Human Experimentation, Bypassing Ethics Standards

But it’s not just malign actors who enjoy privileged access to the private lives of social media users: academia has used Facebook as a loophole around human experimentation guidelines. At any time, you may be subjected to a social experiment by a private organization unbeholden to ethical guidelines, such as being shown purely negative news to observe your reaction. Researchers at Cornell University and the University of California, San Francisco, (“UCSF”) designed an experiment which would subject two groups of users to either mostly positive or negative content, and would observe the groups’ reactions, along with two other control groups. None of the participants were notified of this experiment, or compensated for it. You may feel an intuitive sense of outrage, or injustice at this- and you’d be correct, sociological or psychological experimentation in the United States ordinarily falls under the purview of the Institutional Review Boards (“IRBs”) and the Common Rule.

The Common Rule is the baseline standard of ethics by which any government-funded research in the US is held, but nearly all U.S. academic institutions hold their researchers to the Common Rule regardless of funding. The Common Rule stemmed from concerns arising from the Tuskegee Syphilis Study, where Black men were intentionally withheld medical care for their syphilis by doctors despite being told they would receive it. Although doctors knew at the time that penicillin would cure syphilis, they nevertheless did not inform the subjects of their diagnosis, and instead ran placebos and other ineffective treatments. However, Cornell and UCSF didn’t conduct the experiment, Facebook did. Although the universities designed it, and published their findings in the Proceedings of the National Academy of Sciences, the experiment is known as the Facebook Emotional Contagion Experiment, and since it was run by Facebook, it is not subject to IRBs or Common Rule ethical guidelines. 

Such a loophole would permit institutions bound by ethical guidelines to launder their sociological research through social media platforms and other private actors.

Such a loophole would permit institutions bound by ethical guidelines to launder their sociological research through social media platforms and other private actors. As previously seen, medical observations such as being the victim of rape, or having HIV is for sale by data brokers. Outside of the Common Rule and IRBs’ purviews, what would a data-driven Tuskegee Syphilis study look like today? Would you ever conceive on your survey answers on a shopping site being linked to your search history for a genetic disease? How would you engage with the online world when anything you say or do could be used against you?

The Panopticon

In a world of total data commodification, the boundaries between private acts and public ones blur. As Calli Schroeder puts it: “One of the major effects of being unable to create your own separations between who knows what about you is that anything that could meet with the disapproval of those watching you is repressed. We don’t always do it consciously – we’re wired to hide things that may hurt us. […] The ability to determine “this group of people gets this much of me, this group can see this, corporations get this, etc.” is an act of self-preservation. It allows us the freedom to explore new ideas, to change and grow, without the pressure of everyone watching and judging.” In short, we are not ourselves when we know we are being observed. Studies have shown that when people are reminded that they are under surveillance, they are much meeker in their opinions, and much more likely to conform to the prevailing social narrative. These studies first emerged in response to concerns about NSA surveillance and Edward Snowden- so why are we silent now?

Why Is This Tolerated?

According to Calli Schroeder, the problem is partially cultural. “In the EU, you see a lot more resistance to corporate surveillance. They are much, much more concerned about that and much less concerned than Americans typically tend to do to be about government surveillance.” As mentioned before, private actors are often used as workarounds for ethical or Constitutional protections. 

The answer is complex, but breaks down to two factors: necessity and apathy. The first, necessity, addresses an intuitive response to the issue of surveillance advertising: “Why don’t you just stop using services like that if you’re so worried about it?” As Kashmir Hill writes for the New York Times, it is (loosely) impossible. Google and Amazon have integrated themselves into the infrastructure of the internet- everything from fonts to entire website hosting relies on one of those two tech giants. Uber and Lyft rely on Google Maps, merchants outside of Amazon nevertheless use Amazon for fulfillment, and the Google/Apple duopoly on mobile phones means the alternative is a dumbphone, or a phone running an alternative operating system, both of which bring compatibility issues with modern necessities such as banking and navigation. In short, going without corporate surveillance means going without a smartphone, and the impracticalities that brings. 

The second factor, apathy, is usually experienced as “I don’t care if X is surveilling me.” As previously mentioned, while people may say they don’t care, sociological and psychological studies have shown that mass surveillance has a chilling effect on discourse and online behavior. When the Snowden leaks revealed the extent to which the National Security Agency collected domestic telephony records, the cultural response was largely one of apathy. In the wake of Snowden, Americans reported little confidence that their data was secure, or that they had a lot of control over how much information about their daily lives was being collected.

