February 10, 2012 | By Marcia Hofmann and rainey Reitman and Seth Schoen

Comparing Privacy and Security Practices on Online Dating Sites

Concerned about your privacy when you use online dating sites? You should be. We recently examined 8 popular online dating sites to see how well they were safeguarding user privacy through the use of standard encryption practices. We found that the majority of the sites we examined did not take even basic security precautions, leaving users vulnerable to having their personal information exposed or their entire account taken over when using shared networks, such as at coffee shops or libraries. We also reviewed the privacy policies and terms of use for these sites to see how they handled sensitive user data after an individual closed her account. About half of the time, the site’s policy on deleting data was vague or didn't discuss the issue at all.

HTTPS by default Free of mixed content Uses secure cookies or HSTS Delete data after closing account
Ashley Madison
Zoosk Not discussed
Plenty of Fish Vague
eHarmony Vague
Match Not discussed
Adult Friend Finder
OkCupid Vague
Lavalife

Please read below for more details about the sites' policies on deleting data after an account is closed.

HTTPS by default

HTTPS is standard web encryption–often signified by a closed lock in one corner of your browser and ubiquitous on sites that allow financial transactions. As you can see, most of the dating sites we examined fail to properly secure their site using HTTPS by default. Some sites protect login credentials using HTTPS, but that’s generally where the protection ends. This means individuals who use these sites can be vulnerable to eavesdroppers when they use shared networks, as is typical in a coffee shop or library. Using free software such as Wireshark, an eavesdropper can see what data is being transmitted in plaintext. This is particularly egregious due to the sensitive nature of information posted on an online dating site–from sexual orientation to political affiliation to what items are searched for and what profiles are viewed.

In our chart, we gave a heart to the companies that employ HTTPS by default and an X to the companies that don’t. We were shocked to find that only one site in our study, Zoosk, uses HTTPS by default.

Free of mixed content

Mixed content is a problem that occurs when a site is generally secured with HTTPS, but serves certain portions of its content over an insecure connection. This can happen when certain elements on a page, such as an image or Javascript code, are not encrypted with HTTPS. Even if a page is encrypted over HTTPS, if it displays mixed content, it may be possible for a eavesdropper to see the images on the page or other content which is being served insecurely. On dating sites, this can reveal photos of people from the profiles you are browsing, your own photos, or the content of ads being served to you. In some cases, a sophisticated attacker can actually rewrite the entire page.

We gave a heart to the websites that keep their HTTPS websites free of mixed content and an X to the websites that don’t.

Uses secure cookies or HSTS

For sites that require users to log in, the site may set a cookie in your browser containing authentication information that helps the site recognize that requests from your browser are allowed to access information in your account. That’s why when you return to a site like OkCupid, you might find yourself logged in without having to provide your password again.

If the site uses HTTPS, the correct security practice is to mark these cookies "secure," which prevents them from being sent to a non-HTTPS page, even at the same URL. If the cookies are not "secure," an attacker can trick your browser into going to a fake non-HTTPS page (or just wait for you to go to a real non-HTTPS part of the site, like its homepage). Then when your browser sends the cookies, the eavesdropper can record and then use them to take over your session with the site.

Session hijacking was once (wrongly) dismissed as a sophisticated attack; however, Firesheep, a straightforward and freely available online tool, makes this type of attack simple even for individuals with mediocre skills. Any site that provides insecure cookies at login could be vulnerable to session hijacking.

HSTS (HTTPS Strict Transport Security) is a new standard by which a web site can request that users automatically always use HTTPS when communicating with that site. The user's browser will remember this request and automatically turn on HTTPS when connecting to the site in the future, even if the user didn't specifically ask for it.

We gave a heart to the websites that use secure cookies or HSTS, and an X to the websites that don’t.

Delete data after closing account

After a user closes an online dating account, they may want the assurance that their data isn’t hanging around for week, months or even years. Users can look to a website’s privacy policy and terms of service to see whether the company has a practice of deleting or removing user data upon request or when an account is closed. In our analysis, we gave a heart to companies that explicitly say that your data is deleted upon request or account closing. In many cases, the language is too vague to determine the company’s policy for deleting user data, and sometimes there is no mention of removing data at all. We’ve noted such companies with the words “vague” and “not mentioned,” respectively.

Here are the details you need to know about each dating service's policies. We have individually contacted each of the companies listed below to ask them to clarify their policies on deleting data after an account is closed; we’ll update this chart if we learn more from the companies.

Note that this text is taken from their policies as of the publication of this post, and these policies can change at any time!

