Executive summary

The 2020 Ranking Digital Rights Corporate Accountability Index evaluated 26 of the world’s most powerful digital platforms and telecommunications companies on their publicly disclosed commitments and policies affecting privacy and freedom of expression and information. These companies held a combined market capitalization of more than USD $11 trillion. Their products and services affect a majority of the world’s 4.6 billion internet users.

In 2020, we saw improvements by a majority of companies and found noteworthy examples of good practice. But these things were overshadowed by findings demonstrating that the global internet is facing a systemic crisis of transparency and accountability. Users of the world’s most powerful digital platforms and telecommunications services are largely in the dark about who has the ability to access their personal information and under what circumstances. People lack basic information about who controls their ability to connect, speak online, or access information, and what information is promoted and prioritized.

The 2020 RDR Index ranking

The 2020 RDR Index is the fifth RDR Index since 2015. In 2020 we added two new companies, Amazon and Alibaba, and used an expanded methodology with new indicators examining company disclosures related to their use of algorithms and targeted advertising.

• Twitter earned first place in this year’s ranking of digital platforms, due to its comparatively strong transparency about its enforcement of content rules and of government censorship demands.
• Telefónica retained its top spot in 2020 and earned the highest governance score of all companies (including digital platforms) by nearly 20 points for its strong human rights commitments.
• Ooredoo earned the lowest score of all companies in the 2020 RDR Index. The Qatari telco disclosed less than any other telecommunications company that we evaluated about its governance processes to ensure respect for human rights.
• Amazon ranked last among digital platforms. The e-commerce giant scored only 20 out of 100 possible points, showing just how far behind the company is on transparency and accountability around users’ rights, particularly when compared to other major U.S.-based digital platforms. It disclosed very little about how it handles or secures user information, and nothing about its data retention policies, despite its deep reliance on user data to fuel its business model.

Surprising news from U.S. and Chinese e-commerce rivals

In 2020, we added Amazon and the Chinese e-commerce giant Alibaba to the RDR Index for the first time, to allow us to assess two of the world’s biggest online retailers whose digital products and services have tremendous power over the online and offline lives of most of the world’s internet users.

Alibaba bested Amazon by five points, disclosing more information about its data collection, handling, and retention practices, likely owing to China’s increasingly tight regulations on personal data. In its disclosures concerning how it responds to government demands for user data, Amazon did offer more information than Alibaba, but far less than its U.S. peers. The bottom line: Amazon appears to be doing more to protect users from government-perpetrated human rights violations than Alibaba, at least in its home market. But the company has failed to disclose basic information about policies and practices that would help users understand the human rights risks they face when using Amazon’s products and services.

The good news

Since we launched the first RDR Index in 2015, the number of companies pledging to protect users’ freedom of expression or privacy, or both, has grown steadily. The number of companies that conduct any type of human rights due diligence has grown every year as well.

In 2020, nearly all of the companies evaluated in the 2019 Index improved disclosure in multiple areas affecting users’ freedom of expression and privacy. With the exceptions of Google and AT&T, every company surpassed its 2019 scores on comparable indicators.

Users of some digital platforms are getting more information about how their speech is policed. Apple was the second-most improved digital platform, thanks primarily to its new human rights policy and improved transparency around app store removals. More platforms reported information about how they enforce their private content rules. In 2020, seven companies published some type of data about content removed or accounts suspended for rules violations, up from zero in 2015.

Company disclosures around data security have also improved over time. In 2020, half of the 26 companies we ranked disclosed information about how they handle data breaches—up from only three when we first started tracking the issue in 2017.

Companies headquartered in the world’s toughest regulatory environments made notable efforts to improve.

• Mail.Ru, owner of Russian social media platform VK, was the most improved digital platform owing to its new, explicit commitments to privacy and freedom of expression and information.
• Baidu, which operates China’s leading internet search engine, was the third-most improved digital platform. It improved many disclosures, but still kept silent about government censorship and surveillance requirements.
• MTN was the most improved telco. The South African company saw a wave of improvements on human rights due diligence, along with the arrival of a new CEO.
• Etisalat and Ooredoo, the largest telcos in the Middle East, both unveiled privacy policies for the first time.

These companies all remain in the bottom half of our ranking. But their improvements are meaningful, and they provide new ways for advocates and users to hold them to account.

The bad news

The most striking takeaway from the 2020 RDR Index was just how little companies across the board were willing to publicly disclose about how they shape and moderate digital content, enforce their rules, collect and use our data, and build and deploy the underlying algorithms that shape our world.

New benchmarks on algorithms and targeted ads show a crisis of accountability

Our new indicators on algorithms and targeted advertising caused a five-point drop in the scores of many companies because of a lack of transparency on how they develop and deploy targeted advertising and algorithmic systems.

None of the social media services we evaluated offered adequate information about how they actually shape, recommend, and amplify either user-generated or paid content. Digital platforms appear to exercise little control over the technologies and systems that are driving the flood of problematic content online, with no clear accountability mechanisms in place to prevent the cascade of harms to democracy and human rights that are occurring as a result.

