Yesterday, @ACLU updated their privacy statement to finally disclose that they share constituent information with ‘service providers’ like @Facebook for targeted advertising, flying in the face of the org’s public advocacy and statements. (1/11) aclu.org/about/privacy/state…

7:19 PM · Apr 2, 2021

53
749
1,362
In fact, I was retained by @ACLU last summer to perform a privacy audit after concerns were raised internally regarding their data sharing practices. I only agreed to do this work on the promisee by ACLU’s Executive Director that the findings would be made public. (2/11)
4
49
295
Unfortunately, after reviewing my findings, the ACLU decided against publishing my report and instead sat on it for ~6 months before quietly updating their terms of service and privacy policy without explanation for the context or motivations for doing so. (3/11)
2
60
318
While I’m bound by a nondisclosure agreement to not disclose the information I uncovered or my specific findings, I can say with confidence that the ACLU’s updated privacy statements do not reflect the full picture of their practices. (4/11)
4
54
330
For example, public transparency data from Google shows that @ACLU has paid Google nearly half a million dollars to deliver targeted advertisements since 2018 (when the data first was made public) transparencyreport.google.co… (5/11)
4
47
246
The @ACLU also opted to only disclose its advertising relationship with @Facebook only began in 2021, when in truth, the relationship spans back years totaling over $5million in ad-spend. facebook.com/ads/library/?ac… (6/11)
2
39
223
These relationships fly against the principles and public statements of the ACLU regarding transparency, control, and disclosure before use, even as the organization claims to be a strong advocate for privacy rights at the federal and state level itsgoodfor.biz/be-transparen… (7/11)
3
42
245
In fact, the NY Attorney General conducted an inquiry into whether @ACLU had violated its promises to protect the privacy of donors and members in 2004. The results of which many aren’t aware of. (8/11). nytimes.com/2004/12/18/us/ac…
4
32
200
And to be clear, the practices described would very much constitute a ‘sale’ of members’ PII under the CPRA. The irony is not lost on me that the ACLU vehemently opposed the CPRA—the toughest state privacy law in the country—when it was proposed (9/11) aclunc.org/blog/californians…
5
42
221
While I have tremendous respect for the work @ACLU and other NGOs do, it’s important that nonprofits are bound by the same privacy standards they espouse for everyone else. (Full disclosure: I’m on the @EFF advisory board and was recently invited to join @EPIC’s board) (10/11)
5
43
301
My experience with @ACLU further amplifies the need to have strong legal privacy protections that *apply to nonprofits* as well as businesses — partially since many of the underlying practices, particularly in the area of fundraising and advocacy, are similar if not worse (11/11)
10
54
310