For web developers, privacy can feel like a compliance issue — something handled by legal teams, cookie banners, and terms of service. But on the Smashing Podcast, Laura Kalbag, co-founder of the Small Technology Foundation and creator of the Better Blocker and Site.js, argues that privacy is fundamentally a design challenge. "Privacy is not about hiding things," she explains. "It's about having control over information about yourself."

From Kalbag's perspective, developers hold much of the responsibility for preserving user privacy. The choices made during development — which third-party scripts to load, which analytics to track, what data to store — determine how much control users actually have. Her work at the Small Technology Foundation focuses on what she calls "small technology": tools designed to be humane, sustainable, and respectful of their users, in contrast to the centralized and exploitative "big tech" model. She advocates for a web where power is distributed back to individuals rather than hoarded by a handful of platforms.

## Why Privacy Matters for the Web

Kalbag's view is that the current state of the web, dominated by a small number of powerful players, creates an imbalance that's damaging to users. Data collection and surveillance extend far beyond what most users realize. "It's not just about who's looking at your Facebook profile," she says. "It's about the massive amounts of data that are collected by companies you've never heard of, and how that data is used to manipulate and control people."

She encourages developers to question the status quo and avoid collecting data simply because they can. A key shift, she suggests, involves moving the "privacy controls" from an afterthought, buried in submenus and user-unfriendly flows, to being a central part of the user interface they design.

## Redefining Metrics of Success

Kalbag challenges developers to reconsider their own success metrics. "We tend to say, 'If we get lots of visitors, that's good,'" she notes, "but if we have lots of visitors, but not many people are completing the actions we want, we need to look at the design."

But what can a developer do right now? Kalbag's foundational advice is to adopt a "privacy-first" mindset tied to existing laws. She highlights that under regulations like the General Data Protection Regulation (GDPR) in Europe, organizations are supposed to apply principles like data minimization and purpose limitation. This means they must collect only what's needed for a certain purpose, and not use it for something else later without asking again.

## Practical Steps for Developers

On the ground, implementing these principles often begins with the most mundane things. Kalbag's recommendations for day-to-day development include:

  1. Question every integration. Ask whether a third-party service truly meets user needs, and whether its data processing can itself erode user privacy in ways you wouldn't want to experience.
  2. Avoid assumptions about risk. Do not judge or stereotype users when determining their privacy thresholds. Consider broad contexts—just because a user isn't accessing a site from a sensitive state doesn't mean their privacy isn't valuable.
  3. Treat the browser as a hostile environment. Users should not be tracked by default, and tools should be built to protect them from the third-party trackers that proliferate around the web.

This places the moral burden not on the user to educate themselves, but on developers to anticipate how their design choices shape that environment. Tools like Kalbag's own Site.js are concrete examples of the experimentation driving this movement: an open-source project designed to create websites that are secure by default, out of the box — with options such as automatic HTTPS and a focus on minimal reliance on third parties.

Both Better Blocker and Site.js provide routes toward reducing these systemic issues. Better Blocker, Kalbag notes, handles "anything we can think of related to local-first, privacy-respecting alternative options to add to a site" — an idea that may be ready for more widespread adoption.

The Developer's New Role

Ultimately, Kalbag sees privacy as groundwork for better design. Encouraging researchers to practice test-driven development of products with a focus on how those practices affect that most essential part of design: the experience of those using the software.

"It's really important to not always assume that because someone isn't in a 'high-risk' category that they don't need to consider privacy," she explains, "and, perhaps even more importantly, to remind ourselves of its universal applications." Whatever the immediate task — whether reshaping a web app, implementing tracking policies, or writing a line of JavaScript — each individual action's cumulative impact can refashion an internet that is fairer, freer, and more conscious of how complexity can best serve its wider community.

Among Laura Kalbag's recommendations: her personal website, laurakalbag.com; the Small Technology Foundation at small-tech.org; Better Blocker; and Site.js. You can find all these, plus links to her projects and upcoming research, in the Show Notes below.

