Systemic Design, Not User Error: Why Digital Privacy Remains Unsolved
Carnegie Mellon professor Jason Hong argues that tracking is so deeply integrated into digital infrastructure that behavioral changes alone cannot fix it.
Digital privacy remains an elusive goal despite a global climate of frequent data breaches and intense public scrutiny of corporate surveillance. The persistence of tracking is not a result of user negligence, but a systemic failure of the internet's underlying architecture.
In a recent piece for Communications of the ACM titled "Why is Privacy So Hard?", Jason Hong, an Associate Professor at Carnegie Mellon University, examines the structural reasons why privacy is so difficult to achieve. The article is based on a presentation titled "Security and Privacy at the Edge," which Hong delivered at UCSD's Halıcıoğlu Data Science Institute. In the analysis, Hong explores how privacy failures have become endemic across the web and smartphone ecosystems, and warns that these patterns are likely to extrapolate into the emerging Internet of Things (IoT).
The Infrastructure of Tracking
The current digital economy relies on an infrastructure where tracking is not an optional feature, but a fundamental component. Hong questions why constant tracking persists on the web and smartphones even after significant negative press. He suggests that the difficulty in solving privacy stems from the way tracking is integrated into the very fabric of these ecosystems. Because the tools used to build the modern web and mobile apps are designed for data collection, removing that surveillance requires more than just updating a few settings; it requires a fundamental redesign of how these systems operate.
Shifting the Narrative
This systemic perspective shifts the conversation away from the common narrative of individual user error. For years, the burden of privacy has been placed on the consumer—encouraging users to read lengthy terms of service or toggle complex privacy switches. However, Hong's analysis suggests that when tracking is baked into the structural design of device ecosystems, behavioral changes are insufficient. The problem is not that users are failing to protect their data, but that the systems are designed to make that protection nearly impossible.
The Road Ahead
As the industry moves toward a more connected world via the Internet of Things, the stakes for systemic privacy increase. If the failures of the web and smartphones are mirrored in IoT devices, the scope of surveillance will expand from our screens into our physical environments. The primary challenge moving forward will be determining whether the industry can implement structural changes to these ecosystems or if the current trajectory of integrated tracking will become the permanent blueprint for all connected hardware.