But My Post Was Private!
Why We Can’t Assume Privacy on Social Network Sites

By Samantha Warren

Participation in social network sites such as Facebook, MySpace, and Twitter has dramatically increased in recent years, offering users an online environment where they can share what they are doing and express their views (Huberman, Romero & Wu, 2009; Rosenblum, 2007). This explosive growth and the amount and type of information participants reveal has lead to increased scrutiny of user’s private lives. Personally identifiable information, along with sexual, political or entertainment interests all provide a disturbingly intimate insight (Gross & Acquisti, 2005). In this paper, I will be focussing on the issue of privacy and social network sites, and how we cannot assume that what we post on a social network site is private.

boyd and Ellison (2007) define social network sites as:

“web-based services that allow individuals to (1) construct a public or semi-public profile within a bounded system, (2) articulate a list of other users with whom they share a connection, and (3) view and traverse their list of connections and those made by others within the system”

Social network sites provide a setting for online interaction and communication, with sites typically displaying a user’s profile and their social network of other users. Profiles display personal information such as age, location, interests, and many allow users to upload photos and other multimedia (boyd & Ellison, 2007).

The visibility of and access to a user’s profile can be set by the user and varies by site. Interfaces allow millions of users to share and follow the lives of families, friends, acquaintances and often unknown numbers of strangers (boyd & Ellison, 2007). Gross & Acquisti’s (2005, p.5) study of Facebook users found that:

“90.8% of profiles contain an image, 87.8% of users reveal their birth date, 39.9% list a phone number …… and 50.8% list their current residence. The majority of users also disclose their dating preferences (male or female), current relationship status (single, married, or in a relationship), political views (from “very liberal” to “very conservative”), and various interests (including music, books, and movies). A large percentage of users (62.9%) that list a relationship status other than single even identify their partner by name and/or link to their Facebook profile.”

Rosenblum (2007, p.47) created a fake MySpace profile in order to test the amount of personal information that could be obtained. The randomly chosen profile was that of a woman who was generally careful about the information she posted; it included her age, but not her birth date; her home state, but not the town; her first name, but not her last. These precautions were negated by the fact that she posted her AOL Instant Messenger screen name. This linked her MySpace page to her blog, which provided enough information to determine her name. A brief examination of her blog revealed one post titled “surveys,” in which she posted her detailed responses to a number of online surveys. Among these were answers indicating that she had been taken into police custody, had stolen in the past and had been medicated for attention-deficit disorder and obsessive-compulsive disorder behaviour. All this information was readily available and easily accessible.

There are a number of reasons why social network site users reveal so much personal information. Site architecture and privacy defaults are skewed towards disclosure, while alleged ‘relaxed attitudes towards personal privacy’ (Gross & Acquisti, 2005, p.3), combined with user’s lack of understanding of the possible privacy risks increase the assumption that user’s information is readily and intentionally disclosed (Woods, 2010). Additionally, the perception of social network sites as private spaces impedes a user’s ability to control impressions and manage social contexts online (Gross & Acquisti, 2005).

The willingness of users to post personal information on social network sites creates huge amounts of data – data that is worth millions to marketers, who use personal information collected in public online databases for commercial purposes. This commodification of information means social network sites want as much user data public as possible. Facebook’s 2005 privacy policy stated that:

“the site will collect additional information about its, not originated from the use of the service itself: participants’ information may include information that the participant has not knowingly provided: personal data may be shared with third parties” (Gross & Acquisti, 2005, p.4).

One way social network sites can achieve this is to make their default settings public. The default privacy settings of new accounts are set to make the users profile publicly searchable and the content freely visible. In 80% of cases, however, users will stick with these default settings (Peterson, 2009). Peterson (2009, p.22) described this proclivity as “the power of the default” meaning that “users are simply too lazy, confused, or irrational to make a choice and instead just stick with the default option”. This in turn has lead to claims that “privacy is dead” and users don’t care (boyd, 2010). Facebook CEO Mark Zuckerberg maintains “people have really gotten comfortable not only sharing more information and different kinds, but more openly and with more people – and that social norm is just something that has evolved over time” (McCullagh, 2010). Following this theory, social network site developers can justify making publicly available data more public (boyd, 2010). Additionally, the “power of default” is indicative of the user’s lack of understanding of the risks associated with having so much information publicly available. The amount and depth of personal information disclosed on social network sites, intentionally or otherwise, can expose users to personal attacks, stalking, re-identification and identity theft, both online and offline (Gross & Acquisti, 2005).