However in recent years people are growing less trusting of corporate surveillance, and increasing want government regulation. Increased regulation of tech companies is a surprisingly popular, bipartisan issue, with over 50% of Republican, Independent, and Democratic voters seeking it according to a 2021 Gallup Poll. So, what does effective regulation look like, and what do we have now?

Legislative Solutions

The European Union’s (EU) General Data Protection Regulation (GDPR) was the first and most significant data protection law Americans had exposure to. While not an American law, websites that want to do business with European internet users have to abide by it. As a result, websites either block European users, or apply GDPR to their entire website. The GDPR requires that websites must give users the ability to opt out of certain kinds of cookies, have a legitimate interest in collecting and retaining them, possess the minimum amount of data necessary, and other similar provisions focused on minimizing data collection or empowering data subjects to control how it is used.

Some websites clarify they will continue to sell your data against your consent if you are not a California resident. 

Another promising template for data protections is California’s Consumer Privacy Act (CCPA). It permits California residents to ask businesses to disclose what information a business has on them, what it has done with that information, as well as to delete or not sell that information. The ‘Do not sell my information’ button you may see (and hopefully use!) on websites are catering to the CCPA, and revealingly, some websites clarify they will continue to sell your data against your consent if you are not a California resident.

The EU’s ePrivacy Regulation (EPR) is an upcoming update to the GDMR, which requires uniformity of confidentiality across communication systems- whether you use a landline phone or Skype, your conversations should be guaranteed at the same level of privacy.  The EPR also standardizes protections for all users, whether individuals or businesses, bans spam calls, emails, and text messages, and anonymizes or deletes metadata such as time and location of a call. 

However laws, no matter how well-crafted, are meaningless without enforcement. As Schroeder, puts it: “There’s never enough enforcement […] there’s loopholes and gray areas. These companies pay corporate attorneys to find every loophole and gray area. If it exists, they’re going to find it. If there’s a way to challenge it, they’re going to challenge it.” In contrast, enforcement “agencies, and attorneys general…are frequently underfunded and cover way too much. They do not have the resources to cover the vast volume of violations out there.” 

However, the FTC has been reportedly underfunded and understaffed for years, their numbers being nearly halved by the end of the Reagan presidency, and remaining largely flat ever since.

Enforcement within the United States has primarily been through the Federal Trade Commission (FTC) as an extension of its duties under the Fair Credit Reporting Act. This includes when website owners fail to implement reasonable security measures to protect consumer information, illegally collect children’s sensitive health data, or when Facebook obfuscates user privacy options, seeking to prevent complaints or perceptions of surveillance, while nevertheless continuing to collect sensitive personal information. However, the FTC has been reportedly underfunded and understaffed for years, their numbers being nearly halved by the end of the Reagan presidency, and remaining largely flat ever since.

In comparison to the tech giants they seek to enforce, the FTC’s  entire 2021 budget was 0.49% that of Facebook/Meta, 0.19% of Google/Alphabet, and 0.07% of Amazon’s operating budgets. 

However, even if it receives the funding and staffing it direly needs to protect consumers’ privacy, the FTC is currently an incomplete solution to the surveillance threat in America. The FTC is primary concerned with consumers, and it protects privacy under Section 5 of the FTC Act, which prohibits “unfair or deceptive acts or practices,” the Fair Credit Reporting Act (FRCA), and the Children’s Online Privacy Protection Act (COPPA). If a privacy concern falls outside of this purview, such as a non-profit, or a common carrier (like AT&T, Verizon, or your internet service provider), the FTC is limited in its ability to protect the surveillance subject. 

One possibility is to expand the agency’s responsibilities, as Congress did in 1970 with the FRCA and again with COPPA in 1998. Such a possibility would require federal privacy laws and charter by which the FTC could hold companies responsible. Another option is the generation of an entirely new, specialized federal agency, like Germany’s Federal Commission for Data Protection and Freedom of Information, or the California Privacy Protection Agency. 

Lastly, states have demonstrated an interest in protecting their citizens’ privacy. State privacy cases are typically pursued by state Attorneys General, but as these offices are quickly overwhelmed, states have evolved their approaches. As mentioned, California has created its own agency responsible for enforcement of the CCPA, and Colorado has empowered not only the Attorneys General, but District Attorneys to pursue enforcement of the Colorado Privacy Act. While federal enforcement continues to lack, at least some state citizens have the option to control their data. However, this spotty coverage still allows for massive gaps in meaningful protection, a status quo that the surveillance advertising industry seeks to maintain.

Corporate Self-Regulation

Corporations which benefit from the privacy status quo are desperate to avoid strong privacy laws and regulations. To prevent or delay statutory response, corporations have made efforts to self-regulate, or to take advantage of the anger against surveillance by promising increased privacy. Apple recently distinguished its products from the competition by outright banning certain surveillance trackers and scripts. Google has somewhat followed suit when it agreed to dispense with third-party cookies from its popular Chrome browser, a move that will likely spell the end for that mode of surveillance advertising. 

