September 24, 2003
Nettle vs ACLU
by Brian Dear
Some time around one year ago, I joined the American Civil Liberties Union. I guess I felt, as an American, it was time to do my small part to preserve, protect, and defend the Constitution of the United States. So, yes, for the first time in my life, I became a card-carrying member of the ACLU.
But this blog entry isn't directly about politics or law or the work that this particular organization does. It's about the customer experience I had in dealing with the ACLU. It all started when I joined through the signup form on their website. . .
1. Carpet-Bombed by Non-Profit Organizations
I went to the site, clicked on the link to join, and found a signup form. It asked for name, address, all the usual stuff. So I filled it out, including my credit card info, and paid the minimum $20.
Not even a week had gone by before the deluge began. Big, thick colorful envelopes arrived, not from ACLU, but from Sierra Club, Americans United for the Separation of Church & State, the Nature Conservancy, Americans For This, Americans for That, Yadda Yadda Yadda. Organization after Organization after Organization. Most of them I had never heard of.
I was astounded. Not only by the sheer volume of the material, but by the considerable weight of the material. Typical envelope: glossy 4-color with big bold lettering urging me to join the organization. Inside, paper after paper, each a different size, often a different color -- as if maybe I might read JUST ONE of these, and be convinced to give money. Then there were the customized pens. Calendars. Posters. Personalized address labels. Colorful stamps. Bumperstickers. Flyers. Brochures. Booklets. Pamplets. Beg Letters. On and on. The number of trees that must have been cut down in order to manufacture these solicitation packages -- think about it. And to think that one of the worst offenders in this regard was none other than . . . Sierra Club! You think they'd notice the irony of their wasted mailings.
Well, it didn't take but a moment to put two and two together and assume that there was a direct correlation between my joining ACLU and my receiving daily inundations of junk mail from nonprofit organizations.
And, by the way, the junk mail was so fast in arriving, it beat the arrival of the ACLU membership card (a real card-carrying ACLU member!). But I simply had to assume ACLU had given out my personal information against my wishes.
After a while, I decided to contact ACLU to see what could be done about it. I wrote to Anthony Romero, Executive Director of ACLU. He admitted right away that ACLU was no different than "most other non-profit membership organizations", which "identifies potential new members through exchanging membership lists with other, like-minded organizations." He went on to say that "the ACLU is always extremely careful to protect the privacy of our members who request that we do so." He said he'd remove my name from "the list that is shared with other organizations."
It was nice that Mr. Romero took the time to personally respond to my email inquiry. One thing I've learned is that the ACLU does actually listen, and I give them a lot of credit for that. (Name one corporation where you can email the CEO or President and expect to get a personal, thoughtful reply -- not from a lackey but from the real person -- within 24 hours.)
However, what I was amazed to find is that the ACLU automatically gave my name and address to third parties -- and did it so swiftly that I was already receiving mailings from third parties before I received my ACLU membership packet.
The implication in Mr. Romero's email was that because I put up a fuss, they would remove my name from "the list that is shared" -- had I not put up a fuss, they'd no doubt continue to merrily give my information away.
Fast foward a month. The floodgates had opened wider and I was getting even more junk mail from needy non-profit organizations. I wrote back to Romero and requested that the ACLU notify each and every organization it had given my information to, to immediately cease and desist from sending me stuff, and to remove my name from their lists.
He wrote back a few days later, apologizing again but assuring me that my name had been removed, and, no doubt shrugging as he wrote it, "because of the 'double blind' nature of the name sharing system we take part in, it is impossible for us to know what organizations have received your name."
So I contacted some of these organizations directly. Funny, they knew exactly what organization they got my name from, and told me so: the ACLU. I never told them I'd signed up for the ACLU. But they knew. So much for the "name sharing system" being "double blind."
Well at this point, I gave up. I could have escalated this more, but I had more important things to do. (Which I'm sure relieved the ACLU and the other organizations.)