The very act of signing-up to a social network site can create confusion about what is private and what is public. The member information requested by the site, such as email addresses, birthdates and real names, gives a false sense of intimacy and privacy, and leads to the assumption of social network sites as private spaces (Peterson 2009; Rosenblum, 2007). User’s perceptions of what is private online are influenced by the belief that a problem that afflicts others will not affect them. This in turn causes them to underestimate privacy risks and thus undervalue their privacy, often realising their mistake only after a breach (Peterson, 2009).

Weintraub (1997) postulates that private is “what is hidden or withdrawn versus what is open, revealed, or accessible”, and that private things are “things that we are able and/or entitled to keep hidden, sheltered, or withdrawn from others”. Nissembaum’s (2004) concept of contextual integrity describes the expectations people have about what level of protection our information requires, expectations about what data may be shared in a given situation and with whom that data may be shared. She argues that privacy is violated when individuals do not respect social norms of appropriateness and distribution (Peterson, 2009; Nissembaum, 2004).

In real life, people try to restrict access to information about themselves to obtain privacy; they also use privacy to protect relationships. Different kinds of relationships require different levels of protection from outside scrutiny (Lange, 2007). People conduct themselves according to the social context they find themselves in, be it home, work or public; they become different people to maintain the standards of conduct and appearance of their social group. Privacy issues arise when these different “presentations of self” collide on the flat dimension of the social network site; “the architectural heuristics that guide privacy practices in the physical world” are removed (Peterson, 2009, p.12). User’s need to determine how to best present themselves in a multi-use public space; information shared “in the wrong way and with inappropriate others” leads to the disintegration of social contexts and changes how and to whom information is distributed and communicated. In certain occasions people want information about themselves to be known only by a small circle of close friends, and not by strangers. In other instances, they are willing to reveal personal information to anonymous strangers, but not to those who know them better. Social network sites do away with the privacy barriers that user’s keep between different aspects of their lives (Peterson, 2009; Gross & Acquisti, 2005).

The virtual nature of the social network site also removes the “real world” separation of social situations, leading to a loss of the contextual and situational awareness that guides offline interactions. It is possible for somebody’s profile to be connected to hundreds of users directly, and thousands of others through the network’s ties; users know that someone is looking at their content, but they don’t necessarily know who is accessing it or what they are viewing. This inability to determine or even recognise the “invisible audience” leads users to unintentionally disclose information, which can have unforseen consequences (Peterson 2009; Rosenblum, 2007).

“In 2009, a 16-year-old employed by a marketing firm in England returned home from work and wrote on her Facebook that her job was “boring.” She was promptly fired after colleagues accessed her profile and passed on the post to her supervisor. “[This] display of disrespect and dissatisfaction undermined her relationship with the company,” a representative of the firm said. “Had [she] put up a poster on the staff notice board making the same comments and invited other staff to read it there would have been the same result.” Skeptics argued that employers rarely followed their employees to the local bar to eavesdrop on any griping that regularly occurred there” (Peterson, 2009, p.11).

The lack of physical separation of social situations removes the sense not only of how public user’s information is on social network sites, but also how permanent it is. The false belief of privacy leads user’s to feel protected from the consequences of their actions online. Communication on social network sites, and indeed, on the Internet in general, is recorded, disseminated and stored. It is a permanent digital record that can later be searched and accessed by third parties (Rosenblum, 2007).

As the Internet becomes the preferred social forum of tomorrow, our private lives will increasingly be lived out in the public domain. The lucrative marketing nature of social network sites means there is little or no incentive to create personal information verification procedures or enhanced scrutiny with regard to posted information. In order to best protect our privacy, we need to use our common sense. Once any information is posted, it is all but impossible to purge every iteration outside the social network, so the best strategy is simply to exercise judgment in what personal information we choose to post. This is the only thing that offers the hope of safeguarding reputation and privacy. Awareness is key to solving the privacy problem. We as individuals need to be more proactive about educating each other and protecting our privacy on the Internet.

