Privacy and Data Use Policy

1 Introduction

This Privacy Statement covers how Personal Data is collected, received, used, stored, transferred, shared, processed, and protected on the National Internet Observatory Website at https://nationalinternetobservatory.org/ (the “Website”), and the installation of associated Tools that are developed and distributed by the National Internet Observatory.  

By providing us with your Personal Data or using our Website and Tools,you agree to the data protection practices described in this Privacy Statement. If you do not agree to this Privacy Statement, please do not access or use the Website or Tools.

If you signed an Informed Consent Form to participate in a research Study that uses any of the Tools, additional and/or different policies and practices may apply to Data or Personal Data collected from or about you, as described in your Informed Consent Form. This Privacy Statement does not cover any other personal data processing by Northeastern University, which is covered by other applicable policies and procedures, including Northeastern University’s Privacy Statement.

2 Definitions

The following terms have the following meanings for this Privacy Statement:

  • The “Observatory” refers to the National Internet Observatory, which is research infrastructure that is developed, managed, and maintained by the Observatory Team Members.
  • Observatory Team Members,” “Team Members,” or “We” are the people who build, manage, and maintain the Observatory and are conducting the Observatory Study. The Team includes professors and staff at Northeastern University, and subject matter experts from outside Northeastern University who are paid by the Observatory.
  • The “Observatory Study” refers to the research study described in award # 2131929 from the National Science Foundation under the title “Mid-scale RI-1 (M1:IP): Observatory for Online Human and Platform Behavior.
  • You are a “Study Participant” or a “Participant” if you provide your consent to participate in the Observatory Study by agreeing to participate after reading and signing an Informed Consent Form.
  • You are a “Prospective Study Participant” or a “Prospective Participant” if you begin the Informed Consent Process, whether or not you complete that process, consent to participate in the Observatory Study, or actually participate in the Observatory Study.
  • Data” without other qualifiers refers to information collected through the Website and Tools.
  • External Researchers” are people who are approved for access to Observatory scientific Data for research purposes. External Researchers may include people from a variety of disciplinary backgrounds, including academics, journalists, and public policy Researchers. Although most External Researchers will not be affiliated with the Observatory, Observatory Team Members may also function as External Researchers—in this case, the Team Members must follow all procedures for gaining access to and protecting Observatory Scientific Data that all other External Researchers must abide by.
  • Observatory Website” or “Website” refers to the website at https://nationalinternetobservatory.org/.
  • Tools” refers to software, applications, and online services (excluding the Website) developed and maintained by the Observatory for the purpose of collecting Data and conducting research. When applicable, we describe the data collection practices of particular Tools throughout this Privacy Statement.
  • Personal Data” means any Data about you that contains identifiers or other information that uniquely identifies you.

3 What Data We Collect

We collect Data and Personal Data that you voluntarily give us when you use the Website and Tools.

3.1 Data Collected from the Website and Tools

When you use the Website and Tools, the following information may be created and automatically logged in our systems:

  • Log Data: Information (“log Data”) that your browser automatically sends whenever you visit the Website, or that the Website and Tools automatically send when you use them.  Log Data includes your Internet Protocol (“IP”) address (so we understand which country you are connecting from when you visit the Website), browser type and settings, the date and time of your request, and how you interacted with the Website and Tools.
  • Device Information: Includes type of device you are using, operating system, settings, unique device identifiers, network information and other device-specific information. Information collected may depend on the type of device you use and its settings.
  • Geolocation information.

3.2 Data Collected from the Website

When you visit the Website we will collect Personal Data about your use of the Website using the following methods.

3.2.1 Cookies

The Website uses cookies and other technologies to make it easier for you to use the Website during future visits, monitor traffic on the Website and personalize content. For more information, please see the “Cookies and Other Tracking Technologies” section below for more about how we use cookies and similar technologies, and your choices with respect to them.

3.2.2 Social Network or Third-Party Plug-ins or Widgets

The Website may include social network or third-party plug-ins or widgets that may provide Data to their social networks or third parties about your interactions with the Website, even if you do not click on or otherwise interact with the plug-in or widget. The information is transmitted from your browser and may include an identifier assigned by the social network or third party, information about your browser type, operating system, device type, IP address, and the URL of the Web page where the widget appears. Please read the privacy policies of these sites before you visit them or use their Tools to learn what information they collect, use, and share. We are not responsible for the privacy policies or Data practices of social network or third party sites or third party plug-ins or widgets.

