Policy Recommendations

Over the 15 consecutive years of internet freedom’s decline, Freedom House and other members of the digital rights community have offered clear, practical recommendations for protecting freedom online and reversing this trajectory. However, implementation has lagged behind rhetoric and the velocity of change in digital infrastructure and tools. As democracies cut foreign assistance budgets and private companies retreat from rights-respecting approaches, the global balance of digital power may tip further toward those who see the internet as a tool of control rather than of freedom. The urgency to act has never been greater. Protecting human rights online and rebuilding a free, open, and secure internet will require sustained commitment, resources, collaboration, and imagination from governments, the private sector, and civil society.

Civil society actors are indispensable partners in defending human rights online and countering authoritarian digital repression. To ensure that civil society can continue to build tools that advance rights, provide essential analysis, and conduct critical advocacy and programming, democratic governments and companies must strengthen—not reduce—their financial and political support. There is no time to waste: with coordinated action, it is still possible to reclaim the internet as a space for freedom, accountability, and human dignity.

15 Consecutive Years of Decline: Addressing Key Drivers of Digital Repression

Freedom on the Net research over the past 15 years has illustrated how the major drivers of digital repression are consistently related to restrictions on free expression, the manipulation of the online environment, and restrictions on privacy and disproportionate government surveillance. The following recommendations outline how governments and companies can and should address these perennial challenges. Many of these recommendations will look familiar—because they are. The fundamentals of protecting human rights online have not changed, and sustained implementation of these principles remains essential to reversing and preventing global declines in internet freedom.

1. Countering Restrictions on Freedom of Expression

Freedom of expression online has been and is increasingly under attack as governments shut off internet connectivity, block social media platforms, and restrict access to websites that host political, social, and religious speech. Protecting freedom of expression will require strong legal and regulatory safeguards for digital communications.

Governments

Governments should maintain access to internet services, digital platforms, and anticensorship technology, particularly during elections, protests, and periods of unrest or conflict. Imposing outright or arbitrary bans on social media and messaging platforms unduly restricts free expression. Governments should address any legitimate risks posed by these platforms through existing democratic mechanisms, such as regulatory action, security audits, parliamentary scrutiny, and legislation passed in consultation with civil society. Other methods to address legitimate security problems include strengthening legal requirements for platform transparency, data privacy, cybersecurity, and responsibility for mandatory human rights due diligence and risk assessments. Any legal restrictions for online content should adhere to international human rights standards of legality, necessity, and proportionality, and include robust oversight, transparency, and consultation with civil society and the private sector.

Legal frameworks addressing online content should uphold internationally recognized human rights and establish special obligations for companies that are tailored to their size and services, incentivize platforms to improve their own standards, and require human rights due diligence and reporting. Such obligations should prioritize transparency across core products and practices, including content moderation, recommendation and algorithmic systems, collection and use of data, and political and targeted advertising. Laws should ensure that vetted researchers are able to access platform data in a privacy-protecting way, allowing them to provide insights for policy development and civil society’s broader analysis and advocacy efforts.

Safe-harbor protections for intermediaries should remain in place for most of the user-generated and third-party content appearing on platforms, so as not to encourage these companies to impose excessive restrictions that inhibit free expression. Laws should also reserve final decisions on the legality and removal of content for the judiciary. Independent regulators with sufficient resources and expertise should be empowered to oversee the implementation of laws, conduct audits, and ensure compliance.

Companies

Companies should commit to respecting the rights of people who use their platforms or services, and to addressing any adverse impact that their products might have on human rights. Companies should support the accessibility of anticensorship technologies, including by making them more affordable, and resist government orders to shut down internet connectivity or ban digital services. Service providers should use all available legal channels to challenge content removal requests—whether official or informal—that would violate international human rights standards, particularly when they relate to the accounts of human rights defenders, civil society activists, journalists, or other at-risk individuals.

If companies cannot resist such demands in full, they should ensure that any restrictions or disruptions are as limited as possible in duration, geographic scope, and type of content affected. Companies should thoroughly document government demands internally and notify people who use their platforms as to why connectivity or content may be restricted, especially in countries where government actions lack transparency. When faced with a choice between a ban of their services and complying with censorship orders, companies should bring strategic legal cases that challenge government overreach, in consultation or partnership with civil society.

Protecting Digital Rights in the Future

Even as the main drivers of repression remain unchanged, new forces are beginning to redefine the contours of digital freedom: government-backed AI development, the growth of satellite internet, and the proliferation of age-verification mandates. Freedom House and its partners are monitoring these developments, as their governance and implementation could profoundly affect the future of human rights online.

Government-backed AI development: As governments deploy AI services and develop their own systems, they should conduct human rights impact assessments to ensure that their products do not curtail freedom of expression and other fundamental rights. This includes identifying key human rights risks, empowering impacted communities to comment on potential human rights impacts, developing and implementing mitigation plans, and evaluating the success or shortcomings of those plans. In addition, governments should limit data collection for AI systems to strictly what is needed to provide a necessary service. It is also important that governments transparently communicate with stakeholders about how they are addressing actual and potential human rights impacts. Similarly, when the private sector partners with governments to develop AI systems for public services, they should conduct human rights due diligence. Localization and customization should never be prioritized over human rights principles.

