'No Winners' as Global Tech Giants Receive Failing Grades on User Privacy and Protections

The world's biggest tech companies are failing to uphold users' basic privacy rights, according to a comprehensive new analysis released Tuesday.

Top U.S. firms like Facebook, Google, and Microsoft all earned D or F grades in the first annual Corporate Accountability Index (pdf), released by the New America Foundation, a U.S.-based think tank. The index measured 16 global companies on their track records in privacy protections, upholding users' freedom of expression, and their commitment to disclosing their practices which impact these concerns.

None of them were found to provide adequate information about the handling of user data, terms of service enforcement, and third-party requests to share or restrict content from either the government or private entities. Moreover, all the companies were impeded in privacy performance by surveillance and national security laws or other regulations.

"When we put the rankings into perspective, it's clear there are no winners," said Rebecca MacKinnon, director of Ranking Digital Rights, a project of New America Foundation which compiled the report. "Our hope is that the Index will lead to greater corporate transparency, which can empower users to make more informed decisions about how they use technology."

Google was the top-rated internet company and earned the most points overall with a 65 percent score, while Europe's Vodafone ranked highest among telecommunications firms with 54 percent. Yahoo scored 58 percent, Microsoft 56 percent, and Twitter and AT&T 50 percent each. It is worth noting that Google's executive chairman, Eric Schmidt, is on the board of the New America Foundation.

Facebook scored 41 percent total. Its performance across all categories dropped due to its disclosure policies, which did not include subsidiaries such as Instagram and WhatsApp. On individual indicators, such as freedom of expression, the company scored 35 percent, largely due to its failure to provide comprehensive information about government requests to restrict content.

Ranking Digital Rights began compiling and analyzing its index in 2013. The 16 selected firms "collectively hold the power to shape the digital lives of billions of people across the globe," the group stated in its summary.

Nearly half of the companies on the index--such as Bharti Airtel Limited in India, South Asia, and Africa, or Mail.ru in Russia--scored less than 25 percent, "showing a serious deficit of respect for users' freedom of expression and privacy," Ranking Digital Rights wrote in its executive summary.

That's bad for consumers, and it's particularly dangerous for journalists, activists, and those living under repressive governments, the group said.

In one example, Bharti Airtel, which placed fifth out of eight telecommunications companies, only provided privacy policies for its Indian plans in English.

"[E]ven policies that are visually appealing and written in everyday language lack specificity, particularly related to what user information companies share and what control users have over their data," the group said. "This is significant because it makes it more difficult for individuals to make decisions about information that is essentially private, and the sharing of such information risks enabling third parties to learn about their activities, interests, and connections."

Other findings include:

• The companies lack grievance mechanisms to improve communications between them and their users, and largely fail to meet the remedy expectations laid out by the United Nations Guiding Principles on Business and Human Rights, which stipulate that companies have an obligation to respect those guarantees;
• With the exception of telecommunications firm Kakao in South Korea, none of the companies offered end-to-end encryption by choice or default;
• No company disclosed any information whatsoever about the type of user content that gets deleted or blocked when the terms of service are enforced;
• Public disclosures are often written in language that only regulators can understand, while omitting information the consumers need.

Transparency is increasing and almost half of the ranked companies are taking new measures to back up privacy commitments, but a wide information gap remains--especially when it comes to companies disclosing third-party requests that come along with subpoenas or court orders.

"In sum, users are left in the dark about many company practices that affect freedom of expression and privacy," the group wrote. "Even for a very committed and concerned user who is willing to search news databases, pore over terms of service, and parse through privacy policies, it is impossible to formulate a clear picture about how the ranked companies' practices may affect the user's freedom of expression and privacy."

"The Ranking Digital Rights Corporate Accountability Index can serve as a valuable tool for engaging with companies on digital rights and freedom of expression issues," said Michael Jantzi, CEO of Amsterdam-based research firm Sustainalytics, which helped develop the index.

The report called on companies to prioritize users' rights and improve transparency, accountability, and avenues of communication. MacKinnon told the Guardian she would remain optimistic. "This is the test you take at the beginning of the class where everybody fails, and then you get to work, and then everybody's going to improve," she said.