Electronic Frontier Foundation EFF Privacy Policy changes — 20130817_rev01

1

The Electronic Frontier Foundation (EFF) is committed to protecting the privacy of visitors to our website, as well as our members and activists. EFF has established this Privacy Policy to explain what information we collect through this website and how it is used.

1

The Electronic Frontier Foundation (EFF) is committed to protecting the privacy of visitors to our website, as well as our members and activists. EFF has established this Privacy Policy to explain what information we collect through our websites and how it is used.

2

3

In this policy, "EFF" refers to EFF staff, board members, cooperating attorneys, interns, volunteers, and consultants, all of whom are bound by law or contract to keep information they receive as part of their assistance to EFF confidential.

3

In this policy, "EFF" refers to EFF staff, board members, cooperating attorneys, interns, volunteers, and consultants, all of whom are bound by law or contract to keep confidential information they receive as part of their assistance to EFF.

4

5

EFF does not sell or rent donor information under any circumstances, and we do not share information without prior consent except as compelled by law. (See discussion below.)

5

EFF does not sell or rent member, donor or website visitor information under any circumstances, and we do not share member, donor or visitor information without prior consent except as compelled by law. (See discussion below.)

6

7

## Information Gathered by EFF's Site

8

9

For visitors to our website, we generally log requests to our website through a program called [cryptolog](https://www.eff.org/code/cryptolog). Cryptolog takes the IP address portion of the request getting logged and encrypts it, as well as a chunk of random data (the salt), using a cryptographic hash function. The salt changes every night, which should result in making it very difficult for us, or anyone else, to recover IP addresses from our logs. We also generally do not log other standard technical information, including the browser software you use, your operating system or the Internet address of the website from which you followed a link to our site.

9

**Logging:** For visitors to our website, we generally log requests to our website through a program called [cryptolog](https://www.eff.org/code/cryptolog) (cryptolog described [further below]()) and do internal analytical logging (also described [further below]()) for up to seven days from when the data was collected.

10

11

Circumstances in which EFF may need to log and retain technical information include when we believe it is reasonably necessary for conducting site testing, diagnosis of technical problems, and defending against attacks on the site. In those instances we will delete the information as soon as it is apparent the information is no longer needed for the purpose for which it was kept. For more information on EFF's position on data logging and techniques we use to anonymize, obfuscate, aggregate and delete information, see our [Best Practices for Online Service Providers](https://www.eff.org/wp/osp).

11

Circumstances in which EFF may need to log and retain technical information for longer than seven days include when we believe it is reasonably necessary for EFF's mission and functionality, including situations such as:

12

13

We do not use persistent cookies on this site. We use session cookies on certain portions of the website. Session cookies expire when you close your browser. You can use [Tor](https://www.torproject.org/) if you wish to keep your technical information anonymous.

13

- site testing,

14

- diagnosis of technical problems,

15

- defending against attacks to the site,

16

- handling a spike in traffic or other abnormal, short-term circumstances, or

17

- research projects (in anonymized form) that serve our overall mission to defend freedom online.

14

18

15

In addition, EFF collects and retains information you voluntarily submit to us. It is up to you whether to submit information to us, and how much information to provide. If you choose to become an EFF member or otherwise donate to EFF, we ask for your name, email address, mailing address and phone number. For online donors and shoppers, we also ask for your credit card number. We also maintain records of our members' use of the Action Center. If you use the EFF Shop, you are asked to provide personal information, such as a shipping address, necessary to complete your transaction.

19

In those and similar situations we will delete the information as soon as it is apparent that the information is no longer needed for the purpose for which it was retained. For more information on EFF's position on data logging and techniques we use to anonymize, obfuscate, aggregate and delete information, see our [Best Practices for Online Service Providers](https://www.eff.org/wp/osp).

16

20

17

If you enable the Decentralized Observatory feature of HTTPS Everywhere, we will collect copies of the certificates of SSL/TLS servers that you connect to. In order to help locate man-in-the-middle attacks, the Decentralized Observatory may also log [which ISP](https://secure.wikimedia.org/wikipedia/en/wiki/Autonomous_system_%28Internet%29) you observed the certificate through, although you can disable this behavior in the Observatory settings window.

21

**How Cryptolog Works:** Cryptolog takes the IP address portion of the request getting logged and encrypts it, as well as a chunk of random data (the salt), using a cryptographic hash function. The salt changes every night, which should result in making it very difficult for us, or anyone else, to recover IP addresses from our logs.