References

Arthur, C. (2007). Do social network sites genuinely care about privacy? The Guardian, Thursday 13 September 2007. Retrieved April 4, 2010 from http://www.guardian.co.uk/technology/2007/sep/13/guardianweeklytechnologysection.news1

Barnes, S. (2006). A privacy paradox: Social networking in the United States. First Monday, Vol. 11, No. 9. Retrieved April 1, 2010, from http://firstmonday.org/issues/issue11_9/barnes/index.html

boyd, d. (2010). Making Sense of Privacy and Publicity. SXSW. Austin, Texas, March 13. Retrieved March 20, 2010 from http://www.danah.org/papers/talks/2010/SXSW2010.html

boyd, d. & Ellison, N. (2007). Social network sites: Definition, history, and scholarship. Journal of Computer-Mediated Communication, Vol. 13, No. 1. Retrieved March 17, 2010 from http://jcmc.indiana.edu/vol13/issue1/boyd.ellison.html

Google. (2009a) Advertising and Privacy. Google. Retrieved April 1, 2010, from http://www.google.com/privacy_ads.html

Google. (2009b) Privacy Policy. Google. Retrieved April 24, 2010, from http://www.google.com/privacypolicy.html

Gross, R. & Acquisti, A. (2005). Information Revelation and Privacy in Online Social Networks (The Facebook case). Pre-proceedings version, ACM Workshop on Privacy in the Electronic Society (WPES). Retrieved April 3, 2010, from http://www.heinz.cmu.edu/~acquisti/papers/privacy-facebook-gross-acquisti.pdf

Huberman, B. A., Romero, D. M. & Wu, F. (2009). Social networks that matter: Twitter under the microscope. First Monday, Vol. 14, No. 1. Retrieved April 1, 2010 from http://firstmonday.org/htbin/cgiwrap/bin/ojs/index.php/fm/article/viewArticle/2317/2063

Joshi, P. (2009). Every move you make, Google will be watching you. Business Standard. Retrieved April 1, 2010, from http://www.business-standard.com/india/news/every-move-you-make-google-will-be-watching-you/57071/on

Lange, P. G. (2007). Publicly private and privately public: Social networking on YouTube. Journal of Computer-Mediated Communication, Vol. 13, No. 1. Retrieved March 17, 2010 from http://jcmc.indiana.edu/vol13/issue1/lange.html

Nissembaum, H. (2004). Privacy as contextual integrity. Washington Law Review, Vol. 79 No. 1. Retrieved April 1, 2010 from http://crypto.stanford.edu/portia/papers/RevnissenbaumDTP31.pdf

Peterson, C. (2009). Losing Face: An Environmental Analysis of Privacy on Facebook. Working paper. Retrieved April 1, 2010 from http://etc.cpeterson.org/research/workingpapers/2010/losingface_workingpaper.pdf

Rosenblum, D. (2007). What Anyone Can Know: The Privacy Risks of Social Networking Sites. IEEE Security and Privacy, Vol. 5, No. 3. pp. 40-49. Retrieved April 1, 2010 from IEEE Xplore database.

Soghoian, C. (2008). Debunking Google’s log anonymization propaganda. CNET News. Retrieved April 1, 2010, from http://news.cnet.com/8301-13739_3-10038963-46.html

Weintraub, J. (1997). The theory and politics of the public/private distinction. In J. Weintraub & K. Kumar (Eds.), Public and Private in Thought and Practice (pp. 1-42). Chicago and London: University of Chicago Press. Retrieved April 2, 2010, from http://books.google.com/books?hl=en&lr=&id=XuIfZxddGkkC&oi=fnd&pg=PA1&dq=The+theory+and+politics+of+the+public/private+distinction&ots=FNrridAoY9&sig=9UcAZ5p23hqbcXmB7Lj8re8TFp4#v=onepage&q=The%20theory%20and%20politics%20of%20the%20public%2Fprivate%20distinction&f=false

Woods, R. (2010). Facebook’s Mark Zuckerberg says privacy is dead. So why does he want to keep this picture hidden? The Sunday Times, January 17, 2010. Retrieved March 18, 2010, from http://technology.timesonline.co.uk/tol/news/tech_and_web/the_web/article6991010.ece