Ashley Madison

Privacy policy
Terms of Service

Privacy policy: We keep the information you have given us for at least as long as your Ad Profile stays active or hidden. Accessing and updating your email notification preferences, personal information and public information You have the opportunity to opt-out of certain communications and modify personal information or demographic information you have provided to us, and to hide information visible to the public users of the Website at anytime by going to the 'Manage Profile' or 'Message Center' sections on your Ad Profile. Please be aware that it may take several hours for any custom changes you make to take effect on the public areas of the system. Please also note that changing or deleting your information through the 'Manage Profile' or 'Message Center' section of the system, or opting-out of email notifications from us, will only change or delete the data in our database for the purpose of future activities and communications. These changes and deletions will not change or delete information or emails that are queued to be sent or have already been sent.

Terms of use: Complete Profile Removal. You may also select the "Complete Profile Removal" option, which is offered separately of basic termination. This feature will remove any existence of the account on the Service including all messages sent and received (regular, collect, priority), Winks, Gifts, all photos you have uploaded, any site usage history and other personally identifiable information. By using the Service, you hereby acknowledge that Members' communications may no longer be accessible should that Member have selected the Complete Profile Removal.

Zoosk

Privacy Policy
Terms of Use

The privacy policy does not explain what happens to user data after an account is closed.

The terms of use provides for cancellation of subscription, but does not explain what happens to data upon cancellation.

Plenty of Fish

Privacy Policy and Terms of Use

Privacy Policy: We keep your information only as long as we need it for legitimate business purposes and to meet any legal requirements. Personal information used to make a decision that directly affects an individual will be kept for at least one year after such a decision. We have retention standards that meet these parameters.  

Withdrawing Your Consent. You may notify us at any time that you wish to withdraw or change your consent to our use and disclosure or your information. We will accommodate your request subject to legal and contractual restrictions.

The terms of use provides for cancellation of account, but does not explain what happens to data upon cancellation.

eHarmony

Privacy Policy
Terms of Use

Privacy policy: Choice/Opt-Out
You may use the following options for removing your information from our e-mail database if you wish to opt out of receiving promotional e-mails and newsletters.

  1. Click on the “unsubscribe” link on the bottom of the e-mail;
  2. Send mail to the following postal address letting us know which promotional e-mails you wish to opt-out of: eHarmony, Inc. P.O. Box 3640 Santa Monica, CA 90408 USA
  1. For the eHarmony Singles service, select our Help link from your account home page and search our FAQ's to find the answer you are looking for, or send us an e-mail and our Customer Care agents will be happy to assist you; or
  1. For any services that allow you to control which e-mails you receive, go to the e-mail settings page from your account home page, and un-check the undesired promotions.                                                            

The terms of use provides for cancellation of account, but does not explain what happens to data upon cancellation.

Match.com

Privacy Policy
Terms of Use

The privacy policy does not explain what happens to user data after an account is closed.

The terms of use provides for cancellation of account, but does not explain what happens to data upon cancellation.

Adult Friend Finder

Privacy Policy
Terms of Use

Privacy policy: You may contact us to modify or delete your Personal Information from our database by: sending email to privacy@friendfindernetworks.com; logging in with your password and modify/delete your profile; mailing us at FriendFinder Networks Inc. at 220 Humboldt Court, Sunnyvale, CA 94089, United States, Attn: Privacy; or calling us at (408) 702-1040.

The terms of use provides for cancellation of account, but does not explain what happens to data upon cancellation.

OkCupid

Privacy Policy
Terms of Use

Privacy policy: If you have an online account with us, you also may delete or disable your account at any time by visiting the "Settings" page for your account. If you delete or disable your account, we may still retain certain information associated with your account for analytical purposes and recordkeeping integrity, as well as to prevent fraud, collect any fees owed, enforce our terms and conditions, take actions we deem necessary to protect the integrity of our website or our users, or take other actions otherwise permitted by law. In addition, if certain information has already been provided to third parties as described in this Privacy Policy, retention of that information will be subject to those third parties' policies.

The terms of use does not explain what happens to user data after an account is closed.

Lavalife

Privacy Policy
Terms of Use

Privacy policy: We keep the information you have given us for as long as you are a member on the site or for as long as we are required to do so by law, which ever is longer.

The terms of use provides for cancellation of account, but does not explain what happens to data upon cancellation.


Deeplinks Topics

Stay in Touch

NSA Spying

EFF is leading the fight against the NSA's illegal mass surveillance program. Learn more about what the program is, how it works, and what you can do.

Follow EFF

Breaking: No TPP deal reached in Hawaii, announce trade ministers.

Jul 31 @ 8:06pm

América Latina: El cifrado como derecho, entrevista al Relator de Libertad de Expresión @EdisonLanza de la @CIDH. https://eff.org/r.j5wx

Jul 31 @ 6:41pm

Does your Android phone suffer from StageFright? Here's how you can protect yourself. https://eff.org/r.gxjb

Jul 31 @ 4:05pm
JavaScript license information