Privacy Engineering: Lessons from a Decade of Building for the Open Web

The Internet was not architected with privacy or security in mind, yet it has become the backbone of modern life. The challenge for engineers and companies alike is straightforward: how do you layer privacy protections onto a system that was never designed for them? And more importantly, how do you build systems that minimize the creation of personal data in the first place?

Privacy itself is not a monolithic concept. For some users, it means controlling who collects their data and how it is used. For others, it means the right to access and delete personal information. It can also mean protection from government surveillance, ad tracking, or the ability to operate anonymously. The legal landscape reflects this diversity. Europe's GDPR treats data protection as a fundamental right. The United States focuses on consumer protection against deceptive practices and unwarranted surveillance. Brazil's framework echoes European law, while Canada, Japan, Australia, China, and Singapore all have their own national variations.

The most effective approach to privacy regulation may be to reduce the volume of personal data that exists in the first place. By building tools that empower users to share less, we can address privacy concerns across all these different legal and philosophical frameworks, regardless of a user's jurisdiction.

Core Technologies That Minimize Data Exposure

A range of privacy-enhancing technologies has emerged to address specific weaknesses in the original Internet protocols. The following are foundational examples of how engineering choices can close privacy holes.

  • Universal SSL: Before 2014, only about 2 million websites supported encrypted connections. When universal SSL was introduced that September, encryption became available at scale to millions of sites, including those on free plans. SSL, now known as Transport Layer Security (TLS), encrypts the content of web pages, ensuring data is not sent as plain text. This is the difference between sending personal information in a locked box versus on a postcard.
  • Privacy Pass: This protocol lets users prove they are legitimate across multiple sites without enabling tracking. Users of anonymity services or shared IPs often struggle to prove they are not bots. Privacy Pass reduces friction for these users, many of whom are among the most vulnerable online, by allowing them to verify their legitimacy without revealing their identity or exposing sites to increased bot attacks.
  • Encrypted Server Name Identification (ESNI): SNI was created so multiple websites could share a single IP address, a necessity given the IPv4 shortage. However, SNI reveals which website a user is visiting. ESNI encrypts that field, fixing what was previously a glaring privacy hole in the connection setup process.
  • 1.1.1.1 Public DNS Resolver: Launched in 2018, this resolver was built on the principle that consumers should be able to browse without providers in the middle monitoring their activity. The service does not store the source IP addresses of its users in non-volatile storage. IP addresses are anonymized before any logging occurs, meaning the service retains no information linking a specific user to a specific website lookup.
  • DNS over HTTPS (DoH): Using a public resolver alone does not prevent an ISP from seeing DNS requests unless that channel is also encrypted. DNS requests contain highly personal data, including location, visited domains, and browsing duration. DoH encrypts these requests so only the user and the resolver see them. Query minimization ensures that entities which do not need access to the full URL simply do not get it.
  • 1.1.1.1 Mobile Application with WARP: The mobile app can run in DNS-only mode, sending all DNS queries to the resolver via DoH or DNS over TLS. Activating WARP goes further, routing all device traffic through encrypted tunnels. This ensures that even traffic to sites or apps that do not support HTTPS is encrypted in transit.

Privacy as an Operational Default

Privacy-enhancing features are public evidence of a commitment, but operational practices are just as critical. The following principles illustrate how privacy is integrated into internal workflows and product development.

  • Employee Education and Mindset: Privacy training starts during the first week of employment. Comprehensive orientation stresses the role each employee plays in security. Annual data protection training covers the fundamentals of Fair Information Practices (FIPs), GDPR, and other applicable laws. Teams that handle personal data receive additional targeted training throughout the year.
  • Privacy in Product Development: The principles of data minimization, purpose limitation, and data security are built into the product development lifecycle. Privacy impact assessments are performed whenever personal data may be processed. Data is retained only as long as necessary to provide the service. The operational stance is explicit: no cross-tracking of users across sites, no selling of personal information, and no monetization of DNS requests.
  • Security as a Means of Privacy: Security is a critical component of privacy. Industry certifications demonstrate this commitment. The ISO 27001 and AICPA SOC 2 Type II certifications cover security, confidentiality, and availability controls to protect customer data. A public SOC 3 report is also maintained, and obligations under the EU Directive on Security of Network and Information Systems (NIS) are met.
  • Response to Government and Third-Party Requests: The approach to law enforcement requests emphasizes due process and judicial oversight. Requests that conflict with the privacy laws of a non-U.S. person's country of residence should be legally challenged. Customers are notified of subpoenas or other legal process before disclosure of their information, unless legally prohibited. Transparency reports, published semi-annually, detail the types of requests received and the responses given.
  • Protecting Vulnerable Voices: Project Galileo has provided security products to vulnerable voices online since 2014. The program serves more than 900 organizations, including humanitarian groups, non-profits, and journalism sites, many of which face attacks from powerful adversaries. Privacy is essential to these groups, as they are repeatedly targeted in attempts to knock them offline.

Next Steps in the Privacy Journey

Privacy protection is an ongoing process, not a compliance checkbox. The goal is continual evaluation of how personal data is handled, with a focus on finding new ways to minimize the amount of data received. This requires a degree of self-criticism and a willingness to examine the motivations behind technical development. The work of rebuilding the Internet with privacy baked in continues.