Increased Privacy Controls in Social Networks
Unlike other parts of the Internet, social networks allow users to specify which other users they know and trust, by means of the "friend" paradigm. In addition to facilitating communication between friends, today many social networks offer advanced privacy controls, with which users can limit access to the content they publish.
Examples: Facebook and MySpace
Two of the largest social networks, Facebook and MySpace, started out with very different approaches to privacy. Facebook began with a very private setup in 2004, when it was limited to Harvard students. Thus, content posted by users at Harvard could only be accessed by fellow students at Harvard, which made it a very private community. As Facebook added more schools to their platform and eventually opened their membership to anyone, they added advanced privacy controls that allowed users to specify exactly what types of content can be viewed by which people. Today, users can assign different privacy levels to each feature of their profile and type of shared content. Not only do they have the option to limit certain content to just their friends, but they can also choose to limit content to one or more of their "networks": communities such as schools, workplaces, and geographical areas, that users can be part of. This allows users to publish their content to a wider audience, while still limiting access from people outside of their community. Many of these networks require email addresses to prove membership, such as a @stanford.edu address for the Stanford network, and this keeps malicious users from joining networks they are not legitimately a part of.
A small subset of the privacy controls Facebook offers.
This is not to say, however, that Facebook always allowed users to protect their information. On September 5, 2006, Facebook introduced a new feature called the "News Feed" that displays a list of headlines generated from the activities of a user's friends. They did not extend their advanced privacy controls to this feed, and users were outraged that they could not limit what was posted on the news feed. Users joined together in enormous online Facebook groups to protest the changes, and three days later, the CEO issued a public apology and announced that they had just implemented the desired privacy controls.
MySpace started out with a very different approach to privacy. When they officially launched in 2004, there was no way to restrict content to certain friends or networks, except for the ability to post a "bulletin", a message that gets sent to all of your friends. Only after a year when users requested the feature, MySpace allowed users under 16 to only allow friends to view their profiles. This became a very popular feature for high school students to stop their parents from looking at their profiles.
In January 2008, in the aftermath of many incidents of cyberbullying and identity theft, the Multi-State Working Group on Social Networking met to discuss how to improve privacy controls on MySpace. Led by 50 attorneys general, this group agreed with MySpace to implement new privacy features that make it more difficult for adults to interact with minors on the website. Today, users of all ages have the option to limit their profile to just their friends. In addition, in the same way that Facebook has networks for schools, workplaces, and geographical areas, MySpace has two distinct networks: one for minors and one for users 18 and over. Users can choose in their privacy options to restrict their profile to their respective networks. Of course, it is nearly impossible to verify age online, so anyone with an incentive could easily pose as a user of the opposite age group to gain access to restricted content.
Myspace privacy controls for minors.
Myspace privacy controls for users over 18.
In addition to providing controls to limit content to friends and communities, MySpace, Facebook, and many other social networks allow users to block other users completely. Thus, when users want to publish content to the Internet as a whole but want to restrict certain users (i.e., stalkers or parents), they can easily do so by maintaining a list of blocked users.
Privacy Controls in Practice
In the last page, which described the lack of privacy in the absence of social networks, we saw three examples where users were surprised to see their privacy vanish on the Internet. Let's see how they would fare if they had taken advantage of social networks:
- If Danah Boyd had used Facebook or MySpace to keep her blog, her users could have removed their comments themselves, since the centralized authentication systems give users full control of the content they post (as opposed to many blogs, where viewers have no control over their comments). Furthermore, at least on Facebook, the blog would not have been crawled and cached by search engines, since web crawlers cannot authenticate with the website.
- If the genealogist webmasters had posted their family trees on Facebook (either as a shared file, or using one of the many genealogy applications available on the Facebook platform), they could have restricted access to only users they had explicitly approved as friends. If a stranger wanted to see this data, they could find the genealogist by searching by last name, and request permission to see it. In that way, the genealogists could use their judgment to protect themselves from identity theft.
- If Mancuso had posted her wedding dress photos on Facebook or MySpace, she could have restricted access to her friends. As she pointed out, the only reason she kept a public website was to "make it easy to find [her] should anyone [she] might have lost touch with over the years be curious about whatever became of [her]". This would be just as feasible with a social network, where people she lost touch with could find her profile and make a friend request by searching for her name on a search engine.
The Future of Privacy Controls
Although they encourage us to post more personal content online, it is clear that social networks provide privacy controls unseen elsewhere on the Internet. Without the network of friends to make it easy to limit content to those we trust most, it is very difficult to publish personal content to a wide audience without making it available to everyone on the Internet.
It is easy to imagine this concept of social privacy controls being taken on step further. In his blog post entitled Our Identity Privacy Control Panel of the Future, Nick O'Neill proposed that a standard be developed for privacy controls, so that every application can take advantage of the privacy features provided by social networks. He imagines an online world in which our online identity, social connections, and privacy settings are all managed in a centralized manner. In this world, Danah Boyd would not have to host her blog on Facebook. As long as her blog were compatible with privacy standards, she could host it on any platform, and viewers would have full control over who could see the comments they posted. As the Internet progresses toward more open standards, we can only hope that privacy will be kept in mind.