ACLU discloses that it shares personally identifiable info of its website users and donors with platforms like Facebook, Google, and others, for ad targeting
FortuneDanielle Abril
Context & Ripple Effects
The disclosure lands awkwardly because the ACLU has spent years forcing Facebook to clean up its advertising machinery: it sued over discriminatory employment ads in 2018, then extracted a ~$5M settlement in 2019 covering ads for jobs, housing, and credit, followed by Facebook detailing expanded anti-discrimination measures. The organization also previously exposed how Facebook, Instagram, and Twitter had handed data access to the surveillance firm Geofeedia, pressuring all three to cut ties.
Now the ACLU's own privacy practices show it feeding personally identifiable information about website users and donors to those same platforms for ad targeting. The irony is structural rather than incidental: the ad-targeting infrastructure the ACLU polices is the same infrastructure nearly every advocacy group uses to fundraise.
First-order effects
ACLU faces a direct credibility test with its own donor base — the people whose PII was shared are the constituency that funds its platform-accountability work.
Second-order effects
Facebook and Google gain a reputational shield they didn't ask for but will use: even their most prominent critic depends on their ad tools, complicating the 'platforms vs. civil society' framing that underpinned the discrimination lawsuits.
Other nonprofits and advocacy organizations come under pressure to disclose whether they run the identical practice, since the ACLU's admission reveals a norm the sector rarely states publicly.
Third-order effects
If watchdog organizations cannot avoid the platform ad stack, donor privacy becomes a systemic accountability question rather than an ACLU-specific embarrassment — pointing toward disclosure norms or regulation for nonprofit data sharing.
The episode sharpens a recurring boundary problem the ACLU itself has litigated, from forcing policy bans on surveillance use of platform data to policing ad targeting: permission boundaries around personal data keep proving porous even for the parties who define them.
The trend: Civil society organizations are becoming dependent participants in the same platform data economy they exist to police, making watchdog purity structurally impossible and disclosure the new battleground.
Yesterday, @ACLU updated their privacy statement to finally disclose that they share constituent information with ‘service providers’ like @Facebook for targeted advertising, flying in the face of the org's public advocacy and statements. (1/11) https://www.aclu.org/... https://t…
Some critics respond to @ACLU, a defender of digital privacy, updating its privacy policy to show that it shares user data with @Facebook, which it criticizes for privacy blunders ((like almost every media company that writes about Facebook)) https://fortune.com/...
For example, public transparency data from Google shows that @ACLU has paid Google nearly half a million dollars to deliver targeted advertisements since 2018 (when the data first was made public) https://transparencyreport.google.com/ ... (5/11) https://twitter.com/...
In fact, I was retained by @ACLU last summer to perform a privacy audit after concerns were raised internally regarding their data sharing practices. I only agreed to do this work on the promisee by ACLU's Executive Director that the findings would be made public. (2/11) https://…
Ugh, this #privacy violation hurts. Data includes names, email addresses, phone numbers, country of residence, and ZIP codes. “The practice goes against everything that the #ACLU stands for,” says Ashkan Soltani. #Facebook https://fortune.com/...
While I'm bound by a nondisclosure agreement to not disclose the information I uncovered or my specific findings, I can say with confidence that the ACLU's updated privacy statements do not reflect the full picture of their practices. (4/11)
And to be clear, the practices described would very much constitute a ‘sale’ of members' PII under the CPRA. The irony is not lost on me that the ACLU vehemently opposed the CPRA—the toughest state privacy law in the country—when it was proposed (9/11) https://www.aclunc.org/...
Aside from exposing people's political preferences, there is something very upside down about civil society orgs optimising their campaigns on computational infrastructures and the feedback in clicks and donations bleeding into the way they prioritise their political efforts. htt…