2. The Renewal Letter
Fast forward to just recently. A form letter arrives from ACLU, complete with dire pleadings to send more money to continue the good fight, et cetera, et cetera. I had not forgiven them for their privacy-violating mass-mailing sins of the past year, and tossed the letter in the trash.
Then, a few weeks later, another letter arrives. Very official-looking white envelope, with only "OFFICE OF THE PRESIDENT, AMERICAN CIVIL LIBERTIES UNION" and a return address up in the left-hand corner. I opened and there was a form letter from Nadine Strossen, President of ACLU.
It went on about how ACLU's efforts are weakened when members don't renew. Lots of stuff to make you feel guilty. Fine. But then it brought up how our privacy rights are in peril, and it was at that point I was reminded at how the ACLU had violated my privacy when I joined the organization.
So this morning I wrote Nadine Strossen an email:
|
Dear Ms. Strossen:
I received your "real sense of urgency" letter asking for my membership renewal, and I wanted to respond to you directly. I'm not going to renew my ACLU membership at this time. Why? Not because I don't believe in or support the work that the ACLU is doing. The ACLU is needed more than ever given the current War on the Constitution. No, the reason I choose not to renew is because I was deeply disappointed by what happened when I signed up for the ACLU last year. Within days of sending in my $20, a daily barrage of solicitations from dozens of other nonprofit organizations began. The amount of junk mail I received from Sierra Club, Americans for This, Americans for That, etc., was staggering. I'm still getting such junk mail a year later, although it has died down a lot. I had not received any such mail until the very moment I joined ACLU. I was shocked to learn that ACLU had given out my private contact information to what appeared to me to be any organization that wanted it. I can only imagine what multiple of my $20 contribution you earned from these other organizations paying you for my info. Shame on you. I had thought that if there were one organization I could simply assume to automatically protect one's privacy and play fair, it would be the ACLU. Imagine my disappointment when that turned out not to be the case. So, while I support the work of your organization, I can't give you more money because I don't trust what your organization does with its membership info. And I'm warning others to not join or renew either, unless they don't mind the whole world sending them junk mail. Suggestion: change your ways. Then prove to me you've changed your ways. Then I'll be glad to come back. Sincerely, Brian Dear |
I sent that at 8:08am this morning (my time; 11:08am New York time). Amazingly, two hours and three minutes later, Nadine Strossen wrote back:
|
From: "Nadine" <xxxxxxx@xxxx.xxx> To: "'Brian Dear'" <xxxxxxx@xxxxxx.xxxxx> Cc: <xxxxxxxxx@xxxx.xxx>, "'Jennifer Meyer'" <xxxxxxx@xxxxx.xxx> Subject: RE: Responding to your ACLU membership renewal letter Date: Wed, 24 Sep 2003 13:11:27 -0400 Dear Brian, Thank you so much for writing directly to me -- taking the time to express your important concerns and giving me the opportunity to respond and to rectify. I assure you that the ACLU does "practice what we preach" in terms of privacy and we have scrupulous policies in place to protect you against the kind of junk mail barrage that you're experiencing. As for the details of our policies and practices, I'm forwarding your letter to GINA SCHMELING, who is the ACLU's Membership Director, with the request that she (or someone else she designates) respond to your concern with more concrete details, and to copy me on the answer. You know the old logical fallacy, "Post hoc, propter hoc" -- the fact that (1) you joined the ACLU , and (2) you then got lots of junk mail, doesn't mean that #1 caused #2. I'm not claiming that our policies are perfect -- alas, nothng human is -- so MAYBE something went awry here, but please don't leap to that conclusion. After all, you obviously believe in due process and the presumption of innocence, as a civil libertarian! Please keep an open mind. Again, I'm so grateful to you for speaking up - -but I wouldn't expect anything less of a (former) card-carrier! With warm regards, Nadine -- PS Hope you don't mind being on a first-name basis. I'm a friendly Midwesterner and consider any (former) ACLU member family of sorts! N
Nadine Strossen |
Once again, ACLU had impressed me by a) showing they listen to their members and b) responding quickly to inquiries.
