, that's very far from the experience for most people in the fediverse. Admins2.2 of most of the largest instances today and choose less-private configurations and run the "mainline" version of Mastodon rather than lother forks (variants) that provide valuable improvements.2.3 The good news is that today's low bar – in the software, at hosting companies, on the instances that haven't turned on settings that would protect people and their data – isn't set in stone. Large instance admins could prioritize privacy and safety more than they do today. So could software developers – and if they do, there are a lot of straightforward changes to the software that could improve the situation. Corporations, governments, and civil society groups looking at the fediverse could also prioritize private and safety ... including funding some of this badly-needed work. And new implementations could focus on privacy and safety from the beginning. This article looks at privacy, which is just one aspect of safety. Febuary 2024's [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/) takes a broader view, and mentions the importance of threat modeling, but doesn't go into remotely this level of detail. I'll start by making the case that Meta's potential arrival means that it's critical for the fediverse to start focusing on privacy. After that, the bulk of the article focuses on threat modeling, a useful technique for identifying opportunities for improvement, and specifically looks at the threat of Meta getting people's data without consent. Threat modeling can and should also be applied to other aspects of safety ([Social threat modeling and quote boosts on Mastodon](https://thenexusofprivacy.net/social-threat-modeling-and-quote-boosts/)) and there are lots of potential threats from Meta and a lot of other threat actors to consider but I'm going to focus narrowly here , and keep things at a fairly high level. I wind up with a section on [Charting a path forward](#conclusion), and if you don't want to wallow in the details you can just leap ahead to there. Or if you're short on time and just want to know how you can help improve privacy and safety in the fediverse, skip ahead to the [Recommendations](https://thenexusofprivacy.net/ghost/#recommendations) for developers, instance admins, journalists, hosting companies, funders, businesses, civil society organizations and anybody who's active in the fediverse today. ## Today's fediverse is prototyping at scale Meta's new Threads offering increases the urgency of addressing the fediverse's longstanding privacy issues; even though it's not compatible with ActivityPub yet, according to Instagram CEO Adam Mosseri it will be "[soon](https://techcrunch.com/2023/07/05/adam-mosseri-says-metas-threads-app-wont-have-activitypub-support-at-launch/?ref=thenexusofprivacy.net)". Of course, Meta's a threat in many other ways as well: to the safety and mental health of many people in the fediverse, to many marginalized communities who are trying to make a new home there, to democracy.... As Seirdy says in [De-federating P92](https://seirdy.one/posts/2023/06/20/defederating-p92/?ref=thenexusofprivacy.net), "Of the reasons to resist a Facebook/Meta presence in the Fediverse, privacy is relatively low on the list." That said, the privacy aspects are important too. For one thing, if Meta does indeed follow through on its plans to work with Mastodon instance admins and others "partners", people who trying to avoid harassers or stalkers on if their posts or even their account names get to Meta. And more generally, people in the region of the fediverse that's *not* Meta-friendly will need stronger privacy protections to protect their data. Of course Meta's far from the only threat to privacy out there; but changes that reduce the amount of data Meta can gather without consent will also help with other bad actors. > TODO: INCORPORATE [Why just blocking Meta’s Threads won’t be enough to protect your privacy once they join the fediverse](https://thenexusofprivacy.net/just-blocking-threads-isnt-enough/) HERE AS AN EXAMPLE. And more positively, there's also a huge opportunity here. Privacy's even worse on Facebook and Instagram than it is in the fediverse. Their software is the opposite of Privacy by Design – everything about it is designed to track your every move and encourage you to give them as much data as possible and feed their monetization algorithms. People don't like that but accept it because (for many) there aren't any other good options. If the fediverse can provide a more private alternative, that will be hugely appealing to a lot of people. Any way you look at it, now's a good time for the fediverse to take privacy more seriously. And not just privacy, of course. One way to look at today's Fediverse is as a prototype at scale, big enough to get experience with the complexities of federation, usable enough for many people that it's enjoyable for social network activities, but with big holes including privacy and other aspects of safety, equity, accessibility, usability, sustainability and .... Now's the time to get beyond the prototyping stage. One path forward is to evolve today's implementations and addressing problems incrementally. From this perspective, threat modeling can help identify low-hanging fruit to make more rapid progress in the short term as well as highlight important areas where there *aren't* any good short-term answers yet. Threat modeling's also useful for the complementary path of new implementations that *start* with a focus on privacy by design (and design from the margins, and software engineering best practices, and safety, and equity, and accessibility, and ...). So let's get to it! Or, if you prefer, skip ahead to the section on [Charting a path forward](#conclusion) and the summary of [Recommendations](https://thenexusofprivacy.net/ghost/#recommendations) in the appendix, and then come back to the details. ## Threat modeling 101 > [Social threat modeling](https://medium.com/a-change-is-coming/social-threat-modeling-the-winds-of-change-are-in-the-air-8dc330479a50?ref=thenexusofprivacy.net) applies structured analysis to threats like harassment, abuse, and disinformation. You'd think this would happen routinely, but no. > > – [Social threat modeling and quote boosts on Mastodon](https://thenexusofprivacy.net/social-threat-modeling-and-quote-boosts/) What are the specific ways Meta is a threat? What can we do in response? Threat modeling is a structured way to explore those questions. In this post I'm going to focus on privacy at the software and system level, but it applies to all kinds of threats. [Social threat modeling and quote boosts on Mastodon](https://thenexusofprivacy.net/social-threat-modeling-and-quote-boosts/) the post about quote boosts and [A trip down memory lane](https://medium.com/a-change-is-coming/a-trip-down-memory-lane-part-2-of-social-threat-modeling-draft-8693ee209d51?ref=privacy.thenexus.today), for example, look at applying threat modeling to harassment. Digital Defense Fund's [Threat Modeling](https://digitaldefensefund.org/learn/threat-modeling?ref=thenexusofprivacy.net) and EFF's [Your Security Plan](https://ssd.eff.org/module/your-security-plan?ref=thenexusofprivacy.net) have some good techniques for individuals to do threat modeling to protect their data privacy. Let's start by taking the perspective of a "threat actor" like Meta and looking at potential goals or likely consequences of their hostile actions. A complication is that we don't know just what Meta's goals are for the fediverse, and we don't know just how they'll approach it. Still, we can make some assumptions based on their past behavior and business models, as well as the information that's been reported to date. Historically, Meta's business is monetizing data gathered without consent. Today, they mostly do that by selling ads and the ability to promote posts.3 They even gather data of people who don't have Meta accounts to create "[shadow profiles](https://theconversation.com/shadow-profiles-facebook-knows-about-you-even-if-youre-not-on-facebook-94804?ref=thenexusofprivacy.net)" – and gather data from other sites about people who *do* have Meta accounts to better target them. So if Meta does in fact come to the fediverse, it's extremely likely that they'll try to collect data without consent from people on other fediverse instances. That's what they always do! How might they approach it here? To make it concrete, here's a partial and *very simplified* threat model. This only scratches the surface; what's really needed is an organized social threat modeling effort – and that's going to require funding. Still, even with its limitations, as you'll see, it highlights some specific ways privacy on the fediverse could be improved – as well as potential additional privacy threats from Meta that haven't gotten a lot of discussion yet. ![Different ways collect data without consent, described in the article's text](https://thenexusofprivacy.net/content/images/2023/07/collecting-data-without-consent-2.png) > UPDATE, July 20: Renaud Chapaud's just-published [Evolving Mastodon’s Trust & Safety Features](http://www.renchap.com/blog/post/evolving%5Fmastodon%5Ftrust%5Fand%5Fsafety/?ref=thenexusofprivacy.net) introduces new potential threat vectors that still need to be incorporated in this model. What if Meta runs a "trusted" third-party provider that scans for spam and hate speech, and encourages instances send them all the posts (including private posts and DMs, which also need to be checked) along with additional informaiton, potentially including IP addresses? At least in the US, Meta would have wide latitude to use that data for other purposes as well. [Dan Supernault's proposa](https://mastodon.social/@dansup/110746700144584831?ref=thenexusofprivacy.net)l for centralized abuse and spam checking has similar issues. Of course, others might provide those services as well as (or instead of) Meta, introducing similar threats, so this is another example of how looking at the threat from Meta helps mitigate other threats a well. Advocates of federating with Meta often make arguments like "Meta can already get all the data the want by scraping web pages." In [Project92 and the Fediverse - A Smarter Battle Plan to Protect the Open Social Web](https://www.timothychambers.net/2023/06/23/project-and-the.html?ref=thenexusofprivacy.net), for example, Tim Chambers dismisses the argument that people should be concerned about Meta's data scraping by saying "defederation does virtually zero to avoid any big tech entity scraping all the Fediverse public social graph today." To be clear, as Esther Payne discusses in [Consent and the fediverse](https://onepict.com/consent-fediverse20230627.html?ref=thenexusofprivacy.net), this is not actually a compelling argument for sharing people's data with Meta. Not only that, it's an exaggeration; even with all of today's weaknesses, there's lots of valuable data that *can't* easily be scraped. As Daniel Solove and Woodrow Harzog note in their recent [The Great Scrape: The Clash Between Scraping and Privacy](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4884485&ref=thenexusofprivacy.net), " the public availability of scraped data shouldn’t give scrapers a free pass." Still, there's certainly an important kernel of truth in this argument: a lot of fediverse data *can* easily be scraped today, and bad actors are almost certainly doing it. And Meta's admitted scraping data in the past, so they certainly might try. Of course, scraping's far from the only realistic privacy threat from Meta. The simplified diagram above also includes a couple of others: - [Mastodon provides RSS feeds for every profile](https://www.rssboard.org/news/211/every-mastodon-user-has-rss-feed?ref=thenexusofprivacy.net), containing all the public and unlisted posts. So does other fediverse software (although I'm not sure about unlisted posts). RSS is a good thing! But it can also be used for collecting data. - Instances running fediverse software - just like any other web service out there – provide [application programming interfaces (APIs)](https://docs.joinmastodon.org/client/intro/?ref=thenexusofprivacy.net). APIs are also good things! Apps are built on top of APIs; instances communicate with each other using APIs. But APIs can also be used for other purposes ... like collecting data. - Meta might get the data from other sites or apps. [Hospital Websites](https://themarkup.org/pixel-hunt/2022/06/16/facebook-is-receiving-sensitive-medical-information-from-hospital-websites?ref=thenexusofprivacy.net), [Tax prep websites](https://www.engadget.com/tax-filing-website-data-meta-pixel-facebook-154500543.html?ref=thenexusofprivacy.net), [mental health charities,](https://www.theguardian.com/society/2023/jun/03/uk-mental-health-charities-handed-sensitive-data-to-facebook-for-targeted-ads?ref=thenexusofprivacy.net) and pretty much everybody you can think of share sensitive data with Facebook without people's consent, so it's certainly imaginable that Meta would try to get its "partners" in the fediverse to share data without consent. Of course, a lot of this sharing is illegal, leading class action suits and FTC settlements, and Meta says it's not their fault (it never is). Still, for those of us who don't want our data going to Meta, that doesn't make it any less of a threat. **UPDATE*: GunCheoch pointed out to me that this draft ignores* [***relays***](https://fedi.tips/using-relays-to-quickly-expand-a-servers-view-of-the-fediverse/?ref=thenexusofprivacy.net) *which are also a path for Meta (or anybody else) to get data view other sites. Quite right, and that needs to be reported!* There are a lot more privacy threats of course (that's what the "..." in the image is supposed to indicate), which is why a funded systematic threat modeling effort is so critical, but you get the idea. We'll come back to those other threats below let's start by digging into scraping in a little more detail - and switch our perspective to how to prevent it. ## They can't scrape it if they can't fetch it > TODO: update scraping discussion based on [the joint statement on scraping by ICO et. al](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2023/08/joint-statement-on-data-scraping-and-data-protection/?ref=thenexusofprivacy.net)., [Web Scraping for Me, But Not for Thee](https://blog.ericgoldman.org/archives/2023/08/web-scraping-for-me-but-not-for-thee-guest-blog-post.htm?ref=thenexusofprivacy.net), and [Block the Bots that Feed “AI” Models by Scraping Your Website](https://neil-clarke.com/block-the-bots-that-feed-ai-models-by-scraping-your-website/?ref=thenexusofprivacy.net), and [The Great Scrape: The Clash Between Scraping and Privacy](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4884485&ref=thenexusofprivacy.net) Web scraping works just like web browsing: given a URL (link) to a web page, fetch the HTML contents of the web page. Instead of just displaying it the way a browser does, scraping software analyzes it and extracts the data from it. When you share a link from another website to Mastodon or other fediverse software and it automagically includes the headline and image, that's a very simple example of web scraping, and one that's widely accepted as legitimate. Here's a simple visual representation. ![Three steps to scrapingdata from a web page: find URL of web page, fetch HTML, extract and use data](https://thenexusofprivacy.net/content/images/2023/07/scraping-data-in-three-steps.png) So one way to prevent scraping is to prevent potential scrapers from fetching the HTML of the web page. Unfortunately, this is easier said than done. For one thing, scrapers aren't the only ones who fetch HTML; so do legitimate users, via their browsers, whenver they're looking at anything on the fediverse. So we need find restrictions that will be roadblocks to their scraping, but don't cause so much inconvenience to legitimate users that they're impractical. Not only that, Meta and other scrapers can be very cunning, and will adapt their tactics to whatever we do, so we'll need to try to anticipate their countermeasures. IP blocking, prohibiting access to your site from a range of internet addresses, is one straightforward approach to preventing scraping (although may have downsides as well). If Meta only scrapes from a subdomains of threads.net, or a predictable set of addresses, IP blocking those could stop spreading cold. Mastodon's [documentation](https://docs.joinmastodon.org/admin/moderation/?ref=thenexusofprivacy.net) describes how IP blocking can be done at the firewall level, which makes sense, but there are probably ways to streamline it, existing tools and processes to leverage and package, and potentially new tooling for sharing IP blocklists. Do hosting companies provide these services to people or organizations who are hosting there? What are the downsides of IP blocking with email, and are there ways to avoid or at least mitigate them in the fediverse? These are all areas for improvement for fediverse software today – and one that builds off work that's already been done on projects like The Bad Space and Oliphant Blocklists. **Recommendation*: educate people on (and potentially package) existing processes and tools for IP Blocking, integrate with suspend/limit federation-level processes and infrastructure, and potentially develop new tools and look for ways to address downsides.* Then again Meta could get around this easily enough in a couple of ways. They could hire somebody else to do the scraping for them, [as they have in the past](https://www.engadget.com/meta-data-scraping-lawsuit-145519311.html?ref=thenexusofprivacy.net). Or just like spammers dodging email blocklists, they could potentially rotating a lot of different domains and addresses in different ranges. For that matter, Meta could enlist some of their "partners" to run their own scrapers (perhaps to help them "monetize" more efficiently). So if they want to scrape, IP blocking by itself won't stop them. Disabling anonymous access to web pages (which means only logged-in accounts can look at them) is a complementary approach. Once again, countermeasures are possible: Meta or its "partners" could use RSS instead, so we'll need ways of plugging that hole as well. Or, they could conceivably create accounts on anti-Meta instances and secretly use them to scrape, so we'll need to think about counter-measures for scraping from logged-in accounts as well. Still, it's a useful hurdle. > **Update**, August 10: asking users to share their API access token is an alternative to creating new accounts for scraping. [Fediseer](https://news.feedseer.com/?ref=thenexusofprivacy.net) already does this, and [the fedibuzz pseudo-relay is currently requesting token donation](https://fedi.buzz/token/donate?ref=thenexusofprivacy.net) in response to Mastodon 4.2 cutting off anonymous access to the streaming API.3.8 The downside of token donation is that it also gives access to the DMs of anybody who donates a token, so I'd hope that people would think twice before going this route with Meta, but you never know. Mastodon actually *does* provide a setting that disables anonymous access to the web pages of all profiles, timelines, and individual statuses on a site, although I'm not sure how usable it is in practice.4 **Recommendation*: ensure there's a *usable* way for an instance to disable anonymous access to all profiles, timelines, statuses, images, etc* Even if it worked, though, blocking *all* public access has a huge cost in many cases. I *want* the Nexus of Privacy's profile, and most of the posts I make from that account, to be visible to people who aren't logged in – even if that leaves it at risk of being scraped by Meta. Many other content creators, politicians, journalists, influencers, and celebreties also want at least some of their social media activity to be public. Most instances will want to support that. Still, individuals might want to make different choices, so individual accounts the ability to disable anonymous access to their statuses and timelines would be very valuable as well. **Recommendation*: provide *individuals* a usable way of disabling anonymous access to their profiles, timelines, statuses, images, etc.* Even if somebody wants some of their data to be public, that doesn't mean *everything* has to be. **Mentioned-only posts** (sometimes call direct messages) and **followers-only posts,** neither of which are visible to anybody who's not logged in, are good examples of this already supported by most fediverse software. But that's only the tip of the iceberg. Mastodon forks (variants) like Glitch-soc and Hometown, as well as compatible software like Akkoma, Misskey, and Calckey, have [local-only posts](https://github.com/hometown-fork/hometown/wiki/Local-only-posting?ref=thenexusofprivacy.net). Friendica and Hubzilla have private groups, only visible to members of the group. Hometown maintainer Darius Kazemi has estimated that [70% of Hometown activity is local-only](https://thenewstack.io/lighting-a-bonfire-under-social-media-devs-and-activitypub/?ref=thenexusofprivacy.net), and while that's not likely to be the case for more publicly-oriented sites (infosec.exchange admin Jerry Bell says that he rarely sees them), this would still be a good step forward. What about unlisted posts? Today, despite their name, they're essentially public: they don't appear on timelines and hashtags, but do appear on profiles, and anybody can view them anonymously. That could change, for example allowing instances or individual users to require login. Of course, changing this would have broad implications, and for it to be effective ways would also have to work with older versions of the software, so maybe it would be better to introduce a new visibility level – something like "federatable but not viewable to people who aren't logged in". In any case, it's worth thinking about. And there's also room to explore additional visibility options that cross instance boundaries. Akkoma, for example, has the concept of a "bubble" of instances that share boundaries. Is bubble-only visibility a useful concept? So this highlights another way to make thing harder for Meta (and other scrapers). **Recommendation*: Reduce the number of public pages.* - *Increase use of local-only posts, private groups, and other existing mechanisms that limit scrapability* - *Consider requiring login to view unlisted posts.* - *Investigate new visibility levels like "federatable but not viewable to people who aren't logged in", "viewable only to people logged into instances we federate with", "viewable only to people logged into instances that don't federate with Meta", and "viewable only to people in the same fedifam or caracol" (group of aligned instances, described below)* - *Provide an option for private profiles* Here's a visual representation of what we've discussed so far. Mitigations (in the circles) are marked with an ❌ if they prevent the attack, or a ↘️ if they reduce the severity. ![Migitations for scraping, already described in the text](https://thenexusofprivacy.net/content/images/2023/07/initial-mitigations-for-scraping.png) ## Different kinds of mitigations All the potential mitigations we've talked about so far have been technology-based and focused on preventing scraping, but that's not the only approach. Legal protections are a complementary tactic. They won't necessarily deter a company like Meta that frequently ignores the law, relies on their hundreds of lawyers to try to find loopholes and string the cases along, and budgets for paying huge fines as a cost of doing business. Still, as data protection agencies in Europe continue to bring pressure on Meta – and laws like Illionois' BIPA and Washington state's new My Health My Data allow individuals to sue entities of any size for privacy violations in some situations – they could have enough of an impact by increasing the likely cost of scraping that Meta (or some of the partners they attempt to enlist) decides it's not worthwhile. I'm not a lawyer, so please don't take this as authoritative, but my impression is that scraping public profiles, timelines, statuses, and images is usually legal under today's laws (although their are exceptions – Clearview AI's scraping, for example, has led to it being banned from selling its facial recognition software in country after country, [including the US](https://www.aclu.org/press-releases/big-win-settlement-ensures-clearview-ai-complies-with-groundbreaking-illinois?ref=thenexusofprivacy.net)). But when somebody creates an account on a fediverse instance, they have to agree to the Terms of Service (TOS), which could potentially have prohibitions on scraping. [Ryanair won a 2015 case in the EU](https://www.laytons.com/news/ready-for-take-off-how-ryanair-fought-to-protect-its-data?ref=thenexusofprivacy.net) and its TOS seems to have played a big role in it. So there may be possibilities here. Then again, this approach could have downsides as well. I'm not a lawyer, but there are plenty of them on #LawFedi – and for that matter plenty of them at organizations that are deeply suspicious of Meta and contemplating being on the fediverse. It's worth talking to them about this! **Recommendation*: investigate potential Terms of Service provisions limiting data harvesting, such as prohibiting accounts from doing automatic scraping and/or sharing data with Meta* As well as trying to *prevent* a certain kind of attack, mitigations can also focus on *detecting* it or *limiting the damage*. For example: - Analyzing account activity could detect scraping patterns (although scrapers can modify their software to avoid this) - Rate limits can cut down on how much scraping is done, although potentially also interfere with legitimate activity Here's the diagram including these, and a sneak preview of another mitigations I'll discuss in the next section. I'm using a couple of new icons here: ⚖️ (the scales of justice) indicate legal protections, and 🔎 indicates a mitigation focusing on detecting attacks. ![Mitigations for scraping, as described in the text above and below](https://thenexusofprivacy.net/content/images/2023/07/more-mitigations-for-scraping.png) ## Attack surface reduction and privacy by default Reducing the number of public web pages is an example of a powerful technique called *attack surface reduction*. The underyling idea is simple: the less data that's out there, the less there is for Meta – or any other threat actor – to gather. Okta's [What is an Attack Surface? (And How to Reduce It)](https://www.okta.com/identity-101/what-is-an-attack-surface/?ref=thenexusofprivacy.net) and Microsoft's [Understand and use attack surface reduction (ASR)](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction?view=o365-worldwide&ref=thenexusofprivacy.net) are intros to attack surfaces from a security perspective, and it's easy to see how it applies to privacy as well. Mastodon's "Hide your social graph" preference setting is a good example of this. If you turn it on, your following / followers lists are no longer visible in your profile. This data is very valuable to Meta – it's great for targeting ads – but it's also very risky for many people, including immigrants, activists, and people seeking reproductive and gender-affirming health care in states where it's illegal and anybody helping them. So being able to opt out and remove it from your profile is a very good thing. Of course, from a privacy perspective, it would be even better if "hide your social graph" was the default and you had to opt-in to share it. That way, people would be protected from letting Meta scrape this risky data unless they explicitly decide they want Meta to have that information. And this is far from the only situation where the default leaves data exposed. By default, Mastodon allows anybody to follow you without checking for approval; which means they can get access to followers-only posts. **Recommendation*: "Privacy by default": Set defaults so that people start with stronger privacy protections, and can then choose to give it up.* And while it's great that Mastodon gives people the option of whether or not to show their social graph, it doesn't offer the same flexibility with other data. For example, as far as I know, there's no way to make my pronouns visible to people who are following me or people on my local instance but not to the entire world? So it's worth making a systematic effort to analyze how much of what's visible today really needs to be there. **Recommendation*: Reduce the amount of data that's in public pages, including differentiating between what's shown at different levels of visibility* ## Scraping's far from the only attack to consider ![Different ways collect data without consent, described in the article's text](https://thenexusofprivacy.net/content/images/2023/07/collecting-data-without-consent-2.png) Let's briefly discuss the other three threats we touched on earlier. At least on Mastodon, there's no way to disable RSS feeds. Hometown and GoToSocial, by contrast, take a "privacy by default" approach of turning them off unless people choose to enable them. Other fediverse software should follow their lead. An attack surface reduction approach of reducing the amount of data that's available via RSS feeds is a complementary approach. For example, unlisted posts are currently in the RSS feed; removing them (or introducing a setting that defaults to leaving them out) is an easy improvement. And there may well be other opportunities. **Recommendations*:* - *Provide control for individuals and sites to determine whether RSS feeds are available, and investigate options to reduce information in RSS feeds* For API access, the existing "Authorized Fetch" (also sometimes called "Secure Fetch") mechanism prevents API access from blocked instances; [What does AUTHORIZED\_FETCH actually do?](https://hub.sunny.garden/2023/06/28/what-does-authorized%5Ffetch-actually-do/?ref=thenexusofprivacy.net) is a good overview. Fediverse instances that prioritize safety already have it turned on because it reduces dogpiling and other kinds of harassment; others should turn it on ASAP. And in another good example of "privacy by default", software platforms and hosting companies should make it the default going forward. Combining Authorized Fetch that with shared up-to-date blocklists that include all of Meta's instances could prevent Meta-run instances from directly accessing data via an API. But Meta's decentralized approach could well mean that their instances are hosted under lots of different domains,5 so it's not clear what infrastructure will be needed to do it effectively – or if it's even feasible. Most fediverse software can be run in "allow-list" federation mode; on Mastodon, for example, it's the [LIMITED\_FEDERATION\_MODE setting](https://docs.joinmastodon.org/admin/config/?ref=thenexusofprivacy.net#limited%5Ffederation%5Fmode). However, relatively few instances take this privacy-friendly approach today; indeed, Mastodon's documentation misleadingly describes it as "contrary to Mastodon’s mission of decentralization." To date, relatively little work has been done developing processes and tooling for making allow-list approaches work well, or looking at other alternatives besides pure blocklist or allow-list approaches. So this is an area where investigation is needed ... and there are a lot of interesting complementary possibilities here. For example: - [Peertube's manual approval](https://docs.joinpeertube.org/admin/following-instances?ref=thenexusofprivacy.net) of federation requests (similar to the "[approval first](https://github.com/mastodon/mastodon/issues/21536?ref=thenexusofprivacy.net)" mode described by vitunvuohi here) and ability to follow a list of instances to approve - the "letters of introduction" Erin Shephard describes in [A better moderation system is possible for the social web](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web/?ref=thenexusofprivacy.net), applied to federation instead of individual following - Darius Kaziemi's "[threaderation](https://indieweb.social/@darius@friend.camp/110670093711320853?ref=thenexusofprivacy.net)" (which is a bit more restrictive than the current "silencing" approach). - ophiocephalic's proposal of "[fedifams](https://kolektiva.social/@ophiocephalic/110793535160280425?ref=thenexusofprivacy.net)", a family or alliance of instances where admins could deliberate together on blocklist/allow-list decisions, and a broader moderation council with a representative from multiple fedifams - Kat Marchán's suggestion of "[caracoles](https://toot.cat/@zkat/110810390507239555?ref=thenexusofprivacy.net)", concentric federations of instances that have all agreed to federate with each other, with smaller caracoles able to vote to federate with entire other caracoles. As mentioned above that fedifams and caracoles could also be potential post visibility boundaries, providing more alternatives to fully public posts. Apps can also get data via APIs. Suppose Threads lets people login to their accounts on other instances as well. If I've blocked Meta, but somebody I'm friends with in the fediverse uses Meta's app to log into their account and view my status, could the data get to Meta? Without doing a full analysis, my guess is probably yes. If so, what are the countermeasures – for example, allow-lists for apps? **Recommendations*:* - *Enable "Authorized Fetch" on current sites, and make it the default setting in software releases and at hosting sites.* - *Investigate shifting to allow-list federation, and look at alternative approaches like "approval first" federation.* - *Investigate tooling for and feasibility of blocklist of Meta's instances if there are a huge number of them hosted on different domains* - *Look at potential app-based dataflows and potential counter-measures.* ## Win/win "monetization" partnerships, threat or menace? The indirect approach, where Meta enlists instances that federate with them to harvest (and "monetize") data from people and instances who don't, opens up new cans of worms. If Meta really does pursue a decentralized strategy (still a big open question) this is new ground in a lot of ways, and a lot will depend on the implementation, so right now this section has a lot more questions than answers. They're very important questions, though, because the answers to these will have a big impact on how people in the different regions of the fediverse will be able to interact. If I'm on an instance that blocks a Meta instance, you're on an instance that federates with them, and somebody on a Meta instance is following you, what happens when you boost, quote boost, favorite, or reply to my status? As Mastodon Migration's [post](https://mastodon.online/@mastodonmigration/110622589366603128?ref=thenexusofprivacy.net) (based on input from Calckey maintainer Kainoa as well as infosec.exchange admin and security expert Jerry) shows, it's complex, and the answer is different for different software (and depend on whether instances are running Authorized Fetch). So this is a place where detailed analysis is needed. And suppose instances that federate with Meta decide to take advantage of Meta's services to recommend content (and/or target and serve ads)? Even if I've blocked Meta, if you're following me from an instance federated with Meta, the software might send my data to them to help recommend better content for you (and/or better target you) ... and once they've got it for one purpose, who knows what they'll use it for. Is there a way to prevent that from happening? Meta's implementation, and the legal agreements they put in place for instances that federate with them, are both wildcards at this point. It'll take a while to analyze the implementation even in the very unlikely event they open-source everything and provide a good architecture and design documents, so the best course of action for now is to take a "privacy by default" approach here of transitive defederation: defederating Meta, any instances that federate with Meta directly or indirectly. That said, this is a very blunt hammer. Are other approaches possible? For example, suppose there was a way for an instance to say "I'll only federate with a site if their privacy statement legally commits them to not sharing any data they receive from my instance with Meta, or with any instance that will share it with Meta" – and the software provided the functionality that could make that commitment real? Is there a role for "bridge" instances, not federating with Meta and somehow allowing people from both "free fediverse" and Meta-friendly instances to communicate while limiting the data that could flow back to Meta? **Recommendation*: initially adopt the "privacy by default" approach of transitive defederation to protect against indirect data flows via Meta-federating instances while analyzing implementation and policies and investigating more flexible alternate approaches* ## A quick note to instance admins Now's a crucial time for instance admins to think about their goals and responsibilities. Are you committed to providing a private and safe experience for people in your community? If so, then show your commitment by shifting your thinking to "privacy by default", and making sure your configuration settings (and software choices) reflect that. Of course, no principle is absolute, so there may well be tradeoffs; and these changes can't necessarily be made overnight. Still, if this the direction you want to go, taking some initial meaningful steps and announcing a plan and timeframe is a good way to demonstrate that you really mean it. If that's *not* the direction you want to go, well, that's also a good thing to let people in your community know so they can make a good decision about whether it's the right instance for them. Threat modeling's especially important for admins who are considering federating with Meta. For one thing, one of the arguments in favor of federation at the instance level is that people on the instance have the "agency" of defederating themselves. But will that defederation actually protect them, or still leave them at risk? It's a hard question to answer until we see the actual implementation, but based on what we know today assuming that'll be the case seems overly optimistic. Not only that, if you can't prevent some of the indirect attacks discussed in [Win/win "monetization" partnerships, threat or menace?](#monetization), then instances that don't want anything to do with Meta will have to defederate from you as well – meaning that people on your instance can't talk to their friends elsewhere in the Fediverse. It's also important to model some of the other threats that are beyond the scope of this article. For example, a lot of LGBTQ+ people are concerned that instances federating with Meta will put them at risk. It's not enough to dismiss this threat by saying "we have tools to prevent this." If you want to ensure people on your instance are safe – or avoid endangering people on other instances – more detailed analysis is needed. And finally, if you're an instance admin who's advocating working with Meta as long as it doesn't put people on your instance at risk, and you're *not* currently taking steps to provide better privacy safety to people on your instance, ask yourself why people should trust your evaluation of what does or doesn't put people at risk. ## Charting a path forward One of the interesting things about the recommendations here is how many of them are straightforward: changing defaults, using and improving existing features, mainline Mastodon and instance admins adopting features like local-only posts that have long been implemented in forks (and other fediverse software). Most of what listed here helps protect against other bad actors besides Meta, and much of it helps with safety as well, so these improvements have been needed for quite a while. They just haven't been prioritized. It's possible that Meta's arrival will lead to the current forks taking privacy and other aspects of safety s to date changing their attitudes, and changing their priorities. Then again, Meta's arrival will also require a lot of other work – scaling, support for whatever win/win monetization Meta's offering, working on the next version of ActivityPub (which will surely need significant improvements to deal with anything on the scale of threads), and ensuring that instances that want to federate can meet other whatever standards Meta requires. So it's also possible that privacy will continue to take a back seat in mainline Mastodon and other platforms.6 If so, it's a good time for forks that prioritizes privacy and safety. And while I know less about other fediverse, the same dynamics may play out there as well. **Recommendation*: Create forks that prioritize privacy and safety if mainline Mastodon (and potentially other platforms) continues not to* Of course, even though many of these recommendations are straightforward, there are a lot of them – some of which (like moving to "privacy by default" and getting away from a federate-by-default approach) are a chunk o' work. Not only that, several of the recommendations are to "investigate" potential approaches; and, not to sound like a broken record, this high-level discussion here only scratches the surface and only for this one threat, so what's really needed is a systematic threat modelling effort. And new implementations, designed with privacy and safety in mind, need resources as well. All of that's going to require funding. As Afsenah Rigot discusses in [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=thenexusofprivacy.net), centering the marginalized people directly impacted by design decisions leads to products that are better for *everybody*. That's especially important for threat modeling. So equity and diversity needs to be a key consideration in terms of who gets funded to work on these projects – something that hasn't historically happened on Mastodon. The good news is that there are plenty of potential funding sources who see Meta as a threat, and some of them have decent budgets. Companies like Fastly and Wordpress who are looking at the fediverse have a lot to lose if it winds up dominated by Meta and surveillance capitalism business models. Responsible companies and governments who are considering partnering with Meta have an interest in making sure that they don't getting coopted in (potentially-illegal) data harvesting – or disinformation broadcasting. Many civil society organizations also see Meta as a huge threat. So do inviduals, so crowdfunding's an option as well. - *Pursue funding from anti-surveillance-capitalism companies, civil society groups, and crowdfunding to allow more detailed analysis, design, and rapid implementation – and ensure that the funding is directed in a way that increases equity and diversity.* Who knows, maybe the fediverse as a whole isn't ready for this yet, and it'll continue to stay at the prototyping stage for a while more. Even if that happens, the kind of informal threat modeling I've done here can still be useful to instances that want to insulate themselves from Meta's threats to the extent that they can, platforms that want to prioritize making improvements with their existing resources, and new implementations that want to do better. With luck, though, Meta's arrival will be the kick in the pants the fediverse needs to shift modes and start taking privacy and other aspects of safety (and equity and accessiblity and usability ...) seriously – and approach it in a way that also improves equity. The opportunity's certainly there! ## Appendix: Short-term recommendations for improving privacy of existing fediverse software *This section pulls together the recommendations scattered throughout the article combining a few similar ones in the process and organizing them into categories.* > **July 7*: currently in the midst of an update, so some minor differences between this and recommendations in the article still need to be synced up.* ### Anybody who's active in the fediverse today. - Ask your instance admin to provide better privacy and safety – you can point them to the [Instance Admins](#instance-admins) recommendations below. If they say no, and don't have good reasons, consider voting with your (virtual) feet and moving to another instance. - Let the developers of the software know that you care about privacy and safety and ask them to prioritize improving it. - If you're running a single-person instance, see the recommendations for instance admins – including turning on [Authorized Fetch](https://docs.joinmastodon.org/admin/config/?ref=thenexusofprivacy.net) (you may need to ask your hosting provider to do it for you). ### Journalists - Reject the incorrect and misleading talking point that there's no privacy harms in instances federating because they can (supposedly) already access all the data on the fediverse. Even if it were true (which it's not), as Esther Payne discusses in [Consent and the fediverse](https://onepict.com/consent-fediverse20230627.html?ref=thenexusofprivacy.net), it wouldn't be a good argument; and, it takes today's low bar as a given. - Highlight that until we know the details of Meta's federation plans – including technical solutions and legal agreements – and how current fediverse software will evolve, instances planning on blocking from Meta may well also have to do "transitive blocking" and all instances that federate with Meta in order to keep their community's data from being gathered without consent. ### Instance admins - "Privacy by default": Set defaults so that people start with stronger privacy protections, and can then choose to give it up. - Initially adopt the "privacy by default" approach of transitive defederation to protect against indirect data flows via Meta-federating instances while analyzing implementation and policies and investigating more flexible alternate approaches - Enable "Authorized Fetch" on current instance, and make it the default setting in software releases and at hosting sites. - Consider shifting to allow-list federation or (if your platform supports it) other approaches such as "approval first" federation. If your platform does't support it, ask them to add it – even if it's not right for you, it can help other instances protect themselves. ### Hosting sites - "Privacy by default": Set defaults so that people start with stronger privacy protections, and can then choose to give it up. For example, make "Authorized Fetch" the default setting, and ensure documention explains it well. ### Developers and fediverse software projects *Note: these should be reordered!* - Press the project leaders to prioritize privacy and safety in their planning. If they don't consider voting with your feet and creating a fork that prioritizes privacy and safety (as well as equity, usability, onboarding and all the other issues that need to be prioritized). - "Privacy by default": Set defaults so that people start with stronger privacy protections, and can then choose to give it up. For example, make "Authorized Fetch" the default setting, and ensure documention explains it well. - Provide a **usable** way for instances and individual users to protect all profiles, timelines, statuses, images, etc from anonymous access. - Reduce the number of public pages and the amount of data in them, including supporting private profiles; increasing use of non-public visibility like local-only posts; investigating new visibility levels like "within the same fedifam or caracol", "viewable only to people logged into instances that don't federate with Meta", differentiating between what's shown at different levels of visibility, and (potentially) requiring login to view unlisted statuses - Provide control for individuals and sites to determine whether RSS feeds are available, and implement an option to remove unlisted statuses from RSS feeds - Educate people on (and potentially package) existing processes and tools for IP Blocking, integrate with suspend/limit federation-level processes and infrastructure, and potentially develop new tools and look for ways to address downsides. - Develop processes and tooling for blocking Meta instances and all instances that federate with them. For example, extend nodeinfo to have a field with an instance's policy towards Meta (transitively block, block but federate with instances that federate with Meta domains, federate with Meta domains). Investigate solutions for blocklists Meta and federating-with-Meta domains (taking into account that there are likely to be a huge number of them hosted on different domains), and for allow-lists for instances that don't share data with Meta - Investigate shifting to allow-list federation, and look at alternative approaches like "approval first" federation. - Look at potential app-based dataflows and potential counter-measures, possibly including allow- and block-lists for apps as well - Pursue funding from anti-surveillance-capitalism companies, civil society groups, governments, and crowdfunding to allow more detailed analysis, design, and rapid implementation of privacy and safety features – and ensure that the funding is directed in a way that increases equity and diversity. ### Business, government agencies, civil society organizations, and funders: - Fund (and contribute staff time to) forks and new projects that prioritize privacy and safety (as well as equity, usability, onboarding and all the other issues that need to be prioritized). - Staff sand fund safety, security, and privacy work including threat modeling – and make sure the funding is distributed in ways that increase equity and diversity. ## Notes 1 Christine Lemmer-Webber (who co-authored the spec) says that from a security and social threat perspective, "the way ActivityPub is currently rolled out is under-prepared to protect its users." In [ActivityPub: The “Worse Is Better” Approach to Federated Social Networking](https://ariadne.space/2019/01/07/activitypub-the-worse-is-better-approach-to-federated-social-networking/?ref=thenexusofprivacy.net), Ariadne Conill describes ActivityPub's approach as prioritizing other concerns over safety, and the same's just as true for privacy. ActivityPub's weaknesses make it especially vulnerable to an "embrace and extend" attack where Meta introduces proprietary solutions that are genuine improvements over the standard. 2 Dan Goodin's [How secure a Twitter replacement is Mastodon? Let us count the ways](https://arstechnica.com/information-technology/2022/11/how-secure-a-twitter-replacement-is-mastodon-let-us-count-the-ways/?ref=thenexusofprivacy.net) is a good overview of some of the issues and the low current bar, like last fall's bug that let people steal passwords by injecting HTML and configuration error that left private photographs from hundreds of instances open to the web. As I was writing this post, the [admins of anarchist instance Kolektiva posted an alert that an unencrypted copy of their database had been seized by the FBI](https://kolektiva.social/@admin/110637031574056150?ref=thenexusofprivacy.net). 2.1 An "instance", also a server, is a site running Mastodon, Misskey, Pixelfed, or any other fediverse software. 2.2 Instance admins typically are responsible for configuring the software and setting the sites policies. Many also install, maintain, and update the software, although hosting companies such as masto.host offer those services, so are attractive options for smaller instances or instances whose admins don't have Linux sysadmin skills (or like me have basic skills but hate sysadmining). 2.3 In the open-source world, a "fork"is a variant of a code base run as a separate project. Glitch-soc and Hometown, both of which support local-only posts, are two popular Mastodon forks. Many Mastodon innovations were first developed in forks and then adopted by the mainline; "exclusive lists", coming in the next version, was originally developed by Hometown. Sometimes, though, the mainline decides not to adopt functionality from forks. 3 They're also exploring other revenue models including subscriptions (like [Instagram Plus](https://embedsocial.com/blog/instagram-subscriptions/?ref=thenexusofprivacy.net)) and an app store in th EU (with the Verge rather hilariously reporting that "[at least initially](https://www.theverge.com/2023/6/29/23778928/meta-eu-facebook-plans-app-install-android-ads?ref=thenexusofprivacy.net)" Meta isn't planning on taking a cut of of in-app revenue, as if they won't change that at the drop of a hat as soon as they decide it makes sense). These are still fairly small contributors to their revenue stream, however, and in any case are also likely to leverage Meta's competence of collecting data without consent. 3.8 Thanks to Vyr Crossont for pointing out Fediseer and Fedibuzz. 4 The setting is called DISALLOW\_UNAUTHENTICATED\_API\_ACCESS. [What does AUTHORIZED\_FETCH actually do?](https://hub.sunny.garden/2023/06/28/what-does-authorized%5Ffetch-actually-do/?ref=thenexusofprivacy.net) includes a good short discussion However, the article warns that this setting blocks anonymous access to *everything*, including the instance's "About" and registration pages. If so, turning it on makes an instance useless for people who don't already have accounts (and could potentially violate laws requiring [an Impressum](https://secureprivacy.ai/blog/what-is-an-impressum?ref=thenexusofprivacy.net) or publicly-posted privacy policy). Bummer. I'm not completely sure this is always true, however; I've seen some sites that appear to block not-logged-in access to statuses and profiles, while still allowing access to the site's about page. I'm not sure if it's this setting or another. 5 Especially if they offer individuals the ability to have their account on their own domain name as part of a $100/year "threads plus" package, or bundle it and use it to increase adoption of Insta Plus, or whatever. Even if they don't go that far and only offer it to a list of partners – celebrities, sports teams, politicians, media outlets, tech pundits, etc – who want to host their communities, there will still be lots of domains. Darnell Clayton's [Facebook Fears The Fediverse. Here’s How Instagram Will Try To Conquer It (EEE!!!!)](https://darnell.day/facebook-fears-the-fediverse?ref=thenexusofprivacy.net) has some interesting thinking on these kinds of scenarios. 6 As The Gibson (mayor of hackers.town) pointed out to me, platforms that aren't taking security and privacy considerations seriou sly need to be treated as a possible [supply-chain attack](https://en.wikipedia.org/wiki/Supply%5Fchain%5Fattack?ref=thenexusofprivacy.net) at this point. ## Update Log September 2024: start updating terminology to align with the [Terminology](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse#terminology) section of September 2024's [I for one welcome Bluesky, the ATmosphere, BTS Army, and millions of Brazilians to the fediverses!](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/) (although it's still a work in progress), added links to [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/) and [The Great Scrape: The Clash Between Scraping and Privacy](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4884485&ref=thenexusofprivacy.net) August 24 2023: add TODO with links on scraping. August 10: add link to fedifams and caracoles in allow-list discussion; add a brief mention of "token donation" and fediseer or fedibuzz; clarify RSS discussion; July 20: add paragraph about new threat vectors from trust and safety services, link to "threaderation" suggestion. July 7: added the top paragraph in response to excellent feedback that a summary would be very helpful! Reworked recommendations. July 6: many small changes in response to excellent feedback. More specific thanks and acknowledgments coming soon! July 5: first draft published July 2-4: early partial drafts sent to "friendlies" for feedback. Because, y'know what else do people have to do on a holiday weekend? So I greatly appreciate everybody who took the time to read it and respond, thank you thank you thank you! ### Six posts, a presentation, and a preview on privacy and prototyping: Fediverse update, July 3 URL: https://thenexusofprivacy.net/five-posts-on-the-fediverse-and-mastodon/ Last updated: 2026-04-16T03:07:18.000Z As usual it's interesting times in the ecosystem of decentralized social networks known as the "fediverse". It's always grown in waves, and now thanks to Reddit's ongoing footgun and Twitter's latest management brilliance, there are at least two in progress. And while the last several waves have focused primarily on Twitter competitor Mastodon, this one is also sparking interest in Reddit-like kbin and Lemmy, Instagram-like Pixelfed, and the rich functionality of Misskey (growing rapidly in Japan) and its about-to-be-renamed Calckey fork. As if that's not enough, Facebook parent company Meta's about to introduce a Twitter-competitor (probably known as Threads), and there's a *lot* to say about that. Interesting times indeed. So there's a lot to write about, and I've been doing a lot of writing about it. Rather embarassingly for a blog/newsletter called "Nexus of Privacy", almost none of it has been directly about privacy, for which I apologize. I'm working on a privacy-related fediverse post and hope to have a draft out by the end of the long weekend. I've got an excerpt at the bottom – that's the "preview" in the title. A lot of the other writing I've done in the last week has been updates of previously-published posts. Individual updates have small enough, and frequent enough, that it's not worth ending out individual newsletter updates. Insrtead, I figured I'd collect them in a single post. Also, I have a lot of new subscribers since last November, so some of you may not have seen the earlier versions of some of these – or Flocking to Mastodon, the "presentation" in the title. ## Six posts *I know this is only five bullets, but the first bullet is two separate posts.* - [How to choose the right Mastodon instance?](https://thenexusofprivacy.net/choosing-a-mastodon-instance/) and [How to use filtering and muting to hear less discussion of odious people on Mastodon](https://thenexusofprivacy.net/how-to-filter-out-mentions-of-unpalatable-people-on-twitter-and-mastodon/) both have minor updates from last fall. If you're one of the many frustrated Twitter or Reddit users who's checking out Mastodon, I hope you'll find them useful! - [A (partial) queer, trans, and non-binary history of Mastodon and the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net) (on WeDistribute) is the revised version of [We’re here, we’re queer, and we’re federated](https://thenexusofprivacy.net/here-queer-and-federated-on-mastodon-and-the-fediverse/), with a different introduction (including several additional quotes, and more of an emphasis on recognizing people who *aren't* mentioned). It also highlights several additional contributors, including Solstice School, Artemis developer Harriet, Calckey maintainer Kainoa, and Hajkey / Blahaj team of Kaity and Ada. - [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) has quite a few new quotes and links as sigificant edits in the [Two views of the fediverse](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#two-views) and [In chaos there is opportunity!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#chaos) sectiuons - [Don’t tell people “it’s easy”, and seven more things Kbin, Lemmy, and the fediverse can learn from Mastodon](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/) has several new sections ([Experiment to find what approaches are a good fit for the current state of the software](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/#experiment) , [Ten days later](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/#ten-days-later), and [A few more thoughts on moderation](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/#more-on-moderation)) and several updates on the bot infestation. - [Mastodon: a partial history (DRAFT)](https://thenexusofprivacy.net/mastodon-a-partial-history/) has some updates to the section on [Does Mastodon really prioritize stopping harassment?](https://thenexusofprivacy.net/mastodon-a-partial-history/#does-mastodon-really-prioritize-stopping-harassment) and a few other minor cleanups, although it still mostly ends in December 2022\. I've got some notes for a followon bringing it up-to-date (as well as a section on Gab), but I'm not sure about the timeframe. The activity on the BlackMastodon and BlackJoy s a huge positive difference from a year ago ... but in so many ways Mastodon hasn't really addressed its problems: over-centricity on mastodon.social, it's cis white guy-heavy power structure, its well-deserved reputation for racism and reply guys, lagging innovation energy compared to apps, other platforms, and forks. [n chaos there is opportunity!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#chaos), but will Mastodon itself be able to seize it? We shall see. ## A presentation: Flocking to Mastodon This is a presentation Alka Roy and RI Labs hosted in late 2022\. The section on "Navigating Mastodon: How to Use it?" has a lot of tips for newcomers, and the "It’s Evolving: Why it Matters & What Next?" remains relevant as well. There were problems with the video quality so we never put it up on YouTube but the slides have a lot of information in them. [Here's the Google Slides link](https://docs.google.com/presentation/d/e/2PACX-1vTNpUxlMpYbSiATL-ekeK7o4HPk2nNOo7JVsWPhk4RHHaFaPZyOtCUiV0WPGLi%5FeN5UigS98ccJhchL/pub?start=false&loop=false&delayms=3000&ref=thenexusofprivacy.net); I'll work on getting a surveillance-free PDF available as well. [Flocking to Mastodon? Here’s what you need to know!Do we know why we are playing the game we are playing? 1 RI Labs Leadership Circle Talks © Alka Roy, RI Labs 2022, All Rights Reserved. Love How You Lead Jon Pincus Founder, Nexus of Privacy RI Labs Future of Leadership Program Participant @jdp23@indieweb.social Flocking to Mastodon?: What You Ne…![](https://ssl.gstatic.com/docs/presentations/images/favicon5.ico)Google Docs![](https://lh3.googleusercontent.com/docs/ADP-6oGoyMdJaKj23BnnzuG4U8Z0eYmm8Hmksx8jhy2GRmgQzQa7J8P4hNeIqhJsL3WAYv15CPiwJJNdIuvlaYK-kbFczxZRYhkGZnQqhU1-qDfv=w1200-h630-p)](https://docs.google.com/presentation/d/e/2PACX-1vTNpUxlMpYbSiATL-ekeK7o4HPk2nNOo7JVsWPhk4RHHaFaPZyOtCUiV0WPGLi%5FeN5UigS98ccJhchL/pub?start=false&loop=false&delayms=3000&ref=thenexusofprivacy.net) ## A preview on privacy and protoyping: excerpts from "Threat modeling, Meta, and privacy in the fediverse" *Title subject to change! This is an early draft,* > Meta's potential arrival may well catalyze a lot of positive changes in the fediverse. And changes are certainly needed! > > – from [In chaos there is opportunity!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#chaos) Privacy is one of those areas of the fediverse where change is badly needed. Mastodon wasn't designed and implemented with privacy in mind – in fact it violates pretty much all of the [seven principles of Privacy by Design](https://www.ipc.on.ca/wp-content/uploads/resources/pbd-implement-7found-principles.pdf?ref=thenexusofprivacy.net). Privacy by default? End-to-end security? User-centricity? Uh, no. And it's not just Mastodon, the same's true with most if not all other fediverse software. Even the underlying AcitivityPub protocal that powers the fedierse has major limitations. Christine Lemmer-Webber (who co-authored the spec) says that from a security and social threat perspective, "the way ActivityPub is currently rolled out is under-prepared to protect its users." Ariadne Conill's [ActivityPub: The “Worse Is Better” Approach to Federated Social Networking](https://ariadne.space/2019/01/07/activitypub-the-worse-is-better-approach-to-federated-social-networking/?ref=thenexusofprivacy.net) describes ActivityPub's approach as prioritizing other concerns over safety, and the same's true for privacy. > **We interrupt this blog post for a public for a public service ammouncement.** > Pleas do not use the fediverse for confidential or secret information. Don't use Facebook, Instagram, Twitter, or any other social network either. Use Signal or some other encrypted messaging system. > > We now return you to your regularly-scheduled programming. Meta's potential arrival on the fediverse increases the urgency of addressing these longstanding privacy issues. For one thing, Meta's a threat in many ways: to the safety and mental health of many people in the fediverse, to many marginalized communities who are trying to make a new home there, to democracy ... and to our data. Meta's business model is exploit data they've gathered without consent by selling ads and influence elections; they're exploring collaborating with Mastodon instance admins in "win/win" partnerships to monetize their users (and their data). People in the region of the fediverse that *doesn't* collaborate with Meta will need stronger privacy protections to protect their data. That said, privacy's even worse on Facebook and Instgram than it is in the fediverse. Their software is the opposite of Privacy by Design, everything about it is designed to track your every move and encourage you to give them as much data as possible and feed their racist algorithms. So there's also a huge opportunity here. If the fediverse can provide a more private alternative, that will be hugely appealing to a lot of people. Either way you look at it, now's a good time for the fediverse to take privacy more seriously. And not just privacy, of course. One way to look at fediverse is that we've been doing a prototype at scale of a decentralized network, big enough to get experience with the complexities of federation, good enough that many people find it usable and even enjoyable for a social network activities – but with big holes including privacy (and safety and accessibility and equity and usability and sustainability and ...). To effectively respond to Meta, the fediverse is going to have to get beyond the prototyping stage. One path forward is to evolve today's implementations and addressing problems incrementally. From this perspective, threat modeling can help identify low-hanging fruit to make more rapid progress in the short term as well as highlight important areas where there *aren't* any good short-term answers yet. And threat modeling's also useful for new implementations that *start* with a focus on privacy by design (and design from the margins, and software engineering best practices, and safety, and equity, and accessibility, and ...). So let's get to it! ### How to use filtering and muting to hear less discussion of odious people on Mastodon URL: https://thenexusofprivacy.net/how-to-filter-out-mentions-of-unpalatable-people-on-twitter-and-mastodon/ Last updated: 2026-04-16T03:07:02.000Z *Originally written November 2022\. Minor updates July 2023, including moving Twitter description to an appendix because who even cares these days.* Twitter's odious new racist, anti-trans management is once again doing odious things. When I first wrote this article they were reinstating the accounts of odious people who have committed "minor" offensive like anti-trans hate speech, organizing harassment campaigns, and attempting to stage coups. Right before I revised this ... oh never mind the details, you're probably as sick of hearing about Elmo as I am. As usual lots of people are talking about it which means that timelines on social media are filled with discussions of odious people. Of course I'm not trying to stop anybody from talking about odious people but I really wish I didn't have to hear so much of it. The good news is that on Mastodon you can use "filters" to reduce how much of this discussion you see on your timelines by telling the software not to show you any posts that include specific keywords. It's similar to Twitter's "muted words", although better in several ways. Just to set expectations, this doesn't work perfectly – I'll discuss some of the limitations at the end of the article. Still, I personally find it's really worth doing. If you want to give it a try, here's how. ## Adding a new filter If you're using the web interface on a phone, you can get to Mastodon's filters by selecting the little gear icon ⚙ on the bottom right, then the menu at the top right, and then **Filters**. If you're using the web interface on a computer, clicking on **Preferences** (on the right-hand side of the screen) and then **Filters**. Once you're there, click on the **Add new filter** button. Here's a screenshot of the current version, filled out to filter any posts mentioning Elmo. ![A screenshot of a complicated dialog, with the title "Add new filter", and at the bottom a big blue "Save new filter" button. More details in the text.](https://thenexusofprivacy.net/content/images/2022/11/Screen-Shot-2022-11-19-at-8.33.29-PM.png) - You can have multiple filters, so choose a **Title** that you'll remember. - **Expires after** lets you put in temporary filters – for as short as 30 minutes or up to a week – but I never want to hear about this hypothetical Elmo ever again so went with **Never** - **Filter contexts** specifies where the filter applies. I checked everything but profiles but you can apply it more narrowly. - **Filter action** is what happens if the filter matches a post. **Hide with a warning** works well when you're testing it out; any of the filter matches displayed as a warning message like the one at the beginning of this article; you can then click on if you want to see the post – kind of like a content warning but it looks different). Once I'm confident it's working, I'll change it to **Hide completely**. - The filter applies to poststhathave any of the **keywords** in the text, CW (content warning), or media description (alt-text) for any images or videos included in the post. If you check “**whole word**,” the filter only applies if the keyword is surrounded by spaces or other non-alphanumeric characters. Otherwise, it applies to any post with the included characters, regardless of whether they are in the middle of a word. - You can add additional keywords as well. For this filter, I went on to add "Apartheid Clyde", his first and last names, and variants with vowels replaced by an asterisk (a commonly-used technique on Twitter). - Once you're done, click the blue **Save new filter** button at the bottom. Once I added some additonal keywords and clicked save, here's what my filters page looks like ![A screenshot saying Filters. Below: "Elmo. 8 Keywords. elmo, Apartheid Clyde, SpaceKaren, ..." To the right, Buttons for "Edit filter" and "Delete". At the top right, a button for "Add new filter"](https://thenexusofprivacy.net/content/images/2022/11/Screen-Shot-2022-11-20-at-10.21.04-AM.png) You can add as many other filters as well; I added one called "disgraced former" and you can probably guess what I put in it. ## You can edit and delete filters too If you don't get it quite right, or decide you want to add another keyword, no worries: you can click on **Edit filter** to refine it – or delete it and start again. There isn't a cancel button on the **Add new filter** or **Edit filter pages**, so if you change your mind partway through, just use the browser's **Back** button. ## Limitations – and an opportunity for innovation Like I said at the beginning of the post, this doesn't work perfectly. - It's very easy to filter out more than you really want. My "Elmo" filter will also filter out other Elmos. If I hadn't checked the "Whole word" box for the "Elmo" keyword, I would have also filtered out any mentions of Emore James, Elmore Leonard, and any other Elmores as well. - No matter how many keywords you add, you're likely to miss posts that use unusual nicknames, have typos, or don't even refer to the person by name. - Unlike Twitter, Mastodon check's the alt-text associated with images. That's good! But unfortunately people often don't provide it. Not including alt-text is bad from an accessibility perspective too – so when you post images on either of these platforms, please consider taking the time to include alt-text. Of course, there are a lot of reasons it can be challenging for people to provide alt-text, so please don't give people a hard time if they're not. I've seen several blind people on Mastodon talking about how irritating it is when sighted people scold them for not providing alt text ... don't be like that. Still, despite the limitations, filters can be very useful. Over the last six months, **Elmo** and **Disgraced former** have made a big difference in my Mastodon experience! Mastodon originally had a more powerful but much less usable approach to filtering called "regex filters", which required [magic incantations](https://write.as/oreolek/mastodon-using-regex-filters?ref=thenexusofprivacy.net) like `[^а-яА-Яa-zA-Z0-9_](nastythings?|vilethings?)[^а-яА-Яa-zA-Z0-9_]` to work. Keyword filters were introduced mid-2018; Cassian’s [I left Mastodon yesterday](https://cassolotl.medium.com/i-left-mastodon-yesterday-4c5796b0f548?ref=thenexusofprivacy.net) and [I left Mastodon 27 days ago](https://cassolotl.medium.com/i-left-mastodon-27-days-ago-ae34919290e1?ref=thenexusofprivacy.net) give some of the backstory. Mastodon's implementation has several improvements on Twitter as well. The ability to filter on CW's and image alt-text is very useful, and so is the option to see warnings for posts that are filtered out. Mastodon version 4.0, released in November 2022, introduced the grouping of multiple keywords into a single named filter, which is useful from a UI perspective, and it's encouraging to see some progress on this front for the first time in several years.. Even so, there's a lot of room for further improvement. For example, it would be great if there were a way for users to share filters with each other – even just the import/export functionality that Mastodon offers for blocklists would be helpful. And how cool would it be if instance admins or moderators could set up optional filters that users could then choose to enable with a single click? It'll be interesting to see if the new surge of interest in Mastodon leads to innovation in areas like this – folks on places like hci.social (a Princeton University-run server for people in and around the Human-Computer Interaction field) have a lot of expertise. As I say so often when writing about Mastodon ... we shall see! *Updated July 2023, moving the Twitter stuff to an appendix and making some minor cleanups.* ## Appendix: Muting words on Twitter Twitter's muted words offers similar funcationality. Here's the simple ten-step process from their [How to use advanced muting options page](https://help.twitter.com/en/using-twitter/advanced-twitter-mute-options?ref=thenexusofprivacy.net). 1. Click **More** from the side navigation menu, then click **Settings and privacy**. 2. Click the **Privacy** and safety tab, then click **Mute and block**. 3. Click **Muted words** 4. Click the plus icon. 5. Enter the word or hashtag you’d like to mute. Entries can only be added one a time. 6. Select **Home timeline** if you wish to mute the word or phrase from your Home timeline. 7. Select **Notifications** if you wish to mute the word or phrase from your Notifications. 8. Specify **From anyone** or **From people you don’t follow**. \[I *still* really don't want to hear about hypothetical Elmo so I specified **From everybody.\]** 9. Under **Mute timing** choose between Forever, 24 hours from now, 7 days from now, or 30 days from now. \[I chose Forever.\] 10. Click **Save**. How intuitive! Then you can do steps 4-10 again to add additional words. It' s a fairly similar process in the Twitter app, although instead of steps 1 and 2 you need to click the icon in the top right corner of your screen, selecting **View content preference**s, and click on **Muted.** Either way, when you mute words, you won't get any notifiations for tweets that include them or see tweets with those words in your timeline – at least theoretically. Twitter's muted words (unlike Mastodon's filters) don't apply to image's alt-text so a lot gets through. And my experience is that this functionality is sometimes buggy even at the best of times on Twitter, and right now is not the best of times, so your mileage may vary. Still, if your staying around on Twitter for now, it's probably worth giving it a try. --- *Thanks to @nanaslugdiva@sfba.social for suggesting filtering out the bad man, which led to "disgraced former" filter and eventually this post! And thanks as well to @maikel@fedi.maikel.dev for all the discussion and insights on the details.* --- ### How to choose the right Mastodon instance? URL: https://thenexusofprivacy.net/choosing-a-mastodon-instance/ Last updated: 2026-04-16T03:06:37.000Z *Originaly written November 2022, updated July 1 2023 for the next wave.* > Feel free to [skip to the **resources**](#resources)for finding the right instance for you. Or, if you want some background, and reasons why the choice of an instance matters so much, read on! A lot of people are once again looking at the Fediverse as an alternative to Twitter these days. Well, more accurately, a lot of people are looking at Mastodon as an alternative, and [Mastodon's part of a much larger ecosystem of interconnected social media sites and services called the Fediverse](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=thenexusofprivacy.net). But Mastodon's getting the most attention, because it's got the biggest installed base and a lot of similarities to Twitter, so that's what I'm going to focus on in this post. One of the challenges for newcomers to Mastodon is that you're faced with a major decision you face when signing up: what server (aka "instance") to choose? Different instances have different focuses: are geographically focused (sfba.social), identity-based (tech.lgbt), interest-based (mastodon.art), professional (infosec.exchange), a group of friends (friend.camp), or even lipogrammatic (oulipo.social, which doesn't allow the letter 'e' in posts). Others are "general purpose", without a specific focus – like mastodon.social, mastodon.ai, and hachyderm.io. The choice isn't irrevocable – you can migrate your account to another instance and keep the list of who you're following and who's following you – but it's still daunting. Newcomers are often told that it doesn't matter what instance you're on, or to just sign up for mastodon.social (the "flagship" instance, which is the default for mobile apps and spreadmastodon.com) and worry about it later. This is really horrible advice, because what instance you're on has a big effect on your experience – and for most people, mastodon.social is *not* a good place to start. Hera's some of the reasons why the instance you're on has such a big effect on your experience: - Instance admins' policies and moderation choices set the norms of the site. As @RadioAngel@sunbeam.city [points out](https://sunbeam.city/@RadioAngel/109378007463991333?ref=thenexusofprivacy.net), moderation can be extremely bad to non-existent on the bigger instances – and a lack of training and rules for moderators can lead to entire instances turning into a dumpster fire overnight. People of color and women on instances that aren't well-moderated face a higher risk of being targeted for harassment (and are less likely to get quick help when it happens), and often have to deal with a lot more of Mastodon's endemic reply gus and "HOA racism". - An instance's "local" timeline (showing all the posts accounts on an instance make) is a good way of finding new people to follow, so it can make sense to choose something that matches your interests (like mastodon.art, fosstodon.social, hci.social, infosec.exchange, social.coop) or physical location (like sfba.social or wien.rocks). Less positively, for huge sites like mastodon.social, the "local" timeline has so much activity that most people find it a not-very-useful firehose. Worse, if you choose an instance that's mostly white techbros, then that's who you'll mostly be exposed to. - Some instances run *forks* (variants) like glitch-soc or Hometown that have user experience, privacy, and anti-harassment improvements that Mastodon's lead developer and BDFL (Benevolent Dictator For Life) Eugen Rochko has kept out of the official release. - Instances can and do block other instances, so if you wind up on an instance that also hosts nazis or TERFs, you won't have access to a lot of the Fediverse. - Instance admins can read everybody's private messages, and are responsible for the ssecurity of the site, so if you're doing anything where privacy matters to you, you want to be on a site with admins you can trust. - As [Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/) discusses, different instances are likely to make different decisions about whether to collaborate with Facebook's parent company Meta, who's introducing a new Twitter competitor that's reportedly going to be compatible with Mastodon and the fediverse sometime in the next few months. If you want nothing to do with Meta, you'll want to be on an instance that blocks them. You can find out some of this information in advance, but it can be time consuming – and there's a lot that's hard to know up front. If you've got friends who are already on Mastodon, ask them what instances they recommend. If not, use sites like [fedifinder.glitch.me](https://fedifinder.glitch.me/?ref=thenexusofprivacy.net) to find out what servers people you're following on Twitter are using and see what they think. Here are some resources that can help you find the right instance for you: - [fedi.garden](https://fedi.garden/?ref=thenexusofprivacy.net) is a small human-curated list of nice, well run servers on Mastodon and the wider Fediverse, run by the same person who runs the invaluable [fedi.tips](https://fedi.tips/?ref=thenexusofprivacy.net) site, and all the sites listed on fedi.garden have promised to obey [specific standards of reliability and responsible moderation](https://fedi.garden/about-this-site/?ref=thenexusofprivacy.net). Small sites are much more likely to have a community feel and responsive moderators; as Mastodon.art's Curator [says](https://mastodon.art/@Curator/110641353328331942?ref=thenexusofprivacy.net), "It's more like belonging to a home that looks after you and your online wellbeing, as opposed to being one person in a sea of strangers forming connections with people on lots of disparate islands." - [joinmastodon.org/servers](https://joinmastodon.org/servers?ref=thenexusofprivacy.net) has a list of servers that have agreed to the [Mastodon Server Covenant](https://joinmastodon.org/covenant?ref=thenexusofprivacy.net), which (like fedi.garden's standards) includes "active moderation against racism, sexism, homophobia and transphobia." Bear in mind that this is very high level, and the site's reality may not align with these values – for example if they don't have enough trained moderators, there may still be problems with racism hate speech and harassment. Still, it's something. - [fediverse.party has a much longer list](https://fediverse.party/en/portal/servers/?ref=thenexusofprivacy.net) of instances, classified by region and topic. - [mastodon.help's instance search tool](https://mastodon.help/instances/en?ref=thenexusofprivacy.net) includes the ability to search for sites baesd on the text in their site description. You can also specify the most-used language, number of users, connectivity to other sites, and several other terms. For example, [here's the results](https://mastodon.help/instances/en?lang=112&desc=privacy&minu=20&maxu=30000&minau=20&minki=100&black=1&creg=1&appr=0&lcok=0&ord=tusersd&advc=1&p=1&ref=thenexusofprivacy.net) of a search for instances where English is the most-spoken language, mention privacy in their description, have at least 20 active users, and are connected to at least 100 other instances. The results contain a list of the most frequent hashtags, how long the site has been around, usage statistics, and the version of the software (so you can see if it's running glitch or Hometown), and the admin's email. Useful! - If you're looking for a server near you, [fediverse.observer's map](https://mastodon.fediverse.observer/map?ref=thenexusofprivacy.net) and the [fediverse.party list](https://fediverse.party/en/portal/servers/?ref=thenexusofprivacy.net) are two good options. - [instances.social](https://instances.social/?ref=thenexusofprivacy.net) lets you search by instance size and language. It used to also allow searching by policies (for example, does it allow NSFW content) but that no longer seems to be an option. - The [Anti-Meta Fedi Pact ](https://fedipact.online/?ref=thenexusofprivacy.net)and [Instances with 25+ members that have signed the FediPact](https://kbin.social/m/FediPact/t/119000/Instances-that-have-signed-the-FediPact?ref=thenexusofprivacy.net) lists many (alhough not all) of the instances how have committed to not working with Meta. Yeah, it'd be a lot easier if a single site provided all of that functionality. Welcome to the fediverse. You can can also find out some information about a server before you set up an account: - Servers' "About" pages typically give an overview of what the site's about and list the site's policies (as a list of rules or a code of conduct), and what version of the software the site is using. A change in Mastodon version 4.0 made these harder to find but you can still get there: it's the "Learn More" link on the left-hand side of the web interface, and the ... button on the right sidebar on phones. How intuitive! One thing to look for on the **About** page is the site's policy about hate speech and harassment. If they talk about "free speech" in their description, rules, or code of conduct, that's often (although not always) code for an almost-anything-goes attitude. Of course some sites with good policies don't actually enforce them in practice, but sites with bad policies are big red flags. Also useful: many sitesinclude a list of instances they've blocked or limited, along with explanations. This is one of the best ways to see if they're moderating actively – and what they consider cause for blocking. On the other hand, publishing a list of blocked instances can potentially open moderators up to harassment many instances intentionally *don't* publish the list . - Many servers let you look at the local timeline even without logging in. On the web interface, it's the "local" link on the right-hand-side of the page; on the phone it's the unrecognizable icon on the right hand side below the # and above the globe. Of course, to reduce the risk of harassment and abuse, some servers don't make this available. - Servers' "explore" pages show the most active posts on the server's "federated" timeline, which also includes all posts from other instances. This is typically also what you see when you visit a site you're not logged into. RadioAngel has some good suggestions about [what to look for when choosing an instance](https://sunbeam.city/@RadioAngel/109378007463991333?ref=thenexusofprivacy.net): - Do they have limits on how many users can join the instance? (This is in force to keep the mod to report ratio healthy). - Do they have a dedicated team of mods? Who are they? - Read their 'About' & 'Limited Servers' sections. Who are they blocking? What are they blocking for? - How active is the instance? Despite being invite only or limiting registrations temporarily, is there a lot of activity? If you've got the time, one good option is to set up accounts on multiple instances and experience them first hand. Right now, I'm primarily using [@jdp23@indieweb.social](https://indieweb.social/@jdp23?ref=thenexusofprivacy.net) as my main public-facing account, but also have accounts on hci.social and scholar.social for my research-y interests, one on wandering.shop that focuses more on writing, and so on. Most Mastodon mobile apps, and web interfaces like or [elk.zone](https://elk.zone/?ref=thenexusofprivacy.net), make it fairly easy to switch between accounts on multiple instances; or you can do what I do and use multiple tabs in your browser. And keep in mind that you're not locked into your initial choice. If the instance you've chosen isn't working for you, find another one! Mastodon lets you move your followers over to a different account, and [Mastodon Content Mover lets](https://mastodoncontentmover.github.io/?ref=thenexusofprivacy.net) you move your posts as well (it's still under development, but I've heard from several people that it usually works fairly well). --- *Thanks to RadioAngel for the permission to quote their excellent suggestions, and thanks to @sloot@twit.social for catching a big editing error in an earlier version!* --- Image credit: “Question Mark” by Hana Chramostova licensed under [CC1.0 Universal Public Domain license](https://creativecommons.org/publicdomain/zero/1.0/?ref=thenexusofprivacy.net), via [PublicDomainPictures.net](https://www.publicdomainpictures.net/en/view-image.php?image=160217&picture=question-mark&ref=thenexusofprivacy.net) ### We're here, we're queer, and we're federated: How queer, trans, and non-binary people helped create Mastodon and are shaping today's fediverse (REVISED DRAFT) URL: https://thenexusofprivacy.net/here-queer-and-federated-on-mastodon-and-the-fediverse/ Last updated: 2026-04-16T03:06:13.000Z > The final version of this post, with additional material (and an editing pass), was published on **We Distribute** as [A (partial) queer, trans, and non-binary history of Mastodon and the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net). I kept this draft around in case people are interested in seeing how it evolves. > "way back, at the beginning of mastodon’s rise to what it is now, queer activists, be they just a stranger with a keyboard, new to the social media site, weighing in on a topic on the public timeline, or me, someone actively attempting to be the middle between the most vocal voices, and tangible, meaningful change through gargron’s code, and github focused writing and activity, people were queer. they were marginalized, to some extent. people who weren’t comfortable with the status quo, so we changed it." > > – hoodieaidakitten, [Mastodon’s Complicated Relationship with Queer Activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=privacy.thenexus.today), July 2018 > “I cannot count the number of people who I’ve seen and followed…on Mastodon and then come and realize more things about their gender identity, their sexual orientation, their different community markers.” > > David Wolfpaw, founder of the tech.lgbt Mastodon community, quoted in [Can Mastodon be a Twitter Refuge for Marginalized Groups](https://www.fastcompany.com/90817452/can-mastodon-be-a-twitter-refuge-for-marginalized-groups?ref=thenexusofprivacy.net), November 2022 Even though it's Pride month, you wouldn't know it from a quick look at the pages showing the most popular posts on most large Mastodon instances.1 As with most social networks, other topics draw a lot more attention than queer issues, and the loudest voices are cis and straight. If you look a little more closely, though, there's actually a heck of a of queerness happening on Mastodon – and it's part of a rich history. Ever since Mastodon started in 2016, queer, trans and non-binary people have helped build it and the interconnected web of decentralized social networks known as the "[fediverse](https://axbom.com/fediverse/?ref=thenexusofprivacy.net)." Today there are dozens or even hundreds of LGBTQ-focused instances, and even many of the instances that aren't specifically for the community are welcoming. Which is good! People telling the Mastodon origin story usually acknowledges the queer influence. Carl Miller's [Who commands the internet?](https://unherd.com/2018/10/who-is-in-charge-of-the-internet/?ref=privacy.thenexus.today) (from 2018) quotes Mastodon's BDFL (Benevolent Dictator for Live) Eugen Rochko on the early growth: > “Queer people joined”, said Eugen, “and Furries. It comes in waves.” Still, very few people I talk to know realize how extensive queer contributions have been – and how much tension there's been around them . [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history/) has a lot of quotes and links to first-person experiences, but they're scattered throughout it – and it ends in late 2022\. So to celebrate Pride, I figured I'd collect some of the highlights in a single post, and then highlight a few of many areas where the impact continues today. First, though, I want to highlight a point that Dr. Johnathan Flowers discusses in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=privacy.thenexus.today). Mastodon – and the broader fediverse – have a long history of hostility to marginalized people, especially people of color. Many Mastodonians use the very positive contributions of queer people I'll be discussing here as a shield against critiques or discussions of the platforms racism. Please don't do that! And even though it's a bit of a downer in an otherwise celebratory post, it's also important to recognize that Mastodon's hostility to marginalized people also applies to many queer, trans, and non-binary people as well. The names of the people who have made the key contributions have been largely erased. The stories I talk about here are rarely told and when they are it's rarely from a queer perspective. As Sasha Costanza-Chock says in [Design, power, and justice](https://news.mit.edu/2020/design-justice-book-0304?ref=privacy.thenexus.today): > "\[P\]eople are often marginalized from the stories we hear about the creation of new tools. Social movements are often hotbeds of innovation, but their contributions aren't always recognized.” Not only that, Mastodon and the fediverse have gotten big enough that there's money floating around ... and most of it's going to cis straight people. And of course all of these impacts are worse on queer, trans, and non-binary people who are also marginlized in other ways – Black and Indigenous people of color, disabled people, sex workers, and others largely excluded from Mastodon's power structure. This is something that really needs to change going forward. And it's also something to keep in mind when thinking about the history of Mastodon and the fediverse, because it highlights how challenging the environment was for the people making these amazing contributions! ## Mastodon's early days > “When everyone joined there wasn’t per-post privacy or CWs or anything that people associate with Mastodon today. The new wave of queer users came up with, designed, pushed for, and implemented those features.” > > – Shel Raphen, former Mastodon volunteer coordinator, project manager, and community manager, in Ana Valens’ [Mastodon is crumbling — and many blame its creator](https://www.dailydot.com/debug/mastodon-fediverse-eugen-rochko/?ref=privacy.thenexus.today) (2019) [Rapid queer-led community innovation](https://thenexusofprivacy.net/mastodon-a-partial-history/#rapid-queer-led-community-innovation) discusses Mastodon's first major growth spurt culminating in the breakthrough month of April 2017\. Here's how I summarized it: > Mastodon in early 2017 was hella queer, and the queer volunteers who helped create Mastodon made an incredible amount of progress in the first half of the year In [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=privacy.thenexus.today), Allie Hart links links to github artifacts for the implementation of locked accounts, private toots (as posts were called at the time recently), blocking, muting, and reporting from the time. Conent warnings (CWs) and instance blocking, a powerful technique helping admins and sites protec themselves from bad actors, was also driven by queer and trans people. As I said when discussing this in an April 2017 presentation on [Transforming Tech with Diversity-Friendly Software](https://medium.com/a-change-is-coming/transforming-tech-with-diversity-friendly-software-338f56d91df?ref=thenexusofprivacy.net), on open-source projects people can implement the functionality they want and need. But as the titles of [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=privacy.thenexus.today) and the followup [Mourning What Now?!?!](https://medium.com/@alliethehart/mourning-what-now-10964cce22a8?ref=privacy.thenexus.today), it wasn't all good. As Hart said, > "The recent influx of users to the platform has brought with it new contributors and an expanded revenue stream that has rendered the original nearly obsolete. Queer users could leave *en masse* without harming the project’s survivability, which means that the reciprocity of their relationship has been terminated — queer users still depend on the project, but the project no longer depends on its queer users." hoodieaidakitten has a similar perspective in [Mastodon’s Complicated Relationship with Queer Activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=privacy.thenexus.today) > "things changed, because more and more people comfortable with the status quo followed. we queer activists rapidly became the subset that originally came, the marginalized. the minority." Things came to a head in [The Battle of the Welcome Modal](https://thenexusofprivacy.net/mastodon-a-partial-history/#the-battle-of-the-welcome-modal). Many new arrivals (including me) found Mastodon confusing in April 2017\. As Valens describes [Mastodon is crumbling — and many blame its creator](https://www.dailydot.com/debug/mastodon-fediverse-eugen-rochko/?ref=privacy.thenexus.today), Shel Raphen – who was doing an outstanding job of project management in a very difficult situation – designed a [welcome modal](https://github.com/mastodon/mastodon/issues/705?ref=privacy.thenexus.today) to help with onboarding. Rochko harshly criticized the design and [made significant changes](https://github.com/mastodon/mastodon/pull/1883?ref=privacy.thenexus.today) that Raphen "[broke the pedagogy and curriculum built into the design of the onboarding modals](https://github.com/mastodon/mastodon/pull/1964?ref=privacy.thenexus.today)," which had been reviewed and approved by various other contributors. Valens describes the incident as "[A breaking point for the queer community](https://thenexusofprivacy.net/mastodon-a-partial-history/#a-breaking-point-for-the-queer-community)" and that's how I remember it too. On the other hand, flawed as it was, the welcome model was also successful, although not as much so as it would have been otherwise: it did in fact reduce a lot of confusion for new users. Unfortunately, progress stalled on onboarding after the Battle of the Welcome Modal, and it remains a problem today.2 Of course, queer people didn't go away. Creatrix Tiara's [Mastodon 101: A Queer-Friendly Social Network You’re Gonna Like a Lot](https://www.autostraddle.com/mastodon-101-a-queer-friendly-social-network-youre-gonna-like-a-lot-390948/?ref=privacy.thenexus.today) on *Autostraddle* later that year brought more queer users, and the number of LGBTQ+-focused instances continued to increase. And innovation didn't go away either. The trans-led Glitch-soc fork (variant) of Mastodon continued to take the lead in introducing tools to protect users by implementing "local-only posts" in June 2017, an innovation that has since been adopted by other forks like Hometown and most other fediverse software (although still not by mainline Mastodon, so it's not available on most large instances).3. Glitch-soc also was the first to implement user‐defined profile metadata, collapsible statuses, user controlled layout, and images inside CWs,. Today, Glitch-soc is the most widely-deployed Mastodon fork, and is used by hundreds of Mastodon instances. ## Ongoing contributions – often without credit > As a trans woman on the internet, my work with Mastodon has always been about more than just social media—it's been about keeping people alive. > > – Margaret KIBI, [Fringe Mastodev – Part II](https://www.u2764.com/NFIC/2018-09-16/fringe-allie/?ref=thenexusofprivacy.net) Queer, trans, and non-binary people continue to make major contributions – often without being credited or acknowledged. A few examples: - Artist Marcia X created the #FediBlock hashtag for admins and users to share information about instances spreading harassment and hate, and long-time Mastodonian Ginger immediately helped by spreading it to faer networks and normalizing its use. In 2022, this hashtag remains an extremely valuable resource. However, various "fediblock" sites and accounts have popped up over the years without any credit – or compensation – to the original creators. - In May/June 2018, the initial implemention of [trending hashtags](https://github.com/mastodon/mastodon/issues/271?ref=privacy.thenexus.today) – with no ability for site admins to turn the feature off – led to a [firestorm](https://github.com/mastodon/mastodon/issues/271?ref=privacy.thenexus.today#issuecomment-394026852) of [criticism](https://github.com/mastodon/mastodon/issues/7702?ref=privacy.thenexus.today#issuecomment-394041017) from people who saw it as clashing with Rochko's claim that Mastodon had "a focus on user experience and anti-abuse tools." As maloki [said](https://github.com/mastodon/mastodon/issues/7702?ref=privacy.thenexus.today#issuecomment-394039200), "You can't have anti-abuse tools by actively creating tools that are very likely to be used for abuse, without consulting people who know and understand anti-abuse." Cassian’s [I left Mastodon yesterday](https://cassolotl.medium.com/i-left-mastodon-yesterday-4c5796b0f548?ref=privacy.thenexus.today) and hoodieaidakitten's [Mastodon’s Complicated Relationship with Queer Activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=privacy.thenexus.today) have some additional discussion. The feature was eventually removed, and an improved implementation was released in 2019. - August 2018's [Battle of Wil Wheaton](https://www.theverge.com/2018/8/31/17801404/mastodon-harassment-wil-wheaton-mobs-twitter?ref=privacy.thenexus.today) highlighted the strength of Mastodon's LGBTQ+ community in responding to the arrival of a celebrity who had caused a lot of harm to trans people. workingdog\_'s Twitter thread provides [important context ommitted from most mainstream narratives](https://twitter.com/workingdog%5F/status/1035544368575401985?ref=privacy.thenexus.today). Wheaton left the platform as a result, and Rochko posted that he was [unhappy with how the situation was resolved](https://mastodon.social/@Gargron/100639540096793532?ref=thenexusofprivacy.net). As Nolan Lawson discusses in [Mastodon and the challenges of abuse in a federated system](https://nolanlawson.com/2018/08/31/mastodon-and-the-challenges-of-abuse-in-a-federated-system/?ref=privacy.thenexus.today), the Battle of Wil Wheaton certainly highlighted the need for improvement in Mastodon's moderation tools. Five years later, though, the moderation tools haven't improved significantly. - [Solstice School ](https://solsticeschool.scholar.social/?ref=thenexusofprivacy.net)is a free, online, interdisciplinary conference for the Fediverse, now in its fourth year, hosted by [Scholar Social](https://scholar.social/?ref=thenexusofprivacy.net). Past topics include spiders, frugal computing, Afro-Indigenous phenomenology, and data (im)permanence; [this year's topics](https://scholar.social/@SummerSchool?ref=thenexusofprivacy.net) look just as interesting. As far as I can tell, though, none of the articles about academics exploring Mastodon or the fediverse have ever mentioned it. - Volunteer moderators are the lifeblood of the fediverse – and a lot of them are queer, trans, and non-binary. Moderation is much more challenging in a decentralized environment, and Mastodon's moderation functionality is much weaker than is typically found on forums or Facebook, but thanks to the huge amount of effort by (and I cannot stress this enough) *unpaid volunteers,* some Mastodon sites are so well-moderated that people describe it as a significantly better environment than Twitter. On the other hand, moderators can also be the targets of abuse; in [Can Mastodon be a Twitter Refuge for Marginalized Groups](https://www.fastcompany.com/90817452/can-mastodon-be-a-twitter-refuge-for-marginalized-groups?ref=thenexusofprivacy.net), Marcia X describes the harassment campaign— including stalkers, bots, and denial of service attacks – that targeted playvicious.social, leading to the instance shutting down because “our safety was starting to become a real risk and also our mental health for that matter.” ## The fediverse is a lot bigger than just Mastodon! Even though Mastodon has gotten by far the most publicity, it's only one part of the fediverse – and there are plenty of other important queer, trans, and non-binary contributers in other branches as well. Here's just a few ... - [Daniel Supernault](https://pixelfed.social/dansup?ref=thenexusofprivacy.net), lead developer on Instagram alternative Pixelfed, one of the fediverse's most successful offerings, and also started the incredibly valuable [FediDB](https://fedidb.org/?ref=thenexusofprivacy.net) and [fediverse.info](https://fediverse.info/?ref=thenexusofprivacy.net) sites - [Kainoa](https://calckey.social/@kainoa?ref=thenexusofprivacy.net), lead developer on Calckey (a fork of Misskey), which has substantial additional functionality beyond Mastodon as well as a much more vibrant user interface - The developers of [GoToSocial](https://gotosocial.org/?ref=thenexusofprivacy.net) \-- a lightweight, customizable, and safety-focused entryway into the Fediverse. - [alyaza](https://beehaw.org/u/alyaza?ref=thenexusofprivacy.net), [Gaywallet](https://beehaw.org/u/gaywallet?ref=thenexusofprivacy.net) and the other moderators of beehaw.org, who are using Lemmy link-aggregation software to create [a community](https://beehaw.org/post/452132?ref=thenexusofprivacy.net) that "cultivates a sense of real belonging to something", aspires to "be(e) a safe, friendly and diverse place", and hosts [a very active LGBTQ+ community](https://beehaw.org/c/lgbtq%5Fplus?ref=thenexusofprivacy.net). Not only that, according to Christine Lemmer-Webber,[ four of the five authors of the ActivityPub standard – which plays a central role in the fediverse allowing communication between differnet software platforms – identify as queer](https://arstechnica.com/gadgets/2023/01/mastodon-highlights-pros-and-cons-of-moving-beyond-big-tech-gatekeepers/?ref=thenexusofprivacy.net). ## Looking forward ![ANTI-META FEDI PACT the following instance admins/mods have agreed to block the hell outta project92 ](https://thenexusofprivacy.net/content/images/2023/06/230622-fedipact.png) [https://fedipact.online/](https://fedipact.online/?ref=thenexusofprivacy.net), created by trans enby girl lesbian gender terrorist vantablack As always, it's interesting times in the fediverse. As Rochko said, it grows in waves. Millions of people created Mastodon accounts late last year in the wake of Twitter's acquisition by a transphobic, racist, techbro. Some of them liked it enough that they stayed around; quite a few of them are queer, trans, and non-binary – including [George Takei](https://universeodon.com/@georgetakei?ref=thenexusofprivacy.net), who with over 386,000 followers may well be the most-followed person in the fediverse! We're in the middle of another wave right now, [with fed-up redditors looking for alternatives](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/) in the wake of Reddit's decision to shutting down third-party apps and ham-fisted response to the protests checking out kbin (an interesting hybrid between Reddit and Twitter) and the aforementioned Lemmy – including people from big trans subreddits which are a critical source of support and knowledge for so many people. And we're going to continue to see new waves, because as always, queer, trans, and non-binary people are under siege on other social network. Twitter's now saying "cis is a slur" and threatening to turn off blocking functionality. Facebook's parent company Meta is introducing a Twitter competitor then again [Anti-Trans Hate Is Absolutely Rampant on Facebook](https://www.vice.com/en/article/dy33ww/facebook-anti-trans-harassment?ref=thenexusofprivacy.net), [Transgender Facebook is content dominated by right-wing sources](https://www.nbcnews.com/feature/nbc-out/transgender-facebook-content-dominated-right-wing-sources-study-finds-n1234252?ref=privacy.thenexus.today), and [Facebook and Instagram parent company Meta’s Nudity Policies Discriminate Against Trans People](https://gizmodo.com/meta-instagram-facebook-trans-moderation-1849994959?ref=thenexusofprivacy.net) (as they have for years) ... so people will keep looking for alternatives. Speaking of Meta's Twitter competitor, it's reportedly going to be compatible with Mastodon, which is another reason it's such interesting times in the fediverse. As Anti-Meta Fedi Pact creator vantablack says in [Why Block Meta?](https://fedipact.online/why?ref=thenexusofprivacy.net), > try being trans and on facebook, having a list of common suicide methods sent to you by a bigot, and reporting it. they'll do goddamn nothing. a real, personal, and depressingly common example [Opinions are mixed in the fediverse about how to react to Meta's potential arrival](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/), but it's not surprising a lot of trans, queer, and non-binary people don't want them here. Of course, we're not the only ones who doesn't want Meta here; hundreds of instances have already signed the [Anti-Meta Fedi Pact](https://fedipact.online/?ref=thenexusofprivacy.net) vantablack created just a week ago. That said, and even though opinions also differ within queer communities as to how best to respond, it's very much in keeping with the fediverse's history that many of the initial signers of the Anti-Meta Fedi Pact are from trans-, queer-, and LGBTQIA2S+-focused instances. In [FediPact is an Organized Effort to Block Meta’s ActivityPub Platform](https://wedistribute.org/2023/06/fedipact-blocking-meta/?ref=thenexusofprivacy.net) vantablack says > I will do everything I can to stop them from burning down the beautiful community we’ve spent over seven years cultivating here. And she's clearly not the only one who sees it that way. [We're here, we're queer, fuck Facebook (or whatever they're calling themselves these days)](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#were-here-were-queer) has more So we'll see where things go for the fediverse from here. [In chaos there is opportunity!](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#chaos) discusses a positive outcome, where resistance Meta's arrival catalyzes needed changes in the fediverse. If that happens, we may well see another burst of queer-led community innovation, this time more diverse in other dimensions as well. Perhaps the marginalized people who make key contributions will also get some recognition and more access to jobs and funding. Hey, it's Pride, might as well be optimistic. In any case, let's take a moment to appreciate how much of an impact queer, trans, and non-binary have had in creating the fediverse as it is today – and look forward to continuing to shape the future. Happy Pride! ## Notes 1 "Instances" is the term used for different sites that run Mastodon or compativle software. Danielle Navarro's [Everything I know about Mastodon](https://blog.djnavarro.net/posts/2022-11-03%5Fwhat-i-know-about-mastodon/?ref=thenexusofprivacy.net) is a detailed introduction to Mastodon; while aimed at data scientists, it's useful for everybody. 2 Both of the latest attempts to streamline onboarding result in new queer and trans people looking checking out Mastodon signing up by default on the flagship node mastodon.social instead of any of the many thriving LGBTQ+-focused instances. It's almost like they don't want queer and trans people to find their community! 3 Margaret KIBI's [Fringe Mastodev – Part III: Joining GlitchSoc](https://www.u2764.com/NFIC/2018-10-01/fringe-glitch/?ref=thenexusofprivacy.net), from 2018, has more. If you're thinking that mainline Mastodon's refusal to support this valuable anti-harassment functionality doesn't align with the stated values of being a platform with less harassment than Twitter ... you're not the only one. [Does Mastodon really prioritize stopping harassment?](https://thenexusofprivacy.net/mastodon-a-partial-history/#does-mastodon-really-prioritize-stopping-harassment) has several other examples. ### Should the Fediverse welcome its new surveillance-capitalism overlords? Opinions differ! (2026 UPDATE) URL: https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/ Last updated: 2026-08-18T17:44:55.000Z *Originally published June 22 2023, significantly revised July 7, remixed in December 2023 after Threads' launch, updated March 2024 after Threads officially launched their fediverse Beta, and again in December 2025 after Meta announced they were putting Threads Fediverse into maintenance mode (for now). See the* [*update log*](#update-log) *at the bottom for a revision history.* ## Exciting times in the Fediverse > "It’s been a wild week or so watching people who I thought hated centralized social networks *because of the harm they do* giddily celebrating the entry into the fediverse of a vast, surveillance-centric social media conglomerate credibly accused of enabling targeted persecution and mass murder." > > – Erin Kissane, [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net), December 2023 As always, it's been an exciting time in the interconnected web of decentralized social networks known as "[the Fediverse](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#termnology)" – and for Twitter competitors in general, as X (formerly Twitter) accelerates its transformation into a[ machine for fascism](https://www.emptywheel.net/2023/10/04/elon-musks-machine-for-fascism-a-tale-of-three-elections/?ref=thenexusofprivacy.net). I wrote the original version of this article in June/July 2023, when Facebook's parent company Meta launched Threads (previously codenamed "Project92" or P92) in June announced that it would integrate with Mastodon and other Fediverse software using the ActivityPub protocol [soon](https://techcrunch.com/2023/07/05/adam-mosseri-says-metas-threads-app-wont-have-activitypub-support-at-launch/?ref=thenexusofprivacy.net). I've updated it several times since the. In December 2025, I revised this section and added a [coda](#coda); the rest of the article was most recently revised in March 2024, when Threads officially entered beta with one-way communication to the Fediverse. Meta's June 2023 announcement was hailed as "[a clear victory for our cause](https://blog.joinmastodon.org/2023/07/what-to-know-about-threads/?ref=thenexusofprivacy.net)" by Mastodon's founder, CEO, and Benevolent Dictator for Life Eugen Rochko. Quite a few other fediverse influencers also expressed enthusiasm. But Meta's announcement also sparked fierce pushback, including hundreds of fedierse instances (aka servers) signing on to the [Anti-Meta FediPact](https://fedipact.online/?ref=thenexusofprivacy.net). Kissane's [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net) is a brilliantly-written overview of some of the pespectives on both sides. I've also covered a range of perspectives here in sections like [Why block Meta?](#why), [The case for "Trust but verify"](#trust-but-verify), [Wait a second. Why should anybody trust Facebook, Instagram, or Meta?](#wait-a-second), [Two views of the fediverse](#two-views), [We're here, we're queer, fuck Facebook (or whatever they're calling themselves these days)](#were-here-were-queer), [An important perspective, too rarely acknowledged in the fediverse](#an-important-perspective) and [A few words about digital colonialism](#digital-colonialism). Threads' initial reviews were tepid, and Meta revised its timeframe for fediverse integration to "[a long way out](https://mastodon.social/@alexeheath/110713788758597963?ref=thenexusofprivacy.net)". In December 2023, Threads posts by [Mark Zuckerberg](https://catvalente.substack.com/p/mark-fking-zuckerberg-is-not-your) and Instagram CEO Adam Mosseri announced the first step of what they described as a year-long "journey" to two-way communication between Threads and the Fediverse: a handful of Meta employees Threads' accounts would now federate and could be followed by people in the Fediverse. A handful of invitation-only "Fediverse Data Dialogue" meetings in December followed; [Johannes Ernst](https://reb00ted.org/tech/20231208-meta-threads-data-dialogue/?ref=thenexusofprivacy.net) and [Tom Coates](http://plasticbag.org/archives/2024/01/how-threads-will-integrate-with-the-fediverse/?ref=thenexusofprivacy.net) have summaries. [Embrace, Extend, and Exploit: Meta’s plan for ActivityPub, Mastodon and the Fediverse](https://thenexusofprivacy.net/embrace-extend-and-exploit/), first written in December 2023, looks at Meta's strategy and how it's played out over time. After adding a few fediverse influencers (including Ernst, Evan Promodrou, and Tim Chambers) to the list of Threads accounts that could federate, [Meta officially showed off Threads’ Fediverse integration for the very first time](https://www.theverge.com/24106231/threads-fediverse-demo-meta-fediforum?ref=thenexusofprivacy.net) at the FediForum unconference in mid-March 2023\. Meta Engineering's [Threads has entered the Fediverse](https://engineering.fb.com/2024/03/21/networking-traffic/threads-has-entered-the-fediverse/?ref=thenexusofprivacy.net) announced a beta release in four countries (with [quote boosts](https://thenexusofprivacy.net/black-twitter-quoting-and-white-toxicity-on-mastodon/)!), Mark Zuckerberg made his first federated post, and the [Threads supplemental privacy policy](https://help.instagram.com/515230437301944?ref=thenexusofprivacy.net) clarifying that Meta will potentially use content, profile information, and interactions they receive through federation "to provide, personalize, and improve Threads and other Meta Products" (presumably including using it training AI models) and "to provide measurement, analytics and other business services" (including ads). Tim Chambers' optimistic [Welcome to Day One of Threads and the Fediverse](https://www.timothychambers.net/2024/03/22/welcome-to-day.html?ref=thenexusofprivacy.net) describes it as "a part of Internet history" and notes that the sky did not fall. As of March 2024, anybody on Threads could opt-in to sharing with the Fediverse , and people in the Fediverse follow them and interact with their post – but the only communication in the other direction is when somebody in the Fediverse back to Meta is when somebody likes a post. Let's give credit where credit is due: Threads' opt-in approch to federation is much more consent-oriented and privacy-friendly than Mastodon's federate-by-default approach. That said, especially since Meta didn't promote "Threads Fediverse", it certainly discouraged broader adoption As Laurens Hof said in [Fediverse Report -#147](https://connectedplaces.online/reports/fediverse-report-147/?ref=thenexusofprivacy.net) (December 2025) > "Threads’ integration with the fediverse was never popular, especially from the side of Threads. In January 2025 the mastodon.social knew about 25k Threads accounts which had turned on federation. But while that number is already low considering the total number of Threads users, the interest in actually following an account on Mastodon from Threads was even lower: in January 2025, only 800 Threads users followed at least one account on mastodon.social. Threads deliberately made it difficult to follow fediverse accounts, and later updates deprioritised the fediverse feed even more." Over the next eighteen months, Meta proceeded very very slowly on its "journey" to two-way federation, getting a round of positive press coverage with each tiny incremental step. But the already slow pace of the updates got slower and slower. By December 2025, Threads new head Connor Hayes made it clear that fediverse integration was not a top priority for the current roadmap. In the original June/July 2023 version of the article, I suggested that the most likely outcome was a schism between anti-Meta "free fediverses" and "Meta's fediverse." [There are many fediverses](#many-fediverses) discusses why I thought it would be a good thing if it happened. Fediverse [polls](#polls) consistently show a lot of current users wanting nothing to do with Meta, and it's not just the FediPact signers who are blocking Meta: hundreds of other instances have blocked Meta without signing the FediPact. Jamie A. Theophilos's December 2024 [Closing the Door to Remain Open: The Politics of Openness and the Practices of Strategic Closure in the Fediverse](https://journals.sagepub.com/doi/full/10.1177/20563051241308323?ref=thenexusofprivacy.net) looks at the Free Fediverse as a "digital counterpublic." As things worked out, the schism didn't happen – or at least hasn't happened yet. More positively, as I predicted [in chaos there is opportunity](#chaos), and Meta's arrival did in fact catalyze some positive, badly-needed changes in the fediverses. This is a very long article, so feel free to skip around to the sections that interest you. **Contents:** - [Exciting times in the fediverse](#intro) - [Why block Meta?](#why) - [The case for "Trust but verify"](#trust-but-verify) - [Wait a second. Why should anybody trust Facebook, Instagram, or Meta?](#wait-a-second) - [Why the Anti-Meta Fedi Pact is good strategy for people who want the Fediverse to be an alternative to surveillance capitalism](#strategy) - [Two views of the Fediverse](#two-views) - [An interesting dynamic](#an-interesting-dynamic) - [We're here, we're queer, fuck Facebook (or whatever they're calling themselves these days)](#were-here-were-queer) - [An important perspective, too rarely acknowledged in the Fediverse](#an-important-perspective) - [A few words about digital colonialism](#digital-colonialism) - [What will instances do? Opinions differ!](#options) - [Speaking of polls ...](#polls) - [There are many fediverses -- and a lot of people will prefer them to Threads](#many-fediverses) - [In chaos there is opportunity!](#chaos) - [Coda: Looking back from late 2025](#coda) - [Terminology notes: LGBTQIA2S+](#lgbtqia2s) and defintions of "the Fediverse" - [Notes](#notes) (including some snark as well as lots of links) ## Why block Meta? ![WHY BLOCK META? tl;dr 1. they won't moderate effectively, there is precedent with facebook being a toxic cesspit of hate 2. they have a long track record of pure evil and we have no reason to give them the benefit of the doubt 3. to protect the existing communities of marginalized people on the fediverse, many of whom rely on it to survive](https://thenexusofprivacy.net/content/images/2023/06/Screen-Shot-2023-06-22-at-10.35.04-AM.png) From [https://fedipact.online/why](https://fedipact.online/why?ref=thenexusofprivacy.net) A lot of people are in the Fediverse looking for an alternative to surveillance capitalism companies like Facebook, Instagram, and Meta who make money by exploiting our data without consent. Also for some strange reason some people in the Fediverse see Facebook, Instagram, and Meta's track record as problematic. The "Incompatible Values" section of [Defederating P92](https://seirdy.one/posts/2023/06/20/defederating-p92/?ref=thenexusofprivacy.net), by Seirdy (Rohan Kumar), for example, starts by noting that > "Facebook has aided and abetted in genocide…more than once. [Myanmar and Ethiopia are the main examples](https://www.theguardian.com/technology/2021/oct/07/facebooks-role-in-myanmar-and-ethiopia-under-new-scrutiny?ref=thenexusofprivacy.net) I know of. After Myanmar, Facebook [repeated the same process in the Phillipines, fueling Duterte’s bloody drug war](https://www.buzzfeednews.com/article/daveyalba/facebook-philippines-dutertes-drug-war?ref=thenexusofprivacy.net) that claimed thousands of lives." Seirdy then goes on to highlight other cultural supremacy, transphobia, and privacy issues, including Facebook's complicity in allowing the rise of Hindu nationalism in India – which [they're still assisting](https://www.washingtonpost.com/world/2023/09/26/india-facebook-propaganda-hate-speech/?ref=thenexusofprivacy.net). Here in the US, Facebook worked with the Trump campaign (and data that [Facebook had shared with Cambridge Analytica without user consent](https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge%5FAnalytica%5Fdata%5Fscandal?ref=thenexusofprivacy.net)) to help him win the 2016 election, continues to sell discriminatory housing ads despite multiple settlements promising not to, allowed groups and pages to spread QAnon, antivax, and election denial conspiracy theories and planning, allows harassment of trans people and Muslims and Black women ... oh and let's not forget their famous [illegal, immoral, and mood-altering](https://medium.com/@JamesGrimmelmann/illegal-unethical-and-mood-altering-8b93af772688?ref=thenexusofprivacy.net) experiment manipulating users' emotions. I could go on, but you get the idea. And Meta's known for racist, anti-LGBTQIA2S+, and Islamophobic coontent moderation policies. That's especially concerning, since Alex Heath has reported that [posts Meta sends into the fediverse, **and** from the fediverse visible on Meta, will be subject to Meta's content moderation rules](https://mastodon.social/@alexeheath/110596226686316769?ref=thenexusofprivacy.net) \-- which, he thinks, "means those policies will have a sweeping impact on the fediverse." Not everybody sees this as a good thing. For example: > "I can't believe some people are seriously considering allowing #meta before they solve their spam, esp. nazi spam problem.... Let me remind you: You log on to tell your extended family good morning, and within the first few things on your home feed, someone has commented that some people in a marginalized group are not deserving of life or freedom." > > – IronWynch, [ion soc.irowyn.ch](https://soc.ironwyn.ch/@wynch/110614002732098055?ref=thenexusofprivacy.net) > "try being trans and on facebook, having a list of common suicide methods sent to you by a bigot, and reporting it. they'll do goddamn nothing. a real, personal, and depressingly common example" > > – Anti-Meta Fedi Pact creator vantablack in [Why Block Meta?](https://fedipact.online/why?ref=thenexusofprivacy.net) A lot of people have had really horrible experiences on Facebook, Instagram, and Meta – and don't like the idea of making it easier for that toxicity to infect the fediverse. And it's not just the toxicity. As joene [says](https://todon.nl/@joenepraat/110661775241957946?ref=thenexusofprivacy.net): > "#Meta's #Threads wanting to federate with the #fediverse (if that will ever happen 🤞) is a form of #gentrification. A large corporate shopping mall settles in a nice neighborhood with small local run shops and community centers. The new shopping mall says 'if we settle here, more people will come, and you all will benefit'. A few years later all small shops are bankrupt and the community is destroyed. What remains is a barren corporate landscape." Also what about Meta's business model of harvesting data without consent? > "[This guy sold our data, including private messages, to Cambridge Analytica](https://www.theguardian.com/technology/2019/jul/24/facebook-to-pay-5bn-fine-as-regulator-files-cambridge-analytica-complaint?ref=thenexusofprivacy.net) so that conservatives could lens their ads so finely, so individually, people were seeing and hearing exactly what they always wanted to, no matter what they’d always wanted to, with a kicky little Trump 2016 in the corner. [He did the same thing for Brexit.](https://www.politico.eu/article/cambridge-analytica-leave-eu-ukip-brexit-facebook/?ref=thenexusofprivacy.net)" > > – Catherynne M. Valente, [Mark F\*\*\*king Zuckerberg Is Not Your Friend](https://catvalente.substack.com/p/mark-fking-zuckerberg-is-not-your) > "Meta Threads has begun federating" is an anagram for "user meat feeding the beast"" > > – [Robert Gehl,](https://aoir.social/@rwg/111575437924437956?ref=thenexusofprivacy.net) As I discuss in [Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/), federating with Meta introduces new paths for data to flow to them without consent. Of course, there's very little privacy on the fediverse today ... but that's something we should be working on improving, not an argument for throwing in the towel and giving Meta non-consensual access to data they can't get at today. > "Meta’s business model centers on owning the dominant forums for online human connection in most of the world and using that dominant position to construct dense webs of data that clients at every level of society will pay a lot of money for so that they can efficiently target their ad/influence campaigns." > > Erin Kissane, [Untangling Threads](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net) So it's not surprising that hundreds of instances (sites running Mastodon or compatible software) quickly signed [the Anti-Meta Fedi Pact](https://fedipact.online/?ref=thenexusofprivacy.net), pledging to block the hell out of any of Meta's instances on the fediverse. With [Threads initially not launching in the EU because of privacy issues](https://techcrunch.com/2023/07/05/threads-no-eu-launch/?ref=thenexusofprivacy.net), and well-known anti-trans and racist accounts like Libs of TikTok and PragerU as enthusiastic early adopters, more and more instances who haven't signed the pact also blocked Meta (although some changed their mind once Threads was cleared to launch in the EU). [https://fedipact.veganism.social/](https://fedipact.veganism.social/?ref=thenexusofprivacy.net) is a good place to see who's doing what (although I'm not sure the last time it was updated) There's broad – although far from universal – support for instances' decisions to block Meta. In fact, polls show that a lot of people are ready to move, depending on what their instance does. [![Max Pearl: Curiosity about Threads by Meta - what should your instance do, and what would you do? Poll results: 44%: Pre-emptively Block - will move if not. 9%: Watch and wait, will move if not. 26%: Prefer Block, won't move. 20% Prefer wait, won't move.](https://thenexusofprivacy.net/content/images/2023/07/meta-poll-max-pearl.png)](https://social.overlappingmagisteria.org/@pearlbear/110653805957945898?ref=thenexusofprivacy.net) [Poll by Max Pearl,](https://social.overlappingmagisteria.org/@pearlbear/110653805957945898?ref=thenexusofprivacy.net) originally posted July 3, 2023 Of course, as I'll discuss in the [polling roundup below](#polls), polls in the Fediverse should be taken with several grains of salt. Still, it's interesting data, and yet one more sign that a lot of people reallllly don't want Meta in the Fediverse. ## The case for "trust but verify" ![Fifteenwhite guys in ties and jackets sitting around a large oval table, with coffeepots and manila folders. Reagan and Gorbachev sit on opposite sides, both flanked by advisers.](https://thenexusofprivacy.net/content/images/2023/06/President_Ronald_Reagan_and_Mikhail_Gorbachev_during_the_second_plenary_session-1.jpg) [Meta's Threads team' meeting with Mastodon Instance admins](#nda-meeting), June 2023\. Just kidding! It's actually the 1985 Geneva Summit meeting with Gorbachev where Reagan famously used the Russian proverb "[trust but verify](https://en.wikipedia.org/wiki/Trust,%5Fbut%5Fverify?ref=thenexusofprivacy.net)." > "This is a clear victory for our cause, hopefully one of many to come." > > – Rochko, in [What to know about Threads](https://blog.joinmastodon.org/2023/07/what-to-know-about-threads/?ref=thenexusofprivacy.net) Then again, opinions differ. It's certainly true that if you put aside concerns about Meta's untrustworthiness and exploitative behavior, there are potential upsides for Threads. For one thing, Meta's endorsement is likely to push adoption of the ActivityPub protocol, which many see as an important goal in its own right. Of course, this path has its perils. As Klaudia Zotzmann-Koch says in [Das Fediverse, Meta und das Toleranzparadoxon](https://www.viennawriter.net/blog/das-fediverse-meta-und-das-toleranzparadoxon/?ref=thenexusofprivacy.net) (also available in [English](https://www.viennawriter.net/blog/the-fediverse-meta-and-the-tolerance-paradox-en/?ref=thenexusofprivacy.net)), "Ein Schubs die Treppe runter ist auch ein Schub": a push down the stairs is also a push.[1](#notes) Miloš Jovanović similarly [cautions](https://social.coop/@loshmi/110594959406206542?ref=thenexusofprivacy.net) "Whoever thinks that we have somehow "won" by having them adopt #ActivityPub is deeply ignoring reality and history." Ploum 's [How to Kill a Decentralised Network (such as the Fediverse)](https://ploum.net/2023-06-23-how-to-kill-decentralised-networks.html?ref=thenexusofprivacy.net) discusses how the XMPP community has never recovered from Google's adoption of the protocol. Still, at least in the short term, Meta's adoption is likely to be good for ActivityPub and people whose careers and reputations revolve around it. And [Rod Hilton has confidently stated](https://indieweb.social/@rodhilton@mastodon.social/110613440891891711?ref=thenexusofprivacy.net) that "The notion that Meta is looking to embrace/extend/extinguish the fediverse is laughable,"[2](#notes) and Fosstodon admin Kev Quirk's's December followup [Threads and the Fediverse](https://kevquirk.com/threads-and-the-fediverse?ref=thenexusofprivacy.net) equally-confidently states "the argument that Threads joining the fediverse is bad for our privacy is bollocks." So if you're willing to take their word for it there's nothing to worry about on this front! [2.1](#fn-fosstodon) [Q](#fn-fosstodon)uirk's earlier [Facebook, Fosstodon & The Fediverse](https://hub.fosstodon.org/facebook-fosstodon-fedi?ref=thenexusofprivacy.net) sketches another possible upside: > What if this thing ends up being a service that can allow you to communicate with your friends who still use Facebook, via the Fedi, in a privacy respecting manor.... We all know Facebook is a [privacy vortex of doom](https://kevquirk.com/why-you-shouldnt-use-facebook?ref=thenexusofprivacy.net) so I doubt that would ever happen, but we shall see… I too doubt that would ever happen, but yes, in the very unlikely event that Meta decides to provide a privacy respecting way for people on the Fediverse to communicate with the friends on Facebook they want to communicate (and not to be exposed to the acquaintances and relatives on Facebook they *don't* want to communicate with) (and it doesn't expose people in the fediverse to the hate speech, disinfo, and harassment that Facebook's moderation allows) (or ads) (or lead to compromising the fediverse's independence) (or expose *other* people's data to Meta without their consent) (etc), that would be a good thing. We shall see. Depending on how many Meta users decide to opt-in explore the Fediverse more, there are several other potential upsides. - People on Mastdon instances can follow Threads accounts that have opted in (as long as their instances aren't blocked by Threads). - App vendors will have a much bigger market, and Meta may well release libraries making it easier to develop applications that work with Threads that become de facto standards that other platforms also support. - If people setting up accounts on a non-Meta Mastodon instance to go with their Threads account, or decide to host their own, that creates opportunities for instance admins and hosting companies. - Meta might well (at least initially) help instance admins who work with them scale and ensure that their users can fully enjoy Threads content – and present them with some win/win opportunities to monetize their user base. As Universeodon's instance admin said (in a now-deleted post) before reaching out to Meta, "if they do find success and make billions - why would some instances not want to carve out a piece of that to earn a living wage and run a legit business?" So it's not surprising that the admins running several of the larger Mastodon instances at least initially have came to the same conclusion Tim Chambers decided to take takeh indieweb.social: don't preemptively block Meta but instead "[stay vigilant with eyes wide open and a finger on the block button](https://indieweb.social/@tchambers/110568723404841278?ref=thenexusofprivacy.net)" – an approach I've seen described as "[Trust but Verify](https://indieweb.social/@tchambers/110560762611844481?ref=thenexusofprivacy.net)." ## Wait a second. Why should anybody trust Facebook, Instagram, or Meta? Good question. In reality, even the people advocating a "trust but verify" approach seem to agree that Facebook, Instagram, and Meta are untrustworthy. After all, it's objectively true! For one of many examples, look at Meta's history with their discriminatory housing ads. - [Pro Publica first reported that Facebook advertisers could run "whites only" ads in 2016](https://www.propublica.org/article/facebook-lets-advertisers-exclude-users-by-race?ref=privacy.thenexus.today), and Facebook promised to fix the problem. - In 2017[ Pro Publica tested again and reported that it wasn't fixed](https://www.propublica.org/article/facebook-advertising-discrimination-housing-race-sex-national-origin?ref=privacy.thenexus.today); Facebook once again promised to fix it. - In 2019 [Facebook settled with National Fair Housing Alliance, Communications Workers of America, and the American Civil Liberties Union](https://nationalfairhousing.org/facebook-settlement/?ref=thenexusofprivacy.net) and promised to fix the problem. - Later in 2019 [HUD sued Facebook over housing discrimination later that year,](https://www.propublica.org/article/hud-sues-facebook-housing-discrimination-advertising-algorithms?token=SNdMjVHydJaBRt8PvOspYpaTiMHV23MB&ref=privacy.thenexus.today) alleging the company's algorithms had made the situation even worse. [Facebook settled again in June 2022](https://abcnews.go.com/Technology/wireStory/facebook-us-make-deal-stop-discriminatory-housing-ads-85539416?ref=privacy.thenexus.today), and promised to fix the problem. Hey wait a second, I'm noticing a pattern here! So I have no idea how why people think "trust but verify" make sense ... but for a while it was.a popular talking point: in [Defederate Meta](https://www.cacherules.com/blog/2023/6/defederate-meta/?ref=thenexusofprivacy.net), fancysandwiches noted in June 2023, "I've seen this from at least [three](https://elk.zone/hachyderm.io/@quintessence/110461367732303169?ref=thenexusofprivacy.net) [different](https://akkoma.sandhill.social/objects/20f6e95e-1213-47dc-9ff2-19e1c2267e87?ref=thenexusofprivacy.net) admins." > Update: Meta supporters stopped using this framing after I and many others mocked it. Good call. Of course, it'spossible to work with companies you don't trust. Still, a strategy of trusting the company you don't trust until you actually catch them trying to screw you over is ... risky. There's a lot to be said for the approach scicomm.xyz describes as "prudently defensive" in [Meta on the Fediverse: to block or not to block?](https://about.scicomm.xyz/doku.php?id=blog:2023:0625%5Fmeta%5Fon%5Fthe%5Ffediverse%5Fto%5Fblock%5For%5Fnot%5Fto%5Fblock&ref=thenexusofprivacy.net): "block proactively and, if none of the anticipated problems materialise within time, consider removing the block." [Georg of lediver.se frames it similarly](https://lediver.se/@gcrkrause/110583628165089219?ref=thenexusofprivacy.net): > We will do the watch-and-see strategy on our instance in regards to #meta: block them, watch them, and if they behave (hahahahaha) we will see if we unblock them or not. No promise though ## Why the Anti-Meta Fedi Pact is good strategy for people who want the fediverse to be an alternative to surveillance capitalism ![vantablack@beach.city: now's the fucking time. to draw a line in the sand. Mar 12, 2023](https://thenexusofprivacy.net/content/images/2023/06/Screen-Shot-2023-06-20-at-12.15.51-AM.png) A post by #FediPact creator vantablack, not long after the first leaks about Meta's project were reported > "By supporting the fedipact we are signalling that we don't consent to interacting with a known abusive actor who revels in their power." > > – Esther Payne, in [Consent and the fediverse](https://onepict.com/consent-fediverse20230627.html?ref=thenexusofprivacy.net) > "If we let Facebook play in our pool, they'll eventually shit in it and monetize our outrage." > > – Alice, [on lgbtqia.space](https://lgbtqia.space/@alice/110573100917820119?ref=thenexusofprivacy.net) But why wait? There's a lot to be said for the approach of "block immediately if not sooner." Facebook, Instagram, and Meta's business model is to make money by exploiting people's data – their users, [and others as well](https://theconversation.com/shadow-profiles-facebook-knows-about-you-even-if-youre-not-on-facebook-94804?ref=thenexusofprivacy.net) – and amplifying right-wing propaganda, conspiracy theories, and disinformation. Even if they're being nice for the time being, it's only a matter of time until they show their true colors on the fediverse as well, and cause the same kind or problems they cause with all their other platforms. And should we really be letting them off the hook for all the harms they've caused *and are continuing to cause* just because it didn't happen on the fediverse? So if you look at it from the perspective of wanting to create a fediverse – or at least a region of the fediverse – that's free of surveillance capitalism, the #FediPact is a great strategy on many levels: - Most importantly, it counters the gaslighting that resistance is futile. The segment of the fediverse that wants to reject Meta is clearly large enough that it will survive no matter what the big Mastodon instances and pundits do. - It's a good first step in organizing a broad "Meta-free" zone in the fediverse. As Miloš Jovanović [says](https://social.coop/@loshmi/110594987100762434?ref=thenexusofprivacy.net), it's a "virtual picket" that can "stake a claim and build a common consciousness." - It puts instance admins considering collaborating with Meta on notice that they'll be held accountable when things go wrong – potentially leading them to rethink their stance of "trust but verify" and at least postpone the decision, even if they're not yet ready to commit to defederating. - It signals to Meta (and other surveillance capitalism companies who are watching what happens with Meta) that the potential costs for exploiting the fediverse may be higher than they originally anticipated. Of course, #FediPact also needs to be accompanied by other organizing tactics – and building the kind of "free fediverse" that addresses the problems that are endemic in today's fediverse. Still, you gotta start somewhere. And from the perspective of people who don't want to federate with Meta, it's one of several good places to start. And yet, I've seen multiple supporters of working with Meta dismiss the #FediPact as "performative." I agree in the sense that it's a performative speech act that alters reality (the #FediPact has *clearly* had am impact on the discussions so far) but I'm pretty sure that's not the sense they're using it it. ### It's not all-or-nothing One argument I've heard against the Anti-Meta Fedi Pact from several people is that unlike the situation with Gab (who [switched to using Mastodon’s code](http://blog.joinmastodon.org/2019/07/statement-on-gabs-fork-of-mastodon/?ref=thenexusofprivacy.net) in 2019 and was almost-immediately defederated by most non-Nazi fediverse instances), there isn't near-unanimous support for defederation of Meta. That's certainly true right now ... but then again there were several weeks of organizing before Gab launched to build consensus for what seemed like immediate action. So as more people and instances have time to discuss it, and as we learn more about the specifics of Meta's plans and there's more analysis of the risks, opposition to Meta might continue to grow – especially if a high-profile greedy, bullying , or untrustworthy moves by Meta and/or other ad-funded big tech social network causes people to reconsider their strategy. We shall see. 3 But even if the larger instances Meta is reportedly reaching out to decide to cast their lot untrustworthy surveillance capialists, so what? As vantablack says in [Why Block Meta?](https://fedipact.online/why?ref=thenexusofprivacy.net), "it's not black-and-white, win-or-lose. there's degrees of this shit." A critical mass of instances announcing up front that they're treating Meta as hostile is already a huge success. And as the discussions sparked by the Anti-Meta Fedi Pact go on, it wouldn't surprise me if more and more people and instances shift their position away from "trust but verify" ... which will also be a success even it's not everybody. **Update, July 14**: And sure enough, after quite a few articles about the launch mentioned the #FediPact and resistance in the fediverse – and a story by a #FediPact supporter about the privacy risks of federating with Mest spent an entire day on the front page of Hacker News – Meta went from originally saying they'd have ActivityPub integration "soon" (and featuring it in Threads' onboarding screens) to their new position that it's "[a long way out](https://mastodon.social/@alexeheath/110713788758597963?ref=thenexusofprivacy.net)." Of course there were other considerations as well, but still, count this as another huge success! ## Two views of the fediverse Others, however, see the situation differently. They don't actually disagree about Facebook, Instagram, and Meta's predatory surveillance capitalism business model differently, or their long record of contributing to genocide, human rights violations, helping authoritarians win elections, running discriminatory ads, amplifying disinformation, privacy abuses, experimenting on their users, and lying about it. There actually seems to be consensus on all of those. But even so, quite a few fediverse influencers disagree with the approach of blocking Meta. For example: - [Manton Reese](https://www.manton.org/2023/06/27/lets-welcome-meta.html?ref=thenexusofprivacy.net) says "Let’s welcome Meta, not block them." - [Dan York](https://mastodon.social/@danyork/110624263880355944?ref=thenexusofprivacy.net) also thinks "we should actually welcome them! Carefully and warily … but still welcoming!)" - [Dan Gillmor](https://mastodon.social/@dangillmor/110573391192806076?ref=thenexusofprivacy.net) suggests that "preemptively blocking them -- and the people already using them -- from your instance guarantees less relevance for the fediverse." - [Tristan Louis](https://mastodon.social/@TNLNYC/110576140169004056?ref=thenexusofprivacy.net) says "The anti-Meta #Fedipact can only achieve one thing: make sure that #ActivityPub loses to the Bluesky protocol."4 - [Chris Stefan](https://social.ridetrans.it/@cstefan206/110657410183575645?ref=thenexusofprivacy.net) opines "the #FediPact is seen as a handful of cranks in a corner." - [John Gruber](https://daringfireball.net/linked/2023/06/19/not-that-kind-of-open?ref=thenexusofprivacy.net) describes the Anti-Meta Pact as "petty and deliberately insular" and that any instance that blocks Meta will be an "[island of misfit loser zealots](https://misfitloserzealot.club/?ref=thenexusofprivacy.net)." In his view, the whole point of ActivityPub is to turn social networking into something more akin to email, which he hilariously describes as "truly open."[5](#fn-gruber) - [Chris Trottier](https://atomicpoet.org/notice/AWYZ1Mo6bA30MFSiES?ref=thenexusofprivacy.net) suggests that "if your community can’t survive Meta using ActivityPub, then it doesn’t deserve to exist" and [argues](https://atomicpoet.org/notice/AX9zOBSSW6gg06h9t2?ref=thenexusofprivacy.net) "if the goal is to fight against Meta’s hegemony, the most effective strategy may be to federate with them." Like I say, opinions differ. BTW in case you didn't notice these are all opinions from guys, and I'm pretty sure all of them are cis. One of the things that's going on here is a a tension between two different views of the fediverse. - For some of us, the Fediverse is an opportunity to build a space that's free of surveillance capitalism and all the exploitation, human rights violations , and discrimination that come with it. From this perspective, as vantablack says, "openness for the sake of openness is meaningless." - For others, the Fediverse is primarily about building a decentralized social network system based on an open protocol where anybody can talk to anybody else even if they're not on sites run by big tech companies. From this perspective, bigger is better: the more people in the network and broader adoption of ActivityPub is the priority. Meta getting on board is a good means to these ends, at least in the short term. Of course, these positions aren't absolute. "Bigger is better" advocates often include such as "as long as it doesn't compromise user safety" or "assuming moderation standards hold." Many people who want a space free of surveillance capitalism hope it grows over time (although as heat-shield.space's [The Two Camps of Mastodon](https://heat-shield.space/mastodon%5Ftwo%5Fcamps.html?ref=thenexusofprivacy.net) notes, many on Mastodon also value small communities). In some ways, as EFF's [The Fediverse Could Be Awesome (If We Don’t Screw It Up)](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=privacy.thenexus.today) highlights, these views are compatible. In other ways, though ... not so much.5.05 Evan Prodromou's December 2023 [Big Fedi, Small Fedi](https://evanp.me/2023/12/26/big-fedi-small-fedi/?ref=thenexusofprivacy.net) frames the two perspectives somewhat differently. As he says near the end of the essay, Prodromou's sees himself as "mostly a Big Fedi person." With his decades of experience on decentralized social networks, it's not surprising that he does an excellent job of presenting the "bigger is better" case. So it's especially worth reading, and thinking critically about, the list of ideas in the "Big Fedi" section of his essay. For example, the "Big Fedi" tenet that "The individual is central, and the account server is mostly a dumb pipe" (as opposed to a community with norms and boundaries run by admins and moderators who have useful tools to protect people on the instance from harassment and hate speech) is very much the Just Nodes view. That said, as [The (annotated) case for a “big fedi](https://thenexusofprivacy.net/the-annotated-case-for-a-big-fedi/) discusses, Prodromou mistakenly attributes some ideas to the "Big Fedi" camp that are in reality shared more broadly: > "Pretty much everybody largely agrees that it should be possible to have open source and ad-free instances; there should be a lot of different instances with different norms to choose from; that services like onboarding tools are useful; connections should be person-to-person; affinity groups should stretch beyond instance boundaries; there should be open-source implementations; existing organizations should be able to run their own instances; and the fediverse is going to look very different over time.. No arguments there." [The (annotated) case for a “big fedi”](https://thenexusofprivacy.net/the-annotated-case-for-a-big-fedi/) also discusses what Prodromou leaves unsaid. ## An interesting dynamic ... Yet another good reason to read [Big Fedi, Small Fedi](https://evanp.me/2023/12/26/big-fedi-small-fedi/?ref=thenexusofprivacy.net) and the [annotated version](https://thenexusofprivacy.net/should-the-fediverse-welcome-surveillance-capitalism/#big-fedi) is as a good example of an interesting dynamic that I've been talking about since the early versions of this post. People in the "bigger is better" camp seem to have a hard time accurately portraying the views of people who don't see it differently. Rochko, for example, has never as far as I know mentioned concerns about safety beyond assuring people that they can block Threads. A series of June/July posts by fediverse influencer Tim Chambers (who in addition to being instance admin or indieweb.org also helped create of spreadmastsodon.org, and in his day job at Dewey Digital publishes the [Twitter Migration Report](https://www.deweysquare.com/digital/twitter-migration-report/?ref=thenexusofprivacy.net)) provide other examples.5.1 And even in areas where concerns are being acknowledged, the responses don't really address them. For example, In [The Fediverse, Metapocalypse & Preemptive Bans](https://careylening.substack.com/p/the-fediverse-metapocalypse-and-preemptive), privacy expert Carey Lening says she's deeply sympathetic with people who have legitimate concerns that their communities will be negatively impacted by letting Facebook/Meta connect – but also says that "ensuring that only the right people join is, I suspect, a key driver for banning Meta." And Chambers dismisses concerns about the impacts of ineffective moderation by Threads by saying "we have all the tools we need for that now - as users & as admins and deal with exactly this from poorly moderated servers EVERY. SINGLE. DAY." Oh really? Have a look at [Mastodon and today’s Fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) and some of the examples of harassment, racism, and other moderation fails I list in the section on [In chaos there is opportunity!](#chaos) and see how effective the tools really are in practice today. And as CJ Bellwether [says](https://octodon.social/@siege/110668072301678301?ref=thenexusofprivacy.net): > "Admins federating with Threads, you are removing the safety barriers and it is going to destroy any community that exists within your realm where LGBTQ+ people just joke around and laugh and make friends and share their experiences. As soon as your users are aware they have an audience of 100M Threads users, many right wing or anti-trans who want to attack them for their existence, make them the target of the week, they will cease to be afforded that open experience." Similarly, if you look at the concerns others have cited about embrace-and-extend and data mining, opinions differ on how persuasive Chambers' responses are.[5.2](#fn-EEE) I certainly don't mean to single out Lening and Chambers here. When discussions about Threads first flared up, they both spent lot more time than most other pro-Meta advocates engaging with people on the other side of the issue. Lening cited this post, and Chambers gave me helpful feedback on this section that led to improving it significantly. They're discussed here primarily because when I first wrote this section, they were the the two well-thought-out articulations of the "bigger is better" positions I could find. By contrast, some of the other most-visible "bigger is better" advocates haven't put much effort at all into understanding objections. By contrast, Trottier (who at the time was the instance admin for the now-defung firefish.social, launching the SpaceHost hosting service,and developing the Great Ape app) blocked me after a [discussion](https://indieweb.social/@jdp23/110523181894567827?ref=thenexusofprivacy.net) where I shared some [links about Facebook's history of digital colonialism](https://indieweb.social/@jdp23/110522771136744833?ref=thenexusofprivacy.net). And let's be blunt: some of the loudest voices for working with Meta as long as it doesn't compromise user safety don't actually have a good track record of prioritizing user safety. [Does Mastodon really prioritize stopping harassment?](https://thenexusofprivacy.net/mastodon-a-partial-history/#does-mastodon-really-prioritize-stopping-harassment) , for example, discusses Rochko's history of tradeoffs with the Mastodon code base.[6](#fn-safety) Rochko also runs the mastodon.social instance, which has a long history of bad moderation. Not only that, ActivityPub, the underlying standard the entire fediverse runs on, also compromises user safety. Ariadne Conill, for example, notes that [the ActivityPub protocol "utterly fails to guarantee basic trust and safety properties expected from a commercial social networking service.](https://social.treehouse.systems/@ariadne/110569050721727190?ref=thenexusofprivacy.net)"7 Of course, protocol weaknesses can be improved over time, and people like ActivityPub spec co-authors Christine Lemmer-Webber and Erin Shephard have consistently pushed for stronger protections, as has Conill. Other ActivityPub boosters, however, haven't; and the protocol hasn't advanced on this front in the five years since it was first improved. So they too have a track record of not priortizing user safety. So as good "bigger is better as long as ..." might sounds in theory, in this situation there's a lot of very justifiable skepticism that it's anything more than a talking point. ## We're here, we're queer, fuck Facebook (or whatever they're calling themselves these days) ![A Black person, speaking into a mic, wearing a T-shirt saying "Black names matter" and holding sign saying "Facebook: stop badering people for ID. My name is as real as yours". In the background, drag queens dressed as nuns, and other protestors, some also holding signs](https://thenexusofprivacy.net/content/images/2023/06/fb-real-names-protest.webp) Protestors, including the Sisters of Perpetual Indulgence, at Facebook's headquarters, 2015\. Photo: [Gareth Gooch](https://www.theguardian.com/commentisfree/2015/jun/03/facebook-real-name-policy-hurts-people-creates-new-digital-divide?ref=thenexusofprivacy.net) > "Trans people talk and post here openly about their lives from a position that has never existed on social media before. We talk openly with cis people reading our posts and replying, friendships, understanding, experience, normalisation. > > Every other social network this is impossible because the continual existence of anti-trans agitators is implicit." > > – CJ Bellwether, on octodon.social > "Meta and co have been terrible for queer people and now that we finally have our own space to be ourselves, they try to force themselves into our lives again for a profit! We all know that we will only suffer as a result of this." > > – Alexis, on alexisart.me As [A (partial) queer, trans, and non-binary history of Mastodon and the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net) describes, queer, trans, and non-binary people have played a huge role in building Mastodon and the fediverse. So it's worth highlighting how many of the initial Anti-Meta Fedi Pact signers are from trans-, queer-, and LGBTQIA2S+-focused instances. And why might that be? For one thing, Threads hasn't banned Libs of Tik Tok, Gays against Groomers, and other anti-LGBTQIA2S+ hate groups. As Kissane [notes](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net), these groups have "refined earlier internet mob justice episodes into a sustainable business model." > "Libs of Tiktok named and targeted [*two hundred and twenty-two* individual employees of schools or education organizations](https://www.mediamatters.org/libs-tiktok/timeline-impact-libs-tiktok-told-through-educators-health-care-providers-librarians?ref=thenexusofprivacy.net) in just the first four months of 2022." And it's not just Threads current bad behavior. Facebook, Instagram, and Meta have a loooooong history here. A few links: - [Facebook’s Discrimination Against the LGBT Community](https://www.aclu.org/news/lgbtq-rights/facebooks-discrimination-against-the-lgbt-community?ref=thenexusofprivacy.net) - [Facebook is making millions off Matt Walsh’s transphobic documentary](https://xtramagazine.com/power/facebook-meta-profiting-off-transphobic-documentary-237936?ref=thenexusofprivacy.net) - [Transgender Facebook content dominated by right-wing sources](https://www.nbcnews.com/feature/nbc-out/transgender-facebook-content-dominated-right-wing-sources-study-finds-n1234252?ref=thenexusofprivacy.net) - [‘I’m Scared for My Followers’: Anti-Trans Hate Is Absolutely Rampant on Facebook](https://www.vice.com/en/article/dy33ww/facebook-anti-trans-harassment?ref=thenexusofprivacy.net) - [Facebook’s ‘real name’ policy hurts real people and creates a new digital divide](http://www.theguardian.com/commentisfree/2015/jun/03/facebook-real-name-policy-hurts-people-creates-new-digital-divide?ref=thenexusofprivacy.net) - [Meta’s Nudity Policies Discriminate Against Trans People](https://gizmodo.com/meta-instagram-facebook-trans-moderation-1849994959?ref=thenexusofprivacy.net), talking about both Facebook and Instagram Hey, wait a second, I'm noticing another pattern here! Of course, just like any other issue, there's a range of opinion in LGBTQIA2S+ communities on what the right approach is to take with Meta. My guess is that former Facebook board member Peter Thiel, for example, isn't likely to support an anti-Meta pact (in fact he probably thinks that defederating Gab was a mistake). And more generally, LGBTQIA2S+ employees of Meta and other surveillance capitalism companies, are likely to have different perspectives than LGBTQIA2S+ who don't have ties to big tech. Hopefully LGBTQIA2S+ people and allies advocating for "trust but verify" or other approach involving engaging with Meta take the strong dissenting perspectives into account. It's a great opportunity to show solidarity. One good starting point is to complement sharing your own opinion with taking the time to listen to, understand, and fairly represent the more marginalized voices who are a lot less likely to be heard – and engage with their criticisms instead of dismissing them. This is especially important for instance admins who want their instances to be seen as LGBTQIA2S+-friendly, employees of surveillance capitalism companies, and cis and/or straight allies with influence in the fediverse. And allies at surveillance capitalism companies, or instance admins who are allies and have queer and trans moderators, please please please avoid the temptation to rely on your LGBTQIA2S+ colleagues to do the all work or ask them to speak for their entire communities! **Updated, December 23**: multiple trans people have reported that [Threads is showing them transphobic content in their "For You" feed](https://neuromatch.social/@jonny/111633121548703898?ref=thenexusofprivacy.net). Who could have predicted? OK, everybody, including me, but other than that, who, who could have predicted? ### It is anti-queer and transphobic to ignore the number of trans and queer-led instances and LGBTQIA2S+ people who oppose federating with Threads – or dismiss LGBTQIA2S+ concerns as "overreacting" [![A post by fedipact.online: me, vanta, trans enby girl polyam lesbian gender terrorist: "people should block threads because it will make fedi unsafe for queer people." the verge, for some reason: "OBVIOUSLY it's a bunch of NERD BOYS trying to keep the WOMEN out"](https://thenexusofprivacy.net/content/images/2023/12/Screenshot-2023-12-23-at-12.28.38-AM.png)](https://indieweb.social/@FediPact@tech.lgbt/111581413144250525?ref=thenexusofprivacy.net) [Queer and trans people built the fediverse](https://wedistribute.org/2023/06/a-partial-queer-trans-and-non-binary-history-of-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net) and many of us have strong opinions on Meta. Of course, no community is monolithic, and there are a range of opinions about how to react to Meta ... but still: - the FediPact was started by a trans enby lesbian gender terrorist - almost none of the largest LGBTQIA2S+- focused instances are planning federating with Threads – and many have signed the Fedipact But you wouldn't know that from the media coverage – or from anything that many of the fediverse influencers who support federating with Threads are saying*.* Erasing trans and queer perspectives is intellectually dishonest, anti-queer, and transphobic. And speaking of intellectually dishonest, anti-queer, and transphobic ... it would be really great if cis people stopped describing LGBTQIA2S+ concerns about hate groups on Threads as "overreacting," or "hysteria". Kissane discussion in [Attack Vectors (open)](https://erinkissane.com/untangling-threads?ref=thenexusofprivacy.net#attack-vectors-open) notes that these hate groups have "refined earlier internet mob justice episodes into a sustainable business model", including one that "named and targeted *two hundred and twenty-two* individual employees of schools or education organizations in just the first four months of 2022\. Perhaps there are ways to mitigate the threat, but the concerns are valid – *not* overreacting, *not* hysteria. As Kissane says > "I’d take assertions that people who don’t want to federate with Threads are all irrational losers as useful revelations about the character of the people making them." ## An important perspective, too rarely acknowledged in the fediverse > "\[I\]t is also the case that whiteness is a large problem within the LGBTQ community. Being queer does not insulate one cell from the inheritance of whiteness, although one can use one’s queerness as a shield from critique, as many Mastodonians have used by presenting the history of Mastodon as grounded in queer folks attempts to avoid the harassment on Twitter." > > – Dr. Johnathan Flowers, in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) > "\[A\]lmost all the [Twitter alternatives](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) that have launched are facing accusations of not being friendly to Black folks, other people of color, the LGBTQ communities, and sex workers—just to name several people in society who are fast losing rights, safety, justice, and voice. While much has been made of federation and the fediverse and Mastodon, at the end of the day many from marginalized communities have not found these spaces to be hospitable to them.... > > Which is why the entry of Meta (as the company once known simply as Facebook is now called) into Twitter-like territory with the unveiling this past week of Threads is interesting." > > – Shay Stewart-Bouley, in [The whitening of social media](https://blackgirlinmaine.com/current-events/the-whitening-of-social-media/?ref=thenexusofprivacy.net) Then again, it's just as true that people advocating blocking Meta don't always understand and acknowledges the perspectives of people on the other side. In particular, as Dr. Jonathan Flowers discusses in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), Mastodon has a long history of racism. Dr. Flowers' outstanding article has plenty of examples; [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) has several more examples from Mastodon's earliest days, and [the replies in Creatrix Tiara's 2022 thread](https://vulpine.club/@creatrixtiara/109310828652037900?ref=privacy.thenexus.today) highlight how these same issues continue. As I discuss a bit more below, Mastodon's reputation for racism is toxic in many Black communities – and extends to the broader fediverse. Of course, Facebook, Instagram, Meta, and pretty much every other social network also have a long history of racism too – [Why Facebook failed its civil rights audit](https://www.vox.com/recode/2020/7/9/21318896/facebook-civil-rights-audit-hate-speech-failed-zuckerberg-white-nationalism-sheryl-sandberg?ref=thenexusofprivacy.net), and [Facebook management ignored internal research showing racial bias, current and former employees say](https://www.nbcnews.com/tech/tech-news/facebook-management-ignored-internal-research-showing-racial-bias-current-former-n1234746?ref=thenexusofprivacy.net) are two good examples. But that doesn't get the fediverse off the hook! And despite their problems, Facebook and Instagram are a *lot* more racially diverse than the fediverse today. As [We're here, we're queer, fuck Facebook](https://thenexusofprivacy.net/p/bda1008d-5142-484c-9f28-c4dc3cd9d5e6/#were-here-were-queer) discussed, many LGBTQIA2S+ people have found a home in the fediverse where they feel much safer and for the first time don't have to deal with the routine micro-aggressions and frequent harassment on other social networks. That's great! But that's not at all the case for many Black and Indigenous people of color in the fediverse. Until that changes, and until the culture changes significantly, many Black people are likely to find much more community and support from their friends and relatives on Threads than they do in the fediverse. I rarely if ever hear advocates of blocking Meta acknowledge these these perspectives.8 To be clear, Black and Indigenous communities aren't monolithic; just as with LGBTQIA2S+ communities, there's a range of opinions on Meta. And Black and Indigenous LGBTQIA2S+ people exist and have their own uniquely intersectional experiences. As always, opinions differ! So, if you're a white person who wants to be an ally or accomplice, the advice I gave above for cis and straight allies applies just as well here: > One good starting point is to complement sharing your own opinion with taking the time to listen to, understand, and fairly represent the more marginalized voices who are a lot less likely to be heard – and engage with their criticisms instead of dismissing them. If you're interested in hearing more of these perspectives on this and other topics, check out hashtags like [#BlackMastodon](https://dair-community.social/tags/BlackMastodon?ref=thenexusofprivacy.net) and [#Indigedon](https://dair-community.social/tags/Indigedon?ref=thenexusofprivacy.net) – and remember that [a lot of fediverse software (including Mastodon) allows you to follow hashtags](https://fedi.tips/how-do-i-follow-hashtags-on-mastodon-and-the-fediverse/?ref=thenexusofprivacy.net). ### A quick note on gatekeeping It's also worth highlighting that the sneering attitudes I hear some people expressing about Instagram users are very reminiscent of the sneering attitudes they express about Twitter users. Mastodon has a reputation for gatekeeping, and while some of the aspects of "old fedi" culture are well worth keeping, even those often get expressed in unhelpful ways. And other aspects of old fedi culture that long predate Mastodon, like "it's good that it's hard because it keeps stupid people out," are most definitely *not* worth keeping. When those attitudes get coupled with dismissing everybody on Instagram (or Twitter) as stupid or clout chasers ... that's not helpful. Worse, it's often expressed in racialized terms, which makes it doubly-unhelpful. So please don't do that. ## A few words about digital colonialism [Digital Colnialism - a talk by Michael Kwet](https://www.youtube.com/watch?v=9YsA%5FIOyLLA&ref=thenexusofprivacy.net) > "Big Tech corporations are wreaking havoc on the Global South. There’s a crisis in the tech ecosystem, and it’s called [digital colonialism](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=3232297&ref=thenexusofprivacy.net)." > > – [Digital colonialism is threatening the Global South](https://www.aljazeera.com/opinions/2019/3/13/digital-colonialism-is-threatening-the-global-south?ref=thenexusofprivacy.net), Michael Kwet > "Anti-colonialism has been economically catastrophic for the Indian people for decades. Why stop now." > > – Meta Board Member Marc Andreessen, [in 2016](https://www.vox.com/2016/2/11/10969300/marc-andreessen-colonialism-facebook?ref=thenexusofprivacy.net). He apologized, but Facebook still went ahead with the "Free Basics" program he was defending. [Free Basics led to a significant increase in hate speech on the path to the genocide in Myanmar.](https://www.abc.net.au/religion/facebook-complicity-in-the-rohingya-genocide/13737882?ref=thenexusofprivacy.net) > "*Instead of heeding the warnings that continued to pour in from Myanmar, Meta doubled down on connectivity—and rolled out a program that razed Myanmar’s online news ecosystem and replaced it with inflammatory clickbait. What happened after that was the worst thing that people can do to one another."* > > – Erin Kissane, [Meta in Myanmar](https://erinkissane.com/meta-in-myanmar-full-series?ref=thenexusofprivacy.net) Also worth highlighting is a point that Seirdy touched on and highlight that the importance of including the perspectives of current and future fediverse members from regions, nations, and communities who are targeted by Facebook's digital colonialism over the years. If you're not familiar with the term digital colonialism, here's a few links - Toussaint Nothias' [How to Fight Digital Colonialism](https://www.bostonreview.net/articles/how-to-fight-digital-colonialism/?ref=thenexusofprivacy.net) - Olivia Solon: [‘It’s digital colonialism’: how Facebook’s free internet service has failed its users](http://www.theguardian.com/technology/2017/jul/27/facebook-free-basics-developing-markets?ref=thenexusofprivacy.net) - Kate Begley's [Digital Colonialism: Facebook in Eastern Africa](https://www.thelondonfinancial.com/scitech/digital-colonialism-facebook-in-eastern-africa?ref=thenexusofprivacy.net) - Satyajeet Malik's [How Meta aims to dominate India’s agriculture sector](https://netzpolitik.org/2022/series-on-digital-colonialism-how-meta-aims-to-dominate-indias-agriculture-sector/?ref=thenexusofprivacy.net) - Adrienne LaFrance's [Facebook and the New Colonialism](https://www.theatlantic.com/technology/archive/2016/02/facebook-and-the-new-colonialism/462393/?ref=thenexusofprivacy.net) - Micahel Kwet's [Digital colonialism: The evolution of US empire](https://longreads.tni.org/digital-colonialism-the-evolution-of-us-empire?ref=thenexusofprivacy.net) - Mijente's outstanding [Tech Wars](https://instituto.mijente.net/courses/tech-wars/?ref=thenexusofprivacy.net) course. The fediverse has people in it from all over the world ... but all the big fediverse instances are currently hosted in the US, Europe, or Japan. And there are plenty of native and Indigenous people in the fediverse, with lively discussions on several hashtags ... but few if any are in positions of power. The same dynamics are true in the standards group that's responsible for ActivityPub. So this is another area where it's vital for allies to understand and amplify views that otherwise won't get heard – and even more importantly, make sure people who are usually excluded are at the table for discussions going forward. ## What will instances do? Opinions differ! Threads' initial plans for fediverse integration sparked a lot of discussion about how instances should respond to Meta, some of it very highly charged.[9](#nda-meeting) Once Threads actually turned on federation in December, another wave ensued, and instances who had (not unreasonably) deferred their decision until more details were available had to make a decision. [https://fedipact.veganism.social/](https://fedipact.veganism.social/?ref=thenexusofprivacy.net) has a list of instances' positions, and the Free Fediverse wiki has a[ (partial) list of announcements](https://freefediverse.org/index.php/Announcements?ref=thenexusofprivacy.net) by instances who are blocking. Announcements in June-July 2023 primarily fall into three camps: - Not preemptively blocking, although open reconsidering when there are problems. hachyderm's [A Minute from the Moderators](https://community.hachyderm.io/blog/2023/07/07/a-minute-from-the-moderators/?ref=thenexusofprivacy.net) in June had a detailed list of criteria. Other examples include [CoSocial Board Decision on Threads](https://cosocial.info/cosocial-board-decision-on-threads/?ref=thenexusofprivacy.net) and Tim Chambers' [Instagram Threads and the Fediverse](https://www.timothychambers.net/2023/07/03/instagram-threads-and.html?ref=thenexusofprivacy.net) (announcing indieweb.social's position), and Fosstodon admin Kev Quirk's [Threads and the Fediverse](https://kevquirk.com/threads-and-the-fediverse?ref=thenexusofprivacy.net). Note that some of these positions changed over time; Hachyderm's mid-December 2032 [Threads Update](https://community.hachyderm.io/blog/2023/12/23/threads-update/?ref=thenexusofprivacy.net) confirmed that Threads was not yet violating any of the criteria, but their January 2025 [Defederation from Threads](https://community.hachyderm.io/blog/2025/01/09/defederation-from-threads/?ref=thenexusofprivacy.net) cited chages to Threads' moderation policies and published statements by Zuckerberg as reasons to defederate. - Preeemptively blocking for now, although potentially reconsidering in the future. mastodon.art's [On Meta, Insta, etc. coming to the Fediverse](https://dotart.blog/dotart-blog/on-meta-insta-etc?ref=thenexusofprivacy.net) (May 23, which is I believe means it was the first blog post announcing an instance's position on Meta), [Trumpet's June 26 toot](https://mas.to/@trumpet/110613035924457237?ref=thenexusofprivacy.net)10 about mas.to's position, and [Stux' July 5 toot](https://mstdn.social/@stux/110662586982485968?ref=thenexusofprivacy.net) about mstdn.io's position are examples. (Stux wound up unblocking Threads after they launched in the EU in mid-December, resolving his major concerns, but then [blocked Threads again in early 2025](https://mstdn.social/@stux/113793895110300721?ref=thenexusofprivacy.net) after Meta changed their moderation policies to allow anti-trans hate.) - Blocking and not planning on reconsidering. This includes #FediPact signers as well as other instances. Victor Wynne's [Regarding Threads](https://victorwynne.com/threads/?ref=thenexusofprivacy.net) (July 4), announcing that "Tooters **will not** become federated with Threads, nor any other potential future Meta properties," is a good example. Some instances are taking more complex positions. Jerry Bell's [Threads and Infosec.Exchange](https://blog.infosec.exchange/2023/12/27/threads-and-infosec-exchange/?ref=thenexusofprivacy.net), for example, describes a multi-step plan including initially limiting Threads on infosec.exchange, starting up a new instance that blocks threads, giving people time to either move to the new instance or block Threads as individuals if they want, and after 60 days removing the limit on Threads. For a site like infosec.exchange that hosts a wide variety of security professionals (including some who work for or with surveillance capitalism companies) [this seems like a very reasonable plan to me](https://infosec.exchange/@thenexusofprivacy/111659467188933303?ref=thenexusofprivacy.net), and I plan to keep The Nexus of Privacy's account on infosec.exchange active – while complementing it with another account on an instance that *does* block Threads. InformaPirata [describes](https://lemmy.blahaj.zone/comment/6811033?ref=thenexusofprivacy.net) another situation involving groups of instances with different stances: > "We have made an internal evaluation on the opportunity to federate Threads with our instances: mastodon [poliversity.it](http://poliversity.it/?ref=thenexusofprivacy.net) instance we decided to silence Threads; with the Friendica [poliverso.org](http://poliverso.org/?ref=thenexusofprivacy.net) instance we used the newly introduced functionality to obfuscate all the personal data of our users towards Threads; with the Lemmy [feddit.it](http://feddit.it/?ref=thenexusofprivacy.net) instance, however, we decided to leave the federation to try to allow Italian Threads users ([feddit.it](http://feddit.it/?ref=thenexusofprivacy.net) is an Italian-speaking instance) to use activitypub groups and discover the “free Fediverse”" [![Has your instance admin asked your community whether or not you want your server to fediblock #Meta? Has your instance admin told you if the server will be federating or not? 1% They asked, and have told us 2% They asked, but haven't told us 7% They haven't asked, but told us 61% They haven't asked and haven't told us 30% I'm an admin/show results](https://thenexusofprivacy.net/content/images/2023/06/230612-smalllpatatas-poll.png)](https://indieweb.social/@smallpatatas@mstdn.patatas.ca/110533043913427118?ref=thenexusofprivacy.net) A Mastodon [poll](https://indieweb.social/@smallpatatas@mstdn.patatas.ca/110533043913427118?ref=thenexusofprivacy.net) by small patatas, June 12-15 (before the FediPact). At the time, very few respondents reported being asked or told their instance's position on blocking Meta. Some instance admins, very much to their credit, have made an effort to get input from people on their instance before making a decision. Wynne, for example, sent out an email blast to tooters.org members, and followed up with a [thread](https://tooters.org/@victor/110622310857450466?ref=thenexusofprivacy.net) updating the community on the initial results; cosocial.com started up a discussion [on a hashtag](https://cosocial.ca/tags/CoSocialMeta?ref=thenexusofprivacy.net)[ ](https://www.tbray.org/ongoing/When/202x/2023/06/24/Fediverse-Governance?ref=thenexusofprivacy.net)before the board vote; Bell followed an initial local-only poll with multiple discussion threads. Here are some other good examples of admins getting input: - social.coop's [Discussion: Support the Anti-Meta Fedi Pact](https://www.loomio.com/d/AZcJK6y2/proposal-to-support-the-anti-meta-fedi-pact/?ref=thenexusofprivacy.net), using loomio (open-source software for group decision-making). - Politica ConCiencia's [thread](https://social.politicaconciencia.org/@PoliticaConC/110583536969111928?ref=thenexusofprivacy.net) with a statement and invitation to the [social.politicaconciencia.org](https://social.politicaconciencia.org/?ref=thenexusofprivacy.net) community – and the broader fediverse – to share their opinions, followed by the outstanding [#TertuliaExtraordinaria discussion](https://social.politicaconciencia.org/@Maya/110605928128040069?ref=thenexusofprivacy.net), (also [available as a single document here](https://politicaconciencia.astrosmxsftp.org/tertulia-extraordinaria-meta-en-el-fedi/?ref=thenexusofprivacy.net)). - Master Control Program's initial [statement](https://indieweb.social/@mcp@lgbtqia.space/110571863566017251?ref=thenexusofprivacy.net) that [lgbtqia.space](https://lgbtqia.space/explore?ref=thenexusofprivacy.net) is postponing a decision, framing the questions they're thinking about, and letting their community know their input is valued. - mastodon.green admin Johan Empa's [poll](https://mastodon.green/@JohanEmpa/110604299644995397?ref=thenexusofprivacy.net) and follow-up [draft statement](https://community.mastodon.green/draft-statement-on-big-tech/?ref=thenexusofprivacy.net), grounding the decision in the instances' mission. - sh.itjust.works (a Lemmy instance) had separate [discussion](https://sh.itjust.works/post/11011288?ref=thenexusofprivacy.net) and [voting](https://sh.itjust.works/post/11308397?ref=thenexusofprivacy.net) threads. ## Speaking of polls ... There were a lot of polls about Meta and Threads in the fediverse back in May and June. Of course, polls on the fediverse aren't any more reliable than polls on Twitter or other social networks, so should be taken with several grains of salt. Still, it's interesting data. Depending on how the question is framed, some fediverse polls show overwhelming opposition to Meta. In [my May 28 poll](https://indieweb.social/@jdp23/110449505980762006?ref=thenexusofprivacy.net), with a very leading question analogizing Meta to Gab, 97% supported blocking. And here's [another similarly-lopsided poll](https://cutie.city/@nuz/110619658603991448?ref=thenexusofprivacy.net), in response to Universeodon's admin (a strong proponent of working with Meta) saying he had deleted his contributions to Mastodon's issues list on github because of snark from "[people that looked like cats, princesses, and video game characters](https://web.archive.org/web/20230628023438/https://universeodon.com/@supernovae/110618947453739861)," and by contrast "talking with meta was fresh air because i was talking with engineers that had a common goal." ![fedi drama shitpoll: which team would win in a cage match?? Poll results: 96%: cats, princesses, and video game characters. 4%: fedi admins and facebook engineers with a common goal.](https://thenexusofprivacy.net/content/images/2023/07/meta-cats-and-princesses-poll.png) [Poll by nutzalgia](https://cutie.city/@nuz/110619658603991448?ref=thenexusofprivacy.net), originally posted June 27 I know who I'm betting on! Other, more neutrally worded polls, show strong but far for universal support for preemptively blocking (at least from accounts who see and respond to polls about Meta, which may or may not be representative of broader opinions).11 - [Jens Finkhäuser's May 22 poll](https://social.finkhaeuser.de/@jens/110416635483023054?ref=thenexusofprivacy.net): 44% of the responses expressing an opinion wanted Meta preemptively blocked - [James Dreben's May 24 poll](https://mastodon.world/@Jdreben/110426756399248557?ref=thenexusofprivacy.net): 64% wanted Meta to be blocked on their instance. - [Tokyo Outsider's June 25 poll](https://mas.to/@tokyo%5F0/110605522116606476?ref=thenexusofprivacy.net): 68% said they'd move instances to be on one that didn't federate with Meta. - [Volker Weber's June 28 poll](https://social.heise.de/@vowe/110623997627351369?ref=thenexusofprivacy.net): 43% will move to an instance that excludes Meta. - [Stux' June 28 poll:](https://mstdn.social/@stux/110622583732793662?ref=thenexusofprivacy.net) 63% wanted Meta blocked. With over 8000 responses, this has the broadest participation of any of the polls. - [Max Pearl's July 3 poll](https://social.overlappingmagisteria.org/@pearlbear/110653805957945898?ref=thenexusofprivacy.net): 70% wanted their instance to block – and 44% say they'll move instances if their current instance doesn't block - [mcc's July 5 poll](https://mastodon.social/@mcc/110663712542031369?ref=thenexusofprivacy.net): 36% are opposed to Meta federating, 30% are alarmed, and only 10% are supportive. mcc also did a second poll at the same time, asking a similar question about Tumblr, with very different results , highlighting how much of the opposition is specific to Meta. More recently, in sh.itjust.works' late-December [voting](https://sh.itjust.works/post/11308397?ref=thenexusofprivacy.net) thread, 78% voted for preemptive defederation. ## There are many fediverses -- and a lot of people will prefer them to Threads ![The vibes on Threads are bad. Have you ever been high/drunk and you walk into a CVS and the security guard is staring at you? That’s what Threads is. It’s deodorants locked behind plastic. It’s TikTok Hype Houses. It is Joe Biden’s reelection campaign. It’s a sneaker collab between Nike and JP Morgan. It’s your favorite stand-up comic showing up in a commercial for Carvana. ](https://thenexusofprivacy.net/content/images/2023/07/Screen-Shot-2023-07-06-at-3.01.08-PM.png) From Jason O. Gilbert's [Facebook’s Threads is so depressing](https://jogblog.substack.com/p/facebooks-threads-is-so-depressing) – which is much funnier than this post, I strongly recommend you read it! In [the original version](https://web.archive.org/web/20230623164631/https://privacy.thenexus.today/should-the-fediverse-welcome-surveillance-capitalism/) of this article, I said that I wouldn't be at all surprised if Meta decides not to go forward with ActivityPub federation with the Fediverse in the short term ... and sure enough they launched without it. Now that they're finally moving forward, it'll be interesting to see how quickly they move on the path they're planning on taking. As Ernst notes, starting with broadcasting information without allowing people to reply, and then adding likes to enable tracking and reshares to make the broadcasting even more effective, is likely to appear one-sided and self-serving – both because of Meta's track record of one one-sided and self-serving "partnerships" and because it is, in fact, one-sided and self serving. Once they enable two-way communications, they'll have to deal with the distraction of angry fediversians and instance defederation drama. So, we shall see how long it takes them to go there. In any case, no matter what Meta does, Threads will have a huge impact on the fediverses. I expect we'll see a lot of people moving servers as the Fediverse sorts itself into instances that prioritize "openness" and growth, even if it involves surveillance capitalism, and the instances that prefer a different path.12 The most likely outcome is a schism into anti-Meta "free fediverses", pro-Meta instances in "Meta's fediverses", and a lot of non-aligned instances connecting with Threads to some extent but trying to keep at arms length. It's even possible that this will escalate to a de-facto partition, with some instances in the anti-Meta "free fediverses" blocking not just Meta instances, but also any instances that federate with Meta.12.5 Most people don't want a partition – Vanta Black explicitly highlights that it'a *not* a goal of the Fedipact. Still, as Kissane suggests in Untangling Threads, with today's software this "transitive defederation" provides higher levels of protection for people at risk of being targeted by hate groups on Threads; and it may also be necessary to prevent data flowing to Meta via Meta-friendly instances.13 [Why just blocking Meta’s Threads won’t be enough to protect your privacy once they join the fediverse](https://thenexusofprivacy.net/just-blocking-threads-isnt-enough/) provides a simple example of indirect data flow could put people at risk. And depending on how well-moderated instances federated with Meta are, transitive blocking may also be needed to protect people from harassment, abuse, and disinfo on Threads. Of course people who support federation view this kind of schism as a horrible outcome – Chambers calls it the "nuclear option", and Lening frames it in terms of "punishing" instances and admins who refuse to preemptively block Meta. 13.5 In reality, though, the fediverse already has other schisms. One obvious example: many instances block the so-called "freeze peach" instances who are known sources for hate speech and harassment) and most people are just fine with that. As Aymeric Mansoux and Roel Roscam Abbing point out in [Seven Theses on the Fediverse and the Becoming of F/LOSS](https://test.roelof.info/log/seven-theses/?ref=thenexusofprivacy.net), the structure of the fediverse supports agonistic pluralism – or at least "a form of bastard agonism through pillarization." So if a schism happens, it'll be a good thing. There are many fediverses. Like I said earlier in the article, a lot of people came to the fediverses to get away from Facebook, Instagram, and other corporate social networks. Instances that federate with Meta will lose that advantage. Balanced against that, though, at least for now they're gaining the ability to let people there communicate with friends on Threads who haven't made the jump yet and are willing to (and make the effort to) opt-in to federation. But Threads' entrance to the Fediverse actually *highlights* the advantage of "free fediverse" instances – which are likely to be *much* more appealing to the increasing number of people people who want as little as possible to do with Meta, surveillance capitalism, and all the harms and abuses that come with it. Of course, Apartheid Clyde's X (formerly Twitter) is *sooooo* horrible that it makes Threads look good by comparison. But there's certainly room to do better, and the huge variety of software in the fediverses means a lot of people are likely to find something they prefer. ## In chaos there is opportunity! And more generally, I think that Meta's arrival will catalyze a lot of positive changes in the fediverses. And changes are certainly needed! [![A graph of monthly active users from fedidb.org, starting at 1,600,000 in January 2023, with ups and downs over the year, and ending at 1,400,000 in December 2023](https://thenexusofprivacy.net/content/images/2023/12/fedidb-monthly-active-users-chart-1-.jpeg)](https://fedidb.org/?ref=thenexusofprivacy.net) Fediverse usage flatlined in 2023 Despite millions of people leaving Twitter, and fed-up Redditors looking for options, Fediverse usage flatlined in 2023\. New apps have made huge progress in usability, but other critical underlying issues which have been widely discussed since the Twitter wave of 2017 still haven't been addressed – including [safety](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/). As I say in [Today's Fediverse is prototyping at scale](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/#time-to-change) > "One way to look at today's Fediverse is as a prototype at scale, big enough to get experience with the complexities of federation, usable enough for many people that it's enjoyable for social network activities, but with big holes including privacy and other aspects of safety, equity, accessibility, usability, sustainability and .... > > Now's the time to get beyond the prototyping stage." For example: [![I truly wish #Mastodon did not bomb it with BIPOC during the Twitter migration. #bluesky is becoming a crap show. I can't even invite people here b/c of what they have experienced or heard about others experiencing. 147 people liked this post.](https://thenexusofprivacy.net/content/images/2023/07/230528-damon-bipoc-mastodon.png)](https://calckey.social/notes/9facp5emmg?ref=thenexusofprivacy.net) Damon Outlaw, [on calckey.social (now firefish.social)](https://calckey.social/notes/9facp5emmg?ref=thenexusofprivacy.net) Despite the increasingly strong Black Mastodon community, and the positive impact of the #BlackJoy and #BlackFriday hashtags, [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) remains a huge problem as well. As I was writing the first draft of this article, I saw posts from at least four Black people I follow describing racist interactions they had just had, and they're far from the only ones. As mekka okereke [says](https://hachyderm.io/@mekkaokereke/110273797004251326?ref=thenexusofprivacy.net), it should be almost impossible for a new, non-technical user to onboard onto the Fediverse and accidentally join a server where they will receive racist death threats – and that is very much *not* the case today. As Rochko and cis white male admins of large Mastodon instances who *haven't* prioritized dealing with this and other issues cozy up to Meta, it'll create spaces for others in anti-Meta part of the Fediverse – and their relative lack of power in comparison to Meta will open up space in the pro-Meta region. Mastodon forks, apps and other fediverse platforms continue to innovate, but mainline Mastodon has had challenges keeping pace – and important community contributions still haven't integrated into the mainline code. And Mastodon's dominance has made it a challenge for forks and other Twitter-like implementations to get traction. That's already starting to change, and Meta's arrival will accelerate these changes. A few of the other issues where progress is badly needed: - Moderation on many instances is no better than Facebook. Mastodon's moderation tools leave out important functionality that's standard on forums and (sorry) Facebook groups – and most other Fediverse implementations have even fewer tools for moderators than Mastodon (although that's changing). And the lack of progress is striking! [Mastodon and today’s Fediverse are unsafe by design and unsafe by default](https://thenexusofprivacy.net/unsafe-by-design-and-unsafe-by-default/) discusses the issues in a lot more detail, and [Steps towards a safer fediverse](https://thenexusofprivacy.net/steps-towards-a-safer-fediverse/) talks about opportunities for improvement. - The ActivityPub protocol still hasn't made progress on some huge issues that have been there since version 1.0 – including safety, consent, and complexity of implementation. The pace has picked up somewhat in the W3C SWICG standards group since the Threads announcement (and the working group foccusing on account migration started with threat modeling, which is really great to see), but innovation is happening much more quickly on Bluesky's newer and cleaner AT Protocol. Threads remains well-placed to [Embrace, Extend, and Exploit](https://thenexusofprivacy.net/embrace-extend-and-exploit/) ActivityPub. - [There's very little privacy in the Fediverse today. But it doesn't have to be that way!](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/#very-little-privacy)14 No matter how you feel about Meta, their arrival highlights the need to deal with those problems ... and even more importantly, will almost certainly upend the power structures that have hindered progress. And [Strategies for the free fediverses (2024 DRAFT)](https://thenexusofprivacy.net/strategies-for-the-free-fediverses/) goes into more detail on ways that those of us in the fediverses who are opposed to Meta, big tech, and fascism can turn the situation to our advantage. So while it's likely to be a chaotic time in the fediverses ... in chaos there is opportunity! ## Coda: Looking back from late 2025 > "The interaction of Threads with the fediverse was a major part of the conversations on the fediverse in 2024, dominating the mind share and people’s understanding of what the risks to the network are. In 2025 those conversations died down, as it turned out that marginally few people actually made use of the connection. With the year at the close, it also means closing the chapter on the fediverse-Threads story for now (although it might be back some day, you never know)." > > – Laurens Hof, [Fediverse Report -#147](https://connectedplaces.online/reports/fediverse-report-147/?ref=thenexusofprivacy.net) There was general agreement that one of the major reasons for Threads' focus on the fediverse was to use as a response to regulators, both here in the US and in the EU. It clearly had some value there; for example, the sycophantic quote [ in the Washington Post](https://www.washingtonpost.com/politics/2024/10/02/meta-threads-fediverse-mosseri-mastodon-rochko/?ref=privacy.thenexus.today) ([archive link here](https://archive.ph/o6mPt?ref=privacy.thenexus.today)) from a fediverse influencer claiming that "Meta is actually at the forefront" of an industry transformation to "open networks" was a boon to Meta's lobbying. But by 2025, with Mark F—ing Zuckerberg as besties with an anti-regulation US government and the EU's Digital Omnibus on a path to weakening protections against big tech, regulatory pressure was clearly much less of a threat to Meta. That could change, of course, So one way of looking at Threads' shift to maintenance mode (but not canceling it) is minimizing investment while keeping it in reserve in case its needed. Another, complementary, way of looking at it is that the ActivityPub Fediverse didn't prove as juicy target for Meta to exploit as they had hoped. In early 2023, when Meta first put their plans in place, Mastodon and the Fediverse seemed poised for rapid growth ... but as [A faux “Eternal September” turns into flatness](https://thenexusofprivacy.net/flatness/) describes, things didn't work out that way. Today, both Mastodon (600,000 monthly active users) and the broader Fediverse(about 1,000,000 MAU are s*maller* than they were in early 2023\. Meanwhile, Threads has steadily grown 400,000,000 MAU, and is starting to introduce ads. Of course, Threads might well be lying about their numbers, but even so, it's clear they're much much much larger than the Fediverse – and easier to monetize. That said, I also think the pushback from FediPact and others opposed to Meta played a significant role here. For one thing, it significantly increased the potential cost to Meta if anti-LGBTQIA2S+ groups did indeed use Threads as a platform to attack trans, non-binary, and queer communities in fedi. If that *had* happened, the schism would have been inevitable – and very rightly blamed on Meta, undercutting all their positive press and possible regulatory leverage. So even though Meta continued to give anti-LGBTQIA2S+ groups free rein on Threads itself, they (very sensibly) reduced that risk of blowback from fedi by not encouraging people to federate ... which meant that adoption was minimal. Instead of creating a positive feedback cycle, where the pro-Meta faction in the Fediverse could point to all the value that was getting created by federation, it led to a situation whre pro-Meta people were constantly expressing disappointment – and looking naive for ever having believed that Meta had their best interests at heart. In any case, while the the strong resistance to Threads from the FediPact and the rest of the Free Fediverse is only one of the reasons Meta has shifted 'Threads Fediverse' to maintenance mode, it's still unambiguously very good news for the Free Fediverse. Defederation is a blunt tool, and today's fediverwse still relies far too much on it ... but just as with Gab, it's a very effective tool for fighting fascists fascists. For the corporate fediverse, it's a disappointment for anybody foolish enough to have believed Meta would actually give anybody else access to their audience, but good news for companies making a bet on descentralization. By contrast, it's a big embarassment for all the "Big Fedi" advocates who were soooo excited back when Threads found it useful to say nice things about fedi ... one more way in which it's good news for the fediverses as a whole! ## ## Terminology notes: LGBTQIA2S+ and definitions of "the Fediverse" I'm using LGBTQIA2S+ as a shorthand for lesbian, gay, gender non-conforming, genderqueer, bi, trans, queer, intersex, asexual, agender, [two-sprit](https://oacas.libguides.com/sogie/two-spirit?ref=privacy.thenexus.today), and others who are not straight, cis, and heteronormative. [Julia Serrano's trans, gender, sexuality, and activism glossary](https://www.juliaserano.com/terminology.html?ref=privacy.thenexus.today) has definitions for most of terms, although resources like [OACAS Library Guides' Two-spirit identities page](https://oacas.libguides.com/sogie/two-spirit?ref=thenexusofprivacy.net) go into a lot more detail. Serrano also discusses the tensions between ever-growing and always incomplete acronyms and more abstract terms like "gender and sexual minorities". Ontario Human Rights Commission's page on [Gender identity and gender expression](https://www3.ohrc.on.ca/en/en/policy-preventing-discrimination-because-gender-identity-and-gender-expression/3-gender-identity-and-gender-expression?ref=privacy.thenexus.today) is a good short reference on the distinctions between gender identity, gender expression, sexual orientation, and sex. I'm using "the Fediverse" and "today's Fediverse" as defined in the [Terminology](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse#terminology) section of September 2024's [I for one welcome Bluesky, the ATmosphere, BTS Army, and millions of Brazilians to the fediverses!](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/) - **"the Fediverse"** is a fediverse whose boundaries, culture, software, protocols, and over time and means different things to different people but typically include a network organization based on **instances**, a specific kind of server - **"the fediverse"** is a synonym for "the Fediverse" - **"today's Fediverse"** is the Fediverse as it is now, as opposed to how it was in 2016 (before Mastodon existed) or whatever comes next A caveat: the last major update to this article was in March 2024, months before I finalized that termiology section, so it's not necessarily completely in sync yet. ## Notes 1 For example: - Meta could introduce their own proprietary extensions to the protocol, just as Facebook and Google did with the XMPP decentralized messaging protocol (a setback XMPP never really recovered from). Ploum's [How to Kill a Decentralised Network (such as the Fediverse)](https://ploum.net/2023-06-23-how-to-kill-decentralised-networks.html?ref=thenexusofprivacy.net) discusses the XMPP situation in more detail. - Meta could use the threat of dropping ActivtyPub support to pressure the standards group to adopt Meta's suggested "improvements." - For that matter, nothing prevents Meta from turning around and saying "oh and we support ATProto and Bluesky as well," just as Flipboard already supports Bluesky as well as Mastodon. [Embrace, Extend, and Exploit: Meta’s plan for ActivityPub, Mastodon and the fediverse](https://thenexusofprivacy.net/embrace-extend-and-exploit/), from December 2023, explores Meta's options in more detail. ActivityPub supporters optimistically suggest that none of those things will happen this time, at least not for a while, and even if and when they do it won't hurt ActivityPub much. 2 Hope springs eternal! It reminds me of the time a friend of mine stepped in as interim CEO of a startup whose quests to get funding were repeatedly stymied when VCs asked why they'd be successful when a dozen companies had previously failed with a similar strategy. Lacking a better answer, he told me "I'd look them right in the eye and confidently say 'because we're going to be lucky.'" I actually do agree that Meta's not particularly trying to extinguish the fediverse, and instead is employing an ["Embrace, Extend, and Exploit"](https://thenexusofprivacy.net/embrace-extend-and-exploit/) strategy, but still, it's not like that's exactly comforting. 2.1 **Update, April 2025**: After a reddit account run by a Fosstodon moderator made [anti-immigrant and anti-trans posts](https://gamedev.lgbt/@bram/114397681439709478?ref=thenexusofprivacy.net), Fosstodon admin Mike [refused to remove them](https://fosstodon.org/@mike/114394345053697948?ref=thenexusofprivacy.net). It's an interesting parallel to the attitude that yes Meta has done horrible things elswhere but they haven't done them here yet so there's no problem. 3 In fact if you think about it, there are lots of scenarios that could lead a majority of instances defederating. Reddit's ongoing footgun, with a big ad-funded tech company screwing over its most active users, app developers, and volunteer moderators could lead to the fediverse equivalents of all of the above (as well as instance admins and pundit) to think twice about the wisdom of working with Meta. Canadians might see Meta's blacking out news as contrary to the spirit of the fediverse; Californians might see Meta's threat to black out news coverage as bullying. Another whisteblower could attract media coverage about some new appalling way Facebook, Instagram, WhatsApp, or Meta exploited their users. Of course the likelihood and impact hard to predict, but any of these things are distinctly possible. 4 Bluesky is another decentralized social network, originally funded by former Twitter CEO Jack Dorsey, which developed its own protocol (ATProto) instead of starting with ActivityPub. Tim Chambers' [Project92 and the Fediverse](https://www.timothychambers.net/2023/06/23/project-and-the.html?ref=thenexusofprivacy.net) similarly highlights the risk of Meta adopting Bluesky. Meta knows that ActivityPub loyalists see Bluesky as a rival, so I'm sure they're subtly (or maybe-not-so) hinting that if the fediverse spurns them, they'll cozy up to Bluesky. Of course even if the fediverse welcomes them with open arms, they'll cozy up to Bluesky the second that it's useful from their perspective, so I'm not sure why people think this talking point is so effective ... but it's clearly a talking point. Annalee Newitz' [Bluesky is just another Twitter clone and that isn’t a good thing](https://www.newscientist.com/article/mg25834421-400-bluesky-is-just-another-twitter-clone-and-that-isnt-a-good-thing/?ref=thenexusofprivacy.net) and Michał "rysiek" Woźniak's [BlueSky is cosplaying decentralization](https://rys.io/en/167.html?ref=thenexusofprivacy.net) discuss Bluesky in more detail. ændra's [My top Bluesky feature requests for 2024](https://www.aendra.com/posts/my-top-bluesky-feature-requests-for-2024?ref=thenexusofprivacy.net) includes some interesting perspectives on differences between Bluesky and the fediverse. 5 Hahahaha. Apple and Google have close to 90% of the email client market, Microsoft and Yahoo another 7% ... and while it's still possible to run your own email server if you've got the time to learn about DKIM, SPF, DMARC and other anti-spam technies, even following best practices it's become increasingly difficult to get Gmail to actually accept mail from individual servers without marking it as spam. This is the best example he could come up with as a triumph of openness? As Ian Betteridge says in [Meta and Mastodon – What’s really on people’s minds?](https://ianbetteridge.com/2023/06/21/meta-and-mastodon-whats-really-on-peoples-minds/?ref=thenexusofprivacy.net), "the email analogy is terrible, and we should all stop using it." Gruber's [response](https://daringfireball.net/linked/2023/06/22/betteridge-meta-mastodon?ref=thenexusofprivacy.net) to Betteridge's post contains this gem: > If you don’t want Meta (or Google, or whoever) to see your posts, then no matter which instance you’re on, and which other servers your instance chooses to federate with, you need to make your account private.... If your account isn’t private, you’re posting to the open web. He clearly has no idea what he's talking about here. For one thing, Mastodon doesn't have private accounts. Like other social networks, though, it does have the ability to resrict individual posts – "followers-only", specific people, or visible on your instance – in which case *they're not public*. Why does anybody listen to him? But he's got 47,000 followers on Mastodon, and his posts frequently show up on Mastodon's algorithmic "explore" tab which means people are boosting them, so ... 🤷🏻‍♂️. Sean Tilley's [John Gruber Doesn’t Know What He’s Talking About](https://wedistribute.org/2023/06/john-gruber-no-understand/?ref=thenexusofprivacy.net) deconstructs Gruber's post in more detail. For the record, I had written that Gruber "clearly has no idea what he's talking about here" before seeing Sean's headline ... we reached the same conclusion independently! **Update, July 21**: in a discussion about the likelihood of Threads-based ads infecting the fediverse once they federate, Tim Chambers points out that [there are already sponsored posts here, such as this one from ... Gruber](https://mastodon.social/@daringfireball/110731426703166396?ref=thenexusofprivacy.net)! You can't make this stuff up. \[Is it just me or is "Gruber, a very loud advocate of federating with Meta is already doing ads here, so we don't have to worry about ads from Meta" not as strong an argument as Tim seems to think it is?\] 5.05 **Update, January 2026:** The original version of this threads quoted and linked to an excellent, but since-deleted thread, by L. Rhodes on [Just Nodes and Networked Communities](https://merveilles.town/@lrhodes/110555014534253768?ref=thenexusofprivacy.net) > Those two views aren't necessarily incompatible, but they tend toward different philosophies that impact important things like app development. [Groundedness and community](https://destructured.net/groundedness-networked-community?ref=thenexusofprivacy.net), on destructured.net, is a more polished version of the thread (although emphasizes a different difference). An excerpt: > "Instances administrated according to a Just Nodes perspective aren’t necessarily incompatible with the ideals of Networked Communities, but the two lend themselves to different approaches. I’ve seen it suggested, for example, that de-federation should be reserved for hopelessly abusive instances—sometimes with the implication that even less stringent limits are likewise a bridge too far. And that makes some sense if an instance is only an access point to the network at large, but that need not be the only way to conceive of your instance’s relation to the rest of the fediverse. Shifting to an emphasis on building and serving a local community makes decisions about when and how to federate an expression of the needs and values of that community." Which is a very good point, and relates to the Threads debate and in general. Prodormou's [Big Fedi](https://thenexusofprivacy.net/the-annotated-case-for-a-big-fedi/) doesn't use the "Just Nodes" terminology, but this description of a "big fedi" tenet very much aligns: > **The individual is central..**.. The account server may set some parameters around content or software usage, but otherwise it’s mostly a dumb pipe. Still, with the additional terminology it doesn't fit in smoothly with in the text in that specifc place, and needs this contextualization, so I'm moving it all to a footnote for now. 5.1 Chambers similarly left some of the most important concerns of many people advocating blocking Meta out of the original version of his June 23 [Project92 and the Fediverse - A Smarter Battle Plan to Protect the Open Social Web](https://www.timothychambers.net/2023/06/23/project-and-the.html?ref=thenexusofprivacy.net) – and then, even after multiple discussions with people supporting blocking, devoted just once sentence to the concerns in his [June 25](https://www.timothychambers.net/2023/06/25/project-the-fediverse.html?ref=thenexusofprivacy.net) post, and *didn't even mention these concerns* in his [June 30](https://www.timothychambers.net/2023/06/30/meta-and-the.html?ref=thenexusofprivacy.net), [July 3](https://www.timothychambers.net/2023/07/03/instagram-threads-and.html?ref=thenexusofprivacy.net) , and [July 5](https://www.timothychambers.net/2023/07/05/nstagram-threads-and.html?ref=thenexusofprivacy.net) posts, instead decrying the “almost religious overtones” of the debate and calling for "empathy, humility, and community." Looking at [vantablack's tl;dr summary](https://fedipact.online/why?ref=thenexusofprivacy.net) of reasons for the Anti-Meta Fedi Pact I included above – all of which I've heard from lots of other people as well – Chambers original three-point summary missed the mark on two out of three: - Chambers doesn't mention Facebook, Instagram, and Meta's long track record of evil behavior, instead simply treating them as a potential risk just like any other bad actor on the fediverse (just on a larger scale) that he suggests can can be managed and moderated by technical tools (that he sees as generally working well enough today) - vantablack focuses on protecting *marginalized communities –* as opposed to Chambers third point focusing on defending the ActivityPub *standard* against embrace-and-extend attacks \[And yes I know it's weird to have decimal points in footnote numbers. Ghost (the software I'm currently using for the Nexus of Privacy newsletter) only has footnote number withing Markdown cards as far as I know, and I hate Markdown, so it's a real pain to constantly adjust them. Sorry about that.\] 5.2 For example: - Ploum's [How to Kill a Decentralised Network (such as the Fediverse)](https://ploum.net/2023-06-23-how-to-kill-decentralised-networks.html?ref=thenexusofprivacy.net) - oblomov's [A credible threat to (and from) commercial social network silos](http://wok.oblomov.eu/tecnologia/credible-threat-1/?ref=thenexusofprivacy.net) - fancysandwich's [Resistance is futile. You will be assimilated by Meta](https://www.cacherules.com/blog/2023/6/resistance-is-futile-you-will-be-assimilated-by-meta/?ref=thenexusofprivacy.net), - Darnell Clayton's [Facebook Fears The Fediverse. Here’s How Instagram Will Try To Conquer It (EEE!!!!)](https://darnell.day/facebook-fears-the-fediverse?ref=thenexusofprivacy.net) 6 One example: Rochko has famously refused to integrate community-contributed support for "local-only posts", which can provide protection against harassment and dogpiles (as wall as improving privacy). But it's not just Rochko; admins of virtually all of the larger instances have chosen not to run Mastodon forks (variants) like Glitch-soc and Hometown that provide more safety for their users by implementing local-only posts. Meta will try very hard to make it worthwhile for them to compromise user safety (or just trick them into doing it), and past behavior is the best predictor of future behavior. The question of whether or not Meta's pursing an EEE – [embrace, extend, and extinguish](https://en.wikipedia.org/wiki/Embrace,%5Fextend,%5Fand%5Fextinguish?ref=thenexusofprivacy.net) – strategy has generated a lot of discussion. On the SWICG standards mailing list, for example, Sean O'Brien replied to mail suggesting that "Regardless of how you may think of Meta as an organization, from a standards perspective, this is a major success" with a message that just said "Embrace, extend, extinguish." Fediverse influencer Evan Prodromou objected, describing this O'Brien's male as "not acceptable. You're insulting our member from Meta; you're also insulting the integrity of everyone else working on the ActivityPub standards, here and elsewhere." As a few others (including me) pointed out, that's nonsense. Whether or not it's what Meta's intentionally trying to do here (I personally don't think so; 'extinguish' isn't the only word that starts with an 'E' and I think they're plan is to [embrace, extend, and exploit](https://thenexusofprivacy.net/embrace-extend-and-exploit/), but many others do),it's not insulting the integrity of anybody working on the standards to say that they should discuss what (if anything) to do to respond to the concerns and risk. But SWICG co-chair Dmitri Zagidulin sided with Prodromou, suggesting with his co-chair hat on that since O'Brien's mail didn't go into details it was an example of "lazy behavior and knee-jerk reaction." 🍿 6 One example: Rochko has famously refused to integrate community-contributed support for "local-only posts", which can provide protection against harassment and dogpiles (as wall as improving privacy). But it's not just Rochko; admins of virtually all of the larger instances have chosen not to run Mastodon forks (variants) like Glitch-soc and Hometown that provide more safety for their users by implementing local-only posts. Meta will try very hard to make it worthwhile for them to compromise user safety (or just trick them into doing it), and past behavior is the best predictor of future behavior. 7 For more critiques of ActivityPub, including from another author of the spec, see the [ActivityPub](https://thenexusofprivacy.net/mastodon-a-partial-history/#activitypub) section of [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history/). ActivityPub's weaknesses make it especially vulnerable to an "embrace and extend" attack where Meta introduces proprietary solutions that are genuine improvements over the standard. Of course, these design flaws can be worked around to some extent. In addition, ActivityPub could evolve to better address harassment; Erin Shepherd's [A better moderation system is possible for the social web](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web/?ref=privacy.thenexus.today) and Christine Lemmer-Webber's [OcapPub: Towards networks of consent](https://gitlab.com/spritely/ocappub/blob/master/README.org?ref=privacy.thenexus.today) describe potential paths forward. But, most ActivityPub supporters haven't prioritized this. 8 And since this section wasn't in the [original version](https://web.archive.org/web/20230623164631/https://privacy.thenexus.today/should-the-fediverse-welcome-surveillance-capitalism/) of this article ... I'm afraid that I too have been guilty of this. My apologies. 9 A good example of the vortex of toxicity around Meta: in mid-June, conflicting reports of [a meeting between Meta and instance admins (and others?) with a non-disclosure agreement (NDA)](https://universeodon.com/@supernovae/110574402887070239?ref=thenexusofprivacy.net) threw gasoline on the flames, leading to defederations and allegations of backstabbing, bullying, and "lynch mobs". \[A quick racial justice education aside: if you're not a Black person, and you use this term to refer to a white person getting hassled, it's racist.\] Rumors swirling around deleted tweets resulted in people like Dan Supernault of Pixelfed who apparently *didn't* sign the NDA or attend the meeting getting attacked. mastodon.art anounced they were defedereating Universeodon, whose instance admin Byron had history of problematic behavior even before he reached out to Meta. mstdn.social's admin Stux got so frustrated with mastodon.art's admin Welsh Pixie for what he saw as mischaracterizing the situation that he defederated mstdn.social from mastodon.art with no notice – severing connections between people on the two instances. Even though he refederated the next day, the connections don't magically reappear, he continued to block all communications from people on his instance with mastodon.art's instance admin – by which point I saw more than one person saying that it was their cue to move on from mstdn.social. That's only the tip of the iceberg of course, but you get the idea. Details aside, one of the key takeaways here is the lack of maturity of the software: after six years why wasn't there an option of defederating in a way that allows connections to be reestablished when the situation changes and refederation is possible? If you look in inga-lovinde 's [Improve defederation UX](https://github.com/mastodon/mastodon/issues/15891?ref=thenexusofprivacy.net) March 2021 feature request on Github, it's pretty clear that it's not the first time stuff like this happened. [Dan Fixes Coin-Ops has an interesting perspective](https://retro.social/@ifixcoinops/110574102504926859?ref=thenexusofprivacy.net) on retro.social describes how this looked from the perspective of a (former) mstdn.social user. But the details are important too, especially given how things played out and Byron's comments that he felt so much more affinity with Meta engineers than he did with people on the fediverse. mastodon.art's [Defederating from Universeodon](https://dotart.blog/dotart-blog/defederating-from-universeodon?ref=thenexusofprivacy.net) and Universeodon's now-deleted "Meta - Progress and Controversy" (still available [on archive.org](https://web.archive.org/web/20230628143106/https://blog.universeodon.com/meta-progress-and-controversy)) give two different views of what happened in June. Byron claimed that he had received "death threats" because of the .art blog post, and also claied that .art's admin had claimed they were justified. In a June 26 post, stux said "It's time people stand up against the bullies from the .art staff." Others however saw it differently. In a June 27 post, ngmx's admin noted that Byron and Stux' behavior "[raises all sorts of red flags](https://ngmx.com/@custodian/110804401052794325?ref=thenexusofprivacy.net), as they try to avoid taking responsibility for their own actions, and try to frame .art as the aggressor instead," and helpfully included a link to Wikipedia's page on [DARVO](https://en.wikipedia.org/wiki/DARVO?ref=thenexusofprivacy.net). Byron blocked me on June 28 after I pointed out that his mischaracterization of a critical comment as "abuse" was "[a classic self-pitying excuse for not trying to understand others' point of view](https://indieweb.social/@jdp23/110624103395192701?ref=thenexusofprivacy.net)". Well, okay I also pointed out that he was being unfair to his kids by highlighting their positive experiences on Meta while ignoring the horror stories so many people of color and LGBTQ+ people have about their less-positive experiences there, and told him he should apologize to his kids, so I totally get why he blocked me ... but he then proceeded to tell people it was because I had called him a Nazi for not agreeing with him. Uh, no, that's not what I said. Over the next few weeks, Byron kept [showing up in people's mentions ](https://universeodon.com/@supernovae/110786099791916447?ref=thenexusofprivacy.net)accusing .art of abuse and ignoring requests to stop. In [an excellent thread with cutie.city's admin Nuz](https://archive.ph/y1446?ref=thenexusofprivacy.net), Byron couldn't or wouldn't produce receipts showing an relationship between .art and the accounts that made those "death threats." Oliphant's July 20 post [Defederating Universeodon](https://writer.oliphant.social/oliphant/defederating-universeodon?ref=thenexusofprivacy.net), characterizing Byron's behavior as harassment, was swiftly followed by Byron's farewell post [Thank you Universeodon and the Fediverse!](https://blog.universeodon.com/thank-you-universeodon-and-the-fediverse?ref=thenexusofprivacy.net) In a now-deleted tweet, Free Ze Peach (yes really, you think I could make up that perfect an account name?) described the situation as "the high school mean girl cancel mob vibe at Mastodon, they are relentless bullies, sadists in disguise." Some people on the fediverse no doubt felt that way as well. Others wishing Byron well were presumably just being polite; if you were one of them, it's worth looking at [Nuz' perspectives here](https://cutie.city/@nuz/110805820041497188?ref=thenexusofprivacy.net), which also include links to a few other posts. Nuz' [white dude story time](https://cutie.city/@nuz/110816125244953896?ref=thenexusofprivacy.net) is also worth reading. Welsh Pixie's [The Toxic Manosphere of Fedi](https://dotart.blog/welshpixie/the-toxic-manosphere-of-fedi?ref=thenexusofprivacy.net) has detailed receipts and analysis of the misogyny, DARVO, gaslighting, and abuser tactics. As she says: > "The fediverse – a network of social media platforms without one big tech company or a board room of white guys in suits or a dickhead egotistical billionaire controlling everything – by its very nature challenges the status quo. White guys who are used to being in control, who are used to waving their privilege dicks around and everyone else getting the fuck out of the way while they indulge in their incessant and continuous mutual ego-stroking, are running into people who don't give a shit about them or their supposed Place In Society, but now instead of having to 'like it or lump it', we're able to do something; we're able to opt out and continue our lives without them in the conversation." 10 Posts on Mastodon were officially known as toots up until last November, and still frequently get referred to that way. And how could I pass up the opportunity to refer to "Trumpet's toot"? 11 Note that several of the polls included options like "just see results" or "SpiderNeal/Comments"; the numbers I'm presenting here exclude those responses. And no, I don't know who SpiderNeal is either. 12 Unfortunately Mastodon doesn't provide any way to take your posts with you when you move to a different instance, but Tokyo Outsider's work on the [Mastodon Content Mover](https://mastodoncontentmover.github.io/?ref=thenexusofprivacy.net) and Firefish's support for post migration mean that there are more options now than there were six months ago. [Alex Heath has reported that Threads will allow users to import their account info and posts from Mastodon](https://mastodon.social/@alexeheath/110596226686316769?ref=thenexusofprivacy.net). On the one hand it would be pretty funny if the implemented this before Mastodon; on the other hand, it's a good example of how an "embrace and extend" can exploit weaknesses in fediverse software to provide a better proprietary experience for their users. Osma Ahvenlampi points out that [groups are another fediverse weakness ripe for Meta to target](https://social.fishpool.org/@osma@fishpool.org/posts/193896504010843696/https://osma.medium.com/meta-threads-and-the-fediverse-pt-2-6a50500de201?ref=thenexusofprivacy.net). Facebook has a very flexible group mechanism; by contrast, Reddit alternatives Kbin and Lemmy are promising, but have a long way to go; Mastodon's implementation is still in the works. 12.5 In the original version of this post I framed it as a single "free fediverse", but there may well be more than one. For example, in recent Mastodon discussions I've suggested that we're seeing the emergence of an anarchist/leftist fediverse and an anti-racist fediverse; if so, I'd expect both of those regions to reject Meta. Earlier versions of this post were also careless about the use of schism and partition; I'm now trying to be consistent about using "schism" to refer to a split and "partition" for transitive defederation. 13 As Mastodon Migration's [post](https://mastodon.online/@mastodonmigration/110622589366603128?ref=thenexusofprivacy.net) (based on input from Firefish maintainer Kainoa as well as infosec.exchange admin and security expert Jerry) shows, Mastodon instances federating with Meta will share data from instances that have blocked Meta. Even though today's ActivityPub implementations make most stuff public, where Meta, Google, and other bad actors could get to it by web scraping, many people (including me) see that as a problem that needs to be addressed – and *not* a reason for instances to also be bad actors and give them my data without consent. [Threat modeling Meta, the fediverse, and privacy ](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/)explores this and other privacy issues in somewhat more detail (although as I point out, it's still only a simple analysis, a more detailed analysis is needed, and that will require funding). As far as I know, nobody's done similar threat modelnig for the other direction: harassment, hate speech, and disinfo flowing from Meta, via instances that federate with them, to instances that have blocked Meta but haven't blocked instances federating with Meta. Again, detailed analysis is needed, and that too will require funding. Until these detailed analyses are done, "transitive defederation" (defederating Meta, any instances that federate with Meta directly or indirectly) is the safer approach. 13.5 As Only Brown Mastodon [pointed out](https://mastodon.social/@onlybrownmastodon/111326143705471623?ref=thenexusofprivacy.net) in October, in a different context, "For a white person on the Fediverse, defederation is punishment; for the rest of us, it is a form of self-defence." 14 A few examples: - bad actors can easily scrape public information, and most information is public – Mastodon doesn't even provide the equivalent of Twitter's private profiles (although you can limit visibility of individual posts) - the option to keep your posts from search engines doesn't work - direct messages aren't end-to-end encrypted so instance admins can create them, - the security bar is so low that nobody even batted an eye last fall when [infosec.exchange (one of the fediverse hubs for the security community) misconfigured the system and left all images exposed to anybody who wanted to see them](https://www.alevsk.com/2022/11/system-misconfiguration-is-the-number-one-vulnerability-at-least-for-mastodon/?ref=thenexusofprivacy.net), - Most instance admins don't turn on "secure fetch", which provides additional security and privacy guarantees - Most instance admins don't provide people the ability to make "local-only posts", which provide stronger privacy as well as saftety [Threat modeling Meta, the fediverse, and privacy](https://thenexusofprivacy.net/fediverse-threat-modeling-privacy-and-meta/) discusses ways to make progress on many of these privacy issues. ## Update log Ongoing: fixing typos and confusing wording, adding new links, and other minor changes April 2025: add[ footnote on fosstodon](#fn-fosstodon) and note about Hachyderm's January 2025 defederation of Threads September 12: begin terminology update; see the [Terminology notes](#terminology) for details June 29: begin work on update but wind up mostly putting it on hold April 12: update schism / partition discussion. March 22-23: revise introduction after beta announcement; remove *The (annotated) case for a "big fedi"* section, since there's now a separate article on it. March 4, 2024: add InformaPirata quote December 23-31 2023: significantly revised with a new introduction, starting with Kissane's quote, and moving the contents after the intro, new sections on *The (annotated) case for a "big fedi"* (since moved to a separate article) and [It is anti-queer and transphobic to ignore the number of trans and queer-led instances and LGBTQIA2S+ people who oppose federating with Threads – or dismiss LGBTQIA2S+ concerns as "overreacting"](#anti-queer), lots of other minor updates. December 13-22: updated after Zuckerberg's announcement – including getting rid of the line (in the [July version](https://web.archive.org/web/20230725002253/https://privacy.thenexus.today/should-the-fediverse-welcome-surveillance-capitalism/)) "In my view it's still an open question whether they do it at all." Other than that, though, almost everything else aged well, so I added a few links and updated the analysis based on their apparent rollout strategy. [Here's the last version (from archive.org) before the remix](https://web.archive.org/web/20231223090623/https://privacy.thenexus.today/should-the-fediverse-welcome-surveillance-capitalism/). August 1: updated [the footnote on the NDA meeting](#nda-meeting), after Byron's departure – it's now even longer than [the footnote mocking Gruber](#fn5)! But, it's relevant both as an illustration of the point that Meta's arrival will cause positive changes in the power structure here, and his perspective that he felt more affinity with Meta engineers than with people in the fediverse. July 21: updated [footnote #5](#fn5), mocking Gruber. This footnote's long enough that at some point I should break it out into a separate post! July 14: update in response to new reporting that ActivityPub integration is a "long way out" July 8: include a quick summary in the intro, breaking most of the existing intro into the new Why block Meta section; tweak the strategy section in response to feedback. July 6-7: major update now that Threads has been released: changes in the introductionn to bring it up to date, additional quotes, reordering, adding new sections on [An important perspective, too rarely acknowledged](#an-important-perspective), [What will instances do? Opinions differ!](#options), [Speaking of polls ...](#polls), [There are many fediverses -- and a lot of people will prefer them to Threads](#many-fediverses), and significant changes to [An interesting dynamic](#an-interesting-dynamic) and [In chaos there is opportunity!](#chaos) Also cleaning up the numbering of the footnotes, which are becoming the bane of my existence. June 27: add quote from IronWynch about Meta's nazi spam problem, and Esther Payne's crucial point about consent; move vantablack's quote about what it's like to be trans on Facebook up front. June 26: more work on [An interesting dynamic](#an-interesting-dynamic) to better capture the mismatch between the two sides ... it's now long enough that it's a section in its own right. And, added a poll on people moving instances and a brief discussion of on privacy in [In chaos there is opportunity!](#chaos) June 25: rework discussion of "bigger is better" in respones to feedback to highlight that some of the loudest advocates for working with Meta have a track record of not prioritizing user safety; incorporate a few updates from [We’re here, we’re queer, and we’re federated](https://thenexusofprivacy.net/here-queer-and-federated-on-mastodon-and-the-fediverse/). June 23-24: incorporated feedback, added a few more links, clarified some points June 22: published and sent to newslsetter subscribers. Here's [the original version on archive.org](https://web.archive.org/web/20230623164631/https://privacy.thenexus.today/should-the-fediverse-welcome-surveillance-capitalism/). ### Eight days later: Kbin, Lemmy, the landed gentry, and the rise of the "threadiverse" (DRAFT) URL: https://thenexusofprivacy.net/8-days-later-draft-kbin-lemmy-landed-gentry/ Last updated: 2026-04-16T03:05:37.000Z *Update, June 20: After revisions, I integrated this into* [*Don’t tell people “it’s easy”, and six more things Kbin, Lemmy, and the fediverse can learn from Mastodon*](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/)*.* > See the discussion n [Kbin](https://kbin.social/m/RedditMigration/t/54002/Eight-days-later-KBin-Lemmy-the-landed-gentry-and-the?ref=thenexusofprivacy.net), [Lemmy](https://lemmy.blahaj.zone/post/214933?ref=thenexusofprivacy.net), and [Mastodon](https://mastodon.social/@nexusofprivacy/110567990867966906?ref=thenexusofprivacy.net) – and it's also on [Hacker News](https://news.ycombinator.com/item?id=36395866&ref=thenexusofprivacy.net) and [Techmeme](https://www.techmeme.com/230619/p16?ref=thenexusofprivacy.net#a230619p16). ![A graph, with a green line steadily increasing from 80,000 users on June 12 to 200,000 on June 18](https://thenexusofprivacy.net/content/images/2023/06/230618-lemmy-kbin-growth.png) Growth of Kbin and Lemmy, via [@threadcount@botsin.space](https://botsin.space/@threadcount/110567230856441064?ref=thenexusofprivacy.net) Contents: - [Eight days later ...](#seven-days-later) - [Experiment to find what approaches are a good fit for the current state of the software](#experiment) - [Recruit moderation teams, and put policies and processes in place](#recruit) - [Defederation can be a useful tool](#defederation) > The fediverse has always grown in waves, and it looks like the next one's in progress. The most obvious reddit alternatives in the fediverse are Kbin and Lemmy, both of which offer "link aggregation" functionality: people can post links, memes, videos from around the web, discuss them, and vote on the best posts and comments. They're both quite new, and still relatively small (last week Lemmy had a few thousand active users, and KBin a lot fewer) – but they're open-source projects, so the code can improve quickly, and people or organizations can set up new instances on different websites as new homes for one or more subreddits. Even better, people on one instance can interact with people and communities on other instances – and people already in the fediverse using Mastodon, Friendica, and dozens of other software platforms can interact with Lemmy and Kbin. > > How cool is that? > > Of course, we're talking about early-stage software here, and today's reality has a lot of confusion, bugs, and limitations along with it's coolness. > > – [Don’t tell people “it’s easy”, and six more things Kbin, Lemmy, and the fediverse can learn from Mastodon](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/), June 10 ## Eight days later ... Tens of thousands of people have signed up for KBin and Lemmy accounts since I first published [Don’t tell people “it’s easy”](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/), hundreds of new instances have been created, and "the threadiverse" is suddenly a hot topic of conversation. As expected, many of the newcomers initially found the experience somewhat confusing, especially the federation aspects... but most got the gist of it fairly quickly, and there are plenty of vibrant discussions on multiple topics. As Asif Youssuff's [Unofficial Subreddit Migration List](https://www.quippd.com/writing/2023/06/15/unofficial-subreddit-migration-list-lemmy-kbin-etc.html?ref=thenexusofprivacy.net) and the [sub.rehab list](https://sub.rehab/?ref=thenexusofprivacy.net) illustrate, more and more subreddits are exploring alternatives. Of course, it hasn't all gone smoothly. The moderation functionality of KBin or Lemmy is waaaaaaay weaker than Reddit – and for that matter, weaker than Mastodon's functionality today. So with limited tools, it's been a real challenge to keep trolling, [spam, and porn](https://kbin.social/m/kbinMeta/t/35027/Spam-and-porn-are-flooding-kbin-already?ref=thenexusofprivacy.net) under control. In that and many other ways, the software's not yet ready for prime time. But the opportunity's not going away. Reddit CEO Steve Huffman is [tripling down](https://www.techdirt.com/2023/06/16/reddit-ceo-triples-down-insults-protesters-whines-about-not-making-enough-money-from-reddit-users/?ref=thenexusofprivacy.net), and generally throwing gasoline on the fire. [Thousands of moderators are keeping their subreddis private](https://www.nytimes.com/2023/06/20/business/media/reddit-moderators-api-protest.html?ref=thenexusofprivacy.net) despite the company's following through on their threats to remove volunteer moderators (who Huffman described as "[landed gentry](https://www.theverge.com/2023/6/15/23762868/reddit-ceo-steve-huffman-interview?ref=thenexusofprivacy.net)")[1](#notes). Other subreddits are opening up but [continuing the protest in creative ways](https://www.businessinsider.com/reddit-community-is-protesting-by-posting-sexy-john-oliver-photos-2023-6?ref=thenexusofprivacy.net). As Yousuff points out, Reddit's reactions are [a clear sign that the protests are working](https://www.quippd.com/writing/2023/06/18/reddit-is-sowing-division-in-mod-teams-because-protest-is-working.html?ref=thenexusofprivacy.net). [It's going to be very hard for Reddit to recover trust](https://www.wired.com/story/the-reddit-blackout-is-breaking-reddit/?ref=thenexusofprivacy.net) after the "[brutal blackout](https://www.theguardian.com/technology/2023/jun/20/techscape-reddit-blackout-forums-ipo-profit?ref=thenexusofprivacy.net)", so even if they somehow cobble together enough moderators to keep going and people reluctantly stay there for a while, everybody will keep looking for alternatives. And just as with similar waves to the fediverse in the past, there's also a surge of developers getting involved – contributing bug fixes and new functionality, userscripts to customize the experience, and starting to work on apps. As [KBin developer Ernest](https://kbin.social/m/random/p/444184/-/reply/773052?ref=thenexusofprivacy.net) says, > We have challenging times ahead. We need to cover critical functions in the code, develop better moderation tools, focus on performance, and create user-friendly documentation. By doing so, it will be much easier. And I intentionally use the word "we" because what is happening on Codeberg is absolute madness. > > – [KBin developer Ernest](https://kbin.social/m/random/p/444184/-/reply/773052?ref=thenexusofprivacy.net), in response to fedia.io admin Jerry Bell Yeah really. As I write this, there are over 40 active "pull requests" (code contributions) in [KBin's source code repository on Codeberg](https://codeberg.org/Kbin/kbin-core/pulls?ref=thenexusofprivacy.net); Lemmy has almost 20 pull requests [on Github](https://github.com/LemmyNet/lemmy-ui/pulls?ref=thenexusofprivacy.net). And I'm sure both code bases will improve significantly. Mastodon's influx in 2016-2017 led to a period of [rapid community innovation](https://thenexusofprivacy.net/mastodon-a-partial-history/#rapid-queer-led-community-innovation) and similar things are happening in the threadiverse (the suddenly-hot subset of the fediverse including KBin, Lemmy, and other federated threaded-discussion software). That's good! Looking at the dynamics of the last week, the lessons I highighted in [Don’t tell people “it’s easy”](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/) all remain very relevant. As I said in that post, though, there's a lot more that can be said. So here's one important lesson I should have included, and a few more thoughts on moderation that fit in well with some of the other lessons. ## Experiment to find what approaches are a good fit for the current state of the software Mastodon instances run the gamut from single-person instances, relatively-small communities, and big general purpose sites. Over time, techniques have been refined for the different approaches – Darius Kazemi's [How to run a small social network site for your friends](https://runyourown.social/?ref=thenexusofprivacy.net), for example, is an invaluable resource. But unsurprisingly, the software itself is a better match for some approaches than others; mainline Mastodon, for example, has consistently de-emphasized functionality that's very useful for smaller community-focused instances (in contrast to forks like Hometown and Glitch) KBin and Lemmy are similarly flexible enough that that they're getting deployed in a lot of different ways. For example: - [startrek.website](https://startrek.website/?ref=thenexusofprivacy.net) hosts three related communities: [Star Trek](https://startrek.website/c/startrek?ref=thenexusofprivacy.net) for news and discussion (and a bit of slash fic), [Risa](https://startrek.website/c/risa?ref=thenexusofprivacy.net) for memes and shitposts, and [Daystrom Institute](https://startrek.website/c/risa?ref=thenexusofprivacy.net) for serious in-depth discussions with no memes or whinging. - [programming.dev](https://programming.dev/?ref=thenexusofprivacy.net) and [slrpnk.net](https://slrpnk.net/?ref=thenexusofprivacy.net) are also interest-focused, but have dozens of communities - [feddit.it](https://feddit.it/?ref=thenexusofprivacy.net), f[eddit.nl](https://feddit.nl/?ref=thenexusofprivacy.net), [midwest.social](https://midwest.social/?ref=thenexusofprivacy.net), [aussie.zone](https://aussie.zone/?ref=thenexusofprivacy.net), and others have a geographical focus - [beehaw.org](https://beehaw.org/?ref=thenexusofprivacy.net) is a general-interest site with a lot of communities on differnet topics that's "aspiring to be(e) a safe, friendly and diverse place," with screened signups and active moderation - [lemmy.world](https://lemmy.world/?ref=thenexusofprivacy.net) and [sh.itjust.works](https://sh.itjust.works/?ref=thenexusofprivacy.net) are also general-interest but have open registrations and less-active moderation Some of these approaches are be a better match than others for where the software is today; most obviously, until the moderation tools and scaling improves, larger instances will be a lot more challenging. Of course, with enough creativity and effort, it's often possible to work around the software's limitations and get it to work in less-obvious ways, possibly by making tradeoffs (for example giving up on "good moderation" in the short term in order to keep registrations open). With relatively-new and fast moving software, there's no substitute for experimentation – and sharing what does and doesn't work. ## A few more thoughts on moderation ### Recruit moderation teams, and put policies and processes in place In last week's post I talked about the importance of [investing in moderation tools](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/#moderation), starting with providing currently-lacking basics, and then over time breaking new ground. But tools by themselves don't solve anything. Moderation is done by people in line with the policies set by instances and specific communities (or magazines). Once the load starts to get heavy, moderation teams also need to put processes in place to make sure that reports from users get responded to, bad actors get warned and then if necessary banned, appeals can be made when needed, and so on. On Reddit, volunteer subreddit moderators perform the bulk of the moderation – Sarah Gilbert's [Towards Intersectional Moderation](https://arxiv.org/pdf/2305.11250.pdf?ref=privacy.thenexus.today) describes one large, tightly-moderated subreddit. When moderators go absent, don't enforce sitewide policies against harassment or hate speech, or are themselves the source of the problems, with Reddit employees known as "admins" step in. The same two-level approach is likely to apply in the fediverse, although right now many magazines and communities are essentially unmoderated. The good news is that there are a lot of people in the fediverse who have moderation experience – including some who have helped define policies and processes in subreddits, forums, Facebook groups, chat rooms, or other similar spaces. Anybody running an instance, or a large community or magazine, should be reaching out and looking for help right now. And policies, processes, and practices initially developed for one community can be refined into templates that are potentially more broadly useful. ### Defederation can be a useful tool People who are new to the fediverse often see it as an inherently bad thing when one instances blocks or defederates from another. After all, part of the vision of the fediverse is to have information flowing freely; instance blocking and defederation interfere with that. And [when beehaw.org defederated from lemmy.world and sh.itjust.works](https://beehaw.org/post/567170?ref=thenexusofprivacy.net), it was certainly a hassle for users who have accounts on one of those instances wanted to participate in communities on the other one. But defederation's also an incredibly valuable tool for limiting the impact of trolls and bigots hosted on loosely-moderated sites. Most Mastodon sites defederate from [hundreds of instances](https://writer.oliphant.social/oliphant/the-oliphant-social-blocklist?ref=thenexusofprivacy.net), and some have much longer lists. And that's okay! An important point is that defederation doesn't have to be permanent. When mastodon.social got hit with a wave of spammers that infected the whole fediere, some instances temporarily defederated to limit the annoyance to their users (and load on their admins and moderators) until the problem got under control. As beehaw admins said i[n their annoncement](https://beehaw.org/post/567170?ref=thenexusofprivacy.net): > this is also not a permanent judgement (or a moral one on the part of either community’s owner, i should add–we just have differing interests here and that’s fine). in the future as tools develop, cultures settle, attitudes and interest change, and the wave of newcomers settles down, we’ll reassess whether we feel capable of refederating with these communities. sh.itjust.work's admin TheDude [adds](https://sh.itjust.works/post/129725?ref=thenexusofprivacy.net) > After this happened, the beehaw admins and I had a good chat about their decision. While our stances on registration policies might diverge, we realized that our ultimate goals are aligned: we both strive to foster communities that thrive in an atmosphere of safety and respect, where users can passionately engage in discussions and feel a sense of belonging. > > Although the probability of an immediate reversal are slim given the current circumstances, I believe we have managed to identify common ground. It’s evident that, even in separation, we can unite to contribute positively to the broader fediverse community. ## Notes 1 I'd love to hear what r/AskHistorians has to say about Steve's description of developers as "landed gentry" but, like many of the 8000+ subreddits that "went dark" in a two-day blackout on June 12-13, they're continuing their protest. ### Don't tell people "it's easy", and seven more things Kbin, Lemmy, and the fediverse can learn from Mastodon (UPDATED) URL: https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/ Last updated: 2026-04-16T03:04:45.000Z *Originally published June 10; last updated June 20, with several new sections. See the* [*Update history*](#updates) *at the end for details. Thanks everybody for the great feedback on earlier versions!* > Join the discussion on [kbin](https://kbin.social/m/RedditMigration/t/66863/Don-t-tell-people-it-s-easy-and-seven-more-things-Kbin?ref=thenexusofprivacy.net), [Lemmy](https://lemmy.ml/post/1420347?ref=thenexusofprivacy.net), and [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/110583476827999524?ref=thenexusofprivacy.net) **Contents:** - [I'm flashing!!!!!](#flashing) - [But first, some background](#background) 1. [Don't tell people "it's easy"](#its-not-easy) 2. [Improve the "getting-started experience"](#getting-started) 3. [Keep scalability and sustainability in mind](#scalability) 4. [Prioritize accessibility](#accessibility) 5. [Get ready for trolls, hate speech, harassment, spam, porn, and disinformation](#harassment) 6. [Invest in moderation tools](#moderation) 7. [Experiment to find what approaches are a good fit for the current state of the software](#experiment) 8. [Values matter](#values) - [This is a great opportunity – and it won't be the last great opportunity](#opportunity) - [Ten days later ...](#ten-days-later) - [A few more thoughts on moderation](#more-on-moderation) Each section should hopefully mostly stand on its own, so feel free to pick and choose or read in whatever order you want! ## I'm flashing!!!!! > **April 2017: "**So, April, huh. Twitter changed the reply system, which everybody told them they shouldn’t do, and then removed the iconic egg avatar for new users, and suddenly all of my work of telling people that one day Twitter would do something they didn’t like and they’d need a viable alternative paid off." > > – Mastodon lead developer Eugen Rochko, [April post-mortem](http://blog.joinmastodon.org/2017/04/april-post-mortem/?ref=thenexusofprivacy.net) on joinmastodon.org > **June 2023:** "For those who are unaware, lemmy and kbin to a lesser extent are in the early stages of a rapid growth in users, similar to the one Mastodon experienced in November last year. In a move similar to Twitter, Reddit has all but confirmed that 3rd party apps will be locked out with their new API pricing .... We live in interesting times on the fediverse." > > – Ada, lemmy.blahaj.zone admin, [on Calckey](https://blahaj.zone/notes/9fhjwjtver?ref=thenexusofprivacy.net) Hey wait a second, I'm noticing a pattern here! Once again, a boneheaded move by a big tech company has once again created a huge opportunity for the decentralized social networks of the "[fediverse](https://axbom.com/fediverse/?ref=thenexusofprivacy.net)." In 2011 it was Facebook, in 2016, 2017, 2018, and 2022 it was Twitter. This time it's Reddit, whe announced that they're shutting down apps written by third party developers that tens of millions of users and moderators rely on. Unsurprisingly, redditors don't much care for the idea; there's a firestorm of protest, including hundreds of communities (aka "subreddits") already "going dark" in protest and [thousands more planning to join the Reddark on June 12](https://reddark.untone.uk/?ref=thenexusofprivacy.net). At an AMA (Ask My Anything) Friday, Reddit's CEO u/spez [threw gasoline on the flames](https://old.reddit.com/r/ModCoord/comments/145l7wp/todays%5Fama%5Fwith%5Fspez%5Fdid%5Fnothing%5Fto%5Falleviate/?ref=thenexusofprivacy.net). Even if they walk back or delay some of the changes, they've lost so much goodwill and trust that a whole lot of fedup redditors are looking for alternatives. The fediverse has always grown in waves, and it looks like the next one's in progress. The most obvious reddit alternatives in the fediverse are Kbin and Lemmy, both of which offer "link aggregation" functionality: people can post links, memes, videos from around the web, discuss them, and vote on the best posts and comments. They're both quite new, and still relatively small (last week Lemmy had thousands of active users, and Kbin's even smaller) – but they're open-source projects, so the code can improve quickly, and people or organizations can set up new instances on different websites as new homes for one or more subreddits. Even better, people on one instance can interact with people and communities on other instances – and people already in the fediverse using Mastodon, Friendica, and dozens of other software platforms can interact with Lemmy and Kbin. How cool is that? Of course, we're talking about early-stage software here, and today's reality has a lot of confusion, bugs, and limitations along with it's coolness. Kbin and Lemmy (and most other fediverse software) is nowhere near as polished as Reddit, Twitter, Instagram, and other social networks that people are used to. It doesn't yet have key safety and moderation funcationality, and may well need a lot of performance and scalability work support subreddits with millions of people yet. The compatibility with other tools still has a lot of quirks. The list goes on ... It's very similar to the situation with Mastodon in 2016-2017 (when I was one of a million or so people attracted by the idea of a "Twitter without Nazis") and again in 2022 (when millions of people checked it out in response to the Twitter acquisition). As [Lessons (so far) from Mastodon](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=thenexusofprivacy.net) and [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history/) discuss, both of those waves led to major challenges for Mastodon. Keeping up with rapid growth and responding to all the bug reports and feature requests is hard even in the best of circumstances, and a decentralized network makes everything more challenging and (for most people) confusing. Many people found Mastodon unwelcoming – especially Black people, as Dr. Johnathan Flowers discusses in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net). The wave died out in a few months. The network grew, but it also and got whiter and less queer, and the hoped-for breakthrough didn't happen. The [rapid queer-led community innovation](https://thenexusofprivacy.net/mastodon-a-partial-history/#rapid-queer-led-community-innovation) of 2016-2017 tailed off. Since then, mainline Mastodon has moved slowly, while forks, apps, and other fediverse projects continue to innovate. So it's worth looking at what we can learn from the Mastodon experience as the wave of redditors crashes in. Tactics worked well in the past might be useful again, and there may be opportunities to adapt and build on them. It's also valuable to look at what went wrong or didn't work out as well in the past, to see if there are ways to do better. Here are some initial thoughts. ## But first, some background > "The fediverse isn’t a single, gigantic social media platform like Facebook or Twitter. It’s an expanding ecosystem of interconnected social media sites and services...." > > – [The Fediverse Could Be Awesome (If We Don’t Screw It Up)](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=thenexusofprivacy.net), Cindy Cohn and Rory Mir of EFF, November 2022 The fediverse has been around in various forms since 2008 or so; [Mastodon, GNU social, and the early fediverse](https://thenexusofprivacy.net/mastodon-a-partial-history/#mastodon-gnu-social-and-the-early-fediverse) has a quick summary of the early days. It's grown in a series of waves, most recently the one late last year that followed Aprtheid Clyde and his buddies taking over Twitter. So far, each wave has crested in a month or two; some of the people who check it out decide they like it enough to hang around, although most don't. If you're coming from Reddit, the decentralized structure of the fediverse – where people on different sites (also known as "instances") can interact with each other –is a big contrast. Reddit is a centralized network, so all the subreddits are hosted on reddit.com. The fediverse is decentralized, so it's a bit more complex: - different communities (the equivalent of subreddits) are hosted on different instances. Instead of everything being on reddit.com, there's are different communities on feddit.de, beehaw.org, sopuli.xyz , kbin.social, lemmy.ml, and oodles of other sites. - people can interact with communities and people on different instances. If somebody posts something on lemmy.ml, you can potentially upvote it no matter wheher your account is on lemmy.ml, kbin.social, a popular instance lke beehaw.org, or a tiny instance you're running for your self and maybe a few friends. In return for this complexity, decentralized networks are also a lot more flexible. The company running a centralized network can suddenly change the rules and screw everybody over if [they're facing financial pressure](https://www.reuters.com/technology/reddit-lay-off-about-5-workforce-wsj-2023-06-06/?ref=thenexusofprivacy.net) or [they think it can help them go public](https://www.businessinsider.com/reddit-openai-chatgpt-ipo-valuation-karma-2023-6?ref=thenexusofprivacy.net). On a decentralized network, anybody can host their own instance, so (at least in theory) it's easy to move when someting like this happens. This flexibility is a key part of the reason why EFF thinks the fediverse could be [awesome](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=thenexusofprivacy.net) – and fed-up Redditors very likely to appreciate it too! But decentralized networks *are* more complex. As L. Rhodes says in [Here’s how it’s going to go down](https://beehaw.org/post/506929?ref=thenexusofprivacy.net) > Lemmy and Kbin are designed to do something very like what Reddit, Digg and other link-aggregating social sites do, but the fact of federating with the broader network makes certain complications impossible to avoid or ignore. And there are deliberate differences that have less to do with federation than with what the devs thing might work better. Some people adapt quickly, others don't. Some people just plain don't like it. In any case, there's a learning curve, and that's bound to be a source of friction. Another way the fediverse is more complex is that different software often uses different names for similar things. For example: > "You can follow Lemmy “communities” in Kbin, and Kbin “magazines” in Lemmy, and I believe other Fediverse groups (like Frendica groups) also federate. You can *also* follow Lemmy or Kbin users or communities from your account on another Fediverse platform, like Mastodon, and can reply to, like and boost Lemmy/Kbin posts." > > – [On Reddit and Its Federated Alternatives](https://www.jayeless.net/2023/06/on-reddit-and-alternatives.html?ref=thenexusofprivacy.net), Jessica Smith on Jayeless And reality adds a lot more complexity to these conceptual descriptions – see the thread on [How can we make the fediverse easier to adopt?](https://fedia.io/m/asklemmy@lemmy.ml/t/615/How-can-we-make-the-fediverse-easier-to-adopt?ref=thenexusofprivacy.net) or some of the examples in [the footnotes](#notes) for some examples. Still, despite the quirks, once you figure a few things out, both Kbin and Lemmy can give you a surprisingly good reddit-like experience, and some of the larger communities have over a thousand active users which isn't chopped liver. A quick summary: - KBin goes beyond Reddit's functionality to also include a "microblog" tab. The first few questions in [dannekrose's excellent Kbin FAQ](https://kbin.social/m/kbinMeta/t/11493/A-small-FAQ-to-hopefully-help-new-users-to-kbin?ref=thenexusofprivacy.net) gives a good idea of the functinality – and if you're checking out Kbin, you might want to keep it bookmarked. - Lemmy is a more straightforward "federated reddit". Ruud's [Lemmy.world starting guide](http://lemmy.world/post/37906?ref=thenexusofprivacy.net) is a good overview. Both are tiny, but growing rapidly. Kbin launched earlier this year and at the there were only a handful Kbin sites and a few hundred active users. Lemmy's been around for a couple of years, and had around 75 sites and less than 1000 active users at the beginning of June (at least [according to FediDB](https://fedidb.org/software/lemmy?ref=thenexusofprivacy.net), although fediverse statistics are notoriously unreliable). As of today, both are noticeably larger: FediDB reports a bit over 5,000 active users on KBin, and a bit less than 10,000 on Lemmy. The replies in "Differences between Kbin and Lemmy" threads by [juneten on kbin.social ](https://kbin.social/m/RedditMigration/t/12361/Difference-between-kbin-and-lemmy?ref=thenexusofprivacy.net)and by [YoTcA on feddit.de](https://feddit.de/post/781919?ref=thenexusofprivacy.net) give some good perspectives on the differences. It's worth highlighting that even though other fediverse software isn't as close a match for reddit's link aggregation functionality, it could be a good fit for reddit communities who care more about discussion than links – or could be adapted to add this functionality. So even though I'll focus mostly on Kbin and Lemmy here, a lot of this is potentially relevant to other software as well. So if all goes well, many redditors looking for alternatives may decide to check things out and stay around. Good news for the fediverse! ## 1\. Don't tell people "it's easy" > Don't tell people it's "easy" anytime. Anything is easy when you know how to do it. Learning new things is difficult and telling someone it's easy just makes people feel dumb and that they can't do it. Encourage folks to learn. > > – ozoned [on Beehaw.org](https://beehaw.org/comment/142908?ref=thenexusofprivacy.net), in a comment on the original version of this article. Yeah really. For many people, very much including me, the Fediverse *isn't* easy. It gets easier over time as you figure things out and get used to the quirks, but I've been on Mastodon since 2017 and I still find it very complex – and sometimes confusing, too, like when I click on a link and it unexpectedly opens up in a window that's not logged in anywhere, or the way posts federate means I don't see all of a conversation. Also the terminology can be off-putting for newcomers. ![Everny Mastodon explanation is like "it's very simple, your account is part of a kerflunk, and each kerflunk can talk to each other as a part of a blumburt ..."](https://thenexusofprivacy.net/content/images/2023/06/kinda-like-email.png) Hopefully it will get easier over time but that hasn't happened yet with Mastodon. And yet, you constantly hear people talking about how easy it is – which implies that anybody who doesn't think it's easy must be stupid, incompetent, or doing something wrong. *This is not helpful*. It's annoying and drives people away. So don't say it. As [the examples in the footnotes](#notes) highlight, Kbin and Lemmy have similar quirks. That's okay! I mean, it's not ideal, but it is what it is; the developers are doing what they can to improve things, guides are betting better quickly, hopefully it'll get easier over time – and it's not like you need an advanced degree in computer sicence to figure it out. But it's not easy! So please don't misset expectations and alienate people by telling them that it is! And while you're at it, also don't say "it's good that it's hard to sign up, it keeps the quality high." As well as being annoying, that's elitist. And besides, think about it for a second: if it were harder to sign up for Gab, would that make the quality higher? Of course not. ## 2\. Improve the getting-started experience Less than 20% of the accounts that have signed up on Mastodon in the last year are still active,. That's actually better than it sounds: in Twitter's or Google+'s early days, the number was less than 10%. Most people who check out a new social network don't stick around. A good way to make it more likely that people will stay around is to focus on improving their initial experience. People are a lot more likely to stay around if things start off on a good note – and a lot less likely if they get frustrated or (as well'll discuss below) greeted with hate speech or racist abuse. So while you're never going to make everybody happy, putting work into improving the getting-started experience for new users can make a big difference. A couple of specific tactics that could be useful here: - **Make sure "getting started" guides are easy to find for new and potential users**. The simple three-screen "welcome modal" Shel Raphen designed for Mastodon in 2017 had a big impact, and the joinmastodon.org "hub" site has also been helpful, but those certainly aren't ot the only approach – templates for a well-written short pinned posts on communities and instances could also be very effective, and as long as reddit doesn't censor it people could share it there to help people who haven't yet moved get started. Lemmy already has joinlemmy.org (althogh like any website there's room for improvement) and I've seen drafts of a couple short getting-started guides, so things are on the right track (although I'm not sure about the Kbin world), but more time and energy directed here is likely to pay a lot of dividends. - **Make it easy for people to avoid instances where racism, anti-LGBTQ+ and anti-Muslim bigotry, and other forms of bigotry hate speech are tolerated**. In response to Gab, Mastodon introduced the [Mastodon Server Covenant](https://joinmastodon.org/covenant?ref=thenexusofprivacy.net) requiring sites to commit to "active moderation against racism, sexism, homophobia and transphobia" in order to be listed.... which is a good first step, although needs to be expanded to other forms of bigotry targeting Muslims, disabled people, immigrants and other groups. But policies by theyselves aren't enough; good moderation is also needed: anti-Muslim content is visible on several prominent Lemmy sites, and [there are concerns about moderation on the flagship lemmy.ml](https://lemmy.world/comment/43639?ref=thenexusofprivacy.net). As I said [on lemmy.blahaj.zone](https://lemmy.blahaj.zone/comment/32008?ref=thenexusofprivacy.net), > "As we’ve seen on Mastodon, if a Black user goes to a site where racism is tolerated and quickly encounters racist sh\*t, they leave and tell their friends; ditto for trans, queer, Muslim, etc. users having bad initial experiences. Once that happens a bunch of times the reputation becomes hard to shake." - **Give instance admins control over their "landing page" so they can give the right information to potential users**. Just what information that is depends on the instance. For example, instances that so many communities that a list would be overwhelming might decide that it's best to show a list of top local posts. Instances that host a handful of communities might be better off having a list of communities be the landing page. Instances with a single community, designed as a home for an individual subreddit, might want to show the community on the main page – or a welcome post, telling people how to log in. Mastodon's often resistant to giving admins options like this, but "once size fits all" usually doesn't fit everybody equally well. ## 3\. Keep scalability and sustainability in mind > Scaling is hard was probably the main lesson 😀 > > – Ryan Wild, admin of masodonapp.uk, [on Mastodon](https://indieweb.social/@wild1145@mastodonapp.uk/110510262312035966?ref=thenexusofprivacy.net) When a surge happens, everybody's overwhelmed. Instances allowing open registrations get so many signups that they have to add new hardware capacity, and often don't have the moderation resources to keep up. Instances that screen registrations for new users want to turn things around as quickly as possible, but have to deal with hundreds or thousands a day. Dev teams need to deal with performance issues, critical bug fixes, and urgently-needed improvements – while also supporting instance admins and developers, who on the one hand are helping to spread the load but on the other hand are one more demand on already-scarce time. There isn't any magic answer here: scaling *is* hard, and even large commercial sites can have problems keeping up with intense surges. Still, one key lesson is the importance of spreading people out to multiple well-moderated instances to overloading the flagship and other big instances. In principle, by allowing people from one instance to interact with each other instances, the fediverse makes this easy. In practice, it's more complicated. Asking people to choose an instance right off the bat, before they've had any experience with the platform or even know what the implications of choosing an instance are, can be a huge barrier. So it's tempting to try to simplify things by pointing everybody to a default instance but that doesn't scale: every significant surge to Mastodon has led to mastodon.social having to close down signups for a while. So landing pages and guides that help people through the process of choosing an instance are crucial – and so are hosting services making it easy for non-techies to set up their own instances ([Elestio has just introduced $10/month Lemmy hosting](https://elest.io/fully-managed-services?ref=thenexusofprivacy.net)), good instructions for how people can set up their own instances, community support for when they run into problems, and best practies for admins to scale their instances. More positively, since smaller fediverse instances tend to retain more active users, this is a great opportunity to shape the network; [Marcel Costa's analysis](https://socialhub.activitypub.rocks/t/analysis-of-fediverse-diversity-in-terms-of-decentralization/3252?ref=thenexusofprivacy.net) shows that Masotodon decentralized significantly as a result of the November 2017 surge. That's good! But it was pretty exhausing for all concerned. As mas.to admin Rodti Macleary said in February's [The Mastodon Bump Is Now a Slump](https://www.wired.com/story/the-mastodon-bump-is-now-a-slump/?ref=thenexusofprivacy.net), “I loved Mastodon for fun. For a little while, Mastodon became work. I came quite close to burnout at the end of last year.” Which brings me to a few other key lessons for instance admins: - build teams place to help with moderation, system administration, and support - put a funding structure on place (via patreon, ko-fi, LiberaPay, or a sponsorship mechanism) to deal with ongoing costs. - if things are starting to get overloaded, put the brakes on growth to keep from having to choose between burning out and giving people a bad experience. As long-time fediversian Michał "rysiek" Woźniak says > "Manage your spoons well. > > The wave of sign-ups will come and go, but burn-out or some bad moderation decisions will affect a community for a long, long time. > > It's better to slowly but reliably build a small, resilient, safe space than to try to go hockey-stick on sign-ups only to have people get burnt, abandon their accounts, and tell their friends about it." \[If you're not familiar with "spoon theory", it's a metaphor describing the amount of physical and/or mental energy that a person has available for daily activities and tasks, and how it can become limited. The term was originally coined by writer and blogger Christine Miserandino in 2003 as a way to express how it felt to have lupus and is now used widely in the disability community. [What The ‘Spoon Theory’ Means for People Living With Chronic Illnesses, Disabilities](https://theswaddle.com/what-the-spoon-theory-means-for-people-living-with-chronic-illnesses-disabilities/?ref=thenexusofprivacy.net) is a good discussion.\] ## 4\. Prioritize accessibility > "One of our moderators, [u/itsthejoker](https://old.reddit.com/u/itsthejoker?ref=thenexusofprivacy.net), has had multiple hour-long calls with various Reddit employees. However, as of the current time, our concerns have gone unheard, and Reddit remains firm." > > – r/Blind moderators in [Reddit’s Recently Announced API Changes, and the future of the /r/blind subreddit](https://www.reddit.com/r/Blind/comments/13zr8h2/reddits%5Frecently%5Fannounced%5Fapi%5Fchanges%5Fand%5Fthe/?ref=thenexusofprivacy.net), While reddit killing third-party apps is bad for users and moderators in general, it's even worse for blind users and moderators. Reddit's own software doesn't play well with screenreaders and other assistive technologies. As a result, third-party apps like Apollo, Reddit for Blind, and Luna for Reddit are crucial for blind users to be able to participate. Reddit now says they're going to continue to allow non-commercial accesibiity apps, although won't give a list of criteria and it's also demanding free labor from developers who want to help blind people so it is not by any means a good solution. Reddit not prioritizing the needs of blind users is nothing new. > "We would also like to note that [r/blind](https://www.reddit.com/r/blind/?ref=thenexusofprivacy.net), [u/rumster](https://www.reddit.com/u/rumster/?ref=thenexusofprivacy.net) in particular, have continuously contacted Reddit over accessibility concerns, over the past 3 years, having received no substantive response." > > – MostlyBlindGamer, in a reddit [comment](https://www.reddit.com/r/Blind/comments/13zr8h2/comment/jnbkjed/?utm%5Fsource=reddit&utm%5Fmedium=web2x&context=3) So now's a great opportunity for KBin, Lemmy, and the fediverse to collectively show that they're not like reddit – and attract a bunch of people who are tired of being ignored. KBin and Lemmy both have some accessibility problems now (as does most Fediverse software), but most of these problems are fairly easy if developers decide to take the time. It hasn't been prioritized to date – but it's easy enough to change that. The [Accessibility](https://thenexusofprivacy.net/mastodon-a-partial-history/#accessibility) section of [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history/) has examples of successful community-driven development worth emulating, like [Changeling’s Guide to Mastodon for Screen Reader Users](https://www.starshipchangeling.net/mastodon/?ref=thenexusofprivacy.net) and the highly-accessible[ Pinafore](https://pinafore.social/?ref=thenexusofprivacy.net) web client, created by Nolan Lawson. Lawson's[ What I’ve learned about accessibility in SPAs](https://nolanlawson.com/2019/11/05/what-ive-learned-about-accessibility-in-spas/?ref=thenexusofprivacy.net) talks about Marco Zehe's "patient coaching" and [comments on the Pinafore GitHub repo](https://github.com/nolanlawson/pinafore/issues?q=is%3Aissue+author%3Amarcozehe+is%3Aclosed&ref=thenexusofprivacy.net) as a "treasure trove of knowledge," and illustrates how much help and support can be available when people sincerely reach out. Then again Mastodon also provides example of what not to do here. The main dev team hasn't prioritized implementing alt text on images: it took over a year to implement originally, so it wasn't available during the April 2017 wave; configurable message lengths and underlined links, both valuable for accessibility, have been implemented for years in forks but aren't well supported in the mainline branch.[2](#notes) Hopefully Lemmy and KBin will do better on this front – and Mastodon and other fediverse software will also take the opportunity to start improving their own platforms' accessibility. ## 5\. Get ready for trolls, hate speech, harassment, spam, porn, and disinformation Yeah, all of those exist already – and on reddit too – but the scale's likely to increase siginificantly. > **Update, June 28**: exploding-heads.com quickly became s a hotbed of trolling, hate speech, and harassment. [Lemmy.world Admin Response to Defederation from Exploding Heads](http://lemmy.world/post/747912?ref=thenexusofprivacy.net) has some receipts. KBin and Lemmy have more tools than Diaspora did back in the day (they're more comparable to Mastodon in very early 2017), but it's not clear how much they've focused on these issues yet – there's still a lot more that could be done here. For example: - **Provide individual users the ability to block instances.** Mastodon's innovation of instance-level blocking – allowing instances or individual users can block everything from a site that's a source of harassment, trolling, or just unwanted content – allowed users and sites wanted to avoid interactions with channer, shitposting, and Nazi instances. [Lemmy currently doesn't allow individual users to block instances ](https://github.com/LemmyNet/lemmy/issues/2397?ref=thenexusofprivacy.net)(although admins can), and multiple people have already requested this functionality. - **Work out a process for community-curated instance block lists.** If each new instance has to learn the hard way that there are some well-known bad actor sites out there, a lot of users and admins will have unnecessarily bad early experiences. But having the main dev team curate block lists (an approach Mastodon has wisely stayed away from) risks centralizing power even further. Community-led processes like the [Oliphant.social block lists](https://writer.oliphant.social/oliphant/the-oliphant-social-blocklist?ref=thenexusofprivacy.net) and [The Bad Space](https://thebad.space/about?ref=thenexusofprivacy.net) are a good alternative – and may well be useful starting points. A couple of key points in the implementation: there need to be are good instructions for admins on how to adopt them and subscribe to updates; and new instances should be srongly encouraged to adopt at least a "Tier 0" blocklist of the literally hundreds of known bad actors that are already widely blocked. - **Be ready to respond when spammers and harassers start to take advantage of open registrations or communities that anybody can share to.** As Brian Krebs' [Interview With a Crypto Scam Investment Spammer](https://krebsonsecurity.com/2023/05/interview-with-a-crypto-scam-investment-spammer/?ref=thenexusofprivacy.net) highlights, the fediverse has gotten big enough that it's worth spamming, and sites with open registration make spammers lives very easy. Mastodon responded by introducing a captcha on signup, which puts in a speed bump for spammers at the cost of making things more difficult for people with vision or motor challenges. Turning off open registrations, at least temporarily, may be a better option. **Updates** **June 18**: beehaw.org cited problems caused by open registration policy as one of its [reasons](https://beehaw.org/post/567170?ref=thenexusofprivacy.net) for defederating from lemmy.world and sh.itjust.works **June 23**: Good news: there are over 2.2 million Lemmy accounts! Bad news: [over 90% of Lemmy accounts are now bots](https://lemmy.fmhy.ml/post/235195?ref=thenexusofprivacy.net). Looking at [FediDB's statistics](https://fedidb.org/software/lemmy?ref=thenexusofprivacy.net), there are plenty of instances with tens of thousands of users and only one or two posts, so they haven't started actively spamming yet, but I'm sure it's only a metter of time. **June 28**: [A tale of a new Lemmy instance, a bot infestation, the fallout, and how we dealt with it](https://lemmy.ninja/post/30492?ref=thenexusofprivacy.net) discussess lemmy.ninja's experience "\[A\]ssuming we were small and beneath notice, we opened our registration for a few days until we could figure out if the problems we were experiencing were configuration related or software bugs. In that brief time, we were discovered by malicious actors and hundreds of new bot users were being created on the site. Of course we had no idea, since Lemmy provides no user management features. We couldn’t see them, and the bots didn’t participate in any of our local content." Turning on a captcha and activate email validation prevented new bots from signing up. However, the captcha feature was eliminated in Lemmy 0.18.0\. Captchas are problematic from an accessibility perspective, and attackers can work around them, so it's hard to know how much of a difference this'll make. We shall see. - **"NSFW" flags aren't enough.** Porn is popular on reddit. Many fediverse instances don't want to host porn, because of concern about legal liability or other reasons. Not only that, different jurisdictions and cultures often see things diffferently in terms of what is and isn't legal or acceptable: in early 2017 Mastodon faced a dicey situation around sharing images that were completely legal in Japan but consider very risky by many Western sites,. Mastodon does have some tools like the "reject media" federation option and content warnings (CWs), althouth their far from sufficient and cause challenges of their own: CWs haven't been improved signiicantly since it was first introduced in 2017 and have led to constant battles about norms and racialized CW abuse. A far as I can tell, Lemmy and KBin currently only have an optional NSFW flag to put on posts – even farther from sufficient. beehaw.org, currently the third-largest site after the flagsnhip lemmy.ml and the tankie lemmygrad.ml, has a NSFW policy, and it wouldn't surprise me if they and other similar sites wind up developing a fork. **Update, June 20**: [Can LEMMY.BLAHAJ.ZONE defederate with LemmyNSFW?](http://0.0.0.0/post/206021?ref=thenexusofprivacy.net) illustrates some of the problems. LemmyNSFW doesn't mark all its NSFW content as NSFW; and, since NSFW is the only option, it uses the same tag for all porn, including variants like rape porn that many find offensive and don't want to see. But filtering out all NSFW content isn't a good solution either, because some people use the tag for discussions of trans issues relating to bottom surgery. **Update, August 10**: [lemmy.blahaj.zone defederated from LemmyNSFW](https://lemmy.blahaj.zone/post/1204784?ref=thenexusofprivacy.net) a couple of weeks ago. Here's [lemmyNSFW's admin's perspective](https://lemmynsfw.com/comment/683532?ref=thenexusofprivacy.net). [A few more thoughts on moderation](#more-on-moderation), below, has some additional thoughts. **Update, June 23**: [Oh dear](https://lemmy.world/post/509808?ref=thenexusofprivacy.net). [![WFT: My feed is entirely Greg's 3 day poop memes](https://thenexusofprivacy.net/content/images/2023/06/Screen-Shot-2023-06-24-at-12.56.04-AM.png)](https://lemmy.world/post/509808?ref=thenexusofprivacy.net) Screenshot from lemmy.world, June 2023 The front page of fedia.io is also all poop. I hate it when that happens. **Update, August 10**: lemmy.world notes that there's [an obstacle to closing open registrations](https://github.com/LemmyNet/lemmy-ui/issues/2051?ref=thenexusofprivacy.net): the message on the signup page telling people about joinlemmy.world, where they can find other instances, is only shown on lemmy.ml. Meanwhile, [lemmy.world has been under a DDOS attack](https://lemmy.world/post/2923697?ref=thenexusofprivacy.net): > *"So who is attacking us?* One thing that is clear is that those responsible of these attacks know the ins and outs of Lemmy. They know which database requests are the most taxing and they are always quick to find another as soon as we close one off. That’s one of the only things we know for sure about our attackers. Being the biggest instance and having defederated with a couple of instances has made us a target." **Update, August 29**: [attackers spammed lemmy.world's lemmyshitpost community with CSAM (child sexual abuse material)](https://lemmy.world/post/4018526https://jamie.moe/post/113630?ref=thenexusofprivacy.net), which then got federated out to other instances. In response, [lemmy.world turned off open registration](https://lemmy.world/post/3995057?ref=thenexusofprivacy.net), but it didn't help: attackers continued to post from other instances. So they wound up [closing lemmyshitpost](https://lemmy.world/post/4018526?ref=thenexusofprivacy.net) ... although it would be easy enough for attackers to switch to another community, so we'll see how effective that is. It's a difficult situation for other instances as well as lemmy.world. "Purging" the federated posts didn't delete the images, there's no way to disable image caching, and limitations of the moderation tools mean that admins have to view unblurred images to decide what to delete. Disabling image uploads leads to some unexpected error messages. There isn't any equivalent of Mastodon's "reject-media" option. The list goes on.... lemm.ee's short-term [mitigation plan](https://lemm.ee/post/5905754?ref=thenexusofprivacy.net) includes disabling image uploads, deleting all images that have been downloaded from other sites, and applying a patch to prevent future downloads of images from other sites. db0 ([lead developer of AI Horde](https://nivenly.org/blog/2023/08/14/a-deeper-dive-into-haidra/?ref=thenexusofprivacy.net)) contributed [a script that uses attempts to identify problematic images and delete them](https://github.com/db0/lemmy-safety?ref=thenexusofprivacy.net), although it has a lot of false positives (and it's not clear how this interacts with mandatory reporting requirements in the US). ## 6\. Invest in moderation tools > "Reddit admins have had 8 years to build a stronger infrastructure to support moderators but have not. " > > – Sarah Gilbert, [AskHistorians and uncertainty surrounding the future of API access](https://www.reddit.com/r/AskHistorians/comments/142w159/askhistorians%5Fand%5Funcertainty%5Fsurrounding%5Fthe/?ref=thenexusofprivacy.net) As Gilbert's outstanding description of the situation discusses, Reddit's underinvested in moderation tools for years. Alas, ever since 2017 , so has Mastodon. And so has every other fediverse software platform I can think of. Now's a great opportunity to change that. In the short term, there could be a lot of leverage porting the moderation tools that have been developed for reddit – or finding ways to replicate their functionality in a federated environment. Moderator time is often the scarcest resource during a high-growth surge, and if moderators can't keep up with the load there will be more spam, disinformation, racism, harassment, and people having bad experiences. Tools can amplify their efforts, and potentially let people who don't have as much moderation experience help more effectively. And done right, these tools evolve to work on other fediverse software, where there's certainly room for improvement. But why stop there? > In this study, I perform a collaborative ethnography with moderators of r/AskHistorians, a community that uses an alternative moderation model, highlighting the importance of accounting for power in moderation. > Drawing from Black feminist theory, I call this “intersectional moderation.”... To ensure the successful implementation of intersectional moderation, I argue that designers should support decision-making processes and policy makers should account for the impact of the sociotechnical systems in which moderators work. > > – > [Towards Intersectional Moderation: An Alternative Model ofModeration Built on Care and Power](https://arxiv.org/pdf/2305.11250.pdf?ref=thenexusofprivacy.net), Sarah Gilbert, J . ACM, Vol. 37, No. 4, Article 111\. Publication date: August 2023. New tools designed to center the voices of those who are directly impacted by the outcomes – designed from the beginning to prioritize accessibility, consent, safety, privacy and other community needs that current fediverse software doesn't handle well – could be truly transformational. Sure, easier said than done, but this is a good opportunity to make progress. ## 7\. Experiment to find what approaches are a good fit for the current state of the software Mastodon instances run the gamut from single-person instances, relatively-small communities, and big general purpose sites. Over time, techniques have been refined for the different approaches – Darius Kazemi's [How to run a small social network site for your friends](https://runyourown.social/?ref=thenexusofprivacy.net), for example, is an invaluable resource. But unsurprisingly, the software itself is a better match for some approaches than others; mainline Mastodon, for example, has consistently de-emphasized functionality that's very useful for smaller community-focused instances (in contrast to forks like Hometown and Glitch) KBin and Lemmy are similarly flexible enough that that they're getting deployed in a lot of different ways. For example: - [startrek.website](https://startrek.website/?ref=thenexusofprivacy.net) hosts three related communities: [Star Trek](https://startrek.website/c/startrek?ref=thenexusofprivacy.net) for news and discussion (and a bit of slash fic), [Risa](https://startrek.website/c/risa?ref=thenexusofprivacy.net) for memes and shitposts, and [Daystrom Institute](https://startrek.website/c/risa?ref=thenexusofprivacy.net) for serious in-depth discussions with no memes or whinging. - [programming.dev](https://programming.dev/?ref=thenexusofprivacy.net) and [slrpnk.net](https://slrpnk.net/?ref=thenexusofprivacy.net) are also interest-focused, but have dozens of communities - [feddit.it](https://feddit.it/?ref=thenexusofprivacy.net), f[eddit.nl](https://feddit.nl/?ref=thenexusofprivacy.net), [midwest.social](https://midwest.social/?ref=thenexusofprivacy.net), [aussie.zone](https://aussie.zone/?ref=thenexusofprivacy.net), and others have a geographical focus - [beehaw.org](https://beehaw.org/?ref=thenexusofprivacy.net) is a general-interest site with a lot of communities on differnet topics that's "aspiring to be(e) a safe, friendly and diverse place," with screened signups and active moderation - [lemmy.world](https://lemmy.world/?ref=thenexusofprivacy.net) and [sh.itjust.works](https://sh.itjust.works/?ref=thenexusofprivacy.net) are also general-interest but have open registrations and less-active moderation Some of these approaches are be a better match than others for where the software is today; most obviously, until the moderation tools and scaling improves, larger instances will be a lot more challenging. Of course, with enough creativity and effort, it's often possible to work around the software's limitations and get it to work in less-obvious ways, possibly by making tradeoffs (for example giving up on "good moderation" in the short term in order to keep registrations open). With relatively-new and fast moving software, there's no substitute for experimentation – and sharing what does and doesn't work. ## 8\. Values matter > Policies against racism, sexism, discrimination against gender and sexual minorities, and Nazis are extremely appealing positioning these days. > > – [Lessons (so far) from Mastodon](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=thenexusofprivacy.net), 2017 It's still true! Mastodon's April 2017 influx was catalyzed by Sarah Jeong's [Mastodon is like Twitter without Nazis](https://www.vice.com/en/article/783akg/mastodon-is-like-twitter-without-nazis-so-why-are-we-not-using-it?ref=thenexusofprivacy.net) and the November 2022 wave was triggered by transphobic Apartheid Clyde's acquisition of Twitter. And when [Gab switched to Mastodon’s code in 2019, ](http://blog.joinmastodon.org/2019/07/statement-on-gabs-fork-of-mastodon/?ref=thenexusofprivacy.net)Mastodon BDFL (Benevolent Dictator for Life) Eugen Rochko stated his opposition to Gab’s philosophy, which he accurately described as using "he pretense of free speech absolutism as an excuse to platform racist and otherwise dehumanizing content" ... and virtually every Mastodon instance blocked Gab. This decisions remains widely popular; in [a recent poll](https://indieweb.social/@jdp23/110449505980762006?ref=thenexusofprivacy.net) I did, over 90% of respondents thought that Gab should be blocked. Of course, the policies aren't enough. As Dr. Johnathan Flowers discusses in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), "Mastodon has a history of being inhospitable to marginalized users." [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) discusses several examples of racism and white supremacy on Mastodon in 2017\. As a result, Mastodon's got a problematic – although thoroughly deserved – reputation for anti-Blackness. Lemmy also has a reputation. > I’ve been aware of Lemmy for a long time, but I’ve always been somewhat wary of it because it’s developed by tankies, and its flagship server (lemmy.ml) has a history of tolerating/encouraging tankie politics.... There’s just no way I could feel comfortable in a community that supports the right-wing nationalist Putin’s [war on Ukraine](https://www.jayeless.net/wiki/2022-russian-invasion-of-ukraine.html?ref=thenexusofprivacy.net), or outright denies the [harsh repression meted out against Muslims in China](https://www.jayeless.net/wiki/repression-in-xinjiang.html?ref=thenexusofprivacy.net). I’m far from the only one leery of Lemmy for this reason – [the FediTips Mastodon account doesn’t recommend it ](https://mstdn.social/@feditips/110476830253102884?ref=thenexusofprivacy.net), either. > > – Jessica Smith, [On Reddit and Its Federated Alternatives](https://www.jayeless.net/2023/06/on-reddit-and-alternatives.html?ref=thenexusofprivacy.net) You don't have to scroll too far down the list of sites on joinlemmy.org to find more than one hosting anti-Muslim content. That's not good. And posts from these sites show up on lemmy.ml, so there's anti-Muslim content on the flagship instance. That's also not good. It's possible that it's a combination of understaffed or undertrained moderators and a few anti-Muslim instances, and once everybody improves their moderation and defederates the bad actors the problem will go away. Time will tell. And whether or not that happens, Lemmy's developers are reportedly [tankies](https://en.wikipedia.org/wiki/Tankie?ref=thenexusofprivacy.net), which is a problem for a lot of people. It wouldn't surprise me at all if there's a fork. > **Update, December 2025**: nope. Or at least not yet. The discussion [Does Lemmy need a fork or a rewrite due to its maintainers views?](https://piefed.social/c/fediverse/p/1603888/does-lemmy-need-a-fork-or-a-rewrite-due-to-its-maintainers-views?ref=thenexusofprivacy.net), on piefed.social, suggests that the reason why is that people who don't agree with the Lemmy dev's politics have instead shifted to working on alternatives like piefed and mbin. More positively, though, defederation from bigoted sites is one of the fediverse's good features, and forks can have a very positive effect. And with Twitter's transformation into an openly right-wing, racist, anti-LGBTQ+ pro-authoritarian, disinfo media network, whatever segment of the fediverse offers an alternative is going to continue to be very appealing! ## This is a great opportunity – and it won't be the last great opportunity There's a lot more that can be said ... but this is long enough already, so I'll leave the rest to discussions in the fediverse and perhaps future posts. But since I spent so much of this post focusing on past screwups and likely problems, I'm going to wrap up on a positive note. This is quite likely to be the biggest wave to the fediverse yet. It'll be interesting to see how things go, especially during the June 12 Reddit blackout, but if even a small fraction of the people who want to check things out wind up staying around, the network could grow significantly. Not only that, the surge of interest is likely to be a shot in the arm for other fediverse software as well as KBin and Lemmy. > "For many of us, the details of the API changes are not the most important point anymore. This decision, and the subsequent interaction with users by admins to justify it, have eroded much of the confidence and trust in the management of reddit that they have been working so hard to regain." > > – BuckRowdy, [Reddit held a call today with some developers regarding the API changes](https://www.reddit.com/r/ModCoord/comments/143rk5p/reddit%5Fheld%5Fa%5Fcall%5Ftoday%5Fwith%5Fsome%5Fdevelopers/?ref=thenexusofprivacy.net) And no matter what happens, this is far from the last opportunity. Reddit may well make enough concessions in the short term to keep people around for a while ... but the writing's on the wall, so as soon as alternatives fediverse are good enough for enough people, we'll start to see significant movement, and the [Reddark](https://reddark.untone.uk/?ref=thenexusofprivacy.net) will turn into a Rexxit. > People try out the Fediverse, only to drift back to the corporate platform. Then six months later, a year, two years, something new comes up. The platform finds a new way to alienate users, and some subset of them will go hunting through their email to figure out which Fediverse server their forgotten account is on, and what login name they used. (Trust me: keep that info somewhere you can find it.) > > – L. Rhodes in [Here’s how it’s going to go down](https://beehaw.org/post/506929?ref=thenexusofprivacy.net) on Beehaw.org Meanwhile Twitter's doubling down on the "toxic hellscape" strategy, with Apartheid Clyde now talking about disalbing blocking. What could possibly go wrong? If he does that, there's going to be another major exodus; even if he doesn't, anybody who doesn't want to spend their time in a racist, transphobic, hard-right-wing, disinfo-filled environment will continue to look for alternatives.. And while [Facebook/Instagram/Meta's new ActivityPub-compatible Twitter competitor](https://www.theverge.com/2023/6/8/23754304/instagram-meta-twitter-competitor-threads-activitypub?ref=thenexusofprivacy.net) will bring surveillance capitalism and an embrace-extend-dominate mindset to the fediverse, it could potentailly also bring connections with Oprah, the Dalai Lama, and 2 billion Instagram users. So that's a huge opportunity as well. As Ada says, it's interesting times in the fediverse. ## Ten days later ... Tens of thousands of people have signed up for KBin and Lemmy accounts since I first published this post, hundreds of new instances have been created, and "the threadiverse" is suddenly a hot topic of conversation. As expected, many of the newcomers initially found the experience somewhat confusing, especially the federation aspects... but most got the gist of it fairly quickly, and there are plenty of vibrant discussions on multiple topics. As Asif Youssuff's [Unofficial Subreddit Migration List](https://www.quippd.com/writing/2023/06/15/unofficial-subreddit-migration-list-lemmy-kbin-etc.html?ref=thenexusofprivacy.net) and the [sub.rehab list](https://sub.rehab/?ref=thenexusofprivacy.net) illustrate, more and more subreddits are exploring alternatives. Of course, it hasn't all gone smoothly. The moderation functionality of KBin or Lemmy is waaaaaaay weaker than Reddit – and for that matter, weaker than Mastodon's functionality today. So with limited tools, it's been a real challenge to keep trolling, [spam, and porn](https://kbin.social/m/kbinMeta/t/35027/Spam-and-porn-are-flooding-kbin-already?ref=thenexusofprivacy.net) under control. In that and many other ways, the software's not yet ready for prime time. But the opportunity's not going away. Reddit CEO Steve Huffman is [tripling down](https://www.techdirt.com/2023/06/16/reddit-ceo-triples-down-insults-protesters-whines-about-not-making-enough-money-from-reddit-users/?ref=thenexusofprivacy.net), and generally throwing gasoline on the fire. [Thousands of moderators are keeping their subreddis private](https://www.nytimes.com/2023/06/20/business/media/reddit-moderators-api-protest.html?ref=thenexusofprivacy.net) despite the company's following through on their threats to remove volunteer moderators (who Huffman described as "[landed gentry](https://www.theverge.com/2023/6/15/23762868/reddit-ceo-steve-huffman-interview?ref=thenexusofprivacy.net)")[3](#notes). Other subreddits are opening up but [continuing the protest in creative ways](https://www.businessinsider.com/reddit-community-is-protesting-by-posting-sexy-john-oliver-photos-2023-6?ref=thenexusofprivacy.net). As Yousuff points out, Reddit's reactions are [a clear sign that the protests are working](https://www.quippd.com/writing/2023/06/18/reddit-is-sowing-division-in-mod-teams-because-protest-is-working.html?ref=thenexusofprivacy.net). [It's going to be very hard for Reddit to recover trust](https://www.wired.com/story/the-reddit-blackout-is-breaking-reddit/?ref=thenexusofprivacy.net) after the "[brutal blackout](https://www.theguardian.com/technology/2023/jun/20/techscape-reddit-blackout-forums-ipo-profit?ref=thenexusofprivacy.net)", so even if they somehow cobble together enough moderators to keep going and people reluctantly stay there for a while, everybody will keep looking for alternatives. In fact, just as I was sharing this update post to kbin, [I saw that r/blind has set up their own Lemmy instance](https://rblind.com/?ref=thenexusofprivacy.net). And just as with similar waves to the fediverse in the past, there's also a surge of developers getting involved – contributing bug fixes and new functionality, userscripts to customize the experience, and starting to work on apps. As [KBin developer Ernest](https://kbin.social/m/random/p/444184/-/reply/773052?ref=thenexusofprivacy.net) says, > We have challenging times ahead. We need to cover critical functions in the code, develop better moderation tools, focus on performance, and create user-friendly documentation. By doing so, it will be much easier. And I intentionally use the word "we" because what is happening on Codeberg is absolute madness. > > – [KBin developer Ernest](https://kbin.social/m/random/p/444184/-/reply/773052?ref=thenexusofprivacy.net), in response to fedia.io admin Jerry Bell Yeah really. As I write this, there are over 40 active "pull requests" (code contributions) in [KBin's source code repository on Codeberg](https://codeberg.org/Kbin/kbin-core/pulls?ref=thenexusofprivacy.net); Lemmy has almost 20 pull requests [on Github](https://github.com/LemmyNet/lemmy-ui/pulls?ref=thenexusofprivacy.net). And I'm sure both code bases will improve significantly. Mastodon's influx in 2016-2017 led to a period of [rapid community innovation](https://thenexusofprivacy.net/mastodon-a-partial-history/#rapid-queer-led-community-innovation) and similar things are happening in the threadiverse (the suddenly-hot subset of the fediverse including KBin, Lemmy, and other federated threaded-discussion software). That's good! Looking at the dynamics of the last week, the lessons I highlighted here all remain very relevant. As I said in that post, though, there's a lot more that can be said. So I added a new section above on [Experiment to find what approaches are a good fit for the current state of the software](#experiment), and am including a few more thoughts on moderation below. ## A few more thoughts on moderation *These complement the discussion in* [*Get ready for trolls, hate speech, harassment, spam, porn, and disinformation*](#harassment)*, and perhaps I'll merge them into that section later. But that section's already quite long, and the format here is somewhat different, I'm putting it here for now 😎* ### Recruit moderation teams, and put policies and processes in place There's an entire section above talking about [investing in moderation tools](https://thenexusofprivacy.net/kbin-lemmy-fediverse-learnings-from-mastodon/#moderation), starting with providing currently-lacking basics, and then over time breaking new ground. But tools by themselves don't solve anything. Moderation is done by people in line with the policies set by instances and specific communities (or magazines). Once the load starts to get heavy, moderation teams also need to put processes in place to make sure that reports from users get responded to, bad actors get warned and then if necessary banned, appeals can be made when needed, and so on. On Reddit, volunteer subreddit moderators perform the bulk of the moderation – Sarah Gilbert's [Towards Intersectional Moderation](https://arxiv.org/pdf/2305.11250.pdf?ref=privacy.thenexus.today) describes one large, tightly-moderated subreddit. When moderators go absent, don't enforce sitewide policies against harassment or hate speech, or are themselves the source of the problems, with Reddit employees known as "admins" step in. The same two-level approach is likely to apply in the fediverse, although right now many magazines and communities are essentially unmoderated. The good news is that there are a lot of people in the fediverse who have moderation experience – including some who have helped define policies and processes in subreddits, forums, Facebook groups, chat rooms, or other similar spaces. Anybody running an instance, or a large community or magazine, should be reaching out and looking for help right now. And policies, processes, and practices initially developed for one community can be refined into templates that are potentially more broadly useful. ### Defederation can be a useful tool People who are new to the fediverse often see it as an inherently bad thing when one instances blocks or defederates from another. After all, part of the vision of the fediverse is to have information flowing freely; instance blocking and defederation interfere with that. And [when beehaw.org defederated from lemmy.world and sh.itjust.works](https://beehaw.org/post/567170?ref=thenexusofprivacy.net), it was certainly a hassle for users who have accounts on one of those instances wanted to participate in communities on the other one. But defederation's also an incredibly valuable tool for limiting the impact of trolls and bigots hosted on loosely-moderated sites. Most Mastodon sites defederate from [hundreds of instances](https://writer.oliphant.social/oliphant/the-oliphant-social-blocklist?ref=thenexusofprivacy.net), and some have much longer lists. And that's okay! An important point is that defederation doesn't have to be permanent. When mastodon.social got hit with a wave of spammers that infected the whole fediere, some instances temporarily defederated to limit the annoyance to their users (and load on their admins and moderators) until the problem got under control. As beehaw admins said i[n their annoncement](https://beehaw.org/post/567170?ref=thenexusofprivacy.net): > this is also not a permanent judgement (or a moral one on the part of either community’s owner, i should add–we just have differing interests here and that’s fine). in the future as tools develop, cultures settle, attitudes and interest change, and the wave of newcomers settles down, we’ll reassess whether we feel capable of refederating with these communities. sh.itjust.work's admin TheDude [adds](https://sh.itjust.works/post/129725?ref=thenexusofprivacy.net) > After this happened, the beehaw admins and I had a good chat about their decision. While our stances on registration policies might diverge, we realized that our ultimate goals are aligned: we both strive to foster communities that thrive in an atmosphere of safety and respect, where users can passionately engage in discussions and feel a sense of belonging. > > Although the probability of an immediate reversal are slim given the current circumstances, I believe we have managed to identify common ground. It’s evident that, even in separation, we can unite to contribute positively to the broader fediverse community. ## Notes 1 For example: - Sometimes people on different instances can't interact because of software incompatibilities because one instance has blocked the other or turned on "authorized fetch". - [Some Lemmy instances have downvotes, others don't](https://github.com/maltfield/awesome-lemmy-instances?ref=privacy.thenexus.today). - Last week an upvote on Kbin boosted the post, this week it's treated as a like (as it is in Lemmy); that's an improvement, but also a change that adds to everybody's cognitive load. - Threads like [PSA: How to link users & communities so it doesn’t break for other instances](http://lemmy.ml/post/1168136?ref=privacy.thenexus.today) and [how do I link to my community in comments?](http://lemmy.ml/post/1157974?ref=privacy.thenexus.today) illustrate how confusing trying to refer to people and discussions on multiple instances can be (a huge problem on Mastodon as well). The list goes on ... 