18

22

19

We may ask for additional personal information when you provide feedback or comments, or otherwise communicate with us. We are pleased to receive anonymous donations in the mail, but please note that your personal information is required if you choose to donate using our online form.

23

**How EFF Internal Analytics Works:** EFF endeavors to gather sufficient information for analyzing our website and how visitors move within it without compromising the privacy of our visitors. EFF's internal analytical logging, which is separate from the Cryptolog logs, involves logging for up to seven days a single byte of the IP address, as well as the referrer page, time stamp, page requested, user agent, language header, website visited, and a hash of all of this information. After seven days we keep only aggregate information from these logs. We also geolocate IP addresses before anonymizing them and store only the country.

20

24

21

If you choose to subscribe to EFFector, our free electronic newsletter or any of our other mailing lists, we collect your email address, and, if you choose to provide it, a zip or postal code.

25

**Decentralized Observatory of HTTPS Everywhere:** If you enable the Decentralized Observatory feature of the downloaded browswer extension [HTTPS Everywhere](https://www.eff.org/https-everywhere), we will collect, analyze and publish copies of the certificates of SSL/TLS servers that you connect to. These certificates generally do not identify you and we will take reasonable steps to try to avoid collecting specific certificates that may be used to identify you. In order to help locate man-in-the-middle attacks, the Decentralized Observatory may also log [which ISP](https://secure.wikimedia.org/wikipedia/en/wiki/Autonomous_system_%28Internet%29) you observed the certificate through, although you can disable this behavior in the Observatory settings window.

22

26

27

**Cookies:** We do not use persistent ID cookies on this site. We use session cookies on certain portions of the website. Session cookies expire when you close your browser. You can use [Tor](https://www.torproject.org/) if you wish to keep your connection information anonymous.

28

29

**Voluntarily Submitted Information:** In addition, EFF collects and retains information you voluntarily submit to us. It is up to you whether to submit information to us, and how much information to provide. If you choose to become an EFF member or otherwise donate to EFF, we ask for your name, email address, mailing address and phone number. For online donors and shoppers, we also ask for your credit card number. We also maintain records of our members' use of the Action Center. If you use the EFF Shop, you are asked to provide personal information, such as a shipping address, necessary to complete your transaction.

30

31

We may ask for additional personal information when you provide feedback or comments, or otherwise communicate with us. We are pleased to receive anonymous donations in the mail, but please note that your personal information is required if you choose to donate using our online form.

32

23

33

From time to time, we may ask for personal information on other portions of the site, such as asking you to sign a petition, participate in a contest, or provide prior art for a patent busting project.

24

34

35

**EFFector and other Mailing Lists:** If you choose to subscribe to EFFector, our free electronic newsletter or any of our other mailing lists, we collect your email address, and, if you choose to provide it, a zip or postal code.

36

25

37

## EFF's Use of Information

26

38

27

In general, EFF uses the information provided by you to further its mission, protect privacy, defend freedom, and protect your rights in the digital world.

39

In general, EFF uses the information provided by you to further its mission, including to protect privacy, defend freedom and innovation, and to protect your rights in the digital world**.**

28

40

29

We use member and donor information to process and manage your membership or contribution. If you opt in, we will use your email address to send you updates and alerts on protecting your rights in the digital world, so you may take action, such as contacting your representative in Congress or attending an event. If you choose to complete the "Please tell us why you became a member of EFF" field when donating, this information may be shared with the entire EFF staff and board, and select unattributed quotes may be used to promote our mission, such as including a relevant quote in a grant proposal.

41

**Member and Donor Information:** We use member and donor information to process and manage your membership or contribution. If you opt in, we will use your email address to send you updates and alerts on protecting your rights in the digital world, so you may take action, such as contacting your representative in Congress or attending an event. If you choose to complete the "Please tell us why you became a member of EFF" field when donating, this information may be shared with the entire EFF staff and board, and select unattributed quotes may be used to promote our mission, such as including a relevant quote in a grant proposal.

30

42

31

If you enable the Decentralized Observatory feature of HTTPS Everywhere, we analyze and publish the copies of the certificates of SSL/TLS servers that you connect to. These certificates generally do not identify you and we will take reasonable steps to try to avoid collecting certificates that may be used to identify you.

