Privacy and TNG at

In the excitement of creating a family genealogy, there is great satisfaction in being able to show family connections from the most ancient ancestor to the youngest descendent. Often, however, the online, public display of such a genealogy is done without adequate thought given to the privacy of family connections, particularly when the genealogy is created by the hobbyist. With respect to family connections, possible options for online privacy are as follows:

  1. Purge or exclude all living family connections from the online genealogy database,
  2. Exclude, from the database, all living family connections born on or after a specific date,
  3. Mask the names and personal details of living family connections with a "Living" placeholder,
  4. Replace first names of living family connections with an initial while displaying the surname,
  5. Require a login to see the personal details of living family connections, or
  6. A combination of these options.
The Privacy Issue

Why the concern for privacy at Several concerns were pointed out by Kylie H. Veale in "A DOCTORAL STUDY OF THE USE OF THE INTERNET FOR GENEALOGY":

"…concerns over information veracity and quality; fears about intrusions into privacy and even the chance for identities to be stolen…."

These concerns apply particularly to hobbyist who are not constrained by the standards or ethics of the trained and/or professional genealogist.

Privacy at

At, we take the privacy of family connections very seriously—and, if there is a doubt, we err on the side of privacy. To begin with, we exclude all living family members born approximately on or after 1940. What this means is that at, many living family connections need to know who their grandfather was to locate themselves in the genealogy; the youngest family connections depend on their parents or grand parents to help them locate their place in the genealogy. As time goes by and the older family connections pass away, a later "cutoff" date will be appropriate. Fortunately, The Next Generation of Genealogy Sitebuilding© ("TNG") used at made implementing our privacy goals easy.

TNG and Privacy

If no birth date is given for an individual in the database, the person can be flagged as either deceased or living (default is deceased). Also, if no death date is given, the default is to consider the person to be deceased if older than 110. This "cutoff" date can be changed by the TNG administrator (Figure 1).

Figure 1: TNG Privacy Settings for Import/Export

TNG Privacy Settings for Import/Export

TNG enables the administrator to tailor the database privacy options (Figure 2). The privacy options enable the administrator to

  • Require a login to see anything but the home page,
  • Protect living data, including hiding both data and names, and
  • Define what persons can see and do when logged in.
Figure 2: TNG Privacy Options

TNG Privacy Options

Managing the TNG Database for Privacy

The job of managing our database at to insure the privacy of specific individuals turned out to be relatively easy. The creator of TNG, Darrin Lythgoe, has made finding and maintaining records in the database possible without having to know MySQL. It is easy to query the database and return reports through the administrative report utility (Figure 3a-3c). Once the report has been defined, the administrator can "run" the report(Figure 4). Figure 5 shows the results of running the "Living Family Connections" report.

Figure 3a: Create TNG Report: Choose Fields to Display

Create TNG Report: Choose Fields to Display

Figure 3b: Create TNG Report: Choose Criteria

 Create TNG Report: Choose Criteria

Figure 3c: Create TNG Report: Choose Sort Fields

Create TNG Report: Choose Sort Fields

The report generates the MySQL query (table prefix, xy_, is user defined):

SQL: SELECT, xy_people.private, lnprefix, prefix, suffix, xy_people.branch,lastname, firstname,birthdate, xy_people.personID, xy_people.gedcom, nameorder FROM (xy_people ) WHERE ( = 1) ORDER BY lastname

Figure 4: Edit, Delete, or Run the TNG Report

Edit, Delete, or Run the TNG Report

Figure 5: The TNG Report

The TNG Report

Once a report has been defined and run, the records of identified individuals can then be edited or deleted to insure privacy, where appropriate. For example, the “Living” flag can be turned on or off or the record of a living family member can be deleted. More complex queries and reports can be created using operators and constants. Figure 6 shows the available features for managing "People."

Figure 6: TNG Administration of Records for People

TNG Administration of Records for People

Personal—and Private—Genealogy for Family Connections

At, and using the TNG administrative features, it was easy to accomplish the privacy goals for our genealogy pages. Although we would much rather see a complete genealogy extending to the newest family connection, privacy concerns outweighed our personal preference. However, there is one great advantage to purging the database of "recent" living family connections: we can export a "safe" copy of our .ged file to family connections interested in bringing their own genealogies up-to-date. This can be done on a local PC using *no cost* software, such as PAF. As an alternative, with an easy to install server package called WampServer, it is even possible to install and run TNG on a local PC without a connection to the Internet—thus keeping the resulting genealogy private and complete, if desired, down to the youngest family connection.

Resources — A DOCTORAL STUDY OF THE USE OF THE INTERNET FOR GENEALOGY by Kylie H. Veale — Standards For Sharing Information With Others Recommended by the National Genealogical Society — The Next Generation of Genealogy Sitebuilding© ("TNG") — WampServer — PAF software for a PC can be obtained here.