However, most self-regulation moves appear to be privacy-washing otherwise profit-minded endeavors. Apple is the least offensive of these, retaining their Apple advertising ID to the exclusion of other trackers. Google, on the other hand, is attempting to mediate the needs of digital businesses and advertisers through its Privacy Sandbox, promising a method that allows relevant ads and privacy. Without naming Apple explicitly, Google criticizes Apple’s approach as ‘too blunt’ and ineffective. Facebook’s own self-regulation attempt through a review board has been considered a failure, designed to move slowly and with minimal impact to the giant while preserving the appearance of responsibility. Notably, the multibillion dollar tech giant uses the rhetoric of small businesses and minority views to justify continued surveillance advertising.

Between government regulation and corporate competition, there is a glimmering hope of the average user somehow deriving more privacy out of the melee. At a minimum, ‘third-party’ tracking, or inviting surveillance advertisers to a website and selling them the opportunity to observer users, will be heavily reduced in the future. But this is not a guarantee. The occlusion of third party advertisers may drive more data “capital” into the hands of first-party providers, or the actual websites which host the service or content accessed. A website like Amazon or Google would continue to find ways to gain data, whether through consent (like a banner which obfuscates a portion of the screen and defaults to ‘I accept all cookies’, or by making consent mandatory for use of services), or through offering to ‘buy’ the individual’s data from them. The latter possibility still puts impetus on the individual to understand the magnitude and possibilities of the data industry but pays them a negligible amount to ignore their concerns. As Schroder said in another interview, “I think that puts way too much responsibility on the individual, we don’t even know how much information gets collected and by who […] to have to track and parcel out portions of your data for different purposes puts too much of a time responsibility of people [..] and a lot of research responsibility on people”. 

The occlusion of third party advertisers may drive more data “capital” into the hands of first-party providers

In this scenario, the capabilities of the surveillance data industry are still being leveraged against the individual, but now the fruits are being concentrated in the hands of a few already-enormous first party data collectors. Without further legislation, these data collectors may be able to sell this data for even more profit. The issue isn’t just that too many organizations have access to our data (although this is true), but that this immensely useful data is available in the first place. But we need not watch the tech giants with hope in our eyes, praying that they mercifully relinquish this mechanism that causes untold suffering and threatens worse in the future.

What is to be Done?

The most complete solution at the governmental level is to ban behavioral advertising, data collection, data trading, and to provide significant enforcement resources. While beyond the scope of this article, governments dedicated to the integrity of their societies, the privacy of their citizens, and the preservation of their democracies should prevent the widescale collection, aggregation, and utilization of data in this manner. This is a vague, and grand charge, but there are starting points: for example, banning the transfer of consumer data between entities, including from parent company to child company, limiting the retention of sensitive data to a brief window, implementing a more active encryption scheme where a user must authorize access to their sales data by the business for any purpose, to include customer support, and obfuscating data in order to make it less identifiable to an individual. Again, enforcement is crucial for any legislation to have an effect, and companies should have their data practices regularly audited for compliance.

Is there a risk of harm to consumers? Is that harm mitigated by the benefits to the consumers or the economy?

For businesses, the current state of privacy affairs provides a fantastic opportunity for seizing market share. As Apple demonstrated, one does not need to accelerate towards more and more intrusive surveillance to be competitive: offering privacy to users is a practical and profitable way to distinguish yourself on the market and to exploit a competitor’s dependence on surveillance advertising. Companies can leverage anxieties and distrust about surveillance advertising by rejecting it entirely and protecting their customers from intrusion. The irony of surveillance advertising is that it is unclear whether it is more effective than traditional contextual advertising, which focuses on the event or context in which an ad is seen- sportswear at an athletic event, for example. Companies should consider the benefit they’re individually gaining from their advertising models, and consider the FTC’s priorities as Schroeder puts them: “Is there a risk of harm to consumers? Is that harm mitigated by the benefits to the consumers or […] the economy,” and “Is the consumer able to avoid that risk reasonably?” If the answers for your business are yes, no, and no, then it is not only more ethical, but more profitable to reconsider your advertising or data strategy.

What can I do?

You can take steps as an individual to protect your data and become a more difficult target for surveillance advertising. The mindsets to bear in mind are ‘follow the money,’ or identify how a service makes its profit, ‘if the service is free, you’re the product,’ which means an otherwise free-seeming service may derive its profit from selling your activity and data, and ‘it doesn’t have to be like this,’ which is a reminder that the current state of privacy affairs is malleable, and we can push for a world without this nightmare machine. 

