The Evolving Challenges to Maintaining Anonymity

Privacy law should supplement the First Amendment's anonymity protections.

First Amendment anonymity safeguards have been vital over the past half-century, but they have limits. The constitutional protections prevent certain uses of government power to unmask people. Cases like Talley limit the government's ability to force authors to disclose their real names. And John Doe online subpoena opinions protect online anonymity when a private party seeks to use a court-issued subpoena to compel the disclosure of identifying information. But due to the state action doctrine, these precedents generally do not restrict purely private activities that could compromise a person's anonymity.

We disclose information to companies, the government, and other people that, when pieced together, can provide a roadmap to our identities. This occurs even when we assume that we are anonymous. As Helen Nissenbaum wrote in 1999, while anonymity in the computer age is not impossible, "achieving it is a more demanding business than merely allowing people to withhold their names."

My book outlines three primary challenges to maintaining anonymity that are largely beyond the reach of the First Amendment protections. First, some online platforms have adopted "real-name" policies, prohibiting customers from using their services anonymously or pseudonymously. Second, the vast amount of public information that is available about people enables them to be unmasked, even when they try to speak anonymously online. Third, companies maintain large swaths of unregulated personal information that can make it harder to operate anonymously.

Social media platforms decide whether to require their users to post under or register their real names. Facebook has long had a real name policy, while Twitter and Reddit have long touted their users' abilities to operate pseudonymously (though they prohibit impersonation). Just as the government cannot require platforms to have real-name policies, it cannot prohibit them either. Although I question the efficacy of real-name policies and believe that they too often disproportionately harm marginalized groups, platforms are free to determine what level of anonymity, if any, they will offer.

The second challenge—the availability of public information about speakers—also largely cannot be addressed by changes to the law. As I describe in the book, anonymous speakers' identities have been disclosed because there were enough clues to enable others to put together these puzzle pieces to learn their identities.

Some clues were in their posts, and often could be linked to other publicly available data. Academic research has long established that only a few data points are necessary to identify people. In a 2000 research paper, Latanya Sweeney used Census data to establish that 87 percent of Americans had a unique combination of five-digit ZIP code, gender, and birth date. As Paul Ohm presciently observed in 2010, the ease of reidentification of presumably anonymous data poses great threats to individual safety. "Our enemies will find it easier to connect us to facts that they can use to blackmail, harass, defame, frame, or discriminate against us," Ohm wrote. "Powerful reidentification will draw every one of us closer to what I call our personal 'databases of ruin.'"

In the years since Sweeney's groundbreaking research, the amount of publicly available information has surged, along with the popularity of social media.  As I describe in my book, in recent years many people who posted controversial or objectionable speech on social media, presumably under pseudonyms, were unmasked based on clues that they included in their posts combined with publicly available information. How easily people can be unmasked and tracked based on public information suggests that the anonymity empowerment provided by the First Amendment and technology also requires people to carefully assess the information that they are providing to the world.

Legal changes could address the third modern challenge to anonymity empowerment: a great deal of identifying personal information is collected by data brokers and other companies, with few restrictions on its use in piercing anonymity both online and offline. As I document in the book, U.S. law imposes few limits on the collection, use, and sharing of facial recognition data, precise geolocation points, and other personal information that can identify people.

Privacy, data protection, and data security laws should aim to protect anonymity.  Some data protection laws, such as Europe's General Data Protection Regulation, encourage the pseudonymization or anonymization of data. While this is a positive step, I worry that we might to quickly assume that data is anonymized or pseudonymized when it can actually be linked back to individuals. Privacy laws should consider anonymization tactics such as adding noise to datasets.

The GDPR and some state laws such as the California Consumer Privacy Act also provide data subjects with the ability to access and request deletion of certain personal information. This also is a positive step, but it places a tremendous burden on individuals. And even if a person wants to take the time to request deletion of personal information, they may be unaware of every company and data broker that has their data. While privacy laws should provide individuals with control over their data, these options are not a panacea.

Ultimately, we need a strong national privacy law that not only encourages anonymization and provides data subjects with choices, but also prohibits particularly egregious forms of data collection, use, and sharing. One such example can be seen in local governments, such as San Francisco and Boston, which have banned law enforcement use of facial recognition technology. At the national level, we need a dialogue about how much we want to protect anonymity, and Congress should incorporate those values into a national privacy law.

Likewise, data security laws should more effectively address data that can be used to identify people, such as precise geolocation information. U.S. data security laws are scattered and weak, and many focus on particular sectors such as healthcare and banking. While protecting that information is important, data security laws should more effectively protect personal information that can compromise the ability to speak anonymously.

I've enjoyed guest blogging this week and hearing your thoughts about the very complex equities surrounding anonymous speech. I have several book talks scheduled over the next few weeks, and am happy to speak with classes, bar associations, or other groups that are interested in the issue.

-- Jeff Kosseff is an associate professor of cybersecurity law at the United States Naval Academy. The views presented are only his, and do not represent the Naval Academy, Department of Navy, or Defense Department. This piece is adapted from The United States of Anonymous: How the First Amendment Shaped Online Speech, by Jeff Kosseff, published by Cornell University Press. Copyright (c) 2022 by Cornell University.