Slash Privacy Watch's Journal: Customer Profiling and the OSDN Privacy Policy

Does the Slashdot Customer Profile violate my Privacy?

It is strongly reccomended that you understand Slashdot Customer Profiles before asking this question. Now that you do, let's attempt to understand the answer.

The Right to Privacy is not guaranteed by the United States Constitution, and in America whatever "right" we may have had to privacy is rapidly dissapearing. Nowhere is this more true than on the Internet. However, many Americans value their privacy, and the courts have attempted to safeguard the privacy of citizens to some degree. However, "privacy" on the Internet is a subjective and hotly contested term, so any attempt to define it objectively will most likely fail.

Does the Slashdot Customer Profile violate the OSDN Privacy Statement?

This much more focused question can be easily answered. The Slashdot Privacy Policy is linked from the toolbar in the upper left hand corner of your web browser. Slashdot is part of VA Linux Inc.'s OSD Network, and is bound by OSDN's Privacy Policy. Let's examine the relevant portions of this policy:

With regard to personal information, users can view their data on their personal profile page.

This statement is empirically false. No user has ever been permitted to view his or her Slashdot Customer Profile "IP address history" field.

OSDN will track the domains from which people visit OSDN and analyze this data for trends and statistics.

This statement is empirically false. Slashdot does not track domain statistics in the aggregate, rather it profiles every customer and their IP address history for the purpose of gagging abusive content on a per-user or per-subnet basis.

Subject to the provisions of this Privacy Policy, different OSDN sites may use accumulated data for different purposes, including but not limited to marketing analysis, service evaluation and planning.

This statement is true, but misleading. Tracking and gagging users by IP address is certainly a "different purpose", and it is clearly stated that use of per-customer information includes but is not limited to the stated purposes. One must wonder what the other unstated purposes are?

General: In cases where users voluntarily and publicly disclose personal information which may contain Registration Data or otherwise post personal information in conjunction with content subject to an open source license, such personal information necessarily will be disclosed subject to the terms of the applicable license.

Keep in mind that your IP address history is not a "voluntarily disclosed" piece of information: you are forced to disclose an IP address when you interact with a web site. Therefore IP address histories are not bound by this clause.

At OSDN, we intend to give you as much control as possible over your personal information, including the Registration Data

It is not possible to change, modify, or "opt out" of having your IP address history stored in your Slashdot Customer Profile. Therefore, we must understand this statement to mean "OSDN does not believe it is possible for a Slashdot user to check a box which opts them out of being profiled by IP address".

The simple answer to the question "Does the Slashdot Customer Profile violate the OSDN Privacy Statement?", therefore, is a resounding yes. The recent changes to Slashcode to profile every customer and their IP address history for the purpose of gagging abusive content on a per-user or per-subnet basis have only been made recently. It is therefore possible - nay, likely - that these changes have been made without a careful examination of the OSDN Privacy Policy.

Which brings any concerned privacy advocate to the obvious question: Should I be concerned about potential privacy violations on Slashdot? More importantly, should Slashdot users be given the option of "opting out" of being profiled? The answer is a resounding... perhaps .