43

**Invitees to EFF:** If you invite another person to join EFF or take action in one of our alerts, we will ask for that person's name and online contact information. We use this information to contact and, if necessary, remind that person that he or she has been invited to join EFF.

32

44

33

If you invite another person to join EFF or take action in one of our alerts, we will ask for that person's name and online contact information. We use this information to contact and, if necessary, remind that person that he or she has been invited to join EFF.

45

**Publication by EFF:** If you provide information for publication we may use your name and contact information you have provided to us to provide you with attribution.

34

46

35

If you provide information for publication we may use your name to provide you with credit.

47

**Other activities:** We may run surveys, contests, or similar activities through this site. Such information will be used for the purposes for which it was collected. We also look at technical information to diagnose problems with or consider improvements to our servers or related technologies and to administer the eff.org and other websites we host or provide.

36

48

37

We may run surveys, contests, or similar activities through this site. Such information will be used for the purposes for which it was collected.

49

## Third-Party Service Providers to EFF

38

50

39

We look at technical information to diagnose problems with our server and to administer the eff.org site.

51

Portions of the eff.org site, including our individual action alert webpages, are operated by a third-party grassroots campaign service provider or providers. These service providers may place session cookies on your computer. EFF's service providers may also log standard technical information, such as the numerical Internet Protocol (IP) address of the computer you are using; the browser software you use and your operating system; the date and time you access our site; and the Internet address of the website from which you linked directly to our site. Our service providers may also store and organize the personal information collected through this site on our behalf.

40

52

41

## Third-Party Service Providers

53

EFF also uses a third-party credit card processor and hosting providers.

42

54

43

Portions of the eff.org site, including our individual action alert webpages, are operated by third-party grassroots campaign service provider or providers ("Provider"), which are currently Salsa Labs and, for some limited purposes CiviSMTP. Providers may place session cookies on your computer. Providers may also logs standard technical information, such as the numerical Internet protocol (IP) address of the computer you are using; the browser software you use and your operating system; the date and time you access our site; and the Internet address of the website from which you linked directly to our site. Our Providers also store and organize the personal information collected through this site on our behalf for a time.

55

For all of EFF's service providers, hosting providers and credit card processors and any other providers we may use in the future, the information collected from EFF users remains under our control, and our agreement with each will require the information to be kept confidential and disclosed only to employees who require such access in the course of their assigned duties. EFF also requires all of our third-party service providers to notify EFF if they receive legal process seeking information about visitors to EFF's website.

44

56

45

EFF also uses a third-party credit card processor.

57

EFF may change the specific third-party providers from time to time, and will transfer stored information to any new provider subject to similar restrictions and agreements. From time to time, EFF may work with third-party consultants or other service providers who may have access to personally identifiable information. In such cases, we will restrict their use of personally identifiable information in accordance with their assigned tasks.

46

58

47

For EFF's Providers and third-party credit card processor, the information they collect from EFF users remains under our control, and our agreement with each requires the information to be kept confidential and disclosed only to their employees who require such access in the course of their assigned duties. Provider and the credit card processor have also agreed to cooperate with EFF, if necessary, to protect this information from legal process. EFF may change the provider from time to time, and will transfer stored information to the new provider subject to similar restrictions.

59

EFF's site also provides links to a wide variety of third-party websites, including interactive links to sites like Twitter or mapping services. EFF is not responsible for, and does not have any control over, the privacy practices or the content of such third parties. We encourage users to read the privacy policies of any website visited via links from EFF's website.

48

60

49

From time to time, EFF may work with third-party consultants or other service providers who may have access to personally identifiable information. In such cases, we will restrict their use of personally identifiable information in accordance with their assigned tasks.

61

We do occasionally allow our website to interact with other services, like social networking, mapping, and video hosting websites. It is our policy not to include third-party resources when users initially load our web pages, but we may dynamically include them later after giving the user a chance to opt-in. If you believe a third-party resource is automatically loading, please let us know so we can address it.

50

62

51

EFF's site provides links to a wide variety of third-party websites. EFF is not responsible for, and does not have any control over, the privacy practices or the content of such third parties. We encourage users to read the privacy policies of any website visited.

52

53

63

## Disclosure of Your Information

54

64

55

While EFF endeavors to provide the highest level of protection for your information, we may disclose personally identifiable information about you to third parties in limited circumstance, including: (1) with your consent; or (2) when we have a good faith belief it is required by law, such as pursuant to a subpoena or other judicial or administrative order.

