Photo by Barbara Johnston
I walk into this interview with my smartphone in silent mode. Within minutes, I’m wondering if I should unload my digital sidekick entirely. An hourlong conversation with Kirsten Martin has that effect.
In Martin’s view, the concept of online privacy in 2022 is roughly equivalent to the state of environmental protection before adoption of the Clean Air and Clean Water acts in the 1970s. Or akin to automobile safety before seat belts became required equipment in all new American cars in 1968.
It’s almost nonexistent.
Most people don’t realize the sheer volume of personal information that is constantly being pulled from their cellphones and Google searches and the websites they frequent, says Martin, a professor of information technology, analytics and operations in the Mendoza College of Business. She’s a nationally recognized expert on privacy, technology and business ethics.
That personal information is stored, shared and sold by third-party data aggregators intent on learning as much as they can about individuals and their interests, vulnerabilities and buying habits.
The public doesn’t entirely grasp who has their personal information and the volume and intimacy of that information, Martin says.
“There’s a lot of information they can get off of search terms and location data that says a lot more about us than we realize,” she says. These companies “probably know more about us than our doctors or therapists or lawyers.”
The middlemen — the data aggregators — benefit most from the online behavior targeting and tracking.
Online searches can help an aggregator determine that a particular user has a health concern, personal problem or financial crisis. Location trackers on smartphones can place a person with pinpoint accuracy — even at a particular physician’s office or support-group meeting — information the individual might not be eager to share.
Online privacy is a topic that generates great interest among the public, even if individuals aren’t sure what to do about it. In a 2019 Pew Research Center survey, more than 80 percent of Americans said they feel they have little or no control over data collected about them by companies and the government.
Martin gave a TED talk in 2018 titled “It’s Not Their Story to Tell: Why Companies Should Respect Privacy Online” that has received more than 30,000 views on YouTube.
That precise location data allows a company to infer many things about an individual — such as where they shop, when they voted or whether they attended a protest rally.
Companies know that trust is important to their business. “Reward companies that are trustworthy and block those that are not,” says Martin, the William P. and Hazel B. White Center Professor of Technology Ethics and director of the Notre Dame Technology Ethics Center.
Young adults are especially attentive to the issues surrounding the mining of their personal information. In her course on the ethics of data analytics, Martin assigns a thorough check of participants’ apps and online privacy. These tech-savvy students are appalled at what they discover. “They’ll say things like: ‘I want to wrap myself in tin foil.’ They are just outraged,” she says.
Contrary to popular wisdom, young people care about privacy. “That’s why they don’t let you see their TikTok. That’s why they have a separate Instagram account, different from the public one their parents see,” Martin says. “They care a lot about how their data is being gathered and used. If anything, they’re more anti-corporate power” than the Gen Xers she grew up with.
Martin is not on Facebook, the social media and networking service that has repeatedly faced privacy concerns and lawsuits. Facebook’s policies around the collection and storage of users’ personal information aren’t strong or transparent enough to gain the professor’s trust.
An internal Facebook document leak in 2021, reported in The Wall Street Journal, showed the company was aware of the harmful effects of its platforms, including the spread of false information, the negative impact of its Instagram platform on teenage users and the promotion of violence in developing countries. Facebook soon announced it was changing the name of its parent company to Meta, deemphasizing the Facebook brand.
Martin uses some social media sites, including Twitter, to follow news and individuals in her professional field. And she’s on TikTok, a short-form video hosting service, which she initially joined because her three children — in their teens and early 20s — use it. “My TikTok feed has a lot of dogs and recipes. It’s very curated to what I like,” she says.
Martin recommends using ad and tracker blocker software. She relies on Ghostery, a free, open-source browser extension that allows users to detect, control and remove tags and trackers that are embedded in many web pages to collect visitors’ search terms and browsing habits.
“Location tracking is one of those burgeoning issues that people are just now realizing is a problem,” Martin says. That precise location data allows a company to infer many things about an individual — such as where they shop, when they voted or whether they attended a protest rally. “Your location says even more about you than your search terms,” she says.
Users can go into the privacy settings on their smartphones and turn off location tracking for most apps. Some apps, such as map-based services, require the user’s location. But the vast majority of apps don’t need your location information in order to function, Martin says.
That resolves some issues. But third-party data collectors have other ways of obtaining a user’s location, particularly when Wi-Fi or Bluetooth is enabled, Martin says. In some ways, the quest for privacy is like playing whack-a-mole: Resolve one problem and another threat pops up elsewhere.
It shouldn’t be that way. “Just because you share information with a company, university or person doesn’t mean you have no privacy expectations. It’s reasonable for people to have privacy expectations, even in public spaces,” she says.
I ask: Do our cell phones eavesdrop on us? I recall conversations I’ve had about a particular retailer or service, only to see online ads for that retailer or service soon afterward.
“I don’t think those anecdotal stories are crazy,” the professor says. “It’s really hard to explain another way that could be happening.” She doesn’t have a smart speaker or any other virtual assistant technology that “listens” to conversations and responds to verbal commands.
The fight for privacy has made some progress. In 2018, the U.S. Supreme Court issued a landmark ruling that government collection of cellphone location data constitutes a search under the Fourth Amendment and the government must show probable cause to believe a person has committed a crime and obtain a warrant before gathering it.
While some consumers have deleted health-tracking apps from their phones, Martin thinks location tracking and online searches are as big a problem as the apps themselves. “Companies have a vested interest in knowing how you are feeling. If you’re down or anxious, that’s a helpful thing for them to know for marketing purposes,” she says. “Marketers are looking for things that show you’re in some sort of vulnerable state.”
Even seemingly innocuous apps such as those promoting spirituality or relaxation can compromise privacy. In early 2022, news broke that a popular prayer app was collecting data about its users, including their location, links they click on and the texts of their posts. (The same app in 2020 had exposed the personal information of as many as 10 million users after developers failed to secure the cloud databases storing that data.) It seems doubly wrong for a company to offer an app for people in potentially vulnerable situations only to increase their vulnerability by compromising their privacy, Martin says.
Martin encourages people to lock down the privacy settings on their phones. “The default should be that these apps [and websites] are not getting your photos, contacts and location,” she says.
I take her advice and lock down the location tracking in my phone. My photos and contacts are set to private. Do I feel safer? Maybe a little, for now.
Martin doesn’t expect federal legislation to protect consumers’ online privacy soon. But action at the state level may have an impact and influence other states, she says. (The California Consumer Privacy Act of 2018, for instance, gives consumers more control over the personal information businesses collect about them.)
Despite her concerns, Martin is confident laws will eventually protect online privacy. It took years and lots of work before the United States adopted environmental protection measures and auto safety laws, she points out.
Back then, carmakers and steel companies argued that such matters weren’t their responsibility and jobs would be lost because of the high costs of compliance, she says. Yet regulations were adopted for the common good. And today, many companies market their products based on their commitment to public safety and protecting the environment. The safeguards provide a competitive advantage.
Martin thinks something similar will unfold related to online privacy. “I’m optimistic,” she says, “that there will be some form of regulatory pressure that will make the industry react.”
Margaret Fosmoe is an associate editor of this magazine.