A significant number of Americans hold significant misconceptions about their privacy, according to opinion research — misconceptions that privacy-invading companies love. That’s according to research on American understandings of privacy carried out over the past couple decades by the Annenberg School for Communication at the University of Pennsylvania, lead by Prof. Joseph Turow, whom I recently heard give a talk summarizing these studies.

Misconception #1: “We care about your privacy!”

One misconception is that when a web site has a “privacy policy,” that actually means the site has a policy to protect your privacy. Annenberg presented respondents with the false statement that “When a web site has a privacy policy, it means the site will not share my information with other websites or companies without my permission.” In 2018, nearly 60 percent of Americans either said they believed this was true, or that they did not know. In past years the percentage of those surveyed giving incorrect answers was as high as 78 percent.

Unfortunately, nothing could be further from the truth. Most “privacy” polices start by declaring, “We care about your privacy!” and then go on to say, in extremely long and complicated legal language, that you have no privacy. Lawyers write these policies to minimize the presence of any actual concrete promises that might limit what a company does. Because the United States doesn’t yet have a baseline privacy law, the only thing protecting our privacy in most commercial contexts is a prohibition on “acts or practices that are unfair or deceptive.” That prohibition was enacted in 1914 — just slightly before the advent of today’s online advertising surveillance systems. What that means is that (outside of a few narrow areas that are regulated such as credit reporting) a company can do whatever it wants with your personal information. The only thing it generally cannot do under federal law is say it’s going to do one thing and then do another, which would count as “unfair or deceptive,” and leave a company vulnerable to enforcement by the Federal Trade Commission.

Turow says that “marketers know” about this misconception and benefit from the confusion and the misplaced consumer trust it creates. Turow suggests that “privacy policy” is “a deceptive term” and that “the FTC should require a change in the label.” “How We Use Your Data” would be more accurate.

Misconception #2: What is unfair is also illegal.

A second misconception that many Americans hold is that the law protects them more than it does. For example, in 2015, 62 percent of Americans didn’t know that it is completely legal for an online store to “charge different prices to different people at the same time of day”; in 2012, 76 percent did not know that “online marketers are allowed to share information about diseases you or your family members have”; and in 2018, 46 percent did not know that an “internet provider has a legal right to sell information to marketers about the websites you visit.” (We think they actually don’t have such a right under the Communications Act, which states that “every telecommunications carrier has a duty to protect the confidentiality” of personal information — but an attempt to craft detailed rules enforcing that law was killed by Congress and President Trump in 2017, and there’s no sign that such a right will be enforced by the federal government anytime soon.)

What’s going on here, Turow believes, is that people have fairly well-defined feelings about what kinds of behavior are fair and what are not — and they tend to think that things that are unfair are also illegal. They think, as he puts it, that the government has our backs much more than it actually does.

Annenberg’s polling confirms other polling in consistently finding that people are deeply uncomfortable with the state of their privacy online. Two-thirds (66 percent) of adults, for example, told surveyors that they do not want advertisements “tailored to their interests,” and 91 percent disagreed with the statement that “if companies give me a discount, it is a fair exchange for them to collect information about me without my knowing.” Asked whether “It’s okay if a store where I shop uses information it has about me to create a picture of me that improves the services they provide for me,” 55 percent disagreed.

These findings, Turow concludes, “refute marketers’ insistence that Americans find increased personalized surveillance and targeting for commercial purposes acceptable.”

So why do people give up so much information? The problem is that they feel helpless. The surveys found that 58 percent of Americans agreed with the statement, “I want to have control over what marketers can learn about me online” — but at the same time 63 percent also agreed, “I’ve come to accept that I have little control over what marketers can learn about me online.” Although marketers like to portray Americans as cheerfully accepting a tradeoff between their privacy and the benefits they gain, that’s not at all what’s happening. As Turow told me, “The bottom line for us is resignation. It’s not as if people want to give up their privacy, but in order to get through life they feel they have to, and they don’t feel like they have the ability to change things.”

