Tumblr announced on Monday it was being bought by tech giant Yahoo! for $1.1 billion in one of the largest social media buyouts in years, but while the purchase will make Tumblr’s founders rich, it may bode poorly for the privacy protections of Tumblr users.
In a recent report card from the Electronic Frontier Foundation (EFF), comparing which tech companies protect user’s data from government snooping, Yahoo received one of the lowest scores with only one out of five stars. Tumblr performed significantly better, receiving three stars for requiring a warrant for content, fighting for users’ privacy rights in Congress, and publishing law enforcement guidelines.
A Yahoo spokesperson told reporters in January that the company was requiring warrants for email content data on fourth amendment grounds, joining Google others tech giants. It’s not yet clear how Yahoo will integrate Tumblr into the company, although Yahoo has promised “not to screw it up” in a press statement and said Tumblr will be independently operated as a separate business with David Karp remaining as CEO.
Online privacy law has lagged significantly behind technology advancements. Under the statute governing law enforcement access to digital communications — including private messages over Tumblr’s Fanmail and Yahoo email — the Electronic Privacy Communications Act (ECPA) of 1986, content data over 180 days old stored remotely only requires an administrative subpoena to access, which has a lower threshold of proof than a probable cause warrant.
There are a number of current legislative proposals to update ECPA, one of which was approved by the Senate Judiciary Committee in late April. The U.S. Court of Appeals for the Sixth Circuit ruled email providers cannot be compelled to turn over the content of messages without a probable cause warrant no matter how long the information has been stored in the cloud in United States v. Warshak. That ruling only applies to the four states in the court’s jurisdiction.