3. The Signup Form
I decided to take a look at the ACLU's website before responding to Nadine. I wanted to see if anything had changed since I'd first contacted Anthony Romero. I noticed right away that the privacy policy had been updated. Part of that policy states as follows:
Whether by exchange or rental, the lists are governed by very strict privacy procedures, as recommended by the U.S. Privacy Study Commission. All exchanges are made on a "blind" basis, as follows: Lists are never given into the physical possession of the organization which has rented or exchanged them. This safeguard is necessary to prevent one organization from knowing who the members of any other organization are. Instead, usually through a list broker, the list, either in the form of labels or tape, is sent to a mail house which prepares the mailing without our ever seeing who is addressed. The only time we get possession of a name from one of these lists is when the person receiving our invitation to join responds by sending our return envelope back to us.
If the receipt of duplicate mailings is too burdensome, you may wish to consider writing to each of the organizations to which you belong and publications to which you subscribe, requesting that your name be eliminated from lists made available for exchange or rental. The ACLU always honors such requests, and we believe that the organizations with which we exchange or rent lists honor them also, although of course we can't guarantee the actions of outside organizations.
Like most other non-profit membership organizations, the ACLU obtains the names of potential new members by renting the membership lists or subscriber lists of like-minded organizations and publications. Sometimes, instead of paying the rental fee, ACLU exchanges its list with that of another organization.
They're wrong about that "blind" part, as I'd proven months before by inquiring to some of the organizations that had carpet-bombed me with junk mail, demanding to know how they got my name and address, and receiving timid emails back along the lines of "gee, well, our records show we got your information from the A.C.L.U., sorry to bother you!" So much for blind.
What I was really interested in, however, was the ACLU membership signup form, accessed from the aclu.org website. Here's page one of the form:
The signup form is broken up into three pages ("3 EASY STEPS", as the ACLU terms it): page one is "your info", page two is "payment info", and page three is "confirmation." Here's page two:
And here's the confirmation page:
It's a reasonable, pretty standard way of designing a signup or registration form, and I'm not going to debate its design. What I am concerned about are two things.
- There is no affordance on any of the three pages --- for instance, a checkbox --- that would allow someone to opt in or opt out of the automatic inclusion of their personal information into what Anthony Romero called "the list that is shared with other organizations." There are plenty of very smart people at the ACLU. I don't believe for a second this omission was accidental. (Oh ok, I'm willing a teensy tiny bit to believe it was accidental --- in keeping with my friend N's plea that I keep an open mind.) But it sure does look like the ACLU is saying, "if you want to have the convenience of using our website to join our organization, the price is your privacy." Whether they mean this or not, the omission of an opt-in/out checkbox is flat-out wrong in my view, and contrary to of the one of the fundamental rights the organization claims it is protecting.
- There is no indication what happens if you only fill out page one of the form. Say you diligently fill out your name and address and phone info, and click the "Continue" button. Then you see the credit card page, realize your wallet is in the kitchen, the phone rings, the baby cries, your favorite TV show is back from commercial, whatever --- something makes you decide to either put off filling out the form or stop altogether. Fine. But the ACLU has your name and address and home phone and work phone and email address. You submitted all that when you clicked the "Continue" button on page one. What does the ACLU do with this information? Does it immediately copy it to "the list that we share"? (How much money does the ACLU get from these other organizations, by the way, as a bounty for sharing this info?) There's no clear indication. Not good. Not fair. Not in keeping with the principles of the ACLU in my view.
So, now I was ready to reply to Nadine's email.