2 Configurable message lengths are valuable for accessibility because assistive technology does better with one long message than multiple short ones, and were I believe first implemented by glitch-soc; underlined lines help people with color vision problems distinguish between links and were first implemented by toot.cafe. 3 I'd love to hear what r/AskHistorians has to say about Steve's description of developers as "landed gentry" but, like many of the 8000+ subreddits that "went dark" in a two-day blackout on June 12-13, they're continuing their protest. ## Update history *Ongoing: fixing typos, improving wording, and adding new links* **July / August**: updates about ongoing moderation and defederation issues. **June 28**: link to an excerpt from lemmy.ninja's excellent post on dealing with bots. **June 22**: info about Lemmy's millions of bot signups. Who could have predicted? **June 20**: new sections [Experiment to find what approaches are a good fit for the current state of the software](#experiment) , [Ten days later](#ten-days-later), and [A few more thoughts on moderation](#more-on-moderation). **June 11**: updates in response to early feedback, including quotes from L. Rhodes and ozoned, links to more threads and resources. **June 10**: published and shared to [infosec.exchange](https://infosec.exchange/@thenexusofprivacy/110522140277722688?ref=thenexusofprivacy.net) and [lemmy.ml](https://lemmy.ml/post/1196560?ref=thenexusofprivacy.net). I tried to share it to KBin as well but it didn't work – I think maybe because of some of the DDOS protections on kbin.social. I also tried to send it a friendica group as well but had a typo in the group name, oops. June 9: draft shared to [calckey.social](https://calckey.social/notes/9fryhzxiqno5zn86?ref=thenexusofprivacy.net), ### Don't tell people "it's easy", and six more things Kbin, Lemmy, and the fediverse can learn from Mastodon (REVISED DRAFT) URL: https://thenexusofprivacy.net/dont-tell-people-its-easy-draft/ Last updated: 2023-06-10T20:44:44.000Z *Originally published June 9, revised June 10.* > **DRAFT! Feedback welcome –** [**here's a thread**](https://calckey.social/notes/9fryhzxiqno5zn86?ref=thenexusofprivacy.net)**. Thanks to everybody for feedback and discussion on the previous draft!** ![Three headlines, with images on the left. Don't Let Reddit Kill 3rd Party Apps! The furries have joined the cause. r/SoftwareEngineering will be shutting down indefinitely on June 12th in protest of Reddit's API changes](https://thenexusofprivacy.net/content/images/2023/06/230607-the-furries-have-joined-the-cause-2.png) front page of r/Save3rdPartyApps subreddit, June 7 **Contents:** - [I'm flashing!!!!!](#flashing) - [But first, some background](#background) 1. [Don't tell people "it's easy"](#its-not-easy) 2. [Improve the "getting-started experience"](#getting-started) 3. [Keep scalability and sustainability in mind](#scalability) 4. [Prioritize accessibility](#accessibility) 5. [Get ready for trolls, hate speech, harassment, spam, porn, and disinformation](#harassment) 6. [Invest in moderation tools](#moderation) 7. [Values matter](#values) - [This is a great opportunity – and it won't be the last great opportunity](#opportunity) Each section should hopefully mostly stand on its own, so feel free to pick and choose or read in whatever order you want! ## I'm flashing!!!!! > **April 2017: "**So, April, huh. Twitter changed the reply system, which everybody told them they shouldn’t do, and then removed the iconic egg avatar for new users, and suddenly all of my work of telling people that one day Twitter would do something they didn’t like and they’d need a viable alternative paid off." > > – Mastodon lead developer Eugen Rochko, [April post-mortem](http://blog.joinmastodon.org/2017/04/april-post-mortem/?ref=thenexusofprivacy.net) on joinmastodon.org > **June 2023:** "For those who are unaware, lemmy and kbin to a lesser extent are in the early stages of a rapid growth in users, similar to the one Mastodon experienced in November last year. In a move similar to Twitter, Reddit has all but confirmed that 3rd party apps will be locked out with their new API pricing .... We live in interesting times on the fediverse." > > – Ada, lemmy.blahaj.zone admin, [on Calckey](https://blahaj.zone/notes/9fhjwjtver?ref=thenexusofprivacy.net) Hey wait a second, I'm noticing a pattern here! Once again, a boneheaded move by a big tech company has once again created a huge opportunity for the decentralized social networks of the "[fediverse](https://axbom.com/fediverse/?ref=thenexusofprivacy.net)." In 2011 it was Facebook, in 2016, 2017, 2018, and 2022 it was Twitter. This time it's Reddit, whe announced that they're shutting down apps written by third party developers that tens of millions of users and moderators rely on. Unsurprisingly, redditors don't much care for the idea; there's a firestorm of protest, including some communities (aka "subreddits") already "going dark" in protest and hundreds more planning to on June 12-3 if not sooner. At an AMA (Ask My Anything) Friday, Reddit's CEO u/spez [threw gasoline on the flames](https://old.reddit.com/r/ModCoord/comments/145l7wp/todays%5Fama%5Fwith%5Fspez%5Fdid%5Fnothing%5Fto%5Falleviate/?ref=thenexusofprivacy.net). At this point, even if they walk back or delay some of the changes, they've lost so much goodwill and trust that a whole lot of fedup redditors are looking for alternatives. The fediverse has always grown in waves, and it looks like the next one's in progress. The most obvious reddit alternatives in the fediverse are Kbin and Lemmy, both of which offer "link aggregation" functionality: people can post links, memes, videos from around the web, discuss them, and vote on the best posts and comments. They're both quite new, and still relatively small (last week Lemmy had thousands of active users) – but they're open-source projects, so the code can improve quickly, and people or organizations can set up new instances on different websites as new homes for one or more subreddits. Even better, people on one instance can interact with people and communities on other instances – and people already in the fediverse using Mastodon, Friendica, and dozens of other software platforms can interact with Lemmy and Kbin. How cool is that? Of course, we're talking about early-stage software here, and today's reality has a lot of confusion, bugs, and limitations along with it's coolness. Kbin and Lemmy (and most other fediverse software) is nowhere near as polished as Reddit, Twitter, Instagram, and other social networks that people are used to. It doesn't yet have key safety and moderation funcationality, and may well need a lot of performance and scalability work support subreddits with millions of people yet. The compatibility with other tools still has a lot of quirks. The list goes on ... It's very similar to the situation with Mastodon in 2016-2017 (when I was one of a million or so people attracted by the idea of a "Twitter without Nazis") and again in 2022 (when millions of people checked it out in response to the Twitter acquisition). As [Lessons (so far) from Mastodon](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=thenexusofprivacy.net) and [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history/) discuss, both of those waves led to major challenges for Mastodon. Keeping up with rapid growth and responding to all the bug reports and feature requests is hard even in the best of circumstances, and a decentralized network makes everything more challenging and (for most people) confusing. Many people found Mastodon unwelcoming – especially Black people, as Dr. Johnathan Flowers discusses in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net). The wave died out in a few months. The network grew, but it also and got whiter and less queer, and the hoped-for breakthrough didn't happen. [Rapid queer-led community innovation](https://thenexusofprivacy.net/mastodon-a-partial-history/#rapid-queer-led-community-innovation) of 2016-2017 tailed off. Since then, mainline Mastodon has moved slowly, while forks, apps, and other fediverse projects continue to innovate. So it's worth looking at what we can learn from the Mastodon experience as the wave of redditors crashes in. Tactics worked well in the past might be useful again, and there may be opportunities to adapt and build on them. It's also valuable to look at what went wrong or didn't work out as well in the past, to see if there are ways to do better. Here are some initial thoughts. ## But first, some background > "The fediverse isn’t a single, gigantic social media platform like Facebook or Twitter. It’s an expanding ecosystem of interconnected social media sites and services...." > > – [The Fediverse Could Be Awesome (If We Don’t Screw It Up)](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=thenexusofprivacy.net), Cindy Cohn and Rory Mir of EFF, November 2022 The fediverse has been around in various forms since 2008 or so; [Mastodon, GNU social, and the early fediverse](https://thenexusofprivacy.net/mastodon-a-partial-history/#mastodon-gnu-social-and-the-early-fediverse) has a quick summary of the early days. It's grown in a series of waves, most recently the one late last year that followed Aprtheid Clyde and his buddies taking over Twitter. So far, each wave has crested in a month or two; some of the people who check it out decide they like it enough to hang around, although most don't. If you're coming from Reddit, the decentralized structure of the fediverse – where people on different sites (also known as "instances") can interact with each other –is a big contrast. Reddit is a centralized network, so all the subreddits are hosted on reddit.com. The fediverse is decentralized, so it's a bit more complex: - different communities (the equivalent of subreddits) are hosted on different instances. Instead of everything being on reddit.com, there's are different communities on feddit.de, beehaw.org, sopuli.xyz , kbin.social, lemmy.ml, and oodles of other sites. - people can interact with communities and people on different instances. If somebody posts something on lemmy.ml, you can potentially upvote it no matter wheher your account is on lemmy.ml, kbin.social, a popular instance lke beehaw.org, or a tiny instance you're running for your self and maybe a few friends. Decentralized networks are more complex than centralized networks, but in return for that they're also a lot more flexible. Redditors who are currently experiencing one of the big problems with centralized social networks: the company running them can suddenly change the rules and screw everybody over if [they're facing financial pressure](https://www.reuters.com/technology/reddit-lay-off-about-5-workforce-wsj-2023-06-06/?ref=thenexusofprivacy.net) or [they think it can help them go public](https://www.businessinsider.com/reddit-openai-chatgpt-ipo-valuation-karma-2023-6?ref=thenexusofprivacy.net). So they're very likely to appreciate this flexibility! Another way the fediverse is more complex is that different software often uses different names for similar things. For example: > You can follow Lemmy “communities” in Kbin, and Kbin “magazines” in Lemmy, and I believe other Fediverse groups (like Frendica groups) also federate. You can *also* follow Lemmy or Kbin users or communities from your account on another Fediverse platform, like Mastodon, and can reply to, like and boost Lemmy/Kbin posts. > > – [On Reddit and Its Federated Alternatives](https://www.jayeless.net/2023/06/on-reddit-and-alternatives.html?ref=thenexusofprivacy.net), Jessica Smith on Jayeless The section below on [Don't tell people "it's easy"](#its-not-easy) has the Mastodon equivalents of these terms. And reality adds a lot more complexity to these conceptual descriptions. For example: - Sometimes people on different instances can't interact because of software incompatibilities because one instance has blocked the other or turned on "authorized fetch". - [Some Lemmy instances have downvotes, others don't](https://github.com/maltfield/awesome-lemmy-instances?ref=thenexusofprivacy.net). - Last week an upvote on Kbin boosted the post, this week it's treated as a like (as it is in Lemmy); that's an improvement, but also a change that adds to everybody's cognitive load. - Threads like [PSA: How to link users & communities so it doesn’t break for other instances](http://lemmy.ml/post/1168136?ref=thenexusofprivacy.net) and [how do I link to my community in comments?](http://lemmy.ml/post/1157974?ref=thenexusofprivacy.net) illustrate how confusing trying to refer to people and discussions on multiple instances can be (a huge problem on Mastodon as well). The list goes on ... Still, despite the quirks, once you figure a few things out both Kbin and Lemmy can give you a surprisingly good reddit-like experience. A quick summary: - Lemmy has been around for several years, currently has about 4700 users (at least [according to FediDB](https://fedidb.org/software/lemmy?ref=thenexusofprivacy.net), although fediverse statistics are notoriously unreliable). - KBin is newer, and goes beyond Reddit and Kbin's functionality to also include a "microblog" tab. It's worth highlighting that even though other fediverse software isn't as close a match for reddit's link aggregation functionality, it could be a good fit for reddit communities who care more about discussion than links – or could be adapted to add this functionality. So even though I'll focus mostly on Kbin and Lemmy here, a lot of this is potentially relevant to other software as well. So if all goes well, many redditors looking for alternatives may decide to check things out and stay around. Good news for the fediverse! ## 1\. Don't tell people "it's easy" ![Everny Mastodon explanation is like "it's very simple, your account is part of a kerflunk, and each kerflunk can talk to each other as a part of a blumburt ..."](https://thenexusofprivacy.net/content/images/2023/06/kinda-like-email.png) Most of the suggestions below are targeted at developers, admins, moderators ... but I decided to lead with one that everybody can help with. For many people, very much including me, the Fediverse *isn't* easy. I've been on Mastodon since 2017 and I still find it very complex – and confusing, too, like when I click on a link and sometimes it opens me pu in a window that's not logged in anywhere, or the way posts federate means I don't see all of a conversation. Hopefully it'll get easier over time but that hasn't happened yet. And yet, you constantly hear people talking about how easy it is – which implies that anybody who doesn't think it's easy must be stupid, incompetent, or doing something wrong. *This is not helpful*. It's annoying and drives people away. So don't say it. And while you're at it, also don't say "it's good that it's hard to sign up, it keeps the quality high." As well as being annoying, that's elitist. And besides, think about it for a second: it's gotten a lot easier recently to sign up for a blue check mark on Twitter. Has that made the quality higher? ## 2\. Improve the getting-started experience Less than 20% of the accounts that have signed up on Mastodon in the last year are still active,. That's actually better than it sounds: in Twitter's or Google+'s early days, the number was less than 10%. Most people who check out a new social network don't stick around. A good way to make it more likely that people will stay around is to focus on improving their initial experience. People are a lot more likely to stay around if things start off on a good note – and a lot less likely if they get frustrated or (as well'll discuss below) greeted with hate speech or racist abuse. So while you're never going to make everybody happy, putting work into improving the getting-started experience for new users can make a big difference. A couple of specific tactics that could be useful here: - **Make sure "getting started" guides are easy to find for new and potential users**. The simple three-screen "welcome modal" Shel Raphen designed for Mastodon in 2017 had a big impact, and the joinmastodon.org "hub" site has also been helpful, but those certainly aren't ot the only approach – templates for a well-written short pinned posts on communities and instances could also be very effective, and as long as reddit doesn't censor it people could share it there to help people who haven't yet moved get started. Lemmy already has joinlemmy.org (althogh like any website there's room for improvement) and I've seen drafts of a couple short getting-started guides, so things are on the right track (although I'm not sure about the Kbin world), but more time and energy directed here is likely to pay a lot of dividends. - **Make it easy for people to avoid instances where racism, anti-LGBTQ+ and anti-Muslim bigotry, and other forms of bigotry hate speech are tolerated**. In response to Gab, Mastodon introduced the [Mastodon Server Covenant](https://joinmastodon.org/covenant?ref=thenexusofprivacy.net) requiring sites to commit to "active moderation against racism, sexism, homophobia and transphobia" in order to be listed.... which is a good first step, although needs to be expanded to other forms of bigotry targeting Muslims, disabled people, immigrants and other groups. It also needs to be combined with good moderation – as I discuss in the section below on [Values](https://thenexusofprivacy.net/dont-tell-people-its-easy-draft/#values), there's currently Islamophobic content on several prominent Lemmy sites, including the flagship lemmy.ml. As I said [on lemmy.blahaj.zone](https://lemmy.blahaj.zone/comment/32008?ref=thenexusofprivacy.net), > \[A\] we’ve seen on Mastodon, if a Black user goes to a site where racism is tolerated and quickly encounters racist sh\*t, they leave and tell their friends; ditto for trans, queer, Muslim, etc. users having bad initial experiences. Once that happens a bunch of times the reputation becomes hard to shake. - **Give instance admins control over their "landing page" so they can give the right information to potential users**. Just what information that is depends on the instance. For example, instances that so many communities that a list would be overwhelming might decide that it's best to show a list of top local posts. Instances that host a handful of communities might be better off having a list of communities be the landing page. Instances with a single community, designed as a home for an individual subreddit, might want to show the community on the main page – or a welcome post, telling people how to log in. Mastodon's often resistant to giving admins options like this, but "once size fits all" usually doesn't fit everybody equally well. ## 3\. Keep scalability and sustainability in mind > Scaling is hard was probably the main lesson 😀 > > – Ryan Wild, admin of masodonapp.uk, [on Mastodon](https://indieweb.social/@wild1145@mastodonapp.uk/110510262312035966?ref=thenexusofprivacy.net) When a surge happens, everybody's overwhelmed. Instances allowing open registrations get so many signups that they have to add new hardware capacity, and often don't have the moderation resources to keep up. Instances that screen registrations for new users want to turn things around as quickly as possible, but have to deal with hundreds or thousands a day. Dev teams need to deal with performance issues, critical bug fixes, and urgently-needed improvements – while also supporting instance admins and developers, who on the one hand are helping to spread the load but on the other hand are one more demand on already-scarce time. There isn't any magic answer here: scaling *is* hard, and even large commercial sites can have problems keeping up with intense surges. Still, one key lesson is the importance of spreading people out to multiple well-moderated instances to overloading the flagship and other big instances. In principle, by allowing people from one instance to interact with each other instances, the fediverse makes this easy. In practice, it's more complicated. Asking people to choose an instance right off the bat, before they've had any experience with the platform or even know what the implications of choosing an instance are, can be a huge barrier. So it's tempting to try to simplify things by pointing everybody to a default instance but that doesn't scale: every significant surge to Mastodon has led to mastodon.social having to close down signups for a while. So landing pages and guides that help people through the process of choosing an instance are crucial – and so are good instructions for how people can set up their own instances, community support for when they run into problems, and best practies for admins to scale their instances. More positively, since smaller fediverse instances tend to retain more active users, this is a great opportunity to shape the network; [Marcel Costa's analysis](https://socialhub.activitypub.rocks/t/analysis-of-fediverse-diversity-in-terms-of-decentralization/3252?ref=thenexusofprivacy.net) shows that Masotodon decentralized significantly as a result of the November 2017 surge. That's good! But it was pretty exhausing for all concerned. As mas.to admin Rodti Macleary said in February's [The Mastodon Bump Is Now a Slump](https://www.wired.com/story/the-mastodon-bump-is-now-a-slump/?ref=thenexusofprivacy.net), “I loved Mastodon for fun. For a little while, Mastodon became work. I came quite close to burnout at the end of last year.” Which brings me to a few other key lessons for instance admins: - build teams place to help with moderation, system administration, and support - put a funding structure on place (via patreon, ko-fi, LiberaPay, or a sponsorship mechanism) to deal with ongoing costs. - if things are starting to get overloaded, put the brakes on growth to keep from having to choose between burning out and giving people a bad experience. As long-time fediversian Michał "rysiek" Woźniak says > Manage your spoons well. > > The wave of sign-ups will come and go, but burn-out or some bad moderation decisions will affect a community for a long, long time. > > It's better to slowly but reliably build a small, resilient, safe space than to try to go hockey-stick on sign-ups only to have people get burnt, abandon their accounts, and tell their friends about it. \[If you're not familiar with "spoon theory", it's a metaphor describing the amount of physical and/or mental energy that a person has available for daily activities and tasks, and how it can become limited. The term was originally coined by writer and blogger Christine Miserandino in 2003 as a way to express how it felt to have lupus and is now used widely in the disability community. [What The ‘Spoon Theory’ Means for People Living With Chronic Illnesses, Disabilities](https://theswaddle.com/what-the-spoon-theory-means-for-people-living-with-chronic-illnesses-disabilities/?ref=thenexusofprivacy.net) is a good discussion.\] ## 4\. Prioritize accessibility > "One of our moderators, [u/itsthejoker](https://old.reddit.com/u/itsthejoker?ref=thenexusofprivacy.net), has had multiple hour-long calls with various Reddit employees. However, as of the current time, our concerns have gone unheard, and Reddit remains firm." > > – r/Blind moderators in [Reddit’s Recently Announced API Changes, and the future of the /r/blind subreddit](https://www.reddit.com/r/Blind/comments/13zr8h2/reddits%5Frecently%5Fannounced%5Fapi%5Fchanges%5Fand%5Fthe/?ref=thenexusofprivacy.net), While reddit killing third-party apps is bad for users and moderators in general, it's even worse for blind users and moderators. Reddit's own software doesn't play well with screenreaders and other assistive technologies. As a result, third-party apps like Apollo, Reddit for Blind, and Luna for Reddit are crucial for blind users to be able to participate. Reddit now says they're going to continue to allow non-commercial accesibiity apps, although won't give a list of criteria and it's also demanding free labor from developers who want to help blind people so it is not by any means a good solution. Reddit not prioritizing the needs of blind users is nothing new. > "We would also like to note that [r/blind](https://www.reddit.com/r/blind/?ref=thenexusofprivacy.net), [u/rumster](https://www.reddit.com/u/rumster/?ref=thenexusofprivacy.net) in particular, have continuously contacted Reddit over accessibility concerns, over the past 3 years, having received no substantive response." > > – MostlyBlindGamer, in a reddit [comment](https://www.reddit.com/r/Blind/comments/13zr8h2/comment/jnbkjed/?utm%5Fsource=reddit&utm%5Fmedium=web2x&context=3) So now's a great opportunity for KBin, Lemmy, and the fediverse to collectively show that they're not like reddit – and attract a bunch of people who are tired of being ignored. KBin and Lemmy both have some accessibility problems now (as does most Fediverse software), but most of these problems are fairly easy if developers decide to take the time. It hasn't been prioritized to date – but it's easy enough to change that. The [Accessibility](https://thenexusofprivacy.net/mastodon-a-partial-history/#accessibility) section of [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history/) has examples of successful community-driven development worth emulating, like [Changeling’s Guide to Mastodon for Screen Reader Users](https://www.starshipchangeling.net/mastodon/?ref=thenexusofprivacy.net) and the highly-accessible[ Pinafore](https://pinafore.social/?ref=thenexusofprivacy.net) web client, created by Nolan Lawson. Lawson's[ What I’ve learned about accessibility in SPAs](https://nolanlawson.com/2019/11/05/what-ive-learned-about-accessibility-in-spas/?ref=thenexusofprivacy.net) talks about Marco Zehe's "patient coaching" and [comments on the Pinafore GitHub repo](https://github.com/nolanlawson/pinafore/issues?q=is%3Aissue+author%3Amarcozehe+is%3Aclosed&ref=thenexusofprivacy.net) as a "treasure trove of knowledge," and illustrates how much help and support can be available when people sincerely reach out. Then again Mastodon also provides example of what not to do here. The main dev team hasn't prioritized implementing alt text on images: it took over a year to implement originally, so it wasn't available during the April 2017 wave; configurable message lengths and underlined links, both valuable for accessibility, have been implemented for years in forks but aren't well supported in the mainline branch.[2](#notes) Hopefully Lemmy and KBin will do better on this front – and Mastodon and other fediverse software will also take the opportunity to start improving their own platforms' accessibility. ## 5\. Get ready for trolls, hate speech, harassment, spam, porn, and disinformation Yeah, all of those exist already – and on reddit too – but the scale's likely to increase siginificantly. KBin and Lemmy have more tools than Diaspora or Mastodon did back in the day, ibut it's not clear how much they've focused on these issues yet – there's still a lot more that could be done here. For example: - **Provide individual users the abilty to block instances.** Mastodon's innovation of instance-level blocking – allowing instances or individual users can block everything from a site that's a source of harassment, trolling, or just unwanted content – allowed users and sites wanted to avoid interactions with channer, shitposting, and Nazi instances. [Lemmy currently doesn't allow individual users to block instances ](https://github.com/LemmyNet/lemmy/issues/2397?ref=thenexusofprivacy.net)(although admins can), and multiple people have already requested this functionality. - **Work out a process for community-curated instance block lists.** If each new instance has to learn the hard way that there are some well-known bad actor sites out there, a lot of users and admins will have unnecessarily bad early experiences. But having the main dev team curate block lists (an approach Mastodon has wisely stayed away from) risks centralizing power even further. Community-led processes like the [Oliphant.social block lists](https://writer.oliphant.social/oliphant/the-oliphant-social-blocklist?ref=thenexusofprivacy.net) and [The Bad Space](https://thebad.space/about?ref=thenexusofprivacy.net) are a good alternative – and may well be useful starting points, as long as there are good instructions for admins on how to adopt them and a process for subscribing to updates. - **Be ready to respond when spammers start to take advantage of open registrations or communities that anybody can share too.** As Brian Krebs' [Interview With a Crypto Scam Investment Spammer](https://krebsonsecurity.com/2023/05/interview-with-a-crypto-scam-investment-spammer/?ref=thenexusofprivacy.net) highlights, the fediverse has gotten big enough that it's worth spamming, and sites with open registration make spammers lives very easy. Mastodon responded by introducing a captcha on signup, which puts in a speed bump for spammers at the cost of making things more difficult for people with vision or motor challenges. Turning off open registrations, at least temporarily, may be a better option. - **"NSFW" flags aren't enough.** Porn is popular on reddit. Many fediverse instances don't want to host porn, because of concern about legal liability or other reasons. Not only that, different jurisdictions and cultures often see things diffferently in terms of what is and isn't legal or acceptable: in early 2017 Mastodon faced a dicey situation around sharing images that were completely legal in Japan but consider very risky by many Western sites,. Mastodon does have some tools like the "reject media" federation option and content warnings (CWs), althouth their far from sufficient and cause challenges of their own: CWs haven't been improved signiicantly since it was first introduced in 2017 and have led to constant battles about norms and racialized CW abuse. A far as I can tell, Lemmy and KBin currently only have an optional NSFW flag to put on posts – even farther from sufficient. beehaw.org, currently the third-largest site after the flagsnhip lemmy.ml and the tankie lemmygrad.ml, has a NSFW policy, and it wouldn't surprise me if they and other similar sites wind up developing a fork. ## 6\. Invest in moderation tools > "Reddit admins have had 8 years to build a stronger infrastructure to support moderators but have not. " > > – Sarah Gilbert, [AskHistorians and uncertainty surrounding the future of API access](https://www.reddit.com/r/AskHistorians/comments/142w159/askhistorians%5Fand%5Funcertainty%5Fsurrounding%5Fthe/?ref=thenexusofprivacy.net) As Gilbert's outstanding description of the situation discusses, Reddit's underinvested in moderation tools for years. Alas, ever since 2017 , so has Mastodon. And so has every other fediverse software platform I can think of. Now's a great opportunity to change that. In the short term, there could be a lot of leverage porting the moderation tools that have been developed for reddit – or finding ways to replicate their functionality in a federated environment. Moderator time is often the scarcest resource during a high-growth surge, and if moderators can't keep up with the load there will be more spam, disinformation, racism, harassment, and people having bad experiences. Tools can amplify their efforts, and potentially let people who don't have as much moderation experience help more effectively. And done right, these tools evolve to work on other fediverse software, where there's certainly room for improvement. But why stop there? > In this study, I perform a collaborative ethnography with moderators of r/AskHistorians, a community that uses an alternative moderation model, highlighting the importance of accounting for power in moderation. > Drawing from Black feminist theory, I call this “intersectional moderation.”... To ensure the successful implementation of intersectional moderation, I argue that designers should support decision-making processes and policy makers should account for the impact of the sociotechnical systems in which moderators work. > > – > [Towards Intersectional Moderation: An Alternative Model ofModeration Built on Care and Power](https://arxiv.org/pdf/2305.11250.pdf?ref=thenexusofprivacy.net), Sarah Gilbert, J . ACM, Vol. 37, No. 4, Article 111\. Publication date: August 2023. New tools designed to center the voices of those who are directly impacted by the outcomes and prioritize the needs of the communites – and prioritizing accessibility from the beginning – could be truly transformational. Sure, easier said than done, but this is a good opportunity to make progress. ## 7\. Values matter > Policies against racism, sexism, discrimination against gender and sexual minorities, and Nazis are extremely appealing positioning these days. > > – [Lessons (so far) from Mastodon](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=thenexusofprivacy.net), 2017 It's still true! Mastodon's April 2017 influx was catalyzed by Sarah Jeong's [Mastodon is like Twitter without Nazis](https://www.vice.com/en/article/783akg/mastodon-is-like-twitter-without-nazis-so-why-are-we-not-using-it?ref=thenexusofprivacy.net) and the November 2022 wave was triggered by transphobic Apartheid Clyde's acquisition of Twitter. And when [Gab switched to Mastodon’s code in 2019, ](http://blog.joinmastodon.org/2019/07/statement-on-gabs-fork-of-mastodon/?ref=thenexusofprivacy.net)Mastodon BDFL (Benevolent Dictator for Life) Eugen Rochko stated his opposition to Gab’s philosophy, which he accurately described as using "he pretense of free speech absolutism as an excuse to platform racist and otherwise dehumanizing content" ... and virtually every Mastodon instance blocked Gab. This decisions remains widely popular; in [a recent poll](https://indieweb.social/@jdp23/110449505980762006?ref=thenexusofprivacy.net) I did, over 90% of respondents thought that Gab should be blocked. Of course, the policies aren't enough. As Dr. Johnathan Flowers discusses in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), "Mastodon has a history of being inhospitable to marginalized users." [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) discusses several examples of racism and white supremacy on Mastodon in 2017\. As a result, Mastodon's got a problematic – although thoroughly deserved – reputation for anti-Blackness. Lemmy also has a reputation. > I’ve been aware of Lemmy for a long time, but I’ve always been somewhat wary of it because it’s developed by tankies, and its flagship server (lemmy.ml) has a history of tolerating/encouraging tankie politics.... There’s just no way I could feel comfortable in a community that supports the right-wing nationalist Putin’s [war on Ukraine](https://www.jayeless.net/wiki/2022-russian-invasion-of-ukraine.html?ref=thenexusofprivacy.net), or outright denies the [harsh repression meted out against Muslims in China](https://www.jayeless.net/wiki/repression-in-xinjiang.html?ref=thenexusofprivacy.net). I’m far from the only one leery of Lemmy for this reason – [the FediTips Mastodon account doesn’t recommend it ](https://mstdn.social/@feditips/110476830253102884?ref=thenexusofprivacy.net), either. > > – Jessica Smith, [On Reddit and Its Federated Alternatives](https://www.jayeless.net/2023/06/on-reddit-and-alternatives.html?ref=thenexusofprivacy.net) You don't have to scroll too far down the list of sites on joinlemmy.org to find more than one hosting anti-Muslim content. That's not good. And posts from these sites show up on lemmy.ml, so there's anti-Muslim content on the flagship instance. That's also not good. It's possible that it's a combination of understaffed or undertrained moderators and a few anti-Muslim instances, and once everybody improves their moderation and defederates the bad actors the problem will go away. Time will tell. And whether or not that happens, Lemmy's developers are reportedly [tankies](https://en.wikipedia.org/wiki/Tankie?ref=thenexusofprivacy.net), which is a problem for a lot of people. It wouldn't surprise me at all if there's a fork. More positively, though, defederation from bigoted sites is one of the fediverse's good features, and forks can have a very positive effect. And with Twitter's transformation into an openly right-wing, racist, anti-LGBTQ+ pro-authoritarian, disinfo media network, whatever segment of the fediverse offers an alternative is going to continue to be very appealing! ## This is a great opportunity – and it won't be the last great opportunity There's a lot more that can be said ... but this is long enough already, so I'll leave the rest to discussions in the fediverse and perhaps future posts. But since I spent so much of this post focusing on past screwups and likely problems, I'm going to wrap up on a positive note. This is quite likely to be the biggest wave to the fediverse yet. It'll be interesting to see how things go, especially during the June 12/13 blackout, but if even a small fraction of the people who want to check things out wind up staying around, the network could grow significantly. Not only that, the surge of interest is likely to be a shot in the arm for other fediverse software as well as KBin and Lemmy. > "For many of us, the details of the API changes are not the most important point anymore. This decision, and the subsequent interaction with users by admins to justify it, have eroded much of the confidence and trust in the management of reddit that they have been working so hard to regain." > > – BuckRowdy, [Reddit held a call today with some developers regarding the API changes](https://www.reddit.com/r/ModCoord/comments/143rk5p/reddit%5Fheld%5Fa%5Fcall%5Ftoday%5Fwith%5Fsome%5Fdevelopers/?ref=thenexusofprivacy.net) And no matter what happens, this is far from the last opportunity. Reddit may well make enough concessions in the short term to keep people around for a while ... but the writing's on the wall, so as soon as alternatives fediverse are good enough for enough people, we'll start to see significant movement. Meanwhile Twitter's doubling down on the "toxic hellscape" strategy, with Apartheid Clyde now talking about disalbing blocking. What could possibly go wrong? If he does that, there's going to be another major exodus; even if he doesn't, anybody who doesn't want to spend their time in a racist, transphobic, hard-right-wing, disinfo-filled environment will continue to look for alternatives.. And while [Facebook/Instagram/Meta's new ActivityPub-compatible Twitter competitor](https://www.theverge.com/2023/6/8/23754304/instagram-meta-twitter-competitor-threads-activitypub?ref=thenexusofprivacy.net) will bring surveillance capitalism and an embrace-extend-dominate mindset to the fediverse, it could potentailly also bring connections with Oprah, the Dalai Lama, and 2 billion Instagram users. So that's a huge opportunity as well. As Ada says, it's interesting times in the fediverse. ## Notes 1 [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history/) discusses the April 2017 and November 2022 waves; and lnks to some articles on the Qvitter/GnuSocial wave (2016). 2 Configurable message lengths are valuable for accessibility because assistive technology does better with one long message than multiple short ones, and were I believe first implemented by glitch-soc; underlined lines help people with color vision problems distinguish between links and were first implemented by toot.cafe. ### Taking a break ... URL: https://thenexusofprivacy.net/taking-a-break/ Last updated: 2026-04-16T03:04:16.000Z With the Washington state legislative session wrapping up, it's a good time for me to take a break for a couple of months. While there's still a lot more to do, My Health My Data passing is the culmination of the successful multi-year battle by grassroots activists to keep big tech from passing the Bad Washington Privacy Act. If we hadn't win in 2020, 2021, and 2022, we almost certainly wouldn't have had the same opportunity this year. So it's a great time to reflect and think about what's next. At the same time, Twitter's API changes have led to the demise of The Nexus Today, the anti-oppressive news aggregator I prototyped for the last several years. Even though the writing's been on the wall for a while, it was still really sad to get the mail from Twitter that my API access had been disabled. Of course there are other platforms out there, and I designed it so that that it's not tied to any one data source, but there's also no obvious replacement (yet) for the diverse input that was available on Twitter. So it's a good time to reflect and think about that as well. As to what next ... well that's one more thing to think about! See you in a couple of months! --- Image Credit: [The Digital Artist, via pixabay](https://pixabay.com/illustrations/chalkboard-blackboard-back-soon-6030141/?ref=thenexusofprivacy.net), free for use under Pixabay's licensing policies. ### My Health My Data goes to the Governor's desk: Washington state privacy update, April 20 URL: https://thenexusofprivacy.net/my-health-my-data-goes-to-the-governors-desk-washington-state-privacy-update-april-20/ Last updated: 2026-04-16T03:03:43.000Z > BREAKING: The WA House of Reps concurred and have sent the WA [#MyHealthMyDataAct](https://twitter.com/hashtag/MyHealthMyDataAct?src=hash&ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) ESHB 1155 to [@GovInslee](https://twitter.com/GovInslee?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) for signature ✍🏻![@SlatterVandana](https://twitter.com/SlatterVandana?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) & [@MankaDhingra](https://twitter.com/MankaDhingra?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) make WA State HERSTORY 💪🏽✊🏽on privacy. 🎉💖 and secure urgent protections for abortion & gender-affirming care seekers! [https://t.co/EI62sBBt6y](https://t.co/EI62sBBt6y?ref=thenexusofprivacy.net) > > — WA People's Privacy (@wapeopleprivacy) [April 17, 2023](https://twitter.com/wapeopleprivacy/status/1648052182045069317?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) > Washington state lawmakers finalized passage of a bill Monday that provides privacy protections for consumer health data.... The legislation has special urgency as many states pass prohibitions against abortion and [seek to limit](https://www.politico.com/news/2022/03/19/travel-abortion-law-missouri-00018539?ref=thenexusofprivacy.net) women from obtaining them elsewhere, according to Rep. [Vandana Slatter](https://housedemocrats.wa.gov/slatter/?ref=thenexusofprivacy.net) (D-Redmond), the bill’s sponsor who spoke to GeekWire in an earlier [interview](https://www.geekwire.com/2023/privacy-bill-aims-to-protect-health-data-on-apps-and-websites-in-washington-state/?ref=thenexusofprivacy.net).... > > Cher Scarlett, a Seattle-area software engineer and worker’s rights[ activist ](https://www.seattletimes.com/business/technology/she-pulled-herself-from-addiction-by-learning-to-code-now-this-kirkland-software-developer-is-leading-a-worker-uprising-at-apple/?ref=thenexusofprivacy.net)who testified in favor of the bill, celebrated its passage. “This is an enormous victory for not only Washington state, but the entire nation,” Scarlett said in an email to GeekWire. > > – [Washington state lawmakers pass bill to protect privacy of consumer health data](https://www.geekwire.com/2023/washington-state-lawmakers-pass-bill-to-protect-privacy-of-consumer-health-data/?ref=thenexusofprivacy.net), Charlotte Schubert, *Geekwire* > By a vote of 57–40, the House voted to concur in the Senate amendments to [House Bill 1155](https://app.leg.wa.gov/billsummary?BillNumber=1155&Year=2023&Initiative=false&ref=thenexusofprivacy.net), prime sponsored by Representative Vandana Slatter... > > The Senate’s changes, proposed by \[Senator Manka Dhingra’s committee, restored the bill to its originally contemplated scope,[1](#notes) with a strong private right of action.2 What that means is that if people find the privacy of their health data has been infringed upon, they can go to the courts to seek justice themselves, rather than having to rely on the Attorney General’s office as the sole enforcer of their rights. > > – [VICTORY! My Health, My Data Act heads to Governor Inslee after House concurrence vote](https://www.nwprogressive.org/weblog/2023/04/victory-my-health-my-data-act-heads-to-governor-inslee-after-house-concurrence-vote.html?ref=thenexusofprivacy.net), in Northwest Progressive Institute (NPI)'s Cascadia Advocate > In addition to protecting private health care data not currently covered by HIPAA, ACLU of Washington Technology and Liberty Project Manager Jennifer Lee [said](https://www.aclu-wa.org/news/aclu-washington-comment-senate-passage-washington-my-health-my-data-act-eshb-1155?ref=thenexusofprivacy.net) the bill "will reduce barriers to abortion and gender-affirming health care access." > > – [Washington state on track to pass broad-based health data privacy law](https://iapp.org/news/a/washington-on-track-to-pass-health-data-privacy-law/?ref=thenexusofprivacy.net), Jennifer Bryant, in IAPP Privacy Explorer > Notably, the scope of “consumer health data” covered by the MHMDA is fairly broad, defined as “personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status.” The definition goes on to list examples like prescription medications, diagnoses and health conditions, biometric data, and location information that would indicate a consumer’s attempt to receive health services, among other examples. > > – [Washington State Legislature Passes Health Data Privacy Law](https://epic.org/washington-state-legislature-passes-health-data-privacy-law/?ref=thenexusofprivacy.net), EPIC Privacy > With a private right of action, broad applicability to businesses[2](#notes) of all sizes and types, a scope that is broader than its name suggests, and strong consent-based requirements and privacy rights, the Washington My Health My Data Act will be a transformative privacy law for the United States. > > – [Washington Legislature Passes My Health My Data Act](https://www.bytebacklaw.com/2023/04/washington-legislature-passes-my-health-my-data-act/?ref=thenexusofprivacy.net), David Stauss, on *Byte Back Law* > “Websites, apps and health tracking devices lack the basic protections we’ve come to expect when sharing our personal health data,” Rep. Slatter said. “There is no way to consent or even know about it. We must protect the data of Washingtonians and all who travel here. Without a federal policy, this is where we are and the first in the nation bill we need. I’m glad my colleagues and the attorney general are choosing to rise to the occasion in protecting people’s right to privacy, personal agency and safe medical care.” > > "People have a right to keep private health data private,” Sen. Dhingra said. “With the My Health My Data Act, Washington becomes the national leader in informing and obtaining consent from consumers when companies collect, share and sell their health care data. It is crucial that people have the ability to request that their private data be deleted once collected, and this bill allows them to do so.” > > – [AG Ferguson, Rep. Slatter bill creating health data privacy protections passes Legislature](https://www.atg.wa.gov/news/news-releases/ag-ferguson-rep-slatter-bill-creating-health-data-privacy-protections-passes?ref=thenexusofprivacy.net), on atg.wa.gov Less than three hours after [My Health My Data in the home stretch](https://thenexusofprivacy.net/my-health-my-data-in-the-home-stretch/) noted that House concurrence was very likely but cautioned "it ain't over 'til it's over", the House did in fact concur on the Senate version of HB 1155\. The bill officially went to Gov. Jay Inslee on Wednesday, and he's expected to sign it next week. So (barring any unexpected hiccups or shenanigans[4](#notes)), My Health My Data is about to become law. Getting *any* privacy bill through the legislature has been a challenge for years, and My Health My Data breaks new ground over other state privacy legislation in hugely important ways – especially the strong private right of action, which industry had blacked from all privacy laws all across the US for the last 15 years. As Rep. Slatter said in at the beginning of the session, "recent attacks on bodily autonomy and reproductive healthcare have shown us how urgent the need is to protect health data." WA People's Privacy founder Maya Morales describes the version of My Health My Data the legislature passed as "[an excellent start](https://www.king5.com/article/news/politics/state-politics/bill-strengthen-privacy-health-data/281-527855ee-640a-4e80-b655-6f89c977fdc0?ref=thenexusofprivacy.net)", noting that "data privacy advocates are aware this bill doesn't go far enough for us. But it is a really important step and we're taking that step in Washington state." And given Washington's justifiable reputation as a tech leader, My Health My Data is likely to influence legislation in other states and federally. Assuming the Governor signs the bill as expected, there's a lot to build on here – and also a lot to analyze, learn from, discuss, and apply. Let's hold those thoughts for now though and take a moment to recognize what's been accomplished. Congratulations and applause to Rep. Slatter and Sen. Dhingra, the Attorney General's Offic, Senators Trudeau and Kuderer and the rest of the Senate Law & Justice committee, Rep. Shelley Kloba and Rep. April Berg for sponsoring earlier privacy bills My Health My Data builds on, and all the other legislators, legislative assistants, staffers, organizers, advocates, and activists who have spent so much time and energy working to pass strong privacy legislation over the years and in 2023! --- ## Notes 1 Not really. As Cher Scarlett pointed out in the Geekwire, nothing that "some of the amendments to the bill weakened its privacy protections compared to the original version." NPI's correct that the Senate bill is stronger than the House bill; Most importantly Chair Dhingra's Senate Law & Justice committee had restored the private right of action, which a House floor amendment from Rep. Amy Walen (D-Bellevue) had stripped. However, the House Civil Rights & Judiciary (CR&J) Committee had previously [watered down](https://thenexusofprivacy.net/a-watered-down-substitute-advances/) the original bill's protections significantly. So while Law & Justice made some valuable improvements in addition to restoring the private right of action, the final version of the bill is much closer to the CR&J watered-down substitute than to the original. That said, restoring the strong private right of action was huge! Sen. Trudeau discusses why it matters so much from a consumer protection perspective in the video below. Sen. Trudeau discusses the private right of action and the"per se" clause starting at about 9:20 into [Can Washington Protect Out-of-State Abortion Rights?](https://www.youtube.com/watch?v=qc%5FuLJn9pwA&ref=thenexusofprivacy.net) on the Indivisible Podcast 2 see the video above, the link in the footnote below, and [The private right of action, the per se clause and why it matters](https://thenexusofprivacy.net/my-health-my-data-in-the-home-stretch/#private-right-of-action) for more 3 and non-profits, who aren't covered by most other state privacy legislation. [Legal Voice's ESHB 1155 overview](https://wa-privacy.net/organizing/2023-leg/my-health-my-data-eshb-1155-legal-voice-overview/?ref=thenexusofprivacy.net) includes a discussion so-called "crisis pregnancy centers" (CPCs) operated by anti-abortion groups that illustrates the importance of a strong private right of action in regulating entities who aren't currently covered by HIPAA and "often lure people in with promises of free diapers, formulas, and fake ultrasounds." 4 Which are technically still possible – it ain't over 'til it's over! And of course even after Gov. Inslee signs the bill, the biennium still ain't over; the legislative battle will resume next session. Not only that, industry may well file suit to block enforcement (as they just did in California). Still, even though it ain't over, getting My Health My Data through the legislature with a strong private right of action is a huge milestone. ### My Health My Data in the home stretch: Washington privacy legislation update, April 17 URL: https://thenexusofprivacy.net/my-health-my-data-in-the-home-stretch/ Last updated: 2026-04-16T03:03:00.000Z > UPDATE: about two hours after I posted this, the House voted to concur with the Senate version of My Health My Data! > "This session ends on Sunday April 23, and privacy legislation has gone down to the wire the last four years. It ain't over 'til it's over!" > > – [A much more favorable environment, but a lot of complexity: Washington state privacy legislation 2023](https://thenexusofprivacy.net/wa-privacy-more-favorable-environment/), January 11 Sure enough, with only a week left in the session, the fate of the consumer health data privacy law My Health My Data (HB 1155) still hasn't been fully decided. My Health My Data protects "consumer health data": data from apps, websites, retailers, advertisers, search engines, wearables like Fitbits, and so-called "crisis pregnancy centers" (CPCs), none of which is covered by HIPAA today. These protections are especially important in a post-Dobbs world, as states including neighboring Idaho criminalize providing, receiving, or helping people seek abortion and gender-affirming care. But industries who make money by exploiting people's data without their consent don't want to be regulated ... and the tech industry is very powerful here in Washington. Last week, the Senate passed a version[1](#notes) with some significant improvements over the version the House passed last month – including a "private right of action" allowing people to sue companies and CPCs that break the law, something industry has fought against for years. If House votes to concur, which most people seems to think is very likely, then once the Governor signs the bill, My Health My Data will become law. That would make it the first consumer health data privacy law to pass anywhere in the US, and the first post-Dobbs data privacy law. Given Washington's justifiable reputation as a tech leader, that's likely to influence legislation in other states and federally. But if there are shenanigans the House votes against concurring, [things get complicated](http://leg.wa.gov/legislature/Pages/Overview.aspx?ref=thenexusofprivacy.net) – more about that below. Before we get to the details of My Health My Data, though, let's celebrate a hugely important privacy bill that *has* passed: the Shield Law, HB 1469\. As Nina Shapiro reports in [Amid post-Roe landscape, WA lawmakers pass abortion ‘shield law’ ](https://www.seattletimes.com/seattle-news/politics/amid-post-roe-landscape-wa-lawmakers-pass-abortion-shield-law/?ref=thenexusofprivacy.net) > The bill, passed by the House in February, prevents abortion-related subpoenas, extradition requests, warrants and other legal mechanisms from getting traction in Washington. It also creates a counterclaim of up to $10,000, plus damages, for those targeted by such legal action. The legislation similarly protects gender-affirming care. > > Reproductive rights advocates said the necessity of a shield law became even more apparent after Idaho lawmakers last month [passed a bill ](https://www.seattletimes.com/seattle-news/idaho-abortion-trafficking-bill-opens-pandoras-box-of-questions-for-wa/?ref=thenexusofprivacy.net)making it a crime to help minors get abortions without parental consent, such as by driving them to Washington or other states where abortion is legal. The penalty for so-called abortion “trafficking” is two to five years imprisonment. Congrats to all the advocates who worked to support this bill through the legislature – and to Shield Law sponsors Sen. Yasmin Trudeau (D-Tacoma) and Rep. Drew Hansen (D-Kitsap County)! Sen. Trudeau has a great discussion of the importance of the Shield Law in [Can Washington Protect Out-of-State Abortion Rights?](https://www.youtube.com/watch?v=qc%5FuLJn9pwA&ref=thenexusofprivacy.net) on the Indivisible Podcast, and Danni Askini of Gender Justice League has an excellent short thread on Twitter putting [the Shield Law in context with other bills passed this session to fight back against the anti-abortion & anti-trans attacks](https://twitter.com/danniaskini/status/1645604389590036482?ref=thenexusofprivacy.net). Still, as important as the Shield Law is, it's only part of the protections that are needed in a world where Idaho has criminalized abortion and gender-affirming care for minors as well as abortion "trafficking." If Idaho law enforcement (or bounty hunters, who can get up to $20,000 thanks to Idaho's "civil enforcement" provision) can continue to just [buy lists of people who visit Planned Parenthood clinics](https://www.vice.com/en/article/m7vzjb/location-data-abortion-clinics-safegraph-planned-parenthood?ref=thenexusofprivacy.net) or [infer that somebody's pregant based on their purchasing history](https://www.npr.org/2022/08/13/1115414467/consumer-data-abortion-roe-wade-pregnancy-test-rewards-card-target-walgreens?ref=thenexusofprivacy.net), they can undercut the Shield Law's protections. So My Health My Data's limits on sharing and selling Washingtonians' health data not already protected by HIPAA – including location data indicating they've visited to a facility offering reproductive, sexual, or gender-affirming care services – are a critical complement to the Shield Law. ## Of course protecting people from Idaho who are coming to Washington for abortions and gender-affirming care is important, but you wouldn't want the sky to fall, would you? > "In addition to protecting private health care data not currently covered by HIPAA, ACLU of Washington Technology and Liberty Project Manager Jennifer Lee [said](https://www.aclu-wa.org/news/aclu-washington-comment-senate-passage-washington-my-health-my-data-act-eshb-1155?ref=thenexusofprivacy.net) the bill "will reduce barriers to abortion and gender-affirming health care access."" > > – [Washington state on track to pass broad-based health data privacy law](https://iapp.org/news/a/washington-on-track-to-pass-health-data-privacy-law/?ref=thenexusofprivacy.net), Jennifer Bryant, International Association of Privacy Professionals (IAPP) Privacy Explorer, April 14 That's a good thing in my books. And tech companies and their lobbyists say they agree. After all, protecting reproductive rights is enormously popular in Washington state; Northwest Progressive Institute (NPI) reports that [more than three-fourths of Washington voters support My Health, My Data's protections](https://www.nwprogressive.org/weblog/2023/04/more-than-three-fourths-of-washington-voters-support-the-proposed-my-health-my-data-act.html?ref=thenexusofprivacy.net).[2](#notes) Not only that, many tech companies position themselves as LGBTQ+-friendly and supportive of pregnant people. So when lobbyists and other tech industry representatives talk about My Health My Data they consistently say they support the bill's goals. But. Despite saying they supporting My Health My Data's goals, lobbyists and other tech industry representatives just as consistently push back against the bill's actual protections. For example, in the IAPP article and other blog posts, Future of Privacy Forum Senior Fellow (and former Microsoft Chief Privacy Counsel) Mike Hintze, State Privacy and Security Coalition lobbyist Andrew Kingman, and executives at tech startups who currently rely on using customer data without consent all express concern that My Health My Data is "broader and more onerous than HIPAA", "overly broad", "extremely broad" ... hey wait a second, I'm noticing a pattern here. But that's not all, according to these totally unbiased experts. My Health My Data creates "unprecedented obligations"! It's "extreme"! It's "vague"! It could have "potentially negative impacts to health-related research and innovation"! Its "overbreadth may well mean that notifications for collecting and sharing truly sensitive reproductive health and gender-affirming care data get lost in the shuffle of opt-in notifications for innocuous, everyday transactions." And if that's not enough, industry representatives warn, the private right of action in the Senate version of My Health My Data (allowing people to sue companies and CPCs when they break the law) will surely cause the sky to fall. OR WORSE!!!!!! You wouldn't want the sky to fall, would you? > The Future of Privacy Forum receives money from Amazon, Apple, Google, Facebook, and Microsoft, as well as industry groups like the Interactive Advertising Bureau and DLA Piper, the law firm behind the State Privacy and Security Coalition. > > – [Tech Industry Groups Are Watering Down Attempts at Privacy Regulation, One State at a Time](https://themarkup.org/privacy/2022/05/26/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time?ref=thenexusofprivacy.net), by Todd Feathers and Alfred Ng on *The Markup* (2022) ## The private right of action, the per se clause and why it matters Sen. Trudeau discusses the private right of action and the"per se" clause starting at about 9:20 into [Can Washington Protect Out-of-State Abortion Rights?](https://www.youtube.com/watch?v=qc%5FuLJn9pwA&ref=thenexusofprivacy.net) on the Indivisible Podcast With that as background, let's look at the private right of action per se clause in My Health My Data. Here's Section 11 of the Senate version of the bill: > "A violation of this chapter is not reasonable in relation to the development and preservation of business, and is an unfair or deceptive act in trade or commerce and an unfair method of competition for the purpose of applying the consumer protection act, chapter 19.86 RCW." It doesn't look like that big a deal, does it? It simply says that violating My Helath My Data is treated as a "per se" violation of the state consumer protection act, which allows the AG to investigate – and individuals to sue. In the video, Sen. Trudeau points out that there's already a per se clause in over 133 statutes in law. As [Legal Voice's excellent short analysis](https://wa-privacy.net/organizing/2023-leg/my-health-my-data-eshb-1155-legal-voice-overview/?ref=thenexusofprivacy.net) discusses, though, the per se clause provides critical protenctions for people seeking abortion care. Suppose "Jane" accidentally ends up at a CPC, who gathers her name, address, medical history, creates a profile in their database with her information, and shares it with their network of CPCs nationwide without getting Jane's consent. With a private right of action, Jane can use the Consumer Protection Act to sue the CPC to get them to stop sharing her info and possibly get compensation for the harm she endured. But if there’s no “per se” violation, Jane would face a very difficult legal process. From the Legal Voice analysis: > She would have to prove that the fake clinic engages in trade and commerce - which can be a difficult argument as they often lure people in with promises of free diapers, formulas, and fake ultrasounds. > > She would also have to prove that it is against the public interest for them to continue storing and selling or sharing people’s health data without her affirmative consent. This requires establishing a pattern of conduct - something that can be especially difficult for individual plaintiffs. > > The Washington Supreme Court has acknowledged that this is a **high burden for a private plaintiff** \- in this case, it could deter Jane from seeking any sort of compensation for the distress she suffered, or the CPC from any significant consequences for the misuse of her health information. > > The Attorney General’s Office would not be able to take on Jane’s case because they do not represent private individuals. They would have to wait until they received multiple complaints - which could take years. Meanwhile, Jane would have no meaningful access to a remedy. Of course CPCs aren't the only ones who can be sued under the per se clause. So can data brokers, tech companies, retailers, or anybody else who breaks the law and collects, shares, or sells people's data without consent. As Sen. Trudeau says[,](https://www.youtube.com/watch?v=qc%5FuLJn9pwA&ref=thenexusofprivacy.net) the per se clause is a fundamental piece of consumer protection law. But tech lobbyists have been successful at keeping private rights of action out of state state privacy laws for the last 15 years, and they like it that way. Sen. Trudeau adds: > "I will just be totally candid: I think tech companies want to set a precedent through this bill." Yeah really. Washington privacy legislation has been a precedent for other states in the past: even though the Bad Washington Privacy Act (Bad WPA) repeatedly failed to pass here, an Amazon lobbyist gave it to a Virginia state legislator and because the basis of their state privacy law – which doesn't have a private right of action.[3](#notes) Since then, the Bad WPA has also been the basis of Colorado's and Connecticut's laws, and Utah has passed an even weaker law ... none of which have a private right of action. Tech wants to keep playing by their own rules, and if they can block the per se clause here that'll give them advantage in other states and federally. Then again, if Washington passes a health data privacy bill with a strong private right of action, that will reinforce the push for strong privacy legislation – and the broader fighting to hold tech accountable – in other states and in Congress. ## And so, here we are Last week's [And you may ask yourself ... well, how did we get here?](https://thenexusofprivacy.net/my-health-my-data-senate-floor/#and-you-may-ask-yourself-well-how-did-we-get-here) traced My Health My Data's path of the bill from its introduction last October by Rep. Vandana Slatter (D-Bellevue), Sen. Manka Dhingra (D-Redmond), and Attorney General Bob Ferguson to the eve of the Senate floor vote, so I'll just include a couple of the key points here. - A House floor amendment from Rep Amy Walen (D-Bellevue) removed the per se clause for lawsuits from individuals - The Senate Law & Justice committee restored the per se clause, although pushed the effective data for most of the bill's protections back to March 31, 2024 (except for the limitations on geofencing, which still go into effect July 23 2023). On the Senate floor, Sen. Mark Mullet (D-Issaquah) proposed a series of amendments that would have removed the per se clase for individuals, given companies and CPCs who break the law get-out-of-jail free cards, and significantly narrowed the definition of consumer health data. Fortunately Law & Justice Chair Dhingra, Sen. Trudeau, and Sen. Patty Kuderer (D-Bellevue) had very strong responses in the floor debate to the Mullet's amendments. Republicans supported Mullet's amendments, and proposed other weakening amendments of their own[4](#notes), but Democrats have enough of a majority that they all failed. Whew. Instead, the Senate adopted Chair Dhingra's floor striker, which made a smaller change to the definition of consumer health data, delayed the effective date for small businesses for an extra three months, and added a commission to review enforcement – but avoided more extensive changes. After adopting Chair Dhingra's striker, the Senate passed My Health My Data 27-21, with Mullet and all the Republicans voting no. Now it's up to the House to concur. ## Stay tuned! It's not surprising that tech's making one more try at sowing fear, uncertainty, and doubt with legislators. After all, they've got a track record of not giving up easily. In 2021, for example, after the House rejected the Bad WPA, former Sen. Reuven Carlyle (D-Amazon) [used procedural shenanigans](https://jedii.tech/the-clock-ticks-down-on-the-bad-wpa/?ref=thenexusofprivacy.net) to keep it alive after the cutoff, and then tried to "encourage" legislators to vote for it by [threatening to hold funding for eviction protection hostage](https://www.thestranger.com/slog/2021/04/29/56978551/washington-legislature-closes-session-with-massive-watered-down-wins?ref=thenexusofprivacy.net). It didn't work, but that didn't keep Carlyle from trying [more shenanigans last year](https://wa-privacy.net/the-situation-is-fluid/?ref=thenexusofprivacy.net) as part of his last doomed attempt to pass the Bad WPA. That once again didn't work, and Carlyle retired after going 0-for-4 with the Bad WPA, but there are no doubt other legislators who will be happy to do their corporate masters' bidding if told. Flash forward to 2023 and it's pretty easy to see what tech's strategy is at this point. Legislators are under a lot of pressure to pass something, so if tech can keep the House from concurring, they'll potentially have a lot of leverage. If the House votes not to concur, then the Senate will vote on a version of the bill *without* the per se clause – and if they vote yes, that's the bill that goes to Gov. Inslee to sign. If not, then it goes to a cross-chamber "reconciliation" committee who will try to come up with a version that can pass both chambers. And if that doesn't happen, then My Health My Data would be dead for the session. So it's no surprise that lobbyists looking to weaken the bill (or perhaps even cause enough chaos that it doesn't pass) are sharpening their talking points and cranking up their PR machines. And tech's also playing the long game. If something passes that they don't like, it'll almost certainly get challenged in court. Since the law doesn't go into effect until March 31 2024, they can try to change it next session. For all I know, they have other tricks up their sleeve as well. Then again privacy advocates and supporters of reproductive right and gender-affirming care are also playing the long game. If shenanigans ensue and tech somehow manages to sabotage the bill, there will be pressure on Gov. Inslee to call a special session. And next session could also offer opportunities to strengthen My Health My Data's protections. Historically, privacy laws haven't gotten strengthened after they've originally been passed ... but that could well change in the unprecedented post-Dobbs world. So we'll see what happens over the last week of the session. The most likely outcome is that tech's last-ditch efforts fail and the House concurs. Democrats have a big majority in the House, and especially with all the headlines about the threats to medication abortion and Idaho's over-the-top laws, it'll be hard for them to defend a vote against protecting reproductive right. By all accounts, at this point even industry-friendly corporate Democratic legislators are saying they support concurrence. If so, then My Health My Data is very close to becoming law. Still ... you never know. It ain't over 'til it's over. Stay tuned! **UPDATE, 12:15 pm: the House voted 57-40 to concur with the Senate amendment. Gov. Inslee still has to sign the bill, but at least from the legislative perspective: it's over.** ![IN THE HOUSE Apr 17 Rules suspended. Placed on Third Reading. House concurred in Senate amendments. Passed final passage; yeas, 57; nays, 40; absent, 0; excused, 1.](https://thenexusofprivacy.net/content/images/2023/04/Screen-Shot-2023-04-17-at-12.34.15-PM.png) --- *Image credit:* photo of Washington State Capitol by Al Toney, via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons](https://en.wikipedia.org/wiki/en:Creative%5FCommons?ref=thenexusofprivacy.net)[Attribution-Share Alike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net) license. --- ## Notes 1 rather confusingly, both the Senate and the House version are referred to as ESHB 1155; the acronym stands for engrossed substitute House bill 1155, and "engrossed" means that the substitute bill the Civil Rights & Judiciary committee advanced has been further amended. The legislature's [bill page](https://app.leg.wa.gov/billsummary?BillNumber=1155&Year=2023&Initiative=false&ref=thenexusofprivacy.net) links to the Senate version as [1155-S.E AMS ENGR S2826.](https://lawfilesext.leg.wa.gov/biennium/2023-24/Pdf/Amendments/Senate/1155-S.E%20AMS%20ENGR%20S2826.E.pdf?ref=thenexusofprivacy.net), and to the House version as the [Engrossed Substitute](https://lawfilesext.leg.wa.gov/biennium/2023-24/Pdf/Bills/House%20Bills/1155-S.E.pdf?q=20230411083730&ref=thenexusofprivacy.net). But wait, there's more: the interim "striker" version advanced by the Law & Justice committee is *also* referred to as ESHB 1155 and linked to as [1155-S.E AMS LAW S2558.1](https://lawfilesext.leg.wa.gov/biennium/2023-24/Pdf/Amendments/Senate/1155-S.E%20AMS%20LAW%20S2558.1.pdf?ref=thenexusofprivacy.net); and there was also a floor striker from Senator Dhingra. Yeesh. For simplicity, I'll refer to them as the Senate version and House version. 2 And I wouldn't be surprised if this underestimates the actual support. The question NPI asked combined several different aspects of the bill so was remarkably long: > Do you strongly support, somewhat support, somewhat oppose, or strongly oppose blocking health tracking apps and advertisers from collecting and selling Washingtonians’ health data without their consent, barring location-specific targeting of people who visit reproductive and gender affirming healthcare facilities, and requiring companies to maintain and publish a privacy policy for people’s health data? When I was summarizing the results to a friend, I described it as "76% support, and everybody else fell to sleep before the end of the question." 3 2020's [A bad day for a bad privacy bill, a good day for privacy](https://medium.com/a-change-is-coming/a-bad-day-for-a-bad-privacy-bill-a-good-day-for-privacy-a2aeea8e8739?ref=thenexusofprivacy.net) describes how the Senate version of the Bad WPA) didn't even have a per se clause for Attorney General enforcement – so the bill was literally unenforceable. Microsoft's blog post touted the bill's "strong enforcement" and Future of Privacy Forum's post inaccurately claimed the AG could enforce it 😂 😂 😂 \] After spirited discussion and a great floor debate, the 2020 session ended with the bill dying in reconciliation after the House added a per se clause for the AG and a private right of action and tech refused any compromises. Good times. 4 Along with a strengthening amendment: Sen. Keith Wagoner (Skagit and Snohomish Counties) proposing extending My Health My Data's protections to data held by government agencies. Wagoner's amendment addressed the tribal sovereignty issues Rep. Tarra Simmons (D-Kitsap County) had pointed out with a simliar House amendment, but didn't address the issue that My Health My Data's enforcement is via the CPA and the CPA doesn't apply to government agencies. Chair Dhingra supported the idea in principle, but suggested that it needs to be addressed to another bill that has more comprehensive protections, and expressed hope that legislators from both parties will work on it in the interim. Let's hope that happens! And it's worth mentioning that the [People's Privacy Act](https://www.aclu-wa.org/story/introducing-people%E2%80%99s-privacy-act-real-privacy-protections-everyone?ref=thenexusofprivacy.net) (sponsored by Rep. Shelley Kloba (D-Kirkland) and Sen. Bob. Hasegawa (D-Seattle)) *does* cover data held by government agencies, and has bipartisan sponsorship ... so once again, as the session draw to a close, the People's Privacy Act is closer to a hearing than it's ever been! ### My Health My Data heads to the Senate floor: Washington privacy legislation update, April 4 URL: https://thenexusofprivacy.net/my-health-my-data-senate-floor/ Last updated: 2026-04-16T03:02:43.000Z > Attorney General Bob Ferguson, Senator Manka Dhingra and Representative Vandana Slatter have a[ media event at 12:30 today, streamed live on TVW,](https://www.tvw.org/watch/?clientID=9375922947&eventID=2023041106&ref=thenexusofprivacy.net) to discuss polling results regarding the privacy of reproductive health data. With only three weeks left in the legislative session, the stakes are high for the upcoming Washington State Senate floor vote on the My Health My Data (HB 1155) consumer health data privacy bill. Everybody says they agree with the bill's goals of protecting consumer health data and people seeking reproductive, sexual, and gender-affirming health care. But industry continues to press to weaken enforcement and insert loopholes, Republicans have consistently voted againt the bill so far, and a small handful of industry-friendly Democrats are trying to use their leverage to shape the bill to better serve their corporate masters – or, perhaps, even kill it. With the Senate expected to vote as early as tomorrow, now's a good time to look at the potential course of the bill. First though, let's do a brief recap of what's happened to date. > UPDATE: On April 5, the Senate passed an amended version of My Health My Data 27-21, rejecting amendments to remove or limit the per se clause, but delaying enforcement on small businesses an additional three months. Up next: the House votes on whether to "concur" and accept the Senate's changes. Stay tuned! ## And you may ask yourself ... well, how did we get here? > A bill proposed by Washington state lawmakers would make it illegal for period-tracking apps, Google or any other website to sell consumers' health data while also making it harder for them to collect and share this personal information. > > Washington Representative Vandana Slatter, a Democrat, introduced House Bill 1155 \[[PDF](https://lawfilesext.leg.wa.gov/biennium/2023-24/Pdf/Bills/House%20Bills/1155.pdf?q=20230117124001&ref=thenexusofprivacy.net)\], the My Health, My Data Act, in response to the US Supreme Court ruling last year to [overturn Roe v. Wade](https://www.theregister.com/2022/06/24/big%5Ftech%5Fpost%5Froe%5Fwade/?ref=thenexusofprivacy.net), which removed constitutional rights to abortion. Since then, a dozen states have [banned](https://reproductiverights.org/maps/abortion-laws-by-state/?ref=thenexusofprivacy.net) the procedure. > > "It's long overdue that we have increased data protections for our most sensitive health data, and it's taken on an increased urgency in a post-Dobbs world," Slatter told *The Register*. "This information, if it's bought or sold, can do real harm." > > – [Proposed Washington law puts period-tracking apps on notice](https://www.theregister.com/2023/01/18/washington%5Fperiod%5Ftracking%5Fapps/?ref=thenexusofprivacy.net), Jessica Lyons Hardcastle in The Register, January 18 My Health My Data's initial announcement [last October](https://www.atg.wa.gov/news/news-releases/ag-ferguson-rep-slatter-sen-dhingra-propose-legislation-protect-washingtonians?ref=thenexusofprivacy.net) by Rep. Vandana Slatter (D-Bellevue), Sen. Manka Dhingra (D-Redmond), and Attorney General Bob Ferguson. The bill described in the announcement, and in Rep. Slatter's original version of HB 1155, not only required opt-in consent before collecting and sharing consumer health data, it also prohibited sales of consumer health data and the use of geofencing at reproductive and gender affirming health care facilities. [At its House Civil Rights & Judiciary (CR&J) Committee hearing](https://thenexusofprivacy.net/my-health-my-data-encouraging-first-step/), Legal Voice, Gender Justice League, Cedar River Clinics, ACLU of Washington, Pro-Choice Washington, Planned Parenthood Alliance Advocates, SEIU Healthcare 1199NW, patients, and privacy advocates (including me!) all supported it – although CR&J Chair Drew Hansen (D-Kitsap County) prevented not allowing four women and a trans femme person (several of whom have very relevant experience in the tech industry) from testifying. But [the industry lobbyists who water down state privacy regulation](https://themarkup.org/privacy/2022/05/26/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time?ref=thenexusofprivacy.net) testified OTHER, claiming they supported the bill's goals while suggesting numerous "improvements" that undercut the bill's protections. Chair Hansen took most of industry's suggestions for improvements, and the CR&J committee advanced SHB 1155, [a watered-down substitute version of the original bill](https://thenexusofprivacy.net/a-watered-down-substitute-advances/). Then the House adopted an amendment from Rep. Amy Walen (D-Bellevue) limiting the "per se" clause for civil suits and making it virtually impossible for individuals to succeed in suits companies (or so-called "crisis pregnancy centers" (CPCs) run by anti-abortion groups) who break the law. So my feelings were very mixed when the House advanced ESHB 1155 . On the one hand, the tech industry is very influential here in Washington, so getting *anything* through the House in the teeth of their lobbying was a huge accomplishment; and the original bill was so strong that even after the watering down, it still has some very valuable protections. Opt-in consent for collecting, using, and sharing consumer health data, and a separate signed authorization required for selling it, is a big deal! But on the other hand, it seemed to me that there were enough loopholes and exemptions in the bill that it would still be easy for law enforcement and bounty hunters to target people getting reproductive and gender-affirming care, and for big tech companies and data brokers to continue to make money by exploiting our data. Even worse, Rep. Walen's amendment had gutted enforcement and the bill's protections for reproductive rights. Fortunately, testimony at the Senate Law & Justice committee hearing from Cher Scarlett, Raquel Clavette, and ACLU of Washington's Jennifer Lee – and written testiony from Legal Voice as well as grassroots privacy activists who didn't get to speak at the hearing — highlighted some of the issues with the House bill. Law & Justice committee member Sen. Yasmin Trudeau, who was previously in the AGO, made [a powerful case](https://www.youtube.com/watch?v=qc%5FuLJn9pwA&ref=thenexusofprivacy.net) for why the per se clause is so important from a consumer protection perspective. And at Town Halls across the state, constituents asked their legislators why the bill had been weakened so much despite the huge outpouring of support. So Chair Dhingra and the rest of the Law & Justice committee advanced a new version (still formally known as ESHB 1155, although technically it's amendment [S2558.1](https://lawfilesext.leg.wa.gov/biennium/2023-24/Pdf/Amendments/Senate/1155-S.E%20AMS%20LAW%20S2558.1.pdf?ref=thenexusofprivacy.net)) that restored the per se clause (undoing the effects of the Walen amendment), and included several other important improvements. It's not everything that privacy advocates had been looking for but it's significant progress over the version the House advanced. But of course that's just one committee's opinion. Now, the full Senate gets a chance to consider further amendments and then vote on the (potentially-further-amended) bill. ## What to expect on the Senate floor The Senate has to pass My Health My Data by April 12\. If as expected they vote on it this week, we 're likely start to see potential amendments as early as today. My guess is that a small number of corporate Democrats are threatening to vote against the bill unless it's weakened. If so, the vast majority of Democrats who want to protect people seeking reproductive, sexual and gender-affirming care will have to decide whether to call their bluff. At this point, all the discussions are behind closed doors, so it's anybody's guess how it'll come out. If discussions in the caucus room don't lead to agreement and there aren't enough votes to pass something, then it's possible that My Health My Data won't even get a Senate floor vote. That seems very unlikely to me – would Senate Democrats really be so self-destructive that they'd let this key bill fail at this point? But then again, you never know. Assuming it does get to the floor, one key battle will be over the "per se" clause. Republicans will almost certainly introduce amendments to remove or limit it. Will corporate Democrats do the same? How else will they try to weaken enforcement? In the House, Rep. Walen started by introducing an amendment to completely eliminate the per se clause for civil suits along with another to give tech companies, auto dealerships, and CPCs an unlimited number of get-out-of-jail-free cards (aka the "right to cure"). Then she introduced "compromises": severely limiting (but not compeltely removing) the per se clause, and limiting the "right to cure" so that tech companies, auto dealerships, and CPCs only get a limited number of get-out-of-jail free cards. Then she withdrew the "compromise" "right to cure" amendment, and House Democrats agreed to the "compromise" of severely limiting people's ability to sue tech companies, auto dealerships, and CPCs. We might well see similar tactics in the Senate. Then again, there are plenty of other ways to limit enforcement, so perhaps we'll see some different "compromises" suggested. Of course, enforcement is far from the only issue on the table! [A dozen Indivisible groups sent a letter to the Senate last week](https://indipluswa.medium.com/hb-1155-indivisibles-tell-washington-senate-do-not-weaken-my-health-my-data-pass-as-strong-a-205bbbfb1be8?ref=thenexusofprivacy.net) asking lawmakers to oppose all weakening amendments and support strengthening, for example by closing loopholes related to location data and geofencing, a topic [Washington Privacy Organizers' short analysis](https://wa-privacy.net/organizing/2023-leg/my-health-my-data-eshb-1155-location-data-geofencing/?ref=thenexusofprivacy.net) looks at in more detail. It'll be interesting to see if any Democrats propose strengthening amendments. And industry lobbyists have their own wish list. Republicans are likely propose to once again propose several amendments on industry's behalf, all of which will be rejected. We're also likely to see a Republican amendment to extend the bill's protections to cover data stored by government agencies. There's a lot to be said for this idea in principle; indeed, the People's Privacy Act covers govenment agencies as well as businesses and non-profits. However,as Rep. Tarra Simmons (D-Kitsap County) pointed out in the House floor debate, the specific language of the amendment Republicans keep proposing is problematic for multiple reasons, including raising sovereignity issues with tribal governments. So this too will be rejected. Hopefully legislators from both parties will craft a more workable version of this for next session – or just pass the People's Privacy Act! There may well be more amendments, with technical fixes smoothing out rough edges. Often, multiple changes get bundled into a "striker", which can then be further amended. On the House floor, there were over 20 amendments (although a few got withdrawn before voting), so it could be a lengthy session. Once all the amendments are voted on, then there's a final vote on the amended bill. It's rare for bills to be voted down at this stage – if there aren't the votes, then it usually doesn't even come to the floor – but not to sound like a broken record: you never know. ## A quick note about gender As far as I know all the corporate Democrats in the Senate who are pushing to weaken My Health My Data are cis guys. Actually, let me be a bit more specific. As far as I know all the corporate Democrats in the Senate who are pushing to weaken My Health My Data's protections for pregnant people and people seeking gender-affirming care are cis guys. Just sayin'. ## What next? Assuming the Senate passes something, then ... - The next step is to go back to the House, who has the option to concur by accepting the Senate changes. - If the House says no, then the Senate has the option to go with the House's version. - If that doesn't happen, then it goes to a cross-chamber negotiating committee who has to come up with a version that both chambers approve. And it all has to be done by April 24 – unless of course the Governor tells legislators to stay longer, or calls for a special session. So there's still a long way to go for My Health My Data, and one lesson we've learned time and again with privacy legislation in Washington is that it ain't over 'til its over. Stay tuned! ### Privacy News Roundup: February 22 URL: https://thenexusofprivacy.net/privacy-news-february-22/ Last updated: 2023-02-26T19:58:42.000Z As always, a lot going on! ### [Forget Milk and Eggs: Supermarkets Are Having a Fire Sale on Data About You](https://themarkup.org/privacy/2023/02/16/forget-milk-and-eggs-supermarkets-are-having-a-fire-sale-on-data-about-you?ref=thenexusofprivacy.net) Jon Keegan on The Markup (themarkup.org) When you use supermarket discount cards, you are sharing much more than what is in your cart—and grocery chains like Kroger are reaping huge profits selling this data to brands and advertisers ### [EU parliamentary committee says ‘no’ to EU-US data privacy framework](https://computerworld.com/article/3688512/eu-parliamentary-committee-says-no-to-eu-us-data-privacy-framework.html?ref=thenexusofprivacy.net) Jon Gold on Computerworld (computerworld.com) Progress on ratifying the Trans-Atlantic Data Policy Framework hit a snag, as a parliamentary committee rejected a draft decision to adopt the pact, saying it did not comply with the EU’s GDPR privacy regulations. It's not really that surprising – there was a lot of [skepticism when the deal was first announced](https://www.computerworld.com/article/3676284/eu-us-data-sharing-agreement-is-it-a-done-deal.html?ref=thenexusofprivacy.net) – but hope springs eternal. ## State privacy legislation ### [Congress’ push for a privacy law is alive and well — in statehouses](https://politico.com/news/2023/02/22/statehouses-privacy-law-cybersecurity-00083775?ref=thenexusofprivacy.net) Alfred Ng on POLITICO (politico.com) Ng looks at EPIC's push for state legisation modeled after the American Data Privacy and Protection Act (ADPPA). Massachusetts and Illinois have already introduced bills based on ADPPA; meanwhile, other states are continuing to introduce TechNet-backed bills similar to Virginia's (based on the Bad Washington Privacy Act). ### [California lawmaker seeks to end to ‘reverse warrants’ that could pinpoint abortion seekers](https://cyberscoop.com/california-lawmaker-reverse-warrants-abortion?ref=thenexusofprivacy.net) Tonya Riley on CyberScoop (cyberscoop.com) Lawmakers say the overly broad digital surveillance tool poses a major threat to reproductive health privacy. ALSO: [EFF Backs California Bill to Protect People Seeking Abortion and Gender-Affirming Care from Dragnet Digital Surveillance](https://eff.org/deeplinks/2023/02/eff-backs-california-bill-protect-people-seeking-abortion-and-gender-affirming?ref=thenexusofprivacy.net), Hayley Tsukayama on Electronic Frontier Foundation (eff.org) ### [Opinion: This bill would hurt children while trying to help them](https://deseret.com/opinion/2023/2/7/23590084/utah-lawmakers-would-hurt-children-while-trying-to-help-them?ref=thenexusofprivacy.net) Shoshana Weissmann on Deseret News (deseret.com) Utah lawmakers are considering SB152, which would require children and adults to provide proof of age to internet sites in order to gain access ### [Illinois Supreme Court Determines BIPA Claims Accrue Individually With Each Violation](https://natlawreview.com/article/breaking-illinois-supreme-court-determines-bipa-claims-accrue-individually-each?ref=thenexusofprivacy.net) Kristin L. Bryan, Kyle R. Fath, Christina Lamoureux, and David J. Oberly on The National Law Review (natlawreview.com) The Illinois Supreme Court today confirmed that each separate violation of the Illinois Biometric Information Privacy Act (BIPA) constitutes a distinct and separately actionable violation of the statute. The decision exponentially increases liability exposure and the scope of damages that may be collected for alleged violations of BIPA. ALSO - [White Castle faces up to $17B fine over worker fingerprints](https://theregister.com/2023/02/18/white%5Fcastle%5Ffingerprints%5Ffine?ref=thenexusofprivacy.net), Tobias Mann on The Register (theregister.com) - [Illinois Supreme Court Holds Five-Year Limitations Period Applies To All BIPA Claims](https://natlawreview.com/article/illinois-supreme-court-holds-five-year-limitations-period-applies-to-all-bipa-claims?ref=thenexusofprivacy.net), Mark Wallin on The National Law Review (natlawreview.com) - [Ill. Justices Say BIPA Claims Accrue With Each Scan](https://law360.com/cybersecurity-privacy/articles/1531953?nl%5Fpk=d4492b03-bbb4-474b-ad68-e84d600d1892&nlaidx=0&nlsidx=0&ref=thenexusofprivacy.net), Law360 - (law360.com) - [Illinois Supreme Court issues opinion over ongoing White Castle biometric privacy case](https://foxbusiness.com/markets/illinois-supreme-court-issues-opinion-ongoing-white-castle-biometric-privacy-case?ref=thenexusofprivacy.net), Aislinn Murphy on Fox Business (foxbusiness.com) - [Biometric Privacy Class Actions Take Aim at Virtual “Try-On” Retailers](https://natlawreview.com/article/biometric-privacy-class-actions-take-aim-virtual-try-retailers?ref=thenexusofprivacy.net), Robert D. Boley on The National Law Review (natlawreview.com) ## AI and Automated Decision Systems #### ### [German Constitutional Court strikes down predictive algorithms for policing](https://euractiv.com/section/artificial-intelligence/news/german-constitutional-court-strikes-down-predictive-algorithms-for-policing?pnespid=quk5VyNYKP9LxqTZ.C%5F7CYmDskqnVpctLOfgxft48kRmW2YkcXm3Q7lIhNrdFL5rPC2w5hqTIQ&ref=thenexusofprivacy.net) Molly Killeen on EURACTIV (euractiv.com) The German Federal Constitutional Court has declared the use of Palantir surveillance software by police in the states of Hesse and Hamburg unconstitutional. ALSO: - [Germany Raises Red Flags About Palantir’s Big Data Dragnet](https://wired.com/story/palantir-germany-gotham-dragnet?ref=thenexusofprivacy.net), Morgan Meaker on WIRED (wired.com) - [German Court Rules Police Use of Crime-Fighting Software is Unlawful](https://voanews.com/a/german-court-rules-police-use-of-crime-fighting-software-is-unlawful-/6965666.html?ref=thenexusofprivacy.net), Reuters on Voice of America (VOA News) (voanews.com) - [Bundesverfassungsgericht - Entscheidungen - Regelungen in Hessen und Hamburg zur automatisierten Datenanalyse für die vorbeugende Bekämpfung von Straftaten s...](https://bundesverfassungsgericht.de/SharedDocs/Entscheidungen/DE/2023/02/rs20230216%5F1bvr154719.html?ref=thenexusofprivacy.net) on BVerfG (bundesverfassungsgericht.de) ### [Privacy Regulators Step Up Oversight of AI Use in Europe](https://wsj.com/articles/privacy-regulators-step-up-oversight-of-ai-use-in-europe-b1a894b9?ref=thenexusofprivacy.net) Catherine Stupp on The Wall Street Journal (wsj.com) The growth of AI business applications, plus coming EU rules on the technology, are pushing privacy regulators to open dedicated units and hire staff. ### [Can ‘we the people’ keep AI in check?](https://techcrunch.com/2023/02/16/ai%5Fgovernance?ref=thenexusofprivacy.net) Connie Loizos on TechCrunch (techcrunch.com) Technologist and researcher Aviv Ovadya isn’t sure that generative AI can be governed, but he thinks the most plausible means of keeping it in check might just be entrusting those who will be impacted by AI to collectively decide on the ways to curb it. ## Commerical surveillance ### [Meta will also sell blue badge on Instagram and Facebook](https://techcrunch.com/2023/02/19/meta-verified-instagram-facebook?ref=thenexusofprivacy.net) Manish Singh on TechCrunch (techcrunch.com) [Remember how hard people fought against Facebook's "real names" policy back in 2014](https://www.theguardian.com/technology/2014/oct/01/victory-drag-queens-facebook-apologises-real-name-policy?ref=thenexusofprivacy.net)? Now, Meta CEO Mark Zuckerberg has launched Meta Verified, a subscription service that will allow Facebook and Instagram users to pay for the privilege of sending them your government-issued ID and getting a blue badge. It's a great example of the phenomon Chris Gilliard and David Golumbia describe in [Luxury Surveillance](https://reallifemag.com/luxury-surveillance/?ref=thenexusofprivacy.net): "People pay a premium for tracking technologies that get imposed unwillingly on others." ### [Google Launches Way for Android Apps to Track You Without Tracking You](https://gizmodo.com/google-android-launches-privacy-sandbox-chrome-cookies-1850112117?ref=thenexusofprivacy.net) Thomas Germain on Gizmodo (gizmodo.com) Privacy Sandbox, the set of changes that will kill third-party cookies forever, is now coming to Android. Paradoxically, Google says the goal is to track everything you do online in a way that’s better for your privacy. ALSO: [Android launches yet another way to spy on users with “Privacy Sandbox” beta](https://arstechnica.com/gadgets/2023/02/googles-privacy-sandbox-advertising-system-arrives-on-android-in-beta?ref=thenexusofprivacy.net), Ron Amadeo on Ars Technica (arstechnica.com) ### [Twitter’s Two-Factor Authentication Change ‘Doesn’t Make Sense’](https://wired.com/story/twitter-sms-2fa-twitter-blue?ref=thenexusofprivacy.net) Lily Hay Newman on WIRED (wired.com) The company will soon require users to pay for a Twitter Blue subscription to get sign-in codes via SMS. Security experts are baffled. ALSO: [How to keep your Twitter secure without giving Elon Musk any money](https://techcrunch.com/2023/02/18/how-to-keep-twitter-secure-two-factor?ref=thenexusofprivacy.net), Zack Whittaker on TechCrunch (techcrunch.com) ## And ... #### [FTC’s new Office of Technology will help mop up tech ‘oozing with snake oil’](https://techcrunch.com/2023/02/17/ftcs-new-office-of-technology-will-help-mop-up-tech-oozing-with-snake-oil?ref=thenexusofprivacy.net) Devin Coldewey on TechCrunch (techcrunch.com) The FTC is embracing change with the establishment of an Office of Technology that will help it regulate the fast-moving world of tech. ALSO: [A Century of Technological Evolution at the Federal Trade Commission](https://ftc.gov/policy/advocacy-research/tech-at-ftc/2023/02/century-technological-evolution-federal-trade-commission?ref=thenexusofprivacy.net), the Premerger Notification Office Staff on Federal Trade Commission (ftc.gov) #### [Gonzalez v. Google Live Analysis – Institute for Rebooting Social Media](https://rebootingsocialmedia.org/events/gonzalez-v-google-live-analysis?ref=thenexusofprivacy.net) on rebootingsocialmedia.org A detailed discussion of the Supreme Court hearing on a key Section 230 case. ALSO: [Quick Debrief on the Gonzalez v. Google Oral Arguments](https://blog.ericgoldman.org/archives/2023/02/quick-debrief-on-the-gonzalez-v-google-oral-arguments.htm?ref=thenexusofprivacy.net), Eric Goldman on Technology & Marketing Law Blog (blog.ericgoldman.org) #### [New research suggests that privacy in the metaverse might be impossible](https://venturebeat.com/virtual/new-research-suggests-that-privacy-in-the-metaverse-might-be-impossible?ref=thenexusofprivacy.net) Louis Rosenberg, Unanimous A.I. on VentureBeat (venturebeat.com) Protecting privacy in the metaverse is critical, and it’s shocking how little data is needed to uniquely identify a user in the metaverse. #### [FTC Launches New Office of Technology to Bolster Agency’s Work](https://ftc.gov/news-events/news/press-releases/2023/02/ftc-launches-new-office-technology-bolster-agencys-work?ref=thenexusofprivacy.net) the Premerger Notification Office Staff on Federal Trade Commission (ftc.gov) The Federal Trade Commission today launched a new #### [This Tool Could Protect Artists From A.I.-Generated Art That Steals Their Style](https://nytimes.com/2023/02/13/technology/ai-art-generator-lensa-stable-diffusion.html?ref=thenexusofprivacy.net) Kashmir Hill on NYTimes (nytimes.com) Artists want to be able to post their work online without the fear “of feeding this monster” that could replace them. #### [Air Canada Launches Digital Identification; First Airline to Test Facial Recognition Technology for Identification Verification in Canada](https://media.aircanada.com/2023-02-21-Air-Canada-Launches-Digital-Identification-First-Airline-to-Test-Facial-Recognition-Technology-for-Identification-Verification-in-Canada?ref=thenexusofprivacy.net) on Air Canada (media.aircanada.com) In a pilot project currently underway, Air Canada's digital identification is now available for customers departing from Vancouver International Airport and for eligible customers entering the Air Canada Café at Toronto Pearson International Airport. #### [Brussels sets out to fix the GDPR](https://politico.eu/article/brussels-plans-new-privacy-enforcement-law-by-summer?ref=thenexusofprivacy.net) Clothilde Goujard on POLITICO (politico.eu) New law to solve enforcement flaws of the GDPR could open a Pandora’s box of lobbying and regulators’ infighting. #### [Domestic violence hotline calls will soon be invisible on your family phone plan](https://arstechnica.com/tech-policy/2023/02/domestic-violence-hotline-calls-will-soon-be-invisible-on-your-family-phone-plan?ref=thenexusofprivacy.net) Ashley Belanger on Ars Technica (arstechnica.com) Domestic violence hotline launches biggest effort yet with wireless industry. #### [New Mobile Phone Service Shows We Can Have Both Privacy and Nice Things](https://aclu.org/news/privacy-technology/new-mobile-phone-service-shows-we-can-have-both-privacy-and-nice-things?ref=thenexusofprivacy.net) Daniel Kahn Gillmor, Jay Stanley on American Civil Liberties Union (aclu.org) Despite the desires of companies to monetize our data, we must insist that privacy be built into the technologies we depend on. #### [Artificial intelligence chatbot banned by Italian privacy authority](https://gamingtechlaw.com/2023/02/artificial-intelligence-powered-chatbot-italian-privacy-authority?ref=thenexusofprivacy.net) Giorgia Carneri on GamingTechLaw (gamingtechlaw.com) The Italian data privacy authority ordered the prohibited a chatbot powered by an artificial intelligence system #### [Privacy-by-design can be a source of value and opportunity, not cost](https://gulfbusiness.com/privacy-by-design-can-be-a-source-of-value?ref=thenexusofprivacy.net) Divsha Bhat on Gulf Business (gulfbusiness.com) Privacy can become a selling point and a source of value, especially when it is implemented by design and not reactively. #### [Privacy and Cybersecurity Issues in Electric Vehicles](https://jdsupra.com/legalnews/privacy-and-cybersecurity-issues-in-3086993?ref=thenexusofprivacy.net) Hannah Ji-Otto on JD Supra (jdsupra.com) This is the second article in a series of alerts that addresses what businesses, organizations and governmental entities should be considering as they... #### [Opinion: Chula Vista’s use of automated license plate surveillance threatens everyone’s privacy](https://sandiegouniontribune.com/opinion/commentary/story/2023-02-06/opinion-automated-license-plate-surveillance-is-going-too-far-in-chula-vista?ref=thenexusofprivacy.net) Norell Martinez, Nancy Relaford, Margaret Baker on San Diego Union-Tribune (sandiegouniontribune.com) Use of surveillance technology disproportionately impacts immigrants. #### [Americans Flunked This Test on Online Privacy](https://nytimes.com/2023/02/07/technology/online-privacy-tracking-report.html?ref=thenexusofprivacy.net) Natasha Singer and Jason Karaian on NYTimes (nytimes.com) Many consumers want control over their personal details. But few understand how online tracking works, says a new report from the University of Pennsylvania. #### [ChatGPT is a data privacy nightmare. If you’ve ever posted online, you ought to be concerned](https://theconversation.com/chatgpt-is-a-data-privacy-nightmare-if-youve-ever-posted-online-you-ought-to-be-concerned-199283?ref=thenexusofprivacy.net) Uri Gal on The Conversation (theconversation.com) ChatGPT is fuelled by our intimate online histories. It’s trained on 300 billion words, yet users have no way of knowing which of their data it contains. #### [Ex-Twitter privacy chief takes job at social media app BeReal](https://reuters.com/technology/ex-twitter-privacy-chief-takes-job-social-media-app-bereal-2023-02-07?ref=thenexusofprivacy.net) Sara Merken on Reuters (reuters.com) Damien Kieran, who resigned as Twitter Inc’s chief privacy officer in November after Elon Musk took over the social media giant, has joined photo sharing app-maker BeReal as its top lawyer. #### [A New Draft Privacy Model Blooms From the NAIC Privacy Working Group](https://jdsupra.com/legalnews/a-new-draft-privacy-model-blooms-from-1097567?ref=thenexusofprivacy.net) Ann Young Black on JD Supra (jdsupra.com) On February 1, the NAIC’s Privacy Working Group’s new privacy model germinated. After months of development, the exposure draft, titled “Insurance Consumer Privacy Protection Model Law #674” (Proposed Model), has finally reached daylight. #### [On the Grid: Data and Privacy Protection Act](https://natlawreview.com/article/grid-data-and-privacy-protection-act?ref=thenexusofprivacy.net) Mayukh Sircar on The National Law Review (natlawreview.com) In a presentation by Ward and Smith attorney Angela Doughty, In-House Counsel Seminar attendees received an overview on a variety of topics relevant to privacy and data security, including curren #### [Web Tracking Creates a Web of Data Privacy Risks](https://jdsupra.com/legalnews/web-tracking-creates-a-web-of-data-8881848?ref=thenexusofprivacy.net) Anahita Anvari on JD Supra (jdsupra.com) Regulatory enforcement and large litigation relating to the use of third party trackers on companies’ websites and applications have been on the rise.... #### [Evolving enforcement priorities in times of debate - Overview of regulatory strategies of European Data Protection Authorities for 2023 and beyond](https://fpf.org/blog/evolving-enforcement-priorities-in-times-of-debate-overview-of-regulatory-strategies-of-european-data-protection-authorities-for-2023-and-beyond?ref=thenexusofprivacy.net) Sebastião Barros Vale on Future of Privacy Forum (fpf.org) At a time where the effectiveness of the EU General Data Protection Regulation (GDPR) enforcement model is being challenged by the European Parliament, Data Protection Authorities (DPAs), civil society, and policymakers, the European Data Protection Board (EDPB) has launched several initiatives to reform the way DPAs are working together. #### [Why Colorado draft AI insurance rules are a “major leap forward” for AI governance](https://venturebeat.com/ai/why-colorado-draft-ai-insurance-rules-are-a-major-leap-forward-for-ai-governance?ref=thenexusofprivacy.net) Sharon Goldman on VentureBeat (venturebeat.com) Colorado’s draft rules for life insurance companies using AI for coverage decisions are game-changing, says Debevoise & Plimpton’s Avi Gesser. #### [Opinion | Why I’m Resigning as an FTC Commissioner](https://wsj.com/articles/why-im-resigning-from-the-ftc-commissioner-ftc-lina-khan-regulation-rule-violation-antitrust-339f115d?ref=thenexusofprivacy.net) Christine Wilson on The Wall Street Journal (wsj.com) Lina Khan’s disregard for the rule of law and due process make it impossible for me to continue serving. #### [The Economist Michigan information privacy $9.5M class action settlement](https://topclassactions.com/lawsuit-settlements/privacy/the-economist-michigan-information-privacy-9-5m-class-action-settlement?ref=thenexusofprivacy.net) Top Class Actions on Top Class Actions (topclassactions.com) The Economist agreed to pay $9.5 million to resolve claims it shared Michigan subscriber information with third parties without consent. #### [Mycroft’s privacy-first, crowdfunded smart speaker will ship, but not to backers](https://arstechnica.com/gadgets/2023/02/mycrofts-privacy-first-crowdfunded-smart-speaker-will-ship-but-not-to-backers?ref=thenexusofprivacy.net) Scharon Harding on Ars Technica (arstechnica.com) Echo alternative’s privacy focus is worth emulating, despite Mycroft’s failure. #### [No porn, no Instagram for kids: France doubles down on age verification](https://politico.eu/article/no-porn-no-instagram-for-kids-france-doubles-down-age-verification-emmanuel-macrons-nick-clegg?ref=thenexusofprivacy.net) Laura Kayali on POLITICO (politico.eu) French MPs want to expand age verification requirements to mainstream social platforms. #### [GAO Calls for Improved Data Privacy Protections](https://darkreading.com/application-security/gao-calls-for-improved-data-privacy-protections-?ref=thenexusofprivacy.net) Dark Reading Staff on Dark Reading (darkreading.com) US federal watchdog agency outlines key measures for better protecting sensitive data under the federal government’s control. #### [Australians able to opt out of targeted ads and erase their data under proposed privacy reforms](https://theguardian.com/australia-news/2023/feb/16/australians-able-to-opt-out-of-targeted-ads-and-erase-their-data-under-proposed-privacy-reforms?ref=thenexusofprivacy.net) Paul Karp on The Guardian (theguardian.com) Individual rights could be modelled on the EU’s general data protection regulation or GDPR #### [Julia Angwin Joins the Brown Institute as an Entrepreneur in Residence](https://brown.columbia.edu/julia-angwin-joins-the-brown-institute-as-an-entrepreneur-in-residence?ref=thenexusofprivacy.net) Mark Hansen on Brown Institute (brown.columbia.edu) #### [Almost 60% of GAO’s Privacy Recommendations Since 2010 Are Unresolved](https://nextgov.com/cybersecurity/2023/02/almost-60-gaos-privacy-recommendations-2010-are-unresolved/383005?ref=thenexusofprivacy.net) Edward Graham on Nextgov (nextgov.com) A watchdog report found that federal agencies have only implemented approximately 41% of recommendations related to the protection and security of sensitive data as of December 2022. #### [IAB Europe Reacts To Belgian Data Authority’s Validation Of Its Action Plan](https://iabeurope.eu/all-news/iab-europe-reacts-to-belgian-data-authoritys-validation-of-its-action-plan?ref=thenexusofprivacy.net) on IAB Europe (iabeurope.eu) The Interenet Advertising Bureau attempts to spin the latest ruling against them. #### [Australian privacy reform moves forward with new government report](https://iapp.org/news/a/australian-privacy-reform-moves-forward-with-new-government-report?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) The Australian Attorney-General’s Department released its highly anticipated review of the Privacy Act, a significant step in the reform of its privacy law. #### [U.S. Technical Advisory Group Helps ISO/PC 317 Complete New Global Standard for Consumer Protection: Privacy by Design](https://oasis-open.org/2023/02/16/us-tag-iso-pc317-consumer-protection-privacy-by-design?ref=thenexusofprivacy.net) Mary Beth Minto on OASIS Open (oasis-open.org) New York, NY, and Boston, MA – 16 February 2023 — The U.S. Technical Advisory Group (TAG) for Consumer Privacy by Design successfully concluded its mission with the publication of a new global standard approved by the International Organization for Standardization (ISO). Administered by the American… #### [How to protect your privacy from streaming TV services](https://techhive.com/article/1513900/how-to-protect-your-privacy-from-streaming-tv-services.html?ref=thenexusofprivacy.net) Jared Newman on TechHive (techhive.com) Four steps to disable smart TV snooping, streaming ad targeting, and data sharing. #### [TrustPid](https://edri.org/our-work/trustpid-baking-ad-tracking-into-the-internet-infrastructure?ref=thenexusofprivacy.net) (guest author) on European Digital Rights (EDRi) (edri.org) The new tracking system, misleadingly dubbed ‘TrustPid’, would be baked into the internet’s network infrastructure – potentially with little recourse or defence for users. #### [Government’s privacy review has some strong recommendations – now we really need action](https://theconversation.com/governments-privacy-review-has-some-strong-recommendations-now-we-really-need-action-200079?ref=thenexusofprivacy.net) Bruce Baer Arnold on The Conversation (theconversation.com) There are many good proposals in Dreyfus’s reform paper. But they risk being lost once again among the voices of those whose interests are served by maintaining the status quo. #### [Your Tax Data Shouldn’t Be Up for Grabs](https://themarkup.org/hello-world/2023/02/18/your-tax-data-shouldnt-be-up-for-grabs?ref=thenexusofprivacy.net) Colin Lecher on The Markup (themarkup.org) Especially when there’s a better way #### [Privacy Litigation Update: California courts will soon hear motions to dismiss in litigation that alleges chat functionality violates wiretapping statutes](https://jdsupra.com/legalnews/privacy-litigation-update-california-2447105?ref=thenexusofprivacy.net) Dustin Taylor on JD Supra (jdsupra.com) Keypoint: Slurry of litigation filed by privacy-plaintiffs has survived its first motion to dismiss challenge in a California court but faces tougher... #### [Senators pressure CFIUS to wrap up TikTok probe with strict restrictions, potentially even separating it from its Chinese parent company](https://cnbc.com/2023/02/16/senators-urge-cfius-to-wrap-up-tiktok-probe-with-strict-restrictions.html?%5F%5Fsource=sharebar%7Ctwitter&ref=thenexusofprivacy.net) Lauren Feiner on CNBC (cnbc.com) The letter is a signal of heightened pressure on the panel as TikTok has so far been able to continue its operations in the U.S. #### [How virtual reality telemetry is the next threat to privacy](https://theregister.com/2023/02/18/vr%5Ftelemetry%5Fidentity?ref=thenexusofprivacy.net) Thomas Claburn on The Register (theregister.com) Boffins find they can identify VR players just from head and hand movements #### [Leiden University stops using smart cameras over privacy concerns](https://nltimes.nl/2023/02/18/leiden-university-stops-using-smart-cameras-privacy-concerns?ref=thenexusofprivacy.net) on NL Times (nltimes.nl) Leiden University will definitely stop using smart cameras on campus after negative advice from the University Council. The cameras raised privacy concerns last year, and risks of violating the privacy of students and employees are too significant to keep using the devices, the University Council sa… #### [Stop collecting airline passenger details in a database: privacy watchdog](https://dutchnews.nl/news/2023/02/stop-collecting-airline-passenger-details-in-a-database-privacy-watchdog?ref=thenexusofprivacy.net) robin on DutchNews.nl (dutchnews.nl) The government must immediately stop processing all airline passengers’ details into a massive database, privacy watchdog Autoriteit Persoonsgegevens (AP) said on Tuesday. ’Travel details of all air passengers are being collected and updated in a database over a period of years and this is not allow… ### Another try at regulating Automated Decision Systems in Washington state (UPDATED) URL: https://thenexusofprivacy.net/automated-decision-systems-regulation/ Last updated: 2026-04-16T03:02:21.000Z *Originally published February 16, with a slightly different ending.* > "Governments are increasingly turning to automated systems to make decisions for criminal sentencing, medicare eligibility, and school placement. Public officials and companies tout gains in speed and efficiency, and the hope that automated decisions can bring more fairness into bureaucratic processes. But the drawbacks are coming into clearer focus. Computer algorithms can also reinforce or introduce new biases. [Studies have shown](https://www.perpetuallineup.org/?ref=thenexusofprivacy.net) that [facial recognition tools used by law enforcement](https://www.fastcompany.com/40564084/cop-cameras-can-track-you-in-real-time-and-theres-no-stopping-them?ref=thenexusofprivacy.net) could disproportionately impact African-Americans, that predictive policing software could unfairly [target](https://rss.onlinelibrary.wiley.com/doi/full/10.1111/j.1740-9713.2016.00960.x?ref=thenexusofprivacy.net) minority neighborhoods because of incomplete crime databases, and that algorithms can [perpetuate](https://www.fastcompany.com/90269688/high-tech-redlining-ai-is-quietly-upgrading-institutional-racism?ref=thenexusofprivacy.net) racial disparities in insurance premium costs. > > Lawmakers in Washington State are taking steps to tame this digital frontier." > > – [Washington could be the first state to rein in automated decision-making](https://www.fastcompany.com/90302465/washington-introduces-landmark-algorithmic-accountability-laws?ref=thenexusofprivacy.net), DJ Pangburn, *Fast Company,* 2019 Four years later, it's all still true. The discriminatory effects of automated decision systems (ADS) continue to come into clearer and clearer focus, and Washington's legislature is considering legislation to regulate ADS. This time, it's Sen. Bob Hasegawa's SB 5356, which proposes minimum standards for fairness and accountability for any government agency buying or using ADS. > Update: despite overwhelmingly positive testimony and signins at SB 5356's [hearing](#hearing), the Senate ENET Committee didn't act on the bill before the "policy cutoff", which means it's probably dead for the session. If you're pressed for time, feel free to skip ahead to details of [SB 5356](#sb5356), the discussion of the [hearing](#hearing), and [the next steps](#next-steps). But if you've got a couple of minutes, it's worth looking at how we got here. ## What's past is prologue The landmark 2019 algorithmic accountability bill the [*Fast Company* article](https://www.fastcompany.com/90302465/washington-introduces-landmark-algorithmic-accountability-laws?ref=thenexusofprivacy.net) covered died in committee. So did Sen. Hasegawa's Automated Decision Systems (ADS) regulation bill in 2021 ... and 2022\. And it's not just a Washington problem! As Todd Feathers' [Why It’s So Hard to Regulate Algorithms](https://themarkup.org/news/2022/01/04/why-its-so-hard-to-regulate-algorithms?ref=thenexusofprivacy.net) in *The Markup* (from early 2022) describes, Big Tech and government contractors have successfully derailed legislation almost everywhere by arguing that proposals are too broad. And even when legislation *has* passed, it's gotten watered down – last week's [New York City’s Law on Using Tech to Make Hiring Decisions Keeps Getting Weaker](https://slate.com/technology/2023/02/aedts-new-york-city-ll-144-automated-employment-decision-tools.html?ref=thenexusofprivacy.net) (by Matthew Scherer and Ridhi Shetty in *Slate Future Tense*) is a good example. More positively, even though Sen. Hasegawa's 2021 bill didn't pass, it led to a small budget proviso that created the [Automated Decision Systems (ADS) workgroup](https://watech.wa.gov/privacy/projects-and-initiatives?ref=thenexusofprivacy.net). The ADS workgroup was tasked with "developing recommendations for changes in state law and policy regarding the development procurement, and use of ADS by public agencies." As well as government agency leads, the workgroup also included researchers, and representatives from advocacy organizations that represent communities that are disproportionately vulnerable to being harmed by algorithmic bias. When I was invited to join (as a volunteer) to provide research perspectives, I was quite hesitant. New York City's earlier ADS workgroup had been a disaster: [they couldn't even agree on the defintion of an automated decision system](https://www.vox.com/recode/2019/12/18/21026229/nyc-ai-algorithms-shadow-report?ref=thenexusofprivacy.net)1, government agencies stonewalled civil society groups, and the workgroup's failure to get information established [a dangerous precedent](https://www.bloomberg.com/news/articles/2019-12-12/nyc-sets-dangerous-precedent-on-algorithm?ref=thenexusofprivacy.net). Still, I decided it was worth a try ... and fortunately, it worked out much better than I had feared. The agency leads in Washington state's ADS workgroup *didn't* try to stonewall; they understood the situation, wanted to make progress, and were candid about their constraints. We also had the advantage of several more years of research on and experience with ADS. Perhaps even more importantly, we also leveraged the insights in Rashida Richardson's 2019 [Confronting Black Boxes](https://ainowinstitute.org/ads-shadowreport-2019.pdf?ref=thenexusofprivacy.net) "Shadow Report" from the NYC workgroup, which includes recommendations for workgroups and advocacy coalitions as well as for government use of ADS systems – all of which proved hugely valuable to us (and should be required reading for anybody working on any kind of algorithmic regulation). So it wasn't a disaster at all. In fact, we even reached consensus on guiding principles and recommendations, and included them in the [ADS Workgroup Report](https://watech.wa.gov/sites/default/files/public/privacy/Automated%20Decision%20Systems%20Workgroup%20Report.pdf?ref=thenexusofprivacy.net) we issued. [Are you at risk? Discriminatory algorithms in government agencies](https://www.youtube.com/watch?v=%5FrIUNA1MXFw&t=2s&ref=thenexusofprivacy.net), a March 2022 Indivisible Town Hall, has perspectives from workgroup members María Paula Ángel, Jennifer Lee, and Ashley del Villar as well as Ben Winters of EPIC, Maya Morales of WA People's Privacy, and me. Indivisible Town Hall: "[Are you at risk? Discriminatory algorithms in government agencies](https://www.youtube.com/watch?v=%5FrIUNA1MXFw&t=2s&ref=thenexusofprivacy.net)" ## The ADS Workgroup: Consensus on a path forward > "Automated decision systems are a way to reduce costs, improve delivery of public services, and make decisions more efficient, reliable, and accurate.... However, a growing body of evidence indicates that automated decision systems can be discriminatory, inaccurate and lack transparency and accountability. > > Washington state agencies currently deploy a large number and range of automated decision systems.... Some systems in use by governmental agencies today have not been audited for biases, and in many cases, were developed several years ago when techniques for identifying and addressing biases were not as advanced as they are today." > > – Washington state [Automated Decision Systems (ADS) Workgroup Report](https://watech.wa.gov/sites/default/files/public/privacy/Automated%20Decision%20Systems%20Workgroup%20Report.pdf?ref=thenexusofprivacy.net), 2021 With my engineering management hat on (I’ve been CTO, VP of Engineering and Chief Product Officer at Silicon Valley-based companies as well as Software Architect at Microsoft), I could really relate to the challenging situation agency leads are in. And again, it's not just here in Washington, it's true *everywhere*. There's been a lot of progress in techiniques recognizing, correcting, and avoiding bias and discrimination in ADS over the last few years ... but most of the systems in use today were built long before that. From an engineering perspective, this means huge amount of "technical debt" has accumulated over the years. As awareness of the harms of these systems grows, it's debt that has a greater and greater cost by exposing the state to steadily increasing litigation risk the longer it isn't addressed – [Challenging the Use of Algorithm-driven Decision-making in Benefits Determinations Affecting People with Disabilities](https://cdt.org/insights/report-challenging-the-use-of-algorithm-driven-decision-making-in-benefits-determinations-affecting-people-with-disabilities/?ref=thenexusofprivacy.net) has multiple examples of lawsuits in other states. It’s a tricky situation. Our state government depends on these systems, and so do millions of Washingtonians, so we can't just put everything on hold until we build new versions. But the problem won't just fix itself. So here’s a summary of the consensus recommendations we came up with. 1. **Prioritization of Resources:** The state should develop a prioritization framework for allocating resources to address existing and future ADS. 2. **Procurement:** As a part of the procurement process, assess new ADS procured by the state. 3. **Evaluation of Existing Systems:** ADS currently in use by the state that produce legal effects on people should be assessed if they are processing data on a large scale or have substantial effects on the rights or freedoms of natural persons. 4. **Transparency:** Require transparency of use, procurement, and development of ADS including monitoring or testing for accuracy and bias, that produce legal effects on identified or identifiable natural persons. 5. **Determination on Whether to Use System:** The state should adopt a framework to evaluate whether use of ADS or AI-enabled profiling should be prohibited 6. **Ongoing Monitoring or Auditing:** Ongoing monitoring or auditing should be performed on ADS systems that have legal effects on people to ensure they do not have differential effects on subpopulations that result over time 7. **Training in Risk of Automation Bias:** Require training of state employees who develop, procure, operate or use automatic decision-making systems as to risk of automation bias. These all still makes sense to me – and aligns well with other important work since our report, including the recommendations in [Algorithmic Justice League’s *Who Audits the Auditors*](https://thenexusofprivacy.net/ajl-audits-the-auditors/) survey of best practices and the [White House Office of Science and Technology Policy *Blueprint for a Draft AI Bill of Rights*.](https://thenexusofprivacy.net/blueprint-for-an-ai-bill-of-rights/) For more information: - The [ADS Workgroup Report](https://watech.wa.gov/sites/default/files/public/privacy/Automated%20Decision%20Systems%20Workgroup%20Report.pdf?ref=thenexusofprivacy.net) discusses the Guiding Principles and Recommendations on pages 10-12\. To make it concrete, we also included a discussion of how these recommendations would apply to a specific agency ADS system in use today – a Department of Corrections system that affects tens of thousands of Washingtonians – on pages 14-16\. - [What are Automated Decision Systems and why you should care?](https://www.youtube.com/watch?v=5m0W7GoaoF4&ref=thenexusofprivacy.net), a webinar that state Chief Privacy Officer Katy Ruckle and I did last September for WaTech, discusses the workgroup's research findings (starting at [15:40](https://youtu.be/5m0W7GoaoF4?t=940&ref=thenexusofprivacy.net)) and recommendations (starting at [18:00](https://youtu.be/5m0W7GoaoF4?t=1077&ref=thenexusofprivacy.net)) [What are Automated Decision Systems and why you should care?](https://www.youtube.com/watch?v=5m0W7GoaoF4&ref=thenexusofprivacy.net) ## The devil is in details Of course, these are fairly high-level recommendations, and the devil is in the details. As Sen. Hasegawa worked on a revised version of SB 5356's predecessor last year, scaling back goals and extending timeframes to try to make it more palatable to government agencies, it became apparent that the consensus didn't extend to the specific language of his bill. A scheduled Ways & Means hearing was postponed twice to give more time to negotiate a compromise. When the hearing finally happened, several workgroup members, including me, testified in support of the bill ... but Chief Privacy Officer Ruckle (who had facilitated the workgroup) testified in opposition. Awkward! Sherri Sheridan of the Governor's Office also testified in opposition, highlighting concerns that the bill could put the systems the state government depends on at risk. With Gov. Inslee likely to veto the bill even if the legislature passed it, the legislature instead approved a budget proviso funding an inventory of ADS by the end of 2022, so that it would be available for this year's session. But Gov. Inslee vetoed the budget proviso, instead directing agencies to begin a more-leisurely inventory without any additional funding, and hope that the situation will magically fix itself. Last September, [What are Automated Decision Systems and why you should care?](https://www.youtube.com/watch?v=5m0W7GoaoF4&ref=thenexusofprivacy.net) discussed the leisurely inventory in more detail. At the hearing, Sen. Hasegawa described the results to date as "dismal": apparently most agencies aren't even bothering to respond. So the current plan of record is that when the leisurely inventory delivers its dismal results at the end of 2023, at least we'll know how many government ADS there currently are at the agencies that bother to respond – although still won't know how many of them have been tested for biases. So the dilemma I talked about in my testimony last year remains. > "It's a difficult situation, and one that won't magically fix itself. The longer we wait to address it, the harder and more expensive it is to make progress -- and the more likely lawsuits are. Investing now leads to longer-term cost savings by increasing workforce skills and productivity as well as reducing litigation risk. How to do that in a fiscally responsible way?" ## SB 5356 Sen. Hasegawa's latest proposal for ADS regulation legislation has a new bill number (SB 5356) and has been assigned to a new committee: the Senate Environment, Energy & Technology (ENET) Committee, chaired by Sen. Joe Nguyen.[2](#notes) Sen. Hasegawa made some additional changes (further scaling back goals and extending timelines) try to make it more palatable to agencies, but the essence remains similar. Here's how the Bill Report prepared by non-partisan legislative staff summarizes the bill. SB 5356: - Requires public agencies to develop an algorithmic accountability report that meet certain requirements on the use of an automated decision system (ADS). - Specifies minimum requirements when an agency develops, procures, or uses an ADS. - Requires the Office of the Chief Information Officer to adopt guidance, develop a prioritization framework, inventory, and conduct audits for an ADS. - Establishes the Algorithmic Accountability Review Board. - Expands Washington's Law Against Discrimination to prohibit discrimination by automated decision systems. Those still seem like good ideas to me, and aligned with the consensus recommendations. But will the legislature agree? ## "We need to get ahead of this program. And I think we're already too late." [Senate Environment, Energy & Technology - TVWPublic Hearing: SB 5356: Establishing guidelines for government procurement and use of automated decision systems in order to protect consumers, improve![](https://tvw.org/wp-content/uploads/cropped-favicon-270x270.png)TVW![](https://tvw.org/wp-content/uploads/tvw-logo-full.svg)](https://tvw.org/watch/?eventID=2023021341&ref=thenexusofprivacy.net) February 15 [Senate ENET Hearing on SB 5356](https://tvw.org/video/senate-environment-energy-technology-2023021341/?eventID=2023021341&ref=thenexusofprivacy.net) 790 people and organizations testifying at and signing in to SB 5356's February 15 [hearing](https://tvw.org/video/senate-environment-energy-technology-2023021341/?eventID=2023021341&ref=thenexusofprivacy.net) signed in PRO to support it, including representatives from Unemployment Law Project, Washington Patients in Intractable Pain, WA People's Privacy, EPIC Privacy, ACLU of Washington, Southwest Washington Equity Coalition, Japanese American Citizens League, Seattle Chapter, and Fix Democracy First. 19 signed in CON, including representatives of the Governor's Office, WaTech (the state IT group) opposed it as well, and Big Tech lobbying organizations TechNet and Washington Technology Industry Association (WTIA). Sen. Hasegawa, the bill sponsor, kicked off the hearing with a history of how we got here (highlighting the [ADS workgroup's consensus recommendations](#consensus)) and an update on the discussions this year. Despite the changes in this year's bill, the Governor's office continued to oppose it. Sen Hasegawa had worked on a substitute version, moving virtually everything to the "intent" section (where it has no legal force); he described it as "so scaled back that it's only a shell of the original bill". But the Governor's office didn't respond, so he didn't offer it as an amendment. Urging the committee to advance the bill despite opposition, Sen. Hasegawa noted the broader trends including the White House Office of Science and Technology Policy's [Blueprint for an AI Bill of Rights](https://thenexusofprivacy.net/blueprint-for-an-ai-bill-of-rights/). He ended by talking about the threats to our freedoms and liberties: "We need to get ahead of this program. And I think we're already too late." Testimony highlighted a couple really horrible examples of discriminatory ADS here in Washington state and elsewhere: - Cyndi Hoenhous of Washington Patients in Intractable Pain discussed NarxCare, an ADS that uses a proprietary algorithm to deny medication to disabled people and people in poor health (especially minorities and women) with moderate to high pain. Well, okay, NarxCare claims it identifies "patients with substance use disorders" (like opioids); but it's frequently wrong: 17% of the high scores are false, so deploying the system would lead to 72,000 people being unable to get access to the medication they need. Today, the decision to deploy this system could be made without any transparency or accountability. - Anne Paxton of the Unemployment Law Project discussed Michigan's MIDAS system, which falsely accused 40,000 people of fraud. Many people didn't get the notifications, or didn't think they needed to respond, which led to charges of fraud ruining many people's careers and lives. Washington uses the same IT vendor as Michagan, and something similar happened: the system sent out questionnaires that people didn't respond to, and more than 100,000 people have gotten overpayment notices, aggressive collections, threats of garnishment and seizure – with no explanation. Her summary: "black boxes are the enemies of equity." Workgroup members María Paula Ángel of UW and Jennifer Lee of ACLU both highlighted the alignment of SB 5356 with the workgroup recommendations. Ángel also noted SB 5356's aligment with ADS regulation internationally; Ben Winters of EPIC Privacy similarly highlighted the bill's alignment with ADS regulation in other states like California and Colorado. And Maya Morales of WA People's Privacy, after noting that the bill comes from a place of love for WA residents and centers the human beings who are affected, asked legislators to look at systems. Are they helpful to people in the state? Or do they hinder, and create inequities? I wound up as the last person testifying, supporting SB 5356 as "a good first step", although expressing openness to other potential first steps as well.3 You can see my full testimony [below](#testimony). Here's an excerpt. > "The longer we wait to start regulating ADS, the more Washingtonians are harmed. > > The longer we wait, the greater the potential costs and liabilities to the state from litigation over discriminatory systems. > > And the longer we wait, the more expensive it will be to clean it up. The partial fiscal note for SB 5356’s predecessor in 2021 estimated the costs over the first two years as $8.5 million; now, the estimated price tag has risen to $23 million – and that’s just in the first two years. How much higher will the estimates be next year?" ## What next? > "Big Tech and government contractors have successfully derailed legislation by arguing that proposals are too broad—in some cases claiming they would prevent public officials from using calculators and spreadsheets—and that requiring agencies to examine whether an ADS system is discriminatory would kill innovation and increase the price of government procurement." > > – [Why It’s So Hard to Regulate Algorithms](https://themarkup.org/news/2022/01/04/why-its-so-hard-to-regulate-algorithms?ref=thenexusofprivacy.net) Friday (February 17) was the "policy committee cutoff" in the Washington legislature, so if the ENET committee didn't advance the bill at their executive session that morning then is dead for the session unless they decide to ignore the rules, which usually only happens for bills the Governor supports. Sen. Hasegawa made the very reasonable request to advance the bill to give the legislature more time to work on this critical issue, and the committee certainly could have advanced a very weak subsitute to keep the discussions going. Before the hearing, I wrote > "Let's hope that's what happens. Otherwise, Washingtonians will keep getting harmed until the legislature takes action, and the burden will continue to fall disproportionately on the most vulnerable populations. And not to sound like a broken record, but the price tag keeps increasing. So even putting aside the issues of Washingtonians getting harmed, the fiscal aspects really are the kind of thing that Ways & Means (the Senate's fiscal committee) should be talking about. > > Then again, Chair Nguyen and the ENET committee may just decide to kick the can down the road, meekly wait for the dismal results of the leisurely inventory, and continue hoping that the situation will magically fix itself." You can probably guess what happened.4 What next? Sen. Hasegawa made it clear that he'd keep fighting for ADS regulation. Even though this year's bill didn't go forward, the hearing was useful for publicly documenting what's been discussed behind the scenes for a while - the systems the state of Washington depends on are discriminatory, and cause harms to hundreds of thousand of Washingtonians - the Governor's Office, WaTech, TechNet, and WTIA are opposed to even the tiniest steps to make progress. There isn't any way to thread the needle. The current version of was scaled back from last year's bill which was scaled back from the year before – and the Governor's Office wouldn't even support a proposed further-scaled-back substitute. More positively, thinking about ADS regulation's come a long way since SB 5356's predecessor was first drafted several years ago. So it's time for some creative thinking to find a different path forward. Easier said than done, of course, but it's not impossible. We shall see. --- ## Testimony *With only two minutes for live testimony, I usually follow up with an extended written version. Here's what I sent the committee.* Chair Nguyen, Ranking Member MacEwen, and members of the Senate Environment, Energy, & Technology Committee, I'm Jon Pincus from Bellevue, a technologist and entrepreneur, and founder of the [Nexus of Privacy](https://thenexusofprivacy.net/). In 2021, I was a member of the Washington State Automated Decision-making Systems (ADS) Workgroup; I’ve also been General Manager of Strategy Development at Microsoft, Senior Researcher at Microsoft Research, and founder/CTO of a successful Silicon Valley-based venture-funded startup. I appreciate the chance to provide testimony on this bill, and would like to thank Chair Nguyen for scheduling this hearing, and Sen. Hasegawa, Vice Chair Lovelett and the other co-sponsors of the bill. **I strongly SUPPORT SB 5356**. As you heard at the hearing, **the systems that run our state government often have biases that reinforce and magnify discrimination**. The longer we wait to start regulating ADS, the more Washingtonians are harmed. The longer we wait, the greater the potential costs and liabilities to the state from litigation over discriminatory systems. And the longer we wait, the more expensive it will be to clean it up. The partial fiscal note for SB 5356’s predecessor in 2021 estimated the costs over the first two years as $8.5 million; now, the estimated price tag has risen to $23 million – and that’s just in the first two years. How much higher will the estimates be next year? The [ADS Workgroup](https://watech.wa.gov/sites/default/files/public/privacy/Automated%20Decision%20Systems%20Workgroup%20Report.pdf?ref=thenexusofprivacy.net) report includes more details on ADS usage in Washington, a path forward, and the landscape of ADS regulation elsewhere. [What are Automated Decision Systems and why you should care?](https://www.youtube.com/watch?v=5m0W7GoaoF4&ref=thenexusofprivacy.net), a webinar that state Chief Privacy Officer Katy Ruckle and I did last September for WaTech, is a good overview of the workgroup’s findings and the consensus recommendations of the agency leads, community groups, and researchers who were part of it. I want to highlight the *consensus* in the recommendations n that report. Agency leads have a good understanding of the situation, and everybody largely agreed about the general direction of the next steps to get from here to better solutions. The devil is in the details, of course, and it’s been a challenge turning this consensus into legislation … but let’s focus for a minute on where we agree. ADS are powerful and when they work well can help government agencies provide better service to more Washingtonians conveniently and far less expensively than purely manual systems. But today’s ADS often embed biases that reinforce and magnify discrimination – and most systems in use at state agencies today were designed and implemented without using the techniques that today are recognized as industry best practices. For example, the workgroup looked at one Department of Corrections system that affects tens of thousands of Washingtonians, and based on the information provided to us concluded that its implementation "has not included adequate monitoring or testing for bias" (see p. 14 of the ADS Workgroup's Report for more details). If it’s typical of other systems, state government agencies may have dozens, maybe hundreds, of systems that haven't been tested for biases. This is a problem everywhere, not just here in Washington state. From an engineering perspective, there's been a huge amount of "technical debt" that has accumulated over the years. As awareness of the harms of these systems grows, it's debt that has a greater and greater cost by exposing the state to steadily increasing litigation risk the longer it isn't addressed – [Challenging the Use of Algorithm-driven Decision-making in Benefits Determinations Affecting People with Disabilities](https://cdt.org/insights/report-challenging-the-use-of-algorithm-driven-decision-making-in-benefits-determinations-affecting-people-with-disabilities/?ref=thenexusofprivacy.net) has multiple examples of lawsuits in other states. It’s a tricky situation, because our state government depends on these systems, and so do millions of Washingtonians, so we can't just put everything on hold until we build new versions. The recommendations and principles in our report align well with important work that’s happened since then including the recommendations the [White House Office of Science and Technology Policy *Blueprint for a Draft AI Bill of Rights*](https://thenexusofprivacy.net/blueprint-for-an-ai-bill-of-rights/) Sen. Hasegawa mentioned in the hearing as well as the [Algorithmic Justice League’s *Who Audits the Auditors*](https://thenexusofprivacy.net/ajl-audits-the-auditors/) survey of best practices. And with my engineering management hat on, they’re a good way to approach a difficult situation where you can’t afford to shut down critical systems. As I said in my testimony on SB 5356’s predecessor last year, > "It's a difficult situation, and one that won't magically fix itself. The longer we wait to address it, the harder and more expensive it is to make progress -- and the more likely lawsuits are. Investing now leads to longer-term cost savings by increasing workforce skills and productivity as well as reducing litigation risk. How to do that in a fiscally responsible way?" SB 5356 as written takes valuable steps towards these recommendations – especially if the estimates in the fiscal note include resources for training, bias testing, monitoring, and auditing. The bill’s timelines and policies for extensions give agencies a lot of flexibility (again, as long as the fiscal note includes the resources they need in addition to making progress with everything else on their plate). It also aligns with proposed state legislation elsewhere. That said I certainly don’t think SB 5356 as written is the only way forward, and there could well be some other better first step. No matter the approach, some key elements to consider: - Start by examining the highest-priority existing systems. The prioritization framework in the ADS Working Group's recommendations is an excellent suggestion from an agency lead that reflects reality – and (realizing it will take time to develop the framework) also recommends giving agencies the flexibility to make their own prioritization decision in the short term. - Make sure to account for costs and risks as well as benefits. Audit requirements ensure that vendors and contractors provide a full accounting; the transparency requirements follow best practices by enabling third-party audits (as recommended by [*Who Audits the Auditors*](https://thenexusofprivacy.net/ajl-audits-the-auditors/) and the [*Blueprint for a Draft AI Bill of Rights*](https://thenexusofprivacy.net/blueprint-for-an-ai-bill-of-rights/)) - Don't make the situation worse! Rules on procurement ensure that new systems are designed, implemented, tested, and deployed in line are another current best practices. SB 5356 and California's proposed [ADS Accountability Act](https://greenlining.org/2021/automated-decision-systems-accountability-act-passes-key-committee/?ref=thenexusofprivacy.net) take similar approaches, including algorithmic impact statements from contractors as part of the procurement process. One way or another I think it’s very important for the legislature to pass some legislation or do a significantly-sized budget proviso this year. The longer you wait, the more expensive it gets. So that means it’s critical for ENET to advance this bill or a substitute in order to continue the fiscal discussions in Ways & Means and hone in on an achievable, fiscally responsible first step. Thank you for your ongoing attention to this important issue, and I hope that you schedule an executive session and advance SB 5356 or a substitute to Ways & Means. Jon Pincus, Bellevue ## Notes 1 Rashida Richardson's 2021 [Defining and Demystifying Automated Decision Systems](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=3811708&ref=thenexusofprivacy.net) discusses definitional issues in detail. Here's her "narrow" definition. > “Automated Decision Systems” are any systems, software, or process that use computation to aid or replace government decisions, judgments, and/or policy implementation that impact opportunities, access, liberties, rights, and/or safety. Automated Decisions Systems can involve predicting, classifying, optimizing, identifying, and/or recommending. Here's the definition in SB 5356, which is somewhat narrower. > "Automated decision system" means any algorithm, including one incorporating machine learning or other artificial intelligence techniques, that uses data-based analysis or calculations to make or support government decisions, judgments, or conclusions that cause a Washington resident or business to be treated differently than another Washington resident or business or results in statistically significant disparities with other classes of persons or businesses in the nature or amount of governmental interaction with that individual or business including, without limitation, benefits, protections, procurement processes, required payments, penalties, regulations, or timing, application, or process requirements. 2 Sen. Nguyen is no longer a Microsoft employee, by the way; he left after last session and started up a strategy consulting business. Washington has a part-time legislature and the previous ENET Chair did strategy consulting for the tech industry while sponsoring legislation like the Bad Washington Privacy Act that would benefit the tech industry, so we're used to this kind of stuff here. 3 Politically, I agree with Sen. Hasegawa that there's value in keeping the bill alive this session so that discussions continue. If the only way to do that is to advance somehting even weaker than SB 5356, oh well, but in my view it'd still be better than once again punting till next year. 4 Of course it ain't over 'til it's over. If the legislature decides they want to make progress on the ADS problem this session, they still could. Even though SB 5356 is dead for the session, it could spring to life again. For example, the usual deadlines don't apply to bills that are deemed Necessary To Implement the Budget (NTIB), which a bill with a steadily-rising eight figure price tag could certainly qualify for. The Bad Washington Privacy Act was marked NTIB in 2021 (and the Bad Washington Privacy Act's sponsor reportedly to "encourage" his colleagues to vote for it by [threatening to hold funding for eviction protection hostage](https://www.thestranger.com/slog/2021/04/29/56978551/washington-legislature-closes-session-with-massive-watered-down-wins?ref=thenexusofprivacy.net)) as was the Foundational Data Privacy Act last year, and their budget impact was significantly less than SB 5356\. ### Privacy News Roundup: February 13 mega-post URL: https://thenexusofprivacy.net/privacy-news-february-13/ Last updated: 2023-02-22T18:35:35.000Z It's been almost two weeks since I did the last privacy news roundup ... and a lot's been happening! ### [Data Brokers and the Sale of Americans’ Mental Health Data](https://techpolicy.sanford.duke.edu/data-brokers-and-the-sale-of-americans-mental-health-data?ref=thenexusofprivacy.net) Joanne Kim on Tech Policy @ Sanford (techpolicy.sanford.duke.edu) The Technology Policy Lab at the Duke Sanford School of Public Policy looks at data brokers and data on U.S. individuals’ mental health conditions, and finds that data brokers advertise and sell this data. They argue that "the largely unregulated and black-box nature of the data broker industry, its buying and selling of sensitive mental health data, and the lack of clear consumer privacy protections in the U.S. necessitate a comprehensive federal privacy law or, at the very least, an expansion of HIPAA’s privacy protections alongside bans on the sale of mental health data on the open market." **ALSO:** - [Now for sale: Data on your mental health](https://washingtonpost.com/technology/2023/02/13/mental-health-data-brokers?ref=thenexusofprivacy.net), Drew Harwell on The Washington Post (washingtonpost.com) - [A researcher tried to buy mental health data. It was surprisingly easy.](https://nbcnews.com/tech/security/researcher-tried-buy-mental-health-data-was-surprisingly-easy-rcna70071?ref=thenexusofprivacy.net), Kevin Collier on NBC News (nbcnews.com) - [Data Brokers Are Selling Long Lists of People With Depression](https://gizmodo.com/depression-anxiety-brokers-sell-mental-health-data-1850107119?ref=thenexusofprivacy.net), Thomas Germain on Gizmodo (gizmodo.com) - [Because The U.S. Is Too Corrupt To Pass Privacy Legislation, Data Brokers Increasingly Traffic In Sensitive Mental Health Data](https://techdirt.com/2023/02/14/because-the-u-s-is-too-corrupt-to-pass-privacy-legislation-data-brokers-increasingly-traffic-in-sensitive-mental-health-data?ref=thenexusofprivacy.net), Karl Bode on Techdirt (techdirt.com) ### [How US police use digital data to prosecute abortions](https://techcrunch.com/2023/01/27/digital-data-roe-wade-reproductive-privacy?ref=thenexusofprivacy.net) Zack Whittaker on TechCrunch (techcrunch.com) Court records reveal how police in the U.S. use text messages, emails, search history to prosecute people seeking abortions. This article looks at several cases in detail – critical information when considering new legislation intended to protect people seeking abortions or gender-affirming care (which is also criminalized in an increasing nmber of states). ### [Distinguishing Privacy Law: A Critique of Privacy as Social Taxonomy](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4347191&ref=thenexusofprivacy.net) María P. Angel and Ryan Calo on SSRN papers.ssrn.com A really interesting paper critiquing the approach at the core of 20th-century privacy scholarship. Angel and Calo highlight both the value of the social taxonomy approach – and it's limitations. Here's the abstract > What distinguishes violations of privacy from other harms? This has proven a surprisingly difficult question to answer. For over a century, privacy law scholars labored to define the illusive concept of privacy. Then they gave up. Efforts at distinguishing privacy came to be superseded at the turn of the millennium by a new approach: a taxonomy of privacy problems grounded in social recognition. Privacy law became the field that simply studies whatever courts or scholars talk about as related to privacy. > And it worked. Decades into privacy as social taxonomy, the field has expanded to encompass a broad range of information-based harms - from consumer manipulation to algorithmic bias—generating many, rich insights. Yet the approach has come at a cost. This article diagnoses the pathologies of a field that has abandoned defining its core subject matter, and offers a research agenda for privacy in the aftermath of social recognition. > > This critique is overdue: it is past time to think anew about exactly what work the concept of privacy is doing in a complex information environment, and why a given societal problem—from discrimination to misinformation - is worthy of study under a privacy framework. Only then can privacy scholars articulate what we are expert in and participate meaningfully in global policy discussions about how to govern information-based harms. ## FTC Enforcement #### [The FTC Is Taking on Telehealth’s Data Sharing Problem—Starting with GoodRx](https://themarkup.org/pixel-hunt/2023/02/01/the-ftc-is-taking-on-telehealths-data-sharing-problem-starting-with-goodrx?ref=thenexusofprivacy.net) Todd Feathers on The Markup (themarkup.org) The action adds to mounting pressure on companies to stop sharing consumers’ health data for advertising purposes—the subject of a recent investigation by The Markup and STAT. ALSO: - [Senators Launch Inquiry into Telehealth Companies for Tracking and Monetizing Personal Data](https://themarkup.org/pixel-hunt/2023/02/07/senators-launch-inquiry-into-telehealth-companies-for-tracking-and-monetizing-personal-data?ref=thenexusofprivacy.net), John Wilkerson of STAT on The Markup (themarkup.org) ## AI and Automated Decision Systems (ADS) #### [Journalistic Lessons for the Algorithmic Age](https://themarkup.org/hello-world/2023/02/04/journalistic-lessons-for-the-algorithmic-age?ref=thenexusofprivacy.net) Julia Angwin on The Markup (themarkup.org) A farewell letter from Julia Angwin **ALSO:** - [Decoding the Hype About AI](https://themarkup.org/hello-world/2023/01/28/decoding-the-hype-about-ai?ref=thenexusofprivacy.net), Julia Angwin on The Markup (themarkup.org) – A conversation with Arvind Narayanan #### [Child welfare algorithm faces Justice Department scrutiny](https://apnews.com/article/justice-scrutinizes-pittsburgh-child-welfare-ai-tool-4f61f45bfc3245fd2556e886c2da988b?ref=thenexusofprivacy.net) Sally Ho and Garance Burke on Associated Press (apnews.com) The Justice Department has been scrutinizing a controversial artificial intelligence tool used by a Pittsburgh-area child protective services agency following concerns that it could result in discrimination against families with disabilities. #### [‘There is no standard’: investigation finds AI algorithms objectify women’s bodies](https://theguardian.com/technology/2023/feb/08/biased-ai-algorithms-racy-women-bodies?ref=thenexusofprivacy.net) Gianluca Mauro and Hilke Schellmann on The Guardian (theguardian.com) AI tools rate photos of women as more sexually suggestive than those of men, especially if nipples, pregnant bellies or exercise is involved ### ALSO: - [Inside Safe City, Moscow’s AI Surveillance Dystopia](https://wired.com/story/moscow-safe-city-ntechlab?ref=thenexusofprivacy.net), Masha Borak on WIRED (wired.com) - [NIST Risk Management Framework Aims to Improve Trustworthiness of Artificial Intelligence](https://nist.gov/news-events/news/2023/01/nist-risk-management-framework-aims-improve-trustworthiness-artificial?ref=thenexusofprivacy.net), NIST (nist.gov) - [AI wrote a bill to regulate AI. Now Rep. Ted Lieu wants Congress to pass it.](https://nbcnews.com/politics/congress/ted-lieu-artificial-intelligence-bill-congress-chatgpt-rcna67752?ref=thenexusofprivacy.net), Kate Santaliz on NBC News (nbcnews.com). ## Federal Privacy Legislation ### [EPIC Urges Financial Services Committee to Strengthen Privacy Bill](https://epic.org/epic-urges-financial-services-committee-to-strengthen-privacy-bill?ref=thenexusofprivacy.net) EPIC - Electronic Privacy Information Center (epic.org) The proposed Financial Data Privacy extends the notice-and-choice provisions of the Gramm-Leach-Bliley Act (GLBA). EPIC says this does little to protect privacy. “The Committee should not advance legislation that purports to be a privacy bill unless it includes a data minimization standard similar to what is set forth in the bipartisan American Data Privacy and Protection Act.” ### [Privacy Fears, Abuse Allegations Jeopardize Foreign Surveillance Tool](https://www.wsj.com/articles/privacy-fears-abuse-allegations-jeopardize-foreign-surveillance-tool-ea3b3712?ref=thenexusofprivacy.net) Dustin Volz on the Wall Street Journal (wsj.com) FISA Section 702 surveillance expires at year end unless it's renewed, and Volz reports that "U.S. intelligence officials are more worried than ever about" its fate due to opposition from both parties. ### [How the US Can Stop Data Brokers’ Worst Practices—Right Now](https://wired.com/story/fcra-letter-data-brokers-privacy-regulation?ref=thenexusofprivacy.net) Dell Cameron on WIRED (wired.com) Legal experts say the Fair Credit Reporting Act should already prevent brokers from collecting and selling data that’s weaponized against vulnerable people. ### ALSO - [Privacy and crypto will likely lead tech policy under split Congress as hope for passing ambitious antitrust reforms dwindles](https://cnbc.com/2022/12/27/privacy-and-crypto-will-likely-lead-tech-policy-under-split-congress.html?%5F%5Fsource=sharebar%7Ctwitter&ref=thenexusofprivacy.net), Lauren Feiner on CNBC (cnbc.com) ## State privacy legislation #### [Utah social media bill with parental consent requirement advances despite privacy concerns](https://ksl.com/article/50573059/utah-social-media-bill-with-parental-consent-requirement-advances-despite-privacy-concerns?ref=thenexusofprivacy.net) Bridger Beal-Cvetko, KSL.com on ksl.com (ksl.com) An effort to prevent kids from using social media without parental approval cleared a Utah House committee last Friday, despite concerns from both sides of the aisle that the bill is a potential violation of privacy. #### [Texas State Representative Introduces Comprehensive State Privacy Bill Draft](https://natlawreview.com/article/texas-state-representative-introduces-comprehensive-state-privacy-bill-draft?ref=thenexusofprivacy.net) Hunton Andrews Kurth’s Privacy and Cybersecurity on The National Law Review (natlawreview.com) On February 6, 2023, Texas State Representative Giovanni Capriglione submitted H.B. 1844, a comprehensive privacy bill modeled after the Virginia Consumer Data Protection Act – which in turn was based on the Bad Washington Privacy Act. #### [How Big Tech Rewrote the Nation’s First Cellphone Repair Law](https://themarkup.org/news/2023/02/08/how-big-tech-rewrote-the-nations-first-cellphone-repair-law?ref=thenexusofprivacy.net) Maddie Stone of Grist on The Markup (themarkup.org) Documents reveal tech lobbyists revised a right-to-repair bill before New York’s governor signed it. This isn't actually privacy legislation ... but it's a useful window into the techniques tech lobbyists use on all kinds of legislation, including privacy. ### ALSO - [California Privacy Protection Agency Passes Revised Regulations](https://natlawreview.com/article/california-privacy-protection-agency-passes-revised-regulations?ref=thenexusofprivacy.net), Mary T. Costigan on The National Law Review (natlawreview.com) - [The privacy concerns at the heart of Wisconsin’s TikTok ban](https://wuwm.com/2023-01-30/the-privacy-concerns-at-the-heart-of-wisconsins-tiktok-ban?ref=thenexusofprivacy.net), Joy Powers on WUWM (wuwm.com), including comments by Michael Zimmer, the director of the Center for Data, Ethics and Society at Marquette University - [California Enforces Consumer Privacy Law With ‘Investigative Sweep’](https://morganlewis.com/pubs/2023/02/california-enforces-consumer-privacy-law-with-investigative-sweep?ref=thenexusofprivacy.net), Catherine North Hounfodji on Morgan Lewis (morganlewis.com) #### ## North of the border ### [Harper government kills controversial Internet surveillance bill](https://theglobeandmail.com/news/politics/harper-government-kills-controversial-internet-surveillance-bill/article8456096?ref=thenexusofprivacy.net) John Ibbitson on The Globe and Mail (theglobeandmail.com) Justice Minister Rob Nicholson said “we will not be proceeding with Bill C-30” ### [News release: Home Depot’s failed to obtain customer consent before sharing personal data with Meta](https://priv.gc.ca/en/opc-news/news-and-announcements/2023/nr-c%5F230126?ref=thenexusofprivacy.net) Office of the Privacy Commissioner of Canada (priv.gc.ca) ### ALSO - [Alberta Justice Minister Accused of Privacy Breach in Law Society Hearing](https://thetyee.ca/News/2023/01/26/Bombshell-Derails-Alberta-Minister-Shandro-Law-Society-Hearing?ref=thenexusofprivacy.net), Charles Rusnell on The Tyee (thetyee.ca) ## Across the pond #### [Privacy and data protection too often suspended at EU borders](https://euractiv.com/section/data-privacy/opinion/it-is-time-to-tear-down-this-wall?ref=thenexusofprivacy.net) Wojciech Wiewiórowski on EURACTIV (euractiv.com) Privacy and data protection are part of the human rights too often suspended at the borders of the European Union - as long as we continue treating migration as a ‘problem’, fundamental rights will remain compromised, Wojciech Wiewiórowski writes. #### [French Senate backs AI-powered video surveillance for Paris 2024 Olympics](https://politico.eu/article/french-senators-back-ai-powered-video-surveillance-for-paris-2024-olympics?ref=thenexusofprivacy.net) Laura Kayali on POLITICO (politico.eu) A majority of senators voted against introducing facial recognition. ### ALSO - [The European Data Protection Board (EDPB) goes after tech’s personalized ad business model](https://brookings.edu/blog/techtank/2023/02/01/the-european-data-protection-board-goes-after-techs-personalized-ad-business-model?ref=thenexusofprivacy.net), Mark MacCarthy on Brookings (brookings.edu) - [Europe-wide overhaul of GDPR monitoring triggered by ICCL](https://iccl.ie/digital-data/europe-wide-overhaul-of-gdpr-monitoring-triggered-by-iccl?ref=thenexusofprivacy.net), Johnny Ryan on Irish Council for Civil Liberties (iccl.ie) ## And ... #### [Cedars-Sinai Medical Center Sued for Website Tracking Technology Privacy Violations](https://hipaajournal.com/cedars-sinai-medical-center-sued-for-website-tracking-technology-privacy-violations?ref=thenexusofprivacy.net) HIPAA Journal (hipaajournal.com) A lawsuit has been filed against Cedars-Sinai Medical Center alleging impermissible disclosures of patient data to Google, Meta, and other third parties ALSO: - [Cedars-Sinai gives patient info to Meta, lawsuit claims](https://theregister.com/2023/02/08/cedarssinai%5Flawsuit?ref=thenexusofprivacy.net), Jude Karabus on The Register (theregister.com) #### [Apple sued for promising privacy, failing at it](https://theregister.com/2023/01/28/apple%5Fsued%5Fprivacy?ref=thenexusofprivacy.net) Thomas Claburn on The Register (theregister.com) What’s allowed for Cupertino is verboten for everyone else #### [Indian social media app Slick exposed childrens’ user data](https://techcrunch.com/2023/02/10/slick-social-media-app-data-exposed?ref=thenexusofprivacy.net) Jagmeet Singh on TechCrunch (techcrunch.com) The emerging Indian social media app exposed a database of young users’ private information, including school-going children. #### [Cookie consent is not enough](https://venturebeat.com/security/cookie-consent-is-not-enough?ref=thenexusofprivacy.net) Ian Cohen, LOKKER on VentureBeat (venturebeat.com) Cookies are everywhere. And, several lawsuits reveal how orgs can misuse them and (inadvertently or no) gain access to highly personal data. #### [Quantum machine learning with differential privacy](https://nature.com/articles/s41598-022-24082-z?ref=thenexusofprivacy.net) William M. Watkins on Nature (nature.com) In this study, we develop a hybrid quantum-classical model that is trained to preserve privacy using differentially private optimization algorithm. This marks the first proof-of-principle demonstration of privacy-preserving Quantum Machine Learning (QML). #### #### [What does GPT-3 “know” about me?](https://technologyreview.com/2022/08/31/1058800/what-does-gpt-3-know-about-me?ref=thenexusofprivacy.net) Melissa Heikkilä on MIT Technology Review (technologyreview.com) Large language models are trained on troves of personal data hoovered from the internet. So I wanted to know: What does it have on me? #### [Project Texas: The Details of TikTok’s Plan to Remain Operational in the United States](https://lawfareblog.com/project-texas-details-tiktoks-plan-remain-operational-united-states?ref=thenexusofprivacy.net) Matt Perault on Lawfare (lawfareblog.com) Last week, senior TikTok executives held a private briefing to review the details of Project Texas and the contours of the national security agreement it is negotiating with the U.S. government. #### [Brazil’s Telecom Operators Made Strides and Had Shortcomings in Internet Lab’s New Report on User Privacy Practices](https://eff.org/deeplinks/2023/01/brazils-telecom-operators-made-strides-and-had-shortcomings-internet-labs-new?ref=thenexusofprivacy.net) Karen Gullo and Veridiana Alimonti on Electronic Frontier Foundation (eff.org) Brazil’s biggest internet connection providers made moderate advances in protecting customer data and being transparent about their privacy practices, but fell short on meeting certain requirements for upholding users’ rights under Brazil’s data protection law. #### [FTC Finalizes Order with Ed Tech Provider Chegg for Lax Security that Exposed Student Data](https://ftc.gov/news-events/news/press-releases/2023/01/ftc-finalizes-order-ed-tech-provider-chegg-lax-security-exposed-student-data?ref=thenexusofprivacy.net) the Premerger Notification Office Staff on Federal Trade Commission (ftc.gov) The Federal Trade Commission has finalized its order with education technology provider Chegg Inc. #### [Modi Is Muzzling Big Tech](https://foreignpolicy.com/2023/01/27/modi-big-tech-india-bbc-documentary-twitter?ref=thenexusofprivacy.net) Rishi Iyengar on Foreign Policy (foreignpolicy.com) Silicon Valley has spent years courting India, but its companies face an increasingly tricky censorship minefield in the world’s largest democracy. #### [Happy Data Privacy Day: On the Essential Link between Data Processing and Security](https://lawfareblog.com/happy-data-privacy-day-essential-link-between-data-processing-and-security?ref=thenexusofprivacy.net) David Hoffman on Lawfare (lawfareblog.com) Today is Data Privacy Day, an annual event in which I am — rather proudly — personally invested. Data Privacy Day began with a conversation at my dinner table eight years ago, when Leonardo Cervera Navas (then with the European Commission and now with the European Data Protection Supervisor’s office… #### [Privacy-by-design can be a source of value and opportunity, not cost](https://gulfbusiness.com/privacy-by-design-can-be-a-source-of-value?ref=thenexusofprivacy.net) Divsha Bhat on Gulf Business (gulfbusiness.com) Privacy can become a selling point and a source of value, especially when it is implemented by design and not reactively. #### [States and Counties Making Fresh Progress on Privacy](https://govtech.com/workforce/states-and-counties-making-fresh-progress-on-privacy?ref=thenexusofprivacy.net) Thad Rueter on GovTech (govtech.com) This year’s Data Privacy Week drew attention to the increasing role that cybersecurity is playing for government. Public agencies are responding via new hiring but still face big challenges. #### [What’s on the Global Horizon for Data Privacy in 2023?](https://jdsupra.com/legalnews/what-s-on-the-global-horizon-for-data-1123751?ref=thenexusofprivacy.net) Shannon Knapp on JD Supra (jdsupra.com) Expect another year of regulatory ambiguity for international data privacy laws in 2023, as the European Commission reviews the EU-US Data Privacy... #### [Data Privacy Laws and Blocking Statutes: Five Practical Strategies for Counsel](https://jdsupra.com/legalnews/data-privacy-laws-and-blocking-statutes-7485715?ref=thenexusofprivacy.net) Rob Robinson on JD Supra (jdsupra.com) Background Note: Data privacy has become a critical issue in the digital era, with laws and regulations constantly evolving. As a result, it’s... #### [Google Fi says hackers accessed customers’ information](https://techcrunch.com/2023/01/31/google-fi-customer-data-breach?ref=thenexusofprivacy.net) Carly Page on TechCrunch (techcrunch.com) The virtual cell service said customers’ data was exposed following “suspicious activity” relating to its primary network provider. #### [How surveillance tech helped protect power — and the drug trade — in Honduras](https://codastory.com/authoritarian-tech/honduras-surveillance-drug-trade?ref=thenexusofprivacy.net) Anna-Catherine Brigida on Coda Story (codastory.com) How big-name monitoring software from companies like Cellebrite and Palantir made Honduras a hotbed of spy tech. #### [Privacy assistant Jumbo tears down its paywall](https://techcrunch.com/2023/01/31/privacy-assistant-jumbo-tears-down-its-paywall?ref=thenexusofprivacy.net) Romain Dillet on TechCrunch (techcrunch.com) Jumbo, an app that lets you control your privacy on the web, is hitting the reset button — sort of. While the company is still focused on privacy and security, users can now download and use all features for free as the premium subscription is gone #### [Could a More Powerful Web Tracker Be Good for Your Privacy?](https://gizmodo.com/full-throttle-new-tracker-google-kills-cookies-1850051167?ref=thenexusofprivacy.net) Thomas Germain on Gizmodo (gizmodo.com) Full Throttle is launching a new, souped-up tracker as Google moves to kill third-party cookies. #### [EU vows to get tougher on Big Tech privacy violations](https://engadget.com/eu-tougher-gdpr-monitoring-big-tech-151519695.html?guccounter=1&ref=thenexusofprivacy.net) on Engadget (engadget.com) The EU is taking a tougher stance on Big Tech privacy investigations.. #### [Just 16% of shoppers feel confident in managing data privacy and security](https://chargedretail.co.uk/2023/01/31/managing-privacy-and-security-online?ref=thenexusofprivacy.net) Isabel Cameron on Latest Retail Technology News From Across The Globe - Charged (chargedretail.co.uk) Just 16% of UK consumers feel completely confident in managing their data privacy and security online according to security company Ring. #### [Data Privacy and the United Nations Sustainable Development Goals](https://natlawreview.com/article/data-privacy-and-united-nations-sustainable-development-goals?ref=thenexusofprivacy.net) Abraham Díaz on The National Law Review (natlawreview.com) In the frame of the International Data Privacy Day celebrated around the world every January 28, it is worthy to remember the relevance gained worldwide by this subject matter as time goes by, as well #### [Small business spending on data privacy up 17% in 2022, higher than medium, large firms: Cisco study ](https://financialexpress.com/industry/sme/msme-tech-small-businesses-spending-on-data-privacy-up-17-in-2022-higher-than-medium-large-firms-cisco/2964138?ref=thenexusofprivacy.net) MSME Desk on Financialexpress (financialexpress.com) Spending at larger organizations remained relatively unchanged after steep increases from 2019 to 2020, the study said. The average privacy spending was $2.7 million in 2022. #### [CDT Comments to NTIA on Mobile App Ecosystem Competition](https://cdt.org/insights/cdt-comments-to-ntia-on-mobile-app-ecosystem-competition?ref=thenexusofprivacy.net) George Slover on Center for Democracy and Technology (cdt.org) CDT submitted comments in response to the National Telecommunications and Information Administration’s (NTIA) request for input for its report on the state of competition in the mobile apps marketplace. Our comments state that competition is clearly in need of improvement, with just two platform eco… #### [Google Asks 9th Cir. to Reconsider Child Privacy Law Preemption Ruling](https://lawstreetmedia.com/news/tech/google-asks-9th-cir-to-reconsider-child-privacy-law-preemption-ruling?ref=thenexusofprivacy.net) Christina Tabacco on Law Street Media (lawstreetmedia.com) #### [EU Tightens Oversight of Data-Privacy Regulators to Speed Up Decisions](https://wsj.com/articles/eu-tightens-oversight-of-data-privacy-regulators-to-speed-up-decisions-11675278744?ref=thenexusofprivacy.net) Catherine Stupp on The Wall Street Journal (wsj.com) Regulators must report details of large-scale investigations, amid complaints of case backlogs in Ireland, where many tech giants have their European headquarters. #### [A TikTok Trend You Can’t Ignore: Addressing the Risks by Protecting Privacy and Bolstering Transparency](https://freedomhouse.org/article/tiktok-trend-you-cant-ignore-addressing-risks-protecting-privacy-and-bolstering?ref=thenexusofprivacy.net) Allie Funk on Freedom House (freedomhouse.org) As one of the world’s most ardent defenders of internet freedom, the United States should strengthen requirements for privacy and transparency rather than resort to an outright ban. #### [We can no longer support the Online Safety Bill](https://politicshome.com/thehouse/article/we-can-no-longer-support-the-online-safety-bill?ref=thenexusofprivacy.net) Ellen Judson and Kyle Taylor on Politics Home (politicshome.com) Around the world, children are being exposed to violent and inappropriate content online with sometimes devastating results. #### [ACLU, public defenders push back against Google giving police your mobile data](https://computerworld.com/article/3686535/aclu-public-defenders-push-back-against-google-giving-police-your-mobile-data.html?ref=thenexusofprivacy.net) Lucas Mearian on Computerworld (computerworld.com) Geofence warrants that allow law enforcement to collect location data on mobile device users for criminal probes are under attack by civil rights groups and public defenders; they say the warrants are fishing expeditions that expose personal information. #### [US lawmakers target TikTok in debate over regulating data privacy](https://scmp.com/news/china/article/3208784/us-lawmakers-target-tiktok-debate-over-regulating-data-privacy?ref=thenexusofprivacy.net) Orange Wang on South China Morning Post (scmp.com) Concerns are raised that the US is falling behind other countries in enacting a comprehensive federal data privacy and security law. #### [Are your bosses spying on you? New bill aims to curtail employer surveillance of workers](https://usatoday.com/story/news/politics/2023/02/02/spying-bosses-senators-workers-remote/11169400002?ref=thenexusofprivacy.net) Candy Woodall on USA TODAY (usatoday.com) Spying bosses is a side effect of working remotely and a mostly unregulated area of labor law that needs to be addressed, Sen. Bob Casey said. #### [Ad Blockers Could Be Helpful for Your Privacy](https://roboticsandautomationnews.com/2023/02/02/ad-blockers-could-be-helpful-for-your-privacy/59826?ref=thenexusofprivacy.net) David Edwards on Robotics & Automation News (roboticsandautomationnews.com) Whether you’re using a mobile device, a computer, or a tablet, ad blockers can help you save time, protect your personal information, and eliminate annoying ads. Among the many benefits, these tool… #### [Illinois top court endorses five-year window for biometric privacy claims](https://reuters.com/legal/litigation/illinois-top-court-endorses-five-year-window-biometric-privacy-claims-2023-02-02?ref=thenexusofprivacy.net) Daniel Wiessner on Reuters (reuters.com) The Illinois Supreme Court on Thursday said workers and consumers have five years to sue for violations of the state’s unique biometric privacy law, rejecting a much narrower window pushed by business groups. #### [Be real or be stalked? Privacy pitfalls of Gen-Z’s favorite app](https://codastory.com/authoritarian-tech/social-media-authoritarian-tech/bereal-app-user-privacy?ref=thenexusofprivacy.net) Isobel Cockerell on Coda Story (codastory.com) BeReal, the photo-sharing app, puts a new twist on age-old privacy problems. #### [Compromise required to resolve impasse on data privacy regulation](https://irishtimes.com/business/2023/02/02/compromise-required-to-resolve-impasse-on-data-privacy-regulation?ref=thenexusofprivacy.net) Cantillon on The Irish Times (irishtimes.com) Regulation of GDPR rules has become a political, legal and cultural tug of war #### [Haggard gun privacy bill moves to full House](https://dailyjournal.net/2023/02/02/haggard-gun-privacy-bill-moves-to-full-house?ref=thenexusofprivacy.net) Staff Reports on Daily Journal (dailyjournal.net) A bill authored by freshman State Rep. Craig Haggard, R-Mooresville, to limit the information released to the federal government from handgun permits passed out of the committee Wednesday. #### [Smear campaign targets nominee who would be FCC’s first openly gay commissioner](https://nbcnews.com/tech/tech-news/fcc-gigi-sohn-nomination-turns-ugly-rcna68224?ref=thenexusofprivacy.net) Kevin Collier on NBC News (nbcnews.com) The nomination of Gigi Sohn, who would be the FCC’s first openly gay commissioner, languished in a Senate committee. Now, she’s the subject of articles from the Daily Mail and Fox News that even her some of her rivals say are out of bounds. #### [New York attorney general orders stalkerware maker to notify hacked victims](https://techcrunch.com/2023/02/03/new-york-stalkerware-notify-victims?ref=thenexusofprivacy.net) Zack Whittaker on TechCrunch (techcrunch.com) The New York-based stalkerware operator also agreed to pay more than $400,000 in civil penalties for facilitating phone surveillance. #### [Lawmakers stumble on data privacy as another tech CEO to testify](https://rollcall.com/2023/02/02/lawmakers-stumble-on-data-privacy-as-another-tech-ceo-to-testify?ref=thenexusofprivacy.net) Gopal Ratnam on Roll Call (rollcall.com) With TikTok’s CEO set to testify before a committee next month, Congress has struggled to fashion data privacy legislation. #### [Privacy Is a Right. Protecting It Is Not Extreme.](https://newamerica.org/oti/blog/privacy-is-a-right-protecting-it-is-not-extreme?ref=thenexusofprivacy.net) David Morar on New America (newamerica.org) Sometimes, defenders of the status quo are the most extreme. #### [Security Principles: Addressing underlying causes of risk in complex systems](https://ftc.gov/policy/advocacy-research/tech-at-ftc/2023/02/security-principles-addressing-underlying-causes-risk-complex-systems?ref=thenexusofprivacy.net) the Premerger Notification Office Staff on Federal Trade Commission (ftc.gov) On December 14th, 2022, in collaboration with technologists on team CTO and attorneys in BCP, I gave a presentation at the Federal Trade Commission’s #### [Apple facing new lawsuit alleging tech giant failed to provide promised privacy](https://wraltechwire.com/2023/02/02/apple-facing-new-lawsuit-alleging-tech-giant-failed-to-provide-promised-privacy?ref=thenexusofprivacy.net) WRAL TechWire on WRAL TechWire (wraltechwire.com) A legal complaint filed in the United States District Court for the Northern District of California alleges that Apple does capture data even when a user of an iPhone selects not to share data. #### [Third Version Of Colorado Privacy Act Draft Rules Published](https://jdsupra.com/legalnews/third-version-of-colorado-privacy-act-9583579?ref=thenexusofprivacy.net) David Stauss on JD Supra (jdsupra.com) Keypoint: The draft CPA rules retain the hallmarks of what makes the CPA rules unique but contain some notable revisions and clarifications. On... #### [Hello from the Dark Side: Dark Patterns in Privacy](https://americanbar.org/events-cle/mtg/web/429275644?login=&ref=thenexusofprivacy.net) John Heckman on American Bar Association (americanbar.org) Welcome to SciTech’s ePrivacy Committee webinar on dark patterns in privacy. Our expert panel will discuss all that you need to know regarding dark patterns in privacy, including what they are (with… #### [What US privacy laws do advertisers need to be aware of in 2023?](https://thedrum.com/profile/confiant/news/what-us-privacy-laws-do-advertisers-need-to-be-aware-of-in-2023-1?ref=thenexusofprivacy.net) Confiant on Confiant (thedrum.com) By John Murphy, chief strategy officer, Confiant January 28th is celebrated globally as Data Privacy Day. It acts as a reminder that several US state privacy regulations become effective during 2023\. As a result, privacy could become more important to the ad ecosystem than ever in the United States,… #### [The privacy pendulum: What can ad tech’s past teach us about the future of tracking?](https://thedrum.com/profile/yieldmo/news/the-privacy-pendulum-what-can-ad-techs-past-teach-us-about-the-future-of-tracking?ref=thenexusofprivacy.net) Yieldmo on Yieldmo (thedrum.com) By Mark McEachran, VP platform product management The year was 1994\. Lou Montulli, a Netscape engineer, had just invented the cookie. Did he mean to build the foundations of a digital ad industry that revolved around audience tracking and targeting? No. He just wanted a shopping cart to work properl… #### [Apple Privacy Suits Claim App Changes Were Guise to Boost Ad Revenue](https://hollywoodreporter.com/business/business-news/apple-privacy-suits-claim-app-changes-boost-ad-revenue-1235317305?ref=thenexusofprivacy.net) Winston Cho on The Hollywood Reporter (hollywoodreporter.com) Apple’s privacy campaign has driven its climbing ad revenue at the expense of competitors, especially Facebook parent company Meta. #### [Replika, a ‘virtual friendship’ AI chatbot, hit with data ban in Italy over child safety](https://techcrunch.com/2023/02/03/replika-italy-data-processing-ban?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) AI chatbot maker Replika has been ordered to stop processing user data in Italy over child safety and data protection concerns. #### [GitHub CEO on why open source developers should be exempt from the EU’s AI Act](https://techcrunch.com/2023/02/03/github-ceo-on-why-open-source-developers-should-be-exempt-from-the-eus-ai-act?ref=thenexusofprivacy.net) Paul Sawers on TechCrunch (techcrunch.com) GitHub CEO Thomas Dohmke says that open source developers should be made exempt from the EU’s proposed new AI regulations. #### [Twitter Circle glitches have users worried about privacy](https://techcrunch.com/2023/02/03/twitter-circle-glitches-have-users-worried-about-privacy?ref=thenexusofprivacy.net) Amanda Silberling on TechCrunch (techcrunch.com) As more Twitter features break and glitch, users are becoming increasingly concerned about the platform’s stability. #### [Privacy and Cybersecurity Issues in Electric Vehicles](https://jdsupra.com/legalnews/privacy-and-cybersecurity-issues-in-3086993?ref=thenexusofprivacy.net) Hannah Ji-Otto on JD Supra (jdsupra.com) This is the second article in a series of alerts that addresses what businesses, organizations and governmental entities should be considering as they... #### #### [HR data is now regulated under California privacy law: How to tackle compliance](https://jdsupra.com/legalnews/hr-data-is-now-regulated-under-1897100?ref=thenexusofprivacy.net) Christian Auty on JD Supra (jdsupra.com) 2023 will be yet another dynamic year for data privacy regulation. In addition to the data privacy laws in Virginia, Colorado, Utah, and Connecticut... #### [Career Opportunities - California Privacy Protection Agency (CPPA)](https://cppa.ca.gov/about%5Fus/jobs.html?ref=thenexusofprivacy.net) on CPPA (cppa.ca.gov) #### [Opinion: Chula Vista’s use of automated license plate surveillance threatens everyone’s privacy](https://sandiegouniontribune.com/opinion/commentary/story/2023-02-06/opinion-automated-license-plate-surveillance-is-going-too-far-in-chula-vista?ref=thenexusofprivacy.net) Norell Martinez, Nancy Relaford, Margaret Baker on San Diego Union-Tribune (sandiegouniontribune.com) Use of surveillance technology disproportionately impacts immigrants. #### [Americans Flunked This Test on Online Privacy](https://nytimes.com/2023/02/07/technology/online-privacy-tracking-report.html?ref=thenexusofprivacy.net) on NYTimes (nytimes.com) Many consumers want control over their personal details. But few understand how online tracking works, says a new report from the University of Pennsylvania. #### [ChatGPT is a data privacy nightmare. If you’ve ever posted online, you ought to be concerned](https://theconversation.com/chatgpt-is-a-data-privacy-nightmare-if-youve-ever-posted-online-you-ought-to-be-concerned-199283?ref=thenexusofprivacy.net) Uri Gal on The Conversation (theconversation.com) ChatGPT is fuelled by our intimate online histories. It’s trained on 300 billion words, yet users have no way of knowing which of their data it contains. #### [Ex-Twitter privacy chief takes job at social media app BeReal](https://reuters.com/technology/ex-twitter-privacy-chief-takes-job-social-media-app-bereal-2023-02-07?ref=thenexusofprivacy.net) Sara Merken on Reuters (reuters.com) Damien Kieran, who resigned as Twitter Inc’s chief privacy officer in November after Elon Musk took over the social media giant, has joined photo sharing app-maker BeReal as its top lawyer. #### [A New Draft Privacy Model Blooms From the NAIC Privacy Working Group](https://jdsupra.com/legalnews/a-new-draft-privacy-model-blooms-from-1097567?ref=thenexusofprivacy.net) Ann Young Black on JD Supra (jdsupra.com) On February 1, the NAIC’s Privacy Working Group’s new privacy model germinated. After months of development, the exposure draft, titled “Insurance... #### [ChatGPT is a data privacy nightmare. If you’ve ever posted online, you ought to be concerned](https://theconversation-com.cdn.ampproject.org/c/s/theconversation.com/amp/chatgpt-is-a-data-privacy-nightmare-if-youve-ever-posted-online-you-ought-to-be-concerned-199283?ref=thenexusofprivacy.net) on The Conversation (theconversation-com.cdn.ampproject.org) ChatGPT is fuelled by our intimate online histories. It’s trained on 300 billion words, yet users have no way of knowing which of their data it contains. #### #### [Musk’s Twitter is facing tricky questions over data deletion](https://techcrunch.com/2023/02/08/elon-musk-twitter-dm-deletion?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) European data protection regulators are “engaging” with Twitter following a series of complaints from users that it’s ignoring requests to delete their direct messages, TechCrunch has learned. #### [Opinion: This bill would hurt children while trying to help them](https://deseret.com/opinion/2023/2/7/23590084/utah-lawmakers-would-hurt-children-while-trying-to-help-them?ref=thenexusofprivacy.net) Shoshana Weissmann on Deseret News (deseret.com) Utah lawmakers are considering SB152, which would require children and adults to provide proof of age to internet sites in order to gain access #### [ChatGPT Is a Disaster for Your Privacy | PIA VPN](https://privateinternetaccess.com/blog/chatgpt-privacy?ref=thenexusofprivacy.net) Glyn Moody on PIA VPN Blog (privateinternetaccess.com) ChatGPT has serious privacy issues. It can collect and process highly sensitive details and associate it with your email and phone number. #### [Amazon is the latest threat to Facebook as ad targeting suffers](https://cnbc.com/2023/02/10/amazon-is-the-latest-threat-to-facebook-as-ad-targeting-suffers.html?%5F%5Fsource=sharebar%7Ctwitter&ref=thenexusofprivacy.net) Jonathan Vanian on CNBC (cnbc.com) Brands are shifting ad budgets away from Facebook and toward Amazon now that targeting users across social networks has become more difficult. #### [Privacy Row Dents Hong Kong Film Awards Celebrating Bumper Year for Local Movies](https://variety.com/2023/film/news/hong-kong-film-awards-privacy-1235519083?ref=thenexusofprivacy.net) Patrick Frater on Variety (variety.com) An unusual five films picked up ten or more nominations for the Hong Kong Film Awards, with court room drama, “The Sparring Partner” picking up 16\. But the event was partially overshadowed by a row… #### [Nobody but your doctor should know your menstrual history](https://vox.com/science-and-health/2023/2/7/23587699/florida-menstrual-period-history-student-athletes-privacy-medical?ref=thenexusofprivacy.net) Keren Landman on Vox (vox.com) The big problem with Florida asking for so much of its student-athletes’ health information. #### [Apple: No apps circumvented user privacy controls](https://appleinsider.com/articles/23/02/10/apple-no-apps-circumvented-user-privacy-controls?ref=thenexusofprivacy.net) Andrew Orr on AppleInsider (appleinsider.com) Apple fixed a potential privacy vulnerability with iOS 16.3 and other updates, but its investigation into an allegation concluded that no apps took advantage of the flaw. #### [Cerebral Class Action Lawsuit Investigation Over Privacy Violation Concerns](https://legalscoops.com/cerebral-class-action-lawsuit-investigation-over-privacy-violation-concerns?ref=thenexusofprivacy.net) Alan Mansfield, Esq. on LegalScoops (legalscoops.com) On February 2, 2023, two members of the United States Senate sent a letter to Cerebral, Inc. where they ““express our concern regarding reports that Cerebral is tracking and sharing sensitive and personally-identifiable health data with third-party social media and online search platforms such as Google and Facebook that monetize this data to target advertisements,” using what is known as the Meta Pixel tracking cookie. #### [Stalkerware Maker Fined $410k and Compelled to Notify Victims](https://eff.org/deeplinks/2023/02/stalkerware-maker-fined-410k-and-compelled-notify-victims?ref=thenexusofprivacy.net) Bill Budington on Electronic Frontier Foundation (eff.org) Last week, the New York Attorney General secured a $410,000 fine from Patrick Hinchy and 16 companies that he runs which produce and sell spyware and stalkerware. In addition, he and his companies must modify their stalkerware to alert victims that their devices have been compromised. This sends a..… ### A watered-down substitute advances: Washington privacy legislation update, February 6 URL: https://thenexusofprivacy.net/a-watered-down-substitute-advances/ Last updated: 2026-04-16T03:01:56.000Z *Last updated April 20\. See the* [*update log*](#update-log) *at the bottom.* Washington's short legislative session continues in high gear. Bills have to make it through multiple committees in either the House or Senate and get a floor vote by March 8, then they've got a month to get through the other chamber. But the first "cutoff" is February 17, which is generally the last day the committee a bill has initially been assigned to (aka the bill's "policy" committee) can vote to advance it, and there are only a handful of committee meetings between now and them, so time is starting to get tight. **My Health My Data** (HB 1155) protects consumer health data – incuding especially urgent as more and more states criminalize abortion and gender-affirming care. Civil Rights & Judiciary (CR&J) Chair Drew Hansen introduced a substitute version of the bill incorporating many of industry's requests for "improvements" (haha), and **on Friday, CR&J advanced the watered-down substitute SHB 1155** on a party-line vote (although one Democrat who described herself as "represnting the tech industry" said she'd vote against it on the floor unless it were further weakened). The bill now moves to the Rules committee, and from there to the House floor. > **Update #1**: on March 5, the House passed ESHB 1155 on a party-line vote after adopting an amendment (brought by Rep. Walen, the Democrat who had threatened to vote against it unless it was weakened ) that gutted the private right of action and made it extremely difficult for people to sue tech companies, data brokers, "crisis pregnancy centers", or anybody else if they break the law. Still, even in it's weakened, watered-down form, it's still a big milestone getting anything through the House. So congratulations to bill sponsor Rep. Vandana Slatter, and all the privacy advocates who have been supporting the bill! > > Up next, the Senate Law & Justice committee, where privacy advocates will be pushing to strengthen the bill – and industry lobbyists will be suggesting more "improvements" (haha). > **Update #2 (April 20)*: The Senate Law & Justice committee restored the per se clause, made some other valuable improvements, rejected most of industry's suggestions for "improvements" (haha), delayed the effective date of most of the bill to March 31 2024\. On April 5,* [*the full Senate passed My Health My Data 27-21*](https://thenexusofprivacy.net/my-health-my-data-senate-floor/#and-you-may-ask-yourself-well-how-did-we-get-here)*, keeping the per se clause and rejecting floor amendments that would have weakened it (although further delaying the effective date for small businesses) – and on April 17,* [*the House concurred*](https://thenexusofprivacy.net/my-health-my-data-in-the-home-stretch/) *and accepted the Senate's version.* [*The bill's currently on the Gov. Inslee's desk*](https://thenexusofprivacy.net/my-health-my-data-goes-to-the-governors-desk-washington-state-privacy-update-april-20/)*, and he's expected to sign it next week.* ## Ask and ye shall receive (if you're an industry lobbyist) > "Industry lobbyists ... pushed back strongly against some of the bill's language, claimed the bill as written would cause the sky to fall, and suggested "improvements" (haha) including narrowing the definitions of consumer health data, introducing more loopholes and exemptions, allowing some geofencing as long as it wasn't "precise", and weakening enforcement." > > – [A very encouraging first step: My Health My Data's first hearing](https://thenexusofprivacy.net/my-health-my-data-encouraging-first-step/) Supporters of My Health My Data had urged the Civil Rights & Judiciary comittee to advance the bill as quickly as possible, so from that perspective it's very good news that the bill moved forward. And the substitute bill continues to include important features; the combination of its opt-in requirements and enforcement mechanisms – including a strong private right of action – protect against some of the egregious abuses that happen today. That said, industry lobbyists got several of the "improvements" (haha) they asked for in his substitute amendment, so the protections are significantly less than in the original bill. The new version of My Health My Data: - **no longer prohibits organizations from selling Washingtonians’ health data**. Companies now can sell data if they get an "authorization", a much lower level of protection.[1](#notes) Prohibiting organizations from selling health data was the #1 bullet on the list in [the press release when AG Ferguson, Rep. Slatter, and Sen. Dhingra introduced My Health My Data](https://www.atg.wa.gov/news/news-releases/ag-ferguson-rep-slatter-sen-dhingra-propose-legislation-protect-washingtonians?ref=thenexusofprivacy.net) last fall. Here's how the press release describes the impact of selling health data: > "Period tracking apps can sell sensitive information about a woman’s late period or miscarriage to data brokers. Data brokers can link that information to her data profile, which is essentially for sale on the open market. Law enforcement from states with strict anti-abortion laws or anti-choice advocacy groups can purchase that data profile and use that information to prosecute women who had an abortion or miscarriage in another state." - **no longer prohibits using location data to target ads at people visiting reproductive and gender affirming health care facilities.** The definition of "geofencing" is now limited to "a virtual boundary that is 2,000 feet or less from the perimeter of the physical location", which opens up several opportunities for anti-abortion groups to [target ads at women visiting clinics](https://www.telegraph.co.uk/technology/2020/04/21/anti-abortion-groups-using-geo-fencing-tech-target-women-inside/?ref=thenexusofprivacy.net).[2](#notes) - **now only explicitly protects location data indicating a consumer's attempt to acquire or receive health services or supplies if it's "precise"** (defined as "directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet"). This could potentially create loopholes letting for vigilantes and law enforcement in states the criminalize abortion or gender-affirming care buy people's imprecise location data and combine it with other information (including "de-identified" location data, which is exempt from My Health My Data) to build up a clearer picture of somebody's movements. - **has a lot more loopholes and exemptions** For example data brokers, "crisis pregnancy centers", and other businesses are allowed to collect, use, and disclose health data without asking consent as long as it's to "prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; or investigate, report, or prosecute those responsible for any such action." That's good news for law enforcement in states where abortion is illegal activity – but bad news for people seeing reproductive health care. There's also a much longer list of exemptions for existing laws on human research and hospital quality programs that have privacy requirements (or requirements that could conflict with privacy); depending on the specifics of those bills these could be necessary carveouts, or could be loopholes undercutting the principle that (where feasible) My Healh My Data should be a floor not a ceiling. - **no longer requires policies to include the specific types of health data collected and shared, the specific sources, and the specific third parties data is shared with**. Instead, privacy policies only have to include the *categories.* This means there's no way to know just from a privacy policy whether a company shares information with third parties who are unregulated entities (who could then do whatever they want with it, including selling it to bounty hunters or law enforcement). Instead, you have to wait for your data to be shared with third parties, then make an access request and wait for however long it takes to process it ... and then make similar access requests from any third parties. By the time you figure out that your data has gone to an unregulated entity, it's too late. There are plenty of other changes as well.[3](#notes) Almost none of them *strengthen* consumer protection – and even the ones that do are a bit of a mixed bag. For example, the right to confirm whether an company is collecting, using, or sharing data now includes a list of all third parties and affiliates (although not processors) the data has been shared with or sold to. That's good! Balanced against this, though, the list of third parties and affiliates that companies share information with is no longer requied in the privacy policy; companies now have longer to respond to requests for information; and companies are allowed to charge if you make more than two requests a year. ## A potentially tricky situation > "Of course, if legislators take lobbyists' suggestions and water My Health My Data down, then it won't protect health data, pregnant people, or gender-affirming care." > > – [A very encouraging first step](https://thenexusofprivacy.net/my-health-my-data-encouraging-first-step/) Despite all the watering down, industry still isn't satisfied. Amendments to remove the requirement for authorization for selling health data and any restrictions on geofencing, weaken enforcement by removing the per se clause, and give companies a get-out-of-jail free card (the so-called "right to cure") were voted down on Friday but will no doubt be back. Still, industry lobbyists are probably quite pleased with the results so far. Going forward, their goal will be to keep most of the discussion going forward focused on their suggestions for additional "improvements" (haha), trying to force the legislature to choose between passing a bill that doesn't protect Washingtonians ... and not passing anything at all. Good news for industry either way! By contrast, Chair Hansen has potentially created a very tricky situation for Democrats in the legislature (and AG Ferguson and Gov. Inslee as well, for that matter). Despite the promising start from Rep. Slatter and Sen. Dhingra, it's not clear that My Health My Data is still on track to deliver on their commitment to protect health data, pregnant people, and gender-affirming care. Worse, the optics of the cis male chair of the Civil Rights committee not allowing four women and a trans femme person (several of whom have very relevant experience in the tech industry) to speak at the hearing, and then giving away so many of these protections to make industry happy are ... not great. Of course, Democrats have majorities in both chambers. So they have the votes to restore these protections (via floor amendments in the House, at the Senate Law & Justice committee, or on the Senate floor) if they want to. After making reproductive freedom a big part of their campaign platform, hopefully Democrats will realize how bad it would be politically to let industry continue to exploit pregnant people's data at the expense of their safety. But then again the tech industry is very influential here in Washington. So, we shall see. ## Notes 1 Prohibiting selling health data (but not other kinds of data) is a content-based restriction, which means it would face strict scrutiny from a constitutional perspective, and in [*Sorrell vs IMS Health Inc*](https://en.wikipedia.org/wiki/Sorrell%5Fv.%5FIMS%5FHealth%5FInc.?ref=thenexusofprivacy.net) *(2011)*, the Supreme Court overturned Vermont's Prescription Confidentiality Law on First Amendment grounds. Content-based restrictions can survive strict scrutiny if they are narrowly tailored to serve a compelling interest and are the least restrictive means available to achieve that purpose; for example, [state legislation of non-consensual intimate images, which is also content-based, has survived constitutional challenges](https://www.naag.org/attorney-general-journal/an-update-on-the-legal-landscape-of-revenge-porn/?ref=thenexusofprivacy.net). However, HIPAA allows sales of protected health information with an authorization, so an outright prohibition might fail the least restrictive means test. Still, even if an outright prohibition would lead to a constitutional challenge, there maybe additional protections to complement the authorization. For example, sale of de-identified data puts some contractual obligations on the purchaser; could a similar approach work for non-deidentified data? Of course, an even more privacy-protective approach that *wouldn't* raise the same content-baed issues would be to prohibit *all* data sales, but given My Health My Data's focus on consumer health data, that's going to have to wait for a comprehensive privacy bill. 2 For example, by combining location-based targeting with a radius of 2,500 feet (not considered geofencing under the current definition) with other data; or by combining information from multiple 2500-foot-radius location-based targeting to triangulate a more precise location. 3 Here's a list of the other changes I've found so far, along with some thoughts. - The definition of consumer health data has changed. Before it was "relating to" past, present or future mental health, now it's "linkable to or reasonably linkable to and identifying" past, present or future mental health. - "Efforts to research or obtain health services or supplies" are no longer considered consumer health data. This doesn't affect efforts to research or obtain reproductive, sexual, and gender-affirming health services; they're still protected, and the definition of those services includes products and medications. However, efforts to research or obtain other health services or supplies aren’t protected any longer – for example a search for "dealing with depression", "Alzheimer's support groups", "cancer specialist". That search data could be sold to unregulated entities, who could then use it to infer – and sell – people's health status. - The definition of "consent" has changed. Before it was written consent; now it's "agreement", which may include written consent provided by electronic means. The new definition has similar wording to the GDPR and the People's Privacy Act, so maybe this is okay. - Sleep and exercise data is no longer included under biometrics. Maybe it's covered elsewhere in the definition of consumer health data (although I'm not sure) ... even if it is, it sure would be good to be explicit about it, otherwise companies can argue that the legislative intent was clearly to remove this protection. - The definition of "publicly available" data – which is exempt from the law – has expanded. It now includes information that "a regulated entity has a reasonable basis to believe a consumer has lawfully made available to the general public." One consequence of this is that information in social media posts (including location) is now exempt from the bill. The new language is similar to California's CCPA, but that doesn't make it okay! - Companies get additional time to respond to requests for information – it used to be 30 days, now it's 45 days with an automatic 45 day extension. Again, the language is similar to California's - Consumers are only allowed to make two free requests per year to see what information a company has on them. - Sections 5(1)(b) and 5(2)(b) now allow companies to collect and share health data if it's "necessary" to provide a product or service that's been requested; before, it was "strictly necessary" - Deletion requests and requests for information now have to be authenticated, and companies are allowed to ignore requests if they can't authenticate them with "commercially reasonable". If a company doesn't take action on a request, there's now an appeals process. There was clearly an issue in the original bill: without any requirement for authentication or verification (as it's called in California's CCPA), anybody could request anybody else's data. However, if the new langauge is badly-worded, it could potentially give companies a way to delay or avoid responding to requests; I haven't looked at it in enough detail to know if there's a problem. - Companies are allowed to defer deletion on backup materials up to six months. This is different from California's CCPA (which allows companies to defer deletion until the backup is restored or the data is used) but it's not clear to me whether it's better or worse. ## Update log February 7: improve discussion of geofencing, include quote from press release on impact of data sales, clean up other wording February 8: remove the bullet point on narrowing the definition of consumer health data, and move the discussion of "efforts to research or obtain health services or supplies" to a footnote. February 11: add footnote on content-based restrictions February 20: update footnote on content-based restrictions to include *Sorrell*, add expansion of publicly available information March 3: remove updates of People's Privacy Act and ADS bill, discussed in more detail in [A much more favorable environment, but a lot of complexity](https://thenexusofprivacy.net/wa-privacy-more-favorable-environment/); update footnote on content-based restrictions again; add more detail on the list of changes in footnote, and move the privacy policy change from the footnote into the main text March 10: add House floor votes; update footnote on consent and sleep data March 16: minor clarifications in disussion of House floor votes April 20: update after House concurs; clarify wording in "precise location data" discusssion. ### Privacy News Roundup: February 1 URL: https://thenexusofprivacy.net/privacy-news-february-1/ Last updated: 2023-02-02T00:21:33.000Z Privacy after Roe, an FTC enforcement action, a federal privacy legislation update ... and more! ## Privacy after Roe ### [How US police use digital data to prosecute abortions](https://techcrunch.com/2023/01/27/digital-data-roe-wade-reproductive-privacy?ref=thenexusofprivacy.net) Runa Sandvik on TechCrunch (techcrunch.com) Sandvik looks at court records of cases between 2011 and 2022 to examine how police in the U.S. use text messages, emails, search history to prosecute people seeking abortions. This kind of detailed examination is valuable to see whether legislation intended to protect people seeking abortions is effective – and highlights the need for Washington state's Shield Law's protections against out-of-state law investigations as well as My Health My Data's requirements for websites to get consent before sharing health information with Facebook and Google. ## Automated Decision Systems ### [Using sensitive data to prevent AI discrimination: Does the EU GDPR need a new exception?](https://iapp.org/news/a/using-sensitive-data-to-prevent-ai-discrimination-does-the-eu-gdpr-need-a-new-exception?ref=thenexusofprivacy.net) Marvin van Bekkum and Frederik Zuiderveen Borgesius on International Association of Privacy Professionals (iapp.org) This article summarizes the authors' [paper](https://www.sciencedirect.com/science/article/pii/S0267364922001133?ref=thenexusofprivacy.net) on whether collecting special categories of personal data could help debias artificial intelligence, and their arguments for and against a new exemption. ### [Assessing Impacts of AI on Human Rights: It’s Not Solely About Privacy and Nondiscrimination](https://lawfareblog.com/assessing-impacts-ai-human-rights-its-not-solely-about-privacy-and-nondiscrimination?ref=thenexusofprivacy.net) Eve Gaumond and Catherine Régis on Lawfare (lawfareblog.com) Artificial intelligence can significantly impact human rights—both positively and negatively. Human rights impact assessments conceived specifically for AI are needed to prevent potential harms and reap the benefits of the technology. ### [NIST Risk Management Framework Aims to Improve Trustworthiness of Artificial Intelligence](https://nist.gov/news-events/news/2023/01/nist-risk-management-framework-aims-improve-trustworthiness-artificial?ref=thenexusofprivacy.net) on NIST (nist.gov) New guidance seeks to cultivate trust in AI technologies and promote AI innovation while mitigating risk.= ### [AI wrote a bill to regulate AI. Now Rep. Ted Lieu wants Congress to pass it.](https://nbcnews.com/politics/congress/ted-lieu-artificial-intelligence-bill-congress-chatgpt-rcna67752?ref=thenexusofprivacy.net) Kate Santaliz on NBC News (nbcnews.com) The California Democrat, one of a handful of members with a computer science background, wants a nonpartisan commission to recommend new regulations for artificial intelligence. ## Enforcement ### [FTC Fines GoodRx $1.5M for Sending Medication Data to Facebook for Ads](https://gizmodo.com/ftc-fines-goodrx-prescription-data-facebook-google-1850059096?ref=thenexusofprivacy.net) Thomas Germain on Gizmodo (gizmodo.com) As well as a $1.5 million fine, GoodRx has agreed to a first-of-its-kind provision banning the company from sharing health data with third parties for ads. As Germain reports: > "GoodRx’s privacy problems were first uncovered by this reporter in [an investigation with Consumer Reports](https://www.consumerreports.org/health-privacy/goodrx-saves-money-on-medsit-also-shares-data-with-google-facebook-and-others-a6177047589/?ref=thenexusofprivacy.net), followed by a similar report in [Gizmodo](https://gizmodo.com/goodrx-shares-my-prescriptions-with-third-parties-and-i-1841772965?ref=thenexusofprivacy.net). At the time, if you looked up Viagra, Prozac, PrEP, or any other medication, GoodRx would tell Facebook, Google, and a variety of companies in the ad business, such as Criteo, Branch, and Twilio. GoodRx wasn’t selling the data. Instead, it shared the information so those companies could help GoodRx target its own customers with ads for more drugs. According to the FTC, that’s illegal." ALSO: - [FTC Enforcement Action to Bar GoodRx from Sharing Consumers’ Sensitive Health Info for Advertising](https://ftc.gov/news-events/news/press-releases/2023/02/ftc-enforcement-action-bar-goodrx-sharing-consumers-sensitive-health-info-advertising?ref=thenexusofprivacy.net), the Federal Trade Commission (ftc.gov) ### [Calif AG puts mobile app developers on notice over privacy](https://theregister.com/2023/01/31/calif%5Fag%5Fmobile%5Fapp%5Fdevelopers?ref=thenexusofprivacy.net) Jessica Lyons Hardcastle on The Register (theregister.com) California's attorney general Rob Bonta has sent letters to businesses with mobile apps that (allegedly) ignore opt-out requests or sell users' data. The letters focus on retail, travel and food service apps. ### [Big changes coming for GDPR enforcement on Big Tech in Europe?](https://techcrunch.com/2023/01/31/gdpr-enforcement-reform-dpa-oversight?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) In what looks like a meaningful -- and long overdue -- reforming step, the European Commission has committed to dial up its monitoring of how data protection authorities at the EU Member State level enforce the bloc’s flagship data protection rules against Big Tech. ALSO - [Europe-wide overhaul of GDPR monitoring triggered by ICCL](https://iccl.ie/digital-data/europe-wide-overhaul-of-gdpr-monitoring-triggered-by-iccl?ref=thenexusofprivacy.net), Johnny Ryan on Irish Council for Civil Liberties (iccl.ie) - [EU vows to get tougher on Big Tech privacy violations](https://engadget.com/eu-tougher-gdpr-monitoring-big-tech-151519695.html?guccounter=1&ref=thenexusofprivacy.net), Jon Fingas on Engadget (engadget.com) ## Federal Privacy Legislation ### [A view from DC: From consumer protection to innovation and data](https://iapp.org/news/a/a-view-from-dc-from-consumer-protection-to-innovation-and-data?ref=thenexusofprivacy.net) Cobun Zweifel-Keegan on International Association of Privacy Professionals (iapp.org) IAPP's Managing Director discusses last week's Future of Data Privacy and Security in the 118th Congress, hosted by R Street. > "Like dormant sugar maple trees, policymakers are just beginning to wake up as the days lengthen into the new term. Whether innovation, competitiveness, safety, security or even pure privacy concerns drive the narrative, the policy discourse is tapped and ready to flow in 2023." ## And ... ### [Child welfare algorithm faces Justice Department scrutiny](https://apnews.com/article/justice-scrutinizes-pittsburgh-child-welfare-ai-tool-4f61f45bfc3245fd2556e886c2da988b?ref=thenexusofprivacy.net) Sally Ho and Garance Burke on Associated Press (apnews.com) The Justice Department has been scrutinizing a controversial artificial intelligence tool used by a Pittsburgh-area child protective services agency following concerns that it could result in discrimination against families with disabilities. #### [How surveillance tech helped protect power — and the drug trade — in Honduras](https://codastory.com/authoritarian-tech/honduras-surveillance-drug-trade?ref=thenexusofprivacy.net) Anna-Catherine Brigida on Coda Story (codastory.com) How big-name monitoring software from companies like Cellebrite and Palantir made Honduras a hotbed of spy tech. #### [Modi Is Muzzling Big Tech](https://foreignpolicy.com/2023/01/27/modi-big-tech-india-bbc-documentary-twitter?ref=thenexusofprivacy.net) Rishi Iyengar on Foreign Policy (foreignpolicy.com) Silicon Valley has spent years courting India, but its companies face an increasingly tricky censorship minefield in the world’s largest democracy. #### #### [Google Fi says hackers accessed customers’ information](https://techcrunch.com/2023/01/31/google-fi-customer-data-breach?ref=thenexusofprivacy.net) Carly Page on TechCrunch (techcrunch.com) The virtual cell service said customers’ data was exposed following “suspicious activity” relating to its primary network provider. #### [Could a More Powerful Web Tracker Be Good for Your Privacy?](https://gizmodo.com/full-throttle-new-tracker-google-kills-cookies-1850051167?ref=thenexusofprivacy.net) Thomas Germain on Gizmodo (gizmodo.com) Full Throttle is launching a new, souped-up tracker as Google moves to kill third-party cookies. #### [What does GPT-3 “know” about me?](https://technologyreview.com/2022/08/31/1058800/what-does-gpt-3-know-about-me?ref=thenexusofprivacy.net) Melissa Heikkilä on MIT Technology Review (technologyreview.com) Large language models are trained on troves of personal data hoovered from the internet. So I wanted to know: What does it have on me? #### [French Senate backs AI-powered video surveillance for Paris 2024 Olympics](https://politico.eu/article/french-senators-back-ai-powered-video-surveillance-for-paris-2024-olympics?ref=thenexusofprivacy.net) Laura Kayali on POLITICO (politico.eu) A majority of senators voted against introducing facial recognition. #### [Project Texas: The Details of TikTok’s Plan to Remain Operational in the United States](https://lawfareblog.com/project-texas-details-tiktoks-plan-remain-operational-united-states?ref=thenexusofprivacy.net) Matt Perault on Lawfare (lawfareblog.com) Last week, senior TikTok executives held a private briefing to review the details of Project Texas and the contours of the national security agreement it is negotiating with the U.S. government. #### [News release: Home Depot’s failed to obtain customer consent before sharing personal data with Meta](https://priv.gc.ca/en/opc-news/news-and-announcements/2023/nr-c%5F230126?ref=thenexusofprivacy.net) Office of the Privacy Commissioner of Canada (priv.gc.ca) #### [Alberta Justice Minister Accused of Privacy Breach in Law Society Hearing](https://thetyee.ca/News/2023/01/26/Bombshell-Derails-Alberta-Minister-Shandro-Law-Society-Hearing?ref=thenexusofprivacy.net) Charles Rusnell on The Tyee (thetyee.ca) Shandro’s testimony allegedly violated the privacy of a witness by referencing secrets he gained in an official role. #### [Privacy and data protection too often suspended at EU borders](https://euractiv.com/section/data-privacy/opinion/it-is-time-to-tear-down-this-wall?ref=thenexusofprivacy.net) Wojciech Wiewiórowski on EURACTIV (euractiv.com) Privacy and data protection are part of the human rights too often suspended at the borders of the European Union - as long as we continue treating migration as a ‘problem’, fundamental rights will remain compromised, Wojciech Wiewiórowski writes. #### [Highly intrusive spyware threatens the essence of human rights - Commissioner for Human Rights - publi.coe.int](https://coe.int/en/web/commissioner/-/highly-intrusive-spyware-threatens-the-essence-of-human-rights?ref=thenexusofprivacy.net) Council of Europe on Council of Europe (coe.int) Strasbourg 27/01/2023 #### [Brazil’s Telecom Operators Made Strides and Had Shortcomings in Internet Lab’s New Report on User Privacy Practices](https://eff.org/deeplinks/2023/01/brazils-telecom-operators-made-strides-and-had-shortcomings-internet-labs-new?ref=thenexusofprivacy.net) Karen Gullo and Veridiana Alimonti on Electronic Frontier Foundation (eff.org) Brazil’s biggest internet connection providers made moderate advances in protecting customer data and being transparent about their privacy practices, but fell short on meeting certain requirements for upholding users’ rights under Brazil’s data protection law, according to InternetLab’s 2022 Quem..… #### #### [FTC Finalizes Order with Ed Tech Provider Chegg for Lax Security that Exposed Student Data](https://ftc.gov/news-events/news/press-releases/2023/01/ftc-finalizes-order-ed-tech-provider-chegg-lax-security-exposed-student-data?ref=thenexusofprivacy.net) the Premerger Notification Office Staff on Federal Trade Commission (ftc.gov) The Federal Trade Commission has finalized its order with education technology provider Chegg Inc. #### [Decoding the Hype About AI](https://themarkup.org/hello-world/2023/01/28/decoding-the-hype-about-ai?ref=thenexusofprivacy.net) Julia Angwin on The Markup (themarkup.org) A conversation with Arvind Narayanan #### [Happy Data Privacy Day: On the Essential Link between Data Processing and Security](https://lawfareblog.com/happy-data-privacy-day-essential-link-between-data-processing-and-security?ref=thenexusofprivacy.net) David Hoffman on Lawfare (lawfareblog.com) Today is Data Privacy Day, an annual event in which I am — rather proudly — personally invested. Data Privacy Day began with a conversation at my dinner table eight years ago, when Leonardo Cervera Navas (then with the European Commission and now with the European Data Protection Supervisor’s office… #### [Apple sued for promising privacy, failing at it](https://theregister.com/2023/01/28/apple%5Fsued%5Fprivacy?ref=thenexusofprivacy.net) Thomas Claburn on The Register (theregister.com) What’s allowed for Cupertino is verboten for everyone else #### [Privacy-by-design can be a source of value and opportunity, not cost](https://gulfbusiness.com/privacy-by-design-can-be-a-source-of-value?ref=thenexusofprivacy.net) Divsha Bhat on Gulf Business (gulfbusiness.com) Privacy can become a selling point and a source of value, especially when it is implemented by design and not reactively. #### [States and Counties Making Fresh Progress on Privacy](https://govtech.com/workforce/states-and-counties-making-fresh-progress-on-privacy?ref=thenexusofprivacy.net) Thad Rueter on GovTech (govtech.com) This year’s Data Privacy Week drew attention to the increasing role that cybersecurity is playing for government. Public agencies are responding via new hiring but still face big challenges. ### [Experts, students shed light on tech user privacy concerns and online safety measures](https://theaggie.org/2023/01/28/75272?ref=thenexusofprivacy.net) Rebeka Zeljko on The California Aggie (theaggie.org) An interesting article in UC Davis' campus newspaper looks at invasive technologies and how they manifest in day-to-day life, with perspectives from students as well as the school's academic associate director for academic technology services. #### [What’s on the Global Horizon for Data Privacy in 2023?](https://jdsupra.com/legalnews/what-s-on-the-global-horizon-for-data-1123751?ref=thenexusofprivacy.net) Shannon Knapp on JD Supra (jdsupra.com) Expect another year of regulatory ambiguity for international data privacy laws in 2023, as the European Commission reviews the EU-US Data Privacy... #### [The privacy concerns at the heart of Wisconsin’s TikTok ban](https://wuwm.com/2023-01-30/the-privacy-concerns-at-the-heart-of-wisconsins-tiktok-ban?ref=thenexusofprivacy.net) Joy Powers on WUWM (wuwm.com) Michael Zimmer, the director of the Center for Data, Ethics and Society at Marquette University, comments on the recent common bans of TikTok among U.S. governments. #### [Privacy assistant Jumbo tears down its paywall](https://techcrunch.com/2023/01/31/privacy-assistant-jumbo-tears-down-its-paywall?ref=thenexusofprivacy.net) Romain Dillet on TechCrunch (techcrunch.com) Jumbo, an app that lets you control your privacy on the web, is hitting the reset button — sort of. While the company is still focused on privacy and security, users can now download and use all features for free as the premium subscription is gone. In addition to this pricing update, Jumbo’s newest… #### [Just 16% of shoppers feel confident in managing data privacy and security](https://chargedretail.co.uk/2023/01/31/managing-privacy-and-security-online?ref=thenexusofprivacy.net) Isabel Cameron on Latest Retail Technology News From Across The Globe - Charged (chargedretail.co.uk) Just 16% of UK consumers feel completely confident in managing their data privacy and security online according to security company Ring. #### [Data Privacy and the United Nations Sustainable Development Goals](https://natlawreview.com/article/data-privacy-and-united-nations-sustainable-development-goals?ref=thenexusofprivacy.net) Abraham Díaz on The National Law Review (natlawreview.com) In the frame of the International Data Privacy Day celebrated around the world every January 28, it is worthy to remember the relevance gained worldwide by this subject matter as time goes by, as well #### [Small business spending on data privacy up 17% in 2022, higher than medium, large firms: Cisco study](https://financialexpress.com/industry/sme/msme-tech-small-businesses-spending-on-data-privacy-up-17-in-2022-higher-than-medium-large-firms-cisco/2964138?ref=thenexusofprivacy.net) MSME Desk on Financialexpress (financialexpress.com) Spending at larger organizations remained relatively unchanged after steep increases from 2019 to 2020, the study said. The average privacy spending was $2.7 million in 2022. #### [CDT Comments to NTIA on Mobile App Ecosystem Competition](https://cdt.org/insights/cdt-comments-to-ntia-on-mobile-app-ecosystem-competition?ref=thenexusofprivacy.net) George Slover on Center for Democracy and Technology (cdt.org) CDT's comments in response to the National Telecommunications and Information Administration’s (NTIA) request for input on the state of competition in the mobile apps marketplace highlight the need for improvement, with just two platform ecosystems, Apple and Google, controlling the key delivery pipelines that connect app developers to app users. #### [Google Asks 9th Cir. to Reconsider Child Privacy Law Preemption Ruling](https://lawstreetmedia.com/news/tech/google-asks-9th-cir-to-reconsider-child-privacy-law-preemption-ruling?ref=thenexusofprivacy.net) Christina Tabacco on Law Street Media (lawstreetmedia.com) Does the federal Children’s Online Privacy Protection Act (COPPA) preempt state invasion of privacy and consumer protection laws? Google and YouTube think so. We'll see what the judge says. ### The session's in high gear: Washington privacy legislation update, January 31 URL: https://thenexusofprivacy.net/a-lot-going-on-washington-privacy-legislation-update/ Last updated: 2026-04-16T03:01:33.000Z With only 105 days in Washington's legislative session, things are (as always) moving quickly. Last week: - My Health My Data (HB 1155), which protects consumer health data – especially urgent as more and more states criminalize abortion and gender-affirming care – had [a very encouraging hearing](https://thenexusofprivacy.net/my-health-my-data-encouraging-first-step/) in the House Civil Rights & Judiciary (CR&J) Committee > TAKE ACTION: if you live in Washington state, [ask your state Representatives to pass My Health My Data](https://action.aclu.org/send-message/protect-abortion-access-pass-my-health-my-data-act?ref=thenexusofprivacy.net) using the ACLU's handy (albeit privacy-invasive[1](#notes)) web form - The Shield Law (SB 1469 / HB 5489), which protects abortion providers, patients, and helpers in Washington state by putting up barriers to out-of-state investigations from states that criminalize abortion abortion or gender-affirming care, had hearings in both the House and the Senate. By the end of the week both committees had advanced versions of the bill (with the House making some amendments). - Digital Driver's Licenses (SB 5105) had a hearing in Senate Transportation, where privacy advocates including WA People's Privacy, ACLU of Washington and me all raised concerns. - The People's Privacy Act (HB 1616 / SB 5643), which broadens My Health My Data's consent requirements to *all* data and covers government agencies as well as corporations, was officially introduced – with bipartisan sponsorship. In the House, it's been assigned to CR&J. This week, CR&J may have an executive session on Friday where they vote on amendments to My Health My Data and then decide whether or not to advance the bill. There's no guarantee that will happen: they had originally scheduled and exec session for last Friday, delayed it till Wednesday, and then delayed again until Friday. Since we still haven't seen any amendments, that probably means language is still being negotiated. Several potential issues were discussed at last week's hearing. As I said in [A very encouraging first step](https://thenexusofprivacy.net/my-health-my-data-encouraging-first-step/), > "Industry lobbyists also consistently said they "support the bill's goals," and for good reason: in a state like Washington, they don't want to be seen as opposing reproductive freedom. But as expected, they pushed back strongly against some of the bill's language, warning that the bill as written would cause the sky to fall. They also, and suggested "improvements" (haha) including narrowing the definitions of consumer health data, introducing more loopholes and exemptions, allowing some geofencing as long as it wasn't "precise", and weakening enforcement.... > > To be fair, there may well be some valid suggestions for improvements along with exaggerated claims that the bill as written will cause the sky to fall." One valid suggestion for improvement that ACLU of Washington and I both made in our testimony is removing the exemption for “de-identified” data. As Sen. Ron Wyden has pointed out, since “de-identified” data can in practice always be reidentified, exempting it from privacy legislation puts pregnant people's privacy at risk. But there's a lot of money to be made in selling "de-identified" data, so I'm sure that industry lobbyists are telling legislators that removing the exemption would cause the sky to fall. ## Talking points emerge There's a lot of complexity to privacy, and unlike California and Colorado (which spend a while finalizing regulations after the legislation has been passed), Washington state tends to put all the details into the legislation itself – meaning it all has to get decided now. The bill's sponsors, working with the AG's office, have to decide which suggested changes to incorporate – keeping the bill as strong as possible while still having enough legislators on board for it to pass. Looking at lobbyists' testimony in the hearing, you can see some talking points emerge. One common thread is that the defintion of health data is too broad; as a result, one lobbyist warned, "consumers will get opt in requests for routine purchases like books about health." Oh no! Thank heavens industry lobbyists are looking out for our interests!!!! But wait a second. Data that somebody's purchased a book like "What to expect when you're expecting" needs to protected just like the result of a pregnancy test. So consumers *should* get opt-in requests if a company wants to do anything with that data other than use it to send you the book you've just bought. And guess what, if businesses have to get people's consent, they'll find a way to make it less annoying. As I said in my written comments: > "Apple has shown that it’s possible to do a very usable opt-in experience. Successful companies will learn from that." Identifying industrytalking points – and helping legislators see through the spin – has been a key tactic for grassroots activists over the last few years, and will no doubt be just as useful this year. The Civil Rights & Judiciary vote is only one step in the process. There will be further opportunities for amendments on the House floor, the Senate Law & Justice Committee, and the Senate floor. At each step, privacy advocates will fight to keep the bill's strong protections, and maybe even strengthen them further; industry will push to weaken the bill. Behind the scenes try to delay the votes as long as possible – if the legislature doesn't pass anything that'd be a major embarassment to Gov. Inslee and the Democratic caucus, so as time pressure mounts industry may have a better chance of extracting concessions. So even though there's still a long way to go, getting the bill "exec'ed out" of CR&J this week would be a very good thing from privacy advocates perspectives. Will it happen? Stay tuned! ## Notes 1 Privacy Badger reports a couple of trackers on the page. And, here's the defaults on the form. That doesn't look like affirmative consent (opt-in) to me! ![Three checked check boxes: "Show my name in a list of action takers", "Sign me up for ACLU emails", "I agree to receive calls and texts"](https://thenexusofprivacy.net/content/images/2023/02/ACLU-bad-privacy-1.png) Boxes checked by default is opt-out, not opt-in. Sigh. ### #Privacy activism on Mastodon and in the fediverse URL: https://thenexusofprivacy.net/privacy-activism-mastodon-fediverse/ Last updated: 2026-04-16T03:01:13.000Z > "Decentralized social networks could be a good match for (decentralized) grassroots organization" > > – me, in [Grassroots activism is hard. Can open source help?](https://docs.google.com/presentation/d/e/2PACX-1vQc0m3OCs6TjgZJcb64dKhLR6NB5Zz0gceMSDSx2izmCahcUuFTU2UAOPPFE0aSsGEGwYWYf-93cYgg/pub?start=false&loop=false&delayms=3000&ref=thenexusofprivacy.net) at Open Source Bridge 2017 Mastodon's grown rapidly over the last several months, and there are now probably a couple of million active accounts in the fediverse (the broader compatible ecosystem of interconnected social media sites and services). Even though that's just a tiny sliver of the number of people on big corporate social networks, it's potentially enough to have an impact. A lot of people on Mastodon and in the fediverse care passionately about privacy. Can we leverage this to complement activis on Twitter and other social networks? There are a lot of barriers to activism in the fediverse, starting with the general "non-political" attitude of so many people and instances[2](#notes) (also known as "servers" – different sites running Mastodon or compatible software). Usability issues, mansplaining, anti-Blackness, and racism are also major challenges. Still, as Twitter doubles down on racism, anti-LGBTQ+ bigotry, right-wing politics, closing down API access, and shitty software, there's a pressing need for complementary platforms. And there's a lot of excitement about the possibilities of decentralized social networks; as Cindy Cohn and Rory Mir of Electronic Frontier Foundation (EFF) say, [The Fediverse Could Be Awesome (If We Don’t Screw It Up)](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=thenexusofprivacy.net). Unsurprisingly, lots of people are looking at organizing and activism in the fediverse. Anarchists and other antifascist organizers who have been kicked off Twitter are active on Mastodon (and many have been there for quite a while – Mastodon's been an anti-fascist social network from the beginning). Project Mushroom is exploring using Mastodon as part of a climate justice organizing platform. Abolitionists, progressive groups, and non-profits are kicking the tires. One way to look at Mastodon and other fediverse software today is as prototypes that are usable at scale by many people for some interesting use cases. Experimenting with activism campaigns can help identify specific ways those prototypes need to evolve – and also design considerations for new implementations, grounded in justice and equity from the very beginning. So for Data Privacy Day, here's some thoughts about privacy activism in the fediverse. > Interested in what an activism campaign in the fediverse looks like in practice? Check out [#Privacy activism in "the other Washington": #waleg #MyHealthMyData #PeoplesPrivacyAct and more](https://thenexusofprivacy.net/waleg-privacy-activism). ## Privacy activism is a good match for Mastodon and the fediverse One of the big selling points of Mastodon and the broader fediverse is that it's not owned by a company like Meta, Twitter, or Google whose business models are based on surveillance and exploiting user data. A lot of people are in the fediverse because they care about privacy. Many have knowledge to share, are eager to learn more, and want to have an impact. EFF, Fight for the Future, Open Rights Group, and many other privacy and digital rights non-profits are building their presence; so are a lot of privacy advocates and academics. Several instances, including [someone.elses.computer](https://someone.elses.computer/about?ref=thenexusofprivacy.net), [techpolicy.social](https://techpolicy.social/about?ref=thenexusofprivacy.net), and [mastodon.think-privacy.com](https://mastodon.think-privacy.com/about?ref=thenexusofprivacy.net) have a strong privacy focus. The infosec community is also very active on Mastodon, and many of them are allies on these issues. And the other activists exploring Mastodon all have good reasons to care about privacy as well. Anarchists, antifascists, climate justice activists, abolitionists ... it's no secret that law enforcement and the surveillance-industrial complex use facial recognition and other privacy-invasive technologies to target all of these groups, here in the US and all over the world.3 Not only that, grassroots privacy activism is a natural match for social networks in general – as successful campaigns including [Get FISA Right](https://medium.com/get-fisa-right/ten-years-later-get-fisa-right-and-the-future-of-civil-liberties-activism-a15e2e51ca6c?ref=thenexusofprivacy.net) on my.barackobama.com in 2008, the [Nymwars](http://www.talesfromthe.net/jon/?p=2948&ref=thenexusofprivacy.net) on Google+ in 2011, [SOPA/PIPA protests](https://restorethe4th.com/?ref=thenexusofprivacy.net) on multiple social networks in 2012, [Restore the Fourth](https://restorethe4th.com/https://www.talesfromthe.net/jon/?p=3489&ref=thenexusofprivacy.net) on Reddit in 2013, and the [pushback against Facebook's "real names" policy](https://www.theguardian.com/technology/2014/oct/01/victory-drag-queens-facebook-apologises-real-name-policy?ref=thenexusofprivacy.net) in 2014 have shown over the years. ## Some kinds of activism will work better than others in the fediverse today It would be disastrous to use the fediverse to plan direct action – or any other kind of organizing that's likely to be targeted by law enforcement or intelligence agencies. Use Signal for stuff you need to keep secret, and assume that anything you put on Mastodon or anywhere else in the fediverse is potentially public. By contrast, activism that *benefits* from visibility is likely to work better. For example: - **Helping people better protect their privacy**, for example by sharing tips, how-tos, and resources or answering questions. This includes helping people to better understand the privacy risks on Mastodon, and learn ways to pretect themselves. - G**etting the word out about local organizing opportunities and activism campaigns like #StopShotspotter** in different cities. Regionally-focused instances like sfba.social and pnw.zone are especially good matches for this. - **Anti-corporate activism** – publicizing ethical and privacy-friendly alternatives to commercial surveillance, pressuring advertisers, threatening and organizing boycotts, shareholder resolutions, exploring class action litigation. It's also a good match for the anti-commercial surveillance, anti-capitalist, and anti-Big Tech values that are common in large chunks of the fediverse. - **Legislative activism** – pressuring state or federal lawmakers to support (or oppose, as the case may be) proposed legislation. Of course, most state and federal legislators aren't on Mastodon yet, so you can't contact them directly – but amplifying "call/email your legislator" actions, with information about how to contact legislators and sample scripts, can be very effective. The next two sections delve into legislative activism in detail, first here in Washington state and then generalizing to other states and federally. Depending on how interested you are in legislative activism, you may want to skip ahead to [It's worth a try!](#its-worth-a-try) which discusses challenges to activism in the Fediverse including ## Learning by doing: #MyHealthMyData and #PeoplesPrivacyAct in #waleg > "Here in "the other Washington", our legislative session is in high gear. There are some important privacy bills in the state legislature this year, including My Health My Data, the Shield Law, the People's Privacy Act, and a bill limiting Department of Corrections cooperation with federal immigration authorities." > > – [#Privacy activism in "the other Washington": #waleg #MyHealthMyData #PeoplesPrivacyAct and more](https://thenexusofprivacy.net/p/e6efa650-a8d2-46d3-861c-317d4cbf8c74/) Legislative advocacy here in Washington state is a great opportunity for learning by doing. > **UPDATE, June 2023:** Indeed it was! I added a section below discussing our learnings. Like activists everywhere, we use social networks (including Facebook, Twitter, and more recently Instagram) for a lot of different things, including getting word out about events; amplifying news stories; live-tweeting hearings; engaging with journalists, legislators, and experts; and encouraging people to share their opinions with legislators. There aren't a lot of legislators in the fediverse yet, but everything else I listed is very doable. Mastodon and the fediverse are a lot smaller than these other platforms. Still, getting just a few dozen more people involved in advocating for (or against) a bill can potentially have an impact – especially if they can bring in their networks on other platforms and in real life. It might or might not work out, but it's certainly possible. The legislative session started in early January, we've already done our first experiment, asking people to "sign in" in support at the My Health My Data health data privacy bill's hearing last week; this week, there's a key committee vote, so another opportunity for activism. With luck, we can steadly get more people involved over the course of the session, which runs until April 23. So please check out hashtags like [#MyHealthMyData](https://mastodon.social/tags/myhealthmydata?ref=thenexusofprivacy.net), [#waleg](https://pnw.zone/tags/waleg?ref=thenexusofprivacy.net), [#privacy](https://hachyderm.io/tags/privacy?ref=thenexusofprivacy.net), [@waprivacy@pnw.zone ](https://pnw.zone/@waprivacy?ref=thenexusofprivacy.net) and the [@jdp23@pnw.zone](https://pnw.zone/@jdp23?ref=thenexusofprivacy.net) and account to see how the experiment is going. If you know people on the fediverse who are in Washington and care about privacy, encourage them to get involved! [Privacy hashtags in "the other Washington": #waleg #MyHealthMyData #PeoplesPrivacyAct and more](https://thenexusofprivacy.net/waleg-privacy-activism) has more. **UPDATE, June 2023:** it was indeed a good learning opportunity! To be honest, we didn't invest a lot in this: social network campaigns weren't our top priority in general and compared to larger social networks the fediverse (currently) was a lower priority. Still, we did a few posts, they got at least some traction, and there was at least one case where somebody took an action after seeing a post in the fediverse, so at last it's a proof point. Some useful takeaways: - single-post actions with a link (or phone number) work better than threads where the action is delayed until the end – there's no guarantee that the whole thread will federate. A 500-char limit (as on mastodon.social and most other Mastodon instances) is very limiting, so posts from sites which allow longer messages may well be more effective. - there isn't yet a convention about hashtagging or filtering requests for activism. The goal is to make it easy for people who are interested in a specific topic (#privacy) or a legislative session (#waleg) to follow what's going on while and see how they can get involved, while also making it easy for people who don't care about this stuff to filter it out. - with people using a chronological feed (as opposed to algorithmic), tactics - the fediverse has a nucleus of Washington state organizers and activists, but is not yet a good place to reach a broad and diverse audience of Washingtonians. It's not clear how many Washingtonians are in the fediverse, most of them are probably not on Washington-focused instances. In the short term, campaigns on national or international issues may be more likely to get to critical mass in the fediverse. - Take Action Network (a non-federated, custom-built social network for Washington state organizers and activists) has a significant impact on Washington state legislation. Where are the potential synergies with ActivityPub and the fediverse? ## There's a lot of opportunities for the fediverse to get involved in doing legislative activism right now > **UPDATE, June 2023:** bear in mind that this was written back in January, and a lot has changed on the state legislative front since then. My Health My Data passed in Washington, and privacy bills have also passed in 5 other states – most recently Texas. Other privacy and AI (or automated decision systems) legislation is still active at the state level and meanwhile at the federal level KOSA has indeed been re-introduced along with EARN IT, Stop CSAM, RESTRICT, and various other horrible legislation. So the details differ, and I'll update this section at some point, but the overall point remains valid: there's still a lot of opportunity here. Washington state's legislative session is a great chance to experiment with privacy activism in the fediverse. 's far from the only state with privacy legislation in progress right now. [New York's 10-point blueprint to crack down on digital surveillance by police](https://www.dailydot.com/debug/new-york-anti-surviellance-package/?ref=thenexusofprivacy.net), the broad protections of the [Massachusetts Data Privacy Protection Act](https://malegislature.gov/Bills/193/HD2281?ref=thenexusofprivacy.net) are only a few of the many important legislative battles over the next few months. David Stauss' [Proposed State Privacy Law Update](https://www.bytebacklaw.com/2023/01/proposed-state-privacy-law-update-january-16-2023/?ref=thenexusofprivacy.net) and [Tatiana Rice's short Twitter thread ](https://twitter.com/tatiianarice/status/1613921100097781765?ref=thenexusofprivacy.net)highlight the huge amount of other state privacy legislation already on the table in 2023: two consumer privacy bills in New York (the [Digital Fairness Act](https://www.nysenate.gov/legislation/bills/2023/S2277?ref=thenexusofprivacy.net) and the [New York Privacy Act](https://www.linkedin.com/pulse/privacy-city-never-sleeps-new-ny-bill-odia-kagan/?ref=thenexusofprivacy.net)) as well as bills in Indiana, Iowa, Kentucky, Mississippi, New Jersey, New York, Oklahoma, and Tennessee; children's privacy bills in New Jersey, Oregon, Texas, Virginia, and West Virginia; biometrics-related bills in Maryland, Mississipi, New Hampshire, New Jersey, Missouri, and elsewhere; and health privacy bills in New York and Virginia as well as Washington. The list goes on, and since the year has only just started we're likely to see more. There's a lot happening at the federal level as well. In his recent Wall Street Journal opion piece, [Republicans and Democrats, Unite Against Big Tech Abuses](https://wsj.com/articles/unite-against-big-tech-abuses-social-media-privacy-competition-antitrust-children-algorithm-11673439411?ref=thenexusofprivacy.net), President Biden asked Congress to pass "serious federal protections for Americans’ privacy" (especially for kids). Several of the bills that Congress considered last session have bipartisan sponsorship and so are likely to be back on the table in this year – and there will be some new ones as well. Here's a few federal bills that seem like good matches for the fediverse: - The [Fourth Amendment Is Not For Sale Act](https://techpolicy.press/bipartisan-support-for-fourth-amendment-is-not-for-sale-act-at-house-judiciary-hearing/?ref=thenexusofprivacy.net) has strong support from privacy and civil liberties organizations and is popular with libertarians so is likely to have very broad appeal in the fediverse – with the same alliance that's been successful with grassroots activism on FISA and SOPA/PIPA activism in the past. - [LGBTQ rights groups oppose the Kids Online Safety Act (KOSA) in its current form](https://www.eff.org/deeplinks/2022/11/coalition-human-rights-lgbtq-organizations-tell-congress-oppose-kids-online-safety?ref=thenexusofprivacy.net); Mastodon's pro-LGBTQ values and long history of queer-led development make this a great opportunity to mobilize people who may not have been involved in the fight so far, who can then bring in their networks. - The comprehensive American Data Privacy Protection Act, which has important priciples like privacy as a civil right data minimization but also has some major weaknesses in its current form, including preempting state privacy bills and significant limits on people's ability to sue companies who invated their privacy as well as barriers to state AG enforcement. - Speaking of FISA, Section 702 (which allows U.S. intelligence agencies to collect data on non-US people) sunsets at the end of the year unless it's reauthorized. Adam Klein's [FISA Section 702 (2008-2023?)](https://www.lawfareblog.com/fisa-section-702-2008-2023?ref=thenexusofprivacy.net) on *Lawfare* desrcribes this as "the hardest reauthorization yet" – and grassroots activism has had a huge impact in past reauth battles. So if there are ways leverage the fediverse for legislative activism on privacy, it can have broad benefits – as well as a lot of synergies with local organizing like #StopShotspotter and anti-corporate activism. ## It's worth a try! Of course, the challenges that [Dr. Johnathan Flowers](https://twitter.com/shengokai/status/1614358675300442112?ref=thenexusofprivacy.net) and others have brought up about doing activism on Mastodon today are very real. For example: - Mastodon and the broader fediverse's power structures are currently very white, and long-term patterns of behavior such as anti-blackness reinforce this. Changing these dynamics is vital; otherwise building a succesful activism platform leaves it vulnerable to a white power structure. \[Flowers' [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) and others who I quote and link to in [Mastodon: a partial history](https://thenexusofprivacy.net/mastodon-a-partial-history/), have a lot more context here.\] In the short term, it will be vital to continue activism on other more diverse platforms like Twitter and Instagram. **Update, June 2023:** the Twitter's continued transformation into a hard-right explicitly racist transphobic political media network highlights the challenges in doing this. - A lot of people would prefer to avoid "political stuff" so there may be a backlash against activism – especially if it foregrounds the racism, anti-trans, and anti-immigrant aspects of privacy and algorithmic abuses. - Some of Mastodon's design decisions are intended to cut down on "viral" posts, so activists will need to experiment with techniques for getting the word out. Attitudes about political posts have long been [a source of tension on Mastodon](https://thenexusofprivacy.net/mastodon-a-partial-history/#flamewars-per-post-privacy-and-rot13) and often play out in [racialized attitudes about content warnings (CWs)](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy). Should a CW be used when somebody shares a news article about [a Black man was wrongfully jailed for a week in Louisiana after a facial recognition error](https://arstechnica.com/tech-policy/2023/01/facial-recognition-error-led-to-wrongful-arrest-of-black-man-report-says/?ref=thenexusofprivacy.net)? What if they also say "contact your legislators", and include a phone number or link making it easy to take action, along with a sample script to use? Opinions may well differ. My guess is that different norms will evolve on different instances; hopefully debates about whether action-related posts should be CW'ed won't take up so much oxygen that the actions themselves don't get traction. And decentralization also introduces complexity. Most users are on a handful of relatively-large instances ... but there are a lot of smaller instances as well, and many of them block or silence some of the larger instances.5 Not only that, people's view of conversations depends on what instances they're on and who other people on their instance are following, so there's plenty of room for confusion and cross signals. For the Washington legislative activism, I set up the @waprivacy on pnw.zone ... does that make sense, or would it be better based on large general-purpose instance like hachyderm.io? There isn't a playbook yet, so we'll need to do some experimenting to find out. Then again Twitter was actually a really sucky platform for activism back in the day (it didn't even have retweets!) and people still made it work. So activists will probably figure out some tactics that work well in the fediverse. My guess is that it'll be a decentralized and somewhat messy approach, with different organizers posting on different instances (some with CWs and some without), and people making their own judgements about which to amplify. At any rate, it seems to me it's worth a try. Hopefully others agree! --- ## Notes 1 Content Warnings, one of the areas where Mastodon has useful functionality that Twitter doesn't. [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) discusses the origin of the long-standing tensions around CWs. 2 Instead of a single "twitter.com" that everybody logs into, the fediverse has thousands of different instances, most of which communicate with each others. Different instances can run different software, including forks (variants) of Mastodon's code base as well as other compatible platforms including Misskey, Calkkey, Akkoma, Pixelfed (photo-sharing a la Instagram), write.as (longer-form blogging), Funkwhale, and more. Per Axbom's [The many branches of the Fediverse](https://axbom.com/fediverse/?ref=thenexusofprivacy.net) is a good overview. 3 While I'm focusing almost completely on the US in this post, it's really worth highlighting the international aspects of all of these battles. [Iran uses facial recognition to identify women breaking hijab laws](https://wired.com/story/iran-says-face-recognition-will-id-women-breaking-hijab-laws?ref=thenexusofprivacy.net), [China deploys facial recognition as part of surveillance](https://www.npr.org/2021/01/05/953515627/facial-recognition-and-beyond-journalist-ventures-inside-chinas-surveillance-sta?ref=thenexusofprivacy.net), [a Black man was wrongfully jailed for a week in Louisiana after a facial recognition error](https://arstechnica.com/tech-policy/2023/01/facial-recognition-error-led-to-wrongful-arrest-of-black-man-report-says/?ref=thenexusofprivacy.net) ... hey wait a second, I'm noticing a pattern here. 4 When signons skew overwhelmingly one way or another, legislators notice.In 2022, for example, strong signins at the Silenced No More Act's early hearings helped build momentum and a strong version of the bill sailed through the legislature. Signins can also help kill bad legislation; after over 100 people signed in CON and only one PRO, [the Bad Washington Privacy Act's last-gasp Ways & Means hearing was ignominiously canceled](https://wa-privacy.net/it-aint-over-till-its-over/?ref=thenexusofprivacy.net). 5 The Nexus Today has an account on mastodon.social (which some sites block or silence because of its history of bad moderation) and infosec.exchange (which some sites block because employees of the US Government CISA organization ahve acounts there). Tricky! --- Image Credit: Photo by [Credit Score Geek](https://creditscoregeek.com/?ref=thenexusofprivacy.net) via [Flickr](https://flickr.com/photos/143106192@N03/43513754712/in/photolist-29ianhd-ffhgvL-ff2YqV-ff2ZCP-ffhf3N-ffhhFs-ff32A6-ff2ZNr-ff2ZqF-2eZK1px-ff331P-LDNuvt-ffhhe1-8MDf5B-JxskS-6b2uMy-bQCfmt-274rxFB-ffhh3j-ff2YNn-EKnJvz-ffheoN-4TKt4N-McgoUj-92GWzu-67ecGp-2nKe7pu-9cPXm5-5hSE31-sade8-2jjTn4U-5NmPue-2jbupSs-7KsZ9X-cdzLtf-bH38YB-7KwPxb-7KwToA-dhPijg-6e1q5i-81CvzP-36G8tq-57vf1v-agZjw5-8rQg8G-c5wNCs-aqQx1-4sCDV2-7KsRok-5hNhYB?ref=thenexusofprivacy.net), licensed under [CC BY 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net). ### #Privacy activism in "the other Washington": #waleg #MyHealthMyData #PeoplesPrivacyAct and more URL: https://thenexusofprivacy.net/waleg-privacy-activism/ Last updated: 2026-04-16T03:00:42.000Z *Last updated February 1, with an example link to* [*a "call your legislators" action*](https://pnw.zone/@waprivacy/109791018467354827?ref=thenexusofprivacy.net)*.* > "Washington state privacy and tech justice advocates have continued to build our power over the last two years. The environment in 2023 is much more favorable than it's ever been for strong privacy legislation – nationally, and in Olympia – so there's good reason for optimism." > > – [A much more favorable environment: Washington state privacy legislation 2023](https://thenexusofprivacy.net/wa-privacy-more-favorable-environment/), January 11 > "Privacy activism is a good match for Mastodon and the fediverse" > > – [Privacy activism on Mastodon and in the fediverse ](https://thenexusofprivacy.net/privacy-activism-mastodon-fediverse) Privacy is a hot topic on on Mastodon and in the fediverse (a broader compatible ecosystem of interconnected social media sites and services) and [Privacy activism on Mastodon and in the fediverse](https://thenexusofprivacy.net/p/a5986770-2b2d-4524-ada4-810f044f3c3e/) looks at reasons why that makes it worth looking at for legislative action. And conveniently enough here in "the other Washington", our legislative session is in high gear. There are some important privacy bills in the state legislature this year, including **My Health My Data, the Shield Law,** the **People's Privacy Act,** and a bill limiting Department of Corrections cooperation with federal immigration authorities. You don't need to know the details to understand the social media aspects, but if you're interested [A much more favorable environment: Washington state privacy legislation 2023](https://thenexusofprivacy.net/wa-privacy-more-favorable-environment/) goes into a lot more detail on the bills, the multi-year context, and the political dynamics. Like activists everywhere, we use social networks (including Facebook, Twitter, and more recently Instagram) for a lot of different things, including getting word out about events; amplifying news stories; live-tweeting hearings; engaging with journalists, legislators, and experts; and encouraging people to share their opinions with legislators. There aren't a lot of legislators in the fediverse yet, but everything else I listed is very doable. [Privacy activism on Mastodon and in the fediverse](https://thenexusofprivacy.net/privacy-activism-mastodon-fediverse) makes the case that many people on the fediverse are likely to be interested in privacy activism – and some of them live in Wahsington state. Mastodon and the fediverse are a lot smaller than these other platforms, but there are already enough people here that if we can engage them, there's an opportunity to have an impact. Or maybe not; there are lots of barriers to activism in the fediverse. Still, we'll learn a lot no matter how it works out, so it's worth a try. ## For example ... Here's an initial experiment I started last week. Washington legislative hearings offer the opportunity for residents to "sign in PRO" to support legislation (or "CON" to oppose it). This takes very little time to do, and the instructions are fairly straightforward, so it's a natural for social network activism. When signons skew overwhelmingly one way or another, legislators notice.1 [This post by @waprivacy@pnw.zone originally asked people to "sign in" to a hearing on the My Body My Data bill](https://pnw.zone/@waprivacy/109734637338889791https://pnw.zone/@waprivacy/109734668120704419?ref=thenexusofprivacy.net) and was part of a short thread of signon actions. And one of the cool features of Mastodon is that you can edit posts, so when it was time for the next action on this bill, I just replaced the link and did some minor tweaking of the language. There's no way to know how many people saw it, let alone actually took action. [@waprivacy](https://pnw.zone/@waprivacy?ref=thenexusofprivacy.net)'s a brand-new account, and only had a couple followers when I first posted this, but it still managed to get a handful of boosts as well as a few people "favoriting" it. When I edited the post, everybody who had boosted it got a notification. With luck, at least some of them will notice and boost the new action as well. As the session goes on, hopefully more people who care about reproductive freedom and privacy will start following the #MyHealthMyData hastag, people who care about politics in Washington will start following #waleg, other accounts will start posting action items on the hashtags as well. We shall see. ## Hashtags, we got 'em > "Hashtag activism, a term that first appeared in news coverage in 2011, describes the creation and proliferation of online activism stamped with a hashtag. We argue that this online activism leads to material effects in the digital and physical sphere." > > – Sarah J. Jackson, Moya Bailey and Brooke Foucault Welles in [#HashtagActivism: Networks of Race and Gender Justice](https://mitpress.mit.edu/9780262043373/hashtagactivism/?ref=thenexusofprivacy.net) Hashtags have played a central role in Twitter activism ever since #IranElection in 2009\. Of course, the fediverse's decentralized structure (there are literally thousands of different instances (aka servers) running Mastodon and compatible software) will mean that the dynamics are likely to be different; as Dr. Johnathan Flowers has pointed out, you couldn't do Black Lives Matter on Mastodon today. Still, hashtags are likely to play a key role – especially since they're the only mechnism for searching. Here's some of the hashtags that are likely to be useful for our activism – on Twitter and Instagram as well as in the fediverse. - [#waleg](https://mastodon.social/tags/waleg?ref=thenexusofprivacy.net), for Washington state legislative discussions in general - [#privacy](https://mastodon.social/tags/privacy?ref=thenexusofprivacy.net), of course. As the #waleg hashtag becomes popular for other bills as well, searching on #waleg #privacy is likely to be the best way to find privacy-related actions. - Hashtags for the various bills: [#MyHealthMyData](https://mastodon.social/tags/MyHealthMyData?ref=thenexusofprivacy.net), [#ShieldLaw](https://mastodon.social/tags/ShieldLaw?ref=thenexusofprivacy.net), [#PeoplesPrivacyAct](https://mastodon.social/tags/PeoplesPrivacyAct?ref=thenexusofprivacy.net) and so on For some people, bill names are easier to remember than numbers; others find the numbers easier, especially if they're working on a lot of bills. Mastodon's global search only works for hashtags so using tags #HB1155 (for My Health My Data) or #SB5270 (for the bill limiting Department of Corrections cooperation with federal immigration authorities) are also useful. And let's not for get #FollowFriday! Activists and organizers often want to be able to find each other so that they can have discussions, work together, and know what others working on the campaign are up to. Mastodon's #FollowFriday tradition is a one way of accelerating this; I've been priming the pump by doing a [#FollowFriday #waleg](https://indieweb.social/@jdp23/109644013926309147?ref=thenexusofprivacy.net) thread, and the Nexus of Privacy also has a [#FollowFriday for #privacy and tech justice thread](https://mastodon.social/@nexusofprivacy/109484760145259593?ref=thenexusofprivacy.net). ## Keep an eye on the hashtags Most actions are more complex than signing in. A "contact your legislators" action typically includes information about how to find out who your legislator is and how to contact them via phone, email, or the web – as well as a sample script. One approach to this is to share a link to actions from organizations like ACLU or sites Take Action Network (a Washington-state focused action platform that's popular with progressive activists here). Another possibility is to thread several posts together with instructions and a script, or use a Mastodon instance that allows longer posts and better formatting. A couple of bills have executive sessions scheduled this week where the committee hearing the bill votes on potential amendments and whether to advance it. Of course just because it's on the schedule doesn't necessarily mean it'll happen; My Health My Data's executive session, for example, has already been postponed twice. Privacy advocates want the committee to advance a strong version of the bill this week; industry lobbyists want to keep it in this initial "policy committee" as long as possible and trying to water it down by narrowing the defintion of health data, making it harder for people to sue them, introducing a get-out-of-jail free card (the so-called "right to cure"), and so on. So it's a classic time for a contact-your-legislators action. After that, there will be lots more more hearings, more executive sessions, and more actions over the course of the session. So keep an eye on the hashtags like [#MyHealthMyData](https://mastodon.social/tags/myhealthmydata?ref=thenexusofprivacy.net), [#waleg](https://pnw.zone/tags/waleg?ref=thenexusofprivacy.net), and [#privacy](https://hachyderm.io/tags/privacy?ref=thenexusofprivacy.net)[ ](https://pnw.zone/@jdp23?ref=thenexusofprivacy.net)as things move forward – and if you know people in Washington state, encourage them to get involved! ## Notes 1 In 2022, for example, strong signins at the Silenced No More Act's early hearings helped build momentum and a strong version of the bill sailed through the legislature. Signins can also help kill bad legislation; after over 100 people signed in CON and only one PRO, [the Bad Washington Privacy Act's last-gasp Ways & Means hearing was ignominiously canceled](https://wa-privacy.net/it-aint-over-till-its-over/?ref=thenexusofprivacy.net). ### Privacy News: January 26 URL: https://thenexusofprivacy.net/privacy-news-january-26/ Last updated: 2023-01-26T18:42:08.000Z State and federal privacy regulation, facial recognition, what's on tap for 2023, a failed experiment with Mastodon ... and more! ### [This Year’s Must-Read Privacy Papers to be Honored at Capitol Hill Event](https://fpf.org/blog/this-years-must-read-privacy-papers-to-be-honored-at-capitol-hill-event?ref=thenexusofprivacy.net) Future of Privacy Forum (fpf.org) Future of Privacy Forum (FPF) does an annual list of Privacy Papers for Policymakers (PPPM) Awards. Here's this year's winners: - [*Dismantling the “Black Opticon”: Privacy, Race, Equity, and Online Data-Protection Reform*](https://www.yalelawjournal.org/forum/dismantling-the-black-opticon?ref=thenexusofprivacy.net) by Anita L. Allen, University of Pennsylvania Carey Law School - [*Privacy and/or Trade*](https://scholarship.law.georgetown.edu/facpub/2444/?ref=thenexusofprivacy.net) by Anupam Chander, Georgetown University Law Center; and Paul M. Schwartz, University of California, Berkeley, School of Law - [*Reproductive Health Care Data Free or For Sale: Post-Roe Surveillance and the ‘Three Corners’ of Privacy Legislation Needed*](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4321244&ref=thenexusofprivacy.net) by Eunice Park, Western State College of Law - [*Understanding the Challenges Data Protection Regulators Face: A Global Struggle Towards Implementation, Independence, & Enforcement*](https://adapt.internews.org/2022/07/26/understanding-the-challenges-data-protection-regulators-face-a-global-struggle-towards-implementation-independence-and-enforcement/?ref=thenexusofprivacy.net) by Pawel Popiel, University of Pennsylvania Annenberg School for Communication; and Laura Schwartz-Henderson, Internews - [*Algorithms and Economic Justice: A Taxonomy of Harms and a Path Forward for the FTC*](https://law.yale.edu/sites/default/files/area/center/isp/documents/algorithms%5Fand%5Feconomic%5Fjustice%5Fmaster%5Ffinal.pdf?ref=thenexusofprivacy.net) by Rebecca Kelly Slaughter, Federal Trade Commission; with Janice Kopec, Federal Trade Commission and Mohamad Batal, Federal Trade Commissio - [*Punitive Surveillance*](https://www.virginialawreview.org/articles/punitive-surveillance/?ref=thenexusofprivacy.net) by Kate Weisburd, George Washington University Law School And the best student papers: - [*Caught in quicksand? Compliance and Legitimacy Challenges In Using Regulatory Sandboxes To Manage Emerging Technologies*](https://onlinelibrary.wiley.com/doi/full/10.1111/rego.12487?ref=thenexusofprivacy.net) by Walter G. Johnson, a Ph.D. Scholar with the Australian National University School of Regulation and Global Governance (RegNet). - [*My Cookie is a phoenix: detection, measurement, and lawfulness of cookie respawning with browser fingerprinting*](https://petsymposium.org/popets/2022/popets-2022-0063.pdf?ref=thenexusofprivacy.net) by Nataliia Bielova, French National Institute for Research in Digital Science and Technology; Imane Fouad, Inria Centre at the University of Lille; Arnaud Legout, Inria Center of Côte d’Azur University; and Cristiana Santos Utrecht University School of Law. Congrats to all the winners ... and wow, what a great reading list! ## Facial recognition ### [She was denied entry to a Rockettes show — then the facial recognition debate ignited](https://npr.org/2023/01/21/1150289272/facial-recognition-technology-madison-square-garden-law-new-york?ref=thenexusofprivacy.net) Manuela López Restrepo on NPR (npr.org) It's a good article, with quotes from Evan Greer of Fight for the Future, law professor Hannah Bloch-Wehba, and Albert Fox Cahn of Surevillance Technology Oversight Project, but the framing is kind of weird > When a lawyer was denied entry to a Rockettes show, it became a flashpoint in the debate over facial recognition technology. Does it keep people safe, or risk further harm? The fight over facial recognition technology's been going on for a long time ... and how does keeping a lawyer who's sued the Rockettes' parent company from seeing one of their shows actually keep people safe? Still, like I say, a good article! ### [South Korea privacy watchdog warns against public facial recognition deployments ](https://biometricupdate.com/202301/south-korea-privacy-watchdog-warns-against-public-facial-recognition-deployments?ref=thenexusofprivacy.net) Alessandro Mascellino on BiometricUpdate.com (biometricupdate.com) The warning comes amidst a plan to introduce an access control system in government buildings designed to bind civil servant ID cards to face biometrics. ## State privacy legislation ### [US State Privacy Legislation Tracker](https://iapp.org/resources/article/us-state-privacy-legislation-tracker?ref=thenexusofprivacy.net) Anokhy Desai, CIPP/US, CIPT on iapp.org This useful tool tracks proposed comprehensive US state privacy bills. ### [Potential Rulemaking on the Horizon: CPPA Board Announces February Public Meeting](https://natlawreview.com/article/potential-rulemaking-horizon-cppa-board-announces-february-public-meeting?ref=thenexusofprivacy.net) Alan L. Friel on The National Law Review (natlawreview.com) The California Privacy Protection Agency Board announced it will hold a public meeting on February 3, 2023\. ### [A very encouraging first step: My Health My Data’s first hearing](https://thenexusofprivacy.net/my-health-my-data-encouraging-first-step/) Jon Pincus on The Nexus of Privacy (thenexusofprivacy.net) You'd think that there would be more coverage of a health data bill that responds to over 50% of the people in the US losing their rights ... but as far as I can tell, almost nobody wrote about My Health My Data's first hearing. Interesting. ALSO: - [State Lawmakers Hear Slew of Abortion Protection Bills Following 50th Anniversary of Roe v. Wade](https://www.spokesman.com/stories/2023/jan/23/state-lawmakers-hear-slew-of-abortion-protection-b/?ref=thenexusofprivacy.net), Laurel Demkovich in the *Spokesman Review*, which has some discussion in the context of Washington Democrats' broader slate of legislation responding to the Dobbs decision ## Federal privacy legislation #### Webinar: [The Future of Data Privacy and Security in the 118th Congress](https://rstreet.org/event/the-future-of-data-privacy-and-security-in-the-118th-congress?ref=thenexusofprivacy.net) Today at 1:00 PM Pacific time Keynotes – **Tim Kurth**, Chief Counsel, Innovation, Data, and Commerce Subcommittee, House Energy & Commerce Committee – Majority – **Lisa Hone**, Chief Counsel, Innovation, Data, and Commerce Subcommittee, House Energy & Commerce Committee – Minority Panel – \[Moderator\] **Cristiano Lima**, Reporter, The Washington Post – **Alexandra Reeve Givens**, President & CEO, Center for Democracy and Technology – **Brandon Pugh**, Director and Senior Fellow, Cybersecurity & Emerging Threats, R Street Institute – **Cameron F. Kerry**, Ann R. and Andrew H. Tisch Distinguished Visiting Fellow, Governance Studies, Center for Technology Innovation at The Brookings Institution #### Webinar: [What Will It Take for Congress to Pass Bipartisan Privacy Legislation?](https://cdt.org/event/what-will-it-take-for-congress-to-pass-bipartisan-privacy-legislationhttps://itif.org/events/2023/02/07/what-will-it-take-for-congress-to-pass-bipartisan-privacy-legislation/?ref=thenexusofprivacy.net) on Innovation Technology and Information Forum (itiforg) Another webinar, this one hosted by a tech industry trade assocation, on Tuesday, February 7, 2023 at 11:00 am Pacific time (2:00 Eastern). Representative Jan Schakowsky (D-IL) will speak, and then Ashley Johnson of ITIF will moderate a panel with Eric Null of Center for Democracy & Technology and Divya Sridhar of SIIA (the security industry trade assocation) ## Privacy in 2023 ### [A look at what to expect for privacy in 2023 with Omer Tene](https://iapp.org/news/a/a-look-at-what-to-expect-for-privacy-in-2023-with-omer-tene?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) IAPP Editorial Director Jedidiah Bracy sat down with former IAPP Managing Director Omer Tene to discuss what he thinks will be some of the biggest developments in privacy in 2023. ### [Global Privacy State of Play: What to Pay Attention to in 2023](https://linkedin.com/pulse/global-privacy-state-play-what-pay-attention-2023-zanfir-fortuna?ref=thenexusofprivacy.net) Dr. Gabriela Zanfir-Fortuna on linkedin.com What to pay attention to this year in privacy? Enforcement; the race to AI Regulation; intertwining of competition and data drotection law; regulatory movements in India, Argentina, Australia, Canada, and South Korea ### [Organizations Must Brace for Privacy Impacts This Year](https://darkreading.com/endpoint/organizations-must-brace-for-privacy-impacts-this-year?ref=thenexusofprivacy.net) J. Trevor Hughes on Dark Reading (darkreading.com) Expect more regulatory and enforcement action in the US and around the world. ## Mastodon ### [We tried to run a social media site and it was awful](https://ft.com/content/8d995a24-d77c-4208-a3a6-603d8788ebcd?ref=thenexusofprivacy.net) Bryce Elder on the Financial Times ft.com Financial Times' Alphaville blog set up a Mastodon server a couple months ago and opened up registration to everybody. What could possibly go wrong? Compliance, security, operational, and especially legal risks – and a lot more work than they expected. > \[T\]o summarise, Mastodon has proved more hassle than it’s worth. So they're announcing the shutdown of Alphaville.club (although giving people three months to migrate to another site). Easy come, easy go. ## And ... #### [TikTok’s New Defense in Washington: Going on the Offense](https://nytimes.com/2023/01/26/technology/tiktok-bytedance-data-security.html?ref=thenexusofprivacy.net) Cecilia Kang, Sapna Maheshwari and David McCabe on the New York Times (nytimes.com) Keeping its head down has not paid off for the company, which now faces regulatory pressure on many fronts. So it is starting to speak out. #### [Head of Israeli Cyber Firm NSO Group Reaffirms Company Commitment to Spyware](https://wsj.com/articles/head-of-israeli-cyber-firm-nso-group-reaffirms-company-commitment-to-spyware-11674738269?ref=thenexusofprivacy.net) Byron Tau and Dustin Volz on The Wall Street Journal (wsj.com) Yaron Shohat acknowledges past mistakes, but says the technology is vital for law-enforcement and intelligence agencies. #### [Amazon’s Trickle-Down Monopoly](https://datasociety.net/library/amazons-trickle-down-monopoly?ref=thenexusofprivacy.net) Moira Weigel on Data & Society (datasociety.net) Hidden intermediaries have played key roles in making Amazon one of the most powerful corporations in the world, while remaining mostly invisible to customers: third-party (3P) sellers. #### [Defending Data: Privacy Protection, Independent Researchers, and Access to Social Media Data in the US and EU](https://cdt.org/insights/report-defending-data-privacy-protection-independent-researchers-and-access-to-social-media-data-in-the-us-and-eu?ref=thenexusofprivacy.net) Caitlin Vogus on Center for Democracy and Technology (cdt.org) Legal requirements that social media companies make data available to independent researchers should not inadvertently become tools for unjustified and increased law enforcement surveillance of social media users. This report examines existing legal protections for stored social media data in the US and EU and how they might be impacted by researcher access to social media data. #### [AI governance and human rights](https://chathamhouse.org/2023/01/ai-governance-and-human-rights?ref=thenexusofprivacy.net) Kate Jones on Chatham House – International Affairs Think Tank (chathamhouse.org) Resetting the relationship #### [How to hide from drones and swerve everyday surveillance](https://komando.com/privacy/how-to-hide-from-drones/874008?ref=thenexusofprivacy.net) Serena O’Sullivan on Komando.com (komando.com) Biometric cameras collect your facial data everywhere, from mall cameras to flying drones. Not sure how to hide from drones? Use these tips. #### [Protect independence of privacy watchdog, EU Parliament to tell Greece](https://euractiv.com/section/politics/news/protect-independence-of-privacy-watchdog-eu-parliament-to-tell-greece?ref=thenexusofprivacy.net) Sarantis Michalopoulos on EURACTIV (euractiv.com) #### [Reality Check: How is the EU ensuring data protection in XR Technologies? ](https://digi-con.org/reality-check-how-is-the-eu-ensuring-data-protection-in-xr-technologies?ref=thenexusofprivacy.net) Sebastião Barros Vale on The Digital Constitutionalist (digi-con.org) Extended reality (XR) technologies rely on large quantities of varied data about users and their environment, creating risks to their fundamental rights. e of their important role in enabling immersive experiences, which promise… #### [The year in UK GDPR regulatory enforcement action](https://privacylaws.com/uk125enforce?ref=thenexusofprivacy.net) Richard Jeens, Ross O’Mahony and Alex Buchanan on Privacy Laws & Business (privacylaws.com) The ICO’s approach to enforcement is still risk-based, but increasingly targeted #### [Why universities need to build a culture around data and privacy](https://edscoop.com/radio/why-universities-need-to-build-a-culture-around-data-and-privacy?ref=thenexusofprivacy.net) on EdScoop (edscoop.com) On the Cutting EDge podcast, the Rochester Institute of Technology’s Ben Woelk previews his new Educause workshop on data and privacy. #### [5 iPhone features you should enable for better privacy](https://techadvisor.com/article/1482863/5-iphone-features-enable-better-privacy.html?ref=thenexusofprivacy.net) Jim Martin on Tech Advisor (techadvisor.com) Apple provides many ways to protect your privacy, but are you using them? Here’s how to check. #### [Data Privacy Day: 15 Tips to Keep in Mind for the Coming Year](https://jdsupra.com/legalnews/data-privacy-day-15-tips-to-keep-in-1694544?ref=thenexusofprivacy.net) Odia Kagan on JD Supra (jdsupra.com) Data Privacy Day is this weekend. Here are some tips and pointers individuals and businesses should keep in mind going forward. #### [EU Takes Step Toward Approval of EU-US Data Privacy Framework](https://jdsupra.com/legalnews/eu-takes-step-toward-approval-of-eu-us-5346507?ref=thenexusofprivacy.net) David Aaron on JD Supra (jdsupra.com) As U.S.-based companies await a decision by the European Union (EU) regarding data transfers, the European process for approving the EU-U.S. data privacy framework has progressed a step. #### [#DataPrivacyWeek: Data Privacy Breeds Trust – Here’s Why](https://infosecurity-magazine.com/opinions/data-privacy-breeds-trust?ref=thenexusofprivacy.net) Russell Howe on Infosecurity Magazine (infosecurity-magazine.com) Respecting your customers data choices can have big commercial benefits --- *Image credit:* Daquella manera on [Flickr ](https://www.flickr.com/photos/62518311@N00/466172168?ref=thenexusofprivacy.net) via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons Attribution 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net) license. ### A very encouraging first step: My Health My Data's first hearing URL: https://thenexusofprivacy.net/my-health-my-data-encouraging-first-step/ Last updated: 2026-04-16T02:59:35.000Z > "The environment in 2023 is much more favorable than it's ever been for strong privacy legislation – nationally, and in Olympia – so there's good reason for optimism. > > One of the reasons the legislative environment is much more favorable in 2023 is that privacy threats have become a lot more real to many people in the aftermath of the Supreme Court's Dobbs decision overturning Roe." > > – [A much more favorable environment, but a lot of complexity Washington state privacy legislation 2023](https://thenexusofprivacy.net/wa-privacy-more-favorable-environment/), January 23 > "The My Health, My Data Act would require third-party services, such as apps that track menstrual cycles, to publish policies surrounding health data collection and sharing, and require them to obtain consumers’ consent prior to any data collection or sharing. It would prohibit both the sale of this data and the use of geofencing, a type of location-based advertising, surrounding health care facilities. > > While the bill applies to health data protection generally, supporters emphasized the importance of data collection in regard to reproductive health and gender care." > > – [State Lawmakers Hear Slew of Abortion Protection Bills Following 50th Anniversary of Roe v. Wade](https://www.spokesman.com/stories/2023/jan/23/state-lawmakers-hear-slew-of-abortion-protection-b/?ref=thenexusofprivacy.net), Laurel Demkovich in the *Spokesman Review* My Health My Data's first hearing featured strong support for the bill and virtually no overt opposition – although [the industry lobbyists who water down state privacy regulation](https://themarkup.org/privacy/2022/05/26/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time?ref=thenexusofprivacy.net) tried to make a case for watering its protections for consumer health data. No surprises there, of course; it's their job! So overall, the hearing was a very encouraging first step for this urgently-needed bill. As Demkovich says, most of the outstanding testimony at the hearing focused on the need to respond to the *Dobbs* decision by protecting reproductive health care patients and providers against the threat of states criminalizing abortion and authorizing bounty hunters and vigilantes – and on protecting people seeking and providing gender-affirming services, who face similar threats. Bill sponsor Rep. Vandana Slatter, Andrea Alegrett from the Attorney General's Office (who worked with Rep. Slatter and Sen. Manka Dhingra to develop the bill), and advocates from organizations including Pro-Choice Washington, Gender Justice League, Legal Voice, Washington Immigrant Solidarity Network, Cedar River Clinics, Planned Parenthood Alliance Advocates, Japanese American Citizens League - Seattle Chapter, La Resistencia, League of Women Voters of Washington, and ACLU of Washington all made powerful cases for why this bill is so badly needed. In fact there was so much support for the bill that Chair Hansen cut off testimony before WA People's Privacy and several grassroots activists with a technology background could testify which was really unfortunate. [My live-tweeting has more details](https://threadreaderapp.com/thread/1617945841016373248.html?ref=thenexusofprivacy.net), and it's really worth watching [the video of the hearing](https://tvw.org/video/house-civil-rights-judiciary-2023011514/?eventID=2023011514&ref=thenexusofprivacy.net). Industry lobbyists also consistently said they "support the bill's goals," and for good reason: in a state like Washington, they don't want to be seen as opposing reproductive freedom. But as expected, they pushed back strongly against some of the bill's language, claimed the bill as written would cause the sky to fall, and suggested "improvements" (haha) including narrowing the definitions of consumer health data, introducing more loopholes and exemptions, allowing some geofencing as long as it wasn't "precise", and weakening enforcement. Of course, if legislators take lobbyists' suggestions and water My Health My Data down, then it won't protect health data, pregnant people, or gender-affirming care. Does that really "support the bill's goals"? Opinions differ, I guess. For example, industry's most prominent talking point was the need to narrow My Health My Data's defintion of "consumer health data." Here's how it's currently defined, accroding to the bill summary: *Personal information relating to the past, present, or future physical or mental health of a consumer including any personal information relating to:* - *individual health conditions, treatment, status, diseases, or diagnoses;* - *social, psychological, behavioral, and medical interventions;* - *health-related surgeries or procedures, diagnostic testing, and treatment;* - *use or purchase of medication;* - *bodily functions, vital signs, symptoms, or related measurements;* - *efforts to research or obtain health services or supplies;* - *gender-affirming care information;* - *reproductive or sexual health information;* - *biometric and genetic data related to consumer health data;* - *location information that could reasonably indicate a consumer's attempt to acquire or receive health services or supplies; and* - *any consumer health data information that is derived or extrapolated from non-health information, such as proxy, derivative, inferred, or emergent data.* That all looks like health data to me! How does it "support the bill's goals" to remove any of those bullets? Still, it's not hard to see why this makes industry nervous. As a lobbyist said at the hearing, this definition could mean that data derived from purchasing a book could be considered consumer health data. But then again, if the book is something like "Living With Alzheimer's" ... it really *is* health data, and narrowing the definition to exclude it is just putting in a loophole for indusry to exploit. To be fair, there may well be some valid suggestions for improvements along with exaggerated claims that the bill as written will cause the sky to fall. One lobbyist brought up a situation where (if I understood correctly) the bill's requirements to allow people to delete data clashed with federal legislation that prohibits data deletion from peer-reviewed research. If that's the case (and I could certainly believe it is – the landscape of existing privacy legislation is very complicated), and the resolution isn't as simple as "the federal bill takes precedence over state legislation," it might make sense to clean up the bill's language. And as I pointed out in my testimony (included [below](#testimony)), there are also ways the bill could be *strengthened*. For example, "de-identified" data is currently exempted. As Sen. Ron Wyden pointed out when discussing the de-identified data exemption in the proposed ADPPA, this loophole could allow data brokers to sell location data to the government about visits to reproductive health facilities. And the bill exempts government agencies; as Rep. Amy Walen clarified during the hearing, this means that Washington's [Apple Health](https://www.hca.wa.gov/free-or-low-cost-health-care/apple-health-you?ref=thenexusofprivacy.net) isn't covered. So it'll be interesting to see how the bill evolves. The next step is potential amendments, and then an executive session where the Civil Rights & Judiciary Committee will vote on the amendments and advance the bill. That could happen as early as Friday or it could get pushed to next week. The Senate "companion bill" SB 5351 may also have its own hearing in the next couple of weeks, and in general there's still a long way to go. Still, this hearing was a very encouraging first step in the process! ## Testimony *Here's my written testimony, which expanded on my live testimony at the hearing. Section numbers refer to the* [*original version*](https://lawfilesext.leg.wa.gov/biennium/2023-24/Pdf/Bills/House%20Bills/1155.pdf?q=20230303040105&ref=thenexusofprivacy.net) *of the bill.* Chair Hansen, Ranking Member Walsh, and members of the committee, Thank you for the opportunity to address the committee today – and thanks as well to the sponsors and AG’s office for bringing a privacy bill so many of us are excited to support. This written testimony expands on my comments at the hearing in support of the My Health My Data Act (HB 1155). I’m a technologist and entrepreneur, and the founder of [The Nexus of Privacy](https://thenexusofprivacy.net/), which focuses on the intersection of privacy technology, policy, and strategy. In 2021, I served on the state Automated Decision Systems (ADS) Workgroup. My career also includes roles as General Manager of Strategy Development at Microsoft, and Chief Product Officer and founder/CTO of successful venture-funded startups. The data abuses that My Health My Data addresses are real and constant. As Ranking Member Walsh pointed out during the hearing, these abuses affect everybody. For example: - Early last year, [a suicide chat hotline shared chat logs with mental health information with a for-profit spinoff](https://www.politico.com/news/2022/01/28/suicide-hotline-silicon-valley-privacy-debates-00002617?ref=thenexusofprivacy.net). - Last summer The Markup reported that [Facebook is receiving sensitive medical information from hospital websites](https://themarkup.org/pixel-hunt/2022/06/16/facebook-is-receiving-sensitive-medical-information-from-hospital-websites?ref=thenexusofprivacy.net). - Just last week, ProPublica [websites that sell medication are sharing data with Google](https://www.propublica.org/article/websites-selling-abortion-pills-share-sensitive-data-with-google?ref=thenexusofprivacy.net), All of this data sharing happens without consent. For years, tech companies have been able to dismiss privacy advocacy by saying “privacy’s only for people who have something to hide.” But the Supreme Court’s *Dobbs* decision shows people across the political spectrum that *everybody* potentially has something to hide. Even people who oppose abortion are shocked to realize that something like a period tracking app, a web search, or a visit to a doctor could expose their health data to bounty hunters … and it’s just a small step from that to realizing that predatory companies like Facebook have already been exploiting their health data for years. So please: - Resist any attempts to weaken My Health My Data by narrowing the definition of health data as so many lobbyists who testified today suggested. Yes, it’s true that the bill’s current definition of health care data includes purchase history of books like “A Guide to a Healthy Pregnancy” or “The Chronic Illness Companion.” From a consumer perspective, that’s a good thing! - Don’t give in to industry threats to make our lives miserable by bombarding us with opt-in notifications if this bill passes. Some companies may well destroy their business by attempting to bully their customers into consenting but if so it’s their own fault. Apple has shown that it’s possible to do a very usable opt-in experience. Successful companies will learn from that. - Ignore the spin from industry lobbyists claiming that this bill will cause the sky to fall. They always say that. The reality is that companies should have no problem complying with this straightforward, cleanly written law. My Health My Data’s requirement for opt-in consent before collecting or sharing data, ban on sales of health data, and prohibition of geofencing align well with trends in privacy law elsewhere. As people here in Washington and all over the world demand stronger privacy protections, a high bar for privacy here will be a huge *advantage* to Washington’s startup ecosystems and our world-class technology companies. Indeed, there are a few ways in which My Health My Data should be *strengthened* – for example by removing Section 2(17)(c), the exemption for “de-identified” data. In practice, “deidentified” data can always be re-identified; [Your Data Were ‘Anonymized’? These Scientists Can Still Identify You](https://www.nytimes.com/2019/07/23/health/data-privacy-protection.html?ref=thenexusofprivacy.net), from 2019, is one of many examples. Here’s how Sen. Ron Wyden described the “de-identified” data loophole (his term, not mine) in the proposed federal American Data Privacy Protection Act: > “Data that tracks phones from a doctor’s office to where individuals sleep at night would make it trivially easy to re-identify supposedly anonymous data and put women’s privacy at risk.” Another area for improvement is prohibiting economic coercion of consent. Section 5(4) does prohibit discrimination against consumers who exercise their rights, but more explicit language such as California’s requirement that “\[the\] business shall not use financial incentive practices that are unjust, unreasonable, coercive, or usurious in nature” to obtain consent \[§1798.125(b)(4)\] might well be a useful complement. Washington has a well-deserved reputation for being on the cutting edge of technology, so legislation here will influence the rest of the country. This a great opportunity for Washington to take leadership on one of the most important civil rights issues of our time. So please strengthen and advance My Health My Data! Jon Pincus, Bellevue --- Image credit: [@gggonzalezzz on Twitter](https://twitter.com/gggonzalezzz/status/1617961153933762561?ref=thenexusofprivacy.net) ### Privacy News: January 20 URL: https://thenexusofprivacy.net/privacy-news-january-20/ Last updated: 2023-01-20T18:45:51.000Z Websites selling abortion pills sharing data with Google, the My Health My Data Act, the "no fly" list accidentally exposed, a state privacy legislation bonanza ... and more! ## Privacy After Roe ### [Websites Selling Abortion Pills Are Sharing Sensitive Data With Google](https://propublica.org/article/websites-selling-abortion-pills-share-sensitive-data-with-google?ref=thenexusofprivacy.net) Jennifer Gollan on ProPublica (propublica.org) That's bad. Using [the Markup's Blacklight tool](https://themarkup.org/blacklight?ref=thenexusofprivacy.net), a nonprofit tech-journalism newsroom, ProPublica ran checks on 11 online pharmacies that sell abortion medication to reveal the web tracking technology they use. At least 9 of them had web trackers. > These third-party trackers, including a Google Analytics tool and advertising technologies, collect a host of details about users and feed them to tech behemoth Google, its parent company, Alphabet, and other third parties, such as the online chat provider LiveChat. Those details include the web addresses the users visited, what they clicked on, the search terms they used to find a website, the previous site they visited, their general location and information about the devices they used, such as whether they were on a computer or phone.... > > While many people may assume their health information is legally protected, U.S. privacy law does little to constrain the kind or amount of data that companies such as Google and Facebook can collect from individuals. Tech companies are generally not bound by the Health Insurance Portability and Accountability Act, known as HIPAA, which limits when certain health care providers and health plans can share a patient’s medical information. Nor does federal law set many limits on how companies can use this data. ### [Proposed Washington law puts period-tracking apps on notice](https://www.theregister.com/2023/01/18/washington%5Fperiod%5Ftracking%5Fapps/?ref=thenexusofprivacy.net) Jessica Lyons Hardcastle on The Register (theregister.com) My Health My Data, a bill currently in Washington's state legislature, would protect health data that collected by apps and websites -- including reproductive health care data. For some reason, the articles about it so far have focused on period-tracking apps, but that's only the tip of the iceberg. > "Think about period-tracking apps that can sell information about a woman's missed or late period," \[sponsor Rep. Vandana\] Slatter said. "Or a pregnancy crisis center that someone visits and then learns they can't receive an abortion, but their information can be sold to anti-abortion groups. Or digital advertising firms that set up geofencing around healthcare facilities. This bill is about closing the gap on health data privacy protections from the technological side of it." I talked more about My Health My Data and its prospects here last week in [A much more favorable environment: Washington state privacy legislation 2023](https://thenexusofprivacy.net/wa-privacy-more-favorable-environment/), and with a hearing on Tuesday I'll have more to say about it soon! **ALSO:** - [Washington state bill would make period-tracking apps follow privacy laws in reflection of post-Roe fears ](https://cnn.com/2023/01/18/politics/washington-state-period-tracking-apps?ref=thenexusofprivacy.net), Shawna Mizelle on CNN (cnn.com) A pair of articles about My Health My Data, a bill introduced by Democrats in Washington’s state legislature would prevent private health data that is collected by apps -- particularly those that track menstrual cycles -- from being shared without consumers’ consent. #### ## Surveillance ### [U.S. airline accidentally exposes ‘No Fly List’ on unsecured server](https://dailydot.com/debug/no-fly-list-us-tsa-unprotected-server-commuteair?ref=thenexusofprivacy.net) Mikael Thalen on The Daily Dot (dailydot.com) CommuteAir, a United Airlines subsidiary, left a copy of the U.S. No Fly List on an unsecured server as a file named "NoFly.csv" that could be viewed by anyone. > The list, according to crimew, appeared to have more than 1.5 million entries in total. The data included names as well as birth dates. It also included multiple aliases, placing the number of unique individuals at far less than 1.5 million. ### [Little-Known Surveillance Program Captures Money Transfers Between U.S. and More Than 20 Countries](https://wsj.com/articles/little-known-surveillance-program-captures-money-transfers-between-u-s-and-more-than-20-countries-11674019904?ref=thenexusofprivacy.net) Dustin Volz and Byron Tau on The Wall Street Journal (wsj.com) Law-enforcement agencies across the U.S. have direct access to over 150 million transactions housed at an Arizona-based nonprofit. ## State privacy legislation ### [States are readying a flurry of privacy bills as Washington stalls](https://www.washingtonpost.com/politics/2023/01/20/states-are-readying-flurry-privacy-bills-washington-stalls/?ref=thenexusofprivacy.net) Cristiano Lima on the Washington Post (washingtonpost.com) A roundup of some of the various laws being proposed, including - Comprehensive privacy bills in Massachusetts, Iowa, Mississippi, Indiana, Oklahoma, Oregon, Tennessee, New York and Kentucky - Protections for children’s data in Connecticut, Oregon, West Virginia, Virginia and New Jersey. - Biometrics, health data, and data broker laws in New York, Mississippi, Maryland, Oregon, New Jersey, Virginia and Washington. That's a lot! ### [State legislators aren’t waiting for Congress to regulate children’s online privacy](https://cyberscoop.com/california-age-appropriate-design-code-oregon-privacy?ref=thenexusofprivacy.net) Tonya Riley on CyberScoop (cyberscoop.com) More states are following California’s lead in regulating children’s privacy. But experts say the laws raise many tough questions. ### [Data Privacy ‘Panoply’ Looms as States Move to Fill Federal Hole](https://news.bloomberglaw.com/privacy-and-data-security/data-privacy-panoply-looms-as-states-move-to-fill-federal-hole?ref=thenexusofprivacy.net) Brenna Goth and Skye Witley on Bloomberg Law (news.bloomberglaw.com) Consumers across the US could gain more control over how companies collect and use their personal information through state legislative efforts to create new data privacy requirements. ## And ... ### [The Future of Manipulative Design Regulation](https://fpf.org/blog/the-future-of-manipulative-design-regulation/?ref=thenexusofprivacy.net) Felicity Slater, Future of Privacy Forum (fpf.org) A look at rules and enforcement actions, in the US and around the world, targeting manipulative design practices online. > These efforts are complex and address a range of consumer protection issues, including privacy and data protection risks. They raise thorny questions about how to distinguish between lawful designs that encourage individuals to consent to data practices, and unlawful designs that manipulate users through unfair and deceptive techniques. As policymakers enforce existing laws and propose new rules, it is crucial to identify when the design and default settings of online services constitute unlawful manipulative design that impairs user’s intentional decision-making. #### [How the Netherlands Is Taming Big Tech](https://nytimes.com/2023/01/18/technology/dutch-school-privacy-google-microsoft-zoom.html?ref=thenexusofprivacy.net) Natasha Singer on NYTimes (nytimes.com) Dutch privacy negotiators have spurred major changes at Google, Microsoft and Zoom, using a landmark European data protection law as a lever. #### [Thinking and Reading at the Intersection of Labor, Race, and Tech](https://points.datasociety.net/thinking-and-reading-at-the-intersection-of-labor-race-and-tech-c86e687fa0cf?ref=thenexusofprivacy.net) Data & Society on Data & Society: Points (points.datasociety.net) The rise of data-centric technologies is an opportunity for the labor and racial justice movements to build new bridges. #### [Meta dodged a €4BN privacy fine over unlawful ads, argues GDPR complainant](https://techcrunch.com/2023/01/19/meta-ads-noyb-epdb-gdpr-complaint?