Table of Contents
- Definitions
- Introduction
- Terms of Service and Privacy Policy Documents
- Terms of Service and Privacy Policy Change Notification
- Process for Terms of Service Enforcement
- Transparency About Terms of Service Enforcement
- Identity Policy
- Security Oversight
- Third-Party Requests for User Data
- Data Control
- Data Collection
- Minimal Data Collection
- Data Use
- Data Retention and Deletion
- Threat Notification
- User Notification About Third-Party Requests for User Information
- Transparency Reporting
- Governance
- Open Source
- Interoperability
- Ownership
- Resale
- Functionality Over Time
- Privacy by Default
- Best Build Practices
- Authentication
- Encryption
- Known Exploit Resistance
- Vulnerability Disclosure Program
- Security Over Time
- Product Stability
- Personal Safety
- Open Innovation
- Business Model
- Repair Accessibility
- Repair Penalty
- Data Benefits
Identity Policy
Criteria: I can register using any name and identifying characteristics I wish, or keep my identity completely anonymous.
See this test in action:
Indicators
- The company does not require users to verify their identity with their government-issued identification, or with other forms of identification that could be connected to their offline identity.
Methodology for Assessing Each Indicator
1) The company does not require users to verify their identity with their government-issued identification, or with other forms of identification that could be connected to their offline identity.
- Obtain and review a copy of the product’s terms of service and privacy policy.
- Look for language regarding information that the company collects.
- Look for information regarding any sort of requirement that the user must use a legal name, or provide any copies of identification like a drivers’ license in order to use the product.
- Try to set up an account using the device or application. See what information is collected and whether that information is verified in any way.
- If identity verification is not required, mark PASS.
- If information is required that could be linked to an offline identity, but does not require government-issued documents, mark PARTIAL PASS.
- If users are required to verify identity using government-issued documents, mark FAIL.