Can the government use My Vote Forward data?

Any data an operator of the My Vote Forward framework holds could, in principle, be sought by a government agency through legal process such as a warrant or subpoena, and the strength of legal protections depends on the type of data, the jurisdiction, and the purpose. The United States Supreme Court held in Carpenter v. United States (2018) that the government generally needs a warrant to obtain historical cell-site location records from a phone company, but the Court called that decision “a narrow one.” The framework’s main protection is therefore structural: collect as little individual data as possible, never handle official ballots, keep opinions private by default, and publish only aggregate results that pass privacy review.

The objection in its strongest form

The objection to My Vote Forward here is that any system recording people’s political priorities and opinions creates a list that governments may want. Today’s administration may be benign; a future one may not. Law enforcement can seek records with subpoenas and warrants. Intelligence agencies have broad authorities. Legislatures can pass new laws requiring disclosure. If a public body partners with the operator, records may become subject to public records requests. And even “anonymous” aggregates can sometimes be traced back to individuals. A privacy policy is a promise from an organization that may not exist in ten years, under laws that may change.

The critic adds that the risk is not symmetric. People with unpopular views, people in precarious immigration or employment situations, and people in small communities have the most to lose and the most reason to stay away. If they stay away, the results become less representative, and the framework fails at its purpose.

Why the objection matters

Government access matters for My Vote Forward because opinions on political questions are among the most sensitive data a person can share. Fear of surveillance would chill participation and distort results. The framework’s claim that opinions are private by default is only as good as its answer to compelled disclosure. See who can see my data? for the general access question and can someone be punished for an opinion? for the harm.

Defined terms

• Warrant: a court order authorizing a search, issued on probable cause.
• Subpoena: a legal demand for records or testimony, often issued without a judge’s prior finding of probable cause.
• Third-party doctrine: a line of United States cases holding that people have reduced privacy expectations in information they share with third parties such as banks or phone companies.
• Public records law: a law, such as the federal Freedom of Information Act, giving the public a right to request government records.
• Data minimization: collecting and keeping only the data needed for a stated purpose.
• Aggregate release: a published group result that does not show individual records. See published release.

Evidence

The Fourth Amendment protects “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures,” and provides that “no warrants shall issue, but upon probable cause, supported by oath or affirmation”.⁠¹ How that applies to records held by a company is the subject of the third-party doctrine.

In Carpenter v. United States, decided June 22, 2018 by a 5 to 4 vote, the Supreme Court held that the government “must generally obtain a warrant supported by probable cause” before acquiring historical cell-site location records, and declined to extend the earlier third-party cases, Smith and Miller, to that data.⁠² The Court also wrote, “Our decision today is a narrow one”.⁠² Whether Carpenter’s reasoning would protect a person’s recorded political priorities held by a civic platform is not settled by the decision.

Public records laws can reach data held by governments. The federal Freedom of Information Act gives the public a right to request records from federal agencies, subject to nine exemptions that protect interests including personal privacy, national security, and law enforcement.⁠³ State public records laws differ. If a public body, rather than an independent operator, held participant data, those laws could apply, with their own exemptions.

Aggregates are not automatically safe. NIST’s Guidelines for Evaluating Differential Privacy Guarantees (SP 800-226, March 2025) states that “even aggregate statistics can inadvertently leak information from individual data points,” and that mathematical results show “publishing enough statistics will always result in accurate reconstruction attacks”.⁠⁴ NIST recounts that in 1997 researchers used gender, ZIP code, and birth date from public voter registration data to re-identify individuals in de-identified medical records, including Massachusetts Governor William Weld, and that 87% of the United States population can be uniquely identified by those three elements.⁠⁴ The Census Bureau reports a simulated attack that reconstructed 2010 Census records for 97 million people;⁠⁵ its page on differential privacy now carries a notice that its information is no longer current while the Bureau evaluates alternatives under a Commerce Department order prohibiting noise infusion.⁠⁵

How comparable systems have handled it

Systems that handle sensitive civic data use three kinds of protection.

• Do not hold the data. Secret ballots are designed so that no record links a voter to a vote. See secrecy and the secret ballot.
• Hold less and delete sooner. Data minimization limits what any legal demand can reach.
• Protect releases mathematically. Differential privacy, as described by NIST, is designed so that releases are “resistant to all (even not yet developed) privacy attacks” within its stated guarantees.⁠⁴ See differential privacy.

Competing interpretations

One interpretation holds that the legal system provides adequate protection: warrants require judicial approval, and courts have extended protections to new technologies, as in Carpenter.⁠² On this view, the objection exaggerates the risk.

A second interpretation holds that legal protections are uneven and can change, and that the only reliable protection is not holding the data. On this view, any system that stores named political opinions is a liability regardless of its policies.

A third interpretation holds that some government use is legitimate and desirable: a public body that commissions a priority pilot should see aggregate results. On this view, the problem is not government use of aggregates but access to individual records, and the design should distinguish them sharply.

What the framework answers

My Vote Forward’s position follows the second and third interpretations.

• No ballots. The framework never handles official ballots, so no ballot data can be demanded from it. See private voting.
• Minimize individual data. Any real deployment would collect only what is needed, separate identity records from participation records, and set short retention periods. See privacy.
• Opinions private by default. Individual opinions are not published unless a person chooses to share a specific one. See consent.
• Aggregates only, with review. Releases pass a privacy review including small-group suppression and, where appropriate, formal privacy methods. See published releases.
• Transparency about demands. Any real operator should publish how many legal demands it received and how it responded, to the extent law allows.
• No promise of immunity. The framework does not claim participant records can never be compelled.

Hypothetical example. A county commissions a priority pilot. Under the pilot’s terms, the operator holds participation records and the county receives only reviewed aggregate releases. Identity records are kept separately and deleted after verification. If the county later received a public records request, it would hold no individual records to disclose; any demand for records would have to go to the operator, whose retained data would be limited by design.

Where the objection still wins

The objection wins on uncertainty. Legal protections for political opinion data held by a civic platform are not settled, they differ across jurisdictions, and they can change. Data minimization limits exposure but does not eliminate it while records exist. Aggregate releases can leak information if poorly designed, as NIST and the Census Bureau’s reconstruction work show.⁠^4,5 And participants’ fear is itself a harm: even if no records are ever demanded, people who believe they might be will stay away. The framework has no operating history, no transparency report, and no legal review of its design.

Unresolved questions

• Should a real deployment hold any named opinion records at all, or use designs where the operator cannot link opinions to identities?
• How should privacy protections for aggregate releases be balanced against the accuracy institutions need?
• Should an operator be located in a jurisdiction chosen for its legal protections, and what would that mean for accountability?
• How should a pilot partnered with a public body handle public records laws?

Related

• Who can see my data?
• Privacy
• Differential privacy
• Why should anyone trust published releases?
• Hard questions