Why privacy matters.
You close a door to use the bathroom. You do not tell your bank about your health, or your doctor about your money. Nobody calls that hiding. Yet when tracking comes up, someone may say “I have nothing to hide.” People who say it usually mean something reasonable. If you have done nothing wrong, a record of what you do cannot hurt you, so letting others look costs you nothing. That reasoning assumes that your records show only what you think they show, that the people reading them will read fairly, and that the records stay where you left them.
Privacy sets rules for who may read a record
Anyone who handles a postcard can read it. A sealed letter carries a rule about who may open it. Privacy works like the envelope. It sets terms on who may see a record, for what purpose, for how long and with whose permission.
Secret ballots rest on the same idea. A vote that can be watched can be bought or punished. That line of reasoning is part of why the booth has a curtain.
The nothing-to-hide argument looks only at what a record contains. A list of times, places and purchases can hold nothing embarrassing and still be worth money to people who will never meet you. What happens next depends on who reads the list.
Ordinary details can single out one person
A form asks for your postcode, your date of birth and your sex. None of those feels like a secret.
Every fact narrows the crowd. Start with everyone who shares your postcode, keep those with your birth date, then keep those with your sex. Using one large country’s census, researchers estimated that those three facts together single out nearly two people in three. No name is needed for that. A second list that carries names can connect the match to a person. So when records are called anonymized, you can ask whether they still hold a postcode, a birth date and a sex.
A record can also suggest what you never put in it. In one study, a model given only the pages people had liked guessed their sexual orientation, religion and politics far better than chance. Fewer than one in twenty of the gay users had liked an explicitly gay page, so for most of them the model had only other pages to go on. A guess that beats chance can still be wrong about any one person, and someone may act on it anyway.
Whoever reads a record decides what it means
Picture every search you made last year, printed with no explanations and left on the desks of your boss, your family and your friends. The symptom you looked up for a friend now reads as yours. Nothing on those pages is a crime.
The argument assumes a fair reading, one that sees you are innocent and leaves you alone. A record keeps what you bought, where you went and who you called, and it often leaves out why.
Sometimes whoever reads the record has a purpose of their own. During a war in the 1940s, census answers given in confidence helped a government find where families of one ancestry lived. Those families were forced from their homes. The answers were given for counting. They were used for finding.
Records can keep moving after you hand them over
If you are fine being seen because you do nothing wrong, you are betting on whoever holds your records today. That may be a fair bet. The same records can be somewhere else next year. A company that holds them can be sold, records and all. A new law can change what counts as wrong.
During the pandemic, check-in records were collected to fight a virus, under promises they would be used for nothing else. Police in more than one country later used some of them.
Records about people are also for sale. In one report, 37 data brokers were asked for data about people with mental health conditions. Eleven were willing to sell it.
When a genetic testing company went bankrupt, a court approved the sale of its customers’ genetic data with the rest of the business. Before you send a sample, you can read what the service says happens to your data if the company is sold.
Researchers used a model to estimate that once a DNA database covers about 2 percent of a population, nearly anyone in that population has a third cousin or closer in the database. Suppose you never sent a sample. A cousin did.
Watching everyone may add little to finding the few
People who support watching everyone say that anyone who means harm should be found, and that someone who has done nothing wrong loses little by being looked at. They are right that harm should be found. Some surveillance is targeted and lawful, starting from a reason to look at one person, and it can be useful. What is less clear is what collecting everyone’s records adds, and what it costs everyone else.
Two separate reviews looked at one program that collected the call records of millions of people. An oversight board knew of no case in which the program had directly helped uncover an unknown terrorist plot or stop an attack. A review panel found that what the program contributed was not essential to preventing attacks, and could have been obtained in time with targeted court orders.
Imagine a million people, ten of whom plan harm, and a screen that gives the right answer 99 times in 100 for each person. It would flag about ten thousand innocent people, along with nearly all ten real cases. Each real case arrives beside roughly a thousand innocent people. These numbers are made up to show the arithmetic. The same reasoning holds for any check run on everyone. If real cases are far fewer than the check’s mistakes, most of its flags land on innocent people. You do not have to be a suspect to be flagged. You only have to be one of the people it checks.
A wrong flag does not always stop at a second look. Some people have been arrested after face matching software picked the wrong face.
Knowing you may be watched can change lawful choices
In one large field experiment, households were mailed a list of whether they and their neighbors had voted in past elections, with a promise to send an updated list after the next one. In one primary election in one state, turnout in those households was 8.1 percentage points higher than in households sent nothing, and some recipients reacted with anger. Many people would welcome more voting. All it shows is that people changed an ordinary, lawful act once they knew their neighbors would see it. How anyone voted stayed behind the curtain.
Knowing you might be watched can also change what people read. An article about an attack in the news, or about how a weapon works, can look suspicious out of context. After the surveillance revelations of 2013, one study found that average monthly visits to online encyclopedia articles on topics that could look suspicious fell by about a fifth in the months that followed. A separate study found fewer searches for terms people rated as likely to get them in trouble. Each is a single study, so treat the pair as a lead.
Sharing is easy to agree to and hard to see
The benefit of sharing arrives now, as a faster checkout or a map that already knows where you are. Any cost can arrive later, somewhere else, and out of sight. Convenience has real value, and you may still decide the trade is worth it.
The layout of a consent notice can shape the choice too. In one small experiment, removing the refuse button from the notice’s first page raised acceptance by more than twenty percentage points.
So can where you start. One field experiment gave shoppers a choice between a 10 dollar gift card not linked to their name and a 12 dollar card that would be. About half of the shoppers who started with the anonymous card kept it, turning down two extra dollars. Of those who started with the linked card, fewer than one in ten paid two dollars to switch. The shoppers were all women at one mall, the stakes were small, and the order the options were described in also changed choices. Together, the two results suggest the starting point counted for more than the two dollars. They do not put a price on privacy.
Another experiment had 543 students from one class join a made-up social network. Three in four skipped its privacy policy. Those who opened it spent about a minute on it, on average, for a text that would take an estimated half hour to read. Ninety-eight percent missed terms saying their data would go to their employer and to an intelligence agency, and that they would hand over their first-born child. Nothing real was at stake for the students. The study shows that people agree to more than they read, and it never tested what they would choose after a careful read.
More than half of those asked in one national survey had accepted that they had little control over what marketers learn about them. Resignation can be a reasonable answer to a system that makes control hard to find. It is still worth checking your own settings.
One app’s permissions make a good first step
If you want a first step, open the permissions for one app you use every day. Turn off location, contacts or photo access wherever the app does not need them. That limits what this app can collect from now on. Anything it already has stays with it. While you are there, see what was already switched on when you installed it.
If you look after accounts for someone else, such as a child’s school login or a parent’s phone, ask what they want kept private and let them decide. Your part is showing them where the settings are.
For the longer case, read Privacy Guides on why privacy matters, an independent guide written by people who earn nothing from what they recommend.
A claim you see or hear again and again starts to feel truer, whether it is true or not. That includes the claims on this page, so check what you can. To see what a website tracks, paste this site’s address, or any other, into Blacklight, a free tool that shows the trackers it runs.
The nothing-to-hide argument starts from someone who does nothing wrong, and that person has a fair claim to be left alone. Next time a form asks for three everyday facts, what would you want to know before you answer?
Read next: How the loop works. It takes the guru funnel apart, stage by stage.