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) A €390M privacy fine against Meta’s behavioural ads issued earlier this month in the EU was several billion dollars smaller than it should have been, argues the original complainant. #### [The year in UK GDPR regulatory enforcement action](https://privacylaws.com/uk125enforce?ref=thenexusofprivacy.net) on Privacy Laws & Business (privacylaws.com) #### [The Battle Over Women’s Data](https://wired.com/story/privacy-health-data-women?ref=thenexusofprivacy.net) Chi Onwurah on WIRED (wired.com) In a post-Roe world, bodily autonomy must include control over personal data. #### [All the Data Apple Collects About You—and How to Limit It](https://wired.com/story/apple-privacy-data-collection?ref=thenexusofprivacy.net) Matt Burgess on WIRED (wired.com) Cupertino puts privacy first in a lot of its products. But the company still gathers a bunch of your information. #### [The big risk in the most-popular, and aging, big tech default email programs](https://cnbc.com/2023/01/15/the-most-popular-big-tech-email-programs-are-old-and-vulnerable.html?ref=thenexusofprivacy.net) Elizabeth MacBride on CNBC (cnbc.com) Many individuals and businesses rely on Google and Microsoft email programs created long ago, and big tech email ‘age’ is a big cybersecurity risk. #### [Irish Data Protection Authority gives € 3.97 billion present to Meta. Authority allegedly unable to assess financial benefit from Meta’s GDPR violations.](https://noyb.eu/en/irish-data-protection-authority-gives-eu-397-billion-present-meta-authority-allegedly-unable-assess?ref=thenexusofprivacy.net) on noyb.eu (noyb.eu) The DPC has turned a blind eye on the revenue generated by Meta from violating the GDPR since 2018\. Ignoring the EDPB demand to include the unlawful revenue of Meta, reduced the fine by 3,97 Mrd EUR. #### [Privacy Fines: GDPR Sanctions Last Year Surged to $3 Billion](https://bankinfosecurity.com/privacy-fines-gdpr-sanctions-last-year-surged-to-3-billion-a-20950?ref=thenexusofprivacy.net) Mathew J. Schwartz on bankinfosecurity.com European data protection regulators last year imposed known privacy and data breach fines under GDPR collectively worth at least 2.9 billion euros, or $3.1 billion, #### [UK data agency plays down privacy risks of connected tech, as demand for Amazon Alexa and Google Nest show consumer trust](https://cityam.com/uk-data-agency-plays-down-privacy-risks-of-connected-tech-as-demand-for-amazon-alexa-and-google-nest-show-consumer-trust?ref=thenexusofprivacy.net) Jess Jones on CityAM (cityam.com) The UK’s data watchdog has played down potential privacy concerns linked to connected technology, arguing that strong demand for devices like the Amazon #### [Privacy Shield 2.0 What’s Next for International Data Transfers?](https://swlaw.com/publications/view/privacy-shield-20-whats-next-for-international-data-transfers?ref=thenexusofprivacy.net) Myriad Interactive on Snell & Wilmer (swlaw.com) Snell & Wilmer is one of the largest law firms in the western Unites States. #### [Podcast: Why Privacy Matters](https://techpolicy.com/PrivacyExpertsRichards-Citron-WhyPrivacyMatters.aspx?ref=thenexusofprivacy.net) Neil Richards and Danielle Citron on Tech Policy (techpolicy.com) In a UVA Common Law podcast, privacy law expert Neil Richards, law professor at Washington University in St. Louis, joins University of Virginia law professor Danielle Citron to discuss how privacy regulation could ensure that information cannot be used to gain control and influence others. #### [CDT and Technologists File SCOTUS Brief Urging Court To Hold that Section 230 Applies to Recommendations of Content](https://cdt.org/insights/cdt-and-technologists-file-scotus-brief-urging-court-to-hold-that-section-230-applies-to-recommendations-of-content?ref=thenexusofprivacy.net) Caitlin Vogus, Emma Llansó, Samir Jain on Center for Democracy and Technology (cdt.org) The Center for Democracy & Technology and six technologists with expertise in online recommendation systems filed an amicus brief today in Gonzalez v. Google. The brief urges the U.S. Supreme Court to hold that Section 230’s liability shield applies to claims against interactive computer service pro… #### [Podcast: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy](https://lawfareblog.com/lawfare-podcast-how-spy-your-pocket-threatens-end-privacy-dignity-and-democracy?ref=thenexusofprivacy.net) Jen Patja Howell on Lawfare (lawfareblog.com) Lawfare fellow in technology policy and law Eugenia Lostri sat down with Laurent Richard and Sandrine Rigaud to talk about their new book, “Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy.” #### [Apple privacy under question as apps get independent checks](https://techhq.com/2023/01/apple-privacy-tracking-anonymity-fact-checkers-whether-they-like-it-or-not?ref=thenexusofprivacy.net) Molly Loe on TechHQ (techhq.com) Question’s around Apple privacy policies as it’s found that Apple’s own applications identify users personally and phone data home. #### [Meta centralizes more user and privacy settings across its apps, announces changes to ads controls](https://techcrunch.com/2023/01/19/meta-centralizes-more-user-and-privacy-settings-across-its-apps-announces-changes-to-ads-controls?ref=thenexusofprivacy.net) Sarah Perez on TechCrunch (techcrunch.com) Facebook parent Meta announced today it’s further centralizing various user settings across its suite of apps — Facebook, Instagram, and Messenger. As a result, several existing settings will be relocated to Meta’s “Accounts Center” feature, first launched in 2020\. Specifically, the changes will see… #### [Publishers are preparing for 2023’s new consumer privacy laws](https://digiday.com/sponsored/publishers-are-preparing-for-2023s-new-consumer-privacy-laws?ref=thenexusofprivacy.net) Melissa Cooper, Sovrn on Digiday (digiday.com) A new set of[ state-specific privacy regulations](https://www.huschblackwell.com/2023-state-privacy-law-tracker?ref=thenexusofprivacy.net) is scheduled to take effect in 2023. #### [How can breaching citizens’ privacy be lawful?](https://asianews.network/how-can-breaching-citizens-privacy-be-lawful?ref=thenexusofprivacy.net) Kamal Ahmed on Asia News Network (asianews.network) Without legal safeguards, putting in place such surveillance systems aimed at suspected anti-state activities carries serious risks of innocent victims being harassed. #### [Obtaining Consent for Privacy Practices](https://jdsupra.com/legalnews/obtaining-consent-for-privacy-practices-2797343?ref=thenexusofprivacy.net) Mallory Acheson on JD Supra (jdsupra.com) By now, most businesses are aware of the growing requirements to provide notice to consumers regarding how a business uses and discloses personal information. --- Image credit: Originally by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net), licensed from [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) via [Picpedia](https://www.picpedia.org/chalkboard/p/privacy.html?ref=thenexusofprivacy.net) #### ### Privacy News: January 17 URL: https://thenexusofprivacy.net/privacy-news-january-17/ Last updated: 2023-01-17T21:32:14.000Z Algorithms of oppression (re)producing racism, pushing back on AI hype, a new approach to try to make GDPR's protections real, state privacy legislation ... and more! ### [When Black Death Goes Viral: How Algorithms of Oppression (Re)Produce Racism and Racial Trauma](https://perspectivesblog.sagepub.com/blog/research/when-black-death-goes-viral-how-algorithms-of-oppression-reproduce-racism-and-racial-trauma?ref=thenexusofprivacy.net) Dr. Tiera Chantè Tanksley on SAGE Perspectives Blog (perspectivesblog.sagepub.com) > "Concerned about how seeing images of Black people dead and dying would affect young social media users, I conducted a study to understand how digitally mediated traumas were impacting Black girls’ mental and emotional wellness. As I completed interviews with nearly 20 Black girls (ages 18-24) across the US and Canada, my initial fears were quickly confirmed: Black girls reported unprecedented levels of anxiety, depression, fear and chronic stress from encountering Black death online. The most common phrases participants used were “traumatizing,” “exhausting” and “PTSD.” Many of the girls endured mental, emotional and physiological effects, including insomnia, migraines, nausea, prolonged “numbness” and dissociation.... Mental health concerns directly affected schooling experiences, with many girls too overwhelmed, triggered or physically exhausted to fully engage in academics following high profile police killings." ### [Algorithms Allegedly Penalized Black Renters. The US Government Is Watching](https://wired.com/story/algorithms-allegedly-penalized-black-renters-the-us-government-is-watching?ref=thenexusofprivacy.net) Khari Johnson on WIRED (wired.com) The Department of Justice has warned SafeRent, a provider of tenant-screening software, that its tenant-screening algorithms must comply with fair housing law. SafeRent claims that they're exempt from the law because their discrimintory algorithms only advise landlords and don’t make decisions, but [DOJ's Kristen Clarke isn't having any of that](https://www.justice.gov/opa/pr/justice-department-files-statement-interest-fair-housing-act-case-alleging-unlawful-algorithm?ref=thenexusofprivacy.net): > “Housing providers and tenant screening companies that use algorithms and data to screen tenants are not absolved from liability when their practices disproportionately deny people of color access to fair housing opportunities.” ### [Stop feeding the hype and start resisting](https://irisvanrooijcogsci.com/2023/01/14/stop-feeding-the-hype-and-start-resisting?ref=thenexusofprivacy.net) Iris van Rooij on Iris van Rooij (irisvanrooijcogsci.com) As van Rooij points out, it’s almost as if academics are eager to do the [PR work](https://twitter.com/emilymbender/status/1613224496437301249?ref=thenexusofprivacy.net) for OpenAI (the company that created ChatGPT). Why? > "As Tamar Sharon, professor of Ethics and Political Philosophy and co-director of [iHub](https://ihub.ru.nl/?ref=thenexusofprivacy.net) at the Radboud University, notes in the Dutch newspaper NRC[1](https://irisvanrooijcogsci.com/2023/01/14/stop-feeding-the-hype-and-start-resisting/?ref=thenexusofprivacy.net#footnote1): “the ideals of OpenAI are not credible”, the company is “founded by millionaires based on their ideology of Effective Altruism, EA” and while they talk about making “beneficial AI”, so far this type of tech is realised by exploiting cheap labour of underpaid workers and the push to make Large Language Models (LLMs), such as ChatGPT, larger and larger creates a “gigantic ecological footprint” with implications for “our planet that are far from beneficial for humankind”.... > > Please join me in resisting and start helping to curb the hype." ### [Will Europe’s Privacy Bill of Rights Ever Truly Be Enforced?](https://themarkup.org/hello-world/2023/01/14/will-europes-privacy-bill-of-rights-ever-truly-be-enforced?ref=thenexusofprivacy.net) Julia Angwin on The Markup (themarkup.org) As Angwin says, the GDPR is essentially a privacy bill of rights. > Amid rising commercial surveillance, it offered EU residents some [essential rights](https://edps.europa.eu/data-protection/our-work/subjects/rights-individual%5Fen?ref=thenexusofprivacy.net) over their data—including the right to see their data, to correct it, to delete it, to restrict or object to specific uses, and to not have data used about their sex, health, religion, political identity, and other sensitive topics.... > > But many of the rights have been nearly impossible to exercise because legal challenges based on the law have often languished at the Irish Data Protection Commission, which handles most GDPR complaints against Big Tech. Angwin talks with Tanya O’Carroll, co-founder and former director of Amnesty Tech, who's trying to going around the Irish regulator by [filing a lawsuit in a U.K. court](https://www.awo.agency/files/ocarroll-v-meta-bundle.pdf?ref=thenexusofprivacy.net) against Meta for violating the GDPR, ## Mastodon and the Fediverse ### [How you could build a search that the fediverse would welcome](https://anildash.com/2023/01/16/a-fediverse-search/?ref=thenexusofprivacy.net) Anil Dash (anildash.com) Mastodon doesn't have full-text search. This is a hassle from a user interface perspective, and as people check out Mastodon and other compatible fediverse software as alternatives to Twitter, there have been [several recent attempts to implement search](https://cathode.church/fedi-scraper-counter.html?ref=thenexusofprivacy.net) ... all of which have gone down in flames after intense community pushback. As Dash says > \[S\]earch is also a signifier to those who pioneered and established the current era of the fediverse, symbolizing the extractive and exploitative hypergrowth systems that often ruined the positivity and promise of the human web. One of the issues with all of the previous search proposals is that they're opt-out based: posts get indexed for search unless people say they shouldn't. Dash suggests a consent-based, opt-in approach, which is much better aligned with the fediverse's values – and with trends in privacy law. ## Facial recognition ### [Lawyers Barred by Madison Square Garden Found a Way Back In](https://nytimes.com/2023/01/16/technology/madison-square-garden-ban-lawyers.html?ref=thenexusofprivacy.net) Kashmir Hill on th New York Times (nytimes.com) MSG Entertainment resorted to facial recognition technology to kick out legal foes, but some have undermined the ban using a law passed to protect theater critics in 1941. ### [Does the European Parliament use Facial Recognition Technology?](https://iccl.ie/news/does-the-european-parliament-use-facial-recognition-technology?ref=thenexusofprivacy.net) Kris Shrishak on Irish Council for Civil Liberties (iccl.ie) ICCL has received documents that indicate the European Parliament requested for CCTV cameras with facial recognition capability. ## State privacy legislation #### [Privacy in the City that Never Sleeps: New NY Privacy Bill](https://linkedin.com/pulse/privacy-city-never-sleeps-new-ny-bill-odia-kagan?ref=thenexusofprivacy.net) Odia Kagan on linkedin.com New York's [S 365](https://nyassembly.gov/leg/?default%5Ffld=&leg%5Fvideo=&bn=S00365&term=2023&Summary=Y&Actions=Y&Text=Y&ref=thenexusofprivacy.net) is the latest versiof of the New York Privacy Act. It follows GDPR's terminology (controllers, processors, and personal data), and takes a similar approaches to California when it comes to deidentiied data, sale of data, and sensitive data. It also has requirements for automated decision making. It'll be interesting to see how far it gets this session. #### [South Carolina earns mid-pack scores for online privacy laws](https://thecentersquare.com/south%5Fcarolina/south-carolina-earns-mid-pack-scores-for-online-privacy-laws/article%5F9220db40-9395-11ed-90ef-33d4a864ab16.html?ref=thenexusofprivacy.net) T.A. DeFeo The Center Square (thecentersquare.com) South Carolina ranked in the middle of the pack nationwide for its laws governing online privacy. The Palmetto State scored 5.5 out of 25 points in a new analysis from Comparitech, a website focused on cyber security and online privacy. According to Rebecca Moody, head of data research at Comparitech, > “Its score stems from data disposal laws which cover companies and government entities, legislation to protect K-12 student information, a shield law to protect journalists, and an insurance data security law. It also scores half a point thanks to its protections for genetic testing when it comes to insurance quotes and coverage.” #### [Virginia’s Data Privacy Law Just Went Into Effect – What You Should Know.](https://jdsupra.com/legalnews/virginia-s-data-privacy-law-just-went-4634522?ref=thenexusofprivacy.net) Melody McAnally on JD Supra (jdsupra.com) On January 1, 2023, Virginia’s Consumer Data Protection Act (“Virginia Privacy Law”) went into effect. Here's what you need to know. ## ## And ... #### [Wikipedia needs different safety rules, says foundation](https://bbc.co.uk/news/technology-64285220?ref=thenexusofprivacy.net) Chris VallanceTechnology reporter on BBC News (bbc.co.uk) The Online Safety Bill shouldn’t treat community-run sites like big tech firms its foundation says. #### [US obtains exclusion of NGOs from drafting AI treaty](https://euractiv.com/section/digital/news/us-obtains-exclusion-of-ngos-from-drafting-ai-treaty?ref=thenexusofprivacy.net) Luca Bertuzzi on EURACTIV (euractiv.com) Civil society organisations have been excluded from the drafting process of the first international treaty on Artificial Intelligence based on a request of the US to avoid countries’ positions becoming public. #### [AI and privacy: Experts worry users may have already ‘traded a lot’ for services ](https://globalnews.ca/news/9411392/artificial-intelligence-privacy?ref=thenexusofprivacy.net) Irelyne Lavery on Global News (globalnews.ca) With individual data being largely unregulated, AI companies are walking a fine line with the privacy of consumers, according to one expert. #### [The big risk in the most-popular, and aging, big tech default email programs](https://cnbc.com/2023/01/15/the-most-popular-big-tech-email-programs-are-old-and-vulnerable.html?ref=thenexusofprivacy.net) Elizabeth MacBride on CNBC (cnbc.com) Many individuals and businesses rely on Google and Microsoft email programs created long ago, and big tech email ‘age’ is a big cybersecurity risk. #### [AI art tools Stable Diffusion and Midjourney targeted with copyright lawsuit](https://theverge.com/2023/1/16/23557098/generative-ai-art-copyright-legal-lawsuit-stable-diffusion-midjourney-deviantart?ref=thenexusofprivacy.net) James Vincent on The Verge (theverge.com) AI art gets its first major copyright lawsuit #### [Meta alleges surveillance firm collected data on 600,000 users via fake accounts](https://theguardian.com/technology/2023/jan/12/meta-voyager-labs-surveillance-fake-accounts?ref=thenexusofprivacy.net) Sam Levin on The Guardian (theguardian.com) The social media giant sued to prevent a surveillance company partnering with the Los Angeles police from obtaining data #### [Data Is What Data Does: Regulating Use, Harm, and Risk Instead of Sensitive Data](https://teachprivacy.com/data-is-what-data-does-regulating-use-harm-and-risk-instead-of-sensitive-data?ref=thenexusofprivacy.net) Daniel Solove on TeachPrivacy (teachprivacy.com) Sensitive data is unworkable and counterproductive, especially in an age of Big Data.. It is also based on a conceptual mistake. #### [An Interview With the Guy Who Has All Your Data](https://gizmodo.com/acxiom-ceo-chad-engelgau-data-broker-interview-privacy-1849977330?ref=thenexusofprivacy.net) Thomas Germain on Gizmodo (gizmodo.com) It’s 10 pm. Do you know where your data is? Chad Engelgau does. He’s the CEO of Acxiom, a data broker. Your info is probably on one of his servers. #### [Meta sues “scraping-for-hire” service that sells user data to law enforcement](https://arstechnica.com/information-technology/2023/01/meta-sues-scraping-for-hire-service-that-sells-user-data-to-law-enforcement?ref=thenexusofprivacy.net) Dan Goodin on Ars Technica (arstechnica.com) Israeli firm says it uses AI to analyze “billions of ‘human pixels’ and signals.” #### [‎The Gray Area with Sean Illing: Is ethical AI possible? ](https://podcasts.apple.com/us/podcast/is-ethical-ai-possible/id1081584611?i=1000593166307&ref=thenexusofprivacy.net) Apple Podcasts (podcasts.apple.com) ‎Timnit Gebru joins Sean Illing to discuss whether ethical AI is possible. #### [‘SweepWizard’ Policing App May Have Exposed Personal Data on Hundreds of Officers and Thousands of Suspects](https://gizmodo.com/sweepwizard-police-app-data-expose-leaked-1849977290?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) A flaw in the app’s API reportedly let anyone with a specific URL view data on officers, suspects, and the operations they were engaged in. #### [New York Enacts First State “Right-to-Repair” Law](https://natlawreview.com/article/new-york-enacts-first-state-right-to-repair-law?ref=thenexusofprivacy.net) Jeffrey D. Neuburger on The National Law Review (natlawreview.com) At the close of 2022, New York Governor Kathy Hochul signed the “Digital Fair Repair Act” (S4101A/A7006-B) (to be codified at N.Y. GBL §399-nn) (the “Act”). The #### [In new GOP-led House, Rep. Sara Jacobs targets global peacekeeping, digital privacy and children’s issues](https://sandiegouniontribune.com/news/politics/story/2023-01-15/sara-jacobs-year-ahead-congress?ref=thenexusofprivacy.net) Deborah Sullivan Brennan on San Diego Union-Tribune (sandiegouniontribune.com) Last year, during her first term, Jacobs worked to boost military pay, housing and child care and protect digital privacy for reproductive health. #### [Three law firms join forces for mega privacy case against Medibank](https://afr.com/technology/three-law-firms-join-forces-for-mega-privacy-case-against-medibank-20230113-p5ccfv?ref=thenexusofprivacy.net) John Davidson on Australian Financial Review (afr.com) The merging a class action lawsuit with a complaint to Australian privacy watchdog could result in billions of dollars in payouts to Medibank customers. #### [Apple’s Fight To Protect Privacy Has Shaken Up Digital Advertising. Here’s How Marketers Can Thrive In A Cookie-Less World, From An Expert.](https://forbes.com/sites/garydrenik/2023/01/11/apples-fight-to-protect-privacy-has-shaken-up-digital-advertising-heres-how-marketers-can-thrive-in-a-cookie-less-world-from-an-expert?ref=thenexusofprivacy.net) Gary Drenik on Forbes (forbes.com) In our ever-digital world, privacy is the hottest commodity. Brands want to buy it, users want to keep it for themselves, and the middleman collecting all this information doesn’t quite know what’s right. #### [People of colour: there’s a bias in how pictures are used to depict disease in global health publications](https://theconversation.com/people-of-colour-theres-a-bias-in-how-pictures-are-used-to-depict-disease-in-global-health-publications-196056?ref=thenexusofprivacy.net) Esmita Charani on The Conversation (theconversation.com) Through the choice of images in publications, women and children of colour in low and middle income countries were treated with less dignity and respect than those in high income countries. #### [Report about govt purchase of Israeli spy technology rocks Bangladesh](https://benarnews.org/english/news/bengali/surveillance-01142023175608.html?ref=thenexusofprivacy.net) on Benar News (benarnews.org) Home minister acknowledges agencies are monitoring social media to thwart “anti-government activities.” #### ### Social threat modeling and quote boosts on Mastodon URL: https://thenexusofprivacy.net/social-threat-modeling-and-quote-boosts/ Last updated: 2026-04-16T02:59:07.000Z > Last updated December 30, 2024 – see the update log for details. [Social threat modeling](https://medium.com/a-change-is-coming/social-threat-modeling-the-winds-of-change-are-in-the-air-8dc330479a50?ref=thenexusofprivacy.net) applies structured analysis to threats like harassment, abuse, and disinformation. You'd think this would happen routinely, but no. [A trip down memory lane](https://medium.com/a-change-is-coming/a-trip-down-memory-lane-part-2-of-social-threat-modeling-draft-8693ee209d51?ref=thenexusofprivacy.net) looks at a couple of high-profile missteps by Twitter and how social threat modeling could have avoided them. Social threat modeling can also be very useful for Mastodon. The early days features significant [innovation](https://thenexusofprivacy.net/mastodon-a-partial-history/#rapid-queer-led-community-innovation) like instance blocking and local-only posts; since then, though, the lack of progress has been striking. As of early 2023, Mastodon lacks some of Twitter's basic anti-harassment functionality (protected profiles, the ability to limit who can respond to a post), and local-only posts still haven't been accepted from the main code base. And while features like [full text search](https://www.tbray.org/ongoing/When/202x/2022/12/30/Mastodon-Privacy-and-Search?ref=thenexusofprivacy.net) haven't been implemented yet due to concerns about the possibility of toxicity and abuse, it's not clear that this leads to significant additional safety. As Mastodon gets broader adoption, it's more and more important to do some deeper analysis about what can be done to prevent or mitigate these threats. This post only scratches the surface, but hopefully gives enough of an idea of the power of the approach that people can take it forward. And I certainly hope that any companies or government agencies adopting Mastodon are putting some resources into looking at these issues as well. That all sounds pretty abstract, so let's make it concrete by talking about everybody's favorite Mastodon topic: quote boosts! ## QTs, QBs, reblogs, wtf? > Quote Toots are coming. The choice is to make them benign, or not to. > > – [Isabelle Moreton](https://mastodon.lol/@epistemophagy/109586023788561244?ref=thenexusofprivacy.net) (@epistemophagy) "Quote boosts", the not-yet-widely-implemented equivalent of Twitter's "quote tweets" and Tumblrs "reblog with comment," are one of the hottest topics on these days on Mastodon, the decentralized open-source social network that's getting a lot of attention these days. *Terminology note: Mastodon's "posts", the equivalent of Twitter's tweets and Tumblr's blogs, were called "toots" until November 2022, so "quote toot" and "quote boost" are synonyms. I'll use "quote boost" and "QB" unless I'm quoting somebody in which case I'll use whatever language they use.* On the one hand there lots of positive uses of quote tweets (QTs) and reblogs. They're useful for helping people understand discussions they don't have all the background for, valuable for helping highlight similar experiences, great for calling out hypocrisy ("This you?"), a core component of Black digital practices including call-and-response patterns, ... the list goes on. On the other hand, they're also used for targeting people for harassment, taking quotes out of context, and spreading disinformation. Last month's [Black Twitter, quoting, and white views of toxicity on Mastodon](https://thenexusofprivacy.net/black-twitter-quoting-and-white-toxicity-on-mastodon/) discusses the topic in more deail. Hilda Bastian's [Quote Tweeting: Over 30 Studies Dispel Some Myths](https://absolutelymaybe.plos.org/2023/01/12/quote-tweeting-over-30-studies-dispel-some-myths/?ref=thenexusofprivacy.net) on *Absolutely Maybe* is a detailed look at the research on Twitter, although little if any of it gets down to the level of detail we need to consider to prevent harassment and abuse.1 How to balance the positives and negatives? For the last five years, Mastodon has tried to avoid the problem by only supporting "boost" (the equivalent of Twitter's "retweet" and Tumblr's "reblog") but not supporting quote boosts (QBs). You can work around this doing a "screenshot-and-link": sharing an image of the post you're quoting along with a link, but it's a lot more work so it introduces friction. Directly supporting QBs will (hopefully) make it easier, reducing friction. That's good for the positive uses, but could increase harassment and abuse. The Appendix in last month's [Black Twitter, quoting, and white views of toxicity on Mastodon](https://thenexusofprivacy.net/black-twitter-quoting-and-white-toxicity-on-mastodon/) goes into detail comparing screenshot-and-link to Twitter's QTs including a discusion of [friction](https://thenexusofprivacy.net/black-twitter-quoting-and-white-toxicity-on-mastodon/#friction). Mastodon forks like fedibird, treehouse, and Hometown already support them – as compatible fediverse applications like Misskey, Calckey, and Friendica have similar constructs. Mastodon BDFL (Benevolent Dictator for Life) has recently said that they're working on QB's so it's probably just a matter of time until they make it into mainline Mastodon in some form or another ... but just what they'll look like when they're implemented is still completely up in the air. > **Update, December 2024**: In April 2024, Mastodon got funding from NLNet to implement quote posts. Specification and implementation began in late summer, and it's expected to ship in the upcoming release 4.4. ## Dogpiling 101 Let's look in more detail at one way that quote boosts could be used as part of harassment: encouraging *dogpiling* – getting a bunch of accounts to target somebody. Of course, there are plenty of ways to dogpile without quote boosts – [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](https://thenexusofprivacy.net/mastodon-a-partial-history/#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) discusses a 2017 episode on Mastodon, and it's happened plenty of times since then. Introducing quoting functionality can potentially make matters worse, which would be bad, and we'll get to that in the next section. First though let's look at dogpiling without quoting. From an attacker's perspective, you can think of dogpiling as a three-step process: 1. Find a post from your target to point people to 2. Get broad visibility on that post in ways that encourage people to respond hostilely 3. Some percentage of the people who see the post do in fact respond hostilely, bombarding the target with nasty replies, direct messages, or notifications ![Four boxes with words in them. On the top, "Dogpile target". Below, "1. Find a post to target", "2. Get wide visibility" and "3. Others pile on with replies, DMs, notifications, ...""](https://thenexusofprivacy.net/content/images/2023/01/stpm-dogpile-target.png) How to prevent this from happening? Well, if the attacker can't see your posts, then they can't target them; so if you know in advance that somebody's going to attack you, you can block them. That's not always the case though – and even if you block an attacker's account, they can set up another, or enlist a friend to help. Restricting visibility on posts (making them followers-only, for example) provides broader protection. Of course, there's a downside to this: it cuts down your ability to communicate with people who aren't your attackers. Still, even though these defenses aren't perfect, they're quite useful. ![The same diagram, now with a big red X over "find post to target", and two circles below: "Block attacker" and "Lmiit visibility"](https://thenexusofprivacy.net/content/images/2023/01/stm-prevent-finding-post.png) Mastodon has support for blocking, both of individual accounts and entire instances. However, support for limiting visibility is a lot weaker than it could be. - "Followers-only" posts seem like they provide a lot of protection, but unless you've turned on "approve follows", an attacker can just follow you and boom they have access to all your followers-only posts. - Additional levels of visibility such as"mutual followers" (people who you're following who are also following you) or "trusted accounts" could allow for even more protection. - Forks like Glitch and Hometown support "local-only posts," which are only visible to people running on the same instance as you; this provides significant protection if you're on a well-moderated instance that doesn't have open enrollments, but unfortunately this functionality isn't available in mainline Mastodon so most users can't take advantage of it. So even though we haven't gotten to quote boosts yet, we've identified a couple of areas for improvement. ## How to get wide visibility on a post? Next let's about the situation where we haven't been able to prevent the attacker from finding a post, and they want to get wide visibility for it. Even without quote boosts, they've got a whole range of techniques available today: - Boosting the post - Replying, and boosting the reply - Sending a link to the post to people via email, a chat message, a DM on some other social network along with instructions about what to do Mastodon doesn't currently let people control who can boost or reply to your posts. Once you know that a post is getting a lot of attention, it would be great to lock it down in some way ... but that's not an option The only control you have is the ability to delete the post[2](#notes) – which might well be exactly what the people who are dogpiling you want. Once again, there's a lot of room for improvement. Let's skip over the "get wide visibility" bit for now, and look at the third aspect of the attack. Once the post has broad visibility, are there ways to prevent people from piling on? In principle, yes. Limiting the visibility of the post, or who can reply or send you notifications, cuts down the number of dogpilers. And in the worst case, having a "shields up" mode that locks down your account – the equivalent of Twitter's "protected profile" – insulates you from the dogpiling. ![The same diagram, now with a big red X over "3. Others pile on", and a circle below: "Limit visibility, limit replies, limit notifications, shields up mode"](https://thenexusofprivacy.net/content/images/2023/01/stm-prevent-pileon.png) Mastodon does allow you to limit who can send you notifications, but unfortunately none of these other defenses are currently available. Limiting visibility would be very helpful, but (in addition to the limitations discussed above) you can't change the visibility of a post after it's been created.[3](#notes) Unlike Twitter, Mastodon doesn't have the ability to limit who can reply to a post; and there's no equivalent of Twitter's "protected mode". Of course, if you like to interact broadly, shifting to protected mode makes your account a lot less useful; and (just like deleting a post), it's giving ground to the attacker. So it's certainly not ideal. Still, this kind of "shields up" functionality is incredibly valuable when you're under attack. Mastodon's instance boundaries could allow for more gradations of "shields up"; for example, limiting access only to people on the same instance – or on a list of "trusted instances" (along the lines of Akkoma's "bubble"). ## Dogpiling *with* quoting Quoting gives the attacker another technique for getting visibility on a post ... or, more accurately, several additional techniques, because there's more than one way to quote a post. Here's one way to show it visually. ![Boxes, including "Quote". Below "quote", four boxes: "screenshot and link", "media", "private quote boost", "public quote boost"](https://thenexusofprivacy.net/content/images/2023/01/stm-quoting-2.png) Today, without any support for quote boost functionality, it's still fairly easy to approximate a quote boost by doing a screenshot and sharing it along with a link. It's more work than a quote boost, but from an attacker's perspective it also has the advantage that the person being targeted doesn't get a notification and so doesn't know they're being quoted. Attackers who are journalists (or know journalists) have another powerful option: quote the tweet in a media outlet with broad visibility. Anybody who's been targeted by Fox News knows how devastating this can be. Quote boosts add a couple more options. A *private* quote boost is one that the target can't see – but the attacker and their friends can. Claire Goforth's [Why users want Twitter to ban private quote tweets](https://www.dailydot.com/debug/twitter-private-quote-tweets-abuse/?ref=thenexusofprivacy.net) on the *Daily Dot* describes the problems this creates. If and when Mastodon implements quote boosts, it should prohibit private quote boosts. How to limit the impact of public quote boosts? One straightforward and important thing to do is prohibit quote boosts that increase the visibility of a post:. - If a post is followers-only, it should be impossible to make a public or unlisted quote boost. - If a post is local-only, it should be impossible to make a quote boost that's *not* local-only. - If an account has chosen to try to keep their posts out of search engines, the quote boost should also be withheld from search engines (or quote boosting shouldn't be allowed unless the quoter also keeps their posts from being indexed by search engines). - Quote boosts by people with huge numbers of followers can significantly increase visibility, so does it make sense to put some limits on that – for example, you can't quote boost a post by somebody who has less than 10% of followers that you do?4 Another possibility is to add a new option to posts saying whether or not it can be QB'ed, along with defaults for public and unlisted posts. Or the implementation could go even further, and require the quoter to ask for consent before quoting a post (or maybe allow people you're following to quote without consent but require it from others).5 Combining these last several points visually, we get a diagram that looks something like this. ![Boxes, including a big red X over "private quote boost" and a circle below with "prohibit"l and a big red X over"public quote boost", with a circle below "Limit who can QB; require consent"](https://thenexusofprivacy.net/content/images/2023/01/stm-preventing-quoting-abuse-1.png) > **Update, December 2024**: Bluesky implemented an additional mitigation I hadn't considered: the ability to [detach a quote post](https://bsky.social/about/blog/08-28-2024-anti-toxicity-features?ref=thenexusofprivacy.net). And since Bluesky treats links to posts as quote posts, the mitigation also applies to dogpiling via "screenshot and link". These limitations could have potential downsides as well. If a politician or some other public figure says something racist or anti-LGBTQ, should they be able to prevent people from quoting it? Mastodon's content warning (CW) norms are often racialized, with people of color getting told they need to put CWs on their personal experiences to avoid making white people uncomfortable. I could certainly picture similar things happening with requiring consent to quote.. For that matter, unless there are limits on who can ask for consent to quote, it's possible that bombarding somebody with consent requests could become a harassment technique in its own right. To be clear, though, these aren't necessarily reasons *not* to do these things, just factors that need to be considered in any design. Of course, if people can't use quote boosts to do this kind of quoting, they'll fall back on screenshot-and-link or (if they have access) a media quote. There's no obvious way to prevent these. Norms about consent to be quoted could be somewhat helpful even if attackers ignored them ... once again, though, there are potential downsides. Still, as Leigh Honeywell disucsses in [Another Six Weeks: Muting vs. Blocking and the Wolf Whistles of the Internet](https://modelviewculture.com/pieces/another-six-weeks-muting-vs-blocking-and-the-wolf-whistles-of-the-internet?ref=thenexusofprivacy.net), a lot of harassment is low-grade, opportunistic, and not terribly persistent. Screenshot-and-link is more effort than a quote boost, so even if it remains an option, reducing abuse possibilities for quote boosts has value. ## There's a lot more to learn! The quick analysis I've done here only scratches the surface. One important limitation of the discussion so far is that it's only focused on what people being dogpiled (or concerned about the risk) can do. Moderators and instance admins can also play a role – helping protect site members who are being dogpiled, taking early action to defuse a dogpiling-in-progress, encouraging norms and seetting defaults that make unintended dogpiling less likely, and so on. How can Mastodon's software, moderator funding and training, and communications channels between admins and moderators better support this work? For example, when dealing with a sustained dogpiling attack coming from multiple instances, is there a instance-level "shields up" mode limiting interaction to a short list of trusted instances? Or take @cd24@sfba.social's observation in [Some thoughts on Quote Boosts](https://write.as/collisiondomain/some-thoughts-on-quote-boosts?ref=thenexusofprivacy.net) that when dealing with screenshot-and-link quoting, "the *single* most crucial missing feature from the current moderation interfaces is contextualization." Should moderators be able to see what posts on their instance link to a post (whether or not they're quote boosts)? On the other hand, moderators can also be dogpiled. Back in 2018, Rochko's view of the [Battle of Wil Wheaton](https://www.theverge.com/2018/8/31/17801404/mastodon-harassment-wil-wheaton-mobs-twitter?ref=thenexusofprivacy.net) was that "An admin was overwhelmed with frivolous reports about him and felt forced to exile him." Opinions differ on whether the reports were frivolous (workingdog\_'s Twitter thread provides [important context ommitted from most mainstream narratives](https://twitter.com/workingdog%5F/status/1035544368575401985?ref=thenexusofprivacy.net)), but there's no question that Mastodon's moderation tools didn't give enough support in this situation; Nolan Lawson's [Mastodon and the challenges of abuse in a federated system](https://nolanlawson.com/2018/08/31/mastodon-and-the-challenges-of-abuse-in-a-federated-system/?ref=thenexusofprivacy.net) has some good perspectives. I'm not sure how much tools have evolved since then, but this is another good area to focus on in threat modeling. And [Block Party](https://www.blockpartyapp.com/?ref=thenexusofprivacy.net) has support for "helpers," who (with permission) can mute and block on somebody's behalf, as well as other tools to help filter out unwanted Twitter @mentions and use Twitter as normal. How can Mastodon support Block Party or equivalent tools? Are there ways to involve helpers in collective defense at the instance level? What about groups of instances working together? On a different front ... almost all of the discussion around quote boosts has been in terms of the Twitter experience. What about Tumblr? Tumblr's reblogs put the rebloggers comment at the *bottom* and provide a chain of reblogs, as opposed to Twitter's QT's where it's at the top and you have to click through to multiple tweets to see the full context. The Mastodon treehouse fork implements QB's that have commentary afterwards (like Tumblr-like) but only includes the first part of the post being quoted. What impact do these and other differences have – and what other variations could be worth exploring? At an even deeper level, as Erin Sanders describes in [A better moderation system is possible for the social web](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web/?ref=thenexusofprivacy.net), the ActivityPub that's at the basis of Mastodon and other fediverse software lets anybody send messages to anybody else's inbox by default. As Sanders says, perhaps letting any random person send us a message is not ideal. Could a more consent-based model cut down the risks of dogpiling and other harassment? Sanders' "letters of introduction", and the object capability approaches Christine Lemmer-Webber outlines in [OcapPub: Towards networks of consent](https://gitlab.com/spritely/ocappub/blob/master/README.org?ref=thenexusofprivacy.net), are two interesting paths forward here. As they say in research papers, these are all interesting grounds for future work. ## Summing up After going down into the weeds of quoting, lets take a step back and look some of the key potential mitigations we've identified – for quote boosts and for dogpiling more generally. 1. Adding more nuance to post visibility: local-only posts (currently only available in forks), "mutual follows", "trusted followers", "bubble" of trusted instances. 2. Make it clear that "follower-only" posts don't provide protection unless you also require approval to follow. 3. Changing visibility on posts after they have been made. This is likely to be imperfect for federated posts, but should be robust for local-only posts. 4. Adding the ability to limit who can boost a post. 5. Adding the ability to limit who can reply to a post. 6. Prohibiting quote boosts that increse visibility of followers-only, unlisted, local-only, or non-indexed posts. 7. Adding the ability to limit who can quote-boost posts, and perhaps also requiring consent in some cases. 8. Adding norms about consent for quoting by journalists and screenshot-and-link and 9. "Shields up" modes so that people can protect themselves when an attack is in process: followers-only, local-instance only, a "bubble" of local instances 10. Potential improvements in collective response tools, protocols, communications channels, training, and funding for moderators, admins, helpers, and instances While a couple of these specifically relate to quote boost implementation, the vast majority don't. So at least to me, one big takeaway from this is that quote boosts are only a relatively-small part of the overall dogpiling problem. While it's important to get quote boosts design right, it's even more important to look at the deeper issues – including the many ways Mastodon currently provides *less* protection than Twitter. Interestingly, most of these ideas have already been proposed in Github issues and discussions on Mastodon ... but they haven't been prioritized yet. So another big takeaway is that if Mastodon – or any other fediverse implementation – wants to be a significantly safer environment than Twitter, that prioritization needs to change. The quick analysis I've done here only scratches the surface; there are additional mitigations and dogpiling techniques I didn't cover, and dogpiling's only one of many aspects of harassment to consider. What's really needed is an organized social threat modeling effort – and that's going to require funding. And as Afsenah Rigot discusses in [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=thenexusofprivacy.net), centering the marginalized people directly impacted by design decisions leads to products that are better for *everybody*. With social threat modeling, this means working with, listening to, and following the lead of, ***AND FUNDING***: - marginalized communities who make extensive use of quoting, especially Black Twitter and disability Twitter - people and communities who are the targets of harassment using quoting along with other tactics, especially women of color, trans and queer people and disabled people Hopefully that will happen as more large corporations , non-profits, activism groups, and government agencies adopt Mastodon and other compatible platforms. --- A funded project would also include budget for some real threat modeling tools ... these diagrams were just done with Google Slides, which is fine for simple stuff but only gets you so far. Still, I figure I'd wrap things up with a diagram that attempts to put it all together. ![An extremely complex diagram with boxes and words, big red Xs, and circles. See description below.](https://thenexusofprivacy.net/content/images/2023/01/stm-incredibly-complex-diagram-1.png) Image description: At the top, a box saying "dogpile target". Below, boxes with words: "1\. Find a post to target" with a red X over it and a circle below saying "Limit who can post"; "2\. get wide visibility" with a complex diagram below it; "3\. Others pile on with replies, DMs, notifications ..." with a red X over it and a circle below saying "Limit visibility, limit replies, limit notifications, shields up mode". Below "Get Wide visibility", two boxes side-by-side, both with red X's over them: "Boost" and "Reply and boost". Below those boxes, a circle with "Limit replies; Limit boosting". To the left, a box with "Send link via DM, email, or chat". To the right, a box with "Quote" on it, and a complex diagram below it. Below the "quote" box, four boxes. On the left, "Screenshot and Link" and "Media(TV, newspaper)" with a circle below saying "Norms about consent. Content licensing?" Next, "Private quote boost" with a big red X, and a circle below it saying "Prohibit." On the right, "Public quote boost" with a big red X, and a circle below saying "Limit who can QB; Require consent." ## Notes 1 Almost none of the research Bastian [cites](https://absolutelymaybe.plos.org/2023/01/12/quote-tweeting-over-30-studies-dispel-some-myths/?ref=thenexusofprivacy.net) looks directly at harassment and abuse, let alone examine potential differences in how different kinds of attackers operate over time, as Twitter's affordances, harassment techniques, and the dynamics of overall weaponization have all changed. While there are papers looking at hate speech, and in particular slurs against disabled people and antisemiticsm none of the cited research appears to look specifically at harassment of trans people, Black women, and other common targets of harassment. And some significant harassment techniques using quoting are invisible in the data. One obvious example: as we discuss later in the artcle, "private QTs" were a maor Twitter attack vector for a while. Since they're private, they aren't available in any of the data sets researchers have worked with ... so we have no idea how much they are or aren't used in harassment. Or hypothetically suppose that Twitter's moderation leaves trans people particularly at risk, and/or anti-trans bigots have refined techniques for weaponizing QTs ... which of the 30+ research papers would reflect this? 2 Unfortunately, once a post has federated to other instances, there's no guarantee you can delete it: buggy or incompatible software on other instances might ignore the deletion request, or if the other instances has defederated from yours they might not even see it. I've found posts from instances that no longer exist still available on other instances, and even in Google searches. Thi isn't an issue for local-only posts, another reason they're so important. 3 Supporting this once a post has federated to other instances could be very challenging to implement well (and as with deletion, buggy or icompatible instances might just ignore the change in visibility), but it should be straightforward to implement for local-only posts. 4 Of course, attackers could get around this by having somebody with fewer followers QB and then having the high-profile boosting the QB, so it's not clear how much this would help ... but it's worth considering. 5 And unless the software supports a smooth way to discuss consent, requiring people to ask for consent could lead to a lot of posts cluttering up everybody's timeline. "Can I quote this?" "What part of it are you going to quote?" "The first sentence." etc. etc. etc. ## Updates January 16: add references to [A better moderation system is possible for the social web](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web/?ref=thenexusofprivacy.net), [OcapPub: Towards networks of consent](https://gitlab.com/spritely/ocappub/blob/master/README.org?ref=thenexusofprivacy.net), and protocol improvements. December 30, 2024: add reference to Bluesky "detach quote post" mitigation and Mastodon getting funding for quote posts ### Privacy News: January 12 URL: https://thenexusofprivacy.net/privacy-news-january-12/ Last updated: 2023-01-12T21:05:11.000Z President Biden weighs in, facial recognition in Iran, ISO adopts Privacy by Design, details on the big EU decisions against Facebook and Instagram, Medium on Mastodon ... and more! ### [Opinion | Republicans and Democrats, Unite Against Big Tech Abuses](https://wsj.com/articles/unite-against-big-tech-abuses-social-media-privacy-competition-antitrust-children-algorithm-11673439411?ref=thenexusofprivacy.net) Joe Biden on The Wall Street Journal (wsj.com) President Biden calls on Congress to "find common ground on the protection of privacy, competition and American children." I certainly agree with his framing that "the risks Big Tech poses for ordinary Americans are clear," and at in principle I even agree with his three recommendations. Congress *should* pass "serious federal protections for Americans’ privacy," algorithmic regulation, and laws to rein in anti-competitive behavior. And the draft AI Bill of Rights and the FTC's proposed rulemaking on Commercial Surveillance is developing new privacy rules for commercial data are both important developments. However, Biden also says we must "fundamentally reform Section 230 of the Communications Decency Act," and in December Biden backed the well-intentioned but harmful Kids Online Safety Act (KOSA) instead of pushing for antitrust legislation that would have reined in big business. And while I'd be overjoyed if he starts pushing to strengthen the proposed American Data Privacy Protection Act (ADPPA), right now despite its bipartisan sponsorship it's a giveaway to the big tech companies he claims to want to do something about. So, we shall see. ### [Iran Says Face Recognition Will ID Women Breaking Hijab Laws](https://wired.com/story/iran-says-face-recognition-will-id-women-breaking-hijab-laws?ref=thenexusofprivacy.net) Khari Johsnson on WIRED (wired.com) Iranian women are baring their heads to protest government controls. A top official said algorithms can identify anyone flouting dress codes. Johnson's reporting is always solid; he quotes Mahsa Alimardani on the digital surveillance systems Iran’s government (like China's and the US's) has spent years building, Freedom House research analyst Cathryn Grothe, and former US State Department surveillance expert Steven Feldstein (author of [*The Age of Digital Repression*](https://www.amazon.com/Rise-Digital-Repression-Technology-Resistance/dp/0190057491?ref=thenexusofprivacy.net)) ### [Privacy by Design to become an ISO standard next month](https://itworldcanada.com/article/privacy-by-design-to-become-an-iso-standard-next-month/521415?ref=thenexusofprivacy.net) Howard Solomon on IT World Canada (itworldcanada.com) Fourteen years after being introduced by Canadian privacy commissioner Anne Cavoukian, Privacy by Design (PbD) is about to become an international privacy standard for the protection of consumer products and services. > Adoption by the ISO “gives life to operationalizing the concept of Privacy by Design,” said Cavoukian, “helping organizations figure out how to do it. The standard is designed to be utilized by a whole range of companies — startups, multinational enterprises, organizations of all sizes. With any product, you can make this standard work because it’s easy to adopt. We’re hoping privacy will be pro-actively embedded in the design of \[an organization’s\] operations and it will complement data protection laws.” ## EU's Facebook and Instagram decisions ### [Major EU privacy decisions against Meta’s legal basis for ads raise fresh complaints](https://techcrunch.com/2023/01/11/meta-ads-legal-basis-dpc-final-decisions/?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) If you want to dig into the details of the major decisions requiring Facebook and Instagram to get opt-in consent to personal data for behavioral advertising requires, you're in luck! Privacy rights group [noyb](https://noyb.eu/en/meta-advertising-ban-decision-published?ref=thenexusofprivacy.net), published the 188-page [Facebook decision here](https://noyb.eu/sites/default/files/2023-01/DPCDecision%5FFacebook.pdf?ref=thenexusofprivacy.net) and the 196-page [Instagram decision here](https://noyb.eu/sites/default/files/2023-01/DPCDecision%5FInstagram.pdf?ref=thenexusofprivacy.net). ### [Facebook and Instagram decisions: “Important impact on use of personal data for behavioural advertising”](https://edpb.europa.eu/news/news/2023/facebook-and-instagram-decisions-important-impact-use-personal-data-behavioural%5Fen?ref=thenexusofprivacy.net) European Data Protection Board (edpb.europa.eu) The European Data Protection Board, which overruled the Irish Data Protection Commission's much-friendlier-to-Meta draft ruling, has a press release out as well as their [Binding Decisions](https://edpb.europa.eu/our-work-tools/consistency-findings/binding-decisions%5Fen?ref=thenexusofprivacy.net). ### Also ... - VIDEO: [Unpacking DPC Ireland's Meta decisions: AdTech and beyond](https://linkedin.com/video/event/urn:li:ugcPost:7019013053123850241?ref=thenexusofprivacy.net), hosted by IAPP on LinkedIn - [What the DPC-Meta decision tells us about the EU GDPR dispute resolution mechanism](https://iapp.org/news/a/what-the-dpc-meta-decision-tells-us-about-the-gdprs-dispute-resolution-mechanism?ref=thenexusofprivacy.net), Isabelle Roccia on International Association of Privacy Professionals (iapp.org) ## Mastodon ### [Medium embraces Mastodon](https://blog.medium.com/medium-embraces-mastodon-19dcb873eb11?ref=thenexusofprivacy.net) Tony Stubblebine, Medium (medium.com) Medium has raised well over $100 million in venture funding since Twitter founders Ev Williams started it a decade ago, [trying and abandoning many different business models](https://www.niemanlab.org/2019/03/the-long-complicated-and-extremely-frustrating-history-of-medium-2012-present/?ref=thenexusofprivacy.net). Now, they're setting up a Mastodon instance at [me.dm](https://me.dm/?ref=thenexusofprivacy.net). In his opinion post, CEO Stubblebine writes: > Mastodon is an emerging force for good in social media and we are excited to join this community. The 19th CTO Ben Werdmuller sees this as a[ really great thing](https://werd.social/@ben/109677938851771371?ref=thenexusofprivacy.net): > 1\. It's an endorsement of the platform. In particular, the statements from Twitter co-founders are great. > 2\. Medium will put resources behind maintaining a well-run community. > 3\. It's not trying to own Mastodon - it's participating like everyone else. > 4\. Other startups, newsrooms, etc, will take note and join in. > 5\. It'll bring people in too. > 5\. Should it close in the future, Mastodon already has the concept of portable identities. However, the sentiment is far from universal. In a poll [by happyborg](https://fosstodon.org/@happyborg/109676187938154707?ref=thenexusofprivacy.net), a quarter of the respondents to date support defederating commercially-owned instsances such as me.dm. In [Flocking to Mastodon?](https://bit.ly/FlockingToMastodon?ref=thenexusofprivacy.net), I noted that Mastodon has historically been anti-ad, anti-surveillance, anti-influencer, and anti-large corporations and that we should expect culture clashes. It wouldn't surprise me if the "fediverse" (the decentralized network-of-networks that Mastodon and compatible software are part of) will split into a "corporate fediverse" and an "indie fediverse." We shall see! ## And ... #### [Engage and Evade](https://press.princeton.edu/books/hardcover/9780691182285/engage-and-evade?ref=thenexusofprivacy.net) Asad L. Asad on Princeton University Press (press.princeton.edu) How everyday forms of surveillance threaten undocumented immigrants—but also offer them hope for societal inclusion #### [Privacy and/or Trade](https://lawreview.uchicago.edu/publication/privacy-andor-trade?ref=thenexusofprivacy.net) Anupam Chander on The University of Chicago Law Review (lawreview.uchicago.edu) #### [A Police App Exposed Secret Details About Raids and Suspects](https://wired.com/story/sweepwizard-police-raids-data-exposure?ref=thenexusofprivacy.net) on WIRED (wired.com) SweepWizard, an app that law enforcement used to coordinate raids, left sensitive information about hundreds of police operations publicly accessible. #### [Roomba testers feel misled after intimate images ended up on Facebook](https://technologyreview.com/2023/01/10/1066500/roomba-irobot-robot-vacuum-beta-product-testers-consent-agreement-misled?ref=thenexusofprivacy.net) Eileen Guo on MIT Technology Review (technologyreview.com) An MIT Technology Review investigation recently revealed how images of a minor and a tester on the toilet ended up on social media. iRobot said it had consent to collect this kind of data from inside homes—but participants say otherwise. #### [EU Tells TikTok Chief To Respect Data Privacy Laws](https://securityweek.com/eu-tells-tiktok-chief-respect-data-privacy-laws?ref=thenexusofprivacy.net) EduardKovacs on SecurityWeek.Com (securityweek.com) The European Union warns online giant TikTok to respect EU law and ensure the safety of European users’ data, as the video-sharing app’s CEO met with top officials in Brussels. #### [EU data protection supervisor warns on migrant privacy rights ](https://biometricupdate.com/202301/eu-data-protection-supervisor-warns-on-migrant-privacy-rights?ref=thenexusofprivacy.net) Alessandro Mascellino on BiometricUpdate.com (biometricupdate.com) Wiewiórowski says that people reaching EU borders seeking international protection are required to provide personal data in order to gain access. #### [Age verification law for adult websites comes with privacy, technical concerns](https://lailluminator.com/2023/01/11/age-verification-law-for-adult-websites-comes-with-privacy-technical-concerns?ref=thenexusofprivacy.net) Piper Hutchinson on Louisiana Illuminator (lailluminator.com) Users of adult websites voiced concerns on social media about a new law requiring age verification for pornography websites #### [Boffins break VoLTE privacy in LTE and 5G networks](https://theregister.com/2023/01/11/volte%5Fphone%5Fsecurity?ref=thenexusofprivacy.net) Thomas Claburn on The Register (theregister.com) Call metadata can be ferreted out #### [Apple Faces Second Class-Action Suit Over Privacy After Gizmodo Story](https://gizmodo.com/apple-iphone-privacy-analytics-second-lawsuit-1849967188?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) Tests showed Apple collects data even when its own settings promise not to. Two lawsuits and several months later, the company hasn’t answered any questions. #### [The foundation: Inside the LAPD’s secretive, multimillion-dollar private funding arm](https://latimes.com/california/story/2023-01-04/lapd-police-foundation-private-funding-arm?ref=thenexusofprivacy.net) Kevin Rector on Los Angeles Times (latimes.com) A Times investigation reveals how LAPD officials work with the Los Angeles Police Foundation to solicit private funding for the public agency. #### [Breaking down enforcement of Meta’s legal basis for personalized ads](https://iapp.org/news/a/breaking-down-enforcement-of-metas-legal-basis-for-personalized-ads?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) The Irish DPC’s decision on Meta’s personalized advertising model highlights disagreements between regulators and raises uncertainty around GDPR compliance. #### [Are Quantum Computers about to Break Online Privacy?](https://scientificamerican.com/article/are-quantum-computers-about-to-break-online-privacy?ref=thenexusofprivacy.net) Davide Castelvecchi,Nature magazine on Scientific American (scientificamerican.com) A new algorithm is probably not efficient enough to crack current encryption keys—but that’s no reason for complacency, researchers say #### [Louisiana's new porn law carries user privacy risks](https://www.northernpublicradio.org/2023-01-08/louisianas-new-porn-law-carries-user-privacy-riskshttps://www.northernpublicradio.org/2023-01-08/louisianas-new-porn-law-carries-user-privacy-risks?ref=thenexusofprivacy.net) Andrew Limbong and Jason Kelley on Northern Public Radio (northernpublicradio.org) Louisiana's new Act 440 requires people visiting porn sites to hand over information from your driver's license or other government ID to a third-party website to make sure they're of legal age. What could possibly go wrong? EFF's Kelley highlights some of the privacy issues this brings up. #### [South Carolina Weighs In; Privacy Rights in the Wake of Dobbs](https://jdsupra.com/legalnews/south-carolina-weighs-in-privacy-rights-3750013?ref=thenexusofprivacy.net) Mark Ashton on JD Supra (jdsupra.com) Yesterday, the Supreme Court of South Carolina offered its response to the decision last June by the U.S. Supreme Court in Dobbs v. Jackson Women’s... #### [Colorado AG Updates Draft Rules for Colorado Privacy Act](https://jdsupra.com/legalnews/colorado-ag-updates-draft-rules-for-4232834?ref=thenexusofprivacy.net) Linn Freedman on JD Supra (jdsupra.com) Colorado Attorney General Phil Weiser’s office recently published an updated version of the draft rules governing the Colorado Privacy Act, which goes... #### [In Consumer Tech, Privacy Is A Distant Concern](https://adexchanger.com/ad-exchange-news/tuesday-10012023?ref=thenexusofprivacy.net) AdExchange (adexchanger.com) Consumer tech startups at CES last week seemed blissfully unaware of privacy concerns. #### [Walmart Slammed for Delivery Service That Critics Say Violates Privacy](https://yahoo.com/lifestyle/walmart-slammed-delivery-critics-violates-172832613.html?ref=thenexusofprivacy.net) Zachary Mack on Yahoo Life (yahoo.com) Drone delivery, what could possibly go wrong? #### [Australian Government Serious About Data Privacy: Substantial Increases in Fines and Enhanced Regulatory Powers](https://jdsupra.com/legalnews/australian-government-serious-about-4543816?ref=thenexusofprivacy.net) Daniel Moloney on JD Supra (jdsupra.com) Following a number of high-profile cyber incidents resulting in significant data breaches, the Australian Government has doubled down on its efforts to strengthen privacy laws and cybersecurity resilience, passing the most significant reforms to the *Privacy Act 1988* (Cth) ("Privacy Act") since the introduction of the notifiable data breach scheme in 2017, as well as announcing that it will soon begin consulting on a revised Cybersecurity Strategy for 2023–2030. #### [Demystifying the cookieless future: looking ahead to a new era of privacy](https://thedrum.com/opinion/2023/01/11/demystifying-the-cookieless-future-looking-ahead-new-era-privacy?ref=thenexusofprivacy.net) Federico D’Uva on The Drum (thedrum.com) Rawnet’s Federico D’Uva argues that marketers are missing the point of phasing out cookies, suggesting that now’s the time to reassess how (and why) we exchange data. --- Image Credit: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [picserver.org](https://www.picserver.org/p/privacy.html?ref=thenexusofprivacy.net). ### A much more favorable environment, but a lot of complexity: Washington state privacy legislation 2023 (UPDATED) URL: https://thenexusofprivacy.net/wa-privacy-more-favorable-environment/ Last updated: 2026-04-16T02:58:42.000Z > Last updated February 4\. See the [update log](#update-log) below. > Washington is justifiably looked to as a tech-savvy state, and legislation that gets passed here will influence other states and the national debate. > > – me in [The stakes are high: Washington state privacy, facial recognition, and automated decision systems legislation 2021](https://jedii.tech/wa-privacy-legislation-2021/?ref=thenexusofprivacy.net) The 2023 Washington state legislative session is already in high gear, and once again there's some significant privacy and automated decision systems legislation on the agenda. Even though none of the bills I was excited about in "The stakes are high" wound up passing, Washington state privacy and tech justice advocates have continued to build our power over the last two years. The environment in 2023 is much more favorable than it's ever been for strong privacy legislation – nationally, and in Olympia – so there's good reason for optimism. One of the reasons the legislative environment is much more favorable in 2023 is that privacy threats have become a lot more real to many people in the aftermath of the Supreme Court's *Dobbs* decision overturning Roe. The increasing number of states criminalizing abortion – and allowing "civil enforcement", aka vigilantes and bounty hunters – highlights the urgency of new legislation like **My Health My Data** and the **Shield Law** as well as the broad protections of the **People's Privacy Act**. Before we get to the specifics of this year's legislation, though, let's catch up on where we left off. If you want information about a particular bill, feel free to skip ahead! - [My Health My Data](#MyHealthMyData) - [People's Privacy Act](#PeoplesPrivacyAct) - [Shield Law](#ShieldLaw) ## What's past is prologue If you're just tuning in, here's a quick overview on the multi-year legislative battle in Washington state. The tech industry and their allies have spent the last several years trying but failing to pass the **Bad Washington Privacy Act** (Bad WPA). In 2019, the Senate almost-unanimously advanced it – only Sen. Bob Hasegawa (D-Seattle) voted no. The House had been working on a bill as well, but by the end of the session nothing made it to the House floor for a vote, so nothing passed. [How lobbyists rewrote Washington state’s privacy law](https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.politico.eu%2Farticle%2Fhow-lobbyists-rewrote-washington-state-privacy-law-microsoft-amazon-regulation%2F&data=04%7C01%7C%7Cf06046ac681047b964a808d9bf9c47fc%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C637751500228034582%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=vhXnUzKyit%2BupO4OIUg9DCeOLfoyHGUOUZBfA3%2FdyAI%3D&reserved=0&ref=thenexusofprivacy.net) and [Why Did Washington State’s Privacy Legislation Collapse?](https://www.govtech.com/policy/Why-Did-Washington-States-Privacy-Legislation-Collapse.html?ref=thenexusofprivacy.net) give an overview of the issues. In 2020 once again the version the Senate advanced the Bad WPA overwhelmingly (only Sen. Hasegawa voting no). For calibration, this bill was literally unenforceable (at least according to the AG's Office, who were the only people allowed to enforce it) but everybody agreed that it was an improvement on the 2019 version. After a great hearing and outstanding floor debate, the House strengthened it significantly, and passed a version that was enforceable and included a private right of action – but the Bad WPA's sponsor (whose treasured friend, former Senate colleague is now an Amazon lobbyist) refused to compromise. [A bad day for a bad privacy bill, a good day for privacy](https://medium.com/a-change-is-coming/a-bad-day-for-a-bad-privacy-bill-a-good-day-for-privacy-a2aeea8e8739?ref=thenexusofprivacy.net) and [Significant progress, although still a ways to go (SB 6280/SB 6281 update)](https://medium.com/a-change-is-coming/significant-progress-although-still-a-ways-to-go-sb-6280-sb-6281-update-82972ab8536d?ref=thenexusofprivacy.net) have my pespectives on this and the facial recognition bill. The [**People's Privacy Act**](https://www.aclu-wa.org/story/introducing-people%E2%80%99s-privacy-act-real-privacy-protections-everyone?ref=thenexusofprivacy.net)– developed by the ACLU of Washington working with the community-based groups of the [**Tech Equity Coalition (TEC)**](https://aclu-wa.org/pages/tech-equity-coalition?ref=thenexusofprivacy.net), and introduced by Rep. Shelley Kloba in January 2021 – transformed the legislative discussion even though it hasn't yet gotten a hearing. The state Senate once again passed a (slightly-improved) version Bad WPA overwhelmingly in 2021, with only Sen. Hasegawa voting no, but it died in committee in the House despite the sponsor's negotiating tactic of holding funding for eviction prevention hostage. Eli Sanders' reporting on this was excellent, in [Inside One State’s Fierce Battle Over Online Privacy](https://wildwest.substack.com/p/inside-one-states-fierce-battle-over), [Industry-backed digital privacy bill sees head-spinning changes in Washington state](https://www.geekwire.com/2021/industry-backed-digital-privacy-bill-sees-head-spinning-changes-washington-state/?ref=thenexusofprivacy.net)*,* and [A Digital Privacy Bill Dies in Washington](https://wildwest.substack.com/p/a-digital-privacy-bill-dies-in-washington). [The Clock Ticks Down on the Bad Washington Privacy Act](https://jedii.tech/the-clock-ticks-down-on-the-bad-wpa/?ref=thenexusofprivacy.net) has some of my perspectives near the end of the session. In 2022, Reps. Vandana Slatter and April Berg introduced the Foundational Data Privacy Act (FDPA) in an attempt to make incremental progress, and the People's Privacy Act once again didn't get a hearing. The FDPA started with the BadWPA and the sponsors put a lot of effort in and appeared to have gotten industry to have made some concessions. Privacy advocates were willing to work with the sponsors, but Washington Tech Industry Association (WTIA) continued to back the Bad WPA (hilariously telling legislators to ["stop looking to the past" and adopt a bill they had already rejected three times](https://wa-privacy.net/correcting-misleading-claims-in-wtias-seattle-times-op-ed/?ref=thenexusofprivacy.net)) and after some procedural shenanigans all the FDPA's improvements were removed and it was back to the Bad WPA which (surprise!) failed yet again after a last-minute attempt to sneak it through suffered [another ignominious defeat](https://wa-privacy.net/it-aint-over-till-its-over/?ref=thenexusofprivacy.net#opposition).[1](#notes) On the facial recognition front, Rep. Cindy Ryu' s proposal in 2019 for a moratorium on government use didn't garner enough support of move forward. Instead, [a Microsoft-backed "compromise" bill](https://www.aclu-wa.org/story/we-need-face-surveillance-moratorium-not-weak-regulations-concerns-about-sb-6280?ref=thenexusofprivacy.net) with some basic guardrails passed in 2020\. The bill that passed actually *was* a compromise: implementation was delayed a year to give time for a funded task force to report back to the legislature in time for the 2021 session and potentially make changes. Unfortuantely, Gov. Inslee line-item vetoed the task force. As a result, having legislation in place wound up being a barrier to progress on anything stronger in 2021 and 2022 – exactly as privacy advocates (including me!) had predicted in our testimony in 2020\. Sen. Bob Hasegawa introduced a facial recognition moratorium bill in 2021, but it never got a hearing; neither did the People's Privacy Act, which also included a ban on facial recognition and AI profiling in places of public accommodation. Of course there's a lot this quick summary leaves out, including all kinds of shenanigans by the tech industry (which has a lot of influence here in Washington) to try to sneak the Bad WPA through. In 2021, for example, the Bad WPA's sponsor reportedly threatened to hold eviction funding hostage unless his colleagues passed his bill. Good times! The references at the end have a long list of articles if you want to wallow in the details. Despite their repeated failures here in Washington, big tech has been more successful at getting the Bad WPA adopted elsewhere; it's the basis for privacy laws Virginia, Colorado, and Connecticut. Todd Feathers and Alfred Ng's [Tech Industry Groups Are Watering Down Attempts at Privacy Regulation, One State at a Time](https://themarkup.org/privacy/2022/05/26/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time?ref=thenexusofprivacy.net) and Ben Brody's [Quiet industry lobbyists are watering down state privacy laws](https://www.protocol.com/policy/state-privacy-utah-spsc?ref=thenexusofprivacy.net) look at industry's strategy in more detail. ## Significant successes for Washington privacy advocates As well as stopping the tech industry from passing the BadWPA, Washington privacy advocates also blocked an industry-backed digital identity bill in 2022, and supported the successful Silenced No More Act, protecting whistleblowers. Given the resources Microsoft, Amazon, WTIA, and the rest of the tech industry devote to lobbying here, that's pretty impressive. And there have also been some major successes at the local level: - [King County (home of Seattle, Amazon, and Microsoft) passed the county's first county-wide ban on government use of facial recognition technology](https://www.geekwire.com/2021/seattles-king-county-becomes-first-u-s-county-ban-government-use-facial-recognition-software/?ref=thenexusofprivacy.net) in June 2021 - [Bellingham passed initiatives banning government use of facial recognition and predictive policing](https://peoplefirstbellingham.org/victorystatement/index.html?ref=thenexusofprivacy.net) in November 2021. - Most recently, [Seattle City Council nixed the mayor's request for $1M for the ShotSpotter gunshot detection system](https://www.axios.com/local/seattle/2022/12/01/seattle-shotspotter-cut-budget-police?ref=thenexusofprivacy.net) in November 2022. 2022 also featured involvement in federal privacy legislation debates by WA People's Privacy, Indivisible groups around the state, and grassroots privacy advocates (including me!), supporting the Fourth Amendment Is Not For Sale Act and My Body My Data, and pushing to strengthen the American Data Privacy Protection Act (ADPPA). And, several of us also spoke at the FTC's Public Forum on Commercial Surveillance or submitted formal comments – here's mine, focusing on [Consent, Automated Systems, and Discrimination](https://thenexusofprivacy.net/consent-automated-systems-and-discrimination/). ## New in 2023: My Health My Data > "It's long overdue that we have increased data protections for our most sensitive health data, and it's taken on an increased urgency in a post-Dobbs world. This information, if it's bought or sold, can do real harm." > > – State Representative Vandana Slatter, quoted in Jessica Lyons Hardcastle's [Proposed Washington law puts period-tracking apps on notice](https://www.theregister.com/2023/01/18/washington%5Fperiod%5Ftracking%5Fapps/?ref=thenexusofprivacy.net) in The Register The **My Health My Data Act (**[**HB 1155**](https://app.leg.wa.gov/billsummary?BillNumber=1155&Year=2023&Initiative=false&ref=thenexusofprivacy.net) **/** [**SB 5351**](https://apps.leg.wa.gov/billsummary?BillNumber=5351&Chamber=Senate&Year=2023&ref=thenexusofprivacy.net)**),** which Rep. Slatter is sponsoring along with Sen. Manka Dhingra, responds to the Dobbs decision by providing strong protections for consumer health data. Shawna Mizelle's [Washington state bill would make period-tracking apps follow privacy laws in reflection of post-Roe fears](https://www.cnn.com/2023/01/18/politics/washington-state-period-tracking-apps/index.html?ref=thenexusofprivacy.net) on *CNN* also discusses the bill – which covers a lot more than period-tracking apps! Slatter and Dhingra worked with the Attorney General's office developing the bill, and there is a *lot* to like about it. Here's how the [AG's press release in October](https://www.atg.wa.gov/news/news-releases/ag-ferguson-rep-slatter-sen-dhingra-propose-legislation-protect-washingtonians?ref=thenexusofprivacy.net) describes its key features: - Prohibits organizations from selling Washingtonians’ health data. - Blocks apps and websites — like health tracking apps, search engines and advertisers — from collecting and sharing Washingtonians’ health data without their consent. - Prohibits “geofences” from being used at reproductive and gender affirming health care facilities. Geofences are a virtual perimeter around a physical location that can be used to send messages to a person who enters a specific location. Each of these would be significant advances over existing state privacy laws so there are going to be a lot of lobbyists pushing for weaker protections. That said, there's room for strengthening as well. For example, the bill currently exempts de-identified data, which Sen. Ron Wyden has warned could put people seeking reproductive health care at risk. At the hearing and behind the scenes, expect the [tech industry groups](https://themarkup.org/privacy/2022/05/26/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time?ref=thenexusofprivacy.net) and [lobbyists who water down state privacy laws](https://www.protocol.com/policy/state-privacy-utah-spsc?ref=thenexusofprivacy.net) to try to narrow the definitions of consumer health data, introduce more loopholes and exemptions, and weaken enforcement by claiming that holding companies accountable for the harms they cause by not protecting people's data will "harm innovation" or cause the sky to fall. Microsoft is a wild card and it will be interesting to hear what they have to say. Many of their customers would benefit from a weaker bill, but strong legislation would be good for their business – and they'll face a lot of employee pressure if they aren't pushing for it. > **UPDATE, January 28:** [A very encouraging first step](https://thenexusofprivacy.net/my-health-my-data-encouraging-first-step/) summarizes the House Civil Rights & Judiciary (CR&J) hearing on My Health My Data; [my live-tweeting has more details](https://threadreaderapp.com/thread/1617945841016373248.html?ref=thenexusofprivacy.net). There was great testimony supporting the bill from reproductive freedom, gender justice, health care provider and patient, immigrant, and tech perspectives – in fact there was so much support for the bill that Chair Hansen cut off testimony before WA People's Privacy and several grassroots activists with a technology background could testify which was really unfortunate.[2](#notes) Meanhile industry did as expected: testified OTHER, supported the bill's goals, warned that it would cause the sky to fall, critiqued the bill in the ways I predicted as well as suggesting introducing a get-out-of-jail free card (the "right to cure"),3 removing the "per se" clause4 and allowing some geofencing as long as it wasn't "precise". Next step is a potential executive session on Wednesday February 1 where they will consider amendments and vote on whether to advance the bill. > **UPDATE, February 4:** CR&J advanced a weakened substitute version of the bill on a party-line vote (although one Democrat said she'd vote against it on the floor unless it were further weakened). [A watered-down substitute advances](https://thenexusofprivacy.net/a-watered-down-substitute-advances/) discusses the changes in more detail. ## The People's Privacy Act: closer to a hearing than it's ever been ACLU webinar on the People's Privacy Act, 2021\. [Here's the slides.](https://docs.google.com/presentation/d/e/2PACX-1vQqH8q9rE3yy5NVglh2WfOSh%5FhQO1EJ3%5FqcUlXD%5Fty%5FtL-Qx5kJUGhkS%5FK0BoP4H3fU1SlNrIM9xNai/pub?ref=thenexusofprivacy.net#slide=id.g8c2c1d9496%5F0%5F57) The [**People's Privacy Act**](https://www.aclu-wa.org/story/introducing-people%E2%80%99s-privacy-act-real-privacy-protections-everyone?ref=thenexusofprivacy.net) ([HB 1616](https://app.leg.wa.gov/billsummary?BillNumber=1616&Year=2023&Initiative=false&ref=thenexusofprivacy.net) / SB 5463), introduced by Rep. Shelley Kloba (with bipartisan co-sponsorship) and Sen. Bob Hasegawa, broadens My Health My Data's opt-in consent requirements to other personal data – and covers government agencies as well as the private sector. In addition, the People's Privacy Act also - makes it unlawful for companies and government agencies to use people’s personal information to discriminate - bans facial recognition technology and AI-enabled profiling in any place of public accommodation (e.g., restaurants, hotels, theaters, pharmacies, parks, schools, and stores) ACLU's [Introducing the People’s Privacy Act: Real Privacy Protections for Everyone](https://www.aclu-wa.org/story/introducing-people%E2%80%99s-privacy-act-real-privacy-protections-everyone?ref=thenexusofprivacy.net), from 2021, has more details of the previous version; I haven't looked in any detail yet at this year's version, but from my understanding it's mostly similar. The tech industry really doesn't want discussion of bills like this – it highlights how weak bills like the Bad WPA are by comparison – and thus far has been successfully using its influence to block discussion. The People's Privacy Act didn't get a hearing in either of the last two years, which is kind of disappointing since it's had broad support from privacy, civil rights, immigrant rights, and civil liberties organizations ever since Rep. Shelley Kloba first introduced it in 2021\. Again, though, it's a more favorable environment in 2023\. Since last session, dozens of civil rights, privacy, and public interest groups wrote to Congress and submitted FTC comments about the importance of anti-discrimination protections and privacy as a civil right that align very much with the People's Privacy Act – and it also aligns well with My Health My Data's emphasis on opt-in consent. So hopefully third time's a charm and the People's Privacy Act *will* get a hearing this year. If and when that happens, expect tech industry to claim that it will cause the sky to fall and press to weaken it. Amidst the overwrought objections, there may also be some legitimate areas for improvement. Privacy advocates are likely to be supportive, and some may even push to strengthen it – for example introduce a duty of loyalty, or broaden it to include employee protections similar to the recently-introduced Massachusetts Data Privacy and Protection Act. ## The Shield Law: "Concerning access to reproductive health care services and gender-affirming treatment in Washington state." The Shield Law (SB 5489 / HR 1469), introduced by Sen. Yasmin Trudeau and Rep. Drew Hansen, would protect abortion providers, patients, and helpers in Washington state by putting up barriers to out-of-state investigations from states that criminalize providing or accessing abortion or gender-affirming care in Washington state. Here's how Pro-Choice Washington describes it: > "With the loss of *Roe v. Wade*, patients from states with abortion bans now rely on states like Washington to provide the care they need. In fact, the Guttmacher Institute estimates that there will be 385% more out-of-state patients expected to seek abortions in Washington than before Roe was overturned. But providers and patients face frightening uncertainty about whether they could be criminalized for seeking or providing legal abortion care in Washington. By passing a shield law, Washington can provide lifesaving refuge to patients and protect the health care workers who provide these vital services. Legal Voice and ACLU of Washington also support this bill. It had hearings on Tuesday, January 24 at 10:30 am in the Senate Law & Justice Committee and House Civil Rights & Judiciary Committee. Later that week, Senate Law & Justice advanced the original bill without amendments; House Civil Rights & Judiciary advanced a substitute with [a fair number of changes](https://app.leg.wa.gov/committeeschedules/Home/Document/249819?ref=thenexusofprivacy.net#toolbar=0&navpanes=0). ## Automated Decision Systems (ADS) Regulation What are Automated Decision Systems and why you should care: a webinar by Washington State Chief Privacy Officer Katy Ruckle and me Also important from a privacy and tech justice perspective is Sen. Bob Hasegawa's **Automated Decision Systems (ADS) Regulation**, which establishes minimum standards for fairness, accountability, and transparency in government use of these systems. Tech Equity Coalition groups and other privacy advocates have supported this bill since it was first introduced in 2021; several, including me, worked with agency leads on the state [Automated Decision Systems workgroup](https://watech.wa.gov/privacy/projects-and-initiatives?ref=thenexusofprivacy.net). In the video above, Washington State Chief Privacy Officer Katy Ruckle and I discuss the recommendations and the current work inventorying state ADS systems. While state governemnt agencies agreed with the recommendations in the workgroup report, they pushed back on the 2022 version of the ADS bill, arguing that it would put the systems our state government depends on at risk. Sen. Hasegawa's made some revisions, hopefully addressing their concerns. And since the last session, a litany of stories of algorithmic abuses has kept the spotlight on the issue, and the White House Office of Science and Technology Policy's Draft AI Bill of Rights has provided strong recommendations for ADS regulation. ADS Regulation has been assigned to the Senate Energy, Environment, and Technology committee, unlike last year when it went to State Government. ENET's chaired by Sen. Joe Nguyen, and it's not clear what he thinks of the bill. We'll see how things go. ## Stay tuned! Bills are supposed to advance through their initial committee by Friday, February 17, so the picture will start to come into focus fairly quickly (although there are ways for bills can stay alive even if they miss deadlines). This session ends on Sunday April 23, and privacy legislation has gone down to the wire the last four years. It ain't over 'til it's over! Right now, though, it's not even close to being over – in fact we've only just started. Stay tuned! ## References ### 2022 **Narrative** - [It’s time for Washington to pass strong privacy legislation!](https://wa-privacy.net/2022-leg-priview/?ref=thenexusofprivacy.net) - [WA Privacy Legislation Update – February 14 💘](https://wa-privacy.net/legislation-update-021422/?ref=thenexusofprivacy.net) - [The situation is … fluid – March 4 (late-night update)](https://wa-privacy.net/the-situation-is-fluid/?ref=thenexusofprivacy.net) - [It ain’t over till it’s over – March 7-10 ](https://wa-privacy.net/it-aint-over-till-its-over/?ref=thenexusofprivacy.net) **Op-eds and open letters** - [Tech Equity Coalition letter to the Washington state House of Representatives](https://wa-privacy.net/tech-equity-coalition-letter-021422/?ref=thenexusofprivacy.net) - [Indivisble privacy letter to CRJ committee, January 24](https://indipluswa.medium.com/indivisble-privacy-letter-to-crj-committee-january-24-c4b39150d8e3?ref=thenexusofprivacy.net) - [Support legislation that enacts data privacy](https://www.kitsapsun.com/story/opinion/readers/2022/01/30/support-legislation-enacts-data-privacy/9261220002/?ref=thenexusofprivacy.net), Carollynn Zimmers, *Kitsap Sun* - [Data privacy bills favor tech companies over people](https://www.heraldnet.com/opinion/data-privacy-bills-favor-tech-companies-over-people/?ref=thenexusofprivacy.net), Naomi Dietrich, *Everett Herald* - [Tech Companies Want to Write Their Own Rules on Data Privacy. Don’t Let Them](https://southseattleemerald.com/2022/02/24/opinion-tech-companies-want-to-write-their-own-rules-on-data-privacy-dont-let-them/?ref=thenexusofprivacy.net), Hillary Hayden and Brianna Auffray, *South Seattle Emerald* - [Fact Check: WA’s Leadership on Privacy Legislation](https://www.aclu-wa.org/story/fact-check-was-leadership-privacy-legislation?ref=thenexusofprivacy.net#overlay-context=), Jennifer Lee and Maya Morales - [A Deep Dive into the Affiliates Loophole](https://wa-privacy.net/affliates-loophole/?ref=thenexusofprivacy.net) **Federal privacy legislation** - Washington Indivisible groups' June 13 [Letter to Sen. Cantwell and Rep. McMorris Rodgers on federal privacy legislation](https://medium.com/@indipluswa/indivisible-letter-to-sen-cantwell-and-rep-mcmorris-rodgers-on-federal-privacy-legislation-8071ba1d350e?ref=thenexusofprivacy.net) - WA People's Privacy founder Maya Morales' [Comments at California Privacy Protection Agency board meeting](https://wapeoplesprivacy.org/our-public-comment-in-historic-ccpa-meeting/?ref=thenexusofprivacy.net) - Washington Indivisible groups' September 14 [Privacy one-pager](https://medium.com/@indipluswa/washington-indivisible-federal-privacy-one-pager-add67a8c1453?ref=thenexusofprivacy.net) - Washington Indivisible groups November 28 letter: [Please only advance ADPPA if it is strengthened significantly](https://medium.com/@indipluswa/washington-indivisibles-please-only-advance-adppa-if-it-is-strengthened-significantly-9701286f7c07?ref=thenexusofprivacy.net) - WA People's Privacy-led November 30 letter to Rep. Jayapal and the Progressive Caucus: [Please Co-sponsor & Pass the Fourth Amendment Is Not For Sale Act](https://wapeoplesprivacy.org/about/fanfsaletter11-30-2022/?ref=thenexusofprivacy.net) - WA People’s Privacy-led December 17 letter to Speaker Pelois: [Request to block H.R. 8152, ADPPA, from a floor vote unless it is first strengthened in the specific ways enclosed](https://wapeoplesprivacy.org/about/addpaletter-pelosi-12-16-22/?ref=thenexusofprivacy.net) - Washington privacy advocates letter to the WA Congressional delegation: [Thank you for not passing ADPPA this session – and we look forward to working with you on privacy in 2023](https://wa-privacy.net/thank-you-for-not-passing-adppa/?ref=thenexusofprivacy.net) ### 2021 **Narrative** - [The stakes are high: Washington state privacy, facial recognition, and automated decision making legislation 2021](https://jedii.tech/wa-privacy-legislation-2021/?ref=thenexusofprivacy.net) - [European-style data privacy bill returns](https://www.seattletimes.com/seattle-news/politics/european-style-data-privacy-bill-returns-as-washington-state-lawmakers-ponder-new-regulations/?ref=thenexusofprivacy.net) (Joseph O’Sullivan, *Seattle Times*), discussing the Senate hearing - [Criticism and praise at the hearing for SB 5062 (the Bad Washington Privacy Act)](https://jedii.tech/criticism-and-praise-for-at-the-hearing-for-sb-5062-the-bad-washington-privacy-act/?ref=thenexusofprivacy.net) - [Inside One State’s Fierce Battle Over Online Privacy](https://wildwest.substack.com/p/inside-one-states-fierce-battle-over) (Eli Sanders, *Wild West)* - [Industry-backed digital privacy bill sees head-spinning changes in Washington state](https://www.geekwire.com/2021/industry-backed-digital-privacy-bill-sees-head-spinning-changes-washington-state/?ref=thenexusofprivacy.net) (Eli Sanders, *GeekWire*) - [The Clock Ticks Down on the Bad Washington Privacy Act](https://jedii.tech/the-clock-ticks-down-on-the-bad-wpa/?ref=thenexusofprivacy.net) - [Washington Privacy Act goes 0 for 3](https://iapp.org/news/a/washington-privacy-act-fails-for-third-straight-year/?ref=thenexusofprivacy.net), perspectives from lobbyists Jim Halpert of DLA Piper and Samantha Kersul of TechNet - [A Digital Privacy Bill Dies in Washington](https://wildwest.substack.com/p/a-digital-privacy-bill-dies-in-washington) (Eli Sanders, *Wild West*) **Op-eds and letters to the editor** - [The People’s Privacy Act, not the Washington Privacy Act, is the better bill to protect consumers’ civil rights and civil liberties](https://www.seattletimes.com/opinion/con-the-peoples-privacy-act-not-the-washington-privacy-act-is-the-better-bill-to-protect-consumers-civil-rights-and-civil-liberties?ref=thenexusofprivacy.net), Jennifer Lee of ACLU of Washington, *Seattle Times* - [Real Electronic Data Protection Is Opt In](https://demcastusa.com/2021/04/10/real-electronic-data-protection-is-opt-in/?ref=thenexusofprivacy.net) , Brandy Donaghy, *Demcast* - [The Washington Privacy Act: Insufficient for the immigrant, refugee communities we serve](https://iexaminer.org/interims-corner-the-washington-privacy-act-insufficient-for-the-immigrant-refugee-communities-we-serve/?ref=thenexusofprivacy.net), Derek Lum of Interim CDA in the *International Examiner* - [Silence is Not Consent](https://www.aclu-wa.org/story/silence-not-consent?ref=thenexusofprivacy.net) by Emilie St. Pierre of Future Ada - [The Bad Washington Privacy Act: An Illusion of Rights And As Cher Would Say, “What a Monet”](https://jedii.tech/the-bad-washington-privacy-act-an-illusion-of-rights-and-as-cher-would-say-what-a-monet/?ref=thenexusofprivacy.net) Deborah Pierce - [The illusion of protection and SB 5062 (the Bad Washington Privacy Act)](https://jedii.tech/the-illusion-of-protection/?ref=thenexusofprivacy.net) - [The Washington Privacy Act: Not a model for state privacy law](https://ngreggbrown.medium.com/the-washington-privacy-act-not-a-model-for-state-privacy-law-5a484813ab2e?ref=thenexusofprivacy.net), N. Gregg Brown - [Data Privacy Unlocked, A Conversation with Representative Shelley Kloba of Washington State](https://www.jdsupra.com/legalnews/data-privacy-unlocked-a-conversation-wi-67790/?ref=thenexusofprivacy.net), a podcast on JD Supra, July 2021 ### 2020 - [A bad day for a bad privacy bill, a good day for privacy](https://medium.com/a-change-is-coming/a-bad-day-for-a-bad-privacy-bill-a-good-day-for-privacy-a2aeea8e8739?ref=thenexusofprivacy.net) : the House Civil Rights and Judiciary Committee hearing on the Bad Washington Privacy Act - [Significant progress, although still a ways to go (SB 6280/SB 6281 update)](https://medium.com/a-change-is-coming/significant-progress-although-still-a-ways-to-go-sb-6280-sb-6281-update-82972ab8536d?ref=thenexusofprivacy.net) - [Washington Privacy Act fails for second time](https://iapp.org/news/a/washington-privacy-act-fails-for-second-time/?ref=thenexusofprivacy.net), with perspectives from Sen Carlyle and Republican Rep. Norma Smith (R-10, long-time privacy champion who retired after the session). ### Industry lobbying strategy - [How Big Tech is quietly pushing for watered-down state privacy laws](https://www.grid.news/story/technology/2022/04/11/big-tech-turns-to-an-old-industry-playbook-when-passing-state-privacy-legislation/?ref=thenexusofprivacy.net)(Benjamin Powers on *Grid*) - [Tech Industry Groups Are Watering Down Attempts at Privacy Regulation, One State at a Time](https://themarkup.org/privacy/2022/05/26/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time?ref=thenexusofprivacy.net) (Todd Feathers and Alfred Ng on *The Markup*) - [The Amazon lobbyists who kill U.S. consumer privacy protections](https://www.reuters.com/investigates/special-report/amazon-privacy-lobbying/?ref=thenexusofprivacy.net)(Jeffrey Dastin, Chris Kirkham, Aditya Kalra on *Reuters*) - [Big Tech Is Pushing States to Pass Privacy Laws, and Yes, You Should Be Suspicious](https://themarkup.org/privacy/2021/04/15/big-tech-is-pushing-states-to-pass-privacy-laws-and-yes-you-should-be-suspicious?ref=thenexusofprivacy.net) (Todd Feathers on The *Markup*) ## Notes 1 although the Bad Washington Privacy Act has been more successful elsewhere – it's the basis for Virginia's, Colorado's, and Connecticut's privacy bills). 2 Just as Chair Hansen did at Civil Rights & Judiciary committee hearing on the Bad Washington Privacy Act two years ago ... hey wait a second, I'm noticing a pattern here! 3 Consmer Reports used the "get-out-of-jail free card" analogy in their 2021 letter, and AG Ferguson has previously described the right-to-cure as "anti-consumer". But industry insists on having this fight every year. 4 They never give up, do they? 2020's [A bad day for a bad privacy bill, a good day for privacy](https://medium.com/a-change-is-coming/a-bad-day-for-a-bad-privacy-bill-a-good-day-for-privacy-a2aeea8e8739?ref=thenexusofprivacy.net) includes an excerpt of Andrea Alegrett's testimony on why the Bad Washingtonn Privacy Act's lack of a "per se" clause made it unenforceable. Industry conceded on this in 2021 and that year's version of Bad Washington Privacy Act included a per se clause so it is disappointing that they had their fingers crossed ... although not surprising. Footnote 2 in [The elephant and the lame duck: ADPPA after the midterms (a federal privacy legislation update)](https://thenexusofprivacy.net/the-elephant-and-the-lame-duck/) discusses how the per se issue came up last summer (and will probably come back up again soon) in the proposed American Data Privacy Protection Act. ## Update log *Note: I've also made typo fixes and minor wording changes along the way without adding them here.* January 11 . Originally published as "A much more favorable environment," before several of the bills had officially been introduced January 22-23: Revised as "A much more favorable environment, but a lot of complexity" January 28: Updated baed on My Health My Data and Shield Law hearings February 4: Mention that My Health My Data advanced, add ADS section. I had originally written this when I first published the article but the ADS bill's prospects were so uncertain, that I took it out. Now that the bill's likely to get a hearing, I put it back. ### Privacy News: January 9 URL: https://thenexusofprivacy.net/privacy-news-january-9/ Last updated: 2023-01-09T18:04:42.000Z Lots of surveillance stories, fines for Facebook, Google, and Apple, and much much more! ## Surveillance ### [Fighting ‘Big Brother’: Anti-surveillance advocates in New York seek to halt creeping proliferation of cameras and tracking software](https://amny.com/politics/anti-surveillance-advocates-new-york-big-brother?ref=thenexusofprivacy.net) Ben Brachfeld on amNewYork (amny.com) Anti-surveillance activists are working with progressive lawmakers in Albany seeking to curtail the proliferation of “Big Brother” as as government and corporate surveillance become an increasing part of everyday life. The coalition plans to unveil on Monday a 10-point blueprint to make New York a “sanctuary state” against surveillance, starting with bills to ban “geofence warrants” and prohibit police from using fake social media accounts to ensnare suspects. ### [Conservative group targets migrant cell phone data at NGOs, raising privacy concerns](https://www.tpr.org/border-immigration/2023-01-06/conservative-group-targets-migrant-cell-phone-data-at-ngos-raising-privacy-concerns?ref=thenexusofprivacy.net) Pablo De La Rosa on Texas Public radio (tpr.org) The Heritage Foundation locked on to the locations of at least 30,000 cell phones at non-government (NGO) migrant aid shelters and Customs and Border Protection (CBP) facilities. The Washington D.C.-based conservative think-tank then continued tracking the movement of the devices across the country over the course of at least a month in January 2022\. Catholic Charities of the Rio Grande Valley and the Del Rio and Val Verde CBP processing stations in Texas were among the more than 30 migrant facilities that were “geofenced” for data tracking in a [report released in December](https://npr.brightspotcdn.com/b1/d8/c4d36a40448e8dde7806cfc28b61/borderngomemo.pdf?ref=thenexusofprivacy.net) by Heritage. ### [San Francisco Police Are Using Driverless Cars as Mobile Surveillance Cameras](https://vice.com/en/article/v7dw8x/san-francisco-police-are-using-driverless-cars-as-mobile-surveillance-cameras?ref=thenexusofprivacy.net) Aaron Gordon on vice.com “Autonomous vehicles are recording their surroundings continuously and have the potential to help with investigative leads,” an internal training document states. ### [Tracked, detained, vilified: How China throttled anti-covid protests](https://washingtonpost.com/world/2023/01/04/china-surveillance-protests-security?ref=thenexusofprivacy.net) Cate Cadell on The Washington Post (washingtonpost.com) After widespread protests, China relaxed its strict covid controls. But on the protesters themselves, the government unleashed a police state brimming with new surveillance technology. ### [Controversial Facial Recognition Software Has Been Implemented At Airports Across America - How Will Travelers Respond?](https://forbes.com/sites/willmcgough/2023/01/06/controversial-facial-recognition-software-has-been-implemented-at-airports-across-americahow-will-travelers-respond?ref=thenexusofprivacy.net) Will McGough on Forbes (forbes.com) The program claims to make security screening faster and safer. But there are privacy and data concerns as well. ## Facebook, Google, and Apple fined ### [Meta prohibited from use of personal data for advertisment](https://noyb.eu/en/breaking-meta-prohibited-use-personal-data-advertising?ref=thenexusofprivacy.net) noyb (noyb.eu) This is a big one, because the Irish Data Protection Commission not only handed out a big fine, it required Facebook, Instagram and WhatsApp to get opt-in consent to use the personal data of users for behavioral advertizing in the EU. Of course, Facebook et al will no doubt try to come up with another legal basis for using the data, at which point there will be another court case, but this is the biggest threat yet to their business model. Kudos to noyb, which first brought the complaint five years ago! ALSO: - [€390M fine strikes blow to Meta’s ad-fueled business model](https://politico.eu/article/meta-fina-ad-business-model?ref=thenexusofprivacy.net), Vincent Manancourt on POLITICO (politico.eu) - [The Slow Death of Surveillance Capitalism Has Begun](https://wired.com/story/meta-surveillance-capitalism?ref=thenexusofprivacy.net), Morgan Meaker on WIRED on (wired.com) - [Meta’s Ad Practices Ruled Illegal Under E.U. Law](https://nytimes.com/2023/01/04/business/meta-facebook-eu-gdpr.html?ref=thenexusofprivacy.net), Adam Satariano on NYTimes (nytimes.com) - [Refresher: The GDPR’s Six Legal Bases for Data Processing](https://iapp.org/resources/article/refresher-the-gdprs-six-legal-bases-for-data-processing/?ref=thenexusofprivacy.net), Müge Fazlioglu, IAPP (iapp.org) - [Could the EU’s decision against Meta affect data privacy policies in the U.S.?](https://healthcareitnews.com/news/could-eus-decision-against-meta-affect-data-privacy-policies-us?ref=thenexusofprivacy.net) Andrea Fox on Healthcare IT News (healthcareitnews.com) - [Meta to appeal £345m fine for Facebook and Instagram privacy breaches](https://computerweekly.com/news/252528915/Meta-to-appeal-345m-fine-for-Facebook-and-Instagram-privacy-breaches?ref=thenexusofprivacy.net), Bill Goodwin, on ComputerWeekly.com (computerweekly.com) - [The Irish Data Protection Commission's announcement](https://dataprotection.ie/en/news-media/data-protection-commission-announces-conclusion-two-inquiries-meta-ireland?ref=thenexusofprivacy.net) - [How Meta Uses Legal Bases for Processing Ads in the EU](https://about.fb.com/news/2023/01/how-meta-uses-legal-bases-for-processing-ads-in-the-eu?ref=thenexusofprivacy.net), Meta's laughable response ### [Apple fined €8M in French privacy case](https://politico.eu/article/apple-fined-e8-million-in-privacy-case?ref=thenexusofprivacy.net) Laura Kayali on POLITICO (politico.eu) France’s data protection authority CNIL has fined Apple €8 million for privacy violations. The regulator found that the U.S. tech giant did not "obtain the consent of French iPhone users (iOS 14.6 version) before depositing and/or writing identifiers used for advertising purposes on their terminals," [according to a statement](https://www.cnil.fr/fr/identifiant-publicitaire-sanction-de-8-millions-deuros-lencontre-de-apple-distribution-international?ref=thenexusofprivacy.net) released Wednesday. ALSO: - [CNIL Fines Apple 8 Million Euros Over Personalized Ads](https://natlawreview.com/article/cnil-fines-apple-8-million-euros-over-personalized-ads?ref=thenexusofprivacy.net), Hunton Andrews Kurth’s Privacy and Cybersecurity on The National Law Review (natlawreview.com) ### [Google to Pay $23 Million in Search Privacy Deal With Users ](https://news.bloomberglaw.com/privacy-and-data-security/google-to-pay-23-million-in-search-terms-settlement-with-users?ref=thenexusofprivacy.net) Andrea Vittorio on Bloomberg Law (news.bloomberglaw.com) Alphabet Inc.’s Google agreed to pay $23 million to resolve a long-running lawsuit brought by consumers who claimed its search engine shared their queries with advertisers or other third parties without their permission. ALSO: - [Google Agrees to Pay $23 Million Over Privacy Issues, Report Says](https://cnet.com/news/privacy/google-agrees-to-pay-23-million-over-privacy-issues-report-says?ref=thenexusofprivacy.net), Oscar Gonzalez on CNET (cnet.com) ## State privacy law ### [All things ‘California Privacy Law’ with Lothar Determann](https://iapp.org/news/a/all-things-california-privacy-law-with-lothar-determann?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) IAPP Editorial Director Jedidiah Bracy, CIPP, chats with Lothar Determann about the new edition of ‘California Privacy Law.’ ALSO: - [California Privacy Law, Fifth Edition (Digital)](https://iapp.org/store/books/a191P000003hpHeQAI?ref=thenexusofprivacy.net), Lothar Determann, the new edition ## And ... #### [Twitter leak: 200m+ account database now free to download](https://theregister.com/2023/01/05/twitter%5Fleak%5F200m%5Faccounts?ref=thenexusofprivacy.net) Jessica Lyons Hardcastle on The Register (theregister.com) No passwords, but planety of stuff for social engineering and doxxing. ALSO: - [Data From 200 Million Twitter Users Offered For Free On Hacker Forum](https://forbes.com/sites/petersuciu/2023/01/04/data-from-200-million-twitter-users-offered-for-free-on-hacker-forum?ref=thenexusofprivacy.net), Peter Suciu on Forbes (forbes.com) #### [Meet The Spy Tech Companies Helping Landlords Evict People](https://vice.com/en/article/xgy9k3/meet-the-spy-tech-companies-helping-landlords-evict-people?ref=thenexusofprivacy.net) Nick Keppler on vice.com The growing ‘proptech’ industry is now explicitly marketing surveillance tech as a way to evict tenants and raise rent. #### [Adobe will use your work to train its AI algorithms](https://theregister.com/2023/01/07/adobe%5Fai%5Ftraining?ref=thenexusofprivacy.net) Katyanna Quach on The Register (theregister.com) Content analysis system scans data stored on its Creative Cloud services #### [Advancing ethics review practices in AI research - Nature Machine Intelligence](https://nature.com/articles/s42256-022-00585-2?ref=thenexusofprivacy.net) Madhulika Srikumar on Nature (nature.com) The implementation of ethics review processes is an important first step for anticipating and mitigating the potential harms of AI research. Its long-term success, however, requires a coordinated community effort, to support experimentation with different ethics review processes, to support experimentation with different ethics review processes, to study their effect, and to provide opportunities for diverse voices from the community to share insights and foster norms. #### [It’s 2023, and tech is still pushing unsafe products](https://washingtonpost.com/technology/2023/01/08/ces-worst-products-safety-privacy?ref=thenexusofprivacy.net) Tatum Hunter on The Washington Post (washingtonpost.com) CES brings a flood of new products for consumers — often with little vetting from their makers. #### [Back into the Trenches of the Crypto Wars](https://themarkup.org/hello-world/2023/01/07/back-into-the-trenches-of-the-crypto-wars?ref=thenexusofprivacy.net) Julia Angwin on The Markup (themarkup.org) A conversation with Meredith Whittaker #### [Apple wins US biometric privacy case on appeal](https://biometricupdate.com/202301/apple-wins-us-biometric-privacy-case-on-appeal?ref=thenexusofprivacy.net) Jim Nash on BiometricUpdate.com (biometricupdate.com) Apple does not violate BIPA by offering owners of its mobile devices the ability to unlock the operating system using their fingerprint or face. #### [Global Spyware Scandal: Exposing Pegasus](https://pbs.org/wgbh/frontline/documentary/global-spyware-scandal-exposing-pegasus?ref=thenexusofprivacy.net) on FRONTLINE (pbs.org) “Global Spyware Scandal: Exposing Pegasus,” a 2-part documentary from FRONTLINE and Forbidden Films, reveals how the NSO Group’s Pegasus spyware was used on journalists, activists, and others. #### [The Hidden Cost of Cheap TVs](https://theatlantic.com/technology/archive/2023/01/smart-tvs-sony-lg-cheap/672614?ref=thenexusofprivacy.net) Justin Pot on The Atlantic (theatlantic.com) Screens have gotten inexpensive—and they’re watching you back. #### [5 reasons why data privacy compliance must take center stage in 2023](https://venturebeat.com/security/5-reasons-why-data-privacy-compliance-must-take-center-stage-in-2023?ref=thenexusofprivacy.net) Ameesh Divatia, Baffle, Inc. on VentureBeat (venturebeat.com) Companies that are proactive in their data privacy and security compliance approaches will find themselves in an enviable position in 2023. #### [You must now verify your drivers license to watch Pornhub in Louisiana](https://techcrunch.com/2023/01/03/you-must-now-verify-your-drivers-license-to-watch-pornhub-in-louisiana?ref=thenexusofprivacy.net) Amanda Silberling on TechCrunch (techcrunch.com) At the start of the year, a new law went into effect in Louisiana that requires age verification checks on porn sites. #### [The ‘godfather of crypto’ wants to create a privacy-focused CBDC: Here’s how](https://cointelegraph.com/news/the-godfather-of-crypto-wants-to-create-a-privacy-focused-cbdc-here-s-how?ref=thenexusofprivacy.net) Erhan Kahraman on Cointelegraph (cointelegraph.com) David Chaum explains his game plan to create a central bank digital currency (CBDC) that would also be appreciated by the crypto ecosystem in an exclusive interview. #### [Facial recognition error led to wrongful arrest of Black man, report says](https://arstechnica.com/tech-policy/2023/01/facial-recognition-error-led-to-wrongful-arrest-of-black-man-report-says?ref=thenexusofprivacy.net) Jon Brodkin on Ars Technica (arstechnica.com) Lawyer says police didn’t check man’s height, weight—or the mole on his face. #### [Crystal ball privacy in 2023: US states, kids and AI](https://iapp.org/news/a/crystal-ball-privacy-in-2023-us-states-kids-and-ai?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) Goodwin Procter Partner and IAPP Senior Fellow Omer Tene offers a look ahead at privacy in the U.S. for the upcoming year. #### [The Silicon Ceiling: How Artificial Intelligence Constructs an Invisible Barrier to Opportunity](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4318860&ref=thenexusofprivacy.net) See all articles by Elana Zeide on papers.ssrn.com Algorithmic assessments increasingly shape individuals’ success in education and employment. Schools, recruiters, and companies now rely on automated platforms #### [Apple’s Illinois Biometric Privacy Win Expands Compliance Tools](https://news.bloomberglaw.com/privacy-and-data-security/apples-illinois-biometric-privacy-win-expands-compliance-tools?ref=thenexusofprivacy.net) Skye Witley on Request a Free Demo (news.bloomberglaw.com) Companies gained a limited new edge in defending their compliance with Illinois’ biometric privacy law, following a recent state appeals court ruling that Apple Inc.’s face and finger identification tools don’t violate the statute. #### [California’s Sephora Settlement Puts Consumer Privacy First](https://securityboulevard.com/2023/01/californias-sephora-settlement-puts-consumer-privacy-first?ref=thenexusofprivacy.net) Jonathan Joseph on Security Boulevard (securityboulevard.com) Last fall, California drew first blood when it agreed to a $1.2 million settlement with Sephora over the cosmetics company’s violations of the California #### [Billie Eilish Got Doxxed on the Citizen App](https://gizmodo.com/billie-eilish-citizen-app-doxxed-burglary-1849958899?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) The Citizen app reportedly sent a push notification with Billie Eilish’s address to 78,000 people as her home was being burglarized. #### [Controversy illuminates rise of facial recognition in private sector](https://abcnews.go.com/Business/controversy-illuminates-rise-facial-recognition-private-sector/story?id=96116545&ref=thenexusofprivacy.net) ABC News on ABC News (abcnews.go.com) Facial recognition software was used bar an audience member from a New York City theater. #### [Health authority failed to properly report privacy breach, N.W.T. privacy commissioner says](https://ca.news.yahoo.com/health-authority-failed-properly-report-130000195.html?ref=thenexusofprivacy.net) CBC on Yahoo News (ca.news.yahoo.com) The N.W.T. information and privacy commissioner said the territory’s health authority failed to properly report a privacy breach involving personal medical information that was mistakenly shared with the wrong patient. The commissioner found that the department violated the Health Information Act by… #### [The latest lesson on biometric data privacy could cost people’s lives](https://biometricupdate.com/202301/the-latest-lesson-on-biometric-data-privacy-could-cost-peoples-lives?ref=thenexusofprivacy.net) Jim Nash on BiometricUpdate.com (biometricupdate.com) Two United States government documents about the use of biometric identification in occupied Afghanistan lack any mention of data security on the ground. #### [Pivotal Moments In Data Privacy History](https://informationweek.com/big-data/pivotal-moments-in-data-privacy-history?ref=thenexusofprivacy.net) Brandon Taylor on InformationWeek (informationweek.com) In the last 18 years, the internet has evolved at warp speed to keep up with busier lives and a craving for mobility, while also trading access for privacy. #### [Germany could become MEPs’ ally in AI Act negotiations](https://euractiv.com/section/artificial-intelligence/news/germany-could-become-meps-ally-in-ai-act-negotiations?ref=thenexusofprivacy.net) Luca Bertuzzi on EURACTIV (euractiv.com) Inter-institutional negotiations on the AI Act are expected later this year, and while the EU Council has reached its position, Germany has reservations on certain points that bring it closer to the European Parliament’s position than that of other member states. #### [Researchers Could Track the GPS Location of All of California’s New Digital License Plates](https://vice.com/en/article/wxn9vx/researchers-track-reviver-digital-license-plate-gps-location?ref=thenexusofprivacy.net) on vice.com After gaining access to a powerful administrative account, the researchers could perform all sorts of tasks inside Reviver, the sole company that sells the digital plates in California. #### [How do ‘technical’ design-choices made when building algorithmic decision-making tools for criminal justice authorities create constitutional dangers? (Part I)](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4319307&ref=thenexusofprivacy.net) See all articles by Karen Yeung on papers.ssrn.com This two-part paper argues that seemingly ‘technical’ choices made by developers of machine-learning based algorithmic tools used to inform decisions by crimina #### [Meta fined $414m for using personal data without consent](https://theregister.com/2023/01/04/meta%5Ffined%5F390%5Ffor%5Fusing?ref=thenexusofprivacy.net) Brandon Vigliarolo on The Register (theregister.com) Facebook, Insta told to pay up, make changes to data slurping process within 3 months #### [Palantir’s Covid-era UK health contract extended](https://theregister.com/2023/01/04/palantirs%5Fcovidera%5Fuk%5Fhealth%5Fcontract?ref=thenexusofprivacy.net) Lindsay Clark on The Register (theregister.com) US spy-tech firm’s controversial work with patient data pushed out 6 months due to delayed data platform procurement ALSO: - [NHS Palantir contract extension may mean more legal threats](https://theregister.com/2023/01/06/nhs%5Fengland%5Fpalantir%5Fcontract%5Fextention?ref=thenexusofprivacy.net), Lindsay Clark on The Register (theregister.com) #### [The Silicon Ceiling: How Artificial Intelligence Constructs an Invisible Barrier to Opportunity](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4318860&ref=thenexusofprivacy.net) See all articles by Elana Zeide on papers.ssrn.com Algorithmic assessments increasingly shape individuals’ success in education and employment. Schools, recruiters, and companies now rely on automated platforms #### [No more holidays for US telcos, FCC is cracking down](https://theregister.com/2023/01/08/in%5Fbrief%5Fsecurity?ref=thenexusofprivacy.net) Brandon Vigliarolo on The Register (theregister.com) Also, LastPass faces class action, and Louisiana says that, while the internet may be for porn, ID is still required --- Image Credit: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) licensed under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) from [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [*Picpedia*](https://www.picpedia.org/highway-signs/p/privacy.html?ref=thenexusofprivacy.net). ### Privacy News: January 3 URL: https://thenexusofprivacy.net/privacy-news-january-3/ Last updated: 2023-01-03T17:21:43.000Z Looking back at 2022, a good book list, another Black man mistakenly arrested because of facial recognition technology ... and more! We're now posting privacy news items on Mastodon as well as Twitter. If you see some links we should cover, please tag us! ### [2022 Year in Review](https://www.eff.org/2022-year-in-review?ref=thenexusofprivacy.net) Cindy Cohn on Electronic Frontier Foundation (eff.org) As well as an overview of EFF's acomplishments in 2022, this post links out to more detailed analyses of various topcis – for example, Jennifer Pinsof's [Reproductive Justice and Digital Rights](https://eff.org/deeplinks/2022/12/reproductive-justice-and-digital-rights-year-review?ref=thenexusofprivacy.net), Hayley Tsukayama's [Pushing for Strong Digital Rights in the States](https://www.eff.org/deeplinks/2022/12/pushing-strong-digital-rights-states-2022-year-review?ref=thenexusofprivacy.net) , and Alexis Hancock's [A Year in Internet Surveillance and Resilience](https://www.eff.org/deeplinks/2022/12/2022-year-internet-surveillance-and-resilience?ref=thenexusofprivacy.net). Good stuff! #### [The TOP 21 Books in Privacy & Data Protection That You Must Read ASAP](https://theprivacywhisperer.comhttps//www.theprivacywhisperer.com/p/the-top-21-books-in-privacy-and-data?ref=thenexusofprivacy.net) Luiza Jarovsky on The Privacy Whisperer (theprivacywhisperer.com) A roundup from the author of the largest independent privacy newsletter. Most (although not all) of the books here would be on my recommended list as well – in fact we've talked about several of them, especially Ari Ezra Waldman's [Industry Unbound: The Inside Story of Privacy, Data, and Corporate Power](https://www.ariewaldman.com/book-industry-unbound?ref=thenexusofprivacy.net) and Danielle Keats Citron's [The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age](https://www.harvard.com/book/the%5Ffight%5Ffor%5Fprivacy/?ref=thenexusofprivacy.net). I'd also add a few, for example Simone Browne's [Dark Matters: On the Surveillance of Blackness](https://www.dukeupress.edu/dark-matters?ref=thenexusofprivacy.net) and Oscar Gandy's classic [The Panoptic Sort: A Political Economy of Personal Information](https://global.oup.com/academic/product/the-panoptic-sort-9780197579411?cc=us&lang=en&&ref=thenexusofprivacy.net). ### [Facial recognition tool led to mistaken arrest, lawyer says](https://abcnews.go.com/Technology/wireStory/facial-recognition-tool-led-mistaken-arrest-lawyer-96085923?ref=thenexusofprivacy.net) ABC News on ABC News (abcnews.go.com) An attorney says Louisiana authorities’ use of facial recognition technology led to the mistaken-identity arrest of a Georgia man on a fugitive warrant. > "Randall Reid, 28, was jailed in late November in DeKalb County, Georgia, The Times-Picayune/The New Orleans Advocate reported.... > > Reid is Black, and his arrest brings new attention to the use of a technology critics say results in a higher rate of misidentification of people of color than of white people." ## And ... #### [Watching porn now requires age verification in La. because of new law](https://fox8live.com/2022/12/28/watching-porn-now-requires-age-verification-la-because-new-law?ref=thenexusofprivacy.net) Chris Rosato on FOX 8 Local First (fox8live.com) A new law that was passed in Louisiana requires age verification for any website that contains 33.3% or more pornographic material. #### [Fellowship Opportunity: Democratizing the Datafied Society](https://datajusticelab.org/2022/12/08/fellowship-opportunity-democratizing-the-datafied-society?ref=thenexusofprivacy.net) datajustice on Data Justice Lab (datajusticelab.org) The Data Justice Lab is looking for fellows to collaborate with us on exploring how to democratize the datafied society. The fellowships can either be based at the Lab in Cardiff, UK, or be conduct… #### [7+1 tips on how to make the most out of your DSAR](https://privacyinternational.org/explainer/3845/71-tips-how-make-most-out-your-dsar?ref=thenexusofprivacy.net) on Privacy International (privacyinternational.org) Hello friend, #### [What’s in store for cybersecurity in 2023](https://venturebeat.com/security/whats-in-store-for-cybersecurity-in-2023?ref=thenexusofprivacy.net) Steven Stone, Rubrik on VentureBeat (venturebeat.com) 2023 is certain to be as action-packed a year in cybersecurity as 2022 was. Rubrik exec shares five predictions for the coming year. #### [China is helping Zimbabwe to build a surveillance state](https://economist.com/middle-east-and-africa/2022/12/15/china-is-helping-zimbabwe-to-build-a-surveillance-state?ref=thenexusofprivacy.net) The Economist on The Economist (economist.com) Oppressive regimes stick together #### [Impact of European Commission support for EU-U.S. Data Privacy Framework and next steps](https://engage.hoganlovells.com/knowledgeservices/news/impact-of-european-commission-support-for-eu-us-data-privacy-framework-and-next-steps?ref=thenexusofprivacy.net) on Hogan Lovells Engage 5.7.7 (engage.hoganlovells.com) On 13 December 2022, the European Commission (“EC”) published its draft adequacy decision for the EU-U.S. Data Privacy Framework (“DPF”) that is intended to foster trans-Atlant... #### [GPC + GDPR: will it work?](https://harshp.com/research/blog/gpc-gdpr-can-it-work?ref=thenexusofprivacy.net) on harshp.com Global Privacy Controls (GPC) represents a signal to opt out of data sharing. Will it work with GDPR? #### [Four more things we worked on in 2022](https://aisnakeoil.substack.com/p/four-more-things-we-worked-on-in) Arvind Narayanan on AI Snake Oil (aisnakeoil.substack.com) We had a busy 2022\. Here are a few things we worked on but didn’t cover here. #### [Twitter in data-protection probe after ’400 million’ user details up for sale](https://bbc.com/news/technology-64109777?ref=thenexusofprivacy.net) Chris Vallance on BBC News (bbc.com) Politicians and celebrities are said to be affected but the scale of the data breach is unverified. #### [VIDEO: UW professor explains new artificial intelligence chatbot](https://kiro7.com/news/local/video-uw-professor-explains-new-artificial-intelligence-chatbot/ccbc5301-117c-493c-80f7-88388319c759?ref=thenexusofprivacy.net) on KIRO 7 News Seattle (kiro7.com) #### [New Year Brings New Privacy Laws to California Employers](https://natlawreview.com/article/new-year-brings-new-privacy-laws-to-california-employers?ref=thenexusofprivacy.net) Julia Y. Trankiem on The National Law Review (natlawreview.com) The New Year usually means new laws for California employers.  This year, a new privacy law goes into effect with new mandates for employers to ensure that workers have more control over the coll #### [2023 New Year’s Resolution: Don’t Get “Whacked” By A State AG for Cybersecurity Compliance](https://natlawreview.com/article/2023-new-year-s-resolution-don-t-get-whacked-state-ag-cybersecurity-compliance?ref=thenexusofprivacy.net) Joseph J. Lazzarotti on The National Law Review (natlawreview.com) It usually happens after a reported data breach. The organization experiencing the breach sends notifications to affected individuals, as well as federal and or state agencies where appropriate and pe #### [Top 10 Blog Posts for the Workplace Privacy, Data Management & Security Report for 2022](https://natlawreview.com/article/top-10-blog-posts-workplace-privacy-data-management-security-report-2022?ref=thenexusofprivacy.net) Jason C. Gavejian on The National Law Review (natlawreview.com) As the year comes to a close here are some of the highlights from the Workplace Privacy, Data Management & Security Report with our Top 10 most popular posts of 2022. #### [Is it time for GDPR 2.0?](https://arstechnica.com/tech-policy/2022/12/is-it-time-for-gdpr-2-0?ref=thenexusofprivacy.net) Nick Dedeke on Ars Technica (arstechnica.com) EU rules preserve some privacy but can be better. #### [The LastPass disclosure of leaked password vaults is being torn apart by security experts](https://theverge.com/2022/12/28/23529547/lastpass-vault-breach-disclosure-encryption-cybersecurity-rebuttal?ref=thenexusofprivacy.net) Mitchell Clark on The Verge (theverge.com) “LastPass’s claim of ‘zero knowledge’ is a bald-faced lie.” #### [Privacy of 100,000 Crypto Traders Compromised As Trading Bot Firm Confirms Hack After Warning From Changpeng Zhao](https://dailyhodl.com/2022/12/30/privacy-of-100000-crypto-traders-compromised-as-trading-bot-firm-confirms-hack-after-warning-from-changpeng-zhao?ref=thenexusofprivacy.net) Rhodilee Jean Dolor on The Daily Hodl (dailyhodl.com) Crypto trading bot 3Commas is confirming allegations that its platform has been compromised and user data was leaked. #### [Shopify in advertising push to fill void left by Apple privacy crackdown](https://ft.com/content/84ea2a9c-c28d-42a6-b3a9-0d6cc0fb37bb?ref=thenexusofprivacy.net) Tim Bradshaw on ft.com Canadian ecommerce group touts new tool that allows retailers to pool customer data and better target ads #### [US agencies 47 years behind with privacy law](https://biometricupdate.com/202301/us-agencies-47-years-behind-with-privacy-law?ref=thenexusofprivacy.net) Jim Nash on BiometricUpdate.com (biometricupdate.com) According to the Government Accountability Office, agencies are behind in equal measure in accepting digital ID for identity proofing and authentication. #### [Privacy matters! Hide WhatsApp messages with these tricks](https://tech.hindustantimes.com/how-to/privacy-matters-hide-whatsapp-messages-with-these-tricks-71672672231142.html?ref=thenexusofprivacy.net) HT TECH on HT Tech (tech.hindustantimes.com) WhatsApp has some hidden tricks that will let you hide your messages. Check the step-by-step guide here. #### [Tech regulation: What to expect on privacy, antitrust issues in 2023](https://finance.yahoo.com/video/tech-regulation-expect-privacy-antitrust-164701600.html?ref=thenexusofprivacy.net) Yahoo Finance Video on Yahoo Finance (finance.yahoo.com) Yahoo Finance tech editor Dan Howley breaks down the outlook for a tech crackdown in 2023 and how it could weigh on giants such as Meta, Alphabet, and Microsoft. --- *Image credit:* Daquella manera on [Flickr ](https://www.flickr.com/photos/62518311@N00/466172168?ref=thenexusofprivacy.net) via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons Attribution 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net) license. ### The Nexus of Privacy at the turn of the year URL: https://thenexusofprivacy.net/the-nexus-of-privacy-at-the-turn-of-the-year/ Last updated: 2023-01-02T18:34:15.000Z Happy 2023 everybody! The start of the year's a good time to reflect on the Nexus of Privacy's focus in 2022 – and think about what to do differently in the upcoming year. Here's how I originally framed it back in June in [Welcome to The Nexus of Privacy](https://thenexusofprivacy.net/welcome-to-the-nexus-of-privacy/): > The Nexus Of Privacy is a website and newsletter focused on different perspectives on privacy, including technology, policy, activism, and strategy. At a high level, that's held up pretty well! Privacy News roundups routinely cover technology and policy; longer posts on including federal privacy legislation, FTC comments, ShotSpotter, and Mastodon discuss activism and strategy as well as technology and policy. Looking at it in more detail, though, there's room for improvement: most of the technology deeper dives have focused on automated decision systems and Mastodon, and there's been a lot less on privacy technologies and business strategy around privacy. So that's something I hope to focus on more in 2023 – starting with Data Privacy Week in late January. I'm still working on finding the right format and tempo for the Privacy News updates. The half-dozen or so links where I summarize and provide context take the bulk of the time writing it ... but subscribers generally tell me they find this very valuable, often more so than the (much less- time-consuming) laundry list of links. Over the fall I was doing two to three Privacy News stories per week; I could move down to one per week or update it to daily. Once the new year starts up for reals I'll run some polls to try to get a better feel for what people want. Beyond that ... well, here's a list of some of the longer posts currently in draft form. For calibration, some of my posts stay in draft form for years, so there's no guarantee when these will appear. Still, this gives an idea of what's in the works. - A discussion of [The Rise of Privacy Technology (TROPT) Tech Stack Whitepape](https://riseofprivacytech.com/troptprivacytechstackwhitepaper2022?ref=thenexusofprivacy.net)r. With hundreds of privacy tools out there, TROPTs structure helps bring clarity to the complexity of the landscape. Just as valuable are the perspectives from privacy domain experts on the biggest challenges facing privacy tech (and potential solutions), privacy tech trends, visions of the privacy tech future, and a privacy tech buyer "wish list". - A longer look at the policy questions Twitter's new management's actions highlight – and an evaluation of how well different legislation addresses them. [ADPPA and Twitter: eight questions and an elephant](https://thenexusofprivacy.net/adppa-and-twitter-eight-questions-and-an-elephant/) was a prototype for this post, with a shorter list of quesitons and focusing narrowly on the proposed American Data Privacy and Protection Act; but it's also interesting to look at proposed Washington state regulations as well as how other states and the EU handle these situations - Applying [social threat modeling techniques](https://medium.com/a-change-is-coming/social-threat-modeling-the-winds-of-change-are-in-the-air-8dc330479a50?ref=thenexusofprivacy.net). Mastodon provides some great examples here; [Mastodon privacy: you can’t really opt out of search engine indexing](https://thenexusofprivacy.net/mastodon-privacy-remember-that-public-and-unlisted-posts-can-be-indexed-by-search-engines/) and [Black Twitter, quoting, and white views of toxicity on Mastodon](https://thenexusofprivacy.net/black-twitter-quoting-and-white-toxicity-on-mastodon/) both have some analysis along these lines, but more structured thread modeling could be very useful. - A Washington state legislative session preview for privacy and tech justice legislation, similar to [The stakes are high: Washington state privacy, facial recognition, and automated decision systems legislation 2021](https://jedii.tech/wa-privacy-legislation-2021/?ref=thenexusofprivacy.net) (on jedii.tech). This year, we'll have the My Health My Data bill, a new version of the People's Privacy Act, yet another try at automated decision systems regulation, and who knows what else. - Looking at Mastodon, the fediverse, and other independent social networks. Twitter's deterioration under the new Chief Twit – and the mounting regulatory pressure on Facebook – mean that there are a lot of opportunities here! As well as revising [Mastodon: a partial history (DRAFT)](https://thenexusofprivacy.net/mastodon-a-partial-history/), I'm also planning on talking more about strtaegy moving forward. - Key recommendations for business decision makers based on current privacy trends. Some are straightforward but very important: invest in compliance (because more and more states have regulations going into force, and California and the EU are flexing their enforcement muscles), privacy by design (because it's cheaper and more effective to think about privay issues up front and holistically), and privacy tech. Others relate to exploring new business models and social network dynanics. If any of those sound particularly interesting to you – or if there are other topics you think are important that I should also cover – please let me know. And while I didn't make a big deal of it in 2022, I'm also available for consulting work (and would consider a part- or full-time employee role). It's tricky because I have a lot of strengths and interests: strategy, software engineering (especially the interaction between with justice and equity, but also engineering processes and reliable software), social networks, automated decision systems, organizing, and of course privacy. I'm still wrestling with how to best to present that ... but if you're looking for help in any of those areas, please get in touch! A lot happened on the privacy and tech justice front in 2022 and I expect there will be even more in 2023, so it should be a very interesting year. Stay tuned for more! ### Privacy News: December 26 URL: https://thenexusofprivacy.net/privacy-news-december-26/ Last updated: 2022-12-26T21:43:17.000Z Police using health data for surveillance, TikTok spying on journalists, state privacy legislation, and more! ### [Police seize on COVID-19 tech to expand global surveillance](https://apnews.com/article/technology-police-government-surveillance-covid-19-3f3f348d176bc7152a8cb2dbab2e4cc4?ref=thenexusofprivacy.net) Garance Burke, Josef Federman, Huizhong Wu, Krutika Pathi, and Rod McGuirk Remember in the early days of the pandemic when techies scoffed at privacy concerns about contact tracing apps? Three years later, AP looks at how the technologies and data are being used in China, Israel, India, and Australia to halt travel for activists and ordinary people, harass marginalized communities and link people’s health information to other surveillance and law enforcement tools. In some cases, data was shared with spy agencies. For example: > Majd Ramlawi was serving coffee in Jerusalem’s Old City when a chilling text message appeared on his phone. “You have been spotted as having participated in acts of violence in the Al-Aqsa Mosque,” it read in Arabic.... > > Ramlawi, then 19, was among hundreds of people who civil rights attorneys estimate got the text last year, at the height of one of the most turbulent recent periods in the Holy Land. Many, including Ramlawi, say they only lived or worked in the neighborhood, and had nothing to do with the unrest. What he didn’t know was that the feared internal security agency, the Shin Bet, was using mass surveillance technology mobilized for coronavirus contact tracing, against Israeli residents and citizens for purposes entirely unrelated to COVID-19. ### [EXCLUSIVE: TikTok Spied On Forbes Journalists](https://forbes.com/sites/emilybaker-white/2022/12/22/tiktok-tracks-forbes-journalists-bytedance?ref=thenexusofprivacy.net) Emily Baker-White on Forbes (forbes.com) Back in August, Baker-White reported (on *BuzzFeed News*) that revealing that [China-based ByteDance employees had repeatedly accessed U.S. user data](https://www.buzzfeednews.com/article/emilybakerwhite/tiktok-tapes-us-user-data-china-bytedance-access?ref=thenexusofprivacy.net), based on more than 80 hours of audio recordings of internal TikTok meetings. In response, ByteDance (TikTok's parent company) started spying on Baker-White and other journalists. Forbes had earlier reported on this in October, but ByteDance denied it. Turns out they lied: they were in fact using TikTok to monitor journalists’ physical location using their IP addresses. > According to materials reviewed by *Forbes*, ByteDance tracked multiple *Forbes* journalists as part of this covert surveillance campaign, which was designed to unearth the source of leaks inside the company following a [drumbeat](https://www.forbes.com/sites/emilybaker-white/2022/11/28/tiktoks-china-problem/?sh=658ae7e01ee4&ref=thenexusofprivacy.net) of [stories](https://www.forbes.com/sites/emilybaker-white/2022/10/25/bytedance-tiktok-investigation-global-chief-security-officer-roland-cloutier/?sh=6f39cafc6640&ref=thenexusofprivacy.net) [exposing](https://www.forbes.com/sites/emilybaker-white/2022/09/21/tiktok-bleeding-us-execs-china-control-bytedance/?sh=2409e4db9707&ref=thenexusofprivacy.net) the company’s [ongoing links](https://www.forbes.com/sites/emilybaker-white/2022/08/10/bytedance-tiktok-china-state-media-propaganda/?sh=21e9d68f322f&ref=thenexusofprivacy.net) to China. As a result of the investigation into [the surveillance tactics](https://www.forbes.com/sites/emilybaker-white/2022/10/20/tiktok-bytedance-surveillance-american-user-data/?sh=359380f66c2d&ref=thenexusofprivacy.net), ByteDance fired Chris Lepitak, its chief internal auditor who led the team responsible for them. The China-based executive Song Ye, who Lepitak reported to and who reports directly to ByteDance CEO Rubo Liang, resigned. ALSO: - [ByteDance Inquiry Finds Employees Obtained User Data of 2 Journalists](https://nytimes.com/2022/12/22/technology/byte-dance-tik-tok-internal-investigation.html?ref=thenexusofprivacy.net), Cecilia Kang on the New York Times (nytimes.com) ### [A look back at privacy and data protection in 2022](https://iapp.org/news/a/a-look-back-at-privacy-and-data-protection-in-2022?ref=thenexusofprivacy.net) Alex LaCasse, Jennifer Bryant, and Joseph Duball on International Association of Privacy Professionals (iapp.org) Data privacy made more news than ever in 2022\. What developments does IAPP think were most noteworthy for the privacy profession? It's an interesting roundup, starting with Ukraine, including a focus on international and US privacy regulation, and ending with the Supreme Court decision overturning Roe and opening the door for states criminalizing abortions. ## State privacy legislation ### [California Privacy Protection Act Ends 2022 Without CPRA Regulations, But CPPA Targets Risk Assessments and AI for Additional Rulemaking](https://jdsupra.com/legalnews/california-privacy-protection-act-ends-3836831?ref=thenexusofprivacy.net) Mary Costigan on JD Supra (jdsupra.com) The [California Privacy Rights Act (CPRA)](https://www.workplaceprivacyreport.com/2022/09/articles/california-consumer-privacy-act/employers-get-ready-ccpa-employee-and-b2b-exemptions-end-expanded-privacy-compliance-begins-in-2023/?ref=thenexusofprivacy.net), which amends California's privacy law, takes effect starting on January 1\. The California Privacy Protection Agency (CPPA) still hasn't finalized its rulemaking. Final proposed rules are anticipated to be released at the end of January and after going through the various administrative requirements will take effect in April. In the meantime, regulations previously promulgated by the California Attorney General’s Office will remain in effect. ### [’Tis the Season: Colorado Attorney General Releases New Draft CPA Regulations](https://natlawreview.com/article/tis-season-colorado-attorney-general-releases-new-draft-cpa-regulations?ref=thenexusofprivacy.net) David P. Saunders on The National Law Review (natlawreview.com) On December 21, 2022, the Colorado Attorney General released its newest set of draft regulations to the Colorado Privacy Act (CPA), which will take effect in July 2023\. Comments are open until January 18, and there's a rulemaking hearing on February 1. > In soliciting additional comments to the revised CPA regulations, the Colorado AG is seeking specific input on: (1) clarifications to definitions; (2) use of IP addresses to verify consumer requests; (3) a universal opt-out mechanism; (4) streamlining the privacy policy requirements while maintaining their comprehensiveness; and (5) bona fide loyalty programs. The latest draft regulations include detailed questions from the AG to stakeholders on each of these topics. ### [California Courts Must Protect Data Privacy](https://eff.org/deeplinks/2022/12/california-courts-must-protect-data-privacy?ref=thenexusofprivacy.net) Adam Schwartz and Corynne McSherry on Electronic Frontier Foundation (eff.org) The U.S. Supreme Court has been [chipping away](https://www.eff.org/deeplinks/2021/06/supreme-court-says-you-cant-sue-corporation-wrongly-marked-you-terrorist?ref=thenexusofprivacy.net) at private enforcement by rewriting a legal doctrine called “standing,” which determines who has been harmed enough to deserve their day in court. California’s standing rules are different, and far more protective. But a recent state appeals court decision may change those rules, closing the courthouse doors to victims of corporate violations of data privacy laws. EFF and Electronic Privacy Information Center ([EPIC](https://epic.org/?ref=thenexusofprivacy.net)) have filed an [amicus letter](https://www.eff.org/document/2022-12-21-limon-v-circle-k-eff-and-epic-amicus-letter?ref=thenexusofprivacy.net) with the California Supreme Court, urging it to review that decision and keep those doors open (with assistance from Hunter Pyle Law and Feinberg, Jackson, Worthman & Wasow). ### Also ... - [Biometrics privacy push coming to states in 2023](https://pluribusnews.com/news-and-events/biometrics-privacy-push-coming-to-states-in-2023/?ref=thenexusofprivacy.net), Austin Jenkins on Pluribus News (pluribusnews.com) - [How the California Privacy Rights Act reshapes U.S. privacy compliance in 2023](https://digiday.com/marketing/how-the-california-privacy-rights-act-reshapes-u-s-privacy-compliance-in-2023?ref=thenexusofprivacy.net), Tim Peterson on Digiday (digiday.com). - [Where privacy regulation stands ahead of 2023](https://marketingbrew.com/stories/2022/12/21/where-privacy-regulation-stands-ahead-of-2023?ref=thenexusofprivacy.net), ByRyan Barwick on Morning Brew (marketingbrew.com) - [State Privacy Law Applicability Considerations for Midsize and Small Businesses](https://jdsupra.com/legalnews/state-privacy-law-applicability-1162682?ref=thenexusofprivacy.net) ## Mastodon and the Fediverse ### [User Generated Content and the Fediverse: A Legal Primer](https://eff.org/deeplinks/2022/12/user-generated-content-and-fediverse-legal-primer?ref=thenexusofprivacy.net) Corynne McSherry on Electronic Frontier Foundation (eff.org) People hosting their own Mastodon instances face some legal risk. Fortunately, there are some relatively easy ways to mitigate that risk – if you plan ahead. To help people do that, this guide offers an introduction to some common legal issues, along with a few practical considerations. ## And ... #### [Lawyer mom barred from Rockettes by facial recognition tech](https://theregister.com/2022/12/21/rockettes%5Ffacial%5Frecognition%5Fmsg?ref=thenexusofprivacy.net) Brandon Vigliarolo on The Register (theregister.com) No Girl Scout cookies for you #### [Google is making its internal video-blurring privacy tool open source](https://engadget.com/google-is-making-its-internal-video-blurring-privacy-tool-open-source-150052840.html?ref=thenexusofprivacy.net) on Engadget (engadget.com) Google has announced that two of its latest privacy-enhancing technologies (PETs), including one that blurs objects in a video, will be provided to anyone for free via open source.. #### [Are your gadgets watching you? How to give the gift of privacy](https://theguardian.com/world/2022/dec/20/privacy-holiday-gift-guide-tech-smart-devices?ref=thenexusofprivacy.net) Johana Bhuiyan on The Guardian (theguardian.com) Our guide to the data collected by popular smart devices, from sleep and fitness trackers to DNA kits #### [FCC Deadlock Shields Wireless Companies From Privacy Penalties](https://wsj.com/articles/fcc-deadlock-shields-wireless-companies-from-privacy-penalties-11671485450?ref=thenexusofprivacy.net) Drew FitzGerald on The Wall Street Journal (wsj.com) Cellphone carriers facing roughly $200 million in fines are for now shielded from paying by a partisan deadlock at the FCC, according to people familiar with the matter. #### [Shadowy US Spy Firm Promises To Surveil Crypto Users For the Highest Bidder](https://mintpressnews.com/anomaly-6-surveil-crypto-users-highest-bidder/283036?ref=thenexusofprivacy.net) Kit Klarenberg on MintPress News (mintpressnews.com) Leaked documents reveal the secret operations of Anomaly 6, a shadowy private spying firm tracking crypto users on behalf of the US government. #### [Data brokers raise privacy concerns — but get millions from the federal government](https://politico.com/news/2022/12/21/data-brokers-privacy-federal-government-00072600?ref=thenexusofprivacy.net) Alfred Ng on POLITICO (politico.com) How an old privacy law and new security demands force Washington to rely on an industry in the crosshairs. #### [Cookies: MICROSOFT IRELAND OPERATIONS LIMITED fined 60 million euros | CNIL](https://cnil.fr/en/cookies-microsoft-ireland-operations-limited-fined-60-million-euros?ref=thenexusofprivacy.net) on Retourner à l’accueil CNIL.FR (cnil.fr) Following a complaint about the conditions for depositing cookies on “bing.com”, the CNIL carried out several investigations on the website in September 2020 and May 2021\. It found that when users visited this site, cookies were deposited on their terminal without their consent. #### [Despite enforcement delays, attorneys urge preparation for AI, privacy laws](https://legaldive.com/news/employers-prepare-ai-data-privacy-laws-inhouse-counsel/639341?ref=thenexusofprivacy.net) Ginger Christ on Legal Dive (legaldive.com) New legislation extends to employers with applicants or workers who are residents of New York City or California — and may be a harbinger of what’s to come elsewhere. #### [GitHub Cooperates with Tencent’s WeChat to Secure User Privacy](https://pandaily.com/github-cooperates-with-tencents-wechat-to-secure-user-privacy?ref=thenexusofprivacy.net) Pandaily on Pandaily (pandaily.com) GitHub, an Internet hosting service for software development and version control using Git, announced on December 19 that it has partnered with Tencent’s social app WeChat to scan for their tokens and help secure their mutual users on all public and private repositories with GitHub Advanced Security… #### [EU-US Data Privacy Framework in Activist’s Crosshairs](https://bankinfosecurity.com/eu-us-data-privacy-framework-in-activists-crosshairs-a-20757?ref=thenexusofprivacy.net) Akshaya Asokan on bankinfosecurity.com Europe took a key step in formalizing a framework to underpin the trans-Atlantic flow of commercial data but privacy activists say the EU-U.S. agreement won’t stand #### [Eufy responds to privacy allegations, admits it must do better](https://techhive.com/article/1441481/eufy-security-issues.html?ref=thenexusofprivacy.net) Ben Patterson on TechHive (techhive.com) Anker’s Eufy has promised to be “more clear” about when its security cameras store data in the cloud. #### [Apple brings new privacy security features to AirTags](https://deccanherald.com/business/technology/apple-brings-new-privacy-security-features-to-airtags-1173743.html?ref=thenexusofprivacy.net) DH Web Desk, on DH News Service (deccanherald.com) Apple AirTags are a wonderful accessory to tag vehicle keys, house keys, and other daily-use objects at home. Thanks to the expansive Apple devices’ network is very easy to locate misplaced items. However, privacy advocates had raised concerns over user privacy, as some people with bad intentions us… #### [Dolan’s Radio City facial software a gross ‘privacy invasion,’ could bring suit: booted lawyer’s attorney](https://nypost.com/2022/12/21/radio-city-facial-recognition-debacle-poses-privacy-invasion-lawyer?ref=thenexusofprivacy.net) Jeanette Settembre on New York Post (nypost.com) An attorney representing the lawyer who was flagged by facial recognition and kicked out of Radio City said the ordeal was an outrageous “privacy invasion.” #### [DuckDuckGo Will Block Google’s ‘Invasive, Annoying’ Sign-in Popups](https://gizmodo.com/duckduckgo-google-pop-up-sign-in-blocker-1849920942?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) A wave of new Google popups is spreading across the web, but a new feature from DuckDuckGo blocks them automatically. #### [Google Chrome and Android drop TrustCor support following privacy scare](https://techradar.com/news/google-chrome-and-android-drop-trustcor-support-following-privacy-scare?ref=thenexusofprivacy.net) Craig Hale on TechRadar pro (techradar.com) Google, Microsoft, and Mozilla all ditch TrustCor #### [Data privacy rules are sweeping across the globe, and getting stricter](https://cnbc.com/2022/12/22/data-privacy-rules-are-sweeping-across-the-globe-and-getting-stricter.html?%5F%5Fsource=sharebar%7Ctwitter&ref=thenexusofprivacy.net) Bob Violino on CNBC (cnbc.com) Businesses in highly regulated sectors and those that operate in multiple countries are faced with a growing number of data privacy regulations. #### [Massive Twitter data leak investigated by EU privacy watchdog](https://bleepingcomputer.com/news/security/massive-twitter-data-leak-investigated-by-eu-privacy-watchdog?ref=thenexusofprivacy.net) Sergiu Gatlan on BleepingComputer (bleepingcomputer.com) The Irish Data Protection Commission (DPC) has launched an inquiry following last month’s news reports of a massive Twitter data leak. #### [Facebook parent company to settle Cambridge Analytica scandal lawsuit for $725M](https://politico.eu/article/facebook-cambrige-analytica-scandal-lawsuit-meta-data?ref=thenexusofprivacy.net) Nicolas Camut on POLITICO (politico.eu) Leaked court document reveals the social media giant has agreed to settle a long-standing lawsuit filed in the US. #### [Apple Quietly Rolls Out New Updates That Could Prevent AirTag Stalking](https://gizmodo.com/apple-airtags-stalking-tracking-1849922603?ref=thenexusofprivacy.net) Kyle Barr on Gizmodo (gizmodo.com) Despite Apple’s claims of being proactive against AirTag stalking, the issue has not gone away even after multiple updates. #### [Borrowing from the law to filter training data for foundation models](https://venturebeat.com/ai/borrowing-from-the-law-to-filter-training-data-for-foundation-models?ref=thenexusofprivacy.net) Katharine Miller, Stanford Institute for Human-Centered AI on VentureBeat (venturebeat.com) Using a “Pile of Law” dataset, Stanford researchers explore filtering private or toxic content from training data for foundation models. #### [TSA’s facial recognition technology raises security, privacy concerns](https://ksby.com/news/national/tsas-facial-recognition-technology-raises-security-privacy-concerns?ref=thenexusofprivacy.net) By: Scripps National on KSBY News (ksby.com) Holiday travelers may notice that the TSA has been expanding the use of facial recognition technology. It’s now at more than a dozen airports across the country. #### [Musk’s Twitter draws deeper FTC scrutiny over rising privacy, security concerns](https://scmp.com/news/world/united-states-canada/article/3204048/musks-twitter-draws-deeper-ftc-scrutiny-over-rising-privacy-and-security-concerns?ref=thenexusofprivacy.net) Bloomberg on South China Morning Post (scmp.com) The multi-billionaire’s acquisition led to an exodus of many of the social media company’s legal, privacy and compliance executives, prompting the wider investigation. #### [Roomba says leaked pictures including one of a woman on the toilet were taken by test vacuums, not purchased ones](https://businessinsider.com/roomba-photos-recorded-bathroom-leaked-from-test-units-irobot-says-2022-12?ref=thenexusofprivacy.net) Aaron Mok on Insider (businessinsider.com) The leaked images from test Roomba vacuums reportedly came from data-labeling contractors who posted them in private Facebook and Discord groups. #### [Opportunities and blind spots in the White House’s blueprint for an AI Bill of Rights](https://brookings.edu/blog/techtank/2022/12/19/opportunities-and-blind-spots-in-the-white-houses-blueprint-for-an-ai-bill-of-rights?ref=thenexusofprivacy.net) Nicol Turner Lee and Jack Malamud on Brookings (brookings.edu) Nicol Turner Lee and Jack Malamud argue that the principles laid out in the Blueprint for an AI Bill of Rights are crucial, but without congressional action, strategies to effectuate change may lack the credible enforcement regime that only legislation can create. #### [Going digital: How learning and employment records shape access to quality education and jobs](https://brookings.edu/research/going-digital-how-learning-and-employment-records-shape-access-to-quality-education-and-jobs?ref=thenexusofprivacy.net) Annelies Goger, Allyson Parco, Rohan Carter-Rau, Jessa Henderson, Kazumi Homma, Ani Meliksetyan, and Natalie Milman on Brookings (brookings.edu) New research draws from three case studies on implementing and governing new digital education assets to help create more equitable learning and employment pathways. #### [Controversial camera programs raise concerns over privacy in East Providence](https://original.newsbreak.com/@edy-zoo-1600640/2868947541316-controversial-camera-programs-raise-concerns-over-privacy-in-east-providence?ref=thenexusofprivacy.net) Edy Zoo on NewsBreak Original (original.newsbreak.com) EAST PROVIDENCE, R.I. - The city of East Providence, Rhode Island, has announced plans to install 10 new red light cameras and one additional school zone camera in the coming year, following the collection of nearly $3 million in fines in 2022. #### [Top 10 Blog Posts for the Workplace Privacy, Data Management & Security Report for 2022](https://natlawreview.com/article/top-10-blog-posts-workplace-privacy-data-management-security-report-2022?ref=thenexusofprivacy.net) Jason C. Gavejian on The National Law Review (natlawreview.com) As the year comes to a close here are some of the highlights from the Workplace Privacy, Data Management & Security Report with our Top 10 most popular posts of 2022: 1. California Consume #### [You Can Now Detect An Unknown AirTag With This New Privacy Feature](https://in.mashable.com/tech/44112/you-can-now-detect-an-unknown-airtag-with-this-new-privacy-feature?ref=thenexusofprivacy.net) Praneeth Palli on Mashable India (in.mashable.com) The Cupertino-based business recently released the back-to-back firmware upgrades. --- Image credit: Originally by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net), licensed from [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) via [Picpedia](https://www.picpedia.org/chalkboard/p/privacy.html?ref=thenexusofprivacy.net) ### Black Twitter, quoting, and white views of toxicity on Mastodon URL: https://thenexusofprivacy.net/black-twitter-quoting-and-white-toxicity-on-mastodon/ Last updated: 2026-04-16T02:58:09.000Z *Last updated: January 12, 2023\. See the* [*update log*](#updates) *at the bottom.* > For a detailed look at design considerations of a "quote boost" implementation, see the followon post [Social threat modeling and quote boosts on Mastodon](https://thenexusofprivacy.net/social-threat-modeling-and-quote-boosts/) > "The platform is made up of people. Elon Musk bought Twitter, but he did not buy the communities that exist on the platform. And one in particular has defined the zeitgeist here: Black Twitter, which media studies scholar Meredith Clark [defines](https://news.virginia.edu/content/black-twitter-101-what-it-where-did-it-originate-where-it-headed?ref=thenexusofprivacy.net) as “a network of culturally connected communicators using the platform to draw attention to issues of concern to black communities.”" > > – [For Black Folks, Digital Migration Is Nothing New](https://www.wired.com/story/black-twitter-social-media/?ref=thenexusofprivacy.net), Chris Gilliard and Kishonna Gray, Wired, December 13 2022 > "Whether we were watching ABC’s *Scandal*, dissing actress Paula Patton’s fried chicken, or calling out hypocrites with a quote tweet and “This you?,” Twitter is where we come to find humor, complain, and seek solutions." > > –[What happens to social justice and culture on Twitter with Elon Musk at the helm?](https://www.inquirer.com/columnists/twitter-elon-musk-culture-20220426.html?ref=thenexusofprivacy.net) by Elizabeth Wellington in the Philadelphia Inquirer, April 2022 > "As André Brock notes in his book, [*Distributed Blackness*](https://nyupress.org/9781479829965/distributed-blackness/?ref=thenexusofprivacy.net), Black Twitter as a phenomena emerged by means of the affordances of Twitter, through how things like quote tweets, retweets and hashtags allowed Black users to engage in Black digital practices." > > – [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), Dr. Johnathan Flowers, *Tech Policy Press* > "Why can’t we “quote boost” at Mastodon, the way we can “quote tweet” at Twitter? That might sound like an innocuous question, but it’s a volatile one. Quote tweets let you tag someone else’s tweet with your own addition above it, as a new tweet from your account. Both the original and your add-on are in full display." > > – [Reflecting on Twitter, White Flight, & “Quote Tweet” Tensions at Mastodon](https://absolutelymaybe.plos.org/2022/12/01/reflecting-on-twitter-white-flight-quote-tweet-tensions-at-mastodon/?ref=thenexusofprivacy.net), Hilda Bastien on *Absolutely Maybe* It's an interesting time on Mastodon, the decentralized open-source source social network with Twitter-like functionality. In contrast to Twitter, where conditions continue to deteriorate, there's a sense of possibility on Mastodon and other areas of the "fediverse", a network of interconnected sites that's been around for more than a decade. At the same time though the rapid growth is putting a spotlight on issues that haven't been addressed ... like quote boosts for example. [![A Mastodon poll. 43% would be happy with quote-boosts if they were never implmented on Mastodon. Follow the link for more detials.](https://thenexusofprivacy.net/content/images/2022/12/Screen-Shot-2022-12-28-at-10.44.24-AM.png)](https://merveilles.town/@lrhodes/109569485521543223?ref=thenexusofprivacy.net) [A poll by L. Rhodes, December 24-25.](https://merveilles.town/@lrhodes/109569485521543223?ref=thenexusofprivacy.net) *Terminology note: "boost" is Mastodon's equivalent of Twitter's "retweet", so "quote boost" (QB) is often used for the not-yet-existent equivalent of Twitter's "quote tweet" (QT). Sometimes, though, people refer to the hypothetical Mastodon functionality as a quote tweet because that's what we're used to. And since Mastodon's equivalent of tweets were called "toots" until the latest release, sometimes people call them "quote toots".* ## Does quoting "inevitably" add toxicity? Of course not. Mastodon's Benevolent Dictator for Life (BDFL) Eugen Rochko gave his reason for not allowing a quoting feature back in [March 2018](https://mastodon.social/@Gargron/99662106175542726?ref=thenexusofprivacy.net): in his view, quoting "inevitably adds toxicity to people's behaviours." It's not clear why he thinks this. There are plenty of examples of positive uses of quote tweets, so they clearly don't *inevitably* add toxicity. - Amplifying and endorsing opinions, mutual aid requests, actions, or important reporting - References to tweets in another thread. - Starting up a discussion on a related topic to avoid hijacking a thread. - Calling attention to hypocrisy \[[Wellington](https://www.inquirer.com/columnists/twitter-elon-musk-culture-20220426.html?ref=thenexusofprivacy.net)\] – or racism, anti-LGBTQ+ language or attitudes, or patterns of harassment and abuse - For Black Twitter, participating in a call and response phenomena similarly to "playing the dozens" in the Black community \[[Flowers](https://zirk.us/@shengokai/109380443451422591?ref=thenexusofprivacy.net)\] - For Autistic Twitter, presenting parallel experiences as a way to identify with and express solidarity with a given experience. \[[Flowers](https://zirk.us/@shengokai/109380443451422591?ref=thenexusofprivacy.net)\] - For cross-language communication \[@[mawhrin](https://circumstances.run/@mawhrin/109580509964913182?ref=thenexusofprivacy.net)\] - For citation and pedagogical purposes. \[[Carwil Bjork-James](https://mastodon.online/@Carwil/109582197038797878?ref=thenexusofprivacy.net)\] The [#MissedQuoteBoost hashtag on Mastdon has other examples](https://mastodon.social/tags/MissedQuoteBoost?ref=thenexusofprivacy.net). The list goes on ... And while it's certainly true that quoting is sometimes used to harass and abuse people, it's easy for harassers to share links and take screenshots even when quote tweets aren't available ... so it's really not clear how much toxicity they actually add. From a research perspective, as far as I know there's virtually no good analysis of whether QTs contribute to abuse\[[1](#notes)\] – and in particular, nothing specifically looking at abuse of specific identities like Black, indigenous, trans, queer, and disabled people. It's really a stark contrast to research highlighting the value of quote tweets in general (and very specifically for Black Twitter and activism purposes) from Feminista Jones, Clark, Sarah L. Jackson, Moya Bailey Brooke Foucault Welles, Clark, Flowers, Brock, and many others. ## A frustrating conversation > "I've been very frustrated with this entire conversation because I think there are two big assumptions that are taken without examination: > > 1\. Quote-boost was a significant \*cause\* of conflict on twitter that is less present here. Decisions about things like if people can use quote-boost can be effective protective measures. > > 2\. Less conflict is \*always\* objectively good and this should guide decisions about UI." > > – [@futurebird@sauropods.win](https://sauropods.win/@futurebird?ref=thenexusofprivacy.net) Yeah really. One reason quote tweets are so effective on Twitter at calling out hypocrisy (and racist language or assumptions) is the visual aspects, with more prominence on the quote ("this you?") providing context. That often leads to conflict. Do the quote tweets *cause* conflict? Are conflicts caused by calling out hypocrites always a bad thing? What about conflicts caused by calling out racists – or talking about Mastodon's whiteness? ## Quoting happens anyway. So does toxicity. > I'll just say that the lack of quote toots did not stop me from being harassed to the point of blackmail Patreon pledges my first time here. > > Harassers will harass regardless of tools. > > – Creatrix Tiara Even without quoting functionality, Mastodon's got a long history of toxicity. Creatrix Tiara, for example, was [dogpiled within hours of arriving on Mastodon back in 2017](https://twitter.com/creatrixtiara/status/1030380773059096577?ref=thenexusofprivacy.net), after commenting about the lack of people of color. And it's worth mentioning that while arguing that quoting shouldn't be implemented because it "inevitably" leads to toxcisity, Mastodon's BDFL has also blocked functionality like local-only posts that would clearly *reduce* harassment, abuse, and other toxic behaviors.\[[2](#notes)\] It's a great example of a point futurebird made in the Mastdon discussion: "Preventing abuse isn't the same thing as preventing conflict and often these can work in direct opposition to each other." And just as happened on Twitter before quote tweets were officially introduced in 2015, people also find ways to quote on Mastodon even though the software doesn't have the functionality. A screenshot-and-link takes a lot more steps than a quote tweet (see [the analysis below](#appendix-comparing-screenshot-and-link-to-twitters-qts) if you want the details) but if somebody really wants to call somebody out (or direct abuse or harassment at somebody who's called them out) they'll make the effort. Sure enough, sometimes it leads to conflicts. > "As one of the Mastodonians that I have come to rely on for the history of users of color on Mastodon has said, trying to do “this you”– that is the Black Twitter call and response methodology where we point out a problem, the contradictions in a person’s statement by bringing up another statement that they’ve made and saying “this you,” right– that’s a narrow way of defining it. But doing something like “this you” on Mastodon invites a torrent of racist and sexist kinds of violence from other Mastodonians." > > – Dr. Johnathan Flowers in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) Huh. It's almost like confronting people with hypocrisy (or racism) triggers the conflict ... not whether or not the platform supports quoting. Who could have predicted? > "What strikes me with the mansplaining here when we bring up quote tweets, is how many of us who are experts on being harassed on and off line, people do this to. You don’t need to explain to me what leads to harassment when there have been articles written about the harassment I’ve gotten, and that doesn’t even cover 5% of it." > > – Timnit Gebru ## Affordances, norms, and inheriting whiteness > "Mastodon is a very white space. It is not unlike other tech spaces where whiteness is predominant. Insofar as this is the case, the norms, the habits, the affordances of the platform will inherit whiteness." > > – Dr. Johnathan Flowers in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) "Affordances" are the qualities and properties of software that defines its possible uses or encourages people to use it in one way or another. Mastodon's lack of support for quote boosting is a great example of an affordance inheriting whiteness. The unexamined racism of viewing a key component of Black digital practice as "inevitably toxic" is an example of whiteness as a norm. One of the habits I see in discourse about quoting is the suggestion that since Mastodon was founded by marginalized people who wanted to get away from toxicity on Twitter, we should defer to the trans and queer people who have been here for years and don't want quoting. Don't get me wrong, as a queer person who's been on Mastodon since 2017, it's good that people want to take our opinions into account – as [Rapid queer-led community innovation](https://thenexusofprivacy.net/mastodon-a-partial-history/#rapid-queer-led-community-innovation) discusses, trans and queer people drove a lot of Mastodon's improvements in anti-abuse technology in 2016-2017\. And I really really really wish that site admins and Mastodon's BDFL would listen to the trans and queer people who have been advocating for local-only posts\[[2](#notes)\] ever since the trans-led GlitchSoc fork first implemented them in 2017! When it comes to quoting, though, while it's certainly true that some trans and queer people feel that we'd be better off without it, the opinion is far from unanimous; quite a few of us think there are also good arguments in favor of quote tweets. And trans and queer opinions aren't the only ones that matter. As Flowers says: > "\[W\]hiteness is a large problem within the LGBTQ community. Being queer does not insulate one cell from the inheritance of whiteness" So when cis white people cite white trans and queer people's perspectives on quoting without also bringing up Black perspectives, it's a great example of the dynamic Flowers points out: Mastodon's history often gets used as a shield from critiques of anti-Blackness. > I really don't care if QTs happen on this site, or don't happen. What's much more informative and important to me, is how this conversation is unfolding, and what is prioritized. I've heard everything from "The Black perspective isn't real" to "You Twitter refugees!" from folks with account create dates in November, talking to Black folk here since 2017 > > – mekka okereke > I don't really think mastodon needs quote-boost to thrive. It would be better, helpful, positive, but users are creative and will work around it. We will find new ways to communicate. What I'm concerned about **now** is what this restriction *has come to represent.* > > Whose concerns matter? > Who is welcomed? > Who is supported? > Who isn't? > > – [futurebird on GitHub](https://github.com/mastodon/mastodon/issues/14597?ref=thenexusofprivacy.net#issuecomment-1362907651) ## An opportunity for progress > "I'm not sure why there is any debate on QTs. > > There are multiple issues open on the project to implement it that were rejected. Forks have already been made to implement it as it's primarily a client side thing. > > It's clear there will not be a consensus on adding it. So, either work with those that want it to implement it, or work with those who don't to filter it out." > > – [rose](https://toot.cat/@rose@503junk.house/109569823278253157?ref=thenexusofprivacy.net) > Quote Toots are coming. The choice is to make them benign, or not to. > > – [Isabelle Moreton](https://mastodon.lol/@epistemophagy/109586023788561244?ref=thenexusofprivacy.net) (@epistemophagy) Mastodon forks like [Fedibird](https://github.com/mastodon/mastodon/issues/12753?ref=thenexusofprivacy.net#issuecomment-570821865) have quote-boosts and so does other Mastodon-compatible fediverse \[3\] software including Friendica, Misskey, and Akkoma. Just a few hours after I first posted this, treehouse.systems admin (and[ longtime fediverse developer](https://ariadne.space/2022/11/12/twitters-demise-is-activitypubs-future/?ref=thenexusofprivacy.net)) Ariadne Conill released [a Mastodon patch adding quote tweets](https://gitea.treehouse.systems/treehouse/mastodon/pulls/36?ref=thenexusofprivacy.net). Even Mastodon's BDFL (Benevolent Dictator for Life) Eugen Rochko has said [he doesn't feel as strongly about it as he used to](https://www.wired.com/story/the-man-behind-mastodon-eugen-rochko-built-it-for-this-moment/?ref=thenexusofprivacy.net). The good news is that there's a lot of energy in the discussion trying to make them benign. There are multiple Github issues ([1](https://github.com/mastodon/mastodon/issues/20673?ref=thenexusofprivacy.net), [2](https://github.com/mastodon/mastodon/issues/20673?ref=thenexusofprivacy.net), [3](https://github.com/mastodon/mastodon/issues/309?ref=thenexusofprivacy.net)) discussing potential design implementation, as well as hashtags including [#MissedQuoteBoost](https://mastodon.social/tags/MissedQuoteBoost?ref=thenexusofprivacy.net), [#QuoteBoost](https://indieweb.social/tags/QuoteBoost?ref=thenexusofprivacy.net), [#QuoteTweet](https://indieweb.social/tags/QuoteTweet?ref=thenexusofprivacy.net), [#QuoteToot](https://indieweb.social/tags/QuoteToot?ref=thenexusofprivacy.net), and [#QT](https://indieweb.social/tags/QT?ref=thenexusofprivacy.net) – and lots of interesting threads, some of which are linked to from [the QuoteToot page on the toot.cat MeW wiki](https://mew.toot.cat/mw/Quote%5Ftoot?ref=thenexusofprivacy.net). If done right, there's a great opportunity for Mastodon here. There's certainly plenty of room for improvement over how Twitter does quote tweets. Are there are ways to design a quoting mechanism that make it less effective for harassers? Are there ways to make it less likely to trigger accidental dogpiles? As Afsenah Rigot discusses in [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=thenexusofprivacy.net), centering the marginalized people directly impacted by design decisions leads to products that are better for *everybody*. With quoting, this means working with, listening to, and following the lead of: - marginalized communities who make extensive use of quoting, especially Black Twitter and disability Twitter - people and communities who are the target of harasssment using quoting along with other tactics, especially women of color, trans and queer people and disabled people As Bastian says in [Reflecting on Twitter, White Flight, & “Quote Tweet” Tensions at Mastodon](https://absolutelymaybe.plos.org/2022/12/01/reflecting-on-twitter-white-flight-quote-tweet-tensions-at-mastodon/?ref=thenexusofprivacy.net), > "The [principles from the Design Justice Network](https://designjustice.org/read-the-principles?ref=thenexusofprivacy.net) are one of the good places to start to move the quote boost question forward. Those principles begin with the need to seek liberation from oppressive systems, and include prioritizing “impact on the community over the intentions of the designer.”" --- ## Appendix: Comparing screenshot-and-link to Twitter's QTs A common response to the original version of this post from people who oppose adding quoting support to Mastodon make is that there's an existing alternative: take a screenshot and include a link. Of course it adds "friction" by requiring several extra steps, but putting that aside for the moment, isn't the existing functionality good enough? It's a good question, and worth addressing – the issues it highlights are important to consider in the design of a quote boost for Mastodon or other systems. Snce the analysis is fairly lengthy, I decided to put it at the end of the post in an appendix. To get a handle on this, let's look at some of the key properties of Twitter's QT's as they're currently implemented, have several important properties. To be clear, I'm not saying that Mastodon should just clone Twitter's implementation – there's clearly room for improvement! But, it's a concrete existing implementation, so a useful basis for comparison. Screenshot-and-link can be a decent approximation to QTs in several ways - It's easy to navigate from the quote to the original tweet (although if the original tweet had a link to an article you want to read it takes an extra click) - People can see the new commentary as well as the original tweet and any embedded images (although not GIFs or videos) - As long as the quoter has taken the time to put in alt-text, it's can be a good experience for people who use screenreaders (although it's a lot harder if the original tweet had an images, GIFs, or videos) - As long as the quoter has tagged the person who made the original tweet, there's a notification when you're quoted (although it's got less information than a notification for a QT) On the other hand, Twitter's QT functionality also does things that screenshot-and-link *doesn't* approximate: - It's easy to see who's quoted the original tweet and what they've said – and to navigate to the quote tweets. For playing [the dozens](https://www.baltimoresun.com/news/bs-xpm-1994-02-11-1994042244-story.html?ref=thenexusofprivacy.net), splitting off a new thread to have a related discussion, citing a thread as part of an academic discussion, or calling out hypocrisy, these makes a big difference. - If somebody deletes the original tweet, or changes their account to protected, you can no longer see a copy in the QT. The screenshot, by contrast, still shows the original now-deleted tweet – good news for harassers, because it prevents the target from being able to stop the quote from spreading. - A QT always shows the original tweet accurately. Screenshots, by contrast, can be edited, as harassers and disinfo spreaders frequently do. - QT's of polls show the current results. Screenshots, by contrast, show the results of the poll at the time they were taken. - You can't QT a tweet from a protected account. This is very important from a privacy perspective – although in practice, it only stops accidental quoting of protected tweets, because harassers can still screenshot-and-link. - You can't do a "private QT" – quote tweet using protected account. Twitter originally allowed private QTs, and it was a very common attack vector: the private account's followers could see the QT, but the person being targeted couldn't. Interestingly, screenshot-and-link is in some ways more effective than QTs for harassers: the person being attacked doesn't get any information about where the attack is coming from – and they can't protect themself by deleting the tweet or protecting their account. For most other purposes, though, QTs are noticeably more useful. ### "Friction" Which brings us back to the question of "friction", the extra work that needs to be done by the person doing the quoting and by the people looking at the quote. There are two ways to do a QT on Twitter, both fairly straightforward: - when looking at a tweet, click on the "retweet" and then choose the "quote tweet" option and type in your commentary - copy the link to the tweet you want to quote, then compose a tweet as you normally do and paste the link to the tweet you want to quote into it. Doing a screenshot-and-link is much harder, especially if you want to include alt text, and even more so if the original tweet has an iamge. Here's the steps I went through 1. copy the link to the tweet I want to quote, then compose a tweet as I normally would, paste the link to the tweet I want to quote into it, and make sure to tag the person whose tweet I'm quoting 2. go back to the original tweet and make a screenshot of it. 3. return to the tweet I'm composing, compose a tweet, add the screenshot as an image. 4. go back to the original tweet, select the text (including the tweeter's account and name) 5. return to the tweet I'm composing, edit the image, paste in the alt text (but don't click save yet) 6. go back to the original tweet, bring up the alt-text, and copy it 7. return to the tweet I'm composing, and continue to add alt text by typing the words. "With an image of " and pasting the alt-text from the original image That's kind of a lot! It's really worth trying it out yourself, either on Twitter or Mastodon, especially on the phone. When quoting is being used for positive purposes, all this additional friction's a significantly usability issue – especially for those who care about accessibility. And note that selecting and copying text can be very challenging for people with impaired vision or motor skills, so the friction's noticeably higher for them. When quoting is being used for harassment, additional friction is a good thing. On the other hand, harassers are likely to skip adding the alt-text, so they can stop afer step 3 – the friction's a lot lower for them. ## Notes ## \[1\] Hilda Bastian's [Quote Tweeting: Over 30 Studies Dispel Some Myths](https://absolutelymaybe.plos.org/2023/01/12/quote-tweeting-over-30-studies-dispel-some-myths/?ref=thenexusofprivacy.net) (from January 12, 2023) is an outstanding look at research relating to quote tweets – but it didn't exist when I originally wrote this, so here's the references I originally included. Magdalena Wojcieszak et al's [Echo chambers revisited: The (overwhelming) sharing of in-group politicians, pundits and media on Twitter](https://osf.io/xwc79/?ref=thenexusofprivacy.net) notes that quote-tweets of posts by "elites" are more likely to be used to provide negative commentary ... but negativity isn't the same as abuse, and the work equates anti-racists calling out racist posts by conservative politicians and racists directing harassment at progressive politicians of color. A few other interesting papers: - Kiran Garimella et al's [Quote rts on twitter: usage of the new feature for political discourse](https://arxiv.org/pdf/1603.07933.pdfhttps://dl.acm.org/doi/abs/10.1145/2908131.2908170?ref=thenexusofprivacy.net) (from 2016) found that quote tweets had fewer insults than replies. - Haesoo Kim et. al.'s November 2022 [When Does it Become Harassment?: An Investigation of Online Criticism and Calling Out in Twitter](https://kixlab.github.io/website-files/2022/cscw2022-callout-paper.pdf?ref=thenexusofprivacy.net), based on interviews with 32 Twitter users, suggest that "QTs could be perceived to be more aggressive when used for calling outpurpose." - Martin Riedl. et. al.'s [Platformed antisemitism onTwitter: Anti-Jewish rhetoric in political discourse surrounding the 2018 US midterm election](https://journals.sagepub.com/doi/full/10.1177/14614448221082122?ref=thenexusofprivacy.net) notes that quote-tweets were used both to add antisemitic references and context in their quote-tweets, and to contest anti-semitic tweets. Note however that this work appears to use the IHRA definition of anti-Semitism, which many scholars argue has been [“hijacked” to protect the Israeli government from international criticism](https://www.aljazeera.com/news/2022/11/3/128-scholars-ask-un-not-to-adopt-ihra-definition-of-anti-semitism?ref=thenexusofprivacy.net). \[2\] Local-only posts can't get shared with other instances, so if you're on a well-moderated instance this significantly cuts down the risk of having your post targeted by harassers, terfs, or nazis. They're also valuable from a privacy perspective, since they prevent posts from being shared with admins or software that doesn't respect privacy). The GlitchSoc Mastodon fork, which at the time was led by trans and non-binary women, implemented local-only posts in 2017; Darius Kazemi's Hometown fork has supported local-only posts for years. Alas, Rochko's antipathy to them means that they're not available on most instances. \[3\] EFF's [The Fediverse Could Be Awesome (If We Don’t Screw It Up)](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=thenexusofprivacy.net) defines the fediverse as "an expanding ecosystem of interconnected social media sites and services that let people interact with each other no matter which one of these sites and services they have an account with." Mastodon is the most popular software in the fediverse today but there are lots of other options as well. Per Axbom's [The many branches of the Fediverse](https://axbom.com/fediverse/?ref=thenexusofprivacy.net) has more. --- ### Updates - December 25: add link to treehouse implementation - December 26-27: typo fixes - December 28: add poll, rework list of positive purposes, include github quote from futurebird, add appendix - January 12, 2023: update footnote 1 with info from Hilda Bastian's [Quote Tweeting: Over 30 Studies Dispel Some Myths](https://absolutelymaybe.plos.org/2023/01/12/quote-tweeting-over-30-studies-dispel-some-myths/?ref=thenexusofprivacy.net) --- Image credit: philroc, via [Wikipedia](https://commons.wikimedia.org/wiki/File:Quotation%5Fmarks.svg?ref=thenexusofprivacy.net), published under a [Creative Commons](https://en.wikipedia.org/wiki/en:Creative%5FCommons?ref=thenexusofprivacy.net) [CC0 1.0 Universal Public Domain Dedication](https://creativecommons.org/publicdomain/zero/1.0/deed.en?ref=thenexusofprivacy.net). ### That's a wrap (for now): federal privacy legislation update, December 23 URL: https://thenexusofprivacy.net/thats-a-wrap-for-now-federal-privacy-legislation-update-december-23/ Last updated: 2026-04-16T02:57:46.000Z The 117th Congress has adjourned after passing the $1.7 trillion, 4155-page "omnibus" appropriations bill, so it's now official. Even though several privacy bills advanced from committee in 2022, and bill sponsors continued to express confidence during the lame duck session, at the end of the day nothing passed either the House or Senate (let alone both). Legislators have clearly heard that voters want them to do *something*, but the devil is in the details. Privacy legislation is hard. So after a short break, it's on to 2023\. With Republicans saying they'll use their new majority in the House to be obstructionist, and the filibuster unlikely to go anywhere in the Senate, it'll require bipartisan agreement for Congress to pass privacy legislation or anything else. The good news is that most of the key federal privacy bills have bipartisan sponsorship, and Big Tech's bad behavior alienating more and more legislators in both parties ... so it's certainly not impossible. Time will tell. So let's do a quick wrapup of the 2022 session – and start looking forward to 2023\. Here's the list of Nexus of Privacy posts on federal privay legislation; read on for a bill-by-bill breakdown and some thoughts about next year. - [It'll be an interesting summer!](https://thenexusofprivacy.net/federal-privacy-legislation-the-best-chance-yet-to-pass-a-strong-bill/) (June 14) - [Three lessons from "the other Washington"](https://thenexusofprivacy.net/the-view-from-the-other-washington-federal-privacy-legislation-adppa-update-6-22/) (June 22) - [ Talking about the elephant](https://thenexusofprivacy.net/talking-about-the-elephant/) (July 8) - [ A "fresh wrench", two hearings, and a busy week](https://thenexusofprivacy.net/a-fresh-wrench-and-two-hearings/) (July 17) - [ADPPA Advances. But what about the elephant?](https://thenexusofprivacy.net/what-about-the-elephant/) (July 26) - [Is there an elephant in the Zoom room? CPPA says no to ADPPA preempting California law](https://thenexusofprivacy.net/is-there-an-elephant-in-the-zoom-room/) (July 29) - [The opportunity and the elephant](https://thenexusofprivacy.net/the-opportunity-and-the-elephant/) (August 8) - [One out of six ain't good: Five ways the American Data Privacy and Protection Act falls short](https://thenexusofprivacy.net/one-out-of-six-aint-good/) (August 9) - [ADPPA's algorithmic impact assessments are too weak to protect civil rights -- but it's not too late to strengthen them](https://thenexusofprivacy.net/adppa-impact-assessments-and-civil-rights/) (August 25) - [ADPPA's data minimization and duty of loyalty: a deep dive](https://thenexusofprivacy.net/adppa-data-minimization/) (August 31) - [Stress-testing privacy legislation with a queer lens](https://thenexusofprivacy.net/adppa-with-a-queer-lens/) (September 6) - [Who could have predicted? A potential "new compromise" for ADPPA!](https://thenexusofprivacy.net/adppa-new-compromise/) (September 12) - ["An alphabet soup of federal privacy legislation"](https://thenexusofprivacy.net/an-alphabet-soup-of-federal-privacy-legislation/), a webinar with Maya Morales of WA People's Privacy (September 22) - [A quick ADPPA Roundup ](https://thenexusofprivacy.net/federal-privacy-legislation-adppa-roundup/)(September 28) - [The elephant and the lame duck: ADPPA after the midterms](https://thenexusofprivacy.net/the-elephant-and-the-lame-duck/) (November 14) - [ADPPA and a "coordinated effort" not to mention the elephant](https://thenexusofprivacy.net/a-coordinated-effort-not-to-mention-the-elephant/) (December 12) - [ADPPA and Twitter: eight questions and an elephant](https://thenexusofprivacy.net/adppa-and-twitter-eight-questions-and-an-elephant/) (December 19) - [The omnibus drops - with no ADPPA or KOSA!](https://thenexusofprivacy.net/intersectional-perspectives-and-the-omnibus-drops-federal-privacy-legislation-update-december-20/) (December 20) ## Fourth Amendment Is Not For Sale Act The [Fourth Amendment Is Not For Sale Act](https://www.freepress.net/news/press-releases/groups-urge-congress-pass-fourth-amendment-is-not-for-sale-act?ref=thenexusofprivacy.net) feels to me like a huge missed opportunity, with strong support from everybody at its [House Judiciary hearing](https://techpolicy.press/bipartisan-support-for-fourth-amendment-is-not-for-sale-act-at-house-judiciary-hearing/?ref=thenexusofprivacy.net), and well-justified mistrust of law enforcement and intelligence agencies from both parties. Alas, even though there were no obvious downsides to anybody but the surveillance-industrial complex, outgoing House Judiciary Chair Jerry Nadler never scheduled it for a markup. Still, Incoming Judiciary Chair Jim Jordan is a supporter as well (and so is past Judiciary Chair Bob Goodlatte) so it still has a good chance. ## The American Data Privacy and Protection Act (ADPPA) ADPPA advanced from the House Energy & Commerce committee on a 53-2 vote, but could never overcome resistance from California, Washington, Maine, and other states that objected to its preemption of stronger current and future state and local laws. It's the first comprehensive privacy bill to advance from committee this decade, so a signficant achievement, especially the bipartisan support for privacy as a civil right. Preemption's far from the only issue with ADPPA; still, the bill's got plenty of supporters who see its giveaways to Big Tech as a feature, and don't have any problems with how it falls short in protecting LGBTAIQ2S+ people, pregnant people, unhoused people, immigrants, and others who bear the brunt of privacy abuses. So it'll probably be back again in 2023, and Republicans and centrist Dems have the votes to get it through the House, quite possibly weakening it even further in the process. Especially if DC-based privacy and civil rights organizations continue to support it (because "perfect is the enemy of the good"), there will be a lot of pressure on Senate Commerce Committee Chair Maria Cantwell to get on board. Then again, Big Tech's going to continue provide high-profile examples of how badly regulation is needed, so hopefully DC-based privacy and civil rights organizations will start putting more effort into pushing to strengthen ADPPA instead of trying to convince Californians to give up their rights. ## Kids privacy: KOSA and COPPA 2.0 On kids privacy, Senate Commerce also advanced the unconstitutional, anti-LGBTQ KOSA (the Kids Online Safety Act), and there were reports that the White House was pressuring Senators to support it, but spirited opposition from [over 90 human rights and LGBTQ rights groups](https://cdt.org/press/more-than-90-human-rights-and-lgbtq-groups-sign-letter-opposing-kosa/?ref=thenexusofprivacy.net) kept it from being added to the omnibus. Tech industry groups are suing to block [California's similarly unconstitutional Age Appropriate Design Code](https://www.techdirt.com/2022/09/02/the-supreme-court-already-explained-why-californias-age-appropriate-design-code-is-unconstitutional/?ref=thenexusofprivacy.net), but that probably won't prevent Congress from giving KOSA another try next year. Senate Commerce advanced COPPA 2.0 along a mostly-party-line vote, but Republican Senator Tom Wicker (D-MS) and others argued that it was better to focus on ADPPA because it fails to protect adults as well as kids. As Senator Ed Markey notes, there are some key points that are in common between hese bills: banning targeted marketing to children, extending data protection to teenagers, and creating a Youth Marketing and Privacy division in the FTC. Like the Fourth Amendment Act Is Not For Sale, this is a place where it would be easy for Congress to do something if they wanted to ... but I'm not holding my breath. ## My Body My Data and the Health and Location Data Privacy Act Rep. Sara Jacobs' [My Body My Data Act](https://sarajacobs.house.gov/news/documentsingle.aspx?DocumentID=542&ref=thenexusofprivacy.net) to protect reproductive health data never got a hearing, and with Republicans in control of the House next year it's not likely to move forward. Even so, this may well wind up as the session's most impactful bill: Washington state's [My Health My Data Act](https://www.atg.wa.gov/news/news-releases/ag-ferguson-rep-slatter-sen-dhingra-propose-legislation-protect-washingtonians?utm%5Fmedium=email&utm%5Fsource=govdelivery) is only one of many health data privacy acts we're likely to see in 2023\. Danielle Keats Citron's [The End of Roe Means We Need a New Civil Right to Privacy](https://slate.com/technology/2022/06/end-roe-civil-right-intimate-privacy-data.html?ref=thenexusofprivacy.net) discusses the role of My Body My Data Act and the Warren/Wyden/Murray Health and Location Data Privacy Act (which also didn't get a hearing) in a post-Roe world. ## 2023 will be an interesting year! Of course, we'll also see new federal privacy legislation in 2023\. As Lia Holland of Fight for the Future and Mariah Grant of the Sex Workers Project of the Urban Justice Center point out in *Fast Company* [Democrats’ double standard on financial surveillance will be even more dangerous](https://www.fastcompany.com/90825854/democrats-double-standard-on-financial-surveillance-will-be-more-dangerous-in-2023?ref=thenexusofprivacy.net). So there may well e a lot going on in Congress. And of course as David Stauss points out in [The Future of State Privacy Legislation After the 2022 Election](https://www.bytebacklaw.com/2022/11/the-future-of-state-privacy-legislation-after-the-2022-election/?ref=thenexusofprivacy.net), there's a lot going on at the state level too. Here in Washington state, our legislative session starts on January 9\. The [My Health My Data Act](https://www.atg.wa.gov/news/news-releases/ag-ferguson-rep-slatter-sen-dhingra-propose-legislation-protect-washingtonians?ref=thenexusofprivacy.net) is extremely promising and the [People's Privacy Act](https://www.aclu-wa.org/story/introducing-people%E2%80%99s-privacy-act-real-privacy-protections-everyone?ref=thenexusofprivacy.net) is closer than it's ever been to getting a hearing. Not only that, the Bad Washington Privacy Act's primary sponsor has retired after once again failing to pass weak, industry-backed legislation. A broad coalition of civil liberties, civil rights, consumer advocacy, labor, and progressive organizations and individual privacy advocates has steadily been building power over the last several years, and it feels like the best opportunity we've had yet to pass strong protections for Washingtonians. At the same time, we'll be staying involved with the federal legislation, building on the productive discussions we had with staffers this session. I'll have a more detailed 2023 preview early next year. Stay tuned! ## ### The omnibus drops - with no ADPPA or KOSA! Federal privacy legislation update, December 20 URL: https://thenexusofprivacy.net/intersectional-perspectives-and-the-omnibus-drops-federal-privacy-legislation-update-december-20/ Last updated: 2026-04-16T02:57:19.000Z The $1.7 trillion, 4155-page ["omnibus" appropriations bill](https://www.appropriations.senate.gov/imo/media/doc/JRQ121922.PDF?ref=thenexusofprivacy.net) was released at 1:30 am this morning – without any privacy legislation attached. With Congress rushing to leave DC before a huge snowstorm closes in, it looks like that's it for 2022\. Privacy legislation is hard. Still, by the time we got to the lame duck session, there weren't any good options on the table. [More than 90 human rights and LGBTQ Groups](https://cdt.org/press/more-than-90-human-rights-and-lgbtq-groups-sign-letter-opposing-kosa/?ref=thenexusofprivacy.net) opposed the Kids Online Safety Act (KOSA), and the sponsors' attempts to address the problems didn't go far enough. And as the [letter to Speaker Pelosi](https://wapeoplesprivacy.org/about/addpaletter-pelosi-12-16-22/?ref=thenexusofprivacy.net) on the American Data Privacy and Protection Act (ADPPA) from WA People's Privacy, Washington Poor People's Campaign, PDX Privacy, Japanese American Citizens League Seattle Chapter, Whatcom Human Rights Task Force and a bunch of Indivisible groups details, the current version of ADPPA needs significant strengthening "to protect abortion healthcare-seekers, Immigrants, Poor, BIPOC, LGBTQ2SIA+ and unfavored communities and individuals from commercial surveillance and overreaches of law enforcement via access to our data." Far better to continue the discussions in 2023 than to pass a bill with major problems. And the anti-climactic ending shouldn't undercut the very real progress that was made in 2022: - ADPPA was the first comprehensive privacy bill to advance from committee this decade – and a 53-2 bipartisan vote that privacy is a civil right is a huge achievement. Not only that, as the [WA People's Privacy letter](https://wapeoplesprivacy.org/about/addpaletter-pelosi-12-16-22/?ref=thenexusofprivacy.net) highlights, there are specific suggestions for improvements that would address many of the bill's current weaknesses; and privacy abuses from companies like Twitter will no doubt continue to provide [real-world test cases](https://thenexusofprivacy.net/adppa-and-twitter-eight-questions-and-an-elephant/) as to how effective proposed legislation is. - On kids privacy, bipartisan consensus emerged on key high-level points from COPPA 2.0 and ADPPA (although there are lots of details to iron out): banning targeted marketing to children, extending data protection to teenagers, and creating a Youth Marketing and Privacy division in the FTC. - The Fourth Amendment Is Not For Sale Act got [strong bipartisan support](https://techpolicy.press/bipartisan-support-for-fourth-amendment-is-not-for-sale-act-at-house-judiciary-hearing/?ref=thenexusofprivacy.net) at its July hearing. - The FTC's Advance Notice of Potential Rulemaking and the White House Office of Science and Technology Policy's AI Bill of Rights laid the groundwork for strong regulation, either by Congress or the FTC So thanks to all the legislators, staffers, non-profits, advocates, and activists for the hard work on privacy this year! [Laying the groundwork for 2023?](https://thenexusofprivacy.net/a-coordinated-effort-not-to-mention-the-elephant/#laying-the-groundwork-for-2023) discusses the prospects for next year. In Congress, all the key bills have bipartisan sponsorship so may well remain on the table; it's hard to know how quickly they'll focus on privacy, but legislators from both parties understand that their constituents realllllllly want them to do something to rein in the privacy abuses from big tech companies and data brokers. And as David Stauss points out in [The Future of State Privacy Legislation After the 2022 Election](https://www.bytebacklaw.com/2022/11/the-future-of-state-privacy-legislation-after-the-2022-election/?ref=thenexusofprivacy.net), there's a lot going on at the state level as well. Including here in Washington state, where our legislative session starts on January 9 – and a broad coalition of organizations (including the ones who signed on to that letter to Pelosi) and individual privacy advocates has steadily been building power over the last several years. It should be a very interesting session here. The [My Health My Data Act](https://www.atg.wa.gov/news/news-releases/ag-ferguson-rep-slatter-sen-dhingra-propose-legislation-protect-washingtonians?ref=thenexusofprivacy.net) is extremely promising, and the [People's Privacy Act](https://www.aclu-wa.org/story/introducing-people%E2%80%99s-privacy-act-real-privacy-protections-everyone?ref=thenexusofprivacy.net) is closer than it's ever been to getting a hearing. So stay tuned for an exciting 2023! ### Privacy News: December 19 URL: https://thenexusofprivacy.net/privacy-news-december-19/ Last updated: 2022-12-19T18:43:14.000Z A big FTC settlement, student privacy, state and federal privacy legislation, security and privacy issues on Mastodon ... and more! ### [Fortnite Video Game Maker Epic Games to Pay More Than Half a Billion Dollars over FTC Allegations of Privacy Violations and Unwanted Charges](https://ftc.gov/news-events/news/press-releases/2022/12/fortnite-video-game-maker-epic-games-pay-more-half-billion-dollars-over-ftc-allegations?ref=thenexusofprivacy.net) the Premerger Notification Office Staff on Federal Trade Commission (ftc.gov) Epic will pay a $275 million penalty for violating children’s privacy law, change default privacy settings, and pay $245 million in refunds for tricking users into making unwanted charges. Of course it's still just a "cost of doing business", but $500 million. here, $500 million there, and pretty soon you're talking some real money! ALSO: - [Top FTC official warns companies on data](https://axios.com/2022/12/15/ftc-official-warns-consumer-protection-data?ref=thenexusofprivacy.net), Ashley Gold on axios.com, with more general perspectives from Samuel Levine, director of the FTC's bureau of consumer protection. Levine tells Axios the agency won't hesitate to sue companies that abuse customers' data -- and warns companies (like Twitter) that have signed FTC consent decrees that "there's no pause button" on such agreements. ### [What’s more common: opt-in, opt-out, or notice cookie banners?](https://natlawreview.com/article/what-s-more-common-opt-opt-out-or-notice-cookie-banners?ref=thenexusofprivacy.net) David A. Zetoony on The National Law Review (natlawreview.com) In the latest in a series based on Greenberg Traurig LLP's review of the publicly available privacy notices and practices of 555 companies, Zetoony looks at the dreaded cookie banners. From a privacy perspective, the best option is "opt in": you don't get cookies unless you explicitly request them. By contrast, an "opt out" approach (cookies unless you say know) means that companies can exploit your data unless you say otherwise. Even worse is what Zetoony describes as "deemed consent" and "notice only": a notice telling you that they're using cookies and there's nothing you can do about it; or no banner at all, so you don't even know what they're using cookies for. This analysis shows that 28.5% of the sites they looked at are opt in ... kudos to them for doing the right thing, and brickbats to everybody else. And kudos to Zetoony and Greenberg Traurig LLP, this kind of data ## Student Privacy ### [Most apps used in US classrooms share students’ personal data with advertisers, researchers find](https://cyberscoop.com/apps-expose-student-data-privacy?ref=thenexusofprivacy.net) Tonya Riley on CyberScoop (cyberscoop.com) 96% of the apps used in U.S. K-12 schools share children’s personal information with third parties — including advertisers — often without the knowledge or consent of users or schools, [according to a study by Internet Safety Labs published Tuesday](https://www.globenewswire.com/news-release/2022/12/13/2573005/0/en/Internet-Safety-Labs-Research-Reveals-96-of-School-Apps-Send-Student-Data-to-Third-Parties-Including-Advertisers.html?ref=thenexusofprivacy.net). > Researchers looked at 13 schools in every state, leading to a total of 663 schools representing nearly half a million students. They found that most schools had more than 150 approved technologies for classrooms, a dizzying number for parents and school administrators to monitor. One school had as many as 1,411. > > The report follows previous research from the group, formerly known as the Me2B Alliance, finding hundreds of advertisers [collected valuable student data](https://www.cyberscoop.com/advertisers-are-sucking-up-student-data-even-after-courts-crack-down-researchers-say/?ref=thenexusofprivacy.net) from a website specializing in school sports data. #### [KCKPS leaders consider cameras in classrooms for virtual learning; some concerned about privacy, trust](https://kshb.com/news/local-news/kckps-leaders-consider-cameras-in-classrooms-for-virtual-learning-some-concerned-about-privacy-trust?ref=thenexusofprivacy.net) By: JuYeon Kim on KSHB 41 Kansas City News (kshb.com) Kansas City, Kansas, Public Schools is considering cameras in classrooms, but some community members are concerned. ## Federal privacy legislation ### [Dangerous “Kids Online Safety Act” Does Not Belong in Must-Pass Legislation](https://eff.org/deeplinks/2022/12/dangerous-kids-online-safety-act-does-not-belong-must-pass-legislation?ref=thenexusofprivacy.net) Jason Kelley and Aaron Mackey on Electronic Frontier Foundation (eff.org) Everybody agrees that doing something about the abuses of kids' privacy is critical ... but even though the [controversial](https://www.washingtonpost.com/politics/2022/12/15/senates-year-end-childrens-privacy-push-faces-uphill-climb/?ref=thenexusofprivacy.net) and unconstitutional Kids Online Safety Act ([KOSA](https://aboutbgov.com/52Q?ref=thenexusofprivacy.net)) has some privacy-related provisions, it's still a bad bill. The sponsors have made some changes in response to the letter that [more than 90 human rights and LGBTQ Groups](https://cdt.org/press/more-than-90-human-rights-and-lgbtq-groups-sign-letter-opposing-kosa/?ref=thenexusofprivacy.net) sent opposing KOSA last mongth, but as Kelley and Mackey discuss they don't address the underlying problems. Last week Emily Brinbaum of Bloomberg reported that [the White House is making calls to legislators pressuring them to attach this anti-LGBTQ bill to the must-pass "omnibus" spending bill](https://twitter.com/birnbaum%5Fe/status/1603833663464013840?ref=thenexusofprivacy.net), but House Democrat leadership is pushing back. As I was writing this newsletter, Ashley Gold of Axios reported that she's heard that KOSA isn't in the omnibus. If so that's good news. Keep your fingers crossed! ### [ADPPA and Twitter: eight questions and an elephant](https://thenexusofprivacy.net/adppa-and-twitter-eight-questions-and-an-elephant/) Jon Pincus, the Nexus of Privacy (thenexusofprivacy.net) The American Data Privacy and Protection Act (ADPPA) consumer privacy bill also seems unlikely to be attached to the omnibus at this point (although it ain't over til its over) but with its bipartisan sponsorship it's likely to be back on the table next year. Recent events at Twitter provide some clear examples of what’s at stake with real-world privacy-abuses to test how effective ADPPA is going to be in practice. ## State privacy legislation #### [Tech industry group sues to block California law designed to protect kids online over free speech concerns](https://cnbc.com/2022/12/14/tech-grojup-netchoice-sues-to-block-california-kids-online-safety-law.html?%5F%5Fsource=sharebar%7Ctwitter&ref=thenexusofprivacy.net) Lauren Feiner on CNBC (cnbc.com) The group that sued Texas and Florida over social media laws that seek to restrict the tech industry’s liability shield for content is going after California. #### [Looking Forward and Back at the California State Legislature](https://eff.org/deeplinks/2022/12/looking-forward-and-back-california-state-legislature?ref=thenexusofprivacy.net) Hayley Tsukayama on Electronic Frontier Foundation (eff.org) As California’s new two-year session kicks off, EFF looks back at the past session which featured several victories for EFF and its allies advocating for digital rights victories. California is often seen as a leader in recognizing the importance of privacy, innovation, and free expression. Similar bills are being considered this y year in Washington, and no doubht other states, so hopefully we'll be able to build on California's leadership. #### [U.S. State Privacy Laws in 2023: California, Colorado, Connecticut, Utah and Virginia](https://jdsupra.com/legalnews/u-s-state-privacy-laws-in-2023-6910220?ref=thenexusofprivacy.net) Theodore Augustinos on JD Supra (jdsupra.com) A look at new consumer privacy laws coming into effect in California, Colorado, Connecticut, Utah, and Virginia. We've included similar analyses in past issues of the newsletter, but it's interesting to see the different perspectives. This one for example has [a useful chart comparing the different laws](https://www.lockelord.com/-/media/files/newsandevents/publications/2022/12/us-state-privacy-laws-2023.pdf?sc%5Flang=en&ref=thenexusofprivacy.net), which highlights both similarites and some important differences. ## Mastodon ### [Fleeing Twitter users face uncertain privacy, security features on alternative platforms](https://www.cyberscoop.com/twitter-mastodon-law-enforcement-surveillance/?ref=thenexusofprivacy.net) Tonya Riley, Cyberscoop (cyberscoop.com) An excellent high-level look at the security and privacy risks of Mastodon and other Twitter alternatives. A lot of the articles I've seen stop with the basics: Mastodon, like Twitter and Facebook, doesn't encrypt private messages, so admins can read them. But that's just the tip of the iceberg. For example: > As the number of Mastodon grow, so too will data requests from law enforcement. In recent years, law enforcement has increasingly leaned on tech companies for data that can be used to prosecute crimes — [including criminalized abortion](https://www.npr.org/2022/08/12/1117092169/nebraska-cops-used-facebook-messages-to-investigate-an-alleged-illegal-abortion?ref=thenexusofprivacy.net). In just the first six months of 2022, Twitter received nearly 50,000 legal demands, [including a 103% increase](https://www.axios.com/2022/07/28/twitter-report-government-demand-user-info?ref=thenexusofprivacy.net) in legal demands from governments targeting journalists. > > Privacy and security experts are concerned that platforms such as Mastodon are poorly positioned to properly deal with data requests like these. Addressing them would likely fall on independent Mastodon server administrators or their hosting companies, not Mastodon. While Mastodon is based in Germany, its administrators and their hosting companies span the globe. Yeah really. Riley quotes several Mastodon instance admins who basically say, well, if it happens they'll get a lawyer. As privacy and security expert Violet Blue pointed out in her [Cybersecurity Roundup](https://www.patreon.com/posts/cybersecurity-13-75856043?ref=thenexusofprivacy.net) on December 13, there are some big red flags here. Not to sound like a broken record, but **assume that nothing on Mastodon is private, and do not use it for confidential information**! Riley also briefly discusses Hive Social, another Twitter alternative. Hive had a very high-profile security problem, and shut down for a few weeks to address the underlying issues (although it's now back up). As Violet Blue points out, Hive did the right thing here by prioritizing user safety. ## And ... #### [How to spot AI-generated text](https://technologyreview.com/2022/12/19/1065596/how-to-spot-ai-generated-text?ref=thenexusofprivacy.net) Melissa Heikkilä on MIT Technology Review (technologyreview.com) The internet is increasingly awash with text written by AI software. We need new tools to detect it. #### [Under Surveillance: (Mis)use of Technologies in Emergency Responses](https://ecnl.org/publications/under-surveillance-misuse-technologies-emergency-responses?ref=thenexusofprivacy.net) 23-12-2021 on ECNL (ecnl.org) ECNL, INCLO and Privacy International joint report focuses on global lessons from the COVID-19 pandemic. #### [Dayton-area police departments expanding license plate reader use as privacy concerns remain](https://daytondailynews.com/local/dayton-area-police-departments-expanding-license-plate-reader-use-as-privacy-concerns-remain/CPS6RBE6QRHQ7M2THKY6PI7MG4?ref=thenexusofprivacy.net) Nick Blizzard on Dayton Daily News (daytondailynews.com) Dayton, Miamisburg have added automated license plate readers in past several months; Beavercreek and Kettering among police departments that say they help solve crimes while Ohio ACLU, others raise questions. #### [EU takes step towards US data-sharing agreement](https://theregister.com/2022/12/14/eu%5Fus%5Fdata%5Fsharing%5Fagreement?ref=thenexusofprivacy.net) Lindsay Clark on The Register (theregister.com) Campaigners say it’s unlikely to pass a test in the courts, though #### [Sen. Elizabeth Warren Questions Tax Filing Companies, Meta, and Google About Sharing of Financial Data](https://themarkup.org/pixel-hunt/2022/12/14/sen-elizabeth-warren-questions-tax-filing-companies-meta-and-google-about-sharing-of-financial-data?ref=thenexusofprivacy.net) Colin Lecher on The Markup (themarkup.org) Letters to the companies, signed by Warren and others, cite a recent Markup investigation #### [Violation of Right to Privacy: Karti Chidambaram on ‘Orwellian’ usage of facial recognition by Chennai police](https://moneycontrol.com/news/business/violation-of-right-to-privacy-karti-chidambaram-on-orwellian-usage-of-facial-recognition-by-chennai-police-9698351.html?ref=thenexusofprivacy.net) Aihik Sur on Moneycontrol (moneycontrol.com) This comes a few days after the Greater Chennai Police admitted to using the technology in response to a tweet by a Chennai resident. #### [Privacy Breaches to Cost More in Australia as Maximum Penalty Increases to AUD 50 Million](https://cpomagazine.com/data-protection/privacy-breaches-to-cost-more-in-australia-as-maximum-penalty-increases-to-aud-50-million?ref=thenexusofprivacy.net) Scott Ikeda on CPO Magazine (cpomagazine.com) Organizations found to be responsible for a privacy breach now face a maximum penalty of AUD 50 million, 30% of adjusted annual domestic turnover, or three times the value of any benefit obtained through the misuse of the leaked information. #### [Microsoft to roll out ‘data boundary’ for EU customers from Jan. 1](https://reuters.com/technology/microsoft-roll-out-data-boundary-eu-customers-jan-1-2022-12-15?ref=thenexusofprivacy.net) Martin Coulter on Reuters (reuters.com) Microsoft Corp said on Thursday its European Union cloud customers will be able to process and store parts of their data in the region from Jan. 1. #### #### [Federal Agencies Keep Rejecting FOIA Requests for Their Procedures for Handling FOIA Requests](https://eff.org/deeplinks/2022/12/federal-agencies-keep-rejecting-foia-requests-their-procedures-handling-foia?ref=thenexusofprivacy.net) Beryl Lipton on Electronic Frontier Foundation (eff.org) The majority of federal agencies — including law enforcement agencies like Customs and Border Protection — are refusing to release some of the most basic guidance materials used by their Freedom of Information Act (FOIA) offices: procedures for how they do their jobs.Government Attic, a website... #### [The post-Merge Ethereum ecosystem needs privacy more than ever](https://venturebeat.com/security/the-post-merge-ethereum-ecosystem-needs-privacy-more-than-ever?ref=thenexusofprivacy.net) Warren Paul Anderson, Discreet Labs on VentureBeat (venturebeat.com) Privacy in Ethereum must not be a bolt-on feature; it should should become a built-in foundation that enhances user experience. #### [Hulu customer claims an employee violated her privacy by using personal information to contact her after a virtual service chat](https://businessinsider.com/hulu-customer-says-employee-used-personal-contact-information-violated-privacy-2022-11?ref=thenexusofprivacy.net) Jordan Hart on Insider (businessinsider.com) “How many other women has he done this to, and how else is he using my information?” Strauss asked in a TikTok post that went viral earlier this week. #### [Is privacy is possible on the Internet? An interview with Neeva founder and former Google exec Sridhar Ramaswamy](https://itworldcanada.com/article/is-privacy-is-possible-on-the-internet-an-interview-with-neeva-founder-and-former-google-exec-sridhar-ramaswamy/518651?ref=thenexusofprivacy.net) Jim Love on IT World Canada (itworldcanada.com) On Dec 13th, a new search engine, described by some as the “anti-google” called Neeva will be available to use in Canada. Here's an interview with Neeva's CEO. #### [EFF Agrees With the NLRB: Workers Need Protection Against Bossware](https://eff.org/deeplinks/2022/12/eff-agrees-nlrb-workers-need-protection-against-bossware?ref=thenexusofprivacy.net) José EFA and Hayley Tsukayama on Electronic Frontier Foundation (eff.org) The general counsel of the National Labor Relations Board (NLRB) issued an important memo that calls for regulators to protect workers against what she described as “unlawful electronic surveillance and automated management practices.” #### [Is Your Secret Santa App on the Privacy Naughty List?](https://slate.com/technology/2022/12/secret-santa-apps-elfster-privacy-gift-exchange.html?ref=thenexusofprivacy.net) Mia Armstrong-López on Slate (slate.com) Plus, stories from the recent past of Future Tense. #### [Secrecy v. Privacy in Donor Conception Families](https://psychologytoday.com/intl/blog/donor-family-matters/202212/secrecy-v-privacy-in-donor-conception-families?ref=thenexusofprivacy.net) Wendy Kramer is Co-Founder and Director of the Donor Sibling Registry (DSR). on Psychology Today (psychologytoday.com) Walking the fine line between privacy and secrecy is inherent in donor families. #### [Leo Varadkar nightclub footage triggers privacy debate in Ireland](https://theguardian.com/world/2022/dec/13/leo-varadkar-nightclub-footage-triggers-privacy-debate-in-ireland-social-media-regulation?ref=thenexusofprivacy.net) Rory Carroll on The Guardian (theguardian.com) Leaked clip of deputy leader also fuels moves to tighten social media regulation #### [Hongkonger jailed for 8 months in first doxxing sentence under revised privacy law](https://scmp.com/news/hong-kong/law-and-crime/article/3203443/hong-kong-court-jails-man-8-months-first-sentencing-under-revamped-privacy-law-over-malicious?ref=thenexusofprivacy.net) Brian Wong on South China Morning Post (scmp.com) Ho Muk-wah received 8 months’ jail for seven counts of disclosing personal data without consent, including creating fake online accounts under ex-partner’s name. #### [Standing to Sue: Is Theft of Drivers’ License Numbers Sufficient to Allege Imminent Threat of Future Harm?](https://natlawreview.com/article/standing-to-sue-theft-drivers-license-numbers-sufficient-to-allege-imminent-threat?ref=thenexusofprivacy.net) Ryan P. Blaney on The National Law Review (natlawreview.com) Judge Jeffrey White of the Northern District of California recently dismissed a putative class action lawsuit in which plaintiffs claimed they faced an imminent threat of future of harm in the form of identity theft and fraud because their personal information, specifically their driver’s license numbers, may have been compromised in a data breach. In doing so, the court determined that driver’s license numbers “are not as sensitive as social security numbers,” and that they don’t rise to the level of sensitive personal information “needed to establish a credible and imminent threat of future harm” for Article III standing. #### #### [Exhibit At University Of Oxford Shows Differences Between Algorithmic And Human Curation](https://indiaeducationdiary.in/exhibit-at-university-of-oxford-shows-differences-between-algorithmic-and-human-curation?ref=thenexusofprivacy.net) iednewsdesk on India Education (indiaeducationdiary.in) Researchers at the Oxford Internet Institute are launching ‘The Algorithmic Pedestal,’ a public exhibition taking place at J/M Gallery in London from 11-17 January 2023, which will highlight differences between human and algorithmic ways of seeing. Artist Fabienne Hess is bringing her human perspective, while the Instagram algorithm adds the machine perspective. ### ADPPA and Twitter: eight questions and an elephant URL: https://thenexusofprivacy.net/adppa-and-twitter-eight-questions-and-an-elephant/ Last updated: 2026-04-16T02:56:56.000Z > Please share your perspectives [in the Nexus of Privacy Dreamwidth community](https://thenexusofprivacy.dreamwidth.org/?ref=thenexusofprivacy.net), on Mastodon at [mastodon.social](https://mastodon.social/@nexusofprivacy/109537966385611270https://mastodon.social/@nexusofprivacy/109538025678246914?ref=thenexusofprivacy.net) or [on Twitter](https://twitter.com/NexusOfPrivacyhttps://twitter.com/NexusOfPrivacy/status/1604670734504431616?ref=thenexusofprivacy.net) (unless we get suspended for having a Mastodon link in our profile 🤣*)* > "One effective tactic we've used to cut through the complexity of the legislation is to focus on real-world privacy abuses. How effective will proposed legislation actually be at stopping them? If it falls short, how can it be strengthened?" > > –[ Three lessons from “the other Washington”](https://thenexusofprivacy.net/the-view-from-the-other-washington-federal-privacy-legislation-adppa-update-6-22/), June 2022 With only a few days left before Congress wraps up for the year, it’s hard to know what’s up with the American Data Privacy and Protection Act (ADPPA) consumer privacy bill. The situation hasn't changed since [ADPPA and a “coordinated effort” not to mention the elephant](https://thenexusofprivacy.net/a-coordinated-effort-not-to-mention-the-elephant/): ADPPA has no chance to go forward in the House unless the roadblock over its preemption of current and future state and local privacy laws is resolved. Even if that happens, ADPPA still has a big problem in the Senate where Senators Maria Cantwell and Ron Wyden have criticized it as too weak. Still, ADPPA’s supporters continue to express confidence, and Big Tech has a track record of late-in-sessions shenanigans ... so we shall see. As we say here in "the other Washington", [it ain’t over til it’s over](https://wa-privacy.net/it-aint-over-till-its-over/?ref=thenexusofprivacy.net). Even if ADPPA doesn’t move forward in the lame duck session it will be back next year – and as [Laying the groundwork for 2023?](https://thenexusofprivacy.net/a-coordinated-effort-not-to-mention-the-elephant/#laying-the-groundwork-for-2023) discusses, it'll influence state legislation as well. ADPPA’s supporters admit that it's a flawed bill, so whether it’s before a last-minute lame duck vote in Congress, or as starting the prep for next year, it's worth looking at where it falls short and should be strengthened. Recent events at Twitter provide some clear examples of what’s at stake with real-world privacy-abuses to test how effective ADPPA is going to be in practice. For example, consider the issue Sara Morrison explored in[ What happens to your Twitter data when Elon takes over](https://www.vox.com/recode/2022/10/27/23427106/elon-musk-twitter-data-direct-messages?ref=thenexusofprivacy.net): Twitter doesn’t ever actually delete your private messages, even if you delete your account.\[1\] This leads to some very concrete questions to evaluate how effective the bill is: - Does ADPPA give you the ability to force Twitter to delete your data? - If Twitter refuses to delete your data, does ADPPA allow you to sue them for damages? - If Twitter refuses to delete the data of any Washington state residents, can AG Ferguson (who has a long track record of taking on Big Tech companies and winning) use his full investigative and enforcement powers to hold them accountable? - If there’s some data about you that you can’t make Twitter delete, does ADPPA at least give you the ability to prevent them from using your data to improve their product and service? And the new Chief Twit is an anti-trans bigot who’s reinstatating accounts of anti-trans people suspended for hate speech, having chummy discussion with an anti-trans hate group …so it’s a good time to apply Antoine Prince Albert III’s suggestton in[ Hiding OUT: A Case for Queer Experiences Informing Data Privacy Laws](https://publicknowledge.org/hiding-out-a-case-for-queer-experiences-informing-data-privacy-laws?ref=thenexusofprivacy.net): stress-test the law against the harsh and worsening realities of queer experiences. A couple of specific questions: - Does ADPPA prevent Twitter from sharing information about people’s sexual orientation, gender identity, and gender expression \[2\] without their consent? - Does ADPPA prevent Twitter from sharing queer people's location data with hate groups and law enforcement in states that have criminalized gender-affirming health care or passed “don’t say gay” bills? And as well as the queer lens, it’s important to look from the perspective of other groups facing harsh and worsening realities as well. For example: - Does ADPPA protect the privacy of Twitter employees or contractors whose are engaging in worker activism? - Does ADPPA prevent Twitter selling or sharing pregnant people's data with anti-abortion “crisis pregnancy centers,” bounty hunters, or law enforcement in states that have criminalized abortion? This is the elephant in the room that ADPPA supporters do their best to avoid talking about. As Kim Clark of Legal Voice says, “This bill, at least from the perspective of pregnant people, it really doesn’t do much.” Some of these questions have fairly straightforward answers; others are tricky. Unsurprisingly, I have thoughts, and I'll do a follow-up post with my take on it ... but first, I'd love to hear what others have to say. I've started up threads on Dreamwidth, Mastodon, and Twitter to discuss – links coming soon. Please let us know what you think! ## Notes \[1\] Zack Whittaker originally reported this in[ Twitter doesn’t actually delete your direct messages when you try to delete them](https://techcrunch.com/2019/02/15/twitter-direct-messages/?ref=thenexusofprivacy.net) in 2019 on *TechCrunch.* For those of you in the European Union, Michael Veale’s [Deleting DMs from Twitter using the GDPR](https://michae.lv/deleting-dms-from-twitter/?ref=thenexusofprivacy.net) lets you file a request. Worth mentioning: Twitter’s investors (including Larry Ellison, Andreessen-Horowitz, Saudi Prince Alaweed, and the Qatar investment Fund) all have undisclosed “special rights” to the data ... more good reasons to want to delete it! \[2\] Ontario Human Rights Commission's page on[ Gender identity and gender expression](https://www3.ohrc.on.ca/en/en/policy-preventing-discrimination-because-gender-identity-and-gender-expression/3-gender-identity-and-gender-expression?ref=thenexusofprivacy.net) is a good short reference on the distinctions between gender identity, gender expression, sexual orientation, and sex. --- Image credit: from “Question Mark” by Hana Chramostova licensed under [CC1.0 Universal Public Domain license](https://creativecommons.org/publicdomain/zero/1.0/?ref=thenexusofprivacy.net), via [PublicDomainPictures.net](https://www.publicdomainpictures.net/en/view-image.php?image=160217&picture=question-mark&ref=thenexusofprivacy.net) ### Privacy News: December 15 URL: https://thenexusofprivacy.net/privacy-news-december-15/ Last updated: 2022-12-15T16:52:58.000Z Privacy after Roe, surveillance, FTC comments, state and federal privacy legislation ... there's so much in the news these last few days that I'm leaving stuff related to Twitter and Mastodon out of this issue of the newsletter, and will have a followon tomorrow. Even without that, though, this is one of the juiciest news roundups yet! ### [This Privacy Setting Helps Keep Facebook From Tracking You](https://cnet.com/news/privacy/this-privacy-setting-helps-keep-facebook-from-tracking-you?ref=thenexusofprivacy.net) Katie Teague on CNET (cnet.com) The Off-Facebook Activity tool lets you see and control data that apps and websites share with the platform, see what information third-party apps can access, and toggle off Future Off-Facebook Activity – which tells Facebook to disconnect any information the company has shared from your account. Huzzah! The headline's a bit overblown; Facebook will still track you in other ways. Also, the activity lists don't show all the activity that Facebook has received – for example, information they've received when you're not logged into Faecbook, or details such as items added to your shopping cart. Still, it's a very valuable privacy setting, one one that most people don't know about. The article says the setting's under **Settings & Privacy** \> **Settings** \> **Off-Facebook Activity –** presumably that's talking about the app. On the web interface, I found it in **Settings & Privacy** \> **Settings** \> **Privacy** \> **Your Facebook Information** \> **Off-Facebook Activity** ## Automated decision systems ### [Economies of Virtue – The Circulation of ‘Ethics’ in AI](https://networkcultures.org/blog/publication/economies-of-virtue-the-circulation-of-ethics-in-ai?ref=thenexusofprivacy.net) Edited by Thao Phan, Jake Goldenfein, Declan Kuch, and Monique Mann, on the Institute of Network Cultures (networkcultures.org) Theory on Demand #46 features articles from a really outstanding list of authors: Corinne Cath and Os Keyes; Sarah Pink; Rodrigo Ochigame; Sy Taffel, Laura Bedford, and Monique Mann; Angela Daly; Tsvetelina Hristova and Liam Magee; Michael Richardson; Jake Goldenfein, Lilly Irani, J. Khadijah Abdurahman, and Alex Hanna; Jathan Sadowski, Thao Phan, and Meredith Whittaker. From the blurb: > This anthology is a collective response to the reification of ethics into commodity forms. It explores how industry participation in ‘ethical AI’ research has created a new ‘economy of virtue’—a massive network of actors variously situated across industry, civil society, and universities, producing and circulating ethics as a service and a product. The contributors present both critical perspectives and first-hand experiences of this economy. They address a wide range of topics including: the contradictions and personal dilemmas of working in industry-funded spaces; case studies of AI ethics in domains such as defence, facial recognition, and standards setting; critical assessments of techniques like green-washing and the manufacture of trust; and the risks and practicalities of direct action such as speaking up, organizing against and dropping out. Together, these contributions give voice to the intractable problems of co-option, capture, and complicity that plague AI ethics, and give shape to the networks and circulations defining the field. ### [For AI bias law coming January 1, unanswered questions remain](https://venturebeat.com/ai/for-nycs-new-ai-bias-law-unanswered-questions-remain?ref=thenexusofprivacy.net) Sharon Goldman on VentureBeat (venturebeat.com) On January 1, a new law regulating the use of AI employment decision tools goes into effect. What does it mean for U.S. businesses? ## Privacy after Roe ### [Give a Mouse a Cookie, Get a BAA: OCR Bulletin on Tracking Raises HIPAA Risks for HIPAA-Regulated Entities and Online Tracking Vendors](https://hintzelaw.com/hintzelaw-blog/2022/12/12/give-a-mouse-a-cookie-get-a-baa-ocr-bulletin-on-tracking-raises-hipaa-risks-for-hipaa-regulated-entities-and-online-tracking-vendors?ref=thenexusofprivacy.net) Mason Fitch on Privacy Law Matters (hintzelaw.com) A deep dive into the recent [Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associate](https://www.hhs.gov/about/news/2022/12/01/hhs-office-for-civil-rights-issues-bulletin-on-requirements-under-hipaa-for-online-tracking-technologies.html?ref=thenexusofprivacy.net) bulletin from the U.S. Department of Health & Human Services Office for Civil Rights (OCR) – and what covered entities and business partners need to do to ensure they're complying. The bulletin explains how HIPAA’s reach extends to information collected on websites or mobile apps. > While HIPAA-regulated entities have long understood that their ‘internal tools’ (ex: EHR’s, practice management, and clinical support software) must comply with HIPAA, the new bulletin makes it clear that information that is routinely collected by vendors on public-facing websites, apps, and web-based assets may be PHI as well. ## FTC ### [Record Set: Assessing Points of Emphasis from the Public Input on the FTC’s Privacy Rulemaking](https://fpf.org/blog/record-set-assessing-points-of-emphasis-from-the-public-input-on-the-ftcs-privacy-rulemaking?ref=thenexusofprivacy.net) Tatiana Rice, Felicity Slater, and Chloe Suzman on Future of Privacy Forum (fpf.org) A very interesting analysis based on sampling 70 of the more than 1,200 comments on the Federal Trade Commission’s Advance Notice of Proposed Rulemaking (ANPR) on “Commercial Surveillance and Data Security.” There was broad agreement on the value of data minimization (even Palantir and Google) and data security. The biggest area of contention is the FTC's authority, where trade associations and business communities unsurprisingly think they shouldn't have to be regulated. Also, there's a split on whether "commercial surveillance" is a good term; commercial surveillance trade association ITIF doesn't like it, and neither do other commenters (presumably commercial surveillance trade associations or businesses). Funny how that works. The authors also looks at the range of opinions on health data (especially important in light of the Dobbs decision ending the right to abortion), children's data, and Automated Decision-Making and Civil Rights. I was disappointed that FPF didn't include my comments on [Consent, Automated Systems, and Discrimination](https://thenexusofprivacy.net/consent-automated-systems-and-discrimination/), which I thought made some good points that others didn't, such as > The FTC should develop its regulations working with the people most likely to be harmed by commercial surveillance – and prioritize their needs. But then again they didn't mention *any* comments from individuals so hopefully it isn't anything personal. Anyhow, organizations concerned about discrimination thing the FTC should regulate; and industry groups suggest waiting for Congress to act. Since the American Data Privacy and Protection Act that Congress is currently considering allows commerical surveillance companies like Facebook and Google to do their own algorithmic impact assessments to see whether their software is discriminator, and exempts commercial surveillance service providers like Palantir and ShotSpotter, you can certainly see why industry would prefer that. #### [EPIC Commends FTC for Including Data Minimization & Data Rights in Chegg Settlement](https://epic.org/epic-commends-ftc-for-including-data-minimization-data-rights-in-chegg-settlement?ref=thenexusofprivacy.net) on EPIC - Electronic Privacy Information Center (epic.org) ## State privacy legislation ### [Cross-context behavioral advertising is ‘sale.’ It is time to get over it.](https://iapp.org/news/a/cross-context-behavioral-advertising-is-sale-it-is-time-to-get-over-it?ref=thenexusofprivacy.net) Michael Hahn and Tony Ficarrotta on International Association of Privacy Professionals (iapp.org) Of course it is, but really matters here is that Hahn is General Counsel and Executive Vice President of IAB, the Interactive Advertising Bureau, so this is essentially the official position of the ad industry. It relates to what some saw as ambiguity in the langauge of the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA, an update to CCPA passed in 2020 and going into effect on January 1, 2023) and how it relates to cross-context behavioral advertizing (CCBA). > The notion the CPRA amended the CCPA to make “sales” and “shares” mutually exclusive categories of personal information disclosures is fundamentally at odds with the structure of the law, which provides for those concepts to overlap. Indeed, a better reading of the CPRA is that all “shares” are “sales,” but not all “sales” are “shares.” For example, if an industry participant engages in CCBA, it is both a “share” and a “sale.” But there are certain measurement and reporting functions that can support CCBA, or other forms of advertising such as contextual, that are likely “sales” but not “shares....” > > In order to support continued growth in an increasingly fraught regulatory environment, we as an industry must coalesce around a common understanding of the CPRA that accepts the broad scope of the law. Our job is to comply. And that begins by accepting the term “sale,” which is here to stay, includes the CCBA. I'm not an expert on CPRA, CCPA, and CCBA interact but I *think* this aligns with the intent of the CPRA and the position of Califorinia Consumer Privacy Agency. If so, good for IAB! ### [The California Privacy Rights Act Brings New Data Requirements for Employers in 2023](https://jdsupra.com/legalnews/the-california-privacy-rights-act-7918001?ref=thenexusofprivacy.net) Molly Arranz on JD Supra (jdsupra.com) When CPRA goes into effect on January 1, 2023, it will end CCPA's temporary exemption for employee's data. This means that its protections now apply to , job applicants, officers, directors, and independent contractors as well as consumers. Arranz discusses what employers need to do to prepare for this. ### [How many businesses put up a “Do Not Sell My Personal Information” link even when they don’t have to?](https://natlawreview.com/article/how-many-businesses-put-do-not-sell-my-personal-information-link-even-when-they-don?ref=thenexusofprivacy.net) David A. Zetoony on The National Law Review (natlawreview.com) 8% – at least according to Greenberg Traurig LLP, who reviewed the publicly available privacy notices and practices of 555 companies. A bit of background: under CCPA, Companies that don't sell personal information – and say so in their privacy notice – don't have to have a “Do Not Sell My Personal Information” link. But some do, to give them the flexibility to sell the personal information they've collected at some point in the future. I'm not sure just what to think about the 8% number, but it's an interesting data point – and the first one of its type I've seen. ## Federal privacy legislation ### [Revamped Kids’ Online Privacy Bill Emerges in Year-End Push](https://about.bgov.com/news/revamped-kids-privacy-bill-slated-for-release-in-year-end-push/?ref=thenexusofprivacy.net) Maria Curi, Bloomberg Government (bgov.com) Kids Online Safety Act (KOSA) Senate sponsors Richard Blumenthal (D-Conn.) and Marsha Blackburn (R-Tenn.) unveiled a [reworked version](https://aboutbgov.com/52Q?ref=thenexusofprivacy.net) of the bill Tuesday. It's an attempt to look like they're responding to the criticism from [more than 90 human rights and LGBTQ Groups](https://cdt.org/press/more-than-90-human-rights-and-lgbtq-groups-sign-letter-opposing-kosa/?ref=thenexusofprivacy.net) who sent a letter opposing it. As Ari Cohn of Tech Freedom [says](https://masto.ai/@AriCohn/109514113477452072?ref=thenexusofprivacy.net), it's better but still pretty bad. Cohn's [thread](https://masto.ai/@AriCohn/109514113477452072?ref=thenexusofprivacy.net) goes into detail on how the improvements don't really address the major underlying issues. ### [VICTORY! The Safe Connections Act is Now Law](https://eff.org/deeplinks/2022/12/victory-safe-connections-act-now-law?ref=thenexusofprivacy.net) India McKinney on Electronic Frontier Foundation (eff.org) The Safe Connections Act makes it easier for survivors of domestic violence to separate their phone line from a family plan while keeping their own phone number. It also requires the FCC to create rules to protect the privacy of the people seeking this protection. This bill overwhelmingly passed both chambers of Congress, and it was signed by the President on December 7, 2022, making it [Public Law 117-223](https://www.congress.gov/bill/117th-congress/house-bill/7132?ref=thenexusofprivacy.net). It's not a perfect bill but it's a good incremental step. ### [Nearly 40 press rights and civil liberties organizations urge Sen. Schumer to help pass the PRESS Act](https://freedom.press/news/nearly-40-press-rights-and-civil-liberties-organizations-urge-sen-schumer-to-help-pass-the-press-act?ref=thenexusofprivacy.net) Freedom of the Press Foundation on Freedom of the Press (freedom.press) Letter argues that law would curtail trend of government surveillance of journalists. ## Surveillance ### [Surveillance Was Supposed to Make Long-Haul Trucking Safer. Did It?](https://slate.com/technology/2022/12/data-driven-trucker-surveillance-fatigue-elds.html?ref=thenexusofprivacy.net) Karen Levy on Slate (slate.com) The results were surprising—and alarming. This is an excerpt from Levy's [*Data Driven: Truckers, Technology, and the New Workplace Surveillance*](https://www.indiebound.org/book/9780691175300?aff=TAPBookClub&ref=thenexusofprivacy.net)*,* which has gotten great reviews (including Zephyr Teachout's [Cyborgs on the Highways](https://prospect.org/culture/books/cyborgs-on-the-highways-levy-review?ref=thenexusofprivacy.net) which was in the December 11 newsletter but is worth mentioning again! ### [The biggest lie tech people tell themselves — and the rest of us](https://vox.com/the-highlight/2019/10/1/20887003/tech-technology-evolution-natural-inevitable-ethics?ref=thenexusofprivacy.net) Rose Eveleth on Vox (vox.com) They see facial recognition, smart diapers, and surveillance devices as inevitable evolutions. They’re not. ### [Cops missing information on surveillance](https://baystatebanner.com/2022/11/23/cops-missing-information-on-surveillance?ref=thenexusofprivacy.net) Yawu Miller on The Bay State Banner (baystatebanner.com) Last year, the Boston City Council passed a sweeping law aimed at reining in surveillance practices by the Boston Police Department and other city agencies. Like surveillance ordinaces elsewhere, this required city departments to report on surveillance technologies their using like facial recognition, license plate readers, ShotSpotter and other gunshot detction technologies. > Yet during a hearing Monday with the Boston Police Department, police officials were unable to provide key pieces of information required by the ordinance, such as the location of surveillance devices or even how many officers have access to the information culled by such devices. ### [Can police use facial recognition as probable cause? Probably not, but some are doing it anyway](https://grid.news/story/technology/2022/12/08/can-police-use-facial-recognition-as-probable-cause-probably-not-but-some-are-doing-it-anyway?ref=thenexusofprivacy.net) Benjamin Powers on Grid News (grid.news) Using facial recognition has implications for the judicial system, from false arrests to racial bias #### [Violation of Right to Privacy: Karti Chidambaram on ‘Orwellian’ usage of facial recognition by Chennai police](https://moneycontrol.com/news/business/violation-of-right-to-privacy-karti-chidambaram-on-orwellian-usage-of-facial-recognition-by-chennai-police-9698351.html?ref=thenexusofprivacy.net) Aihik Sur on Moneycontrol (moneycontrol.com) This comes a few days after the Greater Chennai Police admitted to using the technology in response to a tweet by a Chennai resident. ## And ... #### [Forget erasure: why blockchain is really incompatible with the GDPR](https://medium.com/berkman-klein-center/forget-erasure-why-blockchain-is-really-incompatible-with-the-gdpr-9f60374e90f3?ref=thenexusofprivacy.net) Elizabeth M. Renieris on Berkman Klein Center Collection (medium.com) Whether blockchain-based projects can comply with the GDPR is a question of much debate and controversy at present. #### [What privacy issues are on deck for 2023? Here are some of the most interesting ones (Part One)](https://jdsupra.com/legalnews/what-privacy-issues-are-on-deck-for-2275753https://www.adlawaccess.com/2022/12/articles/what-privacy-issues-are-on-deck-for-2023-here-are-some-of-the-most-interesting-ones-part-one/?ref=thenexusofprivacy.net) KDW Privacy Team on Kelley Drye's Ad Law Access (adlawaccess.com) Five new state privacy laws will take effect at various points in 2023; other states may pass their own laws; the FTC has a rulemaking in progress ... > If 2022 was the year that regulators and companies spent positioning themselves on the field, 2023 will be the year the balls start flying. #### [Sen. Warren presses Defense Secretary about ex-Google CEO Schmidt’s potential conflicts when he advised Pentagon on AI](https://cnbc.com/2022/12/13/sen-warren-presses-defense-secretary-about-ex-google-ceo-schmidts-potential-conflicts-when-he-advised-pentagon-on-ai.html?ref=thenexusofprivacy.net) Eamon Javers,Kevin Breuninger on CNBC (cnbc.com) Elizabeth Warren pressed Defense Secretary Lloyd Austin about ex-Google CEO Eric Schmidt’s time on advisory panels connected to an industry he was investing in. #### [SIA and NTNU survey practitioners on Privacy by Design in national digital IDe](https://biometricupdate.com/202212/sia-and-ntnu-survey-practitioners-on-privacy-by-design-in-national-digital-id?ref=thenexusofprivacy.net) Alessandro Mascellino on BiometricUpdate.com (biometricupdate.com) The Secure Identity Alliance (SIA) and the Norwegian University of Science and Technology (NTNU) have partnered to conduct a survey on the implementation of Privacy by Design principles within National Digital Identity Systems (NDIS). #### [EU confirms draft decision on replacement US data transfer pact](https://techcrunch.com/2022/12/13/eu-us-data-privacy-framework-draft-decision?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) The European Commission has announced a draft decision on US adequacy, paving the way for a replacement EU-US data transfer deal to be adopted next year. #### [Privacy Advocates Love Strong Encryption, The FBI Doesn’t—Here’s Why](https://lifewire.com/privacy-advocates-love-strong-encryption-the-fbi-doesnt-heres-why-6891253?ref=thenexusofprivacy.net) Sascha Brodsky on Lifewire (lifewire.com) Apple has released new end-to-end encryption that helps protect iCloud data and security advocates love it, but the FBI doesn’t because it makes it harder for the agency to catch criminals. #### [Google urges advertisers to test post-cookie solution as it updates ‘Privacy Sandbox’](https://adage.com/article/digital-marketing-ad-tech-news/google-urges-advertisers-test-post-cookie-solution-it-updates-privacy-sandbox/2458981?ref=thenexusofprivacy.net) Garett Sloane on Ad Age (adage.com) Google updates its “Privacy Sandbox” with call for the industry to test it more, as advertisers look for alternate targeting techniques. #### [Apple’s End-to-End Encryption of Cloud Data a Victory for Privacy, Security and Safety](https://cdt.org/insights/apples-end-to-end-encryption-of-cloud-data-a-victory-for-privacy-security-and-safety?ref=thenexusofprivacy.net) Mallory Knodel, Nick Doty on Center for Democracy and Technology (cdt.org) Apple’s new features and service commitments that provide broader accessibility of strong end-to-end encryption are a victory for privacy and security, including safer online services for children. CDT is encouraged that Apple has taken onboard our and other advocates’ and experts’ advice in moving… #### [Privacy watchdogs to bite into edtech in 2023, analyst predicts](https://verdict.co.uk/privacy-watchdogs-to-bite-into-edtech-in-2023-analyst-predicts?ref=thenexusofprivacy.net) Eric Johansson on Verdict (verdict.co.uk) The edtech industry ballooned during the pandemic, but analysts now predict the sector will become the next target for privacy regulators. #### [Dark patterns, online ads will be potential targets for the next Commission, Reynders says](https://euractiv.com/section/digital/interview/dark-patterns-online-ads-will-be-potential-targets-for-the-next-commission-reynders-says?ref=thenexusofprivacy.net) Luca Bertuzzi on EURACTIV (euractiv.com) #### [The Privacy War Is Coming](https://darkreading.com/endpoint/the-privacy-war-is-coming?web%5Fview=true&ref=thenexusofprivacy.net) Damian Tommasino on Dark Reading (darkreading.com) Privacy standards are only going to increase. It’s time for organizations to get ahead of the coming reckoning. #### [Greek MPs Clash Over New Privacy Communications Bill](https://balkaninsight.com/2022/12/08/greek-mps-clash-over-new-privacy-communications-bill?ref=thenexusofprivacy.net) Eleni Stamatoukou on Balkan Insight (balkaninsight.com) Political parties in parliament confront one another over government’s attempt to put a lid on the Predator spyware scandal by passing a new bill on communications privacy. #### [Your selfies are helping AI learn. You did not consent to this.](https://washingtonpost.com/technology/2022/12/09/chatgpt-lensa-ai-ethics?ref=thenexusofprivacy.net) Shira Ovide on The Washington Post (washingtonpost.com) What are the rules of the road for the A.I. age, where anything you share online might train a computer system that puts an innocent person in jail? #### [A Promising New GDPR Ruling Against Targeted Ads](https://eff.org/deeplinks/2022/12/promising-new-gdpr-ruling-against-targeted-ads?ref=thenexusofprivacy.net) Gennie Gebhart on Electronic Frontier Foundation (eff.org) Targeted advertising’s days may be numbered. The Wall Street Journal and Reuters report that the European Data Protection Board has ruled that Meta cannot continue targeting ads based on user’s online activity without affirmative, opt-in consent. This ruling is based on the European Union’s General.… #### [Around 360K people in Ontario affected by COVAXon privacy breach](https://globalnews.ca/news/9338278/covaxon-privacy-breach?ref=thenexusofprivacy.net) Hannah Jackson on Global News (globalnews.ca) The ministry said in over 95 per cent of cases, only names and/or phone numbers were impacted in the breach. #### [Understanding International Data Transfers and Privacy Protection Under Schrems II](https://trustarc.com/blog/2022/12/07/international-data-transfers-schrems-ii?ref=thenexusofprivacy.net) TrustArc Privacy Intelligence on TrustArc Privacy Blog (trustarc.com) TrustArc’s privacy experts explain how the rules for EU international data transfers changed after the Schrems II decision, including several updates to standard contractual clauses (SCCs). #### [Tapping Phone Lines Or Recording Calls Without Consent Violates Right To Privacy: Delhi High Court, Grants Bail To Former Mumbai Police Chief](https://livelaw.in/news-updates/tapping-phone-lines-recording-calls-without-consent-breach-right-to-privacy-delhi-high-court-216173?ref=thenexusofprivacy.net) Nupur Thapliyal on Live Law (livelaw.in) The Delhi High on Thursday said that tapping phone lines or recordin #### PODCAST: [Right on!: Where enforcement meets Privacy (Glyn Moody)](https://buzzsprout.com/840448/11838777?ref=thenexusofprivacy.net) on Buzzsprout (buzzsprout.com) In this episode of Serious Privacy, Paul Breitbarth of Catawiki and Dr. K Royal of Outschool have a rousing good time with Glyn Moody, author of the recent book [Walled Culture: How Big Content Uses Technology and the Law to Lock Down Culture and Keep Creators Poor](https://www.amazon.com/Walled-Culture-Content-Technology-Creators/dp/9464594950?ref=thenexusofprivacy.net). #### [Legal threat follows NHS data pilot based on Palantir tech](https://theregister.com/2022/12/06/legal%5Fthreat%5Ffollows%5Fnhs%5Fdata?ref=thenexusofprivacy.net) Lindsay Clark on The Register (theregister.com) ‘Acute and justifiable fear’ in the way patient data is set to be processed, campaigners warn #### [Jammu And Kashmir’s Unique Family ID Move Raises Concerns Over Data Privacy](https://ndtv.com/india-news/jammu-and-kashmirs-unique-family-id-move-raises-concerns-over-data-privacy-3597250?ref=thenexusofprivacy.net) Press Trust of India on NDTV (ndtv.com) The Jammu and Kashmir administration is planning to create an authentic database of all families in the Union territory with each of them having a unique alpha-numeric code. #### [Senator: TikTok Bans Won’t Solve Data Privacy Issues](https://meritalk.com/articles/senator-tiktok-bans-wont-solve-data-privacy-issues?ref=thenexusofprivacy.net) By: Jose Rascon on MeriTalk (meritalk.com) Amid the recent rush at the Federal and state levels to ban or curtail use of the China-based TikTok social media app, at least one U.S. senator says that those actions would not be sufficient to prevent China interests from accessing personal data on United States citizens. #### --- Image Credit: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net)[CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net)[Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [picserver.org](https://www.picserver.org/p/privacy.html?ref=thenexusofprivacy.net). #### ### ADPPA and a "coordinated effort" not to mention the elephant: Federal privacy legislation update, December 12 URL: https://thenexusofprivacy.net/a-coordinated-effort-not-to-mention-the-elephant/ Last updated: 2026-04-16T02:56:28.000Z *Updated December 15.* > "Even as enthusiasm among ADPPA's most optimistic supporters [remains high](https://www.brookings.edu/blog/techtank/2022/08/12/federal-privacy-negotiators-should-accept-victory-gracefully/?ref=thenexusofprivacy.net), its prospects are limited this late in the term. Barring miraculous inclusion in a must-pass spending measure, the highest possible outcome for the bill this year is symbolic passage in the House. > > There appears to have been a coordinated effort underway this week to accomplish that limited goal, which the bill's supporters believe will put them on stronger footing for 2023." > > – IAPP Managing Director Cobun Zweifel-Keegan, [Privacy compromise: As seen on TV](https://iapp.org/news/a/a-view-from-dc-privacy-compromise-as-seen-on-tv/?ref=thenexusofprivacy.net) Even though Congress about to leave town and time is ticking down for any action on privacy legislation this session, there's been a sudden flurry of activity on the American Data Privacy and Protection Act (ADPPA). A glowing [editorial](https://www.washingtonpost.com/opinions/2022/12/08/tech-privacy-bill-bipartisan-congress/?ref=thenexusofprivacy.net) supporting ADPPA in the Washington Post, a long [interview](https://www.youtube.com/watch?v=Yfabe8hyPU4&ref=thenexusofprivacy.net) with the sponsors on ABC Live that left Cobun "starry-eyed," a [spin-filled *TechDirt* article](https://www.techdirt.com/2022/12/09/the-us-finally-has-a-chance-for-a-federal-privacy-law-it-should-take-it/?ref=thenexusofprivacy.net) by David Morar of New America's Open Technology Institute (OTI) ... yeah, it sure seems like a "coordinated effort." And what a surprise, none of them mention the elephant in the room. On Twitter, Zweifel-Keegan clarified > when I say "coordinated effort" I mean the appearance of a coordinated effort among civil society groups and the bill's sponsors. This last-minute effort, like most of the ADPPA saga so far, does not carry many fingerprints of Industry™️ Joe Jerome of Facebook liked his tweet so it must be true! Although ... the Washington Post is owned by Jeff Bezos. ABC is owned by Disney. New America's [funding](https://www.newamerica.org/our-funding/?ref=thenexusofprivacy.net) includes $9.4 million from the Bill and Melinda Gates Foundation, $4,000,000 from ex-Google CEO Eric Schmidt and his wife Wendy Schmidt, $1,885,000 from Google, $550,000 from Amazon, $300,000 from Microsoft, $7,300,000 from Melinda French Gates' Pivotal Ventures, and $2,000,000 from Reid Hoffman. So call me cynical, but if you look hard enough there might just be some industry influence here. After all, as New America's Morar points out in the TechDirt article, there are "myriad reasons why companies might support regulation." So before we get to the elephant, let's look at some of the reasons Big Tech might be supporting this particular regulation. The current version of ADPPA: - lets companies buy and sell location data as long as it's "deidentified" (which as Sen. Ron Wyden points out could allow data brokers to sell location data to the government about visits to reproductive health facilities) or comes from an image taken by a surveillance camera - "enforces" civil rights protections by [letting companies like Facebook and Twitter do their own algorithmic impact assessments ](https://thenexusofprivacy.net/adppa-impact-assessments-and-civil-rights/)– and completely exempts government contractors like Palantir and ShotSpotter from doing algorithmic impact assessments as long as they're acting as service providers - [puts up barriers to state Attorneys General enforcing the law](https://oag.ca.gov/system/files/attachments/press-docs/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf?ref=thenexusofprivacy.net) - adds a lot of responsibilities to the FTC without guaranteeing them any more funding - lets companies require mandatory arbitration - completely exempts employee data – and provides very little protection for data on employee-issued machines - guts FCC oversight of telecom companies, and appears to give them [a free pass on $200,000,000 in fines](https://www.vice.com/en/article/m7gb9y/new-us-privacy-law-may-give-telecoms-free-pass-on-dollar200-million-fines?ref=thenexusofprivacy.net) the FCC handed out in 2020. - gets rid of existing state and local consumer privacy laws, like [Maine's ISP privacy law](https://www.eff.org/document/2022-07-13-letter-maine-ag-congress-re-adppa?ref=thenexusofprivacy.net), the Seattle Broadband Ordinance, and California's CCPA/CPRA - prevents states, counties, and cities from protecting their residents by passing future consumer privacy laws. So yeah I can certainly see why ADPPA is widely supported by the tech industry (as Jennifer Haberkorn [reported](https://www.latimes.com/politics/story/2022-09-06/congress-mulls-data-privacy-bill-that-would-void-california-tougher-protections?ref=thenexusofprivacy.net) in September), as well as industry trade organization ITIF and Big Tech's favorite Congresswoman Suzan DelBene (D-Microsoft). Of course they'd like it to be weakerned further, but even in its current form it's a good deal from their perspective. And then there's the elephant, a huge issue that ADPPA supporters never discuss in detail. As Kim Clark of Seattle-based Legal Voices said [in July](https://www.spokesman.com/stories/2022/jul/25/historic-data-privacy-law-could-be-within-reach-if/?ref=thenexusofprivacy.net) > “This bill, at least from the perspective of pregnant people, it really doesn’t do much.” And ADPPA's loopholes that fail to protect pregnant people from post-Roe threats also leave immigrants, Muslims, LGBTQ+ people, and other vulnerable people exposed. It's disappointing that organizations like OTI (who works "to ensure that every community has equitable access to digital technology and its benefits") don't think this even matters enough to mention. Politically, though, I can certainly see why Big Tech would want to get the current Democratic-controlled House to sign off on this in the lame duck unstead of waiting until the Republicans take over in the new year. Of course, as [EPIC Privacy, OTI, Public Knowledge, CDT, and the other public interest, labor, consumer advocacy, and civil rights groups calling for a vote on ADPPA](https://publicknowledge.org/policy/coalition-letter-to-speaker-pelosi-calling-for-adppa-vote/?ref=thenexusofprivacy.net) point out, ADPPA could still be strengthened before it comes to the House floor. Realistically, though, with the very compressed timeframe of the lame duck session it's hard to imagine any significant strengthening. In fact, the changes the House Energy & Commerce made to the bill in July *weakened* ADPPA significantly. I'm sure [data brokers](https://www.politico.com/news/2022/08/28/privacy-bill-triggers-lobbying-surge-by-data-brokers-00052958?ref=thenexusofprivacy.net) and [big tech companies who have been lobbying so successfully](https://www.protocol.com/newsletters/policy/cloud-enterprise-privacy?ref=thenexusofprivacy.net) on the bill will try to weaken it further before it moves forward. Will Big Tech get what they want? Currently, Speaker Pelosi and the rest of the California delegation are blocking the bill because it preempts California's privacy laws. Maybe the last-minute campaign will get California to back down; or, maybe there's a "compromise" in the works. We shall see. If ADPPA *does* go to a vote on the House floor (or gets "miraculously" attached to a must-pass bill) without being strengthened, groups like EPIC Privacy and all the other privacy, civil rights, and public interest groups who have been pushing for a vote on ADPPA are likely to be in a very tough situation. Then again, Congress has a lot of other stuff on its plate, and it's quite possible that nothing will happen in the next two weeks. As Cobun says > "\[T\]he more achievable target of all this activity is momentum for further progress in the 118th Congress. The unity on display among the two E&C leaders as they prepare to swap roles in 2023 seems carefully crafted to send a single message: the change of party control will not upset the compromise that was reached in crafting ADPPA." I'll discuss the implications for 2023, and the potential tough spot for EPIC et al, later on in the article. But first, let's talk a little more about the elephant. ## Why would Congressional Democrats support a privacy bill that doesn't protect pregnant people? I wrote about the elephant at much greater length in [How well does ADPPA protect against post-Roe threats?](https://thenexusofprivacy.net/adppa-post-roe-threats/), where I evaluated the bill against several key post-Roe privacy threats ... but it's such an important point that it really bears repeating! Here's the summary: **✅ *yes* *!* *ADPPA passes the test*** **❓** *I’m not sure or it's complex* **❌ *no.* *ADPPA does not currently pass the test*** - ❌ Does ADPPA prevent prosecutors and law enforcement in states that have criminalized abortion from buying location data and targeting people who visit reproductive health care centers? - ❌ When people travel out of state to get abortions, does ADPPA protect their data? - ❌ Does ADPPA allow pregnant people to force companies to delete data that might put them at risk? - ❌ Does ADPPA protect pregnant people and abortion providers from risks of automated license plate readers (ALPRs)? - ❓Does ADPPA prevent anti-abortion “crisis pregnancy centers” from sharing data with vigilantes and law enforcement? - ❓Will ADPPA hold “crisis pregnancy centers” who break the law and violate people’s privacy accountable? - ❌ Will ADPPA prevent law enforcement from accessing people's private messages to investigate whether they got an abortion? Like I said above, I can certainly see why Big Tech would want to get the current Democratic-controlled House to sign off on this. And I can certainly see why Republicans would go for it! But what's in it for Democrats – especially after they did much better than expected in the midterms because so many voters are passionate about protecting reproductive freedom? One possibility is that most Congressional Democrats don't even realize how significant an issue this is with ADPPA. As far as I know, none of the public interest, privacy, and civil rights groups who have been pushing for a vote on ADPPA have done any detailed analysis of this. The [most recent letter](https://publicknowledge.org/public-knowledge-joins-more-than-20-public-interest-groups-urging-house-to-vote-on-adppa-to-protect-consumers/?ref=thenexusofprivacy.net) is typical: it mentions in the first paragraph that passing comprehensive privacy legislation "is even more vital in a post-Dobbs world" but doesn't have any discussion at all whether or not the legislation would actually address post-Dobbs threats. But at least it acknowledges the existence of the elephant! [Evaluating the American Data Privacy and Protection Act](https://techpolicy.press/evaluating-the-american-data-privacy-and-protection-act/?ref=thenexusofprivacy.net), by Alan Butler and Caitriona Fitzgerald of EPIC Privacy, doesn't even mention Dobbs, Roe, reproductive health, or abortion. So it could well be that a lot of Congressional Democrats are assuming that if groups like EPIC (which under their previous Executive Director Marc Rotenberg had a well-deserved reputation for being uncompromising on privacy issues) aren't bringing the issue up, everything is copacetic. Then again, maybe they actually *do* know the reality. Here in Washington state, supporters of the Bad Washington Privacy Act used the talking point of "perfect is the enemy of the good," and I'm hearing the same thing from ADPPA supporters. It's certainly true that there's no such thing as perfect legislation, so Democrats may be tempted to advance ADPPA even if doesn't protect pregnant people and hope that voters have forgotten about it by the time the next election rolls around. ## Be careful what you wish for The same ADPPA loopholes that fail to protect pregnant people also put many others at risk. Most obviously, similar threats apply to trans people and their families in states that have criminalized gender-affirming health care; ADPPA doesn't protect them either. Or take the de-identified data loophole could allow data brokers to sell location data to the government about visits to reproductive health facilities, [De-identified data has been used to out a gay Catholic priest](https://www.vox.com/recode/22587248/grindr-app-location-data-outed-priest-jeffrey-burrill-pillar-data-harvesting?ref=thenexusofprivacy.net). [The military uses “de-identified data” to track Muslims](https://www.vice.com/en/article/jgqm5x/us-military-location-data-xmode-locate-x?ref=thenexusofprivacy.net). [DHS uses de-identified data to help identify immigrants who were later arrested](https://www.wsj.com/articles/federal-agencies-use-cellphone-location-data-for-immigration-enforcement-11581078600?ref=thenexusofprivacy.net). Hey wait a second, I'm noticing a pattern here. Maybe ADPPA will get strengthened to address these problems. Quite frankly, though, from everything I've heard from staffers and negotiators ... that seems very unlikely. If not, and ADPPA goes forward in its current weak form – or gets further weakened – it leaves EPIC Privacy and all the other privacy, civil rights, and public interest groups who have been pushing for a vote on ADPPA in a real tough situation. On the one hand, "perfect is the enemy of the good." On the other hand, the current version of ADPPA doesn't protect the people most at risk from having their data abused – and history shows that once privacy legislation has been passed, it doesn’t get significantly strengthened. So what message would it send if EPIC Privacy and all these other groups support a bill that protects cis, straight, Christian people born in the US who can't get pregnant – and lets Facebook, Twitter, Palantir, ShotSpotter, data brokers, and other badly-behaving tech companies continue to exploit people's data? ## Laying the groundwork for 2023? > Keep in mind that Big Tech is playing a long game here. If Congress passes a weak preemptive ADPPA this year, they win. If not, they'll go back to [pushing states to pass weak privacy laws](https://themarkup.org/privacy/2021/04/15/big-tech-is-pushing-states-to-pass-privacy-laws-and-yes-you-should-be-suspicious?ref=thenexusofprivacy.net) and[ watering down attempts at privacy regulation, one state at a time](https://themarkup.org/privacy/2022/05/26/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time?ref=thenexusofprivacy.net). > > – ["Tweaking" the "grand bargain"](https://thenexusofprivacy.net/adppa-new-compromise/#tweaking-the-grand-bargain) , September 12 As Zweifel-Keegan mentioned, it's still possible that ADPPA will "miraculously" get attached to a must-pass bill. Otherwise, whether or not the House advances ADPPA in the lame duck, the battle will resume next year – in Congress and the states.\*\* As Keir Lamont says in [Five Big Questions (and Zero Predictions) for the U.S. State Privacy Landscape in 2023](https://fpf.org/blog/five-big-questions-and-zero-predictions-for-the-u-s-state-privacy-landscape-in-2023/?ref=thenexusofprivacy.net), it's possible that ADPPA will substantially drive the content of state privacy bills. If EPIC and all these other public interest, privacy, and civil rights groups are able to use their influence to get the House to advance a significantly strengthened version of the ADPPA that protects the people most at risk from data abuse, that'll be good news. If you look at ADPPA supporters' talking points, they're clearly trying to convince people that the only reason ADPPA hasn't advanced is because selfish Californians who don't want it to preempt their state laws are letting their ego get in the way. This is nonsense, of course; not only are there lots of other important issues (including the elephant), but [people in other states and cities have opinions on preemption too](https://thenexusofprivacy.net/adppa-new-compromise/#people-in-other-states-and-cities-have-opinions-on-preemption-too). Still, it's a useful narrative from Big Tech's perspective. And if ADPPA hits the House floor *without* getting strengthened (or worse, in a further-weakened form), and groups who are pushing for a vote decide to support it, it reinforces the scenario I warned about in ["Tweaking" the "grand bargain"](https://thenexusofprivacy.net/adppa-new-compromise/#tweaking-the-grand-bargain) > "EPIC's and Lawyers' Committee's strong support for ADPPA is likely to make Big Tech's path through the states a lot easier." We can probably overcome this in Washington state, where we've got a strong base of local privacy advocates – and other DC-based privacy organizations have undercut their credibility by supporting the Bad Washington Privacy Act. It's hard to know about other states. Time will tell. Shifting focus back to Congress ... even if the House advances ADPPA, next year's a new session and everything restarts. Still, if Republicans decide to prioritize a giveaway to Big Tech, Democrats advancing ADPPA now certainly makes their lives a lot easier – pressure will mount on Sen. Maria Cantwell to surrender and get on board. Then again, Republicans will have a very thin majority in the House. If new House Minority Leader Hakeem Jeffries and the rest of Democratic leadership decide to fight to protect pregnant people, immigrants, Muslims and LGBTQ+ people, they certainly have a chance to block it. And Democrats will still control the Senate, meaning Sen. Cantwell will continue to chair the Senate Commerce Committee – and she may well try to take another try at privacy legsilation herself So no matter what happens over the next few weeks, ADPPA's not a slam dunk next year. Still, Big Tech's prospects for 2023 are certainly a lot brighter if they can cajole Speaker Pelosi, the California delegation, and the rest of the House into advancing it without strengthening it. And privacy advocates' prospects are a lot brighter if EPIC et al are able to strengthen the bill – or say no if the bill isn't strengthened. And who knows, there may still be some "miraculous" last-minute shenanigans. As we say in Washington state, it ain't over 'til its over. Stay tuned! --- ## Notes \* Todd Feathers' [Big Tech Is Pushing States to Pass Privacy Laws, and Yes, You Should Be Suspicious](https://themarkup.org/privacy/2021/04/15/big-tech-is-pushing-states-to-pass-privacy-laws-and-yes-you-should-be-suspicious?ref=thenexusofprivacy.net), Feathers' and Alfred Ng's 2022 [Tech Industry Groups Are Watering Down Attempts at Privacy Regulation, One State at a Time](https://themarkup.org/privacy/2022/05/26/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time?ref=thenexusofprivacy.net), and Ben Brody's [Quiet industry lobbyists are watering down state privacy laws](https://www.protocol.com/policy/state-privacy-utah-spsc?ref=thenexusofprivacy.net) have more on Big Tech's strategy for pushing weak legislation at the state level. \] ### Privacy News: December 11 URL: https://thenexusofprivacy.net/privacy-news-december-11/ Last updated: 2022-12-11T15:18:39.000Z Large language models, iCloud encryption, Twitter privacy issues, state privacy legislation, and much much more! But first, a shameless plug: on Tuesday (December 13) at 9 am Pacific/noon Eastern, please join me and RI Labs for [Flocking to Mastodon? Here's what you need to know!](https://us06web.zoom.us/meeting/register/tZIvcuippj4vEtx8u0Ir5awanpG1DKvDGvaF?ref=thenexusofprivacy.net) > Are you heading to Mastodon as a Twitter alternative or curious about what it is and how it works? Or want to share your own experiences? > > Join RI Labs Leadership Circle Member & Founder of the Nexus of Privacy, Jon Pincus, in a conversation about navigating Mastodon with an RI Lens. As a long-time user of the platform, Jon will share his experiences, practical tips and challenges to help you enter this world with eyes wide open. Bring your questions, ideas & opinions. [Register here!](https://us06web.zoom.us/meeting/register/tZIvcuippj4vEtx8u0Ir5awanpG1DKvDGvaF?ref=thenexusofprivacy.net) And now, on to the links. ### [ChatGPT, Galactica, and the Progress Trap](https://wired.com/story/large-language-models-critique?ref=thenexusofprivacy.net) Abeba Birhane and Deborah Raji on WIRED (wired.com) Two leading AI Ethics researchers look at the potentially-serious consequences when large language models fall short. > The release of large language models like [ChatGPT](https://openai.com/blog/chatgpt/?ref=thenexusofprivacy.net) (a question-answering chatbot) and [Galactica](https://galactica.org/?ref=thenexusofprivacy.net) (a tool for scientific writing) has revived an old conversation about what these models can do. Their capabilities have been presented as extraordinary, mind-blowing, autonomous; fascinated evangelists have claimed that these models contain “[humanity’s scientific knowledge](https://galactica.org/static/paper.pdf?ref=thenexusofprivacy.net),” are [approaching artificial general intelligence](https://twitter.com/elonmusk/status/1599128577068650498?s=20&t=60TI9fy40kDsICq5v-R8ag&ref=thenexusofprivacy.net) (AGI), and even resemble [consciousness](https://www.washingtonpost.com/technology/2022/06/11/google-ai-lamda-blake-lemoine/?ref=thenexusofprivacy.net). However, such hype is not much more than a distraction from the actual harm perpetuated by these systems. [People get hurt from the very practical ways such models fall short in deployment](https://arxiv.org/abs/2206.09511?ref=thenexusofprivacy.net), and these failures are the result of their builders’ choices—decisions we must hold them accountable for. ALSO: - [The Internet’s New Favorite AI Proposes Torturing Iranians and Surveilling Mosques](https://theintercept.com/2022/12/08/openai-chatgpt-ai-bias-ethics?ref=thenexusofprivacy.net), Sam Biddle on The Intercept (theintercept.com) ### [VICTORY! Apple Commits to Encrypting iCloud, Drops Phone-Scanning Plans](https://www.eff.org/deeplinks/2022/12/victory-apple-commits-encrypting-icloud-and-drops-phone-scanning-plans?ref=thenexusofprivacy.net) Joe Mullin, Electronic Frontier Foundation (eff.org) Apple will provide full end-to-end encryption on iCloud, including backups tand photos. It is indeed a big victory for EFF and the other privacy organizations who have been advocating for this – and for users as well. EFF writes: > Apple’s on-device encryption is strong, but some especially sensitive iCloud data, such as photos and backups, has continued to be vulnerable to government demands and hackers. Users who opt in to Apple’s new proposed feature, which the company [calls Advanced Data Protection for iCloud](https://www.apple.com/newsroom/2022/12/apple-advances-user-security-with-powerful-new-data-protections/?ref=thenexusofprivacy.net), will be protected even if there is a data breach in the cloud, a government demand, or a breach from within Apple (such as a rogue employee). Apple said today that the feature will be available to U.S. users by the end of the year, and will roll out to the rest of the world in “early 2023.” Not only that, Apple annonced that its dropping its plans to install client-side scanning software. They had originally announced this in August 2021, but put it on hold the next month in response to [widespread criticism](https://www.wired.com/story/apple-csam-plan-sparks-outcry-from-policy-groups/?ref=thenexusofprivacy.net) from privacy and security researchers and digital rights groups (incliuding [protests](https://www.eff.org/deeplinks/2021/09/protestors-nationwide-rally-tell-apple-dont-break-encryption-dont-break-your?ref=thenexusofprivacy.net) and a petition from EFF). Now, it's official that theToday’s announcement makes it official. ALSO: - [Apple advances user security with powerful new data protections](https://www.apple.com/newsroom/2022/12/apple-advances-user-security-with-powerful-new-data-protections/?ref=thenexusofprivacy.net), Apple (apple.com): the official announcement, which also introduces iMessage Contact Key Verification, Security Keys for Apple ID, - [Apple makes it easier to keep your data secret from hackers, cops, and even Apple](https://vox.com/recode/2022/12/8/23499936/apple-advanced-data-protection-encryption?ref=thenexusofprivacy.net), Sara Morrison on Vox (vox.com) - [Apple Kills Its Plan to Scan Your Photos for CSAM. Here’s What’s Next](https://www.wired.com/story/apple-photo-scanning-csam-communication-safety-messages/?ref=thenexusofprivacy.net), Lily Hay Newman on Wired (wired.com) - [Apple’s New Encryption Policy Is a Huge Boon for Crypto](https://coindesk.com/consensus-magazine/2022/12/09/apples-new-encryption-is-huge-boon-for-crypto?ref=thenexusofprivacy.net), David Z. Morris on CoinDesk (coindesk.com) - [Everyone Will Be Able to Encrypt Their iCloud Backups Soon](https://gizmodo.com/apple-encryption-icloud-backups-iphone-fbi-1849865919?ref=thenexusofprivacy.net), Kevin Hurler on Gizmodo (gizmodo.com) - [Apple announces new security and privacy measures amid spike in cyber attacks](https://theguardian.com/technology/2022/dec/07/apple-new-security-privacy-measures-spike-cyber-attacks?ref=thenexusofprivacy.net), Johana Bhuiyan on The Guardian (theguardian.com) - [Apple is laser-focused on the privacy of data and end-user experience as it builds out A.I. ambitions](https://fortune.com/2022/12/07/brainstorm-ai-apple-yael-garten?ref=thenexusofprivacy.net), Kylie Robison on Fortune (fortune.com) - [FBI Calls Apple’s Enhanced iCloud Encryption ‘Deeply Concerning’ as Privacy Groups Hail It As a Victory for Users](https://macrumors.com/2022/12/08/fbi-privacy-groups-icloud-encryption?ref=thenexusofprivacy.net), Sami Fathi on MacRumors (macrumors.com) - [Apple rolls out end-to-end encryption for iCloud backups](https://bleepingcomputer.com/news/apple/apple-rolls-out-end-to-end-encryption-for-icloud-backups?ref=thenexusofprivacy.net), Sergiu Gatlan on BleepingComputer (bleepingcomputer.com) - [Privacy changes set Apple at odds with UK government over online safety bill](https://theguardian.com/technology/2022/dec/08/privacy-changes-apple-uk-government-online-safety-bill?ref=thenexusofprivacy.net), Alex Hern on The Guardian (theguardian.com) - [Apple rolls out more encryption of iCloud data](https://thehill.com/policy/technology/3765824-apple-rolls-out-more-encryption-of-icloud-data?ref=thenexusofprivacy.net), Olafimihan Oshin on The Hill (thehill.com) ## Twitter ### [Which websites are sharing data about consumers with Elon Musk’s Twitter?](https://adalytics.io/blog/websites-sharing-data-with-twitter?ref=thenexusofprivacy.net) Adalytics (adalytics.com) Yikes. > When Elon Musk bought Twitter, he also bought a treasure trove of internet traffic data from websites like Reddit, *NYTimes.com*, *Amazon.com,* [*studentaid.gov*](https://urlscan.io/result/17cc3e79-3b01-4fdc-95a7-84ef0d430c74/?ref=thenexusofprivacy.net#transactions) (Department of Education’s Free Application for Federal Student Aid), and the website of Democratic Congressional Campaign Committee (*dccc.org*).... > > The vast majority of these entities have not enabled Twitter's [Restricted Data Usage](https://web.archive.org/web/20221201195226/https://business.twitter.com/en/help/campaign-measurement-and-analytics/conversion-tracking-for-websites/restricted-data-use-guide.html) (RDU) feature to set legal guardrails around what Twitter can do with that web traffic data. ALSO: - [Amazon, FBI.gov, and 70k Other Sites Send Your Data to Elon’s Twitter](https://gizmodo.com/elon-musk-twitter-amazon-fbi-70000-sites-data-security-1849867489?ref=thenexusofprivacy.net), Thomas Germain on Gizmodo (gizmodo.com) ### [Ireland’s privacy watchdog engaging with Twitter over data access to reporters](https://techcrunch.com/2022/12/09/twitter-gdpr-reporter-data-access?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) Elon Musk’s desire to stir conspiratorial shit up by giving select outsiders aligned with his conservative agenda access to Twitter systems could land him in serious doodoo with regulators. ## State privacy legislation #### [CPRA takes effect Jan. 1: Experts warn the ad ecosystem is about to change](https://thedrum.com/news/2022/12/07/with-cpra-become-active-2023-privacy-pros-warn-paradigm-shift?ref=thenexusofprivacy.net) Kendra Clark on The Drum (thedrum.com) For the advertising and publishing ecosystem, California's new regulatory enforcement will create new challenges for managing consumer data privacy. #### [The California Privacy Rights Act Brings New Data Requirements for Employers in 2023](https://jdsupra.com/legalnews/the-california-privacy-rights-act-7918001?ref=thenexusofprivacy.net) Molly Arranz on JD Supra (jdsupra.com) With the holidays upon us, companies are assessing year-end to-do’s and considering what 2023 will bring. #### [Universal Opt-Out/Global Privacy Control: Preparing for the New Online World](https://jdsupra.com/legalnews/universal-opt-out-global-privacy-7739024?ref=thenexusofprivacy.net) Katherine Chaves on JD Supra (jdsupra.com) A growing trend across privacy legislation is requiring company websites to respond to universal opt-out mechanisms, also known as “Global Privacy Control.” If ignored, a business exposes itself to liabilities that can result in legal and financial consequences. ## And ... #### [You Should Seriously Change These Venmo Privacy Settings](https://cnet.com/tech/services-and-software/you-should-seriously-change-these-venmo-privacy-settings?ref=thenexusofprivacy.net) Shelby Brown on CNET (cnet.com) Payment apps like Venmo and CashApp are convenient, but you should be aware of the privacy risks. #### [Some toys this holiday season come with data and privacy concerns, experts warn](https://ctinsider.com/news/article/Smart-toys-privacy-concerns-17643526.php?ref=thenexusofprivacy.net) Vincent Gabrielle on CT Insider (ctinsider.com) With the holiday season here, advocates are warning that certain toys have major privacy issues. #### [India Requires Internet Services to Collect and Store Vast Amount of Customer Data, Building a Path to Mass Surveillance](https://eff.org/deeplinks/2022/12/india-requires-internet-services-collect-and-store-vast-amount-customer-data?ref=thenexusofprivacy.net) Karen Gullo on Electronic Frontier Foundation (eff.org) Privacy and online free expression are once again under threat in India, thanks to vaguely worded cybersecurity directions—promulgated by India’s Computer Emergency Response Team (CERT-In) earlier this year—that impose draconian mass surveillance obligations on internet services, threatening... #### [Want More Privacy? You Need to Change These Browser Settings Now](https://cnet.com/tech/services-and-software/if-you-value-your-online-privacy-change-these-browser-settings-asap?ref=thenexusofprivacy.net) Rae Hodge on CNET (cnet.com) You can give your online privacy a major boost by taking five minutes to adjust a few settings in Chrome, Safari, Firefox, Edge or Brave. #### [The EU AI Act: A discussion with MEP and co-rapporteur Dragoș Tudorache](https://iapp.org/news/a/the-eu-ai-act-a-discussion-with-mep-and-co-rapporteur-dragos-tudorache?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) IAPP Editorial Director Jedidiah Bracy speaks with EU AI Act Co-rapporteur and Romanian MEP Dragoș Tudorache about the state of play of the proposed legislation #### [The Right to Intimate Privacy](https://themarkup.org/newsletter/hello-world/the-right-to-intimate-privacy?ref=thenexusofprivacy.net) Julia Angwin on The Markup (themarkup.org) A conversation with Danielle Citron #### [EU Watchdog Finds Commission Failed to Protect Human Rights From its Surveillance Aid to African Countries](https://privacyinternational.org/press-release/4992/eu-watchdog-finds-commission-failed-protect-human-rights-its-surveillance-aid?ref=thenexusofprivacy.net) on Privacy International (privacyinternational.org) The decision by the EU’s oversight body follows a year-long inquiry prompted by complaints outlining how EU bodies and agencies are cooperating with governments around the world to increase their surveillance powers filed b #### [This Privacy Ruling Against Facebook and Insta Could End Targeted Ads](https://gizmodo.com/facebook-instagram-targeted-ads-europe-privacy-ruling-1849860593?ref=thenexusofprivacy.net) Thomas Germain on Gizmodo (gizmodo.com) EU privacy regulators declared that Meta can’t force users to agree to data collection. #### [Data Clean Rooms: Enabling Analytics, Protecting Privacy](https://informationweek.com/big-data/data-clean-rooms-enabling-analytics-protecting-privacy?ref=thenexusofprivacy.net) Jessica Davis on InformationWeek (informationweek.com) Data clean rooms offer a way for organizations to collaborate with and share data in a protected environment that preserves privacy and governance. Here’s why they are on the rise now. #### [Establishing Trust and Control in the Age of Data Privacy Regulation](https://cio.com/article/415232/establishing-trust-and-control-in-the-age-of-data-privacy-regulation.html?ref=thenexusofprivacy.net) Carol Venezia on CIO (cio.com) Protecting data from theft and improper use is now the concern of the entire C-suite, as it’s crucial organizations are aware of the repercussions of data breaches and failure to comply with regulations. #### [Google must delete search results about you if they’re fake, EU court rules](https://politico.eu/article/google-delete-search-result-fake-eu-court-rule?ref=thenexusofprivacy.net) Vincent Manancourt on POLITICO (politico.eu) Claimants have to prove the information about them is ‘manifestly inaccurate.’ #### [Your platform is not an ecosystem](https://crookedtimber.org/2022/12/08/your-platform-is-not-an-ecosystem?ref=thenexusofprivacy.net) Chris Armstrong on Crooked Timber (crookedtimber.org) Another day, another exhortation to join an “ecosystem” that’s anything but. #### [Cyborgs on the Highways](https://prospect.org/culture/books/cyborgs-on-the-highways-levy-review?ref=thenexusofprivacy.net) Zephyr Teachout on The American Prospect (prospect.org) A review of Karen Levy's [*Data Driven: Truckers, Technology, and the New Workplace Surveillance*](https://www.indiebound.org/book/9780691175300?aff=TAPBookClub&ref=thenexusofprivacy.net)*,* which details the extreme forms of surveillance imposed on long-haul truckers, robbing them of their power. #### [EPIC to Supreme Court: Internet Companies Should Face Suits for their Harmful Conduct](https://epic.org/epic-to-supreme-court-internet-companies-should-face-suits-for-their-harmful-conduct?ref=thenexusofprivacy.net) on EPIC - Electronic Privacy Information Center (epic.org) EPIC's amicus brief in the Section 230 case. #### [A faster way to preserve privacy online](https://news.mit.edu/2022/online-information-user-data-privacy-1207?ref=thenexusofprivacy.net) Adam Zewe on Massachusetts Institute of Technology News (news.mit.edu) MIT researchers developed a method that enables users to search for information in a remote database privately, without revealing the information they are seeking to the server, that is about 30 times faster than other techniques. #### [Cinder’s content moderation software is custom-built for trust and safety teams](https://techcrunch.com/2022/12/08/cinder-builds-a-trust-and-safety-platform?ref=thenexusofprivacy.net) Taylor Hatmaker on TechCrunch (techcrunch.com) Cinder launches software for companies grappling with some of the internet’s most complex, dangerous challenges. #### [AI photography is taking over social media. Why are some concerned about privacy?](https://abcnews.go.com/GMA/Living/ai-photography-taking-social-media-concerned-privacy/story?id=94526042&ref=thenexusofprivacy.net) ABC News on ABC News (abcnews.go.com) Lensa is transforming selfies into virtual avatars that many have shared online. #### [Privacy community mourns death of Danilo Doneda, Brazilian data protection ‘trailblazer’](https://iapp.org/news/a/danilo-doneda-was-heart-and-soul-of-brazilian-data-protection-law?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) The privacy community is remembering Brazilian data protection scholar Danilo Doneda for his contributions to the field. #### [The biggest lie tech people tell themselves — and the rest of us](https://vox.com/the-highlight/2019/10/1/20887003/tech-technology-evolution-natural-inevitable-ethics?ref=thenexusofprivacy.net) Rose Eveleth on Vox (vox.com) They see facial recognition, smart diapers, and surveillance devices as inevitable evolutions. They’re not. #### [UK privacy watchdog reveals more than two dozen data breach incidents](https://therecord.media/uk-privacy-watchdog-reveals-more-than-two-dozen-data-breach-incidents?ref=thenexusofprivacy.net) Alexander Martin on The Record by Recorded Future (therecord.media) The UK’s data protection regulator published the details of more than two dozen data protection incidents in which it reprimanded organizations. #### [One of four US biometric privacy cases clearly protect a defendant](https://biometricupdate.com/202212/one-of-four-us-biometric-privacy-cases-clearly-protect-a-defendant?ref=thenexusofprivacy.net) Jim Nash on BiometricUpdate.com (biometricupdate.com) Court action in the U.S. state of Illinois continues to chip away at the definition of what constitutes a viable biometric information privacy lawsuit. #### [Privacy watchdogs to bite into edtech in 2023, analyst predicts](https://verdict.co.uk/privacy-watchdogs-to-bite-into-edtech-in-2023-analyst-predicts?ref=thenexusofprivacy.net) Eric Johansson on Verdict (verdict.co.uk) The edtech industry ballooned during the pandemic, but analysts now predict the sector will become the next target for privacy regulators. #### [Dark patterns, online ads will be potential targets for the next Commission, Reynders says](https://euractiv.com/section/digital/interview/dark-patterns-online-ads-will-be-potential-targets-for-the-next-commission-reynders-says?ref=thenexusofprivacy.net) Luca Bertuzzi on EURACTIV (euractiv.com) #### [The Privacy War Is Coming](https://darkreading.com/endpoint/the-privacy-war-is-coming?web%5Fview=true&ref=thenexusofprivacy.net) Damian Tommasino on Dark Reading (darkreading.com) Privacy standards are only going to increase. It’s time for organizations to get ahead of the coming reckoning. #### [Greek MPs Clash Over New Privacy Communications Bill](https://balkaninsight.com/2022/12/08/greek-mps-clash-over-new-privacy-communications-bill?ref=thenexusofprivacy.net) Eleni Stamatoukou on Balkan Insight (balkaninsight.com) Political parties in parliament confront one another over government’s attempt to put a lid on the Predator spyware scandal by passing a new bill on communications privacy. #### [Your selfies are helping AI learn. You did not consent to this.](https://washingtonpost.com/technology/2022/12/09/chatgpt-lensa-ai-ethics?ref=thenexusofprivacy.net) Shira Ovide on The Washington Post (washingtonpost.com) What are the rules of the road for the A.I. age, where anything you share online might train a computer system that puts an innocent person in jail? #### #### [Apple’s promises of privacy: Are iPhones as secure as the company claims?](https://english.elpais.com/science-tech/2022-12-09/apples-promises-of-privacy-are-iphones-as-secure-as-the-company-claims.html?ssm=TW%5FCC&ref=thenexusofprivacy.net) Isabel Rubio on Ediciones EL PAÍS S.L. (english.elpais.com) Researchers have found that, despite its statements to the contrary, the company collects personal information from its app usage data #### [Around 360K people in Ontario affected by COVAXon privacy breach | Globalnews.ca](https://globalnews.ca/news/9338278/covaxon-privacy-breach?ref=thenexusofprivacy.net) Hannah Jackson on Global News (globalnews.ca) The ministry said in over 95 per cent of cases, only names and/or phone numbers were impacted in the breach. #### [Will TikTok Make Good on Privacy Promises?](https://securityboulevard.com/2022/12/will-tiktok-make-good-on-privacy-promises?ref=thenexusofprivacy.net) Christopher Burgess on Security Boulevard (securityboulevard.com) TikTok has a problem. Researchers continue to turn up oddities with respect to the storage of user data/information. The timing, of course, is precarious. ALSO: - [TikTok pledges to comply with Dutch & European data privacy rules, says state secretary](https://nltimes.nl/2022/12/09/tiktok-pledges-comply-dutch-european-data-privacy-rules-says-state-secretary?ref=thenexusofprivacy.net), NL Times (nltimes.nl) #### [Understanding International Data Transfers and Privacy Protection Under Schrems II](https://trustarc.com/blog/2022/12/07/international-data-transfers-schrems-ii?ref=thenexusofprivacy.net) TrustArc Privacy Intelligence on TrustArc Privacy Blog (trustarc.com) TrustArc’s privacy experts explain how the rules for EU international data transfers changed after the Schrems II decision, including several updates to standard contractual clauses (SCCs). #### [Executives Personally Sued for Data Privacy Incidents](https://jdsupra.com/legalnews/executives-personally-sued-for-data-2523527?ref=thenexusofprivacy.net) Nathan Morales on JD Supra (jdsupra.com) If you manage a company that collects and otherwise processes personal data (which is just about every company, these days), you may need to protect... #### [Facial recognition system of Tamil Nadu police stirs privacy row](https://hindustantimes.com/india-news/facial-recognition-system-of-tn-police-stirs-privacy-row-101670614143523.html?ref=thenexusofprivacy.net) Divya Chandrababu on Hindustan Times (hindustantimes.com) According to their website, 126 facial recognition systems have been installed across various states. #### [Telstra privacy breach sees customer details made public](https://9news.com.au/national/telstra-privacy-breach-sees-customer-details-made-public/a9a065bd-f80a-4755-aca9-bf3e16f60f90?ref=thenexusofprivacy.net) 9News Staff on 9News (9news.com.au) The details of more than 130,000 Telstra customers have been published online due an internal error. #### [Operation LVMH: How a cybersurveillance firm monitored politicians, union leaders and activists](https://politico.eu/article/operation-lvmh-how-cybersurveillance-firm-monitored-politicians-union-leaders-activists?ref=thenexusofprivacy.net) Elisa Braun on POLITICO (politico.eu) Explosion of online data provides private security companies unprecedented access to personal information. #### [EU countries endorse agreement on European digital identity](https://euractiv.com/section/digital/news/eu-countries-endorse-agreement-on-european-digital-identity?ref=thenexusofprivacy.net) Luca Bertuzzi on EURACTIV (euractiv.com) The EU Council formalised its position on the European digital identity at the Telecom Council meeting on Tuesday (6 December). --- *Image credit:* Daquella manera on [Flickr ](https://www.flickr.com/photos/62518311@N00/466172168?ref=thenexusofprivacy.net) via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons Attribution 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net) license. ### Flocking to Mastodon? Here's what you need to know! URL: https://thenexusofprivacy.net/flocking-to-mastodon-heres-what-you-need-to-know/ Last updated: 2026-04-16T02:56:06.000Z [Next Tuesday (December 13), at 9 am Pacific / noon Eastern](https://us06web.zoom.us/meeting/register/tZIvcuippj4vEtx8u0Ir5awanpG1DKvDGvaF?ref=thenexusofprivacy.net): > Are you heading to Mastodon as a Twitter alternative or curious about what it is and how it works? Or want to share your own experiences? > > Join RI Labs Leadership Circle Member & Founder of the Nexus of Privacy, Jon Pincus, in a conversation about navigating Mastodon with an RI Lens. As a long-time user of the platform, Jon will share his experiences, practical tips and challenges to help you enter this world with eyes wide open. Bring your questions, ideas & opinions. > > The goal of this series is to share experiences & inform users. If you are developing or using other social media alternatives or platforms, we would love to hear from you. Drop us a line at: rilabs@responsibleproject.com Please join us! [Here's the registration link](https://us06web.zoom.us/meeting/register/tZIvcuippj4vEtx8u0Ir5awanpG1DKvDGvaF?ref=thenexusofprivacy.net). ### Privacy News: December 7 URL: https://thenexusofprivacy.net/privacy-news-december-7/ Last updated: 2022-12-07T15:20:28.000Z SF says no to killer robots (for now), the EU says no to Meta's business model, questions about state privacy legislation ... and more! ### San Francisco: [In a surprise turnaround, robot lethal force is banned — for now](http://missionlocal.org/2022/12/surprise-vote-robot-lethal-force-banned-temporary-san-francisco/?ref=thenexusofprivacy.net) Will Jarrett on Mission Local (missionlocal.org) In an unexpected about-face, the Board of Supervisors today voted to temporarily ban the police department from using robots with lethal force. Last week, The Board had voted 8-3 to [approve robot lethal forcelast week](https://missionlocal.org/2022/11/live-supervisors-debate-sfpd-killer-robot-policy-san-francisco/?ref=thenexusofprivacy.net), but at the "second hearing" today the vote went the other way: 8-3 to send the issue back to the Rules committee for further review. Thanks and congratulations to everybody who got involved! ALSO: - [San Francisco lawmakers vote to ban killer robots in drastic U-turn](https://www.theguardian.com/us-news/2022/dec/06/san-francisco-lawmakers-ban-killer-robots-u-turn?ref=thenexusofprivacy.net), Sam Levin on The Guardian (theguardian.com) - [San Francisco bars police from using killer robots, reversing recent vote](https://www.washingtonpost.com/nation/2022/12/07/san-francisco-killer-robot-cop/?ref=thenexusofprivacy.net), Niha Masih on the Washington Post (washingtonpost.com) #### [noyb win: Personalized Ads on Facebook, Instagram and WhatsApp declared illegal](https://noyb.eu/en/noyb-win-personalized-ads-facebook-instagram-and-whatsapp-declared-illegal?ref=thenexusofprivacy.net) on noyb.eu (noyb.eu) The European Data Protection Board has decided that three Meta Apps (Facebook, Instagram and WhatsApp) did not have a legal basis to process user data since May 2018. ALSO: - [Meta’s Targeted Ad Model Faces Restrictions in Europe](https://wsj.com/articles/metas-targeted-ad-model-faces-restrictions-in-europe-11670335772?ref=thenexusofprivacy.net), Sam Schechner on The Wall Street Journal (wsj.com) - [EDPB adopts Art. 65 dispute resolution binding decisions regarding Facebook, Instagram and WhatsApp](https://edpb.europa.eu/news/news/2022/edpb-adopts-art-65-dispute-resolution-binding-decisions-regarding-facebook-instagram%5Fen?ref=thenexusofprivacy.net), European Data Protection Board (edpb.europa.eu) - [Meta’s behavioral ads will finally face GDPR privacy reckoning in January](https://techcrunch.com/2022/12/06/meta-gdpr-forced-consent-edpb-decisions?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com) - [Meta faces record EU privacy fines](https://politico.eu/article/eu-fines-meta-privacy-tech-security-facebook-whatsapp-instagram?ref=thenexusofprivacy.net), Vincent Manancourt on POLITICO (politico.eu) ## Face surveillance #### [A Forensic Without the Science: Face Recognition in U.S. Criminal Investigations](https://www.law.georgetown.edu/privacy-technology-center/publications/a-forensic-without-the-science-face-recognition-in-u-s-criminal-investigations/?ref=thenexusofprivacy.net) Georgetown Law Center on Privacy & Technology (law.georgetown.edu) A report released by the Center on Privacy & Technology evaluates the reliability of face recognition as it is used by police in the United States. ## State Privacy Legislation #### [Five Big Questions (and Zero Predictions) for the U.S. State Privacy Landscape in 2023](https://fpf.org/blog/five-big-questions-and-zero-predictions-for-the-u-s-state-privacy-landscape-in-2023?ref=thenexusofprivacy.net) Keir Lamont on Future of Privacy Forum (fpf.org) Lamont’s questions 1. Will any state raise the bar for privacy protections? 2. Is there an ‘ADPPA Effect’? 3. Are we in the Age of the Age-Appropriate Design Code? 4. Will lawmakers prioritize protections for health and location data? 5. How effective will the new laws be? #### [FPF Releases Comparative Analysis of California and U.K. Age-Appropriate Design Codes](https://fpf.org/blog/fpf-releases-comparative-analysis-of-california-and-u-k-age-appropriate-design-codes?ref=thenexusofprivacy.net) Chloe Altieri on Future of Privacy Forum (fpf.org) The Future of Privacy Forum (FPF) today released a new policy brief comparing the California Age-Appropriate Design Code Act (AADC), a first-of-its-kind privacy-by-design law in the United States, and the United Kingdom’s Age-Appropriate Design Code. While there are distinctions between the two codes, the California AADC, which is set to become enforceable on July 1, 2024, was modeled after the UK’s version and represents a significant change in the regulation of the technology industry and how children will experience online products and services. ## And ... #### [Perspective | The voices left out of Elon Musk’s free-speech agenda](https://washingtonpost.com/technology/2022/12/06/elon-musk-twitter-free-speech?ref=thenexusofprivacy.net) Shira Ovide on The Washington Post (washingtonpost.com) Elon Musk has said little about what Twitter should do to give people a voice when their own governments do not want people to have it. Look at China and Iran. #### [ICE data dump reveals PII of 6,000+ asylum seekers](https://theregister.com/2022/12/01/ice%5Fdata%5Fdump?ref=thenexusofprivacy.net) Jessica Lyons Hardcastle on The Register (theregister.com) Your tax dollars at work #### [Twitter’s iOS app is riddled with privacy settings glitches](https://techcrunch.com/2022/12/06/twitters-ios-app-is-riddled-with-privacy-settings-glitches?ref=thenexusofprivacy.net) Amanda Silberling on TechCrunch (techcrunch.com) Features affecting protected tweets, mentions and sensitive content are not working correctly for many Twitter iOS users. #### [Tech & Society Salon: The Home Surveillance State](https://eventbrite.com/e/tech-society-salon-the-home-surveillance-state-tickets-469220580387?ref=thenexusofprivacy.net) on Eventbrite (eventbrite.com) Join our talk as we discuss which devices are monitoring you and your activities in and around your residence, and how police use your data. #### [Are we taking patient privacy as seriously as we ought to be?](https://healthcareitnews.com/news/are-we-taking-patient-privacy-seriously-we-ought-be?ref=thenexusofprivacy.net) Andrea Fox on Healthcare IT News (healthcareitnews.com) At the 2022 HIMSS Healthcare Cybersecurity Forum in Boston, keynote speaker Anita Allen described the delicate and complex balance between the imperative of data sharing and the need to protect privacy. #### [US intelligence chief: Parents ‘should be’ concerned for kids’ privacy on TikTok](https://thehill.com/policy/technology/3763428-us-intelligence-chief-parents-should-be-concerned-for-kids-privacy-on-tiktok?ref=thenexusofprivacy.net) Olafimihan Oshin on The Hill (thehill.com) Director of National Intelligence Avril Haines is warning parents about risks to their children’s data privacy on the social media platform TikTok, which is owned by the Chinese company ByteD… #### [Will we be able to protect our privacy in the metaverse?](https://verdict.co.uk/will-we-be-able-to-protect-our-privacy-in-the-metaverse?ref=thenexusofprivacy.net) Kurt Robson on Verdict (verdict.co.uk) The metaverse is one of the hottest topics in big tech right now, but is our privacy in the metaverse going to be protected? #### [Geofencing Warrants Are a Threat to Privacy](https://reason.com/2022/12/05/geofencing-warrants-are-a-threat-to-privacy?ref=thenexusofprivacy.net) Bonnie Kristian on Reason.com (reason.com) A precedent set in the January 6 prosecutions could be dangerous to the public. #### [Tinder subject of new Illinois class action privacy lawsuit](https://mystateline.com/news/local-news/tinder-subject-of-new-illinois-class-action-privacy-lawsuit?ref=thenexusofprivacy.net) John Clark on MyStateline.com (mystateline.com) ROCKFORD, Ill. (WTVO) — Users of Tinder in Illinois may be eligible for a claim in a class action lawsuit. According to the Cook County Record, a lawsuit filed in October on behalf of plaintiffs Br… #### [International Coalition of Rights Groups Call on Internet Infrastructure Providers to Avoid Content Policing](https://eff.org/press/releases/international-coalition-rights-groups-call-internet-infrastructure-providers-avoid?ref=thenexusofprivacy.net) Paige Collings on Electronic Frontier Foundation (eff.org) San Francisco—Internet infrastructure services—the heart of a secure and resilient internet where free speech and expression flows—should continue to focus their energy on making the web an essential resource for users and, with rare exceptions, avoid content policing. Such intervention often... #### [Invasion of Privacy Lawsuits Will Be On The Rise In California Where Employers Use Monitoring/Tracking Technology](https://jdsupra.com/legalnews/invasion-of-privacy-lawsuits-will-be-on-2578688?ref=thenexusofprivacy.net) Dan Forman on JD Supra (jdsupra.com) California is one of the only states that provides its employees and citizens with an express constitutional right of privacy. #### [TikTok CEO offers reassurances over data privacy](https://marketwatch.com/story/tiktok-ceo-offers-reassurances-over-data-privacy-11669852813?ref=thenexusofprivacy.net) Sarah E. Needleman, Alexander Saeedy on MarketWatch (marketwatch.com) TikTok Chief Executive Shou Chew said the video-sharing platform is taking greater steps to keep user data secure and that it needs to invest more in... #### [Australian Parliament Passes Privacy Penalty Bill](https://infosecurity-magazine.com/news/australian-parliament-passes?ref=thenexusofprivacy.net) Alessandro Mascellino on Infosecurity Magazine (infosecurity-magazine.com) The higher penalties and extended powers will become effective after the bill receives royal assent #### [What Do the Multimillion-Dollar Google Settlement, Meta Fine Mean for Data Privacy?](https://informationweek.com/big-data/what-do-the-multimillion-dollar-google-settlement-meta-fine-mean-for-data-privacy-?ref=thenexusofprivacy.net) Carrie Pallardy on InformationWeek (informationweek.com) Google agreed to pay a significant amount in a settlement for violating consumer privacy laws. Could this settlement and Meta’s latest fine be the beginning of a new future for data privacy? #### [The EU AI Act: A discussion with MEP and co-rapporteur Dragoș Tudorache](https://iapp.org/news/a/the-eu-ai-act-a-discussion-with-mep-and-co-rapporteur-dragos-tudorache?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) IAPP Editorial Director Jedidiah Bracy speaks with EU AI Act Co-rapporteur and Romanian MEP Dragoș Tudorache about the state of play of the proposed legislation #### [Consumers in three recent biometric data privacy cases seek class action status](https://biometricupdate.com/202212/consumers-in-three-recent-biometric-data-privacy-cases-seek-class-action-status?ref=thenexusofprivacy.net) Jim Nash on BiometricUpdate.com (biometricupdate.com) Three proposed U.S. class actions involving alleged biometric privacy violations are churning between Chicago and New Orleans. #### [Privacy Rights in a Remote Work World: Can My Employer Monitor My Activity?](https://natlawreview.com/article/privacy-rights-remote-work-world-can-my-employer-monitor-my-activity?ref=thenexusofprivacy.net) Bonnie Henry on The National Law Review (natlawreview.com) The rise in remote work has brought with it a rise in employee monitoring.  Between 2019 and 2021, the percentage of employees working primarily from home tripled. #### [The biggest security risks of using fitness trackers and apps to monitor your health](https://cnbc.com/2022/11/26/the-biggest-risks-of-using-fitness-trackers-to-monitor-health.html?%5F%5Fsource=sharebar%7Ctwitter&ref=thenexusofprivacy.net) Cheryl Winokur Munk on CNBC (cnbc.com) Fitness trackers and apps from Google’s Fitbit to Apple Watch and Strava help stay on top of health and wellness, but secure personal data before sporting them. #### [How to stop Facebook Messenger spam from reaching you](https://businessinsider.com/guides/tech/facebook-messenger-spam?ref=thenexusofprivacy.net) Dave Johnson on Insider (businessinsider.com) You can reject most or all spam messages in Facebook Messenger automatically by adjusting your privacy settings. #### [Brave starts showing “privacy-preserving” ads in search results](https://bleepingcomputer.com/news/technology/brave-starts-showing-privacy-preserving-ads-in-search-results?ref=thenexusofprivacy.net) Sergiu Gatlan on BleepingComputer (bleepingcomputer.com) Brave Software announced that, as part of a global beta program, it is now displaying “privacy-preserving ads” in-between results shown by its web search engine to select users. #### [India Requires Internet Services to Collect and Store Vast Amount of Customer Data, Building a Path to Mass Surveillance](https://eff.org/deeplinks/2022/12/india-requires-internet-services-collect-and-store-vast-amount-customer-data?ref=thenexusofprivacy.net) Karen Gullo on Electronic Frontier Foundation (eff.org) Privacy and online free expression are once again under threat in India, thanks to vaguely worded cybersecurity directions—promulgated by India’s Computer Emergency Response Team (CERT-In) earlier this year—that impose draconian mass surveillance obligations on internet services, threatening... #### [LOST THE WAR?: Google Beats a CIPA Case—But the Ruling Likely Paves the Way for Another Generation of California Privacy Claims](https://natlawreview.com/article/lost-war-google-beats-cipa-case-ruling-likely-paves-way-another-generation?ref=thenexusofprivacy.net) Puja J. Amin on The National Law Review (natlawreview.com) Happy Sunday my fellow CIPA followers! I am currently en route to Florida (the Czar is currently snoozing in flight next to me. I have video evidence for anyone who wants it). And traveling cross coun #### [Zcash Doesn’t Need Your Trust](https://coindesk.com/consensus-magazine/2022/12/05/zooko-wilcox-most-influential-2022?ref=thenexusofprivacy.net) Daniel Kuhn on CoinDesk (coindesk.com) For years, the Electric Coin Company has been breaking new ground with zero-knowledge proofs. This year itradically improved privacy on itsZcash protocol, even as the right to use it is under attack. That’s why CEO Zooko Wilcox is one of CoinDesk’s Most Influential 2022. #### [Experts say Chula Vista’s new privacy policy falls short](https://kpbs.org/news/local/2022/12/05/experts-say-chula-vistas-new-privacy-policy-falls-short?ref=thenexusofprivacy.net) Amita Sharma on KPBS Public Media (kpbs.org) Chula Vista officials claim the policy bans the sale of data picked up by police surveillance tools. Yet, most personal information could still lawfully be sold, according to experts in how surveillance data is used and regulated. #### [Apple faces critics over its privacy policies](https://techxplore.com/news/2022-12-apple-critics-privacy-policies.html?ref=thenexusofprivacy.net) Jules BONNARD on Tech Xplore (techxplore.com) Apple presents itself as a white knight on the subject of privacy, but critics say its own advertising ambitions are built on anti-competitive practices. #### [UPS and FedEx gun purchase tracking policies draw privacy concerns](https://wboy.com/news/west-virginia/ups-and-fedex-gun-purchase-tracking-policies-draw-privacy-concerns?ref=thenexusofprivacy.net) Alexandra Weaver on WBOY.com (wboy.com) Reports of new UPS and FedEx policies surrounding the purchase of firearm products and parts in addition to the firearms themselves have a group of attorneys general worried. #### [We Asked Privacy Experts About Amazon and Ring’s Controversial Relationship With Law Enforcement](https://yahoo.com/lifestyle/asked-privacy-experts-amazon-ring-233000315.html?ref=thenexusofprivacy.net) Taylor Galla on Yahoo Life (yahoo.com) Is Ring a great tool for protecting your home, or another tool to be used by the surveillance state? We talked to cybersecurity experts to find out. #### [Asia Pacific privacy conference covers biometric data collection, voice ID case | Biometric Update](https://biometricupdate.com/202212/asia-pacific-privacy-conference-covers-biometric-data-collection-voice-id-case?ref=thenexusofprivacy.net) Joel R. McConvey on BiometricUpdate.com (biometricupdate.com) The forum saw representatives from seventeen APPA member nations gather to meet and discuss privacy regulation, enforcement and best practices. #### [Hamburg DPA issues optimistic stance on Executive Order for EU-U.S. Data Privacy Framework](https://engage.hoganlovells.com/knowledgeservices/news/hamburg-dpa-issues-optimistic-stance-on-executive-order-for-eu-us-data-privacy-framework?ref=thenexusofprivacy.net) on Hogan Lovells Engage 5.7.7 (engage.hoganlovells.com) The Data Protection Authority (“DPA”) of the German state Hamburg is one of the first European DPA to publish an optimistic assessment on the U.S. Executive Order on “Enhancing Safeg... ### Privacy News: December 5 URL: https://thenexusofprivacy.net/privacy-news-december-5/ Last updated: 2022-12-05T20:41:40.000Z Killer robots, a new deadline for Real ID, effective privacy organizing, security cameras with a data leak, Mastodon, and more! ### [San Francisco’s Killer Robots Threaten the City’s Most Vulnerable](https://www.wired.com/story/san-franciscos-killer-police-robots-threaten-the-citys-most-vulnerable/?ref=thenexusofprivacy.net) Khari Johnson, WIRED (wired.com) Last week, San Francisco's Board of Supervisors voted 8-3 to give police the right to kill a criminal suspect with a teleoperated robot if they believe there is an imminent threat of death to police or members of the public. As Johnson reports > The new administrative code requires a police chief to authorize use of deadly force involving a robot and to first consider de-escalation or an alternative use of force. But some civil liberties groups, San Francisco residents, and experts on police violence fear allowing killer robots on city streets. They say the policy change normalizes militarized policing and could lead to the intimidation or death of vulnerable people historically discriminated against by law enforcement, such as those with mental health problems, homeless people, and communities of color. The final vote is tomorrow. > TAKE ACTION! [Demand the San Francisco Board of Supervisors vote against police robots to kill](https://actionnetwork.org/letters/2212%5Fbcf%5Fletters%5Fsfbos%5Fpolicerobots/?ref=thenexusofprivacy.net) using Black Lives Matter's handy web form. [![Patrick Matthews on Twitter: The year is 8192. The US Sec of Galactic Security announces an extension of the REAL ID implementation deadline. ](https://thenexusofprivacy.net/content/images/2022/12/Screen-Shot-2022-12-05-at-10.48.01-AM.png)](https://twitter.com/matthews%5Fp/status/1599803955755847685?ref=thenexusofprivacy.net) ### [DHS resets the clock on its threat to stop flyers without ID](https://papersplease.org/wp/2022/12/05/dhs-resets-the-clock-on-its-threat-to-stop-flyers-without-id/?ref=thenexusofprivacy.net) Edwad Hasbrouck on Papers Please (papersplease.org) Department of Homeland Security (DHS) has pushed back the requirment to use a "Real ID" license for boarding domestic flights to May 7, 2025\. > "The change [announced](https://www.dhs.gov/news/2022/12/05/dhs-announces-extension-real-id-full-enforcement-deadline?ref=thenexusofprivacy.net) today — only the most recent in a seemingly [endless](https://papersplease.org/wp/2021/04/27/dhs-extends-real-id-airport-enforcement-deadline-again/?ref=thenexusofprivacy.net)[series](https://papersplease.org/wp/2020/04/20/covid-19-the-real-id-act-and-id-to-fly/?ref=thenexusofprivacy.net) of [postponed](https://papersplease.org/wp/2018/01/08/dhs-postpones-threats-of-real-id-act-enforcement/?ref=thenexusofprivacy.net)[empty](https://papersplease.org/wp/2017/10/24/dhs-blinks-again-on-real-id/?ref=thenexusofprivacy.net) REAL-ID threats — again postpones, but does not withdraw, the DHS [threat](https://papersplease.org/wp/2022/09/16/countdown-to-a-crackdown-on-flying-without-id/?ref=thenexusofprivacy.net) to start preventing people without ID from traveling by airline within the US." When I was discussing this with a Congressional staffer before Thanksgiving, I mentioned that I've been involved in activism against Real ID for over 20 years – back in 2005, Stop Real ID Now was one of the first privacy activism campaigns to use social networks, and there was such a flurry of last-minute comments that it overwhelmed the Federal Register's fax machines. In [Real ID requirement for air travel delayed, again](https://www.washingtonpost.com/transportation/2022/12/05/real-id-delay-air-travel/?ref=thenexusofprivacy.net) on the Washington Post, Luz Lazo reports that as of a fwe months ago, only 49% of state-issued IDs are Real-ID compliant. Mine most emphatically is not! ALSO: [DHS Announces Extension of REAL ID Full Enforcement Deadline | Homeland Security](https://www.dhs.gov/news/2022/12/05/dhs-announces-extension-real-id-full-enforcement-deadline?ref=thenexusofprivacy.net), Department of Homeland Security (dhs.gov) ### [It’s Not Science, Just Surveillance (and it’s Under Your Desk)](https://news.techworkerscoalition.org/2022/11/29/issue-19/?ref=thenexusofprivacy.net) Max von Hippel, Tech Workers Coalition (techworkerscoalition.org) In October, Northeastern University installed motion sensors installed under all the desks in the Interdisciplinary Science & Engineering Complex (ISEC) at Northeastern University – without letting students know in advance, let alone getting IRB approval or students' consent. Von Hippel writes: > "The alleged reason for the sensors was to conduct a study on desk usage. Reader, we have assigned desks, and we use a key-card to get into the room, so, they already know how and when we use our desks. Most likely the sensors were installed as part of a coordinated effort to push us out of our existing work-space, or to make us share our desks with other students via a hotelling system, an en-vogue new cost-saving measure that’s terrible for research." Unsprurpsingly, students pushed back. Von Hippel's [Twitter thread](https://twitter.com/maxvonhippel/status/1578048837746204672?ref=thenexusofprivacy.net) has a good timeline. Students removed all the sensors and turned them into a public art piece. Eventually, the university backed down. ALSO: [‘NO’: Grad Students Analyze, Hack, and Remove Under-Desk Surveillance Devices Designed to Track Them](https://vice.com/en/article/m7gwy3/no-grad-students-analyze-hack-and-remove-under-desk-surveillance-devices-designed-to-track-them?ref=thenexusofprivacy.net), Edward Ongweso Jr on VICE Motherboard (vice.com) ### [Eufy’s security cameras send data to the cloud without consent, and that’s not the worst part](https://zdnet.com/article/eufys-security-cameras-send-data-to-the-cloud-without-consent-and-thats-not-the-worst-part?ref=thenexusofprivacy.net) Maria Diaz on ZDNET (zdnet.com) Eufy's home page tells customers they can "keep privacy in their own hands" ... but no. Security researcher Paul Moore has discovered that Eufy uploads video thumbnails and photos of the faces of people detected in the video to the cloud – even when the option to use cloud storage was disabled. Not only that, it turns out that anybody could potentially access a Eufy camera without authentication or encryption by using VLC remotely. Yikes. ALSO: [Anker’s Eufy security cameras hit with new privacy brouhaha](https://techhive.com/article/1418923/ankers-eufy-security-cameras-hit-with-new-privacy-brouhaha.html?ref=thenexusofprivacy.net), Ben Patterson on TechHive (techhive.com) ## Mastodon ### [How secure a Twitter replacement is Mastodon? Let us count the ways](https://arstechnica.com/information-technology/2022/11/how-secure-a-twitter-replacement-is-mastodon-let-us-count-the-ways/?ref=thenexusofprivacy.net) Dan Goodin, Ars Technica (arstechnica.com) A good look at the security issues related to Mastodon, with perspectives from a range of experts – including me! Goodin discusses the impact of Mastodon not having a security team, the lack of any security auditing, the recent [misconfiguration vulnerability](https://www.alevsk.com/2022/11/system-misconfiguration-is-the-number-one-vulnerability-at-least-for-mastodon/?ref=thenexusofprivacy.net) in multiple instances that allowed for the downloading and deleting of all files stored on the server and replacing every user’s profile picture, and other issues as well. > “On personal security, there aren't a lot of protections against harassment,” said Jon Pincus of the [Nexus of Privacy](https://nexusofprivacy.net/?ref=thenexusofprivacy.net). “Many instances aren't well-moderated (including mastodon.social, which \[Mastodon creator\] Eugen \[Rochko\] runs). Even well-moderated instances can be overwhelmed by determined attacks.” Obviously, I'm still using Mastodon despite the security issues. I see it pretty much the same way as Kevin Beaumont, a security professional and admin for the cyberplace.social instance Goodin also quotes: > “My take is the same as Twitter. Don’t write anything on social media you wouldn’t write in public. Much like Twitter handles direct messages without encryption, Mastodon messages aren’t encrypted either.” ### [Mastodon privacy: you can’t really opt out of search engine indexing](https://thenexusofprivacy.net/mastodon-privacy-remember-that-public-and-unlisted-posts-can-be-indexed-by-search-engines/) Jon Pincus, The Nexus of Privacy (privacy.thenexus.today) There are a lot of reasons people might not want their posts on a social network to be indexed by search engines. Too bad Mastodon's "opt out" doesn't actually opt you out. ## And ... #### [Chinese security firm advertises ethnicity recognition technology while facing UK ban](https://theguardian.com/world/2022/dec/04/chinese-security-firm-advertises-ethnicity-recognition-technology-while-facing-uk-ban?ref=thenexusofprivacy.net) Alex Hern on The Guardian (theguardian.com) Campaigners concerned that ‘same racist technology used to repress Uyghurs is being marketed in Britain’ #### [Effective Altruism Is Pushing a Dangerous Brand of ‘AI Safety’](https://wired.com/story/effective-altruism-artificial-intelligence-sam-bankman-fried?ref=thenexusofprivacy.net) Timnit Gebru on WIRED (wired.com) This philosophy—supported by tech figures like Sam Bankman-Fried—fuels the AI research agenda, creating a harmful system in the name of saving humanity #### [Meredith Whittaker Shares What’s Next for Signal](https://time.com/6238482/signals-president-meredith-whittaker-interview?ref=thenexusofprivacy.net) Billy Perrigo on Time (time.com) Whittaker spoke to TIME about the state of the tech landscape, where Signal is going next and the crypto meltdown. #### [Dal Garante privacy 2 milioni di multa a Clubhouse, il social delle chat vocali](https://gpdp.it/web/guest/home/docweb/-/docweb-display/docweb/9828286?ref=thenexusofprivacy.net) on Garante Privacy (gpdp.it) #### [Why automating trucking is harder than you think](https://theverge.com/2022/12/5/23490433/trucker-surveillance-autonomous-karen-levy-book-interview?ref=thenexusofprivacy.net) David Zipper on The Verge (theverge.com) Autonomous trucks are probably further out than we think. #### [Buddi Limited - Immigration Enforcement’s favourite tracking buddy](https://privacyinternational.org/long-read/4991/buddi-limited-immigration-enforcements-favourite-tracking-buddy?ref=thenexusofprivacy.net) on Privacy International (privacyinternational.org) Since early 2021, PI have been investigating and challenging the latest stride in the UK’s cruel migration policies: the roll-out of GPS ankle tags to monitor migrants released on immigration bail, a dehumanising, #### [CCTV in classrooms does not violate right to privacy: Delhi govt to HC](https://business-standard.com/article/current-affairs/cctv-in-classrooms-does-not-violate-right-to-privacy-delhi-govt-to-hc-122120300450%5F1.html?ref=thenexusofprivacy.net) IANS on Business Standard (business-standard.com) The Delhi government recently told the High Court that one major reason behind its 2017 decision is to save and secure students from sexual abuse and bullying #### [Let Data Breach Victims Sue Marriott](https://eff.org/deeplinks/2022/11/let-data-breach-victims-sue-marriott?ref=thenexusofprivacy.net) Adam Schwartz and Cindy Cohn on Electronic Frontier Foundation (eff.org) A company harvested your personal data, but failed to take basic steps to secure it. So thieves stole it. Now you’ve lost control of your data, and you’re at greater risk of identity theft. But when you sue the negligent company, they say you haven’t really been injured, so you don’t belong in... #### [France’s CNIL Fines Discord €800,000 for GDPR Violations](https://cpomagazine.com/data-protection/frances-cnil-fines-discord-e800000-for-gdpr-violations?ref=thenexusofprivacy.net) Scott Ikeda on CPO Magazine (cpomagazine.com) Though the fine is not one of the largest issued by CNIL (or for general GDPR violations across the bloc), the case is noteworthy in that Discord is mostly being taken to task for not providing default or built-in security options rather than the fallout of a specific data breach. #### [Contending with data privacy concerns in 5 charts](https://insiderintelligence.com/content/contending-with-data-privacy-concerns-5-charts?ref=thenexusofprivacy.net) Sara Lebow on Insider Intelligence (insiderintelligence.com) Apple’s AppTrackingTransparency, Google’s cookie deprecation, and the impending threat of regulation are challenging data collection. Trust in social platforms is declining. As consumers shy from sharing information, marketers need to meet customers where they’re comfortable. #### [Companies use design to take our time, money and personal data](https://forbrukerradet.no/side/companies-use-design-to-take-our-time-money-and-personal-data?ref=thenexusofprivacy.net) Øyvind Kaldestad on Forbrukerrådet (forbrukerradet.no) Many companies use deceptive design to hold on to customers, increase sales, or acquire personal data. In many cases, this is illegal, the Norwegian Consumer Council says. #### [Can the U.S. and Europe Agree on Rules for AI?](https://techonomy.com/can-the-u-s-and-europe-agree-on-rules-for-ai?ref=thenexusofprivacy.net) Caitlin Hamilton on Techonomy (techonomy.com) As EU and U.S. leaders meet in Washington at a joint Trade and Technology Council, there is great need for a proposed “transatlantic accord on artificial intelligence.” But the two sides have differing agendas, and agreement is uncertain. #### [Data-driven Health Marketing Surveillance in the U.S.](https://democraticmedia.org/article/data-driven-health-marketing-surveillance-us?ref=thenexusofprivacy.net) on Center for Digital Democracy (democraticmedia.org) #### [Making Government Data Publicly Available: Guidance for Agencies on Releasing Data Responsibly](https://cdt.org/insights/making-government-data-publicly-available-guidance-for-agencies-on-releasing-data-responsibly?ref=thenexusofprivacy.net) Hugh Grant-Chapman, Hannah Quay-de la Vallee on Center for Democracy and Technology (cdt.org) Government agencies rely on a wide range of data to effectively deliver services to the populations with which they engage. Civic-minded advocates frequently argue that the public benefits of this data can be better harnessed by making it available for public access. Recent years, however, have also… #### [International Coalition of Rights Groups Call on Internet Infrastructure Providers to Avoid Content Policing](https://eff.org/press/releases/international-coalition-rights-groups-call-internet-infrastructure-providers-avoid?ref=thenexusofprivacy.net) Paige Collings on Electronic Frontier Foundation (eff.org) San Francisco—Internet infrastructure services—the heart of a secure and resilient internet where free speech and expression flows—should continue to focus their energy on making the web an essential resource for users and, with rare exceptions, avoid content policing. Such intervention often... #### [How to Make a Mastodon Account and Join the Fediverse](https://eff.org/deeplinks/2022/12/how-make-mastodon-account-and-join-fediverse?ref=thenexusofprivacy.net) Rory Mir on Electronic Frontier Foundation (eff.org) The recent chaos at Twitter is a reminder that when you rely on a social media platform, you’re putting your voice, your privacy, and your safety in the hands of the people who run that system. Many people are looking to Mastodon as a backup or replacement for Twitter, and this guide will walk you t… #### [The EU AI Act: A discussion with MEP and co-rapporteur Dragoș Tudorache](https://iapp.org/news/a/the-eu-ai-act-a-discussion-with-mep-and-co-rapporteur-dragos-tudorache?