65

While EFF endeavors to provide the highest level of protection for your information, we may disclose personally identifiable information about you to third parties in limited circumstances, including: (1) with your consent; or (2) when we have a good faith belief it is required by law, such as pursuant to a subpoena or other judicial or administrative order.

56

66

57

67

If we are required by law to disclose the information that you have submitted, we will attempt to provide you with notice (unless we are prohibited) that a request for your information has been made in order to give you an opportunity to object to the disclosure. We will attempt to provide this notice by email, if you have given us an email address, or by postal mail if you have entered a postal address. If you do not challenge the disclosure request, we may be legally required to turn over your information.

58

68

59

69

In addition, we will independently object to requests for access to information about users of our site that we believe to be improper.

60

70

61

If you enable the Decentralized Observatory feature of HTTPS Everywhere, we publish the copies of the certificates of SSL/TLS servers that you connect to. These certificates generally do not identify you, and we will take reasonable steps to try to avoid collecting certificates that may be used to identify you. In some instances, we may also publish information about which ISPs' networks these certificates were observed on.

62

63

71

## Updating or Removing Your Information

64

72

65

73

You may choose to correct, update, or delete the membership information you have submitted to us by sending an email requesting changes to membership@eff.org. Furthermore, if we inadvertently collect more personal information than intended, we endeavor to delete the extraneous information. However, please understand that deleted information may continue to persist on backup media.

