Loomio

Changes to Anonymous Voting

Robert Guthrie Tue 6 Oct 2026 2:06AMPublicSeen by 21

We've made significant changes to Anonymous Voting - a complete rewrite based on an in-depth audit about the security of the design we had in place.

The audit found there were flaws in our system that could be used to associate someone's anonymous vote with their identity - E.G. timestamps and other metadata could give a good indication about who had placed a vote.

So we developed a new system, designed from the beginning to never save any information that could correlate a voter and the vote they placed.

There are some drawbacks in terms of UX that this new system imposes on us:

  • You can not edit your anonymous vote after it has been placed

  • You cannot leave a reason with your vote

  • There is no information about when a vote was placed

  • Reminder notifications options are restricted to a 24 hour poll closing warning. It's not possible to see who has voted and remind others.

The benefits about the change are entirely about the quality of our guarantee about anonymity.

Read more about the new anonymous voting system in the user manual.

Please share any feedback you have here.

Scott Laugenour (he/him)Tue 6 Oct 2026 2:24AM

My organization would want to allow anyone who wishes to share their anonymous vote to do so and we always uphold the right to change one’s vote during the voting period.

We currently have a policy to never use anonymous voting, but I was coincidentally planning to ask about revisiting the policy to get feedback. More people way wish to vote anonymously, although we never allow elected representatives to do so in the official capacities.

Being unable to share or change an anonymous vote makes it less likely that we will change our policy. Are these new provisions already in place without an opportunity to consider the feedback that I have shared here?

Robert GuthrieTue 6 Oct 2026 3:14AM

@Scott Laugenour (he/him) - that's right - the changes are live and the decision is made.

If you want to develop a decision collaboratively - then use normal, identified voting.

If it's more important to allow people to share their vote without fear of being persecuted or treated differently because of how they voted, then anonymous voting can guarantee anonymity.

There isn't a middle ground - and I'm sorry I lead you to believe that there was. If we retain the information that allows people to edit their votes, then it's not anonymous.

When it comes down to it, the decision is mine (in that I am the one responsible for the worse-case outcomes) and after years of experience running this service, I can't sleep well if I know that people who trust that their vote is anonymous then later have their position revealed. I have to know that I've done my very best in this case.

Scott Laugenour (he/him)Tue 6 Oct 2026 4:10AM

@Robert Guthrie I understand that. Thank you for your answer. In our organization nearly all votes that could be anonymous are of the straw poll variety and we are a comradely group. I can't imagine anyone ever painstakingly attempting with sophisticated chicanery to get at someone's anonymous vote. I understand you have to plan for all kinds of organizations, some of which might enshrine anonymity more than my organization does. (We actually enshrine transparency and because of that we adopted the policy of never doing anonymous votes. This is the policy that I was re-thinking for those straw-poll variety of things that maybe, maybe maybe, would attain more participation if the straw poll were anonymous.

We might decide to live with the new updates or we might decide to keep the current policy.

Really appreciate your involvement and engagement and I hope you sleep well!

Robert GuthrieTue 6 Oct 2026 6:55AM

@Scott Laugenour (he/him) now days it's not painstaking to ask an AI to tell you who voted for what - if the information eventually knits up. It's easy, cheap and fast.

The extra constraint we (Loomio) have is being open source and committed to allowing people to access the full history of their data.

It's a feature of Loomio that you can, at any time, download a complete export of your group data and run your own Loomio server - or do whatever you like with it.

Anonymous voting records are included in this promise - and that is only possible because we've designed the data structures to have the integrity we are advertising.

I very much appreciate your engagement here. I'm always listening to how people are using or intending to use Loomio and trying to improve it. I love the work you do and this is my way of supporting it.

Scott Laugenour (he/him)Tue 6 Oct 2026 4:11AM

Next question. Can one totally remove one's anonymous vote and then later re-cast it?

Robert GuthrieTue 6 Oct 2026 6:43AM

@Scott Laugenour (he/him) No, sorry. Editing or deleting an anonymous vote would require information we don't store.