It is fruitful to look to the privacy movement, particularly non-profits, for tools and recommendations. The Electronic Frontier Foundation (EFF) is a nonprofit dedicated to protecting our privacy and digital rights online, and have an Action Center for education and activism on privacy and surveillance-related legislation. The EFF also has a surveillance self-defense center, which covers all privacy issues comprehensively, and the Privacy Badger tool to proactively block trackers from your browser. 

Signal is a cryptographically secure messaging application run by a nonprofit of the same name. When considering a service in light of the first two maxims above, be a critical consumer of services like Virtual Private Networks or web browsers, which offer an observer unfettered access to your unencrypted internet traffic.  Some browsers, like Firefox, offer Enhanced Tracking Protection, which the EFF’s Cover Your Tracks Tool says provides ‘strong protection’. Others, like the Tor Browser, are privacy-first- but at the price of slowing down your web traffic. You can also download and install uBlock, a tool like Privacy Badger, which blocks trackers and ads. However, uBlock blocks some ads, and makes its profit by selling advertisers the chance to bypass its defenses. This model is followed by Brave, which whitelists certain tracker sites in an otherwise robust privacy-focused browser.

Finally, where no alternative can be found, adjust your security and privacy settings to the barest minimum of exposure to the outside world, or whatever makes sense for you. Refuse your location to apps that don’t actively need it to function, or apps that ask for location data while duplicating built-in phone functions (like weather, calculators, flashlights), insist that your data cannot be collected or shared, go into your wireless service provider’s settings and insist they stop selling you at your own expense. Then, continue to refuse to be sold- there will be times, by design, where you must use a tech giant, or simply want to. It’s fine to do so- have compassion for yourself, and view privacy as a skill, or lifestyle, where you gradually improve your posture while making reasonable, sustainable changes in your life, rather than as an all-or-nothing task. 

Lastly, you may consider using a Virtual Private Network (VPN). VPNs present an added layer of security but are fraught with collection risks. A VPN encrypts the connection between your device and the internet, meaning that your online traffic is hidden from your Internet Service Provider (ISP), or other devices on your local network (like Wi-Fi at a café). An observer sees that you have encrypted traffic, and that its heading to a single IP, but doesn’t know what websites you’re accessing. In a secure VPN, the service provider keeps no records of your internet activity, and you can expect a certain degree of security and anonymity. However, certain VPNs provide you security in exchange for collecting all of your traffic and selling the data to brokers. When evaluating a VPN, check how it’s funded: if it’s free, the product is you. Meanwhile, other VPNs such as McAfee Safe Connect retain all of your data for “as long as necessary.” Check that your VPN doesn’t keep logs of your activity for sale or transfer. 

If it’s free, the product is you.

But overall, individual responsibility can only do so much before the overwhelming resources of an industry which has ingratiated itself into our lives as a constructive necessity. The greatest responsibility relies in state, federal, and national governments to uphold their societies’ privacy as a greater good than advertising and the profit of a select few.

Conclusion

This was a story about you, and how you are followed everywhere. How without your consent, or by exploiting your unawareness of the depth and breadth of what you were consenting to, you are watched, catalogued, and sold, how access to your attention is marketed to malign actors, how your economic means or your race are used to exclude you from some opportunities while driving you to inferior ones. This was a story about how some of your lawmakers act to protect you, and others leave you to the whim of businesses, how those businesses launder away the ethical guidelines and Fourth Amendment protections earned in blood and struggle for the benefit of the few. 

This is also a story about what you do can do about it. Contact your congressmen, improve your security posture, refuse to be added to lists and databases without your consent, talk to others about privacy, be skeptical about free services that want to know as much about you as possible. Help others with poor privacy hygiene- make them aware of just how severe the situation is. That data, which is bought and sold and collected and stored beyond our control, isn’t just about us, it is us, our families, our hopes, our fearful search of medical symptoms at 3AM, our curiosities, our very being. Make this a story about how we, the subjects of data, came together, and helped one another to reclaim ourselves.

From The [F]law:

• Diana Cao, Video Underground: How Corporations Capture Culture
• Shao Chang, Gig Economy and the Future of Work
• Amy Robinson, The Digital Divide is No Accident
  

From The Systemic Justice Journal:

• Jack Lubin, Stream a Little Dream: How Netflix Turned Our Culture into Content
• Lauren Fukomoto, Hiding in Plain Sight: Knowledge Concealment and Consumer Powerlessness
• Daniel Zaleznik, Facebook and Genocide: How Facebook contributed to genocide in Myanmar and why it will not be held accountable