Privacy Advocate Confronts ACLU Over Its Use of Google and Facebook's Targeted Advertising (twitter.com) 20
Ashkan Soltani was the Chief Technologist of America's Federal Trade Commission in 2014 — and earlier was a staff technologist in its Division of Privacy and Identity Protection helping investigate tech companies including Google and Facebook
Friday on Twitter he accused another group of privacy violations: the nonprofit rights organization, the American Civil Liberties Union. Yesterday, the ACLU updated their privacy statement to finally disclose that they share constituent information with 'service providers' like Facebook for targeted advertising, flying in the face of the org's public advocacy and statements.
In fact, I was retained by the ACLU last summer to perform a privacy audit after concerns were raised internally regarding their data sharing practices. I only agreed to do this work on the promisee by ACLU's Executive Director that the findings would be made public. Unfortunately, after reviewing my findings, the ACLU decided against publishing my report and instead sat on it for ~6 months before quietly updating their terms of service and privacy policy without explanation for the context or motivations for doing so. While I'm bound by a nondisclosure agreement to not disclose the information I uncovered or my specific findings, I can say with confidence that the ACLU's updated privacy statements do not reflect the full picture of their practices.
For example, public transparency data from Google shows that the ACLU has paid Google nearly half a million dollars to deliver targeted advertisements since 2018 (when the data first was made public). The ACLU also opted to only disclose its advertising relationship with Facebook only began in 2021, when in truth, the relationship spans back years totaling over $5 million in ad-spend. These relationships fly against the principles and public statements of the ACLU regarding transparency, control, and disclosure before use, even as the organization claims to be a strong advocate for privacy rights at the federal and state level. In fact, the NY Attorney General conducted an inquiry into whether the ACLU had violated its promises to protect the privacy of donors and members in 2004. The results of which many aren't aware of. And to be clear, the practices described would very much constitute a 'sale' of members' PII under the California Privacy Rights Act (CPRA).
The irony is not lost on me that the ACLU vehemently opposed the CPRA — the toughest state privacy law in the country — when it was proposed. While I have tremendous respect for the work the ACLU and other NGOs do, it's important that nonprofits are bound by the same privacy standards they espouse for everyone else. (Full disclosure: I'm on the EFF advisory board and was recently invited to join EPIC's board.)
My experience with the ACLU further amplifies the need to have strong legal privacy protections that apply to nonprofits as well as businesses — partially since many of the underlying practices, particularly in the area of fundraising and advocacy, are similar if not worse.
Soltani also re-tweeted an interesting response from Alex Fowler, a former EFF VP who was also Mozilla's chief privacy officer for three years: I'm reminded of EFF co-founder John Gilmore telling me about the Coders' Code: If you find a bug or vulnerability, tell the coder. If coder ignores you or refuses to fix the issue, tell the users.
Friday on Twitter he accused another group of privacy violations: the nonprofit rights organization, the American Civil Liberties Union. Yesterday, the ACLU updated their privacy statement to finally disclose that they share constituent information with 'service providers' like Facebook for targeted advertising, flying in the face of the org's public advocacy and statements.
In fact, I was retained by the ACLU last summer to perform a privacy audit after concerns were raised internally regarding their data sharing practices. I only agreed to do this work on the promisee by ACLU's Executive Director that the findings would be made public. Unfortunately, after reviewing my findings, the ACLU decided against publishing my report and instead sat on it for ~6 months before quietly updating their terms of service and privacy policy without explanation for the context or motivations for doing so. While I'm bound by a nondisclosure agreement to not disclose the information I uncovered or my specific findings, I can say with confidence that the ACLU's updated privacy statements do not reflect the full picture of their practices.