66

74

67

75

## Changes to Our Policies

68

76

+The Electronic Frontier Foundation (EFF) is committed to protecting the privacy of visitors to our website, as well as our members and activists. EFF has established this Privacy Policy to explain what information we collect through this website and how it is used.
+The Electronic Frontier Foundation (EFF) is committed to protecting the privacy of visitors to our website, as well as our members and activists. EFF has established this Privacy Policy to explain what information we collect through our websites and how it is used.
+In this policy, "EFF" refers to EFF staff, board members, cooperating attorneys, interns, volunteers, and consultants, all of whom are bound by law or contract to keep information they receive as part of their assistance to EFF confidential.
+In this policy, "EFF" refers to EFF staff, board members, cooperating attorneys, interns, volunteers, and consultants, all of whom are bound by law or contract to keep confidential information they receive as part of their assistance to EFF.
+EFF does not sell or rent donor information under any circumstances, and we do not share information without prior consent except as compelled by law. (See discussion below.)
+EFF does not sell or rent member, donor or website visitor information under any circumstances, and we do not share member, donor or visitor information without prior consent except as compelled by law. (See discussion below.)
 ## Information Gathered by EFF's Site
+For visitors to our website, we generally log requests to our website through a program called [cryptolog](https://www.eff.org/code/cryptolog). Cryptolog takes the IP address portion of the request getting logged and encrypts it, as well as a chunk of random data (the salt), using a cryptographic hash function. The salt changes every night, which should result in making it very difficult for us, or anyone else, to recover IP addresses from our logs. We also generally do not log other standard technical information, including the browser software you use, your operating system or the Internet address of the website from which you followed a link to our site.
+**Logging:** For visitors to our website, we generally log requests to our website through a program called [cryptolog](https://www.eff.org/code/cryptolog) (cryptolog described [further below]()) and do internal analytical logging (also described [further below]()) for up to seven days from when the data was collected.
+Circumstances in which EFF may need to log and retain technical information include when we believe it is reasonably necessary for conducting site testing, diagnosis of technical problems, and defending against attacks on the site. In those instances we will delete the information as soon as it is apparent the information is no longer needed for the purpose for which it was kept. For more information on EFF's position on data logging and techniques we use to anonymize, obfuscate, aggregate and delete information, see our [Best Practices for Online Service Providers](https://www.eff.org/wp/osp).
+Circumstances in which EFF may need to log and retain technical information for longer than seven days include when we believe it is reasonably necessary for EFF's mission and functionality, including situations such as:
+We do not use persistent cookies on this site. We use session cookies on certain portions of the website. Session cookies expire when you close your browser. You can use [Tor](https://www.torproject.org/) if you wish to keep your technical information anonymous.
+- site testing,
+- diagnosis of technical problems,
+- defending against attacks to the site,
+- handling a spike in traffic or other abnormal, short-term circumstances, or
+- research projects (in anonymized form) that serve our overall mission to defend freedom online.
+In addition, EFF collects and retains information you voluntarily submit to us. It is up to you whether to submit information to us, and how much information to provide. If you choose to become an EFF member or otherwise donate to EFF, we ask for your name, email address, mailing address and phone number. For online donors and shoppers, we also ask for your credit card number. We also maintain records of our members' use of the Action Center. If you use the EFF Shop, you are asked to provide personal information, such as a shipping address, necessary to complete your transaction.
+In those and similar situations we will delete the information as soon as it is apparent that the information is no longer needed for the purpose for which it was retained. For more information on EFF's position on data logging and techniques we use to anonymize, obfuscate, aggregate and delete information, see our [Best Practices for Online Service Providers](https://www.eff.org/wp/osp).
+If you enable the Decentralized Observatory feature of HTTPS Everywhere, we will collect copies of the certificates of SSL/TLS servers that you connect to. In order to help locate man-in-the-middle attacks, the Decentralized Observatory may also log [which ISP](https://secure.wikimedia.org/wikipedia/en/wiki/Autonomous_system_%28Internet%29) you observed the certificate through, although you can disable this behavior in the Observatory settings window.
+**How Cryptolog Works:** Cryptolog takes the IP address portion of the request getting logged and encrypts it, as well as a chunk of random data (the salt), using a cryptographic hash function. The salt changes every night, which should result in making it very difficult for us, or anyone else, to recover IP addresses from our logs.
+We may ask for additional personal information when you provide feedback or comments, or otherwise communicate with us. We are pleased to receive anonymous donations in the mail, but please note that your personal information is required if you choose to donate using our online form.
+**How EFF Internal Analytics Works:** EFF endeavors to gather sufficient information for analyzing our website and how visitors move within it without compromising the privacy of our visitors. EFF's internal analytical logging, which is separate from the Cryptolog logs, involves logging for up to seven days a single byte of the IP address, as well as the referrer page, time stamp, page requested, user agent, language header, website visited, and a hash of all of this information. After seven days we keep only aggregate information from these logs. We also geolocate IP addresses before anonymizing them and store only the country.
+If you choose to subscribe to EFFector, our free electronic newsletter or any of our other mailing lists, we collect your email address, and, if you choose to provide it, a zip or postal code.
+**Decentralized Observatory of HTTPS Everywhere:** If you enable the Decentralized Observatory feature of the downloaded browswer extension [HTTPS Everywhere](https://www.eff.org/https-everywhere), we will collect, analyze and publish copies of the certificates of SSL/TLS servers that you connect to. These certificates generally do not identify you and we will take reasonable steps to try to avoid collecting specific certificates that may be used to identify you. In order to help locate man-in-the-middle attacks, the Decentralized Observatory may also log [which ISP](https://secure.wikimedia.org/wikipedia/en/wiki/Autonomous_system_%28Internet%29) you observed the certificate through, although you can disable this behavior in the Observatory settings window.
