Trust, safety and privacy
How do we protect users and keep their trust?
Fraud, spam, security, privacy, content quality and the handling of failures that affect users’ trust.
What the cases suggest
Treating trust as part of the product, rather than a cost, is the most consistent lesson in this group. PayPal’s fraud models, eBay’s ratings, Airbnb’s host guarantee and Google’s Panda update all accepted short-term cost to protect the system’s integrity and paid off. The failures treated users’ data or users’ reliance as something to exploit or to disclaim (location data brokers, Air Canada’s chatbot).
What separated the decisions that worked
- Successes made the trustworthy behaviour the default and bore the cost themselves.
- Failures shifted the risk onto users who could not see it.
Where this evidence is weak
Trust failures are often recorded only when they become scandals, so quieter failures are missing.
By who decided
| Decision-maker | Cases | Paid off | Mixed | Backfired | Too early |
|---|---|---|---|---|---|
| Market leader | 4 | 2 | 1 | 1 | 0 |
| Young company | 4 | 4 | 0 | 0 | 0 |
| Industry-wide | 2 | 0 | 1 | 1 | 0 |
The cases
Each links to the essay, memo or road not taken where the decision is described and judged, with its sources.
- Let buyers and sellers rate each other publicly after every transaction, instead of policing disputes itself When you cannot inspect every transaction, give participants a memory of each other.
- Build its own fraud detection software and concentrate on payments between buyers and sellers on eBay In payments, the capacity to manage fraud is the product.
- Make security, availability and privacy Microsoft’s highest priority, and choose security over new features whenever they conflict. When a quality problem threatens trust in the whole product, a feature-by-feature fix is not enough; change the priority order explicitly.
- Let customers pay in cash when goods were delivered To win a sceptical customer, take on the risk they will not.
- Change the ranking to demote large volumes of thin, low-quality pages, even though many of them displayed Google ads A ranking that can be gamed must be defended continuously, and sometimes against your own revenue.
- Apologise publicly and guarantee hosts up to $50,000 for damage caused by guests, after a host’s home was ransacked When your marketplace asks people to trust strangers, you will eventually have to insure that trust.
- Fight spam with learning filters and sender reputation rather than a price on sending Every abuse defence is also a market structure. Ask who it advantages.
- Reduce recommendations of “borderline” videos that came close to violating its rules, without removing them What a system chooses to amplify is a decision distinct from what it allows, and should be governed as one.
- Collect precise location from phones through apps and advertising code, and sell or share it Data that shows where a person has been shows who they are, and should be collected as if that were the case.
- Let a website chatbot answer policy questions, then argue in a dispute that the chatbot was responsible for its own words Whatever your AI says to customers, you have said.
Other kinds of decision
- Opening or closing
- Business model and pricing
- Make, buy or partner
- Acquisitions and sales
- Technology bets
- Product design
- New categories and markets
- Distribution and positioning
- Focus, exit and investment
- Executing large change
- Organisation and governance
- Public rules
Shrikant Kumar. “Trust, safety and privacy.” The Telos Decision Record, Telos, version of 2026-11-03. https://shrikantk.com/record/trust-and-safety/