Misconception #3: We’ve lost the privacy battle.

This, I would argue, is the third misconception: that the battle is lost and there’s nothing people can do about protecting their privacy. It’s true that there are good reasons why people feel that way — there’s only so much that an individual can do to protect their privacy, especially if they’re short on technical expertise or willingness to tolerate inconveniences in order to fight surveillance. It’s true that our privacy depends to a large extent not on individual decisions but on collective decisions we make as a nation about the policies we want to set. It’s also true that the companies that profit from surveillance are wealthy and politically powerful.

Nevertheless, the clouds are gathering for a major reckoning. The European Union has enacted a  comprehensive privacy law called the General Data Protection Regulation (GDPR) that is forcing even many U.S.-centered businesses to improve their privacy practices. California, where one in eight Americans live, has also enacted a broad privacy law called the California Consumer Privacy Act (CCPA). And as these laws weaken the will of companies to oppose privacy protections, scandals such as the Cambridge Analytica fiasco have strengthened the desire of politicians across the political spectrum to support such rules. The result: For the first time in many years, members of both parties are reportedly working to draft and enact comprehensive privacy legislation. 

There are major battles ahead, but, as I have argued, in the end people need — and always demand — privacy. Privacy-invading companies love it that people feel helpless, but now is the time for people to trade resignation for anger and activism, and voice that demand to ensure that any new privacy laws are strong and meaningful. The status quo is not stable, and the battle is just getting underway.

Jay Stanley, Senior Policy Analyst, ACLU Speech, Privacy, and Technology Project

In a major victory for privacy rights, a federal court has held that the federal government’s suspicionless searches of smartphones, laptops, and other electronic devices at airports or other U.S. ports of entry are unconstitutional. The ruling in our case is a recognition that the Constitution protects us even at the border, and that traveling to or from the United States doesn’t mean we give the government unfettered access to the trove of personal information on our mobile devices.

BREAKING: In a major victory for privacy, a federal court ruled today that the government’s suspicionless searches of international travelers’ smartphones and laptops at airports and other U.S. ports of entry violate the Fourth Amendment. pic.twitter.com/SJDIERJdV5

— ACLU (@ACLU) November 12, 2019

_{To prevent tracking by Twitter, we are showing a preview. See original tweet.}

In recent years, as the number of devices searched at the border has quadrupled, international travelers returning to the United States have increasingly reported cases of invasive searches. For instance, a border officer searched our client Zainab Merchant’s phone, despite her informing the officer that it contained privileged attorney-client communications. And recently, at Boston Logan Airport, an immigration officer reportedly searched an incoming Harvard freshman’s cell phone and laptop, reprimanded the student for his friends’ social media posts expressing views critical of the U.S. government, and denied the student entry into the country following the search.

These cases aren’t unique. Documents and testimony we and the Electronic Frontier Foundation obtained as part of our lawsuit challenging the searches revealed that the government has been using the border as a digital dragnet. CBP and ICE claim sweeping authority to search our devices for purposes far removed from customs enforcement, such as finding information about someone other than the device’s owner.

The court’s order makes clear that these fishing expeditions violate the Fourth Amendment. The government must now demonstrate reasonable suspicion that a device contains illegal contraband. That’s a far more rigorous standard than the status quo, under which officials claim they can rummage through the personal information on our devices at whim and with no suspicion at all.

It’s difficult to overstate how much personal information our electronic devices contain, and how revealing searches of those devices can be. Our smartphones are unlike any other item officers encounter at the border — they likely contain years of emails, messages, videos, photos, location data, browsing history, and medical and financial data. A search of our clients’ devices revealed photos of themselves without head coverings worn in public for religious reasons. Others had information on their devices related to their work as journalists.

The bottom line is that for most of us, our phones contain far more information than could be found during a thorough search of our homes.

