DRM privacy violations

Last time, we took a look at some of the challenges archivists face as the world transitions to digital. The restriction and loss of access to information is a significant concern, but it’s not the only one. The digital revolution has given birth to an era of surveillance capitalism. Across all digital domains, corporations hungrily gather up every scrap of information they can about the people using these digital resources, and sell that data for profit. This has troubling privacy implications.

DRM technology that locks down eBooks and other digital content restricts a user’s access to information and undermines their rights under copyright. These draconian systems provide a license to a book, rather than an actual copy of it. The technological locks that enforce these restrictions require that devices “phone home” to the license issuer to ensure the user is still allowed to read the book, as the license issuer can revoke the user’s access at any time. That license verification process informs the license holder that the user wants to open the book, so they can now monitor which books the user “owns” and how often they interact with it. That license check can include information like the maker and model of the device the user is reading on, what version of software it’s running, and what page the user is on. And since the license is tied to the user’s account, that information about the user’s behavior can be tied to them as an individual. Further, information about the user’s internet service and location can be included, letting the license holder know where the user does their reading, and even which books they read in which locations, and what internet service providers they use.

Beyond the basic information that could be argued are related to licensing enforcement, many license issuers collect other information under the guise of user convenience. Passages that are highlighted or bookmarked can be recorded and shared across the user’s devices. So can user-authored marginalia, which can be mined for personal insights or fed to AI large language models. Many platforms ask users to rate and review books they read, gathering further information about their thoughts and feelings on topics the book includes. Of course, they may use their reading history to suggest additional titles the user might be interested in purchasing. Some even include social functionality, allowing friends to suggest books to each other, which allows the platform to understand the social connections between users as another source of data to collect and sell.

Beyond the risks of data collection by corporation to be used in manipulating users for profit extraction, all of the data these companies collect can be turned over to law enforcement. Many do so without requiring a warrant as a matter of course. The chilling effect of that information disclosure is a well-understood threat to freedom of expression and information. While many libraries have policies that restrict what information can be disclosed to law enforcement and often refuse to retain such information at all, corporations are financially motivated to collect and retain as much information about their users as possible.

Libraries must often partner with corporate eBook providers in order to provide digital resources to their patrons. This denies their patrons the same privacy they would have with print equivalent materials. While the above discussion is mostly focused on eBooks, the same concerns exist for other digital platforms such as academic article database, audiobooks, and video streaming services that libraries often provide as services to their community. As librarians, we should strive to provide the same patron privacy in our digital resources as we do in our print media. We must include privacy guarantees, including compliance auditing, when contracting with companies to provide these services. And we should continue to lobby law and policy makers to protect the privacy rights that underpin the freedoms we are charged to protect. The surveillance capitalism paradigm is a direct threat to our right to privacy, and we must stand against it.