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) IAPP Editorial Director Jedidiah Bracy speaks with EU AI Act Co-rapporteur and Romanian MEP Dragoș Tudorache about the state of play of the proposed legislation #### [Consumers in three recent biometric data privacy cases seek class action status](https://biometricupdate.com/202212/consumers-in-three-recent-biometric-data-privacy-cases-seek-class-action-status?ref=thenexusofprivacy.net) Jim Nash on BiometricUpdate.com (biometricupdate.com) Three proposed U.S. class actions involving alleged biometric privacy violations are churning between Chicago and New Orleans. #### [Privacy Rights in a Remote Work World: Can My Employer Monitor My Activity?](https://natlawreview.com/article/privacy-rights-remote-work-world-can-my-employer-monitor-my-activity?ref=thenexusofprivacy.net) Bonnie Henry on The National Law Review (natlawreview.com) The rise in remote work has brought with it a rise in employee monitoring.  Between 2019 and 2021, the percentage of employees working primarily from home tripled.  As “produ #### [The biggest security risks of using fitness trackers and apps to monitor your health](https://cnbc.com/2022/11/26/the-biggest-risks-of-using-fitness-trackers-to-monitor-health.html?%5F%5Fsource=sharebar%7Ctwitter&ref=thenexusofprivacy.net) Cheryl Winokur Munk on CNBC (cnbc.com) Fitness trackers and apps from Google’s Fitbit to Apple Watch and Strava help stay on top of health and wellness, but secure personal data before sporting them. #### [How to stop Facebook Messenger spam from reaching you](https://businessinsider.com/guides/tech/facebook-messenger-spam?ref=thenexusofprivacy.net) Dave Johnson on Insider (businessinsider.com) You can reject most or all spam messages in Facebook Messenger automatically by adjusting your privacy settings. #### [Brave starts showing “privacy-preserving” ads in search results](https://bleepingcomputer.com/news/technology/brave-starts-showing-privacy-preserving-ads-in-search-results?ref=thenexusofprivacy.net) Sergiu Gatlan on BleepingComputer (bleepingcomputer.com) Brave Software announced that, as part of a global beta program, it is now displaying “privacy-preserving ads” in-between results shown by its web search engine to select users. #### [Medibank faces formal privacy investigation](https://itnews.com.au/news/medibank-faces-formal-privacy-investigation-588614?ref=thenexusofprivacy.net) Staff Writer on iTnews (itnews.com.au) And prospect of penalties. #### [India Requires Internet Services to Collect and Store Vast Amount of Customer Data, Building a Path to Mass Surveillance](https://eff.org/deeplinks/2022/12/india-requires-internet-services-collect-and-store-vast-amount-customer-data?ref=thenexusofprivacy.net) Karen Gullo on Electronic Frontier Foundation (eff.org) Privacy and online free expression are once again under threat in India, thanks to vaguely worded cybersecurity directions—promulgated by India’s Computer Emergency Response Team (CERT-In) earlier this year—that impose draconian mass surveillance obligations on internet services, threatening... #### [HHS Proposes to Align Federal Substance Use Disorder Law with HIPAA](https://natlawreview.com/article/hhs-proposes-to-align-federal-substance-use-disorder-law-hipaa?ref=thenexusofprivacy.net) Jennifer J. Hennessy on The National Law Review (natlawreview.com) Proposed changes to the federal substance use disorder law will increase provider efficiency and alignment with the Health Insurance Portability and Accountability Act (HIPAA). #### [ICE data dump reveals PII of 6,000+ asylum seekers](https://theregister.com/2022/12/01/ice%5Fdata%5Fdump?ref=thenexusofprivacy.net) Jessica Lyons Hardcastle on The Register (theregister.com) Your tax dollars at work #### ### Mastodon privacy: you can't really opt out of search engine indexing URL: https://thenexusofprivacy.net/mastodon-privacy-remember-that-public-and-unlisted-posts-can-be-indexed-by-search-engines/ Last updated: 2026-04-16T02:55:39.000Z There are a lot of reasons people might not want their posts on a social network to be indexed by search engines. One of the most important is personal safety. Harassers often use search engines to find out information about the people they're targeting – or to find new people to target. So Mastodon gives you the option (on the Preferences/Other settings page) to opt out of search engine indexing. Unfortunately, as we'll discuss below, selecting this option doesn't actually fully opt you out of search engine indexing. If you're familiar with Mastodon's cavalier approach to privacy and security, this probably doesn't come as a surprise to you. As hachyderm.io admin Kris Nova says in [Operating Mastodon, Privacy, and Content](https://medium.com/@kris-nova/operating-mastodon-privacy-and-content-399eef251e65?ref=thenexusofprivacy.net) > My immediate advice is to treat everything on Mastodon as if it is **public data!** However, a lot of people think Mastodon's more private and secure than it really is. For one thing, Mastodon has long positioned itself as reducing harassment by [learning from Twitter’s mistakes](http://blog.joinmastodon.org/2017/03/learning-from-twitters-mistakes/?ref=thenexusofprivacy.net). And making it harder for harassers to search for past messages is often used as an example of this. As EFF's Bill Buddington says in [Is Mastodon Private and Secure?](https://www.eff.org/deeplinks/2022/11/mastodon-private-and-secure-lets-take-look?ref=thenexusofprivacy.net) > "This cuts down on harassment, because abusive accounts will have a harder time discovering posts and accounts using key words typically used by the population they’re targeting (a technique frequently used by trolls and harassers)" So having this option that doesn't actually work gives people a false sense of security – but leaves them exposed if they're at risk of harassment. ## Why doesn't opting out really opt you out? Understanding why this option doesn't work as expected requires a bit of digging into how "noindex" rule works in search engines and how Mastodon treats the opt-out setting. As Google's [Block Search Indexing with ‘noindex'](https://developers.google.com/search/docs/crawling-indexing/block-indexing?ref=thenexusofprivacy.net) describes, when an HTML page has a tag, Google and other search engines that support the noindex rule won't index the page. Of course, badly-behaved search engines *can* ignore the tag, so this won't stop people who write their own crawlers. Still, writing a crawler and storing all your own data is a pretty significant investment, so this is a useful level of protection. Mastodon version 4.0 always puts a noindex tag [on most pages](https://github.com/mastodon/mastodon/pull/19319?ref=thenexusofprivacy.net), but whether or not it's on your profile depends on the "opt-out of search engine indexing" option. The option is also used to determine whether there's a noindex tag on web pages for your posts. My indieweb.social account has that option turned on, so if you look at the HTML for [this post](https://indieweb.social/@jdp23/109454142903621001?ref=thenexusofprivacy.net), you'll see the noindex rule. So far so good. But if I do a search for "[@jdp23@indieweb.social](https://www.google.com/search?as%5Fq=%40jdp23%40indieweb.social&as%5Feq=twitter&ref=thenexusofprivacy.net)", I'll find pages with my posts in them. In fact, I can even do a search for specific text in one of my posts – here's one for "[jdp23 gh\*st](https://www.google.com/search?q=jdp23+gh%2Ast&ref=thenexusofprivacy.net)" that brings up a thread Anil Dash started that I replied to. In this particular case I don't care, but imagine a situation where instead of gh\*st I had used a term that attracts harassers. That'd be very bad. And as Darius Kazemi [verified](https://indieweb.social/@darius@friend.camp/109454083964785804?ref=thenexusofprivacy.net), this applies to unlisted posts as well as public posts. From a software perspective, the bug here is that Mastodon is only checking the "opt out of search engines" setting for the original author. Anil, like many others, doesn't mind if his posts are indexed by search engines. When I reply to him, that means that my post will be indexed by search engines as well – even though I've opted out. I filed a [bug report](https://github.com/mastodon/mastodon/issues/22047?ref=thenexusofprivacy.net) on this and it'll be interesting to see what the response is. ### But wait, there's more This isn't the only way your public and unlisted Mastodon posts can wind up in a search engine even if you've opted out. If somebody from another instance is following you, there's no guarantee that the software they're running will pay attention to the "opt-out from search engines" setting. As long as the other instances are running Mastodon software, this isn't an issue unless admins have intentionally disabled this functionality. However, other software that's compatible with Mastodon may not know about this setting. In fact, because of the way Mastodon implements federation, even posts that have been deleted have copies on other instances that can still be found by search engines. Yikes! It's worth noting that "[local-only posts](https://github.com/hometown-fork/hometown/wiki/Local-only-posting?ref=thenexusofprivacy.net)," supported by Mastodon forks (variants) like Glitch and Hometown, provide significant protection here. Local-only posts aren't included in externally-accesses pages, so search engines never see them. As Hometown maintainer Kazemi points out, if you're on an instance where you trust the admins and the other members, local-only posts give you the ability to ensure that your stuff only goes to actors you personally trust. Unfortunately, Mastodon's BDFL (benevolent dictator for life) has rejcted this valuable anti-harassment technology from the main line of code, so most instances don't have this functionality. Of course, Mastodon's not the only social network site where you don't have any privacy. Twitter allows you to delete your tweets and direct messages, but doesn't actually commit to deleting them from their internal databases or backups. And since there's currently more organized harassment on Twitter than Mastodon, and their investors (including Larry Ellison of Oracle, Prince Alwaleed bin Talal bin Abdulaziz of Saudi Arabia, and the Qatar Investment Authority) get special rights to your personal data, the risks are likely higher there. Still, don't kid yourself: Mastodon's security and privacy story is not good. Lenin Alevski recently found a system misconfiguration vulnerability making [content and videos from supposedly-private direct messages open to the world](https://www.alevsk.com/2022/11/system-misconfiguration-is-the-number-one-vulnerability-at-least-for-mastodon/?ref=thenexusofprivacy.net); as well as infosec.exchange's 33,000 users, Alevski reports this affected several other high-profile sites. The lack of end-to-end encryption means that admins can read supposedly-private direct messages – and if you're DM'ing with somebody on another instance, their admins can read it as well. The **What to do?** section of Dan Goodin's [How secure a Twitter replacement is Mastodon? Let us count the ways](https://arstechnica.com/information-technology/2022/11/how-secure-a-twitter-replacement-is-mastodon-let-us-count-the-ways/?ref=thenexusofprivacy.net) has a useful list of some of the things you can do to cut down the risks, but they only go so far. At the end of the day, I agree with Kevin Beaumont, a security professional and admin for the cyberplace.social instance, who Goodin quotes as saying: > “My take is the same as Twitter. Don’t write anything on social media you wouldn’t write in public." ### Privacy News: December 2 URL: https://thenexusofprivacy.net/privacy-news-december-2/ Last updated: 2022-12-02T18:04:56.000Z A lot of links for your weekend reading pleasure! ### [The airport of the future is the airport of today — and that’s not good](https://papersplease.org/wp/2022/11/23/the-airport-of-the-future-is-the-airport-of-today-and-thats-not-good/?ref=thenexusofprivacy.net) Ed Hasbrouck on Papers Please (papersplease.org) Hasbrouck looks at the integrated and largely-invisible surveillance infrastructure in airports today and the convergence of interests between government agencies, airlines, and airports. > During the pandemic, largely unnoticed, the [dystopian surveillance-by design airport of the future](https://papersplease.org/wp/2019/12/17/airports-of-the-future-surveillance-by-design/?ref=thenexusofprivacy.net) that [we’ve](https://papersplease.org/wp/2014/08/22/passenger-tracking-happy-flow-at-aruba-airport/?ref=thenexusofprivacy.net) been [worried ](https://papersplease.org/wp/2018/10/15/tsa-announces-biometrics-vision-for-all-commercial-aviation-travelers/?ref=thenexusofprivacy.net)and [warning](https://papersplease.org/wp/2020/02/07/the-nightmare-of-airport-facial-recognition/?ref=thenexusofprivacy.net) about for many years has become, in many places, the airport of today.... > > A characteristic feature of almost all new or newly-renovated major airports in the U.S. and around the world is that they are designed and built on the assumption that all passengers’ movements within the airport will be tracked at all times, and that all phases of “passenger processing” will be carried out automatically using facial recognition, as shown in this video from a technology vendor, [Airport of the Future](https://www.youtube.com/watch?v=m5axxLN1LYM&ref=thenexusofprivacy.net). ALSO: - [Hasbrouck's recent presentation at CCRC-IP-Asia](https://hasbrouck.org/video/Hasbrouck-airport-video-28NOV2022.mp4?ref=thenexusofprivacy.net) - [MAGICAL, Part 1](https://www.pelicancrossing.net/netwars/2022/10/magical%5Fpart%5F1.html?ref=thenexusofprivacy.net), Wendy Grossman on net.wars (pelicancrossing.net), a first-person experience from a long-time privacy expert – and some additional perspectives from Hasbrouck ### [TSA now wants to scan your face at security. Here are your rights.](https://washingtonpost.com/technology/2022/12/02/tsa-security-face-recognition?ref=thenexusofprivacy.net) Geoffrey A. Fowler on The Washington Post (washingtonpost.com) Speakingn of which, sixteen major domestic airports are testing facial-recognition tech to verify IDs – and the TSA hopes to expand the pilot to airports all across the country next year. What could possibly go wrong? > The TSA says facial recognition, which has been [banned by cities such as San Francisco](https://www.washingtonpost.com/technology/2019/05/14/san-francisco-becomes-first-city-us-ban-facial-recognition-software/?itid=lk%5Finline%5Fmanual%5F5&ref=thenexusofprivacy.net), helps improve security and possibly also efficiency. But it’s also bringing an unproven tech, with civil rights ramifications we still just don’t understand, to one of the most stressful parts of travel.... > > the TSA hasn’t actually released hard data about how often its system falsely identifies people, through incorrect positive or negative matches. Some of that might come to light next year when the TSA has to make its case to the Department of Homeland Security to convert airports all over the United States into facial recognition systems. > > “I am worried that the TSA will give a green light to technology that is more likely to falsely accuse black and brown and nonbinary travelers and other groups that have historically faced more facial recognition errors,” said \[Alfred Fox\] Cahn of STOP. As Fowler notes, you don't have to participate: you can tell the officer that you do not want their photo taken, and they'll turn off camera. There are supposed to be signs around informing you of your rights, although we'll see how prominent they are. As Hasbrouck says in [The airport of the future is the airport of today](https://papersplease.org/wp/2022/11/23/the-airport-of-the-future-is-the-airport-of-today-and-thats-not-good/?ref=thenexusofprivacy.net) > “Opting out” is, in these new airports and terminals, a [largely theoretical option](https://www.nytimes.com/2022/10/05/travel/customs-kiosks-facial-recognition.html?ref=thenexusofprivacy.net) available only to those travelers who already know their rights (without being given notice of them), who figure out how to assert them (again without notice), and who are willing to put up with additional questioning, search, and/or delay. ### [The Big Problem With Spotify Wrapped](https://wired.com/story/spotify-wrapped-user-data?ref=thenexusofprivacy.net) Amanda Hoover on WIRED (wired.com) According to [Spotify](https://newsroom.spotify.com/2022-11-30/everything-you-need-to-know-about-2022-wrapped/?ref=thenexusofprivacy.net), "Spotify Wrapped is all about celebrating the endless ways that millions of creators and fans connect through audio each and every day." It does that based on all the data it tracks about its users and what they're listening to. > “This is a particularly shining example of the fact that Spotify’s business model is based on surveillance,” says Evan Greer, director of the digital rights advocacy group Fight for the Future. “Spotify has done an amazing job of marketing surveillance as fun and getting people to not only participate in their own surveillance, but celebrate it and share it and brag about it to the world.” Unfortunately, the Wired article leaves out another big proble. Spotify Wrapped was originally developed by Jewel Ham as an intern there, and she's never gotten credit for it. Yes, data privacy is a huge issue ... but it's not the only issue! Whizy Kim's [The Intern Who Created Spotify Wrapped’s Story Format Never Got Her Due](https://www.refinery29.com/en-us/2020/12/10208481/jewel-ham-artist-spotify-wrapped-internship?ref=thenexusofprivacy.net) on *Refinery 29* and Keyaira Boone's [A Black Howard Alumna Claims She Was Influential In Creating Key Spotify Wrapped Features Without Credit](https://www.essence.com/news/jewel-ham-spotify-wrapped/?ref=thenexusofprivacy.net) on *Essence* have more. ## And ... #### [How China’s Police Used Phones and Faces to Track Protesters](https://nytimes.com/2022/12/02/business/china-protests-surveillance.html?ref=thenexusofprivacy.net) Paul Mozur, Claire Fu and Amy Chang Chien in the New York Times (nytimes.com) After a weekend of protests, the authorities in China are using the country’s all-seeing surveillance apparatus to find those bold enough to defy them. #### [A Hacked Newsroom Brings a Spyware Maker to U.S. Court](https://newyorker.com/news/news-desk/a-hacked-newsroom-brings-a-spyware-maker-to-us-court-pegasus?ref=thenexusofprivacy.net) Ronan Farrow on The New Yorker (newyorker.com) When Roman Gressier, an American reporter working in El Salvador, found out that he and his colleagues were being surveilled, he feared persecution due to his sexual identity and worried for his sources’ safety. In a lawsuit filed today in federal court in San Jose, Gressier will become the first U.S. citizen whose phone was infected by Pegasus to sue NSO Group for damages, according to lawyers representing him at the Knight First Amendment Institute at Columbia University. ALSO: [Why We’re Suing NSO Group](https://knightcolumbia.org/blog/why-were-suing-nso-group?%5Fpreview%5F=7bd805e6dc&ref=thenexusofprivacy.net), Jameel Jaffer on Knight First Amendment Institute (knightcolumbia.org) #### [The Irish Times view on the use of facial recognition technologies](https://irishtimes.com/opinion/editorials/2022/12/01/the-irish-times-view-on-the-use-of-facial-recognition-technologies?ref=thenexusofprivacy.net) The Irish Times (irishtimes.com) The Government needs to think again about plans to introduce this new technology in policing, giving its patchy record and privacy fears #### [Companies use design to take our time, money and personal data](https://forbrukerradet.no/side/companies-use-design-to-take-our-time-money-and-personal-data?ref=thenexusofprivacy.net) Øyvind Kaldestad on Forbrukerrådet (forbrukerradet.no) Many companies use deceptive design to hold on to customers, increase sales, or acquire personal data. In many cases, this is illegal, the Norwegian Consumer Council says. #### [Amazon’s Creep Into Health Care Has Some Experts Spooked](https://wired.com/story/amazons-creep-into-health-care-has-some-experts-spooked?ref=thenexusofprivacy.net) Grace Browne on WIRED (wired.com) Using the tech giant’s new telehealth service will mean trusting it with your private data. #### [Anker’s Eufy lied to us about the security of its security cameras](https://theverge.com/2022/11/30/23486753/anker-eufy-security-camera-cloud-private-encryption-authentication-storage?ref=thenexusofprivacy.net) Sean Hollister on The Verge (theverge.com) The cameras have a flaw that Eufy insisted would be impossible #### [Hungary: Data Misused for Political Campaigns](https://hrw.org/news/2022/12/01/hungary-data-misused-political-campaigns?ref=thenexusofprivacy.net) Human Rights Watch (hrw.org) The Hungarian government’s misuse of personal data during the 2022 national elections campaign undermined privacy and further tilted an already uneven playing field in favor of the ruling party, Fidesz. ALSO: [Orbán used Hungarians’ COVID data to boost election campaign, report says](https://politico.eu/article/viktor-orban-hungary-election-campaign-covid-data-use?ref=thenexusofprivacy.net), Louis Westendarp on POLITICO (politico.eu) #### [Online Safety Bill’s ‘spy clause’ will pave way for ‘mass state surveillance’ of WhatsApp](https://inews.co.uk/news/politics/online-safety-bills-spy-clause-will-pave-way-for-state-mandated-mass-surveillance-of-whatsapp-messages-2005430?ref=thenexusofprivacy.net) Richard Vaughan on inews.co.uk (inews.co.uk) The Government has tabled amendments to strengthen powers to ‘scan and intercept’ end-to-end encrypted messages #### [Musk at Twitter has ‘huge work’ ahead to comply with EU rules, warns bloc](https://techcrunch.com/2022/11/30/elon-musk-twitter-eu-dsa-warning?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) European Union regulators have fired another warning shot at Elon Musk over his erratic piloting of Twitter since his takeover last month. #### [Microsoft 365 faces more GDPR headwinds in Germany](https://theregister.com/2022/11/30/office%5F365%5Ffaces%5Fmore%5Fgdpr?ref=thenexusofprivacy.net) Jude Karabus on The Register (theregister.com) Redmond disputes report that ‘it is not possible to use without transferring personal data to the USA’ #### [Making Government Data Publicly Available: Guidance for Agencies on Releasing Data Responsibly](https://cdt.org/insights/making-government-data-publicly-available-guidance-for-agencies-on-releasing-data-responsibly?ref=thenexusofprivacy.net) Hugh Grant-Chapman, Hannah Quay-de la Vallee on Center for Democracy and Technology (cdt.org) Government agencies rely on a wide range of data to effectively deliver services to the populations with which they engage. Civic-minded advocates frequently argue that the public benefits of this data can be better harnessed by making it available for public access. Recent years, however, have also… #### [Irish DPC greenlights Facebook’s “GDPR bypass”.](https://noyb.eu/en/irish-dpc-greenlights-facebooks-gdpr-bypass?ref=thenexusofprivacy.net) noyb (noyb.eu) Schrems: “Decision undermines key element of GDPR.” #### [The Best Privacy-Focused Browsers You’ve Never Heard Of](https://lifehacker.com/the-best-privacy-focused-browsers-you-ve-never-heard-of-1849823243?ref=thenexusofprivacy.net) Pranay Parab on Lifehacker (lifehacker.com) Reduce tracking and improve your privacy with these lesser-known browsers. #### [France’s CNIL Fines Discord €800,000 for GDPR Violations](https://cpomagazine.com/data-protection/frances-cnil-fines-discord-e800000-for-gdpr-violations?ref=thenexusofprivacy.net) Scott Ikeda on CPO Magazine (cpomagazine.com) Though the fine is not one of the largest issued by CNIL (or for general GDPR violations across the bloc), the case is noteworthy in that Discord is mostly being taken to task for not providing default or built-in security options rather than the fallout of a specific data breach. #### [Contending with data privacy concerns in 5 charts](https://insiderintelligence.com/content/contending-with-data-privacy-concerns-5-charts?ref=thenexusofprivacy.net) Sara Lebow on Insider Intelligence (insiderintelligence.com) Apple’s AppTrackingTransparency, Google’s cookie deprecation, and the impending threat of regulation are challenging data collection. Trust in social platforms is declining. As consumers shy from sharing information, marketers need to meet customers where they’re comfortable. That means finding crea… #### [Invasion of Privacy Lawsuits Will Be On The Rise In California Where Employers Use Monitoring/Tracking Technology](https://jdsupra.com/legalnews/invasion-of-privacy-lawsuits-will-be-on-2578688?ref=thenexusofprivacy.net) Dan Forman on JD Supra (jdsupra.com) Employee monitoring and tracking technologies implemented to ensure remote employee productivity for remote work during the COVID-19 pandemic need to... #### [Privacy Isn’t Just an Edge Case for Crypto](https://coindesk.com/layer2/2022/11/28/privacy-isnt-just-an-edge-case-for-crypto?ref=thenexusofprivacy.net) Leah Callon-Butler on CoinDesk (coindesk.com) Financial privacy is useful for dissidents in extreme situations. But nobody should have to justify keeping their personal lives private, says our columnist. #### [Usercentrics Study: 90% of All Apps Do Not Comply With the GDPR](https://yahoo.com/now/usercentrics-study-90-apps-not-071000586.html?ref=thenexusofprivacy.net) Business Wire on Yahoo (yahoo.com) Nine out of ten apps collect personal data from users without their consent, a clear violation of the European Union’s General Data Protection Regulation (GDPR) and the ePrivacy Directive. This is the result of an analysis of 250 apps in the EU apps market, conducted by privacy tech company Usercentrics. #### [Census Bureau chief defends ‘differential privacy’ tool](https://federaltimes.com/home/2022/11/28/census-bureau-chief-defends-differential-privacy-tool?ref=thenexusofprivacy.net) Mike Schneider, The Associated Press on Federal Times (federaltimes.com) Differential privacy algorithms add intentional errors to data to obscure the identity of any given participant. #### [A Look Ahead: Lisa Sotto’s Privacy, Security Outlook in 2023](https://bankinfosecurity.com/look-ahead-lisa-sottos-privacy-security-outlook-in-2023-a-20534?ref=thenexusofprivacy.net) Michael Novinson on bankinfosecurity.com A multitude of state privacy laws taking effect in 2023 has forced organizations to revamp their compliance programs to incorporate the disparate requirements, says #### [The GDPR and the AI Act Interplay: Highlights from FPF and Ada Lovelace Institute’s Joint Event](https://fpf.org/blog/the-gdpr-and-the-ai-act-interplay-highlights-from-fpf-and-ada-lovelace-institutes-joint-event?ref=thenexusofprivacy.net) on Future of Privacy Forum (fpf.org) On November 9, 2022, FPF, along with the Ada Lovelace Institute (Ada), organized a closed roundtable in Brussels where experts met to discuss the lessons that can be drawn from General Data Protection Regulation (GDPR) enforcement precedents when deciding on the scope and obligations of the European… #### [Login.gov is getting new anti-fraud tools, but privacy advocate raises concerns](https://fcw.com/digital-government/2022/11/logingov-getting-new-anti-fraud-tools-privacy-advocate-raises-concerns/380159?ref=thenexusofprivacy.net) Natalie Alms on FCW (fcw.com) GSA is taking comments on a Federal Register notice detailing new fraud prevention and identity verification efforts through Dec. 21. #### [New details on commercial spyware vendor Variston](https://blog.google/threat-analysis-group/new-details-on-commercial-spyware-vendor-variston?ref=thenexusofprivacy.net) Clement Lecigne on Google (blog.google) The Threat Analysis Group shares new information on the commercial spyware vendor Variston. #### [Twitter’s security issues predate Elon Musk – and firing staff isn’t going to help](https://techradar.com/news/twitters-security-issues-predate-elon-musk-and-firing-staff-isnt-going-to-help?ref=thenexusofprivacy.net) Chiara Castro on TechRadar pro (techradar.com) Twitter 2.0 is taking shape and privacy experts are worried #### [As US, UK Embrace ‘Age Verify Everyone!’ French Data Protection Agency Says Age Verification Is Unreliable And Violates Privacy Rights](https://techdirt.com/2022/11/30/as-us-uk-embrace-age-verify-everyone-french-data-protection-agency-says-age-verification-is-unreliable-and-violates-privacy-rights?ref=thenexusofprivacy.net) Mike Masnick on Techdirt (techdirt.com) We keep seeing it show up in a variety of places: laws to “protect the children” that, fundamentally begin with age verification to figure out who is a child (and then layering in a ton… #### [AI regulation in Brazil: Advancements, flows, and need to learn from the data protection experience](https://sciencedirect.com/science/article/abs/pii/S0267364922001108?dgcid=coauthor&ref=thenexusofprivacy.net) Author links open overlay panelLucaBelliaEnvelopeYasminCurzibEnvelopeWalter B.GasparcPersonEnvelope on ScienceDirect (sciencedirect.com) Brazil has recently moved forward on two important developments in its regulatory framework for artificial intelligence: the creation of a national AI… #### [In ruling on disclosure of airplane cockpit voice recordings, SCC considers pilot privacy](https://canadianlawyermag.com/practice-areas/privacy-and-data/in-ruling-on-disclosure-of-airplane-cockpit-voice-recordings-scc-considers-pilot-privacy/371937?ref=thenexusofprivacy.net) Aidan Macnab on Canadian Lawyer (canadianlawyermag.com) Case centred on whether Transportation Safety Board could give in camera submissions on disclosure #### [Popular gifts this holiday season may come with digital privacy risks](https://consumeraffairs.com/news/popular-gifts-this-holiday-season-may-come-with-digital-privacy-risks-113022.html?ref=thenexusofprivacy.net) Kristen Dalli on ConsumerAffairs (consumeraffairs.com) Many of the biggest gifts this holiday season require a WiFi connection, which calls into question companies’ privacy policies for each gadget or device. P #### [Telegram shares data of users accused of copyright violation following court order](https://techcrunch.com/2022/11/29/telegram-shares-data-of-users-accused-of-copyright-violation-following-court-order?ref=thenexusofprivacy.net) Manish Singh on TechCrunch (techcrunch.com) The compliance is a remarkable illustration of the data Telegram stores on its users and can be made to disclose by authorities. #### [Microsoft 365 banned in German schools over privacy concerns](https://computerweekly.com/news/252527842/Microsoft-365-banned-in-German-schools-over-privacy-concerns?ref=thenexusofprivacy.net) Sebastian Klovig Skelton, on ComputerWeekly.com (computerweekly.com) German schools cannot legally use Microsoft Office 365 over lack of clarity about how data is collected, shared and used, as well as the potential for unlawful transfer of European citizens’ personal data to the US. #### [Let privacy bring us together in the new Congress](https://thehill.com/opinion/cybersecurity/3756867-let-privacy-bring-us-together-in-the-new-congress?ref=thenexusofprivacy.net) Cybersecurity on The Hill (thehill.com) One issue does bring millions of Americans of all political persuasions together: the need for stronger privacy and security protections for our personal information. #### [Virginia’s Consumer Data Protection Act Is Not the Commonwealth’s Only Privacy and Data Protection Law — Nor Is It the Nation’s First](https://jdsupra.com/legalnews/virginia-s-consumer-data-protection-act-3951348?ref=thenexusofprivacy.net) Ketan Bhirud on JD Supra (jdsupra.com) Virginia’s new Consumer Data Protection Act will take effect on January 1, 2023, adding new consumer privacy rights, a broader interpretation of... #### [Anker’s Eufy security cameras hit with new privacy brouhaha](https://techhive.com/article/1418923/ankers-eufy-security-cameras-hit-with-new-privacy-brouhaha.html?ref=thenexusofprivacy.net) Ben Patterson on TechHive (techhive.com) Eufy cams have been uploading video thumbnails to the cloud without telling users, according to a security researcher. #### [Common deidentification methods don’t fully protect data privacy: University of Chicago](https://crn.in/news/common-deidentification-methods-dont-fully-protect-data-privacy-university-of-chicago?ref=thenexusofprivacy.net) CRN Team on CRN - India (crn.in) University of Chicago recently published a study describing a new kind of attack called “downcoding,” demonstrating the vulnerability of a deidentified data set and sending a warning that these data transformations should not be considered sufficient to protect individuals’ privacy #### [Data-driven Health Marketing Surveillance in the U.S.](https://democraticmedia.org/article/data-driven-health-marketing-surveillance-us?ref=thenexusofprivacy.net) on Center for Digital Democracy (democraticmedia.org) #### [TikTok CEO offers reassurances over data privacy](https://marketwatch.com/story/tiktok-ceo-offers-reassurances-over-data-privacy-11669852813?ref=thenexusofprivacy.net) Sarah E. Needleman, Alexander Saeedy on MarketWatch (marketwatch.com) TikTok Chief Executive Shou Chew said the video-sharing platform is taking greater steps to keep user data secure and that it needs to invest more in protecting young people from getting exposed to harmful content. #### [Australian Parliament Passes Privacy Penalty Bill](https://infosecurity-magazine.com/news/australian-parliament-passes?ref=thenexusofprivacy.net) Alessandro Mascellino on Infosecurity Magazine (infosecurity-magazine.com) The higher penalties and extended powers will become effective after the bill receives royal assent. ALSO: [First patch to the privacy laws in Australia: increased penalties for global companies](https://jdsupra.com/legalnews/first-patch-to-the-privacy-laws-in-1428990?ref=thenexusofprivacy.net), Mandi Jacobson on JD Supra (jdsupra.com) #### [What Do the Multimillion-Dollar Google Settlement, Meta Fine Mean for Data Privacy?](https://informationweek.com/big-data/what-do-the-multimillion-dollar-google-settlement-meta-fine-mean-for-data-privacy-?ref=thenexusofprivacy.net) Carrie Pallardy on InformationWeek (informationweek.com) Google agreed to pay a significant amount in a settlement for violating consumer privacy laws. Could this settlement and Meta’s latest fine be the beginning of a new future for data privacy? #### [How the new privacy landscape presents opportunities for marketers](https://adage.com/article/data/how-new-privacy-landscape-presents-opportunities-marketers/2448516?ref=thenexusofprivacy.net) Ad Age Studio 30 on Ad Age (adage.com) Execs from Uber, Wavemaker and Meta discussed the challenges and opportunities of the new privacy landscape at The Female Quotient during Advertising Week. #### [Privacy watchdog opens investigation into Medibank breach](https://innovationaus.com/privacy-watchdog-opens-investigation-into-medibank-breach?ref=thenexusofprivacy.net) Justin Hendry on InnovationAus.com (innovationaus.com) Australia’s privacy watchdog has launched an investigation into the Medibank data breach that compromised the personal details of 9.7 million customers, on the same day the would-be hackers posted the full trove of data on the dark web. The Office of the Australian Information Commissioner (OAIC) an… #### [Got any shopping apps on your phone? Privacy analysts say you may be sharing too much information with those companies.](https://consumeraffairs.com/news/got-any-shopping-apps-on-your-phone-privacy-analysts-say-you-may-be-sharing-too-much-information-with-those-companies-120122.html?ref=thenexusofprivacy.net) Gary Guthrie on ConsumerAffairs (consumeraffairs.com) Now that we’re at the height of the holiday shopping season, researchers at privacy protection company Incogni thought it would be interesting to analyze t #### [Driver Telematics Programs Face Privacy Concerns, IRC Study Finds](https://finance.yahoo.com/news/driver-telematics-programs-face-privacy-160000069.html?ref=thenexusofprivacy.net) PR Newswire on Yahoo Finance (finance.yahoo.com) More U.S. drivers are open to opting into usage-based insurance (UBI) programs to save on their auto insurance premiums, yet more widespread acceptance of telematics programs and UBI remains elusive due to privacy concerns, according to a new study from the Insurance Research Council (IRC). --- Image credit: Originally by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net), licensed from [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) via [Picpedia](https://www.picpedia.org/chalkboard/p/privacy.html?ref=thenexusofprivacy.net) ### Privacy News: November 29 URL: https://thenexusofprivacy.net/privacy-news-november-29/ Last updated: 2022-11-29T21:24:02.000Z It's been a week since our last news roundup, so we've got a lot of links! But first, since it's Giving Tuesday, if you're considering donating, please keep these options in mind: - [Maya Morales](https://www.gofundme.com/f/peoples-privacy?ref=thenexusofprivacy.net) of WA People's Privacy is raising funds to support her local, state, and national grassroots organizing efforts. WA People's Privacy doesn't have official 501c status yet, but this people-focused grassroots organizing is a powerful complement to the work larger non-profits. [Organizing & Mobilizing: What we’ve been up to in 2022!](https://wapeoplesprivacy.org/organizing-mobilizing-what-weve-been-up-to-in-2022/?ref=thenexusofprivacy.net) gives an overview of what WA People's Privacy has done in its first year of existence. [Donate here](https://www.gofundme.com/f/peoples-privacy?ref=thenexusofprivacy.net). - [Media Justice](https://support.mediajustice.org/give/449667/?ref=thenexusofprivacy.net#!/donation/checkout) fights for freedom from oppression and the freedom to communicate, takes on big tech's sales of data to large organizations, expose racialized disinformation and its role in the criminalization and marginalization of Black, brown and poor communities and activists, battle oppressive technologies like e-carceration, a false solution to mass incarceration ... and so much more. [Donate here.](https://support.mediajustice.org/give/449667/?ref=thenexusofprivacy.net#!/donation/checkout) And now, on to the links! ### [SFPD authorized to kill suspects using robots in draft policy](http://missionlocal.org/2022/11/killer-robots-to-be-permitted-under-sfpd-draft-policy/?ref=thenexusofprivacy.net) Will Larsen, Mission Local (missionlocal.org) A [policy proposal](https://sfgov.legistar.com/View.ashx?M=F&ID=11449771&GUID=9FC57C5A-6E68-4485-A989-632C3837B909&ref=thenexusofprivacy.net) heading for Board of Supervisors approval next week would explicitly authorize the San Francisco Police Department (SFPD) to kill suspects using robots. What could possibly go wrong? > “We are living in a dystopian future, where we debate whether the police may use robots to execute citizens without a trial, jury, or judge,” said Tifanei Moyer, senior staff attorney at the [Lawyers’ Committee for Civil Rights of the San Francisco Bay Area](https://lccrsf.org/?ref=thenexusofprivacy.net). Moyer leads the organization’s work on police misconduct and militarization. ALSO: - [Red Alert: The SFPD want the power to kill with robots](https://eff.org/deeplinks/2022/11/red-alert-sfpd-want-power-kill-robots?ref=thenexusofprivacy.net), Matthew Guariglia on Electronic Frontier Foundation (eff.org) - [San Francisco considers allowing law enforcement robots to use lethal force](https://www.npr.org/2022/11/28/1139523832/san-francisco-considers-allowing-law-enforcement-robots-to-use-lethal-force?ref=thenexusofprivacy.net), Ari Shapiro and Brianna Scott, NPR's All Things Considered - [We Can Put A Man On The Moon, But We Can’t Make Killer Robot Police?](https://www.theonion.com/we-can-put-a-man-on-the-moon-but-we-cant-make-killer-r-1819583378?ref=thenexusofprivacy.net), The Onion (1997). Well, now we can ... progress, I guess. ### [Meta Fined $275 Million for Breaking E.U. Data Privacy Law](https://nytimes.com/2022/11/28/business/meta-fine-eu-privacy.html?ref=thenexusofprivacy.net) Adam Satariano on the New York Times (nytimes.com) The Irish Data Protection Commissioner imposed a €265 million fine on Meta-owned Facebook and Instagram over their data scraping practices and ordered a set of remedial actions. This brings European fines against Facebook’s parent company to more than $900 million since last year. It's still just a "cost of doing business" for Facebook so far, but a billion here and a billion there, pretty soon you're talking real money! ALSO: - [Meta hit with \~$275M GDPR penalty for Facebook data-scraping breach](https://techcrunch.com/2022/11/28/facebook-gdpr-penalty?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com) - [Meta fined €265m by Irish watchdog for data breach](https://rte.ie/news/business/2022/1128/1338739-meta-fined-265m-by-irish-data-watchdog?ref=thenexusofprivacy.net), Brian O’Donovan on RTÉ (rte.ie) - [Meta sanctioned with €265m over data scraping practices](https://euractiv.com/section/data-protection/news/meta-sanctioned-with-e265m-over-data-scraping-practices?ref=thenexusofprivacy.net), Luca Bertuzzi on EURACTIV (euractiv.com) - [Irish regulator fines Meta $275 million for violations of Europe’s data privacy law](https://cnn.com/2022/11/28/tech/meta-irish-fine-privacy-law?ref=thenexusofprivacy.net), Brian Fung on CNN (cnn.com) - [Meta Fined $277 Million for Leak of Half a Billion Users](https://yro.slashdot.org/story/22/11/28/1612248/meta-fined-277-million-for-leak-of-half-a-billion-users?ref=thenexusofprivacy.net), on Slashdot (yro.slashdot.org) - [Irish Data Protection Commission](https://dataprotection.ie/en/news-media/press-releases/data-protection-commission-announces-decision-in-facebook-data-scraping-inquiry?ref=thenexusofprivacy.net)'s press release ## Privacy after Roe ### [Sneaky ways cops could access data to widely prosecute abortions in the US](https://arstechnica.com/tech-policy/2022/11/sneaky-ways-cops-could-access-data-to-widely-prosecute-abortions-in-the-us?ref=thenexusofprivacy.net) Ashley Belanger on Ars Technica (arstechnica.com) Third-party data brokers give police warrantless access to 250 million devices. ### [‘Gap’ in App Store Rules Endanger Reproductive Data, Top Law Enforcement Chiefs Say](https://gizmodo.com/gap-in-iphone-privacy-endangers-reproductive-data-law-1849820906?ref=thenexusofprivacy.net) Dell Cameron on Gizmodo (gizmodo.com) Nine attorneys general (including Washington's AG Ferguson) have written to Apple CEO Tim Cook urging Apple to up its privacy game in the wake of Roe's demise. > The officials are asking Cook to implement new rules on app developers requiring the deletion of non-essential data, including the location and search histories of users “seeking, accessing, or helping to provide reproductive health care.” > > Additionally, the officials urged Apple to demand app makers certify they’d only disclose reproductive health data in response to a “valid subpoena, search warrant, or court order.” App makers should be required, the officials said, to provide “clear and conspicuous notices” to consumers whenever there’s a potential for such health data to be disclosed to third parties. ### [Top Prosecutors in CA, NY and DC Are Speaking Up For End-to-End Encryption](https://eff.org/deeplinks/2022/11/top-prosecutors-ca-ny-and-dc-are-speaking-end-end-encryption?ref=thenexusofprivacy.net) Joe Mullin on Electronic Frontier Foundation (eff.org) Several states are already enforcing abortion bans, and the Brennan Center for Justice has noted [more than 100 state bills that were introduced in 2022 to further limit abortion access](https://www.brennancenter.org/our-work/research-reports/60-days-after-dobbs-state-legal-developments-abortion?ref=thenexusofprivacy.net). At the same time, many states, including California and New York, have moved to protect or expand the right to abortion access, including for out-of-state persons. In this month’s elections, voters in California, Michigan, and Vermont [enshrined the right to abortion in their state constitutions](https://www.nytimes.com/2022/11/09/us/abortion-rights-ballot-proposals.html?ref=thenexusofprivacy.net). In recent months, we’ve been pleased to see statements from attorneys general in [New York](https://ag.ny.gov/press-release/2022/consumer-alert-attorney-general-james-provides-guidance-protect-digital-privacy?ref=thenexusofprivacy.net), [California](https://oag.ca.gov/news/press-releases/california-attorney-general-bonta-issues-consumer-alert-tips-protecting-your?ref=thenexusofprivacy.net), and [Washington D.C.](https://oag.dc.gov/release/consumer-alert-avoid-using-unencrypted-messaging?ref=thenexusofprivacy.net), all advising citizens to use end-to-end encrypted services when seeking abortion services. ## Federal privacy legislation ### [Rights groups: Kids’ online safety bill could put vulnerable teens at risk](https://cyberscoop.com/rights-online-safety-children?ref=thenexusofprivacy.net) Tonya Riley on CyberScoop (cyberscoop.com) The groups say KOSA has laudable goals but could come with unintended consequences for vulnerable children. I discussed the letter this in yesterday's [Will anything pass this session? Federal privacy legislation update](https://thenexusofprivacy.net/its-time-for-the-lame-duck-session-federal-privacy-legislation-update-november-28/) , but Riley has some good perspectives – including this: > “The LGBTQ+ community is actively under attack, and it’s unthinkable that Democrats are considering advancing a bill that will further harm us and disproportionately target queer and trans young people,” Evan Greer, director of Fight for the Future, said in a statement. “Congress needs to pass real laws that rein in the abuses of Big Tech and protect everyone’s privacy and human rights rather than using kids as pawns to advance poorly drafted legislation in order to score political points.” > > The letter [follows reports](https://www.axios.com/2022/11/16/kids-privacy-online-congress-yearend-push?ref=thenexusofprivacy.net) that members of the Senate are angling to fold KOSA into either the must-pass year-end spending or defense bill. Senate Commerce Committee Chair Sen. Maria Cantwell, D-Wash., as well as bill co-sponsors Sens. Marsha Blackburn, R-Tenn., and Richard Blumenthal, D-Conn., met earlier this month with parents whose children had died in incidents tied to social media, such as cyberbullying and the purchase of fentanyl-laced drugs, in a push to pass the bill. ### [EARN IT Act Will Make The Internet Worse For Everyone By Undermining Privacy And Security](https://techdirt.com/2022/11/23/earn-it-act-will-make-the-internet-worse-for-everyone-by-undermining-privacy-and-security?ref=thenexusofprivacy.net) Tim Cushing on Techdirt (techdirt.com) To save the children, we must destroy everything. That’s the reality of the EARN IT Act. > \[G\]iven the name, it seems like this would be Congress putting funding *towards* supporting moderation efforts that target abusive content. > > But it’s nothing like that. It’s all about punishing tech companies for the acts of their users. [Like FOSTA before it](https://www.techdirt.com/2022/02/04/how-earn-it-act-is-significantly-more-dangerous-than-fosta/?ref=thenexusofprivacy.net), the bill has zero interest in actually targeting the creators and distributors of illegal content, like child sexual abuse material (CSAM). Instead, it’s only interested in allowing prosecutors to [go after the easiest entities](https://www.techdirt.com/2020/07/06/new-earn-it-act-creates-insane-new-dilemma-either-encrypt-all-spy-all/?ref=thenexusofprivacy.net) to locate: sites that rely on or facilitate the distribution of third-party content. ALSO: - [Two Things the US Should Do to Protect the Internet and the Security of Billions of People Online](https://internetsociety.org/blog/2022/11/two-things-the-us-should-do-to-protect-the-internet-and-the-security-of-billions-of-people-online?ref=thenexusofprivacy.net), Natalie Campbell and John Morris on Internet Society (internetsociety.org) ### [What a Republican-controlled House could mean for Silicon Valley](https://cnn.com/2022/11/17/tech/silicon-valley-republicans-house?ref=thenexusofprivacy.net) Brian Fung on CNN (cnn.com) With Republicans projected to take control of the House as a result of the midterm elections, tech giants such as Amazon, Google and Meta, who’ve been in the crosshairs of Democrats in recent years, are soon set to face a very different — but no less hostile — political climate in Washington. ## State privacy legislation ### [The Future of State Privacy Legislation After the 2022 Election](https://bytebacklaw.com/2022/11/the-future-of-state-privacy-legislation-after-the-2022-election?ref=thenexusofprivacy.net) David Stauss on Byte Back (bytebacklaw.com) Stauss looks at the impact of the midterms on some key states. Unfortunately he doesn't discuss Washington, where [AG Ferguson, Rep. Slatter, Sen. Dhingra are proposing legislation to protect Washingtonians’ health data](https://www.atg.wa.gov/news/news-releases/ag-ferguson-rep-slatter-sen-dhingra-propose-legislation-protect-washingtonians?ref=thenexusofprivacy.net). Still, there's lots of good stuff in here. For example: > The changes in Michigan and Minnesota created Democrat trifectas with Democrat governors in control in both states. In fact, both of those states have Democrat quadfectas with Democrats retaining the state Attorney General positions in both states (see [here](https://www.freep.com/elections/results/race/2022-11-08-other-MI-24116/?ref=thenexusofprivacy.net) and [here](https://www.nbcnews.com/politics/2022-elections/minnesota-attorney-general-results?ref=thenexusofprivacy.net)). Attorney General support for a privacy bill can either significantly boost a bill’s chance of passage – as happened in Colorado and Connecticut – or create another roadblock – as has happened in Washington state. > > The Minnesota and Michigan quadfectas are notable because Democrat lawmakers in those states previously proposed privacy bills. In Minnesota, Representative Steve Elkins has long been a proponent of state privacy legislation although he did not run a bill last year. In Michigan, as [first reported](https://twitter.com/keir%5Flamont/status/1575107524042235905?ref=thenexusofprivacy.net) by Future of Privacy Forum’s Keir Lamont, Democrat Senator Rosemary Bates introduced [SB 1182](http://www.legislature.mi.gov/%28S%28ytou24fetpyczt42debn3ici%29%29/mileg.aspx?page=GetObject&objectname=2022-SB-1182&ref=thenexusofprivacy.net) – the Michigan Personal Data Privacy Act – in September 2022\. Democrat House members previously introduced [HB 5989](https://www.legislature.mi.gov/%28S%28cgllrmjkd00fafggg30myfo4%29%29/mileg.aspx?page=getobject&objectname=2022-HB-5989&query=on&ref=thenexusofprivacy.net) in April 2022. > > Massachusetts also now has a quadfecta with Maura Healey [flipping](https://nymag.com/intelligencer/2022/11/democrats-made-gains-in-the-states-too.html?ref=thenexusofprivacy.net) the governorship to Democrat and Democrat Andrea Campbell [replacing](https://www.masslive.com/politics/2022/11/2022-massachusetts-election-results-attorney-general-andrea-campbell-vs-jay-mcmahon.html?ref=thenexusofprivacy.net) Healey as Attorney General. Last year, the Massachusetts Joint Advanced Information Technology, the Internet and Cybersecurity Committee [voted](https://www.bytebacklaw.com/2022/02/proposed-state-privacy-law-update-feb-7-2022/?ref=thenexusofprivacy.net) a privacy bill out of committee although the bill never advanced beyond that point. #### [The Utah Consumer Privacy Act (UCPA) is Here ](https://trustarc.com/blog/2022/04/07/utah-consumer-privacy-act-ucpa?ref=thenexusofprivacy.net) K Royal, JD, PhD on TrustArc Privacy Blog (trustarc.com) Utah became the 4th State to pass a consumer data privacy law on March 24, 2022\. What effects will the Utah Consumer Privacy Act (UCPA) have on organizations? ## Mastodon #### [Mastodon’s Privacy: Who actually holds your data in Mastodon](https://privado.ai/post/who-actually-holds-your-data-in-mastodon-a-privacy-review?ref=thenexusofprivacy.net) Prashant MahajanNovember 28, 2022 on Privado (privado.ai) Good info, but given recent vulnerabilities – including [one that exposed all of the DMs on the server hosting Privado's Mastodon account](https://portswigger.net/daily-swig/mastodon-vulnerable-to-multiple-system-configuration-problems?ref=thenexusofprivacy.net) – take their recommendation that "we believe that the Mastodon application is safe to use" with a grain of salt. #### [What Twitter Users Need To Know About Mastodon Privacy](https://forbes.com/sites/daveywinder/2022/11/27/what-twitter-users-need-to-know-about-mastodon-privacy?ref=thenexusofprivacy.net) Davey Winder on Forbes (forbes.com) If privacy is a primary concern, what do you need to know before signing up with Mastodon? For one thing: > "I've said it before, and I'll keep on saying it until people start listening; if you want or need direct message privacy, then use a service that exists to provide it." ## And ... #### [The case for collective action against the harms of data-driven technologies](https://adalovelaceinstitute.org/blog/collective-action-harms?ref=thenexusofprivacy.net) Jef Ausloos on Ada Lovelace Institute (adalovelaceinstitute.org) To what extent are the GDPR’s data rights an effective tool for enabling collective action? #### [Tax filing websites have been sending users’ financial information to Facebook](https://theverge.com/2022/11/22/23471842/facebook-hr-block-taxact-taxslayer-info-sharing?ref=thenexusofprivacy.net) Colin Lecher, Angie Waller, and Simon Fondrie-Teitler on The Verge (theverge.com) The Markup found that tax preparation services including TaxAct, TaxSlayer, and H&R Block have sent users’ personal financial information to Facebook through the Meta Pixel. #### [Content governance declaration in times of crisis](https://accessnow.org/new-content-governance-in-crises-declaration?ref=thenexusofprivacy.net) Marwa Fatafta on Access Now (accessnow.org) This new content governance declaration lays out principles for social media platforms to help ensure human rights in crises. #### [Enigma 2023 Conference Program](https://usenix.org/conference/enigma2023/program?ref=thenexusofprivacy.net) on USENIX (usenix.org) Enigma 2023 will take place January 24–26, 2023, at the Hyatt Regency Santa Clara in Santa Clara, CA, USA. Enigma centers on a single track of engaging talks covering a wide range of topics in security and privacy. to clearly explain emerging threats and defenses in the growing intersect… #### [Facial recognition technology ‘inappropriate for policing,’ say privacy rights advocates](https://irishtimes.com/crime-law/2022/11/28/facial-recognition-technology-inappropriate-for-policing-say-privacy-rights-advocates?ref=thenexusofprivacy.net) Simon Carswell on The Irish Times (irishtimes.com) Irish Council for Civil Liberties and academics raise concerns about plans for law to enable technology that is banned for policing in other countries #### [The Exploited Labor Behind Artificial Intelligence](https://noemamag.com/the-exploited-labor-behind-artificial-intelligence?ref=thenexusofprivacy.net) Adrienne Williams on NOEMA (noemamag.com) Supporting transnational worker organizing should be at the center of the fight for “ethical AI.” #### [Privacy Act reforms](https://salingerprivacy.com.au/privacy-reforms?ref=thenexusofprivacy.net) Salinger Privacy on salingerprivacy.com.au The Privacy Act is under review, with significant proposals for reform being considered by the Australian Government. The first tranches of reforms are imminent, while others are likely to land in 2023\. Salinger Privacy know-how will guide you through. #### [FCC bans import, sale of certain Chinese tech over ‘unacceptable risk to national security’](https://thehill.com/policy/technology/3750969-fcc-bans-import-sales-of-certain-chinese-tech-over-unacceptable-risk-to-national-security?ref=thenexusofprivacy.net) Adam Barnes on The Hill (thehill.com) The Federal Communications Commission (FCC) has banned the import and sale of certain Chinese technology equipment that it determined poses “an unacceptable risk to national security.” FCC Co… #### [Microsoft 365 faces darkening GDPR compliance clouds after German report](https://techcrunch.com/2022/11/28/microsoft-365-faces-darkening-gdpr-compliance-clouds-after-german-report?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) Legal trouble may be brewing for Microsoft in the European Union where an assessment by a working group of German data protection regulators that’s spent around two years looking into a swathe of privacy concerns attached to its cloud-based 365 productivity products — including by engaging directly… #### [A Leak Details Apple’s Secret Dirt on a Trusted Security Startup](https://wired.com/story/corellium-nso-group-darkmatter-apple-lawsuit?ref=thenexusofprivacy.net) Lorenzo Franceschi-Bicchierai on WIRED (wired.com) A 500-page document reviewed by WIRED shows that Corellium engaged with several controversial companies, including spyware maker NSO Group. #### [3 ways the data privacy wars could pan out – and how marketers can navigate each scenario](https://thedrum.com/opinion/2022/11/23/3-ways-the-data-privacy-wars-could-pan-out-and-how-marketers-can-navigate-each?ref=thenexusofprivacy.net) Andrew Frank on The Drum (thedrum.com) Gartner’s Andrew Frank spells out three potential outcomes of the rising tensions between the data brokering economy and demands for consumer privacy – and how the marketing and advertising industry can navigate each possibility. #### [Consumer privacy predictions—how marketers will be affected in 2023](https://adage.com/article/opinion/consumer-privacy-predictions-how-marketers-will-be-affected-2023/2454106?ref=thenexusofprivacy.net) Abhay Singhal on Ad Age (adage.com) Will Apple’s privacy moves help it join the triopoly? #### [The secret bias hidden in mortgage-approval algorithms](https://apnews.com/article/lifestyle-technology-business-race-and-ethnicity-racial-injustice-b920d945a6a13db1e1aee44d91475205?ref=thenexusofprivacy.net) EMMANUEL MARTINEZ and LAUREN KIRCHNER/The Markup on Associated Press (apnews.com) The new four-bedroom house in Charlotte, North Carolina, was Crystal Marie and Eskias McDaniels’ personal American dream, the reason they had moved to this Southern town from pricey Los Angeles a few years ago. #### [Watchdog: NHS data platform could damage patients’ trust](https://theregister.com/2022/11/22/nhs%5Fdata%5Fplatform%5Fndg?ref=thenexusofprivacy.net) Lindsay Clark on The Register (theregister.com) ‘This store of confidential data is a national treasure that must never be compromised or treated carelessly’ #### [UK Online Safety bill could compromise encryption, privacy experts warn](https://csoonline.com/article/3681093/uk-online-safety-bill-could-compromise-encryption-privacy-experts-warn.html?ref=thenexusofprivacy.net) Charlotte Trueman on CSO Online (csoonline.com) As the controversial legislation makes its way back to Parliament next month, privacy and cybersecurity experts warn that the bill will make UK businesses more susceptible to cyberattacks and intellectual property theft. #### [Privacy & Cybersecurity for Your Life During the Holidays](https://voiceamerica.com/episode/140442?ref=thenexusofprivacy.net) on The VoiceAmerica Talk (voiceamerica.com) Are you armed with the privacy and security knowledge and awareness necessary to identify all the holiday scams and cybercrooks that emerge and try not only new scams and crimes, but also all the same scams and crimes that have proven to be effective year after year for decades? Are you prepared to… #### [Common Sense Media Says School VR Tools Violate Privacy Laws](https://govtech.com/education/k-12/common-sense-media-says-school-vr-tools-violate-privacy-laws?ref=thenexusofprivacy.net) Alyson Klein, Education Week, Bethesda, Md. on GovTech (govtech.com) According to a recent analysis by the research and advocacy organization Common Sense Media, the seven most popular VR devices in schools collect so much user data that they present serious privacy concerns. #### [The Chinese government’s problematic quest to judge online comments](https://technologyreview.com/2022/11/23/1063640/chinese-governments-problematic-judge-online-comments?ref=thenexusofprivacy.net) Zeyi Yang on MIT Technology Review (technologyreview.com) The Chinese social credit system doesn’t have an all-knowing algorithm—but it still has significant implications, particularly on free speech. #### [MetaMask will start collecting user IP addresses](https://cointelegraph.com/news/metamask-will-start-collecting-user-ip-addresses?ref=thenexusofprivacy.net) Zhiyuan Sun on Cointelegraph (cointelegraph.com) Many Web 3.0 firms have began collecting users’ IPs due to tougher regulations. #### [Surveillance powers in UK’s Online Safety Bill are risk to E2EE, warns legal expert](https://techcrunch.com/2022/11/24/uk-online-safety-bill-css-e2ee?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) Independent legal analysis of a controversial UK government proposal to regulate online speech under a safety-focused framework warns the bill poses a risk to the integrity of end-to-end encryption. #### [Ofcom ‘will get more power than spies’ to monitor apps](https://thetimes.co.uk/article/ofcom-will-get-more-power-than-spies-to-monitor-apps-f6z2zmf95?ref=thenexusofprivacy.net) Mark Sellman, Technology Correspondent on The Times (thetimes.co.uk) The media regulator will have greater surveillance powers than spy agencies under laws being considered by parliament, a legal analysis has claimed.Ofcom is be #### [RCMP use of spyware warrants update to Canada’s privacy laws, MPs say](https://politico.com/news/2022/11/24/rcmp-spyware-canada-privacy-laws-00070820?ref=thenexusofprivacy.net) Maura Forrest on POLITICO (politico.com) The federal ethics committee says Ottawa should make a list of banned spyware vendors and set export controls. #### [Documents Show DOJ’s Multi-Pronged Effort to Undermine Section 230](https://eff.org/deeplinks/2022/11/documents-show-dojs-multi-pronged-effort-undermine-section-230?ref=thenexusofprivacy.net) Aaron Mackey on Electronic Frontier Foundation (eff.org) In the summer of 2020, the Department of Justice was closely monitoring the public and congressional debate about a key law protecting internet users’ speech at the same time that it pushed to undermine the law, documents show. DOJ was tracking multiple efforts to repeal or frustrate 47 U.S.C. §... #### [Be like Gmail? Proton Mail will soon offer email categorization, message scheduling, and more](https://techcrunch.com/2022/11/25/proton-mail-will-soon-be-more-like-gmail-with-email-categorization-message-scheduling-and-more?ref=thenexusofprivacy.net) Paul Sawers on TechCrunch (techcrunch.com) Proton has teased a fairly substantial roadmap of features for its flagship Proton Mail and calendar services. #### [Leaked EU Anti-Money Laundering Regulations Indicate Bloc Plans to Ban Privacy Coins](https://cpomagazine.com/data-privacy/leaked-eu-anti-money-laundering-regulations-indicate-bloc-plans-to-ban-privacy-coins?ref=thenexusofprivacy.net) Scott Ikeda on CPO Magazine (cpomagazine.com) New EU anti-money laundering regulations currently under discussion would include a ban on privacy coins such as Dash, Monero and Zcash that add further layers of anonymity to the standard blockchain transaction. #### [BYU, U. researchers say medical health privacy forms can lead to more lies, misdiagnoses](https://ksl.com/article/50524984/byu-u-researchers-say-medical-health-privacy-forms-can-lead-to-more-lies-misdiagnoses?ref=thenexusofprivacy.net) Emily Ashcraft, KSL.com on ksl.com (ksl.com) A recent study done by researchers at Brigham Young University and the University of Utah shows when patients are given a HIPAA form before filling out the health survey, they tend to lie more on the survey — causing a higher likelihood of misdiagnoses. #### [Microsoft erfüllt und übertrifft europäische Datenschutzgesetze](https://news.microsoft.com/de-de/microsoft-erfuellt-und-uebertrifft-europaeische-datenschutzgesetze?ref=thenexusofprivacy.net) on News Center Microsoft Deutschland (news.microsoft.com) Heute haben die unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (DSK) Bedenken zu der Vereinbarkeit von Microsoft 365 (M365) mit den Datenschutzgesetzen in Deutschland und der EU geäußert. #### [Apple Tracks You More Than You Think](https://wired.com/story/apple-iphone-privacy-analytics-security-roundup?ref=thenexusofprivacy.net) Matt Burgess on WIRED (wired.com) #### [UK bans Chinese cameras from government buildings](https://politico.eu/article/uk-bans-chinese-cameras-from-government-buildings?ref=thenexusofprivacy.net) Shannon Van Sant on POLITICO (politico.eu) Remove and replace without waiting for upgrades, British government advises. #### [Tax prep software sent back personal consumer data to Meta and Google, report says](https://cnbc.com/2022/11/22/popular-tax-prep-software-sent-financial-information-to-meta-report.html?%5F%5Fsource=sharebar%7Ctwitter&ref=thenexusofprivacy.net) Lauren Feiner on CNBC (cnbc.com) Sending such information violates Meta’s policies and a spokesperson said its system is designed to filter out potentially sensitive data. #### [EU gets serious on privacy, but too many companies ignore the risk](https://venturebeat.com/security/eu-gets-serious-on-privacy-but-too-many-companies-ignore-the-risk?ref=thenexusofprivacy.net) Seth Batey, Fivetran on VentureBeat (venturebeat.com) To reduce impacts of breaches and fines, orgs must focus on privacy as well as security, and ensure employees know the difference. #### [Deep Dive: The United Kingdom’s Online Safety Bill](https://medium.com/wikimedia-policy/deep-dive-the-united-kingdoms-online-safety-bill-b7020723dd39?ref=thenexusofprivacy.net) Wikimedia Policy on Wikimedia Policy (medium.com) Without Further Revision, Bill Will Harm Wikipedia and Other Open Knowledge Projects #### [The AI Bill of Rights makes uneven progress on algorithmic protections](https://brookings.edu/2022/11/21/the-ai-bill-of-rights-makes-uneven-progress-on-algorithmic-protections?ref=thenexusofprivacy.net) Alex Engler on Brookings (brookings.edu) AI regulation is perpetually going to be a key issue into the future, and the White House should give it the same attention and dedication it has directed toward AI research and AI commerce, argues Alex Engler. #### [Govt, NIRA under fire over ‘data breaches’](https://monitor.co.ug/uganda/news/national/govt-nira-under-fire-over-data-breaches--4034576?ref=thenexusofprivacy.net) Arthur Arnold Wadero on Monitor (monitor.co.ug) Experts warn that the absence of either a recovery or backup centre for the country’s data on National ID cards, could cost the country dear #### [Privacy Isn’t Just an Edge Case for Crypto](https://coindesk.com/layer2/2022/11/28/privacy-isnt-just-an-edge-case-for-crypto?ref=thenexusofprivacy.net) Leah Callon-Butler on CoinDesk (coindesk.com) Financial privacy is useful for dissidents in extreme situations. But nobody should have to justify keeping their personal lives private, says our columnist. #### [Usercentrics Study: 90% of All Apps Do Not Comply With the GDPR](https://yahoo.com/now/usercentrics-study-90-apps-not-071000586.html?ref=thenexusofprivacy.net) Business Wire on Yahoo (yahoo.com) MUNICH, November 15, 2022--Nine out of ten apps collect personal data from users without their consent, a clear violation of the European Union’s General Data Protection Regulation (GDPR) and the ePrivacy Directive. This is the result of an analysis of 250 apps in the EU apps market, conducted by pr… #### [The Best Privacy-Focused Browsers You’ve Never Heard Of](https://lifehacker.com/the-best-privacy-focused-browsers-you-ve-never-heard-of-1849823243?ref=thenexusofprivacy.net) The A.V. Club on Lifehacker (lifehacker.com) Reduce tracking and improve your privacy with these lesser-known browsers. #### [Census Bureau chief defends ‘differential privacy’ tool](https://federaltimes.com/home/2022/11/28/census-bureau-chief-defends-differential-privacy-tool?ref=thenexusofprivacy.net) Mike Schneider, The Associated Press on Federal Times (federaltimes.com) Differential privacy algorithms add intentional errors to data to obscure the identity of any given participant. #### [A Look Ahead: Lisa Sotto’s Privacy, Security Outlook in 2023](https://bankinfosecurity.com/look-ahead-lisa-sottos-privacy-security-outlook-in-2023-a-20534?ref=thenexusofprivacy.net) Michael Novinson on bankinfosecurity.com A multitude of state privacy laws taking effect in 2023 has forced organizations to revamp their compliance programs to incorporate the disparate requirements #### [Trucking groups cite privacy concerns over electronic ID proposal](https://landline.media/trucking-groups-cite-privacy-concerns-over-electronic-id-proposal?ref=thenexusofprivacy.net) Mark Schremmer on Land Line (landline.media) Privacy concerns were common among the more than 2,000 comments about a proposal to require electronic IDs on commercial motor vehicles. --- Image Credit: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) licensed under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) from [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [*Picpedia*](https://www.picpedia.org/highway-signs/p/privacy.html?ref=thenexusofprivacy.net). ### Will anything pass this session? Federal privacy legislation update, November 28 URL: https://thenexusofprivacy.net/its-time-for-the-lame-duck-session-federal-privacy-legislation-update-november-28/ Last updated: 2026-04-16T02:55:12.000Z > Over 90 organizations have signed on to [a letter led by the Center for Democracy & Technology (CDT), Electronic Frontier Foundation (EFF), and Fight for the Future opposing the Kids Online Safety Act](https://cdt.org/insights/coalition-letter-on-privacy-and-free-expression-threats-in-kids-online-safety-act/?ref=thenexusofprivacy.net) (KOSA). Signers include local and national LGBTQ and human rights organizations including the ACLU, American Library Association, Equality Texas, Equality California, Equality Virginia, Equality Utah, GLAAD, GLSEN, National Center for Lesbian Rights, Human Trafficking Prevention Project, Internet Society, Ranking Digital Rights, the Tor Project, TransOhio, Georgia Equality, Wikimedia Foundation, New America’s Open Technology Institute, and National Health Care for the Homeless Council. > > The letter explains how KOSA would harm LGBTQ+ youth especially, and could be weaponized by Attorneys General to censor online resources and information for queer and trans youth, people seeking reproductive healthcare, and more: > > – [More Than 90 Human Rights and LGBTQ Groups Sign Letter Opposing KOSA](https://cdt.org/press/more-than-90-human-rights-and-lgbtq-groups-sign-letter-opposing-kosa/?ref=thenexusofprivacy.net), CDT The [117th US Congressional session](https://en.wikipedia.org/wiki/117th%5FUnited%5FStates%5FCongress?ref=thenexusofprivacy.net) is close to wrapping up, with just a few more weeks of legislating time before the winter holiday recess. The big focus will be on two pieces of "must-pass" legislation: the omnibus spending bill and the NDAA (National Defense Authorization Act). The Senate also has a lot of judges to confirm, as well as confirm key Biden nominees like [Gigi Sohn](https://www.washingtonpost.com/politics/2022/10/14/hundreds-allies-rally-gigi-sohns-fcc-confirmation/?ref=thenexusofprivacy.net) (whose appointment has been stymied by Republicans and centrist Democrats, leaving the FCC deadlocked 2-2). So there's not a lot of time for other legislation. Still, supporters of several privacy bills are saying they still have a chance to pass this session – either as standalone bills, by going through the usual committee and floor vote process, or attached to one of the "must-pass" bills as amendment. Of course, supporters kind of have to say that, no matter what the bill's prospects, so it's hard to know what if anything to read into it. So take it with a grain of salt – most people I talk to think it's not likely that any significant privacy bill will pass this session – but there are at least five bills potentially in play: - The Fourth Amendment Is Not For Sale Act has broad support from legislators in both parties as well as privacy, civil rights, civil liberties, consumer, and media justice groups. By preventing law enforcement and intelligence agencies from buying data without a warrent from data brokers and tech companies, it closes a huge loophole that lets commericial surveillance companies profit from helping the goverment do an end run around the Constitution. The votes are almost certainly there for the Fourth Amendment Is Not For Sale Act but Democratic leadership hsan't prioritized it. - The [Kids Online Safety Act (KOSA) lets the government control what children see online](https://www.eff.org/deeplinks/2022/11/kosa-would-let-government-control-what-young-people-see-online?ref=thenexusofprivacy.net), and would be especially harmful for LGBTAIQ2S+ youth. There's no question that big tech harms and exploits kids and teens, and many of KOSA's supporters are well-intentioned, but the bill itself would be disastrously bad. That said, the bill has bipartisan support and the "think of the children!" argument can be hard to counter. So KOSA may have a better chance than some of the other bills. - The American Data Privacy Protection Act (ADPPA), a broad consumer privacy bill, has been stuck since 2019 over the issue of whether or not to preempt current and future privacy laws in California (and other states, but California has 50 House votes, and Speaker Pelosi is from California, so that's been the major focus). As I discussed in two weeks ago in [The elephant and the lame duck](https://thenexusofprivacy.net/the-elephant-and-the-lame-duck/), even if the preemption issues were somehow magically resolved, there are other important problems including the elephant ADPPA supporters don't want to talk about: ADPPA doesn't protect people seeking abortions or reproductive health care providers. But ADPPA has a lot of support, from big tech as well as from some national privacy and civil rights groups. Here in Washington state, big tech shenanigans to try to sneak privacy bills are something of a tradition – in 2021 for example the Bad Washington Privacy Act's prime sponsor tried to hold funding for eviction protection hostage as part of last-minute negotations – so even though ADPPA seems like along shot at this point we'll see what happens. - Senate Commerce Committee Chair Maria Cantwell has said she's going to give push for the Children and Teens Online Privacy Protection Act (CTOPPA, also known as COPPA) in the lame duck, and the opposition to it has been less vocal than KOSA. That said, it's a much bigger bill than KOSA from a privacy perspective, and big tech is likely to resist it fiercely, so it almost certain has less of a chance thank KOSA - The Informing Consumers about Smart Devices Act passed the House back in June, and [Senators Ted Cruz and Maria Cantwell recently introduced it in the Senat](https://www.cruz.senate.gov/newsroom/press-releases/sens-cruz-cantwell-co-author-consumer-protection-bill-on-recording-smart-devices?ref=thenexusofprivacy.net)e. This is a narrowly-focused bill would require the FTC to create reasonable disclosure guidelines for products that have audio or visual recording components that are not clearly obvious – including refrigerators, washers, dryers and dishwashers. There's not likely to be any significant opposition to this bill, and if Congress wants to say they've done *something* about privacy, this would be the path of least resistance. Like I say, most people I talk to think nothing significant is likely to pass. The Informing Consumers about Smart Devices Act is a bit of a wild card but it's also a bit of a whatever – disclosure is good, but by itself it doesn't do much to protect privacy. Anything bigger ... well it's not impossible, but there's so much else going on that it's likely to be very challenging even in the best of circumstances. Then again, you never know. As we say in here in Washington state, it ain't over till it's over. ### Mastodon: a partial history (DRAFT) URL: https://thenexusofprivacy.net/mastodon-a-partial-history/ Last updated: 2026-04-16T02:54:48.000Z *Originally written November 2022, minor updates sporadically since then but it currently ends with the view from 2022\. See the* [*update log*](#update-log) *below for details.* ## Table of contents - [Introduction](#introduction) - [Before Mastodon: GNU social and other early fediverses](#pre-history) – [The Federation, bridging multiple protocols, and the end of StatusNet's early dominance](#multuiple-protocols) – [The Gnu social fediverse of 2016](#gnu-social-2016) - [2016](#multuiple-protocols) – [Mastodon goes live](#mastodon-goes-live) – [Flamewars, per-post privacy, and ROT13](#flamewars-per-post-privacy-and-rot-13) - [2017](#2017) – [Rapid queer-led community innovation](#rapid-queer-led-community-innovation) – [Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy](#dogpiling-weaponized-content-warning-discourse-and-a-fig-leaf-for-mundane-white-supremacy) – [The breakthrough month](#the-breakthrough-month) – [The Battle of the Welcome Modal](#the-battle-of-the-welcome-modal) – [A breaking point for the queer community](#a-breaking-point-for-the-queer-community) – [The aftermath](#the-aftermath) – [ActivityPub](#activitypub) - [2018-2021](#2018-2021) – [The patterns continue ...](#the-patterns-continue) – [Accessibility](#accessibility) – [PlayVicious](#playvicioussocial) – [Gab](#gab) – [Does Mastodon really prioritize stopping harassment?](#does-mastodon-really-prioritize-stopping-harassment) - [The view from 2022](#the-view-from-2022) ### Follow-on posts, not yet integrated here - [Mastodon, two years later](https://thenexusofprivacy.net/mastodon-two-years-later/) - [A tale of two prototypes](https://thenexusofprivacy.net/a-tale-of-two-prototypes-2/), including a deep dive on [Mastodon 2017 and Glitch 2017](https://thenexusofprivacy.net/p/279f20a3-be31-436a-810d-bb25166957ad/#2017) - [A faux “Eternal September” turns into flatness](https://thenexusofprivacy.net/flatness/) *Terminology notes:* - *The recently-released Mastodon v4.0 changed the name of "toots" to "posts."* - *"Instances", "servers", and "sites" are synonyms.* ## Introduction > "Mastodon is a free and open-source server software designed for communicating with and participating in the large, nebulous social-media network colloquially known as “the fediverse”; in very recent times, it has found itself the subject of a surprising level of journalism, hailed frequently as the (enlightened, doomed, sometimes both) successor to Twitter and its ilk." > > – Allie Hart, [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=thenexusofprivacy.net), April 2017 > "Something remarkable is happening. For the past two weeks, [people have been leaving Twitter. Many others are ](https://www.npr.org/2022/11/10/1135243276/mastodon-twitter-elon-musk?ref=thenexusofprivacy.net)reducing their reliance on it. Great numbers of ex-Twitter users and employees are making a new home in the “fediverse,” fleeing the [chaos](https://twitter.com/christapeterso/status/1592317592966168576?ref=thenexusofprivacy.net) of Elon Musk’s takeover. This exodus includes prominent figures from civil society, tech law and policy, business and journalism. It also represents a rare opportunity to make a better corner of the internet…if we don’t screw it up." > > – Cindy Cohn and Rory Mir of EFF in [The Fediverse Could Be Awesome (If We Don’t Screw It Up)](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=thenexusofprivacy.net), November 2022 I'm flashing!!!! Five and a half years later, there's once again a flock of new arrivals to Mastodon – and a huge amount of media attention. Unsurprisingly, most of the newcomers don't know a lot about Mastodon's history. Neither do most of the journalists covering it. Which is unfortunate. Articles like Will Knight's [The Man Behind Mastodon Built It for This Moment](https://www.wired.com/story/the-man-behind-mastodon-eugen-rochko-built-it-for-this-moment/?ref=thenexusofprivacy.net) in *WIRED* focus primarily on Mastodon founder and BDFL (Benevolent Dictator For Life) Eugen Rochko and presents a very simplified view of history: > "Mastodon grew slowly after the first code was released in 2017, appealing mostly to free software enthusiasts" That's true, but it leaves out some crucial aspects. For example: > "So the first thing that I want to make clear is that Mastodon has a history of being inhospitable to marginalized users." > > – Dr. Johnathan Flowers, [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) And as these past patterns repeating themselves today, and the romanticized view of Mastodon as being a "nicer" place than Twitter gives people an excuse to dismiss them as an aberration, allege that this bad behavior is just coming from newcomers who don't yet know the norms, or make unrealistic assumptions. > "You know, the thing that gets my attention concerning how safety concerns have become a sticking point as more and more people join the fedi is how white people are defiantly defending what is rather than envisioning what could be." > > – [Are0h on Mastodon](https://indieweb.social/@Are0h@ubiqueros.com/109408542850716741?ref=thenexusofprivacy.net) Few if any of the journalists encouraging people to check out Mastodon mention the safety issues, or let their readers know that Mastodon lacks basic anti-harassment functionality that's available on Twitter'(like controlling who can reply to your posts), let alone anything like [Block Party](https://www.blockpartyapp.com/?ref=thenexusofprivacy.net). Maybe they don't realize it, just as most Mastodon users don't know that [valuable anti-harassment functionality](https://github.com/hometown-fork/hometown/wiki/Local-only-posting?ref=thenexusofprivacy.net) isn't available in Mastodon mainline code, even it's been in forks (variants of the code base) for years. What's up with that? Are0h continues: > "The refusal to see outside of what they see is best is one of the most defining characteristics of white people in the fedi and one of the main obstacles to progress, as we are clearly seeing the need for an improved fedi experience across the board." Indeed. So one good reason to look at Mastodon's real history is to do better going forward – a topic I'll return to at the end of this post in [The view from 2022](#the-view-from-2022). Another good reason is that Mastodon's early history is an amazing case study of community-led innovation – and in particular, innovation led by a very queer community. As Flowers warns, it's important not to use this history to avoid critiquing the whiteness of Mastodon or other power inequities. Two things are true simultaneously: - Marginalized queer, trans, and non-binary people drove a lot of Mastodon's key fucntionality, including content warnings, instance blocking, and local-only posts - Mastodon has a long history of being inhospitable to marginalized users, including Black and Indigenous people and other people of color – as well as queer, trans and non-binary people, including many how who contributed to its success Still, it's a great example of the community-led practices Sasha Costanza-Chock discusses in [Design Justice](https://direct.mit.edu/books/book/4605/Design-JusticeCommunity-Led-Practices-to-Build-the?ref=thenexusofprivacy.net). And the way key functionality designed by and for marginalized users haas turned out to be useful for *everybody* is an illustration of the advantage of centering the most impacted populations, a point Afsenah Rigot so powerfully makes in [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=thenexusofprivacy.net): > "Their experiential knowledge of how tech products can be improved to keep their communities safer, though, contains key insights for building better tools for everyone. After all, when your most at-risk and disenfranchised are covered by your product, we are all covered." Much of this work – all done by volunteers – encountered fierce resistance, and virtually none of it has been properly credited. So Mastodon's history is also an excellent example of the point Costanza-Chock makes in [Design, power, and justice](https://news.mit.edu/2020/design-justice-book-0304?ref=thenexusofprivacy.net): > "\[P\]eople are often marginalized from the stories we hear about the creation of new tools. Social movements are often hotbeds of innovation, but their contributions aren't always recognized.” So here's an attempt to provide a history of Mastodon's early days that doesn't whitewash the past – and acknowledges some of the erased contributors. Like any history, this is partial. It focuses primarily on the very early days, up through June 2017, although also has some more recent highlights; and it only discusses English-language Mastodon. And a large percentage of the voices here (including mine) are white. Journalists rarely quoted Mastodonians of color, and Mastodon's norms discourage from linking to posts that weren't written to be shared off-Mastodon (unless you get permission, as I have for the ones I've included here). This creates an inaccurate impression, because despite all the marginalization and abuse directed their way, people of color have played a big role in Mastodon all along. If there are linkable references that I haven't included, please let me know and I'll add them. ## A quick note on terminology > *Added in October 2024.* People (including me at the time I wrote the first draft of this partial history) often talk about "the fediverse" like there's only one. These days, though, I think of it differently: - **a fediverse** (a portmanteau of "federation" and "universe") is a decentralized social network of federated (i.e. interconnected) servers, and the people and organizations with accounts on them, that communicate through one or more protocols, bridges, and hubs.3 Participants in a fediverse can be social networks (either centralized or decentralized) in their own right; participants can also be part of multiple fediverses. - **"the Fediverse"** (often written without quotes or the capital letter: the fediverse) is a fediverse whose boundaries, culture, software, protocols, and over time and means different things to different people but typically include a network organization based on **instances**, a specific kind of server [There are many fediverses](https://thenexusofprivacy.net/bluesky-atmosphere-fediverse/#there-are-many-fediverses) and [Definitions of "the Fediverse"](https://nexusofprivacy.net/is-bluesky-part-of-todays-fediverse/?ref=privacy.thenexus.today#defining-the-fediverse) go into a lot more detail. From 2018-2023, most people used "the Fediverse" to refer to a fediverse where most software platforms mostly used the ActivityPub protocol, and that's how I'm mostly using it here. In 2024, the tech press is increasingly including Bluesky and Nostr (which run different protocols) in the Fediverse, so we'll see how things evolve. ## Before Mastodon: GNU Social and other early fediverses ![three rows of white guys, with a white woman and a couple of guys who aren't white mixed in, mostly in t-shirts or polo shirts.](https://thenexusofprivacy.net/content/images/2024/10/fswsummit.jpg) Attendees at the invitation-only 2010 Federated Social Web summit. Image credit: James Walker, via [Flickr](https://www.flickr.com/photos/walkah/4831708666/in/album-72157624587812344?ref=thenexusofprivacy.net), CC-BY-20 As [The DDFON, Open Social Web, Fediverse, Mycelial Web SNS Historical Timeline](https://codeberg.org/ddfon/federated-sns/src/branch/main/mycelial-web-history.markdown?ref=thenexusofprivacy.net) higlights, federated social media isn't new: XMPP's predecessor Jabber started back in the 1990s. [Evan Prodroumou's 2008 post on identi.ca](https://web.archive.org/web/20080618164355/http://identi.ca/notice/1) is frequently cited as the first post on "the Fediverse" – although the term "fediverse" wasn't actually used to refer to decentralized social networks until 2011 or so. identi.ca originally used the [Open Micro Blogging](https://web.archive.org/web/20080912062848/http://openmicroblogging.org/) protocol. In [A Brief History of the GNU Social Fediverse and ‘The Federation'](https://socialhub.activitypub.rocks/t/fediverse-history-piece-from-2017-a-brief-history-of-the-gnu-social-fediverse-and-the-federation/?ref=thenexusofprivacy.net) (2017/24) Danyl Strype (Strypey) describes Open Micro Blogging as "a mash-up of existing protocols including OAuth, OAuth Discovery, YADIS, and XMPP". Prodromou's StatusNet [raised $875,000 in seed funding](https://techcrunch.com/2009/10/27/statusnet-of-identi-ca-fame-raises-875000-to-become-the-wordpress-of-microblogging/?guccounter=1&ref=thenexusofprivacy.net) in 2009 with a goal of becoming "the Wordpress of Microblogging", At the time, TechCrunch reported there were about 200,000 to 300,000 active users on about 2,000 public sites, with identi.ca the largest at about 80,000 active users. In [What is GNU Social and is Mastodon Social a “Twitter Clone”?](https://robekworld.com/what-is-gnu-social-and-is-mastodon-social-a-twitter-clone-1b12a98c37ec?ref=thenexusofprivacy.net) (April 2017) robek 'rw' April 2017 notes that > "StatusNet the company made it easy to set up your own addnamehere.status.net node, free of charge for single-user nodes, and also provided several nodes with names like 240.status.net, unlimited.status.net etc, to experiment with different message size limits. Evan really tried to get people to grok federation and get off the “flagship node”. But [identi.ca](https://identi.ca/?ref=thenexusofprivacy.net) was the face of StatusNet, and it kept growing." In March 2010, StatusNet launched its "cloud service", and switched to the OStatus protocol, whose design had been led by James Walker (at the time Senior Services Architect at StatusNet). OStatus was also (as Strypey says) "a bouquet of existing protocols including Atom, Activity Streams, PubSubHubbub, Salmon, and the delightfully named Webfinger". Rasheen Porter's [StatusNet Cloud Service Opens To The Public](https://web.archive.org/web/20170519132205/https://www.blackweb20.com/2010/03/09/statusnet-cloud-service/) on *Black Web* mentionsCreative Commons, Mozilla, Motorola, and Canonical as initial StatusNet customers. In May 2010 - work begain on [Gnu Social,](https://web.archive.org/web/20130320083404/http://gitorious.org/social/pages/Home) which became a set of StatusNet plugins. - [Appleseed](https://web.archive.org/web/20100522150704/http://opensource.appleseedproject.org/) launched as "the first open source, fully decentralized social networking software" - Dan Grippi, Ilya Zhitomirskiy, Raphael Sofaer, and Maxwell Salzberg launched a [Kickstarter](https://www.kickstarter.com/projects/mbs348/diaspora-the-personally-controlled-do-it-all-distr?ref=thenexusofprivacy.net) for Diaspora with the tag line "Decentralize the web", raising over $200,000\. The invitation-only, implementers-only July [2010 Federated Social Web summit](https://www.w3.org/2005/Incubator/federatedsocialweb/wiki/Federated%5FSocial%5FWeb%5FSummit%5F2010?ref=thenexusofprivacy.net), desribed as a "how not why" meeting, included implementers of dozens of decentralized social networks. The picture of the attendees at the start of this section, the [attendee bios](https://www.w3.org/2005/Incubator/federatedsocialweb/wiki/People.html?ref=thenexusofprivacy.net), and [invitation list](https://www.w3.org/2005/Incubator/federatedsocialweb/wiki/FedAll2010/Invitations.html?ref=thenexusofprivacy.net), gives an idea of the overwhelmingly-male demographics. ### The Federation, bridging multiple protocols, and the end of StatusNet's early dominance While identi.ca and StatusNet's were the center of "the identiverse" (a term Luke Slater had coined in 2010), interesting work was also happening elsewhere. Diaspora had its separate protocol, and the Diaspora-based fediverse was referred to as "The Federation." Mike MacGivirn's [Friendica](https://friendi.ca/?ref=thenexusofprivacy.net) (originally known as Mistpark) supported DFRN as well as OStatus and Diaspora, was the first fediverse software to bridge multiple protocols. Flash forward to 2024, and Elena Rossini's [The Future of Social is Here: a Show and Tell (part 3: Friendica)](https://blog.elenarossini.com/the-future-of-social-is-here-a-show-and-tell-part-3-friendica/?ref=privacy.thenexus.today) discusses, Friendica's functionality remains much richer than better-known fediverse software like Mastodon. In 2012 Macgivirn started Friendica fork (variant) [Hubzilla](https://hubzilla.org//page/hubzilla/hubzilla-project?ref=thenexusofprivacy.net) (originally Redmatrix), and introduced the Zot protocol. Zot's support for decentralized (aka nomadic) identities was an important user-focused feature that Mastodon and most other fediverse software still doesn't support today. Diaspora also contributed several significant innovations, including their design for Aspects (which Google+'s Circles either copied or independently developed, depending on who you believe). Later in 2010, [Sarah Mei changed Diaspora's gender to be a text field](http://www.sarahmei.com/blog/2010/11/26/disalienation/?ref=thenexusofprivacy.net); as far as I know this was the first fully-flexible gender field on a social network (decentralized or otherwise). Still, Diaspora faced challenges releasing a stable, secure product – challenges that became even more acute after the death of founder Ilya Zhitomirskiy in November 2011\. Sarah Mei's [eulogy](https://diasp.org/posts/454773?ref=thenexusofprivacy.net) gives a sense of what Ilya was like and how huge the loss was. StatusNet's introduced their "premium options" for their hosted service in September 2010\. In [Status.net Launches Premium Options for Cloud Plans](https://thenextweb.com/news/status-net-launches-premium-options-for-cloud-plans?ref=thenexusofprivacy.net) on *The Next Web,* Tris Hawkins was enthusiastic about the possibilities of "something like WordPress.com, but for microblogging, but also use your own domain or get extra storage space". However, Hawkins also notes that > "Status.net is billed as an alternative to Twitter, but my biggest problem is that right now it can’t *replace* Twitter. Posting to Twitter and my followers there isn’t the problem, it’s getting all the folks and information (lists, etc) from Twitter over *there* that is the stopper. I earn my keep in this world with a combination of Twitter and RSS, so I can’t just leave Twitter." Hmm, that sounds familiar. So does And as EFF's [An Introduction to the Federated Social Network](https://www.eff.org/deeplinks/2011/03/introduction-distributed-social-network?ref=thenexusofprivacy.net) (2011) and Klint Finley's [The Federated Web Should Be Easier Than It Sounds](https://techcrunch.com/2012/08/03/the-federated-web-should-be-easier-than-it-sounds/?ref=thenexusofprivacy.net) (2012) highlight, the potential – and the challenges – back then had a lot of similarities to the potential and challenges a decade later. In December 2012 announced plans to [wind down work on StatusNet](https://web.archive.org/web/20121221012427/http://status.net/2012/12/18/upcoming-changes-in-the-status-net-service). In [StatusNet, Identi.ca, and transitioning to pump.io,](https://lwn.net/Articles/544347/?ref=thenexusofprivacy.net)Nathan Willis comments that "StatusNet never quite reached its original goal of becoming a decentralized, multi-site platform." In [pump.io: the decentralized social network that’s really fun](https://opensource.com/life/13/7/pump-io?ref=thenexusofprivacy.net), Prodromou described the new protocol he was working on as "designed from the ground-up as a lean, mean developer tool", and says the main difference is from StatusNet is "that it does *a lot less*." Steven Secula's [The Coming of Pump.io](https://steve.cooleysekula.net/blog/2013/05/27/the-coming-of-pump-iomany-years-ago-i-opted-to-give-the-federated-social-web-a-try-i-was-impressed/?ref=thenexusofprivacy.net), and Laura Arjona Reina's [How I see pump.io now](https://larjona.wordpress.com/2013/10/29/how-i-see-pump-io-now/?ref=thenexusofprivacy.net), both from 2013, have more. ### The Gnu social fediverse of 2016 ![The gnusocial logo: a G with stylzed horns, followed by the word gnusocial, all in a brownish red](https://thenexusofprivacy.net/content/images/2024/09/gnu-social-logo.png) > "the Fediverse at the time \[2016\] had not changed much from its early days as a FLOSS social media federation project, started more than a decade before. Consequently, it was made up of a largely homogenous crowd, whose interests intersected technology, FLOSS, and anti-corporate ideologies." > > – Aymeric Mansoux and Roel Roscam Abbing, in [Seven Theses on the Fediverse and the Becoming of F/LOSS](https://test.roelof.info/log/seven-theses/?ref=privacy.thenexus.today) (2020) In 2013 StatusNet and Free & Social (a StatusNet fork started by Mikael Nordfeldth in 2012) [merged](https://web.archive.org/web/20130616030020/https://www.gnu.org/software/social/merge.html) with GNU Social (sometimes spelled GNU social) to [form GNU social](https://lists.gnu.org/archive/html/social/2013-06/msg00002.html?ref=thenexusofprivacy.net) (sometimes spelled GNU Social). In [an interview by Joshua Gay](https://web.archive.org/web/20181222085852/https://www.fsf.org/blogs/licensing/the-licensing-and-compliance-lab-interviews-matt-lee-of-gnu-social), Matt Lee observes "If that sounds confusing and convoluted, it is." Welcome to the fediverses! Lee also notes "I'm always keen to emphasize that I see GNU social as a social media framework, rather than a network itself. That's why I write social in lowercase – we're not a product, we're a tool." Lee provides some additional background in [a 2023 email](https://lists.w3.org/Archives/Public/public-swicg/2023May/att-0135/00-part?ref=thenexusofprivacy.net) forwarded to the W3C SWICG standards group. In [A Brief History of the GNU Social Fediverse and ‘The Federation'](https://web.archive.org/web/20190329051307/https://www.coactivate.org/projects/disintermedia/blog/2017/04/01/a-brief-history-of-the-gnu-social-fediverse-and-the-federation/) (2017), Danyl Strype (aka Strypey) writes > After this was [announced](https://web.archive.org/web/20190329051307/https://lists.gnu.org/archive/html/social/2013-06/msg00002.html) in 2013, lots of people who had still been running StatusNet sites, and getting concerned about the lack of active development as Evan worked in pump.io, started migrating to the first release of GNU Social, and other folks started setting up new GNU Social servers. Some of them continued to or started to federate using OStatus. Users who had been missing StatusNet since Identi.ca switched to pump.io (including yours truly) started finding and joining GNU Social servers. The [Fediverse](https://web.archive.org/web/20190329051307/https://www.coactivate.org/projects/disintermedia/blog/2017/04/01/a-brief-history-of-the-gnu-social-fediverse-and-the-federation/Fediverse) 1.0 is born. Hannes Mannerheim's [Qvitter](https://git.gnu.io/h2p/Qvitter?ref=thenexusofprivacy.net) plugin, released in 2013, provided a Twitter-like interface for the GNU social fediverse. Thomas Karpiniec's [From GNU social to Mastodon](https://thomask.sdf.org/blog/2018/08/19/from-gnu-social-to-mastodon.html?ref=thenexusofprivacy.net) (2018) describes the Qvitter community as "very left-wing": > Qvitter servers proudly described themselves as “a federation of microbloggers who care about ethics and solidarity and want to quit the centralised capitalist services.” Any right-wing agitators were promptly ejected. Twitter's introduction of [an algorithmic timeline](https://www.buzzfeednews.com/article/alexkantrowitz/twitter-to-introduce-algorithmic-timeline-as-soon-as-next-we?ref=thenexusofprivacy.net) in February 2016 led to an influx, with quitter.se (the largest instance at the time) getting 1200 new signups in two days. Karpiniec's [GNU social and #RIPTwitter](https://thomask.sdf.org/blog/2016/02/09/gnu-social-and-riptwitter.html?ref=thenexusofprivacy.net) (February 2016) describes the GNU social community at the time as consisting "mostly of polite free software enthusiast types," and robek similarly describes the early 2016 Gnu Social as "A slow, but comfy little paradise for geeks and developers" in April's 2017 [What is GNU Social and is Mastodon Social a “Twitter Clone”?](https://robekworld.com/what-is-gnu-social-and-is-mastodon-social-a-twitter-clone-1b12a98c37ec?ref=thenexusofprivacy.net) similarly describes GNU Social as initially ." In a February 2016 Hacker News discussion on [GNU Social, a FLOSS alternative to Twitter](https://news.ycombinator.com/item?id=11062757&ref=privacy.thenexus.today), reidrac similarly describes identi.ca back in the day as "pretty much about Linux, Open Source, and basically that was it." As Hal noted in a 2022 discussion, > "That Linux culture of "just run your own server" originates from them. It's rugged individualism ignoring the barriers in place to doing so that particularly hit marginalised groups very hard." As robek notes that many of these 2016 newcomers were "GamerGaters, Trolls, Idiots, and the curious," many of whom went on to start their own instances. Karpiniec similarly points out that shitposter.club was started at this time, and Hal suggests that many of the Nazi-filled instances in the fediverse today had their origins in this pre-Mastodon influx. In a 2022 [discussion](https://indieweb.social/@Lady@cat.family/109392480190521514?ref=thenexusofprivacy.net), revenant dyke describes GNU Social's late-2016 culture as "a bunch of channer shit and blatantly anti-gay and anti-trans memes", and notes that "the instance we saw most often on the federated timeline in those days was shitposter.club, a place which virtually every respectable instance now has blocked." clacke [notes](https://indieweb.social/@clacke@libranet.de/109419258092793446?ref=thenexusofprivacy.net) that "the famous channer-culture and freezepeach instances came up only months before Mastodon's "Show HN"." In [GNU Social, Pleroma, and the Mastodon Culture Conflict](https://medium.com/@Trevatos/gnu-social-pleroma-and-the-mastodon-culture-conflict-3b10872937c2?ref=thenexusofprivacy.net) (2018), trev similarly describes the enironment as "an ecosystem with intentionally edgy shitposters, gamergaters, and lolicon apologists (mostly banned from Twitter)." As f00f/eris/continuum/etc notes in a [November 2022 thread](https://kind.social/@f00fc7c8/109407989829565640?ref=thenexusofprivacy.net) > "the federated social web of this time was quite poorly moderated; there were servers with rules against certain kinds of harmful content, but their admins had difficulty keeping up with other instances that did not share the same rules, including a lot of "free speech" instances that permitted everything within the law." clacke [comments](https://indieweb.social/@clacke@libranet.de/109419258092793446?ref=thenexusofprivacy.net) that the project and community > were unprepared for the influx and steeped in an individualist hacker culture where tolerance of intolerance was not considered a big problem and "just don't read it" was considered a solution. The software had no tools and the community had no roles for creating a safe environment. As I said in 2017's [Lessons (so far) from Mastodon](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=thenexusofprivacy.net) > The existing “fediverse” is a two-edged sword for a social network with an anti-harassment and anti-racism focus. While the fediverse shares the goal of building an alternative to corporate sites, many fediverse sites that describe themselves as “free speech zones” (and people who prefer those sites) are likely to disagree on some core issues including the definition of harassment. ## 2016 ### Mastodon goes live ![CoronaCOreanici on Twitter: Holy shit everyone Mastodon is basically gay furry-adjacent twitter without risk of racist eggs, get here immediately](https://thenexusofprivacy.net/content/images/2022/11/Screen-Shot-2022-11-23-at-9.36.58-PM.png) Mastodon's initial community, as described by [@CoronaCoreanici](https://twitter.com/CoronaCoreanici/status/801364600629395456?ref=thenexusofprivacy.net) Eugen Rochko (aka Gargron) published the initial version of Mastodon's [source code](https://github.com/mastodon/mastodon?ref=thenexusofprivacy.net) was published in February 2016, and the first issue ([adding a license](https://github.com/mastodon/mastodon/issues/1?ref=thenexusofprivacy.net)) was filed later that month. Mastodon started to get broader adoption after Rochko's October 5[ Show HN: A new decentralized microblogging platform](https://news.ycombinator.com/item?id=12646083&ref=thenexusofprivacy.net) post to Hacker News. Rochko described Mastodon's technical approach to decentralization as based on OStatus, Atom feeds/ActivityStreams, Salmon, PubSubHubbub and Webfinger, and noted that "anything that supports those technologies is part of the network (e.g. GNU social instances)." In response to a question about his future plans for the project, Rochko said: > "I'm a realist so I don't think that it will be able to compete with Twitter. However I would like this project to become the go-to option for people who are already inclined to prefer decentralized/self-hosted solutions, and simply be better than the other software in that space." By late November 2016, Mastodon began getting media attention. Here's three early articles: - [Mastodon is an open source, decentralized version of Twitter](https://www.dailydot.com/debug/mastodon-open-source-social-media/?ref=thenexusofprivacy.net), by Christina Bonnington on the *Daily Dot* (November 22), is a quick overview. One big advantage: "Unlike Twitter, it’s non-commercial and not centrally owned, so you don’t have to worry about what will happen to your account or your posts if it gets acquired by another company." - [Open Source Alternative to Twitter: Mastodon Social Network](https://www.ilovefreesoftware.com/29/social/free-and-open-source-micro-blogging-social-network.html?ref=thenexusofprivacy.net), by Mohammad Suleman on *ILoveFreeSoftware* (November 29) has a good description of the early functionalty. Key advantages over Twitter: the 500-character limit per post, TweetDeck-like user interface (now known as the "[advanced web interface](https://mstdn.social/@feditips/108335235684404846?ref=thenexusofprivacy.net)"), not sharing your data with Twitter, and the ability to "set up a private social network for your company, your school / college, or family." - [MASTODON](https://web.archive.org/web/20180212185912/https://www.aneddoticamagazine.com/mastodon/), on Aneddotica Magazine (November 28), a cut-and-paste of Gargron's original Patreon and a link to mastodon.social. Here's Rochko's demo of the initial UI Mastodon UI demonstration (2016), posted by Gargron in 2021 These articles leave out a few important considerations. For one thing, very early Mastodon had almost no anti-harassment support. "Blocking" didn't really block the other person; muting and reporting didn't exist yet. And early Mastodon didn't have good support for people using screenreaders or other assistive technology. A November 1 2016 github issue noting [the lack of alt-text support](https://github.com/mastodon/mastodon/issues/117?ref=thenexusofprivacy.net) wasn't fixed until September 2017\. ### Flamewars, per-post privacy, and ROT13 Mastodon also didn't initially have tools for creating a safe environment. As Shel Raphen, former Mastodon volunteer coordinator, project manager, and community manager, says in Ana Valens’ [Mastodon is crumbling — and many blame its creator](https://www.dailydot.com/debug/mastodon-fediverse-eugen-rochko/?ref=thenexusofprivacy.net) > “When everyone joined there wasn’t per-post privacy or CWs or anything that people associate with Mastodon today. The new wave of queer users came up with, designed, pushed for, and implemented those features.” In [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=thenexusofprivacy.net) (April 2017), Allie Hart (who first arrived on Mastodon on November 23, before per-post privacy had been implemented) writes > "At this time, replies were not excluded from the public timeline results, and massive reply-chains formed as users jumped freely into ongoing conversations happening on public accounts. > > This system, surprisingly, worked for the first few days, until November 25 rolled around — as some might remember, the day Fidel Castro died. Political flamewars engulfed the site. The very next day, the project’s lead developer [pushed a commit](https://github.com/tootsuite/mastodon/commit/8a4913f?ref=thenexusofprivacy.net) to hide replies from the public timeline, and shortly after made post “privacy” [a per-post setting](https://github.com/tootsuite/mastodon/commit/14bd469?ref=thenexusofprivacy.net)." I wasn't there for the 2016 flame war, but from what I've heard it was pretty epic – and there may well have been some racialized aspects to it. Some people left as a result. And Mastodon's per-post privacy setting was an extension to OStatus, which, which caused tensions with fediverse instances running GNU Social and other software. trev's 2018 [GNU Social, Pleroma, and the Mastodon Culture Conflict](https://medium.com/@Trevatos/gnu-social-pleroma-and-the-mastodon-culture-conflict-3b10872937c2?ref=thenexusofprivacy.net) notes that > GS and its predecessors were built with the presupposition that every message would be fully public and that was desirable behavior. Then came Mastodon with out-of-spec message scoping tacked on to OStatus, and Content Warnings, and compatibility issues. People who idolized a certain kind of “free speech” saw Mastodon’s way of doing things as repugnant — I think we know how that goes. > > When Mastodon first implemented Message Scoping, GS didn’t know anything about it, and displayed all messaged as public. This made GS instances the “bad guy” for ignoring scoping in the eyes of some people. This was also right after the 2016 US presidential election and many people valued Mastodon as an “apolitical” space free of commentary on the upcoming white supremacist presidency. As Shel Raphen notes in [On Content Warnings](https://shelraphen.com/on-content-warnings/?ref=thenexusofprivacy.net) (2024) > "Mastodon's culture emerged in the moments immediately after Trump's election in 2016 and the feeling that the internet was an eternal battle for space against neonazis. A lot of people were exhausted and distressed by thinking about the news." So for a while there was a de facto agreement not to make public posts about politics. That didn't last, and Hart reports that after a number of "similar but smaller disruptions," the convention of using the simple [ROT13](https://en.wikipedia.org/wiki/ROT13?ref=thenexusofprivacy.net) cipher to hide political posts or "other unsavoury material." Jung pbhyq cbffvoyl tb jebat?\* Still, people continued to join. Carl Miller's [Who commands the internet?](https://unherd.com/2018/10/who-is-in-charge-of-the-internet/?ref=thenexusofprivacy.net) (from 2018) quotes Rochko on the early membership: > “Queer people joined”, said Eugen, “and Furries. It comes in waves. We see a spike, then it falls down as users go back to the commercial platforms. But it never falls back as far.” ## 2017 ### Rapid queer-led community innovation ![Mastodon’s early users (and developers): Antifascists, Gay communist furries, LGBTQ people. On open-source projects people implement functionality they want and need](https://thenexusofprivacy.net/content/images/2022/11/Screen-Shot-2022-11-26-at-11.26.48-AM.png) from [Transforming Tech with Diversity-Friendly Software](https://medium.com/a-change-is-coming/transforming-tech-with-diversity-friendly-software-338f56d91df?ref=thenexusofprivacy.net), April 2017 > "way back, at the beginning of mastodon’s rise to what it is now, queer activists, be they just a stranger with a keyboard, new to the social media site, weighing in on a topic on the public timeline, or me, someone actively attempting to be the middle between the most vocal voices, and tangible, meaningful change through gargron’s code, and github focused writing and activity, people were queer. they were marginalized, to some extent. people who weren’t comfortable with the status quo, so we changed it. > > we begged, and screamed, and kicked at the ground until there was enough dust in the air for gargron to cough and wheeze and change things, and in the end, those changes were enough for things to change for the better." > > – hoodieaidakitten, [Mastodon’s Complicated Relationship with Queer Activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=thenexusofprivacy.net), July 2018 As Flowers highlights in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), the history of Mastodon is often presented as "grounded in queer folks attempting to avoid the harassment on Twitter as a shield against critiquing the whiteness of Mastodon." That's a problematic framing for so many reasons. As well as whitewashing history, and erasing the people of color who have been on Mastodon since the beginning, this framing also elides the power struggles related to community members wanting to prioritize improvements to help address the harassment and abuse that was happening *on Mastodon –* especially to people of color. That said, Mastodon in early 2017 was hella queer, and the queer volunteers who helped create Mastodon made an incredible amount of progress in the first half of the year – so much so that even today Mastodon has a reputation for queer-friendliness. At the software level, this included significant advances like content warnings (which despite the potential for abuse is generally seen as a very good feature), instance blocking (a major innovation over Mastodon's predecessors), the welcome modal, and local-only posts. So, while keeping Flowers' perspective in mind, let's take a moment to recognize the community and their contribution. > "What of this community? What was it like? Well: “Welcome to mastodon.social, here’s a copy of the Communist Manifesto and your fursuit,” or so the (oft-repeated) saying went, underscoring the deeply leftist, kink-positive and often furry nature of its core base. Often these users were lesbian, gay, bi, or pan; frequently they were trans and/or nonbinary; many dealt with disabilities; many were victims of harassment. Certainly, the most vocal and most frequent of Mastodon’s unpaid contributors seemed to invariably fall into one or more of these categories." > > – Allie Hart, [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=thenexusofprivacy.net), April 2017 The initial versions of Mastodon initially had no protections at all against harassment. Hart links to github artifacts for the implementation of locked accounts, private toots (as posts were called until very recently), blocking, muting, and reporting in the December 2016 - March 2017 timeframe. As Hart points out, these features were all the result of deliberate requests from members of the community, and many community members contributed code to the implementations. They were also added to Mastodon "generally *after* their moment of need first arose, and even then frequently only after a good deal of strife". For example, - Hart identifies the "massive schism around race and politics led to the creation of awoo.space and drove many POC off the site" as leading to the belated introduction of reporting in February 2017\. - [Instance-level blocking](https://github.com/mastodon/mastodon/issues/423?ref=thenexusofprivacy.net) (aka *defederation*, an innovative and important anti-harassment technique) was prototyped by community members in mid-January but was not adopted in the main code base until May after a succession of incidents from badly-behaving instances. In "The Fediverse as an Ongoing Critique of Openness", section [Seven Theses on the Fediverse and the Becoming of F/LOSS](https://test.roelof.info/log/seven-theses/?ref=privacy.thenexus.today) (2020), Mansoux and Abbing highlight that the as "the Fediverse’s population grew more diverse when Mastodon attracted more heterogeneous communities, conflicts emerged...." > "This time it was the Fediverse’s own idea of openness that was increasingly challenged by the newcomers. As part of this critique, a call emerged within the user community of Mastodon for the ability to block or ‘defederate’ with other servers in the Fediverse. Blocking means that users or administrators of servers could choose to prevent content from other servers in the network from reaching them. ‘Defederation’ in this sense became an additional option in the toolkit for strong community-based moderation, since it prevented confrontation with unwanted or harmful content." Mansoux and Abbing also discuss the friction defederation introduced, and the view that it threatened the entire network. > "In this view, the bigger and more interconnected the network could become, the more successful it might be as an alternative to corporate social media. Similarly, many saw blocking as limiting the possibilities for personal expression and the productive exchange of ideas, fearing filter bubbles and isolation as a consequence. By striving for selected disconnection and challenging the very idea that online discourse is necessarily generative, the communities advocating for defederation also challenged the broader liberal assumptions about openness and universality on which prior Fediverse software was built." ### Dogpiling, weaponized content warning discourse, and a fig leaf for mundane white supremacy ![I became really famous on Mastodon because in my first few HOURS on there, after I commented about the lack of PoC, I was dogpiled ... This harassment went on for about a week if not more.](https://thenexusofprivacy.net/content/images/2022/11/Screen-Shot-2022-11-26-at-11.48.29-AM.png) [@creatrixtiara on Twitter](https://twitter.com/creatrixtiara/status/1030380785226801152?ref=thenexusofprivacy.net) Ana Valens [Mastodon is crumbling — and many blame its creator](https://www.dailydot.com/debug/mastodon-fediverse-eugen-rochko/?ref=thenexusofprivacy.net) (2019) quotes a user who left Mastodon in early 2017 > "Voz, who is a brown queer trans woman, considered Mastodon “a very white space” that gradually mirrored real-life versions of gentrification: White users made the service “more and more hostile to the Black and Brown users” that were among Mastodon’s initial adopters. > > “Whiteness insists on hiding itself, and a veneer of respectability given by ‘banning (overt) Nazis’ is really just a kind of fig leaf for the more mundane white supremacy at work there,” voz said via Keybase." Margaret Kibi's [The Beginnings](https://www.u2764.com/NFIC/2018-09-09/fringe-beginnings/?ref=thenexusofprivacy.net) describes one example. Content warnings (CWs) had first been [proposed](https://github.com/mastodon/mastodon/issues/239?ref=thenexusofprivacy.net) in November 2016\. Blackle coded an [initial implementation](https://github.com/mastodon/mastodon/pull/460?ref=thenexusofprivacy.net), focused on their use as spoilers, in early January 2017 and they were integrated into the main code by the end of the month. As Shel highlights in [On Content Warnings](https://shelraphen.com/on-content-warnings/?ref=thenexusofprivacy.net), > "\[S\]ince not everyone wanted to see the constant discussion of US politics, the "uspol" and "current events" CWs emerged. > > It became expected that *all* posts about politics be hidden behind a CW. It felt impolite to discuss politics and it received less engagement. *All* current events required this CW, including events in one's own highly politicized life." Kibi describes the result: > \[E\]arly in February, this community standard was weaponized, as white, trans users—who, for the record, posted un‐CWed trans shit in their timeline all the time—started taking it to the mentions of people of colour whenever the subject of race came up. It was an incredibly unfair double‐standard, which effectively amounted to white people restricting the domain of public discourse to only those things which made them feel comfortable. [The Beginnings](https://www.u2764.com/NFIC/2018-09-09/fringe-beginnings/?ref=thenexusofprivacy.net) has quite a few toots illustrating the dynanics. As Flowers says in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) > \[W\]hiteness is a large problem within the LGBTQ community. Being queer does not insulate one cell from the inheritance of whiteness In a brief discussion of Mastodon in April 2017's [Transforming Tech with Diversity-Friendly Software](https://medium.com/a-change-is-coming/transforming-tech-with-diversity-friendly-software-338f56d91df?ref=thenexusofprivacy.net), I mentioned some of the other challenges > \[T\]he Mastodon community currently has some significant diversity challenges in some other dimensions (for example, very few Black and Latinx people), an attitude on many instances of shutting down discussions pertaining to identity or systemic oppression as “irrelevant”, and situations where people of color have been harassed. It will be interesting to see how things unfold. Creatrix Tiara's [2018 Twitter thread](https://twitter.com/creatrixtiara/status/1030380808282882048?ref=thenexusofprivacy.net) describes one of those situations I was referring to > I became really famous on Mastodon because in my first few HOURS on there, after I commented about the lack of PoC, I was dogpiled by an instance run by a guy with a known podcast who thought I was some kind of SJW harpy. This harassment went on for about a week if not more.... > > The reason I got dogpiled in the first place was because I talked about how Mastodon seemed to be unintuitive for anyone who isn't a dev, and how that might affect engagement from ESL & PoC overall. I got told that I should put in pull requests or work on the code. > > When I said that not everyone is a coder & that shouldn't be a requirement to make things accessible, that's when things got hostile - that I was unnecessarily playing the race card. I had to quit my first instance and find another one willing to block that instance. As mentioned above, Rochko still hadn't integrated instance blocking into the main Mastodon code base, so Creatrix Tiara had to find a site running one of the Mastodon forks that *did* support it. It's worth highlighting that the dogpiling didn't drive Creatrix Tiara away from Mastodon – in fact, later in 2017 they wrote [Mastodon 101: A Queer-Friendly Social Network You’re Gonna Like a Lot](https://www.autostraddle.com/mastodon-101-a-queer-friendly-social-network-youre-gonna-like-a-lot-390948/?ref=thenexusofprivacy.net) for *Autostraddle*, and was still around in late 2023 when they kicked off [an excellent thread](https://web.archive.org/web/20230331035758/https://vulpine.club/@creatrixtiara/109310828652037900) where BIPOC and POC users shared pespectives on Mastodon's CW culture and norms. However, a lot of other people of color who were kicking the tires on Mastodon saw this and other incidents of racist harassment decided that y'know, maybe Mastodon wasn't the place for them. And who can blame them? ### The breakthrough month [![Mastodon Is Like Twitter Without Nazis, So Why Are We Not Using It? Sarah Jeong, April 4 2017](https://thenexusofprivacy.net/content/images/2022/11/Screen-Shot-2022-11-26-at-11.53.25-AM.png)](https://www.vice.com/en/article/783akg/mastodon-is-like-twitter-without-nazis-so-why-are-we-not-using-it?ref=thenexusofprivacy.net) [The article that convinced me (and many others) to check out Mastodon](https://www.vice.com/en/article/783akg/mastodon-is-like-twitter-without-nazis-so-why-are-we-not-using-it?ref=thenexusofprivacy.net) > "If you—like me—are unfamiliar with the landscape of free and open source software (FOSS) social media, Mastodon is weird. It's really *really* weird." > > – Sarah Jeong, [Mastodon is like Twitter without Nazis](https://www.vice.com/en/article/783akg/mastodon-is-like-twitter-without-nazis-so-why-are-we-not-using-it?ref=thenexusofprivacy.net), VICE (April 4, 2017) > "So, April, huh. Twitter changed the reply system, which everybody told them they shouldn’t do, and then removed the iconic egg avatar for new users, and suddenly all of my work of telling people that one day Twitter would do something they didn’t like and they’d need a viable alternative paid off." > > – Eugen Rochko, [April post-mortem](http://blog.joinmastodon.org/2017/04/april-post-mortem/?ref=thenexusofprivacy.net), April 25, 2017 April 2017 was an exciting month for Mastodon. Sarah Jeong's [Mastodon Is Like Twitter Without Nazis, So Why Are We Not Using It?](https://motherboard.vice.com/en%5Fus/article/mastodon-is-like-twitter-without-nazis-so-why-are-we-not-using-it?ref=thenexusofprivacy.net) on VICE Motherboard (April 4) was part of a wave of media attention that kicked off explosive growth. By the end of the month, Mastodon had funding via Patreon for Rochko and a part-time project manager, and corporate adoption, and over 500,000 users – including me! I joined Mastodon not long after reading Jeong's article, and set up shop [on toot.cat](https://toot.cat/@jdp23?ref=thenexusofprivacy.net), an instance run by people I knew from the Open Source Bridge conference. Jeong links to an early example of people being told to start their own instance if they don't like what's happening, a Mastodon tradition that continues to this day. She also notes: > "And there's one thing that has to be said about mastodon.social. There are a lot of people complaining about transphobia, homophobia, cissexism, sexism, and Nazis. There are not a lot of people complaining about white supremacy, and there isn't a lot of chatter about the surge of Islamophobia in the world. I understand the need to insulate oneself from upsetting topics, but insulation necessarily breeds insularity." A few other snapshots from April 2017: - Qina Liu's [What I wish I knew before joining Mastodon,](https://medium.com/@qinaliu/what-i-wish-i-knew-before-joining-mastodon-7a17e7f12a2b?ref=thenexusofprivacy.net) on *HackerNoon (*April 9) is a getting-started guide I remember recommending, with lots of screenshots, a list of early high-profile accounts to follow, and a discussion of the pineapple meme 🍍. - Johanna Drott's [Mastodon, pineapples, social media and other unanswered questions](https://medium.com/@sargoth/mastodon-pineapples-social-media-and-other-unanswered-questions-c5127c7c9aa0?ref=thenexusofprivacy.net) (April 9) captures the sense of possibilities as well as key questions that still haven't been resolved: “What is interesting is that the sense of early 90s cyberoptimism has started to reappear. It is possible to do things again, to change things, to build things that will make a difference…. What can and ought we do to establish sustainable social norms? How do we live together without breaking one another?” - Eileen Brown's [Is Mastodon the new social media star, or imploding black hole?,](http://www.zdnet.com/article/is-mastodon-the-new-social-media-star-or-imploding-black-hole/?ref=thenexusofprivacy.net) on *ZDNet* (April 17) discusses the challenges brands will face on Mastodon. "I think that enterprises will give the service a wide berth as they will not be able to find a way to monetize the time spent getting adequate coverage. Mastodon diehards will rejoice at this." - Lexi Summer Hale's [Infrastructure 101](https://xn--rpa.cc/irl/infrastructure.html?ref=thenexusofprivacy.net) notes that "For many people in the SJ \[social justce\] community, Mastodon became more than a social network — it was an introduction to the tools of the trade of the open source world." Hale also highlights on Mastodon's scalability issues. "Shiny as the UI may be, Mastodon’s back-end is a performance nightmare. The dev took shortcuts (shortcuts that are becoming terrifyingly industry-standard) and now his servers are paying for it." - [The Normal Invasion](https://mastodon.cloud/@dredmorbius/1058991?ref=thenexusofprivacy.net) (April 16–17), an epic tootstorm by [@dredmorbius](https://mastodon.cloud/@dredmorbius?ref=thenexusofprivacy.net), suggests that Mastodon’s initial quirkiness and welcoming to certain non-mainstream communities will inevitably be lost as the community grows. - [What No One Else Has Told You About Mastodon,](http://www.spot.ph/newsfeatures/the-latest-news-features/69860/what-mastodon-social-network-a1633-20170417?ref=thenexusofprivacy.net) by Ryan Parreno on *Spot* (April 17), discusses the culture on mastodon.social at the time. "\[T\]he most popular kinds of posts in mastodon.social relate to memes, and we get as absurd and silly as we can. During my stay in Mastodon, I’ve posted and shared memes related to Neil Cicierega, misspellings of the word gaming, dril tweets, puns, limericks, sexual limericks, even elaborate jokes that use the content warning feature." Perreno also mentions the threats to Mastodon's culture from gentrification. "Will gay-friendly Mastodon survive? Or can we build a better community in its place?" - Kevin Marks' [Mastodon, Twitter and publics](https://www.kevinmarks.com/mastodontheory.html?ref=thenexusofprivacy.net) (April 24) discusses Mastodon's "pleasant tone to a lot of posts that comes with sharing and reacting without looking over your shoulder," suggests that "Eugen has done a good job of tummling this community, listening to their concerns and tweaking Mastodon to reflect them" (using CWs as an example), and notes that "The structure of Mastodon and GnuSocial instances provides multiple visible publics by default, and Mastodon's columnar layout (on wider screens) emphasises this." - Amaelle Guiton's [Mastodon : un autre Twitter est possible](http://www.liberation.fr/futurs/2017/04/19/mastodon-un-autre-twitter-est-possible%5F1563858?ref=thenexusofprivacy.net) in *Libération* (April 19) also sketches some of the key questions on people's mind at the time. How to resolve tensions between the desire to become a global village like Twitter and the goal of a *“*safe space*”* for groups facing discrimination? Will power shift to instance administrators or the users? How to streamline communication while preventing harassment? Guiton also has a wide range of quotes from people with positive things to say about their experience. - Matthew Skala's [Mastodon WTF timeline](https://ansuz.sooke.bc.ca/entry/335?ref=thenexusofprivacy.net) (April 23) is a detailed look at the situation from the Japanese perspective. By the end of the month Pixiv's pawoo.net and mstdn.jp were the two largest sites, although silenced by most English-language sites because of concerns about images legal in Japan but not elsewhere (a topic Ethan Zuckerman explores more in August 2017's [Mastodon is big in Japan. The reason why is… uncomfortable](https://ethanzuckerman.com/2017/08/18/mastodon-is-big-in-japan-the-reason-why-is-uncomfortable/?ref=thenexusofprivacy.net)). Other than Jeong's article, none of the April 2017 coverage appears to have mentioned race. I also couldn't find any references to harassment. ### The Battle of the Welcome Modal In April 2017, many new arrivals (including me) found Mastodon confusing. Techies could often come up to speed fairly quickly, especially if they had experience with earlier decentralized social networks like Diaspora, identi.ca, and Gnu Social. Others often had a harder time, and as a result a many people didn't stick around long. Of course, this isn't unusual for a new social network (for years, the vast majority of people who signed up for Twitter made at most one Tweet before dropping it), but it still isn't a good thing. Community members with onboarding and user experiences pointed out that giving people a few key pieces of information after they first signed up could address a lot of common sources of confusion. As Valens describes [Mastodon is crumbling — and many blame its creator](https://www.dailydot.com/debug/mastodon-fediverse-eugen-rochko/?ref=thenexusofprivacy.net), Shel Raphen – who was doing an outstanding job of project management in a very difficult situation – designed a [welcome modal](https://github.com/mastodon/mastodon/issues/705?ref=thenexusofprivacy.net). Rochko harshly criticized the design and [made significant changes](https://github.com/mastodon/mastodon/pull/1883?ref=thenexusofprivacy.net) that "[broke the pedagogy and curriculum built into the design of the onboarding modals](https://github.com/mastodon/mastodon/pull/1964?ref=thenexusofprivacy.net)," which had been reviewed and approved by various other contributors. > "Raphen confronted Rochko over the modal, telling him that he has to “thank people and appreciate their work” on the project. > > After Rochko introduced his own alternate welcome modal, Raphen claims community pressure led Rochko to add Raphen’s design—without crediting Raphen in the project’s release notes. > > “I went in and edited the release notes myself and added myself, since I had that privilege, and Eugen got pissed and removed all my privileges and basically booted me from the project,” Raphen said." ### A breaking point for the queer community > "things changed, because more and more people comfortable with the status quo followed. we queer activists rapidly became the subset that originally came, the marginalized. the minority." > > – hoodieaidakitten in [Mastodon’s Complicated Relationship with Queer Activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=thenexusofprivacy.net) (July, 2018) Valens describes Raphen’s treatment in the Battle of the Welcome Modal as "a breaking point for Mastodon’s queer community," and that's how I remember it too. That said, it was only one aspect of the threats the queer community faced. Allie Hart's [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=thenexusofprivacy.net) (April 22), written a few days later, notes that > "The recent influx of users to the platform has brought with it new contributors and an expanded revenue stream that has rendered the original nearly obsolete. Queer users could leave *en masse* without harming the project’s survivability, which means that the reciprocity of their relationship has been terminated — queer users still depend on the project, but the project no longer depends on its queer users." [Enter Allie Hart](https://www.u2764.com/NFIC/2018-09-16/fringe-allie/?ref=thenexusofprivacy.net) (September 2018) discusses the reaction to [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=thenexusofprivacy.net): > "Most of the responses to the piece were things I had anticipated ahead of time: Queer users, generally, said "yes this rings true;" white techbros, more or less, said "this is overblown" or "if you're so upset by this, why don't you write a fork?" (LOL. As a matter of fact, there was another fork attempt around this time—Mastodon CE. I contributed my frontend‐splitting code, but the fork attempt appears only to have lasted all of three days.) > > There was another response which I received which I didn't expect—from people of colour reading the piece, all of whom (who @‐mentioned me) seemed to be new to the site, who were curious about the instances of racism I mentioned but largely left unexplained, and wondered why I was placing so much emphasis on queer problems and queer empowerment when white queer users were arguäbly the source (well, one of the sources) of the racism problem in the first place." As Valens says, some of the same criticisms leveled against the Mastodon project could be made against the white queer community on Mastodon: > "The gentrifiers were now being gentrified, so to speak." In the followup [Mourning What Now?!?!](https://medium.com/@alliethehart/mourning-what-now-10964cce22a8?ref=thenexusofprivacy.net) (April 23), Hart says > "In my essay I write that the queer community deserves justice; namely, that they “be recognized for their efforts, allowed to enjoy the fruits of their labor, and given the opportunity to continue to play a meaningful role in its development.” But what of the other communities, who, granted, didn’t contribute as much to the Mastodon project, but, again, only because *they weren’t allowed to*? Do they not also deserve justice? ... > > *When I say that Mastodon should include queer decision-making in its development process, I do not mean so at the exclusion of the other communities which it serves.* To the contrary, I think that *every* community served by Mastodon deserves a say in the project moving forward." ### The aftermath The surge of users slowed down in May and things calmed down for a while. One reason things calmed down is that Mastodon's Patreon was bringing in enough money to hire maloki as a part time project manager / community manager. hoodieaidakitten [describes](https://hoodieaidakitten.dreamwidth.org/453.html?ref=thenexusofprivacy.net) maloki's efforts to work with Rochko "to try to smooth over his rampant, unceasing issues with transparency on what is being done to the code." Instance-level blcking was finally released in mid-May, but most of the development energy was now occurring in forks. Margaret Kibi describes their reaction to being invited to join one of these forks in [Joining GlitchSoc](https://www.u2764.com/NFIC/2018-10-01/fringe-glitch/?ref=thenexusofprivacy.net): > "I didn't (don't) think that Mastodon's less‐than‐stellar history of responding to race‐related issues would be resolved by anything other than a significant nonwhite presence in the development staff—and that, far more than Mastodon's handling of queer issues, was what had gotten me into Mastodon development. A trans‐dedicated fork could well end up in tension with those goals if—as historically had been the case on Mastodon—those trans women trended overwhelmingly towards being white. > > On the other hand: How many major user‐facing open‐source projects are significantly‐to‐entirely owned, operated, and dedicated to trans women? For a time at least, that was GlitchSoc. It was a big deal, and I couldn't exactly say no." [Joining GlitchSoc](https://www.u2764.com/NFIC/2018-10-01/fringe-glitch/?ref=thenexusofprivacy.net) documents the development of important functionality including user‐defined profile metadata and collapsing posts. User-defined profile data, for example, was originally [proposed](https://github.com/mastodon/mastodon/issues/232?ref=thenexusofprivacy.net#issuecomment-262705473) in November 2016 as a way of including pronouns on a profile page, implemented in GlitchSoc in June 2017, and finally implmented in mainline Mastodon in April 2018\. In late June 2017, GlitchSoc was also the first fork to [implement](https://github.com/glitch-soc/mastodon/commit/93fc8aa14c914d03643197306c325becbaed2581?ref=thenexusofprivacy.net) basic support for [local-only posts](https://github.com/hometown-fork/hometown/wiki/Local-only-posting?ref=thenexusofprivacy.net), originally proposed [in April 2017](https://github.com/glitch-soc/mastodon/issues/2?ref=thenexusofprivacy.net) and *still* not integrated into Mastodon's main line.\*\* [Lessons (so far) from Mastodon for independent social networks](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=thenexusofprivacy.net) (May 10 2017) was my attempt to sum up what I had learned in my month on Mastodon. A few of the highlights: - An explicit anti-harassment and pro-sexual-minority focus will attract a lot of people who are tired of the normalized harassment and heteronormativity on other social networks — enough to have a significant impact on the software. - Even with a stated anti-harassment focus it can still be challenging for a network to respond well when people are actually harassed. - Even with an explicit anti-harassment, anti-fascism, and anti-racism focus, people of color are likely to be marginalized if the most influential people are white. Other patterns that are likely to occur as well (as elsewhere online): — cis men are likely to prioritize anti-harassment functionality lower than women and gender-diverse people. — harassment is more likely to be directed at women, people of color, and LGBTQ+ people. — impacts are likely to fall most heavily on women of color, and in particular queer women of color. - Rapid growth will tend to dilute a LGBTQ+ focus, unless there’s an effort to keep LGBTQ+ people centered and give them real authority. Federating with the Trouble, from Open Source Bridge in June 2017, is a good snapshot of the state of Mastodon from toot.cat's admins. The Open Source Bridge website and wiki are no longer available, but fortunately I live-tooted it – [here’s the tootstream](https://toot.cat/@jdp23/981329?ref=thenexusofprivacy.net). The thread provides another example of queer community-led development, one that affected both toot.cat's code of conduct (originally based on Audrey Eschright's work, the Citizen Code of Conduct, and some earlier anti-oppression work) and the underlying software: > when you start having long conversations, need to get very specific about what you mean by anti-oppression. e.g. "no nudity" is a problem for sex workers. so expanded that to a four-paragraph section. also worked to get NSFW tag changed to "sensitive image" - just came out yesterday! It's really amazing how much of Federating with the Trouble remains relevant. For example, this discussion relates to the current debates about defederating mastodon.social in response to ongoing moderation problems: > suppose an instance has been running for a while and has local followers. now the admin starts breaking their own code of conduct and allowing harassment. can try diplomacy ... it's hard! need a "NATO of Mastodon admins", multiple tries to do that - probably the hardest situation revenant dyke adds > I remember there being an attempt at a themed instance for mastodon admins in mid-2017 but it was incredibly short-lived. Maybe it could have been done better with the technologies we have today, but there were the same administration questions that places like journa.host are grappling with now—admins can't communicate with other admins if they are suspended, but do you really want to open your doors to Every Admin? ### ActivityPub > "ActivityPub has a long history, preceding even its work in the W3C process, with its most clear beginnings as the [Pump.io API](https://github.com/pump-io/pump.io/blob/master/API.md?ref=thenexusofprivacy.net) designed by Evan Prodromou. Erin Shepherd transformed pump.io's API documentation into a draft of a specification document, and Jessica Tallon and I carried the document through the rest of the specification process, with some major rewritings by Amy Guy. But of course this leaves out much history too, and many contributors." > > – Christine Lemmer-Webber, [Handing off activitypub.rocks to the ActivityPub community](https://activitypub.rocks/news/handing-off-activitypubrocks-to-the-activitypub-community.html?ref=thenexusofprivacy.net), August 2025\. Lemmer-Webber's accompanying Mastodon thread has many fascinating slices of ActivityPub history, including the early emacs-based client, and links out to artifacts including Pubstrate, soci-el, 8sync, and mudsync The OStatus protocol used by Mastodon and most of the 2016-2017 fediverse had a lot of limitations, and Mastodon's non-standard (but necessary!) extensions often caused compatability problems with other software. Replacing OStatus with the ActivityPub (AP) protocol, a standard being developed by [the World Wide Web Consortium's Social Working Group](https://www.w3.org/Social/WG?ref=thenexusofprivacy.net) (SocialWG) offered a path forward. In April 2017 Rochko [cited](https://github.com/mastodon/mastodon/issues/1557?ref=thenexusofprivacy.net) a potential benefit of ActivityPub support: "the ability to implement follower-only messages as well as direct messages without leaking them to old GNU social server that don't understand privacy scopes." With substantial contributions from the community, and support from the SocialWG, implementation was completed fairly quickly. > "Mastodon v1.6 is here, and it is the first Mastodon release which fully implements the ActivityPub protocol. ActivityPub is a new federated messaging protocol developed by the World Wide Web Consortium (W3C) which aims to fix the shortcomings of past standards like OStatus." > > – [Mastodon and the W3C](http://blog.joinmastodon.org/2017/09/mastodon-and-the-w3c/?ref=thenexusofprivacy.net) , September 2017 At the time, Mastodon was [by far the largest social network to implement ActivityPub](https://activitypub.rocks/news/mastodon-ap-and-new-cr.html?ref=thenexusofprivacy.net), with over 850,000 users. Sean Tilley's September 2017 [A quick guide to The Free Network](https://medium.com/we-distribute/a-quick-guide-to-the-free-network-c069309f334?ref=thenexusofprivacy.net) highlights the possibility that as a result of ActivityPub, existing social networks including GNU Social, Diaspora, Pleroma, pump.io, Friendica, Hubzilla, SocialHome, PostActiv, and Mastodon "will likely fold into one federated supernetwork containing everybody, maximizing interoperability between nine different systems, possibly more." ActivityPub was a significant improvement over OStatus, and is now supported by dozens of other implementations . As with Mastodon's early days, there was a major queer and trans influence: according to Christine, [four of the five authors of the ActivityPub standard identify as queer](https://arstechnica.com/gadgets/2023/01/mastodon-highlights-pros-and-cons-of-moving-beyond-big-tech-gatekeepers/?ref=thenexusofprivacy.net). However, ActivityPub also has some downsides. For example: > "Sometimes I ponder: If I’d had a detailed security mechanism in that first draft, could I have saved everyone a lot of pain? > > Ah well, hindsight." > > – Erin Shepherd, in [a thread about ActivityPub's 10th birthday](https://akko.erincandescent.net/notice/Alfp5qWXNijI0bl60G?ref=thenexusofprivacy.net), 2024 > "Unfortunately from a security and social threat perspective, the way ActivityPub is currently rolled out is under-prepared to protect its users." > > – [OcapPub: Towards networks of consent](https://gitlab.com/spritely/ocappub/blob/master/README.org?ref=thenexusofprivacy.net), Christine Lemmer-Webber As Ariadne Conill points out in [ActivityPub: The “Worse Is Better” Approach to Federated Social Networking](https://ariadne.space/2019/01/07/activitypub-the-worse-is-better-approach-to-federated-social-networking/?ref=thenexusofprivacy.net), safety analysis is done by testing it against basic use cases (rather than a more structured or complete approach) and simplicity of the protocol is prioritized over safety. As Mike Macgirvin relates, [Mastodon's tradition of not always playing nice with other implementations continued](https://macgirvin.com/item/bde6ffe3-de9f-46a1-b1c1-27e8870f22e3?ref=thenexusofprivacy.net), leading to compatibility issues such as HTML content from other apps vanishing when viewed on Mastodon. While there was some discussion during the standardization process of how ActivityPub could be made more resilient against harassment and abuse (the [meeting minutes from October 2017](https://www.w3.org/wiki/SocialCG/2017-10-11/minutes?ref=thenexusofprivacy.net), for example, note the support for a "block" tool and mention Mastodon's cross-server filtering tools), Christine [cites](https://gitlab.com/spritely/ocappub/blob/master/README.org?ref=thenexusofprivacy.net) "time constraints and lack of consensus" as the reason the ActivityPub spec was released with "holes in the spec" related to authorization and identity management. This lack of consensus was only one of the ways in which ActivityPub standardization process was challenging. In [A better moderation system is possible for the social web](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web/?ref=thenexusofprivacy.net), Erin Shepherd describes it as "4 years going around in circles arguing with each other about minor details" and "a working group divided" that "produced *two* families of incompatible social networking protocols." A 2024 [post](https://cosocial.ca/@evan/112962314153943451?ref=thenexusofprivacy.net) by Evan Prodromou, who was co-chair of the committee at the time, notes that he had never previously apologized to the spec co-authors for the "traumatic experience": > "As co-chair, I should have not have let this get so bad for you. I wanted AP to exist so bad, I didn't pay attention to how hard it was for you. You all told me how much it sucked at the time, and I cajoled you to push on just a little farther. That was wrong. I'm sorry." Amy Guy's [Standards for the Social Web](https://rhiaro.github.io/thesis/chapter5?ref=thenexusofprivacy.net) (from her thesis *The Presentation of Self on a Decentralised Web*),Christine Lemmer-Webber's [On standards divisions and collaboration](http://dustycloud.org/blog/on-standards-divisions-collaboration/?ref=thenexusofprivacy.net), and Robert W. Gehl's chapter "The Non-Standard Standard: When ActivityPub met Mastodon" (in his 2025 book [Move Slowly and Build Bridges](https://moveslowlybuildbridges.com/?ref=thenexusofprivacy.net)) and have more on the dynamics. As a result, as Erin describes in [A better moderation system is possible for the social web](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web/?ref=thenexusofprivacy.net), > "The basics of ActivityPub are that, to send you something, a person `POST`s a message to your Inbox. > > This raises the obvious question: Who can do that? And, well, the default answer is anybody.... > > "\[T\]his means that we’re dealing with things now with the crude tools of instance blocks or allow list based federation; and these are tools which are necesssary, but not sufficient." What could possibly go wrong? As Christine says > "\[T\[here is nothing about Mastodon or the fediverse at large (including the core of ActivityPub) which specifically prevents nazis or other entities conveying undesirable messages (including spam) from entering the network" [Conill](https://ariadne.space/2019/01/07/activitypub-the-worse-is-better-approach-to-federated-social-networking/?ref=thenexusofprivacy.net) cites a specific example of ActivityPub's limitations, relating to instances you’ve banned still being able to see threads from your instance: > "What happens with this is that somebody from a third instance interacts with the thread and then the software (either Mastodon or Pleroma) reconstructs the entire thread. Since there is no authentication requirement to retrieve a thread, these blocked instances can successfully reconstruct the threads they weren’t allowed to receive in the first place." Christine also notes that a last-minute addition to the spec means that "we cannot proceed to make the system much safer to use without throwing out `sharedInbox` since we will lose our ability to make intentional, directed messages." Of course, these design flaws can be worked around to some extent. In addition, ActivityPub could evolve to better address harassment. [LitePub](https://litepub.social/?ref=thenexusofprivacy.net), for example, included [OCAP functionally](https://ariadne.space/2019/06/27/what-is-ocap-and-why.html?ref=thenexusofprivacy.net) in an ActivityPub-compatible protocol suite; [A better moderation system is possible for the social web](https://blog.erinshepherd.net/2022/11/a-better-moderation-system-is-possible-for-the-social-web/?ref=thenexusofprivacy.net) and [OcapPub: Towards networks of consent](https://gitlab.com/spritely/ocappub/blob/master/README.org?ref=thenexusofprivacy.net) both also describe potential paths forward. To date, though, none of these have gotten significant traction in the ActivityPub Fediverse, although Christine Lemmer-Webber's and Jessica Tallon's work at [Spritely Institute](https://spritely.institute/?ref=thenexusofprivacy.net) continues to build on these ideas. ## 2018-2021 A lot of my interest in Mastodon in 2017 was whether it could be a useful platform for grassroots activism (a topic I briefly discussed in my Open Source Bridge presentation [Grassroots activism is hard. Can open source help?](https://docs.google.com/presentation/d/1CzB8Wj1gj8NTlmC4XYbYReXEjsEHPHOTp9-KwXHULD4/edit?ref=thenexusofprivacy.net#slide=id.g1e6b10d98c%5F0%5F70https://docs.google.com/presentation/d/1CzB8Wj1gj8NTlmC4XYbYReXEjsEHPHOTp9-KwXHULD4/edit#slide=id.g1e73da5d9a%5F0%5F1)). It's still an interesting question to me; as Flowers points out on Twitter [Mastodon's anti-virality is a challenge for activism in general](https://twitter.com/shengokai/status/1594143042789085187?ref=thenexusofprivacy.net), but then again intersectional activists used Twitter very effectively even before affordances like quote tweets were supported. But in 2017, the answer for Mastodon was clearly "no", both because of the whiteness and key functionality limitations. So I stopped spending as much time on Mastodon, although kept my accounts and continued to pop my head in from time to time. I was lucky enough to have chosen instances that were well-moderated, 2SLGBTQIA+-friendly, and had zero tolerance for racist abuse, so my personal experiences have been generally positive. Obviously, though, that's not true for everybody. Since I wasn't as present on Mastodon during this time, my notes are much sketchier. So rather than a detailed chronology of this timeframe, I'm just going to sketch some highlights. ### The patterns continue ... [![Twitter rival Mastodon isn’t safe from online mobs either. The mass reporting of actor Wil Wheaton prompts the platform to examine its moderation tools](https://thenexusofprivacy.net/content/images/2022/11/Screen-Shot-2022-11-26-at-1.28.34-AM.png)](https://www.theverge.com/2018/8/31/17801404/mastodon-harassment-wil-wheaton-mobs-twitter?ref=thenexusofprivacy.net) [Megan Farokhmanesh reporting on the Battle of Wil Wheaton for The Verge, August 2018](https://www.theverge.com/2018/8/31/17801404/mastodon-harassment-wil-wheaton-mobs-twitter?ref=thenexusofprivacy.net) The impact of the 2SLGBTQIA+ community on Mastodon continues. As queer, trans web developer David Wolfpaw (founder of the [tech.lgbt](https://tech.lgbt/explore?ref=thenexusofprivacy.net) Mastodon community) says in [Can Mastodon be a Twitter refuge for marginalized groups?](https://www.fastcompany.com/90817452/can-mastodon-be-a-twitter-refuge-for-marginalized-groups?ref=thenexusofprivacy.net) (2022) > “I cannot count the number of people who I’ve seen and followed…on Mastodon and then come and realize more things about their gender identity, their sexual orientation, their different community markers. A lot of people, and I myself would be included as well, have said that exposure to new, different types of identities in a space \[where\] it’s safe to ask questions, it’s safe to learn from others and generally not be instantly harassed has been very helpful.” And marginalized members of the community have continued to drive significant innovation on Mastodon – often without being credited. For example: - [Artist Marcia X created the #FediBlock hashtag](https://subscriptions.boricua.style/fediblock-a-tiny-history-2/?ref=thenexusofprivacy.net) for admins and users to share information about instances spreading harassment and hate, and long-time Mastodonian Ginger immediately helped by spreading it to faer networks and normalizing its use. In 2025, this hashtag remains an extremely valuable resource, and newer projects like [The Bad Space ](https://thenexusofprivacy.net/the-bad-space/)(TBS) build on it. However, various "fediblock" sites and accounts have popped up over the years without any credit – or compensation – to the original creators. Since Marcia X is an Afro-Indigenous Caribbean artist, this is also a good example of the fediverse's anti-Blackness. (The section below on playvicious.social discusses another episode of anti-Blackness directed at Marcia X and others.). As Albinanigans says in [So Your Black Ass Still Wants to Get on Mastodon](https://qcb.neocities.org/mastodon?ref=thenexusofprivacy.net) > "FediBlock was started by a Person of Color to help marginalized identities stay safe on the Fediverse. Don't let them whitewash its history. - Cassian’s [I left Mastodon yesterday](https://cassolotl.medium.com/i-left-mastodon-yesterday-4c5796b0f548?ref=thenexusofprivacy.net) and [I left Mastodon 27 days ago](https://cassolotl.medium.com/i-left-mastodon-27-days-ago-ae34919290e1?ref=thenexusofprivacy.net) (June 2018) document the community-led deveopment of keyword filtering and important muting improvements – and the lack of credit. > "In the last few weeks, I have made a UI suggestion with a mock-up and one without, and Gargron implemented both, but he didn’t acknowledge me or reply to me or thank me for my contributions at any point. He just did it. When I mentioned this on Mastodon, someone replied and said exactly what I was expecting — that working on open source projects is a thankless job and that’s just how it is, it’s the culture, get used to it. (I did also get a lot of grateful and kind and supportive replies, to be fair.)" Valens [quotes](https://www.dailydot.com/debug/mastodon-fediverse-eugen-rochko/?ref=thenexusofprivacy.net) Hoodie Aida Krisstina on the issue of credit: > “Evidently sometimes what \[Rochko\] does is take the pull request, close it, use that code as a starting point, then later commit it himself,” Krisstina said in an email. “This, tied with how \[Rochko\] credits others (read: he doesn’t, except for GitHub commit history), means that there is very little evidence, and virtually no recognition for the folx that actually made a feature happen. Other problematic patterns that were established in the Mastodon's first year have also continued. A few examples: - In May/June 2018, the initial implemention of [trending hashtags](https://github.com/mastodon/mastodon/issues/271?ref=thenexusofprivacy.net) – with no ability for site admins to turn the feature off – led to a [firestorm](https://github.com/mastodon/mastodon/issues/271?ref=thenexusofprivacy.net#issuecomment-394026852) of [criticism](https://github.com/mastodon/mastodon/issues/7702?ref=thenexusofprivacy.net#issuecomment-394041017) from people who saw it as clashing with Rochko's claim that Mastodon had "a focus on user experience and anti-abuse tools." As maloki [said](https://github.com/mastodon/mastodon/issues/7702?ref=thenexusofprivacy.net#issuecomment-394039200), "You can't have anti-abuse tools by actively creating tools that are very likely to be used for abuse, without consulting people who know and understand anti-abuse." Cassian’s [I left Mastodon yesterday](https://cassolotl.medium.com/i-left-mastodon-yesterday-4c5796b0f548?ref=thenexusofprivacy.net) and hoodieaidakitten's [Mastodon’s Complicated Relationship with Queer Activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=thenexusofprivacy.net) have some additional discussion. The feature was eventually removed, and an improved implementation was released in 2019\. - August 2018's [Battle of Wil Wheaton](https://old.reddit.com/r/OutOfTheLoop/comments/9bimug/why%5Fdid%5Fmastodon%5Frun%5Foff%5Fwil%5Fwheaton/e57gknd/?ref=thenexusofprivacy.net) highlighted both the strength of Mastodon's 2SLGBTQIA+ community ([workingdog\_'s Twitter thread](https://twitter.com/workingdog%5F/status/1035544368575401985?ref=thenexusofprivacy.net) provides important context ommitted from most [mainstream narratives](https://www.theverge.com/2018/8/31/17801404/mastodon-harassment-wil-wheaton-mobs-twitter?ref=thenexusofprivacy.net)) and Mastodon's weaknesses in dealing with harassment. Nolan Lawson's [Mastodon and the challenges of abuse in a federated system](https://nolanlawson.com/2018/08/31/mastodon-and-the-challenges-of-abuse-in-a-federated-system/?ref=thenexusofprivacy.net) has some good observations. ### Accessibility [Once the underlying software supported alt-text](https://github.com/mastodon/mastodon/issues/117?ref=thenexusofprivacy.net), much of Mastodon adopted a norm of putting descriptions on images – and not boosting images that don't have alt-text. Even though the software continues to have problems when used with assistive technologies, a vibrant accessibility community has emerged on Mastodon. Community-related resources include - [Changeling’s Guide to Mastodon for Screen Reader Users](https://www.starshipchangeling.net/mastodon/?ref=thenexusofprivacy.net) - The highly-accessible [Pinafore](https://pinafore.social/?ref=thenexusofprivacy.net) web client, created by Nolan Lawson. Lawson's [What I’ve learned about accessibility in SPAs](https://nolanlawson.com/2019/11/05/what-ive-learned-about-accessibility-in-spas/?ref=thenexusofprivacy.net) discusses some of the key learnings from this client, and acknolwedges accessibility expert Marco Zehe's "patient coaching" and [comments on the Pinafore GitHub repo](https://github.com/nolanlawson/pinafore/issues?q=is%3Aissue+author%3Amarcozehe+is%3Aclosed&ref=thenexusofprivacy.net) as a "treasure trove of knowledge." - Sarah Higley's [An oversimplified guide to setting up Mastodon](https://sarahmhigley.com/writing/mastodon/?ref=thenexusofprivacy.net) (including detailed screenreader instructions) - The [toot.cafe fork](https://github.com/tootcafe/mastodon?ref=thenexusofprivacy.net), with better support for underlining links However, Mastodon's mainline code has refused to accept the fixes for underlined links, so most instances only support underlined links in high-contrast mode, [not in the default themes](https://github.com/mastodon/mastodon/pull/9898?ref=thenexusofprivacy.net#issuecomment-456811331). As Adrian Roselli pointed out in [a heated 2019 github discussion](https://github.com/mastodon/mastodon/pull/9898?ref=privacy.thenexus.today#issuecomment-456419500) this means that sites running vanilla Mastodon are in violation of WCAG guidelines – and aren't usable for a lot of people. And Mastodon's mainline code is still not fully accessible. Important improvements like [providing another option besides hovertext to see alt-text](https://github.com/mastodon/mastodon/issues/8237?ref=thenexusofprivacy.net) haven't been addressed for years. Running a simple accessibility checkers like the [axe DevTools plugin](https://chrome.google.com/webstore/detail/axe-devtools-web-accessib/lhdoppojpmngadmnindnejefpokejbdd?hl=en-US&ref=thenexusofprivacy.net) reveals many easily-fixed errors that could affect screenreader use. ### playvicious.social > "I didn't even realize how special it was until I experienced it through the eyes of people that experienced our dynamic for the first time. Honestly, I didn't have any grandiose ideas to make PV this unique thing that was separate from the other instances in the fedi. It just was because that's what we were." > > – Ro, in [Recuerda PV : Chapter 5 - The Rise of PV, Pt. 1](https://roiskinda.cool/2023/01/recuerda-pv-chapter-5-the-rise-of-pv-pt-1.html?ref=thenexusofprivacy.net), January 2023 > **"Ra’il**: What do you think about the legacy of PlayVicious, or, more specifically, how do you want it to be remembered? > > **Marcia**: For one, I don’t want PV to be forgotten. #PVRecuerda!!! (only the real ones will know). I feel strong, positive emotions about PV at the end of the day. What a vibe, what a time. > > We had the most dynamic space the fediverse has seen (I stand by that still to this day). The chemistry was perfect and we had some really amazing moments there. From long, difficult conversations regarding society to just having fun with movies and food, that instance, those years there, really brought out my creativity and how I can engage and socialize with other people. > > We were targeted, we were endlessly harassed, but those things won’t shadow the positives of PV." > > – Marcia X and Ra’il I'Nasah Kiam, in [Blackness in the Fediverse](https://logicmag.io/policy/blackness-in-the-fediverse-a-conversation-with-marcia-x/?ref=privacy.thenexus.today), *Logic, December 2023* For several years, playvicious.social was the highest profile Black-led instance on Mastodon. In Sean Captain's [Can Mastodon be a Twitter refuge for marginalized groups?](https://www.fastcompany.com/90817452/can-mastodon-be-a-twitter-refuge-for-marginalized-groups?ref=thenexusofprivacy.net) (2022), PlayVicious co-founder and moderator Marcia X (also the creator of the #FediBlock hashtag) recalls that the instance was under attack from its founding in 2017, but then harassment escalated in 2019 and again after the George Floyd uprising began in mid-2020\. Here's how Marcia X described it in [Ecosystems of Abuse](https://www.artistmarciax.com/post/ecosystems-of-abuse?ref=thenexusofprivacy.net) > "In 2019, after a white passing person and Black person had a public run in with one another, several issues came to the surface. Misgendering, white women/femmes making comments to Black men that make them uncomfortable, the politics of white passing people as they engage with darker folks, and slurs as they are used intracommunally—these are not easy topics but at some point, they do become necessary to discuss." In [Can Mastodon be a Twitter refuge for marginalized groups?](https://www.fastcompany.com/90817452/can-mastodon-be-a-twitter-refuge-for-marginalized-groups?ref=thenexusofprivacy.net), Marcia X notes > "It’s one thing to have people say ridiculous things in your mentions, but it was a proper harassment campaign—stalkers, cyber stalkers, bots scraping my accounts, people squatting on your timeline and taking screenshots of it and posting it elsewhere. Our safety was starting to become a real risk and also our mental health for that matter.” As Are0h says in [Recuerda PV : Chapter 7 - The Dark and Ugly](https://roiskinda.cool/2023/12/recuerda-pv-chapter-7-the-dark-and-ugly.html?ref=thenexusofprivacy.net) > "The most interesting part for me wasn't the accusations because they always happen. I don't mind accusations because misunderstandings happen. What got my attention was the glee and enthusiasm many people displayed when attacking us. I say attacking specifically because these places did not attempt to have a civil conversation about perceived slights and misunderstandings so that a safe space could be created amid conflict. There was no space to air our grievances so we could address them for community building. From my perspective, it seemed many just wanted the abuse to continue, which prompted our decision to eliminate communication with other popular instances. > > I wish I could say the abuse subsided eventually, but that is not the case. As popular as PV was, there was a sizeable contingent of people who did not want us to exist in the fedi. It felt that there was more patience for outright white nationalist and Nazi-sympathizing instances in the fedi than there was for a place that centered on the needs of Black and Brown people and was unapologetic about creating a space for them." PlayVicious shut down in late 2020\. From weirder.earth's [Goodbye Playvicious.social](http://weirderearth.de/goodbyepv.html?ref=thenexusofprivacy.net) statement from early 2021: > "Playvicious was harrassed off the Fediverse.... The Fediverse is anti-Black. That doesn't mean every single person in it is intentionally anti-Black, but the structure of the Fediverse works in a way that harrassment can go on and on and it is often not visible to people who aren't at the receiving end of it. People whom "everyone likes" get away with a ton of stuff before finally \*some\* instances will isolate their circles. Always not all. And a lot of harrassment is going on behind the scenes, too." ### Gab ![The Nazi-Free Alternative to Twitter Is Now Home to the Biggest Far Right Social Network Gab, which has been used frequently by neo-Nazi terror groups to organize and recruit, is now the biggest node on the Mastodon network. Ben Makuch](https://thenexusofprivacy.net/content/images/2022/12/Screen-Shot-2022-12-07-at-9.16.55-AM.png) > "\[L\]ast week, the social network Gab [migrated to Mastodon](https://www.vice.com/en%5Fus/article/mb8y3x/the-nazi-free-alternative-to-twitter-is-now-home-to-the-biggest-far-right-social-network?ref=thenexusofprivacy.net) — and Mastodon’s admins have been forced to deal with the internet’s Nazi problem head-on. > > The response has been messy." > > – Adi Robertson, [How the biggest decentralized social network is dealing with its Nazi problem](https://www.theverge.com/2019/7/12/20691957/mastodon-decentralized-social-network-gab-migration-fediverse-app-blocking?ref=thenexusofprivacy.net), July 2019 > "We are opposed to Gab’s philosophy, which uses the pretense of free speech absolutism as an excuse to platform racist and otherwise dehumanizing content.... While the Mastodon software is free for everyone to use and modify, our world view could not be further from Gab’s." > > – Eugen Rochko, [Gab switches to Mastodon’s code](http://blog.joinmastodon.org/2019/07/statement-on-gabs-fork-of-mastodon/?ref=thenexusofprivacy.net), July 2019 Far-right "free speech" social network Gab was [deplatformed](https://www.theverge.com/2018/11/5/18049132/gab-social-network-online-synagogue-shooting-deplatforming-return-godaddy-paypal-stripe-ban?ref=thenexusofprivacy.net) by their domain registrar and web hosting company in October 2018 due to their refusal to moderate anti-Semitic comments. By early 2019, however, they were back online, and adopting Mastodon appeared to give them a way around [Apple's and Google's ban on their mobile apps](https://www.theverge.com/2017/8/18/16166240/gab-google-play-removed-hate-speech?ref=thenexusofprivacy.net) – indeed, Ben Makuch's [Mastodon Was Designed to Be a Nazi-Free Twitter—Now It’s the Exact Opposite](https://www.vice.com/en/article/mb8y3x/the-nazi-free-alternative-to-twitter-is-now-home-to-the-biggest-far-right-social-network?ref=thenexusofprivacy.net) quotes a statement from Gab as saying they were "now unstoppable". Despite the clash in values, Mastodon's open-source license allowed Gab (or anybody else) to use their software. In [Decentralized Networks vs The Trolls](https://drive.google.com/file/d/1yqBf04R2swiFDT1jEMUBDQQGgAGS9cx9/view?ref=thenexusofprivacy.net), Derek Caelin quotes Catgirl, the administrator for LGBTQIA.is, on their experience when Gab entered the scene: > “I remember when Gab first came out, I checked it out and immediately you had one of the guys saying to ‘shove jews back on a train’...that goes beyond a “freedom of speech” server, it’s more of a freedom to incite violence server.” The community reacted strongly: - Rochko quickly defederated Gab from mastodon.social, and most other Mastodon instances did the same. Some instances went even further; Caelin quotes mastodon.technology admin Ash Furrow explaining his decision to not only defederate his server from Gab, but even from instances that federate with Gab. - Mobile apps including Tusky, Toot!, Mast, and Amaroq blocked Gab as well. - Rochko introduced the new [Mastodon Server Covenant](https://joinmastodon.org/covenant?ref=thenexusofprivacy.net) and announced that the official website joinmastodon.org would only promote servers that "commit to standing up against racism, sexism, homophobia and transphobia." As a result, Gab was largely isolated. Other fediverse software reacted similarly. Pixelfed's lead developer Daniel Supernault, for example, blocked Gab domains, added community guidelines, and introduced newfunctionality including domain blockings and CWs on comments, [adding](https://mastodon.social/@pixelfed/102380162586932574?ref=thenexusofprivacy.net) > "Fascists and Nazis can h\*ck right off and are NOT welcome on our platform." ### Does Mastodon really prioritize stopping harassment? > I’m on Mastodon, begrudgingly.... My harassers are also on Mastodon; some have multiple accounts. The blocking feature is like horror house anxiety game- I block when I see their new account, hoping I’ve now blocked all of them but knowing I probably never will. Because it’s a federated system, and you can have accounts on multiple servers, it means there’s multiple accounts I have to block to create some digital safety and distance. > > – Caroline Sinders, [I’m @Sinders on Mastodon but I’m not giving up on Twitter, yet](https://medium.com/@carolinesinders/im-sinders-on-mastodon-but-i-m-not-giving-up-on-twitter-yet-5dcd4fb810e1?ref=thenexusofprivacy.net), October 2022 For a platform that supposedly prioritizes anti-abuse Mastodon's lack of progress on this over the last several years is really striking. Of course, harassment and marginalization isn't fundamentally a technology issue. Still, software can help to mitigate problems. Even though Twitter is filled with racist, ablist, and anti-2SLGBTQIA+ hate and harassment, improvements like being able to limit replies and tools like Block Party have made a huge difference to Black Twitter, disability Twitter, and activists. Mastodon still doesn't have any of these improvements. And not to sound like a broken record, but *Mastodon intentionally doesn't support local-only posts*. By allowing people to prevent their posts from shared with other instances (who might have harassers, terfs, nazis, and/or admins or software that doesn't respect privacy), local-only posts significantally reduce the risk of harassment and pileons – and avoid the privacy risk of messages being shared with other instances. As Hometown maintiner Darius Kazemi notes on Run [Your Own Social ](https://runyourown.social/?ref=thenexusofprivacy.net), local-only posts are also useful from an enforcement perspective because they create "serious social repercussions for violating rules to the point where you're kicked off of a server." This functionality has been available in forks since 2017, but Mastodon's BDFL has blocked them from the main codebase – and admis of almost every large instance (with the exception of infosec.exchange) choose not to run forks with this anti-harassment protection, so it's not available to most users. There are also examples where Mastodon has decided not to implement functionality. In [Cage the Mastodon](http://blog.joinmastodon.org/2018/07/cage-the-mastodon/?ref=thenexusofprivacy.net) (July 2018) Rochko wrote > **Mastodon deliberately does not support arbitrary search**. If someone wants their message to be discovered, they can use a hashtag, which can be browsed. [Rochko made this decision early on](https://mastodon.social/@Gargron/4947733?ref=thenexusofprivacy.net) to reduce the risk of harassment. Considering possibilities for abuse before implementing functionality is an important principle. However, here's public and unlisted posts are by default being accessible to other instances, search engines and bad actors, protection is limited (see [Mastodon privacy: you can’t really opt out of search engine indexing](https://thenexusofprivacy.net/mastodon-privacy-remember-that-public-and-unlisted-posts-can-be-indexed-by-search-engines/) for more discussion). These kind of speed bumps can be helpful for reducing harassment, but also can lead to misset expectations – leading people to believe they're safer than they really are. As [What does AUTHORIZED\_FETCH actually do?](https://hub.sunny.garden/2023/06/28/what-does-authorized%5Ffetch-actually-do/?ref=thenexusofprivacy.net) on the *Sunny Garden Hub* describes, Mastodon does support mechanisms that can provide more protections, – but the implementation has unfortunate (and in some cases completely unnecessary) side effects, so once again most large instance admins don't prioritize protecting their users. Rochko has also chosen not to include any quoting feature because in his view "[it inevitably adds toxicity to people's behaviours](https://mastodon.social/@Gargron/99662106175542726?ref=thenexusofprivacy.net)." This decision has led to a lot more controversy, and for good reason. As Dr. Andre Brock discusses in *Distributed Blackness*, Twitter's quote tweets are a key affordance for allowing Black users to engage in digital equivalents of long-standing cultural practice like call and response and playing the dozens. elizabeth veldon [notes](https://indieweb.social/@elizabethveldon@mastodon.scot/109347263587337101?ref=thenexusofprivacy.net) that some autistic people also find quote tweets valuable for communicating empathy: "we do this by relating an incident we feel relates to or, to some extent, mirrors the experience of the person we are talking to. to deny us this is to limit our ability to communicate." [Black Twitter, quoting, and white views of toxicity on Mastodon](https://thenexusofprivacy.net/black-twitter-quoting-and-white-toxicity-on-mastodon/) lists several other positive uses of quote tweets. It's certainly true that quote tweets can be used for dogpiling and other kinds of harassment, but as the examples here illustrate the absence of quoting certainly hasn't made Mastodon immune to these problems! As Hilda Bastian says in [Reflecting on Twitter, White Flight, & “Quote Tweet” Tensions at Mastodon](https://absolutelymaybe.plos.org/2022/12/01/reflecting-on-twitter-white-flight-quote-tweet-tensions-at-mastodon/?ref=thenexusofprivacy.net) > "From what I’ve read in github discussions on potentially developing a quote boost affordance, though, it doesn’t look as though data, formal experiments, and wide community participation have played a major role." Flowers discusses some of the impact of this decision in [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net), and goes into more detail in several of his [Mastodon and Twitter migration threads](https://twitter.com/shengokai/status/1590871165677240320?ref=thenexusofprivacy.net). ## The view from 2022 ![New mastodon accounts (daily). The peak is at 175k on November 17 after Musk's Twitter 2.0 utlimatum, stabilizing at about 50k](https://thenexusofprivacy.net/content/images/2022/12/mastodon-user-growth.png) Mastodon user growith, [charted by @estabanmoro@datasci.social](https://datasci.social/@estebanmoro/109429814361434072?ref=thenexusofprivacy.net), November 30 Like a lot of people, I got involved again this year as a result of Twitter's new management. The Fediverse's decentralized, open-source, ad-free model remains appealing, and there's a sense of excitement with so many people tasting the possibilities of social network that's not run by surveillance capitalists using deceptive design and algorithms to maximize ad revenue. If you're on a well-moderated instance and not the target of harassment, Mastodon in 2022 can be a good experience (albeit confusing for many, including me, and still very white) – especially if you like talking about Mastodon, which continues to be the most popular topic there! So it's been great to meet interesting new people, econnect with other "old-timers", and connect with people I know from Twitter. Mastodon 2022 has a lot of similarities to Mastodon 2017\. Some of this is good! Mastodon's trans- and queer-friendliness continues. Community-contributed tools like fedifinder.glitch.me, Debirdify, and Movetodon have played an important role at helping people reconstruct Twitter networks on Mastodon. But some of the similarites are depressing ... and infuriating. > "It took me eight hours to get a pile of racist vitriol in response to some critiques of Mastodon." > > – Dr. Johnathan Flowers, [The Whiteness of Mastodon](https://techpolicy.press/the-whiteness-of-mastodon/?ref=thenexusofprivacy.net) And "CW discourse" rages on. Content Warnings are an excellent feature; opinions differ about which posts should be CW'ed. The dynamic Hart described of white people using CWs to "restrict the domain of public discourse to only those things which made them feel comfortable" remains; as Flowers says > "\[S\]ome of the arguments for content warnings, or at least the majority of them, at least in my view, come down to an attempt to preserve a particular white entitlement to comfort or freedom from racialized stress through the ways in which whiteness is held center as an inheritance of the platform.... > > Part of the conflict over content warnings has motivated some of the responses of “move to your own instance where you can use content warnings however you see fit.” "Move to your own instance" is often combined with a suggestion that "once there are some Black-led instances that'll solve the problem" It's true that the instance you're on has a huge effect on your experience, and the existence of sites like blacktwitter.io is a very good thing. But neither of these suggestions reflect the realities of racism on Mastodon and in the broader fediverse. As Ehh (a Black woman who like so many other people in the fediverse chooses not to use their "real name") says, it's a VERY weird experience that so many white people are suggesting segregation as a tool for solving the problems that Black people are encountering here – and it's "nefarious to tell people who’ve been systematically oppressed via segregation to use it as a tool for safety." Dr. Chandra Prescod-Weinstein, who was welcomed to Mastodon with racist abuse just like Creatrix Tiara was in 2017, identifies yet another depressingly infuriating continuing pattern. !["white people explaining to people of color that they are facing racism on mastodon because they are using mastodon wrong" is a genre that needs to die in a fucking fire. ](https://thenexusofprivacy.net/content/images/2022/11/Screen-Shot-2022-11-26-at-1.12.51-AM.png) [@IBJIYONGI on Twitter](https://twitter.com/IBJIYONGI/status/1592624334908055564?ref=thenexusofprivacy.net) That said, there are also some very important differences in Mastodon 2022\. For one thing, many of the critical voices I've quoted here have stayed involved and continue to work towards more inclusive and equitable solutions, so there's a huge amount of expertise available. And the infosec community has been on Mastodon for years, so who knows, we might actually get [end-to-end encrypted direct messages](https://github.com/soatok/mastodon-e2ee-specification?ref=thenexusofprivacy.net) one of these days. Not only that, as the Twitter hellscape increases the urgency of finding alternatives, the latest influx is bringing a lot of people who care passionately about creating anti-oppressive spaces. As well as the work that people like Flowers and Costanza-Chock are doing to highlight Mastodon's challenges and opportunities to do better, there are enough new Mastodonians with anti-oppressive design and UX skills that rapid progress is possible. Culturally, it's very hard to change norms on a development team run by a BDFL, so it's likely that forks will continue to take the lead. New implementations compatible with Mastodon are also possible; [Bonfire](https://bonfirenetworks.org/?ref=thenexusofprivacy.net), for example, has been in development for a while, and [Tumblr is planning on supporting ActivityPub](https://techcrunch.com/2022/11/21/tumblr-to-add-support-for-activitypub-the-social-protocol-powering-mastodon-and-other-apps/?ref=thenexusofprivacy.net). As EFF says, [The Fediverse Could Be Awesome (If We Don’t Screw It Up)](https://www.eff.org/deeplinks/2022/11/fediverse-could-be-awesome-if-we-dont-screw-it?ref=thenexusofprivacy.net). It's also very hard to change norms and introduce more diversity on social networks As Twitter's evolution shows, it's not impossible: originally very white and very male, it evolved to play a key role in the #MeToo movement and become a home to Black Twitter. Of course, deeply-rooted inequities and norms never go away; racism, transphobia, and sexism on Twitter remained huge problems even before the new management decided to double down and make them the selling points of "Twitter 2.0." Still, for a while it was pretty darn good in a lot of ways, and Mastodon could follow a similar path. ![](https://thenexusofprivacy.net/content/images/2022/11/Screen-Shot-2022-11-26-at-10.46.20-AM.png) [@inquiline@mastodon.social on Mastodon](https://mastodon.social/@inquiline/109407004905813992?ref=thenexusofprivacy.net) Then again, whiteness resists change. As Are0h [says](https://indieweb.social/@Are0h@ubiqueros.com/109408542850716741?ref=thenexusofprivacy.net) > "It's culture. And whiteness, as Du Bois identified years ago, is committed to fighting to assert itself in yet another new space." Unfortunately a lot of the dynamics of the Twitter exodus risk reinforcing power inequities and racial disparities on Mastodon in the broader fediverse. One obvious factor is the high-profile examples of harassment of people of color (especially women and non-binary people), combined with so many white people talking about how much better they like Mastodon and giving less-than-helpful advice to POC. The failure of many instances to block sites that are well-known for shitposting and harassment makes the problem worse. And even after [mistakes have been admitted](https://mobile.twitter.com/joinmastodon/status/1594798429590507520?ref=thenexusofprivacy.net), and promises made to do better, the high-profile suspensions of women of color on flagship instances run by Rochko (including [Tracy Chou](https://twitter.com/triketora/status/1594348646396559361?ref=thenexusofprivacy.net), creator of Block Party!) also send a signal to POC that maybe Mastodon isn't the place for them. And those issues are just the tip of the iceberg. - How many of the journalists looking at Mastodon as an alternative are even talking about the racial and gender disparities and the long history of marginalization? - How many instances recommendations of who to follow are mostly white and mostly male? - While community-contributed tools like fedifinder.glitch.me, Debirdify, and Movetodon that let people find folks they know from Twitter on Mastodon are extremely helpful, bulk-importing contacts risks magnifying racial and gender disparities. White people are mostly following other white people, and research on other platforms show that white people are more likely to amplify white people, so one likely outcome is steadily-increasing disparities. - And of course there's the longstanding issue of white users telling people of color to put content warnings on discussions about race. As Flowers says: > "Insofar as instances inherit whiteness, the content warning conversation, at least in my view, is an argument over whether or not Mastodon should continue to maintain its inheritance of whiteness because as Ahmed says, “One of the challenges for white people is rejecting this inheritance.”" And it's not just whiteness; the same's true for cis-normativity and ablism. So maybe Mastodon and the Fediverse as a whole won't evolve. We shall see. More positively, though, new instances like blacktwitter.io and dair-community.social are having an impact. Black Aziz Ananzi's #BlackFriday #BlackMastodon #BlackJoy hashtag activism is extremely encouraging.\*\*\*\*\* So whether or not Mastodon evolves, the most exciting potential path forward is for sites with anti-oppressive values to form a loose coalition – an extended version of the "alliance" that toot.cat admins discussed [back in 2017](https://toot.cat/@jdp23/981935?ref=thenexusofprivacy.net) – with relatively-strong connections internally and much more limited connections to the broad fediverse. If white-led sites are willing to follow the lead of sites with BIPOC leadership, and there's funding for diverse BIPOC-led teams to drive improvements to Mastodon and/or new decentralized software platforms (as well as moderation; Costanza-Chock and Kazemi have both proposed moderation collectives), that could lead to a great outcome. However it plays out, an honest look at Mastodon's history is vital for acknowledging, correcting, and making reparations for past harms – and understanding how to do better going forward. So let's close with a pair of quotes, one from 2022 and the other from back in the day, that highlight the potential, what needs to happen, and how little has changed. > "For Mastodon to not only supersede Twitter but to thrive in its own merit, it needs to not only listen to the vulnerable among us, but implement changes for a better Internet culture. The tools have been there, and so have been their highlighted shortcomings. > > Now what will they make of it?" > > – Albinanigans, [Background Radiation](https://raintreeruckus.com/background-radiation/?ref=thenexusofprivacy.net), on *Raintree Ruckus,* December 2022 > "As it stands, Mastodon is not well-equipped for serving disparate communities’ needs. There is but one version of the software, with no established means of extension; there are no advocacy positions or research projects by which communities can make themselves known; the development pipeline seems hardly attentive to or even aware of the specific communities which its product serves. These are all things which will have to change for the project to be able to accommodate anything more than its loudest majority." > > – Allie Hart, [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=thenexusofprivacy.net), April 2017 --- ## Follow-on posts, not yet integrated here - [Mastodon, two years later](https://thenexusofprivacy.net/mastodon-two-years-later/) - [A tale of two prototypes](https://thenexusofprivacy.net/a-tale-of-two-prototypes-2/), including a deep dive on [Mastodon 2017 and Glitch 2017](https://thenexusofprivacy.net/p/279f20a3-be31-436a-810d-bb25166957ad/#2017) - [A faux “Eternal September” turns into flatness](https://thenexusofprivacy.net/flatness/) ## Update log - ongoing: minor fixes and additions in response to feedback and as I discover new links - December 1, 2022: add new section on Mastodon and the Fediverse, and per-year section headings - December 3-4: add new sections on ActivityPub, Playvicious.social, and accessibility; rework the **View from 2022** section - January 14 2023: add link to [Mastodon WTF timeline](https://ansuz.sooke.bc.ca/entry/335?ref=thenexusofprivacy.net) - June 28 2023: changes to the [Does Mastodon really prioritize stopping harassment?](#does-mastodon-really-prioritize-stopping-harassment) section - May 29, 2024: revise [Before Mastodon: GNU social and the early fediverse](#pre-history) and move it to its own section; add section on [Gab](#Gab); remove the (DRAFT) from the title - September 2-3, 2024: expand, rework, and rename the pre-history section, now titled to [Before Mastodon: GNU social and other early fediverses](#pre-history), as first step in updatng the next major update. Restore (DRAFT) to the title. - September 7-8: more work on pre-history section, and discussion of why this is still a draft - October 22: more work on pre-history, add terminology note. - December 30: update PlayVicious section - January 9, 2025: add *Seven Theses* quotes - August 2025: update *ActivityPub* section, links to follow-on posts ### Addendum: Why is this still a DRAFT over two years after first publishing it? For one thing, I'm working on the follow-on, [Mastodon, two years later](https://thenexusofprivacy.net/mastodon-two-years-later/), and that's likely to lead to some changes – for example, [A tale of two prototypes](https://thenexusofprivacy.net/a-tale-of-two-prototypes-2/) and [Mastodon 2017 and Glitch 2017](https://thenexusofprivacy.net/p/279f20a3-be31-436a-810d-bb25166957ad/#2017) belong at the end of the 2017 chapter. And there's still some important stuff missing, especialy from 2018-2022 – more detailed discussions of the role of forks (a topic Margaret KIBI dives into in 2019's [Progressing: Fringe Mastodev](https://www.u2764.com/NFIC/2019-09-15/fringe-progress/?ref=thenexusofprivacy.net)), Mastodon gGmbH getting non-profit status, mobile apps, more on the implications of Mastodon's 2017 embrace-extend-extinguish of OStatus followed by its embrace-extent of ActivityPub (discussed in December 2023's [Embrace, Extend, and Exploit: Meta’s plan for ActivityPub, Mastodon and the Fediverse](https://thenexusofprivacy.net/embrace-extend-and-exploit/)), and so on. If those were the only issues, though, I'd remove the DRAFT – and in fact I did for a while. But more importantly, this was written before I had settled on the terminology I'm now using of many fediverse along with a Fediverse that means different things to different people, and that's fundamental enough that I feel it needs to be reflected here. So I put the DRAFT back on. Oh well. ## Notes \* [rot13.com](https://rot13.com/?ref=thenexusofprivacy.net) is a handy ROT13 decoder \*\* additional implmentation [in December](https://github.com/glitch-soc/mastodon/pull/253?ref=thenexusofprivacy.net) fixed some important loopholes related to boosting and replies. Darius Kazemi's Hometown page on [local-only posting](https://github.com/hometown-fork/hometown/wiki/Local-only-posting?ref=thenexusofprivacy.net) traces further evolution of this functionality. > This feature is based on [the work of Renato Lond](https://github.com/tootsuite/mastodon/pull/8427?ref=thenexusofprivacy.net), which is itself based on a feature in the [Mastodon Glitch Edition](https://glitch-soc.github.io/docs/?ref=thenexusofprivacy.net) fork. Third party application interactions were redesigned based on the suggestions of [@lostfictions](https://github.com/lostfictions?ref=thenexusofprivacy.net). The idea for an emoji triggering a local post comes from Mastodon Glitch Edition, and the idea for it to be a custom emoji called `local_only` comes from [@t54r4n1@mspsocial.net](https://mspsocial.net/@t54r4n1?ref=thenexusofprivacy.net). \*\*\*\*\*In the early-2023 version I also mentioned [Project Mushroom](https://www.kickstarter.com/projects/projectmushroom/project-mushroom?ref=thenexusofprivacy.net) here, nothing that it "foregrounds justice, and has paid moderators." Which was true until its founder and promoter Eric Holthaus decided to lay off the entire paid staff [sign up everybody to his email list without our consent](https://newsletters.projectmushroom.xyz/important-update-on-project-mushroom-3/?ref=thenexusofprivacy.net). Oh well. More positively, though, in early 2025 several well-respected activists have their fediverse homes on Project Mushroom's spore.social. --- Thanks to: - Everybody who gave feedback on earlier versions. Some people specifically asked not to be credited by name, so I'm not listing specific folks yet ... but I greatly appreciate all of your feedback! - Are0h, elizabeth veldon, christina d'ache, and everybody else who gave me permission to quote their Mastodon posts - revenant dyke for help with the timeline on initial implementation of local-only posts, and Artist Marcia X and Ginny for clarifying the origin of #FediBlock. - all the community members and journalists who wrote and spoke about these issues over the years - the admins and moderators on toot.cat, wandering.shop, and scholar.social for all the work over the years to create good online homes - most of all, the volunteers who helped create something that while very imperfect is still pretty amazing. Image Credit: Photo by [Credit Score Geek](https://creditscoregeek.com/?ref=thenexusofprivacy.net) via [Flickr](https://flickr.com/photos/143106192@N03/43513754712/in/photolist-29ianhd-ffhgvL-ff2YqV-ff2ZCP-ffhf3N-ffhhFs-ff32A6-ff2ZNr-ff2ZqF-2eZK1px-ff331P-LDNuvt-ffhhe1-8MDf5B-JxskS-6b2uMy-bQCfmt-274rxFB-ffhh3j-ff2YNn-EKnJvz-ffheoN-4TKt4N-McgoUj-92GWzu-67ecGp-2nKe7pu-9cPXm5-5hSE31-sade8-2jjTn4U-5NmPue-2jbupSs-7KsZ9X-cdzLtf-bH38YB-7KwPxb-7KwToA-dhPijg-6e1q5i-81CvzP-36G8tq-57vf1v-agZjw5-8rQg8G-c5wNCs-aqQx1-4sCDV2-7KsRok-5hNhYB?ref=thenexusofprivacy.net), licensed under [CC BY 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net). ### Privacy News: November 22 URL: https://thenexusofprivacy.net/privacy-news-november-22/ Last updated: 2022-11-22T19:55:33.000Z Privacy after Roe, ADPPA and KOSA in Congress, FTC comments, a big new lawsuit by Foxglove against Meta ... and that's only the tip of the iceberg. ## FTC Comments ![There is a lot of talk about protecting human privacy these days, and I think the emphasis on privacy is limiting the information available for AI development](https://thenexusofprivacy.net/content/images/2022/11/Screen-Shot-2022-11-22-at-10.18.38-AM.png) An FTC comment generated by the GPT-3 language model. The extended deadline for comments on the FTC potential rulemaking on Commercial Surveillance and Data Security was 8:59 pm Pacific time on Monday (11:59 pm Eastern) and I got mine in with well over an hour to spare. Several other Washington privacy organizers submitted comments as well as me, and so did a lot of individuals, non-profits, and businessess. Twitter is the best place to find short summaries and links to comments; for example, [here's Willmary Escoto with Access Now's comments](https://twitter.com/willmaryescoto/status/1595137879793360897?ref=thenexusofprivacy.net). [EPIC has a good overview page](https://epic.org/ftc-rulemaking-on-commercial-surveillance-data-security/?ref=thenexusofprivacy.net) with information about the process, a link to their own 232-page (!) comments, and a roundup of several other organizations' comments including [Parent Coalition on Student Privacy](https://epic.org/wp-content/uploads/2022/11/PCSP-FTC-comments-11.21.22-final.pdf?ref=thenexusofprivacy.net), [Upturn](https://www.upturn.org/static/files/Upturn-FTC-ANPR-Comment-20221121.pdf?ref=thenexusofprivacy.net), the [Irish Council for Civil Liberties, Open Markets Institute, and Trans Atlantic Consumer Dialogue](https://tacd.org/the-ftc-must-act-against-unfair-and-deceitful-commercial-surveillance/?ref=thenexusofprivacy.net), [Fight for the Future](https://www.fightforthefuture.org/news/2022-11-15-fight-for-the-future-comment-re-ftc-anpr-on-commercial-surveillance-and-data-security?ref=thenexusofprivacy.net) and more. [One of the most entertaining comments](https://www.regulations.gov/comment/FTC-2022-0053-0917?ref=thenexusofprivacy.net), submitted by former FTC Chief Technologist Neil Chilson, was text generated by the GPT-3 language model from various prompts. If you replace "AI" with "commericial surveillance", they're remarkably pithy summaries of many of the corporate submissions. My full comments, available [here](https://thenexusofprivacy.net/consent-automated-systems-and-discrimination/), framed things somewhat differently. The summary: 1. Consent is a vital complement to data minimization and completely prohibiting some commercial surveillance activities. Opt-out is not meaningful affirmative consent, and an opt-in approach to regulation will enhance innovation. (Questions 26, 73-81) 2. Algorithmic error and discrimination is pervasive across multiple sectors – and the harms fail disproportionately on the most vulnerable people. (Questions 53, 57, 65, 66, 67) 3. The FTC should build on the recommendations of Algorithmic Justice League’s [Who Audits the Auditors](https://facctconference.org/static/pdfs%5F2022/facct22-126.pdf?ref=thenexusofprivacy.net), the White House OSTP’s [Blueprint for an AI Bill of Rights](https://www.whitehouse.gov/ostp/ai-bill-of-rights/algorithmic-discrimination-protections-2/?ref=thenexusofprivacy.net), and the [California Privacy Protection Agency’s AI equity work](https://medium.com/artificial-intelligence-ai-for-social-impact/xx-22faff63228f?ref=thenexusofprivacy.net). (Questions 41-46, 56, 67) 4. The FTC should develop its regulations working with the people most likely to be harmed by commercial surveillance – and prioritize their needs. (Questions 29, 39, 43) ALSO - [The FTC must act against unfair and deceitful commercial surveillance](https://tacd.org/the-ftc-must-act-against-unfair-and-deceitful-commercial-surveillance?ref=thenexusofprivacy.net) Transatlantic Consumer Dialogue (tacd.org) - [ICCL, Open Markets, and TACD (75 NGOs) urge the U.S. FTC to crack down on surveillance advertising](https://iccl.ie/digital-data/ftc-must-act-against-commercial-surveillance?ref=thenexusofprivacy.net), Johnny Ryan on Irish Council for Civil Liberties (iccl.ie) - [The FTC can finally regulate online privacy protections](https://dallasnews.com/opinion/commentary/2022/11/21/the-ftc-can-finally-regulate-online-privacy-protections?ref=thenexusofprivacy.net), Emily Peterson-Cassin on The Dallas Morning News (dallasnews.com) ## Privacy after Roe National Women's Law Center's FTC comments focused on [the harms that people who seek, provide, or facilitate abortion care can face due to commercial surveillance](https://www.regulations.gov/comment/FTC-2022-0053-0898?ref=thenexusofprivacy.net) – the [elephant](https://thenexusofprivacy.net/what-about-the-elephant/) that American Data Privacy Protection Act (ADPPA) supporters don't want to talk about. NWLC's analysis is much more detailed than anything I've seen in ADPPA discussions. One section looks at privacy issues relating to "crisis preganancy centers", fake clinics run by anti-abortion groups, and details how Harmony International provides a CMS to its 2,000 affiliates in the US. How well does ADPPA address this threat? None of the testimony supporting the bill that I've seen discusses this. Neither do any of the op-eds. And none of the news pieces comment on this absence which you have to admit is kind of weird in a year where the Supreme Court took away pregnant people's right to an abortion and Democrats just did better than expected in midterms due to how much people care about this issue. #### [An Update on the Federal and State E-Roe-sion or P-Roe-tection of Abortion Rights](https://natlawreview.com/article/part-2-update-federal-and-state-e-roe-sion-or-p-roe-tection-abortion-rights?ref=thenexusofprivacy.net) Amy J. Dilcher on The National Law Review (natlawreview.com) A roundup of noteworthy developments that occurred over the past month, including several significant events at both federal and state levels as well as recent activity by registered voters during the midterms to protect access to reproductive care. ## Federal privacy legislation ### [Will Congress kill the push for data privacy?](https://thehill.com/opinion/technology/3743208-will-congress-kill-the-push-for-data-privacy/?ref=thenexusofprivacy.net) Marc Rotenberg on The Hill (thehill.com) Rotenberg cuts to the heart of the thorny debate about preemption in the ADPPA: > "There is a simple solution to the objection from California: Remove the language that preempts stronger state laws. If the federal bill is indeed stronger, as the backers contend, then compliance with the California law should be easy." Yeah really. But of course in reality there are a lot of ways in which California's law is stronger, and the even bigger opportunity for data brokers and big tech is that ADPPA also preempts other current *and future* state and local laws. And as Rotenberg notes, preemption is only the start. He also discusses - the weak private enforcement scheme (aka "private right of action") - the two-year delay before even the weak scheme kicks in - the way the bill's exclusion of European citizens is almost certain to sink the latest attempt to establish [a legal framework](https://www.whitehouse.gov/briefing-room/statements-releases/2022/10/07/fact-sheet-president-biden-signs-executive-order-to-implement-the-european-union-u-s-data-privacy-framework/?ref=thenexusofprivacy.net) that will permit the continued flow of personal data of European consumers to United States internet companies, which is critical to the digital economy. - the problem with putting so much of the enforcement authority with the FTC (a coalition of ten Attorneys General including Washington, New York, Maine, and Illinois have warned that [ADPPA would unnecessarily interfere with their investigative and enforcement abilities](https://oag.ca.gov/system/files/attachments/press-docs/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf?ref=thenexusofprivacy.net)) Of course these could all be addressed if there's the political will, and Rotenberg offers some straightforward solutions. Then again these aren't the only issues with ADPPA – Rotenberg doesn't discuss the elephant or the ways that [ADPPA's algorithmic impact assessments are too weak to protect civil rights](https://thenexusofprivacy.net/adppa-impact-assessments-and-civil-rights/) – so there's a lot of improvement needed. Still, now's as good a time as any. As Roternberg says: > The public attitude toward the tech industry has clearly shifted since work on a federal privacy bill began. Tech lobbyists no longer hold the pen on legislation. Twitter is teetering on the edge. Layoffs have diminished Facebook, Google, and others. Compromises with powerful tech companies — such as federal preemption — that might have looked good a year ago now seem unnecessary. This is not a time for a retribution, but it is a time for Congress to enact effective baseline legislation that provides real protection for consumers and leaves the door open for future innovation in the states. #### [KOSA Would Let the Government Control What Young People See Online](https://eff.org/deeplinks/2022/11/kosa-would-let-government-control-what-young-people-see-online?ref=thenexusofprivacy.net) Jason Kelley and Aaron Mackey on Electronic Frontier Foundation (eff.org) The latest version of the Kids Online Safety Act (KOSA) is focused on removing online information that people need to see—people of all ages. Letting governments—state or federal—decide what information anyone needs to see is a dangerous endeavor. #### [Grieving parents push for kids’ online safety bills during lame duck](https://thehill.com/policy/technology/3738592-grieving-parents-push-for-kids-online-safety-bills-during-lame-duck?ref=thenexusofprivacy.net) Rebecca Klar on The Hill (thehill.com) Congress has a busy itinerary in the lame duck session, but some grieving parents believe lawmakers should have a clear legislative priority: protecting minors from the harms they say led to their kids death. ## And ... #### [Meta’s surveillance biz model targeted in UK ‘right to object’ GDPR lawsuit](https://techcrunch.com/2022/11/21/meta-surveillance-gdpr-right-to-object-lawsuit?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) Meta’s surveillance business model is facing an interesting legal challenge in the UK from Foxglove Senior fellow Tanya O'Carroll over its continued processing of her data for ad targeting despite her objection. If this suit succeeds, it could create a precedent where if any one of us objects to Facebook creepily tracking us across the internet and tells them to stop, Facebook has to stop. - [Foxglove Senior Fellow Tanya O’Carroll sues Facebook for collecting personal data to sell adverts](https://www.foxglove.org.uk/2022/11/21/tanya-ocarroll-sues-facebook-personal-data-adverts/?ref=thenexusofprivacy.net), Foxglove's statement (foxglove.org) - [Tanya O’Carroll v Meta; Landmark case to stop Facebook spying on us](https://awo.agency/blog/tanya-o-carroll-v-meta-landmark-case-to-stop-facebook-spying-on-us?ref=thenexusofprivacy.net), the Tanya O’Carroll relating to her case against Meta (awo.agency) - [Facebook sued for collecting personal data to sell adverts](https://thetimes.co.uk/article/facebook-sued-for-collecting-personal-data-to-sell-adverts-zbtm5hc2p?ref=thenexusofprivacy.net), Mark Sellman, Technology Correspondent on The Times (thetimes.co.uk) #### [US Supreme Court ruling due on spy cams around homes](https://theregister.com/2022/11/18/supreme%5Fcourt%5Fcameras%5Fpolice?ref=thenexusofprivacy.net) Thomas Claburn on The Register (theregister.com) The American Civil Liberties Union on Friday asked the US Supreme Court to consider whether surveillance cameras placed on utility poles by police without a warrant should be allowed to watch people in their homes. #### [Twitter is making DMs encrypted and adding video, voice chat, per Elon Musk](https://theverge.com/2022/11/21/23472174/twitter-dms-encrypted-elon-musk-voice-video-calling?ref=thenexusofprivacy.net) Alex Heath / @alexeheath on The Verge (theverge.com) Encrypted DMs are a good thing, and Twitter should have added them years ago. They didn't, and now Elmo and his investors like Larry Ellison (owner of a data broker) and Saudi Prince Alawaeed have special data rights to every DM that's ever been sent – including from tech whistleblowers and activists in the Middle East. Maybe Twitter really will encrypt DMs but even if they do it's locking the barn after the data has been stolen. Also wasn't Tesla going to ship fully automated driving in 2015 or something? So take it with a grain of salt. Also: - [Is Elon Musk Bringing Encrypted Messages To The $8 Twitter Blue Party?](https://forbes.com/sites/daveywinder/2022/11/17/is-elon-musk-bringing-encrypted-messages-to-the-8-twitter-blue-party?ref=thenexusofprivacy.net), Davey Winder on Forbes (forbes.com) #### [Can anyone avoid CCTV surveillance? We ask an expert](https://theguardian.com/lifeandstyle/2022/nov/18/can-anyone-avoid-cctv-surveillance-we-ask-an-expert?ref=thenexusofprivacy.net) Coco Khan on The Guardian (theguardian.com) Hailed as a tech solution to crime, security cameras throw up questions of accountability and privacy #### [Google employees are concerned about data privacy, court documents reveal](https://insiderintelligence.com/content/google-employees-concerned-about-data-privacy-court-documents-reveal?ref=thenexusofprivacy.net) Daniel Konstantinovic on Insider Intelligence (insiderintelligence.com) How much information is Google collecting on users? It seems even company employees don’t know, according to court documents unveiled via a class-action privacy suit. #### [‘I don’t have the faintest idea what Google has on me’: Google fell short on privacy promises, employees say.](https://marketwatch.com/story/i-dont-have-the-faintest-idea-what-google-has-on-me-google-fell-short-on-privacy-promises-employees-say-11668779086?ref=thenexusofprivacy.net) Shoshana Wodinsky on MarketWatch (marketwatch.com) Newly unsealed court records reveal executives candidly talking discussing about subverting user consent in their products. #### [FIFA World Cup apps stoke data privacy concerns](https://mashable.com/article/world-cup-ehteraz-hayya-app-privacy?ref=thenexusofprivacy.net) Chase DiBenedetto on Mashable (mashable.com) The international event has privacy and human rights experts on edge. #### [Why Meta’s latest large language model only survived three days online](https://technologyreview.com/2022/11/18/1063487/meta-large-language-model-ai-only-survived-three-days-gpt-3-science?ref=thenexusofprivacy.net) Will Douglas Heaven on MIT Technology Review (technologyreview.com) Galactica was supposed to help scientists. Instead, it mindlessly spat out biased and incorrect nonsense. #### [Inside the Business of Digital Privacy: A Profitable Opportunity](https://securityboulevard.com/2022/11/inside-the-business-of-digital-privacy-a-profitable-opportunity?ref=thenexusofprivacy.net) Rakesh Soni on Security Boulevard (securityboulevard.com) Digital privacy is the key that drives business growth as it offers valuable insights to empower businesses to provide personalized experiences to users. This blog explores the aspects of leveraging digital privacy and how businesses can stay ahead of the curve. #### [Is the Video Privacy Protection Act a New Litigation Weapon for Consumers?](https://jdsupra.com/legalnews/is-the-video-privacy-protection-act-a-2798340?ref=thenexusofprivacy.net) Adam Aguirre on JD Supra (jdsupra.com) On September 19, 2022, a Massachusetts federal District Court denied Boston Globe Media Partners LLC’s motion to dismiss a consumer class action suit... #### [Federal Court Dismisses Biometric Privacy Class Action Brought Against University, On Basis It Was a Regulated “Financial Institution”](https://natlawreview.com/article/federal-court-dismisses-biometric-privacy-class-action-brought-against-university?ref=thenexusofprivacy.net) Kristin L. Bryan on The National Law Review (natlawreview.com) For almost four years now, attorneys have remained relentless in their quest to extend the outer boundaries of the Illinois Biometric Information Privacy Act (BIPA) as far as courts are willing to all #### [Video surveillance in 7 Yukon schools collecting too much info on students, says privacy watchdog](https://cbc.ca/news/canada/north/video-surveillance-yukon-schools-1.6654123?ref=thenexusofprivacy.net) CBC News on CBC (cbc.ca) The Yukon's information and privacy watchdog says the Department of Education need to immediately stop using video surveillance in schools to collect personal information about students, and securely destroy any such information it has already collected. She also found the department is collecting too much info, in violation of its own video surveillance policy, and cameras were in multipurpose rooms, sports facilities and pointed at bathroom entrances. #### [Two provincial privacy watchdogs confirm Sobeys experiencing data breach](https://theglobeandmail.com/business/article-two-provincial-privacy-watchdogs-confirm-sobeys-experiencing-data?ref=thenexusofprivacy.net) on The Globe and Mail (theglobeandmail.com) Sobeys has been dealing with ‘IT system’ issues for much of the past week affecting customers seeking prescriptions at some pharmacies it operates #### [Santa’s Data: This Holiday’s Tech Gifts Are Creepier Than Ever](https://gizmodo.com/apple-watch-amazon-prime-alexa-tech-gifts-privacy-1849787192?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) Mozilla’s Privacy Not Included Project looked at the year’s hottest gadgets and found they’re rife with privacy issues. #### [New DuckDuckGo Tool Brings Apple-Style Privacy to Android](https://gizmodo.com/duckduckgo-app-track-protection-android-apple-privacy-1849786101?ref=thenexusofprivacy.net) Thomas Germain on Gizmodo (gizmodo.com) The easy to use App Track Protection feature will block third party companies snooping in your apps #### [The Viral Effect of the CPRA’s Definition of a Business](https://natlawreview.com/article/viral-effect-cpra-s-definition-business?ref=thenexusofprivacy.net) Steven Millendorf on The National Law Review (natlawreview.com) California’s Consumer Privacy Rights Act of 2020 (CPRA) purports to shield small and not-for-profit organizations from the scope of the act. But the CPRA also includes two more, often overlooked, provisions which may ensnare organizations that are not-for-profit or otherwise do not meet one or more of the above thresholds. #### [Facebook’s $90M Privacy Deal Gets Final Nod Over Objections](https://natlawreview.com/article/facebook-s-90m-privacy-deal-gets-final-nod-over-objections?ref=thenexusofprivacy.net) Hunton Andrews Kurth’s Privacy and Cybersecurity on The National Law Review (natlawreview.com) Despite numerous objections that the settlement amount was inadequate, the judge found the final settlement to be “fair, reasonable and adequate.” #### [Keynote: Privacy in sports (IAPP Europe Data Protection Congress 2022)](https://iapp.org/news/video/keynote-privacy-in-sports-iapp-europe-data-protection-congress-2022?ref=thenexusofprivacy.net) on iapp.org Keynote: Privacy in sports and the FIFA World Cup (IAPP Europe Data Protection Congress 2022). #### [How much privacy do you deserve?](https://guardian.ng/features/how-much-privacy-do-you-deserve?ref=thenexusofprivacy.net) Guardian Nigeria on The Guardian Nigeria News - Nigeria and World News (guardian.ng) When The People’s Daily published a story in 2018 stating that the ruling Communist Party had developed and implemented software to detect individual faces using CCTV cameras, many in the West decried the move as another incremental step towards a draconian police state in line with China’s existing… #### ### Consent, Automated Systems, and Discrimination (FTC Comments) URL: https://thenexusofprivacy.net/consent-automated-systems-and-discrimination/ Last updated: 2026-04-16T02:54:15.000Z *Submitted to regulations.gov a couple of hours before last night's deadline. An earlier version of points 2-4 appeared in the* [*extended remix of my public comments*](https://thenexusofprivacy.net/comments-for-ftc-public-forum-for-commercial-surveillance/) *in September.* Thank you for your attention to the pressing issues of commercial surveillance and data security. As the author of the [Nexus of Privacy Newsletter](https://thenexusofprivacy.net/), I write about commercial surveillance and other connections between technology, policy, and justice. My career includes[ founding a successful software engineering startup](http://web2.cs.columbia.edu/~junfeng/08fa-e6998/sched/readings/prefix.pdf?ref=thenexusofprivacy.net); General Manager of Competitive Strategy at Microsoft; and[ co-chairing the ACM Computers, Freedom, and Privacy Conference](https://cacm.acm.org/blogs/blog-cacm/91829-computers-freedom-and-privacy-in-a-networked-society-june-15-18-in-san-jose-and-cyberspace/fulltext?ref=thenexusofprivacy.net). In fall 2021, I was a member of the[ Washington state Automated Decision-making Systems Workgroup](https://watech.wa.gov/privacy/projects-and-initiatives?ref=thenexusofprivacy.net), and I have testified about privacy legislation in over a dozen Washington state legislature hearings. My comments focus primarily on consent, discrimination, algorithmic error, and automated systems, although also touch on questions related to data minimization and other aspects of privacy. In summary: 1. **Consent is a vital complement to data minimization and completely prohibiting some commercial surveillance activities. Opt-out is not meaningful affirmative consent, and an opt-in approach to regulation will enhance innovation. (Questions 26, 73-81)** 2. **Algorithmic error and discrimination is pervasive across multiple sectors – and the harms fail disproportionately on the most vulnerable people. (Questions 53, 57, 65, 66, 67)** 3. **The FTC should build on the recommendations of Algorithmic Justice League’s** [**Who Audits the Auditors**](https://facctconference.org/static/pdfs%5F2022/facct22-126.pdf?ref=thenexusofprivacy.net)**, the White House OSTP’s** [**Blueprint for an AI Bill of Rights**](https://www.whitehouse.gov/ostp/ai-bill-of-rights/algorithmic-discrimination-protections-2/?ref=thenexusofprivacy.net)**, and the** [**California Privacy Protection Agency’s AI equity work**](https://medium.com/artificial-intelligence-ai-for-social-impact/xx-22faff63228f?ref=thenexusofprivacy.net)**. (Questions 41-46, 56, 67)** 4. **The FTC should develop its regulations working with the people most likely to be harmed by commercial surveillance – and prioritize their needs. (Questions 29, 39, 43)** ![A person saying :Technologies reflect the biases of the makers and implicit rules of society" with a photo of an incarcerated Black person in the background](https://lh3.googleusercontent.com/gX-DC9Ea0jEkbudFoZwZUrvXQh2AsbW5f3RFA1amhWx_xj9PdXBZwqbZwO4VJcMOb17B_DM-f_Dg4wCK0OYSY2HUa_Q_YUzbUwC99mMizcc10r8HBVaBnI2clN0oP9WSwNDJjb0DtgPWLyassF3mgPVEW3eQWDzeqLjCX_oIIpoR6GntdnkVphViV8PDLA) Malkia Cyril, at Personal Democracy Forum 2017, originally tweeted by @anxiaostudio ### 1\. Consent is a vital complement to data minimization and completely prohibiting some commercial surveillance activities. Opt-out is not meaningful affirmative consent, and an opt-in approach to regulation will enhance innovation. (Questions 26, 73-81) Privacy scholarship, and practical experience, has clearly shown the limitations of purely consent-based approaches. Businesses that profit from commercial surveillance will use misleading tactics to get people to consent, bombard people with requests to induce “consent fatigue”, or bribe or coerce consent. So commercial surveillance activities with known discriminatory and human rights impacts like face surveillance, social scoring, and crime prediction should be prohibited. The “unacceptable risk” category of the EU’s AI Act is a good starting point, although as [the civil society amendments available on EDRI’s site](https://edri.org/our-work/the-eus-artificial-intelligence-act-civil-society-amendments/?ref=thenexusofprivacy.net) highlight, needs to be expanded – for example, it doesn’t currently prohibit emotion recognition. However, there are many commercial surveillance activities that are not likely to be prohibited by these regulations. Location tracking is one good example. While this data can certainly be abused, it can also power very useful services; different people will make different tradeoffs as to whether and when they want to be tracked. First-party targeted advertising is another. People who trust a company may well wish to see more-relevant ads, both for their own use and to help the company’s business. On the other hand, people who do not have a trust relationship with the company (or distrust some of the service providers the company uses) may not want to have their data used to target ads. In situations like this, consent is crucial – and by consent, I mean affirmative, informed consent, also known as “opt in”. “Opt out” approaches, by contrast, *assume* consent. As a Washington state resident said in testimony in a 2021 state legislative hearing, an "opt-out" approach lets anybody come into your house and rummage around in your drawers – without being invited in – until you tell them to go away. “Opt out” also leads to major biases, for example against disabled people. Even if regulation requires opt-out pages and privacy policies to be accessible, there’s no reason to believe that they will be in practice; after all, [courts have found that non-accessible websites violate the ADA](https://www.jdsupra.com/legalnews/court-finds-domino-s-pizza-violated-the-2182635/?ref=thenexusofprivacy.net), but an astonishing [98.6% of all web home pages have accessibility errors](https://webaim.org/projects/million/?ref=thenexusofprivacy.net) – an average of over 50 errors per page. People who have limited reading or technology skills and people who are not native English speakers are also heavily impacted by opt out. And while advanced opt-out approaches such as a global privacy control help techies who have their own devices and don’t need assistive technologies, they do not fully address the problem. Commercial surveillance providers often object to opt-in saying it will be too hard to use, but the extremely positive response to Apple’s App Tracking Transparency clearly shows that’s a lie. The reality is that most tech companies haven’t devoted any effort at all to making opt-in easy. After all, current privacy regulation is almost exclusively opt-out, so their business interests are better served by putting their effort into making opt-out as hard as possible. So opt-in is also an excellent example of the opportunities for new regulations to enhance innovation – and enhance the development of products that protect our privacy. ### 2\. Algorithmic error and discrimination is pervasive across multiple sectors – and the harms fail disproportionately on the most vulnerable people (Questions 53, 57, 65, 66, and 67) Technology can be liberating … but it can also reinforce and magnify existing power imbalances and patterns of discrimination. As documented by researchers like Dr. Safiya Noble in *Algorithms of Oppression* and Dr. Joy Buolamwini, Timnit Gebru, and Inioluwa Deborah Raji in the *Gender Shades* project, today’s algorithmic systems are error-prone and the datasets they’re trained on have significant biases. These errors – and the discrimination these systems cause – are prevalent across all sectors. For example, Color of Change's[ Black Tech Agenda](https://act.colorofchange.org/sign/black-tech-agenda?ref=thenexusofprivacy.net) talks about “the harm that algorithmic has done to Black communities regarding equitable access to housing, health care, employment, education, credit, and insurance." Similarly, facial recognition errors led to the arresting innocent Black people like [Nijeer Parks, Robert WIlliams, and Michael Oliver](https://www.wired.com/story/wrongful-arrests-ai-derailed-3-mens-lives/?ref=thenexusofprivacy.net); and [Algorithms that detect hate speech online are biased against Black people](https://www.vox.com/recode/2019/8/15/20806384/social-media-hate-speech-bias-black-african-american-facebook-twitter?ref=thenexusofprivacy.net). Of course, it is not only Black communities that are harmed by this – [health care allocation algorithms discriminate against disabled people](https://www.theverge.com/2018/3/21/17144260/healthcare-medicaid-algorithm-arkansas-cerebral-palsy?ref=thenexusofprivacy.net), [automated risk assessments discriminate against Hispanic people](https://www.law.georgetown.edu/american-criminal-law-review/in-print/volume-56-number-4-fall-2019/the-biased-algorithm-evidence-of-disparate-impact-on-hispanics/?ref=thenexusofprivacy.net), [fraud-detection systems harm against unemployed people](https://www.freep.com/story/news/local/michigan/2021/03/26/judge-unemployment-midas-false-fraud-fast-enterprises-csg/7014975002/?ref=thenexusofprivacy.net), … the list goes on. And as this list indicates, the harms are usually much greater on the historically underserved communities the FTC has committed to protecting. Regulation is clearly needed, and it needs to be designed to protect the people who are most at risk. However, the traditional list of “protected classes” is not sufficient. Some algorithmic discrimination is intersectional – for example, Gender Shades and follow-on work highlight that facial recognition is even more inaccurate for Black women. And, other forms of algorithmic discrimination can disproportionately harm groups like unemployed people or [renters](https://www.propublica.org/article/yieldstar-rent-increase-realpage-rent?ref=thenexusofprivacy.net) who are not considered “protected classes”. ### 3\. The FTC should build on the recommendations of Algorithmic Justice League’s [Who Audits the Auditors](https://facctconference.org/static/pdfs%5F2022/facct22-126.pdf?ref=thenexusofprivacy.net), the White House OSTP’s [Blueprint for an AI Bill of Rights](https://www.whitehouse.gov/ostp/ai-bill-of-rights/algorithmic-discrimination-protections-2/?ref=thenexusofprivacy.net), and the [California Privacy Protection Agency’s AI equity work](https://medium.com/artificial-intelligence-ai-for-social-impact/xx-22faff63228f?ref=thenexusofprivacy.net) (Questions 41-46, 56, 67) ![A grid of six colored boxes, each with the one of the policy recommendations listed above](https://lh3.googleusercontent.com/8ZgUZa-eWxHLTxakpROY30ejjvypMAzzfl3VH1oASb_hz9pJUvl47bdu48smoCGb62qc20gxq6EhziXW1CvwsqglFWTqnjywg4WUzJber3cv9O9WFP1zFRQjexMHKOpM3ET9h0ULH-l0ZrwDqvXE0oaf-tYJ1JMVINsjNiFBA2lwIQLVTvmJwLxA7UfX-A) There are a lot of challenges in regulating algorithms and automated decision systems. Fortunately, there is a lot of excellent work out there for the FTC to build on. The Algorithmic Justice League’s founder Joy Buolamwini, research collaborator Inioluwa Deborah Raji, and Director Of Research & Design Sasha Costanza-Chock (known for their work on Design Justice) recently collaborated on[ Who audits the Auditors: Recommendations from a field scan of the algorithmic auditing ecosyystem](https://arxiv.org/pdf/2310.02521.pdf?ref=thenexusofprivacy.net), the first comprehensive field scan of the artificial intelligence audit ecosystem. The policy recommendations in *Who Audits the Auditors* highlight key considerations in several specific areas where FTC rulemaking could have a major impact. 1. Require the owners and operators of AI systems to engage in independent algorithmic audits against clearly defined standards 2. Notify individuals when they are subject to algorithmic decision-making systems 3. Mandate disclosure of key components of audit findings for peer review 4. Consider real-world harm in the audit process, including through standardized harm incident reporting and response mechanisms 5. Directly involve the stakeholders most likely to be harmed by AI systems in the algorithmic audit process 6. Formalize evaluation and, potentially, accreditation of algorithmic auditors. The [Blueprint for an AI Bill of Rights](https://www.whitehouse.gov/ostp/ai-bill-of-rights/?ref=thenexusofprivacy.net) announced in September by the White House Office of Science and Technology Policy (OSTP) is also very valuable. The detailed recommendations in [Algorithmic Discrimination Protections](https://www.whitehouse.gov/ostp/ai-bill-of-rights/algorithmic-discrimination-protections-2/?ref=thenexusofprivacy.net), [Data Privacy](https://www.whitehouse.gov/ostp/ai-bill-of-rights/data-privacy-2/?ref=thenexusofprivacy.net) and [Notice and Explanation](https://www.whitehouse.gov/ostp/ai-bill-of-rights/notice-and-explanation/?ref=thenexusofprivacy.net) sections relate directly to many of the questions in the ANPR. And the details of the rulemaking matter a lot. Too often, well-intended regulation has weaknesses that commercial surveillance companies, with their hundreds of lawyers, can easily exploit. Looking at proposals through an algorithmic justice lens can highlight where they fall short. For example, the *Who Audits the Auditors* recommendations highlight ways that proposed American Data Privacy and Protection Act (ADPPA) consumer privacy bill falls short of effective regulations: 1. ADPPA doesn't require independent auditing, instead allowing companies like Facebook to do their own algorithmic impact assessments. And government contractors acting as service providers for ICE and law enforcement don't even have to do algorithmic impact assessments! As Color of Change's[ Black Tech Agenda](https://act.colorofchange.org/sign/black-tech-agenda?ref=thenexusofprivacy.net) notes "By forcing companies to undergo independent audits, tech companies can address discrimination in their decision-making and repair the harm algorithmic that bias has done to Black communities." 2. ADPPA doesn’t require affirmative consent to being profiled – or even offer the opportunity to opt out. 3. ADPPA doesn’t mandate any public disclosure of its algorithmic impact assessments – not even summaries or key components 4. ADPPA doesn't have any requirement for including real-world harms – or even measuring the impact. 5. ADPPA doesn't have any requirement at all to involve external stakeholders in the assessment process – let alone directly involving the stakeholders most likely to be harmed by AI system. 6. ADPPA allows anybody at a company to do an algorithmic impact assessment – and it's not even clear whether it allows the FTC rulemaking authority for potential evaluation and accreditation of assessors or auditors Taking all of this valuable work into account starting early in the process will lead to more effective regulations. ### 4\. The FTC should develop its regulations working with the people most likely to be harmed by commercial surveillance – and prioritize their needs (Questions 29, 39, 43) As Afsenah Rigot points out in [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=thenexusofprivacy.net), a design process that centers the most impacted and marginalized users from ideation to production results in outcomes that are highly beneficial for all users and companies. While Rigot focuses on product design, and AJL’s recommendations make a similar point about involving the stakeholders most likely to be harmed by AI systems in an auditing process, For example, A. Prince Albert III[ Hiding OUT: A Case for Queer Experiences Informing Data Privacy Laws](https://publicknowledge.org/hiding-out-a-case-for-queer-experiences-informing-data-privacy-laws?ref=thenexusofprivacy.net), suggests using queer experiences as an analytical tool to test whether proposed a privacy regulation protects people’s privacy and [Stress-testing privacy legislation with a queer lens](https://thenexusofprivacy.net/adppa-with-a-queer-lens/) illustrates the insights from this approach. So as the FTC develops these regulations, it’s critical to involve the people who will be most impacted – and to make sure their needs are prioritized. As well as the protected classes, it's also vital to look at how proposed regulations affect pregnant people, rape and incest survivors, immigrants, unhoused people, and others who are being harmed *today* by commercial surveillance. Regulations that protect them will wind up protecting *everybody.* ### Privacy News: November 17 URL: https://thenexusofprivacy.net/privacy-news-november-17/ Last updated: 2022-11-17T19:38:10.000Z Before we get to some very interesting articles on federal privacy legislation and Mastodon, first some important media news – and a very intriguing upcoming event. ### [Protocol, the tech-news focused website, will shutter and lay off its entire staff](https://www.cnn.com/2022/11/15/media/protocol/index.html?ref=thenexusofprivacy.net) Oliver Darcy, CNN (cnn.com) San Francisco-based Protocol has announced that they are shutting down and laying off 60 staffers. It's a huge loss for many reasons, including their solid coverage of privacy issues and tech lobbying. Back in 2021, for example, Emily Birnbaum was the first to report that [an Amazon lobbyist had given the first draft of the Virginia Consumer Privacy Bill](https://www.protocol.com/policy/virginia-maryland-washington-big-tech?ref=thenexusofprivacy.net) (based on the Bad Wasington Privacy Act) to the state legislator to introduced it. This year, Ben Brody contributed. [Quiet industry lobbyists are watering down state privacy laws](https://www.protocol.com/policy/state-privacy-utah-spsc?ref=thenexusofprivacy.net) and [What Microsoft, IBM and others won as the privacy bill evolved](https://www.protocol.com/newsletters/policy/cloud-enterprise-privacy?ref=thenexusofprivacy.net) (focusing on the ADPPA consumer privacy bill I disussed in earlier this week in [The elephant and the lame duck: ADPPA after the midterms](https://thenexusofprivacy.net/the-elephant-and-the-lame-duck/)). Issie Lapowsky's [For Big Tech whistleblowers, there’s no such thing as ‘moving on’](https://www.protocol.com/big-tech-whistleblowers?ref=thenexusofprivacy.net), from 2021, is another great example of in-depth reporting Protocol frequently produced. German media conglomerate Axel Springer acquired Protocol's parent company Politico early this year, ad sales have been slumping, and the tech industry in general is hitting a bumpy road. Even so it's somewhat surprising they didn't fold at least some of Protocol's newsletters and reporters into Politico. As IAPP's Cobun Zweifel-Keegan said to Lapowsky on Twitter, she and the whole team helped him do his job – and the same's true for so many of us. ### Event: [The Fight Against Surveillance: Our Neighbors, Our Safety](https://us06web.zoom.us/webinar/register/WN%5FMfSXwuXqSCilh2UNuMEL1A?ref=thenexusofprivacy.net) Wednesday, November 30, 10:00 a.m. - 12:00 p.m. Pacific / 1:00 - 3:00 p.m. Eastern From the description: > As funders aiming to secure safety, self-determination, and joy for all–and particularly for those of us committed to ending the harmful practice of mass incarceration—the issue of surveillance is of utmost importance; one which deeply impacts marginalized communities, as well as those fighting for justice and liberation. Without swift intervention from philanthropy, we can only expect increased and more invasive surveillance in our lifetimes.... > > I invite you to join Spark Justice Fund grantee partners S.T.O.P. (Surveillance Technology Oversight Project), Mijente, and Eye on Surveillance ... for a mini teach-in on surveillance. You’ll hear from a panel of activists leading fights on the ground to progress both anti-surveillance and decarceration efforts—and you’ll leave our gathering better able to understand the strategies needed to progress this work before it’s too late. ## Federal Privacy Legislation #### [What do US midterm results mean for a federal privacy law?](https://theregister.com/2022/11/15/us%5Fmidterm%5Felections%5Fprivacy?ref=thenexusofprivacy.net) Jessica Lyons Hardcastle on The Register (theregister.com) Democrats will hold the Senate, with 50 or 51 seats; Republicans are likely to have a razor-thin margin in the House. What does that mean for the American Data Privacy and Protection Act (ADPPA)? Hardcastle's summary matches what I've heard from staffers: > For the bipartisan [American Data Privacy and Protection Act](https://www.theregister.com/2022/07/21/us%5Fadppa%5Fprivacy/?ref=thenexusofprivacy.net), now stalled in the House, this sharply divided Congress could mean lame-duck lawmakers are more likely to compromise on a privacy law instead of rushing appointments and more partisan issues through the process. Or, it could signal the death knell for the ADPPA, and stronger data privacy. Hardcastle doesn't mention the elephant – although she does mention [criticism](https://www.washingtonpost.com/technology/2022/06/22/privacy-bill-maria-cantwell-congress/?ref=thenexusofprivacy.net) by Sen. Maria Cantwell (D-WA) of ADPPA for being too weak, and if you follow the link you'll see the elephant. She also focuses primarily on the blocking issue of preemption (part of the pattern I discussed a few days ago in [The elephant and the lame duck](https://thenexusofprivacy.net/the-elephant-and-the-lame-duck/)), but does mention that people in other states care about preemption too, which is often overlooked. And there are some interesting quotes giving a lot of texture to the two ways of looking at it. So it's definitely worth reading! ### [Kids' privacy online gets yearend push in Congress](https://www.axios.com/2022/11/16/kids-privacy-online-congress-yearend-push?ref=thenexusofprivacy.net) Ashley Gold, Axios (axios.com) Earlier this year, the Senate Commerce Committee (chaired by Sen. Cantwell) advanced two bipartisan bills: [Children and Teens' Online Privacy Protection Act](https://www.congress.gov/bill/117th-congress/senate-bill/1628/text?ref=thenexusofprivacy.net) (CTOPPA, also called COPPA 2.0) and the [The Kids Online Safety Act](https://www.axios.com/2022/02/16/protect-kids-online-bipartisan-senate-bill?ref=thenexusofprivacy.net) (KOSA). Gold reports that Senate leadership, including Sen. Cantwell, plans to make these a priority in the lame duck and quotes KOSA co-sponsor Sen. Richard Blumenthal (D-CT) as saying the most likely path is to attach the bills to a must-pass bill year-end bill, either defense or the omnibus spending. Of course, bill sponsors always express confidence in getting them passed, and something the article *doesn't* mention is that Sen. Roger Wicker (R-MS) has opposed CTOPPA. Wicker has argued that the effort is better spent on ADPPA (which also has a section on chidren's privacy), so depending on how many Republicans see it that way, it's possible that these bills fate is intertwined with ADPPA. We shall see! In any case, another very solid article. ### [Foreign ad tech risks crystalized in new research, Congress has the power to act](https://humansecurity.com/learn/blog/foreign-ad-tech-risks-crystalized-in-new-research-congress-has-the-power-to-act?ref=thenexusofprivacy.net) Zach Edwards and Alexa Raad on humansecurity.com HUMAN’s Zach Edwards and Alexa Raad discuss the recent Reuters reporting on a Russian software vendor and what this means for the ad tech industry. ## Mastodon > If you're on Mastodon, or anywhere else in the Fediverse, check us out at [@nexusofprivacy@mastodon.social](https://mastodon.social/@nexusofprivacy?ref=thenexusofprivacy.net)! ### [Is Mastodon Private and Secure? Let’s Take a Look](https://www.eff.org/deeplinks/2022/11/mastodon-private-and-secure-lets-take-look?ref=thenexusofprivacy.net) Bill Buddington, Electronic Frontier Foundation (eff.org) This detailed overview starts with the basics: - Private messages aren't end-to-end encrypted, so admins and moderators can read them. If you need secure messaging, use something like Signal insead. - Mastodon's open-soure code is mostly written by volunteers, there isn't a dedicated security team, and some forks have had (and fixed) embarrassing [vulnerabilities](https://portswigger.net/research/stealing-passwords-from-infosec-mastodon-without-bypassing-csp?ref=thenexusofprivacy.net). Expect more bugs as the code base gets more attention. - Two-factor authentication can help keep your account secure. Turn it on. Buddington also discusses the privacy implications of defederation and the absence of full-text search, as well as muting and blocking and challenge of dealing with abusive behavior in a federated environment. One topic I wish had been discussed: the privacy and security implications of mainline Mastodon's refusal to support "[local-only posts](https://github.com/hometown-fork/hometown/wiki/Local-only-posting?ref=thenexusofprivacy.net)", which have been available in forks like glitch-soc and Hometown since 2017\. This functionality is important for privacy and reducing to exposure to abuse, but relatively few servers make it available. It will be interesting to see whether lead developer Eugen Rochko, Mastodon's BDFL (Benevolent Dictator for Life), starts to prioritize privacy and anti-abuse enhancements. Even if that doesn't happen, though, forks and different compatible implementations of the ActivityPub protoco still provide a path forward. ## And ... #### [Telehealth Sites Put Addiction Patient Data at Risk](https://wired.com/story/substance-abuse-telehealth-privacy-tracking-tech?ref=thenexusofprivacy.net) on WIRED (wired.com) New research found pervasive use of tracking tech on substance-abuse-focused health care websites, potentially endangering users in a post-Roe world. #### [The Hidden Value of Prototyping for Policy Making in Tech and Beyond](https://techpolicy.press/the-hidden-value-of-prototyping-for-policy-making-in-tech-and-beyond?ref=thenexusofprivacy.net) Michal Luria on Tech Policy Press (techpolicy.press) Prototyping should be used as a research tool in the policymaking process, says CDT Research Fellow Michal Luria, discussing work done with Caroline Sinders. #### [Unsealed court documents reveal data anarchy at Meta](https://iccl.ie/news/unsealed-court-documents-reveal-data-anarchy-at-meta?ref=thenexusofprivacy.net) Johnny Ryan on Irish Council for Civil Liberties (iccl.ie) ICCL letter to European Commission highlights new material about Meta’s internal data systems, and how Meta infringes the DMA & GDPR. #### [SF Mayor ‘Wallpapered Over’ Privacy Concerns About Police Access to Live Surveillance Cameras, Docs Show](https://vice.com/en/article/qjkmzd/sf-mayor-wallpapered-over-privacy-concerns-about-police-access-to-live-surveillance-cameras-docs-show?ref=thenexusofprivacy.net) Aaron Gordon on vice.com While privacy groups sounded the alarm, SF Police lobbied for the policy and distributed talking points members of the public read aloud at a hearing. #### [California Data Privacy Roundup #2](https://jdsupra.com/legalnews/california-data-privacy-roundup-2-6665412?ref=thenexusofprivacy.net) Travis Brennan on JD Supra (jdsupra.com) A roundup of several stories, starting with the class action against Apple for their apps continuing to collect data even after users change their settings. #### [EU’s Digital Services Act enters into force -- but no confirm if Twitter will feel its full force yet](https://techcrunch.com/2022/11/16/digital-services-act-enters-into-force?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) The EU’s Digital Services Act enters into force today -- setting the clock ticking on designations that will determine which larger Internet platforms face the toughest oversight. #### [Privacy Hits a Low at TikTok, Twitter](https://securityboulevard.com/2022/11/privacy-hits-a-low-at-tiktok-twitter?ref=thenexusofprivacy.net) Teri Robinson on Security Boulevard (securityboulevard.com) Privacy on social media has taken a hit this month, which should surprise no one. Just days after Elon Musk took over Twitter, the platform’s chief #### [Lack of privacy stops 43% from seeking advice in pharmacy, survey finds](https://chemistanddruggist.co.uk/CD136541/Lack-of-privacy-stops-43-from-seeking-advice-in-pharmacy-survey-finds?ref=thenexusofprivacy.net) Emily Stearn on C+D (chemistanddruggist.co.uk) More than two fifths of patients would seek advice or medication for self-treatable conditions if there was more privacy in pharmacies, survey results shared exclusively with C+D have revealed. #### [The First-Party Data Gold Rush: 7 Critical Shifts for Digital Advertising to Thrive](https://medium.com/@kpieper876/the-first-party-data-gold-rush-7-critical-shifts-for-digital-advertising-to-thrive-6accdf76f01?ref=thenexusofprivacy.net) Keith Pieper on Medium (medium.com) Digital advertising is changing because free-for-all access to data is ending. Zero and first-party data is becoming the new standard data… #### [Twitter faces privacy scrutiny over claims it fails GDPR](https://techradar.com/news/twitter-faces-more-privacy-scrutiny-over-claims-it-fails-gdpr?ref=thenexusofprivacy.net) Craig Hale on TechRadar pro (techradar.com) Twitter faces a battle to remain GDPR compliant in the EU #### [Mozilla: These Are the Tech Gifts Privacy-Conscious Shoppers Should Avoid](https://pcmag.com/news/mozilla-these-are-the-tech-gifts-privacy-conscious-shoppers-should-avoid?ref=thenexusofprivacy.net) Rob Pegoraro on PCMag (pcmag.com) Mozilla’s buyers’ guide often amounts to a don’t-buy-this guide, but it also commends some privacy-preserving gadgets. #### [Location tracking continues to face scrutiny after Google’s latest data privacy settlement](https://digiday.com/marketing/location-tracking-continues-to-face-scrutiny-after-googles-latest-data-privacy-settlement?ref=thenexusofprivacy.net) Marty Swant on Digiday (digiday.com) The tech giant is paying $392 million in a new agreement with 40 state attorneys general, but some expect the industry will face more legal battles. #### [The Android Privacy Sandbox Will Enter Beta In Early 2023](https://adexchanger.com/privacy/the-android-privacy-sandbox-will-enter-beta-in-early-2023?ref=thenexusofprivacy.net) Allison Schiff on AdExchanger (adexchanger.com) Google said it plans to roll out the initial Android Privacy Sandbox beta to Android 13 mobile devices starting early next year. #### [Worker’s breach-of-privacy claim should be heard by arbitrator: Saskatchewan Court of Appeal](https://canadianlawyermag.com/practice-areas/privacy-and-data/workers-breach-of-privacy-claim-should-be-heard-by-arbitrator-saskatchewan-court-of-appeal/371515?ref=thenexusofprivacy.net) Jason Tan on Canadian Lawyer (canadianlawyermag.com) Labour arbitrator, not court, has jurisdiction over breach that arose from employment relationship #### [Google Play streamlines policies around kids’ apps as regulations tighten](https://techcrunch.com/2022/11/16/google-play-streamlines-policies-around-kids-apps-as-regulations-tighten?ref=thenexusofprivacy.net) Sarah Perez on TechCrunch (techcrunch.com) Google Play today announced a series of changes to its programs and policies around apps designed for children. The company is describing the update as an expansion of its previously launched “Teacher Approved” program, which includes a review process where teachers and experts vetted apps not just… #### [Amazon RDS snapshots allow extensive leakage of personally identifiable information (PII)](https://venturebeat.com/security/amazon-rds-snapshots-allow-extensive-leakage-of-personally-identifiable-information-pii?ref=thenexusofprivacy.net) Taryn Plumb on VentureBeat (venturebeat.com) According to research from Mitiga, hundreds of databases are exposed monthly — with extensive PII leakage — via Amazon RDS snapshots. #### [New privacy laws in 2023 — considering draft regulations](https://reuters.com/legal/legalindustry/new-privacy-laws-2023-considering-draft-regulations-2022-11-16?ref=thenexusofprivacy.net) Gary Kibel on Reuters (reuters.com) Gary Kibel of Davis+Gilbert LLP discusses draft regulations in California under its consumer privacy law, one of several consumer privacy laws taking effect in 2023. #### [Maintaining Patient Privacy when Transferring Medical Information](https://jdsupra.com/legalnews/maintaining-patient-privacy-when-6279445?ref=thenexusofprivacy.net) Anat Even-Chen on JD Supra (jdsupra.com) An analysis of the Israeli Privacy Protection Authority's recently-published a draft document “Protecting Patients’ Privacy When Transferring Medical Information via Digital Devices and Undesignated Software.” Public comments are invited; the deadline is December 6\. --- Image Credit: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net)[CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net)[Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [picserver.org](https://www.picserver.org/p/privacy.html?ref=thenexusofprivacy.net). ### Privacy News: November 15 URL: https://thenexusofprivacy.net/privacy-news-november-15/ Last updated: 2022-11-15T19:45:13.000Z Checking out Mastodon? The Nexus of Privacy is at [@nexusofprivacy@mastodon.social](https://mastodon.social/@nexusofprivacy?ref=thenexusofprivacy.net)! ### Webinar: [The Fight for Privacy in a Post-Dobbs World](https://teachprivacy.com/webinar-fight-for-privacy-in-a-post-dobbs-world-access/?ref=thenexusofprivacy.net) *Thursday December 1, 11:00 am Pacific (2:00 pm Eastern)* This webinar, hosted by privacy scholar Daniel Solove, will focus on themes from Danielle Citron’s new book, *The Fight for Privacy*: online harassment and hate, Section 230, and how privacy invasions disproportionately are targeted at women. It will also discuss the implications of *Dobbs*, where the U.S. Supreme Court struck down the right to abortion. And talk about an all-star cast! As well as Solove and Citron, speakers include [Mary Anne Franks](https://people.miami.edu/profile/m.franks@miami.edu?ref=thenexusofprivacy.net) of Miami Law, [Jolynn Dellinger](https://law.duke.edu/fac/jdellinger/?ref=thenexusofprivacy.net) of Duke Law, [Elizabeth Joh](https://law.ucdavis.edu/people/elizabeth-joh?ref=thenexusofprivacy.net) of UC Davis Law, and [Allyson Haynes Stuart](https://www.charlestonlaw.edu/teams/allyson-haynes-stuart/?ref=thenexusofprivacy.net) of Charleston Law. ### [A People’s Guide to Finding Algorithmic Discrimination](https://criticalracedigitalstudies.com/peoplesguide?ref=thenexusofprivacy.net) Center for Critical Race and Digital Studies (criticalracedigitalstudies.com) This very approachable guide features four critical lessons: - What is a machine learning algorithm? - Algorithmic Bias? - What types of Bias? - How do these emerge in real-world contexts? There are also demonstrations to help you get hands-on practice using state-of-the-art detection and debiasing tools. Development of the People's Guide was led by Meredith Broussard and Avriel Epps-Darlin, partnering with Rumman Chowdhury and Parity AI. ## Federal privacy legislation ### [Make Privacy Legislation a Lame Duck Priority](https://techpolicy.press/make-privacy-legislation-a-lame-duck-priority?ref=thenexusofprivacy.net) David Morar on Tech Policy Press (techpolicy.press) Morar, a Policy Fellow at New America's Open Technology Institute (OTI), makes the case for American Data Privacy Protection Act (ADPPA). It's a good example of the kind of spin I talked about in [The elephant and the lame duck](https://thenexusofprivacy.net/the-elephant-and-the-lame-duck/). For example, Morar claims "the bill came out of committee debate stronger", which ignores the [many important changes that significantly weakened the bill](https://thenexusofprivacy.net/what-about-the-elephant/#weakening) – and justifies his claim by cites an IAPP article that (as I pointed out in the [September 17 privacy news](https://thenexusofprivacy.net/privacy-news-september-17/#reviewing-the-house-committee-changes-to-the-proposed-adppa)) makes ADPPA look stronger than it really is and has a chart that omitted most of the weakening changes. And he parrots the line from ADPPA supporters that it's stronger than any state privacy bill while ignoring Californians for Consumer Privacy's rebuttal, highlighting dozens of ways California's existing bill is stronger than ADPPA. By the way, OTI's top funder is Melinda Gates' Pivotal Ventures LLC. Former Google CEO Eric Schmidt's foundation, the Gates Foundation , the Siemens Foundation, and Bloomberg Philanthropies are also in the top 10\. ## Twitter ### [Deleting DMs from Twitter using the GDPR](https://michae.lv/deleting-dms-from-twitter?ref=thenexusofprivacy.net) Michael Veale (michae.lv) As we discussed a few weeks ago in [A new Chief Twit - and a big Twitter privacy issue](https://thenexusofprivacy.net/a-new-chief-twit-and-a-big-twitter-privacy-issue/), deleting your Twitter data – and even deactivating your account – doesn't necessarily do anything. In some jurisdictions, though, you have the right to request Twitter delete your data. Michael Veale has detailed instructions for how to do this if you're in the EU. It would be great to see similar instructinos for California, but as far as I know nobody's written them up. Of course Twitter's laid off so many people that they may well ignore the request. Still, if they ignore it, it creates a paper trail of a violation – and if and when regulators choose to act against Twitter, the more violations that are on record, the higher the fines will be. Worth mentioning: ADPPA gives people the right to delete their data ... but there are a lot of exceptions. For example, Twitter doesn't have to delete anything related to "investigations" or preventing unlawful activity; and they don't have to delete anything older than two years. I went into more detail about the deletion problems in [Does ADPPA allow pregnant people to force companies to delete data that might put them at risk?](https://thenexusofprivacy.net/adppa-post-roe-threats/#%E2%9D%8C-does-adppa-allow-pregnant-people-to-force-companies-to-delete-data-that-might-put-them-at-risk) ... I really should add the Twitter use case to that post make it more concrete. ### [Irish privacy boss Damien Kieran leads Twitter executive exodus](https://independent.ie/business/technology/irish-privacy-boss-damien-kieran-leads-twitter-executive-exodus-42134729.html?ref=thenexusofprivacy.net) Adrian Weckler and Anne-Marie Walsh on Independent.ie (independent.ie) The global chief privacy officer of Twitter, Irishman Damien Kieran, has reportedly resigned from the company in a mass exodus of senior security and privacy executives. ### [Is Elon Musk’s Twitter about to fall out of the GDPR’s one-stop shop?](https://techcrunch.com/2022/11/14/is-elon-musks-twitter-about-to-fall-out-of-the-gdprs-one-stop-shop?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) An "anonymous and well-placed source" tells TechCrunch that Twitter is no longer fulfilling key obligations required for it to claim Ireland as its so-called “main establishment” under the European Union’s General Data Protection Regulation (GDPR). It sounds wonky but as Lomas explains, this is actually a pretty big deal. > Like many major tech firms with customers across the European Union, Twitter currently avails itself of a mechanism in the GDPR known as the one-stop shop (OSS). This is beneficial because it allows the company to streamline regulatory administration by being able to engage exclusively with a lead data supervisor in the EU Member State where it is ‘main established’ (in Twitter’s case Ireland), rather than having to accept inbound from data protection authorities across the bloc.... > > In practice, that means any EU data protection authority would be able to act directly on concerns it has that local users’ data is at risk — with the power to instigate their own investigations and take enforcement actions. So Ireland’s more business friendly regulator would no longer be leading the handling of any GDPR concerns about Twitter; probes could be simultaneously opened up all over the EU — including in Member States like France and Germany where data protection authorities have a reputation for being quicker to the punch (and/or more aggressive) in responding to complaints compared to Ireland. ## And ... ### [40 states settle Google location-tracking charges for $392M](https://apnews.com/article/google-privacy-settlement-location-data-57da4f0d3ae5d69b14f4b284dd084cca?ref=thenexusofprivacy.net) Dave Collins and Marcy Gordon on Associated Press (apnews.com) Google has agreed to a $391.5 million settlement with 40 states in connection with an investigation into how the company tracked users’ locations, state attorneys general announced Monday, calling it the largest multistate privacy settlement in U.S history. ALSO: - [Google Agrees to $391.5 Million Privacy Settlement With 40 States](https://cnet.com/news/privacy/google-agrees-to-391-5-million-privacy-settlement-with-state-ags?ref=thenexusofprivacy.net), Imad Khan on CNET (cnet.com) - [Google to pay $391.5 million in location-tracking settlement with 40 states](https://techcrunch.com/2022/11/14/google-pay-391-5-million-location-tracking-settlement?ref=thenexusofprivacy.net) Aisha Malik on TechCrunch (techcrunch.com) - [Google Agrees to $392 Million Privacy Settlement With 40 States](https://nytimes.com/2022/11/14/technology/google-privacy-settlement.html?ref=thenexusofprivacy.net), Cecilia Kang in the New York Times (nytimes.com) #### [Apple faces new lawsuit over its data collection practices in first-party apps, like the App Store](https://techcrunch.com/2022/11/14/apple-faces-new-lawsuit-over-its-data-collection-practices-in-first-party-apps-like-the-app-store?ref=thenexusofprivacy.net) Sarah Perez on TechCrunch (techcrunch.com) A new lawsuit is taking on Apple’s data collection practices in the wake of a recent report by independent researchers who found Apple was continuing to track consumers in its mobile apps, even when they had explicitly configured their iPhone privacy settings to turn tracking off. ALSO: - [Apple sued for collecting user data despite opt-outs](https://theregister.com/2022/11/14/apple%5Fdata%5Fcollection%5Flawsuit?ref=thenexusofprivacy.net), Brandon Vigliarolo on The Register (theregister.com) - [Apple Sued Over ‘Deceptive’ Privacy Settings After Gizmodo Story](https://gizmodo.com/apple-iphone-privacy-analytics-class-action-suit-1849774313?ref=thenexusofprivacy.net), Thomas Germain on Gizmodo (gizmodo.com) #### [French agency warns World Cup fans to get burner phones for Qatar apps](https://politico.eu/article/qatar-world-cup-2022-warning-burner-phones-french-agency?ref=thenexusofprivacy.net) Laura Kayali on POLITICO (politico.eu) Avoid naughty pictures and scrub your phone to keep clear of state snoopers, French regulator says. #### [UK and non-EU businesses to face more uncertainty in GDPR data breach reporting](https://pinsentmasons.com/out-law/news/uk-non-eu-businesses-face-uncertainty-gdpr-data-breach?ref=thenexusofprivacy.net) Wouter Seinen on Pinsent Masons (pinsentmasons.com) Companies that are not established in the EU could face more uncertainty when reporting a data breach involving EU data subjects and complying with the General Data Protection Regulation GDPR. #### [Stalking fears over PimEyes facial search engine](https://bbc.com/news/technology-63544169?ref=thenexusofprivacy.net) Chris Vallance on BBC News (bbc.com) Privacy campaign group Big Brother Watch has asked the UK privacy watchdog to investigate PimEyes. #### [New US FTC Commissioner Bedoya signals support for broad view of online privacy harms – ](https://mlexmarketinsight.com/news/comment/comment-new-us-ftc-commissioner-bedoya-signals-support-for-broad-view-of-online-privacy-harms?ref=thenexusofprivacy.net)Paywalled Mike Swift on MLexMarketing (mlexmarketinsight.com) The US Federal Trade Commission traditionally has been staffed by lawyers, economists and — more recently — by computer scientists who untangle the complex workings of online platforms #### [Harsher penalties for data breaches in new Australian privacy bill](https://securityboulevard.com/2022/11/harsher-penalties-for-data-breaches-in-new-australian-privacy-bill?ref=thenexusofprivacy.net) Nik Hewitt on Security Boulevard (securityboulevard.com) High-profile breaches mean high-profile action In the aftermath of another crop of high-profile data breaches, the Australian Government (also known as the Commonwealth Government) has introduced amendments to Australian privacy law which give the regulator new powers and the ability to impose harsh penalties. #### #### [Why Data Privacy Should Matter To Advertisers](https://forbes.com/sites/forbesbusinessdevelopmentcouncil/2022/11/09/why-data-privacy-should-matter-to-advertisers?ref=thenexusofprivacy.net) Emilia Kirk on Forbes (forbes.com) The death of the cookie opens the door for new, more innovative forms of advertising that respect user privacy while also offering engaging and relevant content. #### [Data privacy lawsuits explode in healthcare, tech sectors](https://securitymagazine.com/articles/98610-data-privacy-lawsuits-explode-in-healthcare-tech-sectors?ref=thenexusofprivacy.net) Ian Cohen on Security Magazine (securitymagazine.com) Cybersecurity executives can explore three recent data privacy lawsuits to determine whether their organizations are truly compliant with data sharing laws. --- *Image credit:* Daquella manera on [Flickr ](https://www.flickr.com/photos/62518311@N00/466172168?ref=thenexusofprivacy.net) via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons Attribution 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net) license. ### The elephant and the lame duck: ADPPA after the midterms (a federal privacy legislation update) URL: https://thenexusofprivacy.net/the-elephant-and-the-lame-duck/ Last updated: 2026-04-16T02:53:37.000Z > It could well be that \[lobbyists\] are just posturing, and the industry plan is to demand concessions on other fronts in return for a "compromise" on preemption. > > – me, in [A "fresh wrench", two hearings, and a busy week](https://thenexusofprivacy.net/a-fresh-wrench-and-two-hearings/#what-next-on-preemption), July 17 Congress heads back to DC this week for the lame duck session. The Democrats did much better than expected in the midterms because so many voters are passionate about protecting reproductive freedom after the Supreme Court's decision ending Roe. Will Congressional Democrats show their appreciation by passing [a privacy bill that fails to protect against post-Roe threats](https://nexusofprivacy.net/adppa-post-roe-threats/?ref=thenexusofprivacy.net)? It doesn't seem like a very good idea to me ... but it seems like they're giving it a try. - Alfred Ng's paywalled story today on Politico Pro [reports](https://subscriber.politicopro.com/article/2022/11/lawmakers-want-to-squeeze-in-privacy-bills-before-end-of-congress-00066730?ref=thenexusofprivacy.net) that the sponsors of the American Data Privacy and Protection Act (ADPPA) are going to take one last try at getting it through.\* - As [How well does ADPPA protect against post-Roe threats?](https://thenexusofprivacy.net/adppa-post-roe-threats/) discusses, loopholes in the current version of ADPPA leave pregnant people and abortion care providers at risk. It's quite possible that most Congressional Democrats don't even know this is an issue with ADPPA. There's been so little discussion about it that I call it the elephant in the room. Instead, most of the discussion has focused on how the current version preempts current and future California privacy laws. Speaker Pelosi and the California delegation have quite rightly said is a non-starter. So unless there's some kind of breakthrough in negotiations, ADPPA's not going anywhere this session. But who knows, maybe the sponsors have a card up their sleeve ... We'll get back to preemption and ADPPA's chances of passing below – along with some lessons from our experiences here in Washington state. But first, let's talk about the elephant. ## Does ADPPA protect against post-Roe privacy threats? > Sen. Ron Wyden, D-Ore., who has previously expressed he would not vote for the House version of the bill, has similar concerns about the exemption of de-identified data. > > “\[T\]his loophole could allow data brokers to sell location data to the government about visits to reproductive health facilities, for example, or other private information that is trivially easy to connect to individuals,” a Wyden aide wrote in an email to CyberScoop. “He strongly believes this must be fixed before any legislation becomes law.” > > – Tonya Riley, [Federal privacy legislation progresses, but concerns about data brokers loom](https://cyberscoop.com/privacy-data-brokers-house-ftc-commerce?ref=thenexusofprivacy.net) on CyberScoop Sen. Wyden's usually right about stuff like that – and the de-identified data loophole is one only of the ways ADPPA falls short. Here are a few more, from [How well does ADPPA protect against post-Roe threats?](https://thenexusofprivacy.net/adppa-post-roe-threats/). In the chart below, **❌** means "*no"* and **❓** means **"** *I’m not sure or it's complex"* - ❌ Does ADPPA prevent prosecutors and law enforcement in states that have criminalized abortion from buying location data and targeting people who visit reproductive health care centers? **NO.** - ❌ When people travel out of state to get abortions, does ADPPA protect their data? **NO.** - ❌ Does ADPPA allow pregnant people to force companies to delete data that might put them at risk? **NO.** - ❌ Does ADPPA protect pregnant people and abortion providers from risks of automated license plate readers (ALPRs)? **NO.** - ❓Does ADPPA prevent anti-abortion “crisis pregnancy centers” from sharing data with vigilantes and law enforcement? Maybe, but there's a potential looploe they could exploit. - ❓Will ADPPA hold “crisis pregnancy centers” who break the law and violate people’s privacy accountable? Maybe, but when you look at it closely it's not clear. - ❌ Will ADPPA prevent law enforcement from accessing people's private messages to investigate whether they got an abortion? **NO.** [The full post](https://thenexusofprivacy.net/adppa-post-roe-threats/) goes into detail on all of these. At a high level, though, this summary from Kim Clark of Seattle-based Legal Voices (quoted in Orion Donovan-Smith’s Spokane [*Spokesman-Revi*ew article](https://www.spokesman.com/stories/2022/jul/25/historic-data-privacy-law-could-be-within-reach-if/?ref=thenexusofprivacy.net)) nails it: > “This bill, at least from the perspective of pregnant people, it really doesn’t do much” ## But wait, there's more ADPPA's failure to protect against post-Roe threats is only one of the problems with the current version of the bill. To start with, the de-identified data loophole Sen. Wyden warns about has a lot of other consequences too. Joseph Cox' [How the U.S. Military Buys Location Data from Ordinary Apps](https://www.vice.com/en/article/jgqm5x/us-military-location-data-xmode-locate-x?ref=thenexusofprivacy.net) on *VICE Motherboard* looks at how de-identified data was used to target Muslims. Sara Morrison's [This outed priest’s story is a warning for everyone about the need for data privacy laws](https://www.vox.com/recode/22587248/grindr-app-location-data-outed-priest-jeffrey-burrill-pillar-data-harvesting?ref=thenexusofprivacy.net) on *Vox* highlights the potential impact on LGBTAIQ2S+ people. As EFF's Bennett Cyphers [says](https://www.eff.org/deeplinks/2022/08/inside-fog-data-science-secretive-company-selling-mass-surveillance-local-police?ref=thenexusofprivacy.net), > Academic researchers have shown [over](https://www.osti.gov/pages/servlets/purl/1095747?ref=thenexusofprivacy.net) and [over again](https://link.springer.com/chapter/10.1007/978-3-642-27576-0%5F3?ref=thenexusofprivacy.net) that de-identified or “anonymized” location data [still poses privacy risks](https://dl.acm.org/doi/10.1145/2030613.2030630?ref=thenexusofprivacy.net). But wait, there's more: - [**ADPPA’s algorithmic impact assessments are too weak to make its civil rights protections against anti-discrimination real**](https://thenexusofprivacy.net/adppa-impact-assessments-and-civil-rights/). ADPPA lets companies like Facebook do their own analysis of whether their algorithms are discriminatory – and exempts government contractors from having to do *any* algorithimic impactassessments. What could possibly go wrong? [Automated Systems and Discrimination](https://thenexusofprivacy.net/comments-for-ftc-public-forum-for-commercial-surveillance/) goes into more detail on how ADPPA falls short of the standards the of the AI Bill of Rights recently released by the White House Office of Science and Technology Policy. - **ADPPA puts up barriers to state Attorneys General enforcing the law**.\*\* AGs from states including Connecticut, Illinois, Maine, Massachusetts, Nevada, New Mexico, New Jersey, New York, and Washington warned in a July 19 letter that the current version of the bill appears to [“substantially preempt many states’ ability to investigate” and “unnecessarily interferes with robust enforcement capabilities.”](https://oag.ca.gov/system/files/attachments/press-docs/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf?ref=thenexusofprivacy.net)​​ - **ADPPA doesn't protect LGBTAIQ2S+ people –** and the de-identified data loophole is only one of the many reasons why. [Stress-testing ADPPA with a queer lens](https://thenexusofprivacy.net/adppa-with-a-queer-lens/) discusses how ADPPA stacks up against threats to queer people Antoine Prince Albert III wrote about in [Hiding OUT: A Case for Queer Experiences Informing Data Privacy Laws](https://publicknowledge.org/hiding-out-a-case-for-queer-experiences-informing-data-privacy-laws?ref=thenexusofprivacy.net). - **ADPPA's "internal research" exemption arguably undermines the entire purpose of privacy legislation –** at least according toWashington Attorney General Ferguson's [June 24 letter](https://www.documentcloud.org/documents/22111995-ferguson-privacy-letter-to-4-corners%5F6-24-2022?ref=thenexusofprivacy.net) to Congress. [ADPPA’s data minimization and duty of loyalty](https://thenexusofprivacy.net/adppa-data-minimization/) goes into detail. The [Washington Indivisible federal privacy "one-pager](https://indipluswa.medium.com/washington-indivisible-federal-privacy-one-pager-add67a8c1453?ref=thenexusofprivacy.net)", from a briefing with staffers I helped arrange in September, has a longer list of issues and links to more references. ## How grand is the bargain? Like I mentioned above, it's quite possible that most Congressional Democrats many of them don't realize that these are issues. When I brought up the loopholes leaving pregnant people at risk in a meeting staffers had with local Indivsible activists in July, it was news to them – which probably means the Congressperson they work for didn't know about it either. And one of the favorite talking points for ADPPA supporters is "perfect is the enemy of the good," encouraging Democrats to view not protecting the people who voted for them as a necessary "compromise" that has to be made to get anything through Congress. Cameron Kerry's description of ADPPA as a “[grand bargain](https://twitter.com/privacypen/status/1549237595418365952https://www.brookings.edu/blog/techtank/2022/06/22/endgame-on-the-narrowing-path-ahead-for-privacy-legislation/?ref=thenexusofprivacy.net)” is a good example of this framing: - People all over the country get some protections including anti-discrimination (that probably can't be enforced) and a very weak "private right of action" allowing them to sue companies (as long as they go through enough hoops, and as long as companies don't require arbitration, which ADPPA allows them to do) - In return, states like California and Maine (and cities like Seattle) who have passed stronger protections for their residents have to give them up. And states like Washington, where we're on track to pass strong cosumer privacy legislatin next year, have to give up any possibility of better protecting residents in the future. Of course Kerry uses somewhat different language that makes the bargain seem more attractive – and he leaves out a few important things. Nowhere in his article does he mention the post-Roe threats that aren't addressed, the lesser protection LGBTAIQ2S+ people get under ADPPA, the barriers to AGs and privacy agencies enforcing the law, the exemptions for government contractors and other service providers, and so on. Factor all of that in, and it doesn't seem like such a grand bargain to me. Other Washington privacy advocates also don't think it's a good deal. Then again, opinions differ. My Congresswoman, Rep. Suzan DelBene, supports ADPPA in its current form. Of course as well as representing me, Rep. DelBene also represents Microsoft and other businesses headquartered in her district, and is an honorary chair of tech-funded think tank Information Technology and Innovation Foundation (ITIF). So my guess is she probably spends a lot more time listening to industry lobbyists than she does to constituents like me. ## Lobbyists are very good at what they do – and we've learned to recognize some of their favorite tactics Most legislators and staffers spend a lot of time listening to lobbyists. This is a huge problem for groups like EPIC and Lawyers' Comittee, who are in a tough position here, trying to move ADPPA forward while defending against [lobbyists' attempts to further weaken it](https://www.politico.com/news/2022/08/28/privacy-bill-triggers-lobbying-surge-by-data-brokers-00052958?ref=thenexusofprivacy.net). At least so far, [the lobbyists are winning](https://www.protocol.com/newsletters/policy/cloud-enterprise-privacy?ref=thenexusofprivacy.net). We've got a lot of experience with this here in [the other Washington](https://thenexusofprivacy.net/the-view-from-the-other-washington-federal-privacy-legislation-adppa-update-6-22/), where tech lobbyists and [industry-funded privacy groups like Future of Privacy Forum (FPF)](https://fpf.org/about/supporters/?ref=thenexusofprivacy.net) have spent years trying to get the Bad Washington Privacy Act (Bad WPA) through our legislature. Over the years, we've learned to recongize some of their favorite tactics. Back in 2020, for example, AG Ferguson said that the Bad WPA was literally unenforceable. Microsoft framed it as "[raising the bar for privacy in the United States](https://blogs.microsoft.com/on-the-issues/2020/01/24/washington-privacy-act-protection/?ref=thenexusofprivacy.net) "and lauded its strong enforcement. FPF said passing the Bad Washington Privacy Act would be a "[significant achievement](https://fpf.org/blog/a-new-model-for-privacy-in-a-new-era-evaluating-the-washington-privacy-act/?ref=thenexusofprivacy.net)"; the chart in their analysis, which they also sent to legislators, inaccurately claimed that the AG could enforce the bill. The [disinfomation analysis](https://docs.google.com/document/d/1m5uh5-AJ7%5F%5FklJmsDzKwisL9unwacntL/edit?ref=thenexusofprivacy.net) I did of a "quick summary" document lobbyists shared with legislators in 2021, and the fact-checking and the [misleading claims in Washington Tech Industry Association 's 2022 op-ed ](https://wapeoplesprivacy.org/correcting-misleading-claims-in-wtias-seattle-times-op-ed/?ref=thenexusofprivacy.net)(fact-checked [here](https://www.aclu-wa.org/story/fact-check-was-leadership-privacy-legislation?ref=thenexusofprivacy.net) by Jennifer Lee of ACLU of Washington and Maya Morales of WA People's Privacy), are two more good examples. And these lobbying tactics work, too. Almost every Washington state legislator I've talked to over the years initially thought the Bad WPA was a lot stronger than it actually was. Fortunately we've been able to spend enough time with them that they've seen through the spin and our Legislature has rejected the Bad Washington Privacy Act four years in a row ... but that's a lot easier with state legislators than it is with Congress. Other states haven't been so successful. [Virginia's privacy law was drafted by Amazon](https://www.reuters.com/investigates/special-report/amazon-privacy-lobbying/?ref=thenexusofprivacy.net), and it whisked right through.\*\*\* Lobbyists are taking a similar approach with ADPPA. ITIF, for example, [described](https://itif.org/publications/2022/06/06/american-data-privacy-and-protection-act-review-part-1-state-preemption-and-private-right-of-action/?ref=thenexusofprivacy.net) the June draft of ADPPA as having "strong enforcement measures" even though it explicitly prevented California Privacy Policy Agency (CPPA, by far the strongest and largest state privacy regulator in the country) from enforcing it – and even though it would substantially preempt state AGs' ability to investigate and unnecessarily interfere with their robust enforcement capabilities. Hey wait a second, I'm noticing a pattern here!\*\*\*\* Another game lobbyists are playing is to focus the discussion on comparisons between ADPPA and state legislation. This tactic has been very effective at putting the privacy and civil liberties organizations who support ADPPA into a position where they're mostly talking about the bill's strengths rather than weaknesses.\*\*\*\*\* Even better, from lobbyists' perspective, the more people are comparing ADPPA to other bills, or arguing about preemption, the less attention the elephant gets. ## Okay, now we can talk about preemption > It could well be that ... the industry plan is to demand concessions on other fronts in return for a "compromise" on preemption: add California's privacy law to the already-long list of preemption exceptions, give the California Privacy Protection Agency the authority they need, and hangs Maine, Washington, and all the other states that also don't want to be preempted out to dry. > > – me, in [A "fresh wrench", two hearings, and a busy week](https://thenexusofprivacy.net/a-fresh-wrench-and-two-hearings/#what-next-on-preemption), July 17 Pelosi and California Democrats have made it clear [since 2019](https://www.politico.com/story/2019/02/21/congress-data-privacy-california-1185943?ref=thenexusofprivacy.net) that they wouldn't accept a bill that preempts California's law this position. So why did everybody pretend to be so surprised with this "fresh wrench" cropped up again in July? My guess at the time was that lobbyists were trying to set things up so that they could announce a "dramatic" last-minute "compromise" on ADPPA. And sure enough, starting in September, articles like the LA Times editorial [Congress must fix data privacy bill so it doesn’t hurt Californians](https://www.latimes.com/opinion/story/2022-09-12/editorial-congress-fix-data-privacy-bill-preempt-california?ref=thenexusofprivacy.net) have been suggesting a waiver for California – and perhaps allowing other states to choose to adopt California's law as an alterntative to the federal law. Who could have predicted? To be clear: giving California a waiver doesn't address the preemption concerns of other states – or of cities and counties, in California or elsewhere. All it does is maybe get California's delegation on board, and make corporations' life easier. As Maya Morales of WA People's Privacy says, [preemption privileges the needs of corporations over the needs of people](https://wapeoplesprivacy.org/our-public-comment-in-historic-ccpa-meeting/?ref=thenexusofprivacy.net). Of course, industry will frame any "compromise" as a major concession, and so they'll almost certainly demand other areas of ADPPA get further weakened. If we do see a new version, it wouldn't surprise me if the algorithmic impact assessments are even weaker – or perhaps removed entirely. And it'll be very interesting to see what new loopholes and exemptions get put in. ## Reading the political tea leaves If lobbyists play their cards right, and there really is an "unexpected breakthrough" on preemption waiting in the wings, then maybe the possibility of actually being able to pass *something* will keep groups like EPIC Privacy and Lawyers' Committee on board despite the weaknesses they acknowledge in the bill. That in turn might give Democratic legislators cover to ignore the elephant and pass a bill that doesn't protect against post-Roe threats (and gives lesser protections to LGBTAIQ2S+ people, allows companies like Facebook to self-assess whether their algorithms are discriminatory, puts up barriers to Democratic AGs to enforce it etc etc etc). After all, "perfect is the enemy of the good" – and even though West Coast privacy organizations like EFF and WA People's Privacy oppose ADPPA, Congress often pays more attention to DC-based groups. The most likely way for ADPPA to move forward at this point is to attach it to the omnibus appropriations bill (as Senators Blumenthal and Markey are reportedly trying to do with COPPA 2.0).\*\*\*\*\*\* From lobbyists' perspective, this has the advantage of minimizing how much scrutiny the bill gets – no need for a hearing or markup in the Senate, and the omnibus bill is so huge that there wouldn't be time for any discussions about the elephant or anything else. Then again, there's not a lot of time in the session, and there's a lot of other stuff on Congress' plate. So it's quite possible that ADPPA *won't* actually move forward at all in the lame duck session. At this point, it seems to me that would be the best outcome. The power balance in Congress next session is still up in the air as I write this, and they might well get deadlocked again on privacy. But states aren't waiting for Congress to act, and some of the new bills being considered are quite strong – for example, [Washington's proposed health data privacy law completely bans sales of health data](https://www.atg.wa.gov/news/news-releases/ag-ferguson-rep-slatter-sen-dhingra-propose-legislation-protect-washingtonians?ref=thenexusofprivacy.net) and requires opt-in to collect or share it. And that means the conversations in DC next session could be very different. Still, industry has enough to gain from passing a weak preemptive federal privacy bill that they won't give up easily. Late-session negotiations in Washington state have featured some spectacular shenanigans – like the time in 2021 when [Bad WPA sponsor Sen. Reuven Carlyle (D-Amazon) tried to hold funding for eviction protection hostage](https://indipluswa.medium.com/indivisibles-say-pass-hb-1277-to-mitigate-harm-on-vulnerable-communities-from-eviction-2956bc5db1c8?ref=thenexusofprivacy.net) to get his colleagues to pass his bill. So we'll see what happens. Maybe nothing! But as we 've learned time and again here in Washington state, [it ain't over 'til its over](https://wa-privacy.net/it-aint-over-till-its-over/?ref=thenexusofprivacy.net). --- *Image credit: Savanna elephant in Kruger National Park, South Africa. By Felix Andrews (*[*CC-BY-SA-3.0*](http://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net)*) via* [*Wikimedia Commons*](http://commons.wikimedia.org/wiki/File:Elephant%5Fside-view%5FKruger.jpg?ref=thenexusofprivacy.net)*.* ## Notes \* In his Washington Post [Across the Aisle](https://acrosstheaislesept29.splashthat.com/?ref=thenexusofprivacy.net) discussion in September, ADPPA co-sponsor House Energy & Commerce Chair Frank Pallone (D-NJ) had confidence that there was enough time to get the bill through in the lame duck session so this doesn't come as a complete suprise. \*\* §404(b)(2)(A): “a violation of this Act shall not be pleaded as an element of any such cause of action." The AG's letter says: > In many states, the Attorney General’s office uses civil investigative demands under its consumer protection authority to demand documents or information from entities when we believe there could have been a violation of a law. Ordinarily, a violation of a federal law or standard could also be a violation of state consumer protection law. But Section 404 would act as a bar to investigate violations of the federal law, because it prohibits them from forming the basis for state consumer protection claims. This language unnecessarily interferes with robust enforcement capabilities. We're especially annoyed by this in Washington because after a big legislative battle over exactly this issue in 2020 *(*which I'll discuss later in the post), big tech conceded on this here in 2021! So even though it's not surprising, it's still kind of annoying to discover that tech lobbyists' fingers were crossed. \*\*\* There's an interesting backstory here. An Amazon lobbyist gave a copy of the Bad Washington Privacy Act to a Virginia state legislator, and after weakening it they quickly passed the Even Worse Virginia Privacy Act. So if the Virginia bill was drafted by Amazon, what does that say about the Washington bill? For what it's worth, Bad Washington Privacy Act sponsor Sen. Reuven Carlyle (now retired after going 0-for-4 trying to pass his signature legislation) represents Amazon’s district and considers their lobbyist Guy Palumbo a [treasured friend](https://twitter.com/Reuvencarlyle/status/1131950017437163520?ref=thenexusofprivacy.net). But maybe that’s all just a coincidence. \*\*\*\* The current version is slightly better: It allows CPPA and other state privacy agencies to enforce the bill, which is good, although the barriers to AG enforcement may effect them as well. But as discussed earlier, it still has the same barriers to AG enforcement. \*\*\*\*\*Jon Leibowitz (co-founder of the [21st Century "Privacy" Coalition](https://www.theatlantic.com/politics/archive/2015/05/the-privacy-coalition-that-wants-to-trim-data-regulations-for-telecom-giants/456477/?ref=thenexusofprivacy.net), whose [funders](https://stopthecap.com/2017/07/19/californias-internet-privacy-legislation-undermined-industry-funded-privacy-group/?ref=thenexusofprivacy.net) include Comcast, AT&T, Verizon, Time Warner Cable/Charter Communications, and DirecTV and their respective trade associations) was very candid about this tactic in his [February Wall Street Journal op-ed](https://thenexusofprivacy.net/a-fresh-wrench-and-two-hearings/#lobbyists-gonna-lobby). Cristiano Lima's [Federal privacy bill trumps California’s law, advocates say](https://www.documentcloud.org/documents/22087567-advocates-memo-comparing-federal-privacy-bill-with-california-law?ref=thenexusofprivacy.net), from mid-July in the Washington Post, is a high-profile example of how these techniques work together. It linked to a detailed [comparison](https://www.documentcloud.org/documents/22087567-advocates-memo-comparing-federal-privacy-bill-with-california-law?ref=thenexusofprivacy.net) making a misleading claim that ADPPA was better than California's laws in 13 of 15 areas. The authors' [revised version](https://www.documentcloud.org/documents/22087567-advocates-memo-comparing-federal-privacy-bill-with-california-law?ref=thenexusofprivacy.net) walking back several of these claims, but of course that didn't get mentioned by the Washington Post. Neither did Californians for Consumer Privacy's later analysis, which came to the opposite conclusion: [California's law is stronger than ADPPA in 23 of 25 areas](https://www.caprivacy.org/analysis-shows-cpra-is-significantly-stronger-than-adppa/?ref=thenexusofprivacy.net). This is a fun game to play – One out of six ain't good is my contribution – but also serves as a distraction from the elephant and other questions about whether ADPPA actually protects people. \*\*\*\*\*\* Technically there's just enough time that it could go the normal route: the House passes it, the Senate Commerce Committee marks it up, the Senate passes it, and if necessary the chambers reconcile any differences. But this could be challenging, both from a timing perspective and because Senate Commerce Committee Chair Maria Cantwell has been resolute about not supporting a preemptive bill that would preempt Washington state – so they'd either have to convince her that the "compromise" is good enough or drop preemption completely. Unanimous consent, which lets them skip some steps of the process, can speed things up, but it requires consent of *all* members, so it's even more unlikely to happen. ### Privacy News: November 10 - and a bit about disinfo too URL: https://thenexusofprivacy.net/privacy-news-november-10/ Last updated: 2022-11-10T18:02:47.000Z First of all, apologies to subscribers for not providing more context about why we suddenly had two newsletters in a row about [protecting democracy by fighting disinformation](https://thenexusofprivacy.net/5-ways-to-fight-disinfo/)! As we say on the [About](https://thenexusofprivacy.net/about/) page, The Nexus of Privacy looks at the connections between technology, policy, strategy, and justice, so disinformation and the strategies about how to respond to it are certainly within scope. And with the very [real and growing threats to democracy](https://oag.ca.gov/news/press-releases/attorney-general-bonta-calls-social-media-companies-stop-spread-disinformation?ref=thenexusofprivacy.net) from disinformation on social media in the US midterm elections, I wanted to get something out to prepare people for the likely increase in disinfo over the next few weeks. But what I didn't highlight in those posts is that there are direct ties between privacy and the ways disinfo is spread on social media. Two examples – - There's still disagreement about how much impact Cambridge Analytica's illegally-acquired data had on Brexit, the 2016 US election, and all the other contries they worked in ... but there's no debate at all that they acquired the data without consent. And back in July, as I discussed in [ADPPA Advances. But what about the elephant?](https://thenexusofprivacy.net/what-about-the-elephant/), Cobun Zweifel-Keegan of IAPP pointed out to me that one of the changes the House Energy & Commerce Committee made to proposed American Data Privacy Protection Act reminded me could exempt businesses like Cambridge Analytica from some audit and governance requirements. What could possibly go wrong? - In 2022, [Facebook and Tiktok aren't removing ads with election disinformation](https://thehill.com/policy/3697761-tiktok-facebook-failed-to-remove-ads-spreading-election-misinformation-report/?ref=thenexusofprivacy.net). Just like other ads, data acquired without consent from all kinds of different sources is used to target them at the people most likely to be "persuaded". And another change the committee made was to [remove ADPPA's requirement for third-party algorithmic impact assessments (AIAs)](https://thenexusofprivacy.net/adppa-impact-assessments-and-civil-rights/). So now Facebook gets to do their own assessment of whether there are any risks or biases in their targeting of disinfo. Call me skeptical but I think [that undercuts ADPPA’s ability to protect civil rights](https://thenexusofprivacy.net/adppa-impact-assessments-and-civil-rights/) ... unless of course you trust Facebook to do these analyses. [Yeah, right](https://time.com/6197154/facebook-india-human-rights/?ref=thenexusofprivacy.net). So I wasn't just chaning the subject with those disinfo posts – even though it might have looked that way! ### [The Quiet Invasion of ‘Big Information’](https://wired.com/story/big-information-relx-privacy-surveillance-data?ref=thenexusofprivacy.net) Sarah Lamdan on WIRED (wired.com) In an excerpt from her new book [Data Cartels: The Companies That Control and Monopolize Our Information](https://www.sup.org/books/title/?id=33205&ref=thenexusofprivacy.net), Landam looks at Reed Elsevier LexisNexis (RELX), which she describes as "a Frankensteinian amalgam of publishers and data brokers, stitched together into a single information giant." Indeed. > Police have abused LexisNexis systems to spy on exes and even to [blackmail women](https://www.leoweekly.com/2022/10/feds-ex-louisville-police-officer-used-law-enforcement-tech-to-help-hack-sexually-explicit-photos-from-women/?ref=thenexusofprivacy.net) using the personal information the company’s policing products provide. Using RELX products for data surveillance is problematic because the company funnels a deluge of unfiltered, unvetted data through [biased data-processing algorithms](https://www.washingtonpost.com/technology/2022/07/15/predictive-policing-algorithms-fail/?ref=thenexusofprivacy.net). The combination of bad data and bad algorithms [leads to government systems](https://www.technologyreview.com/2020/07/17/1005396/predictive-policing-algorithms-racist-dismantled-machine-learning-bias-criminal-justice/?ref=thenexusofprivacy.net) that bake historically racist, xenophobic policing practices and outcomes into a *Minority Report*\-like digital policing dystopia. > > The companies’ error-riddled data has [prevented people from accessing their own bank accounts and getting insurance](https://www.newsweek.com/2019/10/04/lexisnexis-mistake-data-insurance-costs-1460831.html?ref=thenexusofprivacy.net), and from [being able to rent homes](https://www.texasobserver.org/evictions-texas-housing/?ref=thenexusofprivacy.net). The mistakes in RELX’s data make it all the more worrisome. RELX is growing its list of data analytics products, and is even developing technology that [makes predictions about your health](https://risk.lexisnexis.com/about-us/press-room/press-release/20221018-patent-pending-token-and-de-identified-medical-claims?ref=thenexusofprivacy.net) based on your private medical records, assessing your health risks for insurers and your doctors. Imagine what could happen to your health care access if you were wrongly tagged as at risk for opioid abuse or as having a certain chronic illness. And as Alfred Ng describes in [Privacy bill triggers lobbying surge by data brokers](https://www.politico.com/news/2022/08/28/privacy-bill-triggers-lobbying-surge-by-data-brokers-00052958?ref=thenexusofprivacy.net), RELX and data brokers have been lobbying heavily to weaken ADPPA. > The brokers, including U.K.-based data giant RELX and credit reporting agency TransUnion, want changes to the bill — such as an easing of data-sharing restrictions that RELX says would hamper investigations of crimes. Some data brokers also want clearer permission to use third-party data for advertising purposes. ### [Apple Tracks You Even With Its Own Privacy Protections on, Study Says](https://gizmodo.com/apple-iphone-analytics-tracking-even-when-off-app-store-1849757558?ref=thenexusofprivacy.net) Thomas Germain on Gizmodo (gizmodo.com) An independent test suggests Apple collects data about you and your phone when its own settings promise to “disable the sharing of Device Analytics altogether.” > The iPhone Analytics setting makes an explicit promise. Turn it off, and Apple says that it will “disable the sharing of Device Analytics altogether.” However, Tommy Mysk and Talal Haj Bakry, two app developers and security researchers at the software company Mysk, took a look at the data collected by a number of Apple iPhone apps—the App Store, Apple Music, Apple TV, Books, and Stocks. They found the analytics control and other privacy settings had no obvious effect on Apple’s data collection—the tracking remained the same whether iPhone Analytics was switched on or off. Bummer. ### [JP Morgan Wants to Make Tenant Data Available to Every Landlord](https://vice.com/en/article/k7bkyn/jp-morgan-wants-to-make-tenant-data-available-to-every-landlord?ref=thenexusofprivacy.net) Chole Xiang on vice.com Tenants get to throw away their checkbooks. Landlords learn how much to raise your rent by. What could possibly go wrong? ## FTC Regulations #### [Our Response to the FTC’s Advanced Notice of Proposed Rulemaking (ANPR) on Commercial Surveillance and Data Security](https://datasociety.net/announcements/2022/11/09/response-to-the-ftcs-advanced-notice-of-proposed-rulemaking-on-commercial-surveillance-and-data-security?ref=thenexusofprivacy.net) Data & Society (datasociety.net) Comments for the FTC's ANPR have to be submitted by November 21\. Data & Society's comments make some important points – and at 19 pages long show how much effort some organizations put into comments. That said, if you're doing comments yourself, they don't have to be anywhere near this elaborate. As I say in [How and why to submit FTC comments on Commercial Surveillance and Data Security](https://thenexusofprivacy.net/how-and-why-to-submit-ftc-comments-on-commercial-surveillance-and-security/) > Comments can be simple and short; even just saying something like "My personal data shouldn't be exploited, the FTC needs to take action" is useful. Even better is if you can tell a story about yourself or somebody you know. Or, you can respond to one or more of the [95 (!) questions in the ANPR](https://www.ftc.gov/legal-library/browse/federal-register-notices/commercial-surveillance-data-security-rulemaking?ref=thenexusofprivacy.net) (also available in a [PDF](https://www.ftc.gov/system/files/ftc%5Fgov/pdf/commercial%5Fsurveillance%5Fand%5Fdata%5Fsecurity%5Fanpr.pdf?ref=thenexusofprivacy.net)). ## State privacy legislation ### [California jumps out in front (again) on data privacy – here’s how](https://wraltechwire.com/2022/11/09/california-jumps-out-in-front-again-on-data-privacy-heres-how?ref=thenexusofprivacy.net) Steve Britt and Sarah Hutchins on WRAL TechWire (wraltechwire.com) The expansive powers of the California Privacy Protection Agency (CPPA) should not be overlooked, especially since CCPA has already been the subject of four rounds of Attorney General regulations, in some cases imposing rules beyond what was provided in the statute. ### [California’s New Child Privacy Law Could Become National Standard](https://pew.org/3FLHGpK?ref=thenexusofprivacy.net) Caitlin Dewey on Pew Trust's Stateline News Service (pewtrusts.org) California's new Age Appropriate Design Code imposes sweeping restrictions on internet companies that serve minors, requiring that they design their platforms with children’s “well-being” in mind and barring eight common data-collection practices. A broad coalition of privacy groups supported it – although there are also a lot of concerns about unintended consequences. Tech industry groups strongly opposed it, and could still sue to block it. As Dewey reports, "Even advocates have acknowledged that portions of the act are overly vague, leaving major questions about how companies will comply when it goes into effect." But it's also likely to be used as a model for other bills around the country. ## Mastodon (the social network not the extinct elephant) *Mastodon's the decentralized open-source Twitter alternative that's getting a lot of attention in the aftermath of the Twitter acquisition. There's a lot of buzz about Mastodon as Twitter turns into a hellscape, a lot of interesting privacy issues, and a lot of connections between the technology, policy, strategy, and justice. So expect to see some Mastodon news here from time to time!* *Danielle Navarro's* [*Everything I know about Mastodon* ](https://blog.djnavarro.net/posts/2022-11-03%5Fwhat-i-know-about-mastodon/?ref=thenexusofprivacy.net)*is a great introduction -- it's written for data science people but useful for everybody! Sunny Singh's* [*Leaving Twitter says more about you than Elon Musk*](https://www.opendemocracy.net/en/twitter-blue-ticks-elon-musk-white-people-leaving/?ref=thenexusofprivacy.net) *and Twitter threads from* [*@ISASaxonists*](https://twitter.com/ISASaxonists/status/1590101263437688833?ref=thenexusofprivacy.net) *and* [*@IBJIYONGI*](https://twitter.com/IBJIYONGI/status/1589628437601615874?ref=thenexusofprivacy.net) *have good racial justice perspectives;* [*Black Twitter's not giving up without a fight looks*](https://thenexusofprivacy.net/fight-election-disinfo-on-mastodon/#black-twitters-not-giving-up-without-a-fight) *has several more links.