3.3 Data Collected Through the Informed Consent Process

We will collect Personal Data about you if you engage with the Informed Consent Process, as follows:

  • Email address that you provide to enroll in the Observatory Study.
  • Personal Data about how you engage with the Informed Consent Process.  For example, we may collect the time you spend on the total Informed Consent Process and on each consent screen, the questions you answered correctly and incorrectly, whether you clicked on optional screens, and whether or not you provided your consent to enroll in the Observatory Study. We may also collect Data about whether and how you were recruited to the Observatory Study, whether you have completed any surveys (and if so, which ones), and which Tools you have installed.  We may collect this Personal Data whether or not you complete the Informed Consent process, consent to participate in the Observatory Study, or actually participate in the Observatory Study.

Note: If you sign an Informed Consent form, different or additional types of Personal Data may be collected by the respective Study and will be described in and governed by the Informed Consent form that you signed to participate in that Study.

3.4 Data Collected from Third Parties

We may use third party, professional companies to help us recruit participants and administer surveys to participants. These survey companies may provide Personal Data directly to us. This Personal Data may include, but is not limited to, survey responses, individual demographics, and individual unique identifiers. Some of this Personal Data may be retained by these third parties. Participants interested in how these data will be stored and used should contact the relevant third-party companies and review their privacy policies.

We currently rely on services provided by the following third parties, and include links to their privacy policies:

3.5 Survey Responses

Participants will be asked to complete a variety of surveys over time. We will collect your responses to those surveys and associate them with you through a pseudonymous identifier.

We may use web-based platforms developed by Observatory or by third parties (for example, Qualtrics) to implement surveys. In cases where surveys are hosted by third parties, these third parties may have access to survey responses.

3.6 Data from Observatory Tools

The Observatory develops and maintains software, applications, and online services (excluding the Website) for the purpose of collecting Data and conducting research.  The categories of Data collected by each such Tool are generally described below.  For full information about the Data or Personal Data collected from or about you from the Tools, please refer to the Informed Consent Form that you signed to participate in the Study.  

3.6.1 Browser Extension

The National Internet Observatory Browser Extension (the “Extension”) is a piece of software that you may install in your web browser. It collects the following types of Data:

  • Email address that you provide to log in to the Extension.
  • Data about your Internet browsing. After you install our Extension, log in using your email address, and complete the Informed Consent Process, the Extension may collect three types of Data from your browser:
  1. Your “Activity Data” from ANY website you visit using a desktop browser with our study software installed. Activity Data includes a record of the websites visited by Participants, which browser tab was active, playback of media elements like video and audio, and presence detection to determine if the web browser is in active use by a human.
  2. Full content “Website Snapshots” of SOME websites you visit on your desktop computer. Webpage Snapshots include copies of the HTML displayed to Participants in their web browser from a selection of websites.
  3. “Embedded Content” from ANY website you visit using a desktop browser with our study software installed. Embedded Content includes copies of specific content from websites visited by participants. For example, embedded content might include banner advertisements, social media posts and widgets, or text containing particular keywords.

3.6.2 Mobile Data

The Observatory mobile app is software that you may install on your mobile device. It collects the following types of data:

  • Email address that you provide to log in to the Observatory.
  • Data about your Internet communications. This Data is collected from the Internet communications that occur between participants’ mobile devices and the servers they contact. After you install our app, log in using your email address, and complete the Informed Consent Process the app will collect the following types of data:  
  1. Data about the Internet services that you use. For example, we could determine that you use particular apps or visit particular websites.
  2. Data about how much and when you communicate with Internet services. For example, based on this Data, we could distinguish between downloading a news article, an image, or a video stream based on the amount of data being sent by your mobile device.
  • Your “Activity Data” from ANY mobile app you use on a mobile device with our study software installed. Activity Data includes a record of the apps opened by Participants and the duration they were open.
  • “Embedded Content” from ANY app you open on a mobile device with our study software installed. Embedded Content includes copies of specific content from apps opened by participants. For example, embedded content might include banner advertisements, social media posts and widgets, or text containing particular keywords.

