The American Civil Liberties Union (ACLU) has clashed with Facebook a number of times, including a legal battle in recent years that forced the social media giant to make changes to its targeted advertising system. A new update to the ACLU’s privacy policy indicates that the organization is now feeding that same system. The new data sharing notification reveals that the ACLU is providing Facebook with the names, email addresses, phone numbers, countries of residence, and ZIP codes, according to reporting by Fortune.
Former Federal Trade Commission CTO Ashkan Soltani says that this is not necessarily a new development; the ACLU may have been sharing personal data with third parties for at least several months prior to the announcement, and what is in the new privacy policy may not represent the “full picture” of its data sharing practices.
ACLU data sharing appears to contradict its positions on Facebook
The ACLU has taken on Facebook a number of times, mostly in cases that involved privacy and discriminatory profiling practices. The case that was settled in 2019 forced Facebook to stop including certain categories of personal data, such as age and gender, in targeted advertising concerning job opportunities, housing and credit. The organization also contributed to the 2019 case in Illinois that cleared a path for state residents to sue Facebook over illicit use of their biometric information. And last year, the ACLU asked a federal court of appeals to unseal a decision that would reveal why a judge ruled that Facebook did not have to comply with a law enforcement request for encrypted WhatsApp messages, information that could be used for legal defense by other companies in the future.
While the ACLU has been a consistent thorn in Facebook’s side, the group also clearly finds the tech giant’s platforms useful as a means of reaching people (the organization funds itself in part by soliciting private donations). The updated privacy policy says that the ACLU uses targeted advertising and participates in data sharing on a number of communications platforms, specifically naming Facebook and Mother Jones. It additionally says that the group ” … may also share ACLU supporter information with organizations that display our advertisements or petitions to their subscribers.” The ACLU does provide the option to opt out of this data sharing via a communication preferences form, but the only link to it appears to be from the privacy policy page.
Privacy policy raises alarms
The ACLU told reporters that it was not unusual for them to work with organizations they have taken on in court, pointing out to Axios that they bank with JP Morgan Chase even in the wake of a successful 2019 lawsuit against them. But former FTC CTO Soltani, who has previously consulted with the group as an auditor of its privacy practices, said on Twitter that the ACLU had been engaging in this sort of data sharing for some time prior to the privacy policy update and that public notice of it was long overdue. Soltani said that he is bound by a non-disclosure agreement and cannot be more specific, but implied that the ACLU is engaging in even more data sharing than the current privacy policy covers. He points out that the group has faced other investigations into the handling of its chest of personal information dating back as far as 2004, and that the incident demonstrates the need for legal personal information protections that extend to nonprofits.
Fortune reports that the ACLU has spent some $5 million on Facebook ads since May 2018, and about half a million dollars on 1,100 Google ads. A former ACLU attorney that spoke to Fortune suggested that there may be disconnect between the legal and fundraising departments of the group that has led to the group’s seemingly inconsistent position on data sharing.
The ACLU has taken criticism in recent years for pivoting away from an absolute defense of free speech principles, something that had formerly been such a cornerstone belief of the group that it went to bat for Nazis and members of the Ku Klux Klan. The organization began having an internal debate about how to weigh free speech versus protection of marginalized groups after the 2017 rally in Charlottesville that saw a counter-protestor killed and 19 others injured in a car attack by a white supremacist. Conservative commentators have criticized the group for expending the bulk of its energy and resources on issues of identity politics rather than protection of universal rights.
The Wall Street Journal reports that while the group was well-funded during the Trump years, it is now struggling to maintain the levels of donations that it is accustomed to. That could pressure it to make compromises on decisions regarding personal privacy, such as making use of potentially invasive sources of targeted advertising to reach new donors.
Other than responding to some of the reporters covering the story, the ACLU has made no formal statement about its privacy policy update as of yet.