* ### [Mastodon: What you need to know for your security and privacy](https://grahamcluley.com/mastodon-what-you-need-to-know-for-your-security-and-privacy?ref=thenexusofprivacy.net) on Graham Cluley (grahamcluley.com) Cluley has some solid suggestions for the security basics: choose a strong password, enable two-factor authentication, be alert because it's easy to impersonate, and be aware that direct messages aren't encrypted so administrators and moderators on your site and the sites the other people you're talking to are on can all read them. It's disappointing, though, that he doesn't talk about how to keep yourself secure against harassment, which as Caroline Sinders points out in [I’m @Sinders on Mastodon but I’m not giving up on Twitter, yet](https://medium.com/@carolinesinders/im-sinders-on-mastodon-but-i-m-not-giving-up-on-twitter-yet-5dcd4fb810e1?ref=thenexusofprivacy.net) is a big problem. ## And ... #### [Will the DSA work?](https://verfassungsblog.de/dsa-money-effort?ref=thenexusofprivacy.net) Martin Husovec on Verfassungsblog (verfassungsblog.de) The Digital Services Act (DSA) is an ambitious project. It constrains private power to protect the freedom of individuals. Arguably, it is based on ordoliberal thinking that if competition does not discipline private power enough to facilitate individual freedoms, the state must intervene to prescribe basic rules of the game to constrain it; competition can do the rest. The DSA has many components but, in its essence, it is a digital due process regulation bundled with risk-management tools. But will these tools work? #### [Mysterious company with government ties plays key internet role](https://washingtonpost.com/technology/2022/11/08/trustcor-internet-addresses-government-connections?ref=thenexusofprivacy.net) Joseph Menn on The Washington Post (washingtonpost.com) TrustCor Systems, which vouches for the legitimacy of websites, has connections to contractors for U.S. intelligence agencies and law enforcement, according to security researchers, documents and interviews. #### [Crowdsourced Audits of Algorithmic Decision-Makers](https://citizensandtech.org/2021/11/crowdsourced-audit-studies?ref=thenexusofprivacy.net) J. Nathan Matias on Citizens and Technology Lab (citizensandtech.org) How can independent researchers reliably detect bias, discrimination, and other systematic errors in software-based decision-making systems? #### [The Temporal Dimension of Surveillance](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4269468&ref=thenexusofprivacy.net) Michael Birnhack on papers.ssrn.com From the abstract: > This article proposes a critical temporal analysis of surveillance. Along with identifying temporal aspects of a given surveillance setting, we should search for the temporal elements in the discourse about surveillance. This inquiry may enlighten how a particular surveillance apparatus was justified or rejected. > > This article illustrates the relevance of critical temporal inquiry for surveillance studies through a case study from Israel, where mass state surveillance was implemented for contact tracing during the Covid-19 pandemic. I examine three Supreme Court cases that scrutinized this apparatus, exposing how the judicial portrayal of the different time vectors affected its legitimacy. #### [Forrester: Data privacy practices are needed to protect users of immersive experiences](https://venturebeat.com/data-infrastructure/forrester-data-privacy-practices-are-needed-to-protect-users-of-immersive-experiences?ref=thenexusofprivacy.net) Victor Dey on VentureBeat (venturebeat.com) While AR/VR can create next-gen experiences for users, without stringent data privacy, it can also cause harmful manipulation. #### [What costs should we expect from the EU’s AI Act?, by Haataja, Meeri;](https://ideas.repec.org/p/osf/socarx/8nzb4.html?ref=thenexusofprivacy.net) zimmermannstlouisfed.org on ideas.repec.org This short analysis aims to provide an overview of the anticipated costs caused by the EU’s proposed AI regulation, the AI Act (AIA), to impacted organisations: both providers and deployers of systems #### [TikTok privacy cases can proceed in the Netherlands, court rules](https://dutchnews.nl/news/2022/11/tiktok-privacy-cases-can-proceed-in-the-netherlands-court-rules?ref=thenexusofprivacy.net) robin on DutchNews.nl (dutchnews.nl) Three Dutch foundations which are pursuing legal claims against social media company TikTok can continue to fight their cases in the Dutch court system, judges in Amsterdam ruled on Wednesday. TikTok had argued the cases should not be heard in the Netherlands because the claims were made against Tik… #### [Medibank breach: Hackers start leaking health data after ransomware attack](https://techcrunch.com/2022/11/09/medibank-ransomware-leak?ref=thenexusofprivacy.net) Carly Page on TechCrunch (techcrunch.com) Russian-speaking cybercriminals are leaking sensitive personal and health data stolen from Australia’s largest health insurance firm. #### [GDPR and the AI Act interplay: Lessons from FPF’s ADM Case-Law Report](https://fpf.org/blog/gdpr-and-the-ai-act-interplay-lessons-from-fpfs-adm-case-law-report%EF%BF%BC?ref=thenexusofprivacy.net) Read More on Future of Privacy Forum (fpf.org) In May 2022, the Future of Privacy Forum (FPF) launched a comprehensive Report analyzing case-law under the General Data Protection Regulation (GDPR) applied to real-life cases involving Automated Decision-Making (ADM). Our research highlighted that the GDPR’s protections for individuals against for… #### [‘We were taken for fools’: MEPs fume at UK data protection snub](https://politico.eu/article/we-were-taken-for-fools-meps-fume-at-uk-data-protection-snub?ref=thenexusofprivacy.net) Vincent Manancourt on POLITICO (politico.eu) MEPs were in Britain to scrutinize the country’s GDPR reform plans. #### [Privacy regulators call for respect of privacy, transparency rights in creating digital ID ecosystem](https://canadianlawyermag.com/practice-areas/privacy-and-data/privacy-regulators-call-for-respect-of-privacy-transparency-rights-in-creating-digital-id-ecosystem/371327?ref=thenexusofprivacy.net) Katrina Eñano on Canadian Lawyer (canadianlawyermag.com) Regulators set out list of conditions to include in design and operation of ID ecosystem #### [Tech giants and business warm to Labor’s privacy bill but point to flaws in drafting](https://theguardian.com/world/2022/nov/08/tech-giants-google-twitter-meta-facebook-accuse-australia-government-labor-overreach-privacy-bill-50m-company-fines-penalties-for-data-breach?ref=thenexusofprivacy.net) Paul Karp on The Guardian (theguardian.com) Business Council of Australia warns of ‘unintended drafting error’ in privacy bill #### [Duke asks that patient privacy suit be thrown out](https://wral.com/duke-asks-that-patient-privacy-suit-be-thrown-out/20564304?ref=thenexusofprivacy.net) WRAL on WRAL.com (wral.com) Duke University Hospital has asked a court to throw out a lawsuit over data tracking on its website. #### [Facebook group members may be liable under privacy laws](https://newsroom.co.nz/privacy-case-throws-up-liability-questions-for-social-media-groups?ref=thenexusofprivacy.net) Emma Hatton on Newsroom (newsroom.co.nz) Members of Facebook groups may hold more legal liability than they realise, as new privacy laws being tested through the courts decide where the lines will be drawn. #### [MPs debate ‘egregious’ content and privacy concerns under proposed law to enhance online safety](https://channelnewsasia.com/singapore/online-safety-egregious-harmful-content-children-social-media-josephine-teo-3053586?ref=thenexusofprivacy.net) Vanessa Lim on CNA (channelnewsasia.com) The Online Safety (Miscellaneous Amendments) Bill will allow IMDA to deal with harmful online content accessible to Singapore users, including those that originate outside the country. #### [Mass claim against Twitter for selling the data of 11 million Dutch users](https://nltimes.nl/2022/11/08/mass-claim-twitter-selling-data-11-million-dutch-users?ref=thenexusofprivacy.net) on NL Times (nltimes.nl) The Netherlands Data Protection Foundation is preparing a mass claim against Twitter on behalf of 11 million Netherlands residents. According to the foundation, Twitter collected and sold their privacy-sensitive data without permission through the advertising company MoPub, Trouw reports. #### [NY Is First to Require CLE on Cybersecurity, Privacy](https://news.bloomberglaw.com/bloomberg-law-analysis/analysis-ny-is-first-to-require-cle-on-cybersecurity-privacy?ref=thenexusofprivacy.net) Golriz Chrostowski on Request a Free Demo (news.bloomberglaw.com) New York lawyers will need to complete one CLE credit hour of cybersecurity, privacy, and data protection as part of their biennial learning requirement next year, making New York the first jurisdiction to implement such a requirement. #### [Privacy of rape victims ‘seriously undermined’ by criminal justice system, whistleblower claims](https://inews.co.uk/news/rape-victims-privacy-underminded-criminal-justice-system-cps-whistleblower-1955832?ito=twitter%5Fshare%5Farticle-top&ref=thenexusofprivacy.net) Serina Sandhu on inews.co.uk (inews.co.uk) The prosecutor said: ‘The legal change they have introduced clearly undermines victim privacy and anybody who has experience of prosecuting these cases understands that’ --- Image Credit: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net)[CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net)[Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [*Picpedia*](https://www.picpedia.org/highway-signs/p/privacy.html?ref=thenexusofprivacy.net). ### How to fight election disinfo on Mastodon (UPDATED) URL: https://thenexusofprivacy.net/fight-election-disinfo-on-mastodon/ Last updated: 2024-07-12T07:57:59.000Z *Last updated: November 9* > If you're on Mastodon, please help get the word out! [Here's a toot to boost](https://indieweb.social/@VotingRightsNews/109306666207899835https://mastodon.social/@nexusofprivacy/109315171118143829?ref=thenexusofprivacy.net) – or just share this post. > > If you don't care about Mastodon but still want to help fight disinfo, check out [5 ways to fight to protect democracy by fighting election disinformation](https://thenexusofprivacy.net/5-ways-to-fight-disinfo/) > "In the months leading up to the midterm elections, there have been major efforts to disrupt what is the most basic right in functioning democracies: voting." > > – Shireen Mitchell (aka [digitalsista](https://twitter.com/digitalsista?ref=thenexusofprivacy.net)) *of Stop Online Violence Against Women,* in [Disinformation: A Racist Tactic, from Slave Revolts to Elections](https://blog.ucsusa.org/guest-commentary/disinformation-a-racist-tactic-from-slave-revolts-to-elections/?ref=thenexusofprivacy.net), on Union of Concerned Scientists' The Equation Shireen Mitchell’s [*All of us have been targeted by disinformation*](https://vimeo.com/471961897?ref=thenexusofprivacy.net) > "There's a new racist, transphobic new Chief Twit who's personally boosting [homophobic disinfo](https://apnews.com/article/2022-midterm-elections-elon-musk-technology-misinformation-nancy-pelosi-42c1a39e8df739065abd70c400240d84?ref=thenexusofprivacy.net) as well as getting rid of half the company – including the head of Trust & Safety, the Human Rights, responsible AI, and accessibility teams. Later this week, Twitter's introducing a new product helping people boost disinfo for only $8/month, such a deal! And then they'll be letting people whose accounts have been suspending for breaking the site's rules against disinfo, hate speech, and harassment back on. > > What could possibly go wrong?" > > – me, in [5 ways to fight to protect democracy by fighting election disinformation](https://thenexusofprivacy.net/5-ways-to-fight-disinfo/) Election Day is over – but the election isn't. Now the focus will shift to post-ballot counting, claims of fraud, problems with voting machine, election lawfare ... so many opportunities for disinformation! After the 2020 election, disinfo fuelled an attempted coup. This year, nobody knows what to expect – Eddie Perez' [How Elon Musk’s Twitter Could Impact the Midterm Elections](https://techpolicy.press/how-elon-musks-twitter-could-impact-the-midterm-elections/?ref=thenexusofprivacy.net) on *Tech Policy Press and* [Manufactured Chaos is on a Collision Course with the 2022 Midterm](https://trustthevote.org/blog/2022/10/27/manufactured-chaos/?ref=thenexusofprivacy.net) on *Trust the Vote* sketch some possibilities.\* Disinformation is a problem on all social media platforms. Just last week, Calif0rnia Attorney General Bonta sent a sharply-worded [letter](https://oag.ca.gov/news/press-releases/attorney-general-bonta-calls-social-media-companies-stop-spread-disinformation?ref=thenexusofprivacy.net) to the CEOs of Meta, YouTube, Twitter, TikTok, and Reddit warning that the disinfo on their platform poses a "very real and growing threats to our democracy and to the rule of law." That said, disinfo's likely to be *especially* bad on Twitter for the next few weeks. Sounds like a good time time for Mastodon to get involved! Mastodon's a decentralized open-source social network, running on hundreds of different "instances" that can talk to each other. As Twitter turns into a hellscape hundreds of thousands of people are checking it out – as a backup, if Twitter goes down, and a potential alternative. Even though the numbers still are tiny compared to Twitter, a lot of the people and communities looking at it have very good networks on other sites and in the real world as well – [academics](https://github.com/nathanlesage/academics-on-mastodon?ref=thenexusofprivacy.net), for example. So as I discuss in more below in [**Mastodon, WTF** ](#mastodon-wtf)(which also has a brief introduction to Mastodon if this is all new to you)**,** we can collectively potentially have a big impact on disinfo if we engage. With the stakes as high as they are, it's worth a try. Here are four things you can do to help fight disinfo on Mastodon. 1. **THINK before you engage or share** 2. **SHARE accurate information about the election** 3. **REPORT disinfo when you see it** 4. **GET THE WORD OUT – and get people in your networks involved** Actually, you can and should do these things on *any* social network and in real life – you'll reach more people there than on Mastodon. They may seem mundane ... but when enough people get involved (as happened in 2008 and 2020), it can make a big difference. That said, these are also especially good things to be doing on Mastodon right now! > *This info is based on work done in 2020 with Shireen, Stop Online Violence Against Women, Indivisible Plus Washington, Indivisible Whidbey, Washington Indivisible Network, and Indivisisble's Truth Brigade.* [*How To Respond to Disinformation and Digital Voter Suppression*](https://indipluswa.medium.com/how-to-respond-to-disinformation-and-digital-voter-suppression-training-with-shireen-mitchell-1e8ee95695f8?ref=thenexusofprivacy.net) *and* [*Deep Dive*](https://indipluswa.medium.com/deep-dive-responding-to-disinfo-and-digital-voter-suppression-with-shireen-mitchell-b2109173866f?ref=thenexusofprivacy.net) *goes into more detail (although hasn't been updated for 2022, so some of it's a bit out of date). Thanks to all involved!* ## THINK before you engage or share **Don't amplify disinfo!** To start with, make sure information is accurate before sharing. NPR's [How to avoid sharing false or misleading news about the election](https://www.npr.org/2022/11/06/1134412184/election-day-is-coming-heres-what-to-think-about-before-sharing-news?ref=thenexusofprivacy.net) has some excellent suggestions. On Mastodon, remember that it's very easy for anybody to set up an account that claims to be a reputable source. Are they really who they say they are? Check their Twitter to see if they've posted anything about being on Mastodon – for example, if you see an account like [@mastodon.social@ifilljustice](https://mastodon.social/@ifilljustice?ref=thenexusofprivacy.net) claiming to be voting rights advocate Sherrilyn Iffill, do a Twitter search [from:sifill\_ mastodon](https://twitter.com/search?q=from%3Asifill%5F%20mastodon&src=typed%5Fquery&ref=thenexusofprivacy.net) to make sure it's really her. \[Spoiler: it is.\] If you're responding to disinfo, make sure not to amplify it. Mastodon doesn't have Twitter's algorithmic timeline, but even so sharing a link to disinfo (or boosting a link somebody else has shared), leads to more people seeing the headline and images – which can have a lot of power. So if you do share links to or screenshots of disinfo, make sure to use Mastodon's content warning feature (it's the little CW at the bottom of the box where you type the contents of your toots) – and mark the image as sensitive, which will blur it by default. ## SHARE accurate information about the election Take the time to verify that the information you’re sharing is accurate before you share updates! Websites and social media accounts for voting rights organizations, official state and county election departments, reputable local media, and disinformation experts are other usually-reliable sources. On Mastodon, voting rights advocates like [@mastodon.social@ifilljustice](https://mastodon.social/@ifilljustice?ref=thenexusofprivacy.net) and disinfo fighters like [@attorneynora@mastodon.social](https://mastodon.social/@attorneynora?ref=thenexusofprivacy.net) [@zadrozny@mastodon.social](https://mastodon.social/@zadrozny?ref=thenexusofprivacy.net) and [@emmalbriant@mastodon.online](https://mastodon.online/@emmalbriant?ref=thenexusofprivacy.net). Check to see who they're following as well and go from there. On Twitter, lists like Election Protection coalition's [national](https://twitter.com/i/lists/220826382?ref=thenexusofprivacy.net) and [state](https://twitter.com/i/lists/220985989?ref=thenexusofprivacy.net) partners are good starting points. So is [The Leadership Conference's coalition list](https://twitter.com/VOTE411?ref=thenexusofprivacy.net), and the League of Women Voters' [Vote411](https://twitter.com/VOTE411?ref=thenexusofprivacy.net). You can check all of these even if you don't have a Twitter account. I'm not aware of equivalent resources on Mastodon – if somebody else is, please let me know! ## REPORT disinfo when you see it [**ReportDisinfo.org**](https://reportdisinfo.org/?ref=thenexusofprivacy.net) is an easy-to-use site to report disinformation, run by Common Cause Election Fund. You can include a link to the web page, or upload an image. Social network sites also allow you to report disinfo; it's worth doing even though they might ignore it. There hasn't been a lot of disinfo yet on Mastodon, but that may well change. The appendix has the details and a screenshot about how to report disinfo (or other problematic comment) on Mastodon. ## GET THE WORD OUT – and get people in your networks involved There's a lot of other important stuff going on, and disinfo doesn't get a lot of coverage, so most people don't know how significant the threat is ... or how they can help make a difference. Union of Concerned Scientists' [Countering Disinformation in Your Community](https://www.ucsusa.org/sites/default/files/2022-04/Countering-Disinformation-in-Your-Community-Resource-Guide.pdf?ref=thenexusofprivacy.net) and PEN America's [How to Talk to Friends and Family Who Share Misinformation](https://pen.org/how-to-talk-to-friends-and-family-who-share-misinformation/?ref=thenexusofprivacy.net) are excellent resources. So is [5 ways to fight to protect democracy by fighting election disinformation](https://thenexusofprivacy.net/5-ways-to-fight-disinfo/), which is based on work I did in 2020 with Shireen Mitchell and Indivisible's Truth Brigade. And get the word out on Mastodon too! Even though it was founded with a strong anti-Nazi and pro-LGBTQ+ focus, people on Mastodon aren't used to thinking of it as a place to do activism. Again, keep your instance's norms in mind; put content warnings on political toots if that's what you're supposed to do. Don't flood the local timeline – if you're tooting a lot, make them unlisted. Still, with a little creativity you can find ways to do it without being obnoxious. Two easy step: - amplify [this toot by @VotingRightsNews@indieweb.social](https://indieweb.social/@VotingRightsNews/109306666207899835?ref=thenexusofprivacy.net) – or whatever toot or tweet led you to this post! - amplify [this tweet by @thenexusofprivacy](https://twitter.com/NexusOfPrivacy/status/1589869629572517895?ref=thenexusofprivacy.net) ## SUPPORT Black Twitter > "I define “Black Twitter” as a network of culturally connected communicators using the platform to draw attention to issues of concern to black communities. It’s the culture that we grew up with. It’s the culture that we experienced in our lives and school, in the workplace, with entertainment – and you see conversations coalesce around specific cultural moments." > > – Dr. Meredith Clark in [Black Twitter 101: What Is It? Where Did It Originate? Where Is It Headed?](https://news.virginia.edu/content/black-twitter-101-what-it-where-did-it-originate-where-it-headed?ref=thenexusofprivacy.net) Actually there's another very important thing you can do on Mastodon – or anywhere else – to fight disinfo. It's just as easy to do as any of the others, but it's less obvious why it's so critical. So I decided to leave it to the end where I could go into more detail. Black Twitter is the front line of the online battle against disinfo. The good news is that you can support Black Twitter, whether or not you have a Twitter account. The bad news is that most people don't make the effort. So here's a straightforward three step process. 1. Find high-quality tweets by Black tweeters and Black-led organizations that share accurate election information and respond to disinfo. [@BlkVotersMatter](https://twitter.com/blkvotesmatter?ref=thenexusofprivacy.net), [@MsLatoshaBrown](https://twitter.com/MsLaToshaBrown?ref=thenexusofprivacy.net), [@SIfill\_ ](https://twitter.com/SIfill%5F?ref=thenexusofprivacy.net), [@sandylocks](https://twitter.com/sandylocks?ref=thenexusofprivacy.net), [@barbs73](https://twitter.com/barbs73?ref=thenexusofprivacy.net), [@TJC\_DC](https://twitter.com/TJC%5FDC?ref=thenexusofprivacy.net), [@NAACP\_LDF](https://twitter.com/NAACP%5FLDF?ref=thenexusofprivacy.net), [@digitalsista](https://twitter.com/digitalsista?ref=thenexusofprivacy.net), [@ElieNYC](https://twitter.com/ElieNYC?ref=thenexusofprivacy.net), [@michaelharriot](https://twitter.com/michaelharriot?ref=thenexusofprivacy.net), and [@MauriceWFP](https://twitter.com/MauriceWFP?ref=thenexusofprivacy.net) are good starting points for national perspectives. Look for local people as well – if you're in the Seattle area, check out my [Seattle-area Politics](https://twitter.com/i/lists/1157760357688942592?ref=thenexusofprivacy.net) Twitter list. 2. Amplify them – on Mastodon, Twitter (if you still have your accont), and other social networks. 3. Donate, if you can, to the Patreons, GoFundMe's, Kickstarters, and/or non-profits of the Black tweeters you find useful. As to how to amplify ... well it's easy enough on Twitter: like, retweet, reply or quote-tweet them. Even if you're just saying something like "good point" these all help more people see them. If you're on a Mastodon instance allows cross-posting from Twitter, the [crossposter](https://crossposter.masto.donte.com.br/?ref=thenexusofprivacy.net) lets you send your quote tweets and RTs to Mastodon as well. If not, well, cut-and-pasting works. Some instances ask people to put content warnings on political toots, or make them "unlisted" to keep them of the local timeline ... if you're not sure, ask somebody who's been around for a while what to do. And cut-and-pasting works for email and whatever other social networks your on too! ### Black Twitter's not giving up without a fight If you're wondering why I think supporting Black Twitter is important enough that it made this short list of ways to help save democracy ... well, like I said, Black Twitter's always been on the front lines of the fight againsst disinfo. Rachelle Hampton’s [The black feminists behind #YourSlipIsShowing, a campaign against Twitter trolls masquerading as women of color](https://slate.com/technology/2019/04/black-feminists-alt-right-twitter-gamergate.html?ref=thenexusofprivacy.net) and @digitalsista's [Hacking of 2016 would have never happened had folk #ListenedToBW](https://twitter.com/i/events/988069560921284608?ref=thenexusofprivacy.net) have some highlights from back in the day. But fighting disinfo is far from the only thing that happens on Black Twitter. Black Twitter is a big part of why Twitter (at its best) is as a vibrant, interesting, and fun place despite the racists, Nazis, and crypto bros. Even more importantly though, for many people Black Twitter is a community that provides support, laughter, connections, and joy. Now, the racist new Chief Twit is burning it all down and racists are celebrating and spewing hate speech. That sucks for everybody, but it *especially* sucks for communities like Black Twitter that are being directly targeted. Still, at least for now, Twitter's still working well enough that connections and discussions can still work (as long as you continue do a lot of blocking). And it's not like pre-Elmo Twitter was a paradise. As BBC presenter and broadcaster Richie Brave says in [Black Twitter’s Mass Exodus: The Community Will Find Another Way](https://www.elle.com/uk/life-and-culture/a41895307/black-twitter-mass-exodus/?ref=thenexusofprivacy.net) on *Elle* > "Twitter has *always* been a hostile place. I have had death threats, people have said they hope my ill father dies, I have been called the n-word thousands of times." Threads from [@alwaystheself](https://twitter.com/alwaystheself/status/1588950101996625920?ref=thenexusofprivacy.net), [@timjacobwise](https://twitter.com/timjacobwise/status/1587230127783649281?ref=thenexusofprivacy.net), and [@shengokai](https://twitter.com/shengokai/status/1589024924727136257?ref=thenexusofprivacy.net) have some great perspectives on why a lot of Black tweeters are sticking around until the site goes down or becomes unusable. Dr. Clark's [Elon Musk’s purchase is not Black Twitter’s problem](https://thegrio.com/2022/11/03/elon-musks-purchase-is-not-black-twitters-problem/?ref=thenexusofprivacy.net) on *The Grio* is also very relevant. You can support Black Twitter more effectively if you still have your Twitter account – so if you haven't deleted it yet then I would strongly encourage you to wait. That said, you can also support Black Twitter from Mastodon. And if you're a non-Black person who cares about racial equity, it's especially important to do that. Otherwise, even if it's not your intent, you're leaving Black Twitter hung out to dry at a moment that's key for them – and for democracy. Please don't do that. ## Appendix ### Mastodon, WTF? > If you—like me—are unfamiliar with the landscape of free and open source software (FOSS) social media, Mastodon is weird. It's really *really* weird. > > – Sarah Jeong, [Mastodon is like Twitter without Nazis](https://www.vice.com/en/article/783akg/mastodon-is-like-twitter-without-nazis-so-why-are-we-not-using-it?ref=thenexusofprivacy.net), VICE (2017) If you're still wondering what Mastodon is, it's a decentralized, open-source Twitter alternative. With Twitter turning into a hellscape, a lot of people are looking for a backup and potential alternative. Mastodon's one obvious possibility, and several hundred thousand people have signed up over the last week in what's being referred to as the #TwitterMigration. Unlike Twitter or Facebook, a lot of different sites run Mastodon – and other software that can communicate with it.\*\* Different sites (sometimes also called "instances" or "servers") have different cultures, norms, and codes of conduct, which can make things confusing And the software and terminology can be very confusing as well – and I say that as a lifelong software engineer who's written about technology for years and even built a small social network for my friends. So some people quickly decide Mastodon's not for them, at least not yet. But for people who are to put some time and energy into learning a new social network, the learning curve's not so bad – and some instances are very welcoming to newcomers. So quite a few people are sticking around and giving it a shot. The numbers are still tiny compared to Twitter, but a lot of the people in the #TwitterMigration have very good networks – academics, for example, or artists looking at mastodon.art or any of the other art-focused sites. Some of communities are experimenting with Mastodon could be very helpful at fighting disinfo if they engage. For example, looking at the lists of [academics](https://github.com/nathanlesage/academics-on-mastodon?ref=thenexusofprivacy.net) and [research and GLAM-focused servers](https://fediscience.org/server-list.html?ref=thenexusofprivacy.net), there are probably several thousand #AcademicTwitter folks who have set up Mastodon accounts. And journalists are moving there as well. So it's a big enough, skilled, and well-connected population that getting a chunk of people effectively engaged in fighting disinfo as election day and the aftermath play out could maybe, just maybe, make a big difference. And as I was writing this article, Twitter suspended the executive director of the League of Women Voters of California with no warning and no explanation. After an uproar, they said it was by mistake and restored her accout, but still .... How bad will things get there over the next few weeks? Like I say, Mastodon has its issues. [@ISASaxonists](https://twitter.com/ISASaxonists/status/1590101263437688833?ref=thenexusofprivacy.net) and [@IBJIYONGI](https://twitter.com/IBJIYONGI/status/1589628437601615874?ref=thenexusofprivacy.net) have some good threads on racism (which as Margaret KIBI's [Fringe Mastodev: the Beginnings](https://www.u2764.com/NFIC/2018-09-09/fringe-beginnings/?ref=thenexusofprivacy.net) discusses has long been a problem). There are also [harassment](https://medium.com/@carolinesinders/im-sinders-on-mastodon-but-i-m-not-giving-up-on-twitter-yet-5dcd4fb810e1?ref=thenexusofprivacy.net) problems. From a privacy perspective, there's no encryption even for private messages, so don't use it for anything confidential. Still, it's worth considering as a backup – sites like [fedifinder.glitch.me ](https://fedifinder.glitch.me/?ref=thenexusofprivacy.net)and [Debirdify](https://pruvisto.org/debirdify/?ref=thenexusofprivacy.net) let you find people you follow on Twitter that have put their Mastodon address in their bios. Danielle Navarro's [Everything I know about Mastodon](https://blog.djnavarro.net/posts/2022-11-03%5Fwhat-i-know-about-mastodon/?ref=thenexusofprivacy.net) on *Notes from a Data Witch* and Per Axbom's [A Brief Mastodon Guide for Social Media Worriers](https://axbom.com/mastodon-guide/?ref=thenexusofprivacy.net) are good introductions. Even if you do set up a Mastodon account, I'd strongly encourage you *not* to leave Twitter yet. Sunny Singh's [Leaving Twitter says more about you than Elon Musk](https://www.opendemocracy.net/en/twitter-blue-ticks-elon-musk-white-people-leaving/?ref=thenexusofprivacy.net) and threads from [@alwaystheself](https://twitter.com/alwaystheself/status/1588950101996625920?ref=thenexusofprivacy.net), [@timjacobwise](https://twitter.com/timjacobwise/status/1587230127783649281?ref=thenexusofprivacy.net), and [@shengokai](https://twitter.com/shengokai/status/1589024924727136257?ref=thenexusofprivacy.net) have some perspectives on why. ### How to report disinfo on Mastodon There isn't a lot of disinfo on Mastodon yet, at least not on the instances I'm on. But as Mastodon becomes more popular, that's likely to change. That's bad, because Mastodon's defaults don't provide protections against impersonation. If somebody sets up an account with the name, avatar, and description that match a well-respected voting rights organization who's not yet on Mastodon, it could easily fool people. And decentralization makes it harder. What happens if soebody on another instance sets up an account that looks like The Nexus of Privacy? Still, Mastodon does have basic reporting in place. If you see a disinfo post, you can report the user. Here's what the screen looks like: ![A dialog screen.](https://thenexusofprivacy.net/content/images/2022/11/report-modal.jpg) *Image description: At the top, "repording ctfl\_bild@chaos.social". On the left, five items. At the top, text saying "This report will be sent to your server moderators. You can provide an explanaiton of why you are reporting this account below." Below that, a text box for additional comments. Below that, text saying "This account is from another server. Send an anonymized copy of the report there as well?" Next, a yes/no option – not currently selected – saying saying "Forward to chaos.social". At the bottom, a blue button labeled submit. On the right, the content being reported. Two toots with text images, each with a yes/no option. The top yes/no option is selected and displayed in blue. The bottom yes/no option is not selected.* If the person sharing the content is from another instance, you have the choce of whether to forward the report on to them as well. If it's a well-known instance – mastodon.social, masstodon.onlnie, mastodon.art, fosstodon.org, etc – or instance with a good code of conduct, it's a good thing to do. If it's an instance with moderators that don't care – or worse, a malicious instance where the moderators are trying to boost disinfo – it's a bad idea. Unfortunately there's no easy way to know about the moderators on other instances. ![5 ways to fight disinfo on Mastodon, starting with THINK before you engage or share. The full list is in the artcle.](https://thenexusofprivacy.net/content/images/2022/11/5-ways-to-fight-disinfo-on-Mastodon-2.png) \* Perez is former Director of Product Management for Societal Health at Twitter, and a member of the Board of Directors of the [OSET Institute](https://www.osetinstitute.org/?ref=thenexusofprivacy.net), a nonpartisan, nonprofit election technology research, development, and education organization ... so he knows what he's talking about. \*\* Mastodon's only one of many decentralized social networks in what's collectively called the Fediverse, but it's getting the most attention so I'm concentrating on it here. Per Axbom's [The many branches of the Fediverse](https://axbom.com/fediverse/?ref=thenexusofprivacy.net) and Kiernan Christ's [What on Earth Is the Fediverse?](https://www.lawfareblog.com/what-earth-fediverse?ref=thenexusofprivacy.net) on *Lawfare* are good introductions to the Fediverse Here's how Christ describes it: > The Fediverse is a network of interconnected servers, which communicate with each other based on [decentralized networking protocols](https://www.comptia.org/content/guides/what-is-a-network-protocol?ref=thenexusofprivacy.net#:~:text=A%20network%20protocol%20is%20an,internal%20processes%2C%20structure%20or%20design.). These servers can be used for [any number of different services](https://fediverse.party/en/portal/servers?ref=thenexusofprivacy.net), such as social media or file hosting. [The most popular](https://fediverse.observer/stats?ref=thenexusofprivacy.net) services are [Mastodon](https://mastodon.social/about?ref=thenexusofprivacy.net), [PeerTube](https://joinpeertube.org/?ref=thenexusofprivacy.net) (video hosting, like YouTube), and [Pleroma](https://pleroma.social/?ref=thenexusofprivacy.net) (social networking and microblogging similar to Mastodon). ### Privacy News: November 4 URL: https://thenexusofprivacy.net/privacy-news-november-4/ Last updated: 2022-11-04T19:29:52.000Z > Concerned about what's happening on Twitter? > Check out [the Nexus of Privacy's Dreamwidth community](https://thenexusofprivacy.dreamwidth.org/?ref=thenexusofprivacy.net) – or [follow us on Mastodon](https://mastodon.social/@nexusofprivacy?ref=thenexusofprivacy.net)! ### [Musk’s Twitter takeover raises more questions than answers about data privacy](https://usatoday.com/story/tech/2022/11/02/twitters-data-privacy-musk/8242592001?ref=thenexusofprivacy.net) Katie Wedell on USA TODAY (usatoday.com) Actually I think the answer is pretty clear: assume that everything you've ever done on Twitter (including your location) is going to be shared and sold broadly. We talked about one of the issues last week in [A new Chief Twit - and a big Twitter privacy issue](https://thenexusofprivacy.net/a-new-chief-twit-and-a-big-twitter-privacy-issue/) – private messages aren't encrypted, and there's now way to delete them – but that only scratches the surface. As Wedell details, Twitter, already has a history of missteps when it comes to guarding user data. And since this article was published, Twitter's [illegal mass layoffs](https://finance.yahoo.com/news/twitter-layoffs-illegal-lawsuit-122037157.html?ref=thenexusofprivacy.net) make it even less likely they can protect the data against hackers – and highlight that the new management will just ignore laws they don't like. ALSO: - [Members of Twitter’s Trust and Safety Council Not Sure Elon Musk Knows They Exist](https://vice.com/en/article/jgpkbk/members-of-twitters-trust-and-safety-council-not-sure-elon-musk-knows-they-exist?ref=thenexusofprivacy.net), Samantha Cole on vice.com ### [The NYPD is joining Ring’s neighborhood watch app amid privacy and racial profiling concerns](https://engadget.com/nypd-joins-ring-neighbors-app-213032209.html?ref=thenexusofprivacy.net) on Engadget (engadget.com) The NYPD is joining Ring’s Neighbors app despite concerns about privacy and profiling. What could possibly go wrong? > The New York-based Surveillance Technology Oversight Project (STOP) is [concerned](https://www.stopspying.org/latest-news/2022/11/2/stop-condemns-nypd-plan-to-join-amazon-rings-neighbors?ref=thenexusofprivacy.net) support for Neighbors will lead to more police violence, racial profiling and vigilantes. The technology "isn't keeping people safe" and even puts people in danger, Executive Director Albert Fox Cahn claims. He cites an [incident](https://www.businessinsider.com/ring-condemns-vigilantism-florida-shooting-security-doorbell-2022-10?ref=thenexusofprivacy.net) in October where a father and son shot at a woman in response to a Ring doorbell notification. The woman delivered a package sent to the wrong address. ALSO: - [Security Cameras Make Us Feel Safe, but Are They Worth the Invasion?](https://nytimes.com/2022/11/02/technology/personaltech/security-cameras-surveillance-privacy.html?ref=thenexusofprivacy.net), Brian X. Chen on NYTimes (nytimes.com) ### ### [Why Bad Privacy Happens to Good People](https://cyber.jotwell.com/why-bad-privacy-happens-to-good-people?ref=thenexusofprivacy.net) Paul Ohm on Technology Law (cyber.jotwell.com) Ohm review's Ari Ezra Waldman's, [Industry Unbound: The Inside Story of Privacy, Data, and Corporate Power](https://www.cambridge.org/core/books/industry-unbound/787989F90DBFC08E47546178A7AB04F7?ref=thenexusofprivacy.net). I've recommended this book, to dozens of people and Ohm agrees. > Waldman conducted 125 interviews over four years and insinuated himself into product design meetings, industry conferences, and company breakrooms, revealing a rigorous and detailed description of the way privacy is subverted and denied inside these companies.... Waldman’s conclusions are laayered and sophisticated and hard to do justice to in a short review.... > > There is so much I like (lots!) about this book. It provides deep, rich, and rigorously gathered empirical data about the forces that keep privacy at bay inside technology companies. It synthesizes these observations into compelling explorations of the mechanisms at play. It engages deeply and efficiently with multiple vast literatures, making it a readable and concise recommendation for newcomers to the field FIND OUT MORE: - [How Big Tech Turns Privacy Laws Into Privacy Theater](https://slate.com/technology/2021/12/facebook-twitter-big-tech-privacy-sham.html?ref=thenexusofprivacy.net), on *Slate*, is a good short introduction to how well-intentioned privacy professionals are shut out of the process – and often don’t even realize their complicity. - [Privacy, Practice, and Performance](https://californialawreview.org/print/privacy-practice-and-performance?ref=thenexusofprivacy.net), in the California Law Review, goes into more detail on how today's privacy law has been "endogenously created by industry practices that legitimize data extraction." ## State privacy legislation ### [Modified California Consumer Privacy Act Regulations](https://cppa.ca.gov/regulations/consumer%5Fprivacy%5Fact.html?ref=thenexusofprivacy.net) California Privacy Protection Agency (cppa.ca.gov) The California Privacy Protection Agency (CPPA) is working on regulations that will go into effect at the beginning of 2023\. These latest modifications were just released, and there's a short time for public comments in response. Comments are due by November 21 – the same day as [the FTC comment deadline](https://thenexusofprivacy.net/how-and-why-to-submit-ftc-comments-on-commercial-surveillance-and-security/)! ### [Colorado AG Publishes Draft Colorado Privacy Act Rules](https://natlawreview.com/article/colorado-ag-publishes-draft-colorado-privacy-act-rules?ref=thenexusofprivacy.net) Hunton Andrews Kurth’s Privacy and Cybersecurity on The National Law Review (natlawreview.com) A summary of the [Colorado Attorney General Office's draft rules](coag.gov/app/uploads/2022/10/CPA%5FFinal-Draft-Rules-9.29.22.pdf) implementing and enforcing the Colorado Privacy Act. There are "[stakeholder meetings](https://coag.gov/app/uploads/2022/10/Stakeholder-Meeting-Details.pdf?ref=thenexusofprivacy.net)" on November 10 and November 15\. The comment deadline is February 1, 2023. ### [Minor Keys: Major Takeaways from New California Online Children’s Privacy Law](https://jdsupra.com/legalnews/minor-keys-major-takeaways-from-new-9264984?ref=thenexusofprivacy.net) Sean Fernandes on JD Supra (jdsupra.com) An analysis of the new California Age-Appropriate Design Code Act. ## Automated Decision Systems ### [Algorithms Quietly Run the City of DC—and Maybe Your Hometown](https://wired.com/story/algorithms-quietly-run-the-city-of-dc-and-maybe-your-hometown?ref=thenexusofprivacy.net) Khari Johnson on WIRED (wired.com) EPIC Privacy's new report [Screened & Scored in DC](https://epic.org/screened-scored-in-dc/?ref=thenexusofprivacy.net) finds that municipal agencies in Washington deploy dozens of automated decision systems, often without residents’ knowledge. And guess what, these systems don't treat everbody equally. > “More often than not, automated decisionmaking systems have disproportionate impacts on Black communities,” \[EPIC AI and human rights expert Ben\] Winters says. The project found evidence that automated traffic-enforcement cameras are disproportionately placed in neighborhoods with more Black residents. Huh. Just like how [ShotSpotter](https://thenexusofprivacy.net/ghost/#/editor/post/6361f17597585df901f1dd40) is primarily deployed in Black and Latinx neighborhoods. Funny how that works. ### [Europe at a Crossroads over Planned Use of Biometrics](https://cigionline.org/articles/europe-at-a-crossroads-over-planned-use-of-biometrics?ref=thenexusofprivacy.net) Elizabeth M. Renieris on cigionline.org Due to go live in May 2023, the European Union’s Entry/Exit System could cost half a billion euros in the first few years, but the potential cost to the European Union’s moral authority is much higher. ### [Challenging algorithmic profiling: The limits of data protection and anti-discrimination in responding to emergent discrimination](https://t.co/qE5qFCr20Qhttps://journals.sagepub.com/doi/full/10.1177/2053951719895805?ref=thenexusofprivacy.net) Monique Mann and Tobias Matzner in Big Data & Society (journals.sagepub.com) From the abstract: > We contend that with increased algorithmic complexity, biases will become more sophisticated and difficult to identify, control for, or contest. In order to harness anti-discrimination regulation, it needs to confront emergent forms of discrimination or risk creating new invisibilities, including invisibility from existing safeguards. Finally, we outline suggestions to address emergent forms of discrimination and exclusionary invisibilities via intersectional and post-colonial analysis. ## And #### [TikTok privacy update in Europe confirms China staff access to data as GDPR probe continues](https://techcrunch.com/2022/11/03/tiktok-privacy-policy-update-china?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) An incoming privacy policy change made by TikTok yesterday for users in Europe names China as one of several third countries where user data can be remotely accessed. ALSO: - [TikTok tells European users its staff in China get access to their data](https://theguardian.com/technology/2022/nov/02/tiktok-tells-european-users-its-staff-in-china-get-access-to-their-data?ref=thenexusofprivacy.net), Dan Milmo on The Guardian (theguardian.com) - [New TikTok Privacy Policy Confirms Chinese Staff Can Access European Users’ Data](https://thehackernews.com/2022/11/new-tiktok-privacy-policy-confirms.html?ref=thenexusofprivacy.net), Ravie Lakshmanan on The Hacker News (thehackernews.com) - [TikTok’s updated data privacy policy does little to settle nerves](https://qz.com/tiktok-s-updated-data-privacy-policy-does-little-to-set-1849736467?ref=thenexusofprivacy.net), Ananya Bhattacharya on Quartz (qz.com) ### [Schrems: round three](https://euractiv.com/section/digital/podcast/schrems-round-three?ref=thenexusofprivacy.net) (podcast) Luca Bertuzzi on EURACTIV (euractiv.com) Last month, an executive order detailed the EU-US Privacy Shield 2.0, a new legal framework for transatlantic data flows made necessary by the Schrems II ruling. Bertuzzi and Max Schrems, the privacy activist who gave the name to the two landmark verdicts, discuss the new arrangement and the potential implications of a Schrems III. They also touched upon what is currently wrong with the GDPR enforcement and what more can be done to fix it in the near future. #### [Mozilla launches $35M venture capital fund for early-stage ‘responsible’ startups](https://techcrunch.com/2022/11/02/mozilla-launches-35m-venture-capital-fund-for-early-stage-responsible-startups?ref=thenexusofprivacy.net) Paul Sawers on TechCrunch (techcrunch.com) Mozilla Ventures is Mozilla’s new $35 million VC fund targeted at early-stage startups working on “responsible” technologies. #### [GDPR and the AI Act interplay: Lessons from FPF’s ADM Case-Law Report](https://fpf.org/blog/gdpr-and-the-ai-act-interplay-lessons-from-fpfs-adm-case-law-report%EF%BF%BC?ref=thenexusofprivacy.net) Sebastião Barros Vale on Future of Privacy Forum (fpf.org) GDPR’s protections for individuals against forms of Automated Decision-Making (ADM) and profiling go significantly beyond Article 22 – which provides for the right of individuals not to be subject to decisions based solely on automated processing that produces legal effects or significantly impacts them, and are currently being applied by courts and Data Protection Authorities (DPAs) alike. These range from detailed transparency obligations to applying the fairness principle to avoid situations of discrimination and strict conditions for valid consent in ADM cases. #### [Chat Control - A Good Day for Privacy](https://epicenter.works/content/chatcontrol-a-good-day-for-privacy?ref=thenexusofprivacy.net) on Startseite (epicenter.works) The Austrian parliament's EU voted to reject to the proposal for the controversial child sexual abuse regulation (dubbed “chat control”) unless it is not brought in line with fundamental rights #### #### [ICO and Cabinet Office reach agreement on New Year Honours data breach fine](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2022/11/ico-and-cabinet-office-reach-agreement-on-new-year-honours-data-breach-fine?ref=thenexusofprivacy.net) UK Information Commissioner's Office (ico.org.uk) Back in 2019, the Cabinet Office published a file on GOV.UK containing the names and unredacted addresses of more than 1,000 people announced in the New Year Honours list. The UK Information Commissioner (ICO) originally announced a £500,000 fine, but has now reduced it to £50,000\. The ICO says this reflects their "[new approach to working more effectively with public authorities](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2022/06/ico-sets-out-revised-approach-to-public-sector-enforcement/?ref=thenexusofprivacy.net)." #### [‘Contentious’ US tech firm to harvest patient data in NHSE waiting list push](https://hsj.co.uk/technology-and-innovation/contentious-us-tech-firm-to-harvest-patient-data-in-nhse-waiting-list-push/7033571.article?ref=thenexusofprivacy.net) Nick Carding on Health Service Journal (hsj.co.uk) NHS England has ordered the collection of identifiable patient data from hospitals by US data firm Palantir, for a pilot scheme aimed at accelerating recovery of elective waiting lists. #### [Seeking Psychedelics? Check the Data Privacy Clause](https://wired.com/story/colorado-psychedelics-health-privacy-surveillance?ref=thenexusofprivacy.net) Mason Marks on WIRED (wired.com) Colorado’s Proposition 122 wants to let people take psilocybin at healing centers. But sensitive data isn’t covered by medical privacy protections. #### [Australia to introduce world-leading privacy breach penalties](https://mondaq.com/australia/data-protection/1245908/australia-to-introduce-worldleading-privacy-breach-penalties?ref=thenexusofprivacy.net) James North on Corrs Chambers Westgarth (mondaq.com) Companies must act to ensure that their privacy regimes and data security capabilities are up to date and appropriate. #### [We need to start recognizing privacy as a basic human right](https://fastcompany.com/90803869/we-need-to-start-recognizing-privacy-as-a-basic-human-right?ref=thenexusofprivacy.net) Arjun Bhatnagar on fastcompany.com The CEO of Cloaked argues that the only way to successfully build businesses is to acknowledge every person’s ownership over who they are and how others perceive them. #### [White House’s ‘AI Bill of Rights’ Codifies Ethical Use, Privacy](https://governmentciomedia.com/white-houses-ai-bill-rights-codifies-ethical-use-privacy?ref=thenexusofprivacy.net) Sarah Sybert on Home (governmentciomedia.com) The collaborative document aims to keep AI ethical and equitable while standardizing best practices at the federal level. #### [The hidden market for your location data : The Indicator from Planet Money](https://npr.org/2022/11/01/1133397471/the-hidden-market-for-your-location-data?ref=thenexusofprivacy.net) Wailin Wong on NPR (npr.org) Your smartphone is pretty bad at keeping secrets – if it keeps track of your location, someone (or some app) almost definitely knows where you are. Today, the murky market for personal location data.For sponsor-free episodes of The Indicator from Planet Money, subscribe to Planet Money+ via Apple Po… #### [Amazon Must Turn Over Extensive Records in Alexa Privacy Lawsuit](https://news.bloomberglaw.com/tech-and-telecom-law/amazon-must-turn-over-extensive-records-in-alexa-privacy-lawsuit?ref=thenexusofprivacy.net) Christopher Brown on Request a Free Demo (news.bloomberglaw.com) Amazon.com Inc. must produce millions of documents in response to discovery requests in a potential class action over the marketing of its Alexa-enabled devices and their recording of users’ conversations, a federal judge ruled. #### [When Your Neighbor Turns You In](https://wired.com/story/authoritarian-us-neighbors-spy-report?bxid=62850cd9c750785c040efa2c&cndid=69800766&esrc=growl2-regGate-0321&ref=thenexusofprivacy.net) Thor Benson on WIRED (wired.com) Authoritarian societies depend on people ratting each other out for activities that were recently legal—and it’s already happening in the US. #### [Fizz compromised users’ privacy. It may do so again.](https://stanforddaily.com/2022/11/01/opinion-fizz-previously-compromised-its-users-privacy-it-may-do-so-again?ref=thenexusofprivacy.net) Joyce Chen on The Stanford Daily (stanforddaily.com) Last fall, Stanford student researchers found a large vulnerability in Fizz’s security. The founders’ response raises questions about the app today, writes Joyce Chen. #### [Parties to Zoom Privacy Litigation Seek Tentative Ruling from Court Regarding Objectors’ Appeals](https://lawstreetmedia.com/news/tech/parties-to-zoom-privacy-litigation-seek-tentative-ruling-from-court-regarding-objectors-appeals?ref=thenexusofprivacy.net) Christina Tabacco on Law Street Media (lawstreetmedia.com) A joint filing by Zoom Video Communications Inc., the plaintiffs prosecuting a class action against it, and several objectors asked Magistrate Judge to issue a tentative ruling as to whether she would accept the settlements reached by the three objectors who disapproved of the original $85 million class settlement. #### [Google says privacy key as NZ Identity Check system planned](https://rnz.co.nz/news/national/477981/google-says-privacy-key-as-nz-identity-check-system-planned?ref=thenexusofprivacy.net) Phil Pennington on RNZ (rnz.co.nz) Google says it is supporting efforts between countries to fix a lack of “legal stability” around the flow of people’s data and privacy. #### [Gathering CLOUD Requests Forecast for Technology and Communications Service Providers](https://mofo.com/resources/insights/221103-gathering-cloud-requests-forecast?ref=thenexusofprivacy.net) on Morrison Foerster (mofo.com) As a result of a recent agreement between the United Kingdom and United States, technology and communications service providers should prepare for changes in the landscape of data access requests by UK and U.S. law enforcement agencies. #### [Looking to a New EU-US Data Privacy Framework](https://jdsupra.com/legalnews/looking-to-a-new-eu-us-data-privacy-9483542?ref=thenexusofprivacy.net) on JD Supra (jdsupra.com) As we wrote in July 2020, the European Court of Justice issued a landmark decision that invalidated the Privacy Shield as untenable under the European... #### [GAO report: government departments need dedicated leaders to oversee privacy goals](https://csoonline.com/article/3678315/gao-report-government-departments-need-dedicated-leaders-to-oversee-privacy-goals.html?ref=thenexusofprivacy.net) Christopher Burgess on CSO Online (csoonline.com) A US Government Accountability Office report is calling for a host of changes to improve privacy within various federal agencies and departments. How those changes get implemented will depend largely on the establishment of new privacy leaders. #### [Privacy commissioner slams government for not sharing health-care bill ahead of 2nd reading](https://cbc.ca/news/canada/newfoundland-labrador/privacy-commissioner-slams-government-for-not-sharing-health-care-bill-ahead-of-2nd-reading-1.6638509?%5F%5Fvfz=medium%3Dsharebar&ref=thenexusofprivacy.net) Read more articles by Alex Kennedy on CBC (cbc.ca) The bill would amalgamate Newfoundland and Labrador’s four health authorities, but Michael Harvey and opposition parties say they weren’t given the legislation to prepare or ask questions ahead of its second reading on Tuesday. #### [Danish DPA Follows Suit and Becomes the Latest EU Data Protection Authority to Conclude that the Use of Google Analytics is Unlawful Without Supplementary Measures](https://orrick.com/Insights/2022/10/Danish-DPA-Latest-EU-Data-Protection-Authority-to-Conclude-Google-Analytics-Unlawful?ref=thenexusofprivacy.net) on orrick.com In a recent [announcement](https://www.datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics?ref=thenexusofprivacy.net), Datatilsynet, the Danish Data Protection Authority declared that the Google Analytics tool does not comply with the GDPR’s requirements for international transfers. The latest decision by the Danish DPA builds upon the growing sentiment among EU regulators as to the legality of Google Analytics and follows similar rulings by the Austrian, French and Italian data protection authorities. #### [Retailers are wading deeper into customer data. States are raising the alarm.](https://retaildive.com/news/walmart-peloton-snap-biometric-customer-data-consumer-privacy-laws/634746?%3A+2022-11-02+Retail+Dive+Newsletter+%5Bissue%3A45717%5D=&ref=thenexusofprivacy.net) Dani James on Retail Dive (retaildive.com) Brands from Walmart to Peloton are now able to access more personal customer data, including biometric identifiers, as they expand their digital capabilities. Where does that leave them legally? #### [Free privacy for all: Ghostery users can now pay with their expertise instead](https://techradar.com/news/free-privacy-for-all-ghostery-users-can-now-pay-with-their-expertise-instead?ref=thenexusofprivacy.net) Chiara Castro on TechRadar pro (techradar.com) The privacy firm is committed to build a user-first internet --- Image credit: Originally by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net), licensed from [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) via [Picpedia](https://www.picpedia.org/chalkboard/p/privacy.html?ref=thenexusofprivacy.net) ### #StopShotSpotter: Seattle Update URL: https://thenexusofprivacy.net/stopshotspotter-in-seattle-update-november-3/ Last updated: 2026-04-16T02:52:59.000Z Seattle Mayor Harrell’s budget allocates $1 million for a "gunfire detection system" – presumably ShotSpotter, which Harrell's tried to bring to Seattle for over a decade. As Lauryn Bray's [Community Groups Say ShotSpotter in Proposed Mayoral Budget May Harm South End](https://southseattleemerald.com/2022/10/18/community-groups-say-shotspotter-in-proposed-mayoral-budget-may-harm-south-end/?ref=thenexusofprivacy.net) in the *South Seattle Emerald,* there's a lot of opposition to this surveillance technology in the Rainier Beach neighborhood where it would be deployed initially. And for good reason! Systems like ShotSpotter don’t reduce crime or even produce evidence that can be used in court cases. Instead, they waste police time and resources – and harm people in the communities they’re supposed to protect. In Chicago, [police responding to a ShotSpotter alert shot and killed 13-year-old Adam Toledo](https://www.nbcchicago.com/news/local/timeline-the-fatal-shooting-of-adam-toledo-by-a-chicago-police-officer/2487555/?ref=thenexusofprivacy.net). Michael Williams and Daniel Ortiz were wrongfully arrested as a result of ShotSpotter. > **FIND OUT MORE**! > Join Solidarity Budget, WA People's Privacy, Michael Williams, local organizers and members of the national #StopShotSpotter coalition for a webinar on **Monday, November 7,** at 12:00 pm Pacific time – streamed on [YouTube](https://www.youtube.com/watch?v=Wd9V1FDMTAM&ref=thenexusofprivacy.net), [Facebook](https://www.facebook.com/SeattleSolidarityBudget/), and [Twitter](https://twitter.com/wapeopleprivacy?ref=thenexusofprivacy.net) > **TAKE ACTION**! > If you're a Seattle resident, [tell the CPC not to waste $1 million on ShotSpotter!](https://www.takeaction.network/xactions/31316?ref=thenexusofprivacy.net). But there's also some support for ShotSpotter in the community that's targeted for initial deployment. As Shaun Scott, community organizer and policy and field manager for the Statewide Poverty Action Network, [says](https://southseattleemerald.com/2022/10/18/community-groups-say-shotspotter-in-proposed-mayoral-budget-may-harm-south-end/?ref=thenexusofprivacy.net) > “There’s a certain subsection of folks or certain impacted groups within South and Central Seattle that might have a traditional view of the role that policing could play... Which is to say, \[they think\] maybe having more intense police presence would make our neighborhoods safer.” Both of those perspectives were on display in the Seattle Community Police Commission's November 2 discussion of ShotSpotter – [here's my live-tweeting](https://threadreaderapp.com/thread/1587848607507828736.html?ref=thenexusofprivacy.net). UW Professor Angélica Cházaro, who had helped organize a Rainier Beach commuity forum on public safety last week, shared perspectives from community members. For example > "ShotSpotter is giving them a license to hunt bodies. It's a waste of money. It's about control." But Victoria Beach, chair of the SPD African American Community Advisory Council, saw it differently: > "If it saves one life, I'm for it." There's no question that gun violence is a huge problem, in Seattle and around the country – and that it disproportionately affects people in Black and brown communities. What *is* much more of a question is whether ShotSpotter helps. The largest study to date, a meta-review looking at 68 cities, found that ShotSpotter “[has no significant impact on firearm-related homicides or arrest outcomes](https://pubmed.ncbi.nlm.nih.gov/33929640/?ref=thenexusofprivacy.net).” And as Cházaro discussed at the CPC meeting, ShotSpotter also doesn't produce evidence that holds up in court. Chicago Police Department's Office of the Inspector General (OIG) concluded that [the data "does not support a conclusion that ShotSpotter is an effective tool in developing evidence of gun-related crime.](https://igchicago.org/2021/08/24/oig-finds-that-shotspotter-alerts-rarely-lead-to-evidence-of-a-gun-related-crime-and-that-presence-of-the-technology-changes-police-behavior/?ref=thenexusofprivacy.net)"\* ShotSpotter argues that all the studies showing it doesn't have an impact are wrong, instead pointing to a"evidence" like a [shoddy "independent" study](https://ipvm.com/reports/macarthur-edgeworth?ref=thenexusofprivacy.net) it commissioned that claims it's "97% accurate".\*\* They also point to other potential benefits; at the CPC meeting, for example, ShotSpotter's Director of Public Safety Solutions Ron Teachman claimed that it saves lives by getting gunshot victims medical care more quickly. Once again, though, the research says otherise. [Firearm Acoustic Detection in Hartford, Connecticut: Outcomes of a Trauma Center – Law Enforcement Collaboration](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC8592377/?ref=thenexusofprivacy.net) compared gunshot incidents where shots were and weren't detected by ShotSpotter, and found there were no differences in prehospital treatment times, scene and transport duration, and injury severity, surgery or transfusion, lengths of stay, and disposition, including mortality. Of course, potential benefits are only one side of the equation. It's also crucial to look at the costs. As well as false arrests and people killed by police responding to ShotSpotter alerts, Chicago found that the number of pat downs, searches, and enforcement actions increased when officers were responding to ShotSpotter.\*\*\* Not only that, some officers used the presence of ShotSpotter in a neighborhood even without an alert from ShotSpotter as reason in and of itself as to conduct “protective pat downs.” Since ShotSpotter's primarily deployed in Black and Latinx areas (like Rainier Beach), all of this increases racial bias in policing – one of the reasons the [MacArthur Justice Center has filed a class action lawsuit against ShotSpotter.](https://endpolicesurveillance.com/?ref=thenexusofprivacy.net) And [Black, Indigenous, and people of color are already subject to disproportionate rates of violence by SPD](https://policescorecard.org/wa/police-department/seattle?ref=thenexusofprivacy.net). What could possibly go wrong? Speaking of costs: with Seattle facing a $50 million deficit, and the Mayor proposing shifting funding away from housing and Covid relief to plug the gap, $1 million for an initial deployment – a cost that's likely to grow signficantly over time – is a big issue as well. As Solidarity Budget organizer LéTania Severe [says](https://southseattleemerald.com/2022/10/18/community-groups-say-shotspotter-in-proposed-mayoral-budget-may-harm-south-end/?ref=thenexusofprivacy.net), “The budget is our values.” Violence interruption programs can [reduce homicides and assaults by 30-50%](https://nnscommunities.org/impact/impact/?ref=thenexusofprivacy.net), and community-based programs like [Community Passageways](https://www.communitypassageways.org/?ref=thenexusofprivacy.net), [Choose 180](https://choose180.org/?ref=thenexusofprivacy.net), and [Rainier Beach Action Coalition](https://www.rbcoalition.org/?ref=thenexusofprivacy.net) do great work in Seattle. Wouldn't it be better to send more money their way?\*\*\*\* While the CPC provides input, and the Mayor provides an initial draft of the budget, the Seattle City Council makes the decision. Since none of the Seattle Surveillance Ordinance requirements like a Suriveillance Impact Report and public comment period have occurred, the Council really should reject gunshot detection on process grounds. But there are enough pro-law-enforcement councilmembers that it's hard to know how the decision will go. So now's a great time to take action – and to find out more, because I've only scratched the surface of the issues. Monday's webinar is a great opportunity to find out more. It's at 12:00 noon, and will be streamed on [YouTube](https://www.youtube.com/watch?v=Wd9V1FDMTAM&ref=thenexusofprivacy.net), [Facebook](https://www.facebook.com/SeattleSolidarityBudget/), and [Twitter](https://twitter.com/wapeopleprivacy?ref=thenexusofprivacy.net). > **TAKE ACTION**! > If you're a Seattle resident, [tell the CPC not to waste $1 million on ShotSpotter!](https://www.takeaction.network/xactions/31316?ref=thenexusofprivacy.net). > **FIND OUT MORE**! > Join Solidarity Budget, WA People's Privacy, Michael Williams, local organizers and members of the national #StopShotSpotter coalition for a webinar on **Monday, November 7,** at 12:00 pm Pacific time – streamed on [YouTube](https://www.youtube.com/watch?v=Wd9V1FDMTAM&ref=thenexusofprivacy.net), [Facebook](https://www.facebook.com/SeattleSolidarityBudget/), and [Twitter](https://twitter.com/wapeopleprivacy?ref=thenexusofprivacy.net) --- More on ShotSpotter in Seattle: - [Community Groups Say ShotSpotter in Proposed Mayoral Budget May Harm South End](https://southseattleemerald.com/2022/10/18/community-groups-say-shotspotter-in-proposed-mayoral-budget-may-harm-south-end/?ref=thenexusofprivacy.net), Lauryn Bray, *South Seattle Emerald* - [Harrell’s Budget Would Resurrect Rejected Gunfire Detection System](https://publicola.com/2022/10/17/harrells-budget-would-resurrect-rejected-gunfire-detection-system/?ref=thenexusofprivacy.net), Erica Barnett, *PubliCola* - [Council Member Opposes Mayor’s Plan to Spend $1 Million on Unproven Surveillance Tech](https://www.thestranger.com/news/2022/09/29/78549071/mayor-harrell-proposes-1-million-for-questionable-surveillance-tech?ref=thenexusofprivacy.net), Will Casey, *The Stranger* - [Gunshot Detection Technology Spurs Debate Over Policing and Surveillance](https://www.bloomberg.com/news/articles/2022-10-27/cities-weigh-value-of-ai-powered-gunshot-detection-tech?ref=thenexusofprivacy.net) , Sarah Holder and Fola Akinnibi, *Bloomberg* More on ShotSpotter elsewhere: - [Evaluating the Growing Movement to Stop ShotSpotter](https://techpolicy.press/evaluating-the-growing-movement-to-stop-shotspotter/?ref=thenexusofprivacy.net), Angrej Singh, *Tech Policy Press* - [ShotSpotter and the Misfires of Gunshot Detection Technology](https://www.stopspying.org/shotspotter?ref=thenexusofprivacy.net), STOP (Surveillance Technology Oversight Project) - [The Algorithmic Ecology of Shotspotter](https://docs.google.com/presentation/d/1QAFGgXG8L0Y5aZXYJcY3UkGLJ281YOzWuuacCRypnqs/edit?ref=thenexusofprivacy.net), Stop Shotspotter Portland - [Class Action Lawsuit Takes Aim at Chicago’s Use of ShotSpotter After Unfounded Alerts Lead to Illegal Stops and False Charges](https://www.macarthurjustice.org/class-action-lawsuit-takes-aim-at-chicagos-use-of-shotspotter-after-unfounded-alerts-lead-to-illegal-stops-and-false-charges/?ref=thenexusofprivacy.net), MacArthur Justice Center (2022). The [complaint](https://www.macarthurjustice.org/wp-content/uploads/2022/07/Complaint-file-stamped.pdf?ref=thenexusofprivacy.net) has a lot more detail. - [ShotSpotter is deployed overwhelmingly in Black and Latinx neighborhoods in Chicago](https://endpolicesurveillance.com/burden-on-communities-of-color/?ref=thenexusofprivacy.net), Macarthur Justice Center - [Gunshot-Detecting Tech Is Summoning Armed Police to Black Neighborhoods](https://www.vice.com/en/article/88nd3z/gunshot-detecting-tech-is-summoning-armed-police-to-black-neighborhoods?ref=thenexusofprivacy.net), Todd Feathers, VICE, has data from Kansas City, Atlanta, and Cleveland as well as Chicago. ![Surveillance isn't Safety. Stop Shotspotter. Monday Nov. 7 Webinar @ 12 pm. From Solidarity Budget and WA People's Privacy](https://thenexusofprivacy.net/content/images/2022/11/Twitter-Post--Shotspotter-Webinar--Twitter-Post-.png) --- \* One reason for this is that less than 10% of ShotSpotter reports produce anything prosecutors can potentially use as evidence of crimes. Another reason is that when prosecutors *do* try to use ShotSpotter as evidence, it's usually challenged; and since the company fiercely guards its proprietary algorithms, prosecutors wind up having to drop charges – Michael Williams was jailed for a year before prosecutors finally admitted they had insufficient evidence. \*\* The link above went to an analysis of the study. The [study](https://edgeworthanalytics.com/independent-audit-of-the-shotspotter-accuracy/?ref=thenexusofprivacy.net) itself, on Edgeworth Analytics site is currently inaccessible. \*\*\* One of the ShotSpotter employees at the CPC meeting misleadingly claimed that because ShotSpotter supposedly gives the location of the gunshots, it leads to less intrusive police searches – the exact opposite of what the actual data shows. \*\*\*\* At the CPC meeting, ShotSpotter Director of Community Engagement Dr. Gerard Tate suggested that ShotSpotter data could complement violence interruption programs – but that ignores the reality of budgeting and the $50,000,000\. Dr. Tate also talked about sharing ShotSpotter data for social workers ... but [One in Ten Black Children in America Are Separated From Their Parents by the Child-Welfare System. A New Book Argues That’s No Accident](https://time.com/6168354/child-welfare-system-dorothy-roberts/?ref=thenexusofprivacy.net) (a discussion of Dorothy Roberts' book [Torn Apart: How the Child Welfare System Destroys Black Families--and How Abolition Can Build a Safer World](https://www.basicbooks.com/titles/dorothy-roberts/torn-apart/9781549193170/?ref=thenexusofprivacy.net)) or Roberts' shorter work such as [The Reproductive Violence of Family Policing & Separation](http://blog.petrieflom.law.harvard.edu/2022/05/09/dorothy-roberts-torn-apart-family-separation/?ref=thenexusofprivacy.net) and [Abolish Family Policing, Too](https://www.dissentmagazine.org/article/abolish-family-policing-too?ref=thenexusofprivacy.net), highlights the perils of that approach. ### Privacy News: November 1 URL: https://thenexusofprivacy.net/privacy-news-november-1/ Last updated: 2022-11-01T19:57:17.000Z > Concerned about what's happening on Twitter? > Check out [the Nexus of Privacy's Dreamwidth community](https://thenexusofprivacy.dreamwidth.org/?ref=thenexusofprivacy.net) – or [follow us on Mastodon](https://mastodon.social/@nexusofprivacy?ref=thenexusofprivacy.net)! ### [What Karen Memes Teach Us About White Women and Racialized Surveillance](https://yalelaw.hosted.panopto.com/Panopto/Pages/Viewer.aspx?id=0aa939e0-a7fd-401c-b0ee-af1c00f9f1e2&ref=thenexusofprivacy.net) Dr. Apryl Williams on Panopto (yalelaw.hosted.panopto.com) "Karen memes constitute public surveillance of Black bodies by white women. This is no different than the racialized surveillance Black people have always experienced. It’s just a new way of talking about it. Talking about it as a meme allows it to reach new publics." [The Yale Information Society Project's live-tweet thread](https://twitter.com/yaleisp/status/1587477441861279749?ref=thenexusofprivacy.net) has some of the highlights. ### [Mobile-App Privacy Nutrition Labels Missing Key Ingredients for Success](https://cacm.acm.org/magazines/2022/11/265814-mobile-app-privacy-nutrition-labels-missing-key-ingredients-for-success/fulltext?ref=thenexusofprivacy.net) Lorrie Faith Cranor on Communications of the ACM (cacm.acm.org) We're used to nutrition labels on food. Why not take the same approach to apps? It's an attracitve idea, but current implementations fall short. CMU professor Lorrie Faith Cranor, who's researched short standardized privacy for years, looks at today's Android and iOS privacy labels and concludes that they "confuse developers and end users." Cranor includes a set of recommendations to improve the labels. Don't hold your breath though. If Apple and Google really cared about giving people good information, they'd have responded to the well-publicized confusing nature of the labels long ago. It's almost like they care more about looking like they're doing something to help users than about actually helping users. ## Upcoming events #### Today at 1:30 pm Pacific: [Viral Justice: Pandemics, Policing, and Public Bioethics.](https://columbiacuimc.zoom.us/webinar/register/WN%5FZGAvNYsqS9G9lLG31p3xtg?ref=thenexusofprivacy.net) *Register on Zoom (columbiacuimc.zoom.us)* Join us for our first 2022-23 Ethics Grand Rounds 2022/23 “Viral Justice: Pandemics, Policing, and Public Bioethics ” by Ruha Benjamin, PhD, Professor of African American Studies at Princeton University and Founding Director of the Ida B. Wells Just Data Lab. In this talk, Ruha Benjamin examines the twin crises of COVID-19 and police violence, mapping the multiple vectors through which racism gets under the skin, into the blood stream, attacking our bodies and body politic. She offers a vision of change, viral justice – as a practical and principled approach to transmuting a hostile racial climate into one that is more habitable, hopeful, and just. #### Monday, November 7: [#PoliceAbuseTech: No Tech 4 Tyrants Report Launch](https://eventbrite.com/e/policeabusetech-no-tech-4-tyrants-report-launch-tickets-444648103447?ref=thenexusofprivacy.net) *Sign up on Eventbrite (eventbrite.com)* Among global movements to reckon with police powers, NT4T's new report "Surveillance Tech Perpetuates Police Abuse of Power" looks at how police use surveillance technology to abuse their power in the UK and globally. #### Thursday November 10:[ Limits of Decolonial Debate in Internet Studies - DigiLabour Online Roundtable. ](https://digilabour-br.zoom.us/webinar/register/WN%5FfWduKs8ZQTCKqeUcm6aHkw?ref=thenexusofprivacy.net) *Register on Zoom (digilabour-br.zoom.us)* Continuing the discussion started at AoIR conference, this online roundtable analyzes the limits of decolonial approach in internet studies. What are the pitfalls of the decolonial approach, particularly in terms of being co-opted by the colonizers as a brand? What is missing from the decolonial debate in internet studies? How can we make sense of the oversized role played by institutions from the Global North in this debate? Starting from these and other questions, this roundtable will bring researchers to share their views and engage in a constructive debate. Participants include Abeba Birhane (Mozilla Foundation / University College Dublin), Tarcizio Silva (Mozilla Foundation/ Federal University of ABC, Brazil), Anita Gurumurthy (IT for Change), Syed Mustafa Ali (Open University), Cheryll Soriano (Manila University), Rigoberto Lara Guzmán (Data & Society), and Walter Lippold (Rio Grande do Sul Institute) ## Federal privacy legislation ### [The Facial Recognition Act: A Promising Path to Put Guardrails on a Dangerously Unregulated Surveillance Technology](https://lawfareblog.com/facial-recognition-act-promising-path-put-guardrails-dangerously-unregulated-surveillance-technology?ref=thenexusofprivacy.net) Jake Laperruque on Lawfare (lawfareblog.com) There’s consensus in Congress that facial recognition needs to be reined in, but not nearly enough action to bring about effective rules. A new bill could jump-start the debate and move the nation toward the comprehensive set of limits that are needed. ### [Accidental Abolition? Exploring Section 230 as Non-Reformist Reform](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4228573&ref=thenexusofprivacy.net) Kendra Albert on SSRN (papers.ssrn.com) Much ink has been spilled in defense of or against Section 230\. But most scholars do not cite Section 230 as an example of abolition of the police state or prison industrial complex despite the fact that Section 230 may represent the largest single carveout of people and entities from state criminal liability in United States history. ## FTC ### [FTC Brings Action Against Ed Tech Provider Chegg for Careless Security that Exposed Personal Data of Millions of Customers](https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-brings-action-against-ed-tech-provider-chegg-careless-security-exposed-personal-data-millions?ref=thenexusofprivacy.net) Federal Trade Commission (ftc.gov) Chegg, a homework help app, exposed the data of 40 million users, including details about some students’ sexual orientation and religion. That's only one of a series of security problems for Chegg, who suffered four breaches in four years. In their settlement with the FTC, Chegg has agreed to lock the door after the data has been leaked and adopt a comprehensive security program. here's the full ALSO: - [F.T.C. Accuses Ed Tech Firm Chegg of ‘Careless’ Data Security](https://nytimes.com/2022/10/31/business/ftc-chegg-data-security-legal-complaint.html?ref=thenexusofprivacy.net), Natasha Singer on NYTimes (nytimes.com) - FTC Chair Lina Khan has [a short Twitter thread](https://twitter.com/linakhanFTC/status/1587201275271286785?ref=thenexusofprivacy.net) summarizing the order ## Across the pond ... #### [Europe Prepares to Rewrite the Rules of the Internet](https://wired.com/story/europe-dma-prepares-to-rewrite-the-rules-of-the-internet?ref=thenexusofprivacy.net) Khari Johnson on WIRED (wired.com) The Digital Markets Act will force big tech platforms to break open their walled gardens in 2023, says the EU’s new ambassador to Silicon Valley. #### [The DSA has been published – now the difficult bit begins](https://verfassungsblog.de/dsa-published?ref=thenexusofprivacy.net) Joris van Hoboken on Verfassungsblog (verfassungsblog.de) The Digital Services (DSA) has finally been published in the Official Journal of the European Union on 27 October 2022\. This publication marks the end of a years-long drafting and negotiation process, and opens a new chapter: that of its enforcement, practicable access to justice, and potential to set global precedents. #### [Which CJEU data protection cases are currently pending?](https://gdprbeetle.eu/which-cjeu-data-protection-cases-are-currently-pending?ref=thenexusofprivacy.net) Tara on GDPR Beetle (gdprbeetle.eu) Discover new data protection cases, pending at the EU Court of Justice. #### [When Does GDPR Apply? | TrustArc](https://trustarc.com/blog/2022/11/01/when-does-gdpr-apply?ref=thenexusofprivacy.net) Annie Greenley-Giudici on TrustArc Privacy Blog (trustarc.com) When does the GDPR apply to your data collection activities? Review three common misconceptions about how the GDPR applies. ## And ... #### [NSA Watchdog Concluded One Analyst’s Surveillance Project Went Too Far](https://bloomberg.com/news/articles/2022-11-01/nsa-watchdog-concluded-one-analyst-s-surveillance-project-went-too-far?ref=thenexusofprivacy.net) Jason Leopold, Katrina Manson, and William Turton on bloomberg.com An “experienced” analyst working at the National Security Agency developed a surveillance project about a decade ago that resulted in the unauthorized targeting and collection of private communications of people or organizations in the US, newly unearthed documents show. An investigation into the matter, which hasn’t been previously reported, found that the analyst “acted with reckless disregard” and violated numerous rules and possibly the law, according to a 2016 report by the NSA’s Office of Inspector General. #### [Online age-verification system could create ‘honeypot’ of personal data and pornography-viewing habits, privacy groups warn](https://theguardian.com/technology/2022/oct/31/online-age-verification-system-could-create-honeypot-of-personal-data-and-pornography-viewing-habits-privacy-groups-warn?ref=thenexusofprivacy.net) Josh Taylor on The Guardian (theguardian.com) As the government develops online safety guidelines, digital rights groups says any approach requiring the use of ID is ‘invasive and risky’ #### [Danielle Citron on The Fight for Privacy](https://techpolicy.press/danielle-citron-on-the-fight-for-privacy?ref=thenexusofprivacy.net) Justin Hendrix on Tech Policy Press (techpolicy.press) Prof. Citron's “The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age” was published in October by W.W. Norton and Penguin Vintage UK. It's especially timely in the aftermath of the Dobbs decision. **ALSO**: - [In her new book, Danielle Keats Citron makes the case for the ‘right to intimate privacy’](https://cyberscoop.com/danielle-citron-intimate-privacy-rights?ref=thenexusofprivacy.net), Tonya Riley on CyberScoop (cyberscoop.com) - [The Lawfare Podcast: Danielle Citron on Intimate Privacy and How to Preserve It in a Digital Age](https://lawfareblog.com/lawfare-podcast-danielle-citron-intimate-privacy-and-how-preserve-it-digital-age?ref=thenexusofprivacy.net), Jen Patja Howell on Lawfare (lawfareblog.com) - [On protecting intimate privacy: A chat with Danielle Citron](https://iapp.org/news/a/on-protecting-intimate-privacy-a-chat-with-danielle-citron?ref=thenexusofprivacy.net), Jedidiah Bracy on International Association of Privacy Professionals (iapp.org) #### [Can a new form of cryptography solve the internet’s privacy problem?](https://theguardian.com/technology/2022/oct/29/privacy-problem-tech-enhancing-data-political-legal?ref=thenexusofprivacy.net) Alex Bellos on The Guardian (theguardian.com) Techniques which allow the sharing of data whilst keeping it secure may revolutionise fields from healthcare to law enforcement #### [Data Rules: Humanizing the customer experience in light of new data privacy laws](https://technative.io/data-rules-humanizing-customer-experience-data-privacy-laws?ref=thenexusofprivacy.net) Rachel Eisen on TechNative (technative.io) Five states — California, Colorado, Connecticut, Utah, and Virginia — have enacted comprehensive consumer data privacy laws, with Massachusetts expected to pass its Massachusetts Information Privacy and Security Act (MIPSA). While these regulations appear to hamper marketers, using data consumers give willingly has advantages: it allows one-to-one personalization and gives consumers more control over their online shopping interactions without sacrificing privacy. That’s why zero- and first-party data will grow increasingly important for marketers’ efforts to humanize digital interactions that drive long-term customer value. #### [Digital Security and Reproductive Rights: Lessons for Feminist Cyberlaw](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4262774&ref=thenexusofprivacy.net) Michela Meister on papers.ssrn.com Reproductive rights in the United States are under threat, and the threat is growing more serious by the day. #### [Australia seeks stiffer penalty for data breaches amidst spate of security incidents](https://zdnet.com/article/australia-seeks-stiffer-penalty-for-data-breaches-amidst-spate-of-security-incidents?ref=thenexusofprivacy.net) Eileen Yu on ZDNET (zdnet.com) Government says it will push up maximum fines for serious or repeated data privacy breaches to AU$50 million, up from the current AU$2.22 million, in a move that follows a spate of cybersecurity incidents that compromised customer data, including Medibank. #### [Privacy rights must be respected in digital ID systems, say Canadian regulators](https://itworldcanada.com/article/privacy-rights-must-be-respected-in-digital-id-systems-say-canadian-regulators/509796?ref=thenexusofprivacy.net) Howard Solomon on IT World Canada (itworldcanada.com) As Canada’s public and private sectors launch new digital identity programs, federal, provincial, and territorial regulators say rights to privacy and transparency must be fully respected throughout their design and operation. “The development and implementation of a digital ID ecosystem is a tremen… #### [Global data privacy regulators set resolution on facial recognition at annual meeting](https://biometricupdate.com/202210/global-data-privacy-regulators-set-resolution-on-facial-recognition-at-annual-meeting?ref=thenexusofprivacy.net) Chris Burt on BiometricUpdate.com (biometricupdate.com) Data privacy regulators agree to a resolution that personal information should be used for facial recognition only in accordance with a set of six principles. #### [U.K. Watchdog Issues First of Its Kind Warning Against ‘Immature’ Emotional Analysis Tech](https://gizmodo.com/ai-emotional-analysis-tech-facial-recognition-1849705755?ref=thenexusofprivacy.net) Mack DeGeurin on Gizmodo (gizmodo.com) The watchdog’s deputy commissioner warned the tech wasn’t backed by science and that any benefits were outweighed by the risks. #### [Metaverse Privacy Concerns and How to Address Them](https://techtarget.com/searchcio/tip/Metaverse-privacy-concerns-and-how-to-address-them?ref=thenexusofprivacy.net) Ashwin Krishnan, on TechTarget (techtarget.com) Metaverse privacy is a moving target. Learn about the main data privacy concerns the metaverse poses and how to mitigate them. #### [Georgetown Law Welcomes Natalie Roisman as New Executive Director of its Institute for Technology Law & Policy](https://law.georgetown.edu/tech-institute/news/georgetown-law-welcomes-natalie-roisman-as-new-executive-director-of-its-institute-for-technology-law-policy?ref=thenexusofprivacy.net) on Georgetown Law (law.georgetown.edu) Leading technology attorney Natalie Roisman joins the Institute for Technology Law & Policy at Georgetown Law this week as its new Executive Director. Roisman, a veteran practitioner and former president of the Federal Communications Bar Association (FCBA), will bring extensive experience on technol… #### [Understanding Extended Reality Technology & Data Flows: XR Functions](https://fpf.org/blog/understanding-extended-reality-technology-data-flows-xr-functions?ref=thenexusofprivacy.net) Daniel Berrick and Jameson Spivack on Future of Privacy Forum (fpf.org) Today’s virtual (VR), mixed (MR), and augmented (AR) reality environments, collectively known as extended reality (XR), are powered by the interplay of multiple sensors, large volumes and varieties of data, and various algorithms and automated systems, such as machine learning (ML). These complex relationships enable functions like gesture-based controls and eye tracking, without which XR experiences would be [less immersive](https://standards.ieee.org/wp-content/uploads/import/governance/iccom/extended-reality-anonymity-privacy.pdf?ref=thenexusofprivacy.net) or unable to function at all. However, these experiences often depend on sensitive personal information, and the collection, processing, and transfer of this data to other parties may pose [privacy and data protection risks](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4202913&ref=thenexusofprivacy.net) to both users and bystanders. ALSO: [Understanding Extended Reality Technology & Data Flows](https://fpf.org/wp-content/uploads/2022/10/XR-Infographic-Screen-reader-friendly-version.pdf?ref=thenexusofprivacy.net), the infographic from FPF the blog post discusses #### [Data will play key role in sustaining SEA digital economy growth](https://zdnet.com/article/data-will-play-key-role-in-sustaining-sea-digital-economy-growth?ref=thenexusofprivacy.net) Eileen Yu on ZDNET (zdnet.com) Southeast Asia’s digital economy is projected to reach $200 billion in gross merchandise value this year, but market players will need to understand consumer behaviour to sustain growth as adoption of online services matures across the region. #### [4 best practices for a data-centric approach to zero trust](https://venturebeat.com/security/4-best-practices-for-a-data-centric-approach-to-zero-trust?ref=thenexusofprivacy.net) Mike Morper, Virtru on VentureBeat (venturebeat.com) Best practices for implementing zero trust data control for better data protection, wherever your data resides. #### [VR Tracking Facial Expressions May Be the Next Privacy Nightmare—Here’s Why](https://lifewire.com/vr-tracking-facial-expressions-may-be-the-next-privacy-nightmare-heres-why-6823554?ref=thenexusofprivacy.net) lifewire’s editorial guidelines on Lifewire (lifewire.com) Imagine your webcam recording your face the whole time you’re using your computer or phone, and giving that data to a company like Facebook. Welcome to the future of AR and VR. #### [Cape Town “privacy-by-design” startup Omnisient raises funding for growth](https://disrupt-africa.com/2022/10/31/cape-town-privacy-by-design-startup-omnisient-raises-funding-for-growth?ref=thenexusofprivacy.net) Tom Jackson on Disrupt Africa (disrupt-africa.com) Cape Town-based “privacy-by-design” startup Omnisient has raised an undisclosed amount of funding from old and new investors to support its continued international expansion and further develop its platform. #### [The Colorado Privacy Act - What the Draft Rules Say About Data Portability and Authentication](https://jdsupra.com/legalnews/the-colorado-privacy-act-what-the-draft-6351476?ref=thenexusofprivacy.net) Odia Kagan on JD Supra (jdsupra.com) Sixth in a series of articles on the Colorado Privacy Act draft rules. #### [Q&A: Web Browsers at Nexus of Data Privacy Exposures and Risk](https://informationweek.com/security-and-risk-strategy/q-a-web-browsers-at-nexus-of-data-privacy-exposures-and-risks?ref=thenexusofprivacy.net) Joao-Pierre S. Ruth on InformationWeek (informationweek.com) Brian Ebert, Lokker advisory board member and former chief of staff of the Secret Service, discusses findings and issues companies may face on data privacy. #### [AI experts question tech industry’s ethical commitments](https://computerweekly.com/feature/AI-experts-question-tech-industrys-ethical-commitments?ref=thenexusofprivacy.net) Sebastian Klovig Skelton, on ComputerWeekly.com (computerweekly.com) The massive proliferation of ethical frameworks for artificial intelligence has done little to change how the technology is developed and deployed, with experts questioning the tech industry’s commitment to making it a positive social force. #### #### ### Privacy News: October 28 URL: https://thenexusofprivacy.net/privacy-news-october-28/ Last updated: 2022-10-28T22:49:50.000Z > In case you haven't heard, there's a new Chief Twit. His other company is known for [racial abuse of Black workers](https://www.reuters.com/business/autos-transportation/tesla-hit-by-new-lawsuit-alleging-racial-abuse-against-black-workers-2022-07-01/?ref=thenexusofprivacy.net) and [software bugs](https://hypebeast.com/2022/5/tesla-recalls-130000-vehicles-software-bug?ref=thenexusofprivacy.net), and as soon has he took over he fired Vijaya Gadde, the widely-respected head of Trust & Safety. What could possibly go wrong? > > – [A new Chief Twit - and a big Twitter privacy issue](https://thenexusofprivacy.net/a-new-chief-twit-and-a-big-twitter-privacy-issue/) Privacy's only one of the many reasons the Twitter acquisition's a big deal. Unfortunately, most of the articles I've read mostly provide a fairly limited range of perspectives. As Andre Brock [says](https://twitter.com/DocDre/status/1586106272356892673?ref=thenexusofprivacy.net), "Black Twitter’s dominance over the platform has a LOT to do with how many tech pundits/liberal voices on here see Twitter as a ‘hell site’." [I've collected a bunch of other reactions in a Twitter moment](https://twitter.com/i/events/1586034951480553473?ref=thenexusofprivacy.net). ### [What happens to your Twitter data when Elon takes over](https://www.vox.com/recode/2022/10/27/23427106/elon-musk-twitter-data-direct-messages?ref=thenexusofprivacy.net) Sara Morrison on Vox (vox.com) That said, privacy's certainly a big concern! Morrison notes that Twitter doesn't really allow you to delete data, observes that the new owner – or whoever he designates – could certainly get at private direct messages if they wanted to. And that's not the only threat; firing Gadde is likely to lead to a lot of other departures from Twitter's security team, so it's prime opportunity for intelligence agencies, organized crime, or teenagers to get access to data. For somebody like me, this isn't a big deal. I've said a few things in DMs that might be a bit embarassing if they were public, but nothing that would put me or anybody else at risk. But think about whistleblowers or activists who have shared information with journalists or other activists in Twitter DMs – and some of the new Chief Twit's statements that certainly make it seem like he's sucking up to countries like Russia and China. ### [How to run a small social network site for your friends](https://runyourown.social/?ref=thenexusofprivacy.net) Darius Kazemi on runyourown.social As people consider moving off Twitter, it's worth thinking about setting up your own small social network. Kazemi's excellent overview lays out some general principles of running a small social network site, focusing more on community building more than they are related to specific technologies. > Running a social network site is community building first and a technical task second. > > And while community building is hard work, it's often worth it. > > This is my pitch to you: using big social media sites is easy, but you pay a steep price for it. You should consider running your own site, which is harder, but can be extremely rewarding. ## Privacy after Roe ### ### [How the tech sector can protect personal data post-Roe](https://brookings.edu/techstream/how-tech-firms-can-protect-personal-data-after-roe-us-privacy-abortion-surveillance?ref=thenexusofprivacy.net) Jordan Famularo and Richmond Wong on Brookings (brookings.edu) Steps the tech sector should take to prevent the misuse of data in abortion-related cases. ### [DHS Agents Monitored Twitter After Roe Decision, FOIA Shows](https://bloomberg.com/news/newsletters/2022-10-26/dhs-agents-monitored-twitter-after-roe-decision-foia-shows?ref=thenexusofprivacy.net) Jack Gillum on bloomberg.com In the hours after the US Supreme Court overturned Roe v. Wade, federal authorities were monitoring social media to gather intelligence about nationwide protests and possible violence. ### [Cracking Down on Federal Aid for Reproductive Health Surveillance: Fusion Centers](https://cdt.org/insights/cracking-down-on-federal-aid-for-reproductive-health-surveillance-fusion-centers?ref=thenexusofprivacy.net) Jake Laperruque on Center for Democracy and Technology (cdt.org) Fusion centers are law enforcement hubs that stockpile and share data to aid state and local investigations. [At least 80](https://www.hsgac.senate.gov/imo/media/doc/Testimony-Sena-2021-05-18.pdf?ref=thenexusofprivacy.net) fusion centers operate [across the country](https://www.dhs.gov/fusion-center-locations-and-contact-information?ref=thenexusofprivacy.net), with at least one in each state. They are owned and operated by the states and [nearly all](https://www.dhs.gov/sites/default/files/publications/2018%5Fnational%5Fnetwork%5Fof%5Ffusion%5Fcenters%5Ffinal%5Freport.pdf?ref=thenexusofprivacy.net) staff at facilities are from state and local agencies. However, fusion centers significantly rely on the federal government, which can leverage that reliance to ensure that its assistance is not used to facilitate abortion-related investigations. This is one of a series of blog posts examining how the federal government could prevent federal surveillance assistance to state and local law enforcement from being used to investigate and prosecute reproductive health care choices. Other posts examined [Regional Computer Forensic Laboratories](https://cdt.org/insights/cracking-down-on-federal-aid-for-reproductive-health-surveillance-regional-computer-forensic-labs/?ref=thenexusofprivacy.net), the [National Domestic Computer Assistance Center](https://cdt.org/insights/cracking-down-on-federal-aid-for-reproductive-health-surveillance-the-national-domestic-communications-assistance-center/?ref=thenexusofprivacy.net), and [The Computer Analysis Response Team](https://cdt.org/insights/cracking-down-on-federal-aid-for-reproductive-health-surveillance-the-computer-analysis-response-team/?ref=thenexusofprivacy.net). ## Automated decision systems #### [Regulating the Risks of AI](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4195066&ref=thenexusofprivacy.net) Margot E. Kaminski on Social Studies Research Network (papers.ssrn.com) From the abstract: > Companies and governments now use Artificial Intelligence (AI) in a wide range of settings. But using AI leads to well-known risks—that is, not yet realized future harms that arguably present challenges for a traditional liability model. It is thus unsurprising that lawmakers in both the United States and the European Union (EU) have turned to the tools of risk regulation for governing AI systems. > > This Article observes that constructing AI harms as risks is a choice with consequences. Risk regulation comes with its own policy baggage: a set of tools and troubles that have emerged in other fields. Moreover, there are at least four models for risk regulation, each with both overlapping and divergent goals and methods. Emerging conflicts over AI risk regulation illustrate the tensions that emerge when regulators employ one model of risk regulation, while stakeholders call for another. ## And ... #### [Iran’s Secret Manual for Tracking and Controlling Protesters’ Mobile Phones](https://theintercept.com/2022/10/28/iran-protests-phone-surveillance?ref=thenexusofprivacy.net) Sam Biddle on The Intercept (theintercept.com) The documents provide an inside look at an Iranian government program that lets authorities monitor and manipulate people’s phones. #### [On protecting intimate privacy: A chat with Danielle Citron](https://iapp.org/news/a/on-protecting-intimate-privacy-a-chat-with-danielle-citron?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) The IAPP’s Jedidiah Bracy interviews Danielle Citron about her new book “The Fight for Privacy: Protecting Dignity, Identity and Love in the Digital Age.” #### [Children’s data stolen by Medibank hacker, company confirms](https://abc.net.au/news/science/2022-10-28/medibank-data-breach-children-caught-up-privacy-concerns/101584376?ref=thenexusofprivacy.net) Ariel Bogle on ABC News (abc.net.au) While adults are also at risk of scams or stigma due to the disclosure of health records, children are a special case — particularly because they don’t always get a say about what carers sign them up for or share, experts say. #### [Amazon accidentally exposed an internal server packed with Prime Video viewing habits](https://techcrunch.com/2022/10/27/amazon-prime-video-server-exposed?ref=thenexusofprivacy.net) Zack Whittaker on TechCrunch (techcrunch.com) The server, which Amazon took offline, was not protected with a password. #### [Download the Smart City PDX Digital Justice and Surveillance Technologies Zine — News](https://smartcitypdx.com/news/2022/10/21/download-the-smart-city-pdx-digital-justice-and-surveillance-technologies-zine?ref=thenexusofprivacy.net) Hector Dominguez on Smart City PDX (smartcitypdx.com) This Zine is an educational material to learn more about surveillance technologies and Digital Justice. e Smart City PDX #### [An Unrepresentative Democracy: How Disinformation and Online Abuse Hinder Women of Color Political Candidates in the United States](https://cdt.org/insights/an-unrepresentative-democracy-how-disinformation-and-online-abuse-hinder-women-of-color-political-candidates-in-the-united-states?ref=thenexusofprivacy.net) Dhanaraj Thakur, DeVan Hankerson Madrigal on Center for Democracy and Technology (cdt.org) Executive Summary In a press interview, former Vermont state house representative Kiah Morris said she reported at least 26 incidents to the local police where she and her family felt threatened between 2016 and 2018\. The severity of the targeted abuse both on and offline ultimately led Rep. Morris… #### [Tabling of the National Security and Intelligence Review Agency’s Annual Report 2021](https://nsira-ossnr.gc.ca/tabling-of-the-national-security-and-intelligence-review-agencys-annual-report-2021?ref=thenexusofprivacy.net) NSIRA (nsira-ossnr.gc.ca) #### [The TikTok settlement is real, and you can get money from it](https://mashable.com/article/tiktok-data-privacy-settlement-payouts?ref=thenexusofprivacy.net) Mike Pearl on Mashable (mashable.com) In fact, you might have already gotten paid. #### [New Infographic Highlights XR Technology Data Flows and Privacy Risks](https://fpf.org/blog/new-infographic-highlights-xr-technology-data-flows-and-privacy-risks?ref=thenexusofprivacy.net) Future of Privacy Forum (fpf.org) As businesses increasingly develop and adopt extended reality (XR) technologies, including virtual (VR), mixed (MR), and augmented (AR) reality, the urgency to consider potential privacy and data protection risks to users and bystanders grows. Lawmakers, regulators, and other experts are increasingl… #### [‎Dismantling Injustice: History & Future of Racialized Surveillance ](https://podcasts.apple.com/us/podcast/history-future-of-racialized-surveillance/id1553476491?i=1000583682173&ref=thenexusofprivacy.net) Rumsha Sajid and Danny Cendejas on Apple Podcasts (podcasts.apple.com) From a growing culture of deputized surveillance, to shows like “Ring Nation,” surveillance is evolving with us. Two deeply experienced organizers working at MediaJustice discuss the historic roots of present day surveillance—colonialism and slavery—and the continued disproportionate impact that surveillance has on communities of color. #### [Bain Capital Crypto Leads $3.3M Round for Privacy-Focused Identity Protocol](https://coindesk.com/business/2022/10/27/bain-capital-crypto-leads-33m-round-for-privacy-focused-identity-protocol?ref=thenexusofprivacy.net) Brandy Betz on CoinDesk (coindesk.com) Notebook Labs aims to accelerate DeFi adoption with its crypto identity protocol. #### [Privacy regulators call for adequate privacy protections](https://yukon-news.com/news/privacy-regulators-call-for-adequate-privacy-protections?ref=thenexusofprivacy.net) Dana Hatherly on Yukon News (yukon-news.com) Jason Pedlar of the Yukon is among those federal, provincial and territorial privacy regulators #### [Cartoon: Privacy Law Frankenstein](https://teachprivacy.com/cartoon-privacy-law-frankenstein?ref=thenexusofprivacy.net) Daniel Solove on TeachPrivacy (teachprivacy.com) Prof Solove’s new Halloween cartoon - Privacy Law Frankenstein - involving the multitude of different privacy laws in the United States. #### [TikTok accused of plotting to track specific US citizens](https://theregister.com/2022/10/21/tiktok%5Fspying%5Fallegations%5Fbytedance?ref=thenexusofprivacy.net) Brandon Vigliarolo on The Register (theregister.com) China-owned boredom-killing biz issues precision-engineered denial #### [The Current State of General State Privacy Laws](https://jdsupra.com/legalnews/the-current-state-of-general-state-4915876?ref=thenexusofprivacy.net) John Pavolotsky on JD Supra (jdsupra.com) It’s a great time to be a privacy attorney. #### [UK watchdog warns against AI for emotional analysis, dubs ‘immature’ biometrics a bias risk](https://techcrunch.com/2022/10/26/no-to-voight-kampff-tests?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) The UK privacy watchdog has warned against use of “emotion analysis” technologies, saying “immature” biometrics pose a discrimination risk. #### [Apple executives say privacy controls and advertising can coexist](https://livemint.com/technology/tech-news/apple-executives-say-privacy-controls-and-advertising-can-coexist-11666790675455.html?ref=thenexusofprivacy.net) WSJ on mint (livemint.com) The iPhone maker plans to comply with new EU mandate governing how devices must be charged #### [Biometric Privacy Trial Is a Milestone in Privacy Law](https://jdsupra.com/legalnews/biometric-privacy-trial-is-a-milestone-4493147?ref=thenexusofprivacy.net) Elizabeth Burgin Waller on JD Supra (jdsupra.com) Generally, biometric privacy laws seek to protect the unique attributes of human beings that could be leveraged to access sensitive information about... #### [View of Data and the Good?](https://ojs.library.queensu.ca/index.php/surveillance-and-society/article/view/15764/10281?ref=thenexusofprivacy.net) Daniel Susser on ojs.library.queensu.ca The abstract: > Surveillance studies scholars and privacy scholars have each developed sophisticated, important critiques of the existing data-driven order. But too few scholars in either tradition have put forward alternative substantive conceptions of a good digital society. This, I argue, is a crucial omission. Unless we construct new “sociotechnical imaginaries,”new understandings of the goals and aspirations digital technologies should aim to achieve, the most surveillance studies and privacy scholars can hope to accomplish is a less unjust version of the technology industry’s own vision for the future. #### [Where did all the “reject” buttons come from?!](https://noyb.eu/en/where-did-all-reject-buttons-come?ref=thenexusofprivacy.net) on noyb.eu (noyb.eu) More and more websites have added an option to say “no” to cookies and other tracking- as foreseen by the GDPR. Where did this trend come from? #### [Courts Recognize Constitutional Harms from Invasive School Surveillance](https://cdt.org/insights/courts-recognize-constitutional-harms-from-invasive-school-surveillance?ref=thenexusofprivacy.net) Cody Venzke on Center for Democracy and Technology (cdt.org) This fall, a federal trial court in Ohio ruled that certain uses of remote proctoring violate students’ right to be free from unreasonable searches under the Fourth Amendment. The court recognized that some aspects of remote proctoring technology intrude on the “core places” where society recognizes… #### [Metaverse Privacy Concerns and How to Address Them](https://techtarget.com/searchcio/tip/Metaverse-privacy-concerns-and-how-to-address-them?ref=thenexusofprivacy.net) Ashwin Krishnan, on TechTarget (techtarget.com) Metaverse privacy is a moving target. Learn about the main data privacy concerns the metaverse poses and how to mitigate them. #### [Buying police scanners should not be an easy decision -- privacy rights are an issue](https://almanacnews.com/blogs/p/2022/10/26/buying-police-scanners-should-not-be-an-easy-decision----privacy-rights-are-an-issue?ref=thenexusofprivacy.net) Diana Diamond on Almanac Online (almanacnews.com) The Palo Alto Police Department wants the city to spend thousands of dollars each year, for an indefinite period, to purchase an unspecified number (10, 20, or?) of Automated License Plate Readers (ALPRs) to help them identify stolen vehicles, trace cars involved in crimes and help investigators locate perpetrators once a crime has occurred, according to a report from the Police Department. --- Image Credit: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [picserver.org](https://www.picserver.org/p/privacy.html?ref=thenexusofprivacy.net). ### A new Chief Twit - and a big Twitter privacy issue URL: https://thenexusofprivacy.net/a-new-chief-twit-and-a-big-twitter-privacy-issue/ Last updated: 2022-10-28T05:44:20.000Z In case you haven't heard, there's a new Chief Twit. His other company is known for [racial abuse of Black workers](https://www.reuters.com/business/autos-transportation/tesla-hit-by-new-lawsuit-alleging-racial-abuse-against-black-workers-2022-07-01/?ref=thenexusofprivacy.net) and [software bugs](https://hypebeast.com/2022/5/tesla-recalls-130000-vehicles-software-bug?ref=thenexusofprivacy.net), and as soon has he took over he fired Vijaya Gadde, the widely-respected head of Trust & Safety. What could possibly go wrong? > If you care about digital privacy and you’re a Twitter user, this may not be great news. Over the years, Twitter has been dogged by privacy and security issues, while also dragging its feet on implementing possible solutions. The result is that conceivably everything you’ve ever done or said on Twitter, public or private — including your direct messages — may soon belong to one of the richest people in the world, a man known for being unpredictable, childish, and even vengeful. It’ll also be owned by a man who [reportedly plans](https://www.washingtonpost.com/technology/2022/10/20/musk-twitter-acquisition-staff-cuts/?ref=thenexusofprivacy.net) to get rid of 75 percent of its staff, which could compromise Twitter’s security even more. Oops! > > – Sara Morrison in [What happens to your Twitter data when Elon takes over](https://www.vox.com/recode/2022/10/27/23427106/elon-musk-twitter-data-direct-messages?ref=thenexusofprivacy.net) on *Vox,* Oops indeed. So it's not surprising that a lot of people want to delete their Twitter data. Unfortunately, you can't. Back in 2019, Zack Whittaker reported that [Twitter doesn’t actually delete your direct messages when you try to delete them](https://techcrunch.com/2019/02/15/twitter-direct-messages/?ref=thenexusofprivacy.net). And even deleting your account won't help. As Morrison reports > The company told Recode it had “nothing to add here at this time” when asked how long it kept user data or how long it would take for a user’s data to be completely deleted from Twitter — if ever — should that user delete their account. Bummer. --- Image credit: [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net), originally by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) via [Picpedia](https://www.picpedia.org/keyboard/i/invasion-of-privacy.html?ref=thenexusofprivacy.net), licensed under Creative Commons 3 - [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) ### Privacy News: October 26 URL: https://thenexusofprivacy.net/privacy-news-october-26/ Last updated: 2022-10-26T20:01:10.000Z A bumper crop of links, including quite a few updates on state legislation – and international perspectives as well. ### [18 Books That Will Change the Way You Think About AI and Technology](https://miad.medium.com/18-books-that-will-change-the-way-you-think-about-ai-203758a95c3b?ref=thenexusofprivacy.net) Mia Dand on Medium (miad.medium.com) An excellent list of 18 books written by scholars and technology experts. Dand casts a broad net, including privacy-focused books like Helen Nissenbaum's *Privacy in Context* and Carissa Véliz' *Privacy Is Power* as well as classics like Safiya Umoja Noble's *Algorithms of Oppression*, Ruha Benjamin's *Race After Technology*, and Sasha Costanza-Chock’s *Design Justice.* **FIND OUT MORE**: The weekly [AI and Emerging Tech Ethics newsletter](https://lighthouse3.com/newsletter/?ref=thenexusofprivacy.net) from Dand's Lighthouse3 has the latest developments in AI, as well as a list of job opportunities. ## Privacy after Roe ### [Inslee and legislators begin rolling out reproductive freedom policies for 2023 legislative session](https://www.governor.wa.gov/news-media/inslee-and-legislators-begin-rolling-out-reproductive-freedom-policies-2023-legislative?ref=thenexusofprivacy.net) Governor Jay Inslee on governor.wa.gov Gov. Jay Inslee and Democratic lawmakers have begun rolling out their choice-defending agenda for the 2023 legislative session. Rep. Drew Hansen will sponsor a "sanctuary" bill that protects patients and providers from any criminal or civil actions for lawfully receiving or providing reproductive health care services or gender-affirming services in Washington. The bill will help protect patients from states like Texas or Idaho from being punished for lawfully seeking and receiving legal health care services in Washington state. Sen. Manka Dhingra and Rep. Vandana Slatter announced [a health data bill](https://www.atg.wa.gov/news/news-releases/ag-ferguson-rep-slatter-sen-dhingra-propose-legislation-protect-washingtonians?utm%5Fmedium=email&utm%5Fsource=govdelivery) – which prohibits organizations from selling Washingtonians’ health data, prohibits apps and websites from collecting and sharing Washingtonians’ health data without their consent, and prohibits “geofences” from being used at reproductive and gender affirming health care facilities. Inslee also affirmed he will be requesting legislation to pursue a constitutional amendment that expressly establishes a fundamental right to an abortion and a fundamental right to choose or refuse contraceptives. ### [Privacy and digital health data: The femtech challenge](https://iapp.org/news/a/privacy-and-digital-health-data-the-femtech-challenge/?ref=thenexusofprivacy.net) Amy Olivero on International Association of Privacy Professionals (iapp.org) This article examines current laws, latest enforcement actions, and pending legislation around health-relevant data in the U.S. As well as HIPAA and comprehensive state privacy laws like California's CCPA, Olivero also looks at more narrowly-targeted laws (such as data broker regulation in California, Nevada, and Vermont), state Attorney General actions (including California's action against Glow), and FTC enforcement efforts (including Flo's settlement). ## Federal privacy legislation ### [How a federal proposal could undermine California’s privacy rights](https://calmatters.org/commentary/2022/10/california-abortion-federal-proposal-privacy-rights?ref=thenexusofprivacy.net) Hannah-Beth Jackson on CalMatters (calmatters.org) The former chair of California's Senate Judiciary Committee weighs in on the proposed American Data Privacy and Protection Act (ADPPA), which would preempt California's privacy laws. Unsurprisingly, she thinks that would be bad. > This potential government loophole threatens more than just reproductive rights. People of color, low-income workers, undocumented immigrants and the LGBTQ community could also be impacted if government agencies can simply buy data. Immigration and Customs Enforcement has weaponized data location to conduct raids, unleashing fears about government tracking that have led to a decrease in the use of services ranging from food stamps to health care. > > Other government agencies, including the FBI and DEA, have contracted with data brokers to covertly monitor the location and identity of people who assembled during Black Lives Matter protests. > > Under the federal proposal, Californians could also lose the right to strengthen our laws. Unlike a long history of federal privacy laws that let states do more, this one would set a ceiling that no state could improve upon. Privacy rights would be frozen in time while technology develops at lightspeed. FIND OUT MORE: [People in other states and cities have opinions on preemption too](https://thenexusofprivacy.net/adppa-new-compromise/#people-in-other-states-and-cities-have-opinions-on-preemption-too) surveys other reactions to ADPPA's preemption. ## State privacy legislation ### [Montanans’ privacy is on the ballot](https://dailyinterlake.com/news/2022/oct/16/montanans-privacy-ballot?ref=thenexusofprivacy.net) on Daily Inter Lake (dailyinterlake.com) Montanans will vote on whether to join Missouri and Michigan in strengthening constitutional privacy protection: > [Montana C-48](https://montanafreepress.org/2022/10/11/ci-48-montana-digital-privacy-constitutional-amendment/?ref=thenexusofprivacy.net) seeks to amend the state constitution to include electronic data and communications in search and seizure protections. As currently written, the search and seizures section of the constitution states that “the people shall be secure in their persons, papers, homes and effects from unreasonable searches and seizures.” The amendment would simply add “electronic data and communications” to that list — essentially updating the constitution to reflect the reality of modern times. ### [Colorado Consumer Privacy Rules Add to Looming Business Mandates](https://news.bloomberglaw.com/privacy-and-data-security/colorado-consumer-privacy-rules-add-to-looming-business-mandates?ref=thenexusofprivacy.net) Brenna Goth on Bloomberg Law (news.bloomberglaw.com) Draft details of how Colorado intends to implement its new consumer privacy law would add requirements that attorneys say companies should consider well ahead of the July 2023 effective date. ### [CPPA reschedules board meeting on CPRA draft rules](https://iapp.org/news/a/cppa-reschedules-board-meeting-on-cpra-draft-rules/?ref=thenexusofprivacy.net) International Association of Privacy Professionals (iapp.org) The meetings are now [October 28-29](https://cppa.ca.gov/meetings/agendas/20221028%5F29.pdf?ref=thenexusofprivacy.net) and [November 4-5](https://cppa.ca.gov/meetings/agendas/20221104.pdf?ref=thenexusofprivacy.net) (see the links for Zoom information). The meeting materials have the [proposed regulations](https://cppa.ca.gov/meetings/materials/20221021%5F22%5Fitem3%5Fmodtext.pdf?ref=thenexusofprivacy.net) and an [explanation](https://cppa.ca.gov/meetings/materials/20221021%5F22%5Fitem3%5Fexpmodtext.pdf?ref=thenexusofprivacy.net). Consumer Watchdog is concerned that [some of the proposed changes could weaken protections](https://www.consumerwatchdog.org/privacy-technology/last-minute-proposed-changes-could-weaken-landmark-ca-privacy-rules-consumer?ref=thenexusofprivacy.net); their [Privacy Dawn](https://consumerwatchdog.org/sites/default/files/2022-10/Privacy%20Dawn%20report.pdf?ref=thenexusofprivacy.net) report goes into detail. ### [Your 2022 end-of-year privacy ‘to do’ list](https://iapp.org/news/a/your-2022-end-of-year-privacy-to-do-list?ref=thenexusofprivacy.net) Jennifer Ruehr and Sam Castic on International Association of Privacy Professionals (iapp.org) Here’s a to-do list to help your company address these new privacy requirements for 2023. ### [Appellate Court Confirms That Monitoring Online Shopping Activity Violates State’s Anti-Wiretapping Law—and the Time to Act Is NOW! ](https://natlawreview.com/article/appellate-court-confirms-monitoring-online-shopping-activity-violates-state-s-anti?ref=thenexusofprivacy.net) Puja J. Amin on The National Law Review (natlawreview.com) So we’re launching a new feature on TCPAWorld – CIPA Sunday! CIPA – the California Invasion of Privacy Act – has become shorthand for the MASSIVE wave of wiretapping lawsuits crashing all across the country looking at recording of website interactions. And while CIPA is the most famous of these statutes—authorizing a $2,500.00 per violation statutory penalty—California is hardly alone. ## FTC ### [Maximize your minimization and other takeaways from the FTC’s Drizly case](https://iapp.org/news/a/maximize-your-minimization-and-other-takeaways-from-the-ftcs-drizly-case/?ref=thenexusofprivacy.net) Cobun Zweifel-Keegan on International Association of Privacy Professionals (iapp.org) The U.S. Federal Trade Commission enforcement action against Drizly demonstrates how the agency plans to give teeth to its new emphasis on data minimization. The FTC reached a settlement with Drizly, an online alcohol marketplace, and its CEO, alleging the company knew about its data security shortcomings and failed to take action to protect personal data from a data breach affecting 2.5 million users. Though the case derives from a security breach, privacy pros should pay close attention to the remedial actions in the [proposed consent order](https://www.ftc.gov/system/files/ftc%5Fgov/pdf/202-3185-Drizly-Agreement-Containing-Consent-Order.pdf?ref=thenexusofprivacy.net). ALSO: - [FTC Takes Action Against Drizly and its CEO James Cory Rellas for Security Failures that Exposed Data of 2.5 Million Consumers](https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-takes-action-against-drizly-its-ceo-james-cory-rellas-security-failures-exposed-data-25-million?ref=thenexusofprivacy.net), Federal Trade Commission (ftc.gov) - [Data security forecast: Drizly with a 100% chance of far-reaching order provisions](https://www.ftc.gov/business-guidance/blog/2022/10/data-security-forecast-drizly-100-chance-far-reaching-order-provisions?ref=thenexusofprivacy.net), Lesley Fair, FTC Business Blog (ftc.gov) - [FTC brings action against CEO of alcohol delivery company over data breach](https://www.washingtonpost.com/technology/2022/10/24/ftc-drizly-privacy-violations/?ref=thenexusofprivacy.net), Cat Zakrzewski, Washington Post (washingtonpost.com) - [FTC-Drizly Saga Reminds Marketers to Limit Data Collection](https://www.adweek.com/programmatic/the-ftc-drizly-saga-sends-a-stark-reminder-to-marketers-to-limit-data-collection-to-what-is-necessary/?ref=thenexusofprivacy.net), Trishla Ostwall, Adweek (adweek.org) ## And ... #### [‘Immature biometric technologies could be discriminating against people’ says ICO in warning to organisations](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2022/10/immature-biometric-technologies-could-be-discriminating-against-people-says-ico-in-warning-to-organisations?ref=thenexusofprivacy.net) on ICO (ico.org.uk) The Information Commissioner’s Office is warning organisations to assess the public risks of using emotion analysis technologies, before implementing these systems. Organisations that do not act responsibly, posing risks to vulnerable people, or fail to meet ICO expectations will be investigated. ALSO: [Information commissioner warns firms over ‘emotional analysis’ technologies](https://theguardian.com/technology/2022/oct/25/information-commissioner-warns-firms-over-emotional-analysis-technologies?ref=thenexusofprivacy.net), Alex Hern on The Guardian (theguardian.com) #### [Is GPC the new ‘do not track’?](https://iapp.org/news/a/is-gpc-the-new-do-not-track?ref=thenexusofprivacy.net) Anokhy Desai on International Association of Privacy Professionals (iapp.org) This article looks at the Global Privacy Control and the comparison between it and the do not track mechanism. ALSO: [GPC under the GDPR](https://berjon.com/gpc-under-the-gdpr?ref=thenexusofprivacy.net), Robin Berjon on berjon.com #### [Senator questions Mark Zuckerberg over Meta’s healthcare data collection policies](https://healthcareitnews.com/news/senator-questions-zuckerberg-over-metas-healthcare-data-collection-policies?ref=thenexusofprivacy.net) Mike Miliard on Healthcare IT News (healthcareitnews.com) The letter from Sen. Mark Warner to the Facebook founder comes just days after Advocate Aurora Health notified patients of a potential breach involving a pixel-tracking tool. “Of particular concern are the recent allegations that Meta has used Meta Pixel data to inform targeted advertisements on Meta’s platforms." ALSO: [Senator Questions Meta Over Use Of Hospital Data](https://mediapost.com/publications/article/379013/meta-faces-new-scrutiny-over-medical-data.html?ref=thenexusofprivacy.net), Wendy Davis on Media Post (mediapost.com) #### [Square sells access to your inbox. No one knows if the law cares.](https://protocol.com/policy/block-square-privacy?ref=thenexusofprivacy.net) Ben Brody on Protocol (protocol.com) When my work inbox got flooded with reminders of my most twee shopping habits, I found out the Block-owned service throws up obstacles to getting out of its marketing business. #### [AlgorithmWatch is offering 5 fellowships in algorithmic accountability reporting](https://algorithmwatch.org/en/call-for-fellowships-accountability-reporting?ref=thenexusofprivacy.net) Nicolas Kayser-Bril on AlgorithmWatch (algorithmwatch.org) Fellows will receive €1,200 per month during 6 months and will report on automated decision-making in Europe. #### [The Shifting Privacy Left Podcast](https://shiftingprivacyleft.buzzsprout.com/2059470?ref=thenexusofprivacy.net) Debra Farber on Buzzsprout (shiftingprivacyleft.buzzsprout.com) Shifting Privacy Left features lively discussions on the need for organizations to embed privacy by design into engineering, devops and the product development processes BEFORE code or products are ever shipped. #### [We used to get excited about technology. What happened?](https://technologyreview.com/2022/10/21/1061260/innovation-technology-what-happened?ref=thenexusofprivacy.net) Shannon Vallor on MIT Technology Review (technologyreview.com) Innovation that truly serves us all is in scarce supply. That’s a problem. #### [Law firm says ex-lawyer is trying to take over Clearview AI lawsuit](https://reuters.com/legal/litigation/law-firm-says-ex-lawyer-is-trying-take-over-clearview-ai-lawsuit-2022-10-24?ref=thenexusofprivacy.net) David Thomas on Reuters (reuters.com) Chicago law firm Loevy & Loevy has accused one of its former lawyers of trying to force it out of a class action lawsuit against facial recognition startup Clearview AI Inc just as a potentially lucrative settlement may be in the works. #### [Hintze Law Global Privacy Updates](https://hintzelaw.com/hintzelaw-blog/2022/10/24/hintze-law-global-privacy-updates?ref=thenexusofprivacy.net) By Leslie Veloz on Hintze Law PLLC – Privacy + Security (hintzelaw.com) Here’s a snapshot of a few privacy developments from the past few weeks. #### [A Bill of Rights for the Information Age: White House Outlines Principles for Artificial Intelligence Design & Use](https://natlawreview.com/article/bill-rights-information-age-white-house-outlines-principles-artificial-intelligence?ref=thenexusofprivacy.net) Kevin J. White on The National Law Review (natlawreview.com) It is no secret that legislators and regulatory agencies have taken note of companies' increasing reliance on artificial intelligence (AI). #### [Spanish ISPs Fall Short of Robust Commitments to User Privacy in New Eticas’ Report](https://eff.org/deeplinks/2022/10/spanish-isps-fall-short-robust-commitments-user-privacy-new-eticas-report?ref=thenexusofprivacy.net) Veridiana Alimonti on Electronic Frontier Foundation (eff.org) Spanish Internet Service Providers (ISPs) continue to fall short of robust transparency about their data protection and user privacy practices, with many failing to meet criteria that directly builds on Spanish and EU data protection regulations.While highlighting that internet companies in Spain... #### [EU Lawmakers Must Reject This Proposal To Scan Private Chats](https://eff.org/deeplinks/2022/10/eu-lawmakers-must-reject-proposal-scan-private-chats?ref=thenexusofprivacy.net) Joe Mullin on Electronic Frontier Foundation (eff.org) Having a private conversation is a basic human right. Like the rest of our rights, we shouldn’t lose it when we go online. But a new proposal by the European Union could throw our privacy rights out the window. LEARN MORETell the European Parliament: Stop Scanning MeThe European Union’s executive... #### [Casino Developers Want to Fill Times Square With Surveillance Drones](https://gizmodo.com/times-square-nyc-caesars-casino-surveillance-drones-1849683511?ref=thenexusofprivacy.net) Thomas Germain on Gizmodo (gizmodo.com) “If the city makes this high-stakes bet on casino surveillance, I worry they’ll gamble away the future of our public streets,” said one privacy expert. #### [Towards a data-subject-friendly interpretation of Article 82 GDPR](https://verfassungsblog.de/data-subject-friendly?ref=thenexusofprivacy.net) Hubert Bekisz on Verfassungsblog (verfassungsblog.de) Under the General Data Protection Regulation (GDPR), Article 82 is the only instrument to claim compensation resulting from data protection infringements. So far, it has not been interpreted by the Court of Justice of the European Union (CJEU or Court) #### [Better Regulating Drone Use Requires Communication, Not Surveillance](https://eff.org/deeplinks/2022/10/better-regulating-drone-use-requires-communication-not-surveillance?ref=thenexusofprivacy.net) India McKinney on Electronic Frontier Foundation (eff.org) In 2018, Congress gave the Departments of Justice and Homeland Security sweeping new authorities to destroy or commandeer privately-owned drones, as well as intercept the data it sends and receives. EFF objected to The Preventing Emerging Threats Act of 2018 (S. 2836, H.R. 6401) because, among... #### [The Wire Retracts Its Meta Stories](https://thewire.in/media/the-wire-retracts-meta-stories?ref=thenexusofprivacy.net) The Wire on The Wire (thewire.in) Given the discrepancies that have come to our attention via our review so far, The Wire will also conduct a thorough review of previous reporting done by the technical team involved in our Meta coverage. #### [Texas AG sues Google over facial and voice data collection](https://cnbc.com/2022/10/20/texas-ag-sues-google-for-over-facial-and-voice-data-collection.html?%5F%5Fsource=sharebar%7Ctwitter&ref=thenexusofprivacy.net) Lauren Feiner on CNBC (cnbc.com) The complaint underscores the role of individual states in protecting users’ information on the internet in the absence of a federal privacy law. #### [Joy Buolamwini saw first-hand the harm of AI bias. Now she’s challenging tech to do better.](https://vox.com/future-perfect/23365558/future-perfect-50-ai-joy-buolamwini-founder-algorithmic-justice-league?ref=thenexusofprivacy.net) Sigal Samuel on Vox (vox.com) How a personal experience with facial recognition tech sparked a broad campaign for algorithmic justice. #### [UCSB community highlights concerns over privacy, racial profiling and criminalization at Halloween policing town hall](https://dailynexus.com/2022-10-22/ucsb-community-highlights-concerns-over-privacy-racial-profiling-and-criminalization-at-halloween-policing-town-hall?ref=thenexusofprivacy.net) Nisha Malley on The Daily Nexus (dailynexus.com) Isla Vista Foot Patrol plans to install two to four street cameras throughout Isla Vista and upstaff its patrol during Halloween weekend. #### [Black or bot? The long, sordid history of co-opting Blackness online](https://motherjones.com/media/2022/09/disinformation-russia-trolls-bots-black-culture-blackness-ukraine-twitter?ref=thenexusofprivacy.net) Morgan Jerkins on Mother Jones (motherjones.com) Trolls and foreign agents love to exploit African-American culture for political gain. #### [ARE CHAT BOXES THE NEW CIPA GOLDMINE?: Shifting Plaintiff’s Tactics in California Wiretap Cases Are on Recent Display](https://natlawreview.com/article/are-chat-boxes-new-cipa-goldmine-shifting-plaintiff-s-tactics-california-wiretap?ref=thenexusofprivacy.net) Eric J. Troutman on The National Law Review (natlawreview.com) If there is any statute in America that is potentially set to overrun the TCPA for the title of “most dangerous business killer out there–it is probably the California Invasion of Privacy #### [TikTok accused of plotting to track specific US citizens](https://theregister.com/2022/10/21/tiktok%5Fspying%5Fallegations%5Fbytedance?ref=thenexusofprivacy.net) Brandon Vigliarolo on The Register (theregister.com) China-owned boredom-killing biz issues precision-engineered denial #### [Texas sues Google in row over biometric data](https://theregister.com/2022/10/20/texas%5Fag%5Fsues%5Fgoogle%5Fbiometrics?ref=thenexusofprivacy.net) Thomas Claburn on The Register (theregister.com) You can kiss my Californian ass, says ad giant #### [LinkedIn experiment changed job prospects for millions — and it raises red flags: privacy experts](https://cbc.ca/news/business/linkedin-study-consent-1.6625768?%5F%5Fvfz=medium%3Dsharebar&ref=thenexusofprivacy.net) Kiernan Green on CBC (cbc.ca) A five-year study by LinkedIn on nearly 20 million of its users raises ethical red flags since some unknowing participants in the social experiment likely had job opportunities curtailed, experts in data privacy and human resources suggest. #### [Tesco barring store entry to people who refuse club cards](https://iccl.ie/news/tesco-barring-store-entry-to-people-who-refuse-club-cards?ref=thenexusofprivacy.net) Johnny Ryan on Irish Council for Civil Liberties (iccl.ie) ICCL writes to the Oireachtas (Irish Parliament and Senate) Justice Committee, and MEPs from the European Parliament Justice Committee, about the LIBE mission to Dublin to investigate Ireland’s application of the GDPR. #### [The Latest Attempt To Address The Online Data And Privacy Crisis](https://forbes.com/sites/edwardsegal/2022/10/21/the-latest-attempt-to-address-the-online-data-and-privacy-crisis?ref=thenexusofprivacy.net) Edward Segal on Forbes (forbes.com) The online data and privacy crisis could be back in the spotlight thanks to U.S. Senator Edward Markey (D-Mass), who is leading a group of Senate colleagues in asking the Federal Trade Commission to update the Children’s Online Privacy Protection Act. #### [Data Protection framework to be tabled during the budget session in February](https://fortuneindia.com/enterprise/data-protection-framework-to-be-tabled-during-the-budget-session-in-february/110122?ref=thenexusofprivacy.net) Fortune India Exchange on Fortune India (fortuneindia.com) The data protection bill which was first introduced in the Parliament in 2019, aimed to tighten the scrutiny across social media platforms. #### [States Rolling Out Digital Identity Cards Promise User Privacy](https://news.bloomberglaw.com/privacy-and-data-security/states-rolling-out-digital-identity-cards-promise-user-privacy?ref=thenexusofprivacy.net) Andrea Vittorio on Bloomberg Law (news.bloomberglaw.com) States launching digital versions of a driver’s license are championing the credentials as a way to keep personal information more private and secure, though nationwide adoption will depend on coalescing around a common standard for how the identification cards are built and used. #### [Privacy assembly in Istanbul calls for adaptation to new necessities](https://dailysabah.com/politics/diplomacy/privacy-assembly-in-istanbul-calls-for-adaptation-to-new-necessities?ref=thenexusofprivacy.net) Eralp Yarar on Daily Sabah (dailysabah.com) The 44th Global Privacy Assembly (GPA) organized by Türkiye’s Personal Data Protection Authority (KVKK) was launched on Tuesday in Istanbul’s... #### [The Commission’s gross violation of privacy — endangering encryption](https://politico.eu/article/eu-commission-violation-privacy-endangering-encryption?ref=thenexusofprivacy.net) Markéta Gregorová on POLITICO (politico.eu) The EU has fallen for the myth that it’s possible to keep us safer by weakening the very thing that protects us. #### [5 Key Takeaways - How GDPR has Impacted American Companies and the Future of Transatlantic Data Transfers](https://jdsupra.com/legalnews/5-key-takeaways-how-gdpr-has-impacted-5989444?ref=thenexusofprivacy.net) Amanda Witt on JD Supra (jdsupra.com) The European Union’s General Data Protection Regulation (“GDPR”) marked a turning point in privacy and data protection practices globally and... --- *Image credit:* Daquella manera on [Flickr ](https://www.flickr.com/photos/62518311@N00/466172168?ref=thenexusofprivacy.net) via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons Attribution 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net) license. ### Privacy News: October 21, Global Encryption Day URL: https://thenexusofprivacy.net/privacy-news-october-21/ Last updated: 2022-10-21T16:34:40.000Z MENA region LGBTQ+ activist Afsaneh Rigot disucsses why encryption is crucial for keeping people in marginalized communities safe. Today is Global Encryption Day, sponsored by the Global Encryption Coalition. As the signatories write in their [statement](https://www.globalencryption.org/2022/10/global-encryption-day-statement/?ref=thenexusofprivacy.net): > Strong encryption is a critical technology that helps keep people, their information, and communications private and secure. It underpins online trust, protects members of vulnerable communities, and safeguards the data of governments, businesses, and citizens from criminals and other malicious actors.... > > On Global Encryption Day, we call on governments and the private sector to reject efforts to undermine encryption and instead pursue policies that enhance, strengthen, and promote use of strong encryption to protect people everywhere. We also support and encourage the efforts of companies to protect their customers by deploying strong encryption on their services and on their platforms. > **TAKE ACTION:** [**Make DMs Safe!**](https://www.makedmssafe.com/?ref=thenexusofprivacy.net) > Sign on to the [open letter](https://www.makedmssafe.com/?ref=thenexusofprivacy.net) to tell Facebook, Twitter, Google, Apple to protect our private messages and implement default end-to-end encryption immediately. JournalistJames Ball on how end-to-end encryption is critical for keeping journalists safe in the field and at home ### [Uber Will Start Serving You Targeted Ads Based On Where You Go](https://vice.com/en/article/v7vxv8/uber-will-start-serving-you-targeted-ads-based-on-where-you-go?ref=thenexusofprivacy.net) Aaron Gordon on vice.com Yikes! Uber is rolling out a targeted ad system that will let companies serve ads to people in the Uber app based on the specific places they have been, according to [a report by the ](https://www.wsj.com/articles/uber-to-let-marketers-target-riders-by-destination-11666184402?mod=hp%5Flista%5Fpos2&ref=thenexusofprivacy.net)[*Wall Street Journal*](https://www.wsj.com/articles/uber-to-let-marketers-target-riders-by-destination-11666184402?mod=hp%5Flista%5Fpos2&ref=thenexusofprivacy.net) *...* like for example doctors offices, abortion clinics, religious or cultural centers, and a host of other potentially sensitive places. What could possibly go wrong? > “Uber never misses an opportunity to push the boundaries on how extractive and exploitative a company is allowed to be,” Chris Gilliard, Just Tech Fellow at the Social Science Research Council, told Motherboard. “Using the granular details gleaned from people’s travels as fodder for advertising poses a threat to anyone who doesn’t want the intimate details of where they worship, who they date or what medical conditions they have being sold to the highest bidder. This news reaffirms that Uber is a surveillance company masquerading as a transportation company.” ## Student Privacy ### [Students Are Fighting Remote Exam Surveillance — and Winning](https://teenvogue.com/story/remote-proctoring-services-lawsuits?ref=thenexusofprivacy.net) on Teen Vogue (teenvogue.com) “We should be focused on education, not surveillance.” ## Algorithmic Justice ### [The unseen Black faces of AI algorithms](https://nature.com/articles/d41586-022-03050-7?ref=thenexusofprivacy.net) Abeba Birhane on Nature (nature.com) The Gender Shades audit of commercial facial-analysis tools found that dark-skinned faces are misclassified at a much higher rate than are faces from any other group. Four years on, the study is shaping research, regulation and commercial practices. ### [A bias bounty for AI will help to catch unfair algorithms faster](https://technologyreview.com/2022/10/20/1061977/ai-bias-bounty-help-catch-unfair-algorithms-faster?ref=thenexusofprivacy.net) Melissa Heikkilä on MIT Technology Review (technologyreview.com) The hope is it will boost a blossoming sector that works to hold artificial-intelligence systems accountable. #### [France fines Clearview AI maximum possible for GDPR breaches](https://techcrunch.com/2022/10/20/clearview-ai-fined-in-france?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) Clearview AI, the controversial facial recognition firm, has been hit with another fine in Europe after ghosting France’s privacy regulator. ## And ... #### [They got a Ring doorbell alert, then opened fire on a bystander, police say](https://washingtonpost.com/nation/2022/10/19/ring-doorbell-camera-shooting-florida?ref=thenexusofprivacy.net) Justine McDaniel on The Washington Post (washingtonpost.com) After seeing a neighbor on their doorbell camera, a Florida father and son ran outside, looking for an intruder. They shot at a woman sitting in her car, authorities said. #### [Texas Sues Google for Collecting Biometric Data Without Consent](https://nytimes.com/2022/10/20/technology/texas-google-privacy-lawsuit.html?ref=thenexusofprivacy.net) Kashmir Hill and David McCabe on NYTimes (nytimes.com) Ken Paxton, the state attorney general, said products like Google Photos and the Nest camera had violated Texans’ privacy rights. #### [Health system data breach due to Meta Pixel hits 3 million patients](https://bleepingcomputer.com/news/security/health-system-data-breach-due-to-meta-pixel-hits-3-million-patients?ref=thenexusofprivacy.net) Bill Toulas on BleepingComputer (bleepingcomputer.com) Advocate Aurora Health (AAH), a 26-hospital healthcare system in the states of Wisconsin and Illinois, is notifying its patients of an unintentional data breach that impacts 3,000,000 individuals. ALSO: [Advocate Aurora Health in potential 3 million patient leak](https://theregister.com/2022/10/20/health%5Fgroup%5Fsays%5Ftracking%5Fpixel?ref=thenexusofprivacy.net), Brandon Vigliarolo on The Register (theregister.com) #### [Startups Offer to Pay Consumers for Permission to Track Them Online](https://wsj.com/articles/startups-pay-tracking-online-data-11666038682?ref=thenexusofprivacy.net) Katie Deighton on The Wall Street Journal (wsj.com) Consumers have been slow to sign up, as the rewards for allowing tracking remain small. #### [Ring Cameras Are Being Used to Control and Surveil Overworked Delivery Workers](https://vice.com/en/article/7k8dx4/ring-cameras-are-being-used-to-control-and-surveil-overworked-delivery-workers?ref=thenexusofprivacy.net) Edward Ongweso Jr on vice.com A Data & Society report interviewed doorbell camera users and delivery drivers to understand how surveillance is affecting both, for the worse. #### [Indonesia’s Personal Data Protection Bill: Overview, Key Takeaways, and Context](https://fpf.org/blog/indonesias-personal-data-protection-bill-overview-key-takeaways-and-context?ref=thenexusofprivacy.net) Read More on Future of Privacy Forum (fpf.org) On September 20, 2022, Indonesia’s House of Representatives passed the Personal Data Protection Bill (PDP Bill) (note: linked Bill is in Indonesian). This is the first step towards enactment of the PDP Bill as law. The second step was Presidential assent, which happened on October 17, 2022, and sign… #### [Students are acing their homework by turning in machine-generated essays. Good.](https://aisnakeoil.substack.com/p/students-are-acing-their-homework) Arvind Narayanan on AI Snake Oil (aisnakeoil.substack.com) Teachers adapted to the calculator. They can certainly adapt to language models. #### [Privacy Executives Hope Trans-Atlantic Deal Withstands Court Challenges](https://wsj.com/articles/privacy-executives-hope-trans-atlantic-deal-withstands-court-challenges-11666199417?ref=thenexusofprivacy.net) Catherine Stupp on The Wall Street Journal (wsj.com) A new agreement is expected to be in place in early 2023, making it easier to move data about EU citizens to the U.S., though many worry the deal could be short-lived. #### [What are quantum-resistant algorithms—and why do we need them?](https://technologyreview.com/2022/09/14/1059400/explainer-quantum-resistant-algorithms?ref=thenexusofprivacy.net) Tammy Xu on MIT Technology Review (technologyreview.com) When quantum computers become powerful enough, they could theoretically crack the encryption algorithms that keep us safe. The race is on to find new ones. #### [Opinion | Proposed data privacy law favour industry over individuals](https://thestar.com/opinion/contributors/2022/10/07/proposed-data-privacy-law-favour-industry-over-individuals.html?ref=thenexusofprivacy.net) TSBy Teresa ScassaContributorFri., Oct. 7, 2022timer3 min. read on Toronto Star (thestar.com) When it comes to privacy, the government has clearly listened more to the concerns of industry; human rights take a back seat to commercial interests. #### [DuckDuckGo’s New Web Browser for Mac Protects Your Privacy On YouTube](https://gizmodo.com/duckduckgo-mac-web-browser-private-youtube-apple-1849669135?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) The private search company is bringing its data protection to your Mac. #### [Is privacy only for the elite? Why Apple’s approach is a marketing advantage](https://venturebeat.com/security/is-privacy-only-for-the-elite-why-apples-approach-is-a-marketing-advantage?ref=thenexusofprivacy.net) Ashleigh Hollowell on VentureBeat (venturebeat.com) While a burgeoning divide shows it is more difficult for the everyday person to take advantage of their data privacy, companies are also struggling with how to approach it as regulations change. Some companies like Apple are using privacy as a marketing point. #### [After the Optus data breach, Australia needs mandatory disclosure laws](https://theconversation.com/after-the-optus-data-breach-australia-needs-mandatory-disclosure-laws-192612?ref=thenexusofprivacy.net) Jane Andrew on The Conversation (theconversation.com) Optus made a public announcement about its breach but was not legally required to do so. This needs to change. #### [Protecting Data in the Metaverse: Do Avatars Dream of Privacy?](https://jdsupra.com/legalnews/protecting-data-in-the-metaverse-do-5740290?ref=thenexusofprivacy.net) Omer Tene on JD Supra (jdsupra.com) The metaverse will bring many benefits, but it is also likely to multiply and compound privacy issues, particularly given its global nature. ... #### [Consumers care about their data: Learn how to automate privacy and compliance efforts](https://techrepublic.com/article/consumers-data-lautomate-privacy-compliance-efforts?ref=thenexusofprivacy.net) Tarique Mustafa on TechRepublic (techrepublic.com) Consumer data compliance and privacy are growing in importance. Learn how to automate compliance efforts here. #### [Mere “upset” not sufficient for GDPR compensation claims - Advocate General](https://jdsupra.com/legalnews/mere-upset-not-sufficient-for-gdpr-6569116?ref=thenexusofprivacy.net) Thomas Harper on JD Supra (jdsupra.com) The Advocate General of the Court of Justice of the EU has issued an Opinion stating that mere “upset” is not sufficient to give rise to a claim for... #### [Updates on the FTC Privacy Rulemaking: Insights from Commissioner Slaughter and Comment Deadline Extension](https://jdsupra.com/legalnews/updates-on-the-ftc-privacy-rulemaking-8458037?ref=thenexusofprivacy.net) Tyler Bridegan on JD Supra (jdsupra.com) In August, the FTC launched a groundbreaking privacy and security rulemaking under the FTC Act with an extensive Advanced Notice of Proposed Rulemaking (ANPR) that asks a wide range of questions. Last week, the International Association of Privacy Professionals (IAPP) conference in Austin, Texas featured a discussion with FTC Commissioner Rebecca Slaughter regarding this broad new rulemaking. Shortly after Commissioner Slaughter’s discussion, the FTC granted an extension of the deadline for comments in response to the ANPR. #### [MBIE tight-lipped over not consulting Privacy Commissioner on using spy firm Cobwebs](https://rnz.co.nz/news/national/477016/mbie-tight-lipped-over-not-consulting-privacy-commissioner-on-using-spy-firm-cobwebs?ref=thenexusofprivacy.net) RNZ News on RNZ (rnz.co.nz) Officials are refusing to say why they did not consult the Privacy Commissioner over their use of a private overseas spy company. #### [The Best Privacy Features in DuckDuckGo’s New Web Browser](https://lifehacker.com/the-best-privacy-features-in-duckduckgo-s-new-web-brows-1849673422?ref=thenexusofprivacy.net) Jake Peterson on Lifehacker (lifehacker.com) DuckDuckGo’s new web browser brings some killer privacy features to the Mac. #### [Privacy concerns plague 97% mobile internet users: Study](https://asianews.network/privacy-concerns-plague-97-mobile-internet-users-study?ref=thenexusofprivacy.net) The Daily Star on Asia News Network (asianews.network) The study also showed that people are optimistic about the potential of mobile technology to help them lead a more sustainable life. #### [A Pragmatic Compromise? The Role of Article 88 GDPR in Upholding Privacy in the Workplace](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4198067&ref=thenexusofprivacy.net) Halefom H. Abraha on papers.ssrn.com The distinct challenges of data processing at work have led to long-standing calls for sector-specific regulation. This leaves the European legislature with a d #### [What is iCloud Private Relay? How the Apple service can help protect your online privacy](https://businessinsider.com/guides/tech/icloud-private-relay?ref=thenexusofprivacy.net) Dave Johnson on Insider (businessinsider.com) iCloud Private Relay can help protect your privacy by hiding your identity and location when browsing on Safari. #### [Productivity versus privacy – walking the employee tracking tight rope ](https://maddyness.com/uk/2022/10/19/productivity-versus-privacy-walking-the-employee-tracking-tight-rope?ref=thenexusofprivacy.net) Natalie Cramp on Maddyness (maddyness.com) As the remote working shift sees a pivot to surveillance, what does it mean for privacy, and do companies run the risk of taking it too far? #### [Digital ads: The struggle between gratuity and privacy](https://michigandaily.com/statement/digital-ads-the-struggle-between-gratuity-and-privacy?ref=thenexusofprivacy.net) Connor O’Leary Herreras on The Michigan Daily (michigandaily.com) I’m wary of corporations preying on my data but aware that using the internet requires individual action on my part to protect that data. #### [Candidates for Poway mayor discuss development, privacy and small businesses at forum](https://sandiegouniontribune.com/pomerado-news/news/story/2022-10-19/poway-mayoral-candidates-meet-to-discuss-issues?ref=thenexusofprivacy.net) Angela Brandt on Pomerado News (sandiegouniontribune.com) Four of the five candidates for Poway mayor tackled topics from development to small businesses at an Oct. 11 forum. #### [Former NSA researcher creates online privacy app for kids](https://stripes.com/theaters/us/2022-10-20/former-nsa-researcher-online-privacy-7754951.html?ref=thenexusofprivacy.net) Geoffrey A. Fowler on Stars and Stripes (stripes.com) A frightening number of kids’ apps are spying on them. Now parents can get some help to stop it. #### [How Asia’s Digital Governance Beacon Balances Data Privacy and the ‘Public Good’](https://thediplomat.com/2022/10/how-asias-digital-governance-beacon-balances-data-privacy-and-the-public-good?ref=thenexusofprivacy.net) Sam Robbins on thediplomat.com Taiwan’s government has immense amounts of health data on its population. What it can do with that data is the subject of a decade-long lawsuit. #### [Experts Cite Privacy Risks From Two Qatari Apps Required for FIFA World Cup Visitors](https://spiceworks.com/it-security/data-security/news/fifa-world-cup-qatar-data-privacy?ref=thenexusofprivacy.net) on Spiceworks (spiceworks.com) Cybersecurity professional Bruce Schneier: “Everyone visiting Qatar for the World Cup needs to install spyware on their phone.” ### Privacy News: October 19 URL: https://thenexusofprivacy.net/privacy-news-october-19/ Last updated: 2022-10-19T02:36:51.000Z ### [The Rise of ‘Luxury Surveillance’](https://theatlantic.com/technology/archive/2022/10/amazon-tracking-devices-surveillance-state/671772?ref=thenexusofprivacy.net) Chris Gilliard on The Atlantic (theatlantic.com) Surveillance isn’t just imposed on people: many of us buy into it willingly. Gilliard's latest outstanding article starts with a scenario of somebody using Amazon Halo, Amazon Echo, Amazon Ring, Amazon Neighbors ... what could possibly go wrong? > These “smart” devices all fall under the umbrella of what the digital-studies scholar David Golumbia and I call “[luxury surveillance](https://reallifemag.com/luxury-surveillance/?ref=thenexusofprivacy.net)”—that is, surveillance that people pay for and whose tracking, monitoring, and quantification features are understood by the user as benefits. These gadgets are analogous to the surveillance technologies deployed in Detroit and many other cities across the country in that they are best understood as mechanisms of control: They gather data, which are then used to affect behavior. Stripped of their gloss, these devices are similar to the ankle monitors and surveillance apps such as SmartLINK that are forced on people on parole or immigrants awaiting hearings. As the author and activist James Kilgore [writes](https://www.publicbooks.org/e-carceration-surveillance-technology-border-optics/?ref=thenexusofprivacy.net), “The ankle monitor—which for almost two decades was simply an analog device that informed authorities if the wearer was at home—has now grown into a sophisticated surveillance tool via the use of GPS capacity, biometric measurements, cameras, and audio recording.” > > The functions Kilgore describes mirror those offered by wearables and other trackers that many people are happy to spend hundreds of dollars on. Gadgets such as Fitbits, Apple Watches, and the Amazon Halo are pitched more and more for their ability to gather data that help you control and modulate your behavior, whether that’s tracking your steps, looking at your breathing, or analyzing the tone of your voice. The externally imposed control of the formerly incarcerated becomes the self-imposed control of the individual. ### [DuckDuckGo’s beta Mac app is open to public with new features](https://techcrunch.com/2022/10/18/duckduckgos-beta-mac-app-is-open-to-public-with-new-features?ref=thenexusofprivacy.net) Lauren Forristal on TechCrunch (techcrunch.com) [DuckDuckGo’s web browser for Mac is now available](https://duckduckgo.com/mac?ref=thenexusofprivacy.net) as an open beta test with new features like the Duck Player to defend YouTube users from targeted ads. Of course I immediately installed it, and it worked just fine on all the sites I tried it on. In my quick experimenting, its out-of-the-box ad-blocking worked as effectively for me as [uBlock Origin in Firefox](https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/?ref=thenexusofprivacy.net) (my browser of choice); the [Cookie Consent Pop-Up Manager](https://help.duckduckgo.com/duckduckgo-help-pages/privacy/web-tracking-protections/?ref=thenexusofprivacy.net#cookie-consent-pop-up-management) is quite useful. However, there doesn't appear to be a way to block Javascript. ## Privacy After Roe ### [Data Brokers, Police, and the Criminalization of Abortion](https://techpolicy.press/data-brokers-police-and-the-criminalization-of-abortion?ref=thenexusofprivacy.net) Aden Klein and Joanne Kim on Tech Policy Press (techpolicy.press) Police departments already purchase personal data from third party brokers. Now, that information may be used to criminalize abortion. > Coupled with preexisting surveillance systems, the massive amount of information that data brokers can assemble on women and people who get pregnant, as well as expecting families broadly, illustrates a problem of terrifying scale. The almost entirely unrestricted access that police departments have to commercial data and surveillance tools is equally horrifying- a subject that was discussed in detail at a House Judiciary Committee [hearing](https://techpolicy.press/bipartisan-support-for-fourth-amendment-is-not-for-sale-act-at-house-judiciary-hearing/?ref=thenexusofprivacy.net) this summer titled *Digital Dragnets: Examining the Government’s Access to Your Personal Data*.... > > Police use of data brokers to spy on citizens is [well documented](https://cdt.org/wp-content/uploads/2021/12/2021-12-08-Legal-Loopholes-and-Data-for-Dollars-Report-final.pdf?ref=thenexusofprivacy.net). However, following the money provides additional evidence of such practices. We analyzed public data and prior reporting of [states banning or imminently banning abortion](https://www.washingtonpost.com/politics/2022/06/24/abortion-state-laws-criminalization-roe/?ref=thenexusofprivacy.net) to identify companies and tools that could be used to aid in enforcing abortion laws. Even a high-level overview of public documents in [St. Louis County](https://stlouisco.spending.socrata.com/?ref=thenexusofprivacy.net#!/year/2022/explore/0-/segment2/POLICE/0-barChart/departmentgroup?x-return-url=https:%2F%2Fopenfinance.stlouiscountymo.gov%2F%23!%2Fdashboard&x-return-description=Return%20to%20Open%20Finance), the [State of Missouri Department of Public Safety](https://treasurer.mo.gov/showmecheckbook/expenditures?ref=thenexusofprivacy.net), the [City of Dallas](http://spending.dallasopendata.com/?ref=thenexusofprivacy.net#!/year/2021/), and the [City of Houston](https://www.openthebooks.com/members/employer-detail/?Id=5701&tab=3&F%5FName%5FC=stingray&Year%5FC=0&ref=thenexusofprivacy.net) shed light on the access that police have to supposedly private information. ### [Cracking Down on Federal Aid for Reproductive Health Surveillance: The Computer Analysis Response Team](https://cdt.org/insights/cracking-down-on-federal-aid-for-reproductive-health-surveillance-the-computer-analysis-response-team/?ref=thenexusofprivacy.net) Jake Laperruque, Center for Democracy and Technology (cdt.org) The fourth in a series of blog posts examining how the federal government and the White House — which has pledged to fight the criminalization of abortion — can prevent federal surveillance assistance to state and local law enforcement from being used to investigate and prosecute reproductive health care choices. Previous posts looked at [Regional Computer Forensic Laboratories](https://cdt.org/insights/cracking-down-on-federal-aid-for-reproductive-health-surveillance-regional-computer-forensic-labs/?ref=thenexusofprivacy.net) (where federal officials help state and local law enforcement to access and analyze electronic devices), the [National Domestic Computer Assistance Center](https://cdt.org/insights/cracking-down-on-federal-aid-for-reproductive-health-surveillance-the-national-domestic-communications-assistance-center/?ref=thenexusofprivacy.net) (a federal entity that helps local law enforcement collect communications content and other records from companies), and [fusion centers](https://cdt.org/insights/cracking-down-on-federal-aid-for-reproductive-health-surveillance-fusion-centers/?ref=thenexusofprivacy.net) (hubs across the country that intake immense amounts of data and distribute it to other law enforcement entities, with significant federal funding and access to federal law enforcement information). This post focuses on the FBI’s Computer Analysis Response Team (CART), a component of the agency designed to provide digital forensics support across the country ## Federal Privacy Legislation ### [Disabled People Need Critical Privacy Protections in ADPPA](https://cdt.org/insights/disabled-people-need-critical-privacy-protections-in-adppa?ref=thenexusofprivacy.net) Lydia X. Z. Brown on Center for Democracy and Technology (cdt.org) > Disabled people are one of the most hyper-surveilled communities within the U.S. Public and private entities alike collect enormous amounts of often deeply personal data about our lives and health, for purposes ranging from benign (such as [tracking disability-targeted hiring benchmarks](https://www.ancor.org/capitol-correspondence/dol-encourages-states-track-disability-employment-data/?ref=thenexusofprivacy.net)) to malicious (such as [profiling students as likely future criminals](https://www.techdirt.com/2020/11/23/florida-sheriffs-pre-crime-software-says-d-students-victims-domestic-violence-are-potential-criminals/?ref=thenexusofprivacy.net)). Algorithm-driven systems now commonly power [recruiting and hiring processes](https://cdt.org/insights/report-algorithm-driven-hiring-tools-innovative-recruitment-or-expedited-disability-discrimination/?ref=thenexusofprivacy.net), [tenant background checks](https://cdt.org/insights/tenant-screening-algorithms-enable-racial-and-disability-discrimination-at-scale-and-contribute-to-broader-patterns-of-injustice/?ref=thenexusofprivacy.net), [public benefits applications](https://www.btah.org/?ref=thenexusofprivacy.net), and even [remote test proctoring](https://cdt.org/insights/how-automated-test-proctoring-software-discriminates-against-disabled-students/?ref=thenexusofprivacy.net), all with outsized impact on people with disabilities. Meanwhile, researchers and developers are racing to create increasingly sophisticated algorithms to [detect disabil](https://www.wsj.com/articles/apple-wants-iphones-to-help-detect-depression-cognitive-decline-sources-say-11632216601?ref=thenexusofprivacy.net)[i](https://www.wsj.com/articles/apple-wants-iphones-to-help-detect-depression-cognitive-decline-sources-say-11632216601?ref=thenexusofprivacy.net)[ty](https://www.wsj.com/articles/apple-wants-iphones-to-help-detect-depression-cognitive-decline-sources-say-11632216601?ref=thenexusofprivacy.net) and [predict future diagnosis of mental health disabilities](https://www.wired.com/story/an-ai-used-facebook-data-to-predict-mental-illness/?ref=thenexusofprivacy.net).... > > This year, Congress made history by advancing out of committee a bipartisan comprehensive privacy bill, the American Data Privacy and Protection Act (ADPPA).... For disabled people in particular, ADPPA offers heightened protections. ADPPA defines as “sensitive” any data that is or could be interpreted or perceived as relating to disability, or mental and physical health in general, including past, present, or future disabilities and any data that can be used to infer such information. ## And ... #### [Cybersecurity Will Not Thrive in Darkness: A Critical Analysis of Proposed Amendments in Bill C-26 to the Telecommunications Act](https://citizenlab.ca/2022/10/a-critical-analysis-of-proposed-amendments-in-bill-c-26-to-the-telecommunications-act?ref=thenexusofprivacy.net) Christopher Parsons on The Citizen Lab (citizenlab.ca) This report offers 29 recommendations to the draft legislation in an effort to correct its secrecy and accountability deficiencies, while also suggesting amendments which would impose some restrictions on the range of powers that the government would be able to wield. It is important that these amen… #### [Why Signal won’t compromise on encryption, with president Meredith Whittaker](https://theverge.com/23409716/signal-encryption-messaging-sms-meredith-whittaker-imessage-whatsapp-china?ref=thenexusofprivacy.net) Nilay Patel / @reckless on The Verge (theverge.com) Signal recently killed SMS support as part of that mission #### [What the era of “doorbell surveillance” means for delivery drivers](https://marketplace.org/shows/marketplace-tech/doorbell-surveillance-delivery-drivers-privacy?ref=thenexusofprivacy.net) Meghan McCarty Carino on Marketplace (marketplace.org) New research suggests the proliferation of doorbell cameras create an environment of high surveillance that puts delivery drivers on edge. #### [Remembering David Flaherty](https://iapp.org/news/a/remembering-david-flaherty?ref=thenexusofprivacy.net) Elizabeth Denham on International Association of Privacy Professionals (iapp.org) David Flaherty – who studied with Alan Westin, published "Protecting Privacy in Surveillance Societies" in 1989, and was British Columbia's first Information and Privacy Commissioner in the 90s – passed on October 11\. #### [Section 230’s Fate Belongs With Congress—Not the US Supreme Court](https://wired.com/story/section-230-scotus-gonzalez-google?ref=thenexusofprivacy.net) Jeff Kosseff on WIRED (wired.com) A case heading to SCOTUS claims platforms should be held responsible for their algorithmic recommendations. The author of [The Twenty Six Words That Created The Internet](https://www.jeffkosseff.com/home?ref=thenexusofprivacy.net) argues that a history of the statute suggests otherwise. #### [Innovating Like an Optimist, Preparing Like a Pessimist: Ethical Debt and the Problem of Unanticipated Consequences for AI ](https://siliconflatirons.org/events/ai-ethics-series-1-casey-fiesler?ref=thenexusofprivacy.net) Casey Fiesler on Colorado Law - University of Colorado Boulder (siliconflatirons.org) Thursday October 20, noon - 1:00 pm Mountain Time (11:00 am - noon Pacific). > Artificial Intelligence, or AI, is increasingly in use by both the government and the private sector, from the allocation of government benefits to the creation of smart contracts. However, poorly designed AI systems can lead to significant harms, including but not limited to discrimination. The question of how to regulate and build ethical AI is central. This lecture series will emphasize the practical applications of AI technology and ways to ensure principle-based ethics are a key focus of both development and regulation. #### [What is Fog Reveal? A legal scholar explains the app some police forces are using to track people without a warrant](https://theconversation.com/what-is-fog-reveal-a-legal-scholar-explains-the-app-some-police-forces-are-using-to-track-people-without-a-warrant-189944?ref=thenexusofprivacy.net) Anne Toomey McKenna on The Conversation (theconversation.com) Some US law enforcement agencies are using a commercial app that tracks people all day long via their phones – without a court order or oversight. #### [Police Need Warrants to Search Homes. Child Welfare Agents Almost Never Get One.](https://propublica.org/article/child-welfare-search-seizure-without-warrants?ref=thenexusofprivacy.net) Eli Hager, photography by Stephanie Mei-Ling, special to ProPublica on ProPublica (propublica.org) Each year, child protective services agencies inspect the homes of roughly 3.5 million children, opening refrigerators and closets without a warrant. Only about 5% of these kids are ultimately found to have been physically or sexually abused. #### [New Kids’ App Teaches Digital Privacy While Blocking Trackers](https://gizmodo.com/do-not-track-kids-privacy-app-childrens-data-1849667220?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) The Do Not Track Kids app will help you fight back against tech companies who harvest kids’ data. #### [Digital License Plates – A Privacy Nightmare for Employers](https://jdsupra.com/legalnews/digital-license-plates-a-privacy-8178544?ref=thenexusofprivacy.net) Steven Gallagher on JD Supra (jdsupra.com) On September 29, 2022, Governor Newsom signed AB 984 into law, allowing for digital license plates (i.e. “alternative devices”). Employers using these to monitor employees run significant risks. #### [How Apple’s privacy changes force social media marketing to evolve](https://venturebeat.com/security/how-apple-privacy-changes-force-social-media-marketing-evolve?ref=thenexusofprivacy.net) Scott Frey, PossibleNOW on VentureBeat (venturebeat.com) Apple’s privacy changes mean brands must switch to zero-party data, new social platforms and engagement through traditional marketing. #### [Optus tells customers affected by data breach they can no longer use passports as online ID](https://theguardian.com/business/2022/oct/17/optus-tells-customers-affected-by-data-breach-they-can-no-longer-use-passports-as-online-id?ref=thenexusofprivacy.net) Tory Shepherd on The Guardian (theguardian.com) Exposed passport numbers blocked from being used in national Document Verification System #### [Another family looks for answers after a breach of privacy in long-term care | CBC News](https://cbc.ca/news/canada/newfoundland-labrador/breach-privacy-baie-verte-central-health-1.6619053?%5F%5Fvfz=medium%3Dsharebar&ref=thenexusofprivacy.net) Bernice Hillier on CBC (cbc.ca) A third Newfoundland family is speaking up about a reported breach of privacy involving their loved one, who is a resident of long-term care at the Baie Verte Peninsula Health Centre. #### [Big increase in number of NWT health privacy breaches](https://cabinradio.ca/107316/news/health/big-increase-in-number-of-nwt-health-privacy-breaches?ref=thenexusofprivacy.net) Ollie Williams on Cabin Radio (cabinradio.ca) Reported health privacy breaches in the NWT nearly tripled in the past year, for reasons ranging from Covid-19 data mishaps to improvements in reporting. #### [Proof of Concept: California’s First Consumer Privacy Fine](https://bankinfosecurity.com/proof-concept-californias-first-consumer-privacy-fine-a-20277?ref=thenexusofprivacy.net) Anna Delaney on bankinfosecurity.com In the latest “Proof of Concept,” Lisa Sotto of Hunton Andrews Kurth LLP and former CISO David Pollino join ISMG editors discuss the first California #### [Countering an Authoritarian Overhaul of the Internet](https://freedomhouse.org/report/freedom-net/2022/countering-authoritarian-overhaul-internet?ref=thenexusofprivacy.net) Written by Adrian Shahbaz Allie Funk Kian Vesteinsson on Freedom House (freedomhouse.org) At home and on the international stage, authoritarians are on a campaign to divide the open internet into a patchwork of repressive enclaves. #### [Companies are increasingly tracking eye movements — but is it ethical?](https://theconversation.com/companies-are-increasingly-tracking-eye-movements-but-is-it-ethical-191842?ref=thenexusofprivacy.net) Patrick Lecomte on The Conversation (theconversation.com) Augmented reality (AR) uses wearable tech to enhance the physical world. To develop and enhance AR experiences, companies are tracking users’ eye movements, which may be more revealing than intended. --- Image Credit: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [*Picpedia*](https://www.picpedia.org/highway-signs/p/privacy.html?ref=thenexusofprivacy.net). ### Privacy News: October 17 URL: https://thenexusofprivacy.net/privacy-news-october-17/ Last updated: 2022-10-18T00:11:17.000Z Getting the week off to a good start with a bumper crop of links! ## Automated systems and discrimination ### [Rent Going Up? One Company’s Algorithm Could Be Why.](https://propublica.org/article/yieldstar-rent-increase-realpage-rent?ref=thenexusofprivacy.net) Heather Vogell, ProPublica, with data analysis by Haru Coryne, ProPublica, and Ryan Little on ProPublica (propublica.org) Texas-based RealPage’s YieldStar software helps landlords set prices for apartments across the U.S. With rents soaring, critics are concerned that the company’s proprietary algorithm is hurting competition. ### [Ethical Challenges of Using Artifical Intelligence for Intelligence Analysis](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4226631&ref=thenexusofprivacy.net) Alexander Blanchard on SSRN (papers.ssrn.com) Intelligence agencies have identified artificial intelligence (AI) as a key technology for maintaining an edge over adversaries. This article explores the ethical challenges presented by the use of AI for augmented intelligence analysis. It begins with an outline of current and future potential uses of AI augmented intelligence analysis before identifying five sets of ethical risks relating to: intrusion; explainability and accountability; bias; authoritarianism and political security; collaboration and classification. The article offers a series of recommendations targeted at intelligence agencies to address and mitigate these challenges. ### [AI tools fail to reduce recruitment bias - study](https://bbc.com/news/technology-63228466?ref=thenexusofprivacy.net) Chris Vallance on BBC News (bbc.com) Artificially intelligent analysis of job applications or videos is “pseudoscience”, researchers say. ### [Lessons Learned from Algorithmic Impact Assessments in Practice](https://engineering.atspotify.com/2022/09/lessons-learned-from-algorithmic-impact-assessments-in-practice?ref=thenexusofprivacy.net) Spotify Engineering on Spotify Engineering (engineering.atspotify.com) Understanding algorithmic impact is critical to building a platform that serves hundreds of millions of listeners and creators every day. Our approach includes a combination of centralized and distributed efforts, which drives adoption of best practices across the entire organization — from researchers and data scientists to the engineer pushing the code. ## Privacy after Roe #### [How the Dobbs abortion ruling reshaped America’s privacy debate, from health to politics and law](https://grid.news/story/360/2022/10/13/how-the-dobbs-abortion-ruling-reshaped-americas-privacy-debate-from-health-to-politics-and-law?ref=thenexusofprivacy.net) Dan Vergano on Grid News (grid.news) The Supreme Court’s verdict put the spotlight on the country’s patchy privacy protections. ## And ... #### [Consumer privacy tension increases with voice and face biometrics cases across the US](https://biometricupdate.com/202210/consumer-privacy-tension-increases-with-voice-and-face-biometrics-cases-across-the-us?ref=thenexusofprivacy.net) Jim Nash on BiometricUpdate.com (biometricupdate.com) JPMorgan Chase Bank is accused of breaking California privacy law by recording customers’ phone calls without consent using Microsoft software. #### [Detroit Action Responds to ShotSpotter Expansion, Vows to Continue Fight for Violent Prevention Programs](https://detroitaction.medium.com/detroit-action-responds-to-shotspotter-expansion-vows-to-continue-fight-for-violent-prevention-41b91559f697?ref=thenexusofprivacy.net) Detroit Action on Medium (detroitaction.medium.com) "The Detroit City Council’s decision to expand ShotSpotter with millions of our taxpayer dollars is a slap in the face to thousands of Detroit residents teetering on the precipice of homelessness, economic instability, and joblessness.... We’re calling on the Mayor and Council to offset their rash, harmful decisions by reinvesting in solutions to homelessness, recognizing and addressing root causes of violence, preserving and producing deeply affordable housing, increasing vital city services, and supporting arts and culture. The dedication to help our communities thrive is what will keep us safe, not microphones and surveillance." #### [Privacy Lawsuit Exposes Google Employees Cracking Jokes About Chrome’s Incognito Mode](https://hothardware.com/news/privacy-lawsuit-google-employees-jokes-chrome-incognito-mode?ref=thenexusofprivacy.net) Nathan Wasson on HotHardware (hothardware.com) Internal Google documents show employees’ alarm at the lack of privacy afforded by Chrome Incognito mode. #### [Employers using technology to track productivity of remote workers ](https://cbc.ca/listen/live-radio/1-63-the-current/clip/15942113-employers-using-technology-track-productivity-remote-workers?ref=thenexusofprivacy.net) Matt Galloway on CBC Listen (cbc.ca) Some employers use technology to track the productivity of their remote workers — but a new law in Ontario will force companies with more than 25 employees to disclose their electronic monitoring policy to staff. We talk to Lauren Reid, president of The Privacy Pro, a Toronto-based consulting firm. #### [First Court in California Suppresses Evidence from Overbroad Geofence Warrant](https://eff.org/deeplinks/2022/10/california-court-suppresses-evidence-overbroad-geofence-warrant?ref=thenexusofprivacy.net) Jennifer Lynch on Electronic Frontier Foundation (eff.org) A California trial court has held a geofence warrant issued to the San Francisco Police Department violated the Fourth Amendment and California’s landmark electronic communications privacy law, CalECPA. The court suppressed evidence stemming from the warrant, becoming the first court in California..… #### [Lawless Surveillance](https://nyulawreview.org/issues/volume-97-number-4/lawless-surveillance?ref=thenexusofprivacy.net) Barry Friedman on NYU Law Review (nyulawreview.org) Policing agencies in the United States are engaging in mass collection of personal data, building a vast architecture of surveillance. This growing network of surveillance is almost entirely unregulated. In virtually every other instance in which personal information is collected by the government, courts require that a sound regulatory scheme be in place before information collection occurs. The Article defines what a minimally acceptable regulatory scheme for mass data collection must include and shows how it can be grounded in the Constitution. #### [Why is the NYPD hiding its surveillance of BLM?](https://nydailynews.com/opinion/ny-oped-what-is-the-nypd-hiding-20221014-zsmr5eu7dbc6vc3cuemscilutu-story.htmlhttps://www.nydailynews.com/opinion/ny-oped-what-is-the-nypd-hiding-20221014-zsmr5eu7dbc6vc3cuemscilutu-story.html?ref=thenexusofprivacy.net) Albert Fox Cahn and Matt Mahmoudi on New York Daily News In recent weeks, the NYPD took the extraordinary step of appealing a court order to disclose documents about its surveillance of the historic Black Lives Matter protests of 2020\. For Amnesty International and the Surveillance Technology Oversight Project, it was a disappointing delay after two years of fighting to release these documents. But above all, it prompted us to ask: “What is the NYPD hiding?” #### [Hot Hot Hot - Executive Order - Start your Privacy Engines - Serious Privacy](https://buzzsprout.com/840448/11491221?ref=thenexusofprivacy.net) Buzzsprout (buzzsprout.com) On this episode of Serious Privacy, Paul Breitbarth of Catawiki and Dr. K Royal of Outschool discuss the 10-7 series of deliberately machinated and long-awaited political events surrounding the EU-US data transfer mechanism that is intended to replace the Privacy Shield, invalidated under Schrems II back in 2020 - the “thingie.” #### [Client-side scanning to detect child abuse material harmful](https://theregister.com/2022/10/13/clientside%5Fscanning%5Fcsam%5Fanderson?ref=thenexusofprivacy.net) Thomas Claburn on The Register (theregister.com) Security expert Ross Anderson challenges claim that bypassing encryption is essential to protecting kids. #### #### [Equifax surveilled 1,000 remote workers, fired 24 found juggling two jobs](https://arstechnica.com/tech-policy/2022/10/equifax-surveilled-1000-remote-workers-fired-24-found-juggling-two-jobs?ref=thenexusofprivacy.net) Ashley Belanger on Ars Technica (arstechnica.com) Equifax used its own worker surveillance product to spy on workers fired. #### [EU, US central banks see national digital currencies only if privacy balanced by security](https://biometricupdate.com/202210/eu-us-central-banks-see-national-digital-currencies-only-if-privacy-balanced-by-security?ref=thenexusofprivacy.net) Jim Nash on BiometricUpdate.com (biometricupdate.com) The digital identity and privacy communities got some confirmation about the near future from the world’s top two central bankers. #### [Court Says “You May NOT Amend Your TOS by Posting New Terms to Your Site”-International Markets v. Thayer](https://blog.ericgoldman.org/archives/2022/10/court-says-you-may-not-amend-your-tos-by-posting-new-terms-to-your-site-international-markets-v-thayer.htm?ref=thenexusofprivacy.net) Kieran McCarthy on Technology & Marketing Law Blog (blog.ericgoldman.org) Most online terms-of-use agreements claim to give their drafters broad discretion to modify the terms at the host’s discretion. Some terms-of-use agreements purport to allow host websites to modify the terms by sending an email (inevitably, to your spam folder) to notify you of the changes. Others require users to constantly refresh their browsers to know when updates occur. Before 2022, courts usually enforced the former strategy while requiring some evidence of actual or constructive notice to enforce the latter. But this year, courts have begun to require more rigorous evidence of notice and assent to enforce modifications to online agreements. #### [Without a Data Privacy Law, India Must Consider Hazards of ‘Deanonymisation’ of Non-Personal Data](https://thewire.in/rights/deanonymisation-in-non-personal-data?ref=thenexusofprivacy.net) Aarathi Ganesan on The Wire (thewire.in) Deanonymisation is performed by combining anonymised datasets to identify information about a particular user in different contexts, which can reveal layered and comprehensive personal information about an individual. #### [The Internet Is Not Facebook: Why Infrastructure Providers Should Stay Out of Content Policing](https://eff.org/deeplinks/2022/10/internet-not-facebook-why-infrastructure-providers-should-stay-out-content?ref=thenexusofprivacy.net) Corynne McSherry and Jillian C. York on Electronic Frontier Foundation (eff.org) Cloudflare’s recent headline-making decision to refuse its services to KiwiFarms—a site notorious for allowing its users to wage harassment campaigns against trans people—is likely to lead to more calls for infrastructure companies to police online speech. Although EFF would shed no tears at the loss of KiwiFarms (which is still online as of this writing), Cloudflare’s decision re-raises fundamental, and still unanswered, questions about the role of such companies in shaping who can, and cannot, speak online. #### [ICO consultation on the draft employment practices: monitoring at work guidance and draft impact assessment](https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/ico-consultation-on-the-draft-employment-practices?ref=thenexusofprivacy.net) UK Information Commissioner's Office (ico.org.uk) The Information Commissioner’s Office (ICO) is producing topic-specific guidance on employment practices and data protection. We are releasing our drafts of the different topic areas in stages and adding to the resource over time. A [draft of the guidance on monitoring at work](https://ico.org.uk/media/about-the-ico/consultations/4021868/draft-monitoring-at-work-20221011.pdf?ref=thenexusofprivacy.net) is now out for public consultation. #### [Chris Hipkins accused of cowering after criticising privacy report on police photographing](https://rnz.co.nz/news/political/476564/chris-hipkins-accused-of-cowering-after-criticising-privacy-report-on-police-photographing?ref=thenexusofprivacy.net) Katie Scotcher on RNZ (rnz.co.nz) The police minister is facing criticism over his suggestion the law could be changed to allow officers to keep photographing people for looking out of place or suspicious. #### [Feds: Ex Louisville Police Officer Used Law Enforcement Tech To Help Hack Sexually Explicit Photos From Women](https://leoweekly.com/2022/10/feds-ex-louisville-police-officer-used-law-enforcement-tech-to-help-hack-sexually-explicit-photos-from-women?ref=thenexusofprivacy.net) Danielle Grady on LEO Weekly (leoweekly.com) A former Louisville Metro Police Department officer used law enforcement technology as part of a scheme that involved hacking the Snapchat accounts of young women and using sexually explicit photos and videos they had taken to extort them, federal prosecutors said in court documents filed on Tuesday. #### [Privacy Shield 2.0: Data Protection Law May Benefit Businesses](https://searchenginejournal.com/privacy-shield-2-0-data-protection-framework-may-benefit-us-businesses/467708?ref=thenexusofprivacy.net) Matt G. Southern on Search Engine Journal (searchenginejournal.com) Learn what the new European Union (EU) & United States data privacy framework could mean for businesses and marketers. #### [Privacy activists warn against removing compensation for data protection breaches](https://euractiv.com/section/data-protection/news/privacy-activists-warn-again-removing-compensation-for-data-protection-breaches?ref=thenexusofprivacy.net) Laura Kabelka on EURACTIV (euractiv.com) The Advocate General of the Court of Justice of the European Union (CJEU) issued a non-binding opinion, which privacy advocates fear could further limit users’ possibilities to enforce their privacy rights under the GDPR. #### [Meta’s New Quest Pro VR Headset Harvests Personal Data Right Off Your Face](https://wired.com/story/metas-vr-headset-quest-pro-personal-data-face?ref=thenexusofprivacy.net) Khari Johnson on WIRED (wired.com) Cameras inside the Quest Pro that track eye and face movements can make an avatar’s expressions more realistic, but they raise new privacy questions. #### [Targeted Billboard Ads Are a Privacy Nightmare](https://gizmodo.com/billboards-facial-recognition-privacy-targeted-ads-1849655599?ref=thenexusofprivacy.net) Mack DeGeurin on Gizmodo (gizmodo.com) A new report details ways advertisers are taking lessons learned from mobile ads to create intimately targeted ads in the physical world. #### [How Data Privacy Has Revolutionized the Post-Pandemic Workplace Trends?](https://readwrite.com/how-data-privacy-has-revolutionized-the-post-pandemic-workplace-trends?ref=thenexusofprivacy.net) Amtul Rafay on ReadWrite (readwrite.com) Since the Pandemic, data privacy has become a top concern for organizations. Workers working remotely must ensure company and user data is protected. #### [Big Tech accused of shady lobbying in EU Parliament](https://politico.eu/article/big-tech-companies-face-potential-eu-lobbying-ban?ref=thenexusofprivacy.net) Clothilde Goujard on POLITICO (politico.eu) Lawmakers file complaints against 8 companies and trade groups over alleged shadow lobbying. #### [Privacy and Data Security Update - The Consumer Finance Podcast](https://jdsupra.com/legalnews/privacy-and-data-security-update-the-c-41588?ref=thenexusofprivacy.net) Kim Phan on JD Supra (jdsupra.com) Please join Consumer Financial Services Partner Chris Willis and his colleagues Ron Raether and Kim Phan, partners in our Privacy + Cyber Practice... #### [The New Trans-Atlantic Data Privacy Framework Is Not Enough](https://insidehighered.com/blogs/law-policy%E2%80%94and-it/new-trans-atlantic-data-privacy-framework-not-enough?ref=thenexusofprivacy.net) Tracy Mitrano on Law, Policy—and IT? (insidehighered.com) Important issues to act on. #### [Using sensitive data to prevent discrimination by artificial intelligence: Does the GDPR need a new exception?](https://arxiv.org/abs/2206.03262v2?ref=thenexusofprivacy.net) Marvin van Bekkum on arXiv.org (arxiv.org) Organisations can use artificial intelligence to make decisions about people for a variety of reasons, for instance, to select the best candidates from many job applications. But in Europe, an organisation runs into a problem when it wants to assess whether its AI system accidentally discriminates based on ethnicity: the organisation may not know the applicants' ethnicity. This paper asks whether the GDPR's rules on special categories of personal data hinder the prevention of AI-driven discrimination. #### [LEAK: A sneak peak at the EU’s digital agenda for 2023](https://euractiv.com/section/digital/news/leak-a-sneak-peak-at-the-eus-digital-agenda-for-2023?ref=thenexusofprivacy.net) Luca Bertuzzi on EURACTIV (euractiv.com) EURACTIV has obtained an undated version of the Commission’s work programme for 2023, which is set to be presented next Tuesday (18 October). Here is what the EU executive has in store for digital policy. #### [Upcoming California Privacy Rights Act: Key Compliance Tasks for California Employers](https://jdsupra.com/legalnews/upcoming-california-privacy-rights-act-6846588?ref=thenexusofprivacy.net) F. Paul Pittman on JD Supra (jdsupra.com) California employers’ reprieve from obligations to employees to disclose data privacy practices and provide access rights to employees appears to be... #### [Colorado Attorney General Releases Colorado Privacy Act Draft Regulations](https://jdsupra.com/legalnews/colorado-attorney-general-releases-9708578?ref=thenexusofprivacy.net) Roy Wyman on JD Supra (jdsupra.com) The Colorado Attorney General’s Office issued its proposed Colorado Privacy Act (CPA) Rules (Draft Rules) on Friday, September 30\. #### [Dubai bids to answer the data privacy riddle](https://khaleejtimes.com/tech/dubai-bids-to-answer-the-data-privacy-riddle?ref=thenexusofprivacy.net) Joydeep Sengupta on Khaleej Times (khaleejtimes.com) Digital Dubai’s team is on a mission to pave the way for synthetic data, showcasing itself as an innovator among the Arabian Gulf states #### [Pappas seeks new legislation protecting reproductive privacy rights ](https://manchesterinklink.com/pappas-seeks-new-legislation-protecting-reproductive-privacy-rights?ref=thenexusofprivacy.net) Andrew Sylvia aon Manchester Ink Link (manchesterinklink.com) U.S. Representative Chris Pappas (D-NH-01) supports the “My Body, My Data Act” which would [prohibit personal medical data from being used against a woman in criminal proceedings.](https://www.npr.org/2022/05/10/1097482967/roe-v-wade-supreme-court-abortion-period-apps?ref=thenexusofprivacy.net) #### [Online Advertisers Prepped for Multistate Privacy Compliance Challenges](https://nexttv.com/news/online-advertisers-prepped-for-multistate-privacy-compliance-challenges?ref=thenexusofprivacy.net) John Eggerton on Next TV (nexttv.com) IAB updates blueprint for handling differing consent regimes #### [Students Are Using AI to Write Their Papers, Because Of Course They Are](https://vice.com/en/article/m7g5yq/students-are-using-ai-to-write-their-papers-because-of-course-they-are?ref=thenexusofprivacy.net) Claire Woodcock on vice.com Essays written by AI language tools like OpenAI’s Playground are often hard to tell apart from text written by humans. #### [City ‘inadvertently’ shares personal information, breaches privacy in mass email to hundreds of Hamilton voters](https://thespec.com/news/municipal-election/2022/10/14/city-breaches-privacy-in-email-to-hamilton-voters.html?ref=thenexusofprivacy.net) Matthew Van Dongen on TheSpec.com (thespec.com) Breach affected 450 residents registered to vote by mail; city has alerted the provincial privacy commissioner #### [Is Every Website That Plays Videos Breaking An ’80s Privacy Law?](https://gizmodo.com/video-privacy-protection-act-class-action-lawsuits-1849660417?ref=thenexusofprivacy.net) Thomas Germain on Gizmodo (gizmodo.com) A Regan-era law regulating VHS rentals is responsible for a wave of lawsuits claiming video-playing website that collects data is liable. #### [Minnesota takes additional steps to protect ballot privacy](https://dl-online.com/news/local/minnesota-takes-additional-steps-to-protect-ballot-privacy?ref=thenexusofprivacy.net) News Staff on Detroit Lakes Tribune (dl-online.com) At this time, the six Minnesota counties that use the impacted machines have not used the “cast vote record” feature. If a county decides to use the cast vote record feature, a fix is available to prevent ballot identification. #### [Amazon expands ‘pay with your palm’ technology](https://zdnet.com/article/amazon-expands-pay-with-your-palm-tech?ref=thenexusofprivacy.net) Stephanie Condon on ZDNET (zdnet.com) Amazon’s palm-recognition service is being deployed as a standalone payment option for the first time at the Climate Pledge Arena in Seattle. #### [iOS 16 Has An Amazing New iPhone Privacy Feature—Here’s How To Use It](https://forbes.com/sites/kateoflahertyuk/2022/10/08/ios-16-has-an-amazing-new-iphone-privacy-feature-heres-how-to-use-it?ref=thenexusofprivacy.net) Kate O’Flaherty on Forbes (forbes.com) Apple’s iOS 16 comes with an amazing new privacy feature you might not know about. Here’s how to use it. --- Image credit: Originally by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net), licensed from [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) via [Picpedia](https://www.picpedia.org/chalkboard/p/privacy.html?ref=thenexusofprivacy.net) ### How and why to submit FTC comments on Commercial Surveillance and Data Security (UPDATED) URL: https://thenexusofprivacy.net/how-and-why-to-submit-ftc-comments-on-commercial-surveillance-and-security/ Last updated: 2026-04-16T02:52:33.000Z *Originally publishes October 11, last updated November 3 with typo fixes.* The deadline for comments to the Federal Trade Commission (FTC) on commercial surveillance and data security practices that harm consumers has been extended until **November 21**! This [Advance Notice of Proposed Rulemaking (“ANPR”)](https://u7061146.ct.sendgrid.net/ls/click?upn=4tNED-2FM8iDZJQyQ53jATUcs9-2BYv-2FBvF5AG8cihP-2F7iQkODr5C17fyHZOV2EVPiUgfLJpb73VLGkYc5XrMNxLegf5NE7xN7ORsULCgAuD6ezoOeZ6iRKmlZXZWx0XmzaXZldxn2yj4G7nRS6qe0wMQw-3D-3DKv4P%5FzgV5ZzB7nLOjPaxelNcDRjqdl3vizMXKx8pyFPFqP36GZVFbG6RtoZAJ1IX7YAXz-2Bq08XO3PPN1sRMO3IrhM-2F7-2FTQ0TE0ifhDjS7BHsN6srSy9FUInXqhL-2BgQVC6ChTa-2BDwzgBgnA23xEo9vGPQPssXtDj7D58lEdi6TdvBQrNxthcOKEA9tnHlZai8ntrctnkf7ucIeJO3sRE4Hq-2BJIYHqx6jJRhpueBRTPyf96Puk7VRSmaf2WoeampGugAtpcTpK69rf7hC8RaaBO9bi-2BzPWdzLETgkK-2BlHDf8PX-2Buxp8UJkfOAECEzdeptr2-2BSrF-2FiruSZ3Enu3FCU6WWRo85f89w-2FuNTyNvOzW3kZKEWME-3Dhttps://www.ftc.gov/legal-library/browse/federal-register-notices/commercial-surveillance-data-security-rulemaking&ref=thenexusofprivacy.net) is the [first step in a process](https://iapp.org/media/pdf/resource%5Fcenter/ftc%5Fprivacy%5Frulemaking%5Finfographic.pdf?ref=thenexusofprivacy.net) that could lead to new regulations to stop companies from abusing our data. Before we get to the details, let's start with why it's valuable to participate. [As Fight for the Future says](https://www.ftccomments.com/?ref=thenexusofprivacy.net) > We know the companies that profit off our data will dispatch an army of lobbyists to argue for rules in their favor. **But if enough of us mobilize we can demand the FTC protect our privacy, data, and lives.** If you've only got a minute, Fight for the Future's webform at [ftccomments.com](https://www.ftccomments.com/?ref=thenexusofprivacy.net) is the easiest way to participate. You can use their standard comment or edit it to include your own stories or opinions. They've also got a handy FAQ, and a long list of supporting organizations including Surveillance Technology Oversight Project, Ultraviolet, Stop Online Violence Against Women, Access Now, EPIC, and Restore the Fourth. If you've got a little more time, [the web form on regulations.gov is also fairly straightforward](https://www.federalregister.gov/documents/2022/08/22/2022-17752/trade-regulation-rule-on-commercial-surveillance-and-data-security?ref=thenexusofprivacy.net#open-comment). There's a text box, as well as the ability to add a file – if your comments are long or include links, tables and images a PDF is the way to go. If you want email confirmation that your submission has been received, make sure to check the opt in box. And remember that comments become part of the public record, so don't include any personal information you include in your ## What to say in your comments? Comments can be simple and short; even just saying something like "My personal data shouldn't be exploited, the FTC needs to take action" is useful. Even better is if you can tell a story about yourself or somebody you know. Or, you can respond to one or more of the [95 (!) questions in the ANPR](https://www.ftc.gov/legal-library/browse/federal-register-notices/commercial-surveillance-data-security-rulemaking?ref=thenexusofprivacy.net) (also available in a [PDF](https://www.ftc.gov/system/files/ftc%5Fgov/pdf/commercial%5Fsurveillance%5Fand%5Fdata%5Fsecurity%5Fanpr.pdf?ref=thenexusofprivacy.net)). For example, if you want to emphasize the importance of an opt-in approach (companies have to get consent before using, sharing, or selling your data) as opposed to the opt-out approach that most privacy legislation today takes, question #80 is a perfect opportunity: > Have opt-out choices proved effective in protecting against commercial surveillance? If so, how and in what contexts? If you're concerned about student privacy, or the way that social media sites exploit kids' and teens' info, check out the questions starting with #13\. For example: > What types of commercial surveillance practices involving children and teens’ data are most concerning? If you're focused on algorithms, AI, and automated decision-making systems, the list of questions starting at #53 are pretty juicy. For example > 53\. How prevalent is algorithmic error? To what extent is algorithmic error inevitable? If it is inevitable, what are the benefits and costs of allowing companies to employ automated decision-making systems in critical areas, such as housing, credit, and employment? To what extent can companies mitigate algorithmic error in the absence of new trade regulation rules? > > 54\. What are the best ways to measure algorithmic error? Is it more pronounced or happening with more frequency in some sectors than others? > ... > > 65\. How prevalent is algorithmic discrimination based on protected categories such as race, sex, and age? Is such discrimination more pronounced in some sectors than others? If so, which ones? I'll be submitting an expanded version of my [comments at the public forum on Automated Decision Systems and Discrimination](https://thenexusofprivacy.net/comments-for-ftc-public-forum-for-commercial-surveillance/), and many non-profits and corporations will no doubt go into much greater detail. But that's certainly not a requirement. As FTC Commissioner Alvaro Bedoya said at the public forum, shorter comments sharing a story or focusing on a single important pointn can often be the most impactful. So even though there's a lot going on, if you care about privacy, please consider submitting a comment! The links again: - [ftccomments.com](https://www.ftccomments.com/?ref=thenexusofprivacy.net) gives you send a pre-written comment that you can customize - [The web form on regulations.gov](https://www.federalregister.gov/documents/2022/08/22/2022-17752/trade-regulation-rule-on-commercial-surveillance-and-data-security?ref=thenexusofprivacy.net#open-comment) lets you provide a text comment and optionally upload a file if you want to go into more detail. ## Find out more - The FTC's [Fact Sheet on Commercial Surveillance](https://www.ftc.gov/system/files/ftc%5Fgov/pdf/Commercial%20Surveillance%20and%20Data%20Security%20Rulemaking%20Fact%20Sheet%5F1.pdf?ref=thenexusofprivacy.net) has a lot more information about the ANPR - [regulations.gov has the comments submitted so far ](https://www.regulations.gov/document/FTC-2022-0053-0001/comment?ref=thenexusofprivacy.net)– 144 as of October 16. - Disinfo Defence League's [What is the FTC and Why Does it Matter?](https://docs.google.com/presentation/d/1YrKn8gNPAEqMq8JVp9tD8l6Qa%5FHqx26L6IUMo3nz9HM/edit?ref=thenexusofprivacy.net#slide=id.p), a presentation from Nora Benavidez and Carmen Scurato of Free Press, has background ### Privacy News: October 13 URL: https://thenexusofprivacy.net/privacy-news-october-13/ Last updated: 2022-10-19T03:34:05.000Z Danielle Citron on ABC News: "We need a systemic solution" We had Danielle Citron's new book [The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age ](https://wwnorton.com/books/9780393882315?ref=thenexusofprivacy.net)in the October 6 Privacy News. Here's a good short video from her apperance on ABC News last night, where she talks about topics including post-Roe privacy threats and privacy as a civil right. I completely agree with her that pregnant people in states that criminalize abortion shouldn't have to become digital security experts to protect themselves ... but alas, as she points out, that's the world we live in. Digital Defense Fund's [Guide to Abortion Privacy](https://digitaldefensefund.org/ddf-guides/abortion-privacy?ref=thenexusofprivacy.net) is a great resource – [está disponible en español](https://digitaldefensefund.org/privacidad-del-aborto?ref=thenexusofprivacy.net). ### [Protect your privacy and your phone number with Firefox Relay](https://blog.mozilla.org/en/privacy-security/hide-your-phone-number-with-firefox-relay?ref=thenexusofprivacy.net) Tony Amaral-Cinotto on The Mozilla Blog (blog.mozilla.org) Mozilla's new Firefox Relay gives you a new phone number to give out in those situations where you have to provide a phone number but don't want to share your real one. Phone calls and texts are relayed on to your regular number, and your replies keep your phone number masked. It's $48/year or $5/month. ### [First Illinois Biometric Privacy Trial Ends in BNSF Loss](https://news.bloomberglaw.com/privacy-and-data-security/first-illinois-biometric-privacy-jury-trial-ends-in-bnsf-loss?ref=thenexusofprivacy.net) Skye Witley on Request a Free Demo (news.bloomberglaw.com) Illinois Biometric Information Privacy Act (BIPA) is one of the few privacy laws that allows class action suits. Most companies sued under BIPA wind up [settling](https://www.nbcchicago.com/news/local/heres-a-look-at-all-the-settlements-stemming-from-illinois-biometric-privacy-act/2922736/?ref=thenexusofprivacy.net) if they can't get the case dismissed. But after truck drivers sued BNSF Railway for collecting their fingerprints without consent, the company decided to fight it ... and lost, when a jury awared the 45,000 trick drivers a $228 million judgment. ## Amazon ### [At the Digital Doorstep](https://datasociety.net/library/at-the-digital-doorstep?ref=thenexusofprivacy.net) Aiha Nguyen and Eve Zelicksonon, Data & Society (datasociety.net) A deep dive into changing nature of delivery work as a result of increased doorstep surveillance, focusing on Amazon's "Fleet drivers" (aka gig workers). From the introduction: > The doorstep has emerged as the new physical locale of consumption — the threshold at which purchased products become personal property. In this transformation, the porch has become a contested space: it is at once private property and, for delivery workers, their workplace. The growing popularity of Ring and other networked doorbell cameras has normalized home and neighborhood surveillance in the name of safety and security. But for delivery drivers, this has meant their work is increasingly surveilled by doorbell cameras and supervised by customers. The result is a collision between the American ideals of private property and the business imperatives of doing a job. ### [Tour Amazon’s dream home, where every appliance is also a spy](https://washingtonpost.com/technology/2022/amazon-smart-homehttps://www.washingtonpost.com/technology/interactive/2022/amazon-smart-home/?ref=thenexusofprivacy.net) Geoffrey A. Fowler on washingtonpost.com Here’s everything Amazon learns about your family, your home and you ### [All the Data Amazon’s Ring Cameras Collect About You](https://wired.com/story/ring-doorbell-camera-amazon-privacy?ref=thenexusofprivacy.net) Matt Burgess on WIRED (wired.com) The popular security devices are tracking (and sharing) more than you might think. ## And ... #### [Companies in the UK Are Mining Users’ Personal Data to Place Billboard Ads](https://vice.com/en/article/n7zqmb/companies-in-the-uk-are-mining-users-personal-data-to-place-billboard-ads?ref=thenexusofprivacy.net) on vice.com A new investigation reveals that in the UK, the billboards watch you. #### #### [Home Office accused of privacy law breach by seizing phone](https://theferret.scot/home-office-accused-breaching-privacy-laws-visa?ref=thenexusofprivacy.net) byKarin Goodwin on The Ferret (theferret.scot) The Home Office used location data from an international student’s mobile phone to detain him for allegedly breaking his visa conditions, The Ferret can reveal. #### [EXECUTIVE DIRECTOR of the Privacy and Civil Liberties Oversight Board](https://usajobs.gov/job/681610200?ref=thenexusofprivacy.net) on USAJOBS (usajobs.gov) This position is part of the, The Privacy and Civil Liberties Oversight Board. The incumbent will be responsible for management and execution of business activities, critical support services, and long-range strategic planning for several critical resource related support functions across the agency. #### [Legal Analysis: No non-material damages for GDPR violations?](https://noyb.eu/en/analysis-no-non-material-damages-gdpr?ref=thenexusofprivacy.net) on noyb.eu (noyb.eu) Advocate General Sánchez-Bordona issued his Opinion on CJEU case C-300/21 (UI v. Österreichische Post AG), the first of several preliminary ruling requests on the topic of damages for GDPR violations #### [The Lawfare Podcast: The Supreme Court Takes On 230](https://lawfareblog.com/lawfare-podcast-supreme-court-takes-230?ref=thenexusofprivacy.net) Jen Patja Howell on Lawfare (lawfareblog.com) The Supreme Court has granted cert in two cases exploring the interactions between anti-terrorism laws and Section 230 of the Communications Decency Act. #### [Myanmar: The social atrocity: Meta and the right to remedy for the Rohingya](https://amnesty.org/en/documents/ASA16/5933/2022/en?ref=thenexusofprivacy.net) on Amnesty International (amnesty.org) Beginning in August 2017, the Myanmar security forces undertook a brutal campaign of ethnic cleansing against Rohingya Muslims. This report is based on an in-depth investigation into Meta (formerly Facebook)’s role in the serious human rights violations perpetrated against the Rohingya. #### [Mactaggart appointed to CPPA Board](https://iapp.org/news/a/mactaggart-appointed-to-cppa?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) Californians for Consumer Privacy founder Alastair Mactaggart has been appointed to the California Privacy Protection Agency. #### [Alarming: Court of Justice may severely limit enforcement of European’s privacy rights](https://noyb.eu/en/alarming-court-justice-may-severely-limit-enforcement-europeans-privacy-rights?ref=thenexusofprivacy.net) on noyb.eu (noyb.eu) The Advocate General of the CJEU has issued a non-binding opinion, aiming to limit one of the last potential avenues for users to enforce their privacy rights under the GDPR. #### [Some EU Websites Make You Pay to Reject Cookies—the US Could Be Next](https://gizmodo.com/cookie-paywall-eu-gdpr-pay-to-reject-accept-privacy-1849638363?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) Want to protect your privacy? A cookie paywall on a single site could cost you €75 a year. #### [Privacy Advocates Say NYC’s Fix for the ‘Digital Divide’ Is a Hyper-Surveillance Mess](https://vice.com/en/article/epzmvj/privacy-advocates-say-nycs-fix-for-the-digital-divide-is-a-hyper-surveillance-mess?ref=thenexusofprivacy.net) Karl Bode on vice.com Millions of dollars and ample public masturbation later, LinkNYC still hasn’t fixed the city’s stubborn digital divide or the privacy issues raised half a decade ago. #### [Push to scrap Australia privacy exemptions for political parties due to risk of data breaches](https://theguardian.com/australia-news/2022/oct/10/push-to-scrap-privacy-exemptions-for-political-parties-due-to-risk-of-data-breaches?ref=thenexusofprivacy.net) Sarah Martin on The Guardian (theguardian.com) Digital Rights Watch says cyber-attacks on political parties in 2019 narrowly avoided a breach that would have caused ‘unimaginable damage’ #### [Police Quietly Obtain Private Location Data with a Checkbook and not a Warrant](https://pogo.org/analysis/2022/10/police-quietly-obtain-private-location-data-with-a-checkbook-and-not-a-warrant?ref=thenexusofprivacy.net) Freddy Martinez on pogo.org Law enforcement’s new location tracking tool raises unique Fourth Amendment concerns #### [The redress mechanism in the successor to Privacy Shield: On the independence and effective powers of the DPRC](https://iapp.org/news/a/the-redress-mechanism-in-the-successor-to-privacy-shield-on-the-independence-and-effective-powers-of-the-dprchttps://iapp.org/news/a/the-redress-mechanism-in-the-privacy-shield-successor-on-the-independence-and-effective-powers-of-the-dprc/?ref=thenexusofprivacy.net) Kenneth Propp, Peter Swire, and Théodore Christakis on International Association of Privacy Professionals (iapp.org) This article looks at certain specific aspects of the signal intelligence redress mechanism established by the U.S. legal reforms. #### [Twitter is asking users to enter their birthdate to view sensitive content](https://techcrunch.com/2022/10/11/twitter-is-asking-users-to-enter-their-birthdate-to-view-sensitive-content?ref=thenexusofprivacy.net) Ivan Mehta on TechCrunch (techcrunch.com) Twitter is ramping up its efforts to filter to prevent under 18 users from viewing sensitive content by asking users to verify their birthdates. #### [EDPB adopts “wish list” of procedural aspects, first EU data protection seal and a statement on digital euro](https://edpb.europa.eu/news/news/2022/edpb-adopts-wish-list-procedural-aspects-first-eu-data-protection-seal-and-statement%5Fen?ref=thenexusofprivacy.net) European Data Protection Board (edpb.europa.eu) #### [New York’s First Chief Privacy Officer Works to Build State Strategy](https://govtech.com/security/new-yorks-first-chief-privacy-officer-works-to-build-state-strategy?ref=thenexusofprivacy.net) Lauren Harrison on GovTech (govtech.com) Chief Privacy Officer Michele Jones outlined how New York state is formalizing its strategy to protect residents’ data at the NASCIO Annual Conference in Louisville, Ky. #### [NZ privacy advocates: Laws need revamp to reflect biometric surveillance realities](https://biometricupdate.com/202210/nz-privacy-advocates-laws-need-revamp-to-reflect-biometric-surveillance-realities?ref=thenexusofprivacy.net) Jim Nash on BiometricUpdate.com (biometricupdate.com) The nation’s approach to privacy and biometrics must be more nuanced than a government-independent regulator proposed in August. #### [UK Children’s Privacy Protection Comes of Age](https://jdsupra.com/legalnews/uk-children-s-privacy-protection-comes-8133979?ref=thenexusofprivacy.net) Anna Blest on JD Supra (jdsupra.com) The Age Appropriate Design Code (“AADC”) - more commonly known as the Children’s Code - has been heralded as the world’s first code to protect... #### [New York lawmaker wants internet privacy protections for kids](https://spectrumlocalnews.com/nys/central-ny/ny-state-of-politics/2022/10/12/new-york-lawmaker-wants-internet-privacy-protections-for-kids?ref=thenexusofprivacy.net) Nick Reisman Spectrum News 1 Central NY (spectrumlocalnews.com) Ads targeting kids would be banned. ### #StopShotSpotter: my comments at the Seattle Budget Committee hearing URL: https://thenexusofprivacy.net/public-comments-on-shotspotter-at-seattle-budget-committee-hearings/ Last updated: 2022-10-12T01:59:53.000Z *See the* [*livetweet thread here*](https://twitter.com/NexusOfPrivacy/status/1579986305886588928?ref=thenexusofprivacy.net) *for context.* I’m Jon. My comments today focus on the $1 million for gunshot detection. Gun violence is a huge problem – but systems like ShotSpotter won’t help address it. These systems don’t reduce crime. Instead, they waste police time and resources – and harm people in the communities they’re supposed to protect. In Chicago, police responding to a ShotSpotter alert shot and killed 13-year-old Adam Toledo. Michael Williams and Daniel Ortiz were wrongfully arrested as a result of ShotSpotter. Just last week, Peoria police responding to a ShotSpotter alert shot and killed Samuel Richmond. These systems don’t even help after the crimes have happened. Last year, the Chicago Office of the Inspector General’s investigation concluded Chicago Police Department’s data “does not support a conclusion that ShotSpotter is an effective tool in developing evidence of gun-related crime.” Surveillance isn't safety. Please don’t waste taxpayer money on this harmful pseudo-science technology. Instead, fund community-based responses to public safety and the other priorities of the Solidarity Budget. ### Privacy News: October 10 URL: https://thenexusofprivacy.net/privacy-news-october-10/ Last updated: 2022-10-10T23:42:15.000Z A US/EU data transfer agreement, student privacy, privacy after Roe, Colorado privacy regulations ... and more! ### [President Biden Signs Executive Order to Implement the European Union-U.S. Data Privacy Framework](https://www.whitehouse.gov/briefing-room/statements-releases/2022/10/07/fact-sheet-president-biden-signs-executive-order-to-implement-the-european-union-u-s-data-privacy-framework/?ref=thenexusofprivacy.net) The White House (whitehouse.gov) Biden's Executive Order (EO) is the latest attempt to satisfy European Union (EU) concerns about US intelligence agencies' access to data and smooth the path to for European companies to transfer data in the US. As Morgan Meaker says in [Biden’s Privacy Order Slaps a Band-Aid on the EU-US Data Crisis](https://www.wired.com/story/biden-eu-us-data-privacy-executive-order/?ref=thenexusofprivacy.net) > The United States is not going to stop spying on Europeans’ data, but it is going to make sure that spying is “proportionate.” As well as establishing some new civil liberties and privacy policies for intelligence agencies, the EO also establishes a procedure when EU residents complain about data abuse: the Civil Liberties Protection Officer will conduct an initial regulation, and the "Data Protection Review Court" (DPRC) will review. As Max Schrems of noyb.eu points out, though, [the DPRC isn't really a court](https://noyb.eu/en/new-us-executive-order-unlikely-satisfy-eu-law?ref=thenexusofprivacy.net), and that's likely to be a sticking point for the EU. Since Schrems was the plaintiff in both the 2015 Schrems case where the European Court of Justice (CJEU) struck down the "Safe Harbor" agreement and the 2020 Schrems II case where the CJEU struck down the replacement Privacy Shield agreement), his opinion that [the new agreement is unlikely to satisfy EU law](https://noyb.eu/en/new-us-executive-order-unlikely-satisfy-eu-law?ref=thenexusofprivacy.net) is worth paying attention to. Dutch privacy expert Joroen Terstegge notes that [the mutual recognition paragraph at the end of the EO shifts the power balance in favor of the US](https://www.linkedin.com/posts/jeroenterstegge%5Ffact-sheet-president-biden-signs-executive-activity-6984181610208198657-J-EF/?ref=thenexusofprivacy.net), and predicts fierce opposition from EU member states. Here's how Schrems describes the next steps: > Now where the US has issued its Executive Order, the European Commission will have to draft a so-called "adequacy decision" under Article 45 of the GDPR. Once the draft decision is issued, the Commission must hear the European Data Protection Board (EDPB), but is not bound by its findings. In addition, the European Member States must be head and could block the deal. This process can take a couple of months. However, even negative statements by the EDPB and Member States are not binding on the Commission. Once the decision is published, companies can rely on it when sending data to the US and users can challenge it via the national and European courts. This is not expected before spring of 2023, even when it was originally envisioned in fall of 2022. ## Student Privacy ### [How to Protect Yourself If Your School Uses Surveillance Tech](https://www.wired.com/story/how-to-protect-yourself-school-surveillance-tech-privacy/?ref=thenexusofprivacy.net) Pia Ceres, Wired (wired.com) School districts across the country use [monitoring software](https://www.wired.com/story/student-monitoring-software-privacy-in-schools/?ref=thenexusofprivacy.net) to track students’ online behavior. What can students and parents do? This article has some very practical suggestions: asking the school why and how they're monitoring students; assuming you're being watched, even after school; being careful on social media; and teaming up with other students and parents. Here's the questions that Marika Pfefferkorn (co-founder of the Twin Cities Innovation Alliance and a leader of the No Data About Us Without Us Institute) suggests asking: - What software is being used? Does it operate on school devices, over the school Wi-Fi network, or both? - If it’s student monitoring software, what kind of information does the algorithm scan for? If the algorithm detects a “threat” or “inappropriate content,” who does the alert go to? At what point does content get flagged to a third party, such as law enforcement? - How is student data secured? - Where can students and parents report violations of privacy in the district? What processes does the district have to repair harm? - How much of the budget is used for surveillance technology? ## Privacy after Roe ### [California Leads on Reproductive and Trans Health Data Privacy](https://www.eff.org/deeplinks/2022/09/california-leads-reproductive-and-trans-health-data-privacy?ref=thenexusofprivacy.net) Adam Schwartz, Electronic Frontier Foundation (EFF) (eff.org) A description of three bills recently signed by California Gov. Gavin Newsom, all of which EFF supported: [A.B. 1242](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill%5Fid=202120220AB1242&ref=thenexusofprivacy.net), authored by Asm. Rebecca Bauer-Kahan; [A.B. 2091](https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill%5Fid=202120220AB2091&ref=thenexusofprivacy.net), authored by Asm. Mia Bonta; and [S.B. 107](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill%5Fid=202120220SB107&ref=thenexusofprivacy.net), authored by Sen. Scott Wiener. EFF supported [all](https://www.eff.org/deeplinks/2022/08/trans-youths-need-data-sanctuary?ref=thenexusofprivacy.net) [three](https://www.eff.org/deeplinks/2022/09/eff-california-governor-protect-abortion-data-privacy?ref=thenexusofprivacy.net) [bills](https://www.eff.org/deeplinks/2022/05/reproductive-privacy-requires-data-privacy?ref=thenexusofprivacy.net). The highlights: - New reproductive and trans health data exemptions from existing disclosure mandates, covering both law enforcement and civil subpoenas based on either an out-of-state law that interferes with California abortion rights. - New limits on California judges' power to authorize or compel the disclosure of reproductive health data if it's for purposes of investigating abortions that are legal in California. - Similar limits on California state government agencies disclosing providing information to any individual or out-of-state agency. ### [People search websites create privacy nightmares for abortion rights advocates](https://cyberscoop.com/data-broker-removal-services-find-new-demand?ref=thenexusofprivacy.net) Tonya Riley on CyberScoop (cyberscoop.com) Many abortion rights advocates say data brokers selling their personal information online put them at risk. ### [How expanding web of license plate readers could be ‘weaponized’ against abortion](https://theguardian.com/world/2022/oct/06/how-expanding-web-of-license-plate-readers-could-be-weaponized-against-abortion?ref=thenexusofprivacy.net) Johana Bhuiyan on The Guardian (theguardian.com) Activists fear Flock, whose tech reads license plates, might endanger women seeking abortions ## State privacy regulation ### [Colorado Privacy Act Draft Rules Published](https://jdsupra.com/legalnews/colorado-privacy-act-draft-rules-8752518?ref=thenexusofprivacy.net) David Stauss on JD Supra (jdsupra.com) A detailed analysis of the [proposed Colorado Privacy Act (CPA) rules](https://www.dora.state.co.us/pls/real/SB121.Download%5Ffile?p%5Ffile=F-1866647552/CPA%5FDORA%20Complete%20Filing%20Package.pdf&ref=thenexusofprivacy.net) recently published by the Colorado Attorney General’s office. The CPA was based on the Bad Washington Privacy Act, but contained several improvements – including a rulemaking process, similar to California's. Stauss' summary: > The CPA draft rules are a complex and lengthy set of regulations that, if adopted without substantial modification, will significantly expand the CPA’s requirements and require controllers to carefully consider their compliance obligations. ## Algorithmic Justice ### [Escaping the Impossibility of Fairness: From Formal to Substantive Algorithmic Fairness](https://link.springer.com/article/10.1007/s13347-022-00584-6?ref=thenexusofprivacy.net) Ben Green on SpringerLink (link.springer.com) Efforts to promote equitable public policy with algorithms appear to be fundamentally constrained by the “impossibility of fairness” (an incompatibility between mathematical definitions of fairness). This technical limitation raises a central question about algorithmic fairness: How can computer scientists and policymakers support equitable policy reforms with algorithms? Substantive algorithmic fairness presents a new direction for algorithmic fairness: away from formal mathematical models of “fair” decision-making and toward substantive evaluations of whether and how algorithms can promote justice in practice. ### [The White House can build on its AI Bill of Rights blueprint today](https://protocol.com/policy/biden-ai-blueprint-action?ref=thenexusofprivacy.net) Caitriona Fitzgerald and Ben Winters on Protocol (protocol.com) In [last week's article on the White House Office of Science and Technology Policy's "Blueprint for an AI Bill of Rights"](https://thenexusofprivacy.net/blueprint-for-an-ai-bill-of-rights/), I mentioned that the next step is to go from principles to changing policy. Fitzgerald and Winters of EPIC have some suggestions, and note that the administration doesn’t have to wait around for Congress to get moving on some of the principles in the blueprint. ## And ... #### [Dutch employee fired by U.S. firm for shutting off webcam awarded €75,000 in court](https://nltimes.nl/2022/10/09/dutch-employee-fired-us-firm-shutting-webcam-awarded-eu75000-court?ref=thenexusofprivacy.net) on NL Times (nltimes.nl) A remote employee of a U.S. business who was fired for refusing to leave his webcam on while he was working was awarded roughly 75,000 euros by a Dutch court for wrongful termination. The resident of Diessen, Noord-Brabant, was hired by the the Rijswijk branch of Chetu Inc., a software development c… #### #### [Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities](https://whitehouse.gov/briefing-room/presidential-actions/2022/10/07/executive-order-on-enhancing-safeguards-for-united-states-signals-intelligence-activities?ref=thenexusofprivacy.net) The White House on The White House (whitehouse.gov) By the authority vested in me as President by the Constitution and the laws of the United States of America, it is hereby ordered as follows: Section 1\. Purpose. The United States collects signals intelligence so that its national security decisionmakers have access to the timely, accurate, and i… #### [White Paper – Building the next generation of security and privacy professionals](https://iapp.org/resources/article/white-paper-building-the-next-generation-of-security-and-privacy-professionals?ref=thenexusofprivacy.net) Cobun Zweifel-Keegan, CIPP/US, CIPM on iapp.org This white paper explores how the roles of privacy and cybersecurity professionals are becoming increasingly interdependent, and compares the challenges faced b #### [TikTok offers website tracking pixels just like Meta, Google](https://theregister.com/2022/10/03/tiktok%5Ftracking%5Fpixels?ref=thenexusofprivacy.net) Brandon Vigliarolo on The Register (theregister.com) Don’t have a TT account? Doesn’t matter! #### [FPF Statement on White House Executive Order to Implement the European Union-U.S. Data Privacy Framework](https://fpf.org/blog/fpf-statement-on-white-house-executive-order-to-implement-the-european-union-u-s-data-privacy-framework?ref=thenexusofprivacy.net) on Future of Privacy Forum (fpf.org) Statement from Future of Privacy Forum’s CEO Jules Polonetsky: With this step, the U.S. puts in place practical surveillance limitations, oversight, and individual redress that are unmatched almost anywhere else in the world in the context of national security. Leading democracies are converging on… #### [Judge approves $100M Google privacy deal. Here’s how much Illinois residents will get.](https://pantagraph.com/news/state-and-regional/crime-and-courts/judge-approves-100m-google-privacy-deal-here-s-how-much-illinois-residents-will-get/article%5Fde72e1a6-3f61-11ed-8417-676fbf05c803.html?ref=thenexusofprivacy.net) TALIA SOGLIN Chicago Tribune on pantagraph.com (pantagraph.com) Illinois residents who filed claims for a cut of Google’s $100 million class-action settlement over alleged violations of state privacy law could receive checks of about $154 each. #### [Amazon Makes Creepy Surveillance Robot Even Creepier With Yet More Ring Integration](https://gizmodo.com/amazon-astro-robot-ring-virtual-security-guard-cops-1849591805?ref=thenexusofprivacy.net) Lucas Ropek, Gizmodo (gizmodo.com) Amazon keeps trying to put a cute face on its surveillance tech. #### [Privacy-focused web browsers are stuck in a rut, but why?](https://techradar.com/news/privacy-focused-web-browsers-are-stuck-in-a-rut-but-why?ref=thenexusofprivacy.net) Luke Hughes on TechRadar pro (techradar.com) Anonymous browsers like Opera and Mozilla Firefox are fighting an uphill battle on multiple fronts #### [Why Reddit Is Losing It Over Samsung’s New Privacy Policy](https://lifehacker.com/why-reddit-is-losing-it-over-samsung-s-new-privacy-poli-1849609421?ref=thenexusofprivacy.net) The A.V. Club on Lifehacker (lifehacker.com) Samsung’s latest update to its privacy policy is a bit creepy. #### [Journalist Sues Spyware Company for Allegedly Helping Gov. Surveil Him](https://gizmodo.com/thanasis-koukakis-sues-intellexa-over-predator-spyware-1849625793?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) A Greek financial journalist is one of several who believe they have been targeted for surveillance by the nation’s government with the help of Intellexa. #### [Privacy as Product](https://berjon.com/privacy-as-product?ref=thenexusofprivacy.net) Robin Berjon on Robin Berjon (berjon.com) The way in which most businesses approach privacy issues is far from ideal and more often than not self-defeating. Compliance with data regulations has imposed itself as the central part of the work when privacy really is a product concern: as aspect you work on to make your product better and incre… #### [Elton John and Prince Harry sue Daily Mail publisher over ‘privacy breach’](https://bbc.com/news/uk-63164654?ref=thenexusofprivacy.net) Daniel Sandford & Tom Symonds on BBC News (bbc.com) Elton John, Prince Harry and other public figures take legal action against Associated Newspapers. #### [‘A matter of urgency’: Calls for privacy overhaul following Optus data breach](https://9now.nine.com.au/a-current-affair/optus-breach-aussie-data-privacy-expert-calls-for-privacy-act-overhaul/f4e7d4cd-4956-43c5-8eb0-03362e50aa76?ref=thenexusofprivacy.net) A Current Affair Staff on nine (9now.nine.com.au) A data privacy expert says the Optus data breach has shown just how vulnerable our personal information rea... --- *Image credit:* Daquella manera on [Flickr ](https://www.flickr.com/photos/62518311@N00/466172168?ref=thenexusofprivacy.net) via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons Attribution 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net) license. ### Federal Privacy Legislation: What's likely to happen the "lame duck" session? URL: https://thenexusofprivacy.net/adppa-roundup/ Last updated: 2026-04-16T02:51:50.000Z With the House on recess until after the election, the only chance for federal privacy legislation to move forward is in the "lame duck" session in November and December. At the Washington Post Across the Aisle livestream in late September, Data Privacy and Protection Act (ADPPA) co-sponsor Rep. Frank Pallone said there was still plenty of time to pass something, and expressed optimism that ADPPA would move forward. Then again, he kind of has to say that. What do others think? Here's a set of Twitter polls to try to find out. If you're not there, no worries! You can to respond in the comments here, or by sending email to [privacy-polls@thenexus.today](mailto:privacy-polls@thenexus.today). - [How likely is ADPPA to pass this session](https://twitter.com/NexusOfPrivacy/status/1579199049869430784?ref=thenexusofprivacy.net)? - [If ADPPA doesn't pass, how far will it get](https://twitter.com/NexusOfPrivacy/status/1579199051777863683https://twitter.com/NexusOfPrivacy/status/1579199049869430784?ref=thenexusofprivacy.net)? - [How will the debate over wheher ADPPA preempts state and local privacy legislation get resolved](https://twitter.com/NexusOfPrivacy/status/1579199051777863683?ref=thenexusofprivacy.net)? - [If the House advances an amended version of ADPPA, how will it compare to the current version – weaker, about the same, or stronger](https://twitter.com/NexusOfPrivacy/status/1579199053472346112?ref=thenexusofprivacy.net)? - [Will Congress pass the Fourth Amendment is Not for Sale Act this session](https://twitter.com/NexusOfPrivacy/status/1579199055120728064?ref=thenexusofprivacy.net)? - [Will the Facial Recognition Act move forward](https://twitter.com/NexusOfPrivacy/status/1579206315960045568?ref=thenexusofprivacy.net)? - [Will My Body My Data get a hearing](https://twitter.com/NexusOfPrivacy/status/1579206317935579136?ref=thenexusofprivacy.net)? - [Will the Health and Location Data Privacy Act get a hearing](https://twitter.com/NexusOfPrivacy/status/1579206319630090240?ref=thenexusofprivacy.net)? ### Privacy News: October 6 URL: https://thenexusofprivacy.net/privacy-news-october-6/ Last updated: 2022-10-06T16:37:01.000Z Before we get to news around the web, a couple of updates here on The Nexus of Privacy: - Last week's post on [#StopShotSpotter](https://thenexusofprivacy.net/shotspotter-in-the-news/) now has updates about Detroit, Cleveland, and Dayton – which decided not to renew its ShotSpotter contract! - Yesterday's [White House Releases a “Blueprint for an AI Bill of Rights”](https://thenexusofprivacy.net/blueprint-for-an-ai-bill-of-rights/) now has an updated section on how it might (or might not) lead to regulation of AI use in industry ### [The US Needs to Recognize Intimate Privacy as a Civil Right](https://wired.com/story/privacy-intimacy-civil-rights-danielle-citron?ref=thenexusofprivacy.net) Danielle Keats Citron on WIRED (wired.com) In a story adepted from Professor Citron's new book [The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age](https://cna.st/affiliate-link/2rQwPprcmtWkDQzcq5ScmhpvFNNkddwZViNPQY2VGjrT7u1ngDJMDoboGXdFmPNDdQ5dj2K2SK4JifNdkoZ9berob26fquTgNLi65BbR8kyyU5Q4Lo83QMm4dJD8qahE1GBHaNyKGMrYKD6NSHrUR5XdtZaR4pPeaY7jddSXzdvWaNKna4oYVFKjTQ5AdEivt?ref=thenexusofprivacy.net)*,* she pushes back on the framing that privacy is just consumer protection issue. Instead she looks at how it’s inextricably linked to equality, with urgent implications for women and minorities. > To combat invasions of intimate privacy, we first need to recognize intimate privacy as a moral and legal right. Everyone deserves intimate privacy to create a life of meaning, respect, and love and to feel that they belong as citizens. In making this a civil right, lawmakers would show their appreciation of intimate privacy’s significance for individuals, groups, and society. > > In the United States, the recognition of a civil right has legal significance and moral resonance. Our civil rights tradition secures strong protections for crucial rights. Lawmakers can insist upon robust duties to protect intimate privacy and to remedy its violation. The recognition of a civil right to intimate privacy is urgent for women and minorities who suffer discrimination due to attitudes stigmatizing their bodies and intimate lives. Although modern civil rights laws are principally antidiscrimination laws, that should not be their sum total. A civil right to intimate privacy must combat invidious discrimination *and* secure basic entitlements for all. [Law professor Danielle Citron: ‘Privacy is essential to human flourishing’](https://www.theguardian.com/technology/2022/oct/02/danielle-citron-privacy-is-essential-to-human-flourishing?ref=thenexusofprivacy.net), an interview by Laurie Clark in *The Guardian,* and [Professor Danielle Citron’s New Book Argues Intimate Privacy Is a Human Right](https://www.law.virginia.edu/news/202209/professor-danielle-citrons-new-book-argues-intimate-privacy-human-right?ref=thenexusofprivacy.net) on Univesity of Virgnia's site, are good companion reads. > BUY THE BOOK! > [The Fight for Privacy](https://wwnorton.com/books/9780393882315?ref=thenexusofprivacy.net) is available > [from publisher W.W. Norton](https://wwnorton.com/books/9780393882315?ref=thenexusofprivacy.net) > or [via Amazon](https://www.amazon.com/Fight-Privacy-Protecting-Dignity-Identity/dp/0393882314?ref=thenexusofprivacy.net) ### [Privacy, Practice, and Performance](https://californialawreview.org/print/privacy-practice-and-performance?ref=thenexusofprivacy.net) Ari Ezra Waldman on California Law Review (californialawreview.org) Professor Waldman (author of the outstanding [Industry Unbound: The Inside Story of Privacy, Data, and Corporate Power](https://www.ariewaldman.com/book-industry-unbound?ref=thenexusofprivacy.net)) argues that rather than being influenced by the EU's GDPR or a Californias CCPA, recent privacy laws are creations of industry. That's certainly the case for laws like Virgnia's, which was based on the Bad Washington Privacy Act, and is widely described as written by Amazon and Microsoft. As Waldman says on Twitter, "The law has been endogenously created by industry practices that legitimize data extraction." From the abstract > Privacy law is at a crossroads. In the last three years, U.S. policymakers have introduced more than fifty proposals for comprehensive privacy legislation, most of which look roughly the same: they all combine a series of individual rights with internal compliance. The conventional wisdom sees these proposals as groundbreaking progress in privacy law and explains their uniformity by looking to catalyzing precedent like the General Data Protection Regulation in Europe or the California Consumer Privacy Act. > > This Article challenges that emerging consensus. Relying on contemporary sociological and critical studies scholarship, this Article analyzes recent privacy proposals in the United States through their social practices and argues that those practices are drawing boundaries that set the terms of privacy law from the ground up. In other words, privacy law’s practices are descriptively and normatively performative: they have socially constructed what we think privacy law is and should be. We have not only become accustomed to conceptualizing privacy law in certain ways; we have come to see a model of individual rights and internal procedural compliance as the normal, ordinary, commonsense modality of privacy law. So constructed, privacy law is flawed, with substantial negative effects for individuals, society, equality, and justice. Waldman's 2021 [How Big Tech Turns Privacy Laws Into Privacy Theater](https://slate.com/technology/2021/12/facebook-twitter-big-tech-privacy-sham.html?ref=thenexusofprivacy.net) on *Slate* and [A Provocative Critique of Privacy Law](https://teachprivacy.com/a-provocative-critique-of-privacy-law-an-interview-with-ari-waldman/?ref=thenexusofprivacy.net) (an interview by Daniel Solove on *Tech Privacy*) are good introductions to his work. > BUY THE BOOK! > [Industry Unbound](https://www.ariewaldman.com/book-industry-unbound?ref=thenexusofprivacy.net) is available > [from publisher Cambridge University Press](https://www.cambridge.org/us/academic/subjects/law/e-commerce-law/industry-unbound-inside-story-privacy-data-and-corporate-power?format=HB&ref=thenexusofprivacy.net) > or [via Amazon](https://www.amazon.com/Industry-Unbound-Inside-Privacy-Corporate/dp/1108492428/?ref=thenexusofprivacy.net) ## Post-Roe privacy ### [Automated License Plate Readers Threaten Abortion Access. Here’s How Policymakers Can Mitigate the Risk](https://eff.org/deeplinks/2022/09/automated-license-plate-readers-threaten-abortion-access-heres-how-policymakers?ref=thenexusofprivacy.net) Dave Maass on Electronic Frontier Foundation (eff.org) Automated license plate readers (ALPRs) are camera systems that capture license plate numbers and upload the information – including times, dates, locations – to databases. If that sounds like mass surveillance to you ... you're right! But as EFF points out > Now, in the wake of the U.S. Supreme Court's *Dobbs* ruling, that technology may soon be turned against people seeking abortions, the people who support them, and the workers who provide reproductive healthcare. ## Youth Privacy ### [When School Superintendents Market Surveillance Cameras](https://vice.com/en/article/93anj7/when-school-superintendents-market-surveillance-cameras?ref=thenexusofprivacy.net) Aaron Gordon on VICE Motherboard (vice.com( Michael Fox, a superintendent for a small New Jersey school district in Bergan County, sent dozens of sales pitches and coordinated closely with Verkada sales reps to hawk smart security cameras. Another county employee, who works at the county's Office of the Inspector General and is also a a security consultant for third party resellers of security products, was also copied on the mails. Bergen County employees are allowed to have outside employment as long as it does not conflict with county contracts or county activities – and Verkada sells through third-party resellers, so it's not technically a conflict. ### [EFF Urges FTC to Address Security and Privacy Problems in Daycare and Early Education Apps](https://eff.org/press/releases/eff-urges-ftc-address-security-and-privacy-problems-daycare-and-early-education-apps?ref=thenexusofprivacy.net) Jason Kelley on Electronic Frontier Foundation (eff.org) SAN FRANCISCO—The Federal Trade Commission must review the lack of privacy and security protections among daycare and early education apps, the Electronic Frontier Foundation (EFF) urged Wednesday in a letter to Chair Lina Khan. EFF Director of Engineering Alexis Hancock’s [recent investigation](https://www.eff.org/deeplinks/2022/06/daycare-apps-are-dangerously-insecure?ref=thenexusofprivacy.net) found early education and daycare apps have several troubling security risks. Some allow public access to children’s photos via insecure cloud storage; many have dangerously weak password policies; at least one (Tadpoles for Parents) sends “event” data, including when the app is activated and deactivated, to Facebook; and several enable cleartext traffic that can be exploited by network eavesdroppers. ### ## And ... #### [Meet the Military Contractor Running Fare Collection in New York Subways — and Around the World](https://theintercept.com/2022/10/03/cubic-military-public-transit-mta-omny?ref=thenexusofprivacy.net) Schuyler Mitchell on The Intercept (theintercept.com) Cubic Corporation does transit projects like New York City’s OMNY, but also cleans up on government surveillance and security contracts. #### [End-to-end encryption keeps us all safe](https://context.news/surveillance/opinion/end-to-end-encryption-keeps-us-all-safe?ref=thenexusofprivacy.net) Mallory Knodel, Ryan Polk, and Sheetal Kumar on context.news Governments worldwide are attacking encryption, infringing on the right to privacy and undermining their stated aim of making the internet safer for all #### [Announcing New Board Leadership at Data & Society](https://datasociety.net/announcements/2022/10/04/data-societys-board-of-directors-appoints-charlton-mcilwain-as-board-president?ref=thenexusofprivacy.net) on Data & Society (datasociety.net) Data & Society board unanimously appointed Dr. Charlton McIlwain as the new president of the board of directors. McIlwain has served on the board since February 2021\. D&S founder danah boyd has stepped down as president and has decided not to renew her board term when it ends March 1, 2023. #### [How the Supreme Court could change the internet as we know it](https://nbcnews.com/tech/tech-news/supreme-court-change-internet-know-rcna50490?ref=thenexusofprivacy.net) David Ingram on NBC News (nbcnews.com) The court is poised to hear as many as three cases this term about the legal protections that social media companies have used to become industry behemoths. #### [Whatever Happened to Those Self-Service Passport Kiosks at Airports?](https://nytimes.com/2022/10/05/travel/customs-kiosks-facial-recognition.html?ref=thenexusofprivacy.net) on NYTimes (nytimes.com) More than 80 percent of all travelers entering the U.S. are now verified by facial recognition. The loss of older, seemingly more convenient methods has many perplexed. And then there are the privacy issues. #### [UK pauses data reform bill to rethink how to replace GDPR](https://techcrunch.com/2022/10/03/uk-data-reform-bill-replace-gdpr?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) The UK government has paused a data reform bill while ministers take a fresh look at how to replace the EU GDPR. #### [Blocking annoying and privacy-harming cookie consent banners](https://brave.com/privacy-updates/21-blocking-cookie-notices?ref=thenexusofprivacy.net) on Brave Browser (brave.com) Recent versions of Brave on iOS include many new privacy features, ensuring that Brave iOS users have the strongest available protections of any iOS browser. #### [CPDP2023 Computers, Privacy and Data Protection conference • Call for Panels](https://cpdpconferences.org/call-for-panels?ref=thenexusofprivacy.net) on cpdpconferences.org CPDP is an annual three-day conference devoted to privacy and data protection. The 16th edition of CPDP will be held on 24-26 May 2023 in Brussels. This call for panels is aimed at academic consortia, research projects, think tanks and other research organisations. #### [Google pays $85m to settle location privacy lawsuit](https://theregister.com/2022/10/04/google%5Fprivacy%5Flawsuit%5Fsettlement?ref=thenexusofprivacy.net) Jessica Lyons Hardcastle on The Register (theregister.com) Phrasing, Arizona... AG claims deal is ‘historic’ #### [Report: 80% of popular mobile apps collect data on your messages](https://venturebeat.com/security/report-80-of-popular-mobile-apps-collect-data-on-your-messages?ref=thenexusofprivacy.net) VB Staff on VentureBeat (venturebeat.com) The most popular mobile apps all store basic user information, and 60% store information from private conversations. #### [W@Privacy Awards](https://fpf.org/fpf-event/176901?ref=thenexusofprivacy.net) Future of Privacy Forum (fpf.org) Women@ Privacy Awards FPF is honored to host W@Privacy for its first edition of the W@Privacy Awards! As part of W@Privacy’s mission to enhance the visibility and empowerment of women privacy professionals, they’ll recognize and celebrate outstanding women in the privacy field from various categorie… #### [Demographic-Reliant Algorithmic Fairness: Characterizing the Risks of Demographic Data Collection in the Pursuit of Fairness](https://arxiv.org/abs/2205.01038?ref=thenexusofprivacy.net) McKane Andrus on arXiv.org (arxiv.org) Most proposed algorithmic fairness techniques require access to data on a “sensitive attribute” or “protected category” (such as race, ethnicity, gender, or sexuality) in order to make performance comparisons and standardizations across groups, however this data is largely unavailable in practice, h… #### [Amazon’s Ring announces plan to use a robot for security patrols alongside new home security devices](https://techcrunch.com/2022/09/28/amazons-ring-announces-plan-to-use-a-robot-for-security-patrols-alongside-new-home-security-devices?ref=thenexusofprivacy.net) Sarah Perez on TechCrunch (techcrunch.com) Amazon unveiled a refresh of its Ring lineup including new cameras, alarms and more. #### [Ad industry practices come under fire as privacy lawsuits surge](https://insiderintelligence.com/content/ad-industry-practices-come-under-fire-privacy-lawsuits-surge?ref=thenexusofprivacy.net) Daniel Konstantinovic on Insider Intelligence (insiderintelligence.com) Privacy standards are changing under advertisers’ feet: Lawsuits from private citizens and the federal government show that a digital advertising reckoning is under way. #### [Couple Who Rents Cars Brags About Tracking Customers on TikTok](https://vice.com/en/article/g5vwjm/couple-who-rents-cars-brags-about-tracking-customers-on-tiktok?ref=thenexusofprivacy.net) on vice.com Privacy activists are decrying a couple who use TikTok to show how they track people who rented their cars on the car-sharing app Turo. #### [Attorney general flags urgent privacy law changes after Optus data breach](https://theguardian.com/business/2022/sep/29/attorney-general-flags-urgent-privacy-law-changes-in-wake-of-optus-data-breach?ref=thenexusofprivacy.net) Paul Karp on The Guardian (theguardian.com) Mark Dreyfus indicates potential reforms to laws regarding data breaches including higher penalties, mandatory precautions and customer notifications #### [Rohingya seek reparations from Facebook for role in massacre](https://apnews.com/article/technology-business-bangladesh-myanmar-c5af9acec46a3042beed7f5e1bc71b8a?ref=thenexusofprivacy.net) BARBARA ORTUTAY on Associated Press (apnews.com) With roosters crowing in the background as he speaks from the crowded refugee camp in Bangladesh that’s been his home since 2017, Maung Sawyeddollah, 21, describes what happened when violent hate speech and disinformation targeting the Rohingya minority in Myanmar began to spread on Facebook. #### [Privacy, security concerns prompt GAO to call for more telehealth oversight](https://scmagazine.com/analysis/privacy/privacy-security-concerns-prompts-gao-to-call-for-more-telehealth-oversight?ref=thenexusofprivacy.net) Jessica Davis on SC Media (scmagazine.com) A GAO audit of the Medicaid telehealth program found that more oversight is needed of how providers are communicating the privacy and security risks to patients. #### [Indonesia Data Protection Law Includes Potential Prison Time, Asset Seizure, Right to Compensation for Data Breaches](https://cpomagazine.com/data-protection/indonesia-data-protection-law-includes-potential-prison-time-asset-seizure-right-to-compensation-for-data-breaches?ref=thenexusofprivacy.net) Scott Ikeda on CPO Magazine (cpomagazine.com) An Indonesia data protection law that has been in development since 2016 includes some of the harshest penalties yet seen in national data privacy regulations, along with a right to compensation for data breaches. #### [4 Ways to Protect Your Privacy While Playing Online Games](https://pcmag.com/how-to/4-ways-to-protect-your-privacy-while-playing-online-games?ref=thenexusofprivacy.net) Kim Key on PCMag (pcmag.com) Gaming companies monitor all your in-game activities, which means they know more about you than you might want. Follow these tips to limit your online data sharing. --- Image credit: News by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net), licensed under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net), via [Pix4free](https://pix4free.org/?ref=thenexusofprivacy.net) ### White House Releases a "Blueprint for an AI Bill of Rights" URL: https://thenexusofprivacy.net/blueprint-for-an-ai-bill-of-rights/ Last updated: 2026-04-16T02:51:23.000Z > “This is the Biden-Harris administration really saying that we need to work together, not only just across government, but across all sectors, to really put equity at the center and civil rights at the center of the ways that we make and use and govern technologies. We can and should expect better and demand better from our technologies.” > > – Dr. Alondra Nelson, deputy director for science and society at the White House Office of Science and Technology Policy (OSTP), quoted in Garance Burke's [White House unveils artificial intelligence ‘Bill of Rights’](https://apnews.com/article/technology-business-artificial-intelligence-7a39848340d210592aeea2478225f489?ref=thenexusofprivacy.net)on Associated Press The [Blueprint for an AI Bill of Rights](https://www.whitehouse.gov/ostp/ai-bill-of-rights/?ref=thenexusofprivacy.net) announced Tuesday by the Biden administration is an important step to dealing with harms caused by the rise of artificial intelligence systems. These systems can have benefits , but as the Blueprint points out > Too often, these tools are used to limit our opportunities and prevent our access to critical resources or services. These problems are well documented. In America and around the world, systems supposed to help with patient care have proven unsafe, ineffective, or biased. Algorithms used in hiring and credit decisions have been found to reflect and reproduce existing unwanted inequities or embed new harmful bias and discrimination. Unchecked social media data collection has been used to threaten people’s opportunities, undermine their privacy, or pervasively track their activity—often without their knowledge or consent. > > These outcomes are deeply harmful—but they are not inevitable. The Blueprint proposes core five principles to forestall these harmful outcomes, each with an associated "Principles to Practice" page that goes into more detail and including real-life examples of how the principles can become reality: - [**Safe and Effective Systems**](https://www.whitehouse.gov/ostp/ai-bill-of-rights/safe-and-effective-systems-3/?ref=thenexusofprivacy.net): You should be protected from unsafe or ineffective systems. - [**Algorithmic Discrimination Protections**](https://www.whitehouse.gov/ostp/ai-bill-of-rights/algorithmic-discrimination-protections-2/?ref=thenexusofprivacy.net): You should not face discrimination by algorithms and systems should be used and designed in an equitable way. - [**Data Privacy**](https://www.whitehouse.gov/ostp/ai-bill-of-rights/data-privacy-2/?ref=thenexusofprivacy.net): You should be protected from abusive data practices via built-in protections and you should have agency over how data about you is used. - [**Notice and Explanation**](https://www.whitehouse.gov/ostp/ai-bill-of-rights/notice-and-explanation/?ref=thenexusofprivacy.net): You should know when an automated system is being used and understand how and why it contributes to outcomes that impact you. - [**Human Alternatives, Consideration, and Fallbac**k](https://www.whitehouse.gov/ostp/ai-bill-of-rights/human-alternatives-consideration-and-fallback/?ref=thenexusofprivacy.net): You should be able to opt out, where appropriate, and have access to a person who can quickly consider and remedy problems you encounter. Initial responses from algorithmic justice and privacy experts are mostly positive: - [Algorithmic Justice League](https://twitter.com/AJLUnited/status/1577309242146656258?ref=thenexusofprivacy.net) describes it as "an encouraging step in the right direction in the fight toward algorithmic justice," noting that the Blueprint affirms the importance of addressing algorithmic discrimination and provides a roadmap that should be leveraged for greater consent and equity. - Willmary Escoto of Access Now (quoted in Melissa Heikkilä's [The White House just unveiled a new AI Bill of Rights](https://www.technologyreview.com/2022/10/04/1060600/white-house-ai-bill-of-rights/?ref=thenexusofprivacy.net) on MIT Technology Review) notes that guidelines name and address the diverse harms people experience from AI-enabled technologies, and adds that "the AI Bill of Rights could have a monumental impact on fundamental civil liberties for Black and Latino people across the nation.” - Upturn [applauds](https://twitter.com/TeamUpturn/status/1577310354459213829?ref=thenexusofprivacy.net) it, and notes "This kind of critical analysis of tech needs to permeate across the policymaking spectrum — from federal agencies to city councils, and across issues like housing, employment, policing, health, education, financial services … you name it. These aren’t just “tech” issues anymore." - ReNika Moore, director of the American Civil Liberties Union’s Racial Justice Program (quoted in Rachel Metz' [The White House released an ‘AI Bill of Rights’](https://www.cnn.com/2022/10/04/tech/ai-bill-of-rights/index.html?ref=thenexusofprivacy.net) on CNN), called the principles “an important step in addressing the harms of AI” and added that “there should be no loopholes or carve-outs for these protections.” - The Leadership Conference on Civil and Human Rights [commends](https://civilrights.org/2022/10/04/ai-bill-of-rights-blueprint-can-protect-individuals-from-bias-and-discrimination-implementation-will-be-critical/?ref=thenexusofprivacy.net) the Biden administration for a major effort. - Center for Democracy and Technology [welcomes](https://cdt.org/press/cdt-welcomes-white-house-blueprint-for-an-ai-bill-of-rights/?ref=thenexusofprivacy.net) it. - Electronic Privacy Information Center [calls](https://twitter.com/TeamUpturn/status/1577310354459213829?ref=thenexusofprivacy.net) it a significant step, although notes that "the Administration must also ensure that systems used by the federal government meet the goals set out in today’s Blueprint." **Update, October 13:* The US Chamber of Commerce has some "concerns." Who could have predicted? Ben Winters of EPIC has* [*the details, and some quick responses, on Twitter*](https://twitter.com/Wenbinters/status/1580196511547158528?ref=thenexusofprivacy.net)*.* As AJL [points out](https://twitter.com/AJLUnited/status/1577309256298135554?ref=thenexusofprivacy.net), though, the Blueprint isn't everything that algorithmic justice advocates want. For example, as [Meredith Whittaker](https://twitter.com/mer%5F%5Fedith/status/1577287239989882880?ref=thenexusofprivacy.net), [Sarah T. Hamid](https://twitter.com/tsnvaa/status/1577361903789146114?ref=thenexusofprivacy.net), [Albert Fox-Cahn](https://twitter.com/FoxCahn/status/1577297762818969601?ref=thenexusofprivacy.net), and [Jackie Singh](https://twitter.com/HackingButLegal/status/1577355909369843712?ref=thenexusofprivacy.net) all highlight, the Blueprint's focus on the dangers of "continuous" and "unchecked" surveillance normalizes surveillance in general. Think about ["gunshot detection" technologies like ShotSpotter](https://thenexusofprivacy.net/shotspotter-in-the-news), which (supposedly) only kick in when shots are fired and (supposedly) has checks that reduce the number of people falsely arrested or killed by police responding to calls. You can certainly imagine law enforcement and vendors arguing that this isn't continuous or unchecked surveillance ... There are other issues as well. Unlike the EU's AI Act, it doesn't prohibit the use technologies that cuase "unacceptable risk." Upturn is [concerned](https://twitter.com/TeamUpturn/status/1577310379872493568?ref=thenexusofprivacy.net) by the legal disclaimer up front that "appears to suggest that law enforcement and national security should operate under a different, softer set of rules and principles." And I'm sure more detailed analysis will reveal other areas for improvement. Still, overall, the Blueprint is stronger than I had expected it to be. The next step is to go from principles to changing policy. In [a fact sheet](https://www.whitehouse.gov/ostp/news-updates/2022/10/04/fact-sheet-biden-harris-administration-announces-key-actions-to-advance-tech-accountability-and-protect-the-rights-of-the-american-public/?ref=thenexusofprivacy.net), the White House listed over a dozen upcoming agency actions that begin to make the principles concrete. For example, Department of Labor has released “[*What the Blueprint for an AI Bill of Rights Means for Workers*](https://blog.dol.gov/2022/10/04/what-the-blueprint-for-an-ai-bill-of-rights-means-for-workers?ref=thenexusofprivacy.net)” and is [ramping up enforcement of required surveillance reporting](https://blog.dol.gov/2022/09/15/how-were-ramping-up-our-enforcement-of-surveillance-reporting?ref=thenexusofprivacy.net) to protect worker organizing. Department of Education will release recommendations on the use of AI for teaching and learning by early 2023\. And this one in particular could have a big impact on the federal government's use of AI: > **To guide federal procurement**, the Administration will work across agencies to develop new policies and guidance for using and buying AI products and services that are based on effective and promising practices to prevent and address bias and algorithmic discrimination resulting from the use of AI and other advanced technologies. As well as having an impact at the federal level, the Blueprint could also give a boost to states looking to regulate AI-based systems. One of the topics we discussed on the [Washington State Automated Decision-making Systems Workgroup](https://watech.wa.gov/privacy/projects-and-initiatives?ref=thenexusofprivacy.net) last year was the potential risk that if Washington's government procurement guidelines were far more rigorous than elsewhere, vendors might just ignore us. Aligning with the Blueprint's recommendations is a good way to reduce that risk – and convince legislators that we're not just doing our own thing, but are part of a broader movement. What about applying these principles to the private sector? As Theodora Lau, co-founder of Unconventional Ventures, says (in Penny Crosman's [What the White House’s blueprint for an AI bill of rights means for banks](https://www.americanbanker.com/news/what-the-white-houses-blueprint-for-an-ai-bill-of-rights-means-for-banks?ref=thenexusofprivacy.net) on *American Banke*r), "at least it sends a signal to the industry: Hey, we will be watching." And who knows, companies like Facebook, Palantir, and Clearview AI *could* voluntarily adhere to the Blueprint's principles ... hahahahaha. Yeah, right. As Lau says, a nonbinding bill with no enforcement measures is "like a toothless tiger." Khari Johnson goes into more detail in Wired with similar framing: [Biden’s AI Bill of Rights Is Toothless Against Big Tech](https://www.wired.com/story/bidens-ai-bill-of-rights-is-toothless-against-big-tech/?ref=thenexusofprivacy.net) > The White House’s blueprint for AI rights is primarily aimed at the federal government. It will change how algorithms are used only if it steers how government agencies acquire and deploy AI technology, or helps parents, workers, policymakers, or designers ask tough questions about AI systems. It has no power over the large tech companies that arguably have the most power in shaping the deployment of machine learning and AI technology. Still, everybody agrees the Blueprint is just a first step. Potential next steps to applying the blueprint in the private sector include - States continuing to take the lead as laboratories of democracy; for example, the [California Privacy Rights Act has some equity-focused AI regulation,](https://medium.com/artificial-intelligence-ai-for-social-impact/xx-22faff63228f?ref=thenexusofprivacy.net) including the ability to opt out of automated profiling, and their new [Age-Appropriate Design Code](https://iapp.org/news/a/the-future-of-youth-privacy-is-here/?ref=thenexusofprivacy.net) also has some algorithmic regulations. - [The FTC's proposed commercial surveillance rulemaking](https://nexusofprivacy.net/comments-for-ftc-public-forum-for-commercial-surveillance/?ref=thenexusofprivacy.net), whose scope is likely to include AI and other automated decision systems. - New federal legislation, perhaps passing the [Algorithmic Accountability Act of 2022](https://clarke.house.gov/clarke-wyden-and-booker-introduce-algorithmic-accountability-act-of-2022-to-require-new-transparency-and-accountability-for-automated-decision-systems/?ref=thenexusofprivacy.net) or [strengthening the extremely weak algorithmic sections of the American Data Privacy and Protection Act (ADPPA)](https://thenexusofprivacy.net/adppa-impact-assessments-and-civil-rights/), which currently fall far short AI Bill of Rights' principles A more pessimistic scenario is if the current version of ADPPA passes. ADPPA doesn't require notice that AI-based systems are being used, it doesn't require companies to allow people to opt out, it's algorithmic impact assessment requirements don't require third-party evaluation ... so without even digging into the details, it's already struck out on three of the five Blueprint principles. Not only that, [ADPPA has some major data privacy loopholes that put pregnant people at risk](https://thenexusofprivacy.net/adppa-post-roe-threats/), [it doesn't protect LGBAIQ2S+ people](https://thenexusofprivacy.net/adppa-with-a-queer-lens/), and it preempts states from passing stronger legislation. In fact, since ADPPA has exceptions for government contractors acting as service providers, it could even undercut progress within the federal government. Let's hope that doesn't happen. More positively, though, the principles and practices in the Blueprint provide insights for how to improve the ADPPA and other legislation. The backing from the Biden administration is at the very least an important acknowledgement of the breadth and importance of the issues. And the detailed analyses are potentially also a roadmap that could lead to meaningful change. So kudos to all the advocates and organizations who have been pushing for this – and also to Dr. Nelson and the [team](https://twitter.com/AlondraNelson46/status/1577791010305867778?ref=thenexusofprivacy.net) that developed it. As Nelson, Dr. Sorelle Friedle (OSTP Assistant Director for Data and Democracy), and Ami Fields-Meyer (Chief of Staff, OSTP Science and Society Division) say in [Blueprint for an AI Bill of Rights: A Vision for Protecting Our Civil Rights in the Algorithmic Age](https://www.whitehouse.gov/ostp/news-updates/2022/10/04/blueprint-for-an-ai-bill-of-rightsa-vision-for-protecting-our-civil-rights-in-the-algorithmic-age/?ref=thenexusofprivacy.net) > What could it look like for industry developers and academic researchers to think about equity at the start of a design process, and not only after issues of discrimination emerged downstream? What kind of society could we have if all innovation began with ethical forethought? How do we ensure that the guardrails to which we are entitled in our day-to-day lives carry over into our digital lives? > > The *Blueprint for an AI Bill of Rights* begins to answer these questions. It offers a vision for a society where protections are embedded from the beginning, where marginalized communities have a voice in the development process, and designers work hard to ensure the benefits of technology reach all people. The introduction at the White House of the Blueprint for an AI Bill of Rights --- Image Credit: Willmary Escoto [via Twitter](https://twitter.com/willmaryescoto/status/1577344355265716224/photo/1?ref=thenexusofprivacy.net), used with permission ### #StopShotSpotter: Detroit, Cleveland, Portland, Seattle, Dayton and a short reference list (UPDATED) URL: https://thenexusofprivacy.net/shotspotter-in-the-news/ Last updated: 2026-04-16T02:51:01.000Z *Originally written September 29; last updated October 5\. See the* [*Updates*](#updates) *at the bottom.* > "We cannot ignore the fact that there's no data that proves that ShotSpotter actually works.... I've asked (police) give me some data. Please. Don't just be running around putting fear into people. Folks are scared to death in this city. They believe ShotSpotter is going to keep them safe. Lord knows it's not going to happen. You make bad decisions out of fear." > > Detroit City Council Member Mary Waters, quoted in Andrea May Sahouri's reports in [Amid intense debate, Detroit council again delays ShotSpotter expansion](https://www.freep.com/story/news/local/michigan/detroit/2022/09/28/detroit-shotspotter-debate-continues-as-council-again-delays-vote/69522597007/?ref=thenexusofprivacy.net) > The Chicago Police Department data examined by OIG does not support a conclusion that ShotSpotter is an effective tool in developing evidence of gun-related crime. > > – [OIG Finds That ShotSpotter Alerts Rarely Lead to Evidence of a Gun-Related Crime and That Presence of the Technology Changes Police Behavior](https://igchicago.org/2021/08/24/oig-finds-that-shotspotter-alerts-rarely-lead-to-evidence-of-a-gun-related-crime-and-that-presence-of-the-technology-changes-police-behavior/?ref=thenexusofprivacy.net), Chicago’s Office of the Inspector General (OIG), 2021 There's no evidence that the gunshot detection at the heart of ShotSpotter's "Precision Policing Platform™" is effective. Even when it's lucky enough to accurately detects that gunshots were fired, most of the time the results are like [this recent report from Newark](https://www.rlsmedia.com/article/update-shotspotter-device-alerts-newark-police-gunfire-millington-avenue?ref=thenexusofprivacy.net): police responded, but found no reports of victims. As well as wasting time, these false positives increase the number of heightened and harmful interactions with police – like on October 4 in Peoria, when [police killed Samuel V. Richmond while responding to a ShotSpotter alert](https://www.pjstar.com/story/news/2022/10/05/samuel-richmond-peoria-police-shooting-what-we-know/69541682007/?ref=thenexusofprivacy.net). And since most ShotSpotter deployments are in Black, brown, and poor communities, [guess who bears the brunt of this](https://endpolicesurveillance.com/burden-on-communities-of-color/?ref=thenexusofprivacy.net)? But commercial surveillance companies like ShotSpotter are very good at hyping their ineffective technology – and President Biden has encouraged cities to spend "leftover" pandemic relief funding on law enforcement. So ShotSpotter is a very convienient way for city governments to *claim* they're doing something to address gun violence (as opposed to spend money on youth programs, jobs, housing, mental healthcare, or other investments that would actually have an impact). As a result, [ShotSpotter's business continues to grow](https://seekingalpha.com/article/4532236-shotspotter-inc-ssti-ceo-ralph-clark-on-q2-2022-results-earnings-call-transcript?ref=thenexusofprivacy.net). All across the country, local organizers are fighting back. In July, a MacArthur Justice Center at Northwestern University’s law school [filed a federal lawsuit](https://apnews.com/article/gun-violence-technology-crime-chicago-lawsuits-3e6145f63c96593866cf89ac01ce7498?ref=thenexusofprivacy.net) against Chicago, on behalf of plaintiffs Michael Williams and Daniel Ortiz (both jailed as a result of ShotSpotter charges before being released). And as Angrej Singh describes in [Evaluating the Growing Movement to Stop ShotSpotter](https://techpolicy.press/evaluating-the-growing-movement-to-stop-shotspotter/?ref=thenexusofprivacy.net) on *Tech Policy Press*, the broad coalition of groups in the [#StopShotSpotter coalition](https://stopshotspotter.com/?ref=thenexusofprivacy.net) has now grown to about 20 cities. > TAKE ACTION! > 1\. [Sign the #StopSpotterCoalition petition](https://act.newmode.net/action/mpower-change/tell-shotspotter-stop-selling-surveillance/?ref=thenexusofprivacy.net)! > 2\. Look for local organizers and get involved! So here's some updates about recent ShotSpotter-related discussions around the country. If you want to find out more, I've got a list of references at the end of the article. ## Detroit > So far, the favorite public comment today: > > "We don't need ShotSpotter. We need poverty spotter and opportunity spotter." > > – [Tawana Petty of Algorithmic Justice League](https://twitter.com/Combsthepoet/status/1574772138694828032?ref=thenexusofprivacy.net) On September 27, [pressure forced the Detroit City Council to defer a plan to expand ShotSpotter deploymen](https://www.detroitnews.com/story/news/local/detroit-city/2022/09/27/detroit-oks-1-5-million-gunshot-shotspotter-detection-renewal-delays-vote-7-million-expansion/10396781002/?ref=thenexusofprivacy.net)t using $7 million in federal American Rescue Plan Act (ARPA) pandemic-related funding. However, the City Council approved a $1.5 million extension of the current ShotSpotter contract; and a future vote is expected on whether to fund the expansion from the police department's budget. At the October 4 meeting, the [City Council once again delayed their vote on $7 million ShotSpotter contract](https://www.michiganradio.org/public-safety/2022-10-04/detroit-again-delays-the-vote-on-7-million-shotspotter-contract?ref=thenexusofprivacy.net), as Briana Rice reports for Michigan Radio. A [letter](https://docs.google.com/document/d/1evG1wfqo9hOj9qylfz3uAMom2ZK4J5Lk5jIw%5F6VuK%5FM/edit?ref=thenexusofprivacy.net) from the The #StopShotSpotterDetroit coalition (which includes We The People of Michigan, Detroit Will Breathe, Michigan Liberation, Detroit Action, Detroit Justice Center, Sassafras Tech Collective, Black Lives Matter Michigan, and ACLU of Michigan) goes into detail on the local context. > TAKE ACTION: > [Tell Detroit City Council: Say NO to Shotspotter and invest in Detroiters!](https://secure.everyaction.com/P32Hl%5Fx-F0ua8F4LS0AMRQ2?ref=thenexusofprivacy.net) > (from We The People Michigan) Several opinion pieces with great perspectives: - Sammie Lewis' [Faulty Shotspotter gun crime surveillance system doesn’t meet needs of Detroit’s people](https://peoplesworld.org/article/faulty-shotspotter-gun-crime-surveillance-system-doesnt-meet-needs-of-detroits-people/?ref=thenexusofprivacy.net) on People's World - Rebecca Smith's [ShotSpotter profits off fears of gun violence](https://www.metrotimes.com/news/opinion-shotspotter-profits-off-fears-of-gun-violence-31174194?ref=thenexusofprivacy.net), in Detroit Metro Times - Rae Baker and Peter Blackmer's [Detroit is at a crossroads about safety and surveillance, City Council must choose the right path](https://www.metrotimes.com/news/opinion-detroit-is-at-a-crossroads-about-safety-and-surveillance-city-council-must-choose-the-right-path-31241720?ref=thenexusofprivacy.net), also in Detroit Metro Times And if you want pro-ShotSpotter talking points, Raymond Strickland's [A closer look at ShotSpotter as Detroit weighs decision to expand](https://www.cbsnews.com/detroit/news/a-closer-look-at-shotspotter-as-detroit-weighs-decision-to-expand/?ref=thenexusofprivacy.net) on CBS Detroit has perspectives from the Cincinnatti police chief (who says "the good outweighs the bad") and Southern Illinois University Edwardsville professor Dennis Mares (who agrees) as well as two statements from the company. ## Cleveland On September 28,, Cleveland's City Council Safety Committee discussed using $2.8 million in ARPA funding. Lucas Duprile's [Cleveland wants to spend $2.8 million to quadruple the size of its controversial gunshot detection tool](https://www.cleveland.com/news/2022/09/cleveland-wants-to-spend-28-million-to-quadruple-the-size-of-its-controversial-gunshot-detection-tool-stimulus-watch.html?ref=thenexusofprivacy.net) includes perspectives from supporters and opponents. Black Lives Matter Cleveland President LaTonya Goldsby's [Cleveland should cancel its ShotSpotter contract, not expand it](https://cleveland.com/opinion/2022/09/cleveland-should-cancel-its-shotspotter-contract-not-expand-it-latonya-goldsby.html?ref=thenexusofprivacy.net) goes into more detail. > ShotSpotter claims to be highly accurate, with a low false positive rate. However, ShotSpotter has never published results of validation testing. These rates are based on the assumption that every alert is a gunshot. ShotSpotter gives itself a starting grade of 100% and only decreases this number as police report mistakes, something they often aren’t told to do and cannot properly evaluate. Of departments that self-report, false positive rates can be in the double digits. When subpoenaed for proof showing how their system works, ShotSpotter has in one instance [asked to be held in contempt of court](https://chicagoreader.com/news-politics/shotspotter-held-in-contempt-of-court/?ref=thenexusofprivacy.net) rather than provide that information. No tool used in our criminal legal system should be used to arrest, incarcerate, and convict without proving it works. > > Does ShotSpotter prevent gun violence? Their own contracts do not make that claim. From one ShotSpotter Respond Services Agreement: “ShotSpotter does not warrant or represent, expressly or implicitly, that the Software or Subscription Services or its use will: result in the prevention of crime, apprehension or conviction of any perpetrator of any crime, or detection of any criminal.” One [study](https://wpln.org/wp-content/uploads/sites/7/2022/02/Doucette-Impact-of-ShotSpotter-Technology-on-Firearm-Homici.pdf?ref=thenexusofprivacy.net) that examined results from around the country found that ShotSpotter has had no significant impact on violent crime - it’s not a crime-fighting tool. Matthew Richmond's [Use of Shotspotter alerts in Cleveland arrests is raising constitutional concerns](https://www.wksu.org/government-politics/2022-10-05/use-of-shotspotter-alerts-in-cleveland-arrests-is-raising-constitutional-concerns?ref=thenexusofprivacy.net) on WKSU and Rachel Dissell and Mark Puente's [Cleveland Has Spent Millions on Police Cameras. Why Are the Locations a Secret?](https://www.clevescene.com/news/cleveland-has-spent-millions-on-police-cameras-why-are-the-locations-a-secret-40517382?ref=thenexusofprivacy.net) on *Cleveland Scene* provides even more context. > TAKE ACTION: > [Black Lives Cleveland's open letter on Action Network](https://actionnetwork.org/letters/end-shotspotter-contract-in-cleveland?ref=thenexusofprivacy.net) > has scripts and contact information for the city council. > Fill in your name and address, and click "Start Writing" to get the details. ## Portland Oregon On September 22, [Mayor Ted Wheeler announced a plan to move forward with a ShotSpotter pilot program](https://www.opb.org/article/2022/09/22/portland-oregon-gun-violence-police-shotspotter/?ref=thenexusofprivacy.net). The next step is to develop a detailed proposal, including which Black and brown neighborhoods to deploy the system in, after which the City Council will vote. A few relevant links: - An [August repor](https://www.documentcloud.org/documents/22161727-smart-city-pdx%5Fshotspotter-comments?ref=thenexusofprivacy.net)t from Smart City PDX (the city government agency that focuses on surveillance technologies) highlights concerns, including accuracy issues, cost, and the risk of legal liability to the city. - [Say No to ShotSpotter: An Open Letter from Portland Community Members](https://medium.com/@ssspdx/an-open-letter-from-portland-community-organizations-about-shotspotter-and-its-impact-on-2f09c924bdc8?ref=thenexusofprivacy.net) (signed by representatives from a broad coalition of Portland-based organizations including Campaign Zero, Freedom to Thrive, Oregon Justice Resource Center, and PDX Privacy) responds to the FITCOG community oversight group's endorsement of ShotSpotter. - Local activist @AbolitionBabe's [letter](https://twitter.com/AbolitionBabe/status/1556768410129707008?ref=thenexusofprivacy.net) to the Mayor and City Council includes data collected by Campaign Zero, including a poll in which a significant majority of voters disapproved of ShotSpotter when told of its inability to lead police to actionable evidence. - [The A9 Collective live-tweeted the September 27 City Council meeting](https://twitter.com/A9Collective/status/1574823241721712641?ref=thenexusofprivacy.net) discussing surveillance policies ## Seattle On September 27, Seattle Mayor Bruce Harrell's initial budget proposal included $1 million for a ShotSpotter program. This isn't a surprise; [last October](https://twitter.com/DecrimSeattle/status/1453939785253339136?ref=thenexusofprivacy.net), Harrell said he'd direct funding to ShotSpotter if elected, and he's been pushing for it [since 2012](https://www.thestranger.com/news/2016/06/02/24158530/mayor-council-and-police-try-again-with-shotspotter-gunshot-detection-system?ref=thenexusofprivacy.net). Not only that, [as Erica Barnett reports on PublicCola](https://publicola.com/2022/09/27/harrells-budget-would-move-parking-enforcement-back-to-spd-add-10-million-to-homelessness-authority-and-use-jumpstart-to-backfill-budget/?ref=thenexusofprivacy.net), his chief public safety advisor Tim Burgess pushed unsuccessfully to set up ShotSpotter technology in the Rainier Valley back when he was on the city council. It didn't take long for opposition to surface. As KING5's Sebastian Robertson reported [the very next day](https://www.king5.com/article/news/local/seattle/seattle-gunshot-detection-technology/281-8f2d54a3-3a50-42aa-ae06-dfa527517b51?ref=thenexusofprivacy.net): > The Seattle Neighborhood Group, a nonprofit working to create safer communities’ argues the money could be better spent somewhere else – fearing an overreaction by police responding to a computer and not a human call for help. > > “Research has shown that the effects of the shot shooter technology are damaging to communities of color. It’s unreliable and results in false alarms and conflicts within our communities,” said Cathie Willmore with the Seattle Neighborhood Group. And by September 30, [Councilmember Lisa Herbold announced her opposition.](https://www.thestranger.com/news/2022/09/29/78549071/mayor-harrell-proposes-1-million-for-questionable-surveillance-tech?ref=thenexusofprivacy.net) Even though Seattle's one of the few cities that actually cut police spending in the aftermath of the George Floyd uprising in 2020, [several City Councilmembers' positions have shifted since then](https://www.seattletimes.com/seattle-news/politics/50-was-a-mistake-how-seattle-city-council-abandoned-the-idea-of-defunding-police/?ref=thenexusofprivacy.net) and last November's elections brought in a new pro-police councilmember as well as the pro-police Mayor. Then again, the Decriminalize Seattle coalition does outstanding work, quite a few Tech Equity Coalition groups are in Seattle, the Seattle Privacy Coalition helped stop several previous proposed ShotSpotter deployments, and the city's looking at a [$117 million budget deficit](https://www.seattletimes.com/seattle-news/politics/no-obvious-way-out-seattle-facing-117-million-revenue-shortfall-in-2023/?ref=thenexusofprivacy.net) in 2023\. An added wrinkle: ShotSpotter doesn't yet have a Surveillance Impact Report (required under Seattle's Surveillance Ordinance). Also [as Shaun Scott notes on Twitter](https://twitter.com/eyesonthestorm/status/1574870243918622720?ref=thenexusofprivacy.net), a Race and Social Justice Initiative analysis "would caution against its deployment because the racially disparate impact of increasing points of contact between cops and Rainier Valley - site of the proposed pilot - is deathly clear." So it'll be interesting to see how it plays out. ## Dayton On October 4, [Dayton decided not to renew their contract with ShotSpotter program](https://www.daytondailynews.com/local/dayton-not-renewing-contract-with-shotspotter-program/PYYGLLNVRJGUHEAF4OSJJ7K4NA/?ref=thenexusofprivacy.net). As Cornelius Frolik [reports](https://www.daytondailynews.com/local/dayton-not-renewing-contract-with-shotspotter-program/PYYGLLNVRJGUHEAF4OSJJ7K4NA/?ref=thenexusofprivacy.net) in the Dayton Daily News > “Based on the analysis of the ShotSpotter data, considering community response, changes in state law, budget, officer response and other factors, it has been decided that the city of Dayton and the Dayton Police Department will not renew the ShotSpotter contract in 2023,” police said in a statement. E.J. Waltemire has [a screenshot of the police department's statement](https://twitter.com/public%5Fruckus/status/1577418712139051008?ref=thenexusofprivacy.net) on Twitter. Kudos to the Coalition on Public Education and the other advocates who have been working on this! ### ## Find out more - [ShotSpotter and the Misfires of Gunshot Detection Technology](https://www.stopspying.org/shotspotter?ref=thenexusofprivacy.net), STOP (Surveillance Technology Oversight Project, 2022) - [The Algorithmic Ecology of Shotspotter](https://docs.google.com/presentation/d/1QAFGgXG8L0Y5aZXYJcY3UkGLJ281YOzWuuacCRypnqs/edit?ref=thenexusofprivacy.net), Stop Shotspotter Portland (2022) - [Class Action Lawsuit Takes Aim at Chicago’s Use of ShotSpotter After Unfounded Alerts Lead to Illegal Stops and False Charges](https://www.macarthurjustice.org/class-action-lawsuit-takes-aim-at-chicagos-use-of-shotspotter-after-unfounded-alerts-lead-to-illegal-stops-and-false-charges/?ref=thenexusofprivacy.net), MacArthur Justice Center (2022). The [complaint](https://www.macarthurjustice.org/wp-content/uploads/2022/07/Complaint-file-stamped.pdf?ref=thenexusofprivacy.net) has a lot more detail. - [ShotSpotter’s deafening impact](http://chicagoreader.com/news-politics/news/shotspotters-deafening-impact/?ref=thenexusofprivacy.net), Grace Del Vecchio and Matt Chapman, Chicago Reader (2022) - [How AI-powered tech landed man in jail with scant evidence](https://apnews.com/article/artificial-intelligence-algorithm-technology-police-crime-7e3345485aa668c97606d4b54f9b6220?ref=thenexusofprivacy.net), Garance Burke, Martha Mendoza, Juliet Linderman, and Michael Tran, Associated Press (2022). Michael Williams was eventaully released at the request of prosecutors, who said they had insufficient evidence, and is one of the named plaintiffs in the MacArthur Justice Center's lawsuit. - [A gunshot detection tech company is facing criticism. Police are investing anyway](https://www.nbcnews.com/news/us-news/shotspotter-police-gunshot-technology-federal-grants-rcna13815?ref=thenexusofprivacy.net), Jon Schuppe and Joshua Eaton, NBC News (2022). - [The RISE and REACH of Surveillance Technology](https://acrecampaigns.org/wp-content/uploads/2021/03/acre-21stcenturypolicing-r4-web.pdf?ref=thenexusofprivacy.net) report from ACRE (Action Center on Race and Economy, 2021) has broader context and includes a case study on ShotSpotter - [ShotSpotter is deployed overwhelmingly in Black and Latinx neighborhoods in Chicago,](https://endpolicesurveillance.com/burden-on-communities-of-color/?ref=thenexusofprivacy.net) Macarthur Justice Center (2021). [Gunshot-Detecting Tech Is Summoning Armed Police to Black Neighborhoods](https://www.vice.com/en/article/88nd3z/gunshot-detecting-tech-is-summoning-armed-police-to-black-neighborhoods?ref=thenexusofprivacy.net), Todd Feathers, VICE (2021) has data from Kansas City, Atlanta, and Cleveland as well as Chicago. - [Police Are Telling ShotSpotter to Alter Evidence From Gunshot-Detecting AI](https://www.vice.com/en/article/qj8xbq/police-are-telling-shotspotter-to-alter-evidence-from-gunshot-detecting-ai?ref=thenexusofprivacy.net), Todd Feathers, VICE (2021). ShotSpotter filed a 413-page defamation lawsuit over this article, but in July 2022 [the judge dismissed it](https://www.techdirt.com/2022/07/08/judge-tosses-defamation-suit-brought-by-shotspotter-against-vice-media-for-reporting-on-its-shady-tactics/?ref=thenexusofprivacy.net) (although VICE did make some minor changes to the article). - [Chicago Should Cancel ShotSpotter Contract After Report Shows Police Influence On Technology, Activists Say](https://blockclubchicago.org/2021/07/30/activists-demand-city-hall-cancel-shotspotter-contract-adam-toledo/?ref=thenexusofprivacy.net), Mauricio Peña and Justin Laurence, Block Book Club (2021) - [Four Problems with the ShotSpotter Gunshot Detection System](https://www.aclu.org/news/privacy-technology/four-problems-with-the-shotspotter-gunshot-detection-system?ref=thenexusofprivacy.net), Jay Stanley, ACLU (2021) The [#StopSpotterCoalition petition](https://act.newmode.net/action/mpower-change/tell-shotspotter-stop-selling-surveillance/?ref=thenexusofprivacy.net) has several additional references. While you're there, please sign it if you haven't already! ## Updates October 5: update intro; new information on Detroit, Cleveland (including an action), Dayton September 30: more information on Seattle --- Image credit: MPower Change's posting of the [#StopShotSpotter petition](https://act.newmode.net/action/mpower-change/tell-shotspotter-stop-selling-surveillance?ref=thenexusofprivacy.net) ### Privacy News: October 4 mega-update URL: https://thenexusofprivacy.net/privacy-news-october-4/ Last updated: 2026-04-16T02:50:09.000Z Once again, it's been over a week since the last update so this is a loooong list. Where to start? With federal privacy legislation, of course, followed by post-Roe privacy, automated decision systems, news from "across the pond" ... and much much more, with almost 50 links all together. ## Federal privacy legislation ### [Passage of Federal Privacy Bill Remains Possible This Year, Remains a Continued Priority](https://www.natlawreview.com/article/passage-federal-privacy-bill-remains-possible-year-remains-continued-priority?ref=thenexusofprivacy.net) Kristin L. Bryan, Jeffrey L. Turner, Beth L. Goldstein, and Kyle R. Fath on National Law Review (natlawreview.com) At the Washington Post Across the Aisle livestream last Thursday – right before the House went on recess until after the election – American Data Privacy and Protection Act (ADPPA) co-sponsor Rep. Frank Pallone pointed to the upcoming "lame duck" session after the election as an opportunity to pass privacy legislation and expressed optimism. Of course, he's got to say that, so it's hard to know what to read into it. I'll have a longer update on ADPPA in the next few days; for now, here's the [video](https://www.youtube.com/watch?v=g-XGGw5I9ig&ref=thenexusofprivacy.net), my [live-tweeting thread](https://twitter.com/NexusOfPrivacy/status/1575502141221138432?ref=thenexusofprivacy.net), and [an "unrolled" version](https://threadreaderapp.com/thread/1575498837556613128.html?ref=thenexusofprivacy.net) of the thread. ### [House Democrats debut new bill to limit US police use of facial recognition](https://techcrunch.com/2022/09/29/house-democrats-facial-recognition-act/?ref=thenexusofprivacy.net) Zack Whittaker on TechCrunch (techcrunch.com) The new Facial Recognition Act would require police across the United States to first obtain a warrant before using facial recognition technologies. The bill (introduced by Reps. Ted Lieu (D-CA), Sheila Jackson Lee (D-TX), Yvette Clarke (D-NY) and Jimmy Gomez (D-CA) also puts other limits on what law enforcement can use facial recognition for, such as immigration enforcement or peaceful protests, or using a facial recognition match as the sole basis for establishing probable cause for someone’s arrest. [The announcement on Rep. Lieu's site](https://lieu.house.gov/media-center/press-releases/reps-ted-lieu-sheila-jackson-lee-yvette-clarke-and-jimmy-gomez-introduce?ref=thenexusofprivacy.net) has details as well as quotes from the sponsors and privacy advocates organizations including supporting the bill including Center for Democracy and Technology, Project on Government Oversight, Access Now, and several Commissioners on the Massachusetts Facial Recognition Commission. Even though the bill falls short of the moratorium or ban that most privacy advocates (including me) argue is needed, warrant requirements and limits on usage an be valuable steps forward. ## Post-Roe privacy ### [California bars tech companies from complying with other states’ abortion-related warrantss](https://cnn.com/2022/09/29/tech/california-tech-abortion-warrant-ban/index.html?ref=thenexusofprivacy.net) Brian Fung,Clare Duffy on CNN (cnn.com) California is attempting to stymie abortion prosecutions in other states by making it illegal for Silicon Valley giants and other businesses based in the Golden State to hand over the personal information of abortion-seekers to out-of-state authorities. ### [What to know about Alaska’s privacy clause and its link to abortion rights](https://alaskapublic.org/2022/09/19/what-to-know-about-alaskas-privacy-clause-and-its-link-to-abortion-rights?ref=thenexusofprivacy.net) Kavitha George, Alaska Public Media - Anchorage on Alaska Public Media (alaskapublic.org) As Alaskans prepare to vote in November on whether to hold a constitutional convention, the privacy clause is a major focus. ### [Law professor Danielle Citron: ‘Privacy is essential to human flourishing’](https://theguardian.com/technology/2022/oct/02/danielle-citron-privacy-is-essential-to-human-flourishing?ref=thenexusofprivacy.net) Laurie Clarke on The Guardian (theguardian.com) The American professor of law talks about her new book on the fight for data privacy, the personal dossiers brokers build on us and how, post-Roe v Wade, women’s data in the US may be weaponised. ## Automated Decision Systems ### [AI Is Probably Using Your Images and It’s Not Easy to Opt Out](https://vice.com/en/article/3ad58k/ai-is-probably-using-your-images-and-its-not-easy-to-opt-out?ref=thenexusofprivacy.net) Chloe Xiang on Vice Motherboard (vice.com) In one stark example of how sensitive images can end up powering these AI tools, a user found a medical image in the LAION dataset, which was used to train Stable Diffusion and Google’s Imagen. ### [The EU wants to put companies on the hook for harmful AI](https://technologyreview.com/2022/10/01/1060539/eu-tech-policy-harmful-ai-liability?ref=thenexusofprivacy.net) Melissa Heikkilä on MIT Technology Review (technologyreview.com) The new bill, called the AI Liability Directive, will add teeth to the EU’s [AI Act](https://www.technologyreview.com/2022/05/13/1052223/guide-ai-act-europe/?ref=thenexusofprivacy.net) and allow consumers to sue companies for damages—if they can prove that a company’s AI harmed them. Katyanna Quach's [Europe considers rules for easier AI compensation claims](https://theregister.com/2022/09/29/european%5Fcommission%5Fai%5Fliability?ref=thenexusofprivacy.net) has more. ### [AI Data Laundering: How Academic and Nonprofit Researchers Shield Tech Companies from Accountability](https://waxy.org/2022/09/ai-data-laundering-how-academic-and-nonprofit-researchers-shield-tech-companies-from-accountability?ref=thenexusofprivacy.net) Andy Baio on Waxy.org (waxy.org) Tech companies working with AI are outsourcing data collection and training to academic/nonprofit research groups, shielding them from potential accountability and legal liability. ### [Judge declares Buenos Aires’ Fugitive Facial Recognition System Unconstitutional](https://fpf.org/blog/judge-declares-buenos-aires-fugitive-facial-recognition-system-unconstitutional?ref=thenexusofprivacy.net) Maria Badillo on Future of Privacy Forum (fpf.org) On September 7, a trial judge declared the implementation of the Fugitive Facial Recognition System (SRFP, for its name in Spanish) by the Government of the City of Buenos Aires unconstitutional. The decision set an important precedent for risks associated with privacy and intimacy in public spaces. ## Post-Brexit privacy ### [Our plan for digital infrastructure, culture, media and sport](https://conservatives.com/news/2022/our-plan-for-digital-infrastructure--culture--media-and-sport?ref=thenexusofprivacy.net) Michelle Donelan, Secretary of State for Digital, Culture, Media and Sport, on the UK Conservative Party's web site (conservatives.com) Key point from a privacy perspective > We inherited GDPR from the EU, and its bureaucratic nature is still limiting the potential of our businesses.... That is why today Conference, I am announcing that we will be replacing GDPR with our own business and consumer-friendly, British data protection system.... No longer will our businesses be shackled by unnecessary red tape. ### [Peter Thiel’s Palantir Had Secret Plan to Crack UK’s NHS: ‘Buying Our Way In’](https://bloomberg.com/news/articles/2022-09-30/palantir-had-plan-to-crack-uk-health-system-buying-our-way-in?ref=thenexusofprivacy.net) Olivia Solon on bloomberg.com Palantir Technologies had a secret plan to deepen its relationship with the UK’s National Health Service without public scrutiny. The US data-analytics company aimed to buy up smaller rivals that already had an existing relationship with the NHS, according to emails and strategy documents seen by Bloomberg. This approach would hopefully allow Palantir to avoid further scrutiny in working with one of the largest depositories of health data. ### [Certainly uncertain – data protection reform developments](https://informationrightsandwrongs.com/2022/10/03/certainly-uncertain-data-protection-reform-developments?ref=thenexusofprivacy.net) Jon Baines on Information Rights and Wrongs (informationrightsandwrongs.com) In recent weeks the future of data protection law in the UK has been not just hard to predict, but also hard to keep up with. ## And ... #### [US expected to publish Privacy Shield executive order next week](https://politico.eu/article/us-expected-to-publish-privacy-shield-executive-order-next-week?ref=thenexusofprivacy.net) Vincent Manancourt on POLITICO (politico.eu) The order is designed to address European concerns over surveillance practices in the US. #### [Authors for Libraries](https://fightforthefuture.org/authors-for-libraries?ref=thenexusofprivacy.net) Fight for the Future (fightforthefuture.org) Hundreds of authors are speaking out on behalf of libraries, demanding that publishers and trade associations put the digital rights of librarians, readers, and authors ahead of shareholder profits. #### [Why Google Is Scrubbing Personal Info From Search Results (if You Ask)](https://gizmodo.com/google-search-results-scrub-phone-number-address-1849603859?ref=thenexusofprivacy.net) Jody Serrano on Gizmodo (gizmodo.com) Google’s public search liaison explained in a Q&A how the company attempted to balance users’ desire for privacy against providing information to the public. #### [FTC seeks more data on Amazon’s $1.7-billion deal for vacuum maker iRobot](https://reuters.com/markets/deals/ftc-seeks-more-data-amazons-17-bln-deal-vacuum-maker-irobot-2022-09-20?ref=thenexusofprivacy.net) Reuters (reuters.com) The U.S. Federal Trade Commission (FTC) has asked Amazon.com Inc and iRobot Corp for more information on the e-commerce giant’s $1.7-billion buyout of the Roomba vacuum maker. #### [Tunisia: Dangerous New Presidential Decree Legitimises Invasion Of Privacy, Criminalisation Of Dissidents](https://scoop.co.nz/stories/WO2209/S00171/tunisia-dangerous-new-presidential-decree-legitimises-invasion-of-privacy-criminalisation-of-dissidents.htm?ref=thenexusofprivacy.net) Scoop News (scoop.co.nz) Geneva – Tunisian President Kais Saied’s issuance of a new decree allowing security services to violate Tunisians’ digital privacy is reprehensible and opens the door wide to restricting media work and criminalising practices related to freedom of ... #### [Optus security breach compromises customers’ passport details](https://zdnet.com/article/optus-security-breach-compromises-customers-passport-details?ref=thenexusofprivacy.net) Eileen Yu on ZDNET (zdnet.com) Australian operator says it is investigating “unauthorised access” of personal data belonging to its current and former customers, including dates of birth, phone numbers, and passport numbers. #### [Online age verification: balancing privacy and the protection of minors ](https://cnil.fr/en/online-age-verification-balancing-privacy-and-protection-minors?ref=thenexusofprivacy.net) on Retourner à l’accueil CNIL.FR (cnil.fr) Online age verification: a complex issue with significant privacy risks Verifying the age of an Internet user is hampered by the difficulty for the various technical stakeholders on the Internet to really know who is the person behind the computer or smartphone. This need to identify Internet users… #### [Privacy Pledge signatories dream of alternative internet](https://computerweekly.com/news/252525237/Privacy-Pledge-signatories-dream-of-alternative-internet?ref=thenexusofprivacy.net) Alex Scroxton, on ComputerWeekly.com (computerweekly.com) A group of privacy-focused organisations have come together to establish a set of principles for taking the internet back from big tech and surveillance capitalisms #### [Optus cyber-attack: company opposed changes to privacy laws to give customers more rights over their data](https://theguardian.com/australia-news/2022/sep/24/optus-cyber-attack-company-opposed-changes-to-privacy-laws-to-give-customers-more-rights-over-their-data?ref=thenexusofprivacy.net) Josh Taylor on The Guardian (theguardian.com) In its submission to Privacy Act review telco said giving people right to erase personal data would involve ‘significant’ hurdles and costs #### [AI generated images face Getty ban as privacy and ownership concerns grow](https://pcgamer.com/ai-generated-images-face-getty-ban-as-privacy-and-ownership-concerns-grow?ref=thenexusofprivacy.net) Jacob Ridley on PC Gamer (pcgamer.com) The company believes AI generated images may lead to a legal challenge of some sort. #### [Google’s ads privacy lead on why it’s fighting to save the ad-funded internet](https://thedrum.com/opinion/2022/09/23/google-s-ads-privacy-lead-why-it-s-fighting-save-the-ad-funded-internet?ref=thenexusofprivacy.net) Claire Norburn on The Drum (thedrum.com) Digital advertising needs to be safer, but giving up on an ad-supported web entirely would be a mistake writes Google’s Claire Norburn. #### [Would you sell your data for profit? Nearly 50% of Americans said they would](https://techradar.com/news/would-you-sell-your-data-for-profit-nearly-50-of-americans-said-they-would?ref=thenexusofprivacy.net) Chiara Castro on TechRadar pro (techradar.com) Big tech companies already make a ton of money off your data #### [Uncommon Carriage](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4181948&ref=thenexusofprivacy.net) Blake E. Reid on SSRN (papers.ssrn.com) As debates over the regulation of “Big Tech” Internet platforms—social media, search, and more—have swirled, scholars, advocates, and policymakers have increasingly focused their attention on the law of common carriage. Common carriage law increasingly is invoked as a talisman to justify the imposition of non-discrimination rules on platforms targeted at both economic discrimination and content moderation. This Article challenges common carriage law’s coherence as a field and its utility for assessing contemporary Internet policy. #### [Visualizing the Length of the Fine Print, for 14 Popular Apps](https://visualcapitalist.com/terms-of-service-visualizing-the-length-of-internet-agreements?ref=thenexusofprivacy.net) Nicholas LePan on Visual Capitalist (visualcapitalist.com) We visualize the length of service agreements from popular apps, by counting the words and calculating how long it would take to read them. #### [You Have No Privacy—the Government Bought It From Big Tech](https://thedailybeast.com/you-have-no-privacy-the-government-already-bought-it-from-tech-companies?ref=thenexusofprivacy.net) Opinion on The Daily Beast (thedailybeast.com) Congress needs to put some meaningful guardrails on law enforcement’s ability to buy our data from private entities. #### [Indonesia Data Protection Law Includes Potential Prison Time, Asset Seizure, Right to Compensation for Data Breaches](https://cpomagazine.com/data-protection/indonesia-data-protection-law-includes-potential-prison-time-asset-seizure-right-to-compensation-for-data-breaches?ref=thenexusofprivacy.net) Scott Ikeda on CPO Magazine (cpomagazine.com) An Indonesia data protection law that has been in development since 2016 includes some of the harshest penalties yet seen in national data privacy regulations, along with a right to compensation for data breaches. #### [Tech firm touts new way to generate first-party data for agencies, publishers without privacy-compliance issues](https://digiday.com/marketing/this-tech-firm-found-a-new-way-to-generate-first-party-data-without-privacy-compliance-issues?ref=thenexusofprivacy.net) Michael Bürgi on Digiday (digiday.com) FullThrottle’s Audience Flume product has been in market for more than a year, but is just being formally rolled out. The company is still awaiting a formal patent. #### [Attorney general flags urgent privacy law changes after Optus data breach](https://theguardian.com/business/2022/sep/29/attorney-general-flags-urgent-privacy-law-changes-in-wake-of-optus-data-breach?ref=thenexusofprivacy.net) Paul Karp on The Guardian (theguardian.com) Mark Dreyfus indicates potential reforms to laws regarding data breaches including higher penalties, mandatory precautions and customer notifications #### [Privacy issue: SC to hear plea against WhatsApp’s policy in Jan](https://economictimes.indiatimes.com/tech/technology/privacy-issue-sc-to-hear-plea-against-whatsapps-policy-in-jan/articleshow/94526901.cms?ref=thenexusofprivacy.net) PTI on Economic Times (economictimes.indiatimes.com) A five-judge constitution bench headed by Justice K M Joseph asked the parties to complete pleadings in the matter by December 15. #### [Blocking annoying and privacy-harming cookie consent banners](https://brave.com/privacy-updates/21-blocking-cookie-notices?ref=thenexusofprivacy.net) on Brave Browser (brave.com) Recent versions of Brave on iOS include many new privacy features, ensuring that Brave iOS users have the strongest available protections of any iOS browser. #### [Rohingya seek reparations from Facebook for role in massacre](https://apnews.com/article/technology-business-bangladesh-myanmar-c5af9acec46a3042beed7f5e1bc71b8a?ref=thenexusofprivacy.net) BARBARA ORTUTAY on Associated Press (apnews.com) With roosters crowing in the background as he speaks from the crowded refugee camp in Bangladesh that’s been his home since 2017, Maung Sawyeddollah, 21, describes what happened when violent hate speech and disinformation targeting the Rohingya minority in Myanmar began to spread on Facebook. #### [Impact on Companies of California’s Children’s Privacy Law – Effective 2024](https://natlawreview.com/article/impact-companies-california-s-children-s-privacy-law-effective-2024?ref=thenexusofprivacy.net) Liisa M. Thomas on The National Law Review (natlawreview.com) The California governor recently signed into law the California Age-Appropriate Design Code Act, which will go into effect July 1, 2024\. The law applies to “businesses” (as defined by #### [Meta says ad-free Instagram client The OG App breaks its rules](https://techcrunch.com/2022/09/29/meta-says-ad-free-instagram-client-the-og-app-breaks-its-rules?ref=thenexusofprivacy.net) Ivan Mehta on TechCrunch (techcrunch.com) Apple removed The OG App, an ad-free Instagram client, from its App Store. Meanwhile, Meta says the app breaks its rules. #### [How to Advocate for Data Privacy and Users’ Rights](https://wired.com/story/how-to-advocate-your-tech-privacy?ref=thenexusofprivacy.net) Omar L. Gallaga on WIRED (wired.com) Want to speak up against Big Tech, unjust data collection, and surveillance? Here’s how to be an activist in your community and beyond. #### [Brands Review Data Privacy Policies After $1.2 Million Sephora Settlement](https://wsj.com/articles/brands-review-data-privacy-policies-after-1-2-million-sephora-settlement-11664272801?ref=thenexusofprivacy.net) Patrick Coffee on The Wall Street Journal (wsj.com) More marketers are taking notice of California’s data privacy laws after the state said last month that cosmetics retailer Sephora had agreed to pay $1.2 million in penalties for alleged violations related to its targeted advertising practices. #### [Privacy, security concerns prompt GAO to call for more telehealth oversight](https://scmagazine.com/analysis/privacy/privacy-security-concerns-prompts-gao-to-call-for-more-telehealth-oversight?ref=thenexusofprivacy.net) Jessica Davis on SC Media (scmagazine.com) A GAO audit of the Medicaid telehealth program found that more oversight is needed of how providers are communicating the privacy and security risks to patients. #### [Federal cybersecurity bill threatens privacy, transparency, civil society groups say](https://theglobeandmail.com/canada/article-federal-cybersecurity-bill-threatens-privacy-transparency-civil?ref=thenexusofprivacy.net) Jim Bronskill on The Globe and Mail (theglobeandmail.com) In an open letter to Public Safety Minister Marco Mendicino, the groups call for substantive amendments to ensure the legislation delivers effective cybersecurity protections while respecting democratic principles #### [Modeling the Privacy Catwalk: Practical Steps Forward](https://jdsupra.com/legalnews/modeling-the-privacy-catwalk-practical-9258478?ref=thenexusofprivacy.net) Carolina Alonso on JD Supra (jdsupra.com) What’s Trending? (Privacy a la Mode) - Notable fashion brands have been engaging in a “trial period” of new technologies as privacy laws and privacy enforcement are trending – for example, exploring integrating branding into digital assets in video games, virtual reality (VR) and augmented reality (AR) technology, metaverses, and non-fungible tokens (NFTs). Fashion naturally pushes the envelope, taking on risks in the interest of not being left behind and losing relevancy and notoriety. This brings about several legal issues, such as those arising from trademark infringement by NFT creators, as well as marketing collaborations as influencers are becoming an essential component of a brand’s commercial success. #### [Tunisia: Dangerous New Presidential Decree Legitimises Invasion Of Privacy, Criminalisation Of Dissidents](https://scoop.co.nz/stories/WO2209/S00171/tunisia-dangerous-new-presidential-decree-legitimises-invasion-of-privacy-criminalisation-of-dissidents.htm?ref=thenexusofprivacy.net) on Scoop News (scoop.co.nz) Geneva – Tunisian President Kais Saied’s issuance of a new decree allowing security services to violate Tunisians’ digital privacy is reprehensible and opens the door wide to restricting media work and criminalising practices related to freedom of opinion, expression, and publication, Euro-Med Monitor said in a statement. --- Image Credit: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [*Picpedia*](https://www.picpedia.org/highway-signs/p/privacy.html?ref=thenexusofprivacy.net). ### "White Man's Gambit": yet another 'pundit' suggests a real names policy URL: https://thenexusofprivacy.net/white-mans-gambit-and-real-names-policy/ Last updated: 2026-04-16T02:49:40.000Z > "Every few weeks or so, some~~one~~ white dude suggests that the way to solve all of our online problems is to require users to submit ID verification and use their “real names,” ignoring years of research and commentary. > > This is what I like to call the White Man’s Gambit." > > – Jillian C. York, [Everything Old is New Part 2: Why Online Anonymity Matters](https://jilliancyork.com/2021/01/14/everything-old-is-new-part-2-why-online-anonymity-matters/?ref=thenexusofprivacy.net) (2021) Yeah really. York's got a very solid list of references, including her own [A Case for Pseudonyms](https://www.eff.org/deeplinks/2011/07/case-pseudonyms?ref=thenexusofprivacy.net) on the EFF blog from 2011, J. Nathan Matias outstanding 2017 [The Real Name Fallacy](https://coralproject.net/blog/the-real-name-fallacy/?ref=thenexusofprivacy.net), Oliver L. Haimson and Anna Lauren Hoffmann [Constructing and enforcing ‘authentic’ identity online: Facebook, real names, and non-normative identities](https://journals.uic.edu/ojs/index.php/fm/article/download/6791/5521?ref=thenexusofprivacy.net) from 2016, danah boyd's ‘[Real Names’ Policies are an Abuse of Power](http://www.zephoria.org/thoughts/archives/2011/08/04/real-names.html?ref=thenexusofprivacy.net) from 2011, This time the white dude making the [suggestion](https://twitter.com/profgalloway/status/1576186415473303554?ref=thenexusofprivacy.net) was Scott Galloway, an NYU marketing professor best known for doing the [Pivot podcast](https://podcasts.voxmedia.com/show/pivot?ref=thenexusofprivacy.net) with Kara Swisher. Galloway does acknowledges that he's not the first white guy to suggest this: > "Verifying online identity is not a new idea — it was actually the original plan.\*\* For years, Facebook demanded its users go by their “authentic name.” Google had a real-name policy for its (now abandoned) Google+ social network. What happened? Google’s policy was described as [“evil,”](https://gizmodo.com/googles-real-names-policy-is-evil-5830471?ref=thenexusofprivacy.net)[“dangerous,”](https://slate.com/technology/2014/07/google-plus-finally-ditches-its-ineffective-dangerous-real-name-policy.html?ref=thenexusofprivacy.net) an [“abuse of power.”](http://www.zephoria.org/thoughts/archives/2011/08/04/real-names.html?ref=thenexusofprivacy.net) Facebook’s was criticized for being [racist and transphobic](https://www.engadget.com/2015-06-01-facebook-real-name-policy-protest.html?ref=thenexusofprivacy.net). " Galloway even agrees that these are real issues. He just thinks that "these concerns can be addressed." Really? > "This will not solve it. The end." > > – Dr. Sarah J. Roberts, content moderation expert, author of [Behind the Screen](https://www.behindthescreen-book.com/?ref=thenexusofprivacy.net), and co-director of the UCLA Center for Critical Internet Inquiry > "Scott is ignoring the fact that every study ever done has found that online abuse is more severe, more pervasive, and has greater offline impact when someone is using a verified identity vs persistent pseudonymity." > > – [Denise Paolucci](https://twitter.com/rahaeli/status/1576425884722012161https://twitter.com/rahaeli/status/1576432194930745344?ref=thenexusofprivacy.net), founder of Dreamwidth Indeed. Paolucci included a link to Katja Rost, Lea Stahel, and Bruno S. Frey's 2016 [Digital Social Norm Enforcement: Online Firestorms in Social Media](https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0155923&ref=thenexusofprivacy.net). In [another thread](https://twitter.com/rahaeli/status/1576425884722012161?ref=thenexusofprivacy.net), she shared a Alfred Moore's late-2021 [Online anonymity: study found ‘stable pseudonyms’ created a more civil environment than real user names](http://theconversation.com/online-anonymity-study-found-stable-pseudonyms-created-a-more-civil-environment-than-real-user-names-171374?ref=thenexusofprivacy.net). Other studies in York's short list, or the more detailed bibiliographies in Matias', Hamson's, and Hoffman's paper, reached the same conclusion. ### Real names policies don't help prevent abuse, harassment, or trolling. > "This is a really bad idea and has been proven to be a bad idea repeatedly. Why it reemerges persistently in the face of significant evidence is the question we should focus on. Whom does it serve to frame the problem this way?" > > – [Meredith Whitaker](https://twitter.com/mer%5F%5Fedith/status/1576596971099664384?ref=thenexusofprivacy.net), CEO of Signal Good question. Let's hear from some of the critics of real names policies. > "Read about what happened to journalists, women, LGBTQ folks, and marginalized groups more broadly, during the NYMWARS ten years ago." > > – opensourceress [Aeva Black](https://twitter.com/aevavoom/status/1576591780581380098?ref=thenexusofprivacy.net) Good suggestion. [Nymwars!](http://www.talesfromthe.net/jon/?p=2948&ref=thenexusofprivacy.net), from my old blog *Liminal States*, has a bunch of quotes from back in the day.\* Here's a few: ![Quotes from Kathy Sierra, Caterina Fake, Denise Paolucci, Latoya Petersen, s.e. smith, Newsinchin_tweeter, and danah boyd. See the linked article for the full quotes.](https://thenexusofprivacy.net/content/images/2022/10/Screen-Shot-2022-10-02-at-10.46.38-PM.png) Here's some more recent quotes, in response to Galloway's article: > "This path always ends in harassment and stalking for marginalized people. Especially those that are feminine presenting & not white." > > – [Mikki Kendall](https://twitter.com/Karnythia/status/1576720065747034113?ref=thenexusofprivacy.net), author of [Hood Feminism ](https://www.npr.org/2020/02/26/808943234/hood-feminism-is-a-call-for-solidarity-in-a-less-than-inclusive-movement?ref=thenexusofprivacy.net) > "Inhibiting anonymity / obligating use of real names, does little to inhibit abuse, but it DOES boost disenfranchisement & censorship of the poor & less able" > > – [former Facebook engineer Allen Muffet](https://twitter.com/AlecMuffett/status/1576309305950629894?ref=thenexusofprivacy.net) > "this is a really great idea except for the tiny little issues that it'll hurt a lot of vulnerable people and that it won't alleviate the moderation issues naive people generally think they're addressing. > > really great. just those caveats. otherwise, great idea." > > – [Ali Alkhatib](https://twitter.com/%5Falialkhatib/status/1576711523481047041?ref=thenexusofprivacy.net), Director of the Center for Applied Data Ethics at the University of San Francisco. Hey wait a second, I'm noticing a pattern here. Geek Feminism's [Who is harmed by a “Real Names” policy?](https://geekfeminism.fandom.com/wiki/Who%5Fis%5Fharmed%5Fby%5Fa%5F%22Real%5FNames%22%5Fpolicy%3F?ref=thenexusofprivacy.net) list goes into more detail about how these policies impact women; LGBTAIQ2S+ people\*\*\*; victims of real-world abuse and harassment (who often need pseudonyms to protect themselves); people whose names subject them to discrimination based on race, religion, cultural and/or socio-economic bias; and other marginalized groups.\*\*\*\* So it seems to me the answer to Whitaker's question is pretty straightforward. > **When the "real names" idea reemerges persistently in the face of significant evidence that it's a bad idea, it serves the interests of those who want to harm women, LGBTAIQ2S+ people, victims of real world abuse and harassment, people whose names subject them to discrimination based on race, religion, cultural and/or socio-economic bias, and other marginalized groups.** Of course, people like Galloway who aren't the ones who will be harmed and keep suggesting the idea probably don't see it that way. How convenient for them. --- \* And if you're reallllly interested in the nymwars and Google+, here's my 11-part series: [*A Work in Progress*](http://talesfromthe.net/jon/?p=2906&ref=thenexusofprivacy.net)*,* [*Why it matters*](http://talesfromthe.net/jon/?p=2918&ref=thenexusofprivacy.net)*,* [*#nymwars!