A person writes a sentence on the internet. Perhaps it is a complaint, a joke, a moment of grief, or an opinion they will reconsider. To the person who writes it, the sentence belongs to a particular day. To a system that collects it, the sentence can become a permanent attribute.
Much of the ethical difficulty of the digital age begins in that distance. Human expression is provisional, situated, and often contradictory. Digital records are easy to preserve, combine, and move. A remark can travel farther than its author intended, reach an audience they could not have anticipated, and acquire a meaning they would not recognise. The record survives; the circumstances that made it intelligible may not.
At Panoptes, we build social intelligence to help brands, celebrities, and public figures understand conversations and make better decisions. That purpose gives us a responsibility to consider the people whose speech makes understanding possible. Their interests do not disappear because they are absent from a product meeting, a commercial agreement, or a dashboard.
Our dedication to privacy and safety research begins with a question we intend to keep asking as our capabilities grow: what does this way of seeing make possible, and who bears the consequences?
A person is more than a record
Privacy gives people room to develop without having every earlier version of themselves carried into every later encounter. It allows a person to speak differently with friends, colleagues, a support group, and a public audience. Those differences are part of an ordinary human life. A system that collapses them into a single profile can destroy something important even when every fragment was accessible somewhere.
Consider someone who publicly criticises a delayed delivery. Understanding the complaint may help a business fix a recurring failure. Connecting that complaint to the person’s employment, family relationships, health concerns, and political views changes the nature of the activity. The original visibility of the complaint cannot, by itself, justify that expansion.
Public availability is therefore an incomplete ethical test. Purpose, scale, persistence, and the ability to connect records all matter. So does the difference between being heard and being singled out. A community may benefit when an institution recognises a shared concern while its members remain vulnerable to harm if that institution identifies and pressures the people who voiced it.
The OECD’s privacy principles connect limits on collection and use with openness, individual participation, and accountability. Their importance lies in the relationship between those ideas: an organisation’s capacity to collect information does not settle the question of what it should do with it.
The distance between listening and power
Listening can be an act of respect. A brand can discover that its language excludes the people it hopes to serve. An artist can understand why a message caused hurt. A public figure can learn that an apparently minor decision has consequences their own circle did not see. Used well, social intelligence can make institutions more responsive to experiences beyond their immediate reach.
But the same analytical capacity can serve less defensible purposes. Criticism can become a list of targets. Vulnerability can become an opportunity for pressure. A description of an audience can harden into a judgement about everyone who appears to belong to it. These possibilities belong in the design discussion from the beginning.
For Panoptes, the ethical purpose of audience understanding is to improve decisions while respecting people’s agency. We reject the use of social intelligence to facilitate harassment, doxxing, coercion, or exploitation of intimate vulnerabilities. A person’s criticism should invite consideration of the criticism; it should not become a reason to expose unrelated parts of their life.
Power also enters through interpretation. A sentiment label is a model’s judgement about an expression. It is not direct access to a person’s feelings. Sarcasm, dialect, quotation, and cultural context can change what a sentence means. A country-level pattern can conceal substantial differences within that country. A vocal group can dominate a dataset without representing the wider public.
Responsible analysis must make those limits legible. People making decisions need to know what was observed, what was inferred, what was missing, and how much confidence the evidence deserves. A polished chart should never be allowed to borrow certainty from its appearance.
The person behind a data point has interests that no dashboard can fully represent.
Restraint as a design discipline
Respect for privacy becomes meaningful through choices about what a product makes easy, difficult, or impossible. A declaration of values leaves the essential work unfinished. The work reaches into collection, analysis, access, display, export, retention, and deletion.
Our commitment is to pursue useful understanding with the least exposure reasonably necessary for a legitimate purpose. Before adding a field or connecting a source, the question should be specific: which decision requires this information? If the question can be answered at the level of a conversation or a sufficiently broad group, identifying individuals needs a separate justification.
Aggregation deserves scrutiny too. A small group can be recognisable. A precise location can reveal more than a name. A quotation with its username removed may still lead directly to its author through search. Even a broad summary can stigmatise a community. Removing identifiers is a step to evaluate, not a promise that the risk has disappeared.