4 How We Use Data We Collect

In general, we may use your Data and Personal Data for the purposes described below:

  • To study how people and companies behave on the Internet
  • To manage and administer the Website and Tools
  • To better understand how visitors interact with the Website (including through the use of cookies and similar technologies) and ensure that the Website is presented in the most effective manner for you
  • To respond to your requests for help or assistance
  • To facilitate communication with you, send you reminders about surveys, communicate changes to this Privacy Statement, and to authenticate your identity
  • To Study, modify, or improve the study Recruitment and Informed Consent Processes
  • To recruit Prospective Study Participants
  • To prevent fraud or criminal activity, misuses of the Website and Tools, and to ensure the security of our IT systems, architecture, and networks
    To (a) comply with legal obligations and legal process, (b) respond to requests from public and government authorities including public and government authorities outside your country of residence; (c) enforce our terms and conditions; (d) protect our operations; (e) protect our rights, privacy, safety or property, and/or that of you or others; and (f) allow us to pursue available remedies or limit the damages that we may sustain.

If you provided your consent through an Informed Consent Process, your Personal Data will be used in many research studies and other projects, as described in the Informed Consent that you signed. Data, including Personal Data collected from your use of Observatory Tools, will be shared with External Researchers for scientific research purposes. Aggregated, de-identified Data, including survey responses and Data collected through the Observatory Tools, may be shared publicly.  

We will not ask for any additional consent from you each time your Data is used for a new study or shared with an External Researcher.

5 How We Share and Disclose Data We Collect

5.1 For Scientific Purposes

We collect Data and Personal Data from individuals who have and have not consented to the Observatory Study. We now describe how we share and disclose Data and Personal Data from each type of individual.

Except as otherwise described in this Privacy Statement, we do not sell or rent Personal Data with third parties.

5.1.1 Data and Personal Data from Individuals collected during the recruitment and consent process

We may use Data and Personal Data collected during the Recruitment and Informed Consent Processes for scientific purposes, including Data and Personal Data from those who do not complete the consent process or who decline to enroll in the Observatory Study. If we publish a scientific paper about our Recruitment and Informed Consent Processes, we may share individual-level, de-identified Data supporting those findings publicly, only after an assessment that there is no significant chance that you will be re-identified.

5.1.2 Data from Individuals Who Have Consented to the Observatory Study

We may share access to your Data and Personal Data with External Researchers. External Researchers will access Data in a secure “clean room” environment on computers controlled by the Observatory. External Researchers will only be able analyze Data within this environment, and the Data may not leave the environment. This environment will be operated and maintained by the Observatory. External researchers will access the environment remotely once they have applied for access, been approved for access, and authenticated. All activity in the environment will be logged to help prevent misuse of Data.

We may make some aggregate, de-identified Data openly available to the public. Aggregate Data summarizes something about many people instead of just one person—for instance, how many websites the average participant visits each day. We will only make aggregate Data publicly available if it cannot be re-identified.

5.2 In Response to Requests from Law Enforcement

The Observatory is covered by a Certificate of Confidentiality from the National Institutes of Health. This means that we cannot release or use your Data that may identify you in any legal action or lawsuit unless you say it is okay. We also cannot provide it as evidence unless you have agreed. This protection includes federal, state, or local civil, criminal, administrative, legislative, or other proceedings. An example would be a court subpoena.


The Certificate DOES NOT stop reporting that federal, state, or local laws require. Some examples are laws that require reporting of child or elder abuse, some communicable diseases, and threats to harm yourself or others. The Certificate CANNOT BE USED to stop a sponsoring United States federal or state government agency from checking records or evaluating programs. The Certificate also DOES NOT prevent your information from being used for other research if allowed by federal regulations.
 
We may release information about you when you say it is okay. For example, you may give us permission to release information to insurers, medical providers or any other persons not connected with the research. The Certificate of Confidentiality does not stop you from willingly releasing information about your involvement in this research. It also does not prevent you from having access to your own information.

6 Cookies and Other Tracking Technologies

We may use certain technologies to collect information about your use of our Website and Tools to operate the Website and Tools, conduct analytics, improve your user experience, and for scientific purposes.

6.1 Cookies

The Website uses “cookies” which are text files placed on your device when you visit a site that help us understand how you use the Website. Some cookies remain on your computer after you leave the Website (these are called “persistent” cookies). Others are deleted automatically when you close your browser and others simply expire (these are called ‘session’ cookies). For more details on cookies please visit All About Cookies.