Show Notes

The Real Cost of “Free” Platforms

Laura Kalbag, co-founder of the Small Technology Foundation and author of Accessibility for Everyone, joins Drew McLellan to discuss a topic that affects every web user and developer: online privacy. The conversation centers on how centralized platforms have replaced the decentralized, self-hosted web of the ’90s, and what that shift means for personal data.

When we post on platforms like Facebook or Twitter, we are, as Kalbag puts it, “posting everything on somebody else’s website.” This subjects users not only to platform rules but also to data collection practices that go far beyond what most people realize. Platforms can track location, read private messages if they aren’t end-to-end encrypted, and build detailed profiles used for ad targeting or sold to third parties.

Kalbag shares a personal example: after her mother died, she began seeing ads for funeral directors on Facebook. No one in her family had posted publicly about the death, but her sister had sent a private Facebook Messenger note to a friend in Australia. Facebook connected the dots through its knowledge of their relationship and served a targeted ad during a vulnerable moment.

This kind of tracking often doesn’t require access to a microphone or camera. As Kalbag explains, platforms infer intent from search behavior, physical proximity to others, and location data. It’s unsettling precisely because it connects signals that users don’t think of as linked.

Privacy Is Not About Having Something to Hide

Kalbag pushes back on the common dismissal that privacy concerns only matter to people with secrets. Privacy, she argues, is about the right to choose what to share. The decision to avoid Gmail, for example, is undermined when correspondents use Gmail—their choice effectively hands over your emails to Google. Similarly, uploading photos of friends can place them in facial recognition databases scraped from social media, a practice associated with companies like Clearview.

She also warns that data collection has consequences beyond advertising. Facebook has reportedly used friends’ financial statuses to approve or deny loans. Algorithms make decisions about users based on derived data—location patterns, social circles, activity times—that users can neither see nor correct. Regulation like GDPR offers some recourse, but it typically covers only the data collected directly, not the inferences built from it.

There is also the risk of data breaches: centralized databases holding personal information are attractive targets for hackers, and the consequences of those hacks can be severe. Even if one company collects data benignly, that data can be sold or acquired by an organization with very different intentions.

Practical Steps for Users and Developers

For individuals, Kalbag advises a threat-model-based approach: the more you rely on a platform, the more you expose. For one-on-one communication, she recommends alternatives like Wire or Signal, which offer end-to-end encryption. She challenges the assumption that everyone must be on the same platform for it to be useful—having a few close contacts on a private tool is a good start. She also cautions against expecting a single Facebook alternative; instead, users should pick the right tool for the specific function they need.

For developers, Kalbag is blunt: “We shouldn’t be collecting data at all.” She calls analytics one of the biggest offenders, since developers often use it to confirm assumptions rather than learn anything genuinely useful. She points out that hidden third-party scripts—Google Fonts, social logins, trackers—give those companies access to your visitors. It’s a developer’s responsibility to know what third-party code does and to have fallbacks if it fails. The case of the blogger Belle de Jour, exposed by using the same Google Analytics ID on two different blogs, illustrates how easily developers can leak data without realizing it.

On the JAMstack, Kalbag is cautiously supportive. Static sites remove many server-side risks, but she warns that loading up APIs reintroduces the same third-party dependencies: “We may as well have it on somebody else’s platform.” The convenience of quick builds often comes at the cost of user privacy.

Rights-Respecting Alternatives

Kalbag and her team at Small Technology Foundation have built Site.js, a tool for creating and deploying personal websites that are secure and easy to manage. The goal is to give developers full control over their content without compromising visitors’ privacy. For content sharing, she also advocates RSS, which allows people to follow her blog, photo, and status updates without needing to use social platforms.

She recommends that developers start by auditing one existing page, component by component, removing unnecessary scripts and considering the privacy implications of what remains. Better Blocker, the Foundation’s Safari tracker blocker, frequently reveals how bloated sites have become—some, like The Sun, load dozens of analytics scripts per page. She encourages developers to test sites with ad and tracker blockers active, just as they test across browsers, to build more robust experiences.