The growth of satellite internet: Satellite internet providers should use all resources at their disposal to reject or contest disproportionate government demands that contravene international human rights standards or lack a valid judicial warrant. The Global Network Initiative, as a multistakeholder forum dedicated to government and company policies and practices relating to technology and human rights, offers guidance around navigating and mitigating these pressures.

The proliferation of age-verification mandates: Governments should avoid mandating that platforms implement age-verification or age-assurance systems, which often harm privacy and security. If such measures are put in place, they should embed data-minimization requirements, limit the provision of data to third parties and government agencies, and require the strongest possible cybersecurity measures. Governments should create stronger privacy protections for children, such as by requiring platforms that allow children to create accounts to make them private by default, and to alter algorithmic recommendation systems to limit children’s exposure to harmful content. They should also provide greater resources for investigations into online child abuse. Platforms that allow children to create accounts have an obligation to ensure that their services offer controls to ensure strong privacy and security safeguards, and should consult widely with civil society about how to protect children without infringing on their rights.

2. Countering Manipulation of the Online Environment

Governments should encourage a whole-of-society approach to fostering a high-quality, diverse, and trustworthy information space. The Global Declaration on Information Integrity Online identifies best practices for safeguarding the information ecosystem, to which governments should adhere. For example, the declaration lays out recommendations for how to support an information ecosystem that “respects human rights and supports open, safe, secure, prosperous and democratic societies,” enables the production of “accurate, trustworthy, and reliable information,” and protect populations that are often targeted for online harassment and threats.

Laws aimed at increasing platform responsibility as described above—such as those that boost transparency, provide platform data to vetted researchers, and safeguard free expression—are pivotal to countering threats to a reliable information ecosystem. Governments should also support independent online media and empower ordinary people with the tools they need to identify false or misleading information and to navigate complex media environments. They should proactively and directly engage with their constituencies to disseminate credible information and build trust. Governments should support the work of independent civil society organizations that conduct fact-checking efforts, civic education initiatives, and digital literacy training, as well as those that focus on human rights and democracy work more broadly.

Companies

The private sector has a responsibility to ensure that its products contribute to, and do not undermine, a diverse and reliable information space and the protection of freedom of expression. Companies should invest in staff tasked with work related to public policy, access to reliable information, trust and safety, and human rights, including teams of regional and country specialists. These teams should collaborate closely with civil society groups around the world to understand the local impact of their companies’ products and policies. Without such expertise, the private sector is ill-equipped to address harassment, abuse, and false and misleading information that can have serious offline consequences. Social media firms should also develop mechanisms for and expand researchers’ access to platform data, allowing for independent analysis of harassment, influence operations, and other trends online.

Companies should continue to develop effective methods to watermark AI-generated content, which entails the use of a cryptographic signature. While not a silver-bullet solution, watermarking could be useful when combined with other labeling of AI-generated media for individual awareness, as well as coordination with civil society, academia, and technical experts on industry standards for documenting the provenance of specific content. When assessing how to appropriately enhance content provenance, companies should consider privacy risks for human rights defenders and other vulnerable users.

As more government agencies seek to engage with technology firms, companies should tailor their engagement based on an assessment of whether the bodies operate independently and without political interference, in consultation with in-country civil society. Companies should specifically adopt processes to ensure that engagement does not undermine free expression, access to information, due process, and other fundamental rights. For example, formal and informal demands for content removal should be thoroughly documented and evaluated for human rights impact.

3. Countering Restrictions on Privacy and Disproportionate Government Surveillance

Comprehensive data-protection regulations and industry policies on data protection are essential for upholding privacy and combating disproportionate government surveillance, but they require careful crafting to ensure that they do not contribute to internet fragmentation—the siloing of the global internet into nation-based segments—and cannot be used by governments to undermine privacy and other fundamental freedoms.

Governments

Democracies should collaborate to create interoperable privacy regimes that comprehensively safeguard user information, while also allowing data to flow across borders to and from jurisdictions with similar levels of protection. Individuals should be given control over their information, including the right to access it, delete it, and easily transfer it to providers of their choosing. Laws should include guardrails that limit the ways private companies can use personal data for AI development and in their AI systems, including algorithmic recommendations.

Governments should ensure that independent regulators and oversight mechanisms have the ability, resources, and expertise to ensure foreign and domestic companies’ compliance with updated privacy, nondiscrimination, and consumer-protection laws.

Government surveillance programs should adhere to the International Principles on the Application of Human Rights to Communications Surveillance, a framework agreed upon by a broad consortium of civil society groups, industry leaders, and scholars, and launched at the UN Human Rights Council in Geneva in September 2013 by the Electronic Frontier Foundation. The principles, which state that all communications surveillance must be legal, necessary, and proportionate, should also be applied to AI-driven and biometric surveillance technologies, targeted surveillance tools like commercial spyware and extraction software, and open-source intelligence methods such as social media monitoring.

Companies

Companies should mainstream end-to-end encryption in their products, support anonymity software, and uphold other robust security protocols, including by notifying victims of surveillance abuses and resisting government requests to provide special decryption access. Digital platforms should use all available legal channels to challenge problematic requests from state agencies, whether they are official or informal, especially when they relate to the accounts of human rights defenders, civil society activists, journalists, or other at-risk individuals.

Companies should minimize the collection of personal information, such as health, biometric, and location data, and limit how third parties can access and use it. Companies should also clearly explain to people who use their services what data are being collected and for what purpose.