By choosing to use the Website after having been notified of our use of cookies in the ways described in this Privacy Statement, and, in applicable jurisdictions, through notice and unambiguous acknowledgement of your consent, you agree to such use.

We use the following cookies:

  • Strictly Necessary Cookies/session – Used to operate the Website and provide users with the functionality available through the Website, including log-in and access to secure areas. These cookies are essential for using and navigating the Website and without them basic functions of our Website would not work. Because these cookies are strictly necessary to deliver the Website, you cannot refuse them.
  • Analytics – Used to better understand the behavior of the users on our Website and improve our functionality accordingly, for example by making sure users are finding what they need easily.
  • Functionality – Used to enhance the performance and functionality of the Website.

If you reject, turn off, or block cookies, some parts of our Website and other Tools may not function correctly. Also, blocking cookies will not stop us or third parties from collecting your IP address and certain other types of technical information that may uniquely identify your browser.

6.2 HTML5 Local Storage

HTML5 local storage enables browsers to distinguish your device from others and remember data that may be important for the functioning of the Website and Tools. Typically, HTML5 local storage is only deleted if all Internet history, cache, and cookies are deleted. Please check your browser software for how to delete HTML5 local storage.

6.3 E-tags

E-tags are used to prevent duplicative downloading of content to your browser, which can enhance browser performance. E-tags use unique identifiers for content that can also be used to distinguish your browser in certain instances from others. Typically, e-tags are only deleted if all Internet history, cache, and cookies are deleted. You should check your browser software for how to delete e-tags in your case.

6.4 Digital Marketing and Ad Networks

The Website may include social network or third-party plug-ins or widgets. These Third Parties may collect Personal Data about you from other sources. Some third parties involved in advertising operations may maintain their own proprietary consumer databases that allow them to personally identify or track website visitors. Other third parties have proprietary technologies to determine what additional devices you may use, on which it can display relevant advertisements.

7 Information Security

We take reasonable administrative and technical steps to protect the Personal Data from loss, misuse and unauthorized access, disclosure, alteration, or destruction and, where feasible, systems that solicit or display personally identifiable information are protected by authentication and authorization controls and Web-based experiences involving personal information are generally secured by TLS (Transport Layer Security). However, no method of transmission over the internet is 100% secure. Therefore, while we strive to protect your data, we cannot guarantee its absolute security.

8 Retention

Your Data, including Personal Data, may be retained indefinitely by the Observatory, even if you withdraw from or never enroll in the study, unless we are required by law to delete Data. We retain Data so that we can identify and distinguish Data from Participants who are opted-in and opted-out of the Study.

In some circumstances we may de-identify your Personal Data so that it can no longer be associated with you, in which case it is no longer Personal Data.

9 Updating or Removing Your Personal Data

If you need to change or correct your Personal Data, or wish to have it deleted from our systems, you may contact us via email at optout@nationalinternetobservatory.org. We will address your request as required by applicable law.

If you withdraw from the Observatory Study, we will stop collecting data from you. Note that any Data that has already been de-identified or aggregated and subsequently shared with External Researchers or the public cannot be associated with you and therefore cannot be deleted. Even if we can identify Data that we have already collected from you as yours, we might keep and continue to use it.

10 Individuals Outside the United States

It is not anticipated that individuals outside of the United States will visit or use the Website or Tools or participate in the Observatory Study, and we do not knowingly collect Personal Data from individuals located or that reside outside of the United States. Please see the Privacy Statement of Northeastern University regarding the protection of data of individuals from the European Union or the European Economic Area countries of Iceland, Liechtenstein, and Norway.

11 Children’s Privacy

We do not knowingly solicit or collect Personal Data from users under the age of 18. If you believe we have inadvertently collected information about a child under 18 through Website or Tools, please, please contact us and we will endeavor to delete the information.

13 Changes to this Statement

The Privacy Statement is subject to change at any time, and the revision date will be noted here. We encourage users to regularly review the Privacy Statement for any changes. We will notify you if we make any material changes, pursuant to the applicable law.

14 Document Version History

  • Version 3, May 19, 2023: Added section 3.6.2 -- Mobile Data
  • Version 2, August 17 2022: Restructured around data practices rather than individual Websites and Tools
  • Version 1, July 13, 2022: Initial release.