*](http://talesfromthe.net/jon//?p=2948&ref=thenexusofprivacy.net)*,* [*A tale of two searches*](http://talesfromthe.net/jon/?p=2976&ref=thenexusofprivacy.net)*,* [*The double bind of oppression*](http://talesfromthe.net/jon/?p=2990&ref=thenexusofprivacy.net)*,* [*Anxious masculinity under threat*](http://talesfromthe.net/jon/?p=3023&ref=thenexusofprivacy.net), [*Still a Ways to Go*](http://talesfromthe.net/jon/?p=3033&ref=thenexusofprivacy.net)*,* [*Booberday*](http://talesfromthe.net/jon/?p=3083&ref=thenexusofprivacy.net)*,* [*Talk about a hostile environment*](http://talesfromthe.net/jon/?p=3137&ref=thenexusofprivacy.net)*,* [*The Trend is in the Wrong Direction*](http://www.talesfromthe.net/jon/?p=3157&ref=thenexusofprivacy.net), *and* [*In Chaos There Is Opportunity*](http://www.talesfromthe.net/jon/?p=3163&ref=thenexusofprivacy.net)*.* \*\* Wait a second, does Galloway really think that internet history started with Google+ in 2011 and the 2015 [victory for drag queens as Facebook apologises for ‘real-name’ policy](http://www.theguardian.com/technology/2014/oct/01/victory-drag-queens-facebook-apologises-real-name-policy?ref=thenexusofprivacy.net)? Kids today! Meanwhile, back on planet earth, here's how things really looked in 1993. ![A dog at a computer, saying to another dog, "On the Internet, nobody knows you're a dog."](https://thenexusofprivacy.net/content/images/2022/10/Internet_dog.jpg) Peter Steiner's New Yorker cartoon: [On the Internet, nobody knows you’re a dog](https://en.wikipedia.org/wiki/On%5Fthe%5FInternet,%5Fnobody%5Fknows%5Fyou%27re%5Fa%5Fdog?ref=thenexusofprivacy.net) \*\*\* I'm using LGBTAIQ2S+ as a shorthand for lesbian, gay, gender non-conforming, genderqueer, bi, trans, asexual, agender, intersex, queer, questioning, [two-sprit](https://oacas.libguides.com/sogie/two-spirit?ref=thenexusofprivacy.net), and others who are not straight, cis, or heteronormative. [Julia Serrano's trans, gender, sexuality, and activism glossary](https://www.juliaserano.com/terminology.html?ref=thenexusofprivacy.net) has definitions for most of terms, although resources like [OACAS Library Guides' Two-spirit identities page](https://oacas.libguides.com/sogie/two-spirit?ref=thenexusofprivacy.net) go into a lot more detail. Serrano also discusses the tensions between ever-growing and always incomplete acronyms and more abstract terms like "gender and sexual minorities". \*\*\*\* Galloway links to the Geek Feminism page, so he knows how harmful is suggestions are to women, LGBTAIQ2S+ people, and so on. Apparently he thinks it's enough to say that "these problems can be addressed" without saying how. Kara Swisher, if you happen to see this, would you please put him on the spot for this on one of your podcasts? Thanks! Image credits: - "Exhausted, frustrated" by [**mohamed\_hassan**](https://pxhere.com/en/photographer/767067?utm%5Fcontent=clipUser&utm%5Fmedium=referral&utm%5Fsource=pxhere) from [**PxHere**](https://pxhere.com/en/photo/1638940?utm%5Fcontent=clipUser&utm%5Fmedium=referral&utm%5Fsource=pxhere) - [On the Internet, nobody knows you’re a dog](https://en.wikipedia.org/wiki/On%5Fthe%5FInternet,%5Fnobody%5Fknows%5Fyou%27re%5Fa%5Fdog?ref=thenexusofprivacy.net), by Peter Steiner, 1993, originally published in the New Yorker. ### Comments For Impact: Using FTC Rulemaking to Challenge Commercial Surveillance and Consumer Data Abuses URL: https://thenexusofprivacy.net/comments-for-impact/ Last updated: 2026-04-16T02:49:13.000Z The next Disinfo Defense League training is on **Tuesday, October 4, at 9:00 am Pacific Time (12:00 noon Eastern)**. The session is open to the public and will help organizations consider how to get involved in this exciting process. RSVP at [bit.ly/CommentsForImpact](https://bit.ly/CommentsForImpact?ref=thenexusofprivacy.net) From the description: > Big news: the Federal Trade Commission has announced it will begin a rulemaking process to consider new trade regulation rules on how companies collect, retain, and share our data. The agency is requesting comments from the public on the prevalence of commercial surveillance and data security practices that harm consumers. This is a huge step towards realizing greater protections for privacy and civil rights! It also presents an opportunity for civil society and grassroots organizations throughout the US to make our voices heard in the process. > > Join the Disinfo Defense League and Free Press Action for a virtual training on how to engage with the Federal Trade Commission’s privacy rulemaking. The session is open to the public and will help organizations consider how to get involved in this exciting process. We will be joined by Nora Benavidez from Free Press Action and Caitlin Seeley George from Fight For The Future, who will walk attendees through different ways to activate their memberships and organizations. Any and all are welcome. > > Join us to discuss concrete, accessible avenues for engagement ranging from grassroots storytelling to mechanics of how to submit a formal comment to the FTC. ### Federal privacy legislation: a quick ADPPA roundup URL: https://thenexusofprivacy.net/federal-privacy-legislation-adppa-roundup/ Last updated: 2026-04-16T02:48:35.000Z > One of Big Tech's favorite tactics in their incessant attempts to pass weak privacy here in Washington state has been to try to push a "compromise" bill through at the very end of the session.... So it wouldn't surprise me if there are still some shenanigans in store for ADPPA. > > – [Who could have predicted? A potential “new compromise” for ADPPA!](https://thenexusofprivacy.net/adppa-new-compromise/), September 12 > The House Energy and Commerce Committee is considering new consumer privacy legislation that would allow Americans greater control over who can access their personal information online. On Thursday, Sept. 29 at 11:00 a.m. ET, join The Post’s Leigh Ann Caldwell for a conversation with the committee’s chair Rep. Frank Pallone Jr. (D-N.J.) and ranking member Rep. Cathy McMorris Rodgers (R-Wash.), about the prospects for a bipartisan bill and the future of tech regulation. > > Watch live: [washingtonpost.com/acrosstheaislesept29](https://washingtonpost.com/acrosstheaislesept29?ref=thenexusofprivacy.net) > > – [Across the Aisle](https://acrosstheaislesept29.splashthat.com/?ref=thenexusofprivacy.net) with Leigh Ann Caldwell After Energy and Commerce advanced the bipartisan American Data Privacy and Protection Act (ADPPA) by a 53-2 vote in July, hopes were high that it would move to the House floor quickly before the August recess ... but no. By the time the House returned to DC in September, House Speaker Nancy Pelosi's firm pre-Labor Day statement that she wouldn't support a bill that preempts California's laws made it clear that ADPPA's supporters claims of a "consensus" that ADPPA is the best thing since sliced bread are ... exaggerations. Who could have predicted? So with the House once again about to leave DC (Friday is their last scheduled day in session until after the midterms), it'll be interesting to see what Reps. Pallone and McMorris Rodgers have to say. Pass the popcorn! ***UPDATE: well, that was a nothingburger – here's the*** [***video***](https://www.youtube.com/watch?v=g-XGGw5I9ig&ref=thenexusofprivacy.net)***, my*** [***live-tweeting thread***](https://twitter.com/NexusOfPrivacy/status/1575502141221138432?ref=thenexusofprivacy.net)***, and*** [***an "unrolled" version***](https://threadreaderapp.com/thread/1575498837556613128.html?ref=thenexusofprivacy.net) ***of the thread. Key takeaway: Pallone says there's still time to pass ADPPA after the election, and expressed optimism (which of course he has to).*** And to whet everybody's appetite, here's a quick look at five recent ADPPA-related articles. > If you want to see some of my other posts on ADPPA, check out the [federal privacy legislation](https://thenexusofprivacy.net/tag/federal-privacy-legislation/) section of The Nexus of Privacy. ### [California leads the nation in privacy protections. Congress wants to end that](https://www.sfchronicle.com/opinion/openforum/article/California-privacy-protection-congress-17460796.php?ref=thenexusofprivacy.net) Jennifer M. Urban on San Francisco Chronicle (sfchronicle.com) Prof. Urban is the Chair of California Privacy Protection Agency (CPPA), which is already on record as opposing ADPPA's preemption of state laws, so it's not like anything she says here is a surprise. Still, she says it well! One important point she makes: it's not just the California Consumer Privacy Act (CCPA) that would be preempted: > \[B\]y preempting state laws related to consumer privacy, the ADPPA would also prohibit states from acting to protect their residents from future threats. Privacy issues arise quickly, and states can experiment more nimbly, and reflect their residents’ concerns more directly, than Congress can. If passed, the ADPPA would likely be outdated before it goes into effect. Meanwhile, states have been extremely active. Maine [adopted](https://www.cnet.com/tech/tech-industry/maine-governor-signs-internet-privacy-protection-bill/?ref=thenexusofprivacy.net) landmark broadband privacy rules in 2019\. [Colorado](https://leg.colorado.gov/sites/default/files/2021a%5F190%5Fsigned.pdf?ref=thenexusofprivacy.net) and [Connecticut](https://portal.ct.gov/Office-of-the-Governor/News/Press-Releases/2022/06-2022/Governor-Lamont-Signs-Legislation-Enacting-a-Comprehensive-Consumer-Data-Privacy-Law?ref=thenexusofprivacy.net) have adopted comprehensive commercial privacy laws that go into effect in 2023\. [Washington](https://iapp.org/news/a/unpacking-washington-states-cluster-of-comprehensive-privacy-bills/?ref=thenexusofprivacy.net) and [Oregon](https://www.doj.state.or.us/oregon-department-of-justice/office-of-the-attorney-general/spotlight-privacy/?ref=thenexusofprivacy.net) have been working on draft privacy legislation for years. And in recent weeks, the California Legislature advanced [legislation](https://www.sfchronicle.com/tech/article/California-just-passed-a-pair-of-online-safety-17407760.php?ref=thenexusofprivacy.net) to protect children’s privacy\* and to strengthen laws regarding [in-car cameras](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill%5Fid=202120220SB346&ref=thenexusofprivacy.net) and [smart speakers](https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill%5Fid=202120220AB1262&ref=thenexusofprivacy.net). Yeah really. As Washington state Indivisibles said in a [June 13 letter to Rep. McMorris Rodgers and Senator Maria Cantwell](https://indipluswa.medium.com/indivisible-letter-to-sen-cantwell-and-rep-mcmorris-rodgers-on-federal-privacy-legislation-8071ba1d350e?ref=thenexusofprivacy.net): > Indivisibles have invested a lot of time and energy working with state legislators, the Tech Equity Coalition, and WA People’s Privacy Network on privacy legislation over the last several years.... So it is extremely important to us that federal legislation does not preempt Washington state’s own future privacy legislation. Thanks to the years of work legislators, civil rights and community groups, and tech companies have done on privacy, we believe we are likely to pass strong legislation in 2023\. While we appreciate the work that ADPPA has done to explore a “partial preemption” approach, we would prefer the clarity and simplicity of a bill that is fully non-preemptive. ### [State views on proposed ADPPA preemption come into focus](https://iapp.org/news/a/state-level-views-on-proposed-adppa-preemption-come-into-focus/?ref=thenexusofprivacy.net) Joe Duball on International Association of Privacy Professionals (iapp.org) In [People in other states and cities have opinions on preemption too!](https://thenexusofprivacy.net/adppa-new-compromise/#people-in-other-states-and-cities-have-opinions-on-preemption-too) I observed that "all the focus on *California*'s opinion about preemption of their state law frames it as California just being selfish, and obscures both the breadth of the opposition and ADPPA's preemption of local laws," so it's great to see some other perspectives get some coverage. Duball has perspectives from three state legislators - Sen. James Maroney, lead sponsor of Connecticut's privacy law, who "called back instead to California lawmakers' proposal for a federal floor from which states can build." - Rep. Collin Walke, co-sponsor of Oklahoma's privacy bill, who believes that the better route would be "to set a federal floor, not a ceiling." - Sen. Reuven Carlyle, primary sponsor of the Bad Washington Privacy Act, who says "We need to ensure the floor of the protections the federal government might establish are genuine, meaningful and compelling."\*\* Duball also mentions and links to the [July 19 coalition letter from 11 state Attorneys General](https://oag.ca.gov/system/files/attachments/press-docs/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf?ref=thenexusofprivacy.net), which encouraged Congress to "adopt legislation that sets a federal floor, not a ceiling." Hey wait a second, I'm noticing a pattern here!\*\*\* Unfortunately Duball doesn't quote anybody on ADPPA's preemption of local laws, and he doesn't bring up any issues from the states other than preemption. For example: - the July 19 AG coalition letter noted that a clause in ADPPA causes problems for many ability to investigate and [“unnecessarily interferes with robust enforcement capabilities.”​​](https://oag.ca.gov/system/files/attachments/press-docs/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf?ref=thenexusofprivacy.net) - Washington's AG Bob Ferguson's [June 24 letter](https://www.documentcloud.org/documents/22111995-ferguson-privacy-letter-to-4-corners%5F6-24-2022?ref=thenexusofprivacy.net) objected to the lack of whistleblower protections, and highlighted a loophole that "may be used by technology companies to maintain all data indefinitely" and "will undermine the entire purpose of data privacy legislation" So while there's some useful information here, at the end of the day it's yet another example of the pattern I mentioned in [Can we talk about something besides preempting California for a second?](https://thenexusofprivacy.net/adppa-new-compromise/#can-we-talk-about-something-besides-preempting-california-for-a-second): > There’s been so much focus on preemption and California that a lot of other important questions about ADPPA haven’t gotten a lot of airtime, starting with one that's top of mind for a lot of people right now. > > **Does ADPPA protect against post-Roe threats to privacy?** Probably not. [ADPPA's failure to protect against post-Roe privacy threats](https://nexusofprivacy.net/adppa-post-roe-threats/?ref=thenexusofprivacy.net) goes into more detail on that, and [A few more topics that could use a lot more discussion](https://thenexusofprivacy.net/adppa-new-compromise/#a-few-more-topics-that-could-use-a-lot-more-discussion) list of some of the other issues with ADPPA. ### [Reviewing the House Committee changes to the proposed ADPPA](https://iapp.org/news/a/reviewing-the-house-committee-changes-to-the-proposed-american-data-privacy-and-protection-act/?ref=thenexusofprivacy.net) Amy Olivero on International Association of Privacy Professionals (iapp.org) IAPP Westin Research Fellow Olivero breaks down the changes to the draft American Data Privacy and Protection Act (ADPPA). There's some useful information here, although it's worth mentioning that both the description of the changes and the chart at the bottom makes ADPPA look stronger than it really is. For example, - the list of changes is at a very high level. While this improves readability, it also creates a very false impression by omitting[ many important changes that significantly weakened the bill](https://thenexusofprivacy.net/what-about-the-elephant/#weakening). - the chart helpfully provides information on how long covered entities of different sizes have to respond to access, correction, and deletion requests – but it leaves out the fact that they also get an automatic 45-day exemption. - the chart accurately notes that service providers and businessess with less than $250,000,000 annual revenue are subject to ADPPA's civil rights protections (Section 207(a)) – but omits the fact that they're exempt from the requirement to do algorithmic impact assessments (Section 207(b)) . ### [Readout from a Congressional Data Privacy and Security Briefing](https://www.rstreet.org/2022/09/26/readout-from-a-congressional-data-privacy-and-security-briefing/?ref=thenexusofprivacy.net) Brandon Pugh on R Street (rstreet.org) R Street's briefing to congressional staffers featured ADPPA co-sponsor Pallone and a panel of supporters of ADPPA: Brandon Pugh of the R Street Institute, Paul Lekas of the Software & Information Industry Association (SIIA), Sara Collins of Public Knowledge and Yosef Getachew of Common Cause. As with Urban's op-ed, nothing they say is surprising, but it's still useful to see the talking points they're using. For example: > An attendee raised California’s concerns with preemption, especially as House Speaker Nancy Pelosi (D-Calif.) said work is needed to address outstanding concerns. Panelists’ responses to this included reflecting on the changes to the ADPPA to account for the California Privacy Protection Agency; providing a role in enforcement for states; the ADPPA being stronger in multiple areas like civil rights; and providing rights for all Americans. Cool! Except that the reality is ... - The CPPA has all kinds of problems with the current version of the CPPA - State AG's object to ADPPA's barriers to their enforcement. - ADPPA's civil rights protections are certainly a good thing, but [ADPPA’s algorithmic impact assessments are currently too weak to protect civil rights ](https://thenexusofprivacy.net/adppa-impact-assessments-and-civil-rights/) - [There are a lot of other areas where ADPPA is weaker than California's](https://www.caprivacy.org/letter-to-speaker-nancy-pelosi-opposing-adppa/?ref=thenexusofprivacy.net) or [Maine's](https://www.eff.org/document/2022-07-13-letter-maine-ag-congress-re-adppa?ref=thenexusofprivacy.net) current privacy laws. - As for "all Americans", [sexual orientation has now been removed from the definition of "sensitive data," and sex and gender were never included](https://twitter.com/wapeopleprivacy/status/1559999090917720064?ref=thenexusofprivacy.net), and that's only one of the problems from an LGBTAIQ2S+ perspective ([Stress-testing ADPPA with a queer lens](https://thenexusofprivacy.net/adppa-with-a-queer-lens/)) ... plus of course there's the elephant. I wonder which of those they talked about in the briefing? ### [Notes from the IAPP, Sept. 23, 2022](https://iapp.org/news/a/notes-from-the-iapp-sept-23-2022/?ref=thenexusofprivacy.net) Joe Duball on International Association of Privacy Professionals (iapp.org) What if ADPPA doesn't pass this session? In Duball's view, bipartisanship in the House is "stymied" by Democrats' "reluctance, mostly on the part of the California delegation, to move forward with preemption." That's certainly one way to look at it. As I said in "[Tweaking" the "grand bargain"](https://thenexusofprivacy.net/adppa-new-compromise/#tweaking-the-grand-bargain) > ADPPA's supporters have argued that they only way to get federal privacy legislation is a “[grand bargain](https://twitter.com/privacypen/status/1549237595418365952?ref=thenexusofprivacy.net)”: > > \* Republicans will support providing some protections to cis straight non-pregnant people all over the country; something called a "private right of action" that people have to jump thrugh hoops to use and doesn't have statutory damages; and exemptions for government contractors > > \* In return, Democrats will agree states can't provide stronger protections to their residents; AGs and privacy agencies will have a hard time enforcing the law; forced arbitration and a right to cure that can prevent people from suing; and California will give up legislation that had been passed by a referendum in 2020. So yeah, not going along with the "bargain" does "stymie" this approach to bipartisanship. And Duball points out that current projections are for Republicans to take the House. > So in a perfect world, McMorris Rodgers and fellow Republicans working on the bill will use their new majority status to implore a Republican House Speaker to bring this current version of the bill, which a majority of Democrats support, to the floor. It's certainly a possibility. That said, there are some major caveats. - Let's start with the elephant. In a post-Roe world, will a majority of Democrats really support legislation that [fails to protect pregnant people](https://nexusofprivacy.net/adppa-post-roe-threats/?ref=thenexusofprivacy.net)? - Would the majority of the 175 Democratic members of the LGBTQ Equality Caucus really support a bill that [puts LGBTAIQ2S+ people at risk](https://thenexusofprivacy.net/adppa-with-a-queer-lens/)? - And in any case, even in Duball's "perfect world" where House Democrats throw pregnant people and LGBTAIQ2S+ people under the bus to pass a corporate-friendly privacy bill, he admits > \[P\]assing the ADPPA through the House doesn't resolve issues in the Senate, where Democrats could retain control and uphold their own discrepancies with the proposal. So unless Republicans take both chambers, never mind. That said, it's certainly worth thinking about what happens if ADPPA doesn't pass. As I said in [Democrats have other options](https://thenexusofprivacy.net/adppa-new-compromise/#democrats-have-other-options), > \[D\]epending on the November results, it could be a different story in Congress next session. If the Democrats pick up a couple of seats in the Senate and hold the House, they might well remove the filibuster for abortion-related legislation. > > Everybody agrees that the Supreme Court's Dobbs decision ending Roe has changed the political landscape when it comes to privacy. Let's hope Democrats seize the opportunity. ### --- \* How much of California's recently-passed Age-Appropriate Design Code does ADPPA preempt? IAPP's Cobun Zweifel-Keegan, who recently wrote about the Age-Appropriate Design Code in [The future of youth privacy is here](https://iapp.org/news/a/the-future-of-youth-privacy-is-here/?ref=thenexusofprivacy.net), says "[Great question. I think that one is open for debate.](https://twitter.com/cobun/status/1574858476693688324?ref=thenexusofprivacy.net)" Hmm. Am I the only one who thinks it'd be nice to have a definitive answer to that before legislators vote on the bill? \*\* [I don't always agree with Sen. Carlyle](https://www.seattletimes.com/opinion/pro-the-washington-privacy-act-empowers-consumers-to-retake-control-of-their-identity-online-in-our-data-fueled-economy/?commentID=3614fdbb-2cae-44ff-85b6-97e6a7fd4c53&ref=thenexusofprivacy.net) but he's on-target with this: > The ADPPA is "not going to be tinkered with in a meaningful way for a decade or generation. We are living with it because of the general dynamic for how Congress works," Carlyle said. Daniel Solove's [A Faustian Bargain: Is Preemption Too High a Price for a Federal Privacy Law?](https://teachprivacy.com/a-faustian-bargain-is-preemption-too-high-a-price-for-a-federal-privacy-law?ref=thenexusofprivacy.net) makes a similar point. \*\*\* Duball actually understates the breadth of opposition: he doesn't mention the letters from [Maine's AG ](https://www.eff.org/document/2022-07-13-letter-maine-ag-congress-re-adppa?ref=thenexusofprivacy.net)and [Washington Indivisible groups](https://indipluswa.medium.com/indivisible-letter-to-sen-cantwell-and-rep-mcmorris-rodgers-on-federal-privacy-legislation-8071ba1d350e?ref=thenexusofprivacy.net) opposing preemption, or the [comments from Maya Morales of WA People's Privac](https://wapeoplesprivacy.org/our-public-comment-in-historic-ccpa-meeting/?ref=thenexusofprivacy.net)y at the CPPA Board meeting opposing preemption. --- *Image credit:* JessicaRodriguezRivas, via [Wikipedia Commons](https://commons.wikimedia.org/wiki/File:Home%5Fof%5Fthe%5FUS%5FCongress.jpg?ref=thenexusofprivacy.net). licensed under the [Creative Commons](https://en.wikipedia.org/wiki/en:Creative%5FCommons?ref=thenexusofprivacy.net)[Attribution-Share Alike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net) license. ### Surveillance cameras in New York subway cars: Whose voices are heard? URL: https://thenexusofprivacy.net/surveillance-cameras-in-new-york-subway-cars/ Last updated: 2026-04-16T02:48:08.000Z *This was originally published as part of the* [*September 26 Privacy News*](https://thenexusofprivacy.net/privacy-news-september-26/)*, but it's long enough that it deserves its own post.* ### [The ‘Surveillance Solutionism’ of Putting Cameras in NYC Subways](https://www.wired.com/story/the-surveillance-solutionism-of-putting-cameras-in-nyc-subways/?ref=thenexusofprivacy.net) Alfred Fox Cahn, Wired (wired.com) > “You think Big Brother’s watching you on the subways?” New York Governor Kathy Hochul said at a news conference at a Queens subway yard on September 20\. “You’re absolutely right.” The proclamation came amid her announcement of a new state program to pay for two cameras in each of the city’s more than 6,400 subway cars. Hochul was very explicit about the goal: "we’re going to be having surveillance of activity on the subway trains, and that’s going to give people great ease of mind.” New York's subway ridership is down 25-40% since the pandemic, and some polls suggest fear of crime is one of the reasons. As Cahn, founder of STOP (Surveillance Technology Oversight Project) points out, though, [surveillance cameras don't actually decrease crime](https://core.ac.uk/download/pdf/232684543.pdf?ref=thenexusofprivacy.net). Case in point: > In recent years, the transit agency has spent tens of millions of dollars on cameras for every subway entrance. But when a deranged man opened fire on a packed subway car in April, [the cameras didn’t work.](https://nypost.com/2022/04/14/mta-ceo-janno-lieber-blames-subway-shooting-camera-fail-on-bad-internet-connection/?ref=thenexusofprivacy.net) In the aftermath, as the MTA and NYPD tried to throw each other under the bus for the failure, neither agency was willing to question their premise that the cameras were needed in the first place. This story got a lot of attention, and it's interesting to look at the various coverage. Who simply includes talking points from Gov. Hochul and her allies? Who includes perspectives from civil rights and civil liberties perspectives questioning the value of surveillance ? Which experts are quoted? For example, Black Star News' [CPR Denounces NYPD’s Expansion of Policing, Surveillance In Subway](https://www.blackstarnews.com/ny-watch/transit/cpr-denounces-nypds-expansion-of-policing-surveillance-in-subway?ref=thenexusofprivacy.net) quotes Communities United for Police Reform (CPR) spokesperson Darian X, Lead Campaign Organizer with Brooklyn Movement Center: > "While this Mayoral administration is convinced that using decades-old failed Broken Windows policing strategies like increased surveillance and stops will provide safety, New Yorkers of color - particularly Black & Latinx New Yorkers - know all too well that these tactics only lead to police abuse and harassment, and increase the potential for encounters to escalate to brutality and even killing of New Yorkers they claim to be protecting.... > > Instead of fixing our crumbling subway infrastructure, restoring resources for education, housing and health services and ensuring infrastructure improvements, the Mayor has decided to invest into a dangerous attack on the city's most vulnerable communities. This expansion of police and cameras throughout our city and on our subways will only multiply the harm that the NYPD can do to New Yorkers who are just going about their daily lives. We have been down this road, and it leads to a dead-end with more harm and violence, not less." Yeah really. But Darian X isn't quoted in any of the other coverage – and neither are any other POC experts. Funny how that works. Here's a look at eight other articles and who they quote. - [MTA to install 2 surveillance cameras on every subway car](https://gothamist.com/news/mta-to-install-2-surveillance-cameras-on-every-subway-car?ref=thenexusofprivacy.net), Stephen Nessen, Gothamist (gothamist.com), with quotes from Daniel Schwartz of New York Civil Liberties Union (NYCLU) (“Living in a sweeping surveillance state shouldn’t be the price we pay to be safe. Real public safety comes from investing in our communities, not from omnipresent government surveillance)” and MTA spokesman Tim Minton ("cameras are ubiquitous in daily life, in stores, on sidewalks, in offices, at airports, on commuter railroads, on buses, and now in subway cars"). - [MTA to Install Security Cameras in NYC Subway Cars to Deter Crime](https://www.nbcnewyork.com/news/local/mta-to-install-security-cameras-in-nyc-subway-cars-to-deter-crime/3872485/?ref=thenexusofprivacy.net), NBC New York (nbcnewyork.com), with perspectives from MTA Chairman Janno Lieber, insisting that these new cameras won't break down; and NYCLU who unsurprisingly is concerned there might be privacy issues. No, ya think? - [New York City subway trains getting security cameras](https://apnews.com/article/health-crime-new-york-city-covid-6803f1626d3b595c0c16d310faf4960a?ref=thenexusofprivacy.net), Maysoon Khan, The Associated Press (apnews.com), with a quote from NYCLU's Schwartz. - [‘Big Brother’s watching you’: MTA to install surveillance cameras on every NYC subway car by 2025](https://www.amny.com/transit/mta-surveillance-cameras-subway-hochul/?ref=thenexusofprivacy.net), with quotes from MTA Chairperson and CEO Janno Lieber ("If you prey on New Yorkers or you commit vandalism or damage MTA facilities, we’re going to have pictures of you, and the NYPD is going to find you, gonna catch you, and gonna punish you"); STOP's Cahn; Lisa Daglian, the executive director of the MTA’s in-house rider advocacy arm the Permanent Citizens Advisory Committee ("The safer people feel, the more likely they are to ride”); and passengers Jason Ghiassian ("“Safety comes first"), Sue ("I don’t \[worry about privacy concerns\] because safety is more important to me”), and Ray Carlo (“It doesn’t make any change,” said Ray Carlo. “How long ’til NYPD shows up? Cameras don’t stop a murder, right?”) - [NYC Subways Are Getting a 'Big Brother' Addition](https://gizmodo.com/nyc-cameras-surveillance-crime-1849559188?ref=thenexusofprivacy.net), Lauren Leffer on Gizmodo (gizmodo.com), with quotes from NYCLU's Schwartz and STOP's Cahn. Hey wait a second, I'm noticing a pattern here! - [MTA will install cameras in every subway train car to curb crime, increase safety](https://abc7ny.com/mta-subway-train-cameras-surveillance-safety/12243165/?ref=thenexusofprivacy.net), WABC (abc7ny.com), with quotes from New York City Transit President Richard Davey, NYPD Chief of Department Ken Corey, and "an expert with the New York Civil Liberties Union." Hmm, I wonder who that could be? - [New York City Will Get Cameras in All Subway Cars to Fight Crime](https://www.bloomberg.com/news/articles/2022-09-20/new-york-to-install-cameras-in-all-subway-cars-after-crime-spike?ref=thenexusofprivacy.net), Skylar Woodhouse, Bloomberg (bloomberg.com), with a quote from MTA chief executive officer Janno Lieber (“We’re going to have pictures of you, and the NYPD is going to find you. You will be caught.”) - [New York City Subway System to Install Security Cameras in Train Cars](https://www.nytimes.com/2022/09/20/nyregion/nyc-subway-security-cameras.html?ref=thenexusofprivacy.net), Ana Ley in the New York Times (nytimes.com), with quotes from Katheryn Wilde of Partnership for New York City discussing how increased police presence on the subways makes people feel safer; boxing coach Bardia Gharib, who drives his son to school instead of letting him take public transit; STOP's Cahn; Chief Jason Wilcox, the head of the Police Department’s transit bureau, discussing the 160% increase in tickets for "quality of life" offenses such as drinking, urination, stretching out over more than one seat; shoe salesman Zaire Maignan, who thinks cameras will make people feel safer; and university administrative assistant Kalila Abdur-Razzaq, with a great point: > “I just don’t have a lot of faith that they’ll be used in a way that will help people taking the train,” Ms. Abdur-Razzaq, 23, said. “They’re probably going to use it for crimes that affect the M.T.A. financially, not crimes that affect riders.” --- *Image credit:* R38R40, via [Wikipedia Commons](https://commons.wikimedia.org/wiki/File:Interior%5Fof%5FNYC%5FSubway%5FCar%5FR62%5F1345.jpg?ref=thenexusofprivacy.net). licensed under the [Creative Commons](https://en.wikipedia.org/wiki/en:Creative%5FCommons?ref=thenexusofprivacy.net)[Attribution-Share Alike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net) license. ### Privacy News: September 26 URL: https://thenexusofprivacy.net/privacy-news-september-26/ Last updated: 2022-09-28T05:09:09.000Z *Note: after publication, I moved the top story here to a separate post:* [*Surveillance cameras in New York subway cars: Whose voices are heard?*](https://thenexusofprivacy.net/surveillance-cameras-in-new-york-subway-cars/) ## Privacy after Roe ### [Apple Keeps Pretending We Don’t Live in a Post-Roe World](https://slate.com/technology/2022/09/apple-privacy-fertility-tracking-roe.html?ref=thenexusofprivacy.net) Justin Sherman, Slate's Future Tense (slate.com) Apple's latest version of its Watch includes fertility tracking. What could possibly go wrong? Apple has taken some reasonable precautions: phones locked with a passcode encrypt all Health app fitness and health data (but not the user’s Medical ID); and if you use Cycle Tracking with two-factor authentication enabled, health data synced to iCloud is end-to-end encrypted, where Apple does not have the decryption key and cannot read it. Still, as Sherman points out > But it doesn’t change the fact that a multinational technology company—with, by some estimates, [more than 100 million](https://www.statista.com/statistics/1221051/apple-watch-users-worldwide/?ref=thenexusofprivacy.net) watch users worldwide—is proposing tracking period information for people with the capacity to get pregnant. It doesn’t change the fact that said company is doing so, and thought it was a good idea to do so, following the overturning of *Roe v. Wade* in the United States and an even [faster-growing](https://slate.com/technology/2022/05/period-tracking-apps-privacy-roe-abortion.html?ref=thenexusofprivacy.net) [surveillance](https://slate.com/technology/2022/05/roe-overturn-data-privacy-laws.html?ref=thenexusofprivacy.net) [threat](https://www.stopspying.org/pregnancy-panopticon?ref=thenexusofprivacy.net) to women and other people. ### [Flo Period-Tracking App Releases ‘Anonymous Mode,’ but Users Should Still Be Cautious](https://gizmodo.com/flo-app-releases-anonymous-mode-period-abortion-bans-1849536742?ref=thenexusofprivacy.net) Mack DeGeurin, The A.V. Club on Gizmodo (gizmodo.com) Privacy experts welcomed Flo’s efforts but told Gizmodo the mode isn’t technically fully anonymous and should be applied by default. This story is actually a couple of weeks old, but I glossed over it before so wanted to feature it. [Flo's white paper ](https://www.documentcloud.org/documents/22349375-flo-white-paper?ref=thenexusofprivacy.net)goes into more detail about how it works, using "oblivious HTTP" - [Period tracking app Flo rolls out ‘Anonymous Mode’ on iOS, Android launch coming next month](https://techcrunch.com/2022/09/14/period-tracking-app-flo-anonymous-mode/?ref=thenexusofprivacy.net), Aisha Malik, TechCrunch (techcrunch.com) - [Period tracker app Flo turns on ‘anonymous mode.’ Will it ease user privacy concerns?](https://mmm-online.com/home/channel/period-tracker-app-flo-turns-on-anonymous-mode-will-it-ease-user-privacy-concerns?ref=thenexusofprivacy.net) Gordon Faylor on MM+M - Medical Marketing and Media (mmm-online.com) ## State privacy legislation ### [The “Colorado Effect?” Status Check on Colorado’s Privacy Rulemaking](https://fpf.org/blog/the-colorado-effect-status-check-on-colorados-privacy-rulemaking?ref=thenexusofprivacy.net) Keir Lamont and Chloe Suzman on Future of Privacy Forum (fpf.org) Colorado is set to formally enter a rulemaking process which may establish de facto interpretations for privacy protections across the United States. ## And ... #### [ICO could impose multi-million pound fine on TikTok for failing to protect children’s privacy](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2022/09/ico-could-impose-multi-million-pound-fine-on-tiktok-for-failing-to-protect-children-s-privacy?ref=thenexusofprivacy.net) on ICO (ico.org.uk) TikTok could face a £27 million fine after an ICO investigation found that the company may have breached UK data protection law, failing to protect children’s privacy when using the TikTok platform. The ICO has issued TikTok Inc and TikTok Information Technologies UK Limited (‘TikTok’) with a ’noti… #### [Study of Electronic Monitoring Smartphone Apps Confirms Advocates’ Concerns of Privacy Harms](https://eff.org/deeplinks/2022/09/study-electronic-monitoring-smartphone-apps-confirms-advocates-concerns-privacy?ref=thenexusofprivacy.net) Saira Hussain and Will Greenberg on Electronic Frontier Foundation (eff.org) Researchers at the University of Washington and Harvard Law School recently published a groundbreaking study analyzing the technical capabilities of 16 electronic monitoring (EM) smartphone apps used as “alternatives” to criminal and civil detention. #### [France and Germany fall foul of EU data retention rules](https://theregister.com/2022/09/21/eu%5Fdata%5Fretention?ref=thenexusofprivacy.net) Thomas Claburn on The Register (theregister.com) ‘Indiscriminate’ preemptive harvesting of personal info a big no-no. What a novel concept #### [Police delete thousands of attachments in bid to comply with privacy concerns](https://rnz.co.nz/news/national/475414/police-delete-thousands-of-attachments-in-bid-to-comply-with-privacy-concerns?ref=thenexusofprivacy.net) RNZ News on RNZ (rnz.co.nz) Police have deleted 11,000 files after orders to get rid of unlawfully taken photos of young people and adults. #### [Judge Allows Claim That NFL App Violates Privacy by Disclosing Personal Data to Google](https://insurancejournal.com/news/east/2022/09/15/685004.htm?ref=thenexusofprivacy.net) admin on Insurance Journal (insurancejournal.com) The National Football League has lost a bid to completely toss a class action that alleges it violates privacy laws by sharing the video watching habits #### [EA’s new anti-cheat tools dip into the dreaded “kernel mode”](https://arstechnica.com/gaming/2022/09/eas-new-anti-cheat-tools-dip-into-the-dreaded-kernel-mode?ref=thenexusofprivacy.net) Kyle Orland on Ars Technica (arstechnica.com) Publisher promises robust privacy and system security efforts to protect users. #### [Lens reflections may betray your secrets in Zoom video calls](https://theregister.com/2022/09/17/glasses%5Freflections%5Fzoom?ref=thenexusofprivacy.net) Thomas Claburn on The Register (theregister.com) About time someone shined some light onto this #### [To defeat FTC lawsuit, Meta demands 100+ rivals share biggest trade secrets](https://arstechnica.com/tech-policy/2022/09/to-defeat-ftc-lawsuit-meta-demands-100-rivals-share-biggest-trade-secrets?ref=thenexusofprivacy.net) Ashley Belanger on Ars Technica (arstechnica.com) Snap claims Meta wants “to reconstruct virtually every decision Snap has made.” #### [Never Consent: New Privacy Tool Makes Tracking Cookie Pop-ups Disappear](https://forbes.com/sites/daveywinder/2022/09/14/never-consent-new-privacy-tool-makes-tracking-cookie-pop-ups-disappear?ref=thenexusofprivacy.net) Davey Winder on Forbes (forbes.com) This new privacy tool makes cookie consent pop-ups disappear while automatically opting out of tracking. #### [5 Practical Ways To Ensure Privacy With Transcription Services](https://forbes.com/sites/forbesbusinesscouncil/2022/09/13/5-practical-ways-to-ensure-privacy-with-transcription-services?ref=thenexusofprivacy.net) Beth Worthy on Forbes (forbes.com) Audio and video transcriptions are crucial in the academic, legal, market research and business sectors and are still in demand. #### [Patient data privacy should be a focus of patient safety, say industry insiders | Biometric Update](https://biometricupdate.com/202209/patient-data-privacy-should-be-a-focus-of-patient-safety-say-industry-insiders?ref=thenexusofprivacy.net) Jim Nash on BiometricUpdate.com (biometricupdate.com) Biometric identification is a major focus of patient safety efforts because the aid for one person can be the demise of another. #### [‘Ring Nation’ Is a Terrible Idea That’s Unstoppable Because Amazon Owns Everything](https://vice.com/en/article/n7zdkm/cancel-ring-nation-amazon-show?ref=thenexusofprivacy.net) on vice.com Amazon owns Ring, MGM, and production company Big Fish Entertainment. It owns Prime Video, and has the support of #### [Advocacy Groups Demand Amazon, MGM Cancel Creepy ‘Ring Nation’ Surveillance Reality Show](https://gizmodo.com/amazon-mgm-ring-nation-ring-1849559834?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) The groups criticized MGM and Amazon for allegedly trying to, “put a happy face on a dangerous product.” #### [Press release: Use of Google Analytics for web analytics](https://datatilsynet.dk/english/google-analytics/use-of-google-analytics-for-web-analytics?ref=thenexusofprivacy.net) on Logo (datatilsynet.dk) The Danish Data Protection Agency has looked into the tool Google Analytics, its settings, and the terms under which the tool is provided. On the basis of this review, the Danish Data Protection Agency concludes that the tool cannot, without more, be used lawfully. Lawful use requires the implementa… #### [San Jose expanding use of license plate reader cameras, reviewing data privacy](https://ktvu.com/news/san-jose-eyeing-more-license-plate-cameras-reviewing-data-privacy?ref=thenexusofprivacy.net) Mark Sayre on KTVU FOX 2 (ktvu.com) San Jose will consider expanding the number of cameras that can read license plates as it considers tightening data policies to protect the privacy of those using the roadways, #### [Privacy gaps in Apple’s data collection scheme revealed | Imperial News | Imperial College London](https://imperial.ac.uk/news/239752/privacy-gaps-apples-data-collection-scheme?ref=thenexusofprivacy.net) Caroline Brogan on Imperial News (imperial.ac.uk) Imperial researchers have demonstrated how Apple’s use of a widely adopted data protection model could expose individuals to privacy attacks. #### [Meta’s privacy obligations may be added to German antitrust probe, court adviser says](https://reuters.com/technology/german-antitrust-watchdog-may-assess-metas-privacy-obligations-court-adviser-2022-09-20?ref=thenexusofprivacy.net) Foo Yun Chee on Reuters (reuters.com) Antitrust authorities may assess whether companies comply with EU data protection rules during their investigations, an adviser to Europe’s top court said on Tuesday, dealing a possible blow to Meta Platforms in its fight against the German competition agency. --- Image credit: Originally by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net), licensed from [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) via [Picpedia](https://www.picpedia.org/chalkboard/p/privacy.html?ref=thenexusofprivacy.net) ### Privacy News: September 23 URL: https://thenexusofprivacy.net/privacy-news-september-23/ Last updated: 2022-09-23T18:31:17.000Z Every time I do one of these, I'm surprised by how many interesting privacy-related stories there are out there. Admittedly, most of them are depressing, but still! ### [Despite Privacy Concerns, San Francisco Supervisors Expand Police Access to Live Camera Feeds](https://kqed.org/news/11926357/despite-privacy-concerns-san-francisco-supervisors-expand-police-access-to-live-camera-feeds?ref=thenexusofprivacy.net) Janie Har, Associated Press and KQED Staff on KQED (kqed.org) Ignoring the concerns of civil liberties groups, San Francisco's Board of Supervisors voted 7-4 to allow police to monitor in real time private surveillance cameras. As EFF notes in [San Francisco’s Board of Supervisors Grants Police More Surveillance Powers](https://www.eff.org/deeplinks/2022/09/san-franciscos-board-supervisors-grants-police-more-surveillance-powers?ref=thenexusofprivacy.net) > This troubling ordinance also allows police to surveil “significant events,” loosely defined as large or high-profile events, “for placement of police personnel.” This essentially gives police a green light to monitor—in real-time—protests and other First Amendment-protected activities, so long as they require barricades or street closures associated with public gatherings. The SFPD has previously been caught using these very same cameras to [surveil protests following George Floyd’s murder](https://www.eff.org/deeplinks/2020/07/san-francisco-police-accessed-business-district-camera-network-spy-protestors?ref=thenexusofprivacy.net), and the SF Pride Parade, facts that went unaddressed by the majority of Supervisors who authorized the ordinance. Kudos to Supervisors Connie Chan, Dean Preston, Hillary Ronen, and Shamann Walton for voting no. FIND OUT MORE: - [SFPD can now surveil a private camera network funded by Ripple chair](https://www.protocol.com/policy/sfpd-cameras?ref=thenexusofprivacy.net), Issie Lapowsky on Protocol (protocol.com), discusses the 1,000+ surveillance cameras Chris Larsen has funded around the city. - [SFPD can access live feeds from private security cameras under new policy](https://www.sfchronicle.com/sf/article/SFPD-can-access-live-feeds-from-private-security-17455803.php?ref=thenexusofprivacy.net), J.D. Morris on the San Francisco Chronicle (sfchronicle.com) - [San Francisco passes controversial surveillance plan](https://sfgate.com/politics/article/san-francisco-passes-surveillance-plan-17457342.php?ref=thenexusofprivacy.net), Alec Regimbal on SFGATE (sfgate.com) ## Privacy After Roe ### [Freedom to travel to get an abortion](https://papersplease.org/wp/2022/09/22/freedom-to-travel-to-get-an-abortion/?ref=thenexusofprivacy.net) Edward Hasbrouck on Papers Please (papersplease.org) A deep dive by a travel privacy expert on a fundamental right that's under threat in a world where abortion is criminalized in an increasing number of states. > In this context, the right to anonymous travel has acquired new importance and urgency. If you’ve wondered, “[Why would anyone want to travel anonymously?](https://papersplease.org/wp/the-issue/?ref=thenexusofprivacy.net)” now you know one of the reasons. But what’s needed is “[right to travel](https://papersplease.org/wp/2021/11/22/freedom-to-travel-act-of-2021-introduced-in-congress/?ref=thenexusofprivacy.net)” legislation, not just “privacy” legislation. [Current Federal “privacy” bills would do little to protect abortion travelers.](https://thenexusofprivacy.net/adppa-post-roe-threats/) Hasbrouck looks at the different options for interstate travel - bus, trains, planes, and automobiles - as well as the limited surveillance self-defense options and the need for federal legislation. ### [8 VCs discuss the overturning of Roe v. Wade, venture, and the midterm elections](https://techcrunch.com/2022/09/22/8-vcs-discuss-the-overturning-of-roe-v-wade-venture-and-the-midterm-elections?ref=thenexusofprivacy.net) Dominic-Madori Davis on TechCrunch (techcrunch.com) Eight VCs discuss the toppling of Roe, its impact on the overall venture community, and what they think about activism via investing. Hessie Jones of MATR Ventures makes an important point: > “Due diligence needs to expand past the point of founder ‘intentions’ and to look at the current customers using the technology.” Another VC has a different perspective. Can you guess his gender? > “Our job is to make money for folks, and a lot of folks that we’re making money for are the folks who don’t care about these rights. That is the reality of the situation.” ### [Period tracker Flo launches anonymous mode amid post-Roe privacy concerns](https://healthcaredive.com/news/flo-anonymous-mode-period-tracker-app-abortion-roe/631926?ref=thenexusofprivacy.net) Rebecca Pifer on Healthcare Dive (healthcaredive.com) The company, which has a dominant market share with 48 million monthly users and has faced regulatory scrutiny over privacy in the past, originally pledged to release the mode shortly after Roe v. Wade was overturned. ### [MoFo Privacy Tips for Protecting Reproductive Rights Post-Dobbs](https://mofo.com/resources/news/220817-privacy-tips-post-dobbs?ref=thenexusofprivacy.net) Miriam H. Wugmeister and Linnea Dale Pittman on Morrison Foerster (mofo.com) San Francisco-based international law firm Morrison Foerster 's [*MoFo Privacy Tips for Protecting Reproductive Rights*](https://view.ceros.com/mofo/tips-protecting-privacy/p/1?ref=thenexusofprivacy.net), offers guidance for individuals and reproductive healthcare providers, as well as recommendations for technology companies in a post-*Dobbs* world. ## And ... #### [Health apps share your concerns with advertisers. HIPAA can’t stop it.](https://washingtonpost.com/technology/2022/09/22/health-apps-privacy?ref=thenexusofprivacy.net) Tatum Hunter on The Washington Post (washingtonpost.com) We examined the privacy practices of popular health apps including Drugs.com, WebMD, K Health, HealthTap and Period Calendar. #### [‘They Are Watching’: Inside Russia’s Vast Surveillance State](https://nytimes.com/interactive/2022/09/22/technology/russia-putin-surveillance-spying.html?ref=thenexusofprivacy.net) Paul Mozur, Adam Satariano, Aaron Krolik and Aliza AufrichtigSept. 22, 2022 on The New York Times (nytimes.com) A cache of nearly 160,000 files from Russia’s powerful internet regulator provides a rare glimpse inside Vladimir V. Putin’s digital crackdown. #### [Where Online Hate Speech Can Bring the Police to Your Door](https://nytimes.com/2022/09/23/technology/germany-internet-speech-arrest.html?ref=thenexusofprivacy.net) on NYTimes (nytimes.com) Battling far-right extremism, Germany has gone further than any other Western democracy to prosecute individuals for what they say online, testing the limits of free speech on the internet. #### [Google Sees Russia Coordinating With Hackers in Cyberattacks Tied to Ukraine War](https://wsj.com/articles/google-sees-russia-coordinating-with-hackers-in-cyberattacks-tied-to-ukraine-war-11663930801?ref=thenexusofprivacy.net) Robert McMillan in San Francisco and Dustin Volz in Tallinn, Estonia on WSJ (wsj.com) ‘We have never previously observed such a volume of cyberattacks, variety of threat actors, and coordination of effort,’ report says; some U.S. institutions have been targeted. #### [Your ‘intimate’ data is for sale online](https://the1a.org/segments/your-intimate-data-is-for-sale-online?ref=thenexusofprivacy.net) on WAMU 88.5 - American University Radio (the1a.org) Should we treat the collection of ‘intimate data’ as a civil rights issue? #### [Lawsuits say Meta evaded Apple privacy settings to spy on millions of users](https://arstechnica.com/tech-policy/2022/09/lawsuits-say-meta-evaded-apple-privacy-settings-to-spy-on-millions-of-users?ref=thenexusofprivacy.net) Ashley Belanger on Ars Technica (arstechnica.com) A former Google engineer reported the risk, but Meta found no privacy concern. #### [Iran: Circumventing Censorship with Tor](https://forum.torproject.net/t/iran-circumventing-censorship-with-tor/4590?ref=thenexusofprivacy.net) on Tor Project Forum (forum.torproject.net) Currently we are receiving lots of requests for support from Iran. We are investigating the situation. We want to answer all requests, but we are overwhelmed. If you are having issues connecting to the Tor network from Iran, before contacting us on our support channels, please try these solutions:… #### [Apple says it prioritizes privacy. Experts say gaps remain](https://theguardian.com/technology/2022/sep/23/apple-user-data-law-enforcement-falling-short?ref=thenexusofprivacy.net) Johana Bhuiyan on The Guardian (theguardian.com) Tech behemoth could do more to protect user data from landing in the hands of police and other authorities, some say #### [Revealed: U.S. Military Bought Mass Monitoring Tool That Includes Internet Browsing, Email Data](https://vice.com/en/article/y3pnkw/us-military-bought-mass-monitoring-augury-team-cymru-browsing-email-data?ref=thenexusofprivacy.net) Joseph Cox on vice.com The “Augury” platform includes highly sensitive network data that Team Cymru, a private company, is selling to the military. “It’s everything. There’s nothing else to capture except the smell of electricity,” one cybersecurity expert said. #### [Govt proposes law to intercept encrypted messages on WhatsApp, Signal](https://hindustantimes.com/india-news/govt-proposes-law-to-intercept-encrypted-messages-on-whatsapp-signal-101663830524846.html?ref=thenexusofprivacy.net) on Hindustan Times (hindustantimes.com) The bill, if implemented in its current form, will have reaching ramification for the industry that is based on the premise of privacy and security of encrypted messages #### [The ‘Surveillance Solutionism’ of Putting Cameras in NYC Subways](https://wired.com/story/the-surveillance-solutionism-of-putting-cameras-in-nyc-subways?ref=thenexusofprivacy.net) on WIRED (wired.com) When “if you see something, say something” becomes “we see everything,” everyone loses. #### [As facial recognition arrives in schools, Montana enters uncharted territory](https://mtpr.org/montana-news/2022-09-22/as-facial-recognition-arrives-in-schools-montana-enters-uncharted-territory?ref=thenexusofprivacy.net) Sierra Cistone on Montana Public Radio Facial recognition technology has been put into at least one school district in Montana. The surveillance, characterized as a safety tool, is in use as policy makers in Montana debate how to regulate that kind of technology. #### [Facebook users sue Meta, accusing the company of tracking on iOS through a loophole](https://techcrunch.com/2022/09/22/meta-lawsuit-ios-privacy?ref=thenexusofprivacy.net) Taylor Hatmaker on TechCrunch (techcrunch.com) In a new lawsuit, Facebook users accuse Meta of tracking them through an in-app browser in spite of Apple’s iOS privacy changes. #### [Bill 64: First round of new Québec privacy requirements come into force this week – What does this mean for your business?](https://jdsupra.com/legalnews/bill-64-first-round-of-new-quebec-9412634?ref=thenexusofprivacy.net) Sasha Coutu on JD Supra (jdsupra.com) On Thursday, September 22, 2022, the first set of requirements brought on by Bill 64, An Act to modernize legislative provisions as regards the protection of personal information, comes into force in Québec. The remaining requirements will come into force in increments, in September 2023 and in September 2024. #### [CDT Experts Provide Testimony Before FTC’s Commercial Surveillance and Data Security Public Forum](https://cdt.org/insights/cdt-experts-provide-testimony-before-ftcs-commercial-surveillance-and-data-security-public-forum?ref=thenexusofprivacy.net) Lydia X. Z. Brown, Andrew Crawford, Ridhi Shetty on Center for Democracy and Technology (cdt.org) On September 8th, 2022, three CDT team members gave statements on various privacy and data issues in as part of the public remarks section of the Federal Trade Commission’s (FTC) Commercial Surveillance and Data Security Public Forum. The Public Forum was organized in tandem with the FTC’s Advanced… #### [New law will bolster privacy rights for kidnapping victims in New York](https://ny1.com/nyc/all-boroughs/ny-state-of-politics/2022/09/14/new-law-will-bolster-privacy-rights-for-kidnapping-victims?ref=thenexusofprivacy.net) Nick Reisman City of Albany on Spectrum News 1 Central NY (ny1.com) Victims can apply for address confidentiality program. #### [San Francisco Police Must End Irresponsible Relationship with the Northern California Fusion Center](https://eff.org/deeplinks/2022/09/san-francisco-police-must-end-irresponsible-relationship-northern-california?ref=thenexusofprivacy.net) Dave Maass on Electronic Frontier Foundation (eff.org) In yet another failure to follow the rules, the San Francisco Police Department is collaborating with the regional fusion center with nothing in writing—no agreements, no contracts, nothing— governing the relationship, according to new records released to EFF in its ongoing complaint against the... #### [AI Act: Czech Presidency puts forward narrower classification of high-risk systems](https://euractiv.com/section/digital/news/ai-act-czech-presidency-puts-forward-narrower-classification-of-high-risk-systems?ref=thenexusofprivacy.net) Luca Bertuzzi on EURACTIV (euractiv.com) A new partial compromise on the AI Act, seen by EURACTIV on Friday (16 September) further elaborates on the concept of the ‘extra layer’ that would qualify an AI as high-risk only if it has a major impact on decision-making. #### [The Right to Intimate Privacy (SSIR)](https://ssir.org/books/reviews/entry/the%5Fright%5Fto%5Fintimate%5Fprivacy?ref=thenexusofprivacy.net) Navneet Alang on Stanford Social Innovation Review Logo (ssir.org) The Fight for Privacy investigates how governments and businesses violate and profit from our personal lives online. #### ### "An alphabet soup of federal privacy legislation" URL: https://thenexusofprivacy.net/an-alphabet-soup-of-federal-privacy-legislation/ Last updated: 2026-04-16T02:47:38.000Z Here's the video of the webinar Maya Morales of WA People's Privacy and I did, discussing the various privacy bills Congress is working on. Thanks to [Electronic Frontiers Georgia](https://ef-georgia.org/?ref=thenexusofprivacy.net) for hosting! Or, if you prefer, [here it is on Facebook](https://www.facebook.com/ElectronicFrontiersGeorgia/posts/pfbid02joURmA94HbyxzwLoei1cHNH8kUiiZNygzEsWvn6sE8JVaLQFb9o9g5jRdstQsUCdl). Here's the description: > Congress is working on a half-dozen privacy bills, most of them with confusing acronyms like ADPPA, CTOPPA, COPRA, HLDPA, My Body My Data, and The Fourth Amendment Is Not For Sale Act. EFF currently supports The Fourth Amendment Is Not For Sale Act, which prohibits data brokers from selling data to governemnt agencies without a warrant; and My Body My Data, which protects reproductive health information. By contrast, EFF's current position on ADPPA is "Americans Deserve More." We'll look at how effectively the different bills do or don't protect our privacy, and why it's so important for federal legislation to be floor not a ceiling so that states can pass stronger privacy protections. We'll also discuss how you can get involved to increase the chances that strong bills pass -- and weaker ones don't. **TAKE ACTION!** We shared actions from EFF and ACLU on several different bills. - [Tell the Senate: the Solution to Kids’ Privacy Isn’t More Surveillance](https://act.eff.org/action/tell-the-senate-the-solution-to-kids-privacy-isn-t-more-surveillance?ref=thenexusofprivacy.net) (EFF's action on KOSA, the Kids Online Surveillance Act) - [Pass the “My Body, My Data” Act](https://act.eff.org/action/pass-the-my-body-my-data-act?ref=thenexusofprivacy.net) (EFF) - [Tell Congress: The Fourth Amendment is Not For Sale](https://act.eff.org/action/tell-congress-the-fourth-amendment-is-not-for-sale?ref=thenexusofprivacy.net) (EFF) - [Stop the Government’s Massive Privacy Invasion](https://action.aclu.org/send-message/stop-governments-massive-privacy-invasion?ref=thenexusofprivacy.net) (ACLU, also on the Fourth Amendment Is Not For Sale Act) ### Privacy News: September 20 URL: https://thenexusofprivacy.net/privacy-news-september-20/ Last updated: 2022-09-20T18:17:53.000Z ### [Tracked: How Colleges Use AI To Monitor Student Protests](https://pulitzercenter.org/stories/tracked-how-colleges-use-ai-monitor-student-protests?ref=thenexusofprivacy.net) Arijit Douglas Sen and Derêka Bennett, Dallas Morning News / Pulitzer Center's AI Accountability Network (pulitzercenter.org) Social Sentinel (now known as Navigate360 Detect) offers schools colleges technology to scan social media posts from students. The company positions it as a life-saving tool to help students at risk of harming themselves or others, and according to its CEO one in four K-12 schools uses it. But despite publicly saying its service was not a surveillance tool, "Social Sentinel representatives promoted the tool to universities for “mitigating” and “forestalling” protests." What could possibly go wrong? > During demonstrations over a Confederate statue at UNC-Chapel Hill, a Social Sentinel employee entered keywords into the company’s monitoring tool to find posts related to the protests. At Kennesaw State University in Georgia five years ago, authorities used the service to track protesters at a town hall with a U.S. senator, records show. And at North Carolina A&T, a campus official told a Social Sentinel employee to enter keywords to find posts related to a cheerleader’s allegation that the school mishandled her rape complaint. ## Privacy After Roe #### [OPEN LETTER: Make DMs Safe](https://makedmssafe.com/?ref=thenexusofprivacy.net) on Fight for the Future (makedmssafe.com) An open letter assking Facebook, Twitter, Google, Apple, Slack and other companies with messaging platforms to protect our private messages and implement default end-to-end encryption immediately. > Facebook [recently](https://www.forbes.com/sites/emilybaker-white/2022/08/08/facebook-abortion-teen-dms/?ref=thenexusofprivacy.net) handed over direct messages between a mom and her teenage daughter to police. Now they’re being prosecuted under the state’s anti-abortion law. In an increasingly dangerous world, there’s one simple thing every messaging platform must do right now: make our messages safe using end-to-end encryption. > TAKE ACTION: > [Add your signature to the open letter](https://www.makedmssafe.com/?ref=thenexusofprivacy.net). #### [Meta faces mounting questions from Congress on health data privacy as hospitals remove Facebook tracker](https://statnews.com/2022/09/19/facebook-meta-pixel-congress-health-data?ref=thenexusofprivacy.net) Megan Molteni on STAT (statnews.com) Meta faces mounting questions from Congress after an investigation by @TheMarkup, co-published with STAT, found its tracking tool collecting sensitive information on hospital websites. #### [The Data Broker Caught Running Anti-Abortion Ads—to People Sitting in Clinics](https://lawfareblog.com/data-broker-caught-running-anti-abortion-ads%E2%80%94-people-sitting-clinics?ref=thenexusofprivacy.net) Justin Sherman on Lawfare (lawfareblog.com) In 2015, a data broker helped anti-abortion groups target women in clinic waiting rooms. The Massachusetts attorney general decided to act. #### [Third-Party Tracking on Abortion Clinic Websites Sparks Data Privacy Concerns](https://healthitsecurity.com/news/third-party-tracking-on-abortion-clinic-websites-sparks-data-privacy-concerns?ref=thenexusofprivacy.net) Jill McKeon on healthitsecurity.com Researchers analyzed abortion clinic websites and found third-party tracking tools on 99% of them, raising data privacy concerns. #### [Oregon, other U.S. senators push for privacy for women seeking reproductive health care](https://oregoncapitalchronicle.com/briefs/oregon-other-u-s-senators-push-for-privacy-for-women-seeking-reproductive-health-care?ref=thenexusofprivacy.net) Lynne Terry on Oregon Capital Chronicle (oregoncapitalchronicle.com) Nearly 30 U.S. senators wrote to the U.S. Department of Human Services on Tuesday urging it to enact privacy protections for abortions. ## State privacy legislation #### [Michigan, Ohio, and Pennsylvania Consider Data Privacy Legislation](https://shrm.org/resourcesandtools/legal-and-compliance/state-and-local-updates/pages/state-bills-data-privacy.aspx?ref=thenexusofprivacy.net) Jeffrey M. Csercsevits © Fisher Phillips on SHRM (shrm.org) State governments are continuing to propose and adopt legislation that requires businesses to ensure privacy rights for consumers. Businesses operating in Michigan, Ohio, and Pennsylvania should prepare for potential new laws. #### [Key Dates from US Comprehensive State Privacy Laws](https://iapp.org/resources/article/key-dates-from-us-comprehensive-state-privacy-laws?ref=thenexusofprivacy.net) on iapp.org The IAPP created a timeline of key dates from the comprehensive data privacy laws in California, Colorado, Connecticut, Utah and Virginia. ## And ... #### [Detroit Cops Want $7 Million in Covid Relief Money for Surveillance Microphones](https://theintercept.com/2022/09/17/police-surveillance-shotspotter-detroit?ref=thenexusofprivacy.net) Sam Biddle on The Intercept (theintercept.com) The company behind the mics, ShotSpotter, is going all out to guide police stations across the country on how to use relief money for the controversial technology. #### [Distinguished Lecture with Danielle Citron, October 5| The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age ](https://techpolicylab.uw.edu/events/event/distinguished-lecture-with-danielle-citron-the-fight-for-privacy-protecting-dignity-identity-and-love-in-the-digital-age?ref=thenexusofprivacy.net) University of Washington Tech Policy Lab (techpolicylab.uw.edu) #### [Clearview AI, Used by Police to Find Criminals, Now in Public Defenders’ Hands](https://nytimes.com/2022/09/18/technology/facial-recognition-clearview-ai.html?ref=thenexusofprivacy.net) on NYTimes (nytimes.com) After a Florida man was accused of vehicular homicide, his lawyer used Clearview AI’s facial recognition software to prove his innocence. But other defense lawyers say Clearview’s offer rings hollow. #### [More Bosses Are Spying on Quiet Quitters. It Could Backfire.](https://wsj.com/articles/more-bosses-are-spying-on-quiet-quitters-it-could-backfire-11663387216?ref=thenexusofprivacy.net) Christopher Mims on WSJ (wsj.com) The tools companies use to monitor their employees can fall short of their promises, and even be counterproductive. #### [How to Ditch Facebook Without Losing Your Friends (Or Family, Customers or Communities)](https://eff.org/deeplinks/2022/09/how-ditch-facebook-without-losing-your-friends-or-family-customers-or-communities?ref=thenexusofprivacy.net) Cory Doctorow on Electronic Frontier Foundation (eff.org) Today, we launch “How to Ditch Facebook Without Losing Your Friends” - a narrated slideshow and essay explaining how Facebook locks in its users, how interoperability can free them, and what it would feel like to use an “interoperable Facebook” of the future, such as the one contemplated by the US..… #### [Going incognito: How we can protect our privacy in the metaverse](https://venturebeat.com/virtual/going-incognito-how-we-can-protect-our-privacy-in-the-metaverse?ref=thenexusofprivacy.net) Louis Rosenberg, Unanimous A.I. on VentureBeat (venturebeat.com) There’s no “incognito mode” in the metaverse to conceal personal information, but researchers are building a tool to protect users’ privacy. #### [This Ad’s for You (Not Your Neighbor)](https://nytimes.com/2022/09/15/business/custom-political-ads.html?unlocked%5Farticle%5Fcode=AAAAAAAAAAAAAAAACEIPuonUktbfqYhkQVUaBibfQMMmqBCdnr%5FE3acggXq7NC-RSCpDxO0RRoGM4AHNea9nLZMV7giseeVgYvUpVeAgiahWJVBsQA2l5cTakstZfS887I-4D21zgs6TBPVormSzKzjkI7hxnebutUPdPXL4G%5FCKiQ1XLwtvp5Znd12gyCZIkv-DSrgpr4E4ifQxBZl6RiMCbD2KvpTrChZ4OtaBanLM-1V8GrEZCXyIw4nqu%5F9Xex5SCFnGUHt9%5FW86jdteM94WN6r7RAUyUsywhhXirM85G-ZCsXHzxQ&ref=thenexusofprivacy.net) on NYTimes (nytimes.com) Data mining plus streaming can target political ads household by household, largely unregulated. #### #### [Google, Microsoft can get your passwords via web browser’s spellcheck](https://bleepingcomputer.com/news/security/google-microsoft-can-get-your-passwords-via-web-browsers-spellcheck?ref=thenexusofprivacy.net) Ax Sharma on BleepingComputer (bleepingcomputer.com) Enhanced Spellcheck features in Google Chrome and Microsoft Edge web browsers transmit form data, including personally identifiable information (PII) and in some cases, passwords, to Google and Microsoft respectively. #### [Indonesia set to pass new data privacy law after spate of leaks](https://digitimes.com/newsshow/article.asp?datePublish=2022%2F09%2F19&pages=vl&seq=209&ref=thenexusofprivacy.net) Bloomberg on DIGITIMES Inc. (digitimes.com) Data operators could face up to five years in jail and a maximum fine of IDR5 billion (US$337,000) for leaking or misusing private information, according to Indonesia’s new data privacy bill set to be passed by parliament this week. #### [Rights Groups to FTC’s Lina Khan: Please Kill Amazon’s iRobot Acquisition](https://gizmodo.com/amazon-irobot-ftc-cloostermans-1849517224?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) More than two dozen groups singed an open letter claiming the deal could “endanger fair competition,” and jeopardize consumer privacy. #### [The Right to Privacy in Modern Discovery: a review of another great law review article – Part 3](https://jdsupra.com/legalnews/the-right-to-privacy-in-modern-3792200?ref=thenexusofprivacy.net) Ralph Losey on JD Supra (jdsupra.com) This is the conclusion of the blog, The Right to Privacy in Modern Discovery: a review of another great law review article. #### [The Subjects and Stages of AI Dataset Development: A Framework for Dataset Accountability](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4217148&ref=thenexusofprivacy.net) See all articles by Mehtab Khan on papers.ssrn.com There has been increased attention toward the datasets that are used to train and build AI technologies from the computer science and social science research co #### [EDPB, EDPS: Lack of resources may bring ‘weakened’ EU GDPR enforcement](https://iapp.org/news/a/edpb-edps-lack-of-resources-may-bring-weakened-eu-gdpr-enforcement?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) The EDPB and EDPS joined on a letter to European Parliament and the Council of the European Union urging increased funding to ensure proper GDPR enforcement. #### [Google, Meta fined $71.8M for violating privacy law in South Korea](https://techcrunch.com/2022/09/14/google-meta-fined-71-8m-for-violating-privacy-law-in-south-korea?ref=thenexusofprivacy.net) Kate Park on TechCrunch (techcrunch.com) South Korea has hit Google and Meta with a fine of \~$71.8 million (100 billion KRW) after finding they violated the country’s privacy law, the country’s authorities said on Wednesday. The watchdog said in its statement that Google and Meta did not receive legitimate consent in the process of collecting information from users who visit their websites and use other websites as well as apps for customized advertisements. FIND OUT MORE: [S.Korea fines Google, Meta billions of won for privacy violations](https://reuters.com/technology/skorea-fines-google-meta-over-accusations-privacy-law-violations-yonhap-2022-09-14?ref=thenexusofprivacy.net), Soo-Hyang Choi on Reuters (reuters.com) #### [EDPB adopts statement on European Police Cooperation Code & picks topic for next coordinated action](https://edpb.europa.eu/news/news/2022/edpb-adopts-statement-european-police-cooperation-code-picks-topic-next-coordinated%5Fen?ref=thenexusofprivacy.net) on European Data Protection Board (edpb.europa.eu) #### [San Francisco sued by woman who says her rape-kit DNA was used to arrest her](https://arstechnica.com/tech-policy/2022/09/lawsuit-sfpd-used-victims-dna-from-rape-kit-exam-to-arrest-her-for-burglary?ref=thenexusofprivacy.net) Jon Brodkin on Ars Technica (arstechnica.com) Jane Doe “was re-victimized by this unconstitutional practice,” lawsuit says. #### [Proposal to put open arrest warrants online sparks privacy, racism concerns](https://newjerseymonitor.com/2022/09/14/proposal-to-put-open-arrest-warrants-online-sparks-privacy-racism-concerns?ref=thenexusofprivacy.net) Dana DiFilippo on New Jersey Monitor (newjerseymonitor.com) Watchdogs worry about the misuse of a plan proposed by a lawmaker that would create a public database of outstanding arrest warrants. ### Privacy News: September 17 mega-update URL: https://thenexusofprivacy.net/privacy-news-september-17/ Last updated: 2026-04-16T02:47:03.000Z It's been ten days since our last privacy news update, so we've got even more links than normal. ### [Electronic Frontier Foundation to Present Annual Awards to Alaa Abd El-Fattah, Digital Defense Fund, and Kyle Wiens](https://eff.org/press/releases/electronic-frontier-foundation-present-annual-awards-alaa-abd-el-fattah-digital?ref=thenexusofprivacy.net) Electronic Frontier Foundation (eff.org) This year's EFF awards for helping to ensure that technology supports freedom, justice, and innovation for all people: - blogger, software developer, activist, and political prisoner Alaa Abd El-Fattah **TAKE ACTION:** Sign the petition to [Free Alaa!](https://www.change.org/p/help-free-my-brother-before-it-s-too-late-jamescleverly-freealaa?recruiter=201630081&recruited%5Fby%5Fid=6b839030-8d28-11e4-acb0-e726d7a906f2&utm%5Fsource=share%5Fpetition&utm%5Fmedium=copylink&utm%5Fcampaign=petition%5Fdashboard) As Alaa's sister Mona Seif writes, "**if enough people demand it, the UK can bring Alaa home.** He is an Amnesty International Prisoner of Conscience, an Honorary Member of English PEN and dozens of UK MPs have called for his release. We just need the UK government to be firm in their negotiations." - abortion rights technology organization Digital Defense Fund. **TAKE ACTION:** If you're a software developer, website builder, UI designer, digital security trainer, IT technician, or a technologist of any kind, [volunteer with Digital Defense Fund](https://digitaldefensefund.org/volunteer?ref=thenexusofprivacy.net)! - iFixit CEO and co-founder Kyle Wiens (who's been very active in the Right to Repair Movement) Congratulations to all of the above! We talked about Digital Defense Fund's excellent [Guide to Abortion Privacy](https://digitaldefensefund.org/ddf-guides/abortion-privacy?ref=thenexusofprivacy.net) a couple months ago in [Privacy in a post-Roe America](https://thenexusofprivacy.net/privacy-in-a-post-roe-us-privacy-news-june-24/), and that's only one small piece of the digital security work they do for the abortion rights movement. ### [Customs officials have copied Americans’ phone data at massive scale](https://washingtonpost.com/technology/2022/09/15/government-surveillance-database-dhs?ref=thenexusofprivacy.net) Drew Harwell on The Washington Post (washingtonpost.com) U.S. government officials are adding data from as many as 10,000 electronic devices each year to a massive database they’ve compiled from travelers’ devices. > The rapid expansion of the database and the ability of 2,700 CBP officers to access it without a warrant — two details not previously known about the database — have raised alarms in Congress about what use the government has made of the information, much of which is captured from people not suspected of any crime. CBP officials told congressional staff the data is maintained for 15 years. > > Details of the database were revealed Thursday in a letter to CBP Commissioner Chris Magnus from Sen. Ron Wyden (D-Ore.), who criticized the agency for “allowing indiscriminate rifling through Americans’ private records” and called for stronger privacy protections. ## Student and youth privacy ### [With ‘Don’t Say Gay’ Laws & Abortion Bans, Student Surveillance Raises New Risks](https://www.the74million.org/article/with-dont-say-gay-laws-abortion-bans-student-surveillance-raises-new-risks/?ref=thenexusofprivacy.net) Mark Keierleber, The 74 (the74million.org) With states adopting anti-LGBTQ laws and criminalizing abortion, privacy and civil rights advocates warn that school-issued devices could end up exposing students to legal peril. > For years, schools across the U.S. have used digital surveillance tools that collect a trove of information about youth sexuality — intimate details that are gleaned from students’ conversations with friends, diary entries and search histories. Meanwhile, student information collected by student surveillance companies are regularly shared with police, according to a recent survey conducted by the nonprofit Center for Democracy and Technology. These two realities are concerning to Elizabeth Laird, the center’s director of equity in civic technology. Following the Supreme Court’s repeal of Roe v. Wade in June, she said information about youth sexuality could be weaponized. > > “Right now — without doing anything — schools may be getting alerts about students” who are searching the internet for resources related to reproductive health,” Laird said. “If you are in a state that has a law that criminalizes abortion, right now this tool could be used to enforce those laws.” FIND OUT MORE: - Kierleber's earlier [Survey Reveals Extent that Cops Surveil Students Online — in School and at Home](https://www.the74million.org/article/survey-reveals-extent-that-cops-surveil-students-online-in-school-and-at-home/?ref=thenexusofprivacy.net) discusses the finding in CDT's August report [Hidden Harms: The Misleading Promise of Monitoring Students Online](https://cdt.org/insights/report-hidden-harms-the-misleading-promise-of-monitoring-students-online/?ref=thenexusofprivacy.net) - [Back to Surveillance School](https://themarkup.org/newsletter/hello-world/back-to-surveillance-school?ref=thenexusofprivacy.net) is an interesting discussion between Laird and Julia Angwin on The Markup (themarkup.org) ### Also - [ICO sounds alarm over live school attendance tracker](https://schoolsweek.co.uk/information-watchdog-sounds-alarm-over-live-school-attendance-tracker?ref=thenexusofprivacy.net), Freddie Whittaker on Schools Week (schoolsweek.co.uk) - [Governor Newsom Signs First-in-Nation Bill Protecting Children’s Online Data and Privacy](https://gov.ca.gov/2022/09/15/governor-newsom-signs-first-in-nation-bill-protecting-childrens-online-data-and-privacy?ref=thenexusofprivacy.net) (gov.ca.gov) - [Irish regulator fines Instagram for violating children’s privacy in second setback for Meta](https://verdict.co.uk/irish-regulator-fines-instagram-for-violating-childrens-privacy-in-second-setback-for-meta?ref=thenexusofprivacy.net), Chloe Olivia Sladden on Verdict (verdict.co.uk) - [Big Instagram fine shows Europe’s top digital privacy enforcer is finally getting tough](https://politico.eu/article/europe-gdpr-enforce-big-tech-dpc?ref=thenexusofprivacy.net), Vincent Manancourt on Politico (politico.eu) - [Privacy and Paternalism: The Ethics of Student Data Collection](https://thereader.mitpress.mit.edu/privacy-and-paternalism-the-ethics-of-student-data-collection?ref=thenexusofprivacy.net), Kathleen Creel & Tara Dixit on The MIT Press Reader (thereader.mitpress.mit.edu) ## Federal privacy legislation ### [An Alphabet Soup of Privacy Legislation](https://www.facebook.com/ElectronicFrontiersGeorgia/videos/1293439547860164) Maya Morales and Jon Pincus (that's me!), hosted by Electronic Frontiers Georgia Maya and I discussed the Fourth Amendment is Not For Sale Act, My Body My Data, HLDPA, ADPPA, CTOPPA, and KOSA. We planned on an hour but had so many great questions that we went for 90 minutes – many thanks to the attendees! I'll have a fuller report soon; for now, the video's available on EF Georgia's [Facebook](https://www.facebook.com/ElectronicFrontiersGeorgia/videos/1293439547860164) and [Twitch](https://www.twitch.tv/ef%5Fgeorgia?ref=thenexusofprivacy.net) pages. **FIND OUT MORE:** - [Who could have predicted? A potential “new compromise” for ADPPA!](https://thenexusofprivacy.net/adppa-new-compromise/) is an update on what's happening with ADPPA. - ACLU's [New Records Detail DHS Purchase and Use of Vast Quantities of Cell Phone Location Data](https://www.aclu.org/news/privacy-technology/new-records-detail-dhs-purchase-and-use-of-vast-quantities-of-cell-phone-location-data?ref=thenexusofprivacy.net) and EFF's [Fog Data Science Puts our Fourth Amendment Rights up for Sale](https://www.eff.org/deeplinks/2022/08/fog-data-science-puts-our-fourth-amendment-rights-sale?ref=thenexusofprivacy.net) highlight the problem the Fourth Amendment Act is Not For Sale would address. - Danielle Keats Citron’s [The End of Roe Means We Need a New Civil Right to Privacy](https://slate.com/technology/2022/06/end-roe-civil-right-intimate-privacy-data.html?ref=thenexusofprivacy.net) on *Slate* provides the broad context for My Body My Data and Health and Location Data Privacy Act. - Indivisible Plus Washington's [Federal Privacy Legislation Reading list](https://indipluswa.medium.com/federal-privacy-legislation-2022-cfba3cf79e6?ref=thenexusofprivacy.net) has a boatload of links on several of the bills. > **TAKE ACTION:** > [**Tell Congress: The Fourth Amendment is Not For Sale**](https://act.eff.org/action/tell-congress-the-fourth-amendment-is-not-for-sale?ref=thenexusofprivacy.net) **using EFF's handy web form** ### [**Revie**](https://iapp.org/news/a/reviewing-the-house-committee-changes-to-the-proposed-american-data-privacy-and-protection-act?ref=thenexusofprivacy.net)[wing the House Committee changes to the proposed ADPPA](https://iapp.org/news/a/reviewing-the-house-committee-changes-to-the-proposed-american-data-privacy-and-protection-act?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) IAPP Westin Research Fellow Amy Olivero breaks down the changes to the draft American Data Privacy and Protection Act (ADPPA). Note that both the description of the changes and the chart at the bottom makes ADPPA look stronger than it really is. For example, - the list of changes is at a very high level. While this improves readability, it also creates a very false impression by omitting[ many important changes that significantly weakened the bill](https://thenexusofprivacy.net/what-about-the-elephant/#weakening). - the chart helpfully provides information on how long covered entities of different sizes have to respond to access, correction, and deletion requests – but it leaves out the fact that they also get an automatic 45-day exemption. - the chart accurately notes that service providers and businessess with less than $250,000,000 annual revenue are subject to ADPPA's civil rights protections (Section 207(a)) – but omits the fact that they're exempt from the requirement to do algorithmic impact assessments. ### [Editorial: Congress must fix data privacy bill so it doesn’t hurt Californians](https://latimes.com/opinion/story/2022-09-12/editorial-congress-fix-data-privacy-bill-preempt-california?ref=thenexusofprivacy.net) The Times Editorial Board on Los Angeles Times (latimes.com) The LA Times argues that California should get a waiver exempting their privacy law for ADPPA. I discuss this, along Jennifer Haberkorn's excellent September 6 *LA Times* news story [Congress mulls data privacy bill that would void California’s tougher protections](https://www.latimes.com/politics/story/2022-09-06/congress-mulls-data-privacy-bill-that-would-void-california-tougher-protections?ref=thenexusofprivacy.net), in the footnotes of [Who could have predicted? A potential “new compromise” for ADPPA!](https://thenexusofprivacy.net/adppa-new-compromise/) ### [Internet service providers drop challenge of privacy law](https://apnews.com/article/technology-lawsuits-united-states-maine-data-privacy-9b2a40a18839c16df732368ee04ea856?ref=thenexusofprivacy.net) Patrick Whittle, on Associated Press (apnews.com) A group of telecommunication providers has dropped its bid to overturn Maine's opt-in privacy law, which Whittle accurately describes as "one of the strictest internet privacy laws in the United States." Looks like they're pinning their hopes on [ADPPA, which would preempt Maine's law](https://www.eff.org/document/2022-07-13-letter-maine-ag-congress-re-adppa?ref=thenexusofprivacy.net) (as well as other current and future state and local consumer privacy laws). ### [Advocacy Groups Urge Senators to Advance Bills Protecting Children’s Data](https://www.natlawreview.com/article/privacy-tip-344-advocacy-groups-urge-senators-to-advance-bills-protecting-children-s?ref=thenexusofprivacy.net) Lynn F. Freedman, National Law Review (natlawreview.com) Provider groups and privacy advocates have joined together to put pressure on Congress to pass two bipartisan bills designed to bolster children and nd teens’ privacy. The Kids Online Safety Act (S. 3663) and the Children and Teens’ Online Privacy Protection Act (S. 1628) were both passed out of the Senate subcommittee with bipartisan support. Note, however, that EFF *opposes* the Kids Online Safety Act. Jason Kelley's [The Kids Online Safety Act Is a Heavy-Handed Plan to Force Platforms to Spy on Young People](https://www.eff.org/deeplinks/2022/03/kids-online-safety-act-heavy-handed-plan-force-platforms-spy-young-people?ref=thenexusofprivacy.net). from March, discusses why. ## Post-Roe privacy #### [Rumored Apple Watch fertility tracking is a potential post-Roe nightmare](https://mashable.com/article/apple-watch-fertility-tracking-privacy-concerns?ref=thenexusofprivacy.net) Cecily Mauran on Mashable (mashable.com) The possible Apple Watch feature is ill-timed ## FTC ### [FTC Report Shows Rise in Sophisticated Dark Patterns Designed to Trick and Trap Consumers](https://ftc.gov/news-events/news/press-releases/2022/09/ftc-report-shows-rise-sophisticated-dark-patterns-designed-trick-trap-consumers?ref=thenexusofprivacy.net) Federal Trade Commission (ftc.gov) The Federal Trade Commission released a report today showing how companies are increasingly using sophisticated design practices known as “dark patterns” that can trick or manipulate consumers into buying products or services or giving up their privacy. IAPP's Cobun Zweifel-Keegan's [What color are your patterns?](https://iapp.org/news/a/a-view-from-dc-what-color-are-your-patterns?ref=thenexusofprivacy.net) has a short summary. ### [The FTC Is Closing in on Runaway AI](https://www.wired.com/story/ftc-ai-regulation/?ref=thenexusofprivacy.net) Khari Johnson, WIRED (wired.com) The US regulator is eager to end unfair use of artificial intelligence and commercial surveillance, but experts remain skeptical. ### [Even with the FTC mulling a rewrite of data privacy rules, don’t expect change to come soon](https://fastcompany.com/90789396/even-with-the-ftc-mulling-a-rewrite-of-data-privacy-rules-dont-expect-change-to-come-soon?ref=thenexusofprivacy.net) Chris Morris on Fast Company (fastcompany.com) The FTC could borrow from the European Union’s legal framework for what personal data can be collected by companies. But the agency often moves at a glacial pace. ### [Congresswoman Urges FTC to Investigate Newly Revealed Police Software Surveilling Americans’ Movements](https://gizmodo.com/congresswoman-ftc-to-investigate-fog-data-science-softw-1849547432?ref=thenexusofprivacy.net) The A.V. Club on Gizmodo (gizmodo.com) Rep. Anna Eshoo says the tool, Fog Reveal, “presents a new threat” in the post-Roe landscape. ## And ... #### [Cops wanted to keep mass surveillance app secret; privacy advocates refused](https://arstechnica.com/tech-policy/2022/09/cops-wanted-to-keep-mass-surveillance-app-secret-privacy-advocates-refused?ref=thenexusofprivacy.net) Ashley Belanger on Ars Technica (arstechnica.com) Fog Reveal is “almost invisible” when attempting to search for it online. #### [Walmart is facing a class action suit for allegedly violating an Illinois privacy law by using surveillance cameras and Clearview AI’s facial recognition data](https://businessinsider.com/walmart-is-facing-a-class-action-over-its-alleged-use-of-surveillance-cameras-and-clearview-ais-facial-recognition-database-2022-9?ref=thenexusofprivacy.net) Caroline Haskins on Insider (businessinsider.com) Walmart is facing a class action lawsuit over its alleged use of surveillance cameras and Clearview AI’s facial recognition database. #### [What It Really Means to “Hold Big Tech Accountable”](https://lawfareblog.com/what-it-really-means-hold-big-tech-accountable?ref=thenexusofprivacy.net) Brian Fishman on Lawfare (lawfareblog.com) Four principles for U.S. lawmakers to keep in mind as they open the messy and unsatisfying Pandora’s box of tech regulation. #### [The MTA’s switch to OMNY machines is a privacy nightmare](https://fastcompany.com/90788367/the-mtas-switch-to-omny-machines-is-a-privacy-nightmare?ref=thenexusofprivacy.net) Max Ufberg on Fast Company (fastcompany.com) The fare payment system’s connections with the public and private sectors make it a dangerous upgrade for subway riders. #### [A view from DC: What color are your patterns?](https://iapp.org/news/a/a-view-from-dc-what-color-are-your-patterns?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) IAPP Managing Director, Washington D.C., offers his thoughts on the privacy happenings in and around D.C. #### [TikTok won’t commit to stopping US data flows to China | CNN Business](https://cnn.com/2022/09/14/tech/tiktok-china-data/index.html?ref=thenexusofprivacy.net) Brian Fung on CNN (cnn.com) TikTok repeatedly declined to commit to US lawmakers on Wednesday that the short-form video app will cut off flows of US user data to China, instead promising that the outcome of its negotiations with the US government “will satisfy all national security concerns.” #### [Open Call for Tor Board Candidates | Tor Project](https://blog.torproject.org/open-call-tor-board-candidates?ref=thenexusofprivacy.net) Kendra on The Tor Project (blog.torproject.org) The Tor Project is happy to announce an open call for candidates to join the Tor Project Board of Directors. #### [S.Korea fines Google, Meta billions of won for privacy violations](https://reuters.com/technology/skorea-fines-google-meta-over-accusations-privacy-law-violations-yonhap-2022-09-14?ref=thenexusofprivacy.net) Soo-Hyang Choi on Reuters (reuters.com) South Korea levied millions of dollars in fines on Alphabet’s Google and Meta Platforms for privacy law violations, authorities said on Wednesday, as Meta considers fighting the decision in court. #### [Tech tool offers police ‘mass surveillance on a budget’](https://apnews.com/article/technology-police-government-surveillance-d395409ef5a8c6c3f6cdab5b1d0e27ef?ref=thenexusofprivacy.net) GARANCE BURKE AND JASON DEAREN on Associated Press (apnews.com) Local law enforcement agencies from suburban Southern California to rural North Carolina have been using an obscure cellphone tracking tool, at times without search warrants, that gives them the power to follow people’s movements months back in time, according to public records and internal emails o… #### [NYPD Camera Project](https://stopspying.org/nypd-cameras?ref=thenexusofprivacy.net) on S.T.O.P. - The Surveillance Technology Oversight Project (stopspying.org) If you can see an NYPD camera from your window at home, please get in touch with us. We are hoping to sue NYPD to force them to take these cameras down, or at the very least physically block them from viewing New Yorkers’ homes. You may also be entitled to some monetary compensation for violation #### [TikTok claims it’s not collecting U.S. users’ biometric data, despite what privacy policy says](https://techcrunch.com/2022/09/14/tiktok-claims-its-not-collecting-u-s-users-biometric-data-despite-what-privacy-policy-says?ref=thenexusofprivacy.net) Sarah Perez on TechCrunch (techcrunch.com) Last year, TikTok quietly updated its privacy policy to allow the app to collect biometric data on U.S. users, including “faceprints and voiceprints” — a concerning change that the company declined to detail at the time, or during a subsequent Senate hearing held last October. Today, the tech compan… #### [Indonesia Set to Pass New Data Privacy Law After Spate of Leaks](https://itprotoday.com/data-privacy/indonesia-set-pass-new-data-privacy-law-after-spate-leaks?ref=thenexusofprivacy.net) Bloomberg News on ITPro Today: IT News, How-Tos, Trends, Case Studies, Career Tips, More (itprotoday.com) The passing of the bill would make Indonesia the fifth Southeast Asian country to have a specific law on personal data protection after Singapore, Malaysia, Thailand and the Philippines. #### [Opinion: The most disturbing aspect of Vanessa Bryant’s case](https://cnn.com/2022/09/15/opinions/vanessa-bryant-case-privacy-citron-goldberg-zipursky/index.html?ref=thenexusofprivacy.net) Danielle Keats Citron,John C.P. Goldberg,Benjamin C. Zipursky on CNN (cnn.com) Vanessa Bryant’s recent verdict against the Los Angeles County Sheriff’s and Fire Departments represents a federal jury’s response to immoral and grotesquely offensive conduct by some of their employees. #### [Loyalty Programs in the California AG’s Crosshairs Once Again](https://consumerprivacyworld.com/2022/01/loyalty-programs-in-the-california-ags-crosshairs-once-again?ref=thenexusofprivacy.net) Kyle Dull on Consumer Privacy World (consumerprivacyworld.com) With a nod to Data Privacy Day (January 28), California Attorney General Rob Bonta announced an enforcement sweep of loyalty programs operated by retail, #### [TikTok Denies Data Breach Reportedly Exposing Over 2 Billion Users’ Information](https://thehackernews.com/2022/09/tiktok-denies-data-breach-reportedly.html?ref=thenexusofprivacy.net) Ravie Lakshmanan on The Hacker News (thehackernews.com) TikTok has denied reports of a data breach after a hacker group claimed to have gained access to information on two billion of its users. #### [The shift we need to stop mass surveillance](https://ted.com/talks/albert%5Fcahn%5Fthe%5Fshift%5Fwe%5Fneed%5Fto%5Fstop%5Fmass%5Fsurveillance?ref=thenexusofprivacy.net) Albert Cahn on TED Talks (ted.com) Mass surveillance is worse than you think, but the solutions are simpler than you realize, says lawyer, technologist and TED Fellow Albert Cahn. reaking down the crude tactics law enforcement uses to sweep up massive amounts of data collected about us by our everyday tech, he lays out how new legal firewalls can protect the public from geofence warrants and other surveillance abuses -- and how we might end the looming dystopia of mass surveillance. #### [Peter Eckersley Helped Encrypt Internet Traffic to Foil Snoops](https://wsj.com/articles/peter-eckersley-helped-encrypt-internet-traffic-to-foil-snoops-11662732014?ref=thenexusofprivacy.net) James R. Hagerty and Robert McMillan on WSJ (wsj.com) Australian computer scientist, who has died at age 44, worked at a San Francisco nonprofit on projects designed to protect privacy. #### [Third circuit shows how to establish standing in data breach cases](https://iapp.org/news/a/third-circuit-shows-how-to-establish-standing-in-data-breach-cases?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) A recent decision by the federal court of appeals in Philadelphia gives new hope to plaintiffs in class action lawsuits over data breaches. #### [Scant resources might threaten enforcement on Big Tech, EU data protection bodies warn](https://euractiv.com/section/data-protection/news/scant-resources-might-threaten-enforcement-on-big-tech-eu-data-protection-bodies-warn?ref=thenexusofprivacy.net) Luca Bertuzzi on EURACTIV (euractiv.com) #### [Facebook Engineers: We Have No Idea Where We Keep All Your Personal Data](https://theintercept.com/2022/09/07/facebook-personal-data-no-accountability?ref=thenexusofprivacy.net) Sam Biddle on The Intercept (theintercept.com) In a discovery hearing, two veteran Facebook engineers told the court that the company doesn’t keep track of all your personal data. #### [If Caring About Your Digital Privacy Makes Me a Cult Member, Sign Me Up](https://slate.com/technology/2022/09/fog-data-science-eff-cult-of-privacy.html?ref=thenexusofprivacy.net) Jason Kelley on Slate (slate.com) An Arkansas prosecutor recently said that Americans who care about their digital security belong to a “cult of privacy.” #### [Data tracking poses a ‘national security risk’ FTC told](https://theregister.com/2022/09/09/data%5Ftracking%5Fnational%5Fsecurity%5Frisk?ref=thenexusofprivacy.net) Jessica Lyons Hardcastle on The Register (theregister.com) ‘We’re making China’s job easier’ #### [One year later, Apple’s privacy changes helped boost its own ads business, report finds](https://techcrunch.com/2022/09/06/one-year-later-apples-privacy-changes-helped-boost-its-own-ads-business-report-finds?ref=thenexusofprivacy.net) Sarah Perez on TechCrunch (techcrunch.com) A new report examing the impact of Apple’s privacy feature, App Tracking Transparency, indicates Apple’s ads business appears to have financially benefitted as a result of the feature’s launch. Now over a year old, App Tracking Transparency, or ATT, reached mass adoption in June 2021, allowing for a… #### [UK data protection reform: How the UK GDPR may change](https://engage.hoganlovells.com/knowledgeservices/news/uk-data-protection-reform-how-the-uk-gdpr-may-change?ref=thenexusofprivacy.net) on Hogan Lovells Engage 5.7.2 (engage.hoganlovells.com) On 18 July 2022, the UK government introduced the Data Protection and Digital Information Bill to Parliament for its first reading. Following the UK leaving the European Union in 2020, the Bill sets o... #### [Big California Privacy News: Legislative and Enforcement Updates](https://datamatters.sidley.com/big-california-privacy-news-legislative-and-enforcement-updates?ref=thenexusofprivacy.net) Colleen Theresa Brown on Data Matters Privacy Blog (datamatters.sidley.com) Privacy never sleeps in California. In recent days and as California’s legislative session comes to a close, there have been a number of significant legislative and regulatory developments in the state , each of which will likely (again) change the privacy landscape in California and, by extension, the rest of the country. In a surprise to many observers, the California legislature failed to extend the employee- and B2B-exemptions. The exemptions will now expire at the end of 2022 and require businesses to extend CCPA rights to all California residents whose personal information they collect, without regard to their employment status. --- ## Image description Image Credit: from Digital Defense Fund's [Guide to Abortion Privacy](https://digitaldefensefund.org/ddf-guides/abortion-privacy?ref=thenexusofprivacy.net). Image description: The image is titled “Digital Security for Abortion and Pregnancy Privacy.” A white person with braces and short dark curly hair says, “Worried about someone reading your messages or browser history?” Small images provide advice. A hand holds a phone with a green lock screen displaying the word “Enter” and a dial pad. Text reads: “Use a strong PIN on your devices.” A green circle in a pink background contains an illustration of a purple mustache, black glasses, and a pink hat. Text reads: “Browse in an incognito window.” A white magician with brown hair wearing a white shirt and purple cape uses a purple wand to make a purple hat’s contents disappear. Text reads: “Turn on disappearing messages in secure messaging app like Signal.” A brown broom sweeps dust. Text reads: “Clear browsing history.” The image is signed “The Digital Defense Fund x Hazel Mead.” ### Who could have predicted? A potential "new compromise" for ADPPA! URL: https://thenexusofprivacy.net/adppa-new-compromise/ Last updated: 2026-04-16T02:46:27.000Z *Last updated September 15* > It could well be that \[lobbyist Jon\] Leibowitz et. al. are just posturing, and the industry plan is to demand concessions on other fronts in return for a "compromise" on preemption: add California's privacy law to the already-long list of preemption exceptions, give the California Privacy Protection Agency the authority they need, and hangs Maine, Washington, and all the other states that also don't want to be preempted out to dry. > > – me, in [A "fresh wrench", two hearings, and a busy week](https://thenexusofprivacy.net/a-fresh-wrench-and-two-hearings/#what-next-on-preemption), July 17 In July, the House Energy & Commerce committee voted 53-2 to advance the American Data Privacy and Protection Act (ADPPA), a broad consumer privacy bill. It's the first time this century a consumer privacy bill has advanced from committee, and privacy and civil rights groups have justifiably lauded ADPPA's inclusion of civil rights protections as a huge milestone. The next step for ADPPA is a vote on the House floor. But right before the Labor Day weekend, House Speaker Nancy Pelosi issued a firm statement saying that wouldn’t happen unless there were changes in ADPPA. > California’s landmark privacy laws... must continue to protect Californians — and states must be allowed to address rapid changes in technology. Oh no! Republicans have said they're only willing to support a privacy bill if it preempts California!! And now California's not willing to be preempted!!! ***Does this mean that ADPPA is "***[***dead***](https://www.adweek.com/programmatic/ad-tech-granted-some-relief-with-federal-privacy-bill-dead-in-this-congress/amp/?ref=thenexusofprivacy.net)***"?*** ## **Don’t be silly** > The level to which Pelosi's stance affects the ADPPA's chances will depend on what kind of agreement can be reached, if any, to soften preemption. > > – Joe Duball, [Pelosi opposes proposed American Data Privacy and Protection Act, seeks new preemption compromise](https://iapp.org/news/a/pelosi-rejects-proposed-american-data-privacy-and-protection-act-seeks-new-compromise/?ref=thenexusofprivacy.net) Of course this doesn't mean ADPPA is dead. It's not even news: Pelosi and California Democrats have had this position [since 2019](https://www.politico.com/story/2019/02/21/congress-data-privacy-california-1185943?ref=thenexusofprivacy.net). Legislators, staffers, lobbyists, and privacy advocates have all put a huge amount of effort into ADPPA and its predecessors over the last few years. They're not going to give up just because the preemption issue hasn't been resolved yet. Pelosi's statement made it clear that discussions are continuing. Along with statements from House Energy & Commerce Chair Frank Pallone and Ranking Member Cathy McMorris Rodgers (two of ADPPA's sponsors), it's just part of the negotiating process. In fact, there's already been a "new compromise" proposed on preemption. But before we get to that ... ## **Can we talk about something besides preempting California for a second?** There’s been so much focus on preemption and California that a lot of other important questions about ADPPA haven’t gotten a lot of airtime, starting with one that's top of mind for a lot of people right now. **Does ADPPA protect against post-Roe threats to privacy?** Probably not. - Rep. Anna Eshoo says that "under this bill, a sinister prosecutor in a state that criminalizes abortion could use against women their intimate data from search histories or from reproductive health apps." - Sen. Ron Wyden (who's usually right about stuff like this) says the de-identified data loophole "could allow data brokers to sell location data to the government about visits to reproductive health facilities, for example, or other private information that is trivially easy to connect to individuals.” - Senate Commerce Committee staffers warn that the bill would force pregnant people to “jump through arbitrary, drawn-out hoops” to sue over privacy violations. - Kim Clark of progressive feminist non-profit Legal Voice says “This bill, at least from the perspective of pregnant people, it really doesn’t do much” [How well does ADPPA protect against post-Roe threats?](https://nexusofprivacy.net/adppa-post-roe-threats/?ref=thenexusofprivacy.net) goes into more detail, including ## A few more topics that could use a lot more discussion - **Do the changes in the latest version of the bill give free rein to government contractors?** Quite possibly. In [Americans Deserve More Than The Current American Data Privacy Protection Act](https://www.eff.org/deeplinks/2022/07/americans-deserve-more-current-american-data-privacy-protection-act?ref=thenexusofprivacy.net), EFF says they’re concerned about this, and I haven't yet seen any good responses convincing me otherwise. - **Does ADPPA protect LGBTAIQ2S+ people?** No. As WA People’s Privacy pointed out on Twitter, [sexual orientation has now been removed from the definition of "sensitive data," and sex and gender were never included](https://twitter.com/wapeopleprivacy/status/1559999090917720064?ref=thenexusofprivacy.net). And that's only one of the problems; [Stress-testing ADPPA with a queer lens](https://thenexusofprivacy.net/adppa-with-a-queer-lens/) also discusses how ADPPA stacks up against threats to queer people Antoine Prince Albert III wrote about in [Hiding OUT: A Case for Queer Experiences Informing Data Privacy Laws](https://publicknowledge.org/hiding-out-a-case-for-queer-experiences-informing-data-privacy-laws?ref=thenexusofprivacy.net), - **Does ADPPA let state Attorneys General enforce the law?** Not so much. AGs from states including Connecticut, Illinois, Maine, Massachusetts, Nevada, New Mexico, New Jersey, New York, and Washington warn in a July 19 letter that the current version of the bill appears to [“substantially preempt many states’ ability to investigate” and “unnecessarily interferes with robust enforcement capabilities.”](https://oag.ca.gov/system/files/attachments/press-docs/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf?ref=thenexusofprivacy.net)​​ - **Does ADPPA let people sue companies who break the law?** In many cases, no. As Rep. Donald McEachin of Virginia, Sen. Maria Cantwell of Washington, and EFF have all highlighted, ADPPA allows companies to force people into arbitration. Senate Commerce committee staffers said in a memo that ADPPA makes it harder for people to "seek redress when their sensitive health data has been used against them.” There's often a "right to cure", giving companies a get-out-of-jail free card; the Bad Washington Privacy Act also had a right to cure, and Washington's AG called it "anti-consumer". EFF goes into more detail on how the bill needs stronger individual rights to fight back, including statutory damages, in [Americans Deserve More Than The Current American Data Privacy Protection Act](https://www.eff.org/deeplinks/2022/07/americans-deserve-more-current-american-data-privacy-protection-act?ref=thenexusofprivacy.net). - **Does ADPPA provide sufficient resources and authority for FTC enforcement?** Nope. The current version doesn't provide any additional funding for the FTC, but adds substantial new responsibilities (including approval of "compliance guidelines" submitted by companies and trade associations, who can then presumably sue if the FTC doesn't respond within the one-year timeframe). - **Are ADPPA's algorithmic auditing requirements strong enough to make the civil rights protections against anti-discrimination real?** I don’t think so, especially after they were significantly weakened in the last version. [ADPPA’s algorithmic impact assessments are too weak to protect civil rights -- but it’s not too late to strengthen them](https://thenexusofprivacy.net/adppa-impact-assessments-and-civil-rights/) and [Automated Systems and Discrimination](https://thenexusofprivacy.net/comments-for-ftc-public-forum-for-commercial-surveillance/) go into more detail on the changes that are needed. - **Does ADPPA provide whisteblower protections?** No. In a [June 24 letter](https://www.documentcloud.org/documents/22111995-ferguson-privacy-letter-to-4-corners%5F6-24-2022?ref=thenexusofprivacy.net), Washington's Attorney General Bob Ferguson said "Frances Haugen demonstrates how important whistleblowers are to daylighting abusive practices that violate Americans’ privacy and I encourage you to add whistleblower protections to the ADPPA." I could go on … what about the “bossware” loopholes? What about the "pay for privacy" regime, where it's okay to charge customers more or provide lower levels of service if you they don't agree to be part of a "voluntary" loyalty program (which can require consenting to data sharing or sale)? A potential loophole allowing ISPs to escape hundreds of millions in fines? What are the implications of lowered protections for location data from photos, surveillance cameras, and license plate readers? But hopefully there’s enough here to make my point. So yes, It’s a problem that ADPPA preempts California’s law. And as Californians for Consumer Privacy highlight in their [Letter to Speaker Nancy Pelosi Opposing The American Data Privacy and Protection Act](https://www.caprivacy.org/letter-to-speaker-nancy-pelosi-opposing-adppa/?ref=thenexusofprivacy.net), the many ways that ADPPA falls short of California's law are also problems. But those aren't the only problems we should be be talking about! ## **People in other states and cities have opinions on preemption too!** > "In 2019, the Maine Legislature enacted L.D. 946, An Act to Protect the Privacy of Online Customer Information. The law is at the forefront of consumer privacy protection, and it reflects hard-fought progress in Maine to foriify consumer data against unauthorized connection and use by Internet Service Providers. > > Current efforts to adopt federal privacy legislation could imperil this progress, and similar progress made in other states across the country." > > Aaron Frey, Attorney General, State of Maine, in a [July 13 letter](https://www.eff.org/document/2022-07-13-letter-maine-ag-congress-re-adppa?ref=thenexusofprivacy.net) And it's not like Californians are the only ones who oppose preemption. So does AG Frey – and AGs from Connecticut, Illinois, Maine, Massachusetts, Nevada, New Mexico, New Jersey, New York, and Washington, who made similar points in their [coalition letter](https://oag.ca.gov/system/files/attachments/press-docs/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf?ref=thenexusofprivacy.net). But all the focus on *California*'s opinion about preemption of their state law frames it as California just being selfish, and obscures both the breadth of the opposition and ADPPA's preemption of local laws. Seattle's Broadband Privacy Ordinance would similarly be preempted – and so would Seattle's ability to pass future privacy laws. [Here's what Derek Lum of Seattle's InterIm CDA had to say](https://iexaminer.org/interims-corner-the-washington-privacy-act-insufficient-for-the-immigrant-refugee-communities-we-serve/?ref=thenexusofprivacy.net) about the preemption clause in the Bad Washington Privacy Act in 2021: > "This cuts off one of the few avenues that organizations like mine can use to seek better protections for those we serve. Most of our community members live in Seattle, and they have reason to hope that the city will protect its vulnerable populations’ privacy. To deny them this avenue of protection is not right and would be severely limiting our ability to protect our communities." Dozens of Tech Equity Coalition organizations and allies made a similar point in a letter to our state legislature: “[a preemption provision prevents local jurisdictions from making important privacy decisions for their residents](https://signon-acluofwashington.nationbuilder.com/support%5Fkloba%5Famendment%5Fto%5Fsb%5F5062?ref=thenexusofprivacy.net).” Here's some other opinions about ADPPA's preemption from Washington state. - Maya Morales of WA People’s Privacy said at the California Privacy Protection Agency’s July 28 special board meeting that “[It’s important to be crystal clear about who preemption serves, and who it harms: preemption privileges the needs of corporations over the needs of people](https://wapeoplesprivacy.org/our-public-comment-in-historic-ccpa-meeting/?ref=thenexusofprivacy.net).” - A dozen Indivisible groups said in a June 13 letter that “[it is extremely important to us that federal legislation does not preempt Washington state’s own future privacy legislation.](https://indipluswa.medium.com/indivisible-letter-to-sen-cantwell-and-rep-mcmorris-rodgers-on-federal-privacy-legislation-8071ba1d350e?ref=thenexusofprivacy.net)” - In [Stress-testing ADPPA with a queer lens](https://thenexusofprivacy.net/adppa-with-a-queer-lens/), I wrote "From an LGBTAIQ2S+ perspective, this means that if a city like Seattle or a state like Washington wants to better protect its LGBTAIQ2S+ residents by addressing some these problems ... we can't." And now, back to California ... ## What "new compromise" could they possibly have in mind? > "Drawing on lessons from the environmental field, there may indeed be a way forward just as \[EPIC Privacy President and Executive Director Alan\] Butler suggests, with California as our guide.... > > The federal bill can provide California with a waiver, which would recognize its unique position as the home of a critical mass of tech companies and a leader in regulating them. (The Department of Commerce or the Federal Trade Commission could be tasked with determining whether California’s innovations offer greater data privacy protections than the ADPPA to warrant the waiver.) The state could continue to create privacy protections that meet evolving problems, and the nation can avoid the confusion that would result if all 50 states made their own privacy laws." > > \-- [Nancy Pelosi Is Blocking Landmark Data Privacy Legislation—for a Good Reason](https://slate.com/technology/2022/09/nancy-pelosi-data-priavcy-law-adppa.html?ref=thenexusofprivacy.net), Danielle Keats Citron and Alison Glocke, *Slate* Hey! We've got a critical mass of tech companies in Washington too! What are we, chopped liver? **UPDATE**, September 13: > "Another approach lawmakers should consider is a framework similar to [the federal Clean Air Act](https://www.epa.gov/state-and-local-transportation/vehicle-emissions-california-waivers-and-authorizations?ref=thenexusofprivacy.net), which allows California to set a tougher standard than the national one and lets states choose which they want to follow." > > – LA Times editorial, [Congress must fix data privacy bill so it doesn’t hurt Californians](https://www.latimes.com/opinion/story/2022-09-12/editorial-congress-fix-data-privacy-bill-preempt-california?ref=thenexusofprivacy.net) I'm noticing a pattern here ...\* ## "Tweaking" the "grand bargain" ADPPA's supporters have argued that they only way to get federal privacy legislation is a “[grand bargain](https://twitter.com/privacypen/status/1549237595418365952?ref=thenexusofprivacy.net)”: - Republicans will support providing some protections to cis straight non-pregnant people all over the country; something called a "private right of action" that people have to jump thrugh hoops to use and doesn't have statutory damages; and exemptions for government contractors - In return, Democrats will agree states can't provide stronger protections to their residents; AGs and privacy agencies will have a hard time enforcing the law; forced arbitration and a right to cure that can prevent people from suing; and California will give up legislation that had been passed by a referendum in 2020\. As stated, this was never going to fly. California has made it clear [since 2019](https://www.politico.com/story/2019/02/21/congress-data-privacy-california-1185943?ref=thenexusofprivacy.net) and at every stage of discussions htis session that they were not on board. Senate Commerce Chair Maria Cantwell has firmly said she's not on board either. And I suspect that most progressive Democratic legislators would have some serious qualms with the "grand bargain" as I've described it here. And yet, here we are. EPIC Privacy Executive Director Alan Butler [suggests](https://iapp.org/news/a/pelosi-rejects-proposed-american-data-privacy-and-protection-act-seeks-new-compromise/?ref=thenexusofprivacy.net) that the path forward is to combine "substantive tweaks to address issues of differences raised by the CPPA and others in California" with possible modifications to the preemption provisions. He's got a lot more visibility into the negotiations than I do, so who knows ... maybe they really can "tweak" the "grand bargain" and piece together a "new compromise" with the votes to at least get ADPPA through the House while still ignoring input from the other 49 states. We shall see. Keep in mind that Big Tech is playing a long game here. If Congress passes a weak preemptive ADPPA this year, they win.\*\* If not, they'll go back to [pushing states to pass weak privacy laws](https://themarkup.org/privacy/2021/04/15/big-tech-is-pushing-states-to-pass-privacy-laws-and-yes-you-should-be-suspicious?ref=thenexusofprivacy.net) and[ watering down attempts at privacy regulation, one state at a time](https://themarkup.org/privacy/2022/05/26/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time?ref=thenexusofprivacy.net). EPIC's and Lawyers' Committee's strong support for ADPPA is likely to make Big Tech's path through the states a lot easier. One straightforward strategy: use a weakened ADPPA as a starting point, and further weaken it in states where their lobbying is strongest.\*\*\* It's similar to the strategy they took after we rejected the Bad Washington Privacy Act and an Amazon lobbyist introduced it in Virginia, only better (from a Big Tech perspetive); with ADPPA they'll be able to tell legislators things like "privacy groups like EPIC and civil rights groups like Lawyers' Committee support the bill and the only reason Congress didn't pass it was those selfish Californians care more about their ego than protecting people who live in other states." Then once it's passed in a few states, they can take another crack at getting a mostly-preemptive bill through Congress. To be fair, EPIC and Lawyers' Comittee are in a tough position here. They've heard repeatedly that the "grand bargain" is the only path through Congress this session. Depending on how the midterms go, the Congressional landscape might be even tougher next session. Their support for the bill so far resulted in a 53-2 bipartisan vote for the principle that privacy is a civil right, which is a major accomplishment. They probably couldn't have gotten that without advocating so strongly for a bill they know has major weaknesses. But there's a big cost to that as well. I'm sure they're continuing to push for improvements behind the scenes, but since they've already announced their support for the bill I wonder how much leverage they have. And even though [lobbying from Microsoft, IBM and others has significantly weakened the bill](https://www.protocol.com/newsletters/policy/cloud-enterprise-privacy?ref=thenexusofprivacy.net) and [data brokers are lobbying up a storm](https://www.politico.com/news/2022/08/28/privacy-bill-triggers-lobbying-surge-by-data-brokers-00052958?ref=thenexusofprivacy.net), EPIC's and Lawyers' Committee's public statements continue to focus on ADPPA's strengths and the ways they see it as better than California's law. ## Democrats have other options > “We see an opportunity for asking Democrats to recognize the threats that have become far more acute in a post-Roe worldand to consider using the leverage they have – which is not insignificant – to consider these improvements in that light.” > > – Shaunna Thomas of Ultraviolet,[ quoted in the Spokane Spokesman-Review](https://www.spokesman.com/stories/2022/jul/25/historic-data-privacy-law-could-be-within-reach-if/?ref=thenexusofprivacy.net) Even putting the other 49 states aside, ADPPA's gonna need a heckuva lot of "substantive tweaking" to address Californians' issues. Californians for Consumer Privacy's latest comparison highlights quite a few differences, some of which need substantial tweeking to address. EFF is also California based, and they've got a stack of issues as well. Meanwhile industry will be demanding concessions elsewhere to make up for a preemption waiver for California. How much strengthening will Republicans go along with? If the answer is "not enough", supporting a bill that leaves pregnant people at risk is very fraught for Democrats who are counting on their strong stance on reproductive rights after the Dobbs decision to motivate voters – and a bill that doesn't protect LGBTAIQ2S+ people puts the 175 members of the LGBTQ Equality Caucus in [a very awkward position](https://thenexusofprivacy.net/adppa-with-a-queer-lens/). So hopefully Democrats are looking at other options. They have the votes to get something through the House that actually *does* protect pregnant people if they want to. Perhaps it's time to stop focusing on ADPPA, and instead push the My Body My Data and the Health and Location Data Privacy Act, which have narrower but much stronger protections for reproductive health data and pregnant people. Or, they could remove preemption and significantly *strengthen* ADPPA by closing loopholes, removing the forced arbitration protection, and adding whistleblower protections. Conventional wisdom is that if the Dems move forward on My Body My Data, Health and Location Data Privacy Act, or a significantly strengthened ADPPA, whatever the House passes won't have any chance in the Senate. I'm not completely convinced by this,\*\*\*\* but suppose it's true. So what? After all, if nothing’s going to pass, it’s far better for Democrats to position themselves as having fought for strong privacy protections – and position Republicans as so virulently anti-abortion that they’ll sacrifice everybody’s’ privacy just to be able to let vigilantes and sinister prosecutors get at pregnant people’s health data. And privacy advocates can play a long game too. The House passing some *strong* legislation sets up for next year's legislative battles in the states – even if it doesn't pass the Senate. And depending on the November results, it could be a different story in Congress next session. If the Democrats pick up a couple of seats in the Senate and hold the House, they might well remove the filibuster for abortion-related legislation. Everybody agrees that the Supreme Court's Dobbs decision ending Roe has changed the political landscape when it comes to privacy. Let's hope Democrats seize the opportunity. ## **It ain't over til it's over** It'll be interesting to see how things play out over the next few weeks. The House is in session again from September 13 to September 30\. [25+ disability rights groups](https://cdt.org/wp-content/uploads/2022/08/2022-08-25-ADPPA-Disability-Rights-Groups-Letter-to-Pelosi.pdf?ref=thenexusofprivacy.net) have called for ADPPA to be brought to a vote, highlighting the many provisions that will help protect disabled people. So have[ dozens of public interest groups](https://epic.org/epic-joins-48-public-interest-groups-urging-house-to-vote-on-american-data-privacy-and-protection-act/?ref=thenexusofprivacy.net), highlighting its civil rights protections. Meanwhile, the FTC's public forum on commercial surveillance last Thursday [spotlighted the need for strong regulations](https://threadreaderapp.com/thread/1567937896786857985.htm?ref=thenexusofprivacy.net). ADPPA supporters will probably try to use it to support their arguments for why it's important to pass *something*, while avoiding discussions of whether it actually addresses the issues people brought up like protecting pregnant people from post-Roe threats and protecting trans and queer people at a time when they're under attack all over the country. One of Big Tech's favorite tactics in their incessant attempts to pass weak privacy here in Washington state has been to try to push a "compromise" bill through at the very end of the session. In 2021, [the Bad Washington Privacy Act's sponsor tried to hold funding for eviction protection hostage](https://www.thestranger.com/slog/2021/04/29/56978551/washington-legislature-closes-session-with-massive-watered-down-winshttps://www.thestranger.com/slog/2021/04/29/56978551/washington-legislature-closes-session-with-massive-watered-down-wins?ref=thenexusofprivacy.net) in an unsuccessful attempt to "encourage" his colleagues to support the bill in the last days of the session. 2022's farcical last-minute push included[ a secret amendment that wasn't even published before the vote](https://wa-privacy.net/it-aint-over-till-its-over/?ref=thenexusofprivacy.net). Good times. So it wouldn't surprise me if there are still some shenanigans in store for ADPPA. One thing we've learned time and again in Washington state's legislative battles over privacy: it ain't over till it's over. Stay tuned! --- ## Updates *September 15: Include LA Times artcile* --- \* Several patterns, actually. As well as the predicted "waiver for California", this is the second major opinion piece the *LA Times* has published on ADPPA, after [David Brody's July 19 op-ed](https://www.latimes.com/opinion/story/2022-07-28/data-privacy-act-civil-rights-california?ref=thenexusofprivacy.net). Most of what these opinion pieces discuss are the very real problems ADPPA is trying to present and the reasons ADPPA is good. But it's a very different balance than that conveyed by Jennifer Haberkorn's excellent September 6 *LA Times* news story [Congress mulls data privacy bill that would void California’s tougher protections](https://www.latimes.com/politics/story/2022-09-06/congress-mulls-data-privacy-bill-that-would-void-california-tougher-protections?ref=thenexusofprivacy.net). Haberkorn reports that ADPPA is "e legislation is widely supported by the tech industry." She includes critical perspectives from Ashkan Soltani of California Privacy Protection Agency (CPPA) who flat-out says ADPPA “is weaker than the California law.” She quotes Soltani on ADPPA's absence of California's right to opt out of AI profiling. And Haberkorn even mentions [the elephant!](https://nexusofprivacy.net/adppa-post-roe-threats/?ref=thenexusofprivacy.net) > Critics of the Energy and Commerce bill say it has too broad of a loophole for law enforcement to demand data related to a state crime, something that could open the door to the disclosure of location-tracking information, period-tracking information or messages related to abortion access in states where the procedure is illegal. Another concern is whether third parties can access the information. I get it, there's a difference between news and opinion. Still, *LA Times* readers are seeing a lot more positive information about ADPPA than discussions of the questions including the elephant. And all the coverage of preemption (including Haberkorn's) is filtered through a California lens, with nary I mention that I could see of Maine or Washington. \*\* Of course Big Tech isn't going to admit that. From a negotiating perspective, they've got a lot more leverage if they're perceived as soooo against the bill that they're ready to walk away unless they get more concessions. But if you look at the bill in its current form, there's virtually nothing here that they don't have to do for existing legislation in the EU, California, or Colorado. And while the private right of action gets painted as something that industry will never ever in a million years agree to, the reality is that Microsoft actually *did* agree to a private right of action in behind-the-scenes negotiations on a bill in Washington a couple of years ago. For big companies, a private right of action without statutory damages is a small price to pay for a bill that gives them so much. \*\*\* Another possible strategy for Big Tech: sprinkle a few improvements into the Bad Washington Privacy Act and continue to use that as their template. It would be easy enough to add algorithmic impact assessments that are just a teensy bit stronger ADPPA's (although still to weak to hold Big Tech accountable) along with a duty of loyalty and data minimization section. Since the Bad WPA already has civil rights protections, these tweaks would make it "even stronger than ADPPA, which has the support of privacy groups like EPIC and and civil rights groups like Lawyers' Committee!" Big Tech and their allies have the resources to pursue both of these paths as well as continuing to push even weaker bills like Utah's, which makes the Bad Washington Privacy Act and ADPPA look good by comparison. \*\*\*\* The Health and Location Data Privacy acts regulates data brokers, so is a natural complement the Fourth Amendment Is Not For Sale Act -- which prohibits government agencies from buying data from data brokers without a warrant. The Fourth Amendment Is Not For Sale Act has strong bipartisan support, and in its hearing legislators from both parties stressed that it was only a first step. My Body My Data or a significantly strengthened ADPPA would be a tougher sell, but many Republicans in tough election races are already trying to[ backtrack](https://www.washingtonpost.com/opinions/2022/08/29/republican-abortion-backtrack/?ref=thenexusofprivacy.net) on their previous anti-abortion statements, so it’s possible that an effective pressure campaign could change some positions. *Image credit:* JessicaRodriguezRivas, via [Wikipedia Commons](https://commons.wikimedia.org/wiki/File:Home%5Fof%5Fthe%5FUS%5FCongress.jpg?ref=thenexusofprivacy.net). licensed under the [Creative Commons](https://en.wikipedia.org/wiki/en:Creative%5FCommons?ref=thenexusofprivacy.net)[Attribution-Share Alike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net) license. ### Automated Systems and Discrimination: Comments at FTC Public Forum for Commercial Surveillance and Data Security URL: https://thenexusofprivacy.net/comments-for-ftc-public-forum-for-commercial-surveillance/ Last updated: 2026-04-16T02:45:52.000Z *The September 8* [*FTC Public Forum on Commercial Surveillance and Data Security*](https://www.ftc.gov/system/files/ftc%5Fgov/pdf/commercial%5Fsurveillance%5Fpublic%5Fforum%5Ffinal%5Fagenda.pdf?ref=thenexusofprivacy.net) *included time for public comments at the end. Here's an extended version of what I said.* I’m Jon Pincus, founder of the Nexus of Privacy Newsletter, where I write about on the connections between technology, policy, and justice. As a long-time privacy advocate, I greatly appreciate your attention to commercial surveillance. My career includes [founding a successful software engineering startup](http://web2.cs.columbia.edu/~junfeng/08fa-e6998/sched/readings/prefix.pdf?ref=thenexusofprivacy.net); General Manager of Compteitive Strategy at Microsoft; and [co-chairing the ACM Computers, Freedom, and Privacy Conference](https://cacm.acm.org/blogs/blog-cacm/91829-computers-freedom-and-privacy-in-a-networked-society-june-15-18-in-san-jose-and-cyberspace/fulltext?ref=thenexusofprivacy.net). Last year I was a member of the [Washington state Automated Decision-making Systems Workgroup](https://watech.wa.gov/privacy/projects-and-initiatives?ref=thenexusofprivacy.net), and my comments today focus on discrimination and automated systems. ![A person saying :Technologies reflect the biases of the makers and implicit rules of society" with a photo of an incarcerated Black person in the background](https://thenexusofprivacy.net/content/images/2022/09/technologies-reflect-the-biases-of-the-makers.png) Malkia Cyril, at Personal Democracy Forum 2017, originally tweeted by @anxiaostudio Technology can be liberating … but it can also reinforce and magnify existing power imbalances and patterns of discrimination. As documented by researchers like Dr. Safiya Noble in *Algorithms of Oppression* and Dr. Joy Buolamwini, Timnit Gebru, and Inioluwa Deborah Raji in the *Gender Shades* project, today’s algorithmic systems are error-prone and the datasets they’re trained on have significant biases. Like other forms of surveillance, the harms are usually much greater on the historically underserved communities the FTC has committed to protecting. Who gets wrongfully arrested as a result of facial recognition errors? [Nijeer Parks, Robert WIlliams, and Michael Oliver … Black people](https://www.wired.com/story/wrongful-arrests-ai-derailed-3-mens-lives/?ref=thenexusofprivacy.net)! Regulation is clearly needed, and it needs to be designed to protect the people who are most at risk. ![A red face mask with indeterminate gender and the letters AJL. On the right, the four principles listed below](https://thenexusofprivacy.net/content/images/2022/09/Screen-Shot-2022-09-07-at-10.07.18-PM.png) Algorithmic Justice League (AJL) princippes The Algorithmic Justice League’s four principles are a good starting point: - affirmative consent - meaningful transparency - continuous oversight and accountability, and - actionable critique focused on shifting industry practices among those creating and commercializing today’s systems. AJL founder Buolamwini, research collaborator Raji, and Director Of Research & Design Sasha Costanza-Chock (known for their work on Design Justice) recently collaborated on [Who audits the Auditors: Recommendations from a field scan of the algorithmic auditing ecosyystem](https://arxiv.org/pdf/2310.02521.pdf?ref=thenexusofprivacy.net), the first comprehensive field scan of the artificial intelligence audit ecosystem. The policy recommendations in *Who Audits the Auditors* highlight key considerations in several specific areas where FTC rulemaking could have a major impact. 1. Require the owners and operators of AI systems to engage in independent algorithmic audits against clearly defined standards 2. Notify individuals when they are subject to algorithmic decision-making systems 3. Mandate disclosure of key components of audit findings for peer review 4. Consider real-world harm in the audit process, including through standardized harm incident reporting and response mechanisms 5. Directly involve the stakeholders most likely to be harmed by AI systems in the algorithmic audit process 6. Formalize evaluation and, potentially, accreditation of algorithmic auditors. ![A grid of six colored boxes, each with the one of the policy recommendations listed above](https://thenexusofprivacy.net/content/images/2022/09/ajl-recs.png) Who Audits the Auditors policy recommendations And the details of the rulemaking matter a lot. Too often, well-intended regulation has weaknesses that commercial surveillance companies, with their hundreds of lawyers, can easily exploit. Looking at proposals through an algorithmic justice lens can highlight where they fall short. For example, here's how the proposed American Data Privacy and Protection Act (ADPPA) consumer privacy bill stacks up against AJL's recommendations: 1. ADPPA doesn't require independent auditing, instead allowing companies like Facebook to do their own algorithmic impact assessments. And government contractors acting as service providers for ICE and law enforcement don't even have to do algorithmic impact assessments! ***Update*, *September 13* *:*** Color of Change's [Black Tech Agenda](https://act.colorofchange.org/sign/black-tech-agenda?ref=thenexusofprivacy.net) notes "By forcing companies to undergo independent audits, tech companies can address discrimination in their decision-making and repair the harm algorithmic that bias has done to Black communities regarding equitable access to housing, health care, employment, education, credit, and insurance." 2. ADPPA doesn’t require affirmative consent to being profiled – or even offer the opportunity to opt out. 3. ADPPA doesn’t mandate any public disclosure of its algorithmic impact assessments – not even summaries or key components 4. ADPPA doesn't have any requirement for including real-world harms – or even measuring the impact. 5. ADPPA doesn't have any requirement at all to involve external stakeholders in the assessment process – let alone directly involving the stakeholders most likely to be harmed by AI system. 6. ADPPA allows anybody at a company to do an algorithmic impact assessment – and it's not even clear whether it allows the FTC rulemaking authority for potential evaluation and accreditation of assessors or auditors [ADPPA’s algorithmic impact assessments are too weak to protect civil rights -- but it’s not too late to strengthen them](https://thenexusofprivacy.net/adppa-impact-assessments-and-civil-rights/) goes into more detail. More positively, other regulation in the US and elsewhere highlights that these issues *can* be addressed. Rep. Yvette Clarke's [Algorithmic Accountability Act of 2022](https://clarke.house.gov/clarke-wyden-and-booker-introduce-algorithmic-accountability-act-of-2022-to-require-new-transparency-and-accountability-for-automated-decision-systems/?ref=thenexusofprivacy.net), for example, requires companies performing AIAs "to the extent possible, to meaningfully consult (including through participatory design, independent auditing, or soliciting or incorporating feedback) with relevant internal stakeholders (such as employees, ethics teams, and responsible technology teams) and independent external stakeholders (such as representatives of and advocates for impacted groups, civil society and advocates, and technology experts) as frequently as necessary." AJL's recommendation of directly involving the stakeholders most likely to be harmed by AI systems also applies to the process of creating regulations. In [Hiding OUT: A Case for Queer Experiences Informing Data Privacy Laws](https://publicknowledge.org/hiding-out-a-case-for-queer-experiences-informing-data-privacy-laws?ref=thenexusofprivacy.net), A. Prince Albert III (Policy Counsel at Public Knowledge) suggests using queer experiences as an analytical tool to test whether proposed a privacy regulation protects people’s privacy. [Stress-testing privacy legislation with a queer lens](https://thenexusofprivacy.net/adppa-with-a-queer-lens/) is an example of how effective this approach can be at highlighting needed improvements. It's also vital to look at how proposed regulations affect pregnant people, rape and incest survivors, immigrants, non-Christians, disabled people, Black and Indigenous people, unhoused people, and others who are being harmed *today* by commercial surveillance. So I implore you, as you continue the rulemaking process, please make sure that the historically underserved communities most harmed by commercial surveillance are at the table – and being listened to. ### Stress-testing privacy legislation with a queer lens URL: https://thenexusofprivacy.net/adppa-with-a-queer-lens/ Last updated: 2026-04-16T02:45:26.000Z *Last updated: November 18\. See* [*Updates*](#updates) *at the end for a change log.* > The best way for any federal or state legislature to assure all consumers’ privacy is protected online is to stress-test their laws against the harsh and worsening realities of queer experiences. If a law can protect queer interests, it will ensure that all consumers are maximally protected. > > – [Hiding OUT: A Case for Queer Experiences Informing Data Privacy Laws](https://publicknowledge.org/hiding-out-a-case-for-queer-experiences-informing-data-privacy-laws?ref=thenexusofprivacy.net), Antoine Prince Albert III on Public Knowledge Civil rights groups and privacy advocates are very justifiably excited about the inclusion of civil rights protections in the proposed American Data Privacy and Protection Act (ADPPA). Getting strong bipartisan support for the principle that privacy rights are civil rights is hugely important – and the fact that privacy legislation with a civil rights focus has advanced from committee (on a 53-2 vote!) is a significant milestone. But as Professor Daniel Solove says in [Further Thoughts on ADPPA, the Federal Comprehensive Privacy Bill](https://teachprivacy.com/further-thoughts-on-adppa-the-federal-comprehensive-privacy-bill/?ref=thenexusofprivacy.net), "many parts of privacy laws have pretty-sounding rhetoric but ultimately are not any deeper." How deep are the protections in the current version of the ADPPA? So I decided to take Antoine Prince Albert III's excellent suggestion and stress-test ADPPA through a queer lens. It turned out to be a very interesting exercise. ## Ten stress tests Here are ten stress tests of how well ADPPA protects the interests of LGBTAIQ2S+ people.\* The first seven come from [Hiding OUT](https://publicknowledge.org/hiding-out-a-case-for-queer-experiences-informing-data-privacy-laws?ref=thenexusofprivacy.net)'s "Queering Ya Privacy" section, with some minor restructuring and wording changes; the last three focus on some specific hot spots in the ADPPA debate so far. This isn't meant to be definitive; there are a lot of other possible stress tests, and I'd love to hear what others come up with. But I haven't seen much other discussion of this, and it's an important topic, so hopefully this will spark additional discussion. Each test is phrased as questions. I’ve included a emoji to reflect how I think the current version of ADPPA responds to the questions. **✅ *yes* *!* *ADPPA passes the test*** ❓ *I’m not sure or it's complex* ❌ **no.* ADPPA does not currently pass the test* 1. **❌** Does ADPPA protect private media, personal correspondence, informational data, and metadata by default? 2. ❌ Does ADPPA protect sensitive data like a romantic video, an emotional voice note, or an online private message threads? 3. ❌ Does ADPPA protect information about people’s communications patterns? 4. ✅ Does ADPPA contain heightened protection of individuals’ account or device log-in credentials, activities over time and across third-party websites or services? 5. ❓ Does ADPPA contain heightened protection information about television, cable or streaming service subscriptions, preferences, and usage? 6. ❓ Does ADPPA tightly secure health and genetic information? 7. ❓ Does ADPPA include intentionally inclusive civil rights protections? 8. ❌ Does ADPPA tightly secure location data that could put LGBTAIQ2S+ people at risk? 9. ❌ Does ADPPA protect pregnant LGBTAIQ2S+ people in states that have criminalized abortion? 10. ❌ Does ADPPA allow pro-LGBTAIQ2S+ cities and states to protect residents by passing stronger protections? If your first thought is "yikes, this is not good, we should do something about it," feel free to skip ahead to ***Time for an Intervention***. Otherwise, read on for the details. ### ❌ **Does ADPPA protect private media, personal correspondence, informational data, and metadata by default?** This is an easy and unambiguous one: no. ADPPA only protects sensitive data by default. Data that reveals sexual orientation, gender identity or experession, or sex is not considered sensitive – so isn’t protected by default. As Albert says, “Safeguarding data that facially connects people to nontraditional sexual orientations or activities is paramount.” ### **❌ Does ADPPA protect sensitive data like a romantic video, an emotional voice note, or an online private message threads?** The previous version of ADPPA would have been a yes on this. Videos, voice notes, private message threads are all considered sensitive data in ADPPA. So are Albert’s other examples including background data and metadata like calendar events, address book contacts and contact notes, and phone logs. Unfortunately, the latest version added a major exception: much of this information is *not* considered sensitive if it’s on employer-issued machines. Work-related discussions may include very sensitive data; and many queer people blur the boundaries between work machines and personal business. ### **❌ Does ADPPA protect information about people’s communications patterns?** No. For one thing, communications patterns employer-issued machines are not protected. And as EFF noted in their [June comments](https://www.eff.org/files/2022/06/14/2022.06.13%5Feff%5Fletter%5Fto%5Fhouse%5Fenc%5Fre.%5Fhearing%5Fon%5Fprotecting%5Famericas%5Fconsumers%5F.pdf?ref=thenexusofprivacy.net) on the discussion draft, ADPPA’s definition of sensitive data should be expanded to include familial and social relationships. ### **✅ Does ADPPA contain heightened protection of individuals’ account or device log-in credentials, activities over time and across third-party websites or services?** Yes, ADPPA treats these all as sensitive data. ### ❓**Does ADPPA contain heightened protection information about television, cable or streaming service subscriptions, preferences, and usage?** I think so but the language just changed in the last version and I haven ‘t seen any analyses of it yet so am not sure. ### ❓**Does ADPPA tightly secure health and genetic information?** ADPPA considers both health and genetic information as sensitive data but there are some significant exceptions so the answer here is not straightforward. One big potential loophole is that "de-identified" data is completely exempted from the ADPPA. I put air quotes around “de-identified” because it is almost always easy to re-identify people. Indeed, as[ HIPAA and the Leak of “Deidentified” EHR Data](https://www.nejm.org/doi/full/10.1056/NEJMp2102616?query=WB&ref=thenexusofprivacy.net) in the New England Medical Journal discusses, HIPAA's exception for "de-identified" health data has allowed "massive troves of digital health data to traverse the medical–industrial complex unmonitored and unregulated." There’s been a lot of discussion of “de-identified” location data under ADPPA (and we’ll mention it too in the next section), but as far as I know there hasn’t been any discussion of “de-identified” health data as a potential loophole. Also, ADPPA’s data minimization rules have exceptions allowing data to be used without consent for internal research and public interest research. A bipartisan amendment in the latest version, described in terms of making it easier to do clinical research, changed the public interest research language. I haven’t yet seen a discussion of whether it opened up some loopholes but it seems worth looking at. ### **❓ Does ADPPA include intentionally inclusivecivil rights protections?** At first it seems like this is a clear "no". The list of protected classes in ADPPA's anti-discrimination language (§207(c)) does not mention sexual orientation, gender identity, or gender expression. But it's more complex than that. The Supreme Court's 2020 Bostock ruling found that "on the basis of sex" includes discrimination on the basis of sexual orientation or gender identity, meaning that they're implied by the current language in ADPPA as well. Then again, just last month, a judge in Tennessee issued an injuction blocking the Department of Education from Title IX protections to transgender and gay employees/students. So the law is potentially unsettled. On the one hand, as Albert says, queer people cannot rely on “interpretive generosity.” On the other hand, I don't know the political landscape around this issue; it could be that there's some reason that it's actually better to rely on the current language. So I'm going to leave this as a ❓ for now in hopes until it's clear what LGBTAIQ2S+ organizations and activists think is the right answer. ### **❌ Does ADPPA tightly secure location data that could put LGBTAIQ2S+ people at risk?** "Precise geolocation data" (§2(24)) is considered sensitive data under ADPPA so it seems like the answer to this should be yes. But there’s a big caveat here: a lot of data that you and I might think of as precise location data *isn't* considered "precise geolocation data" under ADPPA. For example, Californians for Consumer Privacy [notes that](https://www.caprivacy.org/californians-for-consumer-privacy-announce-opposition-to-adppa/?ref=thenexusofprivacy.net) location data inferred from a surveillance camera or a photo taken in a gay bar aren’t considered sensitive data – meaning it can be shared without consent. And remember just last year when [“de-identified” data from gay dating app data Grindr was apparently sold off and linked to a Catholic priest](https://www.vox.com/recode/22587248/grindr-app-location-data-outed-priest-jeffrey-burrill-pillar-data-harvesting?ref=thenexusofprivacy.net), who then resigned from his job? ADPPA completely exempts “de-identified” data. Sen. Ron Wyden, who’s usually right about stuff like this, has flagged this as a major loophole. ### **❌ Does ADPPA protect pregnant LGBTAIQ2S+ people in states that have criminalized abortion?** Probably not. - Rep. Anna Eshoo has said ADPPA has a loophole that leaves pregnant people at risk of having their data shared with"sinister prosecutors" in states that have criminalized abortion - Sen. Wyden says the de-identified data loophole lets companies sell location data to the government about visits to reproductive health facilities - Senate Commerce Committee staffers warn that the bill "makes it harder for people to seek redress when their sensitive health data has been used against them” and would force people to “jump through arbitrary, drawn-out hoops” to sue over privacy violations. - Kim Clark of Legal Voice says “This bill, at least from the perspective of pregnant people, it really doesn’t do much” ### **❌ Does ADPPA allow pro-LGBTAIQ2S+ cities and states to protect residents by passing stronger protections?** No. ADPPA preempts most existing and future state and local privacy laws. Daniel Solove's[ A Faustian Bargain: Is Preemption Too High a Price for a Federal Privacy Law?](https://teachprivacy.com/a-faustian-bargain-is-preemption-too-high-a-price-for-a-federal-privacy-law?ref=thenexusofprivacy.net) looks at the tradeoffs around preemption in general. From an LGBTAIQ2S+ perspective, this means that if a city like Seattle or a state like Washington wants to better protect its LGBTAIQ2S+ residents by addressing some these problems ... we can't. ## Important: This generalizes to other lenses There is nothing uniquely powerful about the LGBTAIQ2S+ lens. Other targeted and marginalized communities also have harsh and worsening realities. Stress-testing legislation from the perspectives pregnant people and potentially-pregnant people, immingrants, disabled people, Native American and Indigenous people, people without their own devices and/or access to a network, seniors ... all of those lenses can yield insights – and highlight issues that aren't getting attention in the broader conversation. For example, over two dozen disability rights groups have written to Speaker Pelosi which includes a good description of the harsh realities of how disabled people are at particular risk from the misuse of data, including unscrupulous, exploitative, risky, or even dangerous uses of data. It also describes three important stress tests for ADPPA > defining health and disability data as sensitive and thus given extra protection, defining disability as a protected class, and requiring that covered entities make their policies and consent mechanisms accessible to people with disabilities They also ask Pelosi (and the legislators from both parties they CC'ed) to retain and *improve* the protections. Stress tests from a disability perspective can identify specific improvements. It's good that ADPPA defines health and disability data as sensitive; however, employee data is exempt, so what about disability-related HR and benefits information? Is purchasing behavior involving books about long Covid sensitive? Do companies need consent to use "non-sensitive" data to target ads for those books? And so on ... There are plenty of other disability stress tests to consider it as well. The groups who have written the letter, as well as other disability advocates, have the clearest picture of what they want to see in legislation, so are likely to come up with the most relevant tests. And the same is true for other stress tests. Who best knows the privacy and surveillance threats to immigrants? Immigrants! --- \* I'm using LGBTAIQ2S+ as a shorthand for lesbian, gay, gender non-conforming, genderqueer, bi, trans, asexual, agender, intersex, queer, questioning, [two-sprit](https://oacas.libguides.com/sogie/two-spirit?ref=thenexusofprivacy.net), and others who are not straight, cis, or heteronormative. [Julia Serrano's trans, gender, sexuality, and activism glossary](https://www.juliaserano.com/terminology.html?ref=thenexusofprivacy.net) has definitions for most of terms, although resources like [OACAS Library Guides' Two-spirit identities page](https://oacas.libguides.com/sogie/two-spirit?ref=thenexusofprivacy.net) to into a lot more detail. Serrano also discusses the tensions between ever-growing and always incomplete acronyms and more abstract terms like "gender and sexual minorities". For this particular essay, the specific perspectives matter in the section highlighting why sex, sexual orientation, and gender identity all need to be treated as sensitive data, so I decided to go with the acronym despite its problems. Ontario Human Rights Commission's page on [Gender identity and gender expression](https://www3.ohrc.on.ca/en/en/policy-preventing-discrimination-because-gender-identity-and-gender-expression/3-gender-identity-and-gender-expression?ref=thenexusofprivacy.net) is a good short reference on the distinctions between gender identity, gender expression, sexual orientation, and sex. ## Updates **September 8**: - Added new "Important: This generalize to other lenses" section. - Changed the title; it was originally "Stress-testing ADPPA with a queer lens" but other than hard-core privacy people nobody knows what ADPPA is. **November 18**: - Removed "time for an intervention" section – as we're heading into the lame duck session, there isn't really time any more! ### Privacy News: September 6 URL: https://thenexusofprivacy.net/privacy-news-september-6/ Last updated: 2022-09-07T17:15:47.000Z At least in Washington state, there's already a touch of fall in the air ... as well as plenty of provacy news of course! ### [Encrypted app Signal just hired one of Big Tech’s sharpest critics](https://washingtonpost.com/technology/2022/09/06/signal-meredith-whittaker?ref=thenexusofprivacy.net) Nitasha Tiku on The Washington Post (washingtonpost.com) Meredith Whittaker, the former Google manager, is Signal’s first President. (Signal founder Moxie Marlinspike stepped down as CEO on January, and remains on the board along with Whittaker and Brian Acton as they search for a new CEO.) Whittaker's known for helping lead the Google Walkout in 2018, and her work at AI Now. One of her top priorities at Signal will be to move to a sustainable funding strategy; most of the company's funding to date has come from a long-term $50,000,000 loan from Acton. In the [official post on Signal's blog](https://signal.org/blog/announcing-signal-president?ref=thenexusofprivacy.net), Whittaker says > What’s revolutionary about Signal isn’t just the integrity of its cryptographic methods: Signal’s focus on communication sets it apart from the rest. From the beginning, the team behind Signal put people and their needs at the core of their commitments. They understood that iron-clad security is fairly pointless if people can’t use, access, or feel comfortable with it. In other words, if my friends won’t use a messaging app, it doesn’t work as a messaging app. It works as a thought experiment, at best. Understanding this, Signal’s developers and designers created an app that honors people’s needs and expectations, while maintaining strict privacy promises. This is something that’s incredibly difficult to do, and that reflects significant vision and humility. **FIND OUT MORE:** - [A Message from Signal’s New President](https://signal.org/blog/announcing-signal-president?ref=thenexusofprivacy.net), Meredith Whittaker on Signal Messenger (signal.org) - [Meredith Whittaker: “We won’t participate in the surveillance business model”](https://www.derstandard.at/story/2000138831199/meredith-whittaker-we-wont-participate-in-the-surveillance-business-model?ref=thenexusofprivacy.net), an interview by Andreas Proschofsky on DER STANDARD (derstandard.at) The new president of the Signal Foundation in a wide-ranging interview about her distrust of big tech, messenger encryption and the fundamental problems of AI ## Federal Privacy Legislation ### [Pelosi opposes proposed American Data Privacy and Protection Act, seeks new preemption compromise](https://iapp.org/news/a/pelosi-rejects-proposed-american-data-privacy-and-protection-act-seeks-new-compromise/?ref=thenexusofprivacy.net) Joe Duball, on IAPP (iapp.org) Right before Labor Day, Rep. Pelosi released a [statement](https://www.speaker.gov/newsroom/9122?ref=thenexusofprivacy.net) saying she would not hold a vote on the American Data Privacy and Protection Act (ADPPA) consumer privacy bill in its current form. Who could have predicted? Pretty much everybody, actually: this has been Pelosi's position since 2019, and California's Governor, AG, state legislature leadership, and privacy agency have all opposed ADPPA's preemption of California's laws. The article has a lots of good quotes, including from ADPPA co-sponsors Frank Palone and Cathy McMorris Rodgers, California Privacy Protection Agency Executive Director Ashkan Soltani, Kirk Nahra of Wilmer Hale, Omer Tene of Goodwin Procter (who thinks California should just get over it), Information Accountability Foundation Chief Policy Innovation Officer Martin Abrams, and Alan Butler of EPIC Privacy. Here's some of what Butler has to say: > "This statement is a signal that the Speaker wants to ensure that the ADPPA builds on the standards set by California and does not impede the ability of California and other states to address rapid changes in technology in the future. I think both of those issues are addressable, first through substantive tweaks to address issues of differences raised by the CPPA and others in California and possibly by modifications to the preemption provisions that would allow states to continue to be the laboratories of democracy in the future as technology evolves." **ALSO:** - [Congress is running out of time for its sweeping tech agenda](https://www.washingtonpost.com/politics/2022/09/06/congress-is-running-out-time-its-sweeping-tech-agenda/?ref=thenexusofprivacy.net), Cristiano Lima on the Washington Post (washingtonpost.com), which also looks at the American Innovation and Choice Online Act and Open App Markets Act anti-trust bills. - [ADPPA’s Preemption of State Laws is A Major Sticking Point](https://www.hipaajournal.com/adppas-preemption-of-state-lawsis-a-major-sticking-point/?ref=thenexusofprivacy.net), HIPAA Journal (hipaajournal.com) - [American Privacy: What’s Next for the ADPPA](https://www.ilpfoundry.us/podcast/privacy-and-adppa-with-sophia-baik-episode-15/?ref=thenexusofprivacy.net), Sophia Baik and Lama Mohammed, a podcast on Internet Law & Policy Foundry (ilpfoundry.us) - [Ad Tech Granted Some Relief With Federal Privacy Bill ‘Dead’ in This Congress](https://www.adweek.com/programmatic/ad-tech-granted-some-relief-with-federal-privacy-bill-dead-in-this-congress/?ref=thenexusofprivacy.net), Trishla Ostwal, Ad Week (adweek.com) ## Privacy after Roe #### [Should we delete our period tracking apps?](https://theguardian.com/news/audio/2022/sep/05/should-we-delete-our-period-tracking-apps?ref=thenexusofprivacy.net) Hannah Moore on the Guardian (theguardian.com) Since Roe v Wade was overturned in the US in June, there are concerns that law enforcement could request the intimate data users share with period tracking apps. Johana Bhuiyan reports on the privacy concerns #### [These Period Tracker Apps Say They Put Privacy First. Here’s What We Found.](https://news.yahoo.com/period-tracker-apps-put-privacy-122619401.html?ref=thenexusofprivacy.net) Catherine Roberts on Yahoo News (news.yahoo.com) With growing concern about reproductive health privacy, CR’s Digital Lab evaluated the protections offered by Drip, Euki, Lady Cycle, Periodical, and more. ## And ... #### [Instagram fined €405M for violating kids’ privacy](https://politico.eu/article/instagram-fined-e405m-for-violating-kids-privacy?ref=thenexusofprivacy.net) Vincent Manancourt on POLITICO (politico.eu) The fine is the third for a Meta-owned company handed down by the Irish regulator. FIND OUT MORE: - [Instagram fined €405M in EU for children’s privacy breaches](https://techcrunch.com/2022/09/05/instagram-gdpr-fine-childrens-privacy?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com) #### [‘I didn’t want it anywhere near me’: how the Apple AirTag became a gift to stalkers](https://theguardian.com/technology/2022/sep/05/i-didnt-want-it-anywhere-near-me-how-the-apple-airtag-became-a-gift-to-stalkers?ref=thenexusofprivacy.net) Anna Moore on The Guardian (theguardian.com) A gadget the size of a 10p coin, the AirTag was intended to help people find their keys. Instead it has facilitated a boom in terrifying behaviour from abusers #### [As Ex-Uber Executive Heads to Trial, the Security Community Reels](https://nytimes.com/2022/09/06/technology/joe-sullivan-uber-security-trial-ciso.html?ref=thenexusofprivacy.net) Kashmir Hill and Kellen Browning on NYTimes (nytimes.com) Joe Sullivan, Uber’s former chief of security, faces criminal charges for his handling of a 2016 security breach. His trial this week has divided the security industry. #### [Halfords fined for sending nearly 500,000 unwanted marketing emails](https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2022/09/halfords-fined-for-sending-nearly-500-000-unwanted-marketing-emails?ref=thenexusofprivacy.net) on ICO (ico.org.uk) The Information Commissioner’s Office (ICO) has fined Halfords Limited £30,000 for sending 498,179 unsolicited marketing emails to people without their consent. Halfords came to the attention of the ICO following complaints in relation to a direct marketing email about a “Fix Your Bike” government… #### [Could Liz Truss change the UK’s new data laws after parliamentary debate is postponed?](https://techmonitor.ai/policy/privacy-and-data-protection/data-protection-and-digital-information-bill-liz-truss?ref=thenexusofprivacy.net) Sophia Waterfield on Tech Monitor (techmonitor.ai) The Data Protection and Digital Information Bill debate in Parliament was postponed after Liz Truss was named Tory leader and new PM. #### [Why DuckDuckGo’s new email privacy tool is worth checking out](https://fastcompany.com/90786043/why-duckduckgos-new-email-privacy-tool-is-worth-checking-out?ref=thenexusofprivacy.net) Jared Newman on Fast Company (fastcompany.com) You can keep your real email address hidden and minimize tracking by marketers. #### [Over-the-Horizon Drones Line Up But Privacy Is Not In Sight](https://eff.org/deeplinks/2022/08/over-horizon-drones-lineup-privacy-not-sight?ref=thenexusofprivacy.net) Andrés Arrieta on Electronic Frontier Foundation (eff.org) The Federal Aviation Administration (FAA) will soon rule on Beyond Visual Line of Sight (BVLOS) drones, which are capable of flying while its operator (pilot) is far away. While these types of drones might offer benefits to society—think of deliveries, infrastructure inspection, and precision... #### [EFF Calls for Limiting Mandatory Cooperation, Safeguarding Human Rights in International Cybercrime Investigations as Talks Resume for Proposed UN Cybercrime Treaty](https://eff.org/deeplinks/2022/08/eff-calls-limiting-mandatory-cooperation-safeguarding-human-rights-international?ref=thenexusofprivacy.net) Karen Gullo and Tamir Israel on Electronic Frontier Foundation (eff.org) In a new round of talks this week to formulate a UN Cybercrime Treaty, EFF is calling for strictly limiting the scope of the convention’s international cooperation provisions and safeguards to ensure that states respect human rights when responding to legal assistance requests. #### [iRobot addresses privacy concerns amid pending Amazon deal](https://therobotreport.com/irobot-addresses-privacy-concerns-pending-amazon-deal?ref=thenexusofprivacy.net) Steve Crowe on The Robot Report (therobotreport.com) iRobot co-founder and CEO Colin Angle said iRobot’s stance on data privacy will not change when the acquisition by Amazon is finalized. #### [Privacy-driven short-tail bias leaves marketers at a loss as measurement ‘fades to black’](https://thedrum.com/opinion/2022/08/30/privacy-driven-short-tail-bias-leaves-marketers-loss-measurement-fades-black?ref=thenexusofprivacy.net) Jake Moskowitz on The Drum (thedrum.com) The clock is ticking on traditional approaches to media measurement, writes Emodo’s Jake Moskowitz​. #### [Doorbells Deliver a New Dystopian Dilemma](https://morningrattle.com/doorbells-deliver-new-dystopian-dilemma?ref=thenexusofprivacy.net) on The Morning Rattle (morningrattle.com) #### [The GDPR as Privacy Pretext and the Problem of Co-Opting Privacy](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4166261&ref=thenexusofprivacy.net) See all articles by Neil M. Richards on papers.ssrn.com Privacy and data protection law’s expansion brings with it opportunities for mischief as privacy rules are used pretextually to serve other ends. This Essay exa #### [Doing The Math On Privacy Compliance](https://adexchanger.com/adexchanger-talks/doing-the-math-on-privacy-compliance?ref=thenexusofprivacy.net) Allison Schiff on AdExchanger (adexchanger.com) With five state privacy laws set to go into effect next year, consumer privacy and issues related to data collection are top of mind for everyone. #### [Honoring Peter Eckersley, Who Made the Internet a Safer Place for Everyone](https://eff.org/deeplinks/2022/09/honoring-peter-eckersley-who-made-internet-safer-place-everyone?ref=thenexusofprivacy.net) Cindy Cohn on Electronic Frontier Foundation (eff.org) With deep sadness, EFF mourns the loss of our friend, the technologist, activist, and cybersecurity expert Peter Eckersley. Peter worked at EFF for a dozen years and was EFF’s Chief Computer Scientist for many of those. Peter was a tremendous force in making the internet a safer place. --- *Image credit:* Daquella manera on [Flickr ](https://www.flickr.com/photos/62518311@N00/466172168?ref=thenexusofprivacy.net) via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons Attribution 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net) license. ### Privacy News: September 1 URL: https://thenexusofprivacy.net/privacy-news-september-1/ Last updated: 2022-09-05T04:25:09.000Z Today's experiment: more top-level topics, less analysis. Thoughts? ## Surveillance-industrial complex #### [Tech tool offers police ‘mass surveillance on a budget’](https://apnews.com/article/technology-police-california-arkansas-d395409ef5a8c6c3f6cdab5b1d0e27ef?ref=thenexusofprivacy.net) Garance Burke and Jason Dearen on Associated Press (apnews.com) Local law enforcement agencies from suburban Southern California to rural North Carolina have been using Fog Reveal, an obscure cellphone tracking tool, at times without search warrants, that gives them the power to follow people’s movements months back in time,. #### [Inside Fog Data Science, the Secretive Company Selling Mass Surveillance to Local Police](https://eff.org/deeplinks/2022/08/inside-fog-data-science-secretive-company-selling-mass-surveillance-local-police?ref=thenexusofprivacy.net) Bennett Cyphers on Electronic Frontier Foundation (eff.org) A data broker has been selling raw location data about individual people to federal, state, and local law enforcement agencies, EFF has learned. This personal data isn’t gathered from cell phone towers or tech giants like Google — it’s obtained by the broker via thousands of different apps on Android phones. #### [FTC sues company for selling data that could be used to track consumers](https://theguardian.com/technology/2022/aug/29/ftc-sues-kochava-tracking-privacy-data?ref=thenexusofprivacy.net) Guardian staff and agencies on The Guardian (theguardian.com) The lawsuit against data broker Kochava seeks to halt the sale of sensitive geolocation data and delete what was collected #### [Privacy advocates urge cancellation of Amazon’s nightmarish Ring Nation](https://popsci.com/technology/privacy-advocates-amazon-ring-nation-tv?ref=thenexusofprivacy.net) Andrew Paul on Popular Science (popsci.com) MGM Studios, owned by Amazon, is set to premiere the security cam clip show next month. ## Student Privacy #### [Edtech companies breaking UK data laws, privacy campaigners claim](https://ft.com/content/3d649dab-8a54-450d-ae48-e65c3d395fb0?ref=thenexusofprivacy.net) Cristina Criddle on ft.com Investigation by children’s digital rights charity highlights policies of Google Classroom and ClassDojo ## Privacy after Roe #### [Post-Roe, House Democrats want to know how Messenger protects metadata](https://protocol.com/policy/house-democrats-messanger-metadata-abortion?ref=thenexusofprivacy.net) Ben Brody on Protocol (protocol.com) Tech companies have desperately been trying to keep mum on the topic. #### [DNC chairman says issues like abortion that are ‘about privacy and freedom’ will matter more to voters in the midterms](https://news.yahoo.com/dnc-chairman-says-issues-abortion-200021524.html?ref=thenexusofprivacy.net) Pocharapon Neammanee on Yahoo News (news.yahoo.com) DNC chairman Jamie Harrison says that voters will value issues like abortion more than the economy this fall. ## Federal privacy legislation and regulation #### [The Federal privacy bill might be a sheep in wolf’s clothing](https://protocol.com/newsletters/policy/privacy-preemption-adppa?ref=thenexusofprivacy.net) Hirsh Chitkara on Protocol (protocol.com) California and Congress are battling over privacy preemption. #### [The FTC May (Finally) Protect Americans From Data Brokers](https://wired.com/story/the-ftc-may-finally-protect-americans-from-data-brokers?ref=thenexusofprivacy.net) Justin Sherman on WIRED (wired.com) The agency’s lawsuit against Kochava should squash the industry’s core defense—and help keep sensitive info off the open market. #### [The FTC should keep Google out of cars, a privacy group argues](https://protocol.com/policy/tech-auto-privacy-ftc-petition?ref=thenexusofprivacy.net) Ben Brody on Protocol (protocol.com) Fight for the Future says Big Tech’s privacy record should prompt the agency to issue rules that keep the companies from taking over automotive consoles. ## California #### [Why Sephora’s $1.2 million settlement with California should be a wake-up call for companies](https://marketingbrew.com/stories/2022/08/30/why-sephora-s-usd1-2-million-settlement-with-california-should-be-a-wake-up-call-for-companies?ref=thenexusofprivacy.net) ByRyan Barwick and Maeve Allsup on Morning Brew (marketingbrew.com) Some companies using tracking tools like pixels and cookies have been selling customers’ personal information, said California AG. #### [Sweeping Children’s Online Safety Bill Is Passed in California](https://nytimes.com/2022/08/30/business/california-children-online-safety.html?ref=thenexusofprivacy.net) on NYTimes (nytimes.com) The new rules, which would require many online services to increase protections for children, could change how popular social media and game platforms treat minors. ## And ... #### [Why are deep learning technologists so overconfident?](https://aisnakeoil.substack.com/p/why-are-deep-learning-technologists) Arvind Narayanan on AI Snake Oil (aisnakeoil.substack.com) Deep learning researchers have proved skeptics wrong before, but the past doesn’t predict the future. #### [The uselessness of AI ethics - AI and Ethics](https://link.springer.com/article/10.1007/s43681-022-00209-w?ref=thenexusofprivacy.net) Luke Munn on SpringerLink (link.springer.com) As the awareness of AI’s power and danger has risen, the dominant response has been a turn to ethical principles. A flood of AI guidelines and codes of ethics have been released in both the public and private sector in the last several years. However, these are meaningless principles which are conte… #### [The Right to Keep Private Pain Private](https://nytimes.com/2022/08/31/opinion/ashley-judd-naomi-suicide.html?ref=thenexusofprivacy.net) Ashley Judd on NYTimes (nytimes.com) I could not help my mother, Naomi Judd, who lost a long battle against mental illness. I can, however, do something about how she is remembered. #### [A huge Chinese database of faces and vehicle license plates spilled online](https://techcrunch.com/2022/08/30/china-database-face-recognition?ref=thenexusofprivacy.net) Zack Whittaker on TechCrunch (techcrunch.com) Another mass data lapse exposes new weaknesses in China’s sprawling surveillance state. #### #### [The Data Protection Commission is broken. Here is how to fix it](https://irishtimes.com/opinion/2022/09/01/the-data-protection-commission-is-broken-here-is-how-to-fix-it?ref=thenexusofprivacy.net) on The Irish Times (irishtimes.com) To restore confidence, the Government must ensure a robust and completely independent process to select two new commissioners #### [You’re Not Stringer Bell, but You May Still Need a Burner Phone](https://wired.com/story/how-to-use-burner-phone?ref=thenexusofprivacy.net) on WIRED (wired.com) Prepaid phones are looking good as privacy worries peak. #### [Norwegian parliament fined](https://datatilsynet.no/en/news/aktuelle-nyheter-2022/norwegian-parliament-fined?ref=thenexusofprivacy.net) on Datatilsynet (datatilsynet.no) The Norwegian parliament – the Storting – had a data breach in late 2020\. In January, the Data Protection Authority gave notice of a NOK 2 million fine for inadequate security. We have now considered the Storting’s comme … #### [Apple’s Chief Privacy Officer Jane Horvath to Depart Company](https://macrumors.com/2022/08/30/jane-horvath-leaving-apple?ref=thenexusofprivacy.net) Juli Clover on MacRumors (macrumors.com) Apple privacy chief Jane Horvath is set to leave the company to join a law firm, according to a new report from Bloomberg. Horvath has served as... #### [Apple’s Chief Privacy Officer Set to Leave Company for Law Firm](https://bloomberg.com/news/articles/2022-08-30/apple-s-chief-privacy-officer-set-to-leave-company-for-law-firm?ref=thenexusofprivacy.net) on bloomberg.com Jane Horvath, who first joined Apple in 2011, is taking a job at Gibson, Dunn & Crutcher LLP. Privacy has become central to Apple’s marketing efforts, and Horvath represented the company in its dealings with trade groups and Capitol Hill. Horvath was one of a few Apple executives to hold a “chief officer” title, a group that includes the chief operating officer, chief compliance officer and chief financial officer. #### [The Nigerian Lawyer, His/her Emails, WhatsApp Groups And Unresolved Privacy Questions](https://thenigerialawyer.com/the-nigerian-lawyer-his-her-emails-whatsapp-groups-and-unresolved-privacy-questions?ref=thenexusofprivacy.net) Unini Chioma on TheNigeriaLawyer (thenigerialawyer.com) By Olumide Babalola As technology continues to emerge, so also will privacy and data protection jurisprudence! This article only seeks to provoke discussions on the subject, it neither represents a cast-in-stone position on the posers nor apt answers to the analysis. Since COVID-19, the average Nige… #### [How to check the Privacy Report for website tracking in Safari](https://zdnet.com/article/how-to-check-the-privacy-report-for-website-tracking-in-safari?ref=thenexusofprivacy.net) Jack Wallen on ZDNET (zdnet.com) Jack Wallen shows you how to view the Safari Privacy Report so you can see just how prevalent trackers are on the sites you visit. #### [The Cost Of Data Privacy: How A Patchwork Regulatory Framework Impacts Video Game Creators](https://forbes.com/sites/forbestechcouncil/2022/08/24/the-cost-of-data-privacy-how-a-patchwork-regulatory-framework-impacts-video-game-creators?ref=thenexusofprivacy.net) Derrick Morton on Forbes (forbes.com) A patchwork of privacy laws means that regulatory schemes from state to state can conflict with each other, confusing consumers and imposing astronomical costs on organizations. #### [Privado Keeps Developers Honest As Data Privacy Regulation Tightens](https://forbes.com/sites/davidprosser/2022/08/24/privado-keeps-developers-honest-as-data-privacy-regulation-tightens?ref=thenexusofprivacy.net) David Prosser on Forbes (forbes.com) Data privacy scanner Privado is today unveiling a $14 million Series A funding round --- Image credit: News by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net), licensed under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net), via [Pix4free](https://pix4free.org/?ref=thenexusofprivacy.net) ### ADPPA's data minimization and duty of loyalty: a deep dive URL: https://thenexusofprivacy.net/adppa-data-minimization/ Last updated: 2026-04-16T02:44:49.000Z One of ADPPA's strong points is its focus on *data minimization*. This principle has been a bedrock of privacy law as one of the Fair Information Practices since the 1970s, and is also included in Europe’s GDPR and California’s CPRA. ADPPA complements data minimization with a “duty of loyalty”, a powerful and relatively-recent innovation in privacy law. As privacy scholars Neil Richards and Woodrow Herzog write in[ We’re so close to getting data loyalty right](https://iapp.org/news/a/were-so-close-to-getting-data-loyalty-right/?ref=thenexusofprivacy.net) > Done correctly, duties of loyalty would change a company’s business incentives away from manipulative and exploitative practices toward long-term, sustainable and mutually beneficial information relationships between people and companies Of course, as widely-respected privacy scholar Prof. Daniel Solove says in [Further Thoughts on ADPPA, the Federal Comprehensive Privacy Bill](https://teachprivacy.com/further-thoughts-on-adppa-the-federal-comprehensive-privacy-bill/?ref=thenexusofprivacy.net), "many parts of privacy laws have pretty-sounding rhetoric but ultimately are not any deeper”. Virginia’s and Utah’s privacy laws – which even industry lobbyists describe as “weak and loophole-ridden” – are also based on data minimization principles, but the wording is so weak that there’s virtually no protection. So let’s dive more deeply into these relevant sections of ADPPA. I’ve included some of the key language from the current version of bill;, but if you want to follow along in the text, section numbers (§) refer to the[ July 19 ADPPA version](https://docs.house.gov/meetings/IF/IF00/20220720/115041/BILLS-117-8152-P000034-Amdt-1.pdf?ref=thenexusofprivacy.net) as amended by the six[ amendments](https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=115041&ref=thenexusofprivacy.net) that passed.[ The redlined version from IAPP and Future of Privacy Forum](https://media-exp1.licdn.com/dms/document/C4E1FAQG-kcljte035A/feedshare-document-pdf-analyzed/0/1658364628458?e=1661990400&v=beta&t=rw5yxfubj0O4f0wUTkGNr1XoCc3eC0MtfVRIGhDNRkMhttps://media-exp1.licdn.com/dms/document/C4E1FAQG-kcljte035A/feedshare-document-pdf-analyzed/0/1658364628458?e=1663804800&v=beta&t=tfCKZkWWRth0EvQY71JCP6LgFnQRIbstucvzxJq8yPg&ref=thenexusofprivacy.net), including all the amendments and highlighting changes from the subcommittee's version, is also very useful. ## Data minimization and permissible purposes > A covered entity may not collect, process, or transfer covered data unless the collection, processing, or transfer is limited to what is reasonably necessary and proportionate to— > > (1) provide, or maintain a specific product or service requested by the individual to whom the data pertains; or > > (2) effect a purpose expressly permitted under subsection (b). > > – American Data Privacy and Protection Act (ADPPA), §101(a): ADPPA’s data minimization rules apply to everything that the businesses and non-profits it regulates do to any data that it covers. There are actually some big exemptions hidden behind these definitions,\* but put that to the side for now and focus on the entities and data that it does cover. Once a company collects data for specific purpose, ADPPA's data minimization rules say they can only process or transfer it it for that purpose and for the other *permissible purposes* listed in §101(b). Why have *any* permissible purposes beyond providing the individual with the product or service the individual requests? Well, imagine if companies had to get consent from everybody before each time they analyze email to see whether it should go into a spam folder. Spammers wouldn’t give consent, so good luck with spam detection. And for the rest of us, you can imagine how this would be even more annoying than cookie dialogs. We’ll go through the specific permissible purposes below, but first let’s talk about how the ADPPA’s “duty of loyalty” interacts with the data minimization requirements. ## “Duty of loyalty” As Richards and Herzog discuss, ADPPA’s “duty of loyalty” (§102) only covers data minimization – [just one piece of what a duty of loyalty really needs to cover](https://iapp.org/news/a/were-so-close-to-getting-data-loyalty-right/?ref=thenexusofprivacy.net), and the reason I put air quotes around it. Still, it’s certainly an important aspect, and ADPPA’s “duty of loyalty” adds some significant protections for *sensitive data* (defined in §2(28)) Sensitive data is a fairly broad category under ADPPA, including health data; biometric and genetic information; “precise geolocation information”; credit card numbers and financial information; drivers license and passport numbers; photos, videos, and private communications including emails, voicemails and texts (unless they’re on employer-issued machines); and quite a few other categories. There are some important exceptions; for example, sex, sexual orientation, and immigration status aren’t considered sensitive data, and as [Californians for Consumer Privacy discusses](https://www.caprivacy.org/californians-for-consumer-privacy-announce-opposition-to-adppa/?ref=thenexusofprivacy.net) the definition of “precise geolocation information” (§2(24)) excludes location information from surveillance cameras and photos people take. Once again, though, let’s put these aside for now. For sensitive data, ADPPA’s “duty of loyalty” adds several important protections to the basic data minimization rules: - Prohibiting transferring (selling or sharing) sensitive data to third parties\*\* without consent, with a few exceptions (listed in §102(3)) - A heightened standard of *strictly* necessary and proportionate (as opposed to just *reasonably* necessary and proportionate) - Prohibiting collecting and processing sensitive data for targeted advertising or as part of a merger or acquisition\*\*\* - Allowing individuals to sue under the private right of action if their sensitive data is misused\*\*\*\* Looking at it differently, ADPPA’s “duty of loyalty” says that businesses and non-profits can collect or process even sensitive data as long as it’s strictly necessary for permissible purposes (1)-(15) without asking consent. And it's not just they don't have to get your consent. There’s an exception to ADPPA’s opt-out rights (§204(b)(2)) which says *you can’t even opt out* of having your data collected, processed, and transferred for these purposes. ## What could possibly go wrong? The example permissible purpose I talked about above, spam detection, seems innocuous enough. Others, though, could potentially open up big loopholes. For example,, §101(b)(2)(C) allows companies to collect and process data “to conduct internal research or analysis to improve a product or service for which such data was collected.” This also sounds innocuous, but here’s what Washington’s Attorney General Ferguson had to say[ in June](https://www.documentcloud.org/documents/22111995-ferguson-privacy-letter-to-4-corners%5F6-24-2022?ref=thenexusofprivacy.net) about the effects of a slightly-differently-worded version of this in the June ADPPA discussion draft > This broad exemption … may be used by technology companies to maintain all data indefinitely. For example, a company may deny all requests to delete biometric data or retain user photos (including of children) because the data is used to improve their photo tagging technology. Technology companies and their teams of corporate lawyers will defend their data processes, no matter how harmful, as internal research intended to improve the company’s products or services. In short, if Congress passes legislation with this exemption, it will undermine the entire purpose of data privacy legislation. And remember, opt-out doesn’t apply. So no matter why a company’s collected your data, you can’t stop them from using it without your consent for “internal research or analytics” as long as they can claim the way they’re using it is reasonably necessary and proportionate to improving their product or service. If it’s not sensitive data, they can transfer it to third parties without your consent as well. Ferguson’s [comments](https://www.documentcloud.org/documents/22111995-ferguson-privacy-letter-to-4-corners%5F6-24-2022?ref=thenexusofprivacy.net) were on an earlier draft of ADPPA and the current draft has a slightly narrower definition, but the lawyers I checked with didn't think the changes had fully addressed this issue. It’s a good example of how a innocuous-sounding permissible purpose could open up major loophole. ## Fraud and illegal activity With that as background, let’s move on to a pair of permissible purposes that *EFF* expressed concern about in their [June 14 letter ](https://www.eff.org/deeplinks/2022/06/eff-urges-congress-strengthen-american-data-privacy-and-protection-act?ref=thenexusofprivacy.net)(which like AG Ferguson’s letter applied to an earlier draft. §101(b)(6) allows collecting and processing data (without consent or the ability to opt out) to prevent, detect, protect against or respond to fraud. In[ Privacy bill triggers lobbying surge by data brokers](https://www.politico.com/news/2022/08/28/privacy-bill-triggers-lobbying-surge-by-data-brokers-00052958?ref=thenexusofprivacy.net), Alfred Ng quotes a data broker’s deputy general counsel as saying that their lobbying was to help “ensure that fraud prevention products can continue providing meaningful consumer protections.” Ng also quoted staffers as saying the lobbying hasn't had any effect, but I'm not so sure: the latest version added new exceptions for fraud in the “duty of loyalty” and several other places.\*\*\*\*\* Think about the kinds of companies that would want to take advantage of this exception. Data broker[ LexisNexis is currently being sued by immigration advocates](https://apnews.com/article/chicago-lawsuits-georgia-immigration-635396b572cadf172c74b4a0000f52e8?ref=thenexusofprivacy.net) for collecting, combining, and selling personal data without consent. Surveillance technology company Clearview AI was banned from selling facial recognition technology in the US after[ secretly taking facial recognition data from people without their consent](https://www.malwarebytes.com/blog/news/2022/05/clearview-ai-banned-from-selling-facial-recognition-data-in-the-us?ref=thenexusofprivacy.net) in May, and just two weeks later introduced the laughably-named[ Clearview Consent](https://www.clearview.ai/clearview-ai-launches-clearview-consent-companys-first-consent-based-product-for-commercial-use?ref=thenexusofprivacy.net) which "is all about making everyday consumers feel more secure in a world that is rife with crime and fraud." Facebook, Google, and other ad tech companies are concerned with advertising fraud. Companies in the[ connected vehicle data ecosystem](https://themarkup.org/the-breakdown/2022/07/27/who-is-collecting-data-from-your-car?ref=thenexusofprivacy.net) focus on insurance fraud. The list goes on. How much non-consensual data collection and processing will these companies be able to do as a result of this exception? §101(b)(6) also allows collecting and processing data to prevent, detect, protect against or respond to illegal activity, which is defined as a felony or misdemeanor that causes harm. In states which have criminalized abortion, does this mean that pregnant people's data can be collected processed (without consent or the ability to opt out) if it's "strictly necessary" to prevent abortions? What about states which have criminalized gender-affirming health care? ## Trespass and public safety incidents §101(b)(5) allows collecting and processing data (without consent or the ability to opt out) to prevent, detect, protect against or respond to security incidents. In the latest version, - the definition of security incident in §101(b)(5) was broadened to add trespass. - a new permissible purpose §101(b)(15) was added, allowing government entities to require contractors to process to prevent, detect, protect against, or respond to public safety incidents, including trespass. - and a new "duty of loyalty" exception 102(3)(D), allows government contractors transfer an individual’s sensitive data to third parties without consent if the transfer is necessary to prevent, detect, protect against or respond to a public safety incident including trespass, natural disaster, or national security incident What risk does this create in cities and states that use “trespass” laws to target [unhoused people](https://thenexusofprivacy.net/is-there-an-elephant-in-the-zoom-room/#does-adppa-protect-unhoused-people)? What about law enforcement agencies surveilling activists (who after all might cause a protest that escalates into a public safety incident)? ## But wait, there’s more! This version of ADPPA’s has 17 permissible purposes, up from 12 in the previous version. Most of them raise at least some questions. For example: - Does §101(b)(7) (which allows companies to use data without consent “to investigate, establish, prepare for, exercise, or defend legal claims involving the covered entity or service provider”) mean that Google can use whatever you’ve got in your email and Google Docs to prepare for potential future legal claims against them? - Anti-abortion “crisis preganancy centers” have a “good faith” believe in imminent risk of serious harm caused by abortions. Does §101(b)(8) allow them to process any data they’ve obtained for other purposes to prevent or detect people who might be about to get an abortion – or health care providers who might be performing, or helping with, abortions? What about gender-affirming care? Does the similarly-worded “duty of loyalty” exception §102(3)(C) allow transferring (sharing and selling) this data? - How broad are the exceptions for “public interest research” (§101(b)(10)), especially after the latest amendment adding an exemption for research that’s excluded from criteria of institutional review boards? - §101(b)(13) lets companies transfer data in the context of mergers, acquisitions, and bankruptcies. While they do have to provide notice and a “reasonable opportunity” to request deletion, ADPPA's deletion rights have significant exceptions – for example, companies can ignore requests that interfere with "investigations, or reasonable efforts to guard against, detect, prevent, or investigate fraudulent, malicious, or unlawful activity." (§203(e)(3)(A)(vii)). What kinds of loopholes does this open up? - §101(b)(16) covers first-party advertising and marketing, and §101(b)(17) covers third-party targeted advertising. Unlike the other permissible purposes, the “duty of loyalty” doesn’t currently let companies or non-profits use sensitive data for these purposes. Still, because they're permissible purposes, companies can use non-sensitive data for advertising without consent (although like CPRA, ADPPA does provide an opt-out for targeted advertising (204(c))). What are the implications? ## Cynicism is justified Maybe I’m just being cynical to think that industries that make money by exploiting people’s data are trying to get loopholes into ADPPA that let them legally exploit as much data as possible without asking for consent. Perhaps data brokers and surveillance-industrial complex companies won’t try to take advantage of the exceptions for “internal research”, “trespass,” “fraud,” “illegal activity” and government contractors. Or maybe ADPPA’s standards of “strictly necessary” for sensitive data, and “reasonably necessary” for non-sensitive data are strong enough to prevent shenanigans. But then again, as[ What Microsoft, IBM and others won as the privacy bill evolved](https://www.protocol.com/newsletters/policy/cloud-enterprise-privacy?ref=thenexusofprivacy.net) and[ Privacy bill triggers lobbying surge by data brokers](https://www.politico.com/news/2022/08/28/privacy-bill-triggers-lobbying-surge-by-data-brokers-00052958?ref=thenexusofprivacy.net) discuss, there’s been a heckuva lot of lobbying to weaken ADPPA since it was first introduced, with [a fair amount of success](https://thenexusofprivacy.net/what-about-the-elephant/#weakening) – and the next version of ADPPA may be even weaker. Especially if you look at the past behavior of the entities this bill is trying to regulate – and the way big tech has pushed weak privacy legislation across the country – it’s clear that cynicism is justified. So it would be great to see some more detailed legal analysis of ADPPA’s data minimization sections. If there are some issues, there’s still time to amend ADPPA; there may well be existing language in other bills worth looking at. For example, California’s CPRA limits the “serious harm” exception to sharing data with law enforcement (as opposed to ADPPA which also allows sharing data to vigilantes), and puts in some process requirements for emergency requests. HIPAA similarly only allows sharing with law enforcement, and then only if there’s a warrant, subpoena, or summons. These all seem like potential improvements to ADPPA’s current protections. Of course there’s also the political aspect: even if it turns out that improvements are needed to better protect people at risk, are the votes there? It’s hard to know. Stay tuned! --- \* For example, ADPPA exempts “de-identified” data, employee data including benefits information, publicly available information, and inferences from publicly available information (§2(9)). It also exempts government agencies, banks, airlines, and other businesses not regulated by the FTC Act (§2(9)). And, when a covered entity is collecting, processing, or transferring data on behalf of a government agency or another covered entity, they’re not considered a covered entity; they’re a *service provide*r instead. \*\*\* Note that ADPPA's definition of "third party" specifically excludes affiliates. Also, when a service provider collects, processes, or transfers data on behalf of a business, non-profit, or government agency, they’re also not considered a third party. These are both potentialcans of worms on their own –[ EFF has concerns](https://www.eff.org/deeplinks/2022/07/americans-deserve-more-current-american-data-privacy-protection-act?ref=thenexusofprivacy.net) that an amendment to the latest version gives service providers much more leeway than it should. But this writeup is already long and complex enough that I’ll save this discussion for a potential future post. \*\*\* the “duty of loyalty” only allows collection and processing for permissible purposes (1)-(12) and (14), so these other purposes are excluded \*\*\*\* The private right of action *doesn't* apply to violations of data minimization (§209(e)(1)), but does to the “duty of loyalty” \*\*\*\*\* §102(1), §203(E)(1)(e), §203(E)(3)(A)(vi), and §209(b)(2). [ The redlined version from IAPP and Future of Privacy Forum](https://media-exp1.licdn.com/dms/document/C4E1FAQG-kcljte035A/feedshare-document-pdf-analyzed/0/1658364628458?e=1661990400&v=beta&t=rw5yxfubj0O4f0wUTkGNr1XoCc3eC0MtfVRIGhDNRkM&ref=thenexusofprivacy.net) is very useful for looking at how the bill is changing over time! ### Let's talk about the elephant: how well does ADPPA protect against post-Roe threats? URL: https://thenexusofprivacy.net/adppa-post-roe-threats/ Last updated: 2026-04-16T02:44:05.000Z *Last updated December 16\. See update log at the bottom.* As Danielle Keats Citron discusses in[ The End of Roe Means We Need a New Civil Right to Privacy](https://slate.com/technology/2022/06/end-roe-civil-right-intimate-privacy-data.html?ref=thenexusofprivacy.net), the Supreme Court’s recent decision allowing states to criminalize abortion highlights the stakes of online privacy. In response, Rep. Sara Jacobs (D-introduced the My Body My Data Act, which would provide strong protections to reproductive health care; and Senators Elizabeth Warren, Ron Wyden, Patty Murray, Sheldon Whitehouse, and Bernie Sanders introduced the Health and Location Data Privacy Act, which prohibits sale of health and location data. The Fourth Amendment Is Not For Sale Act, which prohibits government agencies from buying data unless they have a warrant, would also help protect against posts-Roe threats. Still, those bills' prospects are unclear, and everybody agrees that comprehensive privacy legislation is a vital complement even if they pass. So in July, the House Energy & Commerce committee advanced the American Data Privacy and Protection Act (ADPPA) 53-2 – the first time this century a consumer privacy bill has made it out of committee. But how well does ADPPA actually respond to post-Roe threats? There's been surprisingly little discussion of this – back in July I called it "[the elephant in the room](https://thenexusofprivacy.net/what-about-the-elephant/)" – but even so there are several red flags. For example: - Sen. Ron Wyden, who’s usually right about stuff like this, says the "de-identified" data loophole lets companies sell location data to the government about visits to reproductive health facilities - And Kim Clark of Legal Voice [says](https://www.spokesman.com/stories/2022/jul/25/historic-data-privacy-law-could-be-within-reach-if/?ref=thenexusofprivacy.net) > “This bill, at least from the perspective of pregnant people, it really doesn’t do much.” ## Stress-testing the elephant So let’s build on A. Prince Albert III's excellent suggestion in [Hiding OUT: A Case for Queer Experiences Informing Data Privacy Law](https://publicknowledge.org/hiding-out-a-case-for-queer-experiences-informing-data-privacy-laws?ref=thenexusofprivacy.net) and stress-test ADPPA by looking at whether it responds to key post-Roe privacy threats. **✅ *yes* *!* *ADPPA passes the test*** **❓** *I’m not sure or it's complex* **❌ *no.* *ADPPA does not currently pass the test*** - ❌ Does ADPPA prevent prosecutors and law enforcement in states that have criminalized abortion from buying location data and targeting people who visit reproductive health care centers? - ❌ When people travel out of state to get abortions, does ADPPA protect their data? - ❌ Does ADPPA allow pregnant people to force companies to delete data that might put them at risk? - ❌ Does ADPPA protect pregnant people and abortion providers from risks of automated license plate readers (ALPRs)? - ❓Does ADPPA prevent anti-abortion “crisis pregnancy centers” from sharing data with vigilantes and law enforcement? - ❓Will ADPPA hold “crisis pregnancy centers” who break the law and violate people’s privacy accountable? - ❌ Will ADPPA prevent law enforcement from accessing people's private messages to investigate whether they got an abortion? If you want to follow along in the bill's text, the section numbers (§) refer to the[ July 19 ADPPA version](https://docs.house.gov/meetings/IF/IF00/20220720/115041/BILLS-117-8152-P000034-Amdt-1.pdf?ref=thenexusofprivacy.net) as amended by the six[ amendments](https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=115041&ref=thenexusofprivacy.net) that passed. Thanks to Maya Morales of WA People's Privacy and all the other Washington privacy organizers who have helped with the analysis! ## ❌ Does ADPPA prevent prosecutors and law enforcement in states that have criminalized abortion from buying location data to target people who visit reproductive health care centers? No. ADPPA generally restricts selling sensitive data unless people give consent, and the definition of sensitive data (§2(28)) includes “precise location information.” But there are some important exceptions. To start with, the “de-identified” location data isn’t covered by the ADPPA (§2(8)(B)(1)), so data brokers and tech companies buy sell it freely – and so can prosecutors, law enforcement, vigilantes doing "civil enforcement" of laws criminalizing abortion, and everybody else. Supposedly, it’s impossible to connect “de-identified” data to individual people. But as Center for Democracy and Technology (CDT) says in [Following the Overturning of Roe v Wade, Action is Needed to Protect Health Data](https://cdt.org/insights/following-the-overturning-of-roe-v-wade-action-is-needed-to-protect-health-data/?ref=thenexusofprivacy.net), “such data is[ easy to re-identify](https://www.nytimes.com/interactive/2018/12/10/business/location-data-privacy-apps.html?ref=thenexusofprivacy.net), with[ one study](https://phys.org/news/2013-03-easy-identity-cell.html?ref=thenexusofprivacy.net#:~:text=By%20analyzing%2015%20months%20of,identify%2095%25%20of%20the%20individuals) showing that one needs only up to four location points to identify the person.” As EFF's Bennett Cyphers [says](https://www.eff.org/deeplinks/2022/08/inside-fog-data-science-secretive-company-selling-mass-surveillance-local-police?ref=thenexusofprivacy.net), > Academic researchers have shown [over](https://www.osti.gov/pages/servlets/purl/1095747?ref=thenexusofprivacy.net) and [over again](https://link.springer.com/chapter/10.1007/978-3-642-27576-0%5F3?ref=thenexusofprivacy.net) that de-identified or “anonymized” location data [still poses privacy risks](https://dl.acm.org/doi/10.1145/2030613.2030630?ref=thenexusofprivacy.net). Indeed, in 2021, [”de-identified” data was used to out a gay priest’](https://www.vox.com/recode/22587248/grindr-app-location-data-outed-priest-jeffrey-burrill-pillar-data-harvesting?ref=thenexusofprivacy.net). In[ How the U.S. Military Buys Location Data from Ordinary Apps](https://www.vice.com/en/article/jgqm5x/us-military-location-data-xmode-locate-x?ref=thenexusofprivacy.net), Joseph Cox quotes an engineer at a data broker that sells products using de-identified data as saying "we could absolutely deanonymize a person." And as[ HIPAA and the Leak of “Deidentified” EHR Data](https://www.nejm.org/doi/full/10.1056/NEJMp2102616?query=WB&ref=thenexusofprivacy.net) in the New England Medical Journal reports, this has long been a problem for electronic health records as well. Alan Butler of EPIC Privacy has suggested that ADPPA’s definition of “de-identified” data is narrow enough that the exemption doesn’t cause risks. In June, Sen. Wyden disagreed. > \[T\]his loophole could allow data brokers to sell location data to the government about visits to reproductive health facilities, for example, or other private information that is trivially easy to connect to individuals, The bill’s definition of “de-identified” data has changed twice since then,\* and the last quote I saw from Sen Wyden’s office was that they were looking at the latest version. So it’ll be interesting to hear their opinions. "De-identified data" is only one of many location-related issues in ADPPA. A few more examples: - [Californians for Consumer Privacy suggests](https://www.caprivacy.org/californians-for-consumer-privacy-announce-opposition-to-adppa/?ref=thenexusofprivacy.net) highlights another apparent loophole: the definition of precise location information (§ 2(24)) excludes “information identifiable or derived solely from the visual content of an legally obtained image, including the location of the device that captured such image.” So companies can share and sell this data without people's consent – to prosecutors, law enforcement, vigilantes, and everybody else. - Loopholes discussed below in the sections on license plate readers and data sharing with vigilantes apply to location data as well. Also, ADPPA doesn't prevent prosecutors and law enforcement with valid warrants or subpoenas from getting access to sensitive data. As discussed below in he section on law access to private messages, courts may well decide that ADPPA doesn't prevent states like California and Washington from passing their own legislation to address this ... but that won't help people in the states that have criminalized abortion. ## ❌ When people travel out of state to get abortions, does ADPPA protect their data? No. ADPPA doesn’t cover airlines or other transportation common carriers. As travel-related human rights expert Ed Hasbrouck points out, “while the most common real-world attackers of travel reservations data have been stalkers and domestic abusers, this data could also be used to identify (even in advance) and track post-Roe interstate abortion travellers.” Hasbrouck's [What's in a Passenger Name Record (PNR)?](https://hasbrouck.org/articles/PNR.html?ref=thenexusofprivacy.net) goes into detail about various information that's associated with reservations – including home address, phone number, who paid for the travel, who's traveling together, and timestamped IP address. As [Sabre and Travelport help the government spy on air travelers](https://papersplease.org/wp/2022/07/01/sabre-and-travelport-help-the-government-spy-on-air-travelers/?ref=thenexusofprivacy.net) discusses, > Travelers’ data is routinely made available by Sabre and other CRS/GDS companies not only to US and other government agencies but publicly, without even passwords, through [online check-in, PNR viewing, and remote stalking sites and apps](https://hasbrouck.org/articles/watching.html?ref=thenexusofprivacy.net) such as Sabre’s [VirtuallyThere.com](https://virtuallythere.com/new/login.html?ref=thenexusofprivacy.net). And, ADPPA doesn’t cover employee data including benefits. So people whose employers pay for abortion-related travel are doubly at risk. ## ❌ Does ADPPA allow pregnant people to force companies to delete data that might put them at risk? ADPPA, like most modern privacy laws, gives people the right to request to see what data companies are storing about them (often called "access") – and request that it be deleted (§203). However, there are some important exceptions: - Companies and non-profits holding the data *must* ignore requests they “reasonably believe” are being made to support criminal activity. (§203(e)(1)(E)). In states that criminalize abortion, does this mean that requests to delete pregnancy-related data can’t be honored? - Companies *may* ignore requests that interfere with "investigations, or reasonable efforts to guard against, detect, prevent, or investigate ... unlawful activity." (§203(e)(3)(A)(vii)). In states that criminalize abortion, does this mean that “crisis pregnancy centers” or menstrual apps can decline requests to delete pregnancy-related data? - When government contractors collect, process, or transfer data on behalf of government agencies, ADPPA doesn’t require either the contractors or government agencies to offer access or deletion rights.\*\* It’s also worth mentioning that the latest version of ADPPA makes it extremely challenging for people to find out what companies their data has been shared with. The company that originally collected the data is supposed to relay requests on to whoever they’ve transferred it to, but suppose you want to double-check this? Easier said than done! - Privacy policies only need to include the *categories* of third parties and service providers (§202(b)(4)), not the names of specific companies. - Previously, the data returned from an access request had the names of third parties; now, it also only has to include categories of third parties, although it does have to provide “an option for consumers to obtain the names of any such third party.” (§203(1)(B)). - Companies with less than $41,000,000 in revenue have up to 90 days to respond to an access request, with an automatic 45-day exception (§203(c)), so it’s going to take a loooong time to figure out all the people who have your data; then they’ve got a similar amount of time to respond to your request about what data they have. By the way, companies also get up to 90 days, with an automatic 45-day exception, to respond to deletion requests. So even in the best case where they decide to honor them, it’s gonna take a while. But wait, there's more. ADPPA limts people to two free access and deletion requests a year, after which companies can charge people a "reasonable fee" to exercise their rights. As ACLU of Washington says in their s [Data Privacy Guiding Principles](https://www.aclu-wa.org/docs/data-privacy-guiding-principles-and-bill-comparison-chart?ref=thenexusofprivacy.net): > Pay-for-privacy provisions worsen the digital divide, which is also a privacy divide and raise racial equity issues. Strong regulations ensure that privacy rights are available to all and not just to those who can afford to pay to keep our privacy. ## ❌ Does ADPPA protect pregnant people and abortion providers from risks of automated license plate readers (ALPRs)? No. ADPPA excludes "publicly available information" and ALPR vendors have in the past successfully argued that[ license plate information is public](https://www.techdirt.com/2014/06/18/license-plate-reader-company-sues-another-state-violating-its-first-amendment-right-to-build-18-billion-image-database/?ref=thenexusofprivacy.net). As EFF's Dave Maass writes in [Automated License Plate Readers Threaten Abortion Access. Here’s How Policymakers Can Mitigate the Risk](https://www.eff.org/deeplinks/2022/09/automated-license-plate-readers-threaten-abortion-access-heres-how-policymakers?ref=thenexusofprivacy.net), > Law enforcement agencies typically do not require officers to get a warrant, demonstrate [probable cause or reasonable suspicion](https://www.google.com/search?client=firefox-b-1-d&q=%22reasonable+suspicion+or+probable+cause+is+not+required+before+using+an+ALPR.%22&ref=thenexusofprivacy.net), or show really much proof at all of a law enforcement interest before searching ALPR data. Meanwhile, as EFF has shown through [hundreds of public records requests](https://www.eff.org/pages/automated-license-plate-reader-dataset?ref=thenexusofprivacy.net), it is the norm that agencies will share ALPR data they collect broadly with other agencies nationwide, without requiring any justification that the other agencies need unfettered access. Police have long argued that you don't have an expectation of privacy when driving on public streets, conveniently dodging how this data could be used to reveal private information about you, such as when you visit a reproductive health clinic.... > > What's worse is that private actors can also access this database. DRN \[Motorola's Digital Recognition Network\] sells access to ALPR data to private investigators, who only need to check a box saying that they're querying the data for litigation development. With the passage of SB 8 in Texas, private actors now have the ability to sue to enforce the state's abortion ban. Unfortunately, anti-abortion activists for years have been [compiling their own databases](https://www.austinchronicle.com/daily/news/2014-08-12/undercover-audio-reveals-anti-abortion-tactics/?ref=thenexusofprivacy.net) of license plates of abortion providers; now they can use that to query private ALPR databases to surveil abortion seekers and reproductive healthcare providers. In addition, the apparent loophole for surveillance camera location information I mentioned above (§ 2(24)) may also apply to ALPR-based location information. If so, then even if it was covered it wouldn't be considered sensitive data. Brennan Center's 2020 [Automatic License Plate Readers: Legal Status and Policy Recommendations for Law Enforcement Use](https://www.brennancenter.org/our-work/research-reports/automatic-license-plate-readers-legal-status-and-policy-recommendations?ref=thenexusofprivacy.net) is a deeper dive into the issues around license plate readers, and Thor Benson's [The Danger of License Plate Readers in Post-Roe America](https://www.wired.com/story/license-plate-reader-alpr-surveillance-abortion/?ref=thenexusofprivacy.net) on Wired has additional discussion about how this puts pregnant people at risk. ## **❓**Does ADPPA prevent anti-abortion “crisis pregnancy centers” from sharing data with vigilantes? > "A Crisis Pregnancy Center (CPC) is an anti-abortion nonprofit organization, a fake clinic, or a mobile vehicle that poses as a legitimate health care center, often to purposely deceive pregnant people. They aim to dissuade, deceive, scare, or pressure people into not seeking or receiving abortion care." > > – National Women's Law Center (NWLC) [FTC Comments ](https://www.regulations.gov/comment/FTC-2022-0053-0898?ref=thenexusofprivacy.net) > "Pregnancy centers, many of which are affiliated with national anti-abortion advocacy groups, including Care Net and Heartbeat International, collect personal data from the millions of women they interact with every year in person, by telephone, and through online chats. This data includes sexual and reproductive histories, test results, ultrasound photos, and information shared during consultations, parenting classes, or counseling sessions, which some pregnancy centers require before they provide aid, like diapers. Because most centers are not licensed medical clinics and offer services for free, privacy lawyers tell TIME that they are not legally bound by federal health data privacy laws." > > – [Anti-Abortion Centers’ Databases Could Be Weaponized Post-Roe](https://time.com/6189528/anti-abortion-pregnancy-centers-collect-data-investigation/?ref=thenexusofprivacy.net), Abigail Abrams and Vera Bergengruen, Time Today, “crisis pregnancy centers” use the data they collect to target ads and boost their search results. And it works, too: a recent [report](https://twitter.com/daveyalba/status/1575539335499288596?ref=thenexusofprivacy.net) by Julia Love and Davey Alba on Bloomberg notes that when people type the words “abortion clinic” into the Google Maps search bar in states like South Carolina or Idaho, “five or more of the top 10 results were for CPCs, not abortion clinics.” When pregnant people contact the “crisis pregnancy center”, they provide a lot more information over the phone, which then gets used to try to talk them out of getting an abortion. Of course a lot of pregnant people see through “crisis pregnancy centers’” manipulation, and wind up seeking abortions elsewhere. In states where abortion is criminalized, this means that the “crisis pregnancy centers” have a lot of data that they can potentially weaponize and/or monetize – sharing with it vigilantes and bounty hunters doing “civil enforcement” of laws like Texas’, or even selling it. ADPPA has strong protections for “sensitive data”, including health and reproductive data, so it seems like they shouldn't be allowed do to this. However, when you dig into the specific ways the CPCs operate, there are some potential loopholes. For example, NWLC's [comments](file:///Users/jdp/Downloads/FTC-2022-0053-0898%5Fattachment%5F1-1.pdf) note that Heartbeat International (H.I.), a network of CPCs that is connected with over 2,000 affiliates, has developed its own Content Management System (CMS) to streamline the collection and retention of personal data. If H.I. provides the CMS as a service to law enforcement and bounty hunters as well as clinics, the last-minute ADPPA [amendment](https://docs.house.gov/meetings/IF/IF00/20220720/115041/BILLS-117-8152-H001067-Amdt-4.pdf?ref=thenexusofprivacy.net) approved by the committee could give them substantial leeway in sharing the data. For example, §302(b)(1)(D)(ii) allows service providers to combine data they've gathered from users with "service provider data" for any of the §101(b) permissible purposes – including "to prevent, detect, protect against or respond to illegal activity." Another potential loophole that seems like it could be exploited by “crisis pregnancy centers” (and [anybody else who believes that abortion is murder](https://www.usnews.com/news/national-news/articles/2022-05-06/the-push-to-make-fetuses-people-and-abortion-murder?ref=thenexusofprivacy.net)): an exception to the duty of loyalty (§102(3)(C)) allows businesses or non-profits to transfer (share or sell) an individual’s sensitive data to third parties without consent if > the transfer is necessary to prevent an individual from imminent injury where the covered entity **believes in good faith** that the individual is at **risk of death,** or serious physical injury, or serious health risk “Crisis pregnancy centers” could certainly claim a good faith belief that fetuses are at risk of death, and in states that have criminalized abortion they’ve got the law on their side as well. Is it “imminent”? Maybe the Fifth Circuit judges who routinely uphold anti-abortion laws would decide that it isn’t, and maybe the Supreme Court would agree. But I’d certainly expect “crisis pregnancy centers” to argue that it is, and share the data until they’re told not to. It would be great to see a detailed legal analysis of these – and other threats related to CPCs. Until then, it's hard to know just how serious these potential loopholes are, so I'll leave this one as a **❓** ## **❓**Will ADPPA hold “crisis pregnancy centers” who break the law and violate people’s privacy accountable? Suppose it turns out that loophole doesn't apply, and ADPPA doesn't actually allow "crisis pregnancy centers" to share data with vigilantes. If they decide to ignore the law and do it anyhow, does ADPPA have enough teeth to hold them accountable? Probably not. At first, it seems like the answer is yes. ADPPA has a “three-tier” enforcement structure: the FTC, state Attorneys General and privacy authorities, and individuals all have some enforcement powers. But when you look at it more closely, it’s a lot less clear: - The FTC has limited resources – and the current version of ADPPA adds a lot of responsibilities, but doesn’t allocate additional funding. - A coalition of ten AG’s warned in a [July 19 letter](https://oag.ca.gov/system/files/attachments/press-docs/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf?ref=thenexusofprivacy.net) that ADPPA puts a significant barrier to their enforcement abilities.\*\*\* So the "crisis pregancy centers" don't have to worry about California, Connecticut, Illinois, Maine, Massachusetts, Nevada, New Mexico, New Jersey, New York, Washington and who knows how many other states. - Individuals have a limited private right of action, but ADPPA also puts up a lot of roadblocks. As Senate Commerce Committee staffers warned in June, it “makes it harder for women to seek redress when their sensitive health data has been used against them” and would force women to “jump through arbitrary, drawn-out hoops” to sue over privacy violations. - A potential fourth tier of city and county privacy authorities and prosecutors aren't allowed to enforce the law (or pass their own law). If a “crisis pregnancy center” shares an individual’s data in a way that breaks the law, here’s some of the specific barriers they’d face if they want to sue: - ADPPA generally allows “[forced arbitration](https://www.nclc.org/issues/forced-arbitration.html?ref=thenexusofprivacy.net)” clauses, where businesses and non-profits can force consumers to give up their right to sue if they want to use the service. - Companies and non-profits with an annual revenue less than $25,000,000 are exempt from ADPPA’s private right of action. Many “crisis pregnancy centers “fall below this threshold - Before suing, companies have to let the FTC or state privacy authority know and give them 60 days to decide whether to bring an action. - Companies and non-profits who are sued have a 45-day “right to cure” Add it all up and ADPPA’s supporters’ claims of “strong enforcement” start to look like a substantial exaggeration, at least in this situation. ## ❌ Will ADPPA prevent law enforcement from accessing people's private messages to investigate whether they got an abortion? No. ADPPA allows covered entities to transfer data to comply with legal obligations under state, local, or tribal law. So it wouldn't do anything to prevent harms like [the Burgess case in Nebraska](https://www.npr.org/2022/08/12/1117092169/nebraska-cops-used-facebook-messages-to-investigate-an-alleged-illegal-abortion?ref=thenexusofprivacy.net), where police got a warrant for a teen's Facebook messages with her mom and then charged them with an illegal abortion illustrates. By contrast, California's A.B. 2091, sponsored by Asm. Mia Bonta, prohibits health care providers from releasing medical information about abortion to law enforcement, or in response to a subpoena, based on either an out-of-state law that interferes with California abortion rights,\*\*\*\* or an out-of-state suit “to punish an offense against the public justice of that state”. EFF's [California Leads on Reproductive and Trans Health Data Privacy](https://www.eff.org/deeplinks/2022/09/california-leads-reproductive-and-trans-health-data-privacy?ref=thenexusofprivacy.net) discusses this and two other recent privacy laws California has passed. Washington state's legislature will consider [similar legislation](https://www.governor.wa.gov/news-media/inslee-and-legislators-roll-out-more-reproductive-freedom-bills-2023-legislative-session?ref=thenexusofprivacy.net) in 2023, and other states where Democrats control the legislature and governorship are likely to follow ... but this doesn't help people in red states. I haven't yet seen any analyses of how ADPPA would interact with laws' like California's and Washington's. ADPPA's current version has some exceptions to preemptions and I *think* laws like these would't be preempted, but the whole preemption section is so complicated that it's very likely it would wind up in court and I'm not sure how it would work out. And it could get worse: the US Chamber of Commerce and some trade associations are pressing to make ADPPA fully preemptive, which would mean it would override these new laws (as well as Washington's and California's current and future privacy laws). Of course, there's no way Congressional Republicans would support a clause like that in ADPPA. So even though this is a hugely important threat, with a clear answer, I left it until the end – it's a dead end politically until Democrats have a majority in both chambers and get rid of the filibuster for abortion-related legislation. ## Get involved! Reproductive justice organizations and experts in reproductive health law haven’t yet added their voices to the public discussion about ADPPA – and for good reason: they’re dealing with crises in multiple states and moving full steam ahead on their post-Roe strategy. Still, with dozens of privacy and civil rights groups calling on Speaker Pelosi to schedule a vote on ADPPA, time’s moving fast. So I really hope that privacy organizations and Democratic legislators who support abortion rights are looking closely at these and other post-Roe threats to see whether ADPPA’s current language is sufficient – and if not, what to do instead. The good news is that there’s still time to amend ADPPA to strengthen its protections for pregnant people. In addition, as I mentioned earlier, Congress is working on two other bills that *do* directly address post-Roe threats: Rep. Sara Jacobs’ My Body My Data has very strong protections for reproductive health data. The Health and Location Data Privacy Act (sponsored by Sens. Warren, Wyden, and Whitehouse) prohibits sales of health and location data. Even if they don’t move forward this session, language from them could be useful for strengthening ADPPA. But the not-so-good news is that it’s not clear there’s political support for strengthening ADPPA. Most of the changes in the latest version weakened it, and big tech companies and data brokers are lobbying to weaken it further. And specifically when it comes to abortion, Democrats may worry that pushing for improvements could cause Republicans to drop their support for the bill. So if you think it’s important for ADPPA to respond to post-Roe abortion threats, it’s a great time to get involved by contacting your legislators and let them know. You don’t have to go into details; just say something like > It’s critical to protect pregnant people’s privacy – especially after the Supreme Court decision ending Roe. Please only vote for privacy legislation that protects pregnant people and health information from vigilantes and sinister prosecutors in states that criminalize abortion – and lets pregnant people protect themselves by deleting all the data companies are tracking about them. [Congress.gov lets you look up your representative based on your address](https://www.congress.gov/contact-us?ref=thenexusofprivacy.net) – or[ here's a directory](https://www.house.gov/representatives?ref=thenexusofprivacy.net) if you know their name or what congressional district you live in. And if you work at a big tech company or data broker, make sure to tell your government affairs office and executives that you want them to lobby to ensure that ADPPA protects pregnant employees even if they’re in states that have criminalized abortion! Rumors are that Congress may take another try at passing privacy legislation in the "lame duck" session after the midterms , so there's still a chance we'll see a new version of ADPPA. As to just what will be in it, it's hard to know: various "stakeholders" are negotiating that behind closed doors. How effectively will it protect against post-Roe threats? We shall see. Stay tuned! --- ## Updates *September 15:* add new section on travel privacy, improve discussion on state and local enforcement (and context in footnote), include pay-for-privacy. *October 8:* split out license plate reader and private message questions to their own sections, minor updates to reflect that it didn't move in September. *November 12:* change wording of first item to highlight it's not related to Rep. Eshoo's mention of an ADPPA loophole allowing access to "sinister prosecutors", and reference to upcoming Washington state law. *December 5*: update section on "crisis pregnancy centers” sharing data with vigilantes and law enforcement to incorporate NWLC's FTC comments. *December 9:* remove confusing discussion of access rights in the section on deletion *December 16*: change title to Let's Talk about the Elephant --- *Image credit: Savanna elephant in Kruger National Park, South Africa. By Felix Andrews (*[*CC-BY-SA-3.0*](http://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net)*) via* [*Wikimedia Commons*](http://commons.wikimedia.org/wiki/File:Elephant%5Fside-view%5FKruger.jpg?ref=thenexusofprivacy.net)*.* ## Footnotes \* the version of ADPPA the subcommittee advanced broadened the definition of “de-identified” data substantially, and then the committee undid those changes. I *think* this gets it back to the language that Wyden originally objected to, but I’m not 100% sure. \*\* government contractors are considered service providers. If the data has originally been collected by or transferred to a covered entity (business or non-profit), the covered entity must forward access and deletion requests to service providers. However, there's no similar requirement for government agencies – who aren't covered by ADPPA. \*\*\* §404(b)(2)(A): “a violation of this Act shall not be pleaded as an element of any such cause of action." The AG's letter says: > In many states, the Attorney General’s office uses civil investigative demands under its consumer protection authority to demand documents or information from entities when we believe there could have been a violation of a law. Ordinarily, a violation of a federal law or standard could also be a violation of state consumer protection law. But Section 404 would act as a bar to investigate violations of the federal law, because it prohibits them from forming the basis for state consumer protection claims. This language unnecessarily interferes with robust enforcement capabilities. We're especially annoyed by this in Washington because we had a big legislative battle over exactly this issue in 2020, when the state AG said a similar problem made the bill *unenforceable*. Big tech conceded on this here in 2021 so even though it's not surprising, it's still kind of annoying to discover that tech lobbyists' fingers were crossed. \*\*\*\* If you're surprised that California can do this, so was I! But Orin Kerr points out that [the full faith and credit clause doesn’t apply in this situation](https://twitter.com/OrinKerr/status/1542570282279260160?ref=thenexusofprivacy.net), and he's usually right about stuff like this. ### Privacy News: August 29 URL: https://thenexusofprivacy.net/privacy-news-august-29/ Last updated: 2022-08-29T17:34:17.000Z Getting the week off to a good start! ### [Sephora to pay $1.2m to settle California privacy law claims](https://www.theregister.com/2022/08/27/sephora%5Fccpa%5Fprivacy%5Fsettlement/?ref=thenexusofprivacy.net) Jessica Lyons Hardcastle, The Register (theregister.com) Sephora failed to disclose to consumers that it was selling their personal information, and failed to process user requests to opt out of sale via user-enabled global privacy controls in violation of the CCPA. The settlement is relatively small – only $1.2 million – but important, because it establishes that regulations global privacy controls will be enforced and that California is taking a broad view of what is considered "sale" of data. FIND OUT MORE: - [Attorney General Bonta Announces Settlement with Sephora as Part of Ongoing Enforcement of California Consumer Privacy Act](https://oag.ca.gov/news/press-releases/attorney-general-bonta-announces-settlement-sephora-part-ongoing-enforcement?ref=thenexusofprivacy.net), the Office of the Attorney General's press release (oag.ca.gov) - [Sephora pays $1.2 million to settle a California suit accusing it of selling customer data without telling them](https://www.latimes.com/business/story/2022-08-24/cosmetics-giant-sephora-settles-customer-data-privacy-suit?ref=thenexusofprivacy.net), Don Thompson, Associated Press (latimes.com) ## Privacy after Roe ### [FTC sues data broker Kochava for sale of people’s sensitive location data, including visits to reproductive health clinics](https://social.techcrunch.com/2022/08/29/ftc-sues-data-broker-kochava-for-sale-of-peoples-sensitive-location-data-including-visits-to-reproductive-health-clinics/?ref=thenexusofprivacy.net) Sarah Perez on TechCrunch (techcrunch.com) The U.S. Federal Trade Commission (FTC) on Monday announced it has filed a lawsuit against data broker Kochava Inc. for selling geolocation data from “hundreds of millions of mobile devices,” it says, which could be used to trace the movements of individuals including those to and from sensitive locations. Specifically, the FTC said the data could reveal people’s visits to places like reproductive health clinics, domestic violence or homeless shelters, addiction recovery centers and places of worship. FIND OUT MORE: [FTC Sues Kochava for Selling Data that Tracks People at Reproductive Health Clinics, Places of Worship, and Other Sensitive Locations](https://ftc.gov/news-events/news/press-releases/2022/08/ftc-sues-kochava-selling-data-tracks-people-reproductive-health-clinics-places-worship-other?ref=thenexusofprivacy.net), the FTC's press release (ftc.gov) ### Also ... [McMaster throws cold water on controversial Senate bill to ban abortion information in South Carolina](https://www.thestate.com/news/politics-government/article264647994.html?ref=thenexusofprivacy.net), Joseph Bustos, The State (thestate.com): South Carolina's a controversial bill that aimed to ban the sharing of information about abortion resources will not go forward. However, as EFF points out, this bill is based on [a model](https://www.nrlc.org/wp-content/uploads/NRLC-Post-Roe-Model-Abortion-Law-FINAL-1.pdf?ref=thenexusofprivacy.net) from the National Right to Life Coalition, so is likely to show up in other states. ## Federal privacy legislation #### [Privacy bill triggers lobbying surge by data brokers](https://politico.com/news/2022/08/28/privacy-bill-triggers-lobbying-surge-by-data-brokers-00052958?ref=thenexusofprivacy.net) Alfred Ng on POLITICO (politico.com) Data brokers, who make money selling people's data (usually without consent), say that the proposed American Data Privacy and Protection Act could put restrictions on their industry and its work with law enforcement. Well yeah, that's the idea! As researcher Wolfie Christl says, “Law enforcement and fraud prevention shouldn’t be a free pass to collect and sell disproportionately excessive data on the whole population.” But the brokers, including U.K.-based data giant RELX and credit reporting agency TransUnion, aren't up for that. They want changes to the bill, arguing that otherwise it will cause problems for investigations of crimes. Some data brokers also want clearer permission to use third-party data for advertising purposes, and working to “ensure that fraud prevention products can continue providing meaningful consumer protections.” In fact, at least four new exceptions got added to the latest version (Secs. 102(1), 203(E)(1)(e), 203(E)(3)(A)(vi), 209(b)(2)), so it seems like the lobbying's having an effect. SEE ALSO: [Wolfie Christl's Twitter thread.](https://twitter.com/WolfieChristl/status/1564199403342159873?ref=thenexusofprivacy.net) ## ## And ... [Trans Youths Need Data Sanctuary](https://eff.org/deeplinks/2022/08/trans-youths-need-data-sanctuary?ref=thenexusofprivacy.net), Adam Schwartz on Electronic Frontier Foundation (eff.org): A growing number of states have prohibited transgender youths from obtaining gender-affirming health care. So these youths and their families must travel out-of-state for necessary health care. The states they visit are health care sanctuaries.These states must also be data sanctuaries for transgender youth. [Meta settles Cambridge Analytica lawsuit in time to avoid Mark Zuckerberg and Sheryl Sandberg’s depositions](https://theverge.com/2022/8/26/23324187/mark-zuckerberg-sheryl-sandberg-cambridge-analytica-meta-facebook?ref=thenexusofprivacy.net), Richard Lawler on The Verge (theverge.com): Mark Zuckerberg would have faced hours of questioning. No details yet on the settlement. [Democrat urges Labor Dept. to regulate tech that monitors employees in the workplace](https://thehill.com/blogs/blog-briefing-room/news/3617291-democrat-urges-labor-dept-to-regulate-tech-that-monitors-employees-in-the-workplace?ref=thenexusofprivacy.net), Ines Kagubare on The Hill (thehill.com): Sen. Bob Casey (D-Pa.), a member of the Committee on Health, Education, Labor and Pensions, is urging the Department of Labor to monitor and regulate how companies are using invasive technology to monitor their employees during work hours. [Should Companies Track Workers With Monitoring Technology?](https://wsj.com/articles/companies-track-workers-technology-11660935634?ref=thenexusofprivacy.net), Bart Ziegler on WSJ (wsj.com): Employers can know when you’re logged in, what you’re typing and analyze your facial expressions. That raises all sorts of difficult questions. [Federal Judge: Invasive Online Proctoring “Room Scans” Are Also Unconstitutional](https://eff.org/deeplinks/2022/08/federal-judge-invasive-online-proctoring-room-scans-are-also-unconstitutional?ref=thenexusofprivacy.net), Jason Kelley on Electronic Frontier Foundation (eff.org) [DuckDuckGo opens its privacy-focused email service to everyone](https://bleepingcomputer.com/news/security/duckduckgo-opens-its-privacy-focused-email-service-to-everyone?ref=thenexusofprivacy.net), Bill Toulas on BleepingComputer (bleepingcomputer.com): DuckDuckGo has opened its ‘Email Protection’ service to anyone wishing to get their own ‘@duck.com’ email address. [Facebook Restricted a Planned Parenthood Post Telling People About Abortion Pills](https://vice.com/en/article/epzpz4/facebook-restricted-a-planned-parenthood-post-telling-people-about-abortion-pills?ref=thenexusofprivacy.net), Joseph Cox on vice.com: Facebook took action on the post, despite medication abortion pills being legal in Michigan. [University can’t scan students’ rooms during remote tests, judge rules](https://theverge.com/2022/8/23/23318067/cleveland-state-university-online-proctoring-decision-room-scan?ref=thenexusofprivacy.net), Monica Chin on The Verge (theverge.com): The practice lies at the core of the Fourth Amendment’s protections. [The real problem with AI isn’t sentience, it’s privacy](https://thedrum.com/opinion/2022/08/22/the-real-problem-with-ai-isn-t-sentience-it-s-privacy?ref=thenexusofprivacy.net), Yacov Salomon on The Drum (thedrum.com): Ketch’s chief innovation officer Yacov Salomon writes that responsible AI will require us to rethink data privacy. [Snap agrees to $35 million settlement over privacy lawsuit](https://theverge.com/2022/8/23/23318545/illinois-snapchat-biometric-privacy-lawsuit-settlement-facebook-location-tracking?ref=thenexusofprivacy.net), Mia Sato on The Verge (theverge.com): Illinois Snapchat users may be eligible for a cut [Gmail creates “Spam Emails”, despite CJEU judgment](https://noyb.eu/en/gmail-creates-spam-emails-despite-cjeu-judgment?ref=thenexusofprivacy.net), NOYB on noyb.eu (noyb.eu):Today, noyb.eu filed a complaint against Google with the French Data Protection Authority (CNIL). The tech giant has repeatedly ignored the European Court of Justice (CJEU) ruling on direct marketing and used its email platform Gmail to send unsolicited advertising emails without valid consent of the users. [The Privacy Flaw Threatening US Democracy](https://wired.com/story/privacy-mass-surveillance-us-authoritarian?ref=thenexusofprivacy.net), Thor Benson on WIRED (wired.com): Without robust federal protections, the country’s widespread mass surveillance systems could be used against citizens like never before. [New Report on Limits of “Consent” in Macau’s Data Protection Law](https://fpf.org/blog/new-report-on-limits-of-consent-in-macaus-data-protection-law?ref=thenexusofprivacy.net), Dominic Paulger on Future of Privacy Forum (fpf.org): a detailed overview of relevant laws and regulations in the Special Administrative Region of Macau, China. [‘Privacy Is Normal’: Rep. Tom Emmer Wants Answers About Tornado Cash Ban](https://decrypt.co/108062/privacy-is-normal-tom-emmer-wants-answers-tornado-cash-ban?ref=thenexusofprivacy.net), Andrew Hayward on Decrypt (decrypt.co): The Treasury’s recent ban on Ethereum mixing service Tornado Cash has a U.S. Representative asking tough questions. [My Comments to the CPPA Regarding its Initial CPRA Proposed Regulations](https://blog.ericgoldman.org/archives/2022/08/my-comments-to-the-cppa-regarding-its-initial-cpra-proposed-regulations.htm?ref=thenexusofprivacy.net), Eric Goldman on Technology & Marketing Law Blog (blog.ericgoldman.org): Preparing those comments was a truly joyless task. Analyzing CPRA regulations is literally “read them and weep.” [Dear California Law Makers: How The Hell Can I Comply With Your New Age-Appropriate Design Code?](https://techdirt.com/2022/08/24/dear-california-law-makers-how-the-hell-can-i-comply-with-your-new-age-appropriate-design-code?ref=thenexusofprivacy.net), Mike Masnick on Techdirt (techdirt.com): I really don’t have time for this kind of thing, but I wanted to pass along that it appears that the California legislature is very, very close to passing AB 2273 [Google faces ‘spam ads’ ePrivacy complaint in France](https://techcrunch.com/2022/08/24/gmail-spam-ads-eprivacy-complaint?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com): Google is facing a fresh privacy complaint in Europe over ads it inserts into its Gmail email service in the guise of emails. Privacy advocacy group, noyb, has filed the complaint with France’s data protection watchdog, the CNIL, claiming the adtech giant has breached the EU’s ePrivacy Directive rules on direct marketing by failing to gain consent from Gmail users for the ads it displays inside their inboxes, alongside promotional emails they have actually signed up for. [Quebec Privacy Law: Is Your Organization Ready for New Rules in Force this September?](https://jdsupra.com/legalnews/quebec-privacy-law-is-your-organization-1011268?ref=thenexusofprivacy.net), Ellie Marshall on JD Supra (jdsupra.com): On September 22, 2022, the first set of amendments from Bill 64, An Act to modernize legislative provisions as regards the protection of personal information, to Quebec’s Act respecting the protection of personal information in the private sector (Quebec Privacy Act) and the Act to establish a legal framework for information technology (Quebec IT Act) will come into force. [Looking Back to Forge Ahead: Challenges of Developing an “African Conception” of Privacy](https://fpf.org/blog/looking-back-to-forge-ahead-challenges-of-developing-an-african-conception-of-privacy?ref=thenexusofprivacy.net), Mercy King’ori on Future of Privacy Forum (fpf.org): An exploration ofthe cultural and societal underpinnings of “privacy” in Africa, looking throughout history, from pre-colonial times, and beyond the modern external influences on the legislative processes resulting in general data protection laws across the continent. Africa is not a monolith, it is multi-cultural and context differs across communities. [UK Privacy Group Says Police Are Abusing Stop And Search Powers To Hassle Protesters](https://techdirt.com/2022/08/26/uk-privacy-group-says-police-are-abusing-stop-and-search-powers-to-hassle-protesters?ref=thenexusofprivacy.net), Tim Cushing on Techdirt (techdirt.com): Most protest activity targets government entities. So, it’s really no surprise that government entities prefer to target protesters. [A pragmatic compromise? The role of Article 88 GDPR in upholding privacy in the workplace](https://academic.oup.com/idpl/advance-article/doi/10.1093/idpl/ipac015/6668508?ref=thenexusofprivacy.net), Halefom H Abraha on OUP Academic (academic.oup.com): While the compromise has delivered on some of its promises in promoting diverse and innovative regulatory approaches, it also runs counter to the fundamental objectives of the GDPR itself by creating further fragmentation, legal uncertainty, and inconsistent implementation, interpretation, and enforcement of data protection rules. ### ADPPA's algorithmic impact assessments are too weak to protect civil rights -- but it's not too late to strengthen them URL: https://thenexusofprivacy.net/adppa-impact-assessments-and-civil-rights/ Last updated: 2026-04-16T02:41:15.000Z > A covered entity or a service provider may not collect, process, or transfer covered data in a manner that discriminates or otherwise makes unavailable the equal enjoyment of goods or services on the basis of race, color, religion, national origin, sex or disability. > > \- American Data Privacy and Protection Act (ADDPA) Section 207(a) Civil rights groups and privacy advocates are very justifiably excited about the inclusion of civil rights protections in ADPPA, the consumer privacy bill currently making its way through Congress. It's the first time this century that consumer privacy legislation has advanced from committee, and a 53-2 vote for the principle of privacy as a civil right is a huge milestone. Still, rights are only meaningful if companies who violate them can be held accountable. ADPPA's approach to that starts with *algorithmic impact assessments* (AIAs). Done right, AIAs can play an important role in regulation. [Rep. Yvette Clarke's Algorithmic Accountability Act of 2022](https://clarke.house.gov/clarke-wyden-and-booker-introduce-algorithmic-accountability-act-of-2022-to-require-new-transparency-and-accountability-for-automated-decision-systems/?ref=thenexusofprivacy.net), which has broad support from privacy and civil liberties groups, relies on AIAs. [How the California Privacy Protection Agency (CPPA) Advances Equity in AI](https://medium.com/artificial-intelligence-ai-for-social-impact/xx-22faff63228f?ref=thenexusofprivacy.net) explores how impact assessments complement other protections against algorithmic discrimination. Prof. Andrew Selbst's recent Harvard Law Reviewpaper [An Institutional View Of Algorithmic Impact Assessments](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=3867634&ref=thenexusofprivacy.net) discusses reasons AIAs can be an attractive regulatory option. But that's only if they're done right. ## ADPPA's AIA's won't protect civil rights unless they're strengthened Unfortunately, **ADPPA's requirements for AIAs** [**got significantly weaker in the latest version**](https://thenexusofprivacy.net/what-about-the-elephant/#algos)**, including removing a vital requirement that AIAs be performed by external, independent auditors or researchers**. As Selbst says, relying on good faith collaboration from the companies being regulated shifts the the compliance approach "from enforcement to encouragement." Call me cynical, but [Facebook has continued to run discriminatory housing ads for years despite repeatedly promising to fix the problem](https://mashable.com/article/facebook-digital-redlining-ads-protected-traits-section-230?ref=thenexusofprivacy.net),\* [failed the civil rights audit it commissioned](https://www.vox.com/recode/2020/7/9/21318896/facebook-civil-rights-audit-hate-speech-failed-zuckerberg-white-nationalism-sheryl-sandberg?ref=thenexusofprivacy.net) but hasn't made significant changes in response, and is now [whitewashing its recent human rights report in India](https://time.com/6197154/facebook-india-human-rights/?ref=thenexusofprivacy.net). "Encouraging" them – or other serial bad actors – to do better isn't going to be effective at protecting civil rights. We've known since last century that self-regulation doesn't work for privacy; see for example [Privacy Self-Regulation: A Decade of Disappointment](https://archive.epic.org/reports/decadedisappoint.html?ref=thenexusofprivacy.net) (EPIC Privacy, 2005) and [Many Failures – A Brief History of Privacy Self-Regulation](https://www.worldprivacyforum.org/2011/10/report-many-failures-a-brief-history-of-privacy-self-regulation/?ref=thenexusofprivacy.net) (World Privacy Forum, 2011). And on top of that, ADPPA's AIAs have some significant loopholes – including an exemption for government contractors and other service providers. Even worse, ADPPA's approach to accountability also mostly *ends* with the algorithmic impact assessments.\*\* In particular, there are two crucial gaps: - ADPPA doesn't include whistleblower protections. As Dr. Timnit Gebru of the Distributed AI Research Institute discusses in the Kapor Center’s [Mobilizing for Racial Justice: Protecting Our Communities from Algorithmic Bias](https://youtu.be/RRaVbiyMbdY?t=4398&ref=thenexusofprivacy.net), these are a key complement to other aspects of data protection regulation. - ADPPA leaves out a key piece in California's CPRA: the right to opt out of automated decision systems, including profiling. **So as it stands right now, ADPPA won't be able to deliver on the promise of civil rights protections.** ## Is "responsible AI" anything more than a PR-friendly buzzword? The good news is that if Congress really does want to make "privacy is a civil right" a reality and protect people against discrimination, there are several straightforward and politically-achievable changes that could significantly improve ADPPA's civil rights protections. But those changes are a lot more likely to happen if at least a few big tech companies support them. So before we get to that, let's talk about big tech companies who are committed to "responsible AI" and the like. Microsoft's a good example. The company commits to [Responsible AI principles](https://www.microsoft.com/en-us/ai/our-approach?activetab=pivot1%3aprimaryr5&ref=thenexusofprivacy.net) including fairness, privacy, inclusiveness, and accountability; publishes its internal [Responsible AI Standard](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4ZPmV?ref=thenexusofprivacy.net); provides an [responsible AI impact assessment template](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4ZHNX?ref=thenexusofprivacy.net) and [guide](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4ZzOI?ref=thenexusofprivacy.net), as well as many additional [resources and tools](https://www.microsoft.com/en-us/ai/responsible-ai-resources?ref=thenexusofprivacy.net); and does [extensive research on responsible AI](https://www.microsoft.com/en-us/research/blog/research-collection-research-supporting-responsible-ai/?ref=thenexusofprivacy.net). IBM's a good example too: they co-founded the [Responsible Computing](https://newsroom.ibm.com/2022-06-02-Object-Management-Group-R-Announces-Responsible-Computing-with-Founding-Members-IBM-and-Dell?ref=thenexusofprivacy.net) consortium. Many other big tech companies commit to one or more of responsible AI, responsible computing, or ethical AI.\*\*\* And yet, when we read about Microsoft and IBM's role in ADPPA, it's about the way they're [lobbying to weaken other areas of the bill](https://www.protocol.com/newsletters/policy/cloud-enterprise-privacy?ref=thenexusofprivacy.net). Not only that, there are reports that they and their allies in the Business Software Alliance are also behind the successful push to weaken the civil rights protections, including the AIAs, in the latest version. How responsible is that? How ethical is that? It's frustrating because not only does pushing for weak regulation that doesn't protect civil liberties clash with their values, it clashes with their strategy. Stronger regulation gives a strategic advantage to companies like Microsoft who have with a strong compliance culture, a "responsible AI" brand and the resources to back it up, and world-class research and engineering organizations. So if you're an employee or customer of a company committed to responsible AI, now's a good time to push for your company to take a stance that aligns with the company's stated values and gives them a potential strategic advantage. And if you're in "responsible AI" (or "ethical AI", or "responsible computing") you've got more leverage – and, quite frankly, also a bigger responsibility, if you want "responsible AI" (or "ethical AI", or "responsible computing") to be anything more than a PR-friendly buzzword. Look for others in your company who might be supportive, including any employee resource groups who are interested in protecting against discrimination, and explore possibilities for joint action. # Politics is the art of the possible ADPPA's next step is a House floor vote. Right now, closed-door negotiations are happening between lobbyists, staffers, legislators, and people from privacy and civil rights organizations. If they can come up with a version that seems like it'll get enough votes to pass, then it's up to Speaker Pelosi to decide whether to bring it to the floor. So this is a good time to be pushing Congress to improve the civil rights protections. And it's very likely that with more focus, at least some progress is possible. Two straightforward improvements could come from undoing changes in the most recent version: - restoring the requirement that algorithmic impact assessments be conducted by independent, external researchers or auditors ***Update*, *September 13* *:*** Color of Change's [Black Tech Agenda](https://act.colorofchange.org/sign/black-tech-agenda?ref=thenexusofprivacy.net) notes "By forcing companies to undergo independent audits, tech companies can address discrimination in their decision-making and repair the harm algorithmic that bias has done to Black communities regarding equitable access to housing, health care, employment, education, credit, and insurance." - removing the exemption for government contractors and other service providers The only arguments I've heard against these are the obvious red herring that they potentially create barriers to small companies – which is clearly nonsense, because ADPPA only requires AIA's for companies with $250,000,000 or more annual revenue. Whistleblower protections are easy to add. California and Washington have already passed the [Silenced No More Act](https://www.protocol.com/bulletins/washington-silenced-no-more?ref=thenexusofprivacy.net). [Companies like Microsoft have announced that they're going to provide the protections all across the US](https://www.seattletimes.com/business/microsoft-eliminates-controversial-practices-to-protect-workers-and-comply-with-state-law/?ref=thenexusofprivacy.net), so it should be easy for them to support it. In[ State of Play: U.S. Privacy Law](https://anonymouswriterinthebay.substack.com/p/state-of-play-us-privacy-law), Anonymous Writer in the Bay characterizes improving whistleblower protections as the "most likely" improvement, and highlights their importance: > Because of the opacity of these algorithims and complex nature of data collection, these whistleblowers are more important than ever for uncovering Big Tech’s/Big Data’s misdeeds. And it's also easy to add the ability for people to opt-out of automated decision systems including profiling is also straightforward. ADPPA's supporters have said that even in its current form it won't preempt California's existing laws, so adding similar requirements to ADPPA won't add any new regulatory burden to companies that are doing business in California. One straightforward approach is simply to add language similar to CPRA's; there may also be an opportunity to make some additional improvements. There are also a lot of other ways to strengthen ADPPA's civil rights protections; the upcoming *Assessing the Assessments* willuse the Algorithmic Justice League's recommendations as Who Audits the Auditors? to highlight other areas for improvement. Still, if we can get these four, it would get ADPPA much closer to delivering on the promise of strong civil rights protections. So **now's a great time to call your representative, or leave them a message through their web form.** It doesn't have to be fancy – even just "please only support the ADPPA consumer privacy bill if the requirement for external, independent auditors is restored, whistleblower protections are added, exemptions for government contractors are removed" will get the message across. [Congress.gov lets you look up your representative based on your address](https://www.congress.gov/contact-us?ref=thenexusofprivacy.net) – or [here's a directory](https://www.house.gov/representatives?ref=thenexusofprivacy.net) if you know their name or what congressional district you live in. And as I discussed above, **if you work at a big tech company, make sure to send the same message internally!** It can be challenging to find time for these kinds of actions – but they're certainly worth doing. ADPPA's civil rights protections are far too important to let them turn into [privacy theater](https://slate.com/technology/2021/12/facebook-twitter-big-tech-privacy-sham.html?ref=thenexusofprivacy.net). --- *Image credit: originally published in* [*Audit the algorithms that are ruling our lives*](https://www.ft.com/content/879d96d6-93db-11e8-95f8-8640db9060a7?ref=thenexusofprivacy.net)*, by Cathy O'Neil, Financial Times, 2018* ### Notes \* [Pro Publica first reported that Facebook advertisers could run "whites only" ads in 2016](https://www.propublica.org/article/facebook-lets-advertisers-exclude-users-by-race?ref=thenexusofprivacy.net), and Facebook promised to fix the problem. In 2017[ Pro Publica tested again and reported that it wasn't fixed](https://www.propublica.org/article/facebook-advertising-discrimination-housing-race-sex-national-origin?ref=thenexusofprivacy.net); Facebook once again promised to fix it. In 2019 Facebook settled with National Fair Housing Alliance and the American Civil Liberties Union and promised to fix the problem. Later in 2019 [HUD sued Facebook over housing discrimination later that year,](https://www.propublica.org/article/hud-sues-facebook-housing-discrimination-advertising-algorithms?token=SNdMjVHydJaBRt8PvOspYpaTiMHV23MB&ref=thenexusofprivacy.net) alleging the company's algorithms had made the situation even worse. [Facebook settled again in June 2022](https://abcnews.go.com/Technology/wireStory/facebook-us-make-deal-stop-discriminatory-housing-ads-85539416?ref=thenexusofprivacy.net), and promised to fix the problem. Hey wait a second, I'm noticing a pattern here! \*\* There are Algorithmic Design Evaluations, but the requirements are so vague that they're not likely to have an impact from a regulatory perpective. And ADPPA's privacy impact assessments (Sec. 301 (c) and (d)) could theoretically also help here but as Ari Ezra Waldman discusses [How Big Tech Turns Privacy Laws Into Privacy Theater](https://slate.com/technology/2021/12/facebook-twitter-big-tech-privacy-sham.html?ref=thenexusofprivacy.net), these typically focus more on assessing litigation risks to the company rather than risks to consumers. \*\*\* Google has a Responsible AI page *and* an AI Ethics page! Then again [they pushed out ethical AI researcher Timnit Gebru ](https://www.wired.com/story/google-timnit-gebru-ai-what-really-happened/?ref=thenexusofprivacy.net)and fired [ethical AI lead Margeret Mitchell](https://www.theverge.com/2021/4/13/22370158/google-ai-ethics-timnit-gebru-margaret-mitchell-firing-reputation?ref=thenexusofprivacy.net) so take their commitments with a grain of salt. \*\*\*\* Which may or may not happen. California – which adopted its own privacy law by referendum in 2020 – is not happy with the ADPPA's preemption of state consumer privacy laws. To be fair, a lot of other states also aren't happy about preemption; Washington's AG and grassroots Indisivible activists in Washington have also sent letters to Congress, and so has a coalition of a dozen AGs including Connecticut, Illinois, Maine, Massachusetts, Nevada, New Jersey, New Mexico, and New York. But Calfornia is especially unhappy. Both no votes in the committee were from California representatives, and California's Governor, AG, state legislature leaders, and privacy authority have all sent letters to Speaker Pelosi and Minority Leader McCarthy -- both of whom are from California. So that'll have to get sorted out for the bill to get a floor vote. Still, most people think that the bill still has a good chance to get through the House, so we should certainly plan for the possibility that they find a "dramatic" way around this "impasse." ## ## ## ## ### Privacy News: August 22 URL: https://thenexusofprivacy.net/privacy-news-august-22/ Last updated: 2022-08-22T18:10:55.000Z A range of stories to start the week off ... ### [Birthing Predictions of Premature Death](https://logicmag.io/home/birthing-predictions-of-premature-death?ref=thenexusofprivacy.net) J. Khadijah Abdurahman on Logic Magazine (logicmag.io) Logic Magazine's incoming editor takes a powerful in-depth look at how family policing (aka "child welfare") became data-driven – and the horrific implications. > Every aspect of interacting with the various institutions that monitored and managed my kids—ACS, the foster care agency, Medicaid clinics—produced new data streams.... Documentation and data collection was not something that existed outside of analog, obscene forms of violence, like having your kids torn away. Rather, it’s deeply tied to real-life harm. > > I had no pre-existing interest in the banal details of data collection, but when I read the political scientist Virginia Eubanks’ Automating Inequality: How High-Tech Tools Profile, Police, and Punish the Poor in 2018, I finally had a framework to understand how our experience was so deeply driven by, and entangled with, the production of data. Eubanks’ notion of the “digital poorhouse”—a complex set of computational geographies for disciplining poor people—was viscerally real for me. FIND OUT MORE: - [The Reproductive Violence of Family Policing & Separation](http://blog.petrieflom.law.harvard.edu/2022/05/09/dorothy-roberts-torn-apart-family-separation/?ref=thenexusofprivacy.net), Dorothy Roberts, *Bill of Health* - [Abolish Family Policing, Too](https://www.dissentmagazine.org/article/abolish-family-policing-too?ref=thenexusofprivacy.net), Dorothy Roberts, *Dissent Magazine* - [One in Ten Black Children in America Are Separated From Their Parents by the Child-Welfare System. A New Book Argues That’s No Accident](https://time.com/6168354/child-welfare-system-dorothy-roberts/?ref=thenexusofprivacy.net), a discussion of Roberts' book [Torn Apart: How the Child Welfare System Destroys Black Families--and How Abolition Can Build a Safer World](https://www.basicbooks.com/titles/dorothy-roberts/torn-apart/9781549193170/?ref=thenexusofprivacy.net) ### [A Dad Took Photos of His Naked Toddler for the Doctor. Google Flagged Him as a Criminal](https://nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html?ref=thenexusofprivacy.net) Kashmir Hill on NYTimes (nytimes.com) Mark's son's penis was painful and looking swollen, so (at the doctor's request) he sent photos to prepare for their emergency video consultation. Google's scanning for child sexual abuse material flagged the picture, so they deleted Mark's account and reported him to the authorities. He was cleared after an investigation – but still doesn't have his account back. The same thing happened to somebody in Texas, and who knows how many others. > Dr. Suzanne Haney, chair of the American Academy of Pediatrics’ Council on Child Abuse and Neglect, advised parents against taking photos of their children’s genitals, even when directed by a doctor. > > “The last thing you want is for a child to get comfortable with someone photographing their genitalia,” Dr. Haney said. “If you absolutely have to, avoid uploading to the cloud and delete them immediately.” ### [Class action against Oracle’s worldwide surveillance machine](https://iccl.ie/news/class-action-against-oracle?ref=thenexusofprivacy.net) ICCL on Irish Council for Civil Liberties (iccl.ie) Oracle claims to have amassed dossiers on 5 billion people, and generates $42.4 billion in annual revenue. ICCL’s Dr Johnny Ryan is a lead plaintiff in a new U.S. class action to stop its global surveillance machine. Ryan's complaint against Internet Advertising Bureau Europe eventually lead to their RTB system being found in violation of the GDPR, so this is a big deal. But the legal environment is much tricker in the US; California's privacy law only has a private right of action for data breaches. So the suit instead alleges violations the California's Constitution and Invasion of Privacy Act, as well as competition law, the common law, and the Electronic Communications Privacy Act (ECPA) FIND OUT MORE: - [Robert Bateman's excellent Twitter thread](https://twitter.com/RobertJBateman/status/1561654119240278017?ref=thenexusofprivacy.net) has some great details - [Oracle ‘profits from sale of dossiers on people’s political views and online purchases’](https://www.irishtimes.com/business/2022/08/22/oracle-profits-from-sale-of-dossiers-on-peoples-political-views-and-online-purchases/?ref=thenexusofprivacy.net), Ian Curran, The Irish Times (irishtimes.com) - [Oracle’s ‘surveillance machine’ faces privacy class action](https://social.techcrunch.com/2022/08/22/oracle-us-privacy-class-action/?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com) ### [Bad Data “For Good”: How Data Brokers Try to Hide in Academic Research](https://eff.org/deeplinks/2022/08/bad-data-good-how-data-brokers-try-hide-academic-research?ref=thenexusofprivacy.net) Gennie Gebhart on Electronic Frontier Foundation (eff.org) When data broker SafeGraph got caught selling location information on Planned Parenthood visitors, their CEO [claimed](https://www.protocol.com/newsletters/protocol-enterprise/safegraph-auren-hoffman-github-twilio?ref=thenexusofprivacy.net) that this harvesting and sharing of sensitive data was, in fact, an engine for beneficial [research](https://www.safegraph.com/academics?ref=thenexusofprivacy.net) on abortion access. Other data brokers also have "data for good" programs. But ... > Location data brokers do not come close to meeting human subjects research standards. This starts with the fact that meaningful opt-in consent is consistently missing from their business practices. In fact, Google concluded that SafeGraph’s practices were so out of line that it [banned any apps using the company’s code](https://www.vice.com/en/article/5db4ad/google-bans-safegraph-former-saudi-intelligence?ref=thenexusofprivacy.net) from its Play Store, and both Apple and Google [banned X-Mode](https://www.vice.com/en/article/g5bjpx/apple-google-x-mode-xmode-app-stores?ref=thenexusofprivacy.net) from their respective app stores. ## And ... [Fears over China’s access to genetic data of UK citizens](https://theguardian.com/science/2022/aug/20/fears-over-chinas-access-to-genetic-data-of-uk-citizens?ref=thenexusofprivacy.net), Shanti Das on The Guardian (theguardian.com): Biobank urged to review transfer of information for medical research [How to Stop Robots From Becoming Racist](https://wired.com/story/how-to-stop-robots-becoming-racist?ref=thenexusofprivacy.net), Khari Johnson on WIRED (wired.com): Algorithms can amplify patterns of discrimination. Robotics researchers are calling for new ways to prevent mechanical bodies acting out those biases. [Regulating the Risks of AI](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4195066&ref=thenexusofprivacy.net), Margot E. Kaminski on papers.ssrn.com: Lawmakers in both the United States and the European Union (EU) have turned to the tools of risk regulation for governing AI systems. But risk regulation comes with its own policy baggage: a set of tools and troubles that have emerged in other fields. [Why AI regulation will resemble privacy regulation](https://venturebeat.com/ai/why-ai-regulation-will-resemble-privacy-regulation?ref=thenexusofprivacy.net), Bobby Napiltonia, Okera on VentureBeat (venturebeat.com): Concerns over data privacy have sparked regulations in the U.S. and Europe. How will AI regulations look as they come to fruition? [Hitting the Books: How can privacy survive in a world that never forgets?](https://engadget.com/hitting-the-books-machines-behaving-badly-toby-walsh-la-trobe-university-press-150017213.html?ref=thenexusofprivacy.net): An excerpt from Dr. Toby Walsh's [*Machines Behaving Badly: The Morality of AI*](https://www.amazon.com/gp/product/B09M65S7BM/ref=as%5Fli%5Fss%5Ftl?ie=UTF8&linkCode=ll1&tag=productpost2022-20&language=en%5FUS&ref=thenexusofprivacy.net)on Engadget (engadget.com) [A Lesson from Google: Can AI Bias be Monitored Internally?](https://hbr.org/podcast/2022/08/a-lesson-from-google-can-ai-bias-be-monitored-internally?ref=thenexusofprivacy.net), Cold Call podcast on Harvard Business Review (hbr.org): A star AI researcher was forced out of Google when she raised concerns about bias in the company’s large language models. Now tech companies must rethink their AI ethics. [LexisNexis sued by immigration advocates over data practices](https://computerweekly.com/news/252523969/LexisNexis-sued-by-immigration-advocates-over-data-practices?ref=thenexusofprivacy.net), Sebastian Klovig Skelton, on ComputerWeekly.com (computerweekly.com): Four immigration advocacy groups launch lawsuit in Illinois alleging data broker’s collection, aggregation and sale of people’s personal data, including non-public information, to corporations and government bodies. [New Pentagon Budget Could Force Military to Disclose Data Purchases](https://gizmodo.com/pentagon-budget-force-data-purchase-disclosure-ndaa-1849432085?ref=thenexusofprivacy.net), Dell Cameron on Gizmodo (gizmodo.com): The House approved a little-discussed budget amendment requiring the Pentagon to make its data purchases public. Now the Senate will decide its fate. [TikTok to tackle midterm misinformation](https://thehill.com/policy/cybersecurity/overnights/3605839-hillicon-valley-tiktok-to-tackle-midterm-misinformation?ref=thenexusofprivacy.net), Rebecca Klar on The Hill (thehill.com): TikTok released its plan to tackle midterm-related content, including how it will crack down on paid influencer political ads. Meanwhile, the Department of Energy announced on … [There are two factions working to prevent AI dangers. Here’s why they’re deeply divided](https://vox.com/future-perfect/2022/8/10/23298108/ai-dangers-ethics-alignment-present-future-risk?ref=thenexusofprivacy.net), Kelsey Piper on Vox (vox.com): AI poses present risks and future ones. Why don’t the teams that work on them get along? [EFF & ACLU Brief: SFPD Violated Surveillance Law by Spying on Protests for Black Lives](https://eff.org/press/releases/eff-aclu-brief-sfpd-violated-surveillance-law-spying-protests-black-lives?ref=thenexusofprivacy.net), Jason Kelley on Electronic Frontier Foundation (eff.org): San Francisco police violated the city’s surveillance technology law by tapping into a private surveillance camera network to spy on demonstrators protesting the 2020 police murder of George Floyd, the Electronic Frontier Foundation (EFF) and American Civil Liberties Union Foundation (ACLU) told a state appeals court in [a brief filed Monday](https://eff.org/document/williams-v-sf-appeal-brief?ref=thenexusofprivacy.net). [Mozilla slaps 18 period and pregnancy tracking apps and devices with a ‘Privacy Not Included’ warning label](https://businessinsider.com/mozilla-period-pregnancy-apps-privacy-warning-label-flo-glow-ovia-2022-8?ref=thenexusofprivacy.net), Jordan Parker Erb on Insider (businessinsider.com): Popular reproductive health apps including Flo, Glow, and Ovia were given a privacy warning label from Mozilla following the reversal of Roe v. Wade. [The US Algorithmic Accountability Act of 2022 vs. The EU Artificial Intelligence Act: what can they learn from each other?](https://link.springer.com/article/10.1007/s11023-022-09612-y?ref=thenexusofprivacy.net), Jakob Mökander on SpringerLink (link.springer.com): On the whole, the US Algorithmic Accountability Act of 2022 (US AAA) is a pragmatic approach to balancing the benefits and risks of automated decision systems. Yet there is still room for improvement. [Privacy Concerns Ground Torrington, Conn., PD Drone Purchase](https://govtech.com/public-safety/privacy-concerns-ground-torrington-conn-pd-drone-purchase?ref=thenexusofprivacy.net), Thad Rueter on GovTech (govtech.com): The Torrington City Council has tabled a vote to approve the purchase of two drones for police use after citizen privacy concerns were raised. The vote has been postponed until the September meeting. [Why America should not adopt Europe’s model for tech regulation](https://thehill.com/opinion/technology/3604145-why-america-should-not-adopt-europes-model-for-tech-regulation?ref=thenexusofprivacy.net), Frances Townsend on The Hill (thehill.com): The author (a former Homeland Security Advisor) argues that the European Union is "barreling toward the final stages of enacting sweeping new rules in antitrust and speech that are gerrymandered to target only America’s most successful technology companies." [Seven Questions To Ask When Choosing A Privacy Management Software](https://forbes.com/sites/forbesbusinesscouncil/2022/08/19/seven-questions-to-ask-when-choosing-a-privacy-management-software?ref=thenexusofprivacy.net), Jodi Daniels on Forbes (forbes.com): There are a few ways to make an off-the-shelf program highly effective. [FTC weighs in on customer data privacy](https://martech.org/the-ftc-weighs-in-on-customer-data-privacy?ref=thenexusofprivacy.net), Kim Davis on MarTech (martech.org): Addressing data privacy concerns, the FTC has announced proposed rule-making on consumer surveillance and data security. [New report warns about privacy of period-tracking, pregnancy apps](https://goodmorningamerica.com/wellness/story/report-warns-privacy-period-tracking-pregnancy-apps-roe-88490331?ref=thenexusofprivacy.net), Good Morning America on Good Morning America (goodmorningamerica.com): The Mozilla Foundation looked at the privacy policies of 25 reproductive health apps. [Meet MetaGuard, an ‘incognito mode’ for the metaverse](https://theregister.com/2022/08/18/metaguard%5Fpromises%5Fprotection%5Ffrom%5Fmetaverse?ref=thenexusofprivacy.net), Thomas Claburn on The Register (theregister.com): As if the VR giants will let that stand – worth a try, though --- Image Credit: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [*Picpedia*](https://www.picpedia.org/highway-signs/p/privacy.html?ref=thenexusofprivacy.net). ### Privacy News: August 19 URL: https://thenexusofprivacy.net/privacy-news-august-19/ Last updated: 2022-08-19T19:02:07.000Z *Trying something different today and including short descriptions with the links. If you've got thoughts on this format – or anything else – please send feedback to* [*newsletter-feedback {at} thenexus {dot} today*](newsletter-feedback@thenexus.today) *Also, a new section on student privacy!* ## Student privacy ### [A Tool That Monitors How Long Kids Are in the Bathroom Is Now in 1,000 American Schools](https://vice.com/en/article/dy73n7/ehallpass-1000-thousand-schools-monitor-bathroom?ref=thenexusofprivacy.net) Joseph Cox on vice.com e-HallPass, a digital system that students have to use to request to leave their classroom and which takes note of how long they’ve been away, including to visit the bathroom, has spread into at least a thousand schools around the United States. Would ADPPA, the consumer privacy bill Congress is currenty considering, help prevent this kind of monitoring? My initial thought is no: e-HallPass is a a service provider collecting and processing data on behalf of the school (which isn't covered, and retains ownerhip of all the data). It'd be interesting to see some more detailed analysis. ## Privacy after Roe ### [FTC threatens to sue firm allegedly revealing abortion clinic visits](https://washingtonpost.com/technology/2022/08/18/ftc-abortion-location-data?ref=thenexusofprivacy.net) Cat Zakrzewski on The Washington Post (washingtonpost.com) The FTC is threatening to sue adtech company Kochava for (allegedly) revealing people’s visits to sensitive locations – including reproductive health clinics, according. And that's not all: > In addition to women’s reproductive health clinics, the agency argues that the data can be used to trace people to therapists’ offices, addiction recovery centers and other medical facilities. Last Friday, Kochava decided to strike first and preeemptively sued the FTC. As Zakrzewski notes > The action is an early indication of how the agency might assert itself as a defender of health-related data, in the wake of the Supreme Court’s decision to overturn Roe v. Wade in June. ### [Hundreds of Google workers demand abortion care protections](https://www.theguardian.com/technology/2022/aug/18/google-workers-demand-safety-abortion-care?ref=thenexusofprivacy.net) Johana Bhuiyan, The Guardian (theguardian.com) Alphabet Workers Union wants the company to - extend access to reproductive healthcare benefits already offered to full-time employees to temporary and contract workers; s - top any and all political lobbying of politicians or organizations “because these politicians were responsible for appointing the supreme court justices who overturned Roe v Wade and continue to infringe on other human rights issues”. - stop storing health-related data that could later be used to criminalize users - address the disinformation and misinformation found in search results – such as sending people searching for abortion information to crisis pregnancy centers. [AWU has details on Twitter](https://twitter.com/AlphabetWorkers/status/1560253968889966593?ref=thenexusofprivacy.net). **ALSO:** - [Google workers demand abortion protections and stronger data privacy](https://cbsnews.com/news/abortion-google-workers-demand-protections-data-privacy?ref=thenexusofprivacy.net), on CBS News (cbsnews.com) - [Hundreds of Google workers demand abortion protections, data privacy](https://pbs.org/newshour/economy/hundreds-of-google-workers-demand-abortion-protections-data-privacy?ref=thenexusofprivacy.net), Associated Press on PBS NewsHour (pbs.org) > **TAKE ACTION! Tell Google to stop profiting from anti-abortion disinformation using** [**Center for Countering Digital Hate's form**](https://act.counterhate.com/page/107525/petition/1?ref=thenexusofprivacy.net)**.** ## And ... [Ring’s new TV show is a brilliant but ominous viral marketing ploy](https://technologyreview.com/2022/08/19/1058259/ring-nation-new-tv-show-viral-marketing?ref=thenexusofprivacy.net), Eileen Guo on MIT Technology Review (technologyreview.com): Ring Nation wants to lure you in with funny content—and push you to buy a Ring camera to make your own. [AI Use Case Inventory | Homeland Security](https://dhs.gov/data/AI%5Finventory?ref=thenexusofprivacy.net), on U.S. Department of Homeland Security logo (dhs.gov): an inventory of non-classified and non-sensitive Artificial Intelligence (AI) use cases. [GPS tagging of migrants breaches UK data protection law, says Privacy International complaint](https://computerweekly.com/news/252523938/GPS-tagging-of-migrants-breaches-UK-data-protection-law-says-Privacy-International-complaint?ref=thenexusofprivacy.net), Bill Goodwin, on ComputerWeekly.com (computerweekly.com): Privacy group files complaints with Information Commissioner’s Office and Forensic Science Regulator over Home Office’s GPS monitoring of migrants. [The U.S. Congress-TikTok data privacy dance on a loop | Biometric Update](https://biometricupdate.com/202208/the-u-s-congress-tiktok-data-privacy-dance-on-a-loop?ref=thenexusofprivacy.net), Jim Nash on BiometricUpdate.com (biometricupdate.com): It is hard to imagine an escape for the U.S. government and TikTok executives as they circle each other in what probably is an unresolvable spiral of distrust. [Facial Recognition Bans Begin To Fall Around the US as Re-Funding of Law Enforcement Becomes Politically Popular](https://cpomagazine.com/data-privacy/facial-recognition-bans-begin-to-fall-around-the-us-as-re-funding-of-law-enforcement-becomes-politically-popular?ref=thenexusofprivacy.net), Scott Ikeda on CPO Magazine (cpomagazine.com): Some cities and states that were early to ban law enforcement from using facial recognition software appear to be having second thoughts as crime spikes become a major political issue. --- Image credit: Privacy, by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) #### ### Queer experience, privacy legislation, and other privacy News: August 18 URL: https://thenexusofprivacy.net/privacy-news-august-18/ Last updated: 2026-04-16T02:40:30.000Z As always, a lot going on! ### [Hiding OUT: A Case for Queer Experiences Informing Data Privacy Laws](https://publicknowledge.org/hiding-out-a-case-for-queer-experiences-informing-data-privacy-laws?ref=thenexusofprivacy.net) Antoine Prince Albert III on Public Knowledge (publicknowledge.org) In a long, thought-provoking, and very timely piece, this article suggests > The best way for any federal or state legislature to assure all consumers’ privacy is protected online is to stress-test their laws against the harsh and worsening realities of queer experiences. If a law can protect queer interests, it will ensure that all consumers are maximally protected. More fundamentally, a federal standard of informational privacy will be essential to disrupt states’ enforcement against individuals’ rights to decisional privacy. After discussions of the harsh realities of American queer experience, and how "life-affirming spaces online trivialize the harsh, anti-queer realities of life offline", Albert ticks off some of the key features legislation needs to protect queer people – and everybody else. - Protect private media, personal correspondence, informational data, and metadata by default. - Protect information about people’s communications patterns as well as obvious sensitive data like a romantic video, an emotional voice note, or an online private message thread - Contain heightened protection of individuals’ account or device log-in credentials, activities over time and across third-party websites or services, as well as information about their television, cable or streaming service subscriptions, preferences, and usage. - Tightly secure health and genetic information - Include intentionally inclusive civil rights protections into their consumer privacy laws. It's interesting to look at the ADPPA consumer privacy legislation through this lens. While it takes steps to address some of these, it also has significant loopholes – for example, gender identity, sexual orientation, and sex aren't considered sensitive data; and voice notes and personal correspondence sent to (or created on) employer-issued machines gets less protection. So I wholeheartedly agree with the author: let's fashion privacy legislation in Queen Swann’s fabulous image! **SEE ALSO**: [Design From the Margins](https://www.belfercenter.org/publication/design-margins?ref=thenexusofprivacy.net), by Afsaneh Rigot, on centering the most marginalized and impacted in design processes. The first example in [the technical report](https://www.belfercenter.org/sites/default/files/files/publication/TAPP-Afsaneh%5FDesign%20From%20the%20Margins%5FFinal%5F220514.pdf?ref=thenexusofprivacy.net) discusses how product changes Grindr made to protect queer users in the Middle East and North Africa, who are generally even more at risk than most Western queers, turned out to be extremely popular for *all* users. Rigot's focusing on product and technology design, but as Albert highlights, the same approach of designing from the margins applies to legislation design as well. ## ## Federal privacy legislation and regulation #### [Nadler & Thompson Send Letter Requesting Information on Government Purchase of Americans’ Private Data](https://judiciary.house.gov/news/documentsingle.aspx?DocumentID=5042&ref=thenexusofprivacy.net) U.S. House Judiciary Committee (judiciary.house.gov) In a followup to the Digital Dragnets hearing and revelations of the scope of DHS purchases of cellphone data we discussed in the [July 20 newsletter](https://thenexusofprivacy.net/privacy-news-july-20/), House Judiciary Committee Chair Jerry Nadler (D-NY) and Homeland Security Committee Chair Bennie G. Thompson (D-MS) sent a letter to DOJ, DHS, the FBI, CBP, ICE, DEA, and BATF requesting information regarding their agencies’ purchasing of Americans’ data from private companies. > “Rather than focusing on particular suspects, data policing tools are dragnets, sifting through all of our data,” the Chairs wrote, “Recent investigative reports indicate that many law enforcement agencies—including yours—have purchased data or licenses through relationships with data brokers, instead of obtaining it through statutory authorities, court order, or legal process.” The information is likely to add more momentum to the Fourth Amendment Is Not For Sale Act, which had strong bipartisan support in the hearing. **FIND OUT MORE**: [Lawmakers Demand FBI, DHS, and Others Reveal Purchases of Private Data](https://gizmodo.com/nadler-thompson-personal-data-letter-doj-dhs-1849420290?ref=thenexusofprivacy.net), Dell Cameron, Gizmodo (gizmodo.com) > **TAKE ACTION:** [**Tell Congress to pass the Fourth Amendment Is Not For Sale Act**](https://act.eff.org/action/tell-congress-the-fourth-amendment-is-not-for-sale?ref=thenexusofprivacy.net) **with EFF's handy web form** #### [New U.S. Privacy Law May Give Telecoms Free Pass on $200 Million Fines](https://vice.com/en/article/m7gb9y/new-us-privacy-law-may-give-telecoms-free-pass-on-dollar200-million-fines?ref=thenexusofprivacy.net) Joseph Cox on Motherboard (vice.com) The ADPPA consumer privacy bill shifts privacy regulation of telecoms a from the FCC to the FTC. In the hearing, lobbyist Maureen Ohlhausen (testifying on behalf of the 21st Century "Privacy" Coalition, whose founders include AT&T, Verizon, Comcast, and industry trade associations) described this as "appropriate". And yeah, you can see why telecoms would support this: > “Congress’s ‘grand’ privacy bargain not only apparently lets the nation’s largest mobile carriers skip hundreds of millions in FCC fines for their egregious, illegal sharing of sensitive data on Americans; it completely strips the expert agency on telecom privacy of any power to protect our rights to our location data. That’s dangerous,” Ryan Singel, open internet fellow at Stanford’s Center for Internet and Society, told Motherboard. The [FCC fined AT&T, T-Mobile, Sprint, Verizon $200 million in in February 2020](https://www.vice.com/en/article/3a87bv/fcc-propose-fines-verizon-att-sprint-tmobile-selling-location-data?ref=thenexusofprivacy.net), after an investigation by Motherboard sold location data that wound up going to [hundreds of bounty hunters](https://www.vice.com/en%5Fus/article/43z3dn/hundreds-bounty-hunters-att-tmobile-sprint-customer-location-data-years?ref=thenexusofprivacy.net), and a spearate invesgiation the *The New York Times* and the office of Sen. Ron Wyden found that the carriers sold location data to a company which allowed [law enforcement officials to track the location of phones without a warrant](https://www.nytimes.com/2018/05/10/technology/cellphone-tracking-law-enforcement.html?ref=thenexusofprivacy.net). FIND OUT MORE: [Lobbyists gonna lobby](https://thenexusofprivacy.net/a-fresh-wrench-and-two-hearings/#lobbyists-gonna-lobby) talks about 21st Century "Privacy" Coalition's other co-founder Jon Leibowitz and his strategy for pushing weak, preemptive federal privacy legislation. To be fair, though, when Leibowitz spoke (right after me!) at the CPPA special board meeting, urging them to support weak federal privacy legislation, he made a point of saying that he wasn't there on behalf of any client. ### Also ... [Learn how the FTC plans to regulate “commercial surveillance"](https://go.terratruehq.com/FTC-regulates-commercial-surveillance-TY.html?ref=thenexusofprivacy.net), Maneesha Mithal, Gabe Madoff, Jason Gerson, and Angelique Carson on logo (go.terratruehq.com) [Idaho Company Sues FTC, Claiming Agency Threatened Suit Over Its Tracking Data](https://wsj.com/articles/idaho-company-sues-ftc-claiming-agency-threatened-suit-over-its-tracking-data-11660608782?ref=thenexusofprivacy.net), John D. McKinnon on WSJ (wsj.com) [The FTC’s privacy rulemaking: Risks and opportunities](https://iapp.org/news/a/the-ftcs-privacy-rulemaking-risks-and-opportunities?ref=thenexusofprivacy.net), Omer Tene on International Association of Privacy Professionals (iapp.org) ## Privacy after Roe [Mozilla slaps 18 period and pregnancy tracking apps and devices with a ‘Privacy Not Included’ warning label](https://businessinsider.com/mozilla-period-pregnancy-apps-privacy-warning-label-flo-glow-ovia-2022-8?ref=thenexusofprivacy.net), Jordan Parker Erb on Insider (businessinsider.com) [When law enforcement wants your social media content, do data privacy laws hold up?](https://npr.org/2022/08/14/1117465757/when-law-enforcement-wants-your-social-media-content-do-data-privacy-laws-hold-u?ref=thenexusofprivacy.net), Michel Martin and Logan Koepke on NPR (npr.org) [Civil society to Meta: Stop censoring reproductive rights content](https://accessnow.org/meta-stop-censoring-reproductive-rights-content?ref=thenexusofprivacy.net), Jennifer Brody on Access Now (accessnow.org) [Coalition Urges SC Lawmakers to Stop Reproductive Health Censorship Bill](https://progresschamber.org/coalition-urges-sc-lawmakers-to-stop-reproductive-health-censorship-bill?ref=thenexusofprivacy.net), cmackenzie on Chamber of Progress (progresschamber.org) [What Facebook’s abortion case should tell us about tech companies and user privacy](https://wbur.org/hereandnow/2022/08/15/facebook-abortion-user-privacy?ref=thenexusofprivacy.net), WBUR on WBUR (wbur.org) [Using HIPAA To Protect Patient Privacy and Fight Abortion Criminalization](https://americanprogress.org/article/using-hipaa-to-protect-patient-privacy-and-fight-abortion-criminalization?ref=thenexusofprivacy.net), Communications on Center for American Progress (americanprogress.org) [How Google found itself under pressure from all sides after Roe’s demise](https://edition.cnn.com/2022/08/12/tech/google-abortion-response?ref=thenexusofprivacy.net), Jennifer Korn on CNN (edition.cnn.com) ## And ... [The Rise of the Worker Productivity Score](https://nytimes.com/interactive/2022/08/14/business/worker-productivity-tracking.html?ref=thenexusofprivacy.net), Jodi Kantor, Arya Sundaram, Aliza Aufrichtig and Rumsey Taylor on The New York Times (nytimes.com) [Improving Researcher Access to Digital Data: A Workshop Report](https://cdt.org/insights/improving-researcher-access-to-digital-data-a-workshop-report?ref=thenexusofprivacy.net), Caitlin Vogus on Center for Democracy and Technology (cdt.org) [New York Becomes First State to Require CLE in Cybersecurity, Privacy and Data Protection](https://natlawreview.com/article/new-york-becomes-first-state-to-require-cle-cybersecurity-privacy-and-data?ref=thenexusofprivacy.net), Hunton Andrews Kurth’s Privacy and Cybersecurity on The National Law Review (natlawreview.com) [Head in the Clouds? A Brief Note on Transfers to the US in a Privacy-Absolutist World](https://linkedin.com/pulse/head-clouds-brief-note-transfers-us-world-carey-lening-cdpp?ref=thenexusofprivacy.net), Carey Lening on linkedin.com [Blockchain’s Forever Memory Confounds EU ‘Right to Be Forgotten’](http://mofo.com/resources/news/220804-blockchains-forever-memory-confounds-eu?ref=thenexusofprivacy.net), on Morrison Foerster (mofo.com) [GitHub’s new privacy policy sparks backlash over tracking cookies](https://bleepingcomputer.com/news/security/githubs-new-privacy-policy-sparks-backlash-over-tracking-cookies?ref=thenexusofprivacy.net), Ax Sharma on BleepingComputer (bleepingcomputer.com) [Beyond third-party cookies: Community and consumer privacy in the metaverse](https://venturebeat.com/data-infrastructure/beyond-third-party-cookies-community-and-consumer-privacy-in-the-metaverse?ref=thenexusofprivacy.net), Fiona Campbell-Webster, MediaMath on VentureBeat (venturebeat.com) [Privacy Protocol Monero Is Getting a Major Upgrade](https://coindesk.com/tech/2022/08/12/privacy-protocol-monero-is-getting-a-major-upgrade?ref=thenexusofprivacy.net), Frederick Munawa on CoinDesk (coindesk.com) [What Apple’s Privacy Message is Missing](https://datanami.com/2022/08/12/what-apples-privacy-message-is-missing?ref=thenexusofprivacy.net), Alex Woodie on Datanami (datanami.com) [18 books (In English) on privacy and data protection](https://threadreaderapp.com/thread/1554036982707265542.html?ref=thenexusofprivacy.net), Luiza Jarovsky on Thread Reader (threadreaderapp.com) [Bitcoin’s Privacy Problem—And What Cypherpunks Are Doing to Solve It](https://decrypt.co/107376/bitcoin-privacy-problem-what-cypherpunks-are-doing?ref=thenexusofprivacy.net), Mat Di Salvo on Decrypt (decrypt.co) [GDPR Compliance: What is Privacy Shield 2.0?](https://jdsupra.com/legalnews/gdpr-compliance-what-is-privacy-shield-2937528?ref=thenexusofprivacy.net), Nicole Cloyd on JD Supra (jdsupra.com) [Potential Privacy Challenges in a Smart Office](https://iotforall.com/privacy-challenges-in-smart-offices?ref=thenexusofprivacy.net), Ellie Poverly on IoT For All (iotforall.com) [‘National Digital Identity Program’ to be introduced to Canadians](https://euroweeklynews.com/2022/08/12/national-digital-identity-program-to-be-introduced-to-canadians?ref=thenexusofprivacy.net), Anna Ellis on Euro Weekly News (euroweeklynews.com) [Apple’s privacy changes are causing many SMBs to lose money](https://techradar.com/news/apples-privacy-changes-are-causing-many-smbs-to-lose-money?ref=thenexusofprivacy.net), Will McCurdy on TechRadar pro (techradar.com) [Public Input Sought To Inform Privacy Rules For Biometrics in New Zeland](https://scoop.co.nz/stories/PO2208/S00107/public-input-sought-to-inform-privacy-rules-for-biometrics.htm?ref=thenexusofprivacy.net), on Scoop News (scoop.co.nz) #### ### Privacy News: August 15 URL: https://thenexusofprivacy.net/privacy-news-august-15/ Last updated: 2022-08-15T18:52:27.000Z Today's top story is from right here in King County – home to Seattle, Microsoft, Amazon, and The Nexus of Privacy! ### [How King County’s efforts to help at-risk students created a record that could jeopardize their privacy](https://seattletimes.com/seattle-news/times-watchdog/king-county-program-to-help-at-risk-students-could-jeopardize-privacy?ref=thenexusofprivacy.net) Daniel Gilbert on Seattle Times (seattletimes.com) King County's Check Yourself [questionnaire](https://www.documentcloud.org/documents/21190961-bsk-sbirt-sb-screening-tool-content%5F20%5F9-9-19?ref=thenexusofprivacy.net) collecting students’ age, grade, race, language, gender identity, sexual orientation, school, and other details they include in open-ended responses — as Gilbert says, "an unusually intimate record for a survey that isn’t anonymous. " Then > This data is transmitted without student names to a for-profit software firm, which grants access to Seattle Children’s Research Institute — both contracted by King County. Schools, which can link student names to their answers, follow up with them to offer support. What could possibly go wrong? The goal is a good one – screening middle- and high-school students for mental health and other risks. And experts in screening youth who the Seattle Times talk ed to mostly praised the approach. From a privacy perspective, though, it's a nightmare. To start with, it's not clear whether the information should be considered part of students' educational record ... but the implications are bad either way. > With such sensitive information in hand, schools must determine whether kids’ screening results are part of their education record. If so, parents would have a right under federal law to see things that their children might not want them to know. If not, the information isn’t protected by a federal privacy law — raising the prospect that it could be released publicly and compromise student privacy, experts say. The whole article is worth reading. A key point from the "deeper look" at the end: it absolutely *is* possible to do this kind of screening while still providing stronger student privacy protections. Massachusetts, for example, prohibits creating any record that includes information that could identify a student – a legal mandate that doesn’t exist in Washington state yet. ## Privacy after Roe ### [Does your rewards card know if you’re pregnant? Privacy experts sound the alarm](https://npr.org/2022/08/13/1115414467/consumer-data-abortion-roe-wade-pregnancy-test-rewards-card-target-walgreens?ref=thenexusofprivacy.net) Manuela López Restrepo on NPR (npr.org) A Twitter thread from a person who bought a pregnancy test at Walgreen's using their reward card and then got a package in the mail from baby forumla company Enfamil (with formula, a pacifier, and a box with the phrase, "Here's our first gift for the most important person in the world") highlights the potential privacy risks of loyalty cards. Walgreen's claims they didn't provide customer data to Enfamil; Enfamil says they don't have access to Walgreen's customer data; so clearly it's just coincidence, right? Wrong. It turns out that if customers opt in to receive marketing information (such as special deals – and who wouldn't opt in for that?) the data is shared with a third party,who then gives Enfamil and others access to it. **ADPPA PERSPECTIVES**: the American Data Privacy Protection Act (ADPPA) currently working its way through Congress has a loophole in it specially crafted to allow this kind of data sharing. Section 104(b), the "pay for privacy" section, allows companies to give customers cheaper prices or better services for agreeing to share their information as part of a "bona fide loyalty program" – just like this one. For more on ADPPA's "pay for privacy" issues, see EFF's [Americans Deserve More Than The Current American Data Privacy Protection Act](https://www.eff.org/deeplinks/2022/07/americans-deserve-more-current-american-data-privacy-protection-act?ref=thenexusofprivacy.net), ACLU's [July 18 letter on ADPPA](https://www.aclu.org/letter/aclu-letter-house-energy-and-commerce-committee-american-data-privacy-protection-act?ref=thenexusofprivacy.net), and [Californians for Consumer Privacy Announce Opposition to ADPPA](https://www.caprivacy.org/californians-for-consumer-privacy-announce-opposition-to-adppa/?ref=thenexusofprivacy.net) ### Also ... [How California Reproductive Health Workers Can Protect Information They Submit to the Government](https://eff.org/deeplinks/2022/08/how-california-reproductive-health-workers-can-protect-information-they-submit?ref=thenexusofprivacy.net), Dave Maass on Electronic Frontier Foundation (eff.org) [The Demise of Roe Threatens the Privacy of a Woman’s Entire Reproductive Health Record](https://jurist.org/commentary/2022/08/jeffrey-harris-dobbs-abortion-reproductive-rights?ref=thenexusofprivacy.net), Jeffrey E. Harris on JURIST (jurist.org) [Facebook, abortion, and the future of data privacy](https://cjr.org/the%5Fmedia%5Ftoday/facebook-abortion-and-the-future-of-data-privacy.php?ref=thenexusofprivacy.net), Mathew Ingram on Columbia Journalism Review (cjr.org) ## And ... [‘Ring Nation’ Is Amazon’s Reality Show for Our Surveillance Dystopia](https://vice.com/en/article/7k8x49/ring-nation-is-amazons-reality-show-for-our-surveillance-dystopia?ref=thenexusofprivacy.net), Edward Ongweso on vice.com > At this point, it is hard to defend ownership of a Ring camera. Using fear-mongering about package theft and suburban crime, a surveillance company has convinced countless homes to affix a surveillance network node that police departments and one of the world’s largest monopolies will use to their benefit. And now they want us to laugh about it all in our (ideally) Ring-surveilled homes. [Police Used a Baby’s DNA to Investigate Its Father for a Crime](https://wired.com/story/police-used-a-babys-dna-to-investigate-its-father-for-a-crime?ref=thenexusofprivacy.net), Emily Mullen on WIRED (wired.com) > Jennifer Sellitti, an attorney with the Office of the New Jersey Public Defender, which is representing the father, says combining newborn screening samples with genetic genealogy opens the door for virtually anyone’s DNA to be used in a criminal investigation. “This is like a dystopian onion. Every time we peel back another layer, we find some new violation of privacy,” she says. [Does Your Car Need to Know Your Race and Heart Rate?](https://themarkup.org/newsletter/hello-world/does-your-car-need-to-know-your-race-and-heart-rate?ref=thenexusofprivacy.net) ,Julia Angwin on The Markup (themarkup.org), a followup to Jon Keegan and Alfred Ng's [Who Is Collecting Data from Your Car?](https://themarkup.org/the-breakdown/2022/07/27/who-is-collecting-data-from-your-car?ref=thenexusofprivacy.net), [Another Amazon acquisition brings us closer to the death of privacy, Tiffany C. Li](https://msnbc.com/opinion/msnbc-opinion/how-amazon-facebook-google-threaten-fundamental-right-n1297895?ref=thenexusofprivacy.net) on MSNBC (msnbc.com) [Amazon’s Creepy Palm Reading Payment System Is Taking Over Whole Foods](https://gizmodo.com/whole-foods-palm-contactless-payment-amazon-1849395184?ref=thenexusofprivacy.net), Mack DeGeurin on Gizmodo (gizmodo.com) [Introduction to the Conformity Assessment under the draft EU AI Act, and how it compares to DPIAs](https://fpf.org/blog/introduction-to-the-conformity-assessment-under-the-draft-eu-ai-act-and-how-it-compares-to-dpias?ref=thenexusofprivacy.net), Katerina Demetzou, Future of Privacy Forum (fpf.org) [Biometrics reach more health cards, airports and retailers amid data privacy conflicts | Biometric Update](https://biometricupdate.com/202208/biometrics-reach-more-health-cards-airports-and-retailers-amid-data-privacy-conflicts?ref=thenexusofprivacy.net), Chris Burt on BiometricUpdate.com (biometricupdate.com) [Here’s What to Know About Google Search Rival DuckDuckGo](https://cnet.com/tech/services-and-software/duckduckgo-what-to-know-about-the-privacy-focused-search-engine?ref=thenexusofprivacy.net), Adam Benjamin on CNET (cnet.com) [Telehealth and Digital Health Privacy Regulations](https://jdsupra.com/legalnews/telehealth-and-digital-health-privacy-4448565?ref=thenexusofprivacy.net), Scott Lashway on JD Supra (jdsupra.com) [Connecticut Will Add More Privacy Requirements](https://shrm.org/ResourcesAndTools/legal-and-compliance/state-and-local-updates/Pages/connecticut-data-privacy.aspx?ref=thenexusofprivacy.net), Jason C. Gavejian and Joseph J. Lazzarotti © Jackson Lewis on SHRM (shrm.org) [Meta is ever so slowly expanding its testing of end-to-end encryption](https://arstechnica.com/information-technology/2022/08/meta-is-ever-so-slowly-expanding-its-testing-of-end-to-end-encryption?ref=thenexusofprivacy.net), Dan Goodin on Ars Technica (arstechnica.com) [Google to pay $60m fine for misleading Australians about collecting location data](https://theguardian.com/technology/2022/aug/12/google-to-pay-60m-fine-for-misleading-australians-about-collecting-location-data?ref=thenexusofprivacy.net), Australian Associated Press on The Guardian (theguardian.com) [85% of Android users are concerned about privacy](https://techrepublic.com/article/85-of-android-users-are-concerned-about-privacy?ref=thenexusofprivacy.net), Esther Shein on TechRepublic (techrepublic.com) [In-app browsers like those in Facebook and Instagram are a big privacy risk, developer shows](https://9to5mac.com/2022/08/11/in-app-browsers?ref=thenexusofprivacy.net), Ben Lovejoy on 9to5Mac (9to5mac.com) [Google fined $40M+ or misleading location tracking settings in Australia](https://techcrunch.com/2022/08/12/google-android-location-tracking-australia?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com) [Hospital and Drugmaker Move to Build Vast Database of New Yorkers’ DNA](https://nytimes.com/2022/08/12/nyregion/database-new-yorkers-dna.html?ref=thenexusofprivacy.net), Joseph Goldstein on NYTimes (nytimes.com) [GitHub’s new privacy policy sparks backlash over tracking cookies](https://bleepingcomputer.com/news/security/githubs-new-privacy-policy-sparks-backlash-over-tracking-cookies?ref=thenexusofprivacy.net), Ax Sharma on BleepingComputer (bleepingcomputer.com) --- *Image credit:* Daquella manera on [Flickr ](https://www.flickr.com/photos/62518311@N00/466172168?ref=thenexusofprivacy.net) via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons Attribution 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net) license. ### FTC Rulemaking and more: Privacy News, August 12 URL: https://thenexusofprivacy.net/privacy-news-august-12/ Last updated: 2026-04-16T02:39:45.000Z ### [FTC Explores Rules Cracking Down on Commercial Surveillance and Lax Data Security Practices](https://ftc.gov/news-events/news/press-releases/2022/08/ftc-explores-rules-cracking-down-commercial-surveillance-lax-data-security-practices?ref=thenexusofprivacy.net) the Premerger Notification Office Staff on Federal Trade Commission (ftc.gov) The FTC's Advanced Notice of Proposed Rulemaking (ANPR) starts a 60-day comment period, after which the FTC can then issue "trade regulation rules." As Commissioner Rebecca Slaughter explained during yesterday's press conference, this provides a path for the FTC to move beyond case-by-case enforcement. **GET INVOLVED:** Public comments are open for until early October, and there's a [public forum](https://www.ftc.gov/news-events/events/2022/09/commercial-surveillance-data-security-anpr-public-forum?ref=thenexusofprivacy.net) on September 8\. The Federal Register page to submit comments online isn't available yet, but you can [sign up to speak at the public forum here](https://www.ftc.gov/form/anpr-registration?ref=thenexusofprivacy.net). **FIND OUT MORE:** Monday at 9 am Pacific (noon Eastern), IAPP's Cobun Zweifel-Keegan talks with two influential former FTC voices: Former Acting Chairman of the FTC Maureen Ohlhausen and Former Director of the Bureau of Consumer Protection Jessica L. Rich in [Start your engines: What does FTC rulemaking mean for privacy?](https://linkedin.com/video/event/urn:li:ugcPost:6963604687371522048?ref=thenexusofprivacy.net) **MORE COVERAGE:** - [FTC officially launches privacy rulemaking endeavor](https://iapp.org/news/a/ftc-officially-launches-privacy-rulemaking-endeavor?ref=thenexusofprivacy.net), Joseph Duball, on International Association of Privacy Professionals (iapp.org) - [FTC kicks off major effort to craft data privacy rules](https://axios.com/2022/08/11/ftc-data-privacy-rules-feedback?ref=thenexusofprivacy.net), Margaret Harding McGill on Axios (axios.com) - [CDT Welcomes FTC Action to Crack Down on Harmful Online Data & Security Practices](https://cdt.org/press/cdt-welcomes-ftc-action-to-crack-down-on-harmful-online-data-security-practices?ref=thenexusofprivacy.net), on Center for Democracy and Technology (cdt.org) - [One big reason the FTC wants to do rule-making](https://www.protocol.com/newsletters/policy/ftc-regulations-penalties?ref=thenexusofprivacy.net), Ben Brody on Protocol Policy (protocol.com) - [FTC Launches National Privacy Rulemaking](https://www.jdsupra.com/legalnews/ftc-launches-national-privacy-rulemaking-4719110/?ref=thenexusofprivacy.net), Wiley Rein, JD Supra (jdsupra.com) - [FTC ponders punishment for commercial data ‘surveillance’](https://www.theregister.com/2022/08/11/ftc%5Fpersonal%5Fdata%5Frules/?ref=thenexusofprivacy.net), Thomas Claburn, The Register (theregister.com) - [The FTC takes aim at commercial surveillance](https://pluralistic.net/2022/08/12/regulatory-uncapture/?ref=thenexusofprivacy.net#conscious-uncoupling), Cory Doctorow, Pluralistic (pluralistic.net) - [FTC Is Exploring Ways to Crack Down on Big Tech’s Obsession With User Data](https://gizmodo.com/ftc-big-tech-user-data-data-brokers-1849400843?ref=thenexusofprivacy.net), Dell Cameron and Kyle Barr, Gizmodo (gizmodo.com) ## Federal Privacy Legislation ### [Californians for Consumer Privacy Announce Opposition to ADPPA](https://caprivacy.org/californians-for-consumer-privacy-announce-opposition-to-adppa?ref=thenexusofprivacy.net) Yes on Prop 24 (caprivacy.org) Californians for Consumer Privacy has been the driver for California's privacy laws, and their co-founder Alistair Mactaggart described the ADPPA as a major threat to Californians' privacy at [the CPPA special board meeting](https://thenexusofprivacy.net/is-there-an-elephant-in-the-zoom-room/), so this doesn't come as a surprise. Still, it's very interesting to see their take on the ways ADPPA is weaker than California's law – which comes to a very different conclusion than ADPPA supporters. **FIND OUT MORE**: Mactaggart was one of the panelists at Prof. Daniel Solove's excellent ADPPA webinar. [Register here](https://teachprivacy.com/webinar-federal-comprehensive-privacy-law/?ref=thenexusofprivacy.net) to get access to the recording. [Here's our live-tweeting](https://twitter.com/NexusOfPrivacy/status/1557431010077224960?ref=thenexusofprivacy.net) – or, if you prefer,[ in a single threadreaderapp page](https://threadreaderapp.com/thread/1557426453779689472.html?ref=thenexusofprivacy.net). ### ALSO: - [Big Tech Wolf in Sheep’s Clothing? Californians Unite in Opposition to the ADPPA “Trap”](https://tomkemp.blog/2022/08/10/big-tech-wolf-in-sheeps-clothing-californians-unite-in-opposition-to-the-adppa-trap/?ref=thenexusofprivacy.net), Tom Kemp, Tom Kemp's Blog (tomkemp.blog) - [One out of six ain’t good: Five ways the American Data Privacy and Protection Act falls short](https://thenexusofprivacy.net/one-out-of-six-aint-good/) , Jon Pincus on The Nexus of Privacy (privacy.theneus.today) ## And ... [Why diversity should have a critical impact on data privacy](https://venturebeat.com/security/why-diversity-should-have-a-critical-impact-on-data-privacy?ref=thenexusofprivacy.net), Veronica Torres, Jumio on VentureBeat (venturebeat.com) [Instagram faces EU privacy decision on kids’ data within weeks](https://techcrunch.com/2022/08/11/instagram-kids-data-gdpr-decision?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com) [The Surveillance Fantasies of the New Millennium Became Our Reality](https://gizmodo.com/the-privacy-we-knew-in-20th-century-no-longer-exists-1849191781?ref=thenexusofprivacy.net), Dell Cameron on Gizmodo (gizmodo.com) [Privacy enhancing technologies are transforming government data usage](https://openaccessgovernment.org/privacy-enhancing-technologies/141251?ref=thenexusofprivacy.net), Eskarina Handley on Open Access Government (openaccessgovernment.org) [Amazon’s One-Stop Shop for Identity Thieves](https://theintercept.com/2022/08/07/amazon-registry-identity-theft?ref=thenexusofprivacy.net), Nikita Mazurov on The Intercept (theintercept.com) [Smartwatches could soon be used to monitor migrants in the UK](https://mashable.com/article/facial-recognition-watches-migrants-uk?ref=thenexusofprivacy.net), Meera Navlakha on Mashable (mashable.com) [How to use App Tracking Transparency to stop apps from collecting your data and location on Apple devices](https://businessinsider.com/app-tracking-transparency?ref=thenexusofprivacy.net), Ryan Ariano on Insider (businessinsider.com) [India scraps data protection law, promises better successor](https://theregister.com/2022/08/04/india%5Fscraps%5Fdata%5Fprotection%5Flaw?ref=thenexusofprivacy.net), Laura Dobberstein on The Register (theregister.com) [Facebook faces third large fine for violating EU data laws in Ireland](https://irishtimes.com/technology/2022/08/08/facebook-faces-new-eu-data-fine?ref=thenexusofprivacy.net), Arthur Beesley on The Irish Times (irishtimes.com) [A first-of-its-kind law in Houston poses a major threat to privacy](https://fastcompany.com/90776461/a-first-of-its-kind-law-in-houston-poses-a-major-threat-to-privacy?ref=thenexusofprivacy.net), Julian Melendi and Evan Enzer on Fast Company (fastcompany.com) [New Report on Limits of “Consent” in Thailand’s Data Protection Law](https://fpf.org/blog/new-report-on-limits-of-consent-in-thailands-data-protection-law?ref=thenexusofprivacy.net), Dominic Paulger on Future of Privacy Forum (fpf.org) [Europe staves off Facebook blackout — for now](https://politico.eu/article/europe-eu-avoids-facebook-blackout-social-media?ref=thenexusofprivacy.net), Vincent Manancourt on POLITICO (politico.eu) [EU Court Expands Definition of Sensitive Data, Prompting Legal Concerns for Companies](https://wsj.com/articles/eu-court-expands-definition-of-sensitive-data-prompting-legal-concerns-for-companies-11660123800?ref=thenexusofprivacy.net), Catherine Stupp on The Wall Street Journal (wsj.com) [Facebook’s Message Encryption Was Built to Fail](https://wired.com/story/facebook-message-encryption-abortion?ref=thenexusofprivacy.net), Alfred Fox-Cahn on WIRED (wired.com) [A good privacy law could fend off Chinese-style surveillance](https://livemint.com/opinion/columns/a-good-privacy-law-could-fend-off-chinese-style-surveillance-11660062069168.html?ref=thenexusofprivacy.net), Andy Mukherjee on mint (livemint.com) [WhatsApp unveils new privacy features, like who can see you online and more](https://today.com/money/tech/whatsapp-new-features-privacy-protection-rcna42196?ref=thenexusofprivacy.net), Laya Neelakandan on TODAY (today.com) [‘Pretty Good Phone Privacy’ protects user metadata, location, more](https://medianama.com/2022/08/223-invisv-phone-carrier-user-metadata-location-privacy?ref=thenexusofprivacy.net), Vallari Sanzgiri on MediaNama (medianama.com) ### One out of six ain't good: Five ways the American Data Privacy and Protection Act falls short URL: https://thenexusofprivacy.net/one-out-of-six-aint-good/ Last updated: 2026-04-16T02:38:32.000Z > > *F*IND OUT MORE*: Prof. Daniel Solove moderated an excellent webinar on ADPPA Wednesday, August 10\.