How WordPress Can Lead the Web in Privacy-First Design

July 4, 2018/Dan Maby/
SHARE POST

In May of 2018, WordPress 4.9.6 was released with new privacy-related features to aid in compliance with the new EU privacy regulations known as the GDPR. The GDPR grants EU citizens the right to request what data a website can collect, and request that it be erased. It also requires informed consent of how the data will be used and shared with third parties.

Every WordCamp I’ve been to since the last US election I’ve had multiple conversations about why corporate surveillance states, like those created by analytics collection, PPC platforms, etc, are in general dangerous, especially when used for hyper-targeted political advertisement.

Of course, there are also multiple talks instructing new WordPress users on the importance of Google Analytics and how to use other analytics collection, PPC platforms, etc. on their sites. Which, of course, we should be.

I can’t bring myself to look, but my site probably has Google Analytics, Hotjar, AdRoll, Facebook and Twitter pixels to say the least. These are valuable tools, we need and I’m not going to throw them out because of how I feel about these platforms.

The web wasn’t built to be privacy-first. Nor was WordPress. That’s fine, we can iterate. WordPress is very well positioned to lead on moving the web towards privacy first, because of our scope. Also, opposed to Facebook, privacy invasion isn’t fundamental to our platform. First, let’s look at why we’re not privacy-first already.

Transition To Privacy First

Please don’t take this as a critique of WordPress’ new privacy-related features. These new tools help comply with the GDPR, and those that are planned are a great first step.

We should now see in WordPress core or our own code, that any existing feature that reduces the right of an individual to control their own private data as a feature that is bugged. At some point we decided to value accessibility and only then could we see existing features to have accessibility related bugs.

Privacy-first design is inclusive design. Making invasive data collection a prerequisite for use of a service, or blocking those who live in the EU where that type of data collection is not allowed by default is coercive.

WordPress Can Lead

WordPress leads in open-source CMS market share. But also has at times used that market share to push the web towards a standard. Morten uses the case of WordPress’ adoption of a proposed standard for response of images as an example where WordPress improved the web for the better by making a decision first:

According to Morten Rand Hendriksen, “In the web community, we have long talked about “paving the cowpaths” for new technologies. Rather than waiting for the browser manufacturers to argue their way to an often unsatisfactory compromise over new technology, the theory is that if the whole web community got together and used that technology in a specific way, the manufacturers would have no choice but to follow. We carve out paths that are so entrenched the browsers have no choice but to pave them.”

What’s Holding Us Back?

WordPress uses its role and market share well to make accessibility a value, a topic we educate on and an engineering requirement. WordPress 4.9.6 is an important step in using WordPress to make the web a place that is more respectful of privacy. That’s great.

If we are going to make WordPress into a privacy-respecting platform, we have to look at all the reasons it’s not.

No one thought about this in the beginning, now we have to graft it on. Like the REST API, and WP CLI and Gutenberg. It’s not easy, and we’ll argue a lot. We’ll survive, I promise.

We don’t currently have a system to associate ownership of data as it goes into the database. Nor is there a universally accepted standard for that metadata that we can attach to HTTP requests to other services that contained that data.

On a lower level, our database has to be opaque to the outside world. MySQL databases and the way we used them in PHP applications like WordPress can’t allow anyone to read from them. That’s a non-starter. Large security red flags waving urgently abound.

As a result, the privacy data requests and deletions that we have to honor to comply with the GDPR are fulfilled on the honor system. This is not a problem unique to WordPress. It’s a part of the nature of web 2.0 and how traditional database architecture works.

But we could choose to tackle this at a large enough scale that a lot of people have financial incentive to help solve it and related problems.  These are problems that public blockchains — encrypted, immutable, verifiable databases — and smart contracts — programs that manage data according to agreed upon parameters — were designed for.

Web 2.0 was about giving everyone their own voice. And the open source CMS, WordPress, Wikimedia being the two most important in terms of keeping ownership of that content self-owned or in the public domain, while Facebook and Google did the opposite.

But we, who built the open web, have helped the surveillance state that Facebook and Google built to monetize everyone’s voices. With the GDPR going into effect we can see the difference in size of sites with all of the tracking on and the free version they serve now in Europe.

The USA Today’s new EU only site is 10 times smaller in terms of total request size than the regular version.

We need tools like Google Analytics to help us build successful WordPress sites, but maybe it’s time to start investing in analytics tools that do that and share our values on privacy.

Important and Fun Problem

If we believe that controlling your own data is important, and I do, then we need to allow for people to actually control the data they give to us. The GDPR provides a legal framework for that. It doesn’t solve the fact that the web wasn’t architected with the idea that all of the data has an owner beyond who holds it now.

The WordPress sites we build hand off data from individuals to all sorts of corporations with no consistent way to audit who has it or programmatic way to revoke access. This is a larger problem than WordPress. We need a solution that creates or complies with open standards for recording consent for data collection. And to programmatically enforce changes in consent state on access to the data — IE deleting from a traditional database or “buring” access to the blocks of a blockchain the data is stored in.

I’ve embed several tweets in this article. As a result, additional Twitter usage tracking is added to the page. Also, Twitter is able to track where the content is enabled. That’s useful data for Twitter, but the authors of the content don’t get that same benefit. I just copied from Morten’s post and added a link.

This article is ending with a vague “we could use blockchain technologies” to solve some of these WordPress problems. But as I mentioned in my last blockchain/ WordPress post for Torque, we have an opportunity to use blockchains to distribute content in new ways that might include new systems for verification of content authorship, review/fact checking and compensation authors.  It’s a perfect opportunity to use this fancy new block-based editor we’re building to make the next evolution of the web intuitive to author content for. While we do it, we should make sure everyone’s privacy is respected. That’s an important value that the GDPR provides a good frame to start from.

Josh is a WordPress developer and educator. He is the founder of Caldera Labs, makers of awesome WordPress tools including Caldera Forms — a drag and drop, responsive WordPress form builder. He teaches WordPress development at Caldera Learn.

The post How WordPress Can Lead the Web in Privacy-First Design appeared first on Torque.

SHARE POST

Sharing is Awesome, Thank You! :)

Share this Blue 37 post with your friends
close-link