Ballot secrecy online: how nobody can know how you voted
"If I vote on my phone, will my boss be able to see how I voted?" That is the number one question, asked by workers and union representatives alike. The short answer is no. The long answer rests on a simple principle, whether on paper or online: you separate who voted from what was voted. Here is how.
The principle, as old as the ballot box
Ballot secrecy is not a digital invention. In a paper polling station, two things are kept separate:
- an attendance list, where your name is ticked at the entrance (proof that you voted),
- a sealed ballot box, into which your anonymous ballot drops.
No one can link the two. It is known that you came to vote, but not for whom. Online voting does not change this principle: it reproduces it by technical means.
The identity / ballot separation, online
In a serious online vote, the same split exists:
- At the entrance, the system checks your identity and your right to vote, then marks you as "has voted" to prevent a second vote.
- In the box, your ballot is cast anonymously and encrypted, with no retained link to your identity.
So the system knows that you voted, but it does not know for whom, because the two pieces of information are never brought together in a single readable table. It is the exact digital equivalent of the attendance list and the sealed box.
What the employer sees (and does not see)
The employer organises the vote, but has no access to individual ballots. It only sees the aggregated results: how many votes each list received, and the seat allocation. Exactly as with a paper box counted at the end of the day. No dashboard will ever tell it "this employee voted for that list", because that information exists nowhere.
What about the vendor?
Same thing. A voting vendor designs its system precisely so that it cannot recompose the link between a person and their ballot. That is an architectural constraint, not a sales promise: if the system were able to cross-reference identity and vote, it would not respect secrecy, and it would be attackable. The right question to ask is not "do you promise not to look?", but "is your system designed to be unable to?".
More secret, and more verifiable
Paper voting has its flaws: a badly folded ballot can be recognisable, a small box in a small office can reveal trends. Online voting adds a quality paper does not have: verifiability. A voter can be guaranteed that their vote was recorded and counted, without that revealing its content. Secret and verifiable are not contradictory: a good system offers both.
In short
Ballot secrecy online rests on a simple, old principle: separate the list of who voted from the content of the ballots. The system checks your right to vote at the entrance, then casts your ballot anonymously and encrypted into a box. Neither the employer nor the vendor can link a person to their choice, because that information is never brought together. It is the booth and the sealed box, digital version, with verifiability on top.
To understand how the identification data is protected on the GDPR side, read GDPR and online voting: how voter data is actually protected. And if you want to see how our system guarantees ballot secrecy, let's talk.