For example, public transparency data from Google shows that the ACLU has paid Google nearly half a million dollars to deliver targeted advertisements since 2018 (when the data first was made public). The ACLU also opted to only disclose its advertising relationship with Facebook only began in 2021, when in truth, the relationship spans back years totaling over $5 million in ad-spend. These relationships fly against the principles and public statements of the ACLU regarding transparency, control, and disclosure before use, even as the organization claims to be a strong advocate for privacy rights at the federal and state level. In fact, the NY Attorney General conducted an inquiry into whether the ACLU had violated its promises to protect the privacy of donors and members in 2004. The results of which many aren't aware of. And to be clear, the practices described would very much constitute a 'sale' of members' PII under the California Privacy Rights Act (CPRA).
The irony is not lost on me that the ACLU vehemently opposed the CPRA — the toughest state privacy law in the country — when it was proposed. While I have tremendous respect for the work the ACLU and other NGOs do, it's important that nonprofits are bound by the same privacy standards they espouse for everyone else. (Full disclosure: I'm on the EFF advisory board and was recently invited to join EPIC's board.)
My experience with the ACLU further amplifies the need to have strong legal privacy protections that apply to nonprofits as well as businesses — partially since many of the underlying practices, particularly in the area of fundraising and advocacy, are similar if not worse.
Soltani also re-tweeted an interesting response from Alex Fowler, a former EFF VP who was also Mozilla's chief privacy officer for three years: I'm reminded of EFF co-founder John Gilmore telling me about the Coders' Code: If you find a bug or vulnerability, tell the coder. If coder ignores you or refuses to fix the issue, tell the users.
This is why the ACLU stopped getting my money (Score:1)
And the EFF gets it instead now.
Re: (Score:1)
I think Google reports directly to Lucifer, and Ba'al Zebûb is just another VP.
Re: (Score:2)
I stopped giving because at the time, I took a good look at their website and realized they simply take credit for any kind of civil rights case in the media, because at one time, they publicly said they "support" the defendant or issue or whatnot, despite not providing anything but lip service.
Re: (Score:2)
Re: (Score:2, Interesting)
I was particularly offended when they split the organization surreptitiously so that donations you thought were going to pro bono work were instead funding lavish dinners and vacations for ACLU execs.
Re: (Score:1)
Funny, I did the same some years ago, but I won't give any more money to the EFF after their attacks on RMS. The amount of flak he got over such minor inconveniences to convention attendees--which he admitted fault for and apologized--is nothing short of religious zealots thirsting for blood.
Constituent Information (Score:2)
Excuse my ignorance, but what is "constituent information?" Is it just a way of saying their membership list, or something else? What other information does ACLU have to share with advertising companies?
Re: (Score:1)
Just because they're an organization of legal experts doesn't mean they expect people to read the EULA and find out it's bunk.
Re: (Score:1)
I work for a non-profit related company (though not ACLU), and yes, "constituents" in this case are people interacting with the non-profits. So, donors and others that have ended up on their lists.
Re: (Score:2)
Thanks! That's what I was asking.
ACLU opposed the CPRA (Score:2)
The irony is not lost on me that the ACLU vehemently opposed the CPRA — the toughest state privacy law in the country — when it was proposed.
That link points to the ACLU's write-up claiming that "Proposition 24" is not a tough privacy law. I assume "CPRA" is the same as "Proposition 24" in this context. Does anyone have any information as to the summary's claims that it was indeed a tough privacy law? Without that, the post actually undermines its own point.
P.S. This is why Twitter is stupid: even if I click the link, I can't read the entire article because it is broken across a whole bunch of tweets. Twitter interjects everyone's responses
Re: (Score:2)
If I, on the other hand, click the llink, I can't even read the first part. That's because, last December, Twitter disabled their "legacy twitter" optional mode. Now I'd have to give them permission to run javascript on my browser to read tweets - and there's NO WAY I'd do that for a company that makes billions analyzing and selling the info their spyware collects from their users.
Between Twit
Re: (Score:2)
Truth about ACLU (Score:2)
This is not your grandfather's ACLU. Not even your dad's. This ACLU was taken over by woke activists in the pursuit of big bucks from leftist donors. This ACLU is now actually the combat operation of the leftmost wing of the Democratic Party. ACLU old guard have condemned them. Do not be fooled by the name.