Danielle Citron is a professor of law at the University of Virginia School of Law, where she specializes in privacy and civil rights. Her new book, The fight for privacy: protecting dignity, identity and love in our digital age, outlines the 21st-century assault on privacy by “Spying Inc,” companies, governments and individuals seeking to exploit and profit from our most sensitive data. She argues that intimate privacy should be enshrined as a civil right in the United States.
We hear a lot about companies harvesting our data, but your book still manages to shock you when it reveals the extent of the practice. You emphasize, for example, that our web browsing history is essentially public and can be purchased by any motivated party. In addition, the dating app Grindr shared information about users’ HIV status with third-party data brokers before it was caught.
We don’t deeply understand how companies and governments control our lives, accumulating intimate information about our bodies, our health, our closest relationships, our sexual actions, and our innermost thoughts. The companies sell this information to data brokers, who compile a dossier of about 3,000 data points on each of us, including whether we’ve been raped, used sex toys, or had abortions or miscarriages.
They estimate our likelihood of developing type 2 diabetes and heart disease, or the likelihood of us being in the hospital in the next six months. They rate us based on how long we stay on adult sites and what our sexual interests are. This information is used, for example, by third-party employment services that help employers search for CVs or by insurers. There are jobs we never interviewed for, or life insurance premiums we didn’t know would increase with this information.
Is the situation the same in the UK?
The UK’s General Data Protection Regulations require consent to be obtained before processing sensitive and personal data, and the UK’s Information Commissioner’s Office has audited three of the biggest credit bureaus. Two have agreed to stop processing confidential data, and one does not agree. But the ICO did not investigate each of the 1,000 data brokers. Protection by enforcement is of a point nature.
You write that this information is used by US law enforcement agencies to create legal cases without the requirement for warrants or subpoenas. This practice is even more troubling after the recent overturning of Roe v Wade, states are now criminalizing abortion. What data will be used against women?
If you travel across state lines or go to another city and visit a medical facility or abortion provider, your phone’s location data indirectly tells the story that you went to get an abortion. If you go to the pharmacy for medicine and sanitary pads on the same day, your purchases can be tracked. For example, if you have a rewards card, you get “discounts” on your purchase history, which is stored and sold to advertisers and data brokers. A third of girls and women in the United States use period tracking apps, and this could be a weapon against them. The story of pregnancy and termination is a story told by data.
Since Roe v. Wade was overturned, we’ve seen an attempt to force period-tracking apps and online companies to commit to protecting users from law enforcement. What meaningful actions could these companies take?
I believe the law should step in to prohibit the collection and sale, especially of reproductive health data and location data. They may process what is necessary to provide the service to you, but they must not store the data, because then law enforcement cannot obtain it with a subpoena or warrant.
At the core of your book this is the concept of intimate privacy. How do you define it?
This is the privacy that is available for our intimate life. This includes our bodies, our minds, our intimate relationships, sexual activity, innermost thoughts, fantasies, emotions, and communication. How we document this in the digital age is, of course, our searching, our browsing, all our digital communications.
Privacy is essential to human flourishing, democratic citizenship and equality. If you are unable to set boundaries around these aspects of intimate privacy, it is difficult to develop yourself. I can’t say it better than Charles Fried, a law professor at Harvard Law School, who said that privacy is the oxygen for love. We fall in love when we become mutually vulnerable and share information with each other, including things we wouldn’t share with anyone else. The argument of the book is that without intimate privacy we are shells of ourselves. We cannot participate in citizenship.
Internet companies and data brokers violate this type of privacy every day, but your book also talks about more targeted attacks, such as revenge porn, where people share intimate photos or videos of others online. It highlights how Section 230, a piece of US law that has been at the center of the debate over social media content moderation in recent years, protects this type of content.
Section 230 of the Communications Decency Act makes it impossible to sue the party best placed to minimize the harm of sharing intimate information without an individual’s consent: the content platform. You cannot request that a site remove nude photos of you that are posted without your permission. The site makes money from your photo, they make money from the data of everyone who follows or visits it, but they can say, “Sorry, too bad.”
In the UK, the Internet Safety Bill has yet to be passed, so victims cannot bring legal action against platforms that host pornography without consent. If it passes, [platforms] may be required to take care to mitigate the risks of online harm. [But] today, criminals can post on UK and US sites without fear.
After 25 years of Section 230’s legal shield, we must recognize that while it has encouraged and enabled all kinds of speech and action online, speech also costs a lot. Cyberbullying, invasion of privacy, and stalking victimize people offline, often women and minorities. We have clear empirical evidence that the status quo is costing civil liberties and civil rights dearly.
We are in a cultural time where many people find it socially acceptable to share images of strangers online. Your book is specifically about intimate privacy, but do you think it’s related?
Part of the book is legal and talking to industry, but it’s also about culture, right? Changing the law in each of us. Because we’re careless, and if it doesn’t happen to us – the shame, the stigma, the embarrassment – it’s hard for people to understand. It should become a lifelong education. Because we humans have such a great potential for joy and love and kindness, but we also have such a great potential for cruelty.
Fighting for Privacy: Protecting Dignity, Identity and Love in the Digital Age Daniel Keats Citron is published by Chatto & Windus (£18.99). To support Guardian and Observer order your copy at guardianbookshop.com. Shipping charges may apply