Evernote to release new privacy policy in early 2017 and create new advisory board for customer feedback; CEO to personally manage employee access to user data
Chris O'Neill / Evernote Blog :
Context & Ripple Effects
Evernote is closing out a bruising two-week arc on trust. On December 15 the company disclosed that its planned January 23 policy change would let some employees read user notes to aid machine learning; within two days of that disclosure, user backlash forced a full retreat to an opt-in model, as covered in the December 17 backtrack announcement. Today's post is the follow-through: a rewritten policy landing in early 2017, plus structural changes meant to show the reversal wasn't cosmetic.
The governance moves land on a company already reshaped by CEO Chris O'Neill, who arrived from Google Glass in mid-2015 and has since cut headcount and offices while rebuilding the executive bench after founding CTO Dave Engberg's departure. Handing O'Neill personal control of employee access to user data is a direct response to the credibility gap the opt-out fiasco opened.
First-order effects
- Users who never opted in are protected by default under the revised policy, and Evernote's machine-learning ambitions on note content now depend entirely on voluntary consent rather than assumed permission.
- Chris O'Neill becomes the single accountable gatekeeper for employee access to user notes, concentrating what was previously a diffuse internal privilege in one executive's hands.
Second-order effects
- The new customer advisory board gives Evernote a formal early-warning channel it lacked when the original policy draft ignited backlash — future product and policy decisions get tested on users before publication.
- Rival note-taking products can now market against Evernote's stumble, making explicit 'we don't read your notes' positioning a competitive differentiator in the productivity category.
Third-order effects
- If the pattern holds, consumer cloud services that want to mine user content for machine learning will converge on opt-in consent plus visible human accountability structures, because the opt-out default proved commercially untenable once exposed.
- Trust incidents like this push privacy governance from legal boilerplate toward operational controls — named executives answerable for data access — a structure regulators and users may increasingly expect of data-heavy services.
The trend: Consumer software companies are learning that mining user content for machine learning requires opt-in consent and visible accountability, not quietly expanded terms of service.