+**Cookies:** We do not use persistent ID cookies on this site. We use session cookies on certain portions of the website. Session cookies expire when you close your browser. You can use [Tor](https://www.torproject.org/) if you wish to keep your connection information anonymous.
+**Voluntarily Submitted Information:** In addition, EFF collects and retains information you voluntarily submit to us. It is up to you whether to submit information to us, and how much information to provide. If you choose to become an EFF member or otherwise donate to EFF, we ask for your name, email address, mailing address and phone number. For online donors and shoppers, we also ask for your credit card number. We also maintain records of our members' use of the Action Center. If you use the EFF Shop, you are asked to provide personal information, such as a shipping address, necessary to complete your transaction.
+We may ask for additional personal information when you provide feedback or comments, or otherwise communicate with us. We are pleased to receive anonymous donations in the mail, but please note that your personal information is required if you choose to donate using our online form.
 From time to time, we may ask for personal information on other portions of the site, such as asking you to sign a petition, participate in a contest, or provide prior art for a patent busting project.
+**EFFector and other Mailing Lists:** If you choose to subscribe to EFFector, our free electronic newsletter or any of our other mailing lists, we collect your email address, and, if you choose to provide it, a zip or postal code.
 ## EFF's Use of Information
+In general, EFF uses the information provided by you to further its mission, protect privacy, defend freedom, and protect your rights in the digital world.
+In general, EFF uses the information provided by you to further its mission, including to protect privacy, defend freedom and innovation, and to protect your rights in the digital world**.**
+We use member and donor information to process and manage your membership or contribution. If you opt in, we will use your email address to send you updates and alerts on protecting your rights in the digital world, so you may take action, such as contacting your representative in Congress or attending an event. If you choose to complete the "Please tell us why you became a member of EFF" field when donating, this information may be shared with the entire EFF staff and board, and select unattributed quotes may be used to promote our mission, such as including a relevant quote in a grant proposal.
+**Member and Donor Information:** We use member and donor information to process and manage your membership or contribution. If you opt in, we will use your email address to send you updates and alerts on protecting your rights in the digital world, so you may take action, such as contacting your representative in Congress or attending an event. If you choose to complete the "Please tell us why you became a member of EFF" field when donating, this information may be shared with the entire EFF staff and board, and select unattributed quotes may be used to promote our mission, such as including a relevant quote in a grant proposal.
+If you enable the Decentralized Observatory feature of HTTPS Everywhere, we analyze and publish the copies of the certificates of SSL/TLS servers that you connect to. These certificates generally do not identify you and we will take reasonable steps to try to avoid collecting certificates that may be used to identify you.
+**Invitees to EFF:** If you invite another person to join EFF or take action in one of our alerts, we will ask for that person's name and online contact information. We use this information to contact and, if necessary, remind that person that he or she has been invited to join EFF.
+If you invite another person to join EFF or take action in one of our alerts, we will ask for that person's name and online contact information. We use this information to contact and, if necessary, remind that person that he or she has been invited to join EFF.
+**Publication by EFF:** If you provide information for publication we may use your name and contact information you have provided to us to provide you with attribution.
+If you provide information for publication we may use your name to provide you with credit.
+**Other activities:** We may run surveys, contests, or similar activities through this site. Such information will be used for the purposes for which it was collected. We also look at technical information to diagnose problems with or consider improvements to our servers or related technologies and to administer the eff.org and other websites we host or provide.
+We may run surveys, contests, or similar activities through this site. Such information will be used for the purposes for which it was collected.
+## Third-Party Service Providers to EFF
+We look at technical information to diagnose problems with our server and to administer the eff.org site.
+Portions of the eff.org site, including our individual action alert webpages, are operated by a third-party grassroots campaign service provider or providers. These service providers may place session cookies on your computer. EFF's service providers may also log standard technical information, such as the numerical Internet Protocol (IP) address of the computer you are using; the browser software you use and your operating system; the date and time you access our site; and the Internet address of the website from which you linked directly to our site. Our service providers may also store and organize the personal information collected through this site on our behalf.
+## Third-Party Service Providers
+EFF also uses a third-party credit card processor and hosting providers.
+Portions of the eff.org site, including our individual action alert webpages, are operated by third-party grassroots campaign service provider or providers ("Provider"), which are currently Salsa Labs and, for some limited purposes CiviSMTP. Providers may place session cookies on your computer. Providers may also logs standard technical information, such as the numerical Internet protocol (IP) address of the computer you are using; the browser software you use and your operating system; the date and time you access our site; and the Internet address of the website from which you linked directly to our site. Our Providers also store and organize the personal information collected through this site on our behalf for a time.
