Definitions of privacy

• The right to be let alone: Warren & Brandeis (1890), written in response to a new technology: the portable camera and newspaper gossip – “the individual shall have full protection in person and in property […] Instantaneous photographs and newspaper enterprise have invaded the sacred precincts of private and domestic life”
• Control over information about oneself: “the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others” (Westin, 1967)
• Control of access to the self or to one’s group: privacy includes limiting social interaction and regulating personal space and territory (Altman, 1975)
• Contextual integrity: privacy is about appropriate flows of information (Nissenbaum, 2004). Flow or distribution of information-movement, or transfer of information from one party to another or others.

Contextual integrity

Nissenbaum (2004): information always flows within a context that has its own norms.

A privacy violation happens when information flows in a way that breaks the norms of the context in which it was shared.

“Public” vs. “private” is not enough: your address is known to your neighbors, but a database of addresses linked to daily locations is something else.

A taxonomy of privacy harms

Solove (2006) groups privacy harms into four activities:

Many computing harms are processing harms: no single piece of data is sensitive, but combining pieces is.

Faulty argument: “I’ve got nothing to hide”

Solove (2007) argues that privacy is not about hiding bad things.

• Aggregation: harmless pieces when combined can reveal sensitive things (health, religion, sexuality, immigration status) – “A piece of information here or there is not very telling. But when combined together, bits and pieces of data begin to form a portrait of a person. The whole becomes greater than the parts”
• Power imbalance: the problem is not only what is seen, but that people have no say in how their data is used
• Chilling effects: people change their behavior when they know they are watched. After the 2013 Snowden revelations, views of Wikipedia articles on terrorism-related topics dropped (Penney, 2016)

Data flows

• First-party collection: what you give a service directly (account info, posts, purchases) and what it records about your use (clicks, time spent, location)
• Third-party tracking: cookies, tracking pixels, and “Login with…” buttons that send data to companies you never interacted with
• Data brokers: companies that buy, combine, and sell profiles about people (report: nine data brokers studied had information on almost every U.S. consumer, with categories such as “Expectant Parent” and “Diabetes Interest”)
• Sensors and devices: smartphones, smart speakers, cars, doorbell cameras, wearables, license plate readers

Inference: data you never provided to anyone

Systems can infer sensitive attributes from data that looks harmless:

• Facebook “likes” can be used to automatically and accurately predict sexual orientation, ethnicity, religion, and political views with high accuracy (Kosinski, Stillwell & Graepel, 2013)
• Target built a model to predict which customers were pregnant from their purchases, and sent them baby product coupons (Duhigg, 2012)
• Recall proxies from the algorithmic bias module: ZIP code → race, name → gender

Activity: Your data trail

In groups, choose one of the following:

1. a fitness tracking app, (b) a ride-sharing app, (c) your university learning management system (e.g., Canvas), (d) a smart doorbell camera

1. List the data it collects (directly and through sensors)
2. List what could be inferred from that data
3. Who might receive it (third parties, data brokers, law enforcement, employers)?
4. For each flow, does it respect contextual integrity? Which flows would surprise users?

Notice and choice

The dominant model of U.S. privacy protection is notice and choice: requires private entities (companies) to notify individuals and ask for their permission before collecting and utilizing their personal data companies, users then decide whether to use the service (choice).

Problems:

• Reading every privacy policy you encounter would take about 201 hours per year (McDonald & Cranor, 2008)
• Policies are vague (“we may share data with partners”) and change over time
• “Choice” is often take-it-or-leave-it: can you really opt out of email, maps, or your university’s systems?
• Users cannot consent to risks they cannot foresee (inference, aggregation, re-identification)

What does informed consent require?

From research ethics (The Belmont Report, 1979):

• Information: the person knows what will happen and what the risks are
• Comprehension: the information is presented in a way they can understand
• Voluntariness: they are free to say no without being pressured or penalized

How does clicking “I agree” compare to these three requirements?

Group discussion

• A/B testing happens on every platform every day. When does an experiment on users need consent?
• Privacy is networked: your choices reveal information about other people (friends, family, people in your contacts, relatives in DNA databases). However, crimes have been solved by exploiding this access to data. For example, the Golden State Killer case was solved by uploading the perpetrator’s crime-scene DNA profile to a public genealogy database. Do the benefits of data sharing outweigh the harms? For whom?
• Who is most vulnerable to data collection (children, people seeking health care, immigrants)? What would a caring design look like?

Dark patterns

Dark patterns (or deceptive design): Harry Brignul defines dark patterns as a “trick in software that gets users to complete an action that they would not otherwise have done, if they had understood it or had a choice at the time”

• Sneak into Basket: Adding items to a cart without user consent.
• “Confirmshaming”: “No thanks, I like paying full price”
• Hard to cancel: Making it easy for the user to sign up for aservice but hard to cancel it
• Hidden Subscription: Charging users a recurring fee under thepretense of a one-time fee or a free trial

ACM’s Case Study: Dark UX Patterns

References and Further Readings

• de Montjoye, Y.-A., Hidalgo, C. A., Verleysen, M., & Blondel, V. D. (2013). Unique in the crowd: The privacy bounds of human mobility. Scientific Reports, 3, 1376.
• Kosinski, M., Stillwell, D., & Graepel, T. (2013). Private traits and attributes are predictable from digital records of human behavior. PNAS, 110(15), 5802–5805.
• Kramer, A. D. I., Guillory, J. E., & Hancock, J. T. (2014). Experimental evidence of massive-scale emotional contagion through social networks. PNAS, 111(24), 8788–8790.
• Mathur, A., et al. (2019). Dark patterns at scale: Findings from a crawl of 11K shopping websites. Proceedings of the ACM on Human-Computer Interaction, 3(CSCW).
• McDonald, A. M., & Cranor, L. F. (2008). The cost of reading privacy policies. I/S: A Journal of Law and Policy for the Information Society, 4(3), 543–568.
• Narayanan, A., & Shmatikov, V. (2008). Robust de-anonymization of large sparse datasets. IEEE Symposium on Security and Privacy.

References and Further Readings

• Nissenbaum, H. (2004). Privacy as contextual integrity. Washington Law Review, 79(1), 119–157.
• Penney, J. W. (2016). Chilling effects: Online surveillance and Wikipedia use. Berkeley Technology Law Journal, 31(1), 117–182.
• Solove, D. J. (2006). A taxonomy of privacy. University of Pennsylvania Law Review, 154(3), 477–564.
• Solove, D. J. (2007). “I’ve got nothing to hide” and other misunderstandings of privacy. San Diego Law Review, 44, 745–772.
• Warren, S. D., & Brandeis, L. D. (1890). The right to privacy. Harvard Law Review, 4(5), 193–220.
• Westin, A. F. (1967). Privacy and Freedom. Atheneum.
• Zuboff, S. (2019). The Age of Surveillance Capitalism. PublicAffairs.