Economy (2016)

US company and campaign platform receives the BigBrotherAward 2016 in the Economy category for its business model of marketing personally identifiable information of signatories together with their political statements. appears to be an progressive and social project, but it really is a for-profit US corporation which shows many deficiencies with respect to data protection law. For example, it continues to store user data in the USA although the Court of Justice of the European Union has declared the “Safe Harbor” Framework invalid.
Prof. Dr. Peter Wedde am Redner.innenpult der BigBrotherAwards 2021.
Prof. Dr. Peter Wedde, Frankfurt University of Applied Science

The BigBrotherAward 2016 in the “Economy” category goes to the campaign platform, represented by the Berlin branch of the US company of the same name, because it uses personally identifiable information of people who signed petitions for the company’s own business purposes in varied and non-transparent ways. Based on information about the petitions somebody signed, this company creates profiles e.g. on political opinion, position in society, social situation – and it uses these for its own profit. As a matter of fact, is not a non-profit social movement in digital form, it is a commercial enterprise whose business model focuses on the use and exploitation of sensitive personal information as well as on trading e-mail addresses.

You know these e-mails: A close or not-so-close acquaintance sends us information about some issue or scandal and asks us to go to and sign an online petition for or against it. These days, it could be about the right to education for Syrian children, about creating humane conditions for refugees waiting in front of the Berlin State Office for Health and Social Welfare (Landesamt für Gesundheit und Soziales, LAGeSo), or about secret lobbying in the German Bundestag (the lower house of parliament).

Sure, as a critical political person I sympathise with these causes and will be happy to support them with my electronic signature! Online, it’s super easy! At, I just need to register once with my last name, first name, and e-mail address, and immediately I can have my say. The fact that details about my signature will be stored permanently is something I’ll put up with for the good cause. I would not know what else happens to my data because as always, I agreed to the terms of use and to the privacy policy without reading them. What could happen anyway on a site that boasts such positive things on its About page as

Our mission is to empower people everywhere to create the change they want to see, and we believe the best way to achieve that mission is by combining the vision of a non-profit with the flexibility and innovation of a tech startup.

To empower people and create change I want to see is just what I want. We all want change, don’t we? And it’s important to me that I can use to further my causes and interests without cost.

Contrary to the progressive and social self-description on their website, is not really an altruistic or non-profit organisation. As a case in point, take the funding model, which is “venture capital backed” even though the management stresses that investors have no influence on the operative business. Investors include powerful and famous industry greats such as Twitter co-founder Evan Williams, LinkedIn CEO Jeff Weiner, Ebay founder Pierre Omidyar, Bill Gates of Microsoft and the British entrepreneur Richard Branson.

Indeed, at first sight, the services of are free for normal users. does however make money with sponsored petitions whose initiators pay for the opportunity to display advertisements to users. And the price list for using all those e‑mail addresses goes to up to a bracket of US$ 250,000–500,000. The list of those who use reads like a “Who is Who” of charitable organisations, from Médecins Sans Frontières via Oxfam up to Unicef. Greenpeace Germany attach importance to the statement that they have no business relationship with Change CEO Ben Rattray told major German news magazine “Spiegel” a few years ago that he wants to turn into a world-wide brand for online activists, just like Amazon has become for book purchases.

All right, so is a for-profit enterprise. But I don’t mind receiving petitions about similar issues after I have signed one. On the contrary, the more I learn more about the issue, the better.’s handling of signatories’ data is problematic. Besides name, address and e-mail address, the corporation collects information about the petitions a person supported. grants itself permission to do so in its privacy policy.

The details collected allow to gain insights about each individual’s political or societal affiliation or social situation, among other things. These insights enable to offer targeted advertisements for other petitions, and thereby influence opinion-forming processes. Moreover, it can not be ruled out that uses its knowledge about opinions and positions to give specific support to paid-for petitions.

Processing and using such sensitive personal data, especially information about political opinions, is forbidden by German and European data protection laws. This cannot be overridden by the declaration of consent used by, which reads,

By signing, you accept’s terms of service and privacy policy, and agree to receive occasional emails about campaigns (you can unsubscribe at any time).

The same is true for people who create an account and are simply shown this note at the bottom of the login window:

By joining, or logging in via Facebook, you accept’s terms of service and privacy policy.

