I heard a reference to Privacy testing recently (James Whittaker mentioned it here.) and it seems like a valuable area to know something about. It's extremely important these days as companies balance "social features" with protecting users P2I (personally identifiable information).

My question is how would someone go about understanding the basis for user privacy? Assuming you’d need to understand what privacy is before you could test for it?

Are there references (blog posts, Wikipedia, books, videos, experts in the field?) on the factors involving user privacy? The end result could involve checking for your own or others user privacy.

  • 3
    Are there specific regulatory rules that you need to comply with, or do you have a general but non-specific "the software shall respect privacy" requirement?
    – user246
    Oct 20, 2011 at 1:03
  • No requirement just interested in understanding more about the testing subject. Things to consider, etc. Oct 20, 2011 at 18:03
  • I'd suggest that if it's not a real problem, you won't get good quality answers. I'm inclined to think we should close this question unless you can add enough detail to make it answerable. sqa.stackexchange.com/faq#dontask Opinions? Anyone able to suggest good edits to make this question more relevant/useful?
    – testerab
    Oct 22, 2011 at 17:43
  • I updated the question to try and make it easier to answer. Does it make more sense? May 22, 2012 at 21:16
  • This is a good article about privacy testing - mitre.org/publications/systems-engineering-guide/… Aug 9, 2019 at 4:01

3 Answers 3


The first thing to be mindful of when it comes to privacy is the simple fact that you are dealing with specific legal constraints upon what is and is not allowed. Therefore unless you have dealt with regulatory issues before, you are going to need somewhat of a different mental model for deriving requirements and testing.

Your location, the type of application (web or desktop), does the app require / transmit personal data, where the servers are and many other factors; will determine which, if any, laws you need to become familiar with.

Consider the following scenario, a web based app that is created by developers in country X with users around the world, and hosted by a third party cloud provider, whose physical server location may change on the fly. Which jurisdictions laws do you need to worry about? Probably all of them.

Fundamentally therefore privacy considerations need to be baked into the architecture and design from day one. There are far too many ways for personally identifiable information to leak otherwise. It is also not possible to secure this data in isolation, there needs to be an understanding of the risks from top to bottom of the organization (large or small) on who may get access to this.

Privacy testing is really a combination of the following:

  1. Store only as little information as needed. You can't leak what you don't know.
  2. Compliance with relevant regulations for what information you do store
  3. Prevention of unintentional leaks e.g. security testing for info leaks, SQL injection etc.
  4. Methods to identify intentional leaking. Monitor for unusual data movement patterns, back doors...
  5. Recovery procedures in the case of a data leak. This is technically covered by item 2 but worth reiterating. There are, depending on jurisdiction, legal obligations regarding notification of data loss.
  • 1
    Here is a way to think about the problem: you should not intentionally violate privacy, and you should not unintentionally violate privacy. You test the former by examining the application's user interface as well as everything the software produces: e.g. emails, files, data streams, queries to other systems, and text messages. You test the latter via security testing. And of course, as Steve said, you can't leak what you don't know.
    – user246
    Oct 27, 2011 at 19:36

There seems to be a lot of information on the web about privacy but nothing so specific as it relates to testing it. However in order to test it you probably need to have experience in some / many aspects. From what I can tell there are several aspects to Privacy including:

  • Technical: As Steve mentions it depends on the type of application, how data is transmitted and stored, etc. This would also related to how you track users, how you verify who's identity is in use, etc.

  • Legal: Privacy laws for each country or state; laws for specific industries like Health Care, how legal jurisdictions work. Does the legal aspect cross other aspects?

  • Social: How does society value privacy and in what ways? What are the social norms and are they changing with social media? Is this area based on a lot of subjectivity - in the eye of the beholder?

  • Ethical: What information should we collect? How should be it be collected? Are there certain groups of the population we shouldn't and others where we can collect more? Protecting your own privacy might fall into this area if you feel others can't be trusted to do it for you.

  • Historical: How do our past involvements with privacy influence our current views? What is the history of Privacy / privacy law in certain countries, states, etc.? Consequences?

Others I can think of include cultural influences, tools that are used, people and organizations involved in the debate.

This isn't a comprehensive list but I'd like to get more input. Anyone see some category I've missed or have additional details on the categories?

--- Chris


I believe you asked to test for your privacy, ie. you identity must be protected when browsing. To test what web browser reveals about you.




  • The OP didin't specify browsing, specifically - there's all manner of possible non-browser software that could be handling sensitive information. For example, I know of various handy desktop applications designed to make it easier to fill out tax returns, and various smartphone applications might handle billing information.
    – user867
    May 23, 2012 at 0:02
  • Protecting your own privacy is one aspect. See my updated question. May 24, 2012 at 23:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.