The European Data Protection Board’s account of data-protection principles brings together purpose limitation, minimisation, accuracy, storage limitation, and accountability. We regard these as important reference points for disciplined product decisions. Citing them does not establish compliance; the relevant obligations have to be assessed and demonstrated in the circumstances of an actual service.
Time matters as much as access. A temporary observation should not become a permanent institutional memory by accident. Retention needs a reason. So does keeping a copy after its original purpose has ended. Corrections and deletions require attention to derived outputs as well as original records: changing a source is of limited value if an old inference continues to guide decisions elsewhere.
These choices will sometimes reduce convenience or analytical detail. We accept that responsible development may require declining a feature, narrowing a use case, or withholding a result whose risks cannot be adequately addressed. Restraint is a capability we want to develop deliberately.
Safety research must earn its name
We are committed to making safety research a continuing part of Panoptes’s development. That commitment carries an obligation to distinguish questions from findings and intentions from demonstrated safeguards. Calling a system safe does not make it so. Research should produce evidence that can change a design decision, including a decision to delay or stop.
The NIST Privacy Framework’s approach to risk considers the problems people may experience throughout the life of data processing, including harms to dignity, discrimination, and physical or economic harm. This is a useful starting point because a system can protect information from an intruder and still harm someone through an authorised use.
The research priorities we set for Panoptes follow from that wider view. We want to examine whether combinations of ordinary outputs can reveal an individual; whether repeated queries defeat the protection of a broad summary; whether a seemingly harmless export enables targeting; and whether labels become less reliable across languages and communities. We also want to understand which interface choices cause people to overestimate the strength of an inference.
A serious evaluation must test plausible misuse as well as intended use. It should consider a determined user, an overconfident analyst, a mistaken classification, and a well-meaning team acting under time pressure. Each creates a different route to harm. Testing only the cooperative user would leave much of the problem unexamined.
Research itself needs limits. It should minimise the use of identifiable material, prefer synthetic or appropriately authorised examples where they can answer the question, and avoid creating an unnecessary archive of the very information it seeks to protect. A safety exercise that exposes people without sufficient justification undermines its own purpose.
We believe useful safety findings should be shared with enough detail to support scrutiny and learning, while protecting affected people and avoiding publication of an immediately usable method of abuse. Honest reporting includes the scope of an evaluation, its failures, and the conditions under which its conclusions may cease to hold. A result for one language, dataset, or version should not quietly become a universal assurance.
The possibility of being challenged
People affected by a system are not always its customers. Their ability to question it is therefore an essential test of accountability. An organisation should be able to explain why information was used, how a conclusion was reached, and who can act when the explanation is inadequate. A concern should reach someone with the authority to investigate and change the outcome.
Transparency must be specific enough to help. Broad promises about trust cannot substitute for clear information about sources, purposes, retention, access, and the routes available for correction or objection. Nor should an essay like this be mistaken for a complete account of a service’s data practices. Those details need their own accurate, accessible documentation.
Human review matters only when the reviewer has time, context, and the power to disagree. Placing a person after an automated judgement does little if the interface presents the judgement as settled fact or the workflow rewards accepting it without examination. Accountability requires a real opportunity to question the result.
It also requires a willingness to hear people whose experience is inconvenient to the organisation. A product team can miss a harm that is obvious to someone represented in its data. We want criticism of our choices to be treated as a source of knowledge, with particular attention to people who have less power to absorb the consequences of an error.
The standard we choose
Panoptes is built around the value of a wider perspective. That ambition is incomplete if it includes only the perspective of the person using the tool. It must also include the person being described, the community being interpreted, and the people who may be affected by the decision that follows.
Our dedication to privacy means keeping those interests present when they complicate a product decision. Our dedication to safety research means seeking evidence about harm, confronting uncertainty, and allowing what we learn to change what we build. Neither commitment can be discharged by publishing this page. Both have to be renewed through work that others can examine.
The digital world needs institutions that can listen carefully and respond intelligently. It also needs room for people to speak, change, and live without being reduced to enduring classifications. We believe social intelligence is worth building when it helps preserve both.
Seeing more gives us more to answer for.
The Panoptes team
November 2026