Neither declaration constitutes an effective basis in data protection law for processing and using sensitive personal information. This means for instance that by German and European data protection laws, must immediately delete all information it holds about political opinions of petition supporters.

Similar considerations apply to the handling of personally identifiable information from “social networks” such as Facebook. From people who have an account there, collects,

(…) your social media account ID and information shared with us via your social media account

In connection with social networks, turns into a full-blown data leech that sucks up and holds on to any bit of information it can get.

Incidentally, signatories don’t even need to have entered their addresses themselves, because these are not verified with a confirmation link. So everyone could enter email addresses of anybody else, and these people would never even know.

Given so much disregard of applicable data protection law, it comes as no surprise that the current privacy policy of does not meet legal requirements. On 6 October, 2015, the Court of Justice of the European Union (CJEU) ruled that the Safe Harbour Framework is ineffective – the so-called Facebook ruling (‘Europe v Facebook’). Ever since, data transmissions to the USA require new and stricter regulations, but still refers to the invalid “Safe Harbor” Framework.

In other words: did not even care to adapt its privacy policy to current jurisdiction in Germany and Europe. Instead, the corporation affords itself data processing practices with no basis in data protection law. A simple change of its terms would not do the trick anyway: even the new EU–US “Privacy Shield” does not offer sufficient protections against the low privacy standards in the US.

In terms of data protection law, nothing is going well at

The corporation’s website used to mention a Berlin office, but this text was removed. But the company still has directors and managers working in Berlin, and lately it advertised a “full-time” job in “Sales and Business Development”, “in close collaboration with Business Dev colleagues in Berlin”.

Well, but at least they use these addresses for a worthy cause. More justice, better protection of the environment – that’s not evil.

Careful there: neither has a “human rights” or “environmental” agenda itself, nor is this corporation a “grassroots movement for a better world”. The personally identifiable information it stores primarily serves as a cash cow. To be honest, should rename itself to

The services of are open for all social and political tendencies. For example, in Germany this corporation has no qualms whatsoever about  simultaneously promoting, under the keyword “refugees”, a demand to open the Balkans route and a call for the resignation of Chancellor Angela Merkel because of her welcoming policy. Anybody can pursue an agenda using, and search for supporters. Oxfam just as well as Pegida (“Patriotic Europeans Against the Islamisation of the Occident”, a far-right anti-islamic movement in Germany) – as long as it generates lots of clicks. In contrast to other petition platforms, does not have its own political agenda. also allows petitions for conservative parties and organisations, such Sarkozy’s Republicans in France. Not necessarily because shares these views – the explanation might quite simply be that the to right of the centre, the corporation’s address collection has not yet grown large enough. In the US, placed job ads for a campaigner who was supposed to help expand the address collection on the political right by launching petitions or making contacts in those circles.

But all of these arguments don’t taint the positive and world-improving petitions running at Is it not even a truly and radically democratic approach to accept all causes and let the people vote with their signatures? Shouldn’t we emphasise this aspect instead of shaming this company with a BigBrotherAward?

Not at all. No matter what objective a campaign may have – because of the corporation’s data collection mania there is always a risk that personal details of its signatories will be processed unlawfully and used for a totally different purpose. If you launch a petition, your name will be used to write to other users – that is, your will be held accountable for the corporation's business purposes, and your friends and acquaintances will be drawn into the reach of the data leech.

If you would like to launch an online campaign, you should choose a different platform. One that values data protection and will never use sensitive personal information for its own purposes.

Heartfelt congratulations on the BigBrotherAward 2016,


Updates to this awardee

Unfortunately, we do not have the capacity to translate our updates into English.

Prof. Dr. Peter Wedde am Redner.innenpult der BigBrotherAwards 2021.
Prof. Dr. Peter Wedde, Frankfurt University of Applied Science

About BigBrotherAwards

In a compelling, entertaining and accessible format, we present these negative awards to companies, organisations, and politicians. The BigBrotherAwards highlight privacy and data protection offenders in business and politics, or as the French paper Le Monde once put it, they are the “Oscars for data leeches”.

Organised by (among others):

BigBrother Awards International (Logo)

BigBrotherAwards International

The BigBrotherAwards are an international project: Questionable practices have been decorated with these awards in 19 countries so far.