The IndieWeb was designed to be a better option for privacy, users, content authorship, and the open web. I think it largely meets those goals, but Sebastian has put together some excellent points on why it may fail on the privacy front at times:
- Backfilling from silos can distort or misrepresent meaning. In other words, a "like" on Twitter may not be the same as a favourite or "like" on the IndieWeb. Nomenclature changes and people use these features for different purposes, for example for bookmarking posts;
- Backfilling also adds unintended legitimacy to simple, spur-of-the-moment user interactions. Liking something on Twitter is considered fairly ephemeral by many: the author of the tweet will see I "liked" it, I will have a record, people can find that "like" if they dig deep enough etc. But backfilling onto a blog post means saving a person's digital identity – their profile photo, name, URL, details etc. – as well as their words to a more permanent store. Most importantly, you're doing so without asking their permission.
- Relatedly, you're also not gaining permission to duplicate their content on your website. A reply that is backfilled is effectively stolen without authorial consent.
Sebastian has gone to lengths to solve these problems, anonymising his backfeed and generating pixelated avatars instead of displaying faces for any interactions that could be considered unintentional.
However, with the implementation of GDPR it seems that even that level of implementation may no longer fit privacy definitions. Whilst I would argue that many companies have since agreed that "public domain === consent" (that's certainly what I have been advised by multiple companies and legal firms), the right to delete is still a very valid point. As is the fact that – legal or not – you are copying someone's content and placing it somewhere else, without explicit consent. I have my own mixed and muddied views on that topic, but it is one that worries me.
Interestingly, it would seem that simply pulling total likes etc. from a silo would be fine and that makes sense. I see those interaction counts as ultimately the author's data, not each individual's who contributed, so only the silo would have a claim to stop you. Personally, that feels less creepy anyway, but it does lose the community feeling. Perhaps some kind of authorisation token within a person's own website (think IndieAuth) could be used to set your own privacy level to "always allow sharing", "never", or "only in X, Y, Z circumstances". As long as it was standardised it could work, though it would mean a separate fetch for each item in the backfeed (at a minimum, probably two: one to the silo profile, the second to the linked indie website).
