Zebra and privacy

For us, the answer would have to be very carefully. We don’t expect to get it perfect from day one, but every feature we create flows downstream from a personal belief in the inalienable right of your audience to privacy and plausible anonymity.

One such feature is Zebra’s live experience, which maps the location of your traffic as it arrives. Our own testing showed us how compelling, even visceral, it is to watch an audience take shape across a map.

For creators, it can be deeply motivating and affirming. For stakeholders or prospective partners, it is evidence of reach they can watch for themselves. It is also the feature that puts audience privacy most at risk.

This tension was at the heart of what made building Zebra incredibly fun, but also challenging. How could we offer creators and content managers useful, motivating, real-time insights into the shape and location of their audience, while still carefully shielding audiences from surveillance or read-receipt-level tracking?

Again, the answer was carefully. But it started with getting the basics right.

The basics (table stakes)

There are a few things any analytics engine operating in the EU needs to get right.

• No cookies. No one following a Zebra link gets a tracking cookie.

• No user-level IP tracking. We truncate incoming IPs the instant they land, then hash what remains with a secret key. The raw address is never stored, and what’s left identifies a network, not a person.

• No fingerprinting. Everything we know about a device comes from the User-Agent header browsers volunteer with every request. We never do anything to circumvent a browser’s built-in privacy safeguards.

Beyond the basics

Basic protections offer a good foundation on which to build, but are not in themselves enough to prevent audience privacy from being compromised. When a detail in analytics data is unusual enough to make isolating a single person trivial, a phenomenon known as singling out comes into play, and a single click becomes a read receipt in everything but name.

Safety in numbers

The fix is one that statisticians and census bureaus have known for decades: waiting for a crowd. Because the same detail that can expose one person becomes harmless once enough people share it, we wait for enough people to share a detail before making that detail visible.

All sensitive analytics in Zebra are veiled according to this principle, keeping data that could single out one person veiled until that same data is shared by a crowd.

To make this more secure, we also vary what constitutes a crowd. We keep one threshold for data attached to a link, another for scans from a QR code (where location is more easily inferred), and a third for signals that ride along inside those scans. We also keep the thresholds themselves variable, making it difficult to predict exactly when the threshold for a crowd will be reached for a given parameter.

The ladder

Our real-time ability to unveil data in a laddered progression safeguards audience privacy while keeping Zebra’s live experience compelling. Details that are safe to reveal get revealed reactively, the instant they become safe to reveal, while details that aren’t remain veiled. But it’s not binary – when a country reaches a crowd, it immediately becomes visible in live analytics, and regions and cities follow. Geography becomes progressively less coarse as crowds in your data take form.

The end result is that you know less about individual clicks or QR scans that don’t actually matter, while the underlying trends that do matter emerge more clearly, often in real time, and without ever pinpointing where any one visitor is.

But a ladder is only as good as the wall that supports it. Thankfully, not only does Zebra have a strong one – it has only one. Our many surfaces, one core approach pays real dividends here, as one disclosure rule, applied where the data leaves our hands, decides what every surface may show. So our dashboard, chat assistant, API and MCP descend every rung of the ladder together in lockstep, with data veiled in exactly the same way.

The path

Protecting audience privacy and delivering a powerful live analytics experience are two goals in obvious and constant tension. Balancing them is one of the challenges that make building Zebra so much fun. But it’s a path we’re still walking, not a final destination we’ve reached. We won’t get every knob or dial right from day one, but we’re proud of the underlying architecture that makes those knobs and dials easy to reach and adjust as our policies evolve and adapt.