The court recognized these critical privacy issues in its ruling. It stated that travelers’ privacy interests in their devices are “vast” and that “the potential level of intrusion from a search of a person’s electronic devices simply has no easy comparison to non-digital searches.” In other words: Digital is different. While the government can search luggage and other physical items at the border without individualized suspicion, it can’t use that authority to rifle through the universe of personal data on our electronic devices.

In reaching that conclusion, the court relied on recent Supreme Court decisions that make clear that older rules under the Fourth Amendment cannot be mechanically extended to justify new kinds of invasive digital-age searches. As the Supreme Court put it, equating searches of physical items and digital devices “is like saying a ride on horseback is materially indistinguishable from a flight to the moon.... Modern cell phones, as a category, implicate privacy concerns far beyond those implicated by the search of a cigarette pack, a wallet, or a purse.” The federal court explained this week that the magnitude of the privacy harms is no less great in the context of border searches, requiring stronger Fourth Amendment protections against searches of electronic devices at the border as well.

The court has not yet issued an order regarding how the government should implement the ruling.

Significant work remains to be done to ensure that government officials respect our constitutional rights in the digital realm and at the border. The court’s ruling is a big step in the right direction.

Hugh Handeyside, Senior Staff Attorney, ACLU National Security Project
Esha Bhandari, Staff Attorney, ACLU Speech, Privacy, and Technology Project,
& Nathan Freed Wessler, Staff Attorney, ACLU Speech, Privacy, and Technology Project

Following a hearing over two days on the issue of Senate Bill 7066, a federal judge in Tallahassee released an order in our favor on Oct. 18.

In court, our clients demonstrated that the law SB7066 unfairly denies their ability to register and vote in Florida elections. The most important immediate impact of the judge’s order is that the 17 named plaintiffs in the consolidated case can register and cast a ballot in upcoming city, state, and federal elections, but the order also opens a path for many others to regain their rights.

The unconstitutional law, SB7066, requires returning citizens with past felony convictions to not only finish their incarceration and probation but also pay any outstanding fines, fees and restitution before they can vote. In passing the bill earlier this year, members of the Florida Legislature undermined Amendment 4, which was approved by over five million Florida voters in November last year and which returned the ability to vote to as many as 1.4 million people. 

Our motion for preliminary injunction was based generally on two legal issues: the state can’t engage in wealth discrimination when it comes to voting, and the state has failed to establish a workable solution for returning citizens to know what fees, fines, and other money obligations, if any, they’re expected to pay pursuant to SB7066 before voting. Judge Robert Hinkle acknowledged these sometimes intractable difficulties and made quite clear that the denial of the right to vote cannot be based on someone’s inability to pay. 

Although the court’s specific injunction concerned the 17 named plaintiffs in the case, the order explained the requirements of the constitution, which must be followed by the state. As such, returning citizens who believe they’re being unconstitutionally prevented from voting may come forward and ask state officials to be included in our democracy. Our team is intent on helping the state ensure the opportunity to register and vote for  Florida’s 1.4 million returning citizens, especially for the hundreds of thousands whom we believe may owe money amounts that would prevent them from voting under Amendment 4. The State of Florida needs to enable these individuals to register in time to participate in upcoming opportunities to vote, including the March 17, 2020 presidential primary.

Beyond the work we’re doing to help make Judge Hinkle’s preliminary injunction a reality for all returning citizens, our team is continuing to prepare for the final hearing in the case, which is scheduled for the week of April 6, 2020. We expect there will be many opportunities to help decision makers correct the flaws in SB7066, so that Floridians can be confident in our election system for the important elections coming up throughout 2020.

Voting is a fundamental right. We are thankful for the constitutional safeguards that keep politicians from restricting the right to vote to only those people who can afford to pay for it.

We feel a huge sense of gratitude for our brave clients who stepped forward to share their stories and fight in court for the right to vote for all Floridians. The chance they have taken to fight for voting rights in our country is profoundly moving. Finally, we feel the support from the more than 5.1 million voters who made Amendment 4 the law of the land in Florida last Nov. 6. 

The goal line to protect the fundamental intent of Amendment 4 is in sight and we are going to get there together.