* [ *Here's our live-tweeting*](https://twitter.com/NexusOfPrivacy/status/1557431010077224960?ref=thenexusofprivacy.net) *– or, if you prefer,* [*in a single threadreaderapp page*](https://threadreaderapp.com/thread/1557426453779689472.html?ref=thenexusofprivacy.net)*.* A lot of the discussion of the proposed American Data Privacy and Protection Act (ADPPA) has focused on comparing it to California's privacy law, generally viewed as the strongest of the handful of existing state privacy laws. In [Californians for Consumer Privacy Announce Opposition to ADPPA](https://www.caprivacy.org/californians-for-consumer-privacy-announce-opposition-to-adppa/?ref=thenexusofprivacy.net), the group responsible for California's privacy law says that for Californians, ADPPA "would weaken existing privacy laws in far-reaching and vital ways." But not everybody sees it that way. Here's how Alan Butler and Caitriona Fitzgerald of EPIC Privacy frame it in [Evaluating the American Data Privacy and Protection Act](https://techpolicy.press/evaluating-the-american-data-privacy-and-protection-act?ref=thenexusofprivacy.net): > We believe that the ADPPA is stronger in several key areas then California’s CCPA, that it would provide roughly equivalent protections in most circumstances, and that the few areas where the CCPA is stronger could be addressed through minor amendments to the ADPPA. The [nicely-designed side-by-side](https://www.documentcloud.org/documents/22087567-advocates-memo-comparing-federal-privacy-bill-with-california-lawhttps://techpolicy.press/wp-content/uploads/2022/08/EPIC-ADPPAvCCPA-07292022.pdfhttps://techpolicy.press/wp-content/uploads/2022/08/EPIC-ADPPAvCCPA-07292022.pdf?ref=thenexusofprivacy.net) from EPIC, CDT and Lawyers Committee makes their case in more detail.\* **UPDATE, August 12**: [Californians for Consumer Privacy's side by-side responds](https://www.caprivacy.org/analysis-shows-cpra-is-significantly-stronger-than-adppa/?ref=thenexusofprivacy.net). They disagree. **UPDATE, September 7:** [a new analysis from Californians for Consumer privacy](https://www.caprivacy.org/californians-for-consumer-privacy-announce-opposition-to-adppa/?ref=thenexusofprivacy.net) spotlights 20 ways in which CPRA is stronger. Taking a step back ... as Omer Tene of Goodwin Procter points out [on Twitter](https://twitter.com/omertene/status/1552317950429986929?ref=thenexusofprivacy.net), when California's current privacy law was on the ballot as Prop. 24 in 2020, ACLU of Northern California opposed it, arguing it was catering to big tech interests and harmful to marginalized communities.\*\* Color of Change, Dolores Huerta, and many immigrant rights groups opposed it for similar reasons. With all the weaknesses these groups identified in California's law, "roughly equivalent protections in most circumstances" doesn't necessarily translate to strong protection. So let's build on Tene's point and take a different approach to the comparison. ## How many of Prop 24's weaknesses does ADPPA address? Prop. 24, also known as the California Privacy Rights Act (CPRA), amended the 2018 California Consumer Privacy Act (CCPA). As significant as Prop 24 was, it was also a missed opportunity to do even better – as the groups who critiqued it pointed out. So I went through the three highest-profile criticisms of Prop 24 from 2020\. - The [ballot argument against Prop 24](https://consumercal.org/wp-content/uploads/2020/07/No-on-Proposition-24-ballot-argument-for-CFC-website.pdf?ref=thenexusofprivacy.net), signed by Dolores Huerta along with Richard Holober of Consumer Federation of California and Tracy Rosenberg of Californians for Privacy Now - The [ballot rebuttal argument](https://consumercal.org/wp-content/uploads/2020/07/No-on-Proposition-24-Rebuttal-Argument.pdf?ref=thenexusofprivacy.net), signed by Kevin Baker of ACLU of California, Nan Brasmer of California Alliance for Retired Americans, John Mathias of Color of Change, and Mark Toney of TURN) - ACLU of Northern California's [Californians Should Vote No on Prop 24](https://www.aclunc.org/blog/californians-should-vote-no-prop-24?ref=thenexusofprivacy.net). Here are the problems they highlighted, along with opinions about how well these issues are addressed in ADPPA. ### Pay for privacy – substantially worse in ADPPA > Proposition 24 asks you to approve an Internet “pay for privacy” scheme. Those who don’t pay more could get inferior service – bad connections, slower downloads and more pop up ads. It’s an electronic version of freeway express lanes for the wealthy and traffic jams for everyone else. > > – from the [ballot argument against Prop 24](https://consumercal.org/wp-content/uploads/2020/07/No-on-Proposition-24-ballot-argument-for-CFC-website.pdf?ref=thenexusofprivacy.net) This criticism of Prop 24 may have been overstated – language in the bill, combined with CPPA's rulemaking authority, goes a long way to limit pay for privacy schemes. However, the key langauge is missing from ADPPA – as even supporters like Butler and Fitzgerald agree. > ADPPA would remove the CCPA’s requirement that financial incentives practices with respect to exercising privacy rights not be “unjust, unreasonable, coercive, or usurious in nature.” This is an important backstop to prevent exploitative practices. > > \- [CPPA July 26 bill analysis](https://cppa.ca.gov/meetings/materials/20220728%5Fitem2%5Fcppa%5Fstaff%5Fmemo%5Fhr8152.pdf?ref=thenexusofprivacy.net), on the latest draft of ADPPA > CPRA states that if businesses wish to incent consumers to share/sell their data, “\[the\] business shall not use financial incentive practices that are ***unjust, unreasonable, coercive, or usurious in nature***.” \[§1798.140(b)(4)\] > > ADPPA’s section covering retaliation, §104, is **missing** this critical consumer protection, which is terrible for consumers. We’ve all been in the situation where the item is 30% or 50% more expensive in the grocery store if you’re not a member of the store’s loyalty program. So if your choice is to pay 50% more for the cereal box or be forced into a loyalty program that gets you the discount but allows the store to sell your data—how is that a *choice?* It’s coercive on the part of the business, and CPRA stops it. > > \- [Californians for Consumer Privacy Announce Opposition to ADPPA](https://www.caprivacy.org/californians-for-consumer-privacy-announce-opposition-to-adppa/?ref=thenexusofprivacy.net) > In [our chart comparing the bills](https://techpolicy.press/wp-content/uploads/2022/08/EPIC-ADPPAvCCPA-07292022.pdf?ref=thenexusofprivacy.net), which is below, we summarize these provisions and highlight a few areas where the California law is stronger or where we feel the ADPPA needs to be tightened to avoid loopholes. These include the “guardrails” set for differential prices charged to individuals who chose to delete their data or decline to participate in a loyalty program > > \- [Evaluating the American Data Privacy and Protection Act](https://techpolicy.press/evaluating-the-american-data-privacy-and-protection-act/?ref=thenexusofprivacy.net), Alan Butler and Caitriona Fitzgerald of EPIC Privacy ### No protection for employee data – also a problem in ADPPA, and getting worse > Currently, employers can obtain all kinds of personal information about their workers and even job applicants, including things like using a pregnancy tracking app, where you go to worship or if you attend a political protest. Proposition 24 allows employers to continue secretly gathering this information for more years to come, overriding a new law that lets workers know what sensitive private information their bosses have beginning January 1, 2021. > > – from the [ballot argument against Prop 24](https://consumercal.org/wp-content/uploads/2020/07/No-on-Proposition-24-ballot-argument-for-CFC-website.pdf?ref=thenexusofprivacy.net) Employers collect all kinds of data about job applicants and employees from a myriad of places: job applications, background checks, HR and benefits forms, social media. The original CCPA, passed in 2018, covered employee data. Businesses pushed back, and in 2019 the California legislature passed a bill which largely exempted employers for a year. Prop 24 pushed the deadline back a couple more years. In ADDPA, by contrast: > You might have also noticed from the definition above that the bill explicitly doesn’t apply to “employee data....” The bill also notes that the term “employee” can be defined as “ employee, director, officer, staff member, trainee, volunteer, or intern of an employer,” regardless of whether they’re unpaid or a temp worker. It’s not just “employees” that are being targeted here, but volunteers and interns, too. > > \- Shoshana Wodinsky, in [Close the Loopholes in the American Data Privacy & Protection Act](https://gizmodo.com/american-data-privacy-and-protection-act-improvements-1849022612?ref=thenexusofprivacy.net) on Gizmodo > The definition of "employee data", which is exempt from ADPPA, has been broadened to include "information processed by an employer relating to an employee who is acting in a professional capacity for the employer, provided that such information is collected, processed, or transferred solely for purposes related to such employee’s professional activities on behalf of the employer." (Sec. 2(8)(C)(ii)) > > \- me, in [But What About the Elephant?](https://thenexusofprivacy.net/what-about-the-elephant/) on ADPPA's latest draft ### Global opt-out – a major loophole in ADPPA > You can set web browsers and cell phones to send a signal to each website you visit and app you use to stop selling your personal data, so you don’t have to think about it each time. Proposition 24 would allow companies to disregard those instructions and shift the burden to you to notify each and every website and app individually to protect your data. > > – from the [ballot argument against Prop 24](https://consumercal.org/wp-content/uploads/2020/07/No-on-Proposition-24-ballot-argument-for-CFC-website.pdf?ref=thenexusofprivacy.net) This is another area where, despite concerns about the Prop 24's language, California's rulemaking has led to an approach that seems fairly workable ... but ADPPA takes a step backwards. > So here is where federal bill (ADPPA) will have a massive fail if not fixed. The latest amended bill suddenly has new language allowing a company to require an authentication process before honoring the global opt-out signal.... If this specific language becomes law - then consumers who turn on GPC (global opt-out) - will have to authenticate each and every site/app in order to visit. More likely they'll just turn it off and lobby will then argue to FTC users don't want it. Poof go your new rights. > > \- [Jason Kint on Twitter](https://twitter.com/jason%5Fkint/status/1552419839284764673?ref=thenexusofprivacy.net), also citing [the CPPA bill analysi](https://cppa.ca.gov/meetings/materials/20220728%5Fitem2%5Fcppa%5Fstaff%5Fmemo%5Fhr8152.pdf?ref=thenexusofprivacy.net)s ### Restricting people from enforcing their privacy rights in court – also a problem in ADPPA > Proposition 24 restricts Californians from enforcing your own privacy rights in court. > > – from the [ballot rebuttal argument](https://consumercal.org/wp-content/uploads/2020/07/No-on-Proposition-24-Rebuttal-Argument.pdf?ref=thenexusofprivacy.net) > Although the ADPPA does contain a private right of action, with the possibility of pursuing monetary damages as well as injunctive relief, that right of action is otherwise deficient in a wide range of respects. These deficiencies are significant enough that the private right of action is unlikely to serve either as an effective vehicle for rights enforcement or as a motivator to comply with the law in order to avoid the risk of liability. > > \- [ACLU July 18 letter on ADPPA](https://www.aclu.org/letter/aclu-letter-house-energy-and-commerce-committee-american-data-privacy-protection-act?ref=thenexusofprivacy.net) > \[T\]he American Data Privacy and Protection Act “makes it harder for women to seek redress when their sensitive health data has been used against them” and would force women to “jump through arbitrary, drawn-out hoops” to sue over privacy violations. > > \- Senate Commerce committe staffers, quoted in Cristiano Lima's [Abortion ruling could scramble data privacy talks](https://www.washingtonpost.com/politics/2022/06/27/abortion-ruling-could-scramble-data-privacy-talks/?ref=thenexusofprivacy.net), June 27 > \[A\]lthough a covered entity or service provider may have technically violated a provision of the ADPPA, plaintiffs may be unable to bring a claim in federal court absent a showing of concrete injury. Proving damages for privacy violations has often proved difficult for plaintiffs. Given that the ADPPA limits cases to federal (and not state) courts, this limitation could be determinative in many lawsuits. > > \- [Analyzing the American Data Privacy and Protection Act’s Private Right of Action](https://bytebacklaw.com/2022/08/analyzing-the-american-data-privacy-and-protection-acts-private-right-of-action?ref=thenexusofprivacy.net), Shelby Dolen and David Stauss > Forced arbitration is no longer enforceable on claims related to gender or partner-based violence or physical harm (Sec. 403(b)). However, companies can still impose forced arbitration on adults in all other cases. During the markup, Rep. Donald McEachin of Virginia said that the bill as currently written wouldn't have his support on the floor because of forced arbitration, and Senate Commerce Chair Maria Cantwell has flagged this as an issue that needs to be fixed. > > \- me, in [But What About the Elephant?](https://thenexusofprivacy.net/what-about-the-elephant/) on ADPPA's latest draft > • §403(b) only prevents pre-dispute arbitration agreements for minors (who cannot legally enter contracts in any event, so this is just gratuitous), or gender or partner-based violence/physical harm > > • 1798.192 prevents forced arbitration clauses for any rights contained in CPRA > > [Californians for Consumer Privacy Announce Opposition to ADPPA](https://www.caprivacy.org/californians-for-consumer-privacy-announce-opposition-to-adppa/?ref=thenexusofprivacy.net) ### Privacy Loopholes – also a problem with ADPPA > Prop 24 introduces numerous other exceptions and loopholes that will further weaken privacy protections for Californians. > > \- ACLU of Northern California's [Californians Should Vote No on Prop 24](https://www.aclunc.org/blog/californians-should-vote-no-prop-24?ref=thenexusofprivacy.net) The post lists several example loopholes – some of which are addressed in the ADPPA, some of which aren't. For example, ACLU discusses how CPRA allows police to tell companies not to delete data; ADPPA similarly says companies have to ignore deletion requests if they "reasonably" believe the request was to "support criminal activity." ADPPA actually has an even bigger loophole here: companies are allowed to ignore deletion requests that interfere with "investigations" as well as "reasonable efforts" to guard against, detect, prevent, or investigate fraudulent, malicious, or unlawful activity. And ADPPA's got plenty of loopholes that weren't on the ACLU of Northern California's shortlist of Prop. 24 problems. > “The bill before us has a major loophole that could allow law enforcement to access private data to go after women. For example, under this bill, a sinister prosecutor in a state that criminalizes abortion could use against women their intimate data from search histories or from reproductive health apps. That loophole must be addressed.” > > Rep. Anna Eshoo, D-California, quoted in [Federal privacy legislation progresses, but concerns about data brokers loom](https://cyberscoop.com/privacy-data-brokers-house-ftc-commerce?ref=thenexusofprivacy.net) [Teen’s jailing shows exactly how Facebook will help anti-abortion states](https://arstechnica.com/tech-policy/2022/08/teens-jailing-shows-exactly-how-facebook-will-help-anti-abortion-states/?ref=thenexusofprivacy.net), [Anti-Abortion Centers’ Databases Could Be Weaponized Post-Roe](https://time.com/6189528/anti-abortion-pregnancy-centers-collect-data-investigation/?ref=thenexusofprivacy.net) and [Teen’s jailing shows exactly how Facebook will help anti-abortion states](https://arstechnica.com/tech-policy/2022/08/teens-jailing-shows-exactly-how-facebook-will-help-anti-abortion-states/?ref=thenexusofprivacy.net) highlight the stakes of loopholes like this. > “\[T\]his loophole could allow data brokers to sell location data to the government about visits to reproductive health facilities, for example, or other private information that is trivially easy to connect to individuals. \[Senator Ron Wyden (D-Oregon) strongly believes this must be fixed before any legislation becomes law." > > \- a Wyden aide quoted in [Federal privacy legislation progresses, but concerns about data brokers loom](https://cyberscoop.com/privacy-data-brokers-house-ftc-commerce?ref=thenexusofprivacy.net) > \[T\]he ADPPA includes a substantial loophole that my office opposed in state legislation. Section 209 includes the following exemption: “A covered entity may collect, process, or transfer covered data for any of the following purposes . . . \[to\] conduct internal research or analytics to improve products and services.” This broad exemption directly conflicts with the ADPPA’s data minimization language and may be used by technology companies to maintain all data indefinitely. > > \- Washington Attorney General Bob Ferguson, in [a June 24 letter](https://www.documentcloud.org/documents/22111995-ferguson-privacy-letter-to-4-corners%5F6-24-2022?ref=thenexusofprivacy.net) > We are also concerned about newly accepted amendments to the bill that address data flows between companies such as [Clearview AI](https://www.eff.org/deeplinks/2022/02/victory-another-lawsuit-proceeds-against-clearviews-face-surveillance?ref=thenexusofprivacy.net) or [ID.me](https://www.eff.org/deeplinks/2022/02/victory-irs-wont-require-facial-recognition-idme?ref=thenexusofprivacy.net) and the government. Specifically, the bill may treat these companies as “service providers”—defined in the ADPPA as companies that collect or process information for government entities—and gives these companies much more leeway than it should. > > \- EFF, in [Americans Deserve More Than The Current American Data Privacy Protection Act](https://www.eff.org/deeplinks/2022/07/americans-deserve-more-current-american-data-privacy-protection-act?ref=thenexusofprivacy.net) ### Applies outside of California – addressed in the ADPPA, although many protections are lower both outside and inside California > Under California law, your privacy rights follow you wherever you go. But with Proposition 24, the minute you travel out of state with a phone, wearable device, or computer, big tech companies are allowed to capture the health, financial, and other confidential information you stored on your device. > > – from the [ballot argument against Prop 24](https://consumercal.org/wp-content/uploads/2020/07/No-on-Proposition-24-ballot-argument-for-CFC-website.pdf?ref=thenexusofprivacy.net) ADPPA applies to the whole country, so clearly addresses this. However, as [Californians for Consumer Privacy's side by-side](https://www.caprivacy.org/analysis-shows-cpra-is-significantly-stronger-than-adppa/?ref=thenexusofprivacy.net) highights (and some of the earlier discussion here reinforces), in many ways ADPPA's protections are lower than CPRA's. So Californians are being asked to give up some important protections (and not be able to get them back) in exchange for not letting anybody else getting those protections. You can certainly see why they wouldn't like that trade. ## One out of six ain't good So of the six areas these groups highlighted, only one is addressed in ADPPA – and in a couple, ADPPA is arguably *worse* than California's a existing law. Combine this with the critiques in [Californians for Consumer Privacy Announce Opposition to ADPPA](https://www.caprivacy.org/californians-for-consumer-privacy-announce-opposition-to-adppa/?ref=thenexusofprivacy.net) and it's clear that there are a lot of ways ADPPA falls short. Of course, there's no question that ADPPA also has areas where it improves on California's privacy law. Explicitly including civil rights protections with anti-discrimination language that includes disparate impact (as well as intentional discrimination) is a very big deal. ADPPA also incorporates some important new ideas, such as a duty of loyalty. Californians for Consumer Privacy analysis also highlights several areas where ADPPA improves on CPRA. These all point to improvements that might well be helpful in California – and other states as well, since privacy laws in Virginia and Utah are much weaker than California's. Then again, the analysis here also points to a lot of ways ADPPA falls short. And these aren't the only areas of ADPPA that need work – there's also the unnecessary interference with state Attorney General enforcement ability,\*\*\* [stripping FTC oversight of telecom data abuse](https://www.cyberscoop.com/adppa-fcc-privacy-ftc-congress-telecom/?ref=thenexusofprivacy.net), potential [threats to unhoused people](https://thenexusofprivacy.net/is-there-an-elephant-in-the-zoom-room/#does-adppa-protect-unhoused-people), and more. Butler and Fitzgerald point to the possibilities of amendments to ADPPA to address some of its weaknesses. At least so far, the trend isn't encouraging. [Microsoft, IBM and the Business Software Alliance have been big winners](https://protocol.com/newsletters/policy/cloud-enterprise-privacy?ref=thenexusofprivacy.net). Many of [the changes in the most recent version of ADPPA](https://thenexusofprivacy.net/what-about-the-elephant/#changes-since-the-subcommittee-version) actually weakened its protections. Still, if Congress decides they really *do* want to protect people's privacy, they've got a good roadmap for improvements to ADPPA. As it is right now, though, comparing ADPPA to California's privacy law just highlights how much improvement is still needed. --- *Image credit:* JessicaRodriguezRivas, via [Wikipedia Commons](https://commons.wikimedia.org/wiki/File:Home%5Fof%5Fthe%5FUS%5FCongress.jpg?ref=thenexusofprivacy.net). licensed under the [Creative Commons](https://en.wikipedia.org/wiki/en:Creative%5FCommons?ref=thenexusofprivacy.net)[Attribution-Share Alike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net) license. \* Although the previous version of the side-by-side (linked from a Washington Post article) claimed that ADPPA was stronger in some additional ways that turned out to be inaccurate, so this one may still be overstating the case. **UPDATE:** Californians for Consumer Privacy's comparison makes it ADPPA 3, CPRA 22 (or something like that). So even if the truth is somewhere in between, EPIC's spreadsheet was indeed still overstating the case. \*\* Gilad Edelman's [The Fight Over the Fight Over California’s Privacy Future](https://www.wired.com/story/california-prop-24-fight-over-privacy-future/?ref=thenexusofprivacy.net) on *Wired* has some of the fascinating backstory. \*\*\* Specifically, ADPPA 404(c)'s language: “a violation of this Act shall not be pleaded as an element of any such cause of action." As the AG's letter says: > In many states, the Attorney General’s office uses civil investigative demands under its consumer protection authority to demand documents or information from entities when we believe there could have been a violation of a law. Ordinarily, a violation of a federal law or standard could also be a violation of state consumer protection law. But Section 404 would act as a bar to investigate violations of the federal law, because it prohibits them from forming the basis for state consumer protection claims. This language unnecessarily interferes with robust enforcement capabilities. The 2020 version of the Bad Washington Privacy Act had a similar problem, and Attorney General Ferguson said it made the bill "unenforceable." Meanwhile, Microsoft it as "raising the bar on privacy in the United States" because of its "strong enforcement." Good times! ### Privacy News August 9: StopShotspotter Week of Action and more URL: https://thenexusofprivacy.net/privacy-news-august-9/ Last updated: 2026-04-16T02:36:59.000Z ### [Tell ShotSpotter: Stop selling surveillance](https://act.newmode.net/action/mpower-change/tell-shotspotter-stop-selling-surveillance?ref=thenexusofprivacy.net) MPower Change on New Mode (act.newmode.net) Yesterday, the [Stop Shotspotter coalition](https://stopshotspotter.com/?ref=thenexusofprivacy.net) kicked off a National Week of Action against ShotSpotter, an audio surveillance company that is deployed in Black, Brown, and poor neighborhoods around the country and targets them for more policing. > ShotSpotter technology regularly sends police, falsely expecting to find gunshots, into the Black, brown, and poor communities where your microphones are embedded.Instead of preventing gun violence, ShotSpotter tech profits from it.... > > ShotSpotter makes everyone in our communities less safe by increasing the number of heightened and harmful interactions with police. Majority Black, brown, and poor communities are already impacted by racist violence by police, and ShotSpotter technology helps further it.... > > Independent research has found that police deployments in response to ShotSpotter alerts fail to result in any evidence of a gun crime about 90% of the time. But we know that ShotSpotter has never released any detailed data or peer-reviewed analyses of its technology’s benefits. TAKE ACTION: [Sign the petition](https://act.newmode.net/action/mpower-change/tell-shotspotter-stop-selling-surveillance/?ref=thenexusofprivacy.net)! FIND OUT MORE: On **Thursday, August 11th at 4:30 pm Pacific (7:30 pm Eastern)**, [**The People’s Earnings Call**](https://us06web.zoom.us/meeting/register/tZEucOqgrz0jEtHpuZHKYOlewvutahAfPIpD?ref=thenexusofprivacy.net), with organizers from campaigns across the country, to talk about how ShotSpotter business financially impacts our communities. ### [Amazon bought the company that makes the Roomba. Antitrust researchers and data-privacy experts say it’s ‘the most dangerous, threatening acquisition in the company’s history’](https://www.businessinsider.com/amazon-roomba-vacuums-most-dangerous-threatening-acquisition-in-company-history-2022-8?ref=thenexusofprivacy.net) Katherine Tangalakis-Lippert on Insider (businessinsider.com) Yeah really. Great headline! Khari Johnson's [Amazon’s iRobot Deal Would Give It Maps Inside Millions of Homes](https://wired.com/story/amazon-irobot-roomba-acquisition-data-privacy?ref=thenexusofprivacy.net) gives the context: > Combined with other recent acquisition targets, Amazon could wind up with a comprehensive look at what’s happening inside people’s homes. The ecommerce giant acquired video doorbell company [Ring in 2018](https://www.wired.com/story/cops-offering-ring-doorbell-cameras-for-information/?ref=thenexusofprivacy.net) and Wi-Fi router-maker [Eero a year later](https://www.wired.com/story/amazon-eero-says-it-wont-snoop/?ref=thenexusofprivacy.net). Speakers and other devices with AI assistant [Alexa](https://www.wired.com/tag/alexa/?ref=thenexusofprivacy.net) can now control thousands of smart home devices, including Roomba vacuums. And Amazon plans to acquire primary care chain One Medical in a $3.49 billion all-cash deal, which if approved would put the health data of millions in its keeping. > > “People tend to think of Amazon as an online seller company, but really Amazon is a surveillance company. That is the core of its business model, and that’s what drives its monopoly power and profit,” says Evan Greer, director of the nonprofit digital rights organization Fight for the Future. “Amazon wants to have its hands everywhere, and acquiring a company that’s essentially built on mapping the inside of people’s homes seems like a natural extension of the surveillance reach that Amazon already has.” **MORE COVERAGE:** - [Amazon finally found a way inside of your home with iRobot](https://www.theverge.com/23293687/amazon-irobot-acquisition-purchase-smarthome-intelligence-privacy-analysis?ref=thenexusofprivacy.net), Jennifer Pattison Tuohy, The Verge (theverge.com) - [Amazon’s Roomba Acquisition Seems Really Not Great!](https://www.themarysue.com/amazons-roomba-acquisition-digital-maps/?ref=thenexusofprivacy.net), Vivian Kane, The Mary Sue (themarysue.com) - [Amazon’s $1.7 billion purchase of Roomba maker iRobot sparks privacy fears: ‘Homes were your last data sanctuary’](https://marketwatch.com/story/amazons-1-7-billion-purchase-of-roomba-maker-irobot-sparks-privacy-fears-homes-were-your-last-data-sanctuary-11659715276?ref=thenexusofprivacy.net) James Rogers on MarketWatch (marketwatch.com) - [Amazon’s Roomba Deal Is Really About Mapping Your Home](https://www.bloomberg.com/news/articles/2022-08-05/amazon-s-irobot-deal-is-about-roomba-s-data-collection?ref=thenexusofprivacy.net), Alex Webb, Bloomberg Businessweek (bloomberg.com) - [Amazon to Buy Maker of the Roomba for $1.7 Billion](https://www.nytimes.com/2022/08/05/business/amazon-roomba-irobot.html?ref=thenexusofprivacy.net), Remy Tumin, New York Times (nytimes.com) - [iRobot and Its Roombas Could Give Amazon a Window Into Your Home](https://www.pcmag.com/opinions/irobot-and-its-roombas-could-give-amazon-a-window-into-your-home?ref=thenexusofprivacy.net), Max Eddy, PC Magazine (pcmag.com) ## Privacy after Roe ### [Nebraska Cops Subpoenaed A Teen’s Facebook DMs So They Could Prosecute Her For Having An Abortion](https://forbes.com/sites/emilybaker-white/2022/08/08/nebraska-cops-supoenaed-a-teens-facebook-dms-so-they-could-prosecute-her-for-having-an-abortion?ref=thenexusofprivacy.net) Emily Baker-White and Sara Emerson on Forbes (forbes.com) A Nebraska teenager is facing criminal charges alleging she aborted a fetus in violation of state law, after authorities obtained her Facebook messages using a search warrant. As Peter Salter reports in [Norfolk mother and daughter accused of illegal abortion, burning and burying body](https://journalstar.com/news/state-and-regional/nebraska/norfolk-mother-and-daughter-accused-of-illegal-abortion-burning-and-burying-body/article%5Fff99fd49-a710-5ec3-8d51-5aced3001c71.html?ref=thenexusofprivacy.net) in the *Lincoln Journal-Star*, the teen and her mother were originally charged with removing, concealing or abandoning a dead human body. After that, though, the detective served a search warrant on Facebook and got access to messages between the two of them allegedly describing her plans for a self-managed abortion. Companies generally have to comply with valid warrants if they are able to. But as Surveillance Technology Oversight Project (STOP) points out in [S.T.O.P. Condemns Meta For Helping Nebraska Prosecute Teen For Abortion](https://www.stopspying.org/latest-news/2022/8/9/stop-condemns-meta-for-helping-nebraska-prosecute-teen-for-abortion?ref=thenexusofprivacy.net), Facebook's made a technology choice here that makes it easy for them to provid this information: > “Facebook’s failure to encrypt users’ data is indefensible,” said Surveillance Technology Oversight Project Executive Director Albert Fox Cahn. “Meta touts its privacy, but it still hasn’t done what’s needed to protect Facebook Messenger or WhatsApp. Facebook could have stopped this warrant if they simply encrypted the data. And Facebook and other companies should be fighting these warrants in court. In post-Roe America, this sort of privacy malpractice is criminal.” ### ALSO: [Phones Know Who Went to an Abortion Clinic. Whom Will They Tell?](https://wsj.com/articles/phones-know-who-went-to-an-abortion-clinic-whom-will-they-tell-11659873781?ref=thenexusofprivacy.net), Patience Haggin on WSJ (wsj.com) ## Federal Privacy Legislation > FIND OUT MORE: Wednesday at 11:00 am Pacific time (2:00 pm Eastern) Prof Daniel Solove leads an all-star set of speakers to discuss the American Data Privacy and Protection Act (ADPPA). [Register here!](https://teachprivacy.com/webinar-federal-comprehensive-privacy-law?ref=thenexusofprivacy.net) ## [Evaluating the American Data Privacy and Protection Act](https://techpolicy.press/evaluating-the-american-data-privacy-and-protection-act?ref=thenexusofprivacy.net) Alan Butler and Caitriona Fitzgerald on Tech Policy Press (techpolicy.press) EPIC Privacy's Executive Director and Deputy Director make the case for preventing states from passing strong consumer privacy protections. > Many privacy and consumer protection organizations, including EPIC, have advocated for decades that Congress should enact comprehensive privacy legislation that sets a federal “floor” and allows the states to go further without restriction. However, no such bill has passed or even advanced to a committee vote in either chamber in more than two decades.... The ADPPA is the first privacy bill in twenty years to garner broad bipartisan support and have a real chance at becoming law. That is due, in part, to a key compromise struck in the bill: it includes a private right of action with certain restrictions, as well as a ceiling preemption provision with certain carveouts. Note that others have used stronger language to describe the restrictions on the private right of action. ACLU, for example calls the private right of action "deficient in a wide range of respects," and concludes "the private right of action is unlikely to serve either as an effective vehicle for rights enforcement or as a motivator to comply with the law in order to avoid the risk of liability." Senate Commerce Committee staffers say the bill “makes it harder for women to seek redress when their sensitive health data has been used against them” and would force women to “jump through arbitrary, drawn-out hoops” to sue over privacy violations. So opinions differ on how good this "compromise" is for consumers. [Analyzing the American Data Privacy and Protection Act’s Private Right of Action](https://bytebacklaw.com/2022/08/analyzing-the-american-data-privacy-and-protection-acts-private-right-of-action?ref=thenexusofprivacy.net), by Shelby Dolen and David Stauss on Byte Back, goes into a lot more detail on the private right of action. Butler and Fitzgerald also compare ADPPA to the Californa Consumer Privacy Act: > We believe that the ADPPA is stronger in several key areas then California’s CCPA, that it would provide roughly equivalent protections in most circumstances, and that the few areas where the CCPA is stronger could be addressed through minor amendments to the ADPPA. Crucially, the ADPPA would also extend privacy protections to more than 330 million people living in the U.S., whereas the CCPA only directly protects California’s 39 million residents. Of course as [Omer Tene pointed out on Twitter](https://twitter.com/omertene/status/1552317950429986929?ref=thenexusofprivacy.net), groups like ACLU and Color of Change criticized California's privacy law as not going far enough to protect the interests of maraginlized groups – and many immigrant rights organizations criticized it as well. So "roughly equivalent" is not actually high praise. I'll have more to say about comparisons between ADPPA and California's privacy law in an upcoming post. ### ALSO: - [San Diego City Council Supports Rep. Jacobs ‘My Body, My Data’ Act to Protect Reproductive Health Data](https://timesofsandiego.com/politics/2022/08/02/city-council-supports-rep-jacobs-my-body-my-data-act-to-protect-reproductive-health-data/?ref=thenexusofprivacy.net), Elizabeth Ireland on Times of San Diego (timesofsandiego.com) - [What Microsoft, IBM and others won as the privacy bill evolved](https://protocol.com/newsletters/policy/cloud-enterprise-privacy?ref=thenexusofprivacy.net), Ben Brody, Hirsh Chitkara on Protocol (protocol.com) - [Corporate lobbying could imperil sweeping data privacy bill](https://thehill.com/business-a-lobbying/3585322-corporate-lobbying-could-imperil-sweeping-data-privacy-bill?ref=thenexusofprivacy.net), Karl Evers-Hillstrom on The Hill (thehill.com) ## And ... [The Radical Scope of Tesla’s Data Horde](https://spectrum.ieee.org/tesla-autopilot-data-scope?ref=thenexusofprivacy.net), Mark Harris on IEEE Spectrum (spectrum.ieee.org) [Facial recognition smartwatches to be used to monitor foreign offenders in UK](https://theguardian.com/politics/2022/aug/05/facial-recognition-smartwatches-to-be-used-to-monitor-foreign-offenders-in-uk?ref=thenexusofprivacy.net), Nicola Kelly on The Guardian (theguardian.com) [226 complaints lodged against deceptive cookie banners](https://noyb.eu/en/226-complaints-lodged-against-deceptive-cookie-banners?ref=thenexusofprivacy.net), on noyb.eu (noyb.eu) [What Are Privacy Coins and Are They Legal?](https://coindesk.com/learn/what-are-privacy-coins-and-are-they-legal?ref=thenexusofprivacy.net), Robert Stevens on CoinDesk (coindesk.com) [Hold-outs targeted in batch of EU cookie consent complaints](https://techcrunch.com/2022/08/08/noyb-gdpr-cookie-consent-complaints?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com) [Will Europe Force a Facebook Blackout?](https://wired.co.uk/article/facebook-eu-us-data-transfers?ref=thenexusofprivacy.net), on WIRED UK (wired.co.uk) [Are You Ready for 2023? New Privacy Laws To Take Effect Next Year](https://jdsupra.com/legalnews/are-you-ready-for-2023-new-privacy-laws-8051507?ref=thenexusofprivacy.net), Christine Chong on JD Supra (jdsupra.com) [Our complaints against Acxiom, Criteo, Equifax, Experian, Oracle, Quantcast, Tapad](https://privacyinternational.org/advocacy/2426/our-complaints-against-acxiom-criteo-equifax-experian-oracle-quantcast-tapad?ref=thenexusofprivacy.net), on Privacy International (privacyinternational.org) [San Diego Citizens Wrest Control of Surveillance Tech Away From Police](https://gizmodo.com/san-diego-citizens-wrest-control-of-surveillance-tech-a-1849378881?ref=thenexusofprivacy.net) Dell Cameron on Gizmodo (gizmodo.com) [Student privacy laws remain the same, but children are now the product](https://thehill.com/opinion/cybersecurity/3586011-student-privacy-laws-remain-the-same-but-children-are-now-the-product?ref=thenexusofprivacy.net), Joel Schwarz and Emily Cherkin, on The Hill (thehill.com) [From America to Zimbabwe: 3 global data privacy trends to be aware of right now](https://thedrum.com/news/2022/08/03/america-zimbabwe-3-global-data-privacy-trends-be-aware-right-now?ref=thenexusofprivacy.net), Kendra Clark on The Drum (thedrum.com) [The UK Online Safety Bill Attacks Free Speech and Encryption](https://eff.org/deeplinks/2022/08/uks-online-safety-bill-attacks-free-speech-and-encryption?ref=thenexusofprivacy.net), Joe Mullin on Electronic Frontier Foundation (eff.org) [Centre targeting early 2023 approval for new privacy bill](https://deccanherald.com/national/centre-targeting-early-2023-approval-for-new-privacy-bill-1132823.html?ref=thenexusofprivacy.net) ,Reuters, on DH News Service (deccanherald.com) [Data Protection Bill wasn’t perfect but new one shouldn’t be opaque](https://timesofindia.indiatimes.com/blogs/voices/data-protection-bill-wasnt-perfect-but-new-one-shouldnt-be-opaque?ref=thenexusofprivacy.net), Raman Jit Singh Chima and Namrata Maheshwari on Times of India (timesofindia.indiatimes.com) [India cannot afford to lack a robust data protection law for too long](https://indiatoday.in/news-analysis/story/india-cannot-afford-to-lack-robust-data-protection-law-for-too-long-1984854-2022-08-07?ref=thenexusofprivacy.net), Saikiran Kannan on India Today (indiatoday.in) --- *Image credit: Stop Shotspotter social media toolkit.* ### The opportunity and the elephant: Federal Privacy Legislation Update, August 8 URL: https://thenexusofprivacy.net/the-opportunity-and-the-elephant/ Last updated: 2026-04-15T22:57:48.000Z Even before June's Supreme Court decision ending Roe, Congress was under a lot of pressure to act on privacy – a recent poll says 80% of Americans want them to act, thanks to a steady stream of reporting on data abuse by government agencies, ed tech companies exploiting kids personal data, sleazy surveillance-industrial companies like Clearview AI and ID.me, Facebook and its ilk. Now, criminalized abortion and vigilante bounty hunters highlight the stakes and put a spotlight on privacy risks. So it's a great opportunity to pass strong privacy protections. Can privacy, civil rights, and civil liberties organiations capitalize on it? It's certainly possible. The House and the Senate both made progress on privacy bills in the four short weeks between their July recess and August recess: - [The Fourth Amendment is Not For Sale Act had strong bipartisan support at its House Judiciary hearing](https://techpolicy.press/bipartisan-support-for-fourth-amendment-is-not-for-sale-act-at-house-judiciary-hearing/?ref=thenexusofprivacy.net). This bill prohibits data brokers from selling data to law enforcement and intelligence agencies without a court order. With Judiciary Chair Jerry Nadler, Ranking Member Jim Jordan, and former Chair Bob Goodlatte all strong supporters, hopefully they'll schedule it for a Judiciary Committee markup in September. - [The Children and Teens Online Privacy Protection Act (CTOPPA) got through the Senate Commerce Committee](https://iapp.org/news/a/us-senate-committee-advances-two-childrens-privacy-bills/?ref=thenexusofprivacy.net) on a party-line vote. This bill strengthens and updates COPPA, and even though they voted against it, several Republicans expressed a desire to keep working on it. However, Senate Commerce Ranking Member Roger Wicker wants Congress to focus on a broad consumer privacy bill that also has some privacy protections for children and teens. So CTOPPA's fate is bound up with ... - The American Protection and Privacy Act (ADPPA) consumer privacy bill, which the [the House Energy & Commerce (E&C) advanced 53-2](https://thenexusofprivacy.net/what-about-the-elephant/). It's the first time a consumer privacy bill has made it through committee this century, and ADPPA sets an important precedent by including civil rights protections prohibiting discrimination. However, it faces [daunting roadblocks](https://www.axios.com/2022/08/04/online-privacy-bill-roadblocks-congress?ref=thenexusofprivacy.net). For one thing, [California's Privacy Protection Agency opposes ADPPA in its current form](https://thenexusofprivacy.net/is-there-an-elephant-in-the-zoom-room/) because it preempts Californina's privacy law. Also, as I'll discuss later in the post, there's an elephant in the room. And even though they haven't gotten hearings yet, two other bills are still in the mix: - The Health and Location Data Protection Act (HLDPA), whose sponsors include Senators Elizabeth Warren and Patty Murray, also focuses on data brokers, prohibiting companies from selling health or location data – to government or anybody else. - The My Body, My Data Act, sponsored by Representative Sara Jacobs and Senators Wyden and Hirono, protects reproductive health data. Then again, industry lobbyists will try to take advantage of the situation to get weak legislation passed (so Congress can say they've done *something*) while blocking and weakening anything stronger. With midterms looming, and a lot of other important issues to deal, there's not a lot of legislating time left this year. So it's hard to know what will happen. The Fourth Amendment Is Not For Sale Act probably has the best chance to pass this session. [Dozens of consumer-advocacy, media-justice and privacy-rights groups](https://www.freepress.net/news/press-releases/groups-urge-congress-pass-fourth-amendment-is-not-for-sale-act?ref=thenexusofprivacy.net) (including the the Brennan Center for Justice, Surveillance Technology Oversight Project, Kairos Action, Demand Progress, Free Press Action, EFF, and ACLU) support it. However, DC-based privacy organizations EPIC Privacy, Future of Privacy Forum (FPF), and Center for Democracy and Technology (CDT) are putting most of their energy into ADPPA. ## The ADPPA and the Elephant Margaret Harding McGill's framing in [Online privacy bill faces daunting roadblocks](https://www.axios.com/2022/08/04/online-privacy-bill-roadblocks-congress?ref=thenexusofprivacy.net) (on *Axios*) reflects the conventional wisdom. She describes ADPPA as "still a long shot to become law." > That's thanks to lobbying by companies over details they don't like, disagreements over whether the law should pre-empt state rules, and tensions between the House and the Senate. Other recent media coverage explores some of these issues in more detail\*: - [What Microsoft, IBM and others won as the privacy bill evolved](https://www.protocol.com/newsletters/policy/cloud-enterprise-privacy?ref=thenexusofprivacy.net) (Ben Brody and Hirsh Chitraka on *Protocol*) - [Privacy bill strips FCC oversight of telecom data abuse, worrying consumer advocates](https://cyberscoop.com/adppa-fcc-privacy-ftc-congress-telecom?ref=thenexusofprivacy.net) (Tonya Riley on *CyberScoop*) - [Corporate lobbying could imperil sweeping data privacy bill](https://thehill.com/business-a-lobbying/3585322-corporate-lobbying-could-imperil-sweeping-data-privacy-bill/?ref=thenexusofprivacy.net) (Karl Evers-Hillstrom and Rebecca Klar on *The Hill*) - [Speaker Pelosi should bring the privacy bill to a vote](https://www.washingtonpost.com/opinions/2022/08/07/federal-privacy-legislation-deserves-vote/?ref=thenexusofprivacy.net) (Washington Post editorial Board) - [Evaluating the American Data Privacy and Protection Act](https://techpolicy.press/evaluating-the-american-data-privacy-and-protection-act/?ref=thenexusofprivacy.net) (Alan Butler and Caitriona Fitzgerald of EPIC Privacy on *Tech Politcy Press*) But y'know what none of these articles discuss? That's right, the elephant in the room. **Will ADPPA protect against post-Roe privacy threats to pregnant people and abortion providers?** [But what about the elephant?](https://thenexusofprivacy.net/what-about-the-elephant/) highlights the red flags that Sen. Ron Wyden, Rep. Anna Eshoo, Senate Commerce Committee staffers, gender-justice nonprofit Ultraviolet, and Seattle-based Legal Voice have raised about this. Kim Clark of Legal Voice, for example, [says](https://www.spokesman.com/stories/2022/jul/25/historic-data-privacy-law-could-be-within-reach-if/?ref=thenexusofprivacy.net) > **“This bill, at least from the perspective of pregnant people, it really doesn’t do much.”** To be fair, ADPPA's supporters don't see it that way.\*\* And it's not yet clear what reproductive justice advocates think of ADPPA's protections – as I mentioned in [How broad is the "consensus" that ADPPA provides "strong privacy protections"?](https://thenexusofprivacy.net/is-there-an-elephant-in-the-zoom-room/#how-broad-is-the-consensus-that-adppa-provides-strong-privacy-protections), we haven't heard much from their perspective. Maybe they're not concerned with leaving pregnant people's data accessible to law enforcement and vigilantes in states that criminalize abortion, or making it harder for pregnant people to sue when their sensitive health data has been used against them. More likely, though, they're just incredibly busy with other short-term priorities, so haven't had time to look at ADPPA in any detail yet. I can certainly see why ADPPA's supporters don't want to talk about the elephant. Right now, the media will keep focusing on the messaging from groups like Future of Privacy Forum [(whose funders include Microsoft, Amazon, Google, Verizon, and the Chan-Zuckerberg Initiative](https://fpf.org/about/supporters/?ref=thenexusofprivacy.net)) that the ADPPA has "strong privacy protections." By contrast, the more discussion of loopholes in ADPPA leaving pregnant people at risk, the more challenging it'll be for most Democrats to support the bill – and the more questions there will be about how effectively it protects others' data. ## Stay tuned There'll be a lot of behind-the-scenes discussions during recess. The Fourth Amdnement Is Not For Sale Act almost certainly has the votes ... but will leadership prioritize it? Will Democrats decide to focus on protecting pregnant people and abortion providers? And how much energy will DC-based privacy organizations put into supporting bills other than ADPPA? Meanwhile, ADPPA supporters will look for a way to get California on board, and industry will pushes to further weaken it. Perhaps there will be a "dramatic" "compromise" adding California's privacy bill to the already-long list of other exceptions to preemption – in return for some other concessions to industry, of course. That could be enough to get California representatives on board, increase pressure on Cantwell to drop her resistance to preemption, and give media a whole set of new stories to cover instead of talking about the elephant. If that doesn't seem likely to happen, then House Democrats could decide to focus on privacy bills that *do* protect pregnant people – moving forward with My Body My Data and Health and Location Data Privacy Act, or adding their language to the ADPPA. True, there would likely be resistance in the Senate. But with the November election coming up, and Democrats looking to translate anger at the loss of Roe into increased enthusiasm and turnout, this could be very smart politics. Even if nothing passes this year, we'll continue to see coverage of privacy abuses, and pressure will mount to do something. If Democrats add some seats in the Senate and hold the House, the opportunity for strong federal consumer and health privacy bills may be even better in 2023\. And states like California and Washington may well continue to move the ball forward as well – which is probably why industry-backed groups like FPF are so insistent about a preemptive federal bill is needed. Stay tuned! --- Image credit: Savanna elephant "Loxodonta africana" in Kruger National Park, South Africa, Felix Andrews, via Wikipedia, licensed under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net), \* Also worth reading, if you want to get into the nitty-gritty of the bill: Privacy scholar Prof. Daniel Solove's [A Faustian Bargain: Is Preemption Too High a Price for a Federal Privacy Law?](https://teachprivacy.com/a-faustian-bargain-is-preemption-too-high-a-price-for-a-federal-privacy-law/?ref=thenexusofprivacy.net) and [Further Thoughts on ADPPA, the Federal Comprehensive Privacy Bill](https://teachprivacy.com/further-thoughts-on-adppa-the-federal-comprehensive-privacy-bill/?ref=thenexusofprivacy.net); and [Analyzing the American Data Privacy and Protection Act’s Private Right of Action](https://bytebacklaw.com/2022/08/analyzing-the-american-data-privacy-and-protection-acts-private-right-of-action?ref=thenexusofprivacy.net), by Shelby Dolen and David Stauss on Byte Back. \*\* Cameron Kerry's[ How comprehensive privacy legislation can guard reproductive privacy](https://www.brookings.edu/blog/techtank/2022/07/07/how-comprehensive-privacy-legislation-can-guard-reproductive-privacy/?ref=thenexusofprivacy.net), for example, suggests that the ADPPA would "accomplish the essence" of stronger bills like My Body My Data and the Health and Location Data Privacy Act, and be a big step forwards towards protecting pregnant people's data. Of course, Kerry's article was written before the committee further weakened the bill. And he admits that ADPPA doesn't address the loophole Eshoo's identified, doesn't discuss the loophole Wyden has focused on, ignores issues like the absence of whistleblower protections that Ultraviolet has highlighted, and downplays the enforcement concerns that Sen. Maria Cantwell and Commerce Committee staffers have raised. ### Privacy News: August 3 URL: https://thenexusofprivacy.net/privacy-news-august-3/ Last updated: 2022-08-03T14:54:39.000Z ### [‘This Is a Massive Loophole:’ Activists Slam ICE for Using LexisNexis Data to Target Undocumented Immigrants](https://gizmodo.com/lexisnexis-ice-data-brokers-undocumented-immigrants-1849340046?ref=thenexusofprivacy.net) Mack DeGuerin on Gizmodo (gizmodo.com) A public hearing in Cook County Illinois explored the way [ICE buys data from data brokers like LexisNexis](https://gizmodo.com/lexisnexis-is-ices-latest-doxing-tool-report-1846608898?ref=thenexusofprivacy.net) that would normally be protected under local laws and uses it to target undocumented immigrants. > “This is a massive loophole in hard-fought sanctuary laws nationwide,” Mijente’s national organizer Cinthya Rodriguez said during the hearing. “We’ve seen time and again how government agencies, stymied by legislation or the constitution itself, attempt to obtain data through third parties like LexisNexis. We know ICE is doing it, we’ve shown this in our research. Now, we need answers about how it’s happening in Chicago....” > > One speaker, who self-identified as an immigrant, said she had viewed roughly 43 pages of data ICE had collected on her which she described as, “extremely disturbing.” That allegedly included the individuals’ past and present address, mortgage, and social security number, as well as the names of 27 different people living in that individual’s apartment building. **GET INVOLVED**: [Tell Congress to pass The Fourth Amendment Is Not For Sale Act](https://action.aclu.org/send-message/stop-governments-massive-privacy-invasion?ref=thenexusofprivacy.net), which would prohibit government agencies from purchasing data from data brokers, using [ACLU's handy web form](https://action.aclu.org/send-message/stop-governments-massive-privacy-invasion?ref=thenexusofprivacy.net). ### [Sadiq Khan issued with legal challenge after ‘terrifying’ number plate camera decision](https://news.sky.com/story/sadiq-khan-issued-with-legal-challenge-after-terrifying-number-plate-camera-decision-12664374?ref=thenexusofprivacy.net) Rowland Manthorpe on Sky (news.sky.com) London is jam-packed with Automated Number-Plate Recognition (ANPR) road cameras (known as Automated License Plate Readers, ALPRs, on this side of the pond). Now, the mayor of London has given the Metropolitan Police access to more data from more of these cameras around London – and activists are fighting back > "It's kind of terrifying," says London Assembly member Sian Berry, who along with privacy campaigners the Open Rights Group is bringing a legal challenge against the mayor's decision. **GET INVOLVED:** [STOP Sadiq Khan giving an Orwellian surveillance network to the Met](https://crowdjustice.com/case/stop-met-orwellian-surveillance?ref=thenexusofprivacy.net) via this crowdfunding campaign for Open Rights Group's the legal challenge against ANPRs ## Federal privacy legislation ### [Webinar - Federal Comprehensive Privacy Law](https://teachprivacy.com/webinar-federal-comprehensive-privacy-law?ref=thenexusofprivacy.net) on TeachPrivacy (teachprivacy.com) Next Wednesday at 11:00 am Pacific time (2:00 pm Eastern), Prof Daniel Solove leads an all-star set of speakers to discuss the American Data Privacy and Protection Act (ADPPA). Participants include Alan Butler of EPIC Privacy, Alistair Mactaggart of Californians for Consumer Privacy, Susan Hintze of Hintze Law (whose other co-founder is a Future of Privacy Forum Senior Fellow and former Microsoft Chief Privacy Officer), Omer Tene of Goodwin Procter, Jody Westby of Global Cyber Risk. Pass the popcorn! Solove's two posts on ADPPA – [A Faustian Bargain: Is Preemption Too High a Price for a Federal Privacy Law?](https://teachprivacy.com/a-faustian-bargain-is-preemption-too-high-a-price-for-a-federal-privacy-law/?ref=thenexusofprivacy.net) and [Further Thoughts on ADPPA, the Federal Comprehensive Privacy Bill](https://teachprivacy.com/further-thoughts-on-adppa-the-federal-comprehensive-privacy-bill/?ref=thenexusofprivacy.net) – are also excellent reading ### More on federal privacy legislation [Privacy bill strips FCC oversight of telecom data abuse, worrying consumer advocates](https://cyberscoop.com/adppa-fcc-privacy-ftc-congress-telecom?ref=thenexusofprivacy.net), Tonya Riley on CyberScoop (cyberscoop.com) [Analyzing the American Data Privacy and Protection Act’s Private Right of Action](https://bytebacklaw.com/2022/08/analyzing-the-american-data-privacy-and-protection-acts-private-right-of-action?ref=thenexusofprivacy.net), Shelby Dolen and David Stauss on Byte Back (bytebacklaw.com) [Federal data privacy bill could make life easier for marketers](https://martech.org/federal-data-privacy-bill-could-make-life-easier-for-marketers?ref=thenexusofprivacy.net) Constantine von Hoffman on MarTech (martech.org) [Federal Privacy Bill Shows Emerging Patterns in US Privacy Law](https://www.jdsupra.com/legalnews/federal-privacy-bill-shows-emerging-5686494/?ref=thenexusofprivacy.net), Alan Friedman, Austin Manes, and Steven Sparling, on JD Supra (jdsupra.com) ## Privacy After Roe ### [How It Feels When Bed Bath and Beyond Thinks You’re Pregnant](https://gizmodo.com/bed-bath-beyond-buy-buy-baby-pregnancy-data-1849356818?ref=thenexusofprivacy.net) Kyle Barr on Gizmodo (gizmodo.com) Barr and Shoshana Wodinsky's [These Companies Know You’re Pregnant—And They’re Not Keeping It Secret](https://gizmodo.com/data-brokers-selling-pregnancy-roe-v-wade-abortion-1849148426?ref=thenexusofprivacy.net) was the top story in our Monday privacy news. We weren't the only ones reading it. So did California-based UX designer Stephanie Lucas, and when she went to pick up her mail later that day ... > Shuffling through her letters, she found a literal example of what she had read about in the form of a mailer from Buy Buy Baby, a chain of stores owned by Bed Bath & Beyond that sells products for infants and young children. The kicker at the bottom of the email read “Welcome to Parenthood.” Yikes! ## And ... [Stop Shotspotter Teach-In,](https://mediajustice.zoom.us/meeting/register/tZAldOmgrDkuHdUbo5vWVMNvdFSOtzhB01yO?ref=thenexusofprivacy.net) hosted by organizers around the country [Meta sued for violating patient privacy with data tracking tool](https://theverge.com/2022/8/2/23288612/meta-hosptials-sued-patient-privacy-facebook-data-hipaa?ref=thenexusofprivacy.net), Nicole Wetsman on The Verge (theverge.com) – a followup to a story we first started covering in [Health care privacy and more ](https://thenexusofprivacy.net/three-health-care-privacy-stories/) in late June. [Meta, US hospitals sued for using healthcare data to target ads](https://bleepingcomputer.com/news/security/meta-us-hospitals-sued-for-using-healthcare-data-to-target-ads?ref=thenexusofprivacy.net), by Bill Toulas on BleepingComputer (bleepingcomputer.com), is another report on the same story. [USA: NYPD ordered to handover documents detailing surveillance of Black Lives Matter protests following lawsuit](https://amnesty.org/en/latest/news/2022/08/usa-nypd-black-lives-matter-protests-surveilliance?ref=thenexusofprivacy.net), on Amnesty International (amnesty.org) [Kids Are Back in Classrooms and Laptops Are Still Spying on Them](https://wired.com/story/student-monitoring-software-privacy-in-schools?ref=thenexusofprivacy.net), Pia Ceres on WIRED (wired.com) [Report – Hidden Harms: The Misleading Promise of Monitoring Students Online](https://cdt.org/insights/report-hidden-harms-the-misleading-promise-of-monitoring-students-online?ref=thenexusofprivacy.net), Elizabeth Laird, Hugh Grant-Chapman, Cody Venzke, Hannah Quay-de la Vallee on Center for Democracy and Technology (cdt.org) [Your camera, the police, and you](https://bostonglobe.com/2022/08/02/opinion/your-camera-police-you?ref=thenexusofprivacy.net), Albert Fox Cahn on The Boston Globe (bostonglobe.com) [Apple Accused Of Potential Consumer Data Misuse With Its ‘Buy Now, Pay Later’ Service](https://forbes.com/sites/ronshevlin/2022/07/27/cfpb-accuses-apple-of-misusing-consumer-data-with-its-buy-now-pay-later-service?ref=thenexusofprivacy.net), Ron Shevlin on Forbes (forbes.com) [Cell carrier privacy settings to change now](https://washingtonpost.com/technology/2022/08/01/cell-carrier-privacy-settings?ref=thenexusofprivacy.net), Tatum Hunter on The Washington Post (washingtonpost.com) [The Problems With the Levy / Robinson UK Paper on Protecting Children from Online Sexual Abuse](https://cdt.org/insights/the-problems-with-the-levy-robinson-uk-paper-on-protecting-children-from-online-sexual-abuse?ref=thenexusofprivacy.net), Mallory Knodel on Center for Democracy and Technology (cdt.org) [WhatsApp boss says no to AI filters policing encrypted chat](https://theregister.com/2022/08/02/encryption%5Fwhatsapp%5Fuk?ref=thenexusofprivacy.net), Jeff Burt on The Register (theregister.com) [Data ruling by Europe’s top court could force privacy reboot](https://techcrunch.com/2022/08/02/cjeu-sensitive-data-case?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com) [Why the future of APIs must include zero trust](https://venturebeat.com/2022/08/01/why-the-future-of-apis-must-include-zero-trust?ref=thenexusofprivacy.net), Louis Columbus on VentureBeat (venturebeat.com) [The seven habits of effective Privacy Impact Assessments](https://salingerprivacy.com.au/2022/08/02/how-to-make-pias-great-again?ref=thenexusofprivacy.net), on salingerprivacy.com.au [Bill C-27 and a human rights-based approach to data protection](http://teresascassa.ca/index.php?Itemid=80&id=361%3Abill-c-27-and-a-human-rights-based-approach-to-data-protection&option=com%5Fk2&view=item&ref=thenexusofprivacy.net), Teresa Scassa on teresascassa.ca [EU to Open San Francisco Office Focused on Tech Regulation](https://wsj.com/articles/eu-to-open-san-francisco-office-focused-on-tech-regulation-11659026182?ref=thenexusofprivacy.net), Catherine Stupp on The Wall Street Journal (wsj.com) [Google brings Street View back to India following 2016 ban](https://theregister.com/2022/07/28/google%5Fstreet%5Fview%5Freturns%5Findia?ref=thenexusofprivacy.net), Simon Sharwood on The Register (theregister.com) [Google Has Once Again Said that Even Though It Could Protect Your Privacy Online, It Won’t](https://inc.com/jason-aten/google-has-once-again-said-that-even-though-it-could-protect-your-privacy-online-it-wont.html?ref=thenexusofprivacy.net), Jason Aten on Inc. (inc.com) [Tim Hortons offer free coffee, donut to settle privacy claim](https://theregister.com/2022/07/30/in%5Fbrief%5Fsecurity?ref=thenexusofprivacy.net), Brandon Vigliarolo on The Register (theregister.com) [Privacy committee to study RCMP use of spyware tools](https://ctvnews.ca/politics/privacy-committee-to-study-rcmp-use-of-spyware-tools-1.6003077?ref=thenexusofprivacy.net), on CTV News (ctvnews.ca) [Meta must disclose India’s Human Rights Impact Assessment](https://accessnow.org/meta-india-human-rights-impact-assessment?ref=thenexusofprivacy.net), Leanna Garfield on Access Now (accessnow.org) [Police want travel card data to track suspicious rail passengers](https://thetimes.co.uk/article/56594248-1292-11ed-b7ce-9b24bf628db2?ref=thenexusofprivacy.net), Fiona Hamilton, Crime Editor on The Times (thetimes.co.uk) [New Report on Limits of “Consent” in Vietnam’s Data Protection Law](https://fpf.org/blog/new-report-on-limits-of-consent-in-vietnams-data-protection-law?ref=thenexusofprivacy.net), Future of Privacy Forum (fpf.org) [FPF Report: A Look into DPA Strategies in the African Continent](https://fpf.org/blog/fpf-report-a-look-into-dpa-strategies-in-the-african-continent?ref=thenexusofprivacy.net), Future of Privacy Forum (fpf.org) [No privacy breach in warrantless seizure of data recorder after car crash: Sask. Court of Appeal](https://canadianlawyermag.com/practice-areas/litigation/no-privacy-breach-in-warrantless-seizure-of-data-recorder-after-car-crash-sask-court-of-appeal/368692?ref=thenexusofprivacy.net), Jason Tan on Canadian Lawyer (canadianlawyermag.com) --- Image credit: News by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net), licensed under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net), via [Pix4free](https://pix4free.org/?ref=thenexusofprivacy.net) #### ### Privacy News: August 1 URL: https://thenexusofprivacy.net/privacy-news-august-1/ Last updated: 2022-08-01T20:42:49.000Z It's been a while since the last Privacy News, and there's a lot going on! ## Privacy After Roe ### [These Companies Know You’re Pregnant—And They’re Not Keeping It Secret](https://gizmodo.com/data-brokers-selling-pregnancy-roe-v-wade-abortion-1849148426?ref=thenexusofprivacy.net) Shoshana Wodinsky and Kyle Barr, The A.V. Club on Gizmodo (gizmodo.com) Gizmodo identified 32 different brokers across the U.S. selling access to the unique mobile IDs from some 2.9 billion profiles of people pegged as “actively pregnant” or “shopping for maternity products.” Hundreds of millions more profiles were labeled “interested in pregnancy” or “intending to become pregnant.” [Here sthe spreasheet with all thei info](https://docs.google.com/spreadsheets/d/10XtXHs4FFV6yzaIwHLGEMsUzclbtZHdNIfXcIfZnhl8/edit?usp=sharing&ref=thenexusofprivacy.net). Gizmodo was able to figure out the likel data sources for 19 of these brokers. For example: > Quotient didn’t make it clear in either of those cases where it was getting that purchasing data from, but Gizmodo’s investigation revealed that the company also owns the popular couponing site, [coupons.com](https://www.coupons.com/?ref=thenexusofprivacy.net). The site has offered coupons for products like [Plan B](https://offers.shopmium.com/mcr-us/n/plan-b-one-step?ref=thenexusofprivacy.net) in the past, though it does not currently. Gizmodo also found that Quotient had access to purchasing data from shoppers at Giant Eagle—a chain of small pharmacies in the Northeast and Midwest—via a [proprietary ad network](https://www.gianteagleadvantagemedia.com/?ref=thenexusofprivacy.net#pillars) the data broker operates. SEE ALSO: [Data brokers shrug off pressure to stop collecting info on pregnant people](https://www.politico.com/news/2022/08/01/data-information-pregnant-people-00048988?ref=thenexusofprivacy.net), by Alfred Ng on *Politico*, a very good complement to the Gizmodo article. ### [South Carolina bill outlaws websites that tell how to get an abortion](https://washingtonpost.com/technology/2022/07/22/south-carolina-bill-abortion-websites?ref=thenexusofprivacy.net) Cat Zakrzewski on The Washington Post (washingtonpost.com) A new bill in the South Carolina legislature, modeled after the National Right to Life Committee's model bill, would make it illegal to “aid, abet or conspire with someone” to obtain an abortion. > The bill aims to block more than abortion: Provisions would outlaw providing information over the internet or phone about how to obtain an abortion. It would also make it illegal to host a website or “\[provide\] an internet service” with information that is “reasonably likely to be used for an abortion” and directed at pregnant people in the state. > > Legal scholars say the proposal is likely a harbinger of other state measures, which may restrict communication and speech as they seek to curtail abortion. ## Federal Privacy Legislation ### [Further Thoughts on ADPPA, the Federal Comprehensive Privacy Bill](https://teachprivacy.com/further-thoughts-on-adppa-the-federal-comprehensive-privacy-bill?ref=thenexusofprivacy.net) Daniel Solove on TeachPrivacy (teachprivacy.com) Well-respected privacy scholar Daniel Solove follows up on his previous analogy that ADPPA's preemption is a [Faustian bargain](https://teachprivacy.com/a-faustian-bargain-is-preemption-too-high-a-price-for-a-federal-privacy-law/?ref=thenexusofprivacy.net), responding to comments by Omer Tene. He starts by clarifying that his "B+" grade for ADPPA was on a curve: > As I have [argued extensively in my scholarship](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=4024790&ref=thenexusofprivacy.net), I believe that existing privacy laws have some severe shortcomings and must be changed significantly to be up to the challenge of protecting privacy.... Many parts of privacy laws have pretty-sounding rhetoric but ultimately are not any deeper. Further, the ADPPA is being weakened as it winds its way through the federal legislative process, which has a knack for whittling away at the stronger elements of laws. He also highights an issue with ADPPA's private right of action I haven't seen others mention: > But if ADPPA preempts state privacy laws, then this forces people to use the private right of action in federal court, where people must deal with the dragon of standing. The U.S. Supreme Court has worked its typical mischief upon standing doctrine, altering it to shut out many valid cases involving clear violations of federal privacy statutes with causes of action. The Court has found ways to creatively interpret away statutory damages provisions (Doe v. Chao). And, more recently in its war against plaintiffs, the Court has allowed courts to throw out cases brought under private rights of action if courts don’t think that there’s a harm. Courts have struggled to recognize privacy harms. And he highlights another important problem with ADPPA's preemption: > There wasn’t as much momentum for a comprehensive privacy law prior to the California Consumer Privacy Act (CCPA). The CCPA was rushed through the California legislature in the summer of 2018 to stave off a referendum. The referendum had widespread popular support, and its existence drove the legislative agenda.... > > The CCPA’s first referendum was pulled because the CCPA was passed, but a subsequent referendum strengthened the law in 2020\. Although the CCPA after the amendments is still not where I’d like it to be, the referendum process is quite valuable. Of course, there are problems with the referendum process, but a virtue is that it gives the people a say in the legislative agenda. The California referendums sent a loud message: People were concerned about privacy and didn’t think existing laws were adequate. No longer could legislatures bury their heads in the sand. No longer could the tech industry and Big Data industry coast on legislative inaction.... Companies actually got off easy, because I think nearly anything would have passed in the referendums, and it was somewhat of a squandered opportunity. But nothing can stop more referendums in the future . . . . except for the ADPPA. The ADPPA could shut the door on this. [Omer Tene responds on LinkedIn](https://www.linkedin.com/posts/omer-tene-a86b363%5Ffurther-thoughts-on-adppa-the-federal-comprehensive-activity-6959769002692780032-EHPI?utm%5Fsource=linkedin%5Fshare&utm%5Fmedium=member%5Fdesktop%5Fweb). **ALSO**: - The California Privacy Protection Agency, in a special board meeting, voted unanimously to oppose the current version of ADPPA – or any federal privacy bill that preempts California's CPRA or interferes with CPPA's enforcement. Friday's newsletter went into detail on this with [Is there an elephant in the Zoom room? CPPA says no to ADPPA preempting California law](https://thenexusofprivacy.net/is-there-an-elephant-in-the-zoom-room/) - Julia Angwin of *The Markup* interviews Brookings' Cameron Kerry in [Federal Privacy Law Has Momentum, but There’s a Catch](https://themarkup.org/newsletter/hello-world/federal-privacy-law-has-momentum-but-theres-a-catch?ref=thenexusofprivacy.net) - Mike Swift looks in detail at the FTC enforcement aspects of ADPPA in [Federal privacy legislation would transform US FTC with new Bureau of Privacy](https://mlexmarketinsight.com/news-hub/editors-picks/area-of-expertise/data-privacy-and-security/federal-privacy-legislation-would-transform-us-ftc-with-new-bureau-of-privacy?ref=thenexusofprivacy.net) on LexisNexis' Mlex. ### [US Senate committee advances two children’s privacy bills](https://iapp.org/news/a/us-senate-committee-advances-two-childrens-privacy-bills/?ref=thenexusofprivacy.net) Alex LaCasse on IAPP's Privacy Advisor (iapp.com) The Senate Commerce Committee voted to advance the Chidren and Teens Online Privacy Protection Act (CTOPPA), which strengthens and updates COPPA, and the Kids Online Safety Act (KOSA), which requires technology companies to prevent harm to minors while mandating more transparency in their algorithms for users and researchers. [We've got more background ](https://twitter.com/NexusOfPrivacy/status/1552294901877841920?ref=thenexusofprivacy.net)in our live-tweet thread of the brief markup session – or if you prefer, [here's an "unrolled" version](https://threadreaderapp.com/thread/1552294901877841920.html?ref=thenexusofprivacy.net), via ThreadReaderApp, with all the tweets on a single page. ## And ... [Who Is Collecting Data from Your Car?](https://themarkup.org/the-breakdown/2022/07/27/who-is-collecting-data-from-your-car?ref=thenexusofprivacy.net), Jon Keegan and Alfred Ng, The Markup (themarkup.org) [Sweden to ban unregistered pre-paid mobile phones](https://www.thelocal.se/20220730/sweden-to-ban-unregistered-pre-paid-mobile-phones/?ref=thenexusofprivacy.net), The Local SE (thelocal.se) [A Cyberattack Illuminates the Shaky State of Student Privacy](https://nytimes.com/2022/07/31/business/student-privacy-illuminate-hack.html?ref=thenexusofprivacy.net), Natasha Singer, New York Times (nytimes.com) [Meta must disclose India’s Human Rights Impact Assessment](https://accessnow.org/meta-india-human-rights-impact-assessment?ref=thenexusofprivacy.net), Leanna Garfield on Access Now (accessnow.org) [India Delays Introduction of Data Protection Bill Before Parliament](https://natlawreview.com/article/india-delays-introduction-data-protection-bill-parliament?ref=thenexusofprivacy.net), Hunton Andrews Kurth’s Privacy and Cybersecurity on The National Law Review (natlawreview.com) [The DHS Bought a ‘Shocking Amount’ of Phone-Tracking Data](https://wired.com/story/dhs-surveillance-phone-tracking-data?ref=thenexusofprivacy.net), on WIRED (wired.com) [TROPT Ethical, Responsible & Privacy Tech Unconference 2022](https://hopin.com/events/tropt-ethical-responsible-privacy-tech-unconference-2022/registration?ref=thenexusofprivacy.net), September 28, on hopin.com [Intel, SpaceX, Philip Morris, and dozens of other US companies were in a leaked database of users for a Russian facial recognition company](https://www.businessinsider.com/intel-spacex-philip-morris-leaked-database-users-ntech-russian-facial-recognition-company-2022-7?ref=thenexusofprivacy.net), Caroline Haskins , Insider (businessinsider.com) [A Stanford Graduate Raises $2M To Plug Privacy Into The Right Web3 Socket](https://forbes.com/sites/frederickdaso/2022/07/27/a-stanford-graduate-raises-2m-to-plug-privacy-into-the-right-web3-socket?ref=thenexusofprivacy.net), Frederick Daso on Forbes (forbes.com) [Some popular children’s apps contain ‘risky’ code transmitting sensitive data, audit finds](https://abc.net.au/news/2022-07-21/the-risky-ways-popular-childrens-android-apps-collecting-data/101175256?ref=thenexusofprivacy.net) Leonie Thorne on ABC News (abc.net.au) [A Frozen Document in China Unleashes a Furor Over Privacy](https://wsj.com/articles/a-frozen-document-in-china-unleashes-a-furor-over-privacy-11657887259?ref=thenexusofprivacy.net), Wenxin Fan on WSJ (wsj.com) [ShotSpotter held in contempt of court](http://chicagoreader.com/news-politics/shotspotter-held-in-contempt-of-court/?ref=thenexusofprivacy.net), Matt Chapman and Jim Daley, Chicago Reader (chicagoreader.com) [California privacy rules target dark patterns through technology design](https://cybersecuritydive.com/news/california-cpra-privacy-rights/627744?ref=thenexusofprivacy.net), Robert Freedman on Cybersecurity Dive (cybersecuritydive.com) [UK and US seek out privacy-enhancing innovations](https://eandt.theiet.org/content/articles/2022/07/uk-and-us-launch-prize-challenges-to-develop-privacy-enhancing-innovations?ref=thenexusofprivacy.net), E&T editorial staff on E&T Magazine (eandt.theiet.org) [Indian women shunning Facebook due to safety, privacy concerns: Study](https://thehindubusinessline.com/info-tech/indian-women-ditching-facebook-due-to-safety-privacy-concerns-study/article65666502.ece?ref=thenexusofprivacy.net), Ayushi Kar on The Hindu BusinessLine (thehindubusinessline.com) [Conceptions of Privacy Shouldn’t Stand in the Way of Privacy Standing](https://lex.jotwell.com/conceptions-of-privacy-shouldnt-stand-in-the-way-of-privacy-standing?ref=thenexusofprivacy.net), Caprice Roberts on Lex (lex.jotwell.com) [Meta Platforms CEO Zuckerberg to testify in Cambridge Analytica privacy lawsuit](https://english.alarabiya.net/business/technology/2022/07/21/Meta-Platforms-CEO-Zuckerberg-to-testify-in-Cambridge-Analytica-privacy-lawsuit?ref=thenexusofprivacy.net), Al Arabiya English on Al Arabiya English (english.alarabiya.net) --- Image Credit: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [*Picpedia*](https://www.picpedia.org/highway-signs/p/privacy.html?ref=thenexusofprivacy.net). ### Is there an elephant in the Zoom room? CPPA says no to ADPPA preempting California law URL: https://thenexusofprivacy.net/is-there-an-elephant-in-the-zoom-room/ Last updated: 2026-04-15T22:56:59.000Z > It’s important to be crystal clear about who preemption serves, and who it harms: preemption privileges the needs of corporations over the needs of people. > > – Maya Morales, WA People's Privacy, at the CPPA board meeting At yesterday's [special board meeting](https://cppa.ca.gov/meetings/materials/20220728.htmlhttps://www.youtube.com/watch?v=2fZ5AIwLwaQ&ref=thenexusofprivacy.net), the California Privacy Protection Agency (CPPA) board voted unanimously to oppose the current version of the federal American Data Privacy and Protection Act (ADPPA) consumer privacy bill, because it would preempt the California Consumer Privacy Act (CCPA), as modified by the California Privacy Rights Act (CPRA), and other California privacy laws. The board also voted unanimously to oppose any bill that similarly threatens these crucial privacy protections for Californians – although also left room for the Agency to support federal privacy legislation that provides a “true floor” allowing states to implement stronger protections. [CPPA's press release](https://www.prnewswire.com/news-releases/california-privacy-protection-agency-board-votes-to-oppose-hr-8152-the-american-data-privacy-protection-act-301595885.html?ref=thenexusofprivacy.net) has quotes from all the board members. [Joseph Duball's summary on IAPP](https://iapp.org/news/a/cppa-takes-aim-at-dismantling-american-data-privacy-and-protection-acts-preemption/?ref=thenexusofprivacy.net) (International Association of Privacy Professionals) includes several of the meeting's many highlights: - Chris Thompson's framing of the "false choice": > He said federal lawmakers are "treating privacy rights as if they are in limited supply and the strong rights of Californians and others need to be taken away" so the rest of the country can be served "weaker rights." - Lydia de la Torre's proposal, adopted by the board, that the agency should embark on a public awareness campaign. During public comments, Californians for Consumer Privacy founder Alistair Mactaggart (the driving force behind California's landmark 2018 CPPA law and the 2020 referendum that updated it with CPRA) strongly supported de la Torre's proposal, highlighting that it was clearly within the agency's statutory mandate. - CPPA Executive Director Ashkan Soltani stated bluntly "While I appreciate suggestions by advocates and others about how the ADPPA may be stronger than California law, I assure you that in my and the staff's expert opinion that it is not." 🍿 The IAPP article also covers the lowlight of the meeting, public commenter Jon Leibowitz's suggested that Californians should give up their rights. Who could have predicted? [Lobbyists gonna lobby](https://thenexusofprivacy.net/what-about-the-elephant/#lobbyists-gonna-lobby) has more about Leibowitz' strategy for passing preemptive federal privacy legislation by comparing it to existing state legislation (although to be fair, Leibowitz said he said he wasn't at the CPPA meeting on behalf of any clients). ## A few perspectives IAPP didn't think were worth mentioning You wouldn't know it from the IAPP article, but several women also spoke during public comments: - Jodi Masters-Gonzales, researcher in AI Ethics and Public Policy and independent auditor of AI systems, strongly opposed ADPPA's removal of CPRA's right to for people opted out of automated decision making – a concern board member Vinhcent Le had previously mentioned.\* - Hayley Tsukayama of Electronic Frontier Foundation discussed how [federal preemption of state privacy law hurts everyone](https://www.eff.org/deeplinks/2022/07/federal-preemption-state-privacy-law-hurts-everyone?ref=thenexusofprivacy.net). - Maya Morales, a community organizer who played a key role in the coalition that passed [a privacy-protecting ordinance](https://peoplefirstbellingham.org/victorystatement/index.html?ref=thenexusofprivacy.net) in Bellingham last year (and whose full comments [on the WA People's Privacy site](https://wapeoplesprivacy.org/our-public-comment-in-historic-ccpa-meeting/?ref=thenexusofprivacy.net) are really worth reading), highlighted who's going to be especially hurt: > \[I\]t is important to note that it is unfavored and marginalized communities that will of course take the brunt of preemptive laws. Preemption will prevent states, counties and municipalities all over this nation from using the law to further protect immigrants of color, LGBTQIA+, Black and Indigenous and People of Color, poor and houseless individuals, and even those with issues of language and disability access that are not addressed by ADPPA. Also, CPPA Deputy Director of Policy and Legislation Maureen Mahoney (whose work got well-deserved compliments from board members and Soltani) provided an analysis of another way ADPPA clearly weakens California protections by recent changes subverting "universal opt-out."\*\* And Board member de la Torre also brought up a topic that hasn't gotten enough attention: ADPPA preempts county and municipal legislation as well as state legislation. In my [comments](https://thenexusofprivacy.net/comments-at-the-cppa-special-board-meeting-on-federal-privacy-legislation-including-adppa/), I briefly mentioned the Seattle Broadbrand Privacy Ordinance; I'm sure there are many others around the country. As de la Torre noted, though, there hasn't yet been any detailed analysis of which local ordinances would be affected by ADPPA's preemption – and what the consequences are. ## Why yes, now that you mention it, there *is* an elephant in the room! Speaking of topics that haven't gotten enough attention, the IAPP article also doesn't mention [the elephant](https://thenexusofprivacy.net/what-about-the-elephant/) – which may have something to do with the lack of women's perspectives in the article. At the meeting, though, board members Lydia de la Torre and Angela Sierra both spoke about the threats to privacy in a post-Roe world. So did I in [my comments](https://thenexusofprivacy.net/comments-at-the-cppa-special-board-meeting-on-federal-privacy-legislation-including-adppa/), quoting Kim Clark of Seattle non-profit Legal Voice describeing ADPPA in Orion Donovan-Smith’s [Spokane *Spokesman-Review* article](https://www.spokesman.com/stories/2022/jul/25/historic-data-privacy-law-could-be-within-reach-if/?ref=thenexusofprivacy.net) earlier this week: > “This bill, at least from the perspective of pregnant people, it really doesn’t do much.” I also highlighted that ADPPA's preemption would prevent states like California and Washington (both of whom have a right to privacy in their state Constitution) from providing stronger protections to our residents. With limited time, I wasn't able to go into detail on the red flags that have been raised about ADPPA's ability to protect against post-Roe threats. For example (from Tonya Riley's [Federal privacy legislation progresses, but concerns about data brokers loom](https://cyberscoop.com/privacy-data-brokers-house-ftc-commerce?ref=thenexusofprivacy.net) on *Cyberscoop*): > “The bill before us has a major loophole that could allow law enforcement to access private data to go after women,” said Rep. Anna Eshoo, D-Calif., who voted against the bill. “For example, under this bill, a sinister prosecutor in a state that criminalizes abortion could use against women their intimate data from search histories or from reproductive health apps. That loophole must be addressed.” [But what about the elephant?](https://thenexusofprivacy.net/what-about-the-elephant/) also has perspectives from Senator Ron Wyden, Senate Commerce Committee staffers, and gender-justice nonprofit UltraViolet on other loopholes and shortcomings in the ADPPA that leave reproductive health data and pregnant people's privacy at risk (as well as a short analysis of some of the changes in the latest version of the ADPPA). And the same ADPPA loopholes and exemptions that make it easy for so-called "crisis pregnancy centers" to share data with vigilantes and law enforcement in states that criminalize abortion also allow targeting of immigrants, LGBTAIQ+ people, unhoused people, people receiving state benefits, and all the other groups who are most impacted by surveillance and data abuse. Preemption stops our states from protecting them as well. ## Does ADPPA protect unhoused people? It's crucial to analyze any privacy bill from the perspective of these communities who are already harmed by survellance. While there's been much discussion of ADPPA's very important civil rights protections, there's been a lot less of how effective the privacy protections actually are in practice. For example, when we discussed how effectively ADPPA protects unhoused people at one of our Washington privacy organizers meetings, we weren't able to find any any detailed analysis from the privacy and civil rights organizations who support the bill. This is concerning. Law enforcement targets unhoused people, so all the loopholes that Eshoo and Wyden has identified as threats to pregnant people apply in this case as well – and not just in states that have criminalized abortion, even in supposedly-progressive cities like San Francisco and Seattle. And as Carrie Leonetti's [The Wild, Wild West: The Right of the Unhoused to Privacy in their Encampment](https://www.law.georgetown.edu/american-criminal-law-review/in-print/volume-56/the-wild-wild-west-the-right-of-the-unhoused-to-privacy-in-their-encampments/?ref=thenexusofprivacy.net) discusses, courts have reached conflicting decisions on what, if any, protection the Fourth Amendment and its state counterparts give to a home that is not a house. As a result, many unhoused people aren't able to take advantage of privacy protections the rest of us take for granted. I'm not a lawyer, but ADPPA's exemptions for not just publicly available data, but also data derived from publicly available data, certainly seem like they could be potential areas of concern here. Leonetti also points out that > Local anti-camping and trespassing ordinances have, in effect, become the new vagrancy laws, criminalizing a status rather than a voluntary behavior in any meaningful sense In light of this, several changes in the latest version of ADPPA are grounds for even more concern: - The "security incident" permissible purpose exception to data minimization (101(b)(5)) has been expanded to include preventing, detecting, protecting against, and responding to **trespass**. - New section 101(b)(14) gives government contractors an additional "permissible purpose" to prevent, detect, protect against or respond to a public safety incident – including **trespass**. - And new section 102(3)(13), an exception to the loyalty duty, lets government contractors transfer data to prevent, detect, protect against or respond to a public safety incident – including **trespass**. There's a lot more to discuss about privacy for unhoused people, in terms of ADPPA and more generally. > **UPDATE, August 9:** [Californians for Consumer Privacy Announce Opposition to ADPPA](https://www.caprivacy.org/californians-for-consumer-privacy-announce-opposition-to-adppa/?ref=thenexusofprivacy.net) makes some relevant and important points, including: > > “Precise geolocation” in ADPPA *excludes* information derived from surveillance cameras I'll go into more depth about this in a future post. For now, though, let's switch focus and look at a tactic that ADPPA supporters are using that's very familiar to us in “[the other Washington](https://thenexusofprivacy.net/the-view-from-the-other-washington-federal-privacy-legislation-adppa-update-6-22/).” ## How broad is the "consensus" that ADPPA provides "strong privacy protections"? In a Twitter discussion later in the evening with board member de la Torre and Dr. Gabriela Zanfir-Fortuna of industry-funded Future of Privacy Forum, EPIC Privacy's [Alan Butler claimed](https://twitter.com/AlanInDC/status/1552814298048733190?ref=thenexusofprivacy.net) that ADPPA has reached "broad consensus" on "strong privacy protections" at the federal level. Where have I heard that before? Oh yeah, that's right, Bad Washington Privacy Act (BadWPA) supporters used those exact same talking points here! In [Washington Tech Industry Association lobbyist Michael Schutzler's misleading Seattle Times opinion piece](https://www.aclu-wa.org/story/fact-check-was-leadership-privacy-legislation?ref=thenexusofprivacy.net) earlier this year, he said the loophole-ridden BadWPA – which was opposed by dozens of immigrant rights, civil rights, civil liberties, and progressive groups, and had already been rejected three times by the state legislature – "reflected years of consensus negotiations with a complex set of stakeholders, and it would have been the country’s strongest privacy bill." The footnotes of [A "fresh wrench"](https://thenexusofprivacy.net/a-fresh-wrench-and-two-hearings/#footnotes)have a bunch of examples of "strong protections", including the time in 2020 Microsoft described the BadWPA as "raising the bar on privacy in the United States" because of its "strong enforcement" even though our Attorney General said the bill was "unenforceable." Good times!\*\*\* Coincidentally enough, the same language that caused enforcement problems for the BadWPA is present in ADPPA as well.\*\*\*\* [A coalition of ten state AG's points out](https://oag.ca.gov/system/files/attachments/press-docs/Letter%20to%20Congress%20re%20Federal%20Privacy.pdf?ref=thenexusofprivacy.net) that this langauge would similarly undermine their enforcement authority. So they're certainly not part of the "consensus." And I wonder just who else is, or isn't, part of this "consensus" ... - Reproductive justice advocates? - Unhoused people and organizations advocating on their behalf? - Immigrant rights organizations concerned about non-consensual data sharing with ICE and ICE contractors? - [The coalition fighting racist surveillance in Detroit?](https://riverwisedetroit.org/article/fighting-racist-surveillance-in-detroit/?ref=thenexusofprivacy.net) - Other local privacy focused organizations like Stop LAPD Spying, Surveillance Technology Oversight Project, Lucy Parsons Lab, PDX Privacy, Oakland Privacy, and (here in Washington) the Tech Equity Coalition? And just to be clear, whatever "consensus" there currently is certainly doesn't yet include me. As I said in my comments, ADPPA does have some very good features – including some that could help inform future legislation in California and elsewhere. There's no question that getting a consumer privacy bill through committee that includes civil rights protections and anti-discrimination language that covers disparate impact is a huge milestone, and I certainly appreciate the work that's gone into that! But the current version of ADPPA appears to have some of the same problems Tech Equity Coalition highlighted with the Bad Washington Privacy Act: loopholes and exemptions, a very weak private right of actions that puts up barriers to people being able to sue, preemption of stronger local regulations .... Of course, it may turn out that some of these concerns are overblown. Others will hopefully be addressed as the bill moves to the House floor. For now though it seems to me like "strong privacy protections" may well be an overstatement. ## Now what? Senate Commerce Chair Maria Cantwell has said she doesn't think Speaker Nancy Pelosi has plans to bring ADPPA to the House floor, and Cantwell currently isn't planning on scheduling a markup. Especially after the CPPA's strong statement, it'll be very difficult for California representatives to vote for something that doesn't change the bill into a "true floor" by removing the preemption section – or at least give their state an exemption. So in contrast to all the discussion of ADPPA's "momentum" after the House Energy & Commerce advanced the bill 53-2, there's now a lot of talk that it's virtually dead. And indeed, the gap on preemption may be too big to bridge. In the markup, Rep. Jan Schachowsky described Rep. Eshoo's amendment to remove state preemption as a "poison pill" that would kill the bill's chances of passing, disrupting the "grand bargain" of trading a weak private right of action for preempting states from providing stronger protectons pregnant people, unhoused people, and other disfavored and marginalized groups. Then again, as we've repeatedly seen in Washington state, [it ain't over til its over](https://wa-privacy.net/it-aint-over-till-its-over/?ref=thenexusofprivacy.net). So I can see at least a couple of ways that ADPPA could move forward: - Industry already has to deal with multiple regulations (including EU's GDPR), so might well decide that they can tolerate California's as well. Perhaps there will be a "dramatic" "compromise" adding the CPRA to the already-long list of other exceptions to preemption – in return for some other concessions to industry, of course. That could be enough to get California represenatives on board – and increase pressure on Cantwell to drop her resistance to preemption. - Or, House Democrats could decide that even though it might meet resistance in the Senate, they've got a golden opportunity to pass a consumer privacy bill that *does* protect pregnant people. The My Body My Data Act and Health and Location Data Privacy Act have strong language that could be adopted by ADPPA, and comments from CPRA, ACLU, EFF, and other groups point out other opportunities for improvement. With the November election coming up, and Democrats hoping anger at the loss of Roe translates to increased enthusiasm and turnout, this could be very smart politics. As Shaunna Thomas of gender justice group UltraViolet says in the [Spokesman-Review article](https://www.spokesman.com/stories/2022/jul/25/historic-data-privacy-law-could-be-within-reach-if/?ref=thenexusofprivacy.net), Democrats have a lot of leverage here. Perhaps they'll use it. With Congress heading to recess, we probably won't know which direction things will go until September. But not to worry, there's still a lot more to discussions will continue between now and then. Stay tuned! CPPA July 28 meeting \* It's entertaining to watch ADPPA proponents tie themselves into knots trying to come up with explanations why not having this right actually makes ADPPA stronger than CPRA. [How the California Privacy Protection Agency Advances Equity in AI](https://medium.com/artificial-intelligence-ai-for-social-impact/xx-22faff63228f?ref=thenexusofprivacy.net) discusses how CPPA is exploring using its authority to regulate algorithms. Meanwhile, [the latest version of ADPPA removed the requirement that algorithimic impact assessments be done by independent third-party researchers](https://thenexusofprivacy.net/what-about-the-elephant/#algos), dropped several requirements on what needs to be covered in the assessments, and further narrowed the definition of which algorithms need to be assessed. \*\* Jason Kint of Digital Content Next has [a short Twitter thread](https://twitter.com/jason%5Fkint/status/1551991266921021440?ref%5Fsrc=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1551991427558694915%7Ctwgr%5E%7Ctwcon%5Es2%5F&ref%5Furl=https%3A%2F%2Fprivacy.thenexus.today%2Fwhat-about-the-elephant%2F&ref=thenexusofprivacy.net) with a good explanation. \*\*\* Industry-funded Future of Privacy Forum also talked about the unenforceable 2020 Bad Washington Privacy Act's "strong enforcement". Unfortunately I didn't save a copy of the chart they were using to make the point, and the only Twitter reference I could find has been deleted, but [my reply pointing out that their chart was inaccurate lives on](https://twitter.com/jdp23/status/1235461252840697856?ref=thenexusofprivacy.net)! \*\*\*\* It's in 404(c): “a violation of this Act shall not be pleaded as an element of any such cause of action." As the AG's letter says: > In many states, the Attorney General’s office uses civil investigative demands under its consumer protection authority to demand documents or information from entities when we believe there could have been a violation of a law. Ordinarily, a violation of a federal law or standard could also be a violation of state consumer protection law. But Section 404 would act as a bar to investigate violations of the federal law, because it prohibits them from forming the basis for state consumer protection claims. This language unnecessarily interferes with robust enforcement capabilities. --- Image credit: screenshot of CPPA meeting, originally from [@CalPrivacy's tweet](https://twitter.com/CalPrivacy/status/1552814871284092929?ref=thenexusofprivacy.net). ### Comments at the CPPA Special Board Meeting on federal privacy legislation, including ADPPA URL: https://thenexusofprivacy.net/comments-at-the-cppa-special-board-meeting-on-federal-privacy-legislation-including-adppa/ Last updated: 2026-04-15T22:56:04.000Z *The California Privacy Protection Agency (CPPA) had* [*a public special board meeting today*](https://cppa.ca.gov/meetings/materials/20220728.html?ref=thenexusofprivacy.net) *to discuss the American Data Privacy and Protection Act (ADPPA), a federal consumer privacy bill that would override California Privacy Rights Act (CPRA). Pass the popcorn!* *Here were my comments, more or less – I edited a bit on the fly, so this might not be 100% accurate.* Thank you for the opportunity to comment today, for all of CCPA's contributions to the discussions about ADPPA, and to Ms Mahoney for her outstanding work. I'm Jon Pincus, a technologist and entrepeneur. I lived in California for years, and may well move back there in the future, but currently live in Bellevue, Washington. I support the first two motions, and ask you to strengthen the third to authorize agency staff to support a federal bill that doesn't preempt CPRA \*AND\* that in general creates a floor that CA and other states can build on in the future. As you highlight, the preemption clause not only eliminates existing state laws like CPRA, and local laws like Seattle's Broadband Privacy Ordinance, it also puts a ceiling on future protections. Washington's Attorney General opposes premption as well. So does Washington People's Privacy and grassroots activists across the state. As Ms. de la Torre highlighted, the threats to privacy in a post-Roe world highlight what's at stake. Here's how Kim Clark of Seattle non-profit Legal Voice described ADPPA in a Spokane Spokesman-Review article earlier this week, > “This bill, at least from the perspective of pregnant people, it really doesn’t do much.” ADPPA's preemption would prevent states like ours, who \*do\* value privacy, from doing more, and providing stronger protections. And as Ms. Morales pointed out, the same ADPPA loopholes and exemptions that make it easy for so-called "crisis pregnancy centers" to share data with vigilantes and law enforcement in states that criminalize abortion also allow targeting of immigrants, LGBTAIQ+ people, unhoused people, people receiving state benefits, and all the other groups who are most impacted by surveillance and data abuse. Preemption stops our states from protecting them as well. ADPPA does have some very good features -- including some that could help inform future legislation in California and elsewhere. Even so, and even if all the issues CCPA and EFF and ACLU and others have identified with ADPPA were somehow magically addressed, preemption would still be a problem. Technology changes quickly, so we need the ability to strengthen protections. States can do that more quickly and effectively than Congress. As Louis Brandeis said, states are the laboratories of democracy. And as a tech leader, California is particularly well placed to do that. So thank you again for fighting for privacy rights of people in California -- and all across the country. ### ADPPA Advances. But what about the elephant? Federal Privacy Legislation Update, July 26 URL: https://thenexusofprivacy.net/what-about-the-elephant/ Last updated: 2026-04-15T22:59:00.000Z As expected, the House Energy & Commerce Committee advanced the bipartisan, bicameral American Data Protection and Privacy Act (ADPPA) on a 53-2 vote. It's the first time this century a consumer privacy protection bill has ever made it out of committee in Congress, so congrats to all involved! ADPPA's next step is a vote by the full House. It's not currently on the House floor schedule, and Congress takes most of August off, so it probably won't happen until mid-September. [The Sunday Show: Prospects for the American Data Privacy and Protection Act](https://techpolicy.press/the-sunday-show-prospects-for-the-american-data-privacy-and-protection-act/?ref=thenexusofprivacy.net), a discussion with Nora Benavidez of Free Press, Justin Brookman of Consumer Reports, and Justin Hendrix, has some good perspectives on the current status and next steps. But even though the bill has strong bipartisan support, it's still far from a sure thing. The intense debate about whether ADPPA will preempt state laws has gotten most of the attention, but as Tonya Riley reports in [Federal privacy legislation progresses, but concerns about data brokers loom](https://cyberscoop.com/privacy-data-brokers-house-ftc-commerce?ref=thenexusofprivacy.net) on *Cyberscoop,* that's far from the only issue. > “The bill before us has a major loophole that could allow law enforcement to access private data to go after women,” said Rep. Anna Eshoo, D-Calif., who voted against the bill. “For example, under this bill, a sinister prosecutor in a state that criminalizes abortion could use against women their intimate data from search histories or from reproductive health apps. That loophole must be addressed.” And Senator Wyden continues to be concerned about the exemption of "de-identified" data. > “\[T\]his loophole could allow data brokers to sell location data to the government about visits to reproductive health facilities, for example, or other private information that is trivially easy to connect to individuals,” a Wyden aide wrote in an email to CyberScoop. “He strongly believes this must be fixed before any legislation becomes law.” Meanwhile, here in “[the other Washington](https://thenexusofprivacy.net/the-view-from-the-other-washington-federal-privacy-legislation-adppa-update-6-22/)”, Kim Clark of Seattle-based Legal Voices goes even farther in Orion Donovan-Smith’s Spokane [*Spokesman-Revi*ew article](https://www.spokesman.com/stories/2022/jul/25/historic-data-privacy-law-could-be-within-reach-if/?ref=thenexusofprivacy.net) > “This bill, at least from the perspective of pregnant people, it really doesn’t do much” > UPDATE: Several California Privacy Protection Agency board members also expressed concerns during their July 28 special board meeting. See [Is there an elephant in the Zoom room?](https://thenexusofprivacy.net/is-there-an-elephant-in-the-zoom-room/#why-yes-now-that-you-mention-it-there-is-an-elephant-in-the-room) for more – including a followon discussion about how similar potential ADPPA loopholes affect unhoused people. To be clear, this isn't the only challenge facing ADPPA. [Most of the other coverage in the last week](https://thenexusofprivacy.net/privacy-news-july-22/#see-also) has focused on the battle over whether ADPPA should preempt state privacy laws. At the markup, Rep. Eshoo's amendment to strip the preemption section was voted down (8-48), but several California Representaties said they'd vote against the bill on the floor unless this issue was addressed. Daniel Solove's[ A Faustian Bargain: Is Preemption Too High a Price for a Federal Privacy Law?](https://teachprivacy.com/a-faustian-bargain-is-preemption-too-high-a-price-for-a-federal-privacy-law?ref=thenexusofprivacy.net) and[ the letter from a coalition of state Attorneys General (including Washington's) opposing preemption of state laws](https://oag.ca.gov/news/press-releases/attorney-general-bonta-leads-coalition-calling-federal-privacy-protections?ref=thenexusofprivacy.net) have more. And while the version of the ADPPA the committee advanced did include some significant improvements, they also weakened the bill in some significant ways – and didn't address the loopholes Rep. Eshoo and Sen. Wyden are talking about. They also didn't address concerns Senate Commerce committee staffers raised in a memo, as [reported by Cristiano Lima in the Washington Post](https://www.washingtonpost.com/politics/2022/06/27/abortion-ruling-could-scramble-data-privacy-talks/?ref=thenexusofprivacy.net): > According to the memo, the [American Data Privacy and Protection Act](https://republicans-energycommerce.house.gov/wp-content/uploads/2022/06/PRIVACY%5F02%5Fxml.pdf?ref=thenexusofprivacy.net) “makes it harder for women to seek redress when their sensitive health data has been used against them” and would force women to “jump through arbitrary, drawn-out hoops” to sue over privacy violations. As Shaunna Thomas of gender justice group UltraViolet says in the [Spokesman-Review article](https://www.spokesman.com/stories/2022/jul/25/historic-data-privacy-law-could-be-within-reach-if/?ref=thenexusofprivacy.net) > “We see an opportunity for asking Democrats to recognize the threats that have become far more acute in a post-Roe world, and to consider using the leverage they have – which is not insignificant – to consider these improvements in that light.” But will Democrats use that leverage? The risk is that contentious topics like preemption take up so much time and energy that legislators don't talk about the elephant in the room – and so don't realize that the current version of ADPPAl, as Kim Clark says, "really doesn't do much" to protect pregnant people. We shall see. ### UPDATE, 6:00 pm (Pacific time) [The California Consumer Privacy Agency (CCPA) released a bill analysis](https://cppa.ca.gov/meetings/materials/20220728%5Fitem2%5Fcppa%5Fstaff%5Fmemo%5Fhr8152.pdf?ref=thenexusofprivacy.net) this morning and announced has [a public special board meeting at 9:00 am Thursday.](https://cppa.ca.gov/meetings/materials/20220728.html?ref=thenexusofprivacy.net) 🍿 And [this short thread from ACLU of Northern California](https://twitter.com/ACLU%5FNorCal/status/1552059006625034241?ref=thenexusofprivacy.net) also makes some great points. > A lot’s being said about the American Data Privacy and Protection Act. > > But not nearly enough on how it dismantles current privacy laws, including over 50 years of work in California. > > There’s a reason Big Tech support it. And it’s not because they care about our rights. > > Thread > > — ACLU of Northern CA (@ACLU\_NorCal) [July 26, 2022](https://twitter.com/ACLU%5FNorCal/status/1552059006625034241?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) ## Sacrificial lambs, sneaking loopholes through, and other industry tactics The version of ADPPA the committee advanced had a lot of changes from the subcommittee's version (which in turn had a lot of changes from the original discussion draft). Some strengthen the bill; some weaken it; many are just cosmetic, like changing "shall not" to "may not." Virtually all of the strengthening changes either reverse a weakening change the subcommittee made, are balanced by other weakening changes, and/or are only small fixes that leave bigger issues unaddressed. Industry lobbyists plan for this by multiple levels of loopholes in early versions of a bill, including some "sacrificial lambs" that they know they're going to have to give up. As a result, privacy advocates, legislators, and staff all have to focus their energy on these relatively-minor issues. When the change is finally made, industry can portray their concession as a compromise, and legislators and the media can talk about how the bill is getting "steadily stronger". The brouhaha about whether California Consumer Privacy Agency (CCPA) can enforce the ADPPA is a good example of a sacrificial lamb and worth looking at in detail. California's voters created CCPA and gave it a $10,000,000 budget in a statewide referendum just two years ago, so it's very very very unlikely that California legislators would vote for a bill that effectively gets rid of it. But the ADPPA discussion draft didn't give state privacy agencies the authority to enforce the bill. So everybody had to spend valuable time arguing about it before reaching the obvious conclusion that yeah, state privacy authorities should be allowed to take action to protect their residents. But the section that got added to the subcommittee version allowing state privacy authorities to enforce was worded in a way that it didn't include CCPA. So now everybody had to spend time talking about that before reaching the obvious conclusion that yeah, CCPA should be allowed to take action to protect Californians. And in the current version there's still a provision that state Attorneys General, including California, warn will substantially interferes with many states' investigation and enforcement authorities. Hey wait a second, I'm noticing a pattern here. Nobody's mentioned this yet in any of the hearings, and as far as I know privacy groups' comments haven't yet emphasized this issue – in fact, Alan Butler of EPIC has said the bill's enforcement is stronger than anybody gives it credit for. So maybe industry will be able to sneak this major loophole through (they tried something similar in Washington in 2020). Even if it gets fixed now, it will take more valuable time and energy. Another industry tactic is to get changes into the bill that they know will almost certainly get undone. Again, this chews up time and energy from privacy advocates, legislators, and staff. Often, industry can get a concession to "balance" their willingness to "compromise" by undoing the change – or use this "compromise" to avoid bigger changes. And when the changes get undone, it's another opportunity for the bill's supporters to claim it's getting stronger, when the reality is that it's just gotten back to where it originally was. ## Changes since the subcommittee version With that as context, here's a list of some of the most important changes. Many thanks to WA People's Privacy and the other Washington privacy organizers who helped with the crowdsourced bill analysis! I'll continue to update this as we analyze some of the other changes. If you want to follow along, you'll want the[ July 19 ADPPA version](https://docs.house.gov/meetings/IF/IF00/20220720/115041/BILLS-117-8152-P000034-Amdt-1.pdf?ref=thenexusofprivacy.net) as amended by the six[ amendments](https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=115041&ref=thenexusofprivacy.net) that passed. [The redlined version from IAPP and Future of Privacy Forum](https://media-exp1.licdn.com/dms/document/C4E1FAQG-kcljte035A/feedshare-document-pdf-analyzed/0/1658364628458?e=1661990400&v=beta&t=rw5yxfubj0O4f0wUTkGNr1XoCc3eC0MtfVRIGhDNRkM&ref=thenexusofprivacy.net), including all the amendments and highlighting the specific textual changes from the subcomittee's version, is also very useful. ### Strengthening - State consumer agencies with expertise in data privacy, including the California Privacy Protection Agency (CPPA), can now enforce the bill (Sec. 2(32)). This addresses one of the many issues CPPA had brought up in their [July 1 comments](https://aboutbgov.com/3XA?ref=thenexusofprivacy.net). - Race, color, ethnicity, religion, and union membership are now once again considered "sensitive covered data" (Sec. 2(28)(A)(14)). This undoes a very harmful change the subcommittee had made. Unfortunately, the committee *removed* sexual orientationfrom sensitive data, and other very sensitive data such as sex, gender, immigration status ,and national origin still *isn't* considered "sensitive covered data." - The defintion of de-identified data, which is exempt from ADPPA, has been revised to undo another very harmful change the subcommittee made (Sec 2(12)). Note however that this does not appear to have fully addressed the concerns from Sen. Wyden and others that de-identified data is a major loophole. - "High impact social media companies" (with more than 300,000,000 users) have to treat somebody as a minor if they "know or should have known" that person is under 17 (Sec. 2(20)(A)(i). Kids privacy experts have been calling for this stronger "constructive knowledge" standard, so this is a big deal. However, "small" businesses with annual revenues of $41,000,000 or less can continue to take advantage of [the "actual knowledge" loophole](https://www.npr.org/2022/06/16/1105212701/users-beware-apps-are-using-a-loophole-in-privacy-law-to-track-kids-phones?ref=thenexusofprivacy.net). Mid-size companies, abd large non-social media companies, split the difference with a "willful disregard" standard. - The weak private right of action, allowing people to sue companies who break the law, now comes into effect in two years instead of four (Sec. 403(a)(1)); and people no longer forfeit their rights if they send a badly-worded demand letter, removing one of the hurdles to being able to sue (Sec. 403(a)(1)). \[Remaining hurdles still include requirements for consumers to give prior notice to the FTC, and a "get out of jail free card" that gives companies a way to duck penalties -- another good example of industry's multi-level loophole strategy.\] Balanced against this, businesses with revenues of less than $25,000,000 are now exempt from the private right of action. (Sec. 403(e)(2)) - Forced arbitration is no longer enforceable on claims related to gender or partner-based violence or physical harm (Sec. 403(b)). However, companies can still impose forced arbitration on adults in all other cases. During the markup, Rep. Donald McEachin of Virginia said that the bill as currently written wouldn't have his support on the floor because of forced arbitration, and Senate Commerce Chair Maria Cantwell has flagged this as an issue that needs to be fixed. - Changes to the section on preempting FCC privacy laws (404(b)(4)) are [appreciated by Public Knowledge](https://publicknowledge.org/public-knowledge-urges-committee-to-support-american-data-privacy-and-protection-act/?ref=thenexusofprivacy.net), who now supports the bill. That said, according to EFF, ADPPA [still blocks several important federal privacy laws](https://www.eff.org/deeplinks/2022/07/americans-deserve-more-current-american-data-privacy-protection-act?ref=thenexusofprivacy.net). - Service providers processing data on behalf of government agencies are now (once again) not exempt from ADPPA, undoing yet another very harmful subcommittee change. Balanced against this, though, a key restriction on all service providers – whether or not they're operating on behalf of government agencies – have been weakened (Sec. 302). ### Weakening - The "permissible purposes" for which businesses and non-profits can collect and process data without consent have been broadened substantially. (Sec 101(b)). One change, for example, expands the definition of "security" in 101(b)(5). Previously, it was "network security as well as intrusion." Now, it's "network security and physical security and life safety, including an intrusion or trespass." [Does ADPPA protect unhoused people?](https://thenexusofprivacy.net/is-there-an-elephant-in-the-zoom-room/#does-adppa-protect-unhoused-people) discusses one of the potential implications of including "trespass." Note that there was already concern that 101(b) purposes was over-broad – see for example Washington AG Ferguson's [June 24 letter](https://www.documentcloud.org/documents/22111995-ferguson-privacy-letter-to-4-corners%5F6-24-2022?ref=thenexusofprivacy.net) describing how "internal research" (101(b)(2)) "may be used by technology companies to maintain all data indefinitely." And 101(b)(6) may well be the source of the "major loophole that could allow law enforcement to access private data to go after women" Rep. Eshoo referred to. So it's very disappointing to see this key data minimization section getting even weaker. - Social security numbers can now be collected, processed, and transferred without consent for "fraud and identity fraud detection and prevention." (102(1)) - The definition of "employee data", which is exempt from ADPPA, has been broadened to include "information processed by an employer relating to an employee who is acting in a professional capacity for the employer, provided that such information is collected, processed, or transferred solely for purposes related to such employee’s professional activities on behalf of the employer." (Sec. 2(8)(C)(ii)) - When people are using devices provided by their employer – or sending something to somebody whose device is provided by their employer – calendar information, address book information, phone or text logs, photos, audio recordings, and videos, maintained for their own private use is no longer considered sensitive covered data. (Sec. 28(A)(x)) - The language requirements for privacy notices has been narrowed. Previously, these had to be provided in any language the product or service is provided in, and any language in which the company carries out activities related to such product or service. Now, they only have to be provided in the those languages if they're also "covered languages" (Sec. 2(10)), defined as the top 10 languages in the US. Many immigrants, Native Americans, and Indigenous people use software in languages that don't fall in the top 10 (Facebook and Google both support over 100 languages), so this significantly impacts their rights. - Service providers are now allowed to combine service provider data with covered data for the 101(b) permissible purposes (Sec. 302). There are several other changes to this section as well, and [EFF is concerned that this section will gives government contractors such Clearview AI and ID.me much more leeway than it should](https://www.eff.org/deeplinks/2022/07/americans-deserve-more-current-american-data-privacy-protection-act?ref=thenexusofprivacy.net). UPDATE, August 4: [What Microsoft, IBM and others won as the privacy bill evolved](https://www.protocol.com/newsletters/policy/cloud-enterprise-privacy?ref=thenexusofprivacy.net) (Ben Brody and Hirsh Chitraka on *Protocol*) discusses these changes in more detail. - Several related changes significantly weaken the Algorithm Impact Assessments and Algorithm Design Evaluations requirements (207(c)), which are vital for enforcing the civil rights anti-discrimination protections against large companies. One major change is to eliminate the requirement that companies use external, independent auditors or researchers to the extent possible. As we've seen time and again with Facebook's repeated denials of discrimination in housing ads – followed by settlements when external audits reveal ongoing discrimination – internal auditors are often unlikely to surface real problems. - The standard for which algorithms require assessment (207(c)(1)(A)) has changed from “may cause potential harm” to “consequential risk of harm.” This is an attempt to focus impact assessments on the highest priority algorithms, but could easily mean that important algorithms don't get impact assessments – especially since, s [Brandon Pugh and Sofia Lesnes point out on *R Stree*t](https://www.rstreet.org/2022/07/21/marking-up-momentum-whats-next-for-the-adppa/?ref=thenexusofprivacy.net), "the exact meaning of consequential risk is not clear." This is especially concerning because the definition of Covered Algorithm (now in 2(7), but otherwise unchanged in this version) also potentially excludes a lot of important algorithms; see comments from [Cynthia Khoo](https://twitter.com/Cyn%5FK/status/1532789046719619073?ref=thenexusofprivacy.net),[ Ben Winters](https://twitter.com/Wenbinters/status/1532791295873273857?ref=thenexusofprivacy.net), and[ Anjana Susarla](https://twitter.com/asusarla?ref=thenexusofprivacy.net) about the potential limitations of the "facilitate human decision-making" framing. - Algorithm Impact Assessments no longer have to include "foreseeable capabilities outside of the articulated proposed use of the covered algorithm." and "reasons for the superiority of the algorithm over nonautomated decision making methods". The requirements for these assessments were already noticeably weaker. - Another weakness: the new version added a new requirement to authenticate global opt-out requests, which it turns out completely undercuts the purpose of global opt-out. (Sec. 210(b) – ADPPA calls this "unified opt-out") [From CCPA's letter](https://cppa.ca.gov/meetings/materials/20220728%5Fitem2%5Fcppa%5Fstaff%5Fmemo%5Fhr8152.pdf?ref=thenexusofprivacy.net): > California requires businesses to honor browser privacy signals as an opt out of sale, and authentication of such requests is not required. This is to prevent hundreds of businesses from contacting the individual to confirm the opt out one-by-one and to prevent targeted advertising loopholes. ADPPA’s global opt out has recently been amended to include an authentication requirement for global opt-out requests. On Twitter, Jason Kint of Digital Content Next has an excellent explanation of why this would be so bad. > So here is where federal bill (ADPPA) will have a massive fail if not fixed. The latest amended bill suddenly has new language allowing a company to require an authentication process before honoring the global opt-out signal. More in a minute on just how awful this would be. /7 [pic.twitter.com/DFNlukSmvm](https://t.co/DFNlukSmvm?ref=thenexusofprivacy.net) > > — Jason Kint (@jason\_kint) [July 26, 2022](https://twitter.com/jason%5Fkint/status/1551991427558694915?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) - Companies with less than 15 employees are now exempt from Sec. 301(c), even if they do not qualify as Sec 209 small businesses (who were already exempt). This means they don’t have to designate a security and privacy officer; and if they're large data holders, they're exempt from the 301(c)(3) audits and compliance training requirement. This came in as a bipartisan amendment modifying 301(c)(1), described as lessening the burden on small businesses. While I certainly agree that there’s no reason a corner store or tiny family-owned restaurant should have to name a security and privacy officer, they were already exempt due to Sec. 209\. So this seems a loophole for tech companies like who process too much data to qualify for Sec. 209 – like small biomedical startups, for example (who also benefit from another bipartisan amendment described as removing barriers to clinical trials). As Cobun Zweifel-Keegan of IAPP reminded me, this could also exempt businesses like Cambridge Analytica – a classic example of why exempting companies based on size can be problematic. ### Privacy News: July 22 URL: https://thenexusofprivacy.net/privacy-news-july-22/ Last updated: 2022-07-24T23:44:05.000Z ## Privacy after Roe ### [Democrats widen scrutiny of tech over abortion data privacy](https://apnews.com/article/abortion-technology-apple-inc-congress-government-and-politics-fa6dfd46baeb3732df4b4fcb720dd04a?ref=thenexusofprivacy.net) Marcy Gordon, Associated Press (apnews.com) In the aftermath of the Supreme Court, Congressional Democrats are pushing tech companies on their privacy policies. Six House Dems sent letters to Amazon, Oracle, Near Intelligence Holdings and Mobilewalla asks asking how the companies handle location data from mobile phones, and what they're doing to protect the privacy rights of individuals seeking information on abortion. As Reps. Lori Trahan (D-MA), David Cicilline (D-RI), Yvette Clarke (D-NY), Debbie Dingell(D-MI), Adam Schiff(D-CA), and Sean Casten (D-IL) highlight: > Data collected and sold by your company could be used by law enforcement and prosecutors in states with aggressive abortion restrictions. Additionally, in states that empower vigilantes and private actors to sue abortion providers, this information can be used as part of judicial proceedings.... > > When consumers use apps on their phone and quickly tap ‘yes’ on ‘use geolocation data’ pop-ups, they should not be worried about the endless sale of their data to advertisers, individuals or law enforcement. And it most certainly should not be used to hunt down, prosecute and jail an individual seeking reproductive care. Companies can take action today to protect individual rights. And Senators Elizabeth Warren and Edward Markey of Massachusetts sent letters to companies making software to monitors students’ online communications, asking whether their software flags students’ online searches for abortion and other related terms. My guess is that Bark Technologies, Gaggle.net, GoGuardian and Securly will say something like "it's our customers who choose what to monitor for", in other words "yes but it's not our fault." We shall see. SEE ALSO: [Democrats press Oracle, AWS over their post-Roe data collection,](https://www.washingtonpost.com/politics/2022/07/21/democrats-press-oracle-aws-over-their-post-roe-data-collection/?ref=thenexusofprivacy.net) Cristiano Lina in the Washington Post. The article has some excellent quotes from Michael Kleinman of Amnesty International, who also wrote to the companies. ### Other post-Roe privacy news [South Carolina bill outlaws websites that tell how to get an abortion](https://washingtonpost.com/technology/2022/07/22/south-carolina-bill-abortion-websites?ref=thenexusofprivacy.net), Cat Zakrzewski on The Washington Post (washingtonpost.com) [Hamilton: Pregnant people in Indiana are about to lose state privacy protections](https://heraldtimesonline.com/story/opinion/columns/2022/07/21/column-pregnant-people-in-indiana-about-to-lose-privacy-protections/65379175007?ref=thenexusofprivacy.net), Mayor John Hamilton on The Herald-Times (heraldtimesonline.com) [The Most Popular Period-Tracking Apps, Ranked by Data Privacy](https://wired.com/story/period-tracking-apps-flo-clue-stardust-ranked-data-privacy?ref=thenexusofprivacy.net), Kristin Poli, on WIRED (wired.com) [Amazon’s $3.9 billion One Medical acquisition is already raising data privacy concerns](https://fastcompany.com/90771530/amazons-3-9-billion-one-medical-acquisition-is-already-raising-data-privacy-concerns?ref=thenexusofprivacy.net), Clint Rainey on Fast Company (fastcompany.com) ## Federal privacy legislation ### [Federal privacy legislation progresses, but concerns about data brokers loom](https://cyberscoop.com/privacy-data-brokers-house-ftc-commerce?ref=thenexusofprivacy.net) Tonya Riley on CyberScoop (cyberscoop.com) On Wednesday, the House Energy & Commerce unanimously advanced the bipartisan, bicameral American Data Protection and Privacy Act (ADPPA). It's the first time a consumer privacy protection bill has ever made it out of committee in Congress, so congrats to all involved! The vote was 53-2, and many DC-based privacy organizations supported the amended version of the bill. The two no votes were both from Californians (Anna Eshoo and Nanette Diaz Barragán), although Donald McEachin of Virgnia and Doris Matsui of California said they were voting yes to advance the bill but it did not yet have their support on the floor. The highest-profile issue is that the current version of the bill preempts most current and future state laws, including California's CRPA. The bill's upporters say that this [faustian bargain](https://teachprivacy.com/a-faustian-bargain-is-preemption-too-high-a-price-for-a-federal-privacy-law?ref=thenexusofprivacy.net) (as privacy scholar Daniel Solove describes it) is necessary to get industry's support for the bill. But that's far from the only issue. From Riley's article: > “The bill before us has a major loophole that could allow law enforcement to access private data to go after women,” said Rep. Anna Eshoo, D-Calif., who voted against the bill. “For example, under this bill, a sinister prosecutor in a state that criminalizes abortion could use against women their intimate data from search histories or from reproductive health apps. That loophole must be addressed.” And Senator Wyden continues to be concerned about the exemption of de-identified data. > “\[T\]his loophole could allow data brokers to sell location data to the government about visits to reproductive health facilities, for example, or other private information that is trivially easy to connect to individuals,” a Wyden aide wrote in an email to CyberScoop. “He strongly believes this must be fixed before any legislation becomes law.” Interestingly, there was almost no discussion of these issues during the markup or the hearing – almost none of the other articles about ADPPA mention [talk about the elephant](https://thenexusofprivacy.net/talking-about-the-elephant/) in the room. ### SEE ALSO - [https://www.vitallaw.com/news/house-e-c-committee-amends-approves-privacy-legislation/e832d1fbfa14479299e92c243bb65d98](https://www.vitallaw.com/news/house-e-c-committee-amends-approves-privacy-legislation/e832d1fbfa14479299e92c243bb65d98?ref=thenexusofprivacy.net) - [American Data Privacy and Protection Act heads for US House floor](https://iapp.org/news/a/american-data-privacy-and-protection-act-heads-for-us-house-floor?ref=thenexusofprivacy.net), Joseph Duball on International Association of Privacy Professionals (iapp.org) - [American Data Privacy and Protection Act Advances in Congress](https://epic.org/american-data-privacy-and-protection-act-advances-in-congress?ref=thenexusofprivacy.net), on EPIC - Electronic Privacy Information Center (epic.org) - [National US data privacy law clears first legislative hurdle](https://theregister.com/2022/07/21/us%5Fadppa%5Fprivacy?ref=thenexusofprivacy.net), Brandon Vigliarolo on The Register (theregister.com) - [Congress Might Pass an Actually Good Privacy Bill](https://wired.com/story/american-data-privacy-protection-act-adppa?ref=thenexusofprivacy.net), Gilad Edelman on WIRED (wired.com) - [Conceptions of Privacy Shouldn’t Stand in the Way of Privacy Standing](https://lex.jotwell.com/conceptions-of-privacy-shouldnt-stand-in-the-way-of-privacy-standing?ref=thenexusofprivacy.net), Caprice Roberts on Lex (lex.jotwell.com) - [The Bipartisan House Privacy Bill Would Surpass State Protections](https://lawfareblog.com/bipartisan-house-privacy-bill-would-surpass-state-protections?ref=thenexusofprivacy.net), Stacey Gray of Future of Privacy Forum on Lawfare (lawfareblog.com) - [Federal privacy legislation that protects civil rights is critical for all Americans](https://thehill.com/opinion/congress-blog/3568525-federal-privacy-legislation-that-protects-civil-rights-is-critical-for-all-americans?ref=thenexusofprivacy.net), Bertram Lee of Future of Privacy Forum on The Hill (thehill.com) - [Data privacy bill moves forward over objections from Gavin Newsom and two California Congress members](https://sfchronicle.com/politics/article/data-privacy-bill-17321100.php?ref=thenexusofprivacy.net), Bob Egelko on San Francisco Chronicle (sfchronicle.com) - [A Faustian Bargain: Is Preemption Too High a Price for a Federal Privacy Law?](https://teachprivacy.com/a-faustian-bargain-is-preemption-too-high-a-price-for-a-federal-privacy-law?ref=thenexusofprivacy.net), Daniel Solove on TeachPrivacy (teachprivacy.com) - [Americans Deserve More Than The Current American Data Privacy Protection Act](https://www.eff.org/deeplinks/2022/07/americans-deserve-more-current-american-data-privacy-protection-act?ref=thenexusofprivacy.net), Hayley Tsukayama, Adam Schwartz, India McKinney, and Lee Tien on Electronic Frontier Foundation (eff.org) UPDATES: - [House E&C Committee Amends, Approves Privacy Legislation,](https://www.vitallaw.com/news/house-e-c-committee-amends-approves-privacy-legislation/e832d1fbfa14479299e92c243bb65d98?ref=thenexusofprivacy.net) Lynn Stanton, VitalLaw (vitallaw.con) has lots of quotes - [The Sunday Show: Prospects for the American Data Privacy and Protection Act](https://techpolicy.press/the-sunday-show-prospects-for-the-american-data-privacy-and-protection-act/?ref=thenexusofprivacy.net), Justin Hendrix with Nora Benevidez of Free Press and Justin Brookman of Consumer Reports, Tech Policy Press (techpolicy,press) ## And ... [Amazon’s $3.9 billion One Medical acquisition is already raising data privacy concerns](https://fastcompany.com/90771530/amazons-3-9-billion-one-medical-acquisition-is-already-raising-data-privacy-concerns?ref=thenexusofprivacy.net), Clint Rainey on Fast Company (fastcompany.com) [California privacy rules target dark patterns through technology design](https://cybersecuritydive.com/news/california-cpra-privacy-rights/627744?ref=thenexusofprivacy.net), Robert Freedman on Cybersecurity Dive (cybersecuritydive.com) [A Frozen Document in China Unleashes a Furor Over Privacy](https://wsj.com/articles/a-frozen-document-in-china-unleashes-a-furor-over-privacy-11657887259?ref=thenexusofprivacy.net), Wenxin Fan on WSJ (wsj.com) [The DHS Bought a ‘Shocking Amount’ of Phone-Tracking Data](https://wired.com/story/dhs-surveillance-phone-tracking-data?ref=thenexusofprivacy.net), Ashley Belanger, on WIRED (wired.com) [Some popular children’s apps contain ‘risky’ code transmitting sensitive data, audit finds](https://abc.net.au/news/2022-07-21/the-risky-ways-popular-childrens-android-apps-collecting-data/101175256?ref=thenexusofprivacy.net), Conor Duffy and Leonie Thorne, ABC News (abc.net.au) [TROPT Ethical, Responsible & Privacy Tech Unconference 2022](https://hopin.com/events/tropt-ethical-responsible-privacy-tech-unconference-2022/registration?ref=thenexusofprivacy.net), The Rise of Privacy Technology on hopin.com [Proposed EU AI Act blurs lines between AI developers and data processors under GDPR](https://iapp.org/news/a/proposed-eu-ai-act-blurs-lines-between-ai-developers-and-data-processors-under-gdpr?ref=thenexusofprivacy.net), Alex LaCasse on International Association of Privacy Professionals (iapp.org) [UK and US seek out privacy-enhancing innovations](https://eandt.theiet.org/content/articles/2022/07/uk-and-us-launch-prize-challenges-to-develop-privacy-enhancing-innovations?ref=thenexusofprivacy.net), E&T editorial staff on E&T Magazine (eandt.theiet.org) [Indian women shunning Facebook due to safety, privacy concerns: Study](https://thehindubusinessline.com/info-tech/indian-women-ditching-facebook-due-to-safety-privacy-concerns-study/article65666502.ece?ref=thenexusofprivacy.net), Ayushi Kar on The Hindu BusinessLine (thehindubusinessline.com) [Meta Platforms CEO Zuckerberg to testify in Cambridge Analytica privacy lawsuit](https://english.alarabiya.net/business/technology/2022/07/21/Meta-Platforms-CEO-Zuckerberg-to-testify-in-Cambridge-Analytica-privacy-lawsuit?ref=thenexusofprivacy.net), Al Arabiya English on Al Arabiya English (english.alarabiya.net) --- *Image Credit*: Privacy by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) via [PicPedia](https://www.picpedia.org/chalkboard/p/privacy.html?ref=thenexusofprivacy.net). ### Privacy News: July 20 URL: https://thenexusofprivacy.net/privacy-news-july-20/ Last updated: 2022-07-20T18:50:04.000Z ### [New Records Detail DHS Purchase and Use of Vast Quantities of Cell Phone Location Data | News & Commentary](https://aclu.org/news/privacy-technology/new-records-detail-dhs-purchase-and-use-of-vast-quantities-of-cell-phone-location-data?ms=220718%5Fblog%5Ftw&ms%5Faff=nat&ms%5Fchan=soc&ref=thenexusofprivacy.net) Shreya Tewari on American Civil Liberties Union (aclu.org) Thousands [previously unreleased records](https://www.aclu.org/cases/aclu-v-department-homeland-security-commercial-location-data-foia?ref=thenexusofprivacy.net#DOcuments%5Fproduced%5Fby%5FCustoms%5F&%5FBorder%5FProtection%5F%28CBP%29:~:text=District%20Court%20%28S.D.N.Y.%29%20FOIA%20litigation%20documents) illustrate how CBP, ICE and other parts of the Department of Homeland Security (DHS) get around the Fourth Amendment's probhition of unreasonable government searches and seizures by buying access to huge volumes of people’s cell phone location information quietly extracted from smartphone apps. Alfred Ng's [Homeland Security records show ‘shocking’ use of phone data, ACLU says](https://www.politico.com/news/2022/07/18/dhs-location-data-aclu-00046208?ref=thenexusofprivacy.net), on *Politico*, is a good summary. If you're thinking that this is the kind of thing that shouldn't be legal, read on to our next story ... ### [Bipartisan Support for Fourth Amendment is Not For Sale Act at House Judiciary Hearing](https://techpolicy.press/bipartisan-support-for-fourth-amendment-is-not-for-sale-act-at-house-judiciary-hearing/?ref=thenexusofprivacy.net) Justin Hendrix, Tech Policy Press (techpolicy.press) Hendrix' post is a good summary of yesterday's [Digital Dragnets: Examining the Government’s Access to Your Personal Data](https://judiciary.house.gov/calendar/eventsingle.aspx?EventID=4983&ref=thenexusofprivacy.net) House Judiciary hearing. Witnesses Elizabeth Goitein of the Brennan Center, Prof. Rebecca Wexler of UC Berkeley Law, Prof. Sarah Landan of City University of New York School of Law, Brett Tolman of Right on Crime, and former House Judiciary Chair Bob Goodlatte did an excellent job describing government's overwhelming access to data and all the various reasons it's a problem. Democrats and Republicans on the committee all voiced strong support for the Fourth Amendment Is Not For Sale Act, so hopefully it will move forward quickly with a markup. [Here's my live-tweeting](https://twitter.com/NexusOfPrivacy/status/1549393641487179779?ref=thenexusofprivacy.net) (or if you prefer [collected here in a single threadreader page with even more ads and tracking](https://threadreaderapp.com/thread/1549393641487179779.html?ref=thenexusofprivacy.net)). ### [European Commission sued for violating EU’s data protection rules](https://euractiv.com/section/data-protection/news/european-commission-sued-for-violating-eus-data-protection-rules?ref=thenexusofprivacy.net) Luca Bertuzzi on EURACTIV (euractiv.com) The European Commission is to face a lawsuit over allegations it is violating its own data protection rules when transferring citizens’ personal data from one of its websites to the United States. The website for the [Conference of the Future of Europe](https://futureu.europa.eu/?ref=thenexusofprivacy.net) is hosted by Amazon Web Services (AWS), so when people register for the event their IP address gets transferred to the US ... oops! And once people are registered they can log in using their Facebook account ... double oops! The Schrems II ruling bans these kinds of data transfers. ## Privacy After Roe [‘A uniquely dangerous tool’: How Google’s data can help states track abortions](https://www.politico.com/news/2022/07/18/google-data-states-track-abortions-00045906?ref=thenexusofprivacy.net), Alfred Ng on Politico (politico.com) [New CDT Task Force Convenes Tech Companies, Scholars, Advocates to Protect Reproductive Health Information](https://cdt.org/press/new-cdt-task-force-convenes-tech-companies-scholars-advocates-to-protect-reproductive-health-information?ref=thenexusofprivacy.net), Center for Democracy and Technology (cdt.org) [Amazon blocked abortion-related advertising on its platform days after Roe v. Wade was overturned](https://www.businessinsider.com/amazon-blocked-abortion-related-advertising-on-its-platform-2022-7?ref=thenexusofprivacy.net), Katherine Long on Insider (businessinsider.com) ## Federal privacy legislation I'll have a longer update on this after the House Energy & Commerce ADPPA markup, which is currently on recess. For now, a couple of quick links. [House panel set to advance privacy bill, striking a long-awaited grand bargain](https://www.washingtonpost.com/politics/2022/07/20/house-panel-set-advance-privacy-bill-striking-long-awaited-grand-bargain/?ref=thenexusofprivacy.net), Cristiano Lina, Washington Post (washingtonpost.com), with a preview of oday's markup. Our [Twitter moment](https://twitter.com/i/events/1549603839094902784?ref=thenexusofprivacy.net) has a roundup of reactions to the amended version of the ADPPA that was released yesterday. ## And [MEPs to visit Ireland in September over data protection enforcement](https://euractiv.com/section/digital/news/meps-to-visit-ireland-in-september-over-data-protection-enforcement?ref=thenexusofprivacy.net), Luca Bertuzzi on EURACTIV (euractiv.com) [Rosenworcel Probes Mobile Carriers on Data Privacy Practices](https://fcc.gov/document/rosenworcel-probes-mobile-carriers-data-privacy-practices?ref=thenexusofprivacy.net), FCC (fcc.gov) [The FBI Forced A Suspect To Unlock Amazon’s Encrypted App Wickr With Their Face](https://forbes.com/sites/thomasbrewster/2022/07/19/fbi-forces-open-amazon-wickr-app-with-a-suspects-face?ref=thenexusofprivacy.net), Thomas Brewster on Forbes (forbes.com) [How to protect your privacy when using mental health care apps](https://npr.org/2022/07/18/1110699297/betterhelp-talkspace-privacy-data-tips-online-therapy?ref=thenexusofprivacy.net), Shauneen Miranda on NPR (npr.org) [Privacy Talk with Sayid Madar, Head at ADGM Office of the Data Protection Commissioner](https://medium.com/privacy-talk/privacy-talk-with-sayid-madar-head-at-adgm-office-of-the-data-protection-commissioner-what-is-ddd3fd38c9f6?ref=thenexusofprivacy.net) Kohei Kurihara on Privacy Talk (medium.com) [Game Commission hands over evidence in constitutional case on privacy rights](https://post-gazette.com/life/outdoors/2022/07/17/pennsylvania-law-fourth-amendment-game-commission-institute-justice/stories/202207150149?ref=thenexusofprivacy.net), John Hayes on Pittsburgh Post-Gazette (post-gazette.com) [Takeaways from a Congressional Trans-Atlantic Data Flows Briefing](https://rstreet.org/2022/07/19/takeaways-from-a-congressional-trans-atlantic-data-flows-briefing?ref=thenexusofprivacy.net), Addyson Garner on R Street (rstreet.org) [Uber Files leak shows why India’s approach to security and privacy matters](https://theprint.in/opinion/uber-files-leak-shows-why-indias-approach-to-security-and-privacy-matters/1045427?ref=thenexusofprivacy.net), Arvind Gupta on ThePrint (theprint.in) ### Privacy News: July 18 URL: https://thenexusofprivacy.net/privacy-news-july-18/ Last updated: 2022-07-18T19:10:44.000Z ### [UK government introduces Data Protection and Digital Information Bill](https://questions-statements.parliament.uk/written-statements/detail/2022-07-18/hcws210?ref=thenexusofprivacy.net) Matt Warman, Minister for Media, Data and Digital Infrastructure on questions-statements.parliament.uk Now that the United Kingdom has brexited from the European Union, what will happen to their data protection regime? If you were guessing "they'll gut it", you're on the right track. The government's new Data Protection and Digital Information bill was formally introduced today. Last month's [Brace yourselves: new UK data laws are coming](https://www.openrightsgroup.org/blog/brace-yourselves-new-uk-data-laws-are-coming/?ref=thenexusofprivacy.net), by Mariano delli Santi on Open Rights Group's blog, covers some of the many problematic aspects of the bill. **ALSO:** [Establishing a pro-innovation approach to regulating AI](https://gov.uk/government/publications/establishing-a-pro-innovation-approach-to-regulating-ai?ref=thenexusofprivacy.net), from the Department for Digital, Culture, Media & Sport, also released today, outlines an industry-friendly AI regulation approach, although doesn't propose any specific regulation. [UK sets out proposals for new AI rulebook to unleash innovation and boost public trust in the technology](https://gov.uk/government/news/uk-sets-out-proposals-for-new-ai-rulebook-to-unleash-innovation-and-boost-public-trust-in-the-technology?ref=thenexusofprivacy.net) has more. ### [Judges opened a Utahn’s therapy records to her abuser’s lawyer. They should have let her defend her privacy, new ruling says.](https://sltrib.com/news/2022/07/12/judges-opened-utahns-therapy?ref=thenexusofprivacy.net) Jordan Miller on The Salt Lake Tribune (sltrib.com) An appalling story from Utah ... > A Utahwoman accused a family friend of sexually abusing her as a child in Utah County, then saw him convicted of a second-degree felony in 2019. > > Checking on his appeal a yearlater, her attorneys say, she was stunned to see that the Utah Court of Appeals — without a request from anyone, or any notice to her — had opened her sealed counseling records to his defense attorney. The appellate court rejected her request to intervene in the appeal. Now, in a big victory for survivors, the state Supreme Court has reversed that ruling. ### [The Department of Defense Should Disclose When it Purchases User Data](https://eff.org/deeplinks/2022/07/department-defense-should-disclose-when-it-purchases-user-data?ref=thenexusofprivacy.net) Matthew Guariglia on Electronic Frontier Foundation (eff.org) The [Jacobs-Davidson Amendment](https://amendments-rules.house.gov/amendments/JACOCA%5F100%5Fxml220705123456604.pdf?ref=thenexusofprivacy.net) to the National Defense Authorization Act (NDAA), the yearly funding bill for national security and the military, would require the Department of Defense to disclose information about location data and internet metadata when it purchases them. As EFF points out, this is how U.S. military contractors ended up buying the location data of people who used a [prayer app specifically for Muslim users](https://themarkup.org/privacy/2022/01/27/gay-bi-dating-app-muslim-prayer-apps-sold-data-on-peoples-location-to-a-controversial-data-broker?ref=thenexusofprivacy.net). ## Privacy After Roe The House Energy & Commerce Committee has hearing on [Roe Reversal: The Impacts of Taking Away the Constitutional Right to an Abortion](https://energycommerce.house.gov/committee-activity/hearings/hearing-on-roe-reversal-the-impacts-of-taking-away-the-constitutional?ref=thenexusofprivacy.net) Tuesday (July 19) at 7:30 am Pacific (10:30 am Eastern). Witnesses include Renee Bracey Sherman of WeTestify, law professor Leah Litman, Paulina Guerrero of All-Options, and Nisha Verma of Physicians for Reproductive Health. [Editorial: Google must make good on abortion privacy pledge to women](https://mercurynews.com/2022/07/16/editorial-google-must-make-good-on-abortion-pledge-to-women?ref=thenexusofprivacy.net), Mercury News and East Bay Times Editorial Boards on The Mercury News (mercurynews.com) [‘A uniquely dangerous tool’: How Google’s data can help states track abortions](https://politico.com/news/2022/07/18/google-data-states-track-abortions-00045906?ref=thenexusofprivacy.net), Alfred Ng on POLITICO (politico.com) ## Federal privacy legislation Yesterday's post [A “fresh wrench”, two hearings, and a busy week: Federal Privacy Legislation Update, July 17](https://thenexusofprivacy.net/a-fresh-wrench-and-two-hearings/) went into a lot of detail on some of the key points of the American Data Protection and Privacy Act (ADPPA). But a lot's happened since then! ### [Consumer Reports (CR) recommendations for strengthening the American Data Privacy and Protection Act](https://advocacy.consumerreports.org/research/cr-recommendations-for-strengthening-the-american-data-privacy-and-protection-act/?ref=thenexusofprivacy.net) Justin Brookman, Consumer Reports Advocacy (advocacy.consumerreports.org) In widely-awaited comments, the influential non-profit highlights changes they want to see. They focus on several areas: - removing loopholes for advertising, especially the section saying people can't even opt out of data sharing for first-party advertising (§ 204(b)(2), for those of you playing along at home). - strengthening the non-retaliation language if people don't want to share their data. EFF had objected that the discussion draft language here wasn't strong enough. CR notes that it was further weakened in the amended version advanced by the subcommittee. - de-identified data, which Senator Wyden has flagged as a loophole that "make trivially easy to re-identify supposedly anonymous data and put women's privacy at risk." CR again notes changes the subcommittee made that significantly weaken protections. - enforcement, focusing on FTC funding - pre-emption of state laws, which they – like most privacy and civil rights organizations – oppose ### [Ad Groups Urge Overhaul Of Proposed Privacy Bill](https://www.mediapost.com/publications/article/375749/ad-groups-urge-overhaul-of-proposed-privacy-bill.html?ref=thenexusofprivacy.net) Wendy Davis on MediaPost (mediapost.com). “The bill should be amended so that responsible advertising -- the lifeblood of the American economy -- is subject to an opt out." The current version of the bill is mostly opt-out for targeted advertising, although it's opt-in for sharing "sensitive data" and aggregated browsing history (and as discussed above, § 204(b)(2) says that people don't even have the option to opt-out of first-party advertising) ### [ID.me pushes for US-wide privacy legislation | IT PRO](https://itpro.co.uk/business/policy-legislation/368550/idme-pushes-for-us-wide-privacy-legislation?ref=thenexusofprivacy.net) Praharsha Anand on IT Pro (itpro.co.uk). The surveillance-industrial complex continues to push for industry-friendly regulation. Facial recognition company ID.me hasn't yet endorsed any specific legislation, but this could be a signal that they're getting ready to line up behind the , which in its current form would put relatively few restrictions on their activities. The IRS dropped its plans to use ID.me's facial recognition earlier this year after a broad outcry from civil liberties groups, but they're still widely used by other government agencies. > **TAKE ACTION:** [Demand all government agencies stop using ID.me](https://www.dumpid.me/?ref=thenexusofprivacy.net) with this easy web form from Fight for the Future. ### ## And ... ### [FTC Charges Twitter with Deceptively Using Account Security Data to Sell Targeted Ads](https://ftc.gov/news-events/news/press-releases/2022/05/ftc-charges-twitter-deceptively-using-account-security-data-sell-targeted-ads?ref=thenexusofprivacy.net), the Premerger Notification Office Staff on Federal Trade Commission (ftc.gov) [A Privacy Panic Flares Up in India After Police Pull Payment Data from Razorpay](https://wired.com/story/police-pull-indian-payments-data?ref=thenexusofprivacy.net), Varsha Bansal on WIRED (wired.com) [Wearable devices present significant security and privacy risks](https://mugglehead.com/1366408-2-privacy-and-security?ref=thenexusofprivacy.net), Joseph Morton on Mugglehead Magazine (mugglehead.com) [Alberta names Diane McLeod as new privacy commissioner](https://canadianlawyermag.com/practice-areas/privacy-and-data/alberta-names-diane-mcleod-as-new-privacy-commissioner/368240?ref=thenexusofprivacy.net), Katrina Eñano on Canadian Lawyer (canadianlawyermag.com) [Facial Recognition Search Engine Pulls Up “Potentially Explicit” Photos of Kids](https://theintercept.com/2022/07/16/facial-recognition-search-children-photos-privacy-pimeyes?ref=thenexusofprivacy.net), Mara Hvistendahl on The Intercept (theintercept.com) [EU Privacy Regulators Are Scrutinizing Data Flows to Russia](https://wsj.com/articles/eu-privacy-regulators-are-scrutinizing-data-flows-to-russia-11657826124?ref=thenexusofprivacy.net), Catherine Stupp on The Wall Street Journal (wsj.com) [Israel’s Facebook Bill: An attack on Palestinian free speech](https://english.alaraby.co.uk/opinion/israels-facebook-bill-attack-palestinian-free-speech?ref=thenexusofprivacy.net), Nadim Nashif on The New Arab (english.alaraby.co.uk) [Propagation of societal gender inequality by internetsearch algorithms](https://pnas.org/doi/epdf/10.1073/pnas.2204529119?ref=thenexusofprivacy.net), Madalina Vlasceanua and David M. Amodio on pnas.org [Data Protection Commission urged to act over alleged illegal retention of data](https://irishtimes.com/ireland/2022/07/16/data-protection-commission-urged-to-act-over-alleged-illegal-retention-of-data?ref=thenexusofprivacy.net), Mary Carolan on The Irish Times (irishtimes.com) [Could there be Trouble in Paradise for Match Group, Inc.?](https://natlawreview.com/article/could-there-be-trouble-paradise-match-group-inc?ref=thenexusofprivacy.net), Danielle M. DeFilippis on The National Law Review (natlawreview.com) [Six Questions to Ask Before Accepting a Surveillance Technology](https://aclu.org/news/privacy-technology/six-questions-to-ask-before-accepting-a-surveillance-technology?ms=220716%5Fblog%5Ftw&ms%5Faff=nat&ms%5Fchan=soc&ref=thenexusofprivacy.net), Jay Stanley on American Civil Liberties Union (aclu.org) [2015 National Book Festival $450K receipt privacy class action settlement](https://topclassactions.com/lawsuit-settlements/open-lawsuit-settlements/2015-national-book-festival-450k-receipt-privacy-class-action-settlement?fb%5Fref=lTJhFxvZqg-Twitter&ref=thenexusofprivacy.net), Top Class Actions (topclassactions.com) [Governing the Datafication of Black Lives](https://cigionline.org/articles/governing-the-datafication-of-black-lives?ref=thenexusofprivacy.net), Mutale Nkonde on cigionline.org [Google hit with $971k sanction for litigation misconduct in privacy suit](https://reuters.com/legal/transactional/google-hit-with-971k-sanction-litigation-misconduct-privacy-suit-2022-07-15?ref=thenexusofprivacy.net), Mike Scarcella on Reuters (reuters.com) --- *Image credit:* Daquella manera on [Flickr ](https://www.flickr.com/photos/62518311@N00/466172168?ref=thenexusofprivacy.net) via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons Attribution 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net) license. ### A "fresh wrench", two hearings, and a busy week: Federal Privacy Legislation Update, July 17 URL: https://thenexusofprivacy.net/a-fresh-wrench-and-two-hearings/ Last updated: 2026-04-15T22:53:54.000Z With Congress in session for just a few more weeks before their next recess, this will be a busy week on the privacy legislation front. It starts with two important hearings on Tuesday. - At 7:00 am Pacific time (10 am Eastern), the House Judiciary Committee's hearing on [Digital Dragnets: Examining the Government's Access to Your Personal Data](https://judiciary.house.gov/calendar/eventsingle.aspx?EventID=4983&ref=thenexusofprivacy.net) discusses the The Fourth Amendment Is Not For Sale Act, which prohibits data brokers from selling their data to government agencies. > **TAKE ACTION:** [Tell Congress: The Fourth Amendment is Not For Sale](https://act.eff.org/action/tell-congress-the-fourth-amendment-is-not-for-sale?ref=thenexusofprivacy.net) using EFF's handy web form - And at 7:30 am Pacific (10:30 am Eastern) Tuesday, the House Energy & Commerce Committee has a hearing , on [Roe Reversal: The Impacts of Taking Away the Constitutional Right to an Abortion](https://energycommerce.house.gov/committee-activity/hearings/hearing-on-roe-reversal-the-impacts-of-taking-away-the-constitutional?ref=thenexusofprivacy.net). Danielle Citron's [The End of Roe Means We Need a New Civil Right to Privacy](https://slate.com/technology/2022/06/end-roe-civil-right-intimate-privacy-data.html?ref=thenexusofprivacy.net) discusses the role of the Rep. Sara Jacbos' My Body My Data Act and the Warren/Wyden/Murray Health and Location Data Privacy Act in a post-Roe world. > **TAKE ACTION: Tell Congress to** [**Pass the “My Body, My Data” Act**](https://act.eff.org/action/pass-the-my-body-my-data-act?ref=thenexusofprivacy.net) House Energy & Commerce is also working on the American Protection and Privacy Act (ADPPA) consumer privacy bill. **UPDATE*: ADPPA markup is scheduled for* [*Energy & Commerce's Wednesday morning session*](https://energycommerce.house.gov/committee-activity/markups/markup-of-six-bills-full-committee?ref=thenexusofprivacy.net)*, which starts at 6:45 am Pacific time (9:45 am Eastern).* They had originally planned to release a new version early last week and then have a markup session. But it didn't work out that way. > BREAKING: In a totally unexpected (yeah right) turn of events, California Dems are demanding that bipartisan, bicameral ADPPA privacy bill doesn't pre-empt California law!!!!!!! > > Who would have predicted? > > Other than me and anybody else paying attention ... 1/7 [https://t.co/ZRBgqbeJH5](https://t.co/ZRBgqbeJH5?ref=thenexusofprivacy.net) > > — Jon Pincus (@jdp23) [July 14, 2022](https://twitter.com/jdp23/status/1547437702785613824?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) As Maria Curi reports in [California Democrats Demand Stronger Privacy Protection Bill](https://about.bgov.com/news/california-democrats-push-for-stronger-privacy-protection-bill/?ref=thenexusofprivacy.net) on Bloomberg Government: > Momentum has gathered behind a bipartisan, bicameral effort to pass a federal privacy law ([H.R. 8152](https://www.bgov.com/core/legislation/federal/bills/?ref=thenexusofprivacy.net#!/7112097912665407528)).... > > But as the committee gears up to hold a vote next week, a fresh wrench has been thrown in the bill’s path. California Democrats want to make sure the federal standard doesn’t weaken their state law by taking precedent over it. Oh no!!!!!!! A "fresh wrench" destroying the bipartisan, bicameral "momentum"! Take it with a grain of salt. Yes, preemption is a real issue – in general, and specifically for California. Rep. Anna Eshoo (who represents a large portion of Silicon Valley) was very clear about this at ADPPA's first hearing in mid-June: "Federal privacy legislation cannot undermine California's privacy laws." But a "fresh wrench" it's not. ## Lobbyists gonna lobby ... > Oh good grief. Worth noting with Leibowitz’s FTC credentials he had a role in throwing out the only strong federal privacy rules for the internet (written by Obama’s FCC). He also took flights to California to testify against the relevant and strong California privacy law. So Um. [https://t.co/vPle50rAma](https://t.co/vPle50rAma?ref=thenexusofprivacy.net) [pic.twitter.com/8oLxwbMtB2](https://t.co/8oLxwbMtB2?ref=thenexusofprivacy.net) > > — Jason Kint (@jason\_kint) [July 14, 2022](https://twitter.com/jason%5Fkint/status/1547698701493084163?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) What's really going on here? The quote from "former FTC chair" Jon Leibowitz arguing that the federal law is better than California's provides a clue. As the article *doesn't* mention, Leibowitz is now an industry lobbyist. 2015's [The ‘Privacy Coalition’ That Wants to Trim Data Regulations for Telecom Giants](https://www.theatlantic.com/politics/archive/2015/05/the-privacy-coalition-that-wants-to-trim-data-regulations-for-telecom-giants/456477/?ref=thenexusofprivacy.net) and 2017's [California’s Internet Privacy Legislation Being Undermined by Industry-Funded Privacy Group](https://stopthecap.com/2017/07/19/californias-internet-privacy-legislation-undermined-industry-funded-privacy-group/?ref=thenexusofprivacy.net) have more about the 21st Century "Privacy" Coalition he co-founded, with funding from Comcast, AT&T, Verizon, Time Warner Cable/Charter Communications, DirecTV. Leibowitz talked about his strategy for getting industry-friendly legislation in a February Wall Street Journal opinion piece [How Congress Can Protect Your Data Privacy](https://www.wsj.com/articles/congress-can-protect-our-data-consumer-privacy-bipartisan-personal-information-regulations-online-security-ftc-cybersecurity-11644871937?ref=thenexusofprivacy.net) (which also didn't mention that he's a lobbyist): > Pass a federal law stronger than any of the existing state laws and pre-empt only direct conflicts. That is easily achievable because the three state laws that have passed—in Virginia, Colorado and California—are either weak or riddled with loopholes. Even the strongest of the trio, California’s, largely limits only the transferring of data and not its collection. In other words, pass something just a bit stronger – but still filled with loopholes – federally, and preempt future stronger laws. Todd Feathers reported on this strategy in 2021's [Big Tech Is Pushing States to Pass Privacy Laws, and Yes, You Should Be Suspicious](https://themarkup.org/privacy/2021/04/15/big-tech-is-pushing-states-to-pass-privacy-laws-and-yes-you-should-be-suspicious?ref=thenexusofprivacy.net) on *The Markup*. Feathers' and Alfred Ng's 2022 [Tech Industry Groups Are Watering Down Attempts at Privacy Regulation, One State at a Time](https://themarkup.org/privacy/2022/05/26/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time?ref=thenexusofprivacy.net), also on *The Markup*, has more discussion. And here in Washington state, Big Tech also used the strategy of comparing the Bad Washington Privacy Act favorably to weak state legislation as a way of shifting the conversation away from the bills weaknesses.\* ## That escalated quickly > "A memo comparing the measures prepared by three prominent nonprofits and shared with The Technology 202 argues that the federal bill’s consumer protections are equal to or better than the California law in a vast majority of areas." [https://t.co/ywuWC7frF2](https://t.co/ywuWC7frF2?ref=thenexusofprivacy.net) > > — EPIC (@EPICprivacy) [July 15, 2022](https://twitter.com/EPICprivacy/status/1547937257486630916?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) The very next day, Cristiano Lima's [Federal privacy bill trumps California’s law, advocates say](https://www.washingtonpost.com/politics/2022/07/15/federal-privacy-bill-trumps-californias-law-advocates-say/?ref=thenexusofprivacy.net) followed up on Leibowitz' talking point. > "Privacy and civil rights advocates are pushing back on criticisms from California officials that a federal privacy bill would weaken protections in the state, arguing that the bipartisan measure recently unveiled in Washington is even stronger than California’s landmark law." Lima included quotes from Alan Butler of EPIC Privacy and David Brody of Lawyers' Committee on Civil Rights highlighting ways in which the ADPPA is stronger than California's CPRA. He also links out to a nicely-designed side-by-side (from EPIC, Lawyers' Committee, and Center for Democracy and Technology (CDT)) with more details. They sure turned that around fast! It's almost like they expected this "fresh wrench" and had their talking points and collateral ready to go. So despite the concerns about lost "momentum", the short-term result was a great news cycle for ADPPA supporters. The main message people in DC heard going into the weekend is that privacy and civil rights advocates are defending ADPPA and saying it's "even stronger" than California's. And then over the weekend, [Future of Privacy Form Senior Fellow Omer Tene](https://twitter.com/omertene/status/1548690418828730370?ref=thenexusofprivacy.net) and ["thought leader" Cameron Kerry of Brookings](https://twitter.com/cam%5Fkerry/status/1548556394953310209?ref=thenexusofprivacy.net) chimed in with threads reinforcing the talking point that ADPPA is stronger than California's law. From industry's perspective, this a much better conversation to be having have than other thornier issues – for example, the concerns that Wyden and others have raised that [ADPPA “unfortunately would not do enough to protect fundamental rights of a woman over her own body and her privacy”](“unfortunately would not do enough to protect fundamental rights of a woman over her own body and her privacy.”). ## ## Just how strong *is* ADPPA's enforcement? But regardless of whether or not ADPPA is or isn't stronger than California's law, are its enforcement provisions strong enough to protect us and our data? Here's some of the issues that privacy and civil rights advocates have highlighted: - EFF, Common Sense and other groups have questioned whether the ADPPA gives the FTC the funding and authority it needs to enforce it. **UPDATE*: Consumer Reports also highlights this concern in their* [*July 17 letter*](https://advocacy.consumerreports.org/wp-content/uploads/2022/07/CR-letter-to-EC-re-ADPPA-AINS.pdf?ref=thenexusofprivacy.net)*.* - Public Knowledge discusses how the ADPPA [undercuts FCC enforcement authority](https://publicknowledge.org/public-knowledge-applauds-bipartisan-privacy-efforts-cautions-congress-must-fix-fcc-authority-concerns-before-full-committee-markup/?ref=thenexusofprivacy.net) - Maine's AG says [ADPPA in its current form would set a ceiling below the state's legislation that protects consumers against abuse by Internet Service Providers](https://www.eff.org/document/2022-07-13-letter-maine-ag-congress-re-adppa?ref=thenexusofprivacy.net) (like the ones funding the 21st Century Privacy Coalition). - Privacy and civil rights advocates at Electronic Frontier Foundation and Disinfo Defense League groups including Media Justice, Access Now, Free Press, Common Cause, Muslim Advocates, Kairos Action, and Asian Americans Advancing Justice all oppose federal preemption of state privacy laws. **UPDATE*: Consumer Reports does too.* - The ADPPA's private right of action won't even exist for four years. Even then is limited, so doesn't cover violations of the data minimizaiton requirements. It doesn't include statutory damages. It puts up significant barriers that mean people have to "[jump through arbitrary, drawn-out hoops](https://www.washingtonpost.com/politics/2022/06/27/abortion-ruling-could-scramble-data-privacy-talks/?ref=thenexusofprivacy.net)" to sue. And ADPPA's right to cure is a get-out-of-jail free card for most businesses with an annual revenue up to $41 million/year.\*\* And a July 1 memo from California Privacy Protection Agency (CPPA) says that [the ADPPA takes away nearly all of their enforcement authority](https://aboutbgov.com/3XA?ref=thenexusofprivacy.net): > \[W'hile ADPPA states that a State Privacy Authority can take civil action to enforce the ADPPA, the definition of state privacy authority does not adequately identify the CPPA, nor can the Agency take civil action, since it has administrative enforcement authority only. So on top of all the other isues, the bill in its current form takes away nearly all the enforcement authority of the country's largest and best-funded state privacy agency. Put it all together and ... well, your mileage may vary, but as of right now ADPPA's "strong enforcement" looks pretty darned weak to me. I can certainly see why its supports would rather be talking about whether or not it's better than California's law. ## What next on preemption? It could well be that Leibowitz et. al. are just posturing, and the industry plan is to demand concessions on other fronts in return for a "compromise" on preemption: add California's privacy law to the already-long list of preemption exceptions, give the California Privacy Protection Agency the authority they need, and hangs Maine, Washington, and all the other states that also don't want to be preempted out to dry. Then again, maybe they'll make some minor improvements in the ADPPA to address the CPPA's concerns, after which California's legislators can say they've fought for Californians' privacy rights and are now willing to "compromise" for the good of the country and go along with something preemptive. Either one of thse approaches will let ADPPA's supporters talk about how this dramatic "compromise" has restored the bill's "momentum," and how now's the best time to make further "compromises" to push it over the finish line. They'd also put pressure on Senate Commerce Chair Maria Cantwell, who's been pushing to get state preemption completely removed, to "compromise" and settle for something that protects Californians but not Washingtonians. But it might not work out that way. Most privacy advocates will continue to press to remove all state preemption. Republicans contine to press to remove ADPPA's current preemption exceptions and make the bill fully preemptive. So another short-term option, probably the path of least resistance, is to keep punting on resolving this issue, and instead hold it open so that they can try to keep the conversation focused on comparing the ADPPA to the GDPR. We shall see. > **TAKE ACTION: If you're on Twitter, like or retweet** [**the Maine AG's concerns about preemption**](https://twitter.com/EFF/status/1547633335249211392?ref=thenexusofprivacy.net) **and my tweet asking Washington Democratic members of Congress to** [**follow California Democtrats' lead and fight for their constituents' privacy rights by removing ADPPA's state preemption**](https://twitter.com/jdp23/status/1547643103846141956?ref=thenexusofprivacy.net) ## What else to look for in the markup Preemption is only one part of the overall enforcement picture. When the new version of ADPPA drops, will it actually give CCPA the authority it needs? Will it clarify FTC funding and authority? Will it stop undercutting the FCC? Will the private right of action improve – or be further weakened? And enforcement's only the tip of the iceberg. There's also the [elephant in the room](https://thenexusofprivacy.net/talking-about-the-elephant/): how far will the new version go to address concerns that [ADPPA “does not adequately protect against” the privacy threats posed by a post-*Roe* world?](https://www.washingtonpost.com/politics/2022/07/15/federal-privacy-bill-trumps-californias-law-advocates-say/?ref=thenexusofprivacy.net) Wyden's statement to the Washington Post focused on the deidentified data loophole, which he says would "make trivially easy to re-identify supposedly anonymous data and put women's privacy at risk."\*\*\* And there are also a lot of other loopholes that put people seeking or providing abortions at risk. **UPDATE:** [*Consumer Reports' letter*](https://advocacy.consumerreports.org/wp-content/uploads/2022/07/CR-letter-to-EC-re-ADPPA-AINS.pdf?ref=thenexusofprivacy.net) *has an excellent discussion of how the subcommittee's amendment weakened the deidentified data language, starting at the bottom of page 4.* A few other issues I'm following closely: - The subcommittee's markup added new exemptions, including one for companies who are collecting, processing, or transferring data on behalf of government agencies (an approach the military uses this approach to surveil Muslims and ICE uses to target immigrants). Will any of these changes get undone in the committee markup? Or will there be some other new exemptions? - The algorithmic auditing section still falls short of the much stronger provisions in the Automated Accountability Act of 2020 and [the Algorithmic Justice League's "Who Audits the Auditors?" recommendations](https://thenexusofprivacy.net/ajl-audits-the-auditors/). How much will the new version improve the language? - The subcommittee's markup also removed race, religion, ethnicity, and union membership from the list of "sensitive data," so it no longer requires opt-in consent to be shared, sold, or used for some purpose other than it was collected for. What does "sensitive data" even *mean* if race and religion aren't considered sensitive? Once the new version drops, there will be a flurry of activity as everybody analyzes it to see what's changed – there's only a short window of time to provide feedback to committee members before the markup session. From there, Cobun Zweifel-Keegan of IAPP has [an excellent thread describing the markup process](https://twitter.com/cobun/status/1539966259424534528?ref=thenexusofprivacy.net); it ends with the committee voting on an amended version of the bill. If the committee advances it, then ADPPA's next stop will probably be the House floor. Stay tuned! \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \* A few examples: - Microsoft Chief Privacy Officer Julie Brill described the 2019 version of Bad Washington Privacy Act (Bad WPA) as the "strongest set of privacy protections in the United States" and included a paragraph on "robust enforcement" in [her post on Microsoft's blog](https://blogs.microsoft.com/on-the-issues/2019/04/29/our-support-for-meaningful-privacy-protection-through-the-washington-privacy-act/?ref=thenexusofprivacy.net). - Brill's 2020 post on how the new version of the Bad Washington Privacy Act ["raises the bar for privacy in the United States](https://blogs.microsoft.com/on-the-issues/2020/01/24/washington-privacy-act-protection/?ref=thenexusofprivacy.net)" also talked about "strong enforcement" – even though the AG had said the law was unenforceable. - In 2021, [a disinformation-filled "quick summary" document industry lobbyists circulated](https://docs.google.com/document/d/1QCxJ6546vd-HieHqkYc2jWPK62YF3LA1/edit?ref=thenexusofprivacy.net) started by asserting "The Bad Washington Privacy Act, if passed, will be the strongest consumer data privacy in the nation." - From 2021's [Criticism and praise for at the hearing for SB 5062 (the Bad Washington Privacy Act)](https://jedii.tech/criticism-and-praise-for-at-the-hearing-for-sb-5062-the-bad-washington-privacy-act/?ref=thenexusofprivacy.net): > The Washington Technology Industry Association talked about the "strong privacy protections" in the bill. The CEO of a Seattle online gaming company lauded its "very strong privacy protections for consumers." Microsoft described it as "the strongest privacy protections in the US." - In 2022, [Washington Tech Industry Association lobbyist Michael Schutzler's misleading Seattle Times opinion piece](https://docs.google.com/document/d/15j85dDtc%5FOWC2F6NPdR39C%5FjLC7FISURfGQc59ii4Ms/edit?ref=thenexusofprivacy.net) said the Bad WPA would have been "the country's strongest privacy bill." Hey wait a second, I'm noticing a pattern here. \*\* California's CPRA doesn't have a private right of action at all for most violations, so rather than focusing on the enforcement questions in general, the EPIC/Lawyers' Committee/CDT side-by-side shows ADPPA's eventual weak, and cumbersome private right of action as a *plus* because it's better than nothing. It's a great example of how useful it is for industry when the focus is on comparisons to other weak bills rather than the more important question of whether the ADPPA will actually address the problems it claims to. \*\*\* In the same article, EPIC's Alan Butler reassures us that there's nothing to worry about because ADPPA's restrictions on de-identified data are "extremely strict,” but then again he also said that ADPPA has stronger enforcement than it's getting credit for, so without having delved into the details my guess is that Wyden's right. *UPDATE, 7/19:* Wyden's right. See Consumer Reports' [letter](https://advocacy.consumerreports.org/wp-content/uploads/2022/07/CR-letter-to-EC-re-ADPPA-AINS.pdf?ref=thenexusofprivacy.net). *UPDATE, 7/25:* it's possible that Butler was talking about the version of the bill that was getting negotiated at the time, because the amended version the committee voted on undid the harmful subcommittee changes to decentralized data that Consumer Reports had discussed. However, according to Tonya Riley's reporting [Federal privacy legislation progresses, but concerns about data brokers loom](https://cyberscoop.com/privacy-data-brokers-house-ftc-commerce?ref=thenexusofprivacy.net), these improvements do not appear to have fully addressed Wyden's concerns. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ *Image credit:* JessicaRodriguezRivas, via [Wikipedia Commons](https://commons.wikimedia.org/wiki/File:Home%5Fof%5Fthe%5FUS%5FCongress.jpg?ref=thenexusofprivacy.net). licensed under the [Creative Commons](https://en.wikipedia.org/wiki/en:Creative%5FCommons?ref=thenexusofprivacy.net)[Attribution-Share Alike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net) license. ### Privacy News: July 16 URL: https://thenexusofprivacy.net/privacy-news-july-16/ Last updated: 2022-07-16T18:18:40.000Z ### [California Democrats Demand Stronger Privacy Protection Bill ](https://about.bgov.com/news/california-democrats-push-for-stronger-privacy-protection-bill?ref=thenexusofprivacy.net) Maria Curi on Bloomberg Government (about.bgov.com) The bipartisan, bicameral ADPPA federal consumer privacy bill's markup session, originally scheduled for last Thursday, has been postponed until next week. California Democrats are callling on the House Energy and Commerce Committee to ensure a leading privacy bill doesn’t undermine their state law. I'll have a longer federal privacy update in the next couple of days. For now, check out [my snarky (yet hopefully insightful) Twitter thread](https://twitter.com/jdp23/status/1547437702785613824?ref=thenexusofprivacy.net) has more. **WORTH HIGHIGHTING**: Curi's quotes former FTC Chair Jon Leibowitz , but doesn't mention that he's is now a lobbyist. Leibowitz' lobbying also wasn't mentioned in his recent Wall Street Journal op-ed. Funny how that works. From 2015, [The ‘Privacy Coalition’ That Wants to Trim Data Regulations for Telecom Giants](https://www.theatlantic.com/politics/archive/2015/05/the-privacy-coalition-that-wants-to-trim-data-regulations-for-telecom-giants/456477/?ref=thenexusofprivacy.net) has more about the 21st Century "Privacy" Coalition Leibowitz co-founded. **FOLLOW UP**: Cristiano Lina's [Federal privacy bill trumps California’s law, advocates say](https://www.washingtonpost.com/politics/2022/07/15/federal-privacy-bill-trumps-californias-law-advocates-say/?ref=thenexusofprivacy.net), includes perspectives from supporters of the ADPPA. Industry used this same trick in Washington state, trying to get people to focus on comparing the Bad Washington Privacy Act to weaker bills in other states. It's true that ADPPA has important clauses like a civil rights protections that are not in today's California privacy bill; but states, including California, should still be able to have their own legislation that provides even stronger protections to their residents. ### [Tell Tech Reviewers: Rescind Amazon Ring Recommendations](https://www.rescindring.com/?ref=thenexusofprivacy.net) Fight for the Future on Rescind Ring (rescindring.com) As [Senator Markey’s probe into Amazon Ring](https://www.markey.senate.gov/news/press-releases/senator-markeys-probe-into-amazon-ring-reveals-new-privacy-problems?ref=thenexusofprivacy.net) and stories like Sara Morrison's [Amazon’s Ring privacy problem is back](https://vox.com/recode/23207072/amazon-ring-privacy-police-footage?ref=thenexusofprivacy.net) and Ashley Belanger's [Amazon finally admits giving cops Ring doorbell data without user consent](https://arstechnica.com/tech-policy/2022/07/amazon-finally-admits-giving-cops-ring-doorbell-data-without-user-consent?ref=thenexusofprivacy.net) highlight, Amazon Ring doorbell cameras exacerbate racial profiling and privacy violations. But tech reviewers continue to recommend Ring. Fight for the Future is trying to do something about it. > Reviewers have a responsibility to protect the public from unsafe products. That’s why they’ve retracted reviews for strollers that harm children and devices that catch on fire. But in addition to considering how products impact consumers, reviewers should evaluate the impact on society as a whole. It’s time for reviewers to rescind their endorsement of these products. **TAKE ACTION:** Call on tech reviewers to withdraw their endorsement of Amazon Ring devices using [Fight for the Future's handy web form](https://www.rescindring.com/?ref=thenexusofprivacy.net). ## Privacy after Roe [Your phone could be used against you in an abortion case | CNN Politics](https://cnn.com/2022/07/16/politics/abortion-data-what-matters/index.html?ref=thenexusofprivacy.net), an interview with Albert Fox-Cahn of Surveillance Technology Oversight Project, Zachary B. Wolf on CNN (cnn.com) [What You Need to Know About Period Tracker Apps and Privacy Post Roe](https://teenvogue.com/story/do-period-tracker-apps-put-your-privacy-at-risk-post-roe-v-wade?ref=thenexusofprivacy.net), Megan McGibney on Teen Vogue (teenvogue.com) [The Surveillance Threat After Roe Is Worse Than You Think](https://washingtonmonthly.com/2022/07/15/the-surveillance-threat-after-roe-is-worse-than-you-think?ref=thenexusofprivacy.net), an interview with data broker expert Justin Sherman of Duke University by Will Norris on Washington Monthly (washingtonmonthly.com) ## And ... [Healthcare Provider Exposed Transplant Donor and Recipient Data](https://infosecurity-magazine.com/news/healthcare-provider-transplant-data?ref=thenexusofprivacy.net), Danny Bradbury on Infosecurity Magazine (infosecurity-magazine.com) **FIND OUT MORE**: [databreaches.net](https://www.databreaches.net/?ref=thenexusofprivacy.net) is a great source for regular stories about databreaches. [‘Europe’s health data reuse plan needs some privacy surgery’](https://techcrunch.com/2022/07/15/european-health-data-space-edpb-edps-opinion?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com) [Which CJEU data protection cases are currently pending?](https://gdprbeetle.eu/which-cjeu-data-protection-cases-are-currently-pending?ref=thenexusofprivacy.net), Joost Gerritsen on GDPR Beetle (gdprbeetle.eu) [Lawyers say ‘a lack of clarity’ in drone laws is a threat to privacy](https://abc.net.au/news/2022-07-14/qld-drone-brisbane-peeping-tom-stalking-legislation-policy/101227560?ref=thenexusofprivacy.net), Lexy Hamilton-Smith on ABC News (abc.net.au) [Meta’s first human rights report is largely self-congratulatory](https://techcrunch.com/2022/07/14/metas-first-human-rights-report-is-largely-self-congratulatory?ref=thenexusofprivacy.net), Kyle Wiggers on TechCrunch (techcrunch.com) [UK’s data privacy watchdog sets out three-year plan to deal with ‘increasing demand and shrinking resources’](https://news.sky.com/story/uks-data-privacy-watchdog-sets-out-three-year-plan-to-deal-with-increasing-demand-and-shrinking-resources-12651400?ref=thenexusofprivacy.net), Alexander Martin on Sky (news.sky.com) [Children’s Online Safety Bills Advance in California](https://natlawreview.com/article/children-s-online-safety-bills-advance-california?ref=thenexusofprivacy.net), Gretchen A. Ramos on The National Law Review (natlawreview.com) [Clearview AI fined $20 million, banned from processing biometric data in Greece after GDPR violations](https://therecord.media/clearview-ai-fined-20-million-banned-from-processing-biometric-data-in-greece-after-gdpr-violations?ref=thenexusofprivacy.net), Jonathan Greig on The Record by Recorded Future (therecord.media) [Is There a Right to Privacy of Thought? (with Nita Farahany)](https://cafe.com/stay-tuned/is-there-a-right-to-privacy-of-thought-with-nita-farahany?ref=thenexusofprivacy.net) CAFE on CAFE (cafe.com) [Consumer data is the next virtual currency](https://venturebeat.com/2022/07/14/consumer-data-is-the-next-virtual-currency?ref=thenexusofprivacy.net), Sam Mallikarjunan, OneScreen.ai on VentureBeat (venturebeat.com) ### Privacy News: July 13 URL: https://thenexusofprivacy.net/privacy-news-july-13-2/ Last updated: 2022-07-13T17:57:16.000Z ### [Surveillance critics blast SF police ‘power grab’](https://missionlocal.org/2022/07/surveillance-critics-blast-police-private-cameras?ref=thenexusofprivacy.net) Eleni Balakrishnan on Mission Local (missionlocal.org) San Francisco was the first city to pass a law regulating government use of facial recognition. More recently, though, Mayor London Breed has been pushing to roll back protections; and she's just appointed a new "tough on crime" DA. Now, the SFPD is proposing a dangerous new surveillance program that would let them live-monitor private security cameras all over town, including residential Ring and Nest doorbells. The Rules Committee took public comments at their meeting last Monday, and is expected to vote next week. **TAKE ACTION**: If you're in San Francisco, [Fight SFPD’s Surveillance Grab](https://action.aclu.org/send-message/fight-sfpds-surveillance-grab?ref=thenexusofprivacy.net) using this form from ACLU of Northern California – or just call your supervisor and tell them to oppose SFPD's proposed policy to obtain sweeping access to private surveillance cameras. **SEE ALSO:** [Breed and New DA Jenkins Pushing Hard to Expand Police Access to Private Security Cameras All Over Town](https://sfist.com/2022/07/11/breed-and-new-da-jenkins-pushing-hard-to-expand-police-access-to-private-security-cameras-all-over-town?ref=thenexusofprivacy.net), Joe Kukura on SFist (sfist.com) ### [Senator Markey’s Probe into Amazon Ring Reveals New Privacy Problems](https://www.markey.senate.gov/news/press-releases/senator-markeys-probe-into-amazon-ring-reveals-new-privacy-problems?ref=thenexusofprivacy.net) Senator Ed Markey on congress.gov Amazon's response to a letter Senator Markey sent last month "highlights the close relationship between Ring and law enforcement, including the proliferation of policing agencies on the Ring platform". [Thousands of police departments use the Neighbors Public Safety System](https://www.govtech.com/biz/data/neighbors-app-usage-grows-among-police-fire-departments?ref=thenexusofprivacy.net), allowing them to request data from Ring users. Amazon also shared data with law enforcement without the owners consent eleven times last year, when the company "made a good-faith determination that there was an imminent danger of death or serious physical injury to a person". Zack Whittaker's [Amazon’s Ring gave a record amount of doorbell footage to the government in 2021](https://techcrunch.com/2022/07/13/amazon-ring-video-footage-government?ref=thenexusofprivacy.net) on TechCrunch delves into Amazon's transparency reports. Law enforcement demands for Ring data, mostly in the form of search warrants, increased 65% last year. ### [TikTok pauses policy switch in Europe after privacy scrutiny](https://techcrunch.com/2022/07/12/tiktok-pauses-privacy-policy-switch?ref=thenexusofprivacy.net) Natasha Lomas on TechCrunch (techcrunch.com) TikTok planned to introduce a privacy policy update in Europe which would have stopped asking users for their consent to be tracked to receive targeted advertising. Last week, Access Now sent open letters to[ TikTok](https://www.accessnow.org/tiktok-personalised-ads-letter?ref=thenexusofprivacy.net) to immediately halt these invasive changes, and to [the European Data Protection Board](https://www.accessnow.org/tiktok-edpb-personalised-ads-letter?ref=thenexusofprivacy.net) and its members to intervene. [Italy's Data Protection Agency quickly issued a formal warning to TikTok](https://techcrunch.com/2022/07/11/tiktok-privacy-switch-warning-italy?ref=thenexusofprivacy.net). DPAs in Ireland and Spain also engaged with TikTok. Now, the company's annouced plans are on hold. ### ## Privacy after Roe [FTC says it will crack down on medical and location data sharing after abortion privacy concerns](https://theverge.com/2022/7/11/23204414/ftc-medical-location-health-data-enforcement-roe-privacy?ref=thenexusofprivacy.net), Corin Faife on The Verge (theverge.com). The FTC's announcement is at [Location, health, and other sensitive information: FTC committed to fully enforcing the law against illegal use and sharing of highly sensitive data](https://ftc.gov/business-guidance/blog/2022/07/location-health-other-sensitive-information-ftc-committed-fully-enforcing-law-against-illegal-use?ref=thenexusofprivacy.net). [PlanCPills.org: Abortion pill site shares data with Facebook, Google](https://protocol.com/policy/plan-c-trackers?ref=thenexusofprivacy.net), Issie Lapowsky on Protocol (protocol.com) [In a Post-Roe World, the Future of Digital Privacy Looks Even Grimmer](https://nytimes.com/2022/07/13/technology/personaltech/abortion-privacy-roe-surveillance.html?ref=thenexusofprivacy.net), Natasha Singer and Brian X. Chen on NYTimes (nytimes.com) [Facebook Has Been Targeting Users Who Visited Pregnancy Center Sites – How Could That Data Be Used?](https://forbes.com/sites/petersuciu/2022/07/10/facebook-has-been-targeting-users-who-visited-pregnancy-center-sites--how-could-that-data-be-used?ref=thenexusofprivacy.net), Peter Suciu on Forbes (forbes.com) [Privacy advocates fear Google will be used to prosecute abortion seekers](https://npr.org/2022/07/11/1110391316/google-data-abortion-prosecutions?ref=thenexusofprivacy.net), Bobby Allyn on NPR (npr.org) ## And ... [A big success for Homo Digitalis: The Hellenic DPA fines CLEARVIEW AI with €20 million](https://homodigitalis.gr/en/posts/12155?ref=thenexusofprivacy.net), Homo digitalis (homodigitalis.gr) [FTC Calls for Research Presentations for PrivacyCon 2022](https://ftc.gov/news-events/news/press-releases/2022/05/ftc-calls-research-presentations-privacycon-2022?ref=thenexusofprivacy.net), the Premerger Notification Office Staff on Federal Trade Commission (ftc.gov) [“Save the GDPR”: our message to the European Commission](https://accessnow.org/european-commission-save-the-gdpr?ref=thenexusofprivacy.net), Estelle Massé on Access Now (accessnow.org) [UK Bill of Rights set to undermine UK\_GDPR and Adequacy](https://amberhawk.typepad.com/amberhawk/2022/07/uk-bill-of-rights-set-to-undermine-uk%5Fgdpr-and-adequacy.html?ref=thenexusofprivacy.net) on Hawktalk (amberhawk.typepad.com) [How to Disable Ad ID Tracking on iOS and Android, and Why You Should Do It Now](https://eff.org/deeplinks/2022/05/how-disable-ad-id-tracking-ios-and-android-and-why-you-should-do-it-now?ref=thenexusofprivacy.net), Bennett Cyphers on Electronic Frontier Foundation (eff.org) [Meta may be forced to suspend services in Europe over data transfer concerns](https://thedrum.com/news/2022/07/08/meta-may-be-forced-suspend-services-europe-over-data-transfer-concerns-and-it-may?ref=thenexusofprivacy.net), Kendra Clark on The Drum (thedrum.com) [Federal and State Actions to Protect Robocall Invasion of Consumer Privacy](https://natlawreview.com/article/federal-and-state-actions-to-protect-robocall-invasion-consumer-privacy?ref=thenexusofprivacy.net), Paul C. Besozzi on The National Law Review (natlawreview.com) [The Holy Grail for DPA Negotiating: A Side-by-Side Comparison of the Contractual Requirements Found in Modern Data Privacy Statutes](https://natlawreview.com/article/holy-grail-dpa-negotiating-side-side-comparison-contractual-requirements-found?ref=thenexusofprivacy.net), David A. Zetoony on The National Law Review (natlawreview.com) --- Image credit: Privacy, by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net) [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net) [Alpha Stock Images](http://alphastockimages.com/?ref=thenexusofprivacy.net) ### Privacy News: July 11 URL: https://thenexusofprivacy.net/privacy-news-july-11/ Last updated: 2022-07-12T19:51:18.000Z As always, there's a lot going on! There's so much discussion of the impact of the Supreme Court *Dobbs* decision ending Roe that I've added a new **Privacy after Roe** section to the updates. ### [Gun applicants in New York will have to list social media accounts](https://apnews.com/article/technology-new-york-social-media-gun-politics-bd1fba804dfa2adb347c74bb6e52d2b0?ref=thenexusofprivacy.net) Marina Villeneuve and Maysoon Kha on Associated Press (apnews.com) People seeking concealed carry permits will be subject to reviews of their social media accounts from the past three years to confirm “character and conduct.” What could possibly go wrong? As Prof. Desmond Upton Patton (founder of [SAFElab](https://safelab.socialwork.columbia.edu/?ref=thenexusofprivacy.net), a research initiative focused on examining the ways in which youth of color navigate violence on and offline) says: > “The question should be: Can we do this in an anti-racist way that does not create another set of violence, which is the state violence that happens through surveillance?” ### [Privacy Groups Blast Virginia for Ditching Cop Facial Recognition Ban](https://gizmodo.com/virginia-lifts-police-facial-recognition-ban-aclu-1849135533?ref=thenexusofprivacy.net) Mack DeGeurin on Gizmodo (gizmodo.com) Last year, [Virginia banned local police use of facial recognition and other biometric identification tools](https://apnews.com/article/technology-legislature-police-law-enforcement-agencies-legislation-033d77787d4e28559f08e5e31a5cb8f7?ref=thenexusofprivacy.net). Now, the bill's been amended to give law enforcement the ability to use these technologies in a lot of situations – without a warrant and virtually no oversight. From ACLU of Virginia's [statement](https://acluva.org/en/press-releases/aclu-vas-statement-gov-youngkins-actions-facial-recognition-technology?ref=thenexusofprivacy.net): > "The question we ask is: why the rush to expand a practice that has proven to be both unreliable and harmful?" ### [Europe’s state of mass surveillance](https://politico.eu/article/data-retention-europe-mass-surveillance?ref=thenexusofprivacy.net) Vincent Manancourt on POLITICO (politico.eu) The European Court of Justice (the EU's top court) has repeatedly ruled that mass retention of phone and internet traffic and location data violates [fundamental EU privacy rights](https://oeil.secure.europarl.europa.eu/oeil/popups/ficheprocedure.do?reference=2017/0003%28COD%29&l=en&ref=thenexusofprivacy.net). Governments do it anyway. > The French government at first [tried to pressure its court](https://www.politico.eu/article/france-data-retention-bypass-eu-top-court/?ref=thenexusofprivacy.net) not to follow EU case law, arguing it went against the country’s “constitutional identity.” Paris [even mulled seeking changes](https://www.politico.eu/article/france-ruling-decision-data-retention/?ref=thenexusofprivacy.net) to the [EU’s](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=LEGISSUM:l14530&from=FR&ref=thenexusofprivacy.net) founding treaties or the Charter of Fundamental Rights, known as the bloc’s primary law, to dodge the EU's top court rulings. > > In Denmark, government ministers openly criticized the EU court. “I think that the fundamental problem here is that the Court of Justice of the European Union creates law without democratic legitimacy,” Danish Justice Minister Nick Hækkerup [said](https://www.ft.dk/samling/20211/lovforslag/L93/BEH1-21/forhandling.htm?ref=thenexusofprivacy.net) following a ruling in late 2021\. “After all, they are just judges.” ## Privacy after Roe [Biggest danger in overturning Roe: Your phone could send you to prison](https://thehill.com/opinion/technology/3544663-biggest-danger-in-overturning-roe-your-phone-could-send-you-to-prison?ref=thenexusofprivacy.net), Riana Pfefferkorn in The Hill (thehill.com) [Navigating Data Privacy Questions Post-Dobbs](https://natlawreview.com/article/navigating-data-privacy-questions-post-dobbs?ref=thenexusofprivacy.net), Scott Weinstein on The National Law Review (natlawreview.com) [No, submitting junk data to period tracking apps won’t protect reproductive privacy](https://fastcompany.com/90767447/no-submitting-junk-data-to-period-tracking-apps-wont-protect-reproductive-privacy?ref=thenexusofprivacy.net), Max Ufberg on Fast Company (fastcompany.com) [The Pendulum Swings Both Ways: State Responses to Protect Reproductive Health Data, Post-Roe](https://www.natlawreview.com/article/pendulum-swings-both-ways-state-responses-to-protect-reproductive-health-data-post?ref=thenexusofprivacy.net), Alaap B. Shah ## And ... [AI & Criminal Justice: A Conversation with Renée Cummings](https://techpolicy.press/ai-criminal-justice-a-conversation-with-renee-cummings?ref=thenexusofprivacy.net), Justin Hendrix on Tech Policy Press (techpolicy.press) [California Privacy Protection Agency Officially Commences CPRA Rulemaking Process](https://natlawreview.com/article/california-privacy-protection-agency-officially-commences-cpra-rulemaking-process?ref=thenexusofprivacy.net), Hunton Andrews Kurth’s Privacy and Cybersecurity on The National Law Review (natlawreview.com) [Italy Bans Google Analytics Along with France, Austria](https://techmoran.com/2022/07/04/italy-bans-google-analytics-along-with-france-austria?ref=thenexusofprivacy.net), Vanessa Waithera on TechMoran (techmoran.com) [Match.com wants FTC court proceedings over users’ biometric data privacy kept quiet](https://biometricupdate.com/202207/match-com-wants-ftc-court-proceedings-over-users-biometric-data-privacy-kept-quiet?ref=thenexusofprivacy.net), Alessandro Mascellino on BiometricUpdate.com (biometricupdate.com) [Buying weed online in N.L.? Your data’s moving to the ‘Wild West’ of privacy protection, experts say](https://cbc.ca/news/canada/newfoundland-labrador/nl-cannabis-data-shopify-us-transfer-1.6503346?%5F%5Fvfz=medium%3Dsharebar&ref=thenexusofprivacy.net), Darrell Roberts on CBC (cbc.ca) [Vast Cache of Chinese Police Files Offered for Sale in Alleged Hack](https://wsj.com/articles/vast-cache-of-chinese-police-files-offered-for-sale-in-alleged-hack-11656940488?ref=thenexusofprivacy.net), Karen Hao in Hong Kong and Rachel Liang in Singapore on WSJ (wsj.com) [India’s New Cybersecurity Order Drives VPN Providers to Leave, Chilling Speech and Subjecting More Indians to Government Surveillance](https://cdt.org/insights/indias-new-cybersecurity-order-drives-vpn-providers-to-leave-chilling-speech-and-subjecting-more-indians-to-government-surveillance?ref=thenexusofprivacy.net), Aliya Bhatia on Center for Democracy and Technology (cdt.org) [Fired Employee Claims Facebook Created Secret Tool to Read Users’ Deleted Messages](https://gizmodo.com/facebook-meta-privacy-facebook-messenger-1849153040?ref=thenexusofprivacy.net), The A.V. Club on Gizmodo (gizmodo.com) [Google account sign-up process targeted with GDPR complaints](https://techcrunch.com/2022/06/29/google-account-gdpr-complaint?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com) [Mangatoon data breach exposes data from 23 million accounts](https://bleepingcomputer.com/news/security/mangatoon-data-breach-exposes-data-from-23-million-accounts?ref=thenexusofprivacy.net), Lawrence Abrams on BleepingComputer (bleepingcomputer.com) [Toronto wants to kill the smart city forever](https://technologyreview.com/2022/06/29/1054005/toronto-kill-the-smart-city?ref=thenexusofprivacy.net), Karrie Jacobs on MIT Technology Review (technologyreview.com) \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Image credit: News by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net), licensed under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net), via [Pix4free](https://pix4free.org/?ref=thenexusofprivacy.net) ### Talking about the elephant: Federal Privacy Legislation Update, July 8 URL: https://thenexusofprivacy.net/talking-about-the-elephant/ Last updated: 2026-04-15T22:50:50.000Z > "The [Supreme Court’s reversal of Roe v. Wade](https://time.com/6189476/abortion-supreme-court-overturns-roe-v-wade/?ref=thenexusofprivacy.net) on June 24 has directed a spotlight on the question of digital surveillance, as Google searches, location information, period-tracking apps and other personal digital data could be collected and used as evidence of a crime if one seeks to terminate a pregnancy—or helps someone do so—in states where it’s illegal.... > > While some lawmakers have been fighting for this issue for years, legislation that would enshrine safeguards against the collection of personal data by governments and companies for criminal surveillance and corporate profit has stalled. But the urgency has intensified in recent weeks." > > – [Lawmakers are scrambling to pass privacy legislation](https://time.com/6193224/abortion-privacy-data-reform/?ref=thenexusofprivacy.net), Nik Popli and Vera Bergengruen, Time Yeah, really. And when Congress is back in session on Monday, there are at least four privacy bills that could have a real impact: - The My Body, My Data Act protects reproductive health data. It's supported by reproductive rights groups including Planned Parenthood, NARAL, Unite for Reproductive & Gender Equity (URGE), and Feminist Majority, - The Fourth Amendment Is Not For Sale Act prohibits data brokers from selling data to law enforcement and intelligence agencies without a court order. Nearly 50 consumer-advocacy, media-justice and privacy-rights groups, including the ACLU, the Brennan Center for Justice, Demand Progress and Free Press Action, support it. - The Health and Location Data Protection Act (HLDPA) also focuses on data brokers, prohibiting them from selling health or location data – to government or anybody else. With the [House Oversight probing data brokers' handling of reproductive health data](https://thehill.com/blogs/blog-briefing-room/news/3549893-house-oversight-opens-probe-into-handling-of-reproductive-health-data/?ref=thenexusofprivacy.net), this is an topic that's goign to get a lot of attention. - The American Data Privacy and Protection Act (ADPPA) is a broad consumer privacy bill, with civil rights protections and some data broker regulation. It's got a lot of momentum and the sense of urgency could be enough to push it over the top, although privacy groups like Electronic Frontier Foundation say [ADPPA still needs significant improvements](https://www.eff.org/files/2022/06/14/2022.06.13%5Feff%5Fletter%5Fto%5Fhouse%5Fenc%5Fre.%5Fhearing%5Fon%5Fprotecting%5Famericas%5Fconsumers%5F.pdf?ref=thenexusofprivacy.net). *UPDATE, July 12: the House Energy & Commerce committee is planning a markup on ADPPA next week.* \[There are also [several child privacy bills](https://fpf.org/wp-content/uploads/2022/06/FPF-Policy-Brief-Child-Privacy-Federal-Bill-Comparison-R5.pdf?ref=thenexusofprivacy.net), but this post is already going to be long enough that I'm going to skip over them for the time being.\] ### GET INVOLVED: [Tell Congress to pass the My Body, My Data Act](https://act.eff.org/action/pass-the-my-body-my-data-act?ref=thenexusofprivacy.net) and [support the Fourth Amendment Is Not For Sale Act](https://www.eff.org/deeplinks/2021/04/tell-congress-support-fourth-amendment-not-sale-act?ref=thenexusofprivacy.net) using EFF's handy web forms. With the Senate split 50-50, the only way for a bill to pass this session is with bipartisan support. The Fourth Amendment Is Not For Sale Act was introduced by Senators Ron Wyden (D-OR) and Rand Paul (R-KY), and Republican Senators Lee and Daines are also co-sponsors, so it has a chance. By contrast, even though My Body, My Data Act sponsor Rep. Sara Jacobs (D-CA) has said there's a good chance that the House will vote on it soon, it may well have a hard time clearing the Senate. \[[Biden has said he’d support eliminating the filibuster to codify Roe and right to privacy](https://www.cbsnews.com/news/biden-support-eliminating-filibuster-codify-roe-right-to-privacy/?ref=thenexusofprivacy.net), which could provide another path, but there don't currently appear to be the votes for that route either.\] The big wild card is the ADPPA, which also has bipartisan sponsorship. Everybody agrees that it's an encouraging start, and breaks some important new ground – for example, a section on civil rights protections that prohibits collecting, processing, and transferring covered data in was that discriminates on the basis of race, color, religion, national origin, sex, or disability. But even though the Consumer Protection and Commerce subcommittee advanced it unanimously, it faces pushback from multiple sides: - Groups like EPIC Privacy, Common Sense, Lawyers Committee on Civil Rights, and EFF have pointed out areas for improvement, and several Democratic legislators are pushing to strengthen it. - Industry trade associations are very concerned that its requirements are too onerous, and several Republicans legislators are pushing to weaken it. ## Talking about the elephant At ADPPA's [hearing](https://energycommerce.house.gov/committee-activity/hearings/hearing-on-protecting-americas-consumers-bipartisan-legislation-to?ref=thenexusofprivacy.net) and [markup](https://jdsupra.com/legalnews/federal-privacy-bill-voted-out-of-house-2845876?ref=thenexusofprivacy.net) in June, reproductive health data was the elephant in the room that nobody talked about. But now, as Cristiano Lima's [Abortion ruling could scramble data privacy talks](https://www.washingtonpost.com/politics/2022/06/27/abortion-ruling-could-scramble-data-privacy-talks/?ref=thenexusofprivacy.net) (in the *Washington Post*) reports, a memo from Democratic staffers raises concerns that the bill "does not adequately protect” privacy in a post-Roe world: > According to the memo, the [American Data Privacy and Protection Act](https://republicans-energycommerce.house.gov/wp-content/uploads/2022/06/PRIVACY%5F02%5Fxml.pdf?ref=thenexusofprivacy.net) “makes it harder for women to seek redress when their sensitive health data has been used against them” and would force women to “jump through arbitrary, drawn-out hoops” to sue over privacy violations. > > Democratic aides called out provisions overriding state laws and delaying when consumers can bring lawsuits against companies by four years. “During that time, all strong state privacy laws are preempted, leaving fewer enforcement mechanisms for women,” they wrote. Democratic legislators are concerned as well. The article quotes Wyden with concerns about the loophole exempting “de-identified” data ([which is typically very easy to re-identify](https://www.theregister.com/2021/09/16/anonymising%5Fdata%5Ffeature/?ref=thenexusofprivacy.net)); Jacobs as saying “it’s clear that there is a lot more to do than is currently included in this bill;” and Senate Commerce Chair Maria Cantwell (D-WA), focusing on how enforcement needs to be strengthened. None of these issues are new. Disagreements on preemption and the private right of action (whether people can sue companies who break the law) have been major roadblocks to agreement on federal privacy legislation for the last several years, and ADPPA attempts to thread the needle with "compromises" in both of those areas was already the source of heated discussion. Articles like Lano's [Cantwell’s elusive endorsement hinders privacy talks](https://www.washingtonpost.com/politics/2022/06/30/sen-cantwells-elusive-endorsement-puzzles-privacy-talks/?ref=thenexusofprivacy.net) give a glimpse into some of the behind-the-scenes tensions. That said, the SCOTUS decision changes the dynamics. Democrats who might have been willing to "compromise" and support a weak bill will look really bad if they pass privacy legislation that *doesn't* protect reproductive health data. Then again, that also gives industry and their an opportunity to *claim* that a weak bill protects reproductive health data (even if it doesn't) and press Democrats to pass it. In [How comprehensive privacy legislation can guard reproductive privacy](https://www.brookings.edu/blog/techtank/2022/07/07/how-comprehensive-privacy-legislation-can-guard-reproductive-privacy/?ref=thenexusofprivacy.net), Brookings' Cameron Kerry says "The ADPPA would accomplish the essence of the Warren-Wyden and Jacobs bills." But would it really? ## Now what? Still, it was clear at the ADPPA hearing that legislators from both parties really understand the need to pass privacy legislation and want to do something this session. So they've certainly got an incentive to work through these problems. And the ADPPA's not the only bill in town. As the Boston Globe notes in [With Roe overturned, Congress must act on data privacy](https://www.bostonglobe.com/2022/07/05/opinion/with-roe-overturned-congress-must-act-data-privacy/?ref=thenexusofprivacy.net), even though bills like HLDPA and My Body My Data are unlikely to get past a Senate filibuster, there's still plenty of room for amendments to the ADPPA that bring in at least some of these protections. And the Fourth Amendment Is Not For Sale Act would also be a big win for our privacy. One of the lessons from our experiences in the multi-year battle over privacy legislation in Washington states is that grassroots organizing can make a big difference in situations like this. Industry has so many well-paid lobbyists that privacy and civil rights groups are badly outnumbered – but polls consistently show that the vast majority of voters in both parties support strong privacy protections. And it's not just legislators and people concerned about reproductive health information who are feeling the urgency to do something about privacy ASAP. As WA People's Privacy Network says in [Losing Roe means we have to fight harder than ever for everyone’s privacy](https://wapeoplesprivacynetwork.org/losing-roe-means-we-have-to-fight-harder-than-ever-for-everyones-privacy/?ref=thenexusofprivacy.net) > Geo-fence warrants, unwarranted data collection and surveillance via brokers and third parties, automated decision systems, biased algorithms, and biometric data collection have all threatened Immigrants; Black, Indigenous and people of color; LGBTQIA+ people; Muslims; community organizers; activists, anti-war, peace and environmental advocates; movement lawyers and journalists for years. These communities have all felt the brunt of data privacy and surveillance threats and harms, and have spoken up about it. So it'll be interesting to see what happens once Congress is back in session. To get involved with the activism, make sure to follow groups like [EFF](https://twitter.com/EFF/?ref=thenexusofprivacy.net) and [WA People's Privacy Network](https://twitter.com/wapeopleprivacy?ref=thenexusofprivacy.net). And I'll continue to cover the federal privacy legislation battle, along with other topics, here on The Nexus Of Privacy. So if you want to stay in the loop, [please subscribe](https://thenexusofprivacy.net/the-view-from-the-other-washington-federal-privacy-legislation-adppa-update-6-22/#/portal/signup)! \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ *Image credit:* JessicaRodriguezRivas, via [Wikipedia Commons](https://commons.wikimedia.org/wiki/File:Home%5Fof%5Fthe%5FUS%5FCongress.jpg?ref=thenexusofprivacy.net). licensed under the [Creative Commons](https://en.wikipedia.org/wiki/en:Creative%5FCommons?ref=thenexusofprivacy.net)[Attribution-Share Alike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net) license. ### Privacy News: July 4 URL: https://thenexusofprivacy.net/privacy-news-july-4/ Last updated: 2022-07-04T19:29:20.000Z Lots of privacy news this holiday weekend! But first, in honor of the Fourth, here's Baratunde Thurston reading Frederick Douglass' "What to the Slave is the Fourth of July." And now on to the links ... ### [Facial recognition use increasing at US federal agencies faster than oversight, GAO reports](https://www.biometricupdate.com/202206/facial-recognition-use-increasing-at-us-federal-agencies-faster-than-oversight-gao-reports?ref=thenexusofprivacy.net) Alessandro Mascellino on Biometric Update (biometricupdate.com) A new [report](https://www.gao.gov/products/gao-22-106100?ref=thenexusofprivacy.net) from the Government Accountability Office (GAO) paints a bleak picture of federal government usage of outside facial recognition systems: > GAO says that out of 13 agencies it recommended should implement mechanisms to track non-federal facial recognition systems used by employees and assess their associated risks, only three have implemented systems, and even they have not performed risk assessments. Dell Cameron's [Congress Surprised to Learn Biometric Surveillance Rampant, Unchecked](https://gizmodo.com/facial-recognition-biometric-surveillance-congress-1849126487?ref=thenexusofprivacy.net) on Gizmodo has more on last Wednesday's Science Space & Technology Committee's Subcommittee on Investigations and Oversight hearing on [Privacy in the Age of Biometrics](https://science.house.gov/hearings/privacy-in-the-age-of-biometrics?ref=thenexusofprivacy.net), noting that "House lawmakers, at times, seemed unfamiliar with not only the laws and procedures relevant to the government’s use of biometric data, but the widespread use of face recognition by federal employees on an ad-hoc basis, absent any hint of federal oversight." ALSO: [NY is Ignoring the Ban on Facial Recognition in Schools](https://www.nyclu.org/en/news/ny-ignoring-ban-facial-recognition-schools?ref=thenexusofprivacy.net), Juan Miguel and Daniel Schwartz, New York Civil Liberties Union ### [Google Says It Will Delete Location Data When Users Visit Abortion Clinics](https://nytimes.com/2022/07/01/technology/google-abortion-location-data.html?ref=thenexusofprivacy.net) on NYTimes (nytimes.com) Last month, over 50 civil rights groups urged Google to stop collecting location data because of the risk to people getting abortions. Last weed Alphabet Workers Union demanded that the company delete any personal data that law enforcement could try to use to prosecute those who are getting abortions. [Google's announcement on Friday](https://blog.google/technology/safety-security/protecting-peoples-privacy-on-health-topics?ref=thenexusofprivacy.net) doesn't go anywhere near that far, but at least it's something: > Some of the places people visit — including medical facilities like counseling centers, domestic violence shelters, abortion clinics, fertility centers, addiction treatment facilities, weight loss clinics, cosmetic surgery clinics, and others — can be particularly personal. Today, we’re announcing that if our systems identify that someone has visited one of these places, we will delete these entries from Location History soon after they visit. This change will take effect in the coming weeks. Of course, Location History is only one of the many different kinds of data Google tracks that puts people at risk; the announcement says nothing about search history. And even for location data, there are all kinds of problems. [Kate Bertash notes](https://twitter.com/KateRoseBee/status/1543274118203998208?ref=thenexusofprivacy.net) that Google products are notoriously terrible at telling when something is actually an abortion clinic, [Ali Alkhatib describes why](https://twitter.com/%5Falialkhatib/status/1543276917435932672?ref=thenexusofprivacy.net) they really need to delete the data for an entire week around the vist, and as [Evan Greer points out](https://twitter.com/evan%5Fgreer/status/1542982130887806980?ref=thenexusofprivacy.net) even having the list of "sensitive sites" is potentially also a problem. Still, it's encouraging – and it shows that the pressure is strong enough that it has an effect. SEE ALSO: [Overturning Roe could change how digital advertisers use location data. Can they regulate themselves?](https://protocol.com/enterprise/roe-location-data-digital-advertising?ref=thenexusofprivacy.net), Kate Kaye on Protocol (protocol.com) ### [Online Abortion Pill Provider Hey Jane Used Tracking Tools That Sent Visitor Data to Meta, Google, and Others](https://themarkup.org/pixel-hunt/2022/07/01/online-abortion-pill-provider-hey-jane-used-tracking-tools-that-sent-visitor-data-to-meta-google-and-others?ref=thenexusofprivacy.net) Jon Keegan and Dara Kerr on The Markup (themarkup.org) The latest in *The Markup's* excellent series looking at web trackers with their Blacklight project. This time, it's Hey Jane, a site that lets connect with medical providers and order "fast, safe and affordable abortion pills." Unfortunately ... > \[A\]n[ analysis of Hey Jane’s website](https://themarkup.org/blacklight?url=heyjane.co&ref=thenexusofprivacy.net) with The Markup’s[ Blacklight privacy inspector](https://themarkup.org/blacklight/2020/09/22/blacklight-tracking-advertisers-digital-privacy-sensitive-websites?ref=thenexusofprivacy.net) tool showed the site employed a series of online trackers that follow users across the internet. The trackers notified Google, Facebook’s parent company Meta, payments processor Stripe, and four analytics firms when users visited its site. > The Markup also found personally identifying information of customers in the data powering Hey Jane’s reviews section, including one reviewer’s Instagram handle and the hometowns of others. The reviews were served by a third-party service called Reviews.io. That's bad! Hey Jane 's has now removed almost all of their trackers (although Google Analytics is still there), and removed the reviews from their site. **EARLIER:** - [Facebook Is Receiving Sensitive Medical Information from Hospital Websites](https://themarkup.org/pixel-hunt/2022/06/16/facebook-is-receiving-sensitive-medical-information-from-hospital-websites?ref=thenexusofprivacy.net), Todd Feathers, Simon Fondrie-Teitler, Angie Waller, and Surya Mattu on *The Markup* - [Facebook and Anti-Abortion Clinics Are Collecting Highly Sensitive Info on Would-Be Patients](https://revealnews.org/article/facebook-data-abortion-crisis-pregnancy-center?ref=thenexusofprivacy.net), Grace Oldham and Dhruv Mehrotra on Reveal (revealnews.org) ### ## And ... #### [ArriveCan app might still be used after the pandemic: public safety minister](https://windsor.ctvnews.ca/arrivecan-app-might-still-be-used-after-the-pandemic-public-safety-minister-1.5966908?ref=thenexusofprivacy.net), Chris Campbell, on CTV News (windsor.ctvnews.ca) [Data privacy concerns make the post-Roe era uncharted territory](https://news.wjct.org/national-news/national-news/2022-07-02/data-privacy-concerns-make-the-post-roe-era-uncharted-territory?ref=thenexusofprivacy.net), Juliana Kim on WJCT News (news.wjct.org) [‘Voiceprints’ Roil Companies as Biometrics Litigation Skyrockets](https://news.bloomberglaw.com/privacy-and-data-security/voiceprints-roil-companies-as-biometrics-litigation-skyrockets?ref=thenexusofprivacy.net), Samantha Hawkins on Request a Free Demo (news.bloomberglaw.com) [EFF to File Amicus Brief in First U.S. Case Challenging Dragnet Keyword Warrant](https://eff.org/deeplinks/2022/06/eff-file-amicus-brief-first-us-case-challenging-dragnet-keyword-warrant?ref=thenexusofprivacy.net), Jennifer Lynch and Andrew Crocker on Electronic Frontier Foundation (eff.org) [PRESS RELEASE: Leading Privacy Scholars and Advocates Join EPIC’s Advisory Board](https://epic.org/press-release-leading-privacy-scholars-and-advocates-join-epics-advisory-board?ref=thenexusofprivacy.net), EPIC - Electronic Privacy Information Center (epic.org) [Federal government will help states punish abortion — using our phones](https://thehill.com/opinion/criminal-justice/3543721-federal-government-will-help-states-punish-abortion-using-our-phones?ref=thenexusofprivacy.net), Riana Pfefferkorn, The Hill (thehill.com) [Abortion Ruling Puts User Data Privacy in Focus. Here’s What to Know.](https://wsj.com/articles/abortion-tech-data-privacy-answers-11656520992?ref=thenexusofprivacy.net) Meghan Bobrowsky on WSJ (wsj.com) [The Mounting Threats to Sensitive Data After Roe v. Wade](https://healthcareinfosecurity.com/interviews/mounting-threats-to-sensitive-data-after-roe-v-wade-i-5094?ref=thenexusofprivacy.net), Marianne Kolbasuk McGee on healthcareinfosecurity.com [Period Tracking Apps Used By Millions Of Women Are Sharing Incredibly Sensitive Data With Facebook](https://buzzfeednews.com/article/meghara/period-tracker-apps-facebook-maya-mia-fem?ref=thenexusofprivacy.net), Megha Rajagopalan on BuzzFeed News (buzzfeednews.com) [How to skim a privacy policy to spot red flags](https://washingtonpost.com/technology/2022/07/01/how-to-read-privacy-policies?ref=thenexusofprivacy.net), Tatum Hunter on The Washington Post (washingtonpost.com) [TikTok Sued by Dutch Parents Group, App Accused of Violating Child Privacy With Data Collection](https://cpomagazine.com/data-protection/tiktok-sued-by-dutch-parents-group-app-accused-of-violating-child-privacy-with-data-collection?ref=thenexusofprivacy.net), Scott Ikeda on CPO Magazine (cpomagazine.com) [Top EU Judge Says Mass Snooping Is Illegal](https://cpomagazine.com/data-protection/top-eu-judge-says-mass-snooping-is-illegal?ref=thenexusofprivacy.net), Jennifer Baker on CPO Magazine (cpomagazine.com) [TikTok responds to data privacy concerns raised by Republican senators](https://nbcnews.com/tech/social-media/tiktok-letter-republican-senators-china-data-privacy-rcna36359?ref=thenexusofprivacy.net), Elliot Lewis on NBC News (nbcnews.com) [Disruptive Legislation Triggers the Need to Reassess the Collection of Employee Data](https://cpomagazine.com/data-privacy/disruptive-legislation-triggers-the-need-to-reassess-the-collection-of-employee-data?ref=thenexusofprivacy.net), Risa B. Boerner on CPO Magazine (cpomagazine.com) ### Privacy News: July 1 URL: https://thenexusofprivacy.net/privacy-news-july-1/ Last updated: 2022-07-01T18:18:47.000Z An extra-long list for the holiday weekend! ### ### [HIPAA Privacy Rule and Disclosures of Information Relating to Reproductive Health Care](https://hhs.gov/hipaa/for-professionals/privacy/guidance/phi-reproductive-health/index.html?ref=thenexusofprivacy.net) on HHS.gov (hhs.gov) New Guidance from the Department of Health and Human Services tells health-care providers they do not have to disclose personal information related to abortion and other sexual and reproductive health care – and that they are often prohibited from disclosing it, even to law enforcement. This is very privacy-friendly guidance. Unfortunately, HIPAA only covers health care providers and insurance companies; tech companies who track personal health care information typically are not affected by HIPAA, so this guidance does not apply to them. SEE ALSO: [Protecting the Privacy and Security of Your Health Information When Using Your Personal Cell Phone or Tablet](https://hhs.gov/hipaa/for-professionals/privacy/guidance/cell-phone-hipaa/index.html?ref=thenexusofprivacy.net), also on HHS.gov ### [Fear, Uncertainty, and Period Trackers](https://medium.com/@Kendra%5FSerra/340ab8fdff74?ref=thenexusofprivacy.net) Kendra Albert, Maggie Delano, and Emma Weil on medium.com > My parable that I'm taking away: people on the ground have a pretty good idea of where risk comes from and we theorize without their input/expertise at our peril. > > — Kendra Albert (@KendraSerra) [June 28, 2022](https://twitter.com/KendraSerra/status/1541899136651386880?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) The risk of information from period tracking apps being used to identify people who get abortions has gotten a lot of attention. This post, by researchers and a lawyer, is an excellent analysis of the risks. The authors conclude > "If you use a period tracker, but your threat model does not include the additional risks of say: helping other people get abortions, we don’t currently have evidence of imminent threats of large-scale preemptive investigation of you based on personal health app data. The biggest threat of criminalization is that a third party (like hospital staff or a relative) reports someone to the police for their pregnancy outcome — not that police find their period data in a database." [Okay, Fine, Let’s Talk About Period Tracking: the detailed explainer](https://medium.com/@maggied/okay-fine-lets-talk-about-period-tracking-the-detailed-explainer-2f45112eebb4?ref=thenexusofprivacy.net), by the same authors, a longer companion piece, goes into even more detail. **SEE ALSO**: - [Should You Really Delete Your Period Tracking App?](https://www.eff.org/deeplinks/2022/06/should-you-really-delete-your-period-tracking-app?ref=thenexusofprivacy.net), Gennie Gebhart and Daly Barnett, EFF - [Period Tracking, Abortions, and Privacy](https://medium.com/@carolinesinders/period-tracking-abortions-and-privacy-308739482a31?ref=thenexusofprivacy.net), caroline sinders (from May 2022) - [The biggest privacy risks in post-Roe America](https://theverge.com/23185081/abortion-data-privacy-roe-v-wade-dobbs-surveillance-period-tracking?ref=thenexusofprivacy.net), Russell Brandom on The Verge - [Deleting Your Period Tracker Won’t Protect You](https://nytimes.com/2022/06/30/technology/period-tracker-privacy-abortion.html?ref=thenexusofprivacy.net), Kashmir Hill, in the New York Times - [The post-Roe data privacy nightmare is way bigger than period tracking apps](https://engadget.com/data-privacy-period-tracking-apps-130054404.html?ref=thenexusofprivacy.net), K. Bell on Engadget (engadget.com) - [Payment Data Could Become Evidence of Abortion, Now Illegal in Some States](https://nytimes.com/2022/06/29/business/payment-data-abortion-evidence.html?ref=thenexusofprivacy.net), Ron Lieber and Tara Siegel Bernard, in the New York Times (nytimes.com) - [Op-Ed: The end of Roe means we’ll be criminalized for more of our data](https://www.latimes.com/opinion/story/2022-05-16/abortion-data-privacy-roe-surveillance?ref=thenexusofprivacy.net), Cynthia Conti-Cook and Kate Bertash, *LA Times (May 2022)* - [Who’s Going to Protect Reproductive Rights Online?](https://techpolicy.press/whos-going-to-protect-reproductive-rights-online/?ref=thenexusofprivacy.net), Nora Benevidez, Tech Policy Press - [In wake of Roe repeal, lawmakers and tech companies must take immediate steps to protect abortion patients from surveillance and censorship](https://www.fightforthefuture.org/news/2022-06-24-in-wake-of-roe-repeal-lawmakers-and-tech-companies-must-take-immediate-steps-to-protect-abortion-patients-from-surveillance-and-censorship?ref=thenexusofprivacy.net), Fight for the Future. - [Supreme Court’s decision on abortion sparks health tech’s Cambridge Analytica moment](https://statnews.com/2022/06/30/roe-abortion-health-data-privacy-cambridge-analytica?ref=thenexusofprivacy.net), Mario Aguilar on STAT (statnews.com) - [Planned Parenthood suspends marketing trackers on abortion search pages](https://washingtonpost.com/technology/2022/06/30/planned-parenthood-privacy-data?ref=thenexusofprivacy.net), Tatum Hunter on The Washington Post (washingtonpost.com) - [Now that Roe has been overturned, it’s up to the tech industry to protect our data](https://fastcompany.com/90765123/now-that-roe-has-been-overturned-its-up-to-the-tech-industry-to-protect-our-data?ref=thenexusofprivacy.net), Max Ufberg on Fast Company (fastcompany.com) - [Federal government will help states punish abortion — using our phones](https://thehill.com/opinion/criminal-justice/3543721-federal-government-will-help-states-punish-abortion-using-our-phones?ref=thenexusofprivacy.net), Riana Pfefferkorn on The Hill (thehill.com) - [Surveilling the Digital Abortion Diary](https://scholarworks.law.ubalt.edu/ublr/vol50/iss1/2?ref=thenexusofprivacy.net),” C. Conti-Cook, *University of Baltimore Law Review*, vol. 50, no. 1, Oct. 2020 ### [Massive Trove of Gun Owners’ Private Information Leaked by California Attorney General](https://thereload.com/new-california-ag-website-leaks-massive-trove-of-gun-owner-private-information/?ref=thenexusofprivacy.net) Stephen Gutowsky, *The Reload* (thereload.com) Yikes. > The California Department of Justice’s [2022 Firearms Dashboard Portal](https://openjustice.doj.ca.gov/data-stories/firearms-data-portal?ref=thenexusofprivacy.net) went live on Monday with publicly-accessible files that include identifying information for those who have concealed carry permits. The leaked information includes the person’s full name, race, home address, date of birth, and date their permit was issued. The data also shows the type of permit issued, indicating if the permit holder is a member of law enforcement or a judge. ### [Will California Eliminate Anonymous Web Browsing? (Comments on CA AB 2273, The Age-Appropriate Design Code Act)](https://blog.ericgoldman.org/archives/2022/06/will-california-eliminate-anonymous-web-browsing-comments-on-ca-ab-2273-the-age-appropriate-design-code-act.htm?ref=thenexusofprivacy.net) Eric Goldman on Technology and Marketing Law Blog (blog.ericgoldman.com) Goldman argues that the wording of this proposed California law would require ebsites and apps to authenticate the age of ALL consumers before they can use the service – which would put an end to anonymous web browsing. In *The Register*, Thomas Claburn [reports](https://theregister.com/2022/06/28/california%5Fkid%5Fprivacy%5Fbill%5Fanonymous?ref=thenexusofprivacy.net) that Consumer Reports has also urged legislators to drop the age verification requirement. SEE ALSO: [California Age-Appropriate Design Code Aims to Address Growing Concern About Children’s Online Privacy and Safety](https://fpf.org/blog/california-age-appropriate-design-code-aims-to-address-growing-concern-about-childrens-online-privacy-and-safety?ref=thenexusofprivacy.net), on Future of Privacy Forum ### [IAPP statement on Dobbs ruling and PSR event](https://iapp.org/news/a/iapp-statement-on-dobbs-ruling-and-psr-event?ref=thenexusofprivacy.net) on International Association of Privacy Professionals (iapp.org) The IAPP "stands against discriminatory laws and unequivocally supports civil rights, which include privacy rights for all persons everywhere" but nonetheless is going to hold their convention in Texas which has stripped privacy rights from pregnant people. As Ari Ezra Waldman says on Twitter, it's unacceptable – but not surprising. > +1\. Unacceptable [@PrivacyPros](https://twitter.com/PrivacyPros?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net). Also not surprising. In Industry Unbound, I show how the IAPP is a mouthpiece for discourses of power for the info industry. It doesn’t actually care abt ppl’s privacy, those of women, ppl who can become pregnant, or anyone for that matter. [https://t.co/cYUYJj247x](https://t.co/cYUYJj247x?ref=thenexusofprivacy.net) > > — Ari Ezra Waldman (@ariezrawaldman) [June 30, 2022](https://twitter.com/ariezrawaldman/status/1542470492422275073?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) ## And ... [‘Supercookies’ Have Privacy Experts Sounding the Alarm](https://wired.com/story/trustpid-digital-token-supercookie?ref=thenexusofprivacy.net), Chris Stokel-Walker on WIRED (wired.com) [Parting thoughts: A Canadian privacy one-on-one with Daniel Therrien](https://iapp.org/news/a/parting-thoughts-a-canadian-privacy-one-on-one-with-daniel-therrien?ref=thenexusofprivacy.net), an interview with the former Privacy Commissioner of Canada on International Association of Privacy Professionals (iapp.org) [TechTank Podcast Episode 47: Will Americans finally see bipartisan federal privacy legislation?](https://brookings.edu/blog/techtank/2022/06/27/techtank-podcast-episode-47-will-americans-finally-see-bipartisan-federal-privacy-legislation?ref=thenexusofprivacy.net), Cameron Kerry, Jennifer King, and Nicol Turner Lee on Brookings (brookings.edu) [Australian retailer pauses facial recognition trial over privacy complaint](https://reuters.com/technology/australian-appliances-giant-pauses-facial-recognition-tech-over-privacy-concern-2022-06-28?ref=thenexusofprivacy.net), Byron Kaye on Reuters (reuters.com) [3 Expert Predications on Where International Privacy Regulations Are Heading in 2023 and Beyond](https://jdsupra.com/legalnews/3-expert-predications-on-where-6330588?ref=thenexusofprivacy.net), Tim Rollins on JD Supra (jdsupra.com) [10 years after: The EU’s ‘crunch time’ on GDPR enforcement](https://iapp.org/news/a/10-years-after-the-eus-crunch-moment-on-gdpr-enforcement?ref=thenexusofprivacy.net), Luca Bertuzzi on International Association of Privacy Professionals (iapp.org) [UK urgently needs law on use of biometrics, warns review](https://techcrunch.com/2022/06/28/uk-biometrics-legal-review?ref=thenexusofprivacy.net), Natasha Lomas on TechCrunch (techcrunch.com) [Google and Apple may face another FTC probe over ‘harmful’ mobile trackers](https://www.androidcentral.com/apps-software/ftc-could-probe-google-and-apple-over-mobile-tracking?ref=thenexusofprivacy.net), Jay Bonggolto, Android Central (androidcentral.com) [The privacy debate could get ‘dangerous’ for the FTC](https://www.protocol.com/policy/ohlhausen-privacy-ftc?ref=thenexusofprivacy.net), an interview with former FTC acting chair (and current lobbyist) Maureen Ohlhausen, by Ben Brody on Protocol. [How did a rental startup I’d never heard of leak my home address?](https://techcrunch.com/2022/06/30/bilt-address-leak-privacy?ref=thenexusofprivacy.net), Zack Whittaker on TechCrunch (techcrunch.com) [Police used a reverse keyword Google search to find an accused killer. He says that’s illegal](https://nbcnews.com/news/us-news/police-google-reverse-keyword-searches-rcna35749?ref=thenexusofprivacy.net), Jon Schuppe on NBC News (nbcnews.com) [Warrants Can Force Google To Look Through Your Search History–A Tragic Arson Case May Decide If That’s Constitutional](https://forbes.com/sites/thomasbrewster/2022/06/30/warrants-can-force-google-to-look-through-your-search-historya-tragic-arson-case-may-decide-if-thats-constitutional?ref=thenexusofprivacy.net), Thomas Brewster on Forbes (forbes.com) [European consumer groups take action against Google for pushing users towards its surveillance system](https://beuc.eu/publications/european-consumer-groups-take-action-against-google-pushing-users-towards-its/html?ref=thenexusofprivacy.net), on www.beuc.eu (beuc.eu) [I saw first-hand how the tech giants seduced the EU – and undermined democracy](https://theguardian.com/commentisfree/2022/jun/28/i-saw-first-hand-tech-giants-seduced-eu-google-meta?ref=thenexusofprivacy.net), Georg Riekeles of the Eurpoean Policy Center on The Guardian (theguardian.com) [Dreyfus pledges sweeping data privacy reforms](https://afr.com/politics/federal/dreyfus-pledges-sweeping-data-privacy-reforms-20220627-p5awvw?ref=thenexusofprivacy.net), Tom Burton on Australian Financial Review (afr.com) [Widely Used IAB TCF Ad Tracking Consent Framework May Not Meet GDPR Standards](https://cpomagazine.com/data-protection/widely-used-iab-tcf-ad-tracking-consent-framework-may-not-meet-gdpr-standards?ref=thenexusofprivacy.net), Scott Ikeda on CPO Magazine (cpomagazine.com) [This new privacy feature in Firefox strips tracking info from links](https://pcworld.com/article/797980/this-new-privacy-feature-in-firefox-strips-tracking-info-from-links.html?ref=thenexusofprivacy.net), Alaina Yee on PCWorld (pcworld.com) [European, U.S. Groups Plan Salvo of Privacy Complaints Against Google](https://wsj.com/articles/european-u-s-groups-plan-salvo-of-privacy-complaints-against-google-11656540061?ref=thenexusofprivacy.net), Catherine Stupp on The Wall Street Journal (wsj.com) --- *Image credit:* Daquella manera on [Flickr ](https://www.flickr.com/photos/62518311@N00/466172168?ref=thenexusofprivacy.net) via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons Attribution 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net) license. ### Algorithmic Justice League audits the auditors (and why it matters from a privacy perspective) URL: https://thenexusofprivacy.net/ajl-audits-the-auditors/ Last updated: 2026-04-15T22:50:01.000Z > "Algorithmic audits (or \`AI audits') are an increasingly popular mechanism for algorithmic accountability; however, they remain poorly defined. Without a clear understanding of audit practices, let alone widely used standards or regulatory guidance, claims that an AI product or system has been audited, whether by first-, second-, or third-party auditors, are difficult to verify and may potentially exacerbate, rather than mitigate, bias and harm." > > \- From Algorithmic Justice League's [Who audits the auditors?](https://www.ajl.org/auditors?ref=thenexusofprivacy.net) site Yeah really. Investigating algorithms and the systems built around them for bias and accuracy is vital both from an algorithmic justice perspective and from a privacy perspective – as we see with the American Data Privacy and Protection Act (ADPPA), where legislators and advocacy have all highlighted the importance of the requirements that "large data holders" conduct algorithmic impact assessments. But as EPIC Privacy warns in their [ADPPA testimony,](https://energycommerce.house.gov/sites/democrats.energycommerce.house.gov/files/documents/Testimony%5FFitzgerald%5FCPC%5F2022.06.14.pdf?ref=thenexusofprivacy.net) there's a risk that these can simply become "box-checking exercises", in the same way that [privacy laws have turned into privacy theater](https://slate.com/technology/2021/12/facebook-twitter-big-tech-privacy-sham.html?ref=thenexusofprivacy.net). How to avoid that? [Who Audits the Auditors? Recommendations from a field scan of the algorithmic auditing ecosystem](https://facctconference.org/static/pdfs%5F2022/facct22-126.pdf?ref=thenexusofprivacy.net), by Sasha Costanza-Chock, Inioluwa Deborah Raji, and Joy Buolamwini of the Algorithmic Justice League (AJL), highlights some key considerations. Based on interviews with industry leaders and a survey, they identify best practices and include six valuable policy recommendations. 1. Require the owners and operators of AI systems to engage in independent algorithmic audits against clearly defined standards 2. Notify individuals when they are subject to algorithmic decision-making systems 3. Mandate disclosure of key components of audit findings for peer review 4. Consider real-world harm in the audit process, including through standardized harm incident reporting and response mechanisms 5. Directly involve the stakeholders most likely to be harmed by AI systems in the algorithmic audit process 6. Formalize evaluation and, potentially, accreditation of algorithmic auditors. This paper was just presented at the ACM Conference on Fairness, Accountability, and Transparency (FAccT ’22) – but the audience for it is a lot broader than just AI researchers, practictioners, and auditors. For one thing, it's information that legislators and regulators looking at privacy or algorithmic justice really need to take into account. ![Charts showing responses for whether regulation should require audits and mandate public disclosure of audit results. See the quote below for the results.](https://thenexusofprivacy.net/content/images/2022/06/regulation-directions-2.png) > "There is a consensus among practitioners that current regulation is lacking, as well as agreement about some areas that require mandates. Auditors and non-auditors alike overwhelmingly agree that AI audits should be mandated (95%), and that the results of these audits, in part or in full, should be disclosed (82%)" Laws and regulations are increasingly requiring auditing, at least for some systems. But the devil is in the details: will the laws regulations require *meaningful* audits, or will they just be a checkbox exercise? [Who audits the auditors?](https://www.ajl.org/auditors?ref=thenexusofprivacy.net) is a great lens for improving proposals currently in the pipelne. Returning to the ADPPA as an example: while the language in the current draft of the bill does require audits in many cases, the details fall short of these recommendations in several ways. For the bill to be effective at protecting civil rights, requirements like disclosure of audit results and involving the stakeholders most impacted by systems will need to be added. [Who audits the auditors?](https://www.ajl.org/auditors?ref=thenexusofprivacy.net) is also like gold from a corporate strategy perspective for companies who see [responsible AI as a competitive business advantage](https://www.nytimes.com/2022/06/21/technology/microsoft-facial-recognition.html?ref=thenexusofprivacy.net) as well as [algorithmic auditing startups](https://venturebeat.com/2021/01/30/what-algorithm-auditing-startups-need-to-succeed/?ref=thenexusofprivacy.net). Strategically, one way to think of work like this is as spotlighting places where "best practices" are not yet widely adopted – leaving a lot opportunities for significant competitive advantages. For example: > "\[A\]lthough many auditors consider analysis of real-world harm (65%) and inclusion of stakeholders who may be directly harmed (41%) to be important in theory, they rarely put this into practice." So, whether you're thinking about it from a research, technology, policy, or strategy perspective, it's well worth the time to delve into [Who Audits the Auditors? Recommendations from a field scan of the algorithmic auditing ecosystem](https://facctconference.org/static/pdfs%5F2022/facct22-126.pdf?ref=thenexusofprivacy.net). Fortunately, it's a very readable paper, with a wealth of information, and an excellent reference list. Kudos to the authors, and to the Algorithmic Justice League for taking on projects like this. And if you don't have time right now to read the paper, no worries ... the authors have a short video as well! ### Privacy News: June 27 URL: https://thenexusofprivacy.net/privacy-news-june-27/ Last updated: 2022-06-28T21:08:26.000Z Links from around the web ... #### [The End of Roe Means We Need a New Civil Right to Privacy](https://slate.com/technology/2022/06/end-roe-civil-right-intimate-privacy-data.html?ref=thenexusofprivacy.net) Danielle Keats Citron on Slate (slate.com) Even the most private spaces and relationships are now ripe for surveillance, every detail about our bodies, health, and relationships amassed and sold. We need to treat intimate privacy as a civil right – which requires comprehensive privacy legislation. **Legislative perspectives:** Citron had been working with lawmakers to strengthen protections. "Recent bills proposed by Sen. Elizabeth Warren and Rep. Sara Jacobs reflect these commitments. [The Health and Location Data Protection Act](https://www.warren.senate.gov/newsroom/press-releases/warren-wyden-murray-whitehouse-sanders-introduce-legislation-to-ban-data-brokers-from-selling-americans-location-and-health-data?ref=thenexusofprivacy.net), introduced by Warren and cosponsored with Sens. Ron Wyden, Sheldon Whitehouse, Patty Murray, and Bernie Sanders, would ban data brokers from selling or transferring location or health data and require the FTC to promulgate rules to implement the law. It would empower the FTC, state attorneys general, and private individuals to sue to enforce provisions of the law and to seek injunctive relief to stop companies from selling intimate data. Jacobs’ [My Body, My Data Act](https://sarajacobs.house.gov/news/documentsingle.aspx?DocumentID=542&ref=thenexusofprivacy.net) would minimize the extent to which companies could collect and retain reproductive health data, and prohibit such data from being disclosed or misused." **Take action:** Tell Congress to pass the My Body, My Data act! [EFF's page makes it easy.](https://act.eff.org/action/pass-the-my-body-my-data-act?ref=thenexusofprivacy.net) ### [Your data is worth more than your life to tech companies](https://www.protocol.com/newsletters/sourcecode/post-roe-data-tech-companies?ref=thenexusofprivacy.net) Brian Kahn and the Source Code team on Protocol (protocol.com) We’re about to find out how much users’ data is worth to tech companies. #### [Tech Companies Won’t Say If They’ll Give Cops Abortion Data](https://vice.com/en/article/v7vmm4/tech-companies-wont-say-abortion-data-roe-v-wade?ref=thenexusofprivacy.net) Joseph M Cox on vice.com Motherboard asked Facebook, Twitter, Snapchat, TikTok, Google, Amazon, Discord, Verizon, AT&T, T-Mobile, Binance, Kraken, CashApp, Coinbase, Venmo, Uber and Lyft. if they’ll provide law enforcement with user data related to abortions. None of them answered the question. **Legislative perspectives:** the latest draft of the ADPPA (proposed federal privacy legislation) allows companies to share data with law enforcement even without a court order, subpena, or warrant. > Wondering how many of these companies have done a human rights impact assessment of how the data they collect will contribute to human rights violations in the post-Roe era... [#itsthebusinessmodel](https://twitter.com/hashtag/itsthebusinessmodel?src=hash&ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net)[https://t.co/YzD97s2MDr](https://t.co/YzD97s2MDr?ref=thenexusofprivacy.net) > > — Ranking Digital Rights (@rankingrights) [June 27, 2022](https://twitter.com/rankingrights/status/1541440849992720386?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) #### [Big Tech silent on future data privacy in post-Roe America](https://theregister.com/2022/06/24/big%5Ftech%5Fpost%5Froe%5Fwade?ref=thenexusofprivacy.net) Jessica Lyons Hardcastle on The Register (theregister.com) We asked what they will do to prevent cases being built against women. So far: Nothing #### [HIPAA won’t protect you, if prosecutors want your reproductive health records](https://statnews.com/2022/06/24/hipaa-wont-protect-you-if-prosecutors-want-your-reproductive-health-records?ref=thenexusofprivacy.net) Eric Boodman on STAT (statnews.com) In states that ban abortion, one legal expert said, simply the suspicion that a patient had an abortion would be enough to allow law enforcement to poke around in their medical records under the guise of identifying or locating a suspect. #### [With Roe overturned, tech companies will have to weigh big data questions](https://marketplace.org/shows/marketplace-tech/with-roe-overturned-tech-companies-will-have-to-weigh-big-data-questions?ref=thenexusofprivacy.net) Kimberly Adams on Marketplace (marketplace.org) How will firms react in terms of digital privacy and user activity online with abortion now criminalized in some states? #### [Meet SmartLINK, the App Tracking Nearly a Quarter Million Immigrants](https://themarkup.org/the-breakdown/2022/06/27/meet-smartlink-the-app-tracking-nearly-a-quarter-million-immigrants?ref=thenexusofprivacy.net) Giulia McDonnell and Nieto Del Rio on The Markup (themarkup.org) Officials say the phone-based app is not meant to conduct “surveillance”—and a quick test didn’t raise red flags. But immigrants and advocates aren’t convinced. ## And ... [You.com is taking on Google with AI, apps, privacy, and personalization](https://zdnet.com/article/you-com-is-taking-on-google-with-ai-apps-privacy-and-personalization?ref=thenexusofprivacy.net), George Anadiotis on ZDNet (zdnet.com) Award-winning AI research? Check. Startup and enterprise experience? Check. Venture capital and Mark Benioff backing? Check. Is that enough for Richard Socher’s you.com to take on Google? [Access Now raises concerns about the sale of surveillance technologies in Latin America](https://business-humanrights.org/en/latest-news/access-now-raises-concern-about-the-sale-of-surveillance-technologies-in-latam-calls-more-than-20-companies-to-respond-on-human-rights-inc-co-responses?ref=thenexusofprivacy.net), on Business & Human Rights Resource Centre (business-humanrights.org) [Non-personal data likely to be dropped from new data law](https://hindustantimes.com/india-news/nonpersonal-data-likely-to-dropped-from-new-data-law-101655752906037.html?ref=thenexusofprivacy.net), Hindustan Times (hindustantimes.com) [India’s New Cybersecurity Order Drives VPN Providers to Leave, Chilling Speech and Subjecting More Indians to Government Surveillance](https://cdt.org/insights/indias-new-cybersecurity-order-drives-vpn-providers-to-leave-chilling-speech-and-subjecting-more-indians-to-government-surveillance?ref=thenexusofprivacy.net), Aliya Bhatia on Center for Democracy and Technology (cdt.org) [EDPB response to EDRi regarding the structural and procedural enforcement of the GDPR and its work to promote and safeguard data protection](https://edpb.europa.eu/our-work-tools/our-documents/letters/edpb-response-edri-regarding-structural-and-procedural%5Fen?ref=thenexusofprivacy.net), on European Data Protection Board (edpb.europa.eu) ### Privacy in a post-Roe America (Privacy News, June 24) URL: https://thenexusofprivacy.net/privacy-in-a-post-roe-us-privacy-news-june-24/ Last updated: 2026-04-15T22:43:07.000Z Earlier today the Supreme Court overturned *Roe v. Wade*, removing the constitutional right to abortion. In the 1973 *Roe* ruling, the Supreme Court had said the Fourteenth Amendment’s Due Process Clause “protects against state action the right to privacy, including a woman’s qualified right to terminate her pregnancy.” The current Supreme Court disagrees. As Paris Hatcher of Black Feminist Future points out, [there is hardly any more fundamental human right than the ability to control what happens to our bodies](https://newsone.com/4360966/supreme-court-ruling-overturning-abortion-reproductive-justice-black-liberation/?ref=thenexusofprivacy.net). **TAKE ACTION**: One of the most pivotal things you can do at this moment is to [support abortion funds](https://secure.actblue.com/donate/supportabortionfunds?ref=thenexusofprivacy.net). Abortion funds provide funding, travel, lodging, and other wrap-around supports. [Donations to National Network of Abortion Funds](https://secure.actblue.com/donate/supportabortionfunds?ref=thenexusofprivacy.net) are split between abortion funds around the country. > Today’s decision abandons nearly 50 years of precedent & marks the first time in history that the Supreme Court has taken away a fundamental right. > The Court’s decision will likely lead to half of U.S. states immediately taking action to ban abortion outright. > > — SisterSong (@SisterSong\_WOC) [June 24, 2022](https://twitter.com/SisterSong%5FWOC/status/1540353625158983682?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) Most of the "trigger laws" criminalizing abortion once Roe is overturned don't go into effect immediately. Lauren Rankin (author of *Our Bodies on the Line*) has a Twitter thread with details. > The Supreme Court just overturned Roe v. Wade and Planned Parenthood v. Casey. This is devastating, an absolute national tragedy. But know that this isn't the end of this fight, that activists and organizers are diligently working to continue access to safe abortion. A thread: > > — Lauren Rankin (@laurenarankin) [June 24, 2022](https://twitter.com/laurenarankin/status/1540337557690470400?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) **TAKE ACTION:** Stephanie Baer's [Here’s How To Fight For Abortion Rights Now That Roe V. Wade Is Gone](https://www.buzzfeednews.com/article/skbaer/how-help-abortion-rights-after-roe?ref=thenexusofprivacy.net) on *Buzzfeed* and Meg O'Connor's [Here’s How You Can Help People After Roe](https://theappeal.org/heres-how-to-help-people-seeking-abortion-after-roe/?ref=thenexusofprivacy.net) on *The Appeal* have suggestions about what to do – and what not to do. By contrast, here on the West Coast, the Governors of Washington, Oregon, and California have just announced [Multi-State Commitment to defend access to reproductive health care](https://www.governor.wa.gov/news-media/west-coast-states-launch-new-multi-state-commitment-reproductive-freedom-standing-united?ref=thenexusofprivacy.net), including abortion and contraceptives, and committed to protecting patients and doctors against efforts by other states to export their abortion bans to our states. > I'd like to note that Thomas wants to "revisit" other unenumerated rights - same sex marriage, contraception, and other private consensual sexual acts (Lawrence case). > > What was missing, you ask? Interracial marriage. Wonder why that is. /s/ Cherrypicking. It's on-brand. [#SCOTUS](https://twitter.com/hashtag/SCOTUS?src=hash&ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) > > — Bärí A. Williams, Esq. (@BariAWilliams) [June 24, 2022](https://twitter.com/BariAWilliams/status/1540365394615013376?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) A lot of other protections also depend on the privacy rights that SCOTUS just gutted. As Clarence Thomas made clear in his dissent, by the same logic [the Supreme Court is also likely to end the right to contraception (overruling *Griswold*), same-sex marriage (*Obergfell*), and same-sex sexual activity (*Lawrence*)](https://www.politico.com/news/2022/06/24/thomas-constitutional-rights-00042256?ref=thenexusofprivacy.net). And of course, ending the right to abortion will also have a huge impact on informational privacy.\* A few links: - Digital Defense Fund's [Guide to Abortion Privacy](https://digitaldefensefund.org/ddf-guides/abortion-privacy?ref=thenexusofprivacy.net) has some excellent suggestions about how to protect yourself if you're pregnant and/or looking for information about an abortion. Tom Read's [How to Keep Your Abortion Private in 2024](https://www.vpnmentor.com/blog/keep-your-abortion-private/?ref=thenexusofprivacy.net) is a good complement, with some of the same points as well as some additional suggestions. - EFF's [What Companies Can Do Now to Protect Digital Rights In A Post-Roe World](https://www.eff.org/deeplinks/2022/05/what-companies-can-do-now-protect-digital-rights-post-roe-world?ref=thenexusofprivacy.net), by Corynne McSherry and Katharine Trendacosta', looks at what people creating software and systems need to keep in mind. - [Anti-Abortion Centers’ Databases Could Be Weaponized Post-Roe](https://time.com/6189528/anti-abortion-pregnancy-centers-collect-data-investigation/?ref=thenexusofprivacy.net), by Abigail Adams and Vera Bergengruen on *Time*, looks at how fake "pregnancy crisis centers" violate abortion seekers' privacy. As we discussed a few days ago, [Google contributes to the problem by sending people searching for abortions to these fake clinics](https://www.reuters.com/legal/transactional/exclusive-us-lawmakers-urge-google-fix-abortion-searches-that-steer-women-fake-2022-06-17/?ref=thenexusofprivacy.net). **TAKE ACTION:** [Tell Google to stop profiting from anti-abortion disinformation](https://act.counterhate.com/page/107525/petition/1?ref=thenexusofprivacy.net) using Center for Countering Digital Hate's form. - [The Impotence of the Fourth Amendment in a Post-Roe World](https://www.lawfareblog.com/impotence-fourth-amendment-post-roe-world?ref=thenexusofprivacy.net), on *Lawfare*, looks at legal aspects of the surveillance architectures of this new world. - Surveillance Technology Oversight Project and Rad Tech hosted a discussion yesterday with JoyceDellinger and Hayley Tsukayama of EFF on [Reproductive Freedom Under Surveillance](https://twitter.com/STOPSpyingNY/status/1540092807401967616?ref=thenexusofprivacy.net) > S.T.O.P. x RadTech: Reproductive Freedom Under Surveillance [https://t.co/nItgMYS6TD](https://t.co/nItgMYS6TD?ref=thenexusofprivacy.net) > > — S.T.O.P.—Surveillance Technology Oversight Project (@STOPSpyingNY) [June 23, 2022](https://twitter.com/STOPSpyingNY/status/1540092807401967616?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) \* [Privacy isn’t in the Constitution – but it’s everywhere in constitutional law](http://theconversation.com/privacy-isnt-in-the-constitution-but-its-everywhere-in-constitutional-law-183204?ref=thenexusofprivacy.net), by Scott Skinner-Thompson on *The Conversation,* is a good short introduction to the distinctionn between "decisional privacy" (also known as "autonomy privacy") and "informational privacy". As Kate Bertash of Digital Defense Fund said at Color of Surveillance earlier this week, you can't have one without the other. --- Image Credit: from Digital Defense Fund's [Guide to Abortion Privacy](https://digitaldefensefund.org/ddf-guides/abortion-privacy?ref=thenexusofprivacy.net) . Image description: The image is titled “Digital Security for Abortion and Pregnancy Privacy.” A white person with braces and short dark curly hair says, “Worried about someone reading your messages or browser history?” Small images provide advice. A hand holds a phone with a green lock screen displaying the word “Enter” and a dial pad. Text reads: “Use a strong PIN on your devices.” A green circle in a pink background contains an illustration of a purple mustache, black glasses, and a pink hat. Text reads: “Browse in an incognito window.” A white magician with brown hair wearing a white shirt and purple cape uses a purple wand to make a purple hat’s contents disappear. Text reads: “Turn on disappearing messages in secure messaging app like Signal.” A brown broom sweeps dust. Text reads: “Clear browsing history.” The image is signed “The Digital Defense Fund x Hazel Mead.” ### Three lessons from "the other Washington" -- Federal Privacy Legislation Update, 6/22 URL: https://thenexusofprivacy.net/the-view-from-the-other-washington-federal-privacy-legislation-adppa-update-6-22/ Last updated: 2026-04-15T22:42:00.000Z The American Data Privacy and Protection Act (ADPPA) [was formally introduced yesterday](https://energycommerce.house.gov/sites/democrats.energycommerce.house.gov/files/documents/BILLS-117hr8152ih.pdf?ref=thenexusofprivacy.net), and a [Consumer Protection and Commerce Subcommittee markup](https://energycommerce.house.gov/newsroom/press-releases/ec-announces-subcommittee-markup-of-bipartisan-bicameral-privacy-legislation?ref=thenexusofprivacy.net) is scheduled for Thursday at 7:30 am Pacific time (10:30 am Eastern). The new version is 120 pages so there's a lot of new material – as well as plenty of changes. Odia Kagan has [an initial summary of changes from the earlier draft](https://www.linkedin.com/posts/odiakagan%5Fadppa-dataprivacyfomo-dataprotection-activity-6945487279385698305-1t1K?ref=thenexusofprivacy.net) on LinkedIn, Omer Tene has [highlights](https://twitter.com/omertene/status/1539847896081829888?ref=thenexusofprivacy.net) on Twitter, and [I'm collecting reactions in a Twitter moment](https://twitter.com/i/events/1539731401376792576?ref=thenexusofprivacy.net). *Update: as expected, the subcommittee advanced ADPPA with no further changes.* [*Here's the live-tweeting of the markup.*](https://threadreaderapp.com/thread/1539980715747463170.html?ref=thenexusofprivacy.net)*. David Stauss'* [*Federal Privacy Bill Voted Out of House Subcommittee*](https://jdsupra.com/legalnews/federal-privacy-bill-voted-out-of-house-2845876?ref=thenexusofprivacy.net) *on JD Supra is a good writeup.* And there's been a lot of other action in the week since I wrote [Federal privacy legislation: It’ll be an interesting summer!](https://thenexusofprivacy.net/federal-privacy-legislation-the-best-chance-yet-to-pass-a-strong-bill/). - Last week's [ADPPA hearing](https://energycommerce.house.gov/committee-activity/hearings/hearing-on-protecting-americas-consumers-bipartisan-legislation-to?ref=thenexusofprivacy.net) highlighted the bill's encouraging momentum and the importance of addressing civil rights and algorithms and including a data minimization requirement – but also illustrated the challenges of getting to agreement on thorny issues like a private right of action (whether people can sue companies who break the law and violate their privacy) and pre-emption (whether or not a federal bill preempts state privacy laws). Former FTC Bureau of Consumer Protection Director Jessica Rich's [Readout on House Privacy Hearing: Wide Attendance, Lots of Issues, Full Steam Ahead](https://www.adlawaccess.com/2022/06/articles/readout-on-house-privacy-hearing-wide-attendance-lots-of-issues-full-steam-ahead/?ref=thenexusofprivacy.net) on Kelley Drye's *Add Law Access Blog ,*and [Insights from the House Subcommittee Hearing on ADPPA](https://www.jdsupra.com/legalnews/insights-from-the-house-subcommittee-2790383/?ref=thenexusofprivacy.net), by Hilary Higgins, Ali Jessani, and Kirk Nahra of Wilmer Hale on *JD Supra,* are both good overviews. - Senators Warren, Wyden, Whitehouse, Murray, and Sanders introduced the [Health and Location Data Protection Act](https://vice.com/en/article/4axydq/legislation-aims-to-ban-health-and-location-data-protection-act?ref=thenexusofprivacy.net) (HLDPA). - [EFF has urged Congress to strengthen ADPPA](https://www.eff.org/deeplinks/2022/06/eff-urges-congress-strengthen-american-data-privacy-and-protection-act?ref=thenexusofprivacy.net), with recommendations including making it non-preemptive; strengthening the private right of action, removing exemptions; prohibiting "pay for privacy" schemes; and providing stronger safeguards by making the bill fully opt-in and strengthening other protections. - [A dozen Washington state Indivisible groups](https://indipluswa.medium.com/indivisible-letter-to-sen-cantwell-and-rep-mcmorris-rodgers-on-federal-privacy-legislation-8071ba1d350e?ref=thenexusofprivacy.net) sent mail to Senator Cantwell and Representative McMorris Rodgers (one of the sponsors of the ADDPA), focusing on non-preemption and the importance of well as exploring how effective the legislation will be at stopping the kinds of data abuses that are occurring today as well as looking ahead to developing threats to privacy. - [Senator Cantwell's still not on board with the ADDPA](https://www.washingtonpost.com/technology/2022/06/22/privacy-bill-maria-cantwell-congress/?ref=thenexusofprivacy.net), citing "major enforcement holes” and saying that is currently too weak to override state privacy laws. - ACLU says ADPPA, and Senator Cantwell's still-unreleased new draft of COPPA, [need significant revision](https://www.aclu.org/letter/aclu-letter-urgent-concerns-privacy-legislation-and-legislative-process?ref=thenexusofprivacy.net), and expressed concern that the bills will be rushed to the floor. I certainly share the ACLU's concern about bills being rushed to the floor. Congress is on recess for two weeks starting on Monday, and then has only four weeks between the July and August recesses, so there really isn't a lot of time. In Washington state's legislative battles over privacy, big tech tried to use the compressed time frame to try to sneak very weak language in the Bad Washington Privacy Act through. It's easy to imagine them using similar tactics at the federal level. Of course, those tactics haven't worked for them in Washington state. The Bad Washington Privacy Act failed once again this session, and is now 0-for-4\. Meanwhile, those of us working for strong privacy and civil rights protections have continued to build our power, and have an opportunity to pass some *good* legislation in 2023\. So as things heat up in DC, there's a lot to learn from our experiences here in "the other Washington". Here's three important lessons. - Language that looks good may well be weaker than it seems - Get concrete! Will the bill actually stop real-world privacy and civil rights abuses? - Build a broad alliance of people and groups who want strong privacy protections ## Language that looks good may well be weaker than it seems In testimony at a 2021 hearing, former Microsoft privacy compliance lead Gregg Brown talked about how the Bad Washington Privacy Act's very nuanced definitions were written to "nuance away" the rights the bill appeared to grant. Susan Grant of Consumer Federation of America mad similar points in her testimony, citing "loopholes and definitional problems that essentially neuter the protections the bill is supposed to provide." [A Deep Dive into the Affiliates Loophole](https://wa-privacy.net/affliates-loophole/?ref=thenexusofprivacy.net) goes into detail on a specific example from this year's legislation – one that was so nuanced that even a good-faith attempt to fix the probleml fell short. ADPPA uses different language from the Bad Washington Privacy Act, but there may well be similar problems. A couple of examples: - Jolynn Dellinger of Duke Law's Kenan Institute for Ethics suggested that ADPPA's use of word “precise” in its definition of “geolocation information” is going to lead to ["litigation and, importantly, circumvention."](https://twitter.com/MindingPrivacy/status/1533797637949890560?ref=thenexusofprivacy.net) The revised draft defines "precise" as "within 1000 feet"; is that a strong enough definition to alleviate these concerns. - Ali Akhatib of the Center for Applied Data Ethics highlighted concerns about the bill's [exclusions of de-identified data, employee data, and publicly available information](https://twitter.com/%5Falialkhatib/status/1532819155618914305?ref=thenexusofprivacy.net). Alan Butler of EPIC suggests that the [de-identification is narrowly defined](https://twitter.com/AlanInDC/status/1532893179032260616?ref=thenexusofprivacy.net); again, is the definition strong enough to alleviate concerns? - Cynthia Khoo of Georgetown Law and Ben Winters of EPIC discussed [potential limitations of the ADPPA's definition of "algorithm"](https://twitter.com/Cyn%5FK/status/1532789046719619073?ref=thenexusofprivacy.net). The revised version has an even more limited definition. Does this undercut the civil rights protections? And these are only the tip of the iceberg – the revised draft is 120 pages long, so there are dozens more. Ideally, legislators and staff would take the time to dig deeply into all of these issues, understand what the tradeoffs are, and refine the definitions. But the short timeframe means that's unlikely. Instead, they're likely to primarily hear input from industry lobbyists. So it's challenging for privacy and civil rights advocates to identify the problems and push back effectively. ## Get concrete! Will the bill actually stop real-world privacy and civil rights abuses? One effective tactic we've used to cut through the complexity of the legislation is to focus on real-world privacy abuses. How effective will proposed legislation actually be at stopping them? If it falls short, how can it be strengthened? I briefly mentioned one example of this in yesterday's [privacy news roundup](https://thenexusofprivacy.net/three-health-care-privacy-stories/). [Doctor check-in software from Phreesia harvests patients health data and uses it to target ads](https://washingtonpost.com/technology/2022/06/13/health-privacy?ref=thenexusofprivacy.net). Does their approach to getting consent meet the ADPPA's requirements for "affirmative express consent"? If so, then the bill's current langauge will do nothing to stop this abusive practice – in fact, it legitimizes it. Another good example is the way [Grindr sold "de-identified" location data that was used to out a Catholic priest](https://www.wsj.com/articles/grindr-user-data-has-been-for-sale-for-years-11651492800?ref=thenexusofprivacy.net). Would this fall under the "de-identified data" exception mentioned above? In the Washington legislative discussions, we also looked at abuses by ed tech companies like Naviance and PowerSchool (discussed [here](https://themarkup.org/machine-learning/2022/01/11/this-private-equity-firm-is-amassing-companies-that-collect-data-on-americas-children?ref=thenexusofprivacy.net) and [here](https://themarkup.org/machine-learning/2022/01/13/college-prep-software-naviance-is-selling-advertising-access-to-millions-of-students?ref=thenexusofprivacy.net)) and CourseHero (discussed [here](https://www.insidehighered.com/news/2022/02/15/course-hero-contends-student-privacy-concerns?ref=thenexusofprivacy.net)), location data from Muslim prayer apps getting non-conensually shared with military contractors, and the reports of [ICE investigators getting warrantelss access to utility data to target immigrants](https://www.washingtonpost.com/technology/2021/02/26/ice-private-utility-data/?ref=thenexusofprivacy.net). Recent reports of [ICE searches of Lexis/Nexis data](https://theintercept.com/2022/06/09/ice-lexisnexis-mass-surveillances/?ref=thenexusofprivacy.net) provide another good test case. If ADPPA's currently language doesn't protect against all of these cases, it will need to be improved if it is to protect these and other vulnerable groups. ## Build a broad alliance of people and groups who want strong privacy protections One of our organizing strengths has been the breadth of the loose alliance we put together for strong privacy protections. Key participants here include: - The Tech Equity Coalition, convened by ACLU of Washington and comprised primarily of individuals representing communities historically targeted by surveillance - Indivisibles and other progressive activists - WA People's Privacy Network's outreach to community organizations. A similar organizing approach at the national level could really strengthen the had of groups who are pushing for legislation to be strengthened. For example, Lawyers' Committee on Civil Rights and EPIC Privacy both made a good case at the ADPPA hearing for strengthening the private right of action (PRA), as did EFF in their email, but they'll need help in overcoming the lobbying from multiple industry associations who are telling Congress that even the relatively weak PRA in the current draft would cause the sky to fall. And there's certainly room for improvement on what we've done so far in Washington state. Can we work with small businesses to push back against loopholes and exemptions that favor big tech (even though we may not see eye-to-eye with them on the private right of action)? What about libertiarians who share concerns about exemptions for law enforcement and other government agencies, or states-rights proponents who don't approve of pre-emption? ### Organizing doesn't just happen ![A person with sunglasses at a political rally. In the background: people holding up signs](https://thenexusofprivacy.net/content/images/2022/06/maya-at-poor-peoples-campaign-in-dc-1.jpg) Maya Morales, at the Poor People's Campaign Moral March in Washington DC, June 18 2022 One thing I really want to highlight is that this kind of organizing requires a lot of work. Non-profits like EPIC Privacy and ACLU work on a lot of issues, and so have limited resources to invest here. Other privacy non-profits like Future of Privacy Forum get their funding primarily from industry, so aren't likely to help build resistance. Maya Morales of the WA People's Privacy Network has played a big role in our organizing here in Washington state, including helping us get out of the "privacy bubble" by working with groups like Washington Poor People's Campaign who don't always get involved in privacy issues. [Maya's got a fundraiser on Go Fund Me](https://www.gofundme.com/f/support-a-data-privacy-organizer?ref=thenexusofprivacy.net) ... please join me in supporting her! And if you’re a grantmaker or larger donor and would like to explore funding longer-term work with WA People's Privacy Network in the future, please reach out and I'll be happy to connect you with her. ## To be continued Congress will have to move quickly to get anything through this session. So expect to hear a lot more about federal privacy legislation this summer – and, most likely, more lessons from our experiences here in the other Washington. --- *Image credits:* - photo of Washington State Capitol by Al Toney, via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons](https://en.wikipedia.org/wiki/en:Creative%5FCommons?ref=thenexusofprivacy.net)[Attribution-Share Alike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net) license. - photo of Poor People's Campaign Moral March copyright Maya Morales, used with permission ### Health care privacy and more (Privacy News, June 21) URL: https://thenexusofprivacy.net/three-health-care-privacy-stories/ Last updated: 2022-06-24T19:13:45.000Z Recent privacy news from around the web ... ### [You agreed to what? Doctor check-in software harvests your health data.](https://washingtonpost.com/technology/2022/06/13/health-privacy?ref=thenexusofprivacy.net) Geoffrey A. Fowler on the *Washington Post* (washingtonpost.com) Software that thousands of clinics and hospitals across the United States use to check people into appointment harvests the information people provide and uses it to target ads. How can they do that? [Phreesia](https://www.phreesia.com/?ref=thenexusofprivacy.net), the software company, includes a paragraph authorizing this in the consent form people sign when they're checking in – and most people don't bother to read it, so consent to sharing. It's a classic example of the way a "notice and consent" approach allows companies to expoit us as long as we don't say no. **THE DEVIL IS IN THE DETAILS:** [ADPPA](https://www.commerce.senate.gov/services/files/6CB3B500-3DB4-4FCC-BB15-9E6A52738B6C?ref=thenexusofprivacy.net) Section 204 (A) (page 33) requires "affirmative express consent" to transfer sensitive data. Does Phreesia's consent form language meet the requirements for "affirmative express consent" in Section 2 (1) (page 2)? > “I hereby authorize my health care provider to release to Phreesia’s check-in system my health information entered during the automated check-in process … to help determine the health-related materials I will receive as part of my use of Phreesia. The health-related materials may include information and advertisements related to treatments and therapies specific to my health status.” ### [Facebook Is Receiving Sensitive Medical Information from Hospital Websites](https://themarkup.org/pixel-hunt/2022/06/16/facebook-is-receiving-sensitive-medical-information-from-hospital-websites?ref=thenexusofprivacy.net) Todd Feathers, Simon Fondrie-Teitler, Angie Waller, and Surya Mattu on *The Markup* > On a TX hospital’s website, we searched for “home abortion” providers. When we clicked the “Schedule Appointment” button on a doctor’s page, Facebook received: > > \- Our device’s IP address > \- The doctor’s name > \- Our search term[https://t.co/fvToCMR9x5](https://t.co/fvToCMR9x5?ref=thenexusofprivacy.net) > > — Todd Feathers (@ToddFeathers) [June 16, 2022](https://twitter.com/ToddFeathers/status/1537420915348320256?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) Thursday, The Markup's investigation revealed that 33 of the top 100 hospitals in the US have a "Meta Pixel" on their websites which sends information about people's medical conditions, prescriptions, and doctor’s appointments to Facebook (aka Meta). Friday, Bloomberg's Evan Peng reported [a class-action suit in California](https://www.bloomberg.com/news/articles/2022-06-17/meta-sued-over-claims-patient-data-secretly-sent-to-facebook?ref=thenexusofprivacy.net) seeks compensatory and punitive damages for "breach of contract, violation of the federal Electronic Communications Privacy Act and a constitutional claim for invasion of privacy, among other allegations." The hospitals involved may have violated HIPAA. Nadia Bey's [What is Meta Pixel, the code detected on health system websites in NC and beyond?](https://charlotteobserver.com/news/local/article262649112.html?ref=thenexusofprivacy.net), in the *Charlotte Observer*, has some local perspectives – and sets it in the context of The Markup's reporting back in April that [information from people who applied for federal student aid had also been sent to Facebook](https://themarkup.org/pixel-hunt/2022/04/28/applied-for-student-aid-online-facebook-saw-you?ref=thenexusofprivacy.net). **GET INVOLVED**: The Markup's reporting is part of the Facebook Pixel Hunt, a collaboration between Markup journalists and Mozilla resarchers. If you run Firefox, [here's how you can help](https://themarkup.org/pixel-hunt/2022/01/21/help-us-investigate-facebook-pixel-tracking?ref=thenexusofprivacy.net)! **Updates**: - [This Children’s Hospital Network Was Giving Kids’ Information to Facebook](https://themarkup.org/pixel-hunt/2022/06/21/this-childrens-hospital-network-was-giving-kids-information-to-facebookhttps://www.newsobserver.com/news/business/article262796318.html?ref=thenexusofprivacy.net), by Alfred Ng and Simon Fondrie-Teitler on *The Markup*, is another example of a "Meta Pixel" violating HIPAA. - [Hospitals that sent patient data to Facebook should be investigated, state reps say](https://www.newsobserver.com/news/business/article262796318.html?ref=thenexusofprivacy.net), by Teddy Rosenbluth in the *News & Observer*, reports that North Carolina State Representatives Brian Farkas and Donny Lambeth have asked the attorney general to investigate whether hospitals violated consumer protection or privacy laws, and to recommend legal changes that would protect patients from privacy breaches in the future – and the AG confirms that he's investigating ### [U.S. lawmakers urge Google to fix abortion searches that steer women to ‘fake clinics’](https://www.reuters.com/legal/transactional/exclusive-us-lawmakers-urge-google-fix-abortion-searches-that-steer-women-fake-2022-06-17/?ref=thenexusofprivacy.net) Diane Bartz on *Reuters* Last week, the Center for Countering Digital Hate released a study finding that [many Google search results for abortion clinics instead returned links to so-called "pregnancy crisis centers"](https://counterhate.com/blog/anti-abortion-fake-clinics/?ref=thenexusofprivacy.net) – fake abortion clinics that instead attempt to convince people not to get abortions. Now, 20 Democratic members of Congress have sent [a letter](https://www.warner.senate.gov/public/%5Fcache/files/5/6/5698c724-cc0d-42f6-bbb6-b05e472b4564/26F26BB28841042A7931EEC58AC80E08.anti-abortion-letter-to-google-final.pdf?ref=thenexusofprivacy.net) to Google telling them to ensure that searches return accurate information. If you're wondering why this is a privacy story, check out Grace Oldham and Dhruv Mehrotra [Facebook and Anti-Abortion Clinics Are Collecting Highly Sensitive Info on Would-Be Patients](https://revealnews.org/article/facebook-data-abortion-crisis-pregnancy-center?ref=thenexusofprivacy.net) on Reveal, a joint investigation with The Markup. These sites are using Meta Pixel to get data about whether a person was considering abortion or looking to get a pregnancy test or emergency contraceptives with the fake pregnancy crisis centers Google sends them to. See also: [Lawmakers urge Google to fix abortion searches suggesting ‘fake clinics’](https://www.washingtonpost.com/health/2022/06/18/google-abortion-clinic-searches-fake/?ref=thenexusofprivacy.net), Kim Bellware, *Washington Post,* with more details and a list of the legislators. **TAKE ACTION:** [Tell Google to stop profiting from anti-abortion disinformation](https://act.counterhate.com/page/107525/petition/1?ref=thenexusofprivacy.net) using Center for Countering Digital Hate's form. ## And ... [**This new Windows 11 privacy feature shows when apps access your microphone, camera or location**](https://zdnet.com/article/this-new-windows-11-privacy-feature-shows-when-apps-access-your-microphone-camera-or-location?ref=thenexusofprivacy.net), Liam Tung, zdnet.com [**Privacy Law in South Korea Whiteboard**](https://teachprivacy.com/privacy-law-in-south-korea-whiteboard?ref=thenexusofprivacy.net), a one-page summary of outh Korea’s Privacy Law, the Personal Information Protection Act, by Prof. Daniel Solove on teachprivacy.com [**S.T.O.P. x RadTech: Reproductive Freedom Under Surveillance**](https://us02web.zoom.us/webinar/register/WN%5FmS5qPz2nS-qibN2DnsISOA?ref=thenexusofprivacy.net) **\-** Wednesday at 3:00 pm Pacific (6:00 Eastern), featuringHayley Tsukayama of Electronic Frontier Foundation, focusing on state legislation and Prof. Jolynn Dellinger of Duke Law's Kenan Institute for Ethics, moderated by S.T.O.P's Alfred Fox-Cahn. --- *Image credit:* Daquella manera on [Flickr ](https://www.flickr.com/photos/62518311@N00/466172168?ref=thenexusofprivacy.net) via [Wikipedia Commons.](https://commons.wikimedia.org/wiki/File:Neon%5Fsign%5FNEWS.jpg?ref=thenexusofprivacy.net) licensed under the [Creative Commons Attribution 2.0](https://creativecommons.org/licenses/by/2.0/?ref=thenexusofprivacy.net) license. ### International perspectives - and Color of Surveillance (Privacy News, June 17) URL: https://thenexusofprivacy.net/privacy-news-june-17/ Last updated: 2022-06-21T17:39:38.000Z Today's roundup has an international focus, looking at perspectives on the EU's GDPR regulations, as well as new proposed legislation in the Canada and the UK. First, though, I wanted to highlight next Wednesday's [The Color of Surveillance 2022](https://www.law.georgetown.edu/privacy-technology-center/events/the-color-of-surveillance-policing-of-abortion-and-reproduction/?ref=thenexusofprivacy.net) conference, hosted by Georgetown Law's Center for Privacy and Technology, focusing on [Policing of Abortion and Reproduction](https://www.law.georgetown.edu/privacy-technology-center/events/the-color-of-surveillance-policing-of-abortion-and-reproduction/?ref=thenexusofprivacy.net). It's a great list of speakers, including activists Rosann Mariappuram of Jane’s Due Process and Kate Bertash of Digital Defense Fund as well as professors Khiara M. Bridges of UC Berkeley School of Law and Leslie J. Reagan of University of Illinois Urbana-Champaign – and poet, abolitionist, cultural worker, and therapist Cynthia Parker-Ohene. The event will: - hold space for reflections on and reactions to the likely overturning of *Roe v. Wade*, and the implications for the future of gender equality, racial justice, LGBTQ+ rights, and civil rights; - draw connections between mass surveillance and policing, the criminalization of abortion, and the growing power of the corporations that use our data to build and sell powerful surveillance technologies; and - situate the leaked SCOTUS draft opinion in the context of the current sociotechnological and legal landscape that people seeking an abortion must navigate, while providing historical context to illuminate the short- and long-term implications of the decision. You can RSVP for the online event [here](https://georgetown.zoom.us/webinar/register/WN%5FymUybNaIQ1upEO-jzqnleA?ref=thenexusofprivacy.net). Live captioning will be provided. And now on to the news ... ### [EU privacy chief bashes lack of GDPR enforcement against Big Tech](https://politico.eu/article/gdpr-europe-wojciech-wiewiorowski-privacy-chief-lack-enforcement-big-tech?ref=thenexusofprivacy.net) Vincent Manancourt on POLITICO (politico.eu) Here in the US, we often look to Europe's GDPR as an example of strong privacy legislation – especially contrasted with the very weak privacy laws big tech has been pushing. But it's far from perfect. In his speech wrapping up the [EDPS Conference](https://www.edpsconference2022.eu/en/conference/programme?ref=thenexusofprivacy.net), European Data Protection Supervisor Wojciech Wiewiórowski on criticized the lack of privacy enforcement against tech companies like Meta and Google, and suggested the need for a more centralized enforcement model. Related, from a few days ago: [What’s wrong with the GDPR?](https://politico.eu/article/wojciech-wiewiorowski-gdpr-brussels-eu-data-protection-regulation-privacy?ref=thenexusofprivacy.net), also by Vincent Manancourt, including an interview with Wiewiórowski as well as quotes from Max Schrems of NOYB. ### [Brace yourselves: new UK data laws are coming](https://openrightsgroup.org/blog/brace-yourselves-new-uk-data-laws-are-coming?ref=thenexusofprivacy.net) Mariano delli Santi on Open Rights Group (openrightsgroup.org) Brexit means the United Kingdom can decide not to be bound by the GDPR, and the government has just announced [their plans for extremely weak legislation](https://www.gov.uk/government/news/new-data-laws-to-boost-british-business-protect-consumers-and-seize-the-benefits-of-brexit?ref=thenexusofprivacy.net). Open Rights Group describes it as "proposing to bonfire your rights and remove the protections the law affords to your private life, vulnerabilities, and aspirations." Related: Heather Burns' [Pop-ups are dead, long live pop-ups: or, the bait-and-switch hidden in today’s cookie announcement](https://webdevlaw.uk/2022/06/17/data-reform-bill-cookie-popups?ref=thenexusofprivacy.net) goes into more detail. ### [The Groundhog Day Privacy Bill: The Government Waited Months to Bring Back Roughly the Same Privacy Plan?!](https://michaelgeist.ca/2022/06/the-groundhog-day-privacy-bill?ref=thenexusofprivacy.net) Michael Geist (michaelgeist.ca) Meanwhile, Canada has introduced [new legislation, C-27, regulating privacy and AI](https://parl.ca/legisinfo/en/bill/44-1/c-27?ref=thenexusofprivacy.net). Michael Geist is not impressed: "it looks an awful lot like the [last privacy bill](https://www.parl.ca/DocumentViewer/en/43-2/bill/C-11/first-reading?ref=thenexusofprivacy.net) that died with last year’s election call and which never even advanced to the committee stage". Canada's Privacy Commissioner called the last bill (C-11) a "step back" for privacy, so it's hard to be optimistic about this one. Anja Karadeglija's [Privacy bill to give Canadians more control over personal data, but doesn’t limit collection](https://nationalpost.com/news/privacy-bill-to-give-canadians-more-control-over-personal-data-but-doesnt-limit-collection?ref=thenexusofprivacy.net) in the National Post is a good short overview of the situation. Related, from last week: [Why is the Canadian government so indifferent to privacy](https://www.michaelgeist.ca/2022/06/canadianprivacy/?ref=thenexusofprivacy.net), also by Michael Geist. ## And ... [Anti-Blackness and Islamophobia in Tech: Under the Gaze of Online Surveillance](https://amaliah.com/post/64927/online-surveillance-of-communities?ref=thenexusofprivacy.net), Vanessa Taylor on Amaliah (amaliah.com) [Firefox Rolls Out Total Cookie Protection By Default To All Users](https://blog.mozilla.org/en/products/firefox/firefox-rolls-out-total-cookie-protection-by-default-to-all-users-worldwide?ref=thenexusofprivacy.net), on The Mozilla Blog (blog.mozilla.org) [Leaked Audio From 80 Internal TikTok Meetings Shows That US User Data Has Been Repeatedly Accessed From China](https://buzzfeednews.com/article/emilybakerwhite/tiktok-tapes-us-user-data-china-bytedance-access?ref=thenexusofprivacy.net), Emily Baker-White on BuzzFeed News (buzzfeednews.com) [How the Federal Government Buys Our Cell Phone Location Data](https://www.eff.org/deeplinks/2022/06/how-federal-government-buys-our-cell-phone-location-data?ref=thenexusofprivacy.net), Bennett Cyphers, on EFF's Deep Links (eff.org) [Cops Will Be Able to Scan Your Fingerprints With a Phone](https://wired.com/story/police-contactless-fingerprints-photos?ref=thenexusofprivacy.net), Matt Burgess onWIRED (wired.com) ### Privacy News - June 15 URL: https://thenexusofprivacy.net/privacy-news-june-15/ Last updated: 2022-06-15T19:09:43.000Z *My plan for The Nexus of Privacy is to combine "news roundups" – links with short commentary – with more detailed posts like yesterday's on* [*federal privacy legislation*](https://thenexusofprivacy.net/federal-privacy-legislation-the-best-chance-yet-to-pass-a-strong-bill/)*.* ## [Facebook and Anti-Abortion Clinics Are Collecting Highly Sensitive Info on Would-Be Patients](https://revealnews.org/article/facebook-data-abortion-crisis-pregnancy-center?ref=thenexusofprivacy.net) *Grace Oldham and Dhruv Mehrotra on Reveal (revealnews.org)* Facebook is collecting ultra-sensitive personal data about abortion seekers visiting "crisis pregnancy center" websites *whether or not they're logged into their Facebook account*, and enabling anti-abortion organizations to use that data as a tool to target and influence people online. So-called "crisis pregnancy centers" are fake abortion clinics that instead attempt to convince people not to get abortions. A joint investigation by Reveal from The Center for Investigative Reporting and The Markup. Related, from last week: [Google search results for abortion services are leading users to ‘fake clinics’, new study finds](https://counterhate.com/blog/anti-abortion-fake-clinics/?ref=thenexusofprivacy.net), from Center for Digital Hate, reports that over 10% of searches for “abortion clinic near me” and “abortion pill” in trigger states lead to "crisis pregnancy centers" rather than real abortion clinics. ## [Warren, Wyden, Murray, Whitehouse, Sanders Introduce Legislation to Ban Data Brokers from Selling Americans’ Location and Health Data](https://warren.senate.gov/newsroom/press-releases/warren-wyden-murray-whitehouse-sanders-introduce-legislation-to-ban-data-brokers-from-selling-americans-location-and-health-data?ref=thenexusofprivacy.net) on warren.senate.gov Sen. Elizabeth Warren: > “Data brokers profit from the location data of millions of people, posing serious risks to Americans everywhere by selling their most private information. With this extremist Supreme Court poised to overturn *Roe v. Wade* and states seeking to criminalize essential health care, it is more crucial than ever for Congress to protect consumers’ sensitive data. The *Health and Location Data Protection Act* will ban brokers from selling Americans’ location and health data, rein in giant data brokers, and set some long overdue rules of the road for this $200 billion industry." Joseph Cox' [Sweeping Legislation Aims to Ban the Sale of Location Data](https://vice.com/en/article/4axydq/legislation-aims-to-ban-health-and-location-data-protection-act?ref=thenexusofprivacy.net) on vice.com has more about the Health and Location Data Protection Act (HLDPA). Privacy scholars including Danielle Citron, Neil Richards, Woodrow Herzog, and Elizabeth Joh worked with Sen. Warren on the legislation. How does this legislation compare with similar clauses in the bipartisan ADPPA comprehensive privacy bill? Good question! Once I see some analyses, I'll include them in a future newsletter. ## And ... [The Impotence of the Fourth Amendment in a Post-Roe World](https://lawfareblog.com/impotence-fourth-amendment-post-roe-world?ref=thenexusofprivacy.net) \- Jolynn Dillinger and Stephanie Pell on Lawfare (lawfareblog.com) [The End of Roe and the Threat to Free Speech Online](https://slate.com/technology/2022/06/roe-supreme-court-online-privacy-speech-wyden.html?ref=thenexusofprivacy.net) – Ron Wyden on Slate (slate.com) [You agreed to what? Doctor check-in software harvests your health data.](https://washingtonpost.com/technology/2022/06/13/health-privacy?ref=thenexusofprivacy.net) – Geoffrey A. Fowler on The Washington Post (washingtonpost.com) [We’re so close to getting data loyalty right](https://iapp.org/news/a/were-so-close-to-getting-data-loyalty-right/?ref=thenexusofprivacy.net) – Woodrow Harzog and Neil Richards on IAPP (iapp.org) \_\_\_\_\_\_\_\_\_\_\_\_\_\_ Image credit: News by [Nick Youngson](http://www.nyphotographic.com/?ref=thenexusofprivacy.net), licensed under [CC BY-SA 3.0](https://creativecommons.org/licenses/by-sa/3.0/?ref=thenexusofprivacy.net), via [Pix4free](https://pix4free.org/?ref=thenexusofprivacy.net) ### Federal privacy legislation: It'll be an interesting summer! (UPDATED) URL: https://thenexusofprivacy.net/federal-privacy-legislation-the-best-chance-yet-to-pass-a-strong-bill/ Last updated: 2026-04-15T22:40:31.000Z *Last updated: June 18\. Originally published: June 14\.* As Congress heads into the summer, there's a sudden surge of activity on federal privacy legislation. The recently-released American Data Privacy and Protection Act (ADPPA) has [a hearing in the House on Tuesday, June 14](https://energycommerce.house.gov/committee-activity/hearings/hearing-on-protecting-americas-consumers-bipartisan-legislation-to?ref=thenexusofprivacy.net). Meanwhile, Sen. Maria Cantwell (D-WA) is circulating a draft of her own bill, a revision to 2019's Consumer Online Privacy Rights Act (COPRA). As if that's not enough, there are also several different children's privacy bills being considered. Exciting! *Update, June 15: and now there's another bill, the* [*Health and Location Data Protection Act*](https://vice.com/en/article/4axydq/legislation-aims-to-ban-health-and-location-data-protection-act?ref=thenexusofprivacy.net) *(HLDPA).* In late May, over 50 civil rights, civil liberties, and consumer protection organizations urged Congress to "[pass comprehensive consumer privacy legislation during this session that prohibits data-driven discrimination and ensures that everyone has the right to equal opportunity on the internet.](https://civilrights.org/resource/support-a-comprehensive-consumer-privacy-law-that-safeguards-civil-rights-online?ref=thenexusofprivacy.net)" Signers including Lawyers Committee on Civil Rights, EPIC Privacy, CDT, Access Now, and Free Press have all described the draft ADPPA as encouraging – both because of its explicit civil rights protections, and its bipartisan support (it's sponsored by House Energy and Commerce Chair Frank Pallone (D-NJ), ranking member Cathy McMorris Rodgers (R-WA.) and Sen. Roger Wicker (R-MI), ranking member of the Senate Commerce Committee). Issues like whether individuals can sue companies who violate their privacy (a "private right of action") and whether the federal bill will prohibit states from passing stronger legislation ("pre-emption") have previously been sticking points to getting bipartisan support. ADPPA's compromises in both of these areas are seen as breaking a stalemate. Since bipartisan support is crucial to get anything through Congress, this is indeed a big deal. On the other hand, there are also lots of concerns about ADPPA. - Sen. Cantwell has criticized its private right of action – which wouldn't take effect until 2026 – as too weak. - Sen. Brian Schatz (D-HI) has reportedly said that a bill without a duty of care should not pre-empt state consumer privacy laws; Sen. Cantwell also opposes pre-emption. - [ACLU says ADPPA needs substantial revision](https://www.aclu.org/letter/aclu-letter-urgent-concerns-privacy-legislation-and-legislative-process?ref=thenexusofprivacy.net), and is concerned that it will be rushed to the floor. - [EFF has urged Congress to strengthen the bill](https://www.eff.org/deeplinks/2022/06/eff-urges-congress-strengthen-american-data-privacy-and-protection-act?ref=thenexusofprivacy.net) - The Chamber of Commerce describes the bill as "[unworkable](https://www.cnbc.com/2022/06/09/bipartisan-privacy-proposal-is-unworkable-chamber-of-commerce-says.html?ref=thenexusofprivacy.net)." - Ari Ezra Waldman (author of the outstanding *Industry Unbound*) describes it as [another gift to industry](https://twitter.com/ariezrawaldman/status/1532365134643044359?ref=thenexusofprivacy.net). Some of the links below go into more details about other issues, including law enforcement access, a "duty of loyalty" that appears to set a very low bar, the complex pre-emption clause, and the exclusion of de-identified data and employment data. So while I too am encouraged by the bipartisan interest in passing privacy legislation, I'm tempering my enthusiasm for now. Based on what we've seen over the years in the Washington state legislative battles, I'm nervous that language in the bill that *looks* strong will turn out to be weaker than it appears, or will be undercut by other sections of the bill. And of course, big tech and data brokers will no doubt claim that even the current text will cause the sky to fall, and will devote huge lobbying efforts to weaken it – [as they routinely have with state privacy bills](https://themarkup.org/privacy/2022/05/26/tech-industry-groups-are-watering-down-attempts-at-privacy-regulation-one-state-at-a-time?ref=thenexusofprivacy.net). One approach that proved very useful here in Washington state is to look at real-world privacy abuses that are occurring today and we expect to see in the near future. In 2021, for example, we looked at whether the state-level bill would prevent ICE access to data from Muslim prayer apps; and earlier this year, we focused on the Markup's reporting on ed tech abuses ([here](https://themarkup.org/machine-learning/2022/01/11/this-private-equity-firm-is-amassing-companies-that-collect-data-on-americas-children?ref=thenexusofprivacy.net) and [here](https://themarkup.org/machine-learning/2022/01/13/college-prep-software-naviance-is-selling-advertising-access-to-millions-of-students?ref=thenexusofprivacy.net)). As we get more information about the legislation, this will help understand how effectively ADPPA and COPRA will actually be in protecting us. So, we shall see. But to end on a positive note: There's general agreement that 2022 is the best chance yet to get a strong privacy bill through Congress. With luck – and enough pressure from privay groups and grassroots activists to counter big tech's lobbying – the bills will improve as they move through the process and converge on something that really does protect our privacy. Which would be pretty darned cool ... So stay tuned for an interesting summer! ### Links with more information - [Here’s the June 3 draft of the ADPPA](https://www.commerce.senate.gov/services/files/6CB3B500-3DB4-4FCC-BB15-9E6A52738B6C?ref=thenexusofprivacy.net). It’s long. Why is there a section on “Digital Content Forgeries” in a privacy bill? I have no idea, and neither does anybody else I’ve talked to. - Rebecca Kern’s [Bipartisan draft bill breaks stalemate on federal data privacy negotiations](https://www.politico.com/news/2022/06/03/bipartisan-draft-bill-breaks-stalemate-on-federal-privacy-bill-negotiations-00037092?ref=thenexusofprivacy.net) in *Politico,* Will Oremus’ [House and Senate members unveil stalled data privacy bill in](https://www.washingtonpost.com/technology/2022/06/03/internet-privacy-congress-compromise-proposal/?ref=thenexusofprivacy.net) the *Washington Post,* and Chris Mills Rodrigo's [Why a bipartisan data privacy proposal faces an uphill battle](https://thehill.com/policy/technology/3522026-why-a-bipartisan-data-privacy-proposal-faces-an-uphill-battle/?ref=thenexusofprivacy.net) in *The Hill* are all good overviews of the political situation. - Müge Fazlioglu's[ Distilling the essence of the American Data Privacy and Protection Act discussion draft](https://iapp.org/news/a/distilling-the-essence-of-the-american-data-privacy-and-protection-act-discussion-draft/?ref=thenexusofprivacy.net) and Cobun Zweifel-Keegan's [Understanding the scope of the draft American Data Privacy and Protection Act](https://iapp.org/news/a/understanding-the-scope-of-the-draft-american-data-privacy-and-protection-act/?ref=thenexusofprivacy.net), both on *IAPP,* delve into some key areas. - [We’re so close to getting data loyalty right](https://iapp.org/news/a/were-so-close-to-getting-data-loyalty-right/?ref=thenexusofprivacy.net), by Woodrow Harzog and Neil Richards, also on *IAPP*, analyzes the "loyalty duties" in ADPPA and other legislation in more detail. - Olga Kagan's[ Federal Privacy Law incoming? New Bipartisan Bill Filed](https://www.linkedin.com/pulse/federal-privacy-law-incoming-new-bipartisan-bill-filed-odia-kagan?ref=thenexusofprivacy.net) on *LinkedIn* and David Stauss'[ Bipartisan U.S. Federal Privacy Bill Circulated](https://www.bytebacklaw.com/2022/06/bipartisan-u-s-federal-privacy-bill-circulated/?ref=thenexusofprivacy.net) on *Byte Back* have a detailed run-down on the bill's contents. - Shoshana Wodinsky's[ Our Country Moves Closer to a Federal Privacy Law, and I Move Closer to Losing My Mind](https://gizmodo.com/american-data-privacy-and-protection-act-improvements-1849022612?ref=thenexusofprivacy.net) and Mike Masnick's[ New ‘Bipartisan’ Federal Privacy Bill Tries To Build Consensus Support, And Basically Succeeds In Annoying Everyone](https://www.techdirt.com/2022/06/06/new-bipartisan-federal-privacy-bill-tries-to-build-consensus-support-and-basically-succeeds-in-annoying-everyone/?ref=thenexusofprivacy.net) provide some more skeptical views. - [Blake Reid's Twitter thread](https://twitter.com/blakereid/status/1532788421260738560?ref=thenexusofprivacy.net) goes into depth on pre-emption; his summary is "As far as I can tell, the default-preemption structure coupled with broad/ambiguous exceptions (particularly the civil rights exception) will introduce a tremendous degree of uncertainty about what is actually preempted." [ William McGeveran](https://twitter.com/BillMcGev/status/1532826822173372416?ref=thenexusofprivacy.net) and[ Whitney Merrill](https://twitter.com/wbm312/status/1532842339227422720?ref=thenexusofprivacy.net) also make some good points. - A dozen members of the Disinfo Defense League, including Free Press, Access Now, Kairos Action, Media Justice, Equality Labs, Asian Americans Advancing Justice, Muslim Advocates, and Common [called on Congress to ensure new privacy legislation safeguards everyone’s online civil rights](https://www.freepress.net/news/press-releases/disinfo-defense-league-calls-congress-ensure-new-privacy-legislation-safeguards-civil-rights?ref=thenexusofprivacy.net). **Update, June 18:** [here's my live-tweeting of the hearing](https://threadreaderapp.com/thread/1536716807624458240.html?ref=thenexusofprivacy.net) (unrolled into a single web page for your convenience). And, [here's EPIC's live-tweeting](https://threadreaderapp.com/thread/1536713261332279299.html?ref=thenexusofprivacy.net), which also has links to witnesses' written testimony. Some new links since then: - Jessica Rich's [Readout on House Privacy Hearing: Wide Attendance, Lots of Issues, Full Steam Ahead](https://www.adlawaccess.com/2022/06/articles/readout-on-house-privacy-hearing-wide-attendance-lots-of-issues-full-steam-ahead/?ref=thenexusofprivacy.net) on Kelley Drye's *Add Law Access Blog;* Joe Duball's [US House committee showcases federal privacy momentum, opportunity](https://iapp.org/news/a/us-house-committee-unpacks-federal-privacy-momentum-opportunity/?ref=thenexusofprivacy.net), on *IAPP*; [Insights from the House Subcommittee Hearing on ADPPA](https://www.jdsupra.com/legalnews/insights-from-the-house-subcommittee-2790383/?ref=thenexusofprivacy.net), by Hilary Higgins, Ali Jessani, and Kirk Nahra of Wilmer Hale on *JD Supra;* and [U.S. Comprehensive Federal Privacy Legislation Takes Major Step Forward](https://www.nasdaq.com/articles/u.s.-comprehensive-federal-privacy-legislation-takes-major-step-forward?ref=thenexusofprivacy.net) by Ieuan Jolly and Kris Ekdahl of Linklatersonare all good overviews. - Cristiano Lima notes that [the Senate may be a roadblock](https://www.washingtonpost.com/politics/2022/06/15/senate-holdouts-pose-hurdle-congresss-surging-privacy-push/?ref=thenexusofprivacy.net), with quotes reactions from Sens. Blumenthal, Schatz, and Cantwell. - Jolina Cuarasema's [The Time is Now for Comprehensive Federal Data Privacy Legislation](https://www.commonsensemedia.org/kids-action/articles/the-time-is-now-for-comprehensive-federal-data-privacy-legislation?ref=thenexusofprivacy.net), on *Common Sense*, summarizes her testimony and highlights some provisions that need to be added to better predict kids and teens. - Ashley Johnson's [Three Bills Show Remaining Divisions in Attempt to Reach a Compromise on Federal Data Privacy Legislation](https://itif.org/publications/2022/06/17/bills-show-remaining-divisions-on-federal-data-privacy-legislation/null/publications/2022/06/17/bills-show-remaining-divisions-on-federal-data-privacy-legislation/?ref=thenexusofprivacy.net), on ITIF, compares and contrasts ADPPA with COPRA and Sen. Schatz' Data Care Act. - [Users beware: Apps are using a loophole in privacy law to track kids’ phones](https://www.npr.org/2022/06/16/1105212701/users-beware-apps-are-using-a-loophole-in-privacy-law-to-track-kids-phones?ref=thenexusofprivacy.net), a discussion between Washington Post tech columnist Geoffrey Fowler NPR Fresh Air Dave Davies, goes into the "actual knowledge" loophole. - [What does the newest U.S. privacy bill mean for cybersecurity?](https://iapp.org/news/a/what-does-the-newest-u-s-privacy-bill-mean-for-cybersecurity/?ref=thenexusofprivacy.net), by Tatyana Bolton, Brandon Pugh, and Sofia Lesmes on IAPP, looks at the security implications. Keep in mind that authors of various articles are not necessarily neutral here! For example, ITIF represents the tech industry, and in their testimony pressed for ADPPA to be weakened. Still, these are all good analyses ... and who am I kidding, I'm not particularly neutral either 😎. \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ *Image credit:* JessicaRodriguezRivas, via [Wikipedia Commons](https://commons.wikimedia.org/wiki/File:Home%5Fof%5Fthe%5FUS%5FCongress.jpg?ref=thenexusofprivacy.net). licensed under the [Creative Commons](https://en.wikipedia.org/wiki/en:Creative%5FCommons?ref=thenexusofprivacy.net)[Attribution-Share Alike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/deed.en?ref=thenexusofprivacy.net) license. ### Welcome to The Nexus of Privacy URL: https://thenexusofprivacy.net/welcome-to-the-nexus-of-privacy/ Last updated: 2026-04-15T22:39:55.000Z The Nexus Of Privacy is a website and newsletter focused on different perspectives on privacy, including technology, policy, activism, and strategy. There will be a lot to talk about over the next few months: federal privacy and anti-trust legislation, the continued rise of privacy technology, California's new proposed regulations (which may be pre-empted by federal privacy legislation), the FTC's focus on enforcement against ed-tech vendors, the privacy impact of the upcoming Supreme Court decision that's likely to criminalize abortion in 29 states, an endless stream of privacy abuses ... the list goes on! And it's all set in the broader strategic context of a battle over the power of big tech and the surveillance-industrial complex, here in the US and abroad. So expect a combination of frequent news roundups with more detailed analysis. Please check back from time to time to see what strikes your interest – or even better, [subscribe](#/portal/) to get email updates! \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Image credit: "[Welcome](https://www.flickr.com/photos/39435232@N00/4706295885?ref=thenexusofprivacy.net)" by [renaissancechambara](https://www.flickr.com/photos/39435232@N00?ref=thenexusofprivacy.net) is licensed under [CC BY 2.0](https://creativecommons.org/licenses/by/2.0/?ref=openverse). ### Microsoft Shareholder Resolutions - Facial Recognition, Pay Equity, Sexual Harassment, and more URL: https://thenexusofprivacy.net/microsoft-shareholder-resolutions-2021/ Last updated: 2021-12-01T18:18:07.000Z Microsoft's annual shareholder meeting is coming up, and the proxy statements include [five excellent shareholder resolutions](https://www.sec.gov/Archives/edgar/data/0000789019/000119312521298757/d189481ddef14a.htm?ref=thenexusofprivacy.net#toc189481%5F31). One of them is on a topic I've written a lot about here: prohibiting sales of facial recognition technology to governments. Unsurprisingly, I support it! As Councilmember Jeanne Kohl-Welles and Jennifer Lee of ACLU of Washington said earlier this year in [King County government must turn its back on facial recognition technology](https://www.seattletimes.com/opinion/king-county-government-must-turn-its-back-on-facial-recognition-technology/?ref=thenexusofprivacy.net) > The potential dangers inherent in government use of this technology are immense and far outweigh any potential benefit. Facial recognition technology must be banned, not only because it fuels discriminatory surveillance, but also because it jeopardizes everyone’s privacy and civil liberties. With this technology, government agencies can track individuals’ movements and contacts without their knowledge or consent, chilling free speech and free association, undermining press freedom and threatening the free exercise of religion. It probably won't pass. Microsoft's Board recommends voting against all the shareholder resolutions including this one, and large institutional investors usually follow the Board. [A similar Amazon resolution in 2019 won just 2% of shareholder vote](https://www.reuters.com/article/us-amazon-com-facial-recognition-idUSKCN1SU2H5?ref=thenexusofprivacy.net) and that's probably most likely the likely outcome[ ](https://www.reuters.com/article/us-amazon-com-facial-recognition-idUSKCN1SU2H5?ref=thenexusofprivacy.net)here. *UPDATE: As expected, the facial recognition resolution only got 4% of the vote.* Still, shareholder resolutions are an effective part of the multifront campaign to ban facial recognition. The 2019 Amazon resolution was a key stepping stone in [the multi-year fight to stop Amazon, IBM, and Microsoft from selling face recognition to law enforcement](https://www.technologyreview.com/2020/06/12/1003482/amazon-stopped-selling-police-face-recognition-fight/?ref=thenexusofprivacy.net). Just last month [Microsoft agreed to human rights review in deals with law enforcement and government](https://www.bloomberg.com/news/articles/2021-10-13/microsoft-agrees-to-investor-push-for-human-rights-review-of-government-deals?ref=thenexusofprivacy.net) in response to another shareholder resolution, since withdrawn. And Stanley Shikuma, Savannah Sly, and Jennifer Lee of the Tech Equity Coalition will have three minutes to speak in favor of this resolution at the board meeting on November 30, which is great! I'll talk more about the facial recognition resolution below, but there are four other resolutions on the proxy statement so first let's look at the full list. ## Five synergistic resolutions I also support the other resolutions, all at the intersections of justice and equity with technology. Each is very worthwhile in its own right, and the full slate has a lot of synergies. 1. **RESOLVED:* Shareholders request Microsoft report on median pay gaps across race and gender, including associated policy, reputational, competitive, and operational risks, and risks related to recruiting and retaining diverse talent. The report should be prepared at reasonable cost, omitting proprietary information, litigation strategy and legal compliance information.* 2. **RESOLVED:* Shareholders urge the Board of Directors to release a transparency report (at reasonable expense, omitting confidential or privileged information) to shareholders assessing the effectiveness of the company’s workplace sexual harassment policies, including the results of any comprehensive, independent audit/investigations, analysis of policies and practices, and commitments to create a safe, inclusive work environment.* 3. **RESOLVED:* Shareholders request that the Board of Directors generally prohibit sales of facial recognition technology to all government entities, and to disclose any exceptions made, in the board and management’s discretion.* 4. **RESOLVED:* Shareholders request that the Board of Directors prepare a report on how implementation of Microsoft’s commitment to the Fair Chance Business Pledge (“the Pledge”) has advanced progress toward eliminating racial discrimination at Microsoft. The report, prepared at reasonable cost and omitting proprietary information and published publicly within one year, should evaluate the risk of racial discrimination that may result from the use of criminal background checks in hiring and employment decisions.* 5. **RESOLVED:* Shareholders request that the Board of Directors oversee an evaluation and issue a public report, at reasonable cost and omitting proprietary information, describing if, and how, Microsoft’s direct and indirect lobbying activities align with company policies and principles on artificial intelligence, public policy, human rights, and racial justice, and how the company plans to mitigate risks created by any misalignment.* *UPDATE: #2 passed, with 78% of the vote. #1 and #5 got 40% and 38% respectively, surprisingly good showings.* [*Microsoft shareholders approve resolution calling for new insights into sexual harassment cases*](https://www.geekwire.com/2021/microsoft-shareholders-approve-resolution-calling-for-new-insights-into-sexual-harassment-cases/?ref=thenexusofprivacy.net)*, on Geekwire, has more.