  In the international development community, the term "digital public goods"
is used to describe open-source digital products (e.g., software, datasets)
that aim to address the United Nations (UN) Sustainable Development Goals. DPGs
are increasingly being used to deliver government services around the world
(e.g., ID management, healthcare registration). Because DPGs may handle
sensitive data, the UN has established user privacy as a first-order
requirement for DPGs. The privacy risks of DPGs are currently managed in part
by the DPG standard, which includes a prerequisite questionnaire with questions
designed to evaluate a DPG's privacy posture.
  This study examines the effectiveness of the current DPG standard for
ensuring adequate privacy protections. We present a systematic assessment of
responses from DPGs regarding their protections of users' privacy. We also
present in-depth case studies from three widely-used DPGs to identify privacy
threats and compare this to their responses to the DPG standard. Our findings
reveal limitations in the current DPG standard's evaluation approach. We
conclude by presenting preliminary recommendations and suggestions for
strengthening the DPG standard as it relates to privacy. Additionally, we hope
this study encourages more usable privacy research on communicating privacy,
not only to end users but also third-party adopters of user-facing
technologies.