With the exceptions of Telefónica and Vodafone, no company published a policy commitment to respect human rights in its development and use of algorithmic systems. Facebook has been the source of some of the more disturbing real-life harms that algorithmic systems can trigger. But the company offers the public no actionable information about how these algorithmic systems are built, how they operate, or how the company monitors them.

Opaque and unaccountable targeting and tracking is spreading from platforms to telcos

Most companies ranked in 2020 did better at communicating how they handle information they collect directly from users—so-called “ first-party data .” But companies revealed little about their more problematic “ third-party data ” collection practices, which really lie at the heart of the “surveillance capitalism” business model.

Amazon and Facebook had the lowest and second-lowest scores, respectively, of all digital platforms we evaluated (including those headquartered in China and Russia) on their transparency regarding options for users to control what data is collected, inferred, retained, and processed.

All of the telecommunications companies we rank have ventured into the mobile ad market, tapping into the troves of data and insights they have on their customers in an effort to compete with platforms for a slice of the lucrative digital advertising pie. But telcos were remarkably opaque about the policies that govern this area. Only a few offered any information on targeting rules and what types of ad targeting is prohibited. Not a single telco reported any data on how it enforces these rules, such as ads removed or accounts suspended for violations.

Governance commitments are not leading to real change

A growing number of companies are making formal commitments to human rights. But most scored poorly when we looked at how these commitments are implemented in practice, such as through human rights due diligence, regular engagement with civil society, and remedy mechanisms for addressing human rights harms. In 2020, most companies failed to demonstrate that they conduct robust, systematic assessments to identify and mitigate the human rights risks of their policies and practices across their global operations.

Not a single company in the entire RDR Index disclosed anything about assessing freedom of expression or privacy risks related to their targeted advertising policies and practices. The same was true for zero rating, despite the overwhelming potential for human rights harms that these programs can cause—as exemplified by Facebook’s service in Myanmar.

When it came to remedy, with the exception of Telefónica, companies failed to offer clear, predictable remedy to users who feel their freedom of expression and privacy rights have been violated.

What should companies and governments do?

If the internet is to be designed, operated, and governed in a way that protects and respects human rights, everyone must take responsibility: companies, governments, investors, civil society organizations, and individuals.

While some government regulations have improved company policies and practices, particularly in areas like privacy and data protection, other regulations have made it harder for companies to meet global human rights standards for transparency, responsible practice, and accountability in relation to freedom of expression and privacy. Even when faced with challenging regulatory environments, companies must take more affirmative steps to respect users’ rights.

Below are our top-line recommendations for companies and governments. For a deeper dive, visit our company and government recommendation pages.

Recommendations for companies

• Commit to and implement robust human rights governance: Demonstrate a commitment to protect and respect freedom of expression and privacy by publishing a strong human rights policy, establishing board oversight, and implementing comprehensive due diligence mechanisms.
• Maximize transparency: Disclose comprehensive information that enables users, researchers, investors, and other relevant stakeholders to understand how platforms and services restrict or shape speech and how they access, use, and share users’ data. Show how risks to users are assessed, mitigated, and provided redress.
• Give users meaningful control over their data and inferred information about them: Provide clear options for users to decide whether and for what purpose their data is collected. If users agree to have their data collected, explain how it is used, and with whom it is shared.
• Account for and mitigate harms that stem from algorithms and targeted advertising: Maximize transparency on the development and deployment of algorithmic systems and targeted advertising. Publish and continually update policies articulating how these systems are used and what rules govern them, and release data about the implementation of these policies.

Recommendations for governments

• Ensure that laws are consistent with human rights standards: Domestic laws affecting online speech or the use and sharing of personal data must not conflict with international human rights standards. Avoid enacting laws that compel companies to violate, or facilitate the violation of, users’ rights to freedom of expression or privacy. Ensure that government agencies that enforce and implement laws are subject to robust and effective oversight.
• Commit to corporate governance reform and mandate robust oversight: Ensure that government power to restrict online speech or access personal data is subject to meaningful oversight against abuse of censorship and surveillance power.
• Model and require maximum transparency: Lead by example on transparency. Regularly disclose data on all requirements and demands made by government entities affecting users’ freedom of expression and privacy. Require companies to disclose meaningful and comprehensive information about the full range of enforcement actions they take that may affect users’ freedom of expression and information or privacy.
• Ensure adequate access to remedy: Ensure that individuals are able to exercise their right to legal recourse when their freedom of expression or privacy rights are violated by any government authority, corporate entity, or company complying with a government demand. Companies should also be required by law to provide accessible and effective grievance and remedy mechanisms for people who believe that their rights have been violated in connection with the use of a product and service.
• Engage with a diversity of stakeholders: Governments must work with civil society, companies, and other governments to develop and enforce effective, constructive regulation that prioritizes the human rights of all internet users. Ensure that vulnerable populations, human rights defenders, and journalists are protected in accordance with international human rights law.