Zebra and privacy

For us, the answer would have to be very carefully. We don’t expect to get it perfect from day one, but every feature we create flows downstream from a personal belief in the right of your audience to privacy and plausible anonymity.

One of the features downstream from that is Zebra’s extraordinary live experience rooted in the earth’s geography. We knew from our own testing how compelling, even visceral, the experience of watching the evolution of a real-time traffic event could be. We saw it as something that could be deeply motivating and affirming to creators, but also a potential game-changer when shared with other stakeholders or potential partners.

This tension was at the heart of what made building Zebra incredibly fun, but also challenging. How can we offer creators and content managers useful, motivating, real-time insights into the shape and location of their audience, while still carefully shielding audiences from surveillance or read-receipt-level tracking?

Again, the answer was carefully. But it starts with getting the basics right.

Table stakes

There are a few basic things any analytics engine serving clients in the EU has to get right. Far from all of them do, but all of them should.

• No cookies. No one following a link by Zebra gets a tracking cookie.

• No user level IP tracking. Our engine truncates incoming IPs the instant they land, then hashes what remains with a secret key. The raw address is never stored, and what’s left identifies a network, not a person.

• No fingerprinting. Everything we know about a device comes from the User-Agent header browsers volunteer with every request. We never do anything to circumvent a browser’s built-in privacy safeguards.

Beyond the basics

Basic protections offer a good foundation on which to build, but are not in themselves enough to prevent audience privacy from being compromised. When a detail in analytics data is unusual enough to make isolating a single person trivial, a phenomena known as singling out comes into play, and a single click becomes a read-receipt in everything but name.

Safety in numbers

The fix is one that statisticians and census bureaus have known for decades: waiting for a crowd. Because the same detail able to expose one person becomes harmless once enough people share it, we simply wait for enough people to share a detail before making that detail visible. All sensitive analytics in Zebra are veiled according to this principle, keeping data that could single out a single user veiled until that same data becomes shared by a crowd.

To make it more secure, what constitutes a crowd also varies. We keep one threshold for data attached to a link, another for scans from a QR code (where location is more easily inferred), and signals that ride along inside those scans get a threshold of their own. We also keep the thresholds themselves variable and entropic, making it difficult to predict exactly when the threshold for a crowd will be reached for a given parameter.

The Ladder

Our real-time ability to unveil data in a laddered progression safeguards audience privacy while keeping Zebra’s live experience compelling. Details that are safe to reveal get revealed reactively, the instant they become safe to reveal, where details that aren’t remain veiled. But it’s not binary – when a country reaches a crowd, it immediately becomes visible in live analytics, where regions and cities follow. Geography becomes progressively less coarse as crowds in your data take form.

The end result is that you will know less about individual clicks or QR scans that don’t actually matter, while the underlying trends that do matter emerge more clearly, often in real-time, and without ever pinpointing where any one visitor is.

But a ladder is only as good as the wall that supports it. Thankfully, not only does Zebra have a strong one – it has only one. Our many surfaces, one core approach pays real dividends here, as one disclosure rule, applied where the data leaves our hands, decides what every surface may show. So our dashboard, chat assistant, API, MCP and PDF report generator descend every rung of the ladder together in lockstep, veiled in exactly the same way.

On the path

Protecting audience privacy while still delivering a meaningful live analytics experience is one of the challenges that made building Zebra so much fun. But these things are in obvious and constant tension, so it’s a path we’re on still, not the final destination. We won’t get every knob or dial right from day one, but we have the knobs and dials, and we’re proud of the underlying architecture that makes evolving policies possible.