+For all of EFF's service providers, hosting providers and credit card processors and any other providers we may use in the future, the information collected from EFF users remains under our control, and our agreement with each will require the information to be kept confidential and disclosed only to employees who require such access in the course of their assigned duties. EFF also requires all of our third-party service providers to notify EFF if they receive legal process seeking information about visitors to EFF's website.
+EFF also uses a third-party credit card processor.
+EFF may change the specific third-party providers from time to time, and will transfer stored information to any new provider subject to similar restrictions and agreements. From time to time, EFF may work with third-party consultants or other service providers who may have access to personally identifiable information. In such cases, we will restrict their use of personally identifiable information in accordance with their assigned tasks.
+For EFF's Providers and third-party credit card processor, the information they collect from EFF users remains under our control, and our agreement with each requires the information to be kept confidential and disclosed only to their employees who require such access in the course of their assigned duties. Provider and the credit card processor have also agreed to cooperate with EFF, if necessary, to protect this information from legal process. EFF may change the provider from time to time, and will transfer stored information to the new provider subject to similar restrictions.
+EFF's site also provides links to a wide variety of third-party websites, including interactive links to sites like Twitter or mapping services. EFF is not responsible for, and does not have any control over, the privacy practices or the content of such third parties. We encourage users to read the privacy policies of any website visited via links from EFF's website.
+From time to time, EFF may work with third-party consultants or other service providers who may have access to personally identifiable information. In such cases, we will restrict their use of personally identifiable information in accordance with their assigned tasks.
+We do occasionally allow our website to interact with other services, like social networking, mapping, and video hosting websites. It is our policy not to include third-party resources when users initially load our web pages, but we may dynamically include them later after giving the user a chance to opt-in. If you believe a third-party resource is automatically loading, please let us know so we can address it.
+EFF's site provides links to a wide variety of third-party websites. EFF is not responsible for, and does not have any control over, the privacy practices or the content of such third parties. We encourage users to read the privacy policies of any website visited.
 ## Disclosure of Your Information
+While EFF endeavors to provide the highest level of protection for your information, we may disclose personally identifiable information about you to third parties in limited circumstance, including: (1) with your consent; or (2) when we have a good faith belief it is required by law, such as pursuant to a subpoena or other judicial or administrative order.
+While EFF endeavors to provide the highest level of protection for your information, we may disclose personally identifiable information about you to third parties in limited circumstances, including: (1) with your consent; or (2) when we have a good faith belief it is required by law, such as pursuant to a subpoena or other judicial or administrative order.
 If we are required by law to disclose the information that you have submitted, we will attempt to provide you with notice (unless we are prohibited) that a request for your information has been made in order to give you an opportunity to object to the disclosure. We will attempt to provide this notice by email, if you have given us an email address, or by postal mail if you have entered a postal address. If you do not challenge the disclosure request, we may be legally required to turn over your information.
 In addition, we will independently object to requests for access to information about users of our site that we believe to be improper.
+If you enable the Decentralized Observatory feature of HTTPS Everywhere, we publish the copies of the certificates of SSL/TLS servers that you connect to. These certificates generally do not identify you, and we will take reasonable steps to try to avoid collecting certificates that may be used to identify you. In some instances, we may also publish information about which ISPs' networks these certificates were observed on.
 ## Updating or Removing Your Information
 You may choose to correct, update, or delete the membership information you have submitted to us by sending an email requesting changes to membership@eff.org. Furthermore, if we inadvertently collect more personal information than intended, we endeavor to delete the extraneous information. However, please understand that deleted information may continue to persist on backup media.
 ## Changes to Our Policies
 ## Security
 EFF employs industry standard security measures to protect the loss, misuse, and alteration of the information under our control. EFF has turned on [HTTPS](https://en.wikipedia.org/wiki/HTTP_Secure) by default.
 Although we make good faith efforts to store information collected by EFF in a secure operating environment, we cannot guarantee complete security. Information collected by EFF will be maintained for a length of time appropriate to our needs. However, we generally do not retain credit card information unless you choose to have us make automatic monthly withdrawals from your account for your donation.
+_Updated October 19, 2011 to reflect: a) implementation of Cryptolog, b) changing from Convio as a provider to a system with different providers that operates differently, including in the information collected, c) use of HTTPS, d) eliminating the specific mention of a protective order since that seemed too specific to apply in all situations and, e) some other small changes._
+_Updated July 24, 2012 to reflect: a) changing our logging practices and promises to reflect our use of analytics; b) include "research" as a basis for longer logging but on an anonymized basis; c) specifically mention situations in which our website interacts with third-party websites in ways that may allow the third party to gain information about visitors to EFF's website, d) allow for third-party hosting providers and e) eliminate the mention of specific service providers so that we do not need to update the page if we change providers but the policies remain the same, and f) specifically include both donors and website visitors as those whose information we do not sell or rent under any circumstances, or share without prior consent.
+_
 ### Previous Privacy Policies
 - [Feb 26 2007 - Jan 4 2009](https://eff.org/policy/2007/02/26)
 - [Jan 5 2009 - Jan 25 2009](https://eff.org/policy/2009/01/05)
 - [Jan 26 2009 - Jun 21 2011](https://eff.org/policy/2009/01/26)
+- [Jun 22 2011 - Oct 18 2011](https://eff.org/policy/2011/06/22)
+- [Oct 19 2011 - Jul 23 2012](https://eff.org/policy/2011/10/19)

EFF Privacy Policy

Full text changes — 20120301_rev01 to 20130817_rev01