I ran across the comment below at http://onemansblog.com/2007/02/02/protect-your-privacy-delete-internet-usage-tracks/#comment-58200 about Gravatar. I'm particularly curious of Meta Stack Overflow's opinions on points 4 and 6, though the others may be of interest too. Are these concerns real, and if so, what defensive measures might be used?
Comment by AL 2009-02-18 00:03:55
I’m a lawyer specialising in internet and privacy issues at a Fortune 100 company and I personally think that Gravatar is easily the worst service available in terms of your data security and privacy. I generally don’t comment on any blogs that are Gravatar-enabled (this being an exception), for the following reasons:
The entire reason Gravatar offers their service is to collect internet usage data across multiple sites. It is not offered free out of the goodness of their heart. The entire purpose of the service is to analyse the way YOU navigate the internet.
Gravatar has clear plans to monetise this data. Whether they are successful or not is another story.
It is unlikely that Gravatar would ever disclose individual user’s personal information, but it is not impossible. The Chinese government has often requested to these kind of information aggregators to disclose data for the prosecution of political dissidents – and very often these requests are met resulting in bloggers being jailed (see Yahoo!’s experiences in China). For example, if I leave a number of comments promoting democracy criticising the PRC government on various blogs, it is entirely possible that the Chinese government could use legal authority to request the holder of information to disclose that to them. By retaining this information and preventing you from stoppping it’s collection, Gravatar is putting both bloggers and commenters at risk. This is not just in China. The Patriot Act and many other new pieces of post-9/11 legislation in Western countries convey similar powers to government.
The most egregious part of Gravatar’s service is the inability to stop them from collecting your data. I have in the past tried to cancel a Gravatar registration. Gravatar does not allow this and will continue to track your e-mail address for the rest of time.
Gravatar does not provide any details about how they use your personal information and does not respond to any queries relating to privacy issues.
As a lawyer, I strongly urge all blog authors and users who are concerned about their privacy to avoid Gravatar.
Related: Is using Gravatar a security risk?