4. The Challenge
So here's my reply, sent today at 12:13pm California time:
|
Date: Wed, 24 Sep 2003 12:13:21 -0700 To: "Nadine" <xxxxxxx@xxxx.xxx> From: Brian Dear <xxxxxx@xxxxx.xxx> Subject: RE: Responding to your ACLU membership renewal letter Cc: <xxxxxxxxxx@xxxxx.xxx>, "'Jennifer Meyer'" <xxxxxx@xxxx.xxx> Dear Nadine: Thank you for writing back, I appreciate hearing from you directly, I really do. I signed up for ACLU through the aclu.org website last year, and the real shocker was the sudden (and months-long) bombardment of mailed solicitations from non-ACLU organizations. The typical solicitation consisted of a thick, heavy envelope inside of which were customized "BRIAN DEAR" pens, posters, stickers, stamps, postcards, address books, address labels, envelopes, calendars, 4-color brochures, you name it. The bombardment -- there's no other word for it -- started days after I signed up through the aclu.org website --- and even before my ACLU membership card arrived. Naturally I assumed that signing up for ACLU caused the junk mail. Turns out I was right. How do I know I was right? Well, I contacted Anthony Romero, told him what was happening, asked if there were indeed a connection between all the new junk mail and my joining ACLU, and he admitted that yes, my contact information had immediately been given out to who knows how many other nonprofit organizations. This had been done without my permission or knowledge. He was very courteous and responsive (something I've not forgotten) and had someone within ACLU stop giving my contact info out anymore, but the cat was already out of the bag, and to this day I still get stuff although far less, thank goodness. Here's the thing: while I am glad to see ACLU has clearly improved the aclu.org website's privacy policy since last year, you still don't give new members any option to opt-out of the impending avalanche of dead tree byproducts (ironic indeed how many trees must be cut down to manufacture the stuff that Sierra Club sends!) when they sign up for membership through the website. Just today I went back to the ACLU website and went through the 3-page new-membership signup form to see if that had improved since last year. Nope. There is still no checkbox or other affordance for users to indicate that they simply want to support the ACLU --- period --- and not support, hear from, or have their personal information sent to any other entity anywhere. That is what I mistakenly *assumed* would be the case when I signed up. I suspect thousands of other people assume the same as well. I mean, I think people who come to the aclu.org website to sign up, do so in good faith and assume that ACLU, of all organizations, would not abuse or take advantage of the trust of individuals who believe in the organization and want to help it fight the good fight. By not disclosing, right out in the open, right within the online membership signup form, that ACLU's going to give information out to other entities, I think you do your new members a grave disservice. Would alerting members to your information-sharing practices right within the form, via a simple checkbox saying "I give permission to ACLU to share my name and address to other worthy nonprofit organizations" be such a bad thing? I can't imagine how adding that to the first page of the signup form would harm your new membership signup rates or your overall mission. I also worry about the way you've broken the form up into three pages. As a user-interface designer myself, I can appreciate your trying to simplify the form and save the user from having to scroll down what might be a fairly long page. But the multi-page design of your form makes me wonder: since you gather name and address information on the first page, what happens to that information the moment it's submitted? After all, it has value right away. What happens if someone doesn't type in their credit card on the second page, and thus does not complete the application? Do you keep the info submitted on the first page of the form? Is there any possibility that that information gets released to third parties? In fact, right here and now I pledge to renew my membership and give $50 to the ACLU the day I see its website signup form modified as I've described above. As a web design professional I would be happy to help ACLU make the right design changes to the form so that members are informed about and have complete control over deciding whether their information is strictly for ACLU's use, or may be shared with other organizations. I look forward to your reply. Sincerely, Brian Dear |
So there you have it. I'll rejoin ACLU when I see they've made a fix to their site, making it clear to all users that it is up to them to opt in or opt out of the ACLU's sharing of their personal contact information with other organizations.
I will post a follow-up as soon as I've heard back from my new pal Nadine. :-)
UPDATE -- 25 September 2003:
I heard back from Nadine Strossen this morning, thanking me for the detailed explanation. "The situation is in the hands of the ACLU's staff specialists," she says. I will post a new Nettle article once I've find out what the ACLU intends to do about fixing their membership signup sequence so people have a choice of opting in to information-sharing or not.
UPDATE -- 3 October 2003:
Part Two of this ACLU article is now available. Click here to go there now.
UPDATE -- 1 December 2003:
See Part Three of this ACLU story for some great news!!!
Posted by brian at September 24, 2003 04:43 PM