* ## The view from the board room? Microsoft's Board of Directors (including their CEO Satya Nadella) recommends voting against all of these. Huh. Does this align with company policies and principles on artificial intelligence, public policy, human rights, and racial justice? Nope. No wonder they're against #5! The Board's recommendations also don't align with Microsoft's corporate values like "[accountability](https://www.microsoft.com/en-us/about/corporate-values?ref=thenexusofprivacy.net)." or their diversity and inclusion statement's claim that "[we believe in the transformative power of engaging many different perspectives](https://www.microsoft.com/en-us/diversity/default.aspx?ref=thenexusofprivacy.net)," or their corporate social responsibility (CSR) [commitments like "unequivocally support the fundamental rights of people, from defending democracy, to addressing systemic racial injustice and inequity, to protecting human rights"](https://www.microsoft.com/en-us/corporate-responsibility/?ref=thenexusofprivacy.net) and ["earn trust"](https://www.microsoft.com/en-us/corporate-responsibility/?ref=thenexusofprivacy.net). Funny how that works. The Board has their reasons of course. A few themes come up in the company's responses to all of the resolutions - Microsoft has made public "commitments" and disclosed some information (or at least plans to) although less than is being asked for, so all the resolutions asking for reporting are "unnecessary." In their response to the Pay Equity resolution, for example, Microsoft admits they are "well aware significantly more work needs to be done" but "does not believe pay gap disclosure would further advance our commitment or ongoing efforts." - Microsoft does positive things in all these areas. Which they do, but that's only part of the story, and not really what the resolutions are about. With several of the resolutions though the list of "positive things Microsoft does" is the bulk of the response. - The requests in each of the resolutions for plans to evaluate or mitigate risk aren't even worth responding to. Seriously, look at the company's responses, they don't even discuss "risk" even though it's specifically mentioned in the resolution! Personally, I don't find the Board's responses particularly persuasive. As a Microsoft shareholder (I worked there from 1999-2007, first in Microsoft Research and then as GM of Strategy Development in MSN, and still own some stock) I'm voting YES of all of five them. If you're a shareholder, I encourage you to vote YES on all five shareholder resolutions as well. ## Hey wait a second! ![Shareholder Proposal - Prohibition on sales of facial recognition technology to all government entities. Board Recommendation: Against. My vote: For.](https://thenexusofprivacy.net/content/images/2021/11/Screen-Shot-2021-11-22-at-5.28.13-PM-3.png) Microsoft goes farthest in opposing the facial recognition resolution, which it bluntly says "does not advance the interests of Microsoft, its shareholders, or other stakeholders." Why? Well for one thing they've made public "commitments", and they've done a lot of positive things! Also: > This proposal would impose a blunt prohibition that would deny public agencies the ability to deploy facial recognition technology in societally beneficial use cases. Hey wait a second, that's not what the resolution says! It explictly allows exceptions, it just asks the Board to disclose them. Luke Stark's helpful analogy that facial recognition is like plutonium, incredibly toxic but with a few beneficial usages, is a good lens to look at this through. There may be exceptions, but tost of the time, spraying plutonium should be prohibited. Of course some of the exceptions may be lucrative, and the Board wants Microsoft to be able to make money helping governments spray people with plutonium in "societally beneficial use cases." The resolution allows that; they just have to disclose what they're doing. Given how toxic facial recognition is, and how strong the evidence is that it's harmful, that seems pretty reasonable to me! In the "societally beneficial use cases" where Microsoft's helping governments spray plutonium, the company should indeed disclose that they're doing it. The human rights resolution They should also be ready to describe the "risk profiles," how the safeguards are "calibrated," and why it's in the interests of all the "stakeholders" – including the ones who are being sprayed with plutonium. ## Stay tuned for more All of these resolutions are part of longer-term battles. In Arjuna Capital's statement for resolution #2 (sexual harassment), they talk about the 2012 class action lawsuit from almost 300 women employees. #1, pay equity, has a history as well: [Microsoft was sued by Black employees in a class action in the early 2000s](https://www.computerworld.com/article/2590352/update--six-plaintiffs-join--5-billion-discrimination-suit-against-microso.html?ref=thenexusofprivacy.net), narrowly avoided a class action suit by women employees on gender inequity, and just last year [settled with the Department of Labor over allegations of racial discrimination](https://news.bloomberglaw.com/daily-labor-report/microsoft-reaches-3-million-hiring-bias-settlement-with-dol?ref=thenexusofprivacy.net). Similarly, the facial recognition resolution is only the latest skirmish in the interlocking multi-year fights over facial recognition and privacy. Resolution #5 (lobbying) has some of the backstory: > In 2020, Microsoft committed not to sell facial recognition to police “until there is a strong national law grounded in human rights,”7 and it has urged governments to consider “civilian oversight and accountability” of facial recognition.8 However, Microsoft lobbies for and testified in support of laws that enable police use of facial recognition and undermine such local accountability efforts.9 Last year, a Microsoft employee – who is also a Washington State Senator – prime sponsored10 a weak, industry-backed state facial recognition bill, which was strongly opposed by a large coalition of privacy advocates, racial justice advocates, and consumer rights organizations.11 Contradicting Microsoft’s claim that the Washington bill “offers protections for civil liberties,”12 privacy expert Jennifer Lee said Microsoft’s bill “purports to put safeguards...but does just the opposite.” I was part of that large coalition opposing the 2020 facial recognition bill, and [the bad privacy bill that Microsoft also supported](https://medium.com/a-change-is-coming/a-bad-day-for-a-bad-privacy-bill-a-good-day-for-privacy-a2aeea8e8739?ref=thenexusofprivacy.net) but failed to pass. In 2021, the Microsoft employee / State Senator opposed even holding a hearing on a facial recognition moratorium bill, and also once again co-sponsored the Bad Washington Privacy Act (which once again Microsoft supported and once again did not pass). Microsoft’s put a lot of energy into"direct and indirect lobbying activities" as part of these battles, in Washington and across the country. As we get ready for the 2022 legislative session, and it's a very good question how well these activities align with the company's stated principles and policy commitments. So even though Microsoft's Board will almost certainly fend off the resolutions at this year's meeting, the issue isn't going away. Once the legislative session ends, activist investors will start planning for next year's shareholder meeting; and if the legislature doesn't act, there's starting to be talk about a potential statewide initiative banning facial recognition. Stay tuned for more! ## Links - [Scrutiny mounts on Microsoft’s surveillance technology](https://thehill.com/policy/technology/558890-exclusive-scrutiny-mounts-on-microsofts-surveillance-technology?ref=thenexusofprivacy.net) in *The Hill* and [Investors pressure Microsoft over surveillance tech policies](https://www.windowscentral.com/investors-call-reports-microsoft-see-if-actions-line-words-surveillance?ref=thenexusofprivacy.net) in *Windows Central* have more on #3, #5, and the human rights review resolution. - Dina Bass' [Microsoft Agrees to Human Rights Review in Deals With Law Enforcement, Government](https://www.bloomberg.com/news/articles/2021-10-13/microsoft-agrees-to-investor-push-for-human-rights-review-of-government-deals?ref=thenexusofprivacy.net) on *Bloomberg Tech* discusses the human rights resolution - [A bad day for a bad privacy bill, a good day for privacy](https://medium.com/a-change-is-coming/a-bad-day-for-a-bad-privacy-bill-a-good-day-for-privacy-a2aeea8e8739?ref=thenexusofprivacy.net) has highlights from Stan Shikuma's and Jennifer Lee's testimony in 2020\. You can see the full video [here](https://www.tvw.org/watch/?eventID=2020021280&ref=thenexusofprivacy.net). - Arjuna Capital's [Microsoft Needs Independent and Transparent Investigation of Gender Discrimination, Sexual Harassment](https://www.businesswire.com/news/home/20210616005826/en/Arjuna-Capital-Shareholder-Resolution-Microsoft-Needs-Independent-and-Transparent-Investigation-of-Gender-Discrimination-Sexual-Harassment?ref=thenexusofprivacy.net) has more about the background on #1 and #2 - [Meet the Woman Who Convinced Apple, Starbucks, and Nike to Close Their Gender Pay Gaps](https://www.yahoo.com/entertainment/meet-woman-convinced-apple-starbucks-110054201.html?ref=thenexusofprivacy.net) has backstory about Arjuna's Natasha Lamb. - [Bowing to investors, Microsoft will make its devices easier to fix](https://grist.org/accountability/bowing-to-investors-microsoft-will-make-its-devices-easier-to-fix/?ref=thenexusofprivacy.net) describes another successful resolution, from right-to-repair activists. ### The King County Ban on governmental use of facial recognition advances! URL: https://thenexusofprivacy.net/king-county-ban-moves-forward/ Last updated: 2021-11-14T20:26:53.000Z ![A red circle with a slash through it, and in the background a screenshot of facial recognition software showing a face overlaid with dots and lines ](https://thenexusofprivacy.net/content/images/2021/05/facial-recognition-image-rectangle.jpg) Great news! The King County Council Committee of the Whole voted 9-0 to advance ordinance 2021-0091, banning use of facial recognition by county government and administrative agencies – including by law enforcement. > *Update, June 2: the King County Council similarly passed it unanimously, 9-0! Thanks to all the activists and researchers who have laid the groundwork for this over the years, all the King County residents who got involved, and to the King Council for the courageous vote!* > *Update, November 10: Bellingham Washington voters banned government use of facial recognition and predictive policing! Initiative 2, brought to the ballot by People First Bellingham, won 57 percent of the vote. Grassroots activism FTW!* [*ACLU of Washington's press release has more*](https://www.aclu-wa.org/news/victory-bellingham-voters-ban-facial-recognition-predictive-policing-software?ref=thenexusofprivacy.net) Kudos to Councilmember Jeanne Kohl-Welles for sponsoring, Councilmembers Rod Dembrowski and Dave Upthegrove for co-sponsoring. Thanks as well to all the Councilmembers for the excellent discussions over the few weeks – and the very courageous vote! And, extra thanks Councilmember Claudia Balducci, who represents my district and was extremely responsive during the discussions. Combined with yesterday's news that [Amazon will extend their moratorium on selling facial recognition to law enforcement](https://mediajustice.org/news/breaking-mediajustice-demands-amazon-permanently-end-sale-of-surveillance-tech-to-police-and-federal-agents/?utm%5Fsource=General+Contacts&utm%5Fcampaign=870d80576b-EMAIL%5FCAMPAIGN%5F5%5F17%5F2021%5F15%5F50&utm%5Fmedium=email&utm%5Fterm=0%5F2cc1e8b217-870d80576b-80672331), and Monday's announcement that [the Metropolitan Washington Council of Governments will end the use of the National Capital Region Facial Recognition Investigative Leads System](https://thehill.com/homenews/state-watch/554118-officals-halting-facial-recognition-system-that-identified-lafayette?ref=thenexusofprivacy.net) ... quite a week! As Kade Crockford and Carl Takei say on ACLU's site, [when we fight, we win](https://www.aclu.org/news/criminal-law-reform/when-we-fight-we-win-victories-in-the-fight-against-face-surveillance-keep-piling-up/?ref=thenexusofprivacy.net). And for good reason. As Councilmember Jeanne Kohl-Welles and Jennifer Lee of ACLU of Washington say in [King County government must turn its back on facial recognition technology](https://www.seattletimes.com/opinion/king-county-government-must-turn-its-back-on-facial-recognition-technology/?ref=thenexusofprivacy.net) > The potential dangers inherent in government use of this technology are immense and far outweigh any potential benefit. Facial recognition technology must be banned, not only because it fuels discriminatory surveillance, but also because it jeopardizes everyone’s privacy and civil liberties. With this technology, government agencies can track individuals’ movements and contacts without their knowledge or consent, chilling free speech and free association, undermining press freedom and threatening the free exercise of religion. The Council is expected to take a final vote on the ordinance at their June 2 meeting. Since all Councilmembers are on the Committee of the Whole, it's looking good unless something changes significantly. Still, it's never over until it's over, and I'm sure facial recognition vendors will keep lobbying against it. So, if you're in King County, it's a great time to [thank your Councilmember for today's vote today](https://www.takeaction.network/xactions/15237?ref=thenexusofprivacy.net)! ### It's time for King County to ban governmental use of facial recognition URL: https://thenexusofprivacy.net/king-county-facial-recognition/ Last updated: 2021-11-13T07:43:57.000Z ![A surveillance camera with a big red X blocking its view](https://thenexusofprivacy.net/content/images/2021/05/surveillance-block.png) The King County Council Committee of the Whole is considering on ordinance 2021-0091, banning governmental use of facial recognition – including by law enforcement. *Update, June 2: King County Council passed the ordinance unanimously, 9-0! Thanks to all the activists and researchers who have laid the groundwork for this over the years, all the King County residents who got involved, and to the King Council for the courageous vote!* As Councilmember Jeanne Kohl-Welles and Jennifer Lee of ACLU of Washington say in [King County government must turn its back on facial recognition technology](https://www.seattletimes.com/opinion/king-county-government-must-turn-its-back-on-facial-recognition-technology/?ref=thenexusofprivacy.net) > The potential dangers inherent in government use of this technology are immense and far outweigh any potential benefit. Facial recognition technology must be banned, not only because it fuels discriminatory surveillance, but also because it jeopardizes everyone’s privacy and civil liberties. With this technology, government agencies can track individuals’ movements and contacts without their knowledge or consent, chilling free speech and free association, undermining press freedom and threatening the free exercise of religion. Opposition to facial recognition often starts by focusing on the biases and inaccuracies in today's software. It's very easy to see the injustice when Black men like [Robert Julian-Borchak Williams](https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.nytimes.com%2F2020%2F06%2F24%2Ftechnology%2Ffacial-recognition-arrest.html&data=04%7C01%7Cmhiggins%40seattletimes.com%7C5beb60b48b1142b78aea08d90a53fbad%7Cfc2b8476b7f0473d82fbe0a89fd99855%7C0%7C1%7C637552178101570710%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=9O2SPyY2nCxCWleYUstTnHqC%2FHP5375As4d9T5nh4vQ%3D&reserved=0&ref=thenexusofprivacy.net), [Nijeer Parks](https://www.nytimes.com/2020/12/29/technology/facial-recognition-misidentify-jail.html?ref=thenexusofprivacy.net#:~:text=In%202019%2C%20a%20national%20study,on%20bad%20facial%20recognition%20matches.), and [Michael Oliver](https://www.vice.com/en/article/bv8k8a/faulty-facial-recognition-led-to-his-arrestnow-hes-suing?ref=thenexusofprivacy.net) are arrested for crimes they didn't commit based on false matches by facial recognition software. But as I said in my [public comments](https://thenexusofprivacy.net/comments-on-king-county-facial-recognition-ban/) at the May 5 Committee of the Whole meeting > **\[T\]he issues with facial recognition go far beyond today’s bias and accuracy problems**. As Timnit Gebru of the Gender Shades project points out in [A Case for Banning Facial Recognition](https://www.nytimes.com/2020/06/09/technology/facial-recognition-software.html?ref=thenexusofprivacy.net), even completely accurate facial recognition can still be used in ways that are “detrimental to certain groups of people.” Evan Selinger and Woodrow Herzog suggest accurate facial recognition might be even more dangerous “[because those in power will find it irresistible and they’ll want to use it more often](https://theappeal.org/the-lab/report/the-case-for-banning-law-enforcement-from-using-facial-recognition-technology/?ref=thenexusofprivacy.net).” Veena Dubal strikes a similar note in [San Francisco was right to ban facial recognition](https://www.theguardian.com/commentisfree/2019/may/30/san-francisco-ban-facial-recognition-surveillance?ref=thenexusofprivacy.net): > The concerns that motivated the [San Francisco](https://www.theguardian.com/us-news/san-francisco?ref=thenexusofprivacy.net) ban are rooted not just in the potential inaccuracy of facial recognition technology, but in a long national history of politicized and racially-biased state surveillance. There's growing momentum for banning facial recognition. At least 20 cities - including Boston, New Orleans, and Portland have joined San Francisco in banning it. Vermont banned law enforcement use of facial recogntion last fall, and last month Virgina also banned local law enforcement use. And just today, Amazon announced an indefinite extension the moratorium on selling their Rekognition facial recognition software to law enforcement. Public comments in the King County Council discussions so far have been really outstanding. Of course, with only two minutes for comments, there's a lot that hasn't been discussed in any detail yet. One area worth highlighting is the implications of facial recognition on transgender, non-binary, and gender-variant people. [Os Keyes' 2019 Washington state legislature testiminony](https://ironholds.org/statement-house/?ref=thenexusofprivacy.net) is a good starting point here. An excerpt: > This technology is deeply threatening to trans existences, particularly the existences of trans people of colour. This is for a couple of reasons. The first is simply that the technology is often biased. It is less accurate with trans people; it is less accurate with people of colour. And so when you take it and deploy it, it is more likely to flag trans people as incongruent, unexpected; to falsely identify us as matches, or highlight us for attention. > > If this happens – if someone is flagged, whether due to dataset bias or a simple error, and reported up to an operator – trans people are also more likely to face unpleasant and often violent outcomes. Because we are incongruent, because we are often unexpected, there is a long history of government entities, be it the police or the housing administration, discriminating against us. > > The National Transgender Survey, in their 2015 report on Washington State, found that 60% of trans people who had interacted with the police experienced mistreatment. And this is without algorithms prompting the police to interact with us. 33% of us experienced discrimination in public accommodations – even without a facial recognition system prompting the administrative official weighing up our housing, healthcare or benefits to give us a second look. These numbers are far worse for trans people of colour, particularly trans women of colour. Of course, that's just one of the many problems with facial recognition technology. [Ban Government use of Facial Recognition in King County](https://signon-acluofwashington.nationbuilder.com/king%5Fcounty%5Ffrt%5Fordinance?ref=thenexusofprivacy.net) (an open letter to King County Council signed by dozens of civil rights, civil liberties, racial equity, immigrant rights, workers rights, and progressive and libertarian organizations) and Malkia Cyril's [Defund Facial Recognition Before It's Too Late](https://www.theatlantic.com/technology/archive/2020/07/defund-facial-recognition/613771/?ref=thenexusofprivacy.net) have more details. So if you live or work in King County, [please contact the Council and ask them to ban governmental use of facial recognition](https://www.takeaction.network/xactions/15190?ref=47). --- *Image credit: originally from* [*San Francisco passes city government ban on facial recognition tech*](https://techcrunch.com/2019/05/14/san-francisco-facial-recognition-ban/?ref=thenexusofprivacy.net) *on TechCrunch* ### JEDII Tech News: May 7 URL: https://thenexusofprivacy.net/jedii-tech-news-may-7-2/ Last updated: 2021-11-14T20:27:15.000Z #### *Links, and occasional tweets, from around the web curated from* [*The Nexus Today* ](https://news.thenexus.today/Tech?ref=thenexusofprivacy.net)*\- an intermittent series* *Update, November 2021: most of the semi-regular "tech news roundups" I did in early 2021 are now hidden. This top story on this one, though, relates to the the Washington privacy battle so I decided to leave it up.* *If the tweet embedding isn't working for you, it's* [*my thoughts*](https://twitter.com/jdp23/status/1390740994849533954?ref=thenexusofprivacy.net) *on a Sen. Carlyle's framing in a now-paywalled Wall Street Journal story* [*State Data Privacy Bills Stumble*](https://www.wsj.com/articles/state-data-privacy-bills-stumble-11620379802?ref=thenexusofprivacy.net) *looking at the state privacy landscape after the back-to-back failure of the Bad Washington Privacy Act and Florida's privacy bill. The landscape's changed a bit since then: Colorado passed* [*the Colorado Privacy Act (ColoPA)*](https://www.jdsupra.com/legalnews/colorado-enacts-comprehensive-privacy-2905554/?ref=thenexusofprivacy.net), *and in New York* [*SB 6701 (strong in many ways including opt-in) made it farther than people had expected*](https://www.mediapost.com/publications/article/363485/opt-in-privacy-bill-advances-in-new-york.html?ref=thenexusofprivacy.net)*.* > [@Reuvencarlyle](https://twitter.com/Reuvencarlyle?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) continues to blame everybody but himself for his repeated failure. Who killed the bad bill?: > > "It was the progressive activists and [@AGOWA](https://twitter.com/AGOWA?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) ... > > in the committee ... > > with the religious fervor!" > > FYI [@IndiPlusWA](https://twitter.com/IndiPlusWA?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) [@IndivisEastside](https://twitter.com/IndivisEastside?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) [@IndivisibleCoup](https://twitter.com/IndivisibleCoup?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) [@DemCastUSA](https://twitter.com/DemCastUSA?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) [pic.twitter.com/RacrPgXZsK](https://t.co/RacrPgXZsK?ref=thenexusofprivacy.net) > > — Jon Pincus (@jdp23) [May 7, 2021](https://twitter.com/jdp23/status/1390740994849533954?ref%5Fsrc=twsrc%5Etfw&ref=thenexusofprivacy.net) #### [Sheikh Jarrah: Facebook and Twitter systematically silencing protests, deleting evidence](https://www.accessnow.org/sheikh-jarrah-facebook-and-twitter-systematically-silencing-protests-deleting-evidence/?ref=thenexusofprivacy.net) on Access Now (accessnow.org) Facebook and Twitter are systematically silencing users protesting and documenting the evictions of Palestinian families from their homes. #### [‘I’m shocked that they need to have a smartphone’: System for unemployment benefits exposes digital divide](https://www.usatoday.com/story/tech/news/2021/05/02/unemployment-benefits-system-leaving-people-behind/4915248001/?ref=thenexusofprivacy.net) By Andrew Kenney on Associated Press (usatoday.com) Like previous changes to the UI system during the pandemic, the new tech has caused a wave of confusion and complaints about overloaded help lines. #### [Tech service workers are essential. They want to be treated like it.](https://www.protocol.com/people/tech-service-workers-essential?ref=thenexusofprivacy.net) By Megan Rose Dickey on Protocol — The people, power and politics of tech (protocol.com) Nora Morales, a janitor at Google, told Protocol tech offices would “fall apart” without service workers. #### [Foresight and Decolonial Humanitarian Tech Ethics](https://cyber.harvard.edu/events/foresight-and-decolonial-humanitarian-tech-ethics?ref=thenexusofprivacy.net) By Sabelo Mhlambi on Berkman Klein Center (cyber.harvard.edu) Anasuya Sengupta, Sabelo Mhlambi, Andrew Zolli, and Aarathi Krishnan discuss if humanitarian actors can play a more intentional role in designing just and equitable digital futures #### [Perspective | Employers’ new tools to surveil and monitor workers are historically rooted](https://www.washingtonpost.com/outlook/2021/05/06/employers-new-tools-surveil-monitor-workers-are-historically-rooted/?ref=thenexusofprivacy.net) By Saima Akhtar on The Washington Post (washingtonpost.com) Technology has just made century-old methods more efficient and widespread. #### [Fake net neutrality comment campaign a harbinger of automated disinformation to come - Justin Hendrix](https://techpolicy.press/fake-net-neutrality-comment-campaign-a-harbinger-of-automated-disinformation-to-come/?ref=thenexusofprivacy.net) By Justin Hendrix on Tech Policy Press (techpolicy.press) Governments may not be prepared to contend with new mechanisms to automatically generate content and, indeed, online identities. #### [“The entire U.S. is built on algorithmic governance”](https://slowbuild.substack.com/p/the-entire-us-is-built-on-algorithmic) By Nancy Scola on Slow Build (slowbuild.substack.com) A Q&A with Colgate’s Dan Bouk on the hidden formula binding Congress #### [WebAIM: Screen Reader User Survey #9](https://webaim.org/projects/screenreadersurvey9/?ref=thenexusofprivacy.net) on webaim.org #### [Answering Europe’s Call: Storing and Processing EU Data in the EU](https://blogs.microsoft.com/eupolicy/2021/05/06/eu-data-boundary/?ref=thenexusofprivacy.net) By Brad Smith - President and Chief Legal Officer on EU Policy Blog (blogs.microsoft.com) Today we are announcing a new pledge for the European Union. If you are a commercial or public sector customer in the EU, we will go beyond our existing data storage commitments and enable you to process and store all your data in the EU. In other words, we will not need to move your data outside th… #### [Analytics Suggest 96% of Users Leave App Tracking Disabled in iOS 14.5](https://www.macrumors.com/2021/05/07/most-iphone-users-app-tracking-opt-out/?ref=thenexusofprivacy.net) By Tim Hardwick on MacRumors (macrumors.com) An early look at an ongoing analysis of Apple’s App Tracking Transparency suggests that the vast majority of iPhone users are leaving app... #### [Greek camps for asylum seekers to introduce partly automated surveillance systems](https://algorithmwatch.org/en/greek-camps-surveillance/?ref=thenexusofprivacy.net) By Corina Petridi (Reporters United) on AlgorithmWatch (algorithmwatch.org) An EU-funded surveillance system for “reception and identification centers” on five Greek islands raises questions about asylum seekers’ privacy and well-being. Despite assurances from European authorities, the Centaur system suggests that mass control, and not shelter, is the priority. #### [How can we resist surveillance advertising?](https://neweconomics.org/2021/05/how-can-we-resist-surveillance-advertising?ref=thenexusofprivacy.net) By Wednesday 19 May 2021, 18:00-19:30 on New Economics Foundation (neweconomics.org) Join Heather Burns from the Open Rights Group, Duncan McCann from the New Economics Foundation and other guests TBA to discuss the growth of surveillance advertising #### [PSA: Twitter’s New Tip Jar Can Reveal Your Address](https://www.vice.com/en/article/wx55k4/psa-twitters-new-tip-jar-can-reveal-your-address?ref=thenexusofprivacy.net) on vice.com Twitter’s new feature to pay users is off to a rough start, as researchers find some issues that may reveal sender or recipient’s personal addresses. ### Comments on King County facial recognition ban URL: https://thenexusofprivacy.net/comments-on-king-county-facial-recognition-ban/ Last updated: 2021-05-05T17:01:33.000Z *From the May 5 King County Council "Committee of the Whole" meeting.* I’m Jon Pincus, a technologist, entrepreneur, and long-time Bellevue resident. Following up on my comments from two weeks ago, I’d like to highlight a key difference between the proposed King County Ordinance 2021-0091 and the statewide facial recognition legislation SB 6280 that comes into effect on July 1. [**Facial recognition is like plutonium**](https://static1.squarespace.com/static/59a34512c534a5fe6721d2b1/t/5cb0bf02eef1a16e422015f8/1555087116086/Facial+Recognition+is+Plutonium+-+Stark.pdf?ref=thenexusofprivacy.net): so toxic that its use needs to be restricted to a small number of highly specialized and tightly controlled situations. That’s exactly what Ordinance 2021-0091 does. SB 6280 takes a very different approach. It allows virtually all uses of the technology, but introduces transparency and testing requirements. For example, it requires government agencies to - document how they’ll ensure that everybody’s sprayed with equal amounts of plutonium. - test out plutonium on the communities most likely to be harmed, to see how toxic it is to them - and produce reports on what happens when people are sprayed with plutonium. Unsurprisingly, **the communities most at risk from facial recognition strongly opposed the statewide legislation, instead favoring a moratorium or ban**. The legislature wasn’t ready to go that far, but they did remove a clause in the original version of the bill that would have prohibited stronger local legislation. In other words, **the legislature specifically allowed for exactly the kind of ordinance King County is currently considering.** Unsurprisingly, the communities most at risk from facial recognition support this ordinance. As a software engineer, I strongly urge you not to get too focused on whether or not algorithms are improving. Cherry-picked quotes and numbers typically make the technology look better than it really is, for example by ignoring real-world complexities like racialized policing and inexperienced users with limited training. Besides, **the issues with facial recognition go far beyond today’s bias and accuracy problems**. As Timnit Gebru of the Gender Shades project points out in [A Case for Banning Facial Recognition](https://www.nytimes.com/2020/06/09/technology/facial-recognition-software.html?ref=thenexusofprivacy.net), even completely accurate facial recognition can still be used in ways that are “detrimental to certain groups of people.” Evan Selinger and Woodrow Herzog suggest accurate facial recognition might be even more dangerous “[because those in power will find it irresistible and they’ll want to use it more often](https://theappeal.org/the-lab/report/the-case-for-banning-law-enforcement-from-using-facial-recognition-technology/?ref=thenexusofprivacy.net).” Please protect King County residents and visitors, and vote to ban government agencies from spraying plutonium. ### The Clock Ticks Down on the Bad Washington Privacy Act URL: https://thenexusofprivacy.net/the-clock-ticks-down-on-the-bad-wpa/ Last updated: 2022-10-01T09:39:03.000Z ![What will happen? A bar chart. Nothing passes House: 54.5%. Carlyle's version passes: 9.1%. Hansen's version passes: 9.1%. Kloba amendments pass: 27.3%](https://thenexusofprivacy.net/content/images/2021/04/210416-what-will-happen-sm.png) Twitter poll, Friday April 16 *Last updated: April 21* There's less a week left in the Washington state legislative session. A few months ago, the Bad Washington Privacy Act (SB 5062) seemed like it was sure to pass. Sen. Reuven Carlyle's weak, industry-backed bill had sailed through the Senate 48-1 – and House Civil Rights and Judiciary Committee Chair Drew Hansen had refused to give a hearing to Rep. Shelley Kloba's People's Privacy Act (HB 1433). But now, the Bad Washington Privacy Act is on the ropes, with its supporters' claims of "consensus" revealed as an illusion. - House committees advanced Rep. Hansen's version of SB 5062 on straight party-line votes. [This version managed to displease almost everybody](https://www.geekwire.com/2021/industry-backed-digital-privacy-bill-sees-head-spinning-changes-washington-state/?ref=thenexusofprivacy.net): the Tech Equity Coalition, tech companies, privacy advocates, progressive grassroots activists, and Republicans all oppose it. - Rep. Kloba has introduced amendments fixing many of the bill's problems, with broad support by immigrant rights, civil rights, and civil liberties groups - Other amendments have been introduced as well, almost two dozen all together – The House didn't vote on SB 5062 before its "cutoff" on Sunday, April 11, but procedural shenanigans means it's still alive. So the House still has a chance to pass something before the session ends this Sunday – the Senate version, Rep. Hansen's version, Rep. Kloba's amendments, or something else. If the House passes something that's different than the Senate version, then there's a multi-step process to try to get to agreement. That's what happened in 2019 and 2020 – and negotiations collapsed. Especially since there's other critical legislation still to be resolved, I can certainly see why most people don't think the House will pass anything this session. That would still be a huge victory for the Tech Equity Coalition and allies – the third time in a row they've stopped a bad bill from passing. But for the last several months we've been saying that the best outcome is meaningful privacy protection for Washingtonians this legislative session – and it's still achievable! So let's look in a little more detail at the pressures the legislators are under, the various options on the table, and why the House can and should pass the Kloba amendments. - ["We've got to pass something"](#we-ve-got-to-pass-something) - [Big tech says yes, legislators should sell out their constituents!](#big-tech-says-yes-legislators-should-sell-out-their-constituents-) - [The case for the Kloba amendments](#the-case-for-the-kloba-amendments) - ["Perfect is the enemy of good"](perfect-is-the-enemy-of-the-good) - [The stakes are high!](#the-stakes-are-high-) ## "We've got to pass *something*" Several of the legislators I've talked with have been quite candid about the pressure they're under to pass *something* this session. And even though the Bad Washington Privacy Act won't actually protect Washingtonians' privacy, passing it at least lets lawmakers claim they've done *something*. Big tech and their allies will continue to claim that the bill offers a "gold standard" with "robust enforcement" and "strong protections" of "unambiguous rights." Legislators can point out that the bill they passed is stronger than the Even Worse Virginia Privacy Act. Hooray! Of course, the risk to legislators, is that their constituents might not believe those claims. On email threads with the House Civil Rights and Judiciary committee, a handful of grassroots activists were quite blunt in their feedback that the Bad Washington Privacy Act is bad. They also made it clear that they thought legislators who were supporting the Bad Washington Privacy Act were representing big tech's interest instead of their constituents. So while in some ways voting to pass something weak seems like the path of least resistance – it keeps big tech happy, and lets legislators claim a win – there's a really high potential cost to it as well. Do they want to be seen as selling their constituents out to big tech? And Republicans' party-line votes against Hansen's version of the bill, on the grounds that it doesn't go far enough to protect privacy, make it an even more fraught situation for Democrats. With immigrant communities, civil rights groups, and progressive activists all opposing the extremely unpopular Bad Washington Privacy Act, will Democrats decide to hand Republicans a campaign issue and antagonize their base by pushing *something* through? ## Big tech says yes, legislators should sell out their constituents! ![A male in a tie and jacket saying "Consent is important, but ..." The chyron at the bottom identifies him as Ryan Harkins, Microsoft Corporation, testifying to the House Civil Rights & Judiciary Committee](https://thenexusofprivacy.net/content/images/2021/04/consent-is-important-but.png) Microsoft's Ryan Harkins advocates for the Bad Washington Privacy Act: "Consent is important, but ..." None of that's a problem from big tech's perspective. They think the Sen. Carlye's "Classic" version of the Bad Washington Privacy Act is just fine. It doesn't make them get consent before exploiting people's data, it doesn't let people sue them if they break the law, it's got all kinds of loopholes and exemptions that neuter enforcement. What's not to like? And even though big tech opposes Rep. Hansen's version, which has some minor improvements such as a very limited private right of action that allows people to sue for injunctive relief (but no damages), that's probably just posturing for negotiation purposes. Last year, they were willing to settle for a limited private right of action in the final negotiations. As I said in the Appropriations hearing, they'll probably wind up describing the Hansen version as a "reasonable compromise" – especially if additional amendments to weaken it further. Because what big tech really really doesn't like is the Kloba amendents – or the even stronger People's Privacy Act. Both of these make tech companies get consent before exploiting people's data. Both of these have much stronger enforcement. So for the third year in a row big tech and Sen. Carlyle are demanding that legislators let them exploit our data and leaves Washingtonians unprotected. The House said no in 2019 and 2020, but the message clearly hasn't been received. This is actually a good reason that the House should pass the Kloba amendments overwhelmingly. It's a good way to respond to big tech's insistence that legislators sell out their constituents by saying NO much more loudly – and it also says YES to meaningful privacy protections and holding big tech accountable. ## The case for the Kloba amendments Emilie St. Pierre of Future Ada: "Opt-out doesn't protect survivors" And there are other even better reasons to pass the Kloba amendmets. Start with the policy case. As [40+ Tech Equity Coalition organizations and allies](https://signon-acluofwashington.nationbuilder.com/support%5Fkloba%5Famendment%5Fto%5Fsb%5F5062?ref=thenexusofprivacy.net) write > Unlike other versions of SB 5062, Rep. Kloba’s striking amendment has a fully opt-in approach, contains a strong enforcement mechanism with a private right of action including a right to recover damages, allows local jurisdictions to pass stronger laws, and removes some loopholes. Although this amendment can still be improved, it is a big step forward and in line with HB 1433, the People’s Privacy Act, and addresses the four key changes we have recommended be made to SB 5062. During the hearings and in written comments, experts from groups like Consumer Federation of America, La Resistencia, CAIR Washington, Future Ada, InterIm CDA, EFF, and ACLU of Washington have gone into detail on all of these. On opt-in, for eample, the current bill's weaker opt-out framework fails to protect immigrants, survivors of stalking, harassment, and domestic violence, and disabled people using screenreader technology. And as well as being good policy, these are popular positions! Opt-in – making companies should have to get informed consent before they collect, share, or sell your data – typically polls over 80%. Most Washingtonians think they should be able to sue companies who break the law and (if they win) get compensated for the harms that have been done. And from House legislators' perspective, a bipartisan attempt to pass good legislation is a much better outcome for *both* parties than just giving up now. Even if the Senate once again refuses to negotiate, the House passing strong privacy protections would be a significant legislative success that builds even more momentum for the discussions next session. ## "Perfect is the enemy of good" But if the Senate once again refuses to negotiate, then the House has to choose between passing the Bad Washington Privacy Act and nothing. After not getting their way in 2019 and 2020, tech lobbyists take advantage of this by warning legislatures they'll be seen as legislative failures if they don't pass something this year. One of their favorite talking points in aid of this is "perfect is the enemy of good". But the Bad Washington Privacy Act isn't good. It's bad. Don't take my word for it. Listen to groups like One America, La Resistencia, CAIR Washington, Future Ada, InterIm CDA, MAPS-AMEN (American Muslim Empowerment Network), Japanese American Citizens League Seattle Chapter, Black Lives Matter - Seattle King County, Puget Sound Sage, the John T. Williams Organizing Committee, Urban League of Metropolitan Seattle, Eastside for All, Real Change, and ACLU of Washington. True, there are also some groups who once the non-profit exemption got added decided that the Bad Washington Privacy Act was good enough. But none of them are looking at it from the perspective of people who are immigrants, people of color, or Muslims. The Bad Washington Privacy Act is bad – and a bad bill is worse than no bill. So in reality standing up to big tech for a third year in a row will be actually a huge legislative success. Why is a bad bill worse than no bill? One big reason is that passing the Bad Washington Privacy Act gives the legislature’s endorsement to allowing predatory and exploitative behavior with no real consequences – and lends credence to big tech's over-inflated claims for how much protection the bill gives people. In their Senate testimony, tech lobbyists were very candid that one of their goals in passing a privacy law is to reassure people that their data is safe so that they'll share more. But people's data won't actually be safe if the Bad Washington Privacy Act passes. So if legislators pass this bill, they're encouraging people to think they're safer than they are – and share more data, putting themselves even more risk. Another important reason a bad bill is worse than no bill is that once something is passed, it's very hard to change it. Last year's legislation on governmental use of facial recognition is an excellent example of this. Since then, the landscape has shifted significantly. Cities including Boston, New Orleans, and Portland have joined San Francisco in banning governmental use. Vermont became the first state to ban it. There's potential federal legislation, with bipartisan support. But when this year's session rolled around, Sen. Carlyle refused to hold a hearing on Sen. Bob Hasegawa's facial recognition moratorium bill, telling *Geekwire* he did not feel a need to re-engage in that issue at this time: > “The legislation that we passed last year created a framework for how the public sector and the private sector can utilize facial recognition technology in responsible ways,” he said. “I feel like we made a material and meaningful policy step forward.” Something similar's very likely to happen if the legislature passes a bad privacy bill this year. After doing so much work, why not wait to see how it works out before changing it? The illusion of protection today will become a further barrier to real protection tomorrow. ## The stakes are high! But then again, big tech's influence is strong here. So really, anything can happen. There's a lot of other critical legislation still to be resolved as well, and it's hard to know how much time and energy legislators have to work on the privacy bill. On the one hand that makes it less likely that anything will happen ... on the other hand, this is exactly the kind of situation where big tech could try to sneak something through. Whatever happens this year, the dynamics will be very different when the battle continues in next year's legislative session. As we've been fighting the bad bill, we've also gotten a chance to do more advocacy for the good features of the People's Privacy Act. The People's Privacy Act protects people, not corporations, and has bi-partisan sponsorship as well as broad support from immigrant rights, civil rights, civil liberties, consumer, and grassroots activism groups. It's a much better starting point for next year's discussion than the Bad Washington Privacy Act was this year. Another way the dynamics will hopefully be different next year would be if Senate Democrats will wake up and smell the coffee. Sen. Carlyle's approach hasn't worked in the past and so is not likely to work in the future. They really should put somebody else in charge next year. And whatever happens in Washington has ramifications in other states as well as with federal legislation. If the Bad Washington Privacy Act passes here, it will reinforce the strategy Todd Feathers discusses in [Big Tech Is Pushing States to Pass Privacy Laws, and Yes, You Should Be Suspicious](https://themarkup.org/privacy/2021/04/15/big-tech-is-pushing-states-to-pass-privacy-laws-and-yes-you-should-be-suspicious?ref=thenexusofprivacy.net) – and be a shot in the arm for [Rep. DelBene's very similar bad federal legislation](https://www.rollcall.com/2021/04/16/280-million-americans-have-no-control-over-their-data-a-national-standard-is-the-only-way-to-fix-it/?ref=thenexusofprivacy.net). But if big tech's plans once again get derailed here in Microsoft's and Amazon's home state ... that could cause some broader hiccups as well. So the stakes are high as Washington's short legislative session wraps up. Stay tuned for more! And, when you get a moment,[ ](http://bit.ly/5062SupportKloba?ref=thenexusofprivacy.net) [please tell your legislators not to sell us out to big tech! Ask them to SUPPORT the Kloba amendments - and OPPOSE the Bad Washington Privacy Act if the amendments don't pass](http://bit.ly/DontSellUsOut?ref=thenexusofprivacy.net). ## UPDATE, after the session It went down to the wire, and final "negotiations" reportedly included Sen. Carlyle holding another bill hostage unless members caved and passed the Bad Washington Privacy Act. But at the end of the day, enough progressive House Democrats opposed the bill that there weren't quite enough votes to get it past united Republican opposition, and the legislature adjourned "sine die" without taking any action on the Bad Washington Privacy Act. It's another huge win for grassroots activism. As Indivisible Plus Washington says in [The Bad Washington Privacy Act has been defeated!](https://indipluswa.medium.com/the-bad-washington-privacy-act-has-been-defeated-56bfde5a735f?ref=thenexusofprivacy.net) > This is the third year in a row that the House has rejected tech lobbyists’ attempt to push through a weak, industry-backed “privacy” bill. Thanks to all the legislators involved.... > > And thanks as well to everybody who got involved with the activism. Every phone call, email, and meeting helped make a difference. > > At the start of the session everybody thought the Bad Washington Privacy Act was almost certain to pass, and after the Senate 48–1 vote it seemed like a done deal. But once again the Tech Equity Coalition took the lead, and lots of us joined in to help with creative and persistent activism. Now, we’ve now got a huge amount of momentum, and a great opportunity to build on this win to get something strong passed in 2022\. Not only that, we’re likely to influence the debate in other states and nationally as well. ## UPDATE, after the 2022 session [It’s time for Washington to pass strong privacy legislation!](https://wa-privacy.net/2022-leg-priview/?ref=thenexusofprivacy.net), [Feb 14 💘 Update](https://wa-privacy.net/legislation-update-021422/?ref=thenexusofprivacy.net), [The situation is … fluid](https://wapeoplesprivacy.org/the-situation-is-fluid/?ref=thenexusofprivacy.net), and [It ain’t over till it’s over](https://wa-privacy.net/it-aint-over-till-its-over/?ref=thenexusofprivacy.net) tell the story of the 2022 session. The new Foundational Data Privacy Act, sponsored by Representatives Slatter and Berg, got off to a promising start, tech lobbying kicked into overdrive, and there were once again missed deadines and shenanigans. By the time it got HB 1850 got out of Appropriations it had been butchered and turned into a "compromise" vehicle to pass ... SB 5062, the Bad Washington Privacy Act! Sen. Carlyle had announced that he'd be retiring after the session but his last try at the apple ended the same way the previous ones did. The session adjourned "sine die", and the Bad Washington Privacy Act was 0-for-4. ### The Bad Washington Privacy Act: An Illusion of Rights And As Cher Would Say, "What a Monet" URL: https://thenexusofprivacy.net/the-bad-washington-privacy-act-an-illusion-of-rights-and-as-cher-would-say-what-a-monet/ Last updated: 2021-04-09T03:42:45.000Z ![](https://thenexusofprivacy.net/content/images/2021/04/full-on-monet.gif) The Washington state legislature is about to vote on the Bad Washington Privacy Act (SB 5062). Defenders of this bill would like us believe that this bill is a "gold standard" with “strong protections” and “unambiguous rights”. In reality, the current version of the bill codifies the status quo. It protects tech industry’s rights, but leaves the privacy rights of the people almost completely unprotected. The bill is a "full-on Monet." As Cher says in the 1995 movie Clueless, "It's like a painting, see? From far away, it's okay, but up close, it's a big old mess." SB 5062 “right” to opt-out of having your data collected and sold to a data broker, or used for targeted advertising, is just one example of “a big old mess” found in the bill. Opt-out means that companies can generally do what they want with your data (subject to their privacy policy) unless you tell them not to. It’s the opposite of “opt-in,” where companies can’t collect or sell your data without getting your informed, affirmative consent. With opt-out, the onus is on the individual to discover that personal information is being collected about them, and then figure out how to "opt-out" of that data collection. The process is so convoluted that the risk is that people will give up trying to navigate the privacy policy and opt-out process and let corporations collect our data anyway. This is exactly what Google, Microsoft, and Amazon want - which is why they’re big supporters of the Bad Washington Privacy Act. The types of data collected by tech companies, advertising companies and others isn’t limited to browser, device, and usage data, such as the type of computer you’re using, the software, or even your IP address. As Norma Smith, a former Republican Washington state legislator notes in [her op ed](https://www.heraldnet.com/opinion/comment-we-need-a-data-privacy-law-but-senate-bill-isnt-it/?ref=thenexusofprivacy.net) in the Everett Herald, data collected might include health information and your political views – in other words, very personal information. Opting out can be a challenging process requiring technical skills and time not readily available to many people. For people who are not technically inclined, or who have low English proficiency, opt-out can present a significant barrier to meaningfully control one’s data. Even after you’ve discovered how to opt out, the Bad Washington Privacy Act makes it difficult to actually make this happen. According to provisions in the bill, individuals are required to send a request to the "data controller". The data controller has 15 days to respond to you. They can extend that to 45 days if they feel they need to. Then they can refuse to honor your request. You can appeal, but that's going to take another 30 days. That can lead to a full 90 days before, maybe, just maybe, you might be able to opt-out. No guarantees, of course. Suppose that after full 90 days, you haven't heard back or your appeal has been denied? You're angry, so you decide to sue them. If you eventually win your lawsuit, then they finally have to let you opt-out, and maybe pay your attorney’s fees - but again, no guarantees. They don’t have to pay any penalties or damages for the harm they’ve caused. The Attorney General is allowed to sue for damages and penalties. But the money allocated for enforcement is only is enough to hire 3.6 full-time employees. For the entire state. The budget is less than a quarter of what the tiny Grand Duchy of Luxembourg, a tenth the size of Washington, spends to enforce its privacy laws. The legislature still has a chance to fix the Bad Washington Privacy Act and pass a strong privacy bill that really protects us. Rep. Shelley Kloba has introduced an amendment that makes the bill fully-opt in. It also give us all the right to sue for money damages — just like we can sue companies that harm us in other ways — and has penalties for companies that break the law. So hopefully the legislature will pass the Kloba amendment, and take an important step to giving us strong privacy protections based on meaningful rights. But the one thing they shouldn't do is pass the current version of the Bad Washington Privacy Act and settle for the illusion of rights, continuing to leave us all at risk. Once a bad bill is passed it is very hard to change. I know there's a temptation to feel like we must pass something, but waiting another year and truly protecting our privacy is much better than passing this bad, “full-on Monet” of a bill. --- *Image via* [*Best Quotes From Clueless Movie*](https://www.refinery29.com/en-us/2015/07/90743/best-clueless-quotes-movie?ref=thenexusofprivacy.net#slide-24)*, Refinery 29* ### House Appropriations Testimony on SB 5062 - the snarky version URL: https://thenexusofprivacy.net/more-testimony-0401/ Last updated: 2021-04-02T06:31:01.000Z *This is the testimony I actually wound up giving at the hearing. It was better live because I made air quotes around the spin that lobbyists were saying :)* [*You can see my longer written testimony here*](https://thenexusofprivacy.net/testimony-0401/)*.* Madame Chair, Mr. Ranking Member, and members of the committee, I’m Jon Pincus from Bellevue, a technologist and entrepreneur. I OPPOSE the Bad Washington Privacy Act in its current form. Others have already discussed the issues I covered in my [written testimony](https://thenexusofprivacy.net/testimony-0401/). So instead ... Lobbyists testifying CON tell you that even the very limited private right of action in the current version of the bill “with no chance for public input” will cause them a “burden”. Anything stronger will surely cause the sky to fall! Remember last year, when they talked about the “robust enforcement” of the Senate bill -- which lacked a *per se* clause, so even the AG couldn’t enforce it? Of course industry prefers no liability when they break the law, and “robust enforcement” by 3.6 FTEs this year’s bill budgets. So take what they say with a grain of salt. Instead, strengthen the private right of action and remove the right to cure. Or go further, and adopt the People’s Privacy Act as a striker. It has bipartisan sponsorship and broad support from dozens of civil rights, immigrant rights, and grassroots organizations -- input that the Senate has ignored over the last three years. A privacy bill without enforcement or deterrence will not protect Washingtonians. So if you don’t strengthen it, please vote no, and don’t give the legislature’s endorsement to allowing predatory and exploitative behavior with no real consequences. ### House Appropriations Testimony on Fiscal Impacts of SB 5062 URL: https://thenexusofprivacy.net/testimony-0401/ Last updated: 2021-04-02T07:30:06.000Z *This was the expanded written version of the testimony I planned to give at the House Appropriations hearing on SB 5062\. Plans changed and* [*I wound up discussing something different*](https://thenexusofprivacy.net/more-testimony-0401/)*, but I still filed it as written testimony.* Mr. Chair, Ranking Member, and members of the Appropriations committee, I’m Jon Pincus from Bellevue, a technologist and entrepreneur, and former General Manager of Strategy Development at Microsoft. I'm also one of the leaders of Indivisible Plus Washington, a grassroots activism group with more than 20,000 members across the state. I OPPOSE SB 5062 in its current form for a long list of reasons. This testimony focuses on the fiscal aspects of SB 5062 and covers four points: - **The paltry $1.2 million budget allocated to the AG’s Office for 2021-2023, *decreasing* in future years, is insufficient for enforcement or deterrence** - **Strengthening the very limited private right of action, and allowing cities and county attorneys to enforce the law as well, can improve enforcement and deterrence without incurring additional taxpayer cost** - **The “right to cure” should be removed** - **If those fixes are not made, the bill as budgeted will not protect Washingtonians’ privacy -- so please vote “no”** ## The budget is insufficient for enforcement or deterrence Other than the very limited private right of action in Section 111, allowing individuals to sue for injunctive relief and costs, Section 112 of the bill limits enforcement “solely” to the AGO. As a result, the AGOs paltry budget of $1.2 million for 2021-2023 (3.6 FTEs), decreasing in future years, is not sufficient to protect Washingtonians privacy. Look at the evidence from elsewhere. European budget allocations are much larger. Ireland’s data protection commission, for example, has a [$23 million annual budget ](https://www.gdprregister.eu/news/irish-data-protection-commission-budget-2021/?ref=thenexusofprivacy.net) despite having a population smaller than Washington state. Even so, [European data protection enforcement has been held back by lack of resources](https://www.euractiv.com/section/data-protection/news/gdpr-enforcement-held-back-by-lack-of-resources-report-says/?ref=thenexusofprivacy.net). Just last week, [the EU Parliament issued a resolution criticizing enforcement](https://protectionofdata.substack.com/p/issue4), noting that cases referred to the Irish DPA in 2018 still have not been heard and that the Irish DPA closes most cases with a settlement rather than a sanction. California’s experience is also instructive here. [In the only case settled so far under their 2018 CCPA](https://woodruffsawyer.com/cyber-liability/first-ccpa-lawsuit-settled/?ref=thenexusofprivacy.net), the settlement gave $2 to each person who had been harmed, but did not impose any additional civil penalties. California’s newer CPRA allocates an annual budget starting at $10 million / year, which must be increased by the legislature “as may be necessary to carry out the provisions of this title.” With the current budget, the AGO estimates it can bring three investigations per year. And what if a large company violates the law? Joseph Jerome of Common Sense Media testified in the Ways & Means hearing that the average large company has 15 privacy lawyers. Facebook has over 150. The AG’s has not been able to prevent Facebook’s and Google’s ongoing violations of Washington political advertising transparency laws, which continued despite a lawsuit and settlement in 2018 and a second lawsuit in 2020\. With such minimal resources, it is hard to see them fairing better here. Unless significant changes are made, SB 5062 will require substantial additional investment if we are to have any hope of holding companies who break the law accountable -- or deterring others. ## Strengthen the private right of action and allow local enforcement Appropriation can resolve this fiscal problem by some straightforward changes. - Replace Section 111, the limited private right of action, with [HB 1433](http://lawfilesext.leg.wa.gov/biennium/2021-22/Pdf/Bills/House%20Bills/1433.pdf?q=20210208204007&ref=thenexusofprivacy.net)’s Section 10 (1) - Remove the word "solely" from Section 112 (1) to allow local enforcement The much stronger private right of action in HB 1433 allows courts to award damages and civil penalties as well. This allows private actions to act as enforcement action -- and the threat of a private action becomes much more of a deterrent. In addition, SB 5062’s Section 113 already provides that moneys from civil penalties can be used to fund the recovery of the AGs attorney fees and costs. If private actions can also lead to civil penalties, AG resources for enforcement can also increase over time -- without additional cost to the taxpayer. Consumer groups such as WashPIRG and Consumer Federation of America generally support a stronger private right of action. Even Consumer Reports, who backs the current version of the bill, said in their March 26 letter to Rep. Hansen that "[We would prefer a private right that would also afford consumers monetary relief](https://advocacy.consumerreports.org/wp-content/uploads/2021/03/CR-Letter-SB-5062-House-Committee-Amendment-3.26.21.pdf?ref=thenexusofprivacy.net)." ## Remove the right to cure The AG’s office has testified that “right to cure” will be a drain on their resources. As Consumer Reports said in their March 26 letter, the right to cure is a ““[get-out-of-jail-free” card” that “ties the AG’s hands and signals that a company won’t be punished for breaking the law](https://advocacy.consumerreports.org/wp-content/uploads/2021/03/CR-Letter-SB-5062-House-Committee-Amendment-3.26.21.pdf?ref=thenexusofprivacy.net)”. Again, the evidence from California is instructive here. Their 2018 CCPA law had a right to cure, and the AG’s initial right-to-cure letters focused on sites missing either key privacy disclosures from their privacy notices or a clear opt-out link. Why should taxpayers fund free testing that companies running the sites should do on their own? Californians decided they shouldn’t, and removed the right-to-cure in 2020 CRPA, adopted by referendum. The amendment adopted by CR&J last week introduces a one-year sunset for the right to cure. But there’s no reason to do this for even a year. Section 112 (4) should be removed. ## If these fixes are not made, please vote “no” A privacy bill without enforcement or deterrence will not protect Washingtonians. Instead, it gives the cover of law -- and the legislature’s endorsement -- to the current situation where there are virtually no consequences for predatory and exploitative behavior. So if these improvements are not made, I ask you to vote “no” on SB 5062, the Bad Washington Privacy Act. Jon Pincus, Bellevue, 98005 ### Bad Bills Advance in the Senate: Washington Privacy Legislation Update URL: https://thenexusofprivacy.net/bad-bills-advance-in-the-senate/ Last updated: 2021-03-03T05:39:06.000Z ![privacy, with a background of numbers and digits looking like a computer screen](https://thenexusofprivacy.net/content/images/2021/03/privacy2.png) The Washington state Senate's about to vote on a couple of key privacy-related bills: - SB 5010, which originally would have prohibited insurers from using credit scores to set rates but now is "watered down to the point where its impact would be quite minimal" thanks to an [amendment written by the insurance industry that ‘gutted’ it](https://www.insurance.wa.gov/news/insurance-industry-guts-proposed-ban-use-credit-scores?ref=thenexusofprivacy.net). > If you live in Washington state, please [Tell your state Senator to support the original version of SB 5010](https://www.takeaction.network/xactions/14058?ref=thenexusofprivacy.net). - SB 5062, the weak, industry-backed Bad Washington Privacy Act. Consumer Federation of America's [We Need Real Privacy Protection in the States, not the Washington Privacy Act’s Illusion of Privacy](https://consumerfed.org/we-need-real-privacy-protection-in-the-states-not-the-washington-privacy-acts-illusion-of-privacy/?ref=thenexusofprivacy.net) is a good run-down of the problems with this bill. > *If you live in Washington state, please* [*Tell your state Senator that you want strong privacy legislation - and the Bad Washington Privacy Act isn't good enough*](https://www.takeaction.network/xactions/14035?ref=47) SB 5010 is a great example of how ["surveillance capitalism" reinforces systemic racism](https://crosscut.com/opinion/2021/02/wa-legislature-takes-systemic-racism-insurance-rates?ref=thenexusofprivacy.net). As Clyde Ford writes in *Crosscut*: > If you want to understand systemic racism — how it began, who suffers from it and how it’s eliminated — the history that led to SB 5010 is a great place to start. Likewise, if you want to understand economic inequality — in short, why it’s expensive to be poor — SB 5010 offers a starting point as well. And civil rights organizations have similarly pointed out who typically gets harmed the most from privacy abuses. As Stanley Shikuma of JACL Seattle Chapter pointed out in his [riveting testimony](https://medium.com/a-change-is-coming/a-bad-day-for-a-bad-privacy-bill-a-good-day-for-privacy-a2aeea8e8739?ref=thenexusofprivacy.net) last year, [data abuse was core to the mass incarceration of Japanese-Americans during World War II](https://www.washingtonpost.com/news/retropolis/wp/2018/04/03/secret-use-of-census-info-helped-send-japanese-americans-to-internment-camps-in-wwii/?ref=thenexusofprivacy.net). In January, Brianna Auffray of CAIR WA, noted that SB 5062 won't even stop the ongoing non-consensual sharing of Muslim prayer app data with ICE and the military ([The illusion of protection](https://thenexusofprivacy.net/the-illusion-of-protection/) goes into more detail about this). But even in a "progressive" state like Washington, corporate Democrats are very deferential to insurance companies (on SB 5010) and big tech (on SB 5062). The original version of SB 5010 has support from the state Insurance Commissioner and Gov. Inslee, but the Senate doesn't necessarily care about stuff like that – last year's version of the Bad Washington Privacy Act passed the Senate 47-1 even though the Attorney General said it was unenforceable. If and when the Senate passes the bills, they head to the House. SB 5062 will go to the Civil Rights & Judiciary committee. There are a couple of paths CJ&R can take: - advancing the People's Privacy Act (H.R. 1433), which incorporates these and other improvements, instead (via a 'striking amendment'). This is the approach the civil rights groups in the Tech Equity Coalition support. - starting with the Bad Washington Privacy Act, and strengthen it by adding a private right of action; making it opt-in only; removing loopholes, the "right to cure", pre-emption of stronger local legislation; and so on. This is the approach the House took last year, where it passed a bill with many of these improvements. But of course the big tech companies will be supporting the legislation, and they and their allies will be pushing to advance SB 5062 roughly as it is. In 2019 and 2020, the Senate passed weak industry-backed privacy bills overwhelmingly, and the House strengthened it significantly. This year's Senate bill doesn't incorporate any of the House's improvements, or address most of the Attorney General Office's feedback; it clearly doesn't allocate enough money to be enforced effectively. So the most likely outcome is the House will strengthen it at least somewhat. We shall see. From an activism perspective, the two Senate votes are the only key short-term actions – the House is currently focused on all the other legislation that has to get through by March 9\. If you, or your group, meet with legislators, now's a good time to think about trying getting on their schedule for sometime in mid-March. Otherwise, we'll be cranking things up once SB 5062 starts to move through the House, so stay tuned for more. And in the short term: *If you live in Washington state, please* - [*Tell your state Senator to support the original version of SB 5010*](https://www.takeaction.network/xactions/14058?ref=thenexusofprivacy.net)*.* - [*Tell your state Senator that you want strong privacy legislation - and the Bad Washington Privacy Act isn't good enough*](https://www.takeaction.network/xactions/14035?ref=47) --- Image credit: via [*TechRepublic*](https://www.techrepublic.com/article/big-data-wake-up-call-increased-online-privacy-concerns-require-risk-management/?ref=thenexusofprivacy.net) ### JEDII Tech News: February 28 URL: https://thenexusofprivacy.net/newsletter-february-28/ Last updated: 2021-02-28T22:28:37.000Z *Links from around the web ...* #### [Disclosures of NYPD Surveillance Technologies Raise More Questions Than Answers](https://techpolicy.press/disclosures-of-nypd-surveillance-technologies-raise-more-questions-than-answers/?ref=thenexusofprivacy.net) By Joël Carter on Tech Policy Press (techpolicy.press) The POST Act requires NYPD to release information on its surveillance systems. But the first tranche of disclosures prompt serious concerns. #### [TikTok is being tapped by brands like Grammarly, which have found success through viral trends and free advertising on the app](https://www.businessinsider.com/tiktok-marketing-how-brands-go-viral-spotify-grammarly-ocean-spray-2021-2?ref=thenexusofprivacy.net) By Grace Kay on Business Insider (businessinsider.com) Companies advertise on TikTok differently than on any other platform — for many, users do more to promote the brands than the companies themselves. #### [What the 2020 Elections Taught Us About Disinformation](https://techpolicy.press/what-the-2020-elections-taught-us-about-disinformation/?ref=thenexusofprivacy.net) By Hermelinda Cortés on Tech Policy Press (techpolicy.press) Any analysis of power in the current moment needs to incorporate disinformation as a form of soft, decentralized power and social control. #### [Sea of Surveillance: Christopher Gregory-Rivera Exposes Policing in Puerto Rico](https://hyperallergic.com/625081/las-carpetas-christopher-gregory-rivera-abrons/?ref=thenexusofprivacy.net) By Ilana Novick on Hyperallergic (hyperallergic.com) Las Carpetas takes a crucial step in exposing the surveillance of activists. But are pictures of folders the most effective way to tell the stories of people impacted? #### [Virginia lawmakers vote to tightly limit police use of facial-recognition technology](https://www.dailypress.com/government/virginia/vp-nw-clearview-facial-recognition-bill-20210224-opnslurppzglnhgocnfsypjlsu-story.html?ref=thenexusofprivacy.net) By Jonathan Edwards on Daily Press (dailypress.com) The bill, which will ban apps like Clearview unless state lawmakers specifically give a police department permission, was sparked by a Virginian-Pilot investigation. #### [Taking on the tech giants: the lawyer fighting the power of algorithmic systems](https://www.theguardian.com/media/2021/feb/28/taking-on-the-tech-giants-whether-its-the-cia-or-facebook-cori-crider-likes-a-fight?ref=thenexusofprivacy.net) By Ed Siddons on The Guardian (theguardian.com) Whether it’s the CIA or Facebook, lawyer and activist Cori Crider is never one to shy away from a fight #### [Fixing Section 230 Without Breaking the Internet](https://www.voxmediaevents.com/thevergelive/thevergetwitter?ref=thenexusofprivacy.net) on voxmediaevents.com Twenty-five years after it was signed into law, Section 230 is more endangered than ever. Republicans blame it for censorship, Democrats blame it for misinformation, and nearly everyone thinks it needs reform. But if policymakers aren’t smart about structuring reform, there could be broad, unantici… #### [Los Altos Hills council set to test license plate surveillance](https://www.losaltosonline.com/news/sections/news/200-police-fire/63992-los-altos-hills-council-set-to-test-license-plate-surveillance?ref=thenexusofprivacy.net) By Megan V. Winslow on Los Altos Town Crier (losaltosonline.com) “We need to do it, and we need to do it now,” Councilmember Stanley Q. Mok said. “I don’t feel completely safe in my town, and I want to feel completely safe.”Mok told his colleagues he is “mortified” by the number of burglaries committed in recent months; burglars breached eight L #### [Covid-19 and Data Breach Litigation: An Interview of Daniel Raymond](https://www.linkedin.com/pulse/covid-19-data-breach-litigation-interview-daniel-raymond-solove/?ref=thenexusofprivacy.net) By Follow on linkedin.com The global pandemic has affected everything. COVID-19 is not just grinding trials to a halt and foreclosing live, in-person judicial proceedings, it has changed the class action litigation landscape, including data breach class actions. ### JEDII Tech News: February 27 URL: https://thenexusofprivacy.net/newsletter-february-27/ Last updated: 2021-02-27T19:56:17.000Z *A roundup of links from around the web ...* #### [How One State Managed to Actually Write Rules on Facial Recognition](https://nytimes.com/2021/02/27/technology/Massachusetts-facial-recognition-rules.html?ref=thenexusofprivacy.net) By Kashmir Hill on NYTimes (nytimes.com) Massachusetts is one of the first states to put legislative guardrails around the use of facial recognition technology in criminal investigations. #### [India Targets Climate Activists With the Help of Big Tech](https://theintercept.com/2021/02/27/india-climate-activists-twitter-google-facebook/?ref=thenexusofprivacy.net) By Naomi Klein on The Intercept (theintercept.com) Tech giants like Google and Facebook appear to be aiding and abetting a vicious government campaign against Indian climate activists. #### [How safe is Clubhouse?](https://www.wired.co.uk/article/clubhouse-app-privacy-security?ref=thenexusofprivacy.net) By Kate O’Flaherty on WIRED UK (wired.co.uk) Despite its boom in popularity, the Clubhouse app has been found lacking in some basic privacy and security protections #### [How Anduril and other startups are building military ready, self-piloted drones, away from Silicon Valley, where such projects have become politically untenable](https://www.techmeme.com/210227/p3?ref=thenexusofprivacy.net) on Techmeme (techmeme.com) By Cade Metz / New York Times. View the full context on Techmeme. #### [Our First Year: Auditing Algorithms](https://www.getrevue.co/profile/themarkup/issues/our-first-year-auditing-algorithms-376252?ref=thenexusofprivacy.net) on Revue (getrevue.co) Dispatches from Editor-in-Chief Julia Angwin #### [These 7 Black Women Are the Unsung Heroes of the COVID Pandemic](https://www.health.com/mind-body/health-diversity-inclusion/these-7-black-women-are-the-unsung-heroes-of-the-covid-pandemic?ref=thenexusofprivacy.net) By Patrice Peck on Health.com (health.com) In the health care and medical spaces critical to curbing COVID-19, seven Black women are playing both offense and defense against a crisis—stabilizing the same ground on which they blaze new trails. #### [Bias, disrespect, and demotions: Black employees say Amazon has a race problem](https://www.vox.com/recode/2021/2/26/22297554/bias-disrespect-and-demotions-black-employees-say-amazon-has-a-race-problem?utm%5Fsource=twitter&utm%5Fcampaign=vox.social&utm%5Fcontent=recode&utm%5Fmedium=social) By Jason Del Rey on Vox (vox.com) Interviews with diversity managers and internal data obtained by Recode find that Black Amazon employees are promoted less frequently and are rated more harshly than non-Black peers. #### [The Dolly Moment](https://tressie.substack.com/p/the-dolly-moment?r=ewry&utm%5Fcampaign=post&utm%5Fmedium=web&utm%5Fsource=copy) By Tressie McMillan Cottom on essaying (tressie.substack.com) Why We Stan A Post-Racism Queen. A new essay on my new project, essaying. Live now. If you are an OG tressiemc.com subscriber - you got this delivered to your inbox along with a free Substack subscription as a thank you. #### [AI Ethics Non-Profit Ecosystem: Where are the Black Folks?](https://miad.medium.com/ai-ethics-non-profit-ecosystem-where-are-the-black-folks-effc51bd61b5?source=social.tw) By Mia Dand on Medium (miad.medium.com) When Ian Moura and I first started compiling a list of non-profits in the space of AI Ethics, our intent was to map the ecosystem to… #### [Introducing #NoMoreDataWeapons](https://blog.d4bl.org/introducing-nomoredataweapons/?ref=thenexusofprivacy.net) By Jamelle Watson-Daniels on Data for Black Lives Blog (blog.d4bl.org) Data for Black Lives is launching #NoMoreDataWeapons. No more investing in Data Weapons, No more building new Data Weapons, No more disguising Data Weapons as legitimate and neutral. #### [Virginia’s Weak Privacy Bill Is Just What Big Tech Wants](https://www.eff.org/deeplinks/2021/02/virginias-weak-privacy-bill-just-what-big-tech-wants?ref=thenexusofprivacy.net) By Hayley Tsukayama on Electronic Frontier Foundation (eff.org) Virginia’s legislature has passed a bill meant to protect consumer privacy—but the bill, called the Virginia Consumer Data Protection Act, really protects the interests of business far more than the interests of everyday consumers.Take ActionVirginia: Speak Up for Real PrivacyThe bill, which both... #### [Zoom Pledges Provide Closed Captioning For All Free Users — A Win For Hearing Health Advocates](https://www.wbur.org/hereandnow/2021/02/26/zoom-free-closed-captioning?ref=thenexusofprivacy.net) By Peter O’Dowd and and Jeannette Jones on WBUR (wbur.org) Hearing health advocate Shari Eberts talks about her fight to make the service accessible to all. ### JEDII Tech News: February 26 URL: https://thenexusofprivacy.net/newsletter-february-26/ Last updated: 2021-11-14T20:27:31.000Z *Update, November 2021: most of the semi-regular "tech news roundups" I did in early 2021 are now hidden. This top story on this one, though, relates to the the Washington privacy battle so I decided to leave it up.* #### [‘This is bigger than just Timnit’: How Google tried to silence a critic and ignited a movement](https://www.fastcompany.com/90608471/timnit-gebru-google-ai-ethics-equitable-tech-movement?ref=thenexusofprivacy.net) By Katharine Schwab on Fast Company (fastcompany.com) Big Tech has used its power to control the field of AI ethics and avoid accountability. Now, the ouster of Timnit Gebru is putting the movement for equitable tech in the spotlight. #### [ICE investigators used a private utility database covering millions to pursue immigration violations](https://www.washingtonpost.com/technology/2021/02/26/ice-private-utility-data/?ref=thenexusofprivacy.net) By Drew Harwell on The Washington Post (washingtonpost.com) ICE’s use of the vast database offers another example of how government agencies have targeted commercial sources to access information they are not authorized to compile on their own. One researcher called it “a massive betrayal of people’s trust”: “When you sign up for electricity, you don’t expec… #### [New York Times Columnist David Brooks Wrote A Blog Post For Facebook’s Corporate Website](https://www.buzzfeednews.com/article/craigsilverman/nyt-david-brooks-blogs-for-facebook?ref=thenexusofprivacy.net) By Craig Silverman on BuzzFeed News (buzzfeednews.com) Brooks also appeared in a Facebook-produced video panel used to promote an NYU study of Facebook Groups funded by the social media giant. #### [Bias, disrespect, and demotions: Black employees say Amazon has a race problem](https://www.vox.com/recode/2021/2/26/22297554/bias-disrespect-and-demotions-black-employees-say-amazon-has-a-race-problem?utm%5Fsource=twitter&utm%5Fcampaign=vox.social&utm%5Fcontent=recode&utm%5Fmedium=social) By Jason Del Rey on Vox (vox.com) Interviews with diversity managers and internal data obtained by Recode find that Black Amazon employees are promoted less frequently and are rated more harshly than non-Black peers. #### [Schools Are Abandoning Invasive Proctoring Software After Student Backlash](https://www.vice.com/en/article/7k9ag4/schools-are-abandoning-invasive-proctoring-software-after-student-backlash?ref=thenexusofprivacy.net) on vice.com Proctorio has cashed in on remote learning since the start of the pandemic. Now, some schools are abandoning the company’s controversial software. #### [What is an “algorithm”? It depends whom you ask](https://www.technologyreview.com/2021/02/26/1020007/what-is-an-algorithm?ref=thenexusofprivacy.net) By Kristian Lum on MIT Technology Review (technologyreview.com) For better accountability, we should shift the focus from the design of these systems to their impact. #### [The Best Law You’ve Never Heard Of](https://nytimes.com/2021/02/23/technology/the-best-law-youve-never-heard-of.html?ref=thenexusofprivacy.net) By Shira Ovide on NYTimes (nytimes.com) Taking back control of our personal data can feel like a lost cause. But there’s hope! #### [Covid Vaccine Websites Violate Disability Laws, Create Inequity for the Blind](https://khn.org/news/article/covid-vaccine-websites-violate-disability-laws-create-inequity-for-the-blind/?ref=thenexusofprivacy.net) By Lauren Weber, Hannah Recht on Kaiser Health News (khn.org) A KHN investigation found covid vaccine registration and information websites at the federal, state and local levels are flouting disability rights laws and limiting the ability of people who are b… #### [Stars, influencers get paid to boost Duterte propaganda, fake news](https://www.rappler.com/newsbreak/investigative/celebrities-influencers-get-paid-to-boost-duterte-propaganda-fake-news?ref=thenexusofprivacy.net) By Camille Elemia on Rappler (rappler.com) Internal documents from Twinmark Media Enterprises, the agency banned by Facebook for coordinated fake behavior, show how the power of celebrities is used for money and disinformation #### [2020 Ranking Digital Rights Corporate Accountability Index](https://rankingdigitalrights.org/index2020/?ref=thenexusofprivacy.net) on Ranking Digital Rights (rankingdigitalrights.org) A comprehensive ranking of top tech and telecom companies’ disclosed policies and practices affecting people’s rights to freedom of expression and privacy. #### [Michael Tubbs on disinformation, racism, and news deserts](https://www.cjr.org/special%5Freport/michael-tubbs-disinformation-racism-news-deserts-stockton-california-209-times.php?ref=thenexusofprivacy.net) By Akintunde Ahmad on Columbia Journalism Review (cjr.org) In 2017, Michael Tubbs made history as the youngest and first Black mayor of Stockton, California, home to some three hundred thousand people and considered the most diverse city in America. A graduate of Stanford University, Tubbs began his political career on the city council of Stockton, his h… #### [CITP Seminar: Woodrow Hartzog - A Duty of Loyalty for Privacy Law](https://citp.princeton.edu/event/hartzog-2?ref=thenexusofprivacy.net) on Center for Information Technology Policy (citp.princeton.edu) Data privacy law fails to stop companies from engaging in self-serving, opportunistic behavior at the expense of those who trust them with their data. Academics and policymakers have recently proposed a possible ... #### [The End Of Student Privacy? Remote Proctoring’s Invasiveness and Bias](https://mobilizon.fr/events/d15b1b04-deb7-4ffe-a788-b2683ce12a93?ref=thenexusofprivacy.net) on Mobilizon (mobilizon.fr) On Saturday, March 6th, from 1:00 – 4:30 pm ET, please join the Surveillance Technology Oversight Project (S.T.O.P.) and Privacy Lab (an initiative of the Information Society Project at Yale Law School… ### Going beyond 'The Social Dilemma': what you can do (and what they didn't discuss) URL: https://thenexusofprivacy.net/the-social-dilemma-followon/ Last updated: 2021-02-22T04:30:02.000Z ![The social dilemma promo image, with the Netflix logo in the top left, and a phone with an image of a skull on it and several red notification bubbles on the right](https://thenexusofprivacy.net/content/images/2021/02/the-social-dilemma.jpg) Meaningful Movies Everett watched [The Social Dilemma](https://www.thesocialdilemma.com/?ref=thenexusofprivacy.net)over the weekend, and I was asked to speak briefly afterwards. The movie makes an important point: *you* are the product that Facebook, Google and other big tech companies manipulate and exploit as part of their "surveillance capitalism" business model. That said, as reviews like [Flamethrowers and Fire Extinguishers](https://librarianshipwreck.wordpress.com/2020/09/17/flamethrowers-and-fire-extinguishers-a-review-of-the-social-dilemma/?ref=thenexusofprivacy.net) point out, there's also a lot the movie doesn't discuss. So of course that's what I talked about! It was a great discussion, and several other good topics came up as well, so I volunteered to do a follow-up post with more information and links. ## Things you can do on an individual level Another good point The Social Dilemma made is that there are things you can do as an individual to reduce the harm these exploitative companies do. It's important to highligh that this by itself isn't enough to change the systemic dynamics; still, it helps protect you, your friends, and your family. There are some good suggestions in the movie, and even more powerful – and fairly straightforward – things you can do. Here's a short list: - Be intentional about how you're using the software. As somebody said in The Social Dilemma, "you vote with your clicks." Think about what you're liking, resharing, watching, and discussing. Ignore recommended videos (which on YouTube and Facebook often suggest misogynist, racist, anti-LGBTQ, and/or conspiracy videos). Later in this article I'll briefly discuss how similar approaches can also help with disinformation. - Cut down the addictiveness by turning off notifications, and learning habits that work for you – for example, keep your phone out of your bedroom, carving out surfing-free times, and limiting your time online. - As parents, help your children learn critical media literacy skills. At the same time, be aware that there's a lot you can learn from them as well! - Use less-invasive alterantives to surveillance capitalism companies. Signal is great (instead WhatsApp or Messenger) for 1-1 and small group conversation. For search, I'm a fan of [Duck Duck Go](https://duckduckgo.com/?ref=thenexusofprivacy.net) as an alternative to Google; Restore Privacy has a long list of [alternatives to other Google products](https://restoreprivacy.com/google-alternatives/?ref=thenexusofprivacy.net). Avoid apps when possible – apps frequently have much more invasive tracking and can introduce malware risks. Web interfaces are generally less intrusive, albeit less convenient. - Use ad-blockers and other privacy-protective techonlogies on your computer. I use Ad Blocker Ultimate and EFF's Privacy Badger; there are other good choices as well. One of the inherent tensions that came up in several questions is the dilemma that especially during the pandemic we're very often connected to friends and family primarily through social networks that are owned by surveillance capitalism companies. It'd be great if everybody ditched Facebook (etc) for a good free privacy-friendly alternatives but meanwhile back in the reality of early 2021, for many people Facebook, WhatsApp, Gmail, and so on are the best way to keep important friendships, connections, and relationships alive. The balance is different for different people, and there often aren't any easy answers here. The key is to think about the choices your making, and look for ways to reduce your exposure to harmful stuff. ## Washington state privacy legislation One of the things The Social Dilemma didn't discuss is the potential role of legislative solutions in establishing accountability for the harms of surveillance capitalism (and interfering with its exploitative business models). Washington state is on the front lines of this battle, with a pair of privacy bills in front of the state legislature. The People's Privacy Act (HB 1433) has been developed working with civil rights and community groups, and offers strong protections ... but unfortunately hasn't even gotten a hearing yet. Meanwhile, [SB 5062, also known as the Bad Washington Privacy Act](https://consumerfed.org/we-need-real-privacy-protection-in-the-states-not-the-washington-privacy-acts-illusion-of-privacy/?ref=thenexusofprivacy.net), got sharp criticism from civil rights groups and community members in its hearings, but praise from Microsoft, Google, Amazon, and industry associations so has sailed through committees and is headed towards a Senate floor vote. Even though the Bad Washington Privacy Act's protections love to talk bout how "strong" its protections supposedly are, it's an illusion. Susan Grant of Consumer Federation of America has a great discussion of this in [We Need Real Privacy Protection in the States, not the Washington Privacy Act’s Illusion of Privacy](https://consumerfed.org/we-need-real-privacy-protection-in-the-states-not-the-washington-privacy-acts-illusion-of-privacy/?ref=thenexusofprivacy.net), and I also look at in some detail in [The illusion of protection and SB 5062 (the Bad Washington Privacy Act)](https://thenexusofprivacy.net/the-illusion-of-protection/) with some very groovy optical illusions if you are into that kind of thing. So one very valuable thing you can do is tell your legislator that you want stronger protections. Here are three things you can do right now: - [Tell representatives to protect your privacy](https://cairwa.salsalabs.org/opposesb5062/index.html?ref=thenexusofprivacy.net), from CAIR Washington and ACLU of Washington, sends your legislators mail discussing the problems of SB 5062. - The [People's Privacy Act Letter to the Editor Kit](https://aclu-wa.org/docs/peoples-privacy-act-letter-editor-toolkit?ref=thenexusofprivacy.net) on the ACLU of Washington's site has great sugestions about how to construct a letter to the editor as well as a link to the list of submission links for [90+ news sites and blogs around the state](https://aclu-wa.org/pages/letter-editor-resources?ref=thenexusofprivacy.net). - [Tell your Senators that you want privacy legislation to protect against Facebook and Google](https://www.takeaction.network/xactions/14035?ref=47) is an action item from Indivisible Plus Washington that focuses specifically on two of the companies discussed in The Social Dilemma. ## Disinformation Shireen Mitchell’s [*All of us have been targeted by disinformation*](https://vimeo.com/471961897?ref=thenexusofprivacy.net) The movie only mentions disinformation briefly, but it's an important enough topic that I wanted to provide some resources on this front as well. Indivsible Plus Washington did several disinformation workshops last fall with Shireen Mitchell of Stop Online Violence Against Women. The two-minute video above is a quick introduction; there's also a longer training course on [Responding to Disinformation and Digital Voter Suppression](https://indipluswa.medium.com/how-to-respond-to-disinformation-and-digital-voter-suppression-training-with-shireen-mitchell-1e8ee95695f8?ref=thenexusofprivacy.net). There are a lot of other great disinformation resources out there as well, including PEN America's [How to Talk to Friends and Family Who Share Misinformation](https://pen.org/how-to-talk-to-friends-and-family-who-share-misinformation/?ref=thenexusofprivacy.net), Jen Soriano’s [Disinformation is like a virus](https://twitter.com/KairosFellows/status/1321200981120528385?ref=thenexusofprivacy.net), and [ReFrame's infographics](https://twitter.com/ReFrameMentor/status/1320825419180851200?ref=thenexusofprivacy.net). In terms of pressuring companies like Facebook and Google to do better on disinformation, there are several important active campaigns. Two examples: - The [Real Facebook Advisory Board](https://the-citizens.com/real-facebook-oversight/?ref=thenexusofprivacy.net) includes Shireen Mitchell, Safiya Noble (author of *Algorithms of Oppression*), Ruha Benjamin (*Race after Technology* and *The New Jim Code*), Jessica J. González of Free Press, Maria Ressa of Rappler and more as well as Roger McNamee, Tristan Harris, and Shoshanna Zuboff (all of whom prominently in the Social Dilemma) - [Stop Hate for Profit](https://www.stophateforprofit.org/faq?ref=thenexusofprivacy.net) is a diverse and growing coalition that wants social media companies to take common-sense steps to address the rampant racism, disinformation and hate on its platform, and includes ADL, Color of Change, Common Sense, Free Press, LULAC, Mozilla, NAACP, National Hispanic Media Center, and Sleeping Giants. ![Image: somebody typing the words "OMG DID YOU SEE THIS". Text: How to not amplify disinfo. Don't feed the algorithm. When you see something that makes you mad: 1. DON’T repost on social media 2. DON’T comment trying to outsmart them, this attracts more attention to the post 3. ONLY IF the post is already popular, DO comment with vetted debugging info. 4. DO take a screenshot if you must share, and share only through email, messenger, etc. 5. DO educate your community to exercise the same discipline. Reframe.](https://cdn-images-1.medium.com/max/1600/0*0k7UfBkrnGc857ht.png) ReFrame’s infographics on [How to NOT amplify disinfo](https://twitter.com/ReFrameMentor/status/1320825419180851200?ref=thenexusofprivacy.net) ## What didn't get discussed in The Social Dilemma – and a short reading list Before wrapping up I want to return to the topic of some things besides legislative solutions that *didn't* get discussed much in The Social Dilemma. For example: - Recognition of the the people and organizations who have been talking about these abuses for years. The people the movie actually focused on spent their careers (and made a lot of money) not listening to warnings about what they were doing ... now that they're finally waking up, they're still saying "how could we have known?" and ignoring the folks who were right all along. - Facebook’s track record of civil rights violations in the US -- or really anything about race and gender. How many Black, Latinx, or Indigenous people did you see in the movie? How much discussion of Facebook and Google's history of sexism, racism, and misogynoir was there? - Tech companies well-documented history of lies and lawbreaking. Washington state offers a great case study of this: [Facebook and Google have been breaking Washington state law on election advertising](https://www.thestranger.com/slog/2019/10/07/41613131/charges-filed-against-facebook-over-washington-state-election-ads?ref=thenexusofprivacy.net) since 2018\. The AG sued, they settled and promised to stop ... and they've kept doing it. - Facebook's role in [genocides](https://www.ohchr.org/Documents/HRBodies/HRCouncil/FFM-Myanmar/A%5FHRC%5F39%5FCRP.2.pdf?ref=thenexusofprivacy.net), [anti-Muslim riots](https://www.aljazeera.com/news/2020/5/13/sri-lanka-facebook-apologises-for-role-in-2018-anti-muslim-riots?ref=thenexusofprivacy.net) and authoritarian governments taking power in countries like Brazil, the Phillipines, and India. - Anything about solutions. So while there were certainly some valid points in The Social Dilemma, it also reflects a lot of the problems of the underlying tech culture. It's good that some of the people got rich by creating these problems are starting to feel bad about it, and they have some useful things to say. Still, instead of looking to them for a real critique of the systems (that made them rich) – or for solutions (that might reduce their influence) – it's far better to turn to people with a deeper understanding. Here's a short reading list to find out more: - [Flamethrowers and Fire Extinguishers](https://librarianshipwreck.wordpress.com/2020/09/17/flamethrowers-and-fire-extinguishers-a-review-of-the-social-dilemma/?ref=thenexusofprivacy.net), on *Librarian Shipwreck* is an extended review of The Social Dilemma, going into more detail on the omissions I briefly discussed here. - [The Prodigal Techbro](https://conversationalist.org/2020/03/05/the-prodigal-techbro/?ref=thenexusofprivacy.net), by Maria Farrell, looks at tech executives who "experience a sort of religious awakening" and become critics. As Ms. Farrell says, "The prodigal tech bro doesn’t want structural change. He is reassurance, not revolution. He’s invested in the status quo, if we can only restore the founders’ purity of intent. Sure, we got some things wrong, he says, but that’s because we were over-optimistic / moved too fast / have a growth mindset." - [Antisocial Media: How Facebook Disconnects Us and Undermines Democracy](https://global.oup.com/academic/product/antisocial-media-9780190841164?cc=us&lang=en&&ref=thenexusofprivacy.net), by Siva Vaidhyanathan, is an excellent book-length exploration of Facebook's problems by somebody who's studied the tech and media industries for years. - [Race After Technology](https://www.ruhabenjamin.com/race-after-technology?ref=thenexusofprivacy.net), by Ruha Benjamin, looks at how technology reinforces and magnifies racial hierarchies in our society. ### Automated Decision Systems regulation advances, but no hearing yet on the People's Privacy Act: Washington state legislation update URL: https://thenexusofprivacy.net/automated-decision-systems-regulation-sb5116-advances-but-no-hearing-yet-for-the-peoples-privacy-act/ Last updated: 2021-02-09T18:49:08.000Z ![Tech E](https://thenexusofprivacy.net/content/images/2021/01/tech-equity-coalition-1.png) It's been a busy few weeks in the Washington state legislature! But before we get to the update, here are three actions you can take right now if you're a if you're a Washingtonian who wants to protect our privacy. - [Pass The People’s Privacy Act](https://signon-acluofwashington.nationbuilder.com/peoplesprivacyact?ref=thenexusofprivacy.net) - [Ask Ways & Means to add a private right of action to SB 5062](https://www.takeaction.network/xactions/13810?ref=47) - [Stop SB 5062 (the weak, corporate-friendly Washington Privacy Act)](https://bit.ly/RealPrivacy4WA?ref=thenexusofprivacy.net) [The People’s Privacy Act, not the Washington Privacy Act, is the better bill to protect consumers’ civil rights and civil liberties](https://www.seattletimes.com/opinion/con-the-peoples-privacy-act-not-the-washington-privacy-act-is-the-better-bill-to-protect-consumers-civil-rights-and-civil-liberties?ref=thenexusofprivacy.net), a *Seattle Times* op-ed by Jennifer Lee of ACLU of Washington, is a great short summary of the differences between the two privay bills. [The People’s Privacy Act: How you can help protect Washingtonians’ privacy](https://indipluswa.medium.com/the-peoples-privacy-act-how-you-can-help-protect-washingtonians-privacy-bf3f78338e5?ref=thenexusofprivacy.net) , on the Indivisible Plus Washington blog, has a lot more information for activists, including the video and slides from a webinar Jennifer and ACLU of Washington organizer Savannah Sly did with Indi+ and Washington Indivisible Network. And now, on to the update! ## Automated Decision Systems regulation advances! Let's start with some very good news is that the Senate State Government and Elections committee gave a "do pass" recommendation to SB 5116 (Accountability and Transparency Standards for Automated Decision Systems). As I discussed in [A good hearing on Automated Decision Systems](https://thenexusofprivacy.net/a-good-hearing-on-automated-decision-systems-sb5116/), there's a lot of support for this groundbreaking legislation. Since the hearing, state and local government agencies have been working with the bill's sponsor to resolve some very valid concerns. During the executive session, Sen. Hasegawa suggested that another amendment was on its way that would get it into final form. So far, it's all very encouraging! Next step for SB 5116: the Senate Ways & Means Committee, which looks at the bill's fiscal impact. ## Hot Ways & Means Action on SB 5062 And speaking of Ways & Means, [SB 5062 (the Bad Washington Privacy Act) had a hearing there on Monday](https://www.tvw.org/watch/?clientID=9375922947&eventID=2021021190&ref=thenexusofprivacy.net). Tech Equity Coalition members and others had some sharp criticisms of the weak, industry-backed bill's paltry enforcement budget – $1.4 million over the next two years, only enough for 3.6 full-time equivalent (FTE) employees. The Attorney General's Office (AGO) projects that they'll be bringing 3 investigations per year. Good luck to the 1.2 FTEs taking on Facebook or Google! As I pointed out in [my testimony](https://docs.google.com/document/d/1EsLcslojmWLC0avrbBILmJ3odYZ7bS9c1zMif4znrsQ/edit?ref=thenexusofprivacy.net#https://jedii.tech/sb-5026-testimony-for-the-ways-means-hearing-fe/), Ireland has a population smaller than Washington, and it's Data Protection Commission's budget is $23 million per year. Jennifer Lee noted that even with their much larger budgets, [European data protection enforcement has been held back by lack of resources](https://www.euractiv.com/section/data-protection/news/gdpr-enforcement-held-back-by-lack-of-resources-report-says/?ref=thenexusofprivacy.net). Joseph Jerome noted that Facebook has 150 privacy lawyers, and that large companies average 15\. Given the budget pressures here due to the pandemic, there's no way they'll budget anywhere near that much ... so we didn't even ask for that. Instead, we focused on adding a private right of action, as the AGO has repeatedly requested. I thought we made a strong case, but then again Ryan Harkins of Microsoft praised the bill's "robust" enforcement. So we'll see what happens. Here's the [video](https://www.tvw.org/watch/?clientID=9375922947&eventID=2021021190&ref=thenexusofprivacy.net). (My testimony's at 23:15\. The Chair said she appreciated that I focused on fiscal issues ... I feel like I got an A on a presentation!) I also [live-tweeted](https://twitter.com/jdp23/status/1358927919205085186?ref=thenexusofprivacy.net) it, and [Joseph Jerome has some reflections on the hearing here](https://twitter.com/joejerome/status/1358940392499138561?ref=thenexusofprivacy.net). And whenever I hear "Ways & Means" I think of the Concrete Blonde song Bloodletting. So here's the video. We got a lot to think about ... oh yeah. ## No hearing for SB 5104 (the Facial Recognition Moratorium) The news is not so good with the Facial Recognition Moratorium. Senate Energy, Environment, and Technology (ENET) Committee Chair Sen. Carlyle decided not to give a hearing to the bill. Last year, there was a lot of support for a moratorium, but the legislature wound up passing a compromise bill written by Sen. Joseph Nguyen of Microsoft. Since then, Microsoft and Amazon have both announced voluntary partial moratoriums on facial recognition, the Seattle Police Department has been caught secretly using Clearview AI, cities including Portland, Boston, and New Orleans have passed moratoriums and bans, and there have been several more reports of facial recognition systems leading to Black people getting arrested for crimes they didn't commit. But as I predicted in my testimony last year, once a weak bill is passed, it becomes a lot harder to pass a strong bill. My guess is that Sen. Carlyle and Sen. Nguyen convinced their colleagues on the committee that since the legislature had just acted last year, passing legislation that Microsoft described as "robust", they didn't need to do anything. Facial recognition is an automated decision system, so SB 5116 will provide some regulation – although not a complete moratorium. ## The People's Privacy Act must be heard! The People's Privacy Act, HB 1433, also has some limitations on facial recognition. It's got a lot of other good stuff too. Here's Jennifer Lee's quick summary: > The People’s Privacy Act is founded on the assumption that everyone’s privacy should be protected by default and that people’s data should not be used without their affirmative, opt-in consent. It gives people the right to know what data companies have about them and the right to correct and delete their information. It prohibits companies from using, selling or sharing data without people meaningfully given consent, which is the true gold standard for privacy. > > HB 1433 also makes it unlawful for companies and government agencies to use people’s personal information to discriminate and bans use or installation of facial recognition technology or equipment incorporating artificial intelligence-enabled profiling in any place of public accommodation (like restaurants, hotels, theaters, pharmacies, parks, schools and stores). The People’s Privacy Act ensures local jurisdictions can advance stronger privacy laws if they wish, protecting community voices. Finally, it provides meaningful enforcement through a private right of action that empowers people to take companies to court for privacy violations. Rep. Shelley Kloba is sponsoring the Peoples Privacy Act, which was created by ACLU of Washington with input and support from the [Tech Equity Coalition](https://www.aclu-wa.org/pages/tech-equity-coalition?ref=thenexusofprivacy.net), a group of civil liberties and civil rights-focused organizations and individuals working to lift up the voices of historically marginalized and disproportionately surveilled communities in decisions about technology. Alas, the People's Privacy Act hasn't been scheduled for a hearing yet either. Dozens of groups around the state signed on to the Tech Equity Coalition's letter asking for the bill to get heard. Indivisible Plus Washington sent a letter to House Civil Rights & Judiciary (CR&J) Chair Rep. Drew Hansen and the rest of the committee requesting a hearing. But with the "policy cutoff" deadline on February 15, it looks like CR&J is going to punt for now and instead wait for the Senate to send over the Bad Washington Privacy Act as a starting point. It's disappointing, although not particularly surprising, because this is the same strategy that didn't work the last couple of years. Activism is hard. No worries, though. As we discussed at [The People’s Privacy Act: How you can help protect Washingtonians’ privacy](https://indipluswa.medium.com/the-peoples-privacy-act-how-you-can-help-protect-washingtonians-privacy-bf3f78338e5?ref=thenexusofprivacy.net), we've got an activism plan B and plan C as well! ## Take action! If you've made it all the way to the bottom of this post, you probably care a lot about privacy! So if you're a Washingtonian who wants to support the People's Privacy Act and oppose the Bad Washington Privacy Act, here's three things you can do today! - [Pass The People’s Privacy Act](https://signon-acluofwashington.nationbuilder.com/peoplesprivacyact?ref=thenexusofprivacy.net) - [Ask Ways & Means to add a private right of action to SB 5062](https://www.takeaction.network/xactions/13810?ref=47) - [Stop SB 5062 (the weak, corporate-friendly Washington Privacy Act)](https://bit.ly/RealPrivacy4WA?ref=thenexusofprivacy.net) ### SB 5026 Testimony for the Ways & Means Hearing URL: https://thenexusofprivacy.net/sb-5026-testimony-for-the-ways-means-hearing-fe/ Last updated: 2021-02-09T05:05:27.000Z *I testified at* [*the February 8 House Ways & Means hearing on SB 5062*](https://www.tvw.org/watch/?clientID=9375922947&eventID=2021021190&ref=thenexusofprivacy.net)*. So did quite a few other people, so we only had a minute each!* [*The video is available on TVW*](https://www.tvw.org/watch/?clientID=9375922947&eventID=2021021190&ref=thenexusofprivacy.net)*; SB 5062 was the first bill discussed in the session, and my testimony starts at 23:15\.* *Here's an expanded version of what I said, which I'm also submitting as written testimony.* Madame Chair, Madame Ranking Member, and members of the committee, Thank you once again for the opportunity to speak at today’s hearing on SB 5062\. In my written testimony, I’d like to expand on the points I made. I’m Jon Pincus from Bellevue, a technologist and entrepreneur, and former General Manager of Strategy Development at Microsoft. I continue to OPPOSE SB 5062 as currently written. My [testimony at the January 14 ENET hearing](https://thenexusofprivacy.net/criticism-and-praise-for-at-the-hearing-for-sb-5062-the-bad-washington-privacy-act/) and followup letter to the committee, and lengthy discussion in [The Illusion of Protection](https://thenexusofprivacy.net/the-illusion-of-protection/) cover a wide variety of issues. My comments here focus on the fiscal aspects, where Ways & Means has an opportunity to improve the legislation. SB 5062’s current [fiscal note](https://fnspublic.ofm.wa.gov/FNSPublicSearch/GetPDF?packageID=61662&ref=thenexusofprivacy.net) fails to allocate sufficient resources for enforcement. Section 111 of the bill gives the Attorney General’s Office (AGO) sole enforcement authority -- but the paltry $1.4 million budget for the next two years is only enough for 3.6 full-time equivalent employees (FTEs) and three investigations per year. Allocations then **decrease** in future years. Contrast this with Ireland, whose data protection commission has a [$23 million annual budget ](https://www.gdprregister.eu/news/irish-data-protection-commission-budget-2021/?ref=thenexusofprivacy.net) despite having a population smaller than Washington state. The German state of Schleswig-Holstein, half the population of Washington, has a staff of 25 in its data protection office. [Even tiny Luxembourg allocates over $8 million/year](https://brave.com/wp-content/uploads/2020/04/Brave-2020-DPA-Report.pdf?ref=thenexusofprivacy.net). Despite these much larger allocations, [European data protection enforcement has been held back by lack of resources](https://www.euractiv.com/section/data-protection/news/gdpr-enforcement-held-back-by-lack-of-resources-report-says/?ref=thenexusofprivacy.net). As you heard at the hearing, Facebook has 150 privacy lawyers. Just last week, [an EU commission called for the European Commission to sued the Irish DPC for failing to enforce the GDPR](https://twitter.com/clarinette02/status/1358186793213034496?ref=thenexusofprivacy.net). While SB 5062 does reserve any receipts from civil penalties under this act for recovering costs and attorney’s fees, the fiscal note projects this as not generating any cash through 2027. California’s experience is instructive here. [In the only case settled so far under their 2018 CCPA](https://woodruffsawyer.com/cyber-liability/first-ccpa-lawsuit-settled/?ref=thenexusofprivacy.net), the settlement gave $2 to each person who had been harmed, but did not impose any additional civil penalties. California’s newer CPRA allocates an annual budget starting at $10 million / year, which must be increased by the legislature “as may be necessary to carry out the provisions of this title.” \[The CPRA also *removed* the right to cure, a topic several other speakers at the hearing discussed.\] Ways & Means can resolve this fiscal problem by taking the AGO’s suggestion of allowing a private right of action. Some specific changes to consider: - Replace Section 111 with [HB 1433](http://lawfilesext.leg.wa.gov/biennium/2021-22/Pdf/Bills/House%20Bills/1433.pdf?q=20210208204007&ref=thenexusofprivacy.net)’s Section 10 (1) - Remove the word "solely" from Section 112 (1) Otherwise, SB 5062 will require substantial additional investment if we are to have any hope of holding companies who break the law accountable. Thank you all for your continued work on this bill (and all the others on your plate). I firmly believe that we share the same goal of protecting Washingtonians’ privacy, and am looking forward to ongoing discussions as SB 5062 moves forward. ### The illusion of protection and SB 5062 (the Bad Washington Privacy Act) URL: https://thenexusofprivacy.net/the-illusion-of-protection/ Last updated: 2021-03-15T10:07:26.000Z *Last updated: March 11.* ![Arcs giving the appearance of a spiral, but in reality concentric circles on a black, white, and gray background.](https://thenexusofprivacy.net/content/images/2021/02/frasier-spiral-illusion.png) It's not actually a spiral. It's an optical illusion. The weak, industry-backed Bad Washington Privacy Act (SB 5062) has passed the Senate, and is heading on to the House. [SB 5062's January Senate hearing featured plenty of sharp criticism](https://thenexusofprivacy.net/criticism-and-praise-for-at-the-hearing-for-sb-5062-the-bad-washington-privacy-act/), including examples of how it would not help people and communities who are being harmed by data abuse. Civil rights and community groups have given [similar feedback](https://www.aclu-wa.org/pages/tech-equity-coalition?ref=thenexusofprivacy.net) on previous iterations of the bill for years. So have consumer groups; see Consumer Reports' policy analyst Maureen Mahoney's [Washington Privacy Bill needs stronger safeguards for consumers](https://www.seattletimes.com/opinion/washington-privacy-bill-needs-stronger-safeguards-for-consumers/?ref=thenexusofprivacy.net) op-ed and Consumer Federation of America Director of Consumer Protection and Privacy Susan Grant's [We Need Real Privacy Protection in the States, not the Washington Privacy Act’s Illusion of Privacy](https://consumerfed.org/we-need-real-privacy-protection-in-the-states-not-the-washington-privacy-acts-illusion-of-privacy/?ref=thenexusofprivacy.net). The Attorney General's Office has made it clear that they think the bill's enforcement needs to be strengthened. Alas, bill sponsor [Sen. Reuven Carlyle rejects these perspectives](https://www.seattletimes.com/opinion/pro-the-washington-privacy-act-empowers-consumers-to-retake-control-of-their-identity-online-in-our-data-fueled-economy/?commentID=a8ade515-331f-4434-b7bd-acf0b19a8af2&ref=thenexusofprivacy.net), describing them as "ideologically pure politics that present perfect as the enemy of the good." But just how good *is* the Bad Washington Privacy Act? Let's start by looking at some of the weaknesses in SB 5062's current draft. Next, I'll go into a case study of real-world privacy abuse to see how much the Bad Washington Privacy Act would really help; then look briefly at other scenarios. I'll include references to specific sections of the current draft ([2SSB 5062](http://lawfilesext.leg.wa.gov/biennium/2021-22/Pdf/Bills/Senate%20Bills/5062-S2.pdf?q=20210311151855&ref=thenexusofprivacy.net)) for those who want to get deep into the details. An [appendix](https://thenexusofprivacy.net/the-illusion-of-protection/appendix-the-people-s-privacy-act-and-potential-improvements-for-sb-5062) has suggestions for improvements to SB 5062, some of which are straightforward, others more controversial. ## Loopholes and exemptions that neuter protection ![A grid of grey lines and white dots on a black background. Most people also see flashing black dots, which don't actually exist in the image.](https://thenexusofprivacy.net/content/images/2021/02/1280px-Grid_illusion.svg.png) The dots aren't actually flashing. It's an illusion. Let's start with a few of what the Attorney General's Office described as "broad exceptions that would permit industry to sidestep the very consumer rights and obligations created by this bill” in their testimony on last year's bad bill. Susan Grant of Consumer Federation of America was just as blunt in SB 5062's January hearing, citing "loopholes and definitional problems that essentially neuter the protections the bill is supposed to provide." For example: - Section 102 (2), clauses a b c d e f g h i j k l m include loopholes that completely exempt government agencies, student data covered by FERPA or the state user privacy in education rights act, health data covered by HIPAA or other legislation, financial data covered by Gramm-Leach-Bliley, and a whole lot more. Update: amendments have now added airlines to the list, so now there's also a clause n. SB 5062, now with more neutering! - Companies like Google, Facebook, and Amazon also get a big carve-out from SB 5062's rules about using data for targeted advertising. The definitional problem here is Section 101 (33) (a), which excludes advertising "based on activities within a controller's own websites or online applications." - Institutions of higher education have a five-year exemption as well, thanks to Section 403 which covers "non-profits and institutions of higher learning." Washington is justifiably proud of its excellent universities, colleges, and community colleges so I can see the basic idea has a lot of support ... but Section 403 also exempts for-profit colleges that as Tressie McMillan Cottom says "[target and thrive off of inequality](https://www.theatlantic.com/education/archive/2017/02/the-coded-language-of-for-profit-colleges/516810/?ref=thenexusofprivacy.net)." Another potentially-neutering loophole is the "right to cure" in Section 112 (4), which gives corporations 30 days until after the AG gives them a letter to "cure" any alleged violations . [Many companies post inaccurate descriptions of the information they share](https://www.washingtonpost.com/technology/2021/01/29/apple-privacy-nutrition-label/?ref=thenexusofprivacy.net). If they correct it within 30 days of a letter from the AG, is there a violation? What if a company shares location data without opt-in consent, but stops if and when the AG puts them on notice? The current version of SB 5062 is silent on whether these would be considered a cure. And there are also very broad exemptions for cooperating with law enforcement agencies even withot a warrant, subpoena, or court order for either of these two exceptions. Section 110 (c) allows cooperation concerning conduct or activity that "may violate" federal laws or regulations. Section 110 (g) allows coopertaion for preventing, detecting, and investigating those responsible for any illegal activity. Of course, companies holding data should comply with legal processes; but it bears repeating: SB 5062 does not require a warrant, subpoena, or court order for either of these two exceptions. ## The illusion of enforceability ![Four squares, each with a grid of hundreds of small hearts in the background and a large heart in the center. The top left and bottom right squares have yellow backgrounds and small blue hearts; the larger heart int he center looks pink. The top right and bottom left squares have blue backgrounds and small yellow hearts; the larger heart looks orange.](https://thenexusofprivacy.net/content/images/2021/02/fourcolorhearts.jpg) The large hearts are actually the same color in all four boxes. It's an illusion. This year's Bad Washington Privacy Act does have some improvements over [Sen. Carlyle's previous bad privacy bill](https://medium.com/a-change-is-coming/a-bad-day-for-a-bad-privacy-bill-a-good-day-for-privacy-a2aeea8e8739?ref=thenexusofprivacy.net). For example, thanks to what Sen. Carlyle describes as the "[constructive insistence ](https://www.seattletimes.com/opinion/pro-the-washington-privacy-act-empowers-consumers-to-retake-control-of-their-identity-online-in-our-data-fueled-economy/?ref=thenexusofprivacy.net)of the Attorney General" (who repeatedly testified that the 2019 and 2020 bills were unenforceable), a "per se" clause has been added. Then again the AGO has also repeatedly testified that giving them the sole authority to enforce the bill is a bad idea, and that "a Private Right of Action, along with AGO enforcement is the best policy for consumers." Many civil rights and consumer organizations have said similar things. The AGO, civil rights, consumer organizations repeated this in SB 5062's January hearing and in the February Ways & Means hearing. Apparently, though, they haven't been insistent enough to be heard yet. One of the reasons a private right of action is such a big deal is that SB 5062 only allocates a pittance for AGO enforcement. The [fiscal note](https://fnspublic.ofm.wa.gov/FNSPublicSearch/GetPDF?packageID=61662&ref=thenexusofprivacy.net) allocates only $700,000 annually for the next two years enough for 3.6 full-time equivalents (FTEs) employees, and then *decreases* the allocation in future years. The AGO's office projects doing only three investigations per year, which isn't a lot ... and good luck to those 1.2 FTEs taking on Facebook, Amazon, or Google! Ireland, by contrast, budgets $23 million per year – despite having a population smaller than Washington state. Even tiny Luxembourg spends $8 million per year! Despite these much larger allocations, European data protection enforcement has been held back by lack of resources. Just last week, an EU commission called for the European Commission to sued the Irish DPC for failing to enforce the GDPR. Section 113 says that receipts from civil penalties can be used to offset costs ... but the fiscal note projects $0 in receipts from civil penalties through 2027. And keep in mind that [Facebook and Google have been breaking Washington state law on election advertising](https://www.thestranger.com/slog/2019/10/07/41613131/charges-filed-against-facebook-over-washington-state-election-ads?ref=thenexusofprivacy.net) for years without the AGO being able to stop them. Why do we expect AG-only enforcement to be more successful with privacy? [Indivisible Plus Washington asked Sen. Carlyle this on Twitter](https://twitter.com/IndiPlusWA/status/1357511406455713793?ref=thenexusofprivacy.net) but as far as I know he hasn't responded yet. There's a good discussion of the private right of action and right to cure, along with many other topics, in Common Sense's [Privacy Nuts and Bolts: How Washington lawmakers can protect our digital privacy](https://www.youtube.com/watch?v=oecLTPXbCp0&ref=thenexusofprivacy.net), featuring UW's Ryan Calo, Jennifer Lee of ACLU of Washington, Stacey Gray of Future of Privacy Form, and Maureen Mahoney of Consumer Reports Advocacy. ## Would SB 5062 prevent ICE and the military from using information from Muslim prayer apps? During the hearing Brianna Auffray of CAIR Washington said "SB 5062 would allow for continued unconsented data collection and sale that will put Muslim and immigrant communities at serious risk of harm." As Ms. Auffray's use of the word "continued" implies, this kind of data collection and sale is already occurring. Last November, Joseph Cox reported in *Motherboard* that [popular apps including Muslim Pro sold location data to X-Mode and other data brokers](https://www.vice.com/en/article/jgqm5x/us-military-location-data-xmode-locate-x?ref=thenexusofprivacy.net) – who then sold it to contractors who worked for the military. Then, just a few weeks ago, new reporting by Cox identified another set of apps, including the Salaat First prayer time app, that sold location data to Predicio, a different data broker – who then sold it to [a contractor that has a history of working with ICE](https://www.vice.com/en/article/xgz4n3/muslim-app-location-data-salaat-first?ref=thenexusofprivacy.net). When the news about Muslim Pro first broke, Zahra Billoo (a civil rights attorney and executive director of CAIR’s San Francisco Bay Area chapter) described it as feeling like "[a betrayal."](https://www.latimes.com/business/technology/story/2020-11-23/muslim-pro-data-location-sales-military-contractors?ref=thenexusofprivacy.net) Majlis Ash-Shura, a leadership council that represents 90 New York state mosques, sent a notification urging people to delete Muslim Pro, citing “safety and data privacy.” After the Salaat First news, Bay Area attorney Sara Mostafavi said she was ["disturbed, appalled, but not surprised." ](https://abc7news.com/salaat-first-prayer-app-pulled-privacy/9633765/?ref=thenexusofprivacy.net) Hopefully we all agree this is the kind of thing that strong privacy legislation should hold companies accountable for! ![A screen shot of the Salaat First app for prayer times](https://thenexusofprivacy.net/content/images/2021/01/Salaat-First.jpeg) And indeed, SB 5062 has some clauses that seem like they stop this kind of abuse: - For sensitive data, including location (Section 101 (31)), SB 5062 requires opt-in consent before sharing (Section 107 (8)). - Sec. 107 (4) says that a controller can't share data for a different purpose than it was collected without getting additional consent. - Sec. 107 (6) prohibits processing of data on the basis of religion in a way that unlawfully discriminates against the consumer. But when you look more closely the answer isn't so clear at all. First of all, there's the law enforcement exceptions 110 (c) and (g) I mentioned earlier. ICE could well argue that they're investigating illegal activity, or activity activity that "may violate" federal laws or regulations; in which case, companies could share data they've collected for a different purpose. Also SB 5062 exempts government agencies (Section 102 (2) (a)). So if ICE, the military, a fusion center or law enforcement agency acquires the data claiming that it's for another purpose, and then uses it for profiling, there's no accountability. Even if one of the corporations involved has shared data inappropriately, they may not have violated SB 5062\. Remember, Section 112 (4) gives them 30 days (after the AG gives them a letter) to "cure" the violation. So suppose they hadn't asked people to opt-in to sharing location data but did it anyway. If they stop this unauthorized sharing within 30 days of getting a notice from the AG, would that be enough to get them off the hook? That's a good question. In a Twitter thread about an earlier version of this post, [Stacey Gray of Future of Privacy Forum](https://twitter.com/staceygraydc/status/1354121785671880705?ref=thenexusofprivacy.net) suggested that some things can't be cured. But that's not what the bill's text currently says. As for Section 107 (6)'s anti-discrimination clause, all of the data's processed, so it's not “on the basis of” religion. And is the discrimination here actually "unlawful"? So that's not likely to help either. With all these uncertainties, and limited resources, would the AGO even bring a case? If not, then the people harmed by this abuse wouldn't have any way to pursue accountability – there's no private right of action (Section 111). What if city or county governments want to protect their residents? Sorry, they're not allowed to (Section 112 (1)). ## Variations on a theme ![Overlapping disks with a geometric pattern in green, pink, and red](https://thenexusofprivacy.net/content/images/2021/02/rotwagashisnakes.jpg) The disks aren't actually rotating. It's an illusion. After diving deep into this one example it's useful to think briefly about some hypothetical variations. Suppose data broker and contractor, or app writer and data broker, are affilliates? Then SB 5062 doesn't apply (Section 101 (30) (b) (iii)). What about if one those sleazy for-profit colleges decides to "monetize" its Muslim students' data by selling it for a purpose the students didn't consent to? Section 403 applies. At least for the next five years, there's no violation. Or, suppose an app shares sensitive info like location with an airline for targeted marketing and advertising ... and the airline instead uses it to flag Muslim users for extra security checking. [Stacey Gray suggests](https://twitter.com/staceygraydc/status/1354121779518836736?ref=thenexusofprivacy.net) that SB 5062 will help here because only a small percentage of users are likely to opt-in to using their location for targeted advertising and marketing. Frankly, I'm skeptical (most of people I know will opt-in to get targeted marketing like discounts or early access to events they're likely to be interested in) but suppose she's right. It doesn't matter! Airlines are exempt (Section 102 (2) c) so they don't actually have to ask people to opt in! And while this particular case study focuses on Muslims, they're far from the only ones getting harmed today. For example: - [ICE gets data from utility companies without consent](https://www.washingtonpost.com/technology/2021/02/26/ice-private-utility-data/?ref=thenexusofprivacy.net). - During the January hearing, Emilie St. Pierre said that SB 5062's opt-out approach did not protect victims of online harassment, stalking, and identify theft. - Non-binary, genderqueer, gender-nonconforming, and agender people get less proection because the definition of "sensitive data" in section 101 (31) doesn't include gender. The examples in [Harms of Data Abuse](https://www.aclu-wa.org/docs/harms-data-abuse?ref=thenexusofprivacy.net) also includes privacy abuses affecting LGBTAIQ+ dating app users; cell phone users; abortion patients; emergency room patients; Black, Indigenous, and People of Color; transgender and nonbinary individual; migrant children and their families; political protesters; children and teenagers; and menstrual cycle tracking app users. How effective will SB 5062 be at protecting them from similar abuses? Even to the extent it might, just how much impact can the AGO's 3.6 FTEs really have? ## Strong protection ... or just an illusion? ‌ ![An optical illusion, looking somewhat like an eye, where curved lines radiating out from a center black dot appear to be moving](https://thenexusofprivacy.net/content/images/2021/01/optical-illusion-2.jpg) The curved lines aren't actually moving. It's an illusion. Unsurprisingly, SB 5062's supporters think much more highly of the bill's consumer protections than I do. In his op-ed, Sen. Carlyle describes the protections as "unambiguous". During the hearing the Washington Technology Industry Association, the CEO of a Seattle online gaming company, and Microsoft used the words "strong", "very strong", and "strongest" to describe its consumer protections. Tech companies also appreciate that the bill as currently written allows them to "operate with increased predictability" and assert confidently that it will increase consumer trust. What's not to like? In reality, though, the Bad Washington Privacy Act's weaknesses encourages even well-intentioned app vendors and data brokers to share data without worrying much about consequences of violating people privacy. After all, most of the time nobody even notices if data's being shared somewhere people don't expect it to. If and when people do notice, the bill may well have a loophole that covers it – and all you have to do is stop sharing the data and you've quite possibly "cured" the problem! And if not, no worries, the AG's 3.6 FTEs have a lot to do, and you'll probably have them badly outnumbered if they do go after you. And of course some big tech companies, app vendors, and data brokers are ... not always well-intentioned. So when you hear the Bad Washington Privacy Act's supporters talk about SB 5062's "strong consumer protection", take it with a grain of salt. Is it really strong protection... or just an illusion? ![An optical illusion in which a static image appears to be moving](https://thenexusofprivacy.net/content/images/2021/01/optical-illusion.png) The image isn't actually moving. It's an illusion. ## Appendix: the People's Privacy Act and potential improvements for SB 5062 The [People’s Privacy Act](https://www.aclu-wa.org/news/washington-state-rep-shelley-kloba-introduces-new-data-privacy-bill-people%E2%80%99s-privacy-act?ref=thenexusofprivacy.net), community-driven, people-centric alternative to the Bad Washington Privacy Act, takes a radically different approach. The People's Privacy Act gives rights to *people*, not just consumers. It was designed from the ground up in collaboration with the civil liberties and community groups in the Tech Equity Coalition, focusing on protecting people who are harmed by data abuases. It's got a private right of action, and allows city and county attorneys to pursue claims against companies that harm Washingtonians. It would be great if the legislature simply adopted the People's Privacy Act. Rep. Shelley Kloba introduced it into the House as HB 1433, and it has bi-partisan co-sponsorship, but it has not yet gotten a hearing. So another path to strong privacy protection is to improve SB 5062\. Let's face it, history is not encouraging here. In 2019 and 2020, the Senate passed weak, corporate-friendly bill sponsored by Sen. Carlyle. The House listened to privacy advocates and community groups, and passed a significantly stronger version to protect consumers. Negotiations between the chambers [collapsed](https://www.govtech.com/policy/Why-Did-Washington-States-Privacy-Legislation-Collapse.html?ref=thenexusofprivacy.net). Our privacy as Washingtonians remained unprotected. I'm sure I'm not the only person who will be really upset if that happens again. Still, SB 5062 is the bill that's on the table now. So it's worth a try. Fortunately, the years of testimony and feedback from civil rights and consumer groups, and in some cases specific langauge from the People's Privacy Act, highlight quite a few opportunities. Here are some possible improvements. Some of these are very straightforward, others likely to be more controversial. **Give rights to *people*, not just consumers**, for example by reframing Section 103. **Remove loopholes and definitional problems**. For example: - Replace the exemptions for student, financial, health care (the Section 102 (2), clauses a b c d e f g h i j k l m I talked about in my testimony) with language from HB 1433 Section 11 (2) and (3), which basically says this new legislation applies where it provides stronger privacy protections for individuals than existing law and the federal laws do not preempt state laws. Also, I realize airlines just got added, but they could certainly be removed again! - Include sites and apps like Google, Facebook, and Amazon within the definition of targeted advertising by removing Section 101 (33) (a). - Remove the warrantless law enforcement exceptions in Sections 110 (c) and (g). - Remove the right to cure in Section 112 (4), as California did in the recently-passed CPRA. A right to cure drains AGO resources, and creates a perverse incentive for companies to ignore the law until they’re notified that they’re breaking it. - Remove or at least tighten the five-year exemption for non-profits and institutions of higher education in Section 403\. As currently written, this exemption even applies to for-profit colleges, who as Tressie McMillan Cottom says "[target and thrive off of inequality](https://www.theatlantic.com/education/archive/2017/02/the-coded-language-of-for-profit-colleges/516810/?ref=thenexusofprivacy.net)." **Get rid of the confusing mix of opt-out and opt-in** (a classic dark pattern!) and require that companies always get consent before using people's data (Section 107 (8)). Opt-in creates positive incentives for companies -- they need to make it easy for users to understand the benefits and consent. Opt-out, by contrast, gives companies incentives to make it hard for users to withdraw their consent. Opt-out is especially problematic for disabled users (many websites do not work well for people using screenreaders or other assistive technology) and people who prefer languages other than English (most websites and apps only have English-language opt-out pages). **Add a private right of action**, as the AGO and other groups have consistently requested, by removing section 111 and instead explicitly using language similar to the People's Privacy Act Section 10 (1). **Allow city attorneys and county prosecutors to enforce the law** by removing the word "solely" from Section 112 (1) and adding language from People's Privacy Act Section 10 (3). **Allow for stronger local legislation**, by removing the preemption clause (Section 114), and potentially replacing it with the People's Privacy Act Section 11 (1). **Split out the timely and important topic of protecting Covid-19 related data (Parts 2 and 3) into a separate bill**, as several people suggested during the hearing . [New York’s Contact Tracing Privacy Bill: A Promising Model](https://www.brennancenter.org/our-work/analysis-opinion/new-yorks-contact-tracing-privacy-bill-promising-model?ref=thenexusofprivacy.net), from the Brennan Center, discusses this in more detail. That's a lot. Still, politics is the art of the possible. Last year, the House ITED committee strengthed the bad Senate bill substantially, and it was further strengthened on the House floor. This year, its going to the House Civil Rights & Judiciary instead; hopefully, they'll be even more attuned to the civil rights issues. The optimistic scenario is that SB 5062 is strengthened enough in the committee that it becomes the Pretty Good Washington Privacy Act, and then further strengthened on the floor to be the Pretty Good Washington Privacy Act. Of course, tech companies will still be push back hard – and politically, it's a lot easier for legislators to pass a bad bill and claim it's better than it is. So it's hard to know how things will work out. Will we get real privacy protection, the illusion of protection, or once again nothing at all? Time will tell! ## References For more about SB 5062's illusion of protection, see - [The video of the Senate hearing on SB 5062](https://www.tvw.org/watch/?eventID=2021011192&ref=thenexusofprivacy.net). If you only have 10-15 minutes, start watching at 59:50 for Brianna Coffrey of CAIR WA's testimony, Cherie Kiesecker of Parent Coalition on Student Privacy, Emilie St-Pierre of Future Ada, Cynthia Spiess, and Susan Grant of Consumer Federation of America. If you've got a few minutes more, follow up with the segment starting at 27:56 which has a range of perspectives. If you prefer text, I [live-tweeted the hearing](https://twitter.com/jdp23/status/1349782928016826368?ref=thenexusofprivacy.net) and have [a summary here](https://thenexusofprivacy.net/criticism-and-praise-for-at-the-hearing-for-sb-5062-the-bad-washington-privacy-act/) ... but it's really worth watching at least the 10-15 minute video segment! - [The Washington Privacy Act: Not a model for state privacy law](https://ngreggbrown.medium.com/the-washington-privacy-act-not-a-model-for-state-privacy-law-5a484813ab2e?ref=thenexusofprivacy.net) by privacy standards expert (and former Microsoft employee) N. Gregg Brown - [Washington Privacy Bill needs stronger safeguards for consumers](https://www.seattletimes.com/opinion/washington-privacy-bill-needs-stronger-safeguards-for-consumers/?ref=thenexusofprivacy.net), by Maureen Mahoney of Consumer Reports in the Seattle Times. - [We Need Real Privacy Protection in the States, not the Washington Privacy Act’s Illusion of Privacy](https://consumerfed.org/we-need-real-privacy-protection-in-the-states-not-the-washington-privacy-acts-illusion-of-privacy/?ref=thenexusofprivacy.net) by Susan Grant of Consumer Federation of America. - [A bad day for a bad privacy bill, a good day for privacy](https://medium.com/a-change-is-coming/a-bad-day-for-a-bad-privacy-bill-a-good-day-for-privacy-a2aeea8e8739?ref=thenexusofprivacy.net) discusses last year's House hearing on the 2020 version of the Bad Washington Privacy Act (SB 6281), with testimony from Stan Shikuma of the Japanese American Citizen League’s Seattle Chapter, Derek Lum of Interim CDA, Eli Goss of OneAmerica, and others including me. Once again, [it's even better on video](https://www.tvw.org/watch/?eventID=2020021280&ref=thenexusofprivacy.net). - [The People’s Privacy Act, not the Washington Privacy Act, is the better bill to protect consumers’ civil rights and civil liberties](https://www.seattletimes.com/opinion/con-the-peoples-privacy-act-not-the-washington-privacy-act-is-the-better-bill-to-protect-consumers-civil-rights-and-civil-liberties?ref=thenexusofprivacy.net) by Jennifer Lee of ACLU of Washington. --- **Image credits** - [Hearts of Four Colors](http://www.psy.ritsumei.ac.jp/~akitaoka/color12e.html?ref=thenexusofprivacy.net), copyright Akiyoshi Kitaoka. - [Fraser Spiral Illusion](https://en.wikipedia.org/wiki/Fraser%5Fspiral%5Fillusion?ref=thenexusofprivacy.net#/media/File:Fraser%5Fspiral.svg), public domain, via Wikipedia - [Grid Illusion, Herrman or Hering grid](https://en.wikipedia.org/wiki/List%5Fof%5Foptical%5Fillusions?ref=thenexusofprivacy.net#/media/File:Grid%5Fillusion.svg), public domain, via Wikipedia - Salaat First by Faisal Edroos/Middle East Eye, originally in [Another Muslim prayer app found to be tracking users' locations](https://www.middleeasteye.net/news/another-muslim-prayer-app-found-be-tracking-its-users-locations-report?ref=thenexusofprivacy.net) - [Rotating Wagishi Snakes](http://www.psy.ritsumei.ac.jp/~akitaoka/rotsnakes14e.html?ref=thenexusofprivacy.net), copyright Akiyoshi Kitaoka. - [Creating Movement with an unmovable object](https://commons.wikimedia.org/wiki/File:5%5FOptical%5FIllusion.jpg?ref=thenexusofprivacy.net), by SABO123 , licensed under CC-BY-SA3.0, via Wikipedia - [Motion illusion in star arrangement](https://commons.wikimedia.org/wiki/File:Motion%5Fillusion%5Fin%5Fstar%5Farrangement.png?ref=thenexusofprivacy.net), by [Fiestoforo](https://commons.wikimedia.org/wiki/User:Fiestoforo?ref=thenexusofprivacy.net), licensed under CC-BY3.0, via Wikipedia **Edit history:** The initial version of this post, in late January focused primarily on the case study, focusing primarily on targeted advertising and marketing. In early February, in response to some very helpful [feedback from Stacey Gray on Twitter](https://twitter.com/staceygraydc/status/1354121762036977667?ref=thenexusofprivacy.net) (who disagreed with someof the original analysis) as well as several people pointing out that I had skipped some basics, I added the new section on loopholes, and reworked the analysis of the case study. On February 6-7, I added new sections on enforceability and "variations on a theme" ... plus a couple more illusions! And on February 9, I incorporated some of the fiscal analysis from the Ways & Means hearing. In early March, I added a discussion of law enforcement exceptions, included a few ore exaples in the "variations on a theme" section, updated the bill's status, and added the References section. ### A good hearing on Automated Decision Systems, a bad privacy bill advances: Washington state legislation update URL: https://thenexusofprivacy.net/a-good-hearing-on-automated-decision-systems-sb5116/ Last updated: 2021-01-29T22:54:00.000Z ![Tech E](https://thenexusofprivacy.net/content/images/2021/01/tech-equity-coalition-1.png) Last week's[**The stakes are high: Washington state privacy, facial recognition, and automated decision making legislation 2021**](https://thenexusofprivacy.net/wa-privacy-legislation-2021/) discussed several bills backed by the [**Tech Equity Coalition**](https://www.aclu-wa.org/pages/tech-equity-coalition?ref=thenexusofprivacy.net), a group of civil liberties and civil rights-focused organizations and individuals working to hold technology companies accountable – as well as one bill we oppose. The Washington legislative season's in high gear, so this week there are significant updates on two of the bills: - SB 5116, Sen. Bob Hasegawa’s bill regulating government use of automated decision making systems, had a hearing at the State Government and Elections committee featuring a lot of great testimony in support of the legislation. - SB 5062, the Bad Washington Privacy Act, got a “do pass” recommendation from the Senate Environment, Energy, and Technology (EET) committee. Since Sen. Carlyle is the EET chair, this wasn't a particular surprise – even though this there was a lot of very negative feedback about SB 5062 from Tech Equity Coalition members and and others in its hearing last week. Rounding out the list, Rep. Shelley Kloba is expected to introduce the People's Privacy Act in the House this week. And SB 5104, the facial recognition moratorium (also sponsored by Sen. Hasegawa), is still waiting for a hearing in the EET committee. There's a lot more to say about all of this legislation. I'll return to SB 5062, the Bad Washington Privacy Act, in a separate post. Read on for a deeper dive into SB 5116\. First though, here's a video with some important context. [**The Fight for the Future: Organizing The Tech Industry**](https://www.youtube.com/watch?v=vDtOxrV9Bqc&feature=youtu.be&ref=thenexusofprivacy.net), with Dr. Timnit Gebru of Black in AI, Dr. Alex Hanna from the Ethical AI team at Google, Charlton Mcilwain of NYU and the Center for Critical Race and Digital Studies, Dr. Safiya Umoja Noble of UCLA and the [Center for Critical Internet Inquiry (C2i2)](https://www.c2i2.ucla.edu/?ref=thenexusofprivacy.net), labor organizer Adrienne Williams, and Meredith Whitaker of NYU and AI Now. Once again, this isn't directly about the legislation but is very important recent context for the wave of tech worker activism. From the description: > In December of 2020 Google fired Timnit Gebru, the co-lead of their Ethical Artificial Intelligence Team, after she refused to accept their attempted censorship of her co-authored article questioning the ethics and environmental impact of largescale AI language models. The termination sparked a new wave of organizing among Tech workers who quickly mobilized to defend Gebru against the corporate giant’s efforts to silence criticism of a key part of their business model. This organizing—following on the heels of the walk-outs against defense contracts and preceding this month’s announcement that Google workers have formed a union—offers important lessons about workers’ power within one of capitalism’s most profitable and important sectors. And now, back to the legislative update. ## SB 5116: Automated Decision Systems > "Automated decision system" means any electronic software, system, or process designed to automate, aid, or replace a decision-making process that impacts the welfare or rights of any Washington resident, and that would otherwise be performed by humans. > > – [SB 5116, Accountability and Transparency Standards for Automated Decision Systems](http://lawfilesext.leg.wa.gov/biennium/2021-22/Pdf/Bills/Senate%20Bills/5116.pdf?ref=thenexusofprivacy.net) Automated decisions fill an increasingly important role in our society. Unfortunately, many of these systems embed biases against Black and Indigenous people, trans and non-binary people, disabled people, non-native English speakers, people of color, and many other groups. [What happened to Nijeer Parks](https://www.nytimes.com/2020/12/29/technology/facial-recognition-misidentify-jail.html?ref=thenexusofprivacy.net) is a clear example an of the harms automated decision systems can cause. First, he was arrested for a crime he didn’t commit -- because an automated facial recognition decision system misidentified him. Then, he was jailed because New Jersey’s no-bail automated decision system decided he was a risk. SB 5116 sets standards for fairness and accountability, transparency requirements, and prohibition on government agencies developing or using automated decision systems to discriminate against people. It’s an important step forward against these kinds of abuses. I’m delighted that the legislature is considering it — and I’m thrilled that Sen. Patty Kuderer, who represents my district, is one of the co-sponsors. ## Some great testimony! SB 5116’s hearing also included discussions of several other bills, some of which had hundreds of people signed up to testify, so committee chair Sen. Sam Hunt limited oral testimony to only six people, for one minute each. The good news is that this meant the section had wrapped up in time for us to watch Lady Gaga at the Inauguration! The [Bill Report](http://lawfilesext.leg.wa.gov/biennium/2021-22/Pdf/Bill%20Reports/Senate/5116%20SBR%20SGE%20TA%2021.pdf?q=20210123003038&ref=thenexusofprivacy.net) includes a short summary of the very positive testimony at the hearing (as well as background and a very readable description of the bill). If you’ve got about 15 minutes, [check out the video of the hearing](https://www.tvw.org/watch/?eventID=2021011342&ref=thenexusofprivacy.net) – SB 5116 is the first topic. Here's my somewhat-longer summary: - Jay Cunningham, a PhD Student and Ethical AI Researcher at University of Washington, made an especially powerful case, and had the best soundbite of the hearing: "What we need in AI is less artificial and more human.” - Jennifer Lee of ACLU-Washington cited the [Arkansas healthcare algorithm that cut benefits to disabled people.](https://www.theverge.com/2018/3/21/17144260/healthcare-medicaid-algorithm-arkansas-cerebral-palsy?ref=thenexusofprivacy.net) - Hillary Haden of Washington Fair Trade Coalition noted this would be the first bill of its kind and would set a sound standard for transparency and fairness – especially important since Washington is justifiably looked to as a tech leader. - Ben Winters of Electronic Privacy Information Center brought national perspectives – and emphasized the timeliness of the issue. - Witnesses from Washington Association of Sheriffs and Police Chiefs and the Internet Association-Washington agreed with the goals of the legislation and the need, although also wanted to make sure that there are not unintended consequences on systems that are in standard use today. Several written testimonies were also submitted in support of the bill. A few highlights: - Alka Roy (founder of the [Responsible Innovation Project and a technology and AI expert](https://responsibleproject.com/?ref=thenexusofprivacy.net)) noted that bills like these are needed "to redefine innovation to include responsibility and accountability" – and highlighted the importance of independent and periodic audits since automated systems continue to be trained on new data and evolve. - Shasta Willson, a software engineer who's spent over two decades working in the industry discussed how unless care is taken to avoid bias, "these systems simply reproduce the disparities they would most idealistically remove." - I noted that the requirements for an algorithmic accountability report should be straightforward for any responsible systems vendor to supply. Conversely, if a vendor doesn’t have this information available, "it’s a sign that they are not applying industry-standard best practices, and so their system is very likely to have significant biases." I’m not sure where the written testimony is available is on the legislature’s site — I’ll update this page with more testimony (and hopefully a link to a repository somewhere) as I find it. ## There's an opportunity here! I agree with pretty much everything the people I've quoted above have brought up ... and one aspecy I especially want to highlight is the timeliness of this legislation. Stories like Nijeer Parks', or the Stanford algorithm that didn’t allocate Covid vaccines to front-line workers, are increasing awareness of the risks and harms of automated decision systems. At the same time, there's the broader context of calls for accountability, ethics, and justice for tech companies and in the AI community – and the wave of tech worker activism. Washington is well-positioned here, with a lot of great AI researchers and allies who have been pushing hard for these principles of accountability, fairness, transparency and justice within the AI community. It's also an advantage that many legislators began discussing this with last year's AI Profiling bill and multiple years of discussion of various facial recognition bills. So as I said in [The stakes are high](https://thenexusofprivacy.net/wa-privacy-legislation-2021/), there's a real chance for Washington to be a leader here. Then again, it's early days, so we shall see. Stay tuned for more! ### Criticism and praise for at the hearing for SB 5062 (the Bad Washington Privacy Act) URL: https://thenexusofprivacy.net/criticism-and-praise-for-at-the-hearing-for-sb-5062-the-bad-washington-privacy-act/ Last updated: 2021-05-26T04:31:30.000Z *Most recent update: January 29* SB 5062's official title is [**Concerning the management, oversight, and use of data**](https://app.leg.wa.gov/billsummary?BillNumber=5062&Year=2021&Initiative=false&ref=thenexusofprivacy.net)**.** It's generally referred to as the "Washington Privacy Act," but as Jennifer Lee of ACLU of Washington said in her testimony at the January 14 hearing, it gives the illusion of privacy. Susan Grant of Consumer Federation of America was equally blunt, citing "loopholes and definitional problems that essentially neuter the protections the bill is supposed to provide." The People's Privacy Act, an altenative to SB 5062, protects people, not corporation. SB 5062 protects corporations, not people. So I call it the "Bad Washington Privacy Act" just to make clear what I think of it. At SB 5062's hearing in the Senate Environment Energy and Technology (EET) committee, quite a few people other people (including me) opposed it. For example - Brianna Auffrey of CAIR Washington (pictured in the image above) discussed how SB 5062's continued unconsented data collection and sale puts Muslim and immigrant communities at serious risk of harm. - Steph Hager, a former Microsoft employee and a parent, and Cheri Kesiecker of Parent Coalition on Student Privacy focused on how SB 5062 wouldn't protect students, who often have no choice about sharing their data. - Emilie St-Pierre of Future Ada's talked about how SB 5062 won't help people who are victims of the crimes of online harassment, identify theft, and stalking. - Independent security expert Cynthia Spiess highlighted how SB 5062's opt-out approach harms people with accessibility challenges or limited English skills. - I talked about loopholes, including Section 102 (2) clauses a b c d e f g h i j k l m, which exempt government agencies, student data, data collected for job applications, financial data, and a whole lot more. But SB 5062 has a lot of support from tech companies and others who make money exploiting users data. The Washington Technology Industry Association talked about the "strong privacy protections" in the bill. The CEO of a Seattle online gaming company lauded its "very strong privacy protections for consumers." Microsoft described it as "the strongest privacy protections in the US." The Washington Hospitality Association, Washington Retail, Internet Assocation, and Association of Washington Businesses were also largely positive, although asked for it to be weakened further. Since EET Chair Sen. Reuven Carlyle is the Bad Washigton Privacy Act's primary sponsor, and many EET members are co-sponsors, the bill will probably move ahead. In 2019 and 2020, the Senate passed weak, corporate-friendly bills sponsored by Sen. Carlyle. The House listened to privacy advocates and community groups, and passed a significantly stronger version to protect consumers. Negotiations between the chambers [collapsed](https://www.govtech.com/policy/Why-Did-Washington-States-Privacy-Legislation-Collapse.html?ref=thenexusofprivacy.net), leaving Washingtonians' privacy unprotected. Hopefully things wil work out better this year. We shall see. For more on the Bad Washington Privacy Act, [check out the video of last week's hearing](https://www.tvw.org/watch/?eventID=2021011192&ref=thenexusofprivacy.net) and [my live-tweeting](https://twitter.com/jdp23/status/1349782928016826368?ref=thenexusofprivacy.net). If you only have a few minutes, start watching at 59:50 for Brianna Coffrey's testimony, followed by the amazing back-to-back trio of Emilie St-Pierre, Cynthia Spiess, and Susan Grant wrapping up the session. The whole video is worth watching if you have the time. The contrast between the bill's supporters repeatedly talking about the "strong protection" it offers and the bill's critics discussing it's shortcomings is ... stark. The Senate [Bill Report on SB 5062](http://lawfilesext.leg.wa.gov/biennium/2021-22/Pdf/Bill%20Reports/Senate/5062%20SBR%20ENET%20TA%2021.pdf?q=20210121015843&ref=thenexusofprivacy.net) includes background, detailed description of the bill, and succinct summary of the PRO, CON, and OTHER points from the first hearing. The bill itself is 44 pages long; [the initial draft is available here.](https://thenexusofprivacy.net/wa-privacy-legislation-2021/lawfilesext.leg.wa.gov/biennium/2021-22/Pdf/Bills/Senate%20Bills/5062.pdf) **Update, January 29**: - the EET Committee issued a "do pass" recommendation in an executive hearing on January 21\. Joseph O'Sullivan's [European-style data privacy bill returns](https://www.seattletimes.com/seattle-news/politics/european-style-data-privacy-bill-returns-as-washington-state-lawmakers-ponder-new-regulations/?ref=thenexusofprivacy.net), as Washington state lawmakers ponder new regulations in the *Seattle Times* has a good overview. There's also some discussion in [A good hearing on Automated Decision Systems, a bad privacy bill advances](https://thenexusofprivacy.net/a-good-hearing-on-automated-decision-systems-sb5116/). - [The illusion of protection and the Bad Washington Privacy Act](https://thenexusofprivacy.net/the-illusion-of-protection/) looks at some of the problems with SB 5062 in more detail. - Meanwhile, the People's Privacy Act has been introduced in the House! [Introducing the People’s Privacy Act: Real Privacy Protections for Everyone](https://aclu-wa.org/story/introducing-people%E2%80%99s-privacy-act-real-privacy-protections-everyone?ref=thenexusofprivacy.net), on ACLU of Washington's site, has more. --- *Originally published as part of* [*The stakes are high: Washington state privacy, facial recognition, and automated decision making legislation 2021*](https://thenexusofprivacy.net/wa-privacy-legislation-2021/)*, but I realized it should be a separate post.* ### The stakes are high: Washington state privacy, facial recognition, and automated decision systems legislation 2021 URL: https://thenexusofprivacy.net/wa-privacy-legislation-2021/ Last updated: 2022-03-24T01:04:15.000Z ![The word "legislation," all in caps, with a notebook, graph, pen, and reading glasses in the background.](https://thenexusofprivacy.net/content/images/2021/01/BLDC_LegislationCoronaVirus_03182020.jpg) *Most recent update: January 30.* Washington is justifiably looked to as a tech-savvy state, and legislation that gets passed here will influence other states and the national debate. It's a challenging time to be doing state legislative work, but the mostly-remote session kicked off as scheduled on January 11 and things are off to a fast start. Some really exciting tech bills, with a strong focus on equity and justice, really do give Washington a chance for leadership. On the other hand, the last two legislative sessions have started off with high hopes for passing a privacy bill ... and it didn't happen. So the stakes are high! Here are three important bills that can establish Washington as a leader. - [**HB 1433, The People's Privacy Act**](https://app.leg.wa.gov/billsummary?BillNumber=1433&Year=2021&ref=thenexusofprivacy.net) protects people, not corporations. This groundbreaking bill was collaboratively developed by the Tech Equity Coalition a group of civil liberties and civil rights-focused organizations and individuals working to hold technology accountable), ACLU of Washington, and Rep. Shelley Kloba. It applies to government agencies as well as corporations, requires opt-in (affirmative consent) for sharing data, prohibits using people’s personal information to discriminate, and bans facial recognition and artificial intelligence-enabled profiling in schools, stores, parks and any other place of public accommodation. It also includes a private right of action, so that people can hold corporations accountable. Find out more at [Introducing the People’s Privacy Act: Real Privacy Protections for Everyone](https://aclu-wa.org/story/introducing-people%E2%80%99s-privacy-act-real-privacy-protections-everyone?ref=thenexusofprivacy.net) on ACLU of Washington's site. - [**SB 5104, Concerning a moratorium on facial recognition technology**](https://app.leg.wa.gov/billsummary?BillNumber=5104&Year=2021&Initiative=false&ref=thenexusofprivacy.net), sponsored by Sen. Bob Hasegawa, would stop state and local government agencies from adopting a technology that causes false arrests, denial of benefits, and other harms – harms that fall disproportionately on communities of color and LGBTQIA+ people. Sentiment against facial recognition technology has continued to grow over the last year, with coverage of false arrests and other abuses; Microsoft and Amazon (as well as Google, IBM, and other tech companies) have voluntarily started partial moratoriums. So far, though, SB 5104 hasn't been scheduled for a hearing. - [**SB 5116, Accountability and Transparency Standards for Automated Decision Systems**](https://app.leg.wa.gov/billsummary?BillNumber=5116&Year=2021&Initiative=false&ref=thenexusofprivacy.net)**,** also sponsored by Sen. Hasegawa, establishes minimum standards for fairness and accountability in automated decision systems, and ensures public transparency and approval before these systems are acquired. It also prohibits state agencies from developing or using automated systems to discriminate against people. [A good hearing on Automated Decision Systems](https://thenexusofprivacy.net/a-good-hearing-on-automated-decision-systems-sb5116/) has more on SB 5116's very positive hearing. On the privacy side, there's also Sen. Reuven Carlyle's weak, pro-corproate [**SB 5062, the Bad Washington Privacy Act**](https://app.leg.wa.gov/billsummary?BillNumber=5062&Year=2021&Initiative=false&ref=thenexusofprivacy.net)**.** SB 5062 is headed to the Senate floor after [a hearing where Tech Equity Coalition members and others fiercely criticized it](https://thenexusofprivacy.net/criticism-and-praise-for-at-the-hearing-for-sb-5062-the-bad-washington-privacy-act/), but Microsoft and various industry associations supported it. In 2019 and 2020 the Senate passed even weaker pro-corporate bills from Sen. Carlyle overwhelmingly so it may well once again sail through. Will we see a repeat of 2019 and 2020, when the House strengthened and improved bad Senate bills, but the Senate said "no we want the bad version", and negotiaions collapsed? Hopefully the People's Privacy Act will change the legislative dynamics enough to get a better outcome this time! Joseph O'Sullivan's [European-style data privacy bill returns](https://www.seattletimes.com/seattle-news/politics/european-style-data-privacy-bill-returns-as-washington-state-lawmakers-ponder-new-regulations/?ref=thenexusofprivacy.net), in the *Seattle Times,* [i](https://thenexusofprivacy.net/criticism-and-praise-for-at-the-hearing-for-sb-5062-the-bad-washington-privacy-act/)s a good overview of the situation as of late January. There were also legislative battles over facial recognition in 2019 and 2020 as well. Last year, Rep. Debra Entenman fought for a moratorium, but there wasn't enough support; the legislature eventually passed a bill she described as a [sensible compromise](https://housedemocrats.wa.gov/entenman/2020/03/12/house-and-senate-reach-agreement-on-facial-recognition-rules/?ref=thenexusofprivacy.net). Since then, Microsoft and Amazon, as well as Google, IBM, and other tech companies, have voluntarily started partial moratoriums. Portland, New Orleans and other cities have enacted local bans (and Portland's is the strongest yet). Will the legislature have the political will for a moratorium this year? One again, we shall see. ![Tech Equity Coalition. In the background, a light green circuit board.](https://thenexusofprivacy.net/content/images/2021/01/tech-equity-coalition.png) The Tech Equity Coalition supports SB 5104 and SB 5116 as well as the People's Privacy Act. One thing I want to highlight is the connections between the issues the three bills cover. As AI accountability expert Deborah Raji [says](https://twitter.com/rajiinio/status/1351930368950153216?ref=thenexusofprivacy.net) > A reminder that all of machine learning, not just facial recognition, encourages the proliferation of surveillance infrastructure of all sorts. Our hunger to hoard & capture data of all forms, whether through web cookies or a camera, is tied to an increasing data requirement. A couple of specific examples: - [Data brokers acquire data from Muslim prayer apps and share it with a contractor who's part of the ICE "supply chain"](https://www.vice.com/en/article/xgz4n3/muslim-app-location-data-salaat-first?ref=thenexusofprivacy.net), who then plug it to algorithmic decision making systems sold by companies like [Palantir](https://nymag.com/intelligencer/2020/09/inside-palantir-technologies-peter-thiel-alex-karp.html?ref=thenexusofprivacy.net). The People's Privacy Act requires consent for this kind of data sharing, covers government agencies like ICE and the military (who SB 5062 exempts). SB 5116's transparency requirements force these kinds of abuses to be disclosed. - [Nijeer Parks was arrested for a crime he did not commit based on a bad facial recognition match](https://www.nytimes.com/2020/12/29/technology/facial-recognition-misidentify-jail.html?ref=thenexusofprivacy.net), and then denied bail because New Jersey’s [no-bail algorithmic decision system](https://www.thecity.nyc/justice/2020/3/6/21210469/new-jersey-no-bail-system-eyed-by-new-york-leaders-reckons-with-bias-risk?ref=thenexusofprivacy.net) decided he was a risk. The People's Privacy Act prohibits facial recognition systems in places of public accomodations. SB 5104's facial recognition moratorium stops additional deployment of these biased and inaccurate systems. SB 5116's transparency requirements force disclosure of the algorithms used in the risk assessment system, and prohibit ongoing use if they are biased. Other important Washington state bills also tackle some of the ramifications of this. SB 5010, for example, prohibits insurers' from the discriminatory practice of using of credit scores to determine rates. HB 1078 restores voting rights to Washingtonians directly impacted by our biased criminal legal system. The three bills I'm highlighting here complement these vital targeted fixes with broader solutions to the systemic issues. ## Background links This is an incredibly complex space, and especially for people who are fairly new to it, there's a lot to catch up on. Here's a list of short articles (with a couple of longer pieces thrown in) that are useful background for the different bills. - The Boston Celtics players' [Regulating facial recognition technology is a racial justice issue](https://www.bostonglobe.com/2020/12/16/opinion/governor-baker-regulating-facial-recognition-technology-is-racial-justice-issue/?ref=thenexusofprivacy.net), Veena Dubal's [San Francisco was right to ban facial recognition. Surveillance is a real danger](https://www.theguardian.com/commentisfree/2019/may/30/san-francisco-ban-facial-recognition-surveillance?ref=thenexusofprivacy.net), and Microsoft researcher Luke Stark's [Facial Recognition is the Plutonium of AI](https://static1.squarespace.com/static/59a34512c534a5fe6721d2b1/t/5cb0bf02eef1a16e422015f8/1555087116086/Facial+Recognition+is+Plutonium+-+Stark.pdf?ref=thenexusofprivacy.net) make the case for a facial recognition moratorium. EFF's [Banning Government Use of Face Recognition Technology: 2020 Year in Review](https://www.eff.org/deeplinks/2020/12/banning-government-use-face-recognition-technology-2020-year-review?ref=thenexusofprivacy.net) looks at the momentum for this kind of legislation in Portland, Massachusetts, and New Orleans. - Deborah Raji's [How our data encodes systematic racism](https://www.technologyreview.com/2020/12/10/1013617/racism-data-science-artificial-intelligence-ai-opinion/?ref=thenexusofprivacy.net) and Julia Angwin's [Machine Bias](http://www.pulitzer.org/finalists/julia-angwin-jeff-larson-surya-mattu-lauren-kirchner-and-terry-parris-jr-propublica?ref=thenexusofprivacy.net) series are good introductions into algorithmic inequities. Ruha Benjamin's *The New Jim Code* has lots more detail. - The Office of the Insurance Commissioner's [Now is the time to ban credit scoring](https://medium.com/commissioners-eye-on-insurance/now-is-the-time-to-ban-credit-scoring-d506fe47ec29?ref=thenexusofprivacy.net) and Melissa Santos' [Bad credit shouldn't mean higher insurance rates, WA official says](https://crosscut.com/news/2020/12/bad-credit-shouldnt-mean-higher-insurance-rates-wa-official-says?ref=thenexusofprivacy.net) discuss SB 5010 and highlight how credit scores (computed by algorithmic decision systems, using data from data brokers that was acquired without people's knowledge) discriminate aginst lower-income people and communities of color. - The Parent Coalition for Student Privacy's [SB5062 does not go far enough to protect consumers or students](https://studentprivacymatters.org/washington-privacy-act-sb5062-does-not-go-far-enough-to-protect-consumers-or-students/?ref=thenexusofprivacy.net) looks at some of the problems with the Bad Washington Privacy Act. - [How the U.S. Military Buys Location Data from Ordinary Apps](https://www.vice.com/en/article/jgqm5x/us-military-location-data-xmode-locate-x?ref=thenexusofprivacy.net) and [Leaked Location Data Shows Another Muslim Prayer App Tracking Users](https://www.vice.com/en/article/xgz4n3/muslim-app-location-data-salaat-first?ref=thenexusofprivacy.net), both by Joseph Cox in VICE, discuss some scary examples of apps data being sold without users' knowledge or informed consent. [NYPD settles lawsuit after illegally spying on Muslims](https://www.theguardian.com/world/2018/apr/05/nypd-muslim-surveillance-settlement?ref=thenexusofprivacy.net) and the San Francisco Human Rights Commssion's [Post 9/11 Surveillance and Profiling of Arab, African, Middle Eastern, Muslim and South Asians (AAMEMSA) Communities](https://sf-hrc.org/post-911-surveillance-and-profiling-arab-african-middle-eastern-muslim-and-south-asians-aamemsa?ref=thenexusofprivacy.net) are important context, looking at suspicionless surveillance programs that went on for years after 9/11. - [New York’s Contact Tracing Privacy Bill: A Promising Model](https://www.brennancenter.org/our-work/analysis-opinion/new-yorks-contact-tracing-privacy-bill-promising-model?ref=thenexusofprivacy.net), from the Brennan Center, talks about the New York state Covid legislation that several of us suggested the legislature look to as a model. - [This is the Stanford vaccine algorithm that left out frontline doctors](https://www.technologyreview.com/2020/12/21/1015303/stanford-vaccine-algorithm/?ref=thenexusofprivacy.net), on *MIT Technology Review,* looks at how even a simple algorithm can have disastrous consequences. [3 lessons from Stanford’s Covid-19 vaccine algorithm debacle](https://www.statnews.com/2020/12/21/stanford-covid19-vaccine-algorithm/?ref=thenexusofprivacy.net) in STAT notes that "the tool appears not to have accounted for workers’ actual exposure to the virus and changes to hospital rules and protocol during the pandemic." Transparency requirements help surface these kinds of problems. [Algorithms and the Coronavirus Pandemic](https://www.ft.com/content/16f4ded0-e86b-4f77-8b05-67d555838941?ref=thenexusofprivacy.net), in the *Financial Times*, looks at other pandemic-related algorithmic issues and the growing "backlash" to automated decision systems. - [Closing the AI Accountability Gap: Defining an End-to-End Framework for Internal Algorithmic Auditing](https://arxiv.org/pdf/2001.00973.pdf?ref=thenexusofprivacy.net), by multiple researchers including Deborah Raji, Timnit Gebru, and Margaret Mitchell. At the time, Gebru and Mitchell led Google's Ethical AI initiative. [Gebru has since been fired](https://www.washingtonpost.com/technology/2020/12/23/google-timnit-gebru-ai-ethics/?ref=thenexusofprivacy.net), and [Google is currently targeting Mitchell as well](https://venturebeat.com/2021/01/20/google-targets-ai-ethics-lead-margaret-mitchell-after-firing-timnit-gebru/?ref=thenexusofprivacy.net). ### JEDII Tech Links - January 15 URL: https://thenexusofprivacy.net/jedii-tech-links-january-15/ Last updated: 2021-01-15T18:37:20.000Z Apologies for missing a few days! Yesterday I testified at a state Senate hearing on SB 5062, the Bad Washington Privacy Act, and let things slide here as I prepared. As you can probably tell I'm still working on getting the right rhythm for the newsletter! Here's the [tweetstream](https://twitter.com/jdp23/status/1349782928016826368?ref=thenexusofprivacy.net) from the hearing. I'll have a longer writeup soon, as well as discussion about the much better People's Privacy Act. Today's links start with a Facebook post, Malkia Cyril's S[leepless early morning thoughts](https://www.facebook.com/malkia.devich.cyril/posts/10159014453384189). This short post by a long-time activist, organizer, and visionary does a great job discussing concerns about censorship and free speech in the aftermath of social media companies finally banning Trump and Amazon et. al. deplatforming Parler. A couple of key points: > Y’all need to understand the difference between [#censorship](https://www.facebook.com/hashtag/censorship?%5F%5Feep%5F%5F=6&%5F%5Fcft%5F%5F[0]=AZVMxI7xClRmnlAIJqbK%5F3sGP08kLt1iibKk%5F5d7p7lfx5cFjtkpw-uPV8UOt7mksMWIY7zODvZoTah%5F-efyffAdkxbpt6s%5FPFEzc2RO0UkPTeqH5wTZNWNRh40rluIQIaQ&%5F%5Ftn%5F%5F=%2ANK-R) and refusing to amplify fascism, misogyny and white supremacy. Nah, this thing isn’t simple and the slopes exist, but they aren’t slippery - they are managed by the gravitational force of power.... > To those concerned that oligarchy is being used as a defense of democracy: The unilateral power of tech companies is an extraordinary threat to democracy. However, managing that existing reality to address the threat of violent white supremacy isn’t. Yeah really. There are plenty of articles by white people discussing the situation as well, but they usually leave out a key aspect of the context: *we're in the midst of an attempted white supremacist coup*. And beware of "experts" who had previously argued against shutting down Trump opining on the current sitaution without admitting how wrong they were ... because, y'know, we'd be in much better shape if things hadn't gotten to the point of an attempted coup. A few more links, related to the aftermath of January 6 and the ongoing insurrection: ### [Everything Old is New Part 2: Why Online Anonymity Matters](https://jilliancyork.com/2021/01/14/everything-old-is-new-part-2-why-online-anonymity-matters/?ref=thenexusofprivacy.net) By Jillian C. York Every few weeks or so, some white dude suggests that the way to solve all of our online problems is to require users to submit ID verification and use their “real names,” ignoring years of research and commentary. #### [The Capitol Attack Doesn’t Justify Expanding Surveillance](https://www.wired.com/story/opinion-the-capitol-attack-doesnt-justify-expanding-surveillance/?ref=thenexusofprivacy.net) By Albert Fox Cahn on WIRED (wired.com) The security state that failed to keep DC safe doesn’t need invasive technology to meet this moment—it needs more civilian oversight. #### [Facebook Has Been Showing Ads For Military Gear Next To Insurrection Posts](https://www.buzzfeednews.com/article/ryanmac/facebook-profits-military-gear-ads-capitol-riot?ref=thenexusofprivacy.net) By Ryan Mac on BuzzFeed News (buzzfeednews.com) Earlier this week, Facebook employees warned that military product ads were being advertised against news about DC riots. The company did not act. #### [The Trump Disinformation Project](https://www.dailydot.com/the-trump-disinformation-project/?ref=thenexusofprivacy.net) By David Covucci on The Daily Dot (dailydot.com) If there is one word that sums up the Trump years, it's disinformation. Through every storyline, narrative, tweet, and scandal, a struggle with basic truth has persisted below the surface. It erupted this month in violence at the U.S. Capitol after the president's most fervent supporters were fed fetid and festering lies for years. ### [You can’t fight fascism by expanding the police state](https://www.fastcompany.com/90592060/capitol-attack-fascism-surveillance-censorship?ref=thenexusofprivacy.net) By Evan Greer on *Fast Company* We won’t reverse the damage done by Trumpism—like the attack on the Capitol—by doubling down on authoritarian policies like surveillance, policing, and censorship. We need to address systemic injustice at its root. ### New on The Nexus Today: Accountability, Impeachment, and Insurrection URL: https://thenexusofprivacy.net/new-on-the-nexus-today-channels-on-accountability-impeachment-and-insurrection/ Last updated: 2021-01-12T04:09:30.000Z ![The "Politics" menu on The Nexus Today, with topics including Higlights (with a check)< Insurrection, Disinformation, Impeachmet, Accountability, Reproductive Justice, Black Lives Matter, and more](https://thenexusofprivacy.net/content/images/2021/01/nexus-menus-2-1.png) [The Nexus Today](https://links.thenexus.today/?ref=thenexusofprivacy.net) is a news aggregator, highlighting interesting links from around the web on a variety of topics. Unlike Google News, Reddit, and other popular news aggregators, it’s designed with an explicit focus on accessibility, privacy, diversity and justice. You can read more about it [here](https://thenexus.today/?ref=thenexusofprivacy.net) – or check it out at [https://links.thenexus.today](https://links.thenexus.today/?ref=thenexusofprivacy.net). One of the advantages of the approach I've taken is that it's fairly easy to add new topics. After [feedback from the Oracle for Transfeminist Technologies](https://thenexusofprivacy.net/starting-the-new-year-with-the-oracle-for-transfeminist-technologies/), I added Accountability last week. In the aftermath of the January 6 attack on the Capitol, and with warnings about ongoing threats of violent actions around the country, I added the timely topics of Insurrection and Impeachment over the weekend. To use the site, pick a topic from the menus. If you like visuals, there's also a "show images" option. Or if you prefer an Apple News/reddit-style display, with just the headlines and smaller images, you can use the alternate link at [https://links.thenexus.today/news](https://links.thenexus.today/news?ref=thenexusofprivacy.net). \[I know, I know, that's kind of awkward ... I'll integrate it better soon.\] Right now stories about the insurrection are unsurprisingly at the top of the Politics front page. Still, there's a lot of other important stuff happening as well – the top stories in the Tech section are currently [Millions of people uploaded photos to the Ever app. Then the company used them to develop facial recognition tools](https://www.nbcnews.com/tech/security/millions-people-uploaded-photos-ever-app-then-company-used-them-n1003371?ref=thenexusofprivacy.net), [Leaked Location Data Shows Another Muslim Prayer App Tracking Users](https://www.vice.com/en/article/xgz4n3/muslim-app-location-data-salaat-first?ref=thenexusofprivacy.net), [Experts weigh in on National Guard monitoring protests](https://www.nbcnews.com/business/business-news/who-decides-when-there-are-helicopters-experts-weigh-national-guard-n1253599?ref=thenexusofprivacy.net)(discussing the George Floyd protests, not the current insurrection), and [A New (Non-)Privacy Policy from WhatsApp? \[A comparison between messaging applications\]](https://smex.org/a-new-non-privacy-policy-from-whatsapp-a-comparison-between-messaging-applications/?ref=thenexusofprivacy.net). And if you're thinking that these look a lot like the links that I include in updates here on JEDII Tech, that's not a coincidence – most of the links in the link roundups do indeed come from The Nexus Today. The site operates mostly automatic (with a limited amount of editing); I cherry-pick some of the best links for the newsletter. Right now, that involves cut-and-paste, but one of the things on my list is to streamline things. ### DRAFT: How social media algorithms embed and magnify racism, sexism, and misogynoir URL: https://thenexusofprivacy.net/draft-how-algorithms-embed-white-supremacy/ Last updated: 2021-01-14T06:55:41.000Z ## DRAFT! Work in progress! Please do not forward broadly yet. Feedback welcome! There's a comment section at the bottom, experimenting with [Commento](https://commento.io/?ref=thenexusofprivacy.net), or you can get in touch with me via email or social networks. Facebook, Twitter, YouTube, Reddit and other social networks use algorithms to decide what news to show you; which of your friends' posts or tweets you see; what gets automatically blocked for hate speech and which accounts get suspended; what ads you see and how much advertisers pay for them; what groups and events they recommend; "trending topic"; what to show if you do a search; and much much more. Virtually all these algorithms are racist, sexist, and [misogynoir.](https://www.tandfonline.com/doi/full/10.1080/14680777.2018.1447395?src=recsys&ref=thenexusofprivacy.net) And when you combine those algorithms with processes, employee demographics and power relations, it all works to reinforce and magnify the kinds of oppression we see throughout society. And not just for social networks, either; books like Safiya Noble's *Algorithms of Oppression*, Ruha Benjamin's *The New Jim Code,* Frank Pasquale's *Black Box Society*, and Cathy O'Neill's *Weapons of Math Destruction* paint a picture of how pervasive these problems are. Of course, algorithms are far from the only source of racism, sexism, and misogynoir in systems like Facebook, Twitter, and reddit. Becca Lewis' [All of YouTube, Not Just the Algorithm, is a Far-Right Propaganda Machine](https://ffwd.medium.com/all-of-youtube-not-just-the-algorithm-is-a-far-right-propaganda-machine-29b07b12430?ref=thenexusofprivacy.net), Siva Vaidhyanathan's [Making Sense of the Facebook Menace](https://newrepublic.com/article/160661/facebook-menace-making-platform-safe-democracy?ref=thenexusofprivacy.net) do a great job at setting the algorithmic issues in a broader system context. Still, they're an important factor. Looking at all the different ways algorithms can be racist, sexist, and misogynoir, and all the different ways algorithms are used in these systems ... there's a lot to cover. So this post certainly isn't an exhaustive catalog. Instead, the bulk of this post will be a quick (partial) tour of different ways algorithms can embed these (and other) forms of systemic oppression, a complement to Jessie Daniels 2018 [Algorithmic Rise of the Alt-Right](https://journals.sagepub.com/doi/pdf/10.1177/1536504218766547?ref=thenexusofprivacy.net). At the end, I'll wrap up with some thoughts on what we can do in response. ## Intentional racist, sexist, and misogynoir algorithms People often talk about algorithmic oppression as an "unintended consequence". Sometimes, though, it's an explicit choice. Automated moderation on Facebook is a great example of this. [Facebook's policy](https://www.propublica.org/article/facebook-hate-speech-censorship-internal-documents-algorithms?ref=thenexusofprivacy.net) is that "white people are racist" is considered hate speech ... but "Black women are " is not. So that's what the algorithms implement. Facebook's support of illegally discriminatory housing and employment ad targeting is another example where the racism was intentional. After [ProPublica first reported this in 2016](https://www.propublica.org/article/facebook-lets-advertisers-exclude-users-by-race?ref=thenexusofprivacy.net), Facebook claimed that they'd stop ... but [they lied](https://www.propublica.org/article/facebook-advertising-discrimination-housing-race-sex-national-origin?ref=thenexusofprivacy.net). Even after Facebook's [2019 settlement](https://about.fb.com/news/2019/03/protecting-against-discrimination-in-ads/?ref=thenexusofprivacy.net), [they're still doing it](https://www.propublica.org/article/facebook-ads-can-still-discriminate-against-women-and-older-workers-despite-a-civil-rights-settlement?ref=thenexusofprivacy.net). A variation on this is when companies have techniques that could improve the situation but choose not to deploy them. [Why Won’t Twitter Treat White Supremacy Like ISIS? Because It Would Mean Banning Some Republican Politicians Too](https://www.vice.com/en/article/a3xgq5/why-wont-twitter-treat-white-supremacy-like-isis-because-it-would-mean-banning-some-republican-politicians-too?ref=thenexusofprivacy.net) (from 2019), [Facebook Struggles to Balance Civility and Growth](https://www.nytimes.com/2020/11/24/technology/facebook-election-misinformation.html?ref=thenexusofprivacy.net), and [Facebook Executives Shut Down Efforts to Make the Site Less Divisive](https://www.wsj.com/articles/facebook-knows-it-encourages-division-top-executives-nixed-solutions-11590507499?ref=thenexusofprivacy.net) describe various examples. And as Kara Swisher says about unconscious bias: after the tenth time it's been pointed out to you, just how unconscious – or unintended – is it? *Algorithms of Oppression* is a really good exploration of search biases, and there has been a ton of research since then .... and yet, when I did a Twitter search for "impeachment" when I was writing this post, nine of the top ten tweets were from white people (with CNN's Ana Cabrera as the only exception). ## "Rich get richer" effects Twitter's search algorithm factors in how much engagement (likes, retweets, replies) a tweet gets. Unsurprisingly, the more followers you have, the more engagement your tweet's likely to get. White people tend to have more followers than people of color, so it's mostly white people's posts who get shown – which makes it more likely that they'll get liked, retweeted, followed. The rich get richer! There are a lot of reasons for the disparity in followers. Twitter's more likely to feature white people as recommended users. White people are more likely to have money to promote posts or buy followers. White people are more likely to be able to get their companies to pay to promote their posts. White people are more likely to be verified. Etc etc etc. Think of follower count as a form of power on social networks, and disparities tend to mirror or magnify other societal power disparities. Similarly guys tend to have more followers than women and non-binary people, and the disparities are greatest at the intersections.The net result: the algorithm loooooves white guys and especially penalizes Black women. "Rich get richer" effects also come up in Twitter's algorithmic timeline, Facebook's timeline and most-shared posts, which redditors posts and which subreddits make it to the front page, many recommendation systems ... and lots of other places. ## Homophily Social networks, online and off, tend to be [*homophilic*](https://www.annualreviews.org/doi/full/10.1146/annurev.soc.27.1.415?ref=thenexusofprivacy.net): people are more likely to connect to, engage with, and amplify people who are similar to them. On Twitter, white people are generally more likely to follow, like, and retweet other white people. Guys are generally more likely to follow, like, and retweet other guys. The net result: another way the search algorithm loooooves white guys and especially penalizes Black women. For most people, homophily also accentuates racial and gender biases in their Facbook feed. If you're friends with a lot of white people, and they're mostly liking and sharing stuff from white people ... what kind of racial balance are you seeing? \[That's not just a rhetorical question; it can be quite interesting to track this and figure out how to improve your balance.\] And again, this pattern comes up all over the place. Susan C. Herring 's [Women and children last: the discursive construction of Weblogs](http://blog.lib.umn.edu/blogosphere/women%5Fand%5Fchildren.html?ref=thenexusofprivacy.net) (from 2004), Shelley Powers' [Guys don’t link](http://burningbird.net/connecting/guys-dont-link/?ref=thenexusofprivacy.net) (2005), my own [Guys talking to guys who talk about guys](http://www.talesfromthe.net/jon/?p=905&ref=thenexusofprivacy.net) (2009), [Ana-Andreea Stoica](https://www.linkedin.com/in/ana-andreea-stoica-98695696/?ref=thenexusofprivacy.net) et. al.’s [Algorithmic glass ceiling in social networks: the effects of social recommendations on network diversity](https://dl.acm.org/citation.cfm?id=3186140&ref=thenexusofprivacy.net) (2018), and [Nikki Usher](https://medium.com/u/45de4cccdf5c?source=post%5Fpage-----3658dc11ba44--------------------------------) et al’s [Twitter Makes It Worse: Political Journalists, Gendered Echo Chambers, and the Amplification of Gender Bias](http://journals.sagepub.com/doi/abs/10.1177/1940161218781254?ref=thenexusofprivacy.net) (2018) look at some of the many different examples. ## Biases embedded in the data Machine learning algorithms are typically "trained" on a dataset, and then applied to real life situations. If the training dataset is biased, then the algorithm will also be biased. Shirin Gaffrey's [The algorithms that detect hate speech online are biased against black people](https://www.vox.com/recode/2019/8/15/20806384/social-media-hate-speech-bias-black-african-american-facebook-twitter?utm%5Fcampaign=vox&utm%5Fcontent=chorus&utm%5Fmedium=social&utm%5Fsource=twitter) discusses one good example of this in a social network context: biases in the data biases lead to Google's "Perspective" API misclassifying some African-American English constructs as toxic. Especially Joy Buolamwini and Timnit Gebru's 2018 [Gender Shades](http://gendershades.org/?ref=thenexusofprivacy.net) project, here's also been a lot of attention to how the biases in image datasets leading to facial recognition systems being much less accurate on Black people than white people. As well as leding to people getting mistakenly arrested, these image technologies are also used by social networks for lower-stakes decisions – for example what kind of text to automatically generate for images and vidoes to support people using assistive technologies. There have been a couple of very high-profile Twitter episodes this year featuring well-known AI experts arguing that this shouldn't be considered algorithmic bias, and instead blaming the data. To me that sounds like rationalization and an attempt to avoid taking responsibility. In any case, though, whether you blame the data for reflecting society's bias, or the algorithm for failing to take into account the obvious fact that the data reflects society's bias, the end result's the same. A first step towards improving the situation is to be explicit about the biases in datasets. Timnit Gebru et. al.'s [Datasheets for Datasets](https://arxiv.org/abs/1803.09010?ref=thenexusofprivacy.net) discusses this in some detail. Why yes, this is the same Timnit Gebru who was recently [fired by Google for her work on ethical AI](https://www.washingtonpost.com/technology/2020/12/23/google-timnit-gebru-ai-ethics/?ref=thenexusofprivacy.net). It's almost like large tech companies don't really care about making their algorithms less biased! ## Algorithmic manipulation "Threat modeling" is a structured approach to looking at security threats. Most social network companies are not very good at it, and so it's often easy for attackers to manipulate thei algorithms to their own advantage. White supremacists exploit this, for example by hijacking YouTube's video recommendation algorithm for recommending videos and using it as a recruitment tool. Disinformation networks also exploit this, for example the fake news sites who manipulated Facebook's "trending topics" algorithm in 2016\. And looking at Facebook's top 10 lists, where sites like Breitbart sites are consistently near the top of the list, there's still a lot of that going on. Still, it's long past time for social networks to be looking at these kinds of issues. ## What can we do in response? At an individual level, once you understand these kinds of biases, you can change your behavior to help reduce their impact some what. True, these are systemic problems, and individual responses can only do so much. Still, straightforward approaches like following more Black activists, media, experts (especially Black women and non-binary people), liking and reshare their posts and comments, and cutting down on how much you like and reshare posts from white people (especially white guys) can make a big difference in the news you personally consume – and have some influene over what your friends see. Getting your friends and family to do the same can multiply the impact. If you're part of a non-profit or activism group, get your colleagues and membership involved as well. For broader change, it's vital to press tech companies to do better – for example by supporting tech worker organizers like the new Alphabet Worker's Union as well as groups like the MediaJustice, Color of Change, Ultra Violet, and the Real Facebook Oversight Board who have taken the lead here. Tech companies have a lot of leverage here, but need encouragement to use it. For example, algorithms often can be adjusted or overridden to get better results. In the ramp-up to the November election, Facebook introduced more friction into their algorithms to cut down how quickly certain kinds of post could spread. Temporary changes Facebook made to their news prioritization algorithms temporarily let mainstream news sites dominate the top 10 ... for a day or two, anyhow, before white supremacist sites took back over. [Facebook to start policing anti-Black hate speech more aggressively than anti-White comments](https://www.washingtonpost.com/technology/2020/12/03/facebook-hate-speech/?ref=thenexusofprivacy.net), from early December, and [Facebook Executives Shut Down Efforts to Make the Site Less Divisive](https://www.wsj.com/articles/facebook-knows-it-encourages-division-top-executives-nixed-solutions-11590507499?ref=thenexusofprivacy.net) discusses several other algorithmic changes. Sometimes the tools are blunter: disabling functionality, [banning accounts](https://docs.google.com/document/d/1dNC87RtdPWBXXReTsrAl-Sknw4PtwanPX0CA%5Foi20ec/edit?ref=thenexusofprivacy.net). Of course all of these interfere with tech companies' business models, at least to some extent, so they typically prefer not to take these kinds of steps – in fact [as Sydette Harry points](https://twitter.com/Blackamazon/status/1347894450828308485?ref=thenexusofprivacy.net) out they'll even claim it's impossible to make straightforward changes. And if they really want to take this seriously, there's a lot more they need to do as well: auditing and fixing existing algorithms, dropping harmful functionalty, threat modeling opportunities for abuse, and so on. Call me a cynic, but they're not likely to do it unless pushed. So, keep pushing. And from an activism and organizing perspective, it's important to acknowledge these issues and incorporate them into planning. Despite all the biases, Black Lives Matter protestors have done a great job at leveraging social media for organizing. Sarah J. Jackson, Moya Bailey and Brooke Foucault Welles' [#Hashtag Activism](https://mitpress.mit.edu/books/hashtagactivism?ref=thenexusofprivacy.net) and Sarah Fiorini's [Beyond Hashtags](https://nyupress.org/9781479813056/beyond-hashtags/?ref=thenexusofprivacy.net) are two good starting points here. ### JEDII Tech Links - January 8 URL: https://thenexusofprivacy.net/jedii-tech-links-january-7/ Last updated: 2021-01-08T21:24:44.000Z Back to links on diverse topics today ... including a video! #### [**My Data Rights**](https://mydatarights.africa/?ref=thenexusofprivacy.net) by Chenai Chair on My Data Rights (mydatarights.africa) A feminist review of AI, privacy and data protection to enhance digital rights. [Are we all equal in the eyes of AI](https://foundation.mozilla.org/en/blog/are-all-equal-eyes-artificial-intelligence/?ref=thenexusofprivacy.net)? What are the opportunities and challenges for marginalised groups in Society with Artificial Intelligence? What control do we have over our data as personal information is collected, stored and processed in the age of Artificial Intelligence (AI)? What can be done to ensure social justice for marginalised communities? Through the eyes of a feminist, the intersections of Artificial intelligence, privacy and data protection are explored in the context of South Africa.The context of gendered marginalisation of women, gender diverse people and sexual minorities forms the basis of understanding the data concerns. #### [**January 8, 2020: My Weekly Roundup of Web Design and Development News**](https://www.lireo.com/january-8-2020-weekly-roundup-web-design-and-development-news/?ref=thenexusofprivacy.net) By Deborah Edwards-Onoro on Lireo Designs (lireo.com) In this week’s web design and development news roundup, you’ll discover content predictions for 2021, find out why machine learning is not sufficient for image alternative text, learn why you might move a client site from self-hosted WordPress to hosted WordPress.com, and more. #### [**In Online Stan Spaces, The Unspoken Rule of Anonymity Empowers Women in Pakistan**](http://www.digitalrightsmonitor.pk/in-online-stan-spaces-the-unspoken-rule-of-anonymity-empowers-women-in-pakistan/?ref=thenexusofprivacy.net) By Rameeza Ahmad on Digital Rights Monitor (digitalrightsmonitor.pk) An anonymous profile anywhere else on the internet would not be taken seriously but in Stan spaces on social media – part of the Stan Culture, it is not just the norm but what is expected of you. #### [**iPhones can now automatically recognize and label buttons and UI features for blind users – TechCrunch**](https://techcrunch.com/2020/12/03/iphones-can-now-automatically-recognize-and-label-buttons-and-ui-features-for-blind-users/?ref=thenexusofprivacy.net) By Devin Coldewey on TechCrunch (techcrunch.com) Apple has always gone out of its way to build features for users with disabilities, and VoiceOver on iOS is an invaluable tool for anyone with a vision impairment — assuming every element of the interface has been manually labeled. But the company just unveiled a brand new feature that uses machine learning to identify and label every button, slider and tab automatically. #### [**Police Robots Are Not a Selfie Opportunity, They’re a Privacy Disaster Waiting to Happen**](https://www.eff.org/deeplinks/2021/01/police-robots-are-not-selfie-opportunity-theyre-privacy-disaster-waiting-happen?ref=thenexusofprivacy.net) By Matthew Guariglia on Electronic Frontier Foundation (eff.org) The arrival of government-operated autonomous police robots does not look like predictions in science fiction movies. #### [**CMA to investigate Google’s ‘Privacy Sandbox’ browser changes**](https://www.gov.uk/government/news/cma-to-investigate-google-s-privacy-sandbox-browser-changes?ref=thenexusofprivacy.net) By Competition and Markets Authority on GOV.UK (gov.uk) The CMA has opened an investigation into Google’s proposals to remove third party cookies and other functionalities from its Chrome browser. #### [**Google Chrome Privacy Plan Faces U.K. Competition Probe**](https://www.wsj.com/articles/google-chrome-privacy-plan-faces-u-k-competition-probe-11610119589?ref=thenexusofprivacy.net) By Sam Schechner on The Wall Street Journal (wsj.com) British regulators are investigating whether Google’s plan to remove some user-tracking tools from its Chrome browser could hurt competition in the online-advertising industry. #### [**Rappler Talk: Disinfo expert Kate Starbird on role of online ecosystems in US Capitol siege**](https://www.youtube.com/watch?v=yD2tKE5TtkY&ref=thenexusofprivacy.net) on YouTube (youtube.com) Kate Starbird, disinformation expert and professor at the University of Washington, talks to Rappler’s Maria Ressa about the online ecosystems that played a role bringing the US Capitol siege to fruition. ### Social networks, disinformation, and the white supremacist mob URL: https://thenexusofprivacy.net/social-networks-disinformation-and-the-insurrection/ Last updated: 2021-01-07T22:53:36.000Z ![](https://thenexusofprivacy.net/content/images/2021/01/attempted-coup-1.png) *Image description: a multi-colored meter, with the needle pointing to the orange area "attempted coup", labled Coup-o-meter. Screenshot from* [*Is this a coup?*](https://isthisacoup.com/?ref=thenexusofprivacy.net) What happened yesterday in DC and statehouses around the country is certainly part of an attempted coup, but it's just one event so needs its own name ... a lot of people are describing it as a "protest," but that de-legitimizes real protest – and gives an excuse for government to crack down on [protest](https://www.theatlantic.com/ideas/archive/2020/06/first-amendment-rightsif-you-agree-with-the-president/612211/?ref=thenexusofprivacy.net) and [dissent](https://mediajustice.org/news/our-plan-to-protectblackdissent/?ref=thenexusofprivacy.net). Calling it "domestic terrorism" [is also problematic](https://medium.com/dfrlab/the-disinformation-campaign-to-define-u-s-protesters-as-terrorists-3ea8db0a4881?ref=thenexusofprivacy.net). So for now I'll follow the lead of [AP](https://apnews.com/article/2f56a611445df15fb9640893bb9f7a93?ref=thenexusofprivacy.net), [Washington Post](https://twitter.com/washingtonpost/status/1347007477351669763?ref=thenexusofprivacy.net), the [New York Times](https://twitter.com/BeccaFoley7/status/1347040163600474112?ref=thenexusofprivacy.net) and others and call it a mob. From a tech perspective, the assault on the Capitol really highlights the role of social networks in organizing events like this. Social network companies like Twitter, Facebook, and Reddit have always had [a love affair with white supremacicsts](https://www.damemagazine.com/2017/10/19/twitter-and-white-supremacy-love-story/?ref=thenexusofprivacy.net), so on the one hand it's great that Facebook, Twitter, Youtube, and Snapchat have suspended Trump's account, at least temporarily, and it would also be great if Facebook had shut down a lot of the groups planning these actions. On the other hand, as Sarah J. Jackson, Moya Bailey and Brooke Foucault Welles discuss in [#HashtagActivism](https://mitpress.mit.edu/books/hashtagactivism?ref=thenexusofprivacy.net), social network activism can also be used in positive ways, and it's critical to defend that – in the upcoming legislative debates on Section 230, and also pressuring companies to continue to allow activism. Social network companies also haven't taken much action to cut down disinformation. The whole "Stop the Steal" narrative (pushed by the majority of Congressional Republicans as well as Trump, Giuliani, and their cronies) laid the groundwork for this. QAnon conspiracy theories played a role as well. As Julia Carrie Wong said on Twitter, tech/disinfo/extremism reporters are (justifiably) furious bc "they saw this coming, they said this was coming, and they were accused of not respecting free speech or being hall monitors or whatever." And with that, on to the links – a couple of older relevant articles as well as some from yesterday and today. ### [Mobilizing the Trump Train: Understanding Collective Action in a Political Trolling Community](https://arxiv.org/abs/1806.00429?ref=thenexusofprivacy.net) (2018) Claudia Flores-Saviaga, Brian C. Keegan, Saiph Savage, International 12th AAAI Conference on Web and Social Media (ICWSM 2018), via arxiv.org We performed a quantitative longitudinal analysis of more than 16 million comments from one of the most popular and disruptive political trolling communities, the subreddit /r/The\_Donald (T\_D). We use T\_D as a lens to understand participation and collective action within these deviant spaces. #### [The Rioters Who Took Over The Capitol Have Been Planning Online In The Open For Weeks](https://www.buzzfeednews.com/article/janelytvynenko/trump-rioters-planned-online?ref=thenexusofprivacy.net) Jane Lytvynenko and Molly Hensley-Clancy, Buzzfeed The mob that forced Congress to flee organized on both obscure and mainstream sites. #### [A man wearing a buffalo cap proves how far mis/disinformation can go and how dangerous it can be](https://www.poynter.org/fact-checking/2021/a-man-wearing-a-buffalo-cap-proves-how-far-mis-disinformation-can-go-and-how-dangerous-it-can-be/?ref=thenexusofprivacy.net) Cristina Tardáguila and Harrison Mantas on poynter.org Fact-checkers and researchers consider the Capitol breach a political event fueled by conspiracy theories and falsehoods ### [The Making of QAnon: A Crowdsourced Conspiracy](https://www.bellingcat.com/news/americas/2021/01/07/the-making-of-qanon-a-crowdsourced-conspiracy/?ref=thenexusofprivacy.net) Bellingcat Once again, this dangerous and eclectic conspiracy is in the spotlight. It has come a long way since its birth on a forum barely three years ago. ### [Trump blocked from Twitter, Facebook, Snapchat after violence on Capitol Hill](https://www.cnet.com/news/trump-blocked-from-twitter-facebook-snapchat-after-violence-on-capitol-hill/?ref=thenexusofprivacy.net) Queenie Wong on CNET For the first time, Twitter says Trump's account will be locked for 12 hours. Facebook goes further. ### [Twitter locked Trump’s account. Insiders say it needs to go further.](https://www.technologyreview.com/2021/01/06/1015830/twitter-trump-suspension-ban/?ref=thenexusofprivacy.net) Abby Ohlheiser and Eileen Guo on *MIT Technology Review* He’s causing death and destruction with his lies,” says Danielle Citron. “The public’s interest is to take him off.” ### [Insurrectionists’ social media presence gives feds an easy way to ID them](https://arstechnica.com/tech-policy/2021/01/insurrectionists-social-media-presence-gives-feds-an-easy-way-to-id-them/?ref=thenexusofprivacy.net) Kate Cox in *Ars Technica* You don't need fancy technology to identify folks who livestream their crimes. ### [Facebook Forced Its Employees To Stop Discussing Trump's DC Riot](https://www.buzzfeednews.com/article/ryanmac/facebook-trump-coup?ref=thenexusofprivacy.net) Ryan Mac in *Buzzfeed* “What excuse did we use not to ban him this time?” ### [Platforms Must Pay for Their Role in the Insurrection](https://www.wired.com/story/opinion-platforms-must-pay-for-their-role-in-the-insurrection/?ref=thenexusofprivacy.net) Roger McNamee in *Wired* Facebook, Twitter, and YouTube have spent years fomenting and enabling yesterday's violence at the Capitol. Policymakers need to do something about it. ### [Twitter and White Supremacy, A Love Story](https://www.damemagazine.com/2017/10/19/twitter-and-white-supremacy-love-story/?ref=thenexusofprivacy.net) Jessie Daniels in *Dame Magazine* Social media is a haven for hate groups, who use the instantaneous medium to organize and troll. So why do the platforms continue to protect them and not those they abuse ### JEDII Tech Links - January 6 URL: https://thenexusofprivacy.net/jedii-tech-links-january-6/ Last updated: 2021-01-06T17:41:35.000Z Quite a crop of links today! ### [**Envisioning a Decolonised Digital Rights Field – and Charting Next Steps**](https://digitalfreedomfund.org/envisioning-a-decolonised-digital-rights-field-and-chartering-next-steps/?ref=thenexusofprivacy.net) By Nani Jansen Reventlow and Claire Fernandez on Digital Freedom Fund (digitalfreedomfund.org) If together we had built a digital rights field in which all groups in society have their voices heard and which works to protect the digital rights of *all*, what would that look like? And what could such a decolonised field achieve? This week, a group of 30 participants, working on issues of racial, social and economic justice, digital rights, and in philanthropy, came together to not only collectively imagine just that, but also to identify the building blocks for a process that might help us get there. ### [Why we must democratize AI to invest in human prosperity, with Frank Pasquale](https://pando.com/2021/01/05/why-we-must-democratize-AI-invest-human-prosperity-with-Frank-Pasquale/?ref=thenexusofprivacy.net) Evan Selinger on pando.com Four years ago, Frank Pasquale, Professor of Law at Brooklyn Law School, catalyzed a debate over algorithmic and corporate power with the publication of his highly acclaimed and highly critical book, The Black Box Society: The Secret Algorithms That Control Money. ### [In Georgia, Facebook’s Changes Brought Back a Partisan News Feed](https://themarkup.org/citizen-browser/2021/01/05/in-georgia-facebooks-changes-brought-back-a-partisan-news-feed?ref=thenexusofprivacy.net) By Corin Faife on *The Markup* Ahead of crucial senate runoffs, Facebook reversed its political ad ban, and the impact was visible on users’ feeds ### [**Love, tech and online abuse of women in the time of coronavirus**](https://news.trust.org/item/20210104110922-bqn8t/?ref=thenexusofprivacy.net) Lin Taylor on Thomson Reuters Foundation News (news.trust.org) As COVID-19 pushes more people online, digital abuse against women is likely to intensify now that the internet is a lifeline for many ### [**WhatsApp Will Delete Your Account If You Don’t Agree Sharing Data With Facebook**](https://thehackernews.com/2021/01/whatsapp-will-delete-your-account-if.html?ref=thenexusofprivacy.net) By Ravie Lakshmanan on The Hacker News (thehackernews.com) Facebook will delete your WhatsApp account if you don’t agree to the new WhatsApp Privacy Policy and Terms of Services. ### [**Pornhub Is Just the Latest Example of the Move Toward a Verified Internet**](https://slate.com/technology/2020/12/pornhub-verified-users-twitter.html?ref=thenexusofprivacy.net) By Robyn Caplan on Slate (slate.com) What groups are more likely to be stigmatized or even pushed offline as more platforms require verification? ### [**Faculty members of color see ‘illusion of inclusion’**](https://www.insidehighered.com/news/2021/01/06/faculty-members-color-see-illusion-inclusion?ref=thenexusofprivacy.net#.X%5FXaBJdgvUA.twitter) By Colleen Flaherty on insidehighered.com Faculty satisfaction data reveal big gaps between how white and nonwhite professors experience campus diversity and inclusion efforts. ### [**Hundreds of startups go public every year. Only 20 have ever been founded and led by women.**](https://www.businessinsider.com/female-entrepreneurs-face-obstacles-taking-companies-public-2020-12?ref=thenexusofprivacy.net) By Alyson Shontell on Business Insider (businessinsider.com) Women are founding companies, but they aren’t reaching the same scale as men. Women need to found more Fortune 500 companies to reach gender equality. ### Privacy Roundup - JEDII Tech Links for January 5 URL: https://thenexusofprivacy.net/privacy-will-be-a-hot-issue-in-2021/ Last updated: 2021-01-06T17:26:56.000Z *Image from* [*ENISA*](https://www.enisa.europa.eu/news/enisa-news/security-for-privacy-on-data-protection-day?ref=thenexusofprivacy.net)*. Description: a keyboard, including a big blue key with the word Privacy and an image of a lock.* With the [People's Privacy Act about to be introduced in Washington state](https://www.seattletimes.com/opinion/washington-needs-a-privacy-law-that-protects-people-not-corporations/?ref=thenexusofprivacy.net), I'll be focusing even more than usual on privacy for the next few months. Here's a handful of recent stories on various privacy issues. ### [What You Need to Know About California's New Privacy Rules](https://www.darkreading.com/risk/what-you-need-to-know-about-californias-new-privacy-rules-/a/d-id/1339749?ref=thenexusofprivacy.net) K Royal on *Dark Reading* Proposition 24 will change Californians' rights and business's responsibilities regarding consumer data protection. ### [**Singapore police can access COVID-19 contact tracing data for criminal investigations**](https://www.zdnet.com/article/singapore-police-can-access-covid-19-contact-tracing-data-for-criminal-investigations/?ref=thenexusofprivacy.net) By Eileen Yu for *By The Way* Under the country's Criminal Procedure Code, the Singapore Police Force can obtain any data -- including information gathered by the contact tracing TraceTogether app and wearable token -- to facilitate criminal probes, confirms cabinet minister. ### [Australia’s spy agencies caught collecting COVID-19 app data](https://social.techcrunch.com/2020/11/24/australia-spy-agencies-covid-19-app-data/?ref=thenexusofprivacy.net) By Zack Whitaker on *TechCrunch* A government watchdog said the data was scooped up "in the course of the lawful collection of other data." ### [**App privacy labels show stark contrasts among messaging apps**](https://9to5mac.com/2021/01/04/app-privacy-labels-messaging-apps/?ref=thenexusofprivacy.net) Ben Lovejoy on *9to5mac* Apple's new app privacy labels went live in the App Store last month, giving users the chance to see what data is collected by each. ### [Google’s iOS apps haven’t been updated in weeks. Could Apple’s privacy labels be the reason?](https://www.fastcompany.com/90591066/googles-ios-apps-havent-been-updated-in-weeks-apples-privacy-labels-could-be-the-reason-why?ref=thenexusofprivacy.net) By Michael Grothaus on *Fast Company* As of December 8, Apple requires developers to publish privacy labels for their apps. The last time Google updated any of its iOS apps was the day before. ### [Court Upholds Legal Challenge Under California Statewide Stingray Law](https://www.lawfareblog.com/court-upholds-legal-challenge-under-california-statewide-stingray-law?ref=thenexusofprivacy.net) By Mailyn Fidler on lawfareblog.com A California state court issued a final decision regulating government agency use of devices that can be used to locate and track cell phones. ### ### Tech Worker Organizing: the new Alphabet Workers Union URL: https://thenexusofprivacy.net/jedii-tech-links-jan-4/ Last updated: 2021-01-05T02:35:25.000Z ![A red circle with a hand holding a stylized magnifying class (the search icon). On the right, the words Alphabet Workers Union.](https://thenexusofprivacy.net/content/images/2021/01/alphabet-workers-union.png) Getting the new year off to a fast start, workers at Google today announced the Alphabet Workers Union. From their page on [Why we organized](https://alphabetworkersunion.org/power/why/?ref=thenexusofprivacy.net): > We recognized that our power as Alphabet workers—full-time employees, temporary employees, vendors, and contractors—comes from our solidarity with one another.... > > To fight the systems of oppression that persist to this day, we stand in solidarity with workers and advocates everywhere.... > > Alphabet’s guiding principle used to be “Don’t be evil.” > > Help us be Alphabet’s conscience. There's a wealth of information on the [Alphabet Workers Union](https://alphabetworkersunion.org/?ref=thenexusofprivacy.net) site, and more on their Twitter account. Here's a handful of links with more perspectives on the Google Union, as well as a couple links about tech organizing in general. ### [We’re Google Workers, and We Are Forming a Union](https://www.nytimes.com/2021/01/04/opinion/google-union.html?ref=thenexusofprivacy.net) By Parul Koul and Chewy Shaw in the *New York Times* *Our company’s motto used to be “Don’t be evil.” An organized work force will help us live up to it.* ### [Googlers Are Forming a Union ](https://news.techworkerscoalition.org/2021/01/04/issue-1/?ref=thenexusofprivacy.net) By Raksha Muthukumar in the Tech Workers Coalition Newsletter ### [The ABC's of Google’s New Union](https://collectiveaction.tech/2021/the-abcs-of-googles-new-union/?ref=thenexusofprivacy.net) By Clarissa Redwine on *Collective Action in Tech* *An explainer on non-contract unions, how workers at Alphabet are using this structure to build and maintain power, and why you should too.* This morning, 250 workers at Google announced that they are forming a union. ### [Hundreds of Google Employees Unionize, Culminating Years of Activism ](https://www.nytimes.com/2021/01/04/technology/google-employees-union.html?ref=thenexusofprivacy.net) By Kate Conger in the *New York Times* *The creation of the union, a rarity in Silicon Valley, follows years of increasing outspokenness by Google workers. Executives have struggled to handle the change.* ### [How Google workers secretly built a union](https://www.protocol.com/google-union-awu?ref=thenexusofprivacy.net) By Anna Kramer in *Protocol* After a year of quiet recruiting, more than 225 Google workers signed union cards with the CWA, launching the Alphabet Workers Union. ### [The Making of the Tech Worker Movement](https://logicmag.io/the-making-of-the-tech-worker-movement/full-text/?ref=thenexusofprivacy.net) By Ben Tarnoff in *Logic* A long look at the mechanics of a movement. ### [There is something missing from tech worker organizing](https://organizing.work/2020/12/there-is-something-missing-from-tech-worker-organizing/?ref=thenexusofprivacy.net) By Carmen Molinari on *Organizing Work* The only way we can help our more vulnerable coworkers, or pursue broader policy changes, is by developing our own power against the company. And this is possible. ### Starting 2021 with the Oracle for Transfeminist Technologies URL: https://thenexusofprivacy.net/starting-the-new-year-with-the-oracle-for-transfeminist-technologies/ Last updated: 2021-01-03T20:41:59.000Z ![](https://thenexusofprivacy.net/content/images/2021/01/deck-layout.jpeg) > What if the technologies we cherish were developed to crash, instead of maintain, the matrix of domination of capitalism, hetero-patriarchy, white supremacy, and colonisation? > > — Joana Varon, [*The Future Is TransFeminist: from imagination to action*](https://deepdives.in/the-future-is-transfeminist-from-imagination-to-action-6365e097eb22?ref=thenexusofprivacy.net) Starting the new year with a Tarot reading is [a great opportunity for reflection and intention setting](https://kallistixf.dreamwidth.org/14677.html?ref=thenexusofprivacy.net). But when the [Oracle for Transfeminist Technologies](https://www.transfeministech.codingrights.org/?ref=thenexusofprivacy.net) deck showed up in my mailbox on December 31, I decided to try something different. Much as I love Tarot, as a system it’s cis-normative, reflects hierarchical power structures, etc etc etc. So 2021 seems like as good a time as any to change the energy! ## Getting to know the deck > I like to take my time with a new tarot deck, working through the full 78 cards one by one several times before I’m ready to shuffle.... This process can take anything from 20 minutes to several days. > > — Beth Maiden, [Get to know your new deck with the Tarot Deck Interview Spread](https://littleredtarot.com/tarot-deck-interview-spread/?ref=thenexusofprivacy.net) One of the design justice principles is to look for what is already working at the community level, honoring and uplifting traditional knowledge and practices. So I started by approaching this deck just the way I would any other new Tarot or oracle deck. There’s a lot to be said for the tradition of getting a little time to get to know it first. ![Four cards, with the words Values, Situations, Places, and Objects. Above them, two small ceramic tiles with a moon on the left and a sun on the right, and candlelight between them.](https://thenexusofprivacy.net/content/images/2021/01/suits.jpg) The TransFemTech Oracle’s 68 cards, including 6 blank ones, are divided into four types: Values, Objects, Situations, and People and Places. One thing that really leapt out at me is the contrast and synergies between the abstraction of the Values and Situations, and the groundedness of People and Places, and the ordinariness of the Objects. The Values and Situations had resonated with me, so I went through the Values again and looking at the images on the values in more detail. Next I went through the Situations and thought about how they applied to various situations I've been in. I started to get a feel for how to use the deck to focus my thinking. If you think of a reading is a structured dialog with the deck, an “interview” is a good initial way of experiencing what the conversation will be like. There are a lot of variations out there; I use the one Beth Maiden describes in her post. The different types of cards are so different that I debated about adapting the spread by choosing a type for each question but instead I shuffled all the cards together including the blank ones. Here’s what the Oracle had to say when I interviewed it. > **What is your most important characteristic?** Sandals > **What are your strengths as a deck?** Autonomy > **What are your limits?** Empathy > **What are you here to teach me?** Bicycle > **How can I best learn and collaborate with you?** Be in your own body. Be in the place you inhabit. > **What is the potential outcome of our working relationship?** Horizontality ## Playing with the Oracle One of the variants in the short instruction book focuses an existing technology instead of using an Object. I decided to focus on news aggregators. As I say on [*The Nexus Today*](https://thenexus.today/?ref=thenexusofprivacy.net), > Sites like Google News, Reddit, Axios, Hacker News, Quartz, and Techmeme primarily amplify and center cis, white, able-bodied, and male perspectives. Meanwhile, my Twitter feed has tons of great content by and about people of color, trans and queer people, disabled people, and women — content that *isn’t* showing up on reddit et al. Here's what the Oracle had to say about news aggregators. ![Three cards under blacklight, At the top, a card with the words "Be in your own body. Be in the place you inhabit." On the bottom left, a hand and the word Accountability. On the bottom right, a ship in a bottle with a lock on it, and the word Decoloniality. ](https://thenexusofprivacy.net/content/images/2021/01/news-aggregators-values.jpeg) > **People/Place:** Be in your own body. Be in the place you inhabit. > **Value**: Accountability > **Value**: Decoloniality Yeah really. The first thought that came to mind (sparked by the People aspect of the first card) was how it requires getting beyond the “one size fits all” attitude and [scale thinking](https://docs.google.com/document/d/1MxYtja5eMK37nRV1Rhd3xI1G1A3wGGg8Na8-KXHJLJE/edit?ref=thenexusofprivacy.net) all of these sites have. Their algorithms, user experience, policies and processes all embed and reinforce the implicit assumption that what’s the most interesting for cis able-bodied guys is the most interesting for everybody else. *\[As I was working on this post, I ran into a great example of this when I checked reddit on New Year’s Day. One the top two links was “Men of reddit. Whats the strangest boner youve ever had?” Oh yeah that's why I never check reddit.\]* My next thought on being in your own body: why isn’t the experience on these sites better for people using assistive technology like screen readers and keyboard navigation? Google News, Techmeme, and Hacker News don’t even implement the accessibility 101 “skip to content” link, so you have to tab through the headers every single time you visit the page. Reddit does … but if you’re not logged in, you get a pop-up dialog asking you to log in instead of the “skip to content” link. And that's just from the first half of the first card! Thinking about news aggregators in terms of being of accountability, decolonialization, and being in the place you inhabit offers plenty of insights as well as questions – for example, who should a news aggregator to be "accountable" to? I'm not sure, but it's certainly a good question. ## A great way to start the year! I hadn't started until after midnight, and had spent a while getting to know the deck first, so I didn't actually take it to the next stage of process -- envisioning and describing a Blueprint for a futuristic technology guided by the Values and developed by and for your People in your Place. Still, I got a lot out of the time I spent with the Oracle ... and have lots of thoughts about other way to use it. What a great way to start off the year! So many thanks to Coding Rights, the MIT Co-Design Lab, and everybody who's helped develop the Oracle for Transfeminist Technology. It's very clear that the Oracle can indeed help generate ideas for technology that's more imbued with transfeminist values and designed to crash the matrix of domination. You can find out more about the Oracle and the multi-year collaborative design process behind it, download resources, and get your own copy on [transfeministech.org](https://transfeministech.org/?ref=thenexusofprivacy.net). ![A card on a colorful reading cloth, under black light, with the words "Be in your own body. Be in the place you inhabit."](https://thenexusofprivacy.net/content/images/2021/01/transfemtech-initial.jpeg) ### Welcome to JEDII Tech URL: https://thenexusofprivacy.net/welcome-to-jedii-tech/ Last updated: 2021-01-04T09:07:31.000Z After blogging at achangeiscoming.net and Medium for the last couple of years, I'm ready for a change. One of my goals for 2021 is to start experimenting with a newsletter. Substack's popular, but ... well let's just say that it's not all that congruent with the brand I'm trying to create. Instead, I'm going to give self-hosted Ghost a try. How hard can it be? Yeah, yeah, I know, famous last words. We'll see how it goes. For now I'm still setting up so expect some roughness ... for example, it doesn't look great when [tweeted](https://twitter.com/jdp23/status/1345278521787047937?ref=thenexusofprivacy.net). But hey, gotta start somewhere. Posts here will probably be a mix of summaries of existing links, short posts, and longer essays. To start with here's a handful of interesting recent articles and a paper. ### [Timnit Gebru’s Exit From Google Exposes a Crisis in AI](https://www.wired.com/story/timnit-gebru-exit-google-exposes-crisis-in-ai/?ref=thenexusofprivacy.net) Alex Hanna and Meredith Whitaker in *Wired* *The situation has made clear that the field needs to change. Here’s where to start, according to a current and a former Googler.* ### [Making Sense of the Facebook Menace](https://newrepublic.com/article/160661/facebook-menace-making-platform-safe-democracy?ref=thenexusofprivacy.net) Siva Vaidhyanathan in *The New Republic* *Can the largest media platform in the world ever be made safe for democracy?* ### [Highlighting Accessible Twitter Content](https://meyerweb.com/eric/thoughts/2021/01/01/highlighting-accessible-twitter-content/?ref=thenexusofprivacy.net) Eric Meyer on *meyerweb* *Twitter doesn’t make it obvious whether someone else’s content has been described* ### [A Queer and Feminist Defense of Being Anonymous Online (PDF)](https://scholarspace.manoa.hawaii.edu/bitstream/10125/70925/0248.pdf?ref=thenexusofprivacy.net) Jessica Lingell in *Proceedings of the 54th Hawaii International Conference on System Sciences* | 2021 *This paper argues that a flat rejection of digital anonymity is problematic, foreclosing certain forms of queer and feminist praxis.* ### [How our data encodes systematic racism](https://www.technologyreview.com/2020/12/10/1013617/racism-data-science-artificial-intelligence-ai-opinion/?ref=thenexusofprivacy.net) Deborah Raji in *MIT Technology Review* *I’ve often been told, “The data does not lie.” However, that has never been my experience. For me, the data nearly always lies.* ### A trip down memory lane: part 2 of “Social threat modeling” URL: https://thenexusofprivacy.net/a-trip-down-memory-lane-part-2-of-social-threat-modeling/ Last updated: 2026-04-15T22:39:04.000Z *A folllwup to* [*"Social Threat Modeling"*](https://thenexusofprivacy.net/social-threat-modeling/) The basic idea of social threat modeling is straightforward: apply standard threat modeling techniques to social threats like harassment and abuse. One easy way to see the potential benefits is to look at situations where companies *didn’t* do social threat modeling. So let’s start by taking a stroll down memory lane, back to 2013 … Leigh Honeywell’s [Another Six Weeks: Muting vs. Blocking and the Wolf Whistles of the Internet](https://modelviewculture.com/pieces/another-six-weeks-muting-vs-blocking-and-the-wolf-whistles-of-the-internet?ref=thenexusofprivacy.net) on *Model View Culture* has a good summary of what went wrong here: > In attempting to solve the problem of users being retaliated against for blocking, Twitter missed other ways that harassers operate on their service. Retweeting, in particular, is often used by harassers to expose the target’s content to the friends of the harasser — potentially subjecting the target to a new wave of harassment. With the blocking functionality changed to work as “mute”, targets lost the ability to stop their harassers from retweeting them. One reason that computer security is so complex is that there are so many different threats that it’s very easy for a change to trigger unexpected consequences — fixing one problem creates another worse. Threat modeling, done well, gives a structured way to analyze this. Let’s start with the simplified threat model for harassment Shireen Mitchell and I sketched out for [our March 2017 SXSW talk](https://medium.com/a-change-is-coming/diversity-friendly-software-at-sxsw-2017-references-c0ca05a191a6?ref=thenexusofprivacy.net) (although we wound up not presenting it), and then Kelly Ireland and I refined as part of my talk at [TRANSform Tech later that month](https://medium.com/a-change-is-coming/transforming-tech-with-diversity-friendly-software-338f56d91df?ref=thenexusofprivacy.net). ![Threat model for different ways of harrassing people](https://miro.medium.com/v2/resize:fit:1400/0*GCnhd9za1Y2-axBc.png) One of the ways harassers attack people is to flood them with messages; one of the ways to do that is to get people to help. There are several different ways to do that, of course, one of which is retweeting. Taking the analysis down to the next level: ![Get people to help by: (1) sending them a link (2) retweet so followers see it (3) ...](https://miro.medium.com/v2/resize:fit:1400/0*Bn9UV__i5URazXzp.png) Before Twitter’s changes, there was an easy way for the target to close off this avenue of attack: block the harasser so they can’t see or retweet the tweet. ![Similar to the previous diagram but with a big circle "Block harasser" covering up the box saying "retweet so followers see it"](https://miro.medium.com/v2/resize:fit:1400/0*WYlYi3hLlkKIerM4.png) When Twitter changed blocking functionality, it re-opened up that avenue of harassment. Of course, the harasser has other options as well. But as Leigh Honeywell points out: > When the unannounced change was noticed, users and commentators argued that a determined harasser could have always copied-and-pasted a target’s tweets, set up new accounts, or otherwise worked around the existing blocking functionality, and that the original blocking functionality represented a false sense of security. These arguments ignored the value of that functionality for dealing with unmotivated, low-grade and opportunistic harassers. If Twitter had done a good job of threat modeling, they would have considered the variety of threats, everything from organized alt-right campaigns to the kinds of opportunistic-but-relatively-lazy people who will retweet because it’s an easy way of poking somebody while showing off to their buddies, but won’t devote a lot of effort to it. Targets of harassment understand these differences, of course. But as Leigh Honeywell says > While I do not know what consultation Twitter did in deciding how this feature change would impact their users, the magnitude of the response suggests that it wasn’t enough. Engaging users who are directly impacted by harassment must be central to any platform’s efforts at combating abuse. Another useful things about applying threat modeling to harassment is that it encourages you to think from the targets’ points of view. Still, “find out what people using the software want” is software engineering 101 whether or not you’re doing thread modeling. Twitter has no excuse for not doing that here. Why didn’t it happen? Leigh Honeywell that the rapid and intense criticism of “emerged in large part from marginalized communities, who are [disproportionately affected by online abuse.](http://cdm16064.contentdm.oclc.org/utils/getfile/collection/p266901coll4/id/655/filename/617.pdf?ref=thenexusofprivacy.net)” Hold that thought, as we flash forward a few years. ![](https://thenexusofprivacy.net/content/images/2025/03/twitter-safety-1.png) ![](https://thenexusofprivacy.net/content/images/2025/03/twitter-quickly-kills.png) Hey wait a second, I’m noticing a pattern here! Sarah Perez’ [Twitter quickly kills a poorly thought out anti-abuse measure](https://techcrunch.com/2017/02/14/twitter-quickly-kills-a-poorly-thought-out-anti-abuse-measure/?ref=thenexusofprivacy.net) on *TechCrunch* goes into more detail. Before Twitter’s changes, adding people to lists meant that they got a notification. Harassers would create a list with an offensive name and use this to bombard people with offensive notifications. Removing notifications when people are added to lists got rid of this avenue of harassment — but overlooked the fact that they were other important reasons for the notifications. Once again, Twitter ignored the perspective of the targets of harassment. As LeslieMac says (in a since-deleted tweet), "literally 10 (paid) Black Women with >5K followers would head all this crap off at the pass 💅🏽". [Listen to black women!](https://medium.com/a-change-is-coming/listen-to-black-women-262cd10fbe44?ref=thenexusofprivacy.net) And more generally: marginalized communities are disproportionately affected by online abuse. Even by the low standards of the tech industry, Twitter’s diversity numbers are pretty bad.\* As former Twitter engineer Leslie Miley said in Charlie Warzel’s [“A Honeypot For Assholes”: Inside Twitter’s 10-Year Failure To Stop Harassment](https://www.buzzfeed.com/charliewarzel/a-honeypot-for-assholes-inside-twitters-10-year-failure-to-s?utm%5Fterm=.bi4p0yxao&ref=thenexusofprivacy.net#.xoo128mKk) > The decision-makers were not people who got abuse and didn’t understand that it’s not about content, it’s about context. If Twitter had people in the room who’d been abused on the internet — meaning not just straight, white males — when they were creating the company, I can assure you the service would be different. Just to be crystal clear: software engineering techniques do not substitute for having a diverse team, inclusive culture, and equitable power distribution and compensation. Sure, “social threat modeling” can be useful even for relatively-homogeneous product development teams, as long as they can work with (and listen to) other voices like social scientists and marginalized people in their community. But the technical aspects aren’t enough by themselves. As Shireen Mitchell says, “The solution is multifaceted. Those that chose just one path will fail. We need all of it.” \* According to their 2017 report, [only 14% of the people in technical roles are women](https://www.usatoday.com/story/tech/news/2017/01/19/twitter-diversity-2016/96749454/?ref=thenexusofprivacy.net), so there probably weren’t a lot of women of color involved on the product development team. And only 2% of the company’s employees are African American. *Updated December 2022\. Original draft May 2018 at* [*A Change Is Coming*](http://achangeiscoming.net/2018/05/20/trip-memory-lane-part-2-social-threat-modeling/?ref=thenexusofprivacy.net)*.* ### "Social threat modeling" URL: https://thenexusofprivacy.net/social-threat-modeling/ Last updated: 2026-04-15T22:38:31.000Z [](https://medium.com/plans?dimension=post%5Faudio%5Fbutton&postId=8dc330479a50&source=upgrade%5Fmembership---post%5Faudio%5Fbutton-----------------------------------------) [Threat modeling](https://www.owasp.org/index.php/Category:Threat%5FModeling?ref=thenexusofprivacy.net) is a structured approach to looking at security threats — and what can be done in response. EFF’s [Assessing Your Risks](https://ssd.eff.org/en/module/assessing-your-risks?ref=thenexusofprivacy.net) describes how people wanting to keep their data safe online can do threat modeling, starting with questions like “what do I want to protect?” and “who do I want to protect it from?” Threat modeling is also an important software engineering technique, and it’s that aspect I’m going to focus on here. When a company takes threat modeling seriously as part of an overall security development process, it can have a huge impact — the comments on Dan Kaminkski’s [Summer of Worms](https://www.facebook.com/dan.kaminsky.12/posts/10157344270504692) Facebook thread highlight how this played out at Microsoft in the early 2000s. Things have come a long way since then. Today there are books, checklists, tutorials, tools, and even games about how to do it well (although there are still plenty of companies who prefer to ignore the risks). Even for companies that do practice it, threat modeling today generally has a rather selective focus. As [Amanda Levendowski](https://medium.com/u/190efea63f27?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) points out in [Conflict Modeling](https://www.levendowski.net/conflict-modeling/?ref=thenexusofprivacy.net): > In the [security](https://www.amazon.com/Threat-Modeling-Designing-Adam-Shostack/dp/1118809998?ref=thenexusofprivacy.net) and [privacy](https://www.esat.kuleuven.be/cosic/publications/article-1412.pdf?ref=thenexusofprivacy.net) contexts, threat modeling developed as a predictable methodology to recognize and analyze technical shortcomings of software systems. And when compared with security and privacy threat modeling, systems have lagged in developing similarly consistent, robust approaches to online conflict. Indeed. The Open Web Application Security Project’s [Application Threat Modeling page](https://www.owasp.org/index.php/Application%5FThreat%5FModeling?ref=thenexusofprivacy.net) discusses things like decomposing the application into components, identify the data that need to be protected, and focusing on trust boundaries between running processes. It doesn’t have much at all to say about the people who are in the system. There’s similarly no mention of important categories of other social and user harms like online conflict, harassment, computational propaganda, and [influencing elections](https://medium.com/a-change-is-coming/facebook-is-fucked-locking-the-barn-door-after-the-elections-were-stolen-a5541d5d658f?ref=thenexusofprivacy.net). ![At the top, a box labeled "Harass person". Below, "Trigger them", "Images" and "Threats"; "Flood them with messages"; "Make them look bad" ](https://thenexusofprivacy.net/content/images/2025/03/simplified-threat-model.png) **Simplified social threat model with different approaches to harassment* To be clear: this isn’t a fundamental limitation of threat modeling, it’s just what’s been emphasized to date. And although the work’s still at a relatively early stage, several people are working on extending threat modeling or similar techniques to these social threats. There isn’t yet a good name for this overall approach. I’m calling it “social threat modeling” for now, but as [Shireen Mitchell](https://medium.com/u/4b19e9d59e5e?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) of Stop Online Violence Against Women points out that’s only one aspect of it. It starts with people (not the technology), and involves looking at things from the perspective of different identities. Whatever you call it, though, there’s a steadily-growing body of promising work here. A few examples:\* - Susan Herring et. al.’s [Searching for Safety Online: Managing “Trolling” in a Feminist Forum](https://www.tandfonline.com/doi/abs/10.1080/01972240290108186?ref=thenexusofprivacy.net), in *The information society* (2002), analyzes the strategies that made a troller successful and the targeted group largely ineffectual in responding to his attack, as a means to understand how such behavior might be minimized and managed in general. Frances Shaw’s [Still ‘Searching for Safety Online’: collective strategies and discursive resistance to trolling and harassment in a feminist network,](http://twentytwo.fibreculturejournal.org/fcj-157-still-searching-for-safety-online-collective-strategies-and-discursive-resistance-to-trolling-and-harassment-in-a-feminist-network/?ref=thenexusofprivacy.net) in *The Fibreculture Journal,* from 2013, looks at similar dynamics in a network of blogs. - Robert Meyer and Michel Cukier’s [Assessing the Attack Threat due to IRC Channels](https://ieeexplore.ieee.org/abstract/document/1633535/?ref=thenexusofprivacy.net), in *Dependable Systems and Networks*, 2006, uses a combination of bots and regular users in IRC chat, and the social structure of IRC channels, to investigate - Borja Sanz et al.’s [A threat model approach to attacks and countermeasures in on-line social networks](http://paginaspersonales.deusto.es/claorden/publications/2010/sanz%5FRECSI10%5FA%20Threat%20Model%20Approach%20to%20Attacks%20and%20Countermeasures%20in%20OSN.pdf?ref=thenexusofprivacy.net), , in *Proceedings of the 11th Reunion Espanola de Criptografıa y Seguridad de la Información (RECSI),* focuses on identifying attacks against users of online social networks and possible countermeasures to mitigate the risks - Leigh Honeywell’s [Another Six Weeks: Muting vs. Blocking and the Wolf Whistles of the Internet](https://modelviewculture.com/pieces/another-six-weeks-muting-vs-blocking-and-the-wolf-whistles-of-the-internet?ref=thenexusofprivacy.net) on *Model View Culture* analyzes different kinds of attackers and their motiviations in the context of somebadly-thought-out functionality. “In attempting to solve the problem of users being retaliated against for blocking, Twitter missed other ways that harassers operate on their service.” - Mozilla’s Coral Project [applies a threat modeling perspective to online communities](http://guides.coralproject.net/threat-modeling-for-communities/?ref=thenexusofprivacy.net). [caroline sinders](https://medium.com/u/7bdeb357cfaa?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) of the Coral project briefly talks about threat modeling’s application to harassment in [SXSW canceled panels: Here is what happened](http://www.slate.com/articles/double%5Fx/doublex/2015/10/sxsw%5Fcanceled%5Fpanels%5Fhere%5Fis%5Fwhat%5Fhappened.html?ref=thenexusofprivacy.net), from 2016 - [Amanda Levendowski](https://medium.com/u/190efea63f27?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) describes Conflict Modeling as “a predictable framework to structure thinking around online conflict by suggesting a methodology for conflict modeling, defining a taxonomy of conflict — safety, comfort, usability, legal, privacy, and transparency (SCULPT) — and examining common mitigation techniques adopted by systems to reduce the risk of certain conflicts.” A draft was presented at the [2017 Privacy Law Scholars Conference,](https://www.law.berkeley.edu/research/bclt/upcoming-events/june-2017-10th-annual-privacy-law-scholars-conference-plsc/agenda-plsc-2017/?ref=thenexusofprivacy.net); as far as I know, the only public information is [on her web site](https://www.levendowski.net/conflict-modeling/?ref=thenexusofprivacy.net) - [Shireen Mitchell](https://medium.com/u/4b19e9d59e5e?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) and I suggested applying threat modeling techniques to online harassment in our 2017 SXSW talk on [Diversity-friendly Software.](https://medium.com/a-change-is-coming/diversity-friendly-software-at-sxsw-2017-references-c0ca05a191a6?ref=thenexusofprivacy.net) I went into a little more detail in [Transforming Tech with Diversity-Friendly Software](https://medium.com/a-change-is-coming/transforming-tech-with-diversity-friendly-software-338f56d91df?ref=thenexusofprivacy.net) ([the slides have a short example](https://docs.google.com/presentation/d/1JB3bTbJvjEypKlPu1JKV20Oz9YlF5zRCl3vLIPdDTrA/edit?ref=thenexusofprivacy.net#slide=id.g2073602466%5F0%5F67)) and worked with [Kelly Ireland](https://medium.com/u/5787059db75?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) at [O.school](https://o.school/?ref=thenexusofprivacy.net) applying this approach to their pleasure education platform; Shireen is working with [Kaliya-IdentityWoman](https://medium.com/u/6991e9b5ea5f?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) on applying a generalized threat modeling approach to social and user harms in the self-sovereign ID world. - Casey Fiesler’s “[speculative harm analysis](https://twitter.com/cfiesler/status/1273604933007192065?ref=thenexusofprivacy.net)” of Twitter’s audio tweets illustrates how just a few minutes of analysis can identify major opportunities for abuse in a new product feature. One interesting aspect to this work is that it’s largely being presented outside of the mainstream security and software engineering world. In the more traditional “tech space”, it’s striking how little attention is getting paid to this issue. Twitter, Facebook, and Google spend zillions of dollars a year (and publish bunches of research papers) on AI; how much have they invested here? And the red-hot blockchain world has no shortage of money either, and a golden chance to get things right from much earlier on, but other than Kaliya, very few of the people I talked to at the recent Internet Identity Workshop were even thinking about this kind of approach. And the results speak for themselves. [Twitter is toxic](https://www.amnesty.org/en/latest/research/2018/03/online-violence-against-women-chapter-1/?ref=thenexusofprivacy.net); their [latest attempt](https://slate.com/technology/2018/05/twitter-will-start-hiding-tweets-that-detract-from-the-conversation.html?ref=thenexusofprivacy.net) to deal with it is likely to fail as miserably as [all their previous ones.](https://www.buzzfeed.com/charliewarzel/a-honeypot-for-assholes-inside-twitters-10-year-failure-to-s?utm%5Fterm=.whYVrd3gK&ref=thenexusofprivacy.net#.mfN1wZeBr) Facebook is frantically trying to [close the barn door after the elections were stolen](https://medium.com/a-change-is-coming/facebook-is-fucked-locking-the-barn-door-after-the-elections-were-stolen-a5541d5d658f?ref=thenexusofprivacy.net) by making[ wildly implausible claims about how they’ll use AI to fix everything](https://www.wired.com/story/how-artificial-intelligence-canand-cantfix-facebook/?ref=thenexusofprivacy.net) in 5–10 years. As [Safiya Umoja Noble, Ph.D.](https://medium.com/u/b2173709989d?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) summed it up at the Data Society conference, “[if you’re designing technology for society, and you don’t know anything about society, you’re unqualified.](https://twitter.com/beccalew/status/996521144919429120?ref=thenexusofprivacy.net)” Still, the winds of change are in the air. The UN is discussing [Facebook’s role in genocides](https://www.reuters.com/article/us-myanmar-rohingya-facebook/u-n-investigators-cite-facebook-role-in-myanmar-crisis-idUSKCN1GO2PN?ref=thenexusofprivacy.net), Amnesty International is reporting on [Toxic Twitter](https://www.amnesty.org/en/latest/research/2018/03/online-violence-against-women-chapter-1/?ref=thenexusofprivacy.net), and [Safiya Umoja Noble, Ph.D.](https://medium.com/u/b2173709989d?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------)’s outstanding [*Algorithms of Oppression*](https://nyupress.org/books/9781479837243/?ref=thenexusofprivacy.net) is getting excerpted [in *Time Magazine*](http://time.com/5209144/google-search-engine-algorithm-bias-racism/?ref=thenexusofprivacy.net)*.* More and more people are seeing [computer science as a social science,](http://www.achangeiscoming.net/docs/cssocsci.html?ref=thenexusofprivacy.net) and coming around to a point that [Zeynep Tufekci](https://medium.com/u/a5b491a8b18c?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------), [AnthroPunk, Ph.D.](https://medium.com/u/4a0c9dd58982?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------), and others have been making for quite a while: software companies need to get anthropologists, sociologists and other social scientists involved in the process. As [Window Snyder](https://medium.com/u/b9f75a7d027a?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) (co-author of a 2004 book on threat modeling and now chief security officer at Fastly) said at the recent OurSA conference, [“the industry changes when we change it.”](https://www.wired.com/story/oursa-security-conference-calls-out-lack-of-inclusion/?ref=thenexusofprivacy.net) So I expect we’ll be seeing a lot more attention to this area over the next few months. It’ll be interesting to see which companies gets ahead of the curve. \* If there’s other work that should be in this list, please let me know! ## Image credits - Microsoft DREAD risk-ranking model from [OWASP’s Application Threat Modeling page](https://www.owasp.org/index.php/Application%5FThreat%5FModeling?ref=thenexusofprivacy.net) - Simplified threat model for harassment originally by Shireen Mitchell and me on a napkin, refined with help from Kelly Ireland and presented at [Transforming Tech with Diversity-friendly software](https://medium.com/a-change-is-coming/transforming-tech-with-diversity-friendly-software-338f56d91df?ref=thenexusofprivacy.net) ## Update Log May 15, 2018: clarifying that it’s anthropologists, sociologists, and other scientists who need to be involved May 17: some additional references and minor rephrasing. August 8: changed title, included paragraph on the name June 2020: added Casey Fiesler’s analysis of audio tweets March, 2025: cut-and-paste to The Nexus of Pricacy *Originally published at* [*A Change Is Coming*](http://achangeiscoming.net/2018/05/11/social-threat-modeling/?ref=thenexusofprivacy.net) *with the overly-optimistic title* [*Social Threat Modeling: the Winds of Change are in the Air*](https://medium.com/a-change-is-coming/social-threat-modeling-the-winds-of-change-are-in-the-air-8dc330479a50?ref=thenexusofprivacy.net)*.. Thanks to* [*AnthroPunk, Ph.D.*](https://medium.com/u/4a0c9dd58982?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) *,* [*Shireen Mitchell,*](https://medium.com/u/4b19e9d59e5e?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------)[*Safiya Umoja Noble, Ph.D.,*](https://medium.com/u/b2173709989d?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) *and* [*caroline sinders*](https://medium.com/u/7bdeb357cfaa?source=post%5Fpage---user%5Fmention--8dc330479a50---------------------------------------) *for* [*feedback on an earlier version*](https://twitter.com/digitalsista/status/996859628179816448?ref=thenexusofprivacy.net)*.* ### Lessons (so far) from Mastodon for independent social networks URL: https://thenexusofprivacy.net/lessons-so-far-from-mastodon-for-independent-social-networks/ Last updated: 2026-04-15T22:36:56.000Z *Update, November 2022: This post was originally written in May 2017\. Since then I’ve updated by fixing typos and adding new links but haven’t changed the lessons. In 2018 I noted that Mastodon has continued to make progress, and that were new lessons to learn, so added “(so far)” to the title. Flash forward to 2022 and it all still seems pretty relevant!* ![](https://miro.medium.com/v2/resize:fit:600/0*Ofujl4KsZr6M2PiI.jpeg) April was an exciting month for Mastodon. By the end of the month, the open-source, decentralized, social network (“Twitter without Nazis”) had grown to over 500,000 users, funding via Patreon for the lead developer and a part-time project manager, and corporate adoption. The month had its challenges as well, of course. [14 Perspectives on a Breakthrough Month](https://thenexusofprivacy.net/mastodon-14-perspectives-on-a-breakthrough-month/) gives an overview of what happened. Things have calmed down in May. There’s a lot less media attention, and growth is slower. The release process is getting more mature, with kanban boards and release candidates, and discussions in the Discourse forum as well as the Discord and Matrix chat rooms. So now’s a great time to look at what we can learn from these experiences — for Mastodon and its future, and for other independent social networks as well. Of course, a lot of these lessons aren’t new at all — we’ve seen them before with Dreamwidth, Diaspora, StatusNet, Gnu Social, Pinboard, Ello, and others. Mastodon’s a good reminder that they’re still true, so it’s worth reiterating here: - A lot of people want an alternative to corporate-owned ad-funded social networks. - Paying attention to marginalized communities is a great way to get critical mass and visibility. - A small team of developers can get something usable out quickly - There’s interest across the world, not just in the U.S. Mastodon’s lead developer is German, the most active instances are based in Europe and Asia; France is the first government to have an instance; and initial corporate adoption came in Japan. - Decentralization makes things more complex Moving on to some new lessons … 1. **Policies against racism, sexism, discrimination against gender and sexual minorities, and Nazis are extremely appealing positioning these days.** Not for everybody, of course: anti-safe-spacers, people with simplistic views of “free speech”, trolls, harassers and Nazis all have problems with it. Still, there’s clearly a large under-served market who’s sick of the norms on Twitter, Reddit, Facebook,\* and elsewhere. Creatrix Tiara’s [Mastodon 101: A Queer-Friendly Social Network You’re Gonna Like a Lot](https://www.autostraddle.com/mastodon-101-a-queer-friendly-social-network-youre-gonna-like-a-lot-390948/?ref=thenexusofprivacy.net) on *Autostraddle*, from November 2017, is a good example.\*\* 2. **An explicit anti-harassment and pro-sexual-minority focus will attract a lot of people who are tired of the normalized harassment and heteronormativity on other social networks** — enough to have a significant impact on the software. Furries, LGBTQ+ people, and women have implemented the bulk of Mastodon’s functionality, and continue to help drive development going forward. 3. **A small team of developers can deliver real innovation when it comes to defenses against harassment.** Mastodon’s content warnings and instance-level blocking, while far from perfect, are both significant advances on Twitter, Facebook, Tumblr, Reddit, an earlier open-source projects. And this lesson directly relates to the previous one: in 2016/2017, it was LGBTQ+ people who advocated for and implemented much of this innovative functionality including content warnings, instance-level blocking, and local-only posts. Allie Hart’s [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=thenexusofprivacy.net) has a list of early queer community-led improvements. Cassian’s [I left Mastodon yesterday](https://cassolotl.medium.com/i-left-mastodon-yesterday-4c5796b0f548?ref=thenexusofprivacy.net) and [I left Mastodon 27 days ago](https://cassolotl.medium.com/i-left-mastodon-27-days-ago-ae34919290e1?ref=thenexusofprivacy.net), from 2018, documents the queer-driven origin of keyword filtering and important muting improvements. 4. **However, even with a stated anti-harassment focus it can still be challenging for a network to respond well when people are actually harassed.** In decentralized networks, communications between instances whose admins have different norms about the definitions of and appropriate reactions to harassment add a level of complexity. And the crucial anti-harassment protection of [local-only posting](https://github.com/hometown-fork/hometown/wiki/Local-only-posting?ref=thenexusofprivacy.net) (originally implemented in the trans-led glitch-soc fork in 2017, and also available in the Hometown fork) has been rejected from the main code base, so isn’t available on most Mastodon sites. Creatrix Tiara’s [2018–2022 Twitter thread](https://twitter.com/creatrixtiara/status/1030380785226801152?ref=thenexusofprivacy.net) is a good early example. 5. **Even with an explicit anti-harassment, anti-fascism, and anti-racism focus, people of color are likely to be marginalized if the most influential people are white.** Other patterns that are likely to occur as well (as elsewhere online): — cis men are likely to prioritize anti-harassment functionality lower than women and gender-diverse people. — harassment is more likely to be directed at women, people of color, and LGBTQ+ people. — impacts are likely to fall most heavily on women of color, and in particular queer women of color. 6. **Rapid growth will tend to dilute a LGBTQ+ focus, unless there’s an effort to keep LGBTQ+ people centered and give them real authority**. Allie Hart’s [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=thenexusofprivacy.net) and [Mourning What Now?!?!](https://medium.com/@alliethehart/mourning-what-now-10964cce22a8?ref=thenexusofprivacy.net) April 2017 posts make this case in detail. Later posts like hoodieaidakitten’s [Mastodon’s Complicated Relationship with Queer Activism](https://hoodieaidakitten.dreamwidth.org/453.html?ref=thenexusofprivacy.net), Cassian's [I left Mastodon yesterday](https://cassolotl.medium.com/i-left-mastodon-yesterday-4c5796b0f548?ref=thenexusofprivacy.net) and [I left Mastodon 27 days ago](https://cassolotl.medium.com/i-left-mastodon-27-days-ago-ae34919290e1?ref=thenexusofprivacy.net), and Margaret KIBI’s Fringe Mastodev series ([The Beginnings](https://www.u2764.com/NFIC/2018-09-09/fringe-beginnings/?ref=thenexusofprivacy.net), [Enter Allie Hart](https://www.u2764.com/NFIC/2018-09-16/fringe-allie/?ref=thenexusofprivacy.net), [Joining GlitchSoc](https://www.u2764.com/NFIC/2018-10-01/fringe-glitch/?ref=thenexusofprivacy.net), [Intermission](https://www.u2764.com/NFIC/2018-11-06/fringe-intermission/?ref=thenexusofprivacy.net), and [Progressing](https://www.u2764.com/NFIC/2019-09-15/fringe-progress/?ref=thenexusofprivacy.net)), provide a detailed look at the early history. Ana Valens’ [Mastodon is crumbling — and many blame its creator](https://www.dailydot.com/debug/mastodon-fediverse-eugen-rochko/?ref=thenexusofprivacy.net), from 2019, is an excellent summary. 7. **The existing “fediverse” is a two-edged sword for a social network with an anti-harassment and anti-racism focus.** While the fediverse shares the goal of building an alternative to corporate sites, many fediverse sites that describe themselves as “free speech zones” (and people who prefer those sites) are likely to disagree on some core issues including the definition of harassment. 8. **Instance-level federation choices are an important tool for sites that want to create a safer environment** (although need to be complemented by user-level control and other functionality). Given the range of different attitudes towards harassment (etc.), this is likely to lead to alliances of more-closely-linked groups of sites that share values, with relatively weak connections between the groups. 9. **There’s a lot more that can be done to counter harassment, Nazism, racism, sexism, transphobia, and other hate online.** Mastodon’s current functionality only scratches the surface of what’s possible — and has generally been introduced in reaction to events in the network. [Transforming Tech with diversity-friendly software](https://medium.com/a-change-is-coming/transforming-tech-with-diversity-friendly-software-338f56d91df?ref=thenexusofprivacy.net) looks at Mastodon in a broader context. It’s early days yet for Mastodon — it’s been around for less than a year — and no doubt there’s more to learn as well. It’ll be interesting to see how the software and the community evolve over time. Stay tuned! *Thanks to Creatrix Tiara, Thursday, and others for feedback on early drafts!* **Update**, June 26 2017: *—* [Here’s the tootstream ](https://toot.cat/@jdp23/981329?ref=thenexusofprivacy.net)from my live-tooting the toot.cat admins’ *Open Source Bridge* presentation[*Federating with the Trouble*](https://web.archive.org/web/20170731030426/http://opensourcebridge.org/sessions/2082)*,* going into more detail based on their experiences. \* see [Mark Zuckerberg Hates Black People](https://medium.com/@thedididelgado/mark-zuckerberg-hates-black-people-ae65426e3d2a?ref=thenexusofprivacy.net) for a good perspective on this \*\* November 2022: Creatrix Tiara is now at [@creatrixtiara@mage.town](https://mage.town/@creatrixtiara?ref=thenexusofprivacy.net). Their [2018–2022 Twitter thread](https://twitter.com/creatrixtiara/status/1030380785226801152?ref=thenexusofprivacy.net) and current thread with [POC perspectives on content warnings](https://vulpine.club/@creatrixtiara/109310828652037900?ref=thenexusofprivacy.net) are both relevant to many of the lessons outlined here. *Originally published at* [*A Change Is Coming*](http://achangeiscoming.net/2017/05/10/lessons-mastodon-independent-social-networks/?ref=thenexusofprivacy.net) *and* [*on Medium*](https://medium.com/a-change-is-coming/lessons-from-mastodon-for-independent-social-networks-ae2d4ccf8f72?ref=thenexusofprivacy.net) ### Mastodon: 14 perspectives on a breakthrough month URL: https://thenexusofprivacy.net/mastodon-14-perspectives-on-a-breakthrough-month/ Last updated: 2026-04-15T22:35:48.000Z [](https://medium.com/?source=post%5Fpage---top%5Fnav%5Flayout%5Fnav-----------------------------------------)[](https://medium.com/new-story?source=post%5Fpage---top%5Fnav%5Flayout%5Fnav-----------------------------------------) > *Apologies for the lack of alt-text on images in this post; it vanished somewhere in the multiple cut-and-paste. There isn't any significant information in them, but I'll re-add it! Also, the images currently point to medium.com's CDN. I'll work on cleaning this up before rebroadcasting it, but just wanted to get it here for now!* > > *– Jon, April 2025* --- April was a big month for Mastodon, the open-source, decentralized, ad-free Twitter alternative. As lead developer Eugen Rochko says > Twitter changed the reply system, which everybody told them they shouldn’t do, and then removed the iconic egg avatar for new users, and suddenly all of my work of telling people that one day Twitter would do something they didn’t like and they’d need a viable alternative paid off. Yeah really! By the end of the month, Mastodon had grown to over 500,000 users, over 1,000 instances, hundreds of contributors to the code base, and funding for a developer and project manager. Exciting times! Of course, rapid growth can cause challenges as well. Can Mastodon keep its anti-harassment, pro-furry, pro-LGBTQ+, anti-Nazi focus as it grows? What to do about content that’s acceptable by some instances but illegal elsewhere? Is the influx of new people who don’t understand the network’s culture the start of an “Eternal April”, like Usenet’s [Eternal September](https://en.wikipedia.org/wiki/Eternal%5FSeptember?ref=thenexusofprivacy.net)?\* There’s certainly a lot to learn from this last month. Before sharing my own thoughts, I wanted to start with a bunch of other perspectives I found very useful. These are organized mostly-chronologically, so you can get a sense of how the month played out — although I put Eugen’s [April Post-Mortem](https://medium.com/@Gargron/april-post-mortem-12e3d141878c?ref=thenexusofprivacy.net) at the end, to give him the last word. ![@sarahjeong@mastodon.social](https://miro.medium.com/v2/resize:fit:392/0*2W4PGweLXAxqNzcQ.png) [Mastodon Is Like Twitter Without Nazis, So Why Are We Not Using It?](https://motherboard.vice.com/en%5Fus/article/mastodon-is-like-twitter-without-nazis-so-why-are-we-not-using-ithttps://www.vice.com/en/article/mastodon-is-like-twitter-without-nazis-so-why-are-we-not-using-it/?ref=thenexusofprivacy.net) by Sarah Jeong in *Motherboard* (April 4), describes her experiences in late March and early April just as things started to heat up. Her summary of the culture: “it’s really more of an LGBTQ-oriented space, one with a lot of anime avatars and a lot of furries.” Her conclusion: “And judging by the chatter on the federated timeline, a lot of people have found a home here. Mastodon, I think, is here to stay.” ![@qinaliu@mastodon.social](https://miro.medium.com/v2/resize:fit:400/0*YdPvdCBQEFxi3XL4.png) [What I wish I knew before joining Mastodon,](https://medium.com/@qinaliu/what-i-wish-i-knew-before-joining-mastodon-7a17e7f12a2b?ref=thenexusofprivacy.net) by Qina Liu on *HackerNoon* (April 9), uses Harry Potter gifs as part of an excellent getting-started guide. Since then, Mastodon has implemented some onboarding screens that should help new people, and introduced new functionality as well, but most of what’s here is still very relevant. ![@sargoth@mastodon.social](https://miro.medium.com/v2/resize:fit:400/0*WnDjdeJOg_v-PJ6r.png) [Mastodon, pineapples, social media and other unanswered questions,](https://medium.com/@sargoth/mastodon-pineapples-social-media-and-other-unanswered-questions-c5127c7c9aa0?ref=thenexusofprivacy.net) by [Johanna Drott](https://medium.com/u/67d68fa7496b?source=post%5Fpage---user%5Fmention--521ce46baa71---------------------------------------) (April 9), captures the sense of possibilities — and the challenging questions. “What is interesting is that the sense of early 90s cyberoptimism has started to reappear. It is possible to do things again, to change things, to build things that will make a difference…. What can and ought we do to establish sustainable social norms? How do we live together without breaking one another?” ![](https://miro.medium.com/v2/1*pNrcOGQ0ifdSN49ghZVACQ.jpeg) ![@jdp23@toot.cat](https://miro.medium.com/v2/resize:fit:400/0*RCGiAaGfZ8Sq2IqN.png) [Transforming Tech with Diversity-Friendly Software](https://medium.com/a-change-is-coming/transforming-tech-with-diversity-friendly-software-338f56d91df?ref=thenexusofprivacy.net), by me, from a presentation on April 13 at TRANSform Tech, includes a look at Mastodon’s early membership (gay communist furries, LGBTQ+ people), attention to harrasment, early significant advances over the state of the art like content warnings. ![@sarahjeong@mastodon.social](https://miro.medium.com/v2/resize:fit:392/0*KjZEiaa6dZ3Smp0r.png) [From Witches to Dolphins, These Are the Communities That Make Mastodon Great](https://motherboard.vice.com/en%5Fus/article/from-witches-to-dolphins-these-are-the-communities-that-make-mastodon-great?ref=thenexusofprivacy.net) by Sarah Jeong in *Motherboard* (April 14), looks at “the top five instances of Mastodon, according to me, as judged by completely meaningless criteria that I refuse to disclose”: mstdn.jp, kirakiratter.com, botsin.space, oulipo.social (which prohibits “that fifth symbol, or any variant of it, that is found in Latin script, including using “3” or homographic symbols in its spot”) and dolphin.town (“the e’s have to go somewhere”). ![@dredmorbius@mastodon.cloud](https://miro.medium.com/v2/resize:fit:400/0*yXyECmQoeuGBqkF0.png) [The Normal Invasion](https://mastodon.cloud/@dredmorbius/1058991?ref=thenexusofprivacy.net) (April 16–17), an epic tootstorm by [@dredmorbius](https://mastodon.cloud/@dredmorbius?ref=thenexusofprivacy.net), suggests that Mastodon’s initial quirkiness and welcoming to certain non-mainstream communities will inevitably be lost as the community grows. [What No One Else Has Told You About Mastodon,](http://www.spot.ph/newsfeatures/the-latest-news-features/69860/what-mastodon-social-network-a1633-20170417?ref=thenexusofprivacy.net) by Ryan Parreno (April 17), discusses the challenges of getting discovered and gentrification. “If you poke into the site now, you may not recognize it but the older users are fighting for control over the community from the newbies. Will gay-friendly Mastodon survive? Or can we build a better community in its place?” ![@eileenb@mastodon.cloud](https://miro.medium.com/v2/resize:fit:400/0*KFGOFy1uY8OQGk3i.png) [Is Mastodon the new social media star, or imploding black hole?,](http://www.zdnet.com/article/is-mastodon-the-new-social-media-star-or-imploding-black-hole/?ref=thenexusofprivacy.net) by Eileen Brown on *ZDNet* (April 17), looks at the current status of Mastodon and the “fediverse”, and concludes that while Twitter and Facebook don’t need to worry about their ad revenue, Mastodon isn’t going away. “In the last seven days I have had more meaningful interactions with my few Mastodon followers there than I have over the last year with the passive followers I have on Twitter.” ![](https://miro.medium.com/v2/resize:fit:740/0*ZarXXDeBnvaEk7wZ.png) **The graph of the fediverse — Liaizon Wakest. Mastodon is the lower left structure.* ![@amaelle_g@mastdn.fr](https://miro.medium.com/v2/resize:fit:396/0*iRADInxX22KZOUV_.png) [Mastodon : un autre Twitter est possible](http://www.liberation.fr/futurs/2017/04/19/mastodon-un-autre-twitter-est-possible%5F1563858?ref=thenexusofprivacy.net) (in French) by Amaelle Guiton in *Libération*, on April 19 looks at the reality, challenges, and possibilities as of mid-April, with excellent observations from Cthulhu 2017, suggesting that it’s off to a more promising start than other alternative social networks like Diaspora\*, and Corentin on [communities around values](https://anticapitalist.party/@corzntin/56680?ref=thenexusofprivacy.net). ![@u2764@icosahedron.website](https://miro.medium.com/v2/resize:fit:400/0*Wyy3COn5PTfqsZhv.png) [Mourning Mastodon](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=thenexusofprivacy.net) and [Mourning What Now?](https://medium.com/@alliethehart/gameingers-are-dead-and-so-is-mastodon-705b535ed616?ref=thenexusofprivacy.net) by Allie Hart (April 22–23) look in more depth at the power structure and ways in which queer people are increasingly being marginalized (as well as other diversity isssues). “Had Mastodon given queer contributors the ability to make executive decisions regarding the project, the community could have reached a place where it was no longer in peril.” **Update:** Margaret KIBI’s Fringe Mastodev series ([The Beginnings](https://www.u2764.com/NFIC/2018-09-09/fringe-beginnings/?ref=thenexusofprivacy.net), [Enter Allie Hart](https://www.u2764.com/NFIC/2018-09-16/fringe-allie/?ref=thenexusofprivacy.net), [Joining GlitchSoc](https://www.u2764.com/NFIC/2018-10-01/fringe-glitch/?ref=thenexusofprivacy.net), [Intermission](https://www.u2764.com/NFIC/2018-11-06/fringe-intermission/?ref=thenexusofprivacy.net), and [Progressing](https://www.u2764.com/NFIC/2019-09-15/fringe-progress/?ref=thenexusofprivacy.net)) provide a detailed look at the early history, the context for Allie Hart’s posts, and what happened next.. ![Tomio Shimizu](https://miro.medium.com/v2/resize:fit:400/0*rLjv65jE_e4Motsx.png) [pixivのマストドン参入の理由と可能性についてPawooプロダクトマネージャーが語る — ログミー](http://logmi.jp/199295?ref=thenexusofprivacy.net) ([Pixiv’s Pawoo Person Speaks](http://logmi.jp/199295?ref=thenexusofprivacy.net)) (in Japanese), on *Logmi* (April 25), a transcription of a talk by Tomio Shimizu of Pawoo.net, discusses what Pixiv is planning on doing with its Mastodon integration. Matthew Skala’s [Mastodon WTF Timeline](http://ansuz.sooke.bc.ca/entry/335?ref=thenexusofprivacy.net) (in English) has some useful background on this. ![@NinahMarie@social.tchncs.de](https://miro.medium.com/v2/resize:fit:400/0*E8srD-H12UsispHe.png) [The Bits and Bytes of Mastodon](http://veiligheidinbeeld.weebly.com/-ergens-en-nergens/the-bits-and-bytes-of-mastodon?ref=thenexusofprivacy.net) (in Dutch), by Ninah Marie on *De Weg Naar*, (April 25), looks at the network as sparking a “giant international multicultural chatbox”, has a great set tips and tricks, and in a postscript talks about how professionals might use Mastodon. ![Laure Lucchesi](https://miro.medium.com/v2/resize:fit:400/0*qln7mqwduJgLQJ96.png) [Laure Lucchesi : “Nous voulons tenter l’aventure du réseau social Mastodon”](https://www.acteurspublics.com/2017/04/28/laure-lucchesi-nous-voulons-tenter-l-aventure-du-reseau-social-mastodon?ref=thenexusofprivacy.net)(in French), *Acteurs publics* (April 28): an interview with the director of the French government agency Etalab discssing why they’ve set up a Mastodon instance for French government employees. ![@Gargron@mastodon.social](https://miro.medium.com/v2/resize:fit:400/0*n-HC8g3HbS_f5Aeo.png) [April Post-Mortem](https://blog.joinmastodon.org/2017/04/april-post-mortem/?ref=thenexusofprivacy.net), by Mastodon lead developer Eugen Rochko (April 25) looks at the month and the current state of Mastodon. There was plenty of other good stuff written as well, but these should be enough to get you started. Update, May 2017: [Lessons (so far) from Mastodon for independent social networks](https://thenexusofprivacy.net/lessons-so-far-from-mastodon-for-independent-social-networks/) has my perspectives on what to learn from all this. \* I first heard the term “Eternal April” from Roza Shanina. Kit Redgrave and gravity conscious orb both used it early the month; and no doubt others have as well. *Originally published at* [*A Change Is Coming*](http://achangeiscoming.net/2017/05/07/mastodon-perspectives-on-a-breakthrough-month/?ref=thenexusofprivacy.net)*.* ### Gender HCI, Feminist HCI, Post-Colonial Computing, Anti-Oppressive Design, and Design Justice URL: https://thenexusofprivacy.net/gender-hci-feminist-hci-post-colonial-computing-anti-oppressive-design-and-design-justice/ Last updated: 2026-04-15T22:17:06.000Z *Originally published 2016, on* [*A Change Is Coming*](http://achangeiscoming.net/2016/12/07/gender-hci-feminist-hci-post-colonial-computing/?ref=thenexusofprivacy.net)*. Last major update: October 2018\. Obviously there have been major advances in all of these areas since then but the most interesting takeaway is how little traction these important and well-developed ideas have gotten in industry!* For years, I’ve asked software engineers and designers I run into at conference if they know about gender HCI (human-computer interaction), feminist HCI, or post-colonial computing. More recently, I’ve added intersectional HCI, anti-oppressive design, and design justice to the list as well. The response is usually something along the lines of “sounds interesting, but never heard of it.” Which is a shame. These fields have some great insights about how to create software that works better for everybody. A very brief overview: - **Gender HCI** focuses on the differences in how different genders interact with computers - **Feminist HCI** is concerned with the design and evaluation of interactive systems that are imbued with sensitivity to the central commitments of feminism — agency, fulfillment, identity and the self, equity, empowerment, diversity, and social justice. - **Post-colonial Computing** centers on the questions of power, authority, legitimacy, participation, and intelligibility in the contexts of cultural encounter, particularly in the context of contemporary globalization - **Intersectional HCI** is a framework for engaging with the complexity of users’ and authors’ identities, and situating these identities in relation to their contextual surroundings. - **Anti-oppressive design** “considers both the values embedded in technological design and the environment that surrounds how a technology is built and researched.” - **Design justice** focuses on the ways that design reproduces, is reproduced by, and/or challenges the matrix of domination (white supremacy, heteropatriarchy, capitalism, and settler colonialism), and is also a growing social movement At some level it’s not surprising that this work isn’t as well known as it should be. Much of this work has been done by women of color, queer and trans people, and others who are marginalized within the tech world. Much of this is heavily influenced by the social sciences, which are also marginalized by tech. And much of this work is also impacted by the kinds of biases against that anti-oppressive research that Alex Ahmed, Judeth Oden Choi, Teresa Almeida, Kelly Ireland, and I discuss in [What’s at Issue: Sex, Stigma, and Politics in ACM Publishing](https://dl.acm.org/citation.cfm?doid=3170427.3188400&ref=thenexusofprivacy.net).\* So here are some slightly longer overviews of these different areas, each featuring a handful of key papers, along with a few videos. Like any literature survey, what’s here is filtered through my background and interests; if there’s other work that you think should be here, please let me know! ### Gender HCI “Gender-Inclusivity Software Engineering” with Margaret Burnett The [GenderMag Method](http://gendermag.org/?ref=thenexusofprivacy.net), a gender-specialized cognitive walk-through process and a set of four personas, is based on 15+ years of [excellent research](http://gendermag.org/publications.html?ref=thenexusofprivacy.net) by Margeret Burnett and a wide range of collaborators (starting with Laura Beckwith). [GenderMag: A method for evaluating software’s gender inclusiveness](http://iwc.oxfordjournals.org/content/early/2016/01/27/iwc.iwv046.short?ref=thenexusofprivacy.net) describes five facets of gender-linked differences: motivation, information processing styles, computer self-efficacy, risk aversion, tinkering). “The users who tend to be best supported by problem-solving software tend to be those best represented in software development teams (e.g. relatively young, able-bodied, males), with other users’ perspectives often over-looked.” There’s also [a community wiki with teaching resources](https://sites.google.com/site/gendermagteach/?ref=thenexusofprivacy.net), and [an open source Recorder’s Assistant](https://github.com/mendezc1/GenderMagRecordersAssistant?ref=thenexusofprivacy.net) to help “semi-automate” the process. [From GenderMag to InclusiveMag: An Inclusive Design Meta-Method](https://arxiv.org/abs/1905.02812?ref=thenexusofprivacy.net) introduces InclusiveMag, a generalization of GenderMag that can be used to generate systematic inclusiveness methods for a particular dimension of diversity, and includes case studies for several different dimensions. Gayna Williams’ “[Are you sure your software is gender-neutral?](http://interactions.acm.org/archive/view/january-february-2014/are-you-sure-your-software-is-gender-neutral?ref=thenexusofprivacy.net)” is a good more general overview, looking at some of the reasons for gender bias in software, with suggestions for free and low-cost ways of improving the situation. Samantha Breslin and Bimlesh Wadhwa’s [Exploring Nuanced Gender Perspectives within the HCI Community,](https://dl.acm.org/citation.cfm?id=2676709&ref=thenexusofprivacy.net) from 2014, discusses “how recent approaches to gender in HCI move past questions of how men and women interact differently with technologies. Scholars are focusing on activist, intersectional, and reflexive approaches to gender and identity in design that focus on inclusion and accountability in terms of who technologies are designed for and in what ways.” The same authors’ [Towards a Gender HCI Curriculum](https://dl.acm.org/citation.cfm?id=2732923&ref=thenexusofprivacy.net) outlines “the core topics, learning outcomes, and possible activities and assessments a Gender HCI module should cover;” and their [Gender and Human‐Computer Interaction](https://onlinelibrary.wiley.com/doi/abs/10.1002/9781118976005.ch4?ref=thenexusofprivacy.net) (in the Wiley *Handbook of Human-Computer Interaction*) outlines various strategies and approaches to gender HCI including “understanding gender, feminist theories, and queer theories; analyzing gender scripts and metaphors embedded in technologies; reflexivity regarding developers’ and designers’ norms and values; feminist design and an intersectional approach; and designing for future diversity.” The most visible academic work on Gender HCI has used a simple binary gender model. Gopinaath Kannabiran’s [Where are all the queers?](https://ccid2.files.wordpress.com/2011/02/gkannabiran-where-are-all-the-queers.pdf?ref=thenexusofprivacy.net) looks at some of the implications of this. Kannabiran’s [Themself: Critical Analysis of Gender in Facebook](https://feministhciworkshop.files.wordpress.com/2010/11/gkannabiran%5Ffeministhci2011.pdf?ref=thenexusofprivacy.net) critically analyzes the interactions of non-binary gendered subjectivities, “uncovering some of the system level design choices that render non-binary gendered users invisible for all intents and purposes,” and recommends approaches based on democratizing design and pluralism. G[ender Recognition or Gender Reductionism? The Social Implications of Automatic Gender Recognition System](https://www.youtube.com/watch?v=cVHgAGiLBzo&ref=thenexusofprivacy.net)s Foad Hamidi, Morgan Klaus Scheuerman, Stacy M Branham Hamidi, Scheuerman, and Branham’s [Gender Recognition or Gender Reductionism?](https://dl.acm.org/citation.cfm?id=3173574.3173582&ref=thenexusofprivacy.net) finds that transgender individuals “have overwhelmingly negative attitudes towards AGR \[automated gender-recognition\] and fundamentally question whether it can accurately recognize such a subjective aspect of their identity,” and includes recommendations on how to accommodate gender diversity when designing new digital systems. Os Keyes [The Misgendering Machines: Trans/HCI Implications of Automatic Gender Recognition](https://ironholds.org/resources/papers/agr%5Fpaper.pdf?ref=thenexusofprivacy.net) shows that “AGR consistently operationalises gender in a trans-exclusive way, and consequently carries disproportionate risk for trans people subject to it,” and includes ideas for alternatives to AGR and how HCI can work towards a more effective and trans-inclusive treatment of gender. Oliver L. Haimson and Anna Lauren Hoffmann’s [Constructing and enforcing “authentic” identity online: Facebook, real names, and non-normative identities](http://www.firstmonday.dk/ojs/index.php/fm/article/view/6791?ref=thenexusofprivacy.net), Alex Ahmed’s [Trans Competent Interaction Design: A Qualitative Study on Voice, Identity, and Technology](https://academic.oup.com/iwc/article-abstract/30/1/53/4657109?ref=thenexusofprivacy.net), the Open Source Bridge wiki page [Flexible self-identification of gender, race,and pronouns](http://opensourcebridge.org/wiki/Flexible%5Fself-identification%5Fof%5Fgender,%5Frace,and%5Fpronouns?ref=thenexusofprivacy.net#Links) (primarily edited by by Tammarrian Rogers and me), and Morgan Klaus Scheuerman, Stacy M. Branham, and Foad Hamidi’s [Safe Spaces and Safe Places: Unpacking Technology-Mediated Experiences of Safety and Harm with Transgender People](https://docs.wixstatic.com/ugd/eb2cd9%5F607b22404ef541469b158d70de9866d0.pdf?ref=thenexusofprivacy.net) look at other important topics from a gender diversity perspective. [HCI Inclusive Gender Guidelines](https://www.morgan-klaus.com/sigchi-gender-guidelines?ref=thenexusofprivacy.net), with contributions from many of the authors listed here, provides helpful tools for writers, researches, and conference organizers, and has a very useful “terminology” section. ### Feminist HCI Justine Cassell’s [Storytelling as a nexus of change in the relationship between gender and technology: a feminist approach to software design](http://www.media.mit.edu/gnl/publications/g&g%5Fchapter%5Fhandout.pdf?ref=thenexusofprivacy.net),(1998) suggests principles of a feminist approach to software design - Transfer design authority to the user - Value subjective and experiential knowledge in the context of computer use - Allow use by many different kinds of users in different contexts - Give the user a tool to express her voice and the truth of her existence - Encourage collaboration among users Susan Herring et. al.’s [Searching for Safety Online: Managing “Trolling” in a Feminist Forum](https://www.tandfonline.com/doi/abs/10.1080/01972240290108186?ref=thenexusofprivacy.net), in *The information society* (2002), looks at a major category of HCI weaknesses that still have not been addressed. [Dealing with hate speech, flaming, and trolls](http://cfp.wikia.com/wiki/Dealing%5Fwith%5Fhate%5Fspeech,%5Fflaming,%5Fand%5Ftrolls?ref=thenexusofprivacy.net), on the Computers, Freedom, and Privacy wiki, provides a snapshot as of 2008\. Frances Shaw’s [Still ‘Searching for Safety Online’: collective strategies and discursive resistance to trolling and harassment in a feminist network,](http://twentytwo.fibreculturejournal.org/fcj-157-still-searching-for-safety-online-collective-strategies-and-discursive-resistance-to-trolling-and-harassment-in-a-feminist-network/?ref=thenexusofprivacy.net) in *The Fibreculture Journal,* from 2013, looks at similar dynamics in a network of blogs. Shireen Mitchell’s [Hacking of 2016 would have never happened had folk #ListenedToBW](https://twitter.com/i/moments/988069560921284608?ref=thenexusofprivacy.net) Twitter Moment looks at lessons from 2014 from an intersectional perspective, and Amnesty International’s [Toxic Twitter — A Toxic Place for Women](https://www.amnesty.org/en/latest/research/2018/03/online-violence-against-women-chapter-1/?ref=thenexusofprivacy.net) highlights the current rather depressing state. Shaowen Bardzell’s [Feminist HCI: taking stock and outlining an agenda for design](http://dl.acm.org/citation.cfm?id=1753521&ref=thenexusofprivacy.net) (2010) defines Feminist HCI in terms of interactive systems “that are imbued with sensitivity to the central commitments of feminism — agency, fulfillment, identity and the self, equity, empowerment, diversity, and social justice” and “entails critical perspectives that could help reveal unspoken values within HCI’s dominant research and design paradigms and underpin the development of new approaches, methods and design variations”. Jennifer A. Rode’s [A theoretical agenda for feminist HCI](https://dl.acm.org/citation.cfm?id=2051541&ref=thenexusofprivacy.net) (2011) discusses the limitations of the three dominant paradigms for treating gender in HCI (including the Beckwith et. al. gender HCI work discussed above), argues for “a need to focus on gender issues in real-world settings rather than in laboratory settings” and “the examination of gender as a social product,” and calls for the field “to engage with existing feminist theory to create our own feminist socio-technical theory.” **Casey Fiesler at CHI16 (the ACM Conference on Human Factors in Computing Systems)* Several case studies apply these frameworks to real-world software projects: - Casey Fiesler, Shannon Morrison, and Amy S. Bruckman’s [An Archive of Their Own: A Case Study of Feminist HCI and Values in Design](http://dl.acm.org/citation.cfm?id=2858409&ref=thenexusofprivacy.net) looks at the popular fan-fiction site. Casey Fiesler has also written [a short overview](https://caseyfiesler.com/2016/02/09/an-archive-of-their-own-a-case-study-of-feminist-hci-and-values-in-design-chi-2016/?ref=thenexusofprivacy.net) for these who prefer blog posts to research papers. (Elizabeth Minkel’s [A Front End of Our Own](https://increment.com/frontend/a-frontend-of-our-own/?ref=thenexusofprivacy.net) is a recent look at AO3, a good complement to Fiesler et. al.’s earlier work.) - Jill Dimond’s PhD dissertation [Feminist HCI for real: Designing technology in support of a social movement](http://jilldimond.com/wp-content/uploads/2012/08/dimond-dissertation.pdf?ref=thenexusofprivacy.net) looks at Hollaback (a movement to end street harassment) through a feminist HCI lens. One key insight: “evidence that the storytelling platform helps participants fundamentally shift their cognitive and emotional orientation towards their experience and informs what activists do on the ground.” Dimond has since worked with Hollaback on [Heartmob](https://iheartmob.org/?ref=thenexusofprivacy.net), a place to document and respond to online harassment, that also embodies many Feminist HCI principles. ![mulit-colored columns, with a multi-colored floor and roof, and text that's too small to read](https://thenexusofprivacy.net/content/images/2026/04/temple-of-time-1.jpg) Emma Willard, Temple of Time (1846) Lauren Klein‘s unpublished monograph,“Feminist Data Visualization: Rethinking the Archive, Reshaping the Field” is described in [Dave DeCamp’s blog post](https://cssh.northeastern.edu/nulab/feminist-data-visualization/?ref=thenexusofprivacy.net) about a 2015 presentation at Northeastern University. Klein’s presentation focused on three 19th-century female “data visualizers” including Emma Willard. “What alternative histories emerge when we rethink the archive of data visualization? … Instead of focusing only on the legibility of visualizations for data, argument, or evidence, Klein considers alternative means for creating, employing, and interpreting data visualizations.” John Kreiger's [Feminist Data Visualization](https://sites.owu.edu/geog-353/2020/11/07/week-13-feminist-data-visualization/?ref=thenexusofprivacy.net) page, from Ohio Wesleyan University's Geography 353, goes into more depth on this topic. Olivier L. Haimson and Gillian R. Hayes’ “[Towards Trans Inclusion in Feminist HCI](http://oliverhaimson.com/PDFs/HaimsonTowardTransInclusion.pdf?ref=thenexusofprivacy.net) discusses the value of trans inclusion, and suggests three approaches: designers should consider changing and faceted identities and temporal complexities when designing technologies; researchers should avoid unnecessary assumptions and rigid gender categorization; and professionals should emphasize trans inclusion in groups and workshops aimed at women or diversity in computing. Alex Ahmed’s [Trans Competent Interaction Design: A Qualitative Study on Voice, Identity, and Technology](https://academic.oup.com/iwc/article-abstract/30/1/53/4657109?ref=thenexusofprivacy.net) suggests including “concrete guidelines to support transgender users and combat marginalization, requiring critical engagement with normative discourses on gender and feminism.” ### Post-colonial Computing Lilly Irani, Janet Vertesi, Paul Dourish, Kavita Philip, and Rebecca E. Grinter’s 2010 paper [Postcolonial computing: a lens on design and development](http://dl.acm.org/citation.cfm?id=1753522&ref=thenexusofprivacy.net) describes postcolonial computing as “an alternative sensibility to the process of design and analysis.” It asserts a series of questions and concerns inspired by the conditions of postcoloniality but relevant to any design project. The authors suggest four shifts in approach: generative models of culture, development as a historical program, uneven economic relations, and cultural epistemologies. 2012's [Postcolonial computing a tactical survey](http://sth.sagepub.com/content/37/1/3.short?ref=thenexusofprivacy.net) is a good companion piece, focusing on tactics for “rereading, rewriting, or reimagining” hegemonic forms of computing. **Residual Mobilities: Infrastructural Displacement and Post-Colonial Computing in Bangladesh* [Residual mobilities: infrastructural displacement and post-colonial computing in Bangladesh](http://dl.acm.org/citation.cfm?id=2702573&ref=thenexusofprivacy.net), by Syed Ishtiaque Ahmed, Nusrat Jahan Mim, and Steven J. Jackson is an example of applying this postcolonial lens. Based on a field study among populations displaced by a development project in Dhaka, Bangladesh, the authors argue that “different and heretofore residual experiences of mobility must also be accounted for in post-colonial and other marginal computing environments” and document “four forms of infrastructural experience — dispossession, reconstitution, collaboration, and repair — that characterize real-world engagements with infrastructure in such settings” ![Mukurtu logo](https://thenexusofprivacy.net/content/images/2026/04/mukurtu.png) [Mukurtu](http://mukurtu.org/about/?ref=thenexusofprivacy.net) is a grassroots project aiming to empower communities to manage, share, narrate, and exchange their digital heritage in culturally relevant and ethically-minded ways. “In 2007, Warumungu community members collaborated with Kim Christen and Craig Dietrich to produce the Mukurtu Wumpurrarni-kari Archive. Mukurtu is a Warumungu word meaning ‘dilly bag’ or a safe keeping place for sacred materials. Warumungu elder, Michael Jampin Jones chose Mukurtu as the name for the community archive to remind users that the archive, too, is a safe keeping place where Warumungu people can share stories, knowledge, and cultural materials properly using their own protocols.” ### Intersectional HCI Ari Schlesinger, W. Keith Edwards, and Rebecca E. Grinter’s [Intersectional HCI: Engaging Identity through Gender, Race, and Class](https://dl.acm.org/citation.cfm?id=3025766&ref=thenexusofprivacy.net) includes a meta-review of identity representation in the CHI proceedings and finds that “previous identity-focused research tends to analyze one facet of identity at a time. Further, research on ethnicity and race lags behind research on gender and socio-economic class.” The authors recommend for “incorporating intersectionality in HCI research broadly, encouraging clear reporting of context and demographic information, inclusion of author disclosures, and deeper engagement with identity complexities.” Miriam E. Sweeney’s chapter on “The Intersectional Interface” (in [*The Intersectional Internet*](https://intersectionalinternet.com/?ref=thenexusofprivacy.net), edited by Safiya Umoja Noble and Brendesha M. Tynes) looks at how gender and race shape the design of *anthropomorphized virtual agents* (AVAs) and “illuminates the ethical considerations that designers of technology must engage with if they are to engage socially responsible technologies.” Sweeney’s “The Ms. Dewey “experience:” Technoculture, gender, and race”, in *Digital Sociologies*, and thesis [Not Just a (Pretty) Interface](https://www.ideals.illinois.edu/bitstream/handle/2142/46617/Miriam%5FSweeney.pdf?sequence=1&ref=thenexusofprivacy.net) go into more detail on AVAs. Noble’s [A Future for Intersectional Black Feminist Technology Studies](http://sfonline.barnard.edu/traversing-technologies/safiya-umoja-noble-a-future-for-intersectional-black-feminist-technology-studies/0/?ref=thenexusofprivacy.net) sets this work in a broader context. [Diversity-friendly software at SXSW](https://medium.com/a-change-is-coming/diversity-friendly-software-at-sxsw-2017-references-c0ca05a191a6?ref=thenexusofprivacy.net), a 2017 presentation by Shireen Mitchell and myself, looks at intersectional internet and HCI issues along with other software engineering techniques. [Sex, pleasure, and diversity-friendly software: the article the ACM wouldn’t publish](https://medium.com/a-change-is-coming/sex-pleasure-and-diversity-friendly-software-the-article-the-acm-wouldnt-publish-19ebc34175d4?ref=thenexusofprivacy.net), from 2018, has detailed references. Morgen Brommell’s 2016 AlterConf talk [Imagining Radical Queer Futures Through Tech](https://youtu.be/MHEZ%5FN9pvmk?ref=thenexusofprivacy.net) considers the possibilities of online spaces created by queer and trans people of color. Morgen Brommell, Imagining Radical Queer Futures Through Tech ### Anti-oppressive design and design justice ![](https://thenexusofprivacy.net/content/images/2026/04/anti-oppressive-design.jpg) Anti-oppressive design: from theory to praxis Jill Dimond’s [Anti-Oppressive Design: From Theory to Praxis](https://civic.mit.edu/2015/03/19/anti-oppressive-design-from-theory-to-praxis-jill-dimond-at-civicmit/?ref=thenexusofprivacy.net) talk at MIT (which builds off the 2014 [ACM Interactions paper](http://interactions.acm.org/archive/view/november-december-2014/anti-oppressive-design?ref=thenexusofprivacy.net) by her and Thomas Smyth) sites these approaches “in a liminal space between interpretivism and radical humanist and radical structuralist paradigms,” discusses her work on gendered violence with Hollaback, her approach to action research, and suggests worker-owned cooperatives as an approach to addressing oppression in the workplace. The [Design Justice Principles](http://designjusticenetwork.org/network-principles/?ref=thenexusofprivacy.net) (developed by an emerging network of designers and community organizers rethink design processes) centers people who are normally marginalized by design, and uses collaborative, creative practices to address the deepest challenges our communities face. Sasha Costanza-Chock’s [Design Justice: Towards an Intersectional Feminist Framework for Design Theory and Practice](https://papers.ssrn.com/sol3/papers.cfm?abstract%5Fid=3189696&ref=thenexusofprivacy.net) builds upon the Principles to propose a working definition of design justice; their [Design Justice, A.I., and Escape from the Matrix of Domination](https://jods.mitpress.mit.edu/pub/costanza-chock?ref=thenexusofprivacy.net) is an outstanding introduction. ![A map of the US with hundreds of orange circles of various sizes](https://thenexusofprivacy.net/content/images/2026/04/separados.jpg) Torn Apart / Separados visualization of locations of ICE facilities across the US [Torn Apart / Separados](http://xpmethod.plaintext.in/torn-apart/?ref=thenexusofprivacy.net) visualizes the geo-spatial, financial, and infrastructural dimensions of immigrant detention in the US in the wake of the Trump Administration’s “zero tolerance” policy. The map above is just one of their visualizations of the locations of ICE facilities and private detention centers, based on aggregating and cross-referencing publicly available data. [Textures](http://xpmethod.plaintext.in/torn-apart/textures.html?ref=thenexusofprivacy.net) has context from the project team; [Emily Dreyfuss](https://medium.com/u/a77087b77b91?ref=thenexusofprivacy.net)’ *Wired* article [ICE Is Everywhere: Using Library Science to Map the Child Separation Crisis](https://www.wired.com/story/ice-is-everywhere-using-library-science-to-map-child-separation/?ref=thenexusofprivacy.net) is an outstanding overview of the project’s beginning; and Lindsay McKenzie’s [Digital humanities for social good,](https://www.insidehighered.com/news/2018/07/09/when-digital-humanities-meets-activism?utm%5Fsource=Inside+Higher+Ed&utm%5Fcampaign=12a40b6442-DNU%5FCOPY%5F01&utm%5Fmedium=email&utm%5Fterm=0%5F1fcbc04421-12a40b6442-198605973&mc%5Fcid=12a40b6442&mc%5Feid=3bf4bb4eff) on *Inside Higher Ed*, has some excellent context for how Torn Apart / Separados and other digital humanities projects are challenging perceptions of the field. --- \* Alex Ahmed and I first met via an earlier version of this page. How meta is that? --- *Originally published at* [*A Change Is Coming*](http://achangeiscoming.net/2016/12/07/gender-hci-feminist-hci-post-colonial-computing/?ref=thenexusofprivacy.net)*. Thanks to @farbandish for* [*the excellent suggestions*](https://twitter.com/farbandish/status/1021525429927067648?ref=thenexusofprivacy.net)*!* ### 4 Things Diaspora can learn from Google+ URL: https://thenexusofprivacy.net/4-things-diaspora-can-learn-from-google/ Last updated: 2026-04-15T22:20:11.000Z *Part 2 of *A Crucial Time for Diaspora*. Originally posted on* [*Liminal States*](http://www.talesfromthe.net/jon/?p=3120&ref=thenexusofprivacy.net)*.* > This weekend I received an invitation through Facebook to join Diaspora. I had tried to join Diaspora last year when I learned about their Kickstarter success while writing my book on crowdsourcing, but I couldn’t get in. So of course I was curious and went immediately to sign up. > > And then I was puzzled. Diaspora looked just like…Google+. Or did Google+ look just like Diaspora? > > — Aliza Sherman, [Google+ meet Diaspora – or maybe you know them already?](http://babyfruit.typepad.com/mediagirl/2011/09/google-meet-diaspora-or-maybe-you-know-them-already.html?ref=thenexusofprivacy.net) Yeah really. Dan Tynan has similar comments in [Will the real anti-Facebook please stand up?](http://www.itworld.com/it-managementstrategy/197329/will-real-anti-facebook-please-stand?ref=thenexusofprivacy.net) Given that G+ emerged some seven months *after* Diaspora went public, I'm guessing Google was taking notes. Sure, the basic idea of having Aspects (in Diaspora) or Circles (in Google+) to organize your acquaintances isn't new,\* but G+'s web layout sure looks a heckuva lot like Diaspora's. What’s that they say about [the sincerest form of flattery](http://www.phrases.org.uk/meanings/imitation-is-the-sincerest-form-of-flattery.html?ref=thenexusofprivacy.net)? And conveniently enough, a large corporation has just spent millions of dollars on a “field test” that offers plenty of learning for Diaspora. Thanks, Google! So last week I started asking people what they thought Diaspora could learn from Google+. Since then Kathy, Helena, Greg, Amy, Stephen, Gretchen, Dan, Paul, Andreas, David, Cindy, Geeky, powlsy, Drew, Terry, Sylvia, Edward, Anne, Hrafn, Shiyiya, Cavlec, Wiring, Madeleine, @PRC\_Amber, @blakereidm, Arvind, Dan, and many others came up with new suggestions and refined the list in discussions on Google+, Dreamwidth, Diaspora, Twitter, earlier draft, and email. Thanks to everybody who got involved! As usual, the majority of the good ideas came from others; all of the clunkers and mistakes are mine. The Diaspora team’s getting a ton of feedback these days — [130 responses just since yesterday](https://diasp.org/posts/230127?ref=thenexusofprivacy.net). Feedback from early users and passionate supporters is a sign that they want you to succeed, and the best roadmap to improving the product. At the same time, though, there’s only so many hours in the day; and my guess is the team’s list of tasks to accomplish is already more than full. So I’ve tried to concentrate here on a handful of areas with fairly immediate impact that won’t add much work for the core team and where the community can do the bulk of the heavy lifting. Without further ado, here they are. # 1\. Focus on the “new user experience” Google+ got 25,000,000 people to sign up in the first few weeks, but only a few million stayed. In the comments to the fascinating “[feedback Friday](https://plus.google.com/109895887909967698705/posts/4N3DAT5ydBS?ref=thenexusofprivacy.net)” thread community manager Natalie Villalobos kicked off last month, a lot of people talk about how difficult the experience is for new people, especially if their friends aren’t there yet. Where are the discussions happening? How do you meet others? Who’s interesting to follow? Diaspora’s got the same challenges — even moreso, because it’s so hard to find good help information. There are good resources out there [on Diasporial](http://diasporial.com/tutorials/connecting-diaspora-to-other-services?ref=thenexusofprivacy.net) and elsewhere (Elo­ísa Valdes has a nice [short list](https://diasp.org/posts/215986?ref=thenexusofprivacy.net)), but no way for new people to discover them. And as Twitter and now Google+ are discovering, a “[suggested users list](http://www.talesfromthe.net/?p=3033&ref=thenexusofprivacy.net)” is fraught with peril. A few straightforward things could help a lot here: - have a “welcome” message for each new user, pointing them to resources and giving some suggestions for getting started. Ideally this would be something that’s easy for individual pod administrators to customize to add their own twist to it. - more awareness of and easier access to the #help hashtag. Perhaps a link in the top right menu? - since a lot of people still have most of their friends on Facebook, publicize Friendrika and other ways of bridging the gap - create a volunteer-led “welcoming committee” to greet new users, help them through the inevitable gotchas, and answer questions\* # 2\. Make it easier for people to extend the system and host their own pods Different people prefer different ways of interacting with the system — dense information vs white space; text-heavy vs. image-heavy; comments expanded or contracted by default; and so on. From very early on, Chrome extensions like [G+me](https://chrome.google.com/webstore/detail/oacdcllhgpddmlnhajiacfakhlilbicp?ref=thenexusofprivacy.net), [Plus Minus](https://chrome.google.com/webstore/detail/pidkbnhjgdngcfcaikoocdanfijkgdli?ref=thenexusofprivacy.net), [Auto-colorizer](https://chrome.google.com/webstore/detail/amhpngpcnpkpfhchniggoncicagacnkc?ref=thenexusofprivacy.net), and the all-important [Troll remover](https://chrome.google.com/webstore/detail/fadjoojmlelmmmibangomfobihpphdhh?ref=thenexusofprivacy.net) make a huge difference in Google+’s usability. Some good examples and instructions — as well as better visibility for [the extensions people are already working on](http://groups.google.com/group/diaspora-dev/browse%5Fthread/thread/c88412d39a2c27a6/fb3e0fd70599fb7d?lnk=raot&ref=thenexusofprivacy.net) — could unleash the same creativity in the Diaspora\* world.\*\* One of Diaspora’s big advantages over Google+ is that people can install it themselves and run small pods for friends, families, clubs, churches, or roller derby teams. But for people to really take advantage of it, the installation needs to be as easy as WordPress\*\*\* and ideally offer “one-click” installation — on Amazon, Heroku, and eventually ISP as well. There are lots of sysadmins and IT professionals in the early Diaspora\* community who have a much better idea about what’s needed on this front than I do. Is there a way for a working group of them to take the lead here? # 3\. Get ready for trolls, hate speech, harassment, and spammers Remember when Google thought that its odious “real name” policy would cut down on bad behavior? Hahahahahaha. Soon enough, just like every other online site, there was plenty of ugliness — and unlike Live Journal, Dreamwidth, Slashdot, or even the old Usenet groups with their killfiles, there aren’t any good tools to deal with it. But as weak as Google’s moderation tools and [processes for reporting harassment](https://plus.google.com/103325808503679220346/posts/DtyapmgRiJ7?ref=thenexusofprivacy.net) are, they’re still a step up on Diaspora\*. So far, [nothing’s been implmented in Diaspora\*](http://getsatisfaction.com/diaspora/topics/block%5Fhide%5Fusers?ref=thenexusofprivacy.net); the vague description of [what’s planned for pre-bata](https://github.com/diaspora/diaspora/issues/1734?ref=thenexusofprivacy.net) makes it seem like it’s repeating Google+’s mistakes (see [Kee Hinckley](https://plus.google.com/117903011098040166012/posts/G45xDb18yWf?ref=thenexusofprivacy.net), [Linda Lawrey](https://plus.google.com/102533732658641069172/posts/PZdupChgcTC?ref=thenexusofprivacy.net), and [Lauren Weinstein](https://plus.google.com/114753028665775786510/posts?ref=thenexusofprivacy.net) for the problems with this approach). This would be a great place to follow Dreamwidth’s model for community-driven discussion and design and come up with a better specification before the team implements something ineffective. And not to sound like a broken record or anything, but it would be great to have the equivalent of [Troll Remover](https://chrome.google.com/webstore/detail/fadjoojmlelmmmibangomfobihpphdhh?ref=thenexusofprivacy.net) for Diaspora. As for spammers, all those [pretty women just out of college who love to advertise Southwest Air](https://plus.google.com/113117251731252114390/posts/ep39RCgR7RC?ref=thenexusofprivacy.net) are going to discover Diaspora soon enough. What’s the strategy to deal with spammers signing up on open pods? What happens when spammers start to set up pods of their own and add people to their aspects? And are pods vulnerable to spammers hacking into them? If the “privacy friendly social network” turns into a spam factory, it’ll be a huge blow to Diaspora’s momentum. Once again, this seems like an opportunity for the community to take the lead. There are plenty of early Diasporans who have hosted forums or run blogs and other sites that have dealt with spam. And while I haven’t seen a lot of security experts there so far, a lot of hackers support Diaspora’s goals, and I have to believe that reaching out to them could help with security testing as well . Even something as simple as a weekly “hack this pod” contest could start getting the community involved in discovering problems before the spammers do. # 4\. Reach out to the people Google’s ignoring It’s a huge challenge for any new social network these days to attract an audience. There are so many sites out there already … who has time for one more? So it makes sense to start by working with people whose needs *aren’t* getting met today. Google+’s core demographics are techies, 20-45 year old guys, affluent “kids and cabernet” couples, and social media experts. Diaspora’s likeliest successes are with everybody else. More specifically, the estimated 40% of people online who prefer “screen names” or pseudonyms are an really good target audience right now. Geek Feminism’s excellent list of [Who is harmed by a “Real Names” policy](http://geekfeminism.wikia.com/wiki/Who%5Fis%5Fharmed%5Fby%5Fa%5F%22Real%5FNames%22%5Fpolicy%3F?ref=thenexusofprivacy.net) and the “Who’s affected?” list on [My Name is Me](http://my.nameis.me/?ref=thenexusofprivacy.net) can be the basis of a great outreach and recruiting plan. It’s not rocket science to reach out to a community — especially if there some passionate early adopters already on Diaspora. A few basics: - Work with people in the community to come up with scenarios and personas highlighting showing how Diaspora helps with the challenges people have today - Blog posts and articles from people within the community to raise awareness - Lists of people within the community who are already on Diaspora\* to help newcomers get involved - Set up a virtuous cycle by providing ways for the community to influence the design and development of future versions of the product - Set up a pod specifically for this community Women (who are 25 times more likely to be harassed online than men), LGBTQs (at risk for bullying or worse — and already likely to look on Diaspora\* favorably because gender is a text field), and activists could be good groups to start with. There are lots of other possibilities as well. # An interesting next few months … Needless to say, these suggestions are only the tip of the iceberg. There’s a ton of stuff that needs to be done on the product side, including dealing with [questions about security](https://joindiaspora.com/posts/404422?ref=thenexusofprivacy.net). And there’s plenty of marketing as well. In a comment on an earlier draft of this post, Dan Tynan suggested “Get Robert Scoble to be your cheerleader. Or Om Malik, or Guy Kawasaki, or one of those other guys.” Indeed! And maybe also some women … Will the Diaspora team and community step up to the challenge? I’m optimistic. As I said in [A crucial time for Diaspora\*](http://www.talesfromthe.net/?p=3122&ref=thenexusofprivacy.net) > There are plenty of people (including me!) who are passionate about what open-source distributed social networks mean for intellectual freedom. And just as importantly, there are plenty of people (also including me!) whose social networking needs aren’t being met right now. One way or another, it’ll be an interesting time for Diaspora\* over the next few months. Stay tuned! jon image from Giorgio \* [via Diaspora\*](https://diasp.org/people/27634?ref=thenexusofprivacy.net) \* Ardith Goodwin is piloting this on Google+; free-association.net, and no doubt other sites, have used similar approaches in the past. \*\* Speaking of which, even a limited read-only API that’s likely to change over time can lead to exciting apps like Mohamed Mansour’s [Stream+](https://plus.google.com/116805285176805120365/posts?ref=thenexusofprivacy.net), developed and released the same day Google published their API. I realize that API design is challenging, but at this there’s a lot of value in something that’s temporary and “good enough”. \*\*\* Cindy Brown suggested WordPress as a model on G+; Dan Patterson goes into more detail [in a comment on *Read Write Web*](http://www.readwriteweb.com/archives/how%5Fcan%5Fdiaspora%5Fhelp%5Fus%5Fin%5Fa%5Ffacebook%5Fand%5Fgoogle.php?ref=thenexusofprivacy.net#comment-308678821)*,* and