danah boyd
Personal Democracy Forum 2011
June 6, 2011
[This is a VERY rough unedited crib of the actual talk. This talk builds off of a paper that I co-authored with Alice Marwick called "Social Privacy in Networked Publics: Teens' Attitudes, Practices, and Strategies." If this topic interests you, that paper will definitely interest you.]
Citation: boyd, danah. 2011. "Networked Privacy." Personal Democracy Forum. New York, NY, June 6.
Battles over privacy are in the air. Congress is considering various bills to regulate what companies can do with data. New privacy-related bills have also been written by state legislatures. The Federal Trade Commission is considering its role in corporate privacy practices. And countless organizations in DC are thinking about data collection, with a specific eye towards behavioral marketing. Across the pond, European regulators are trying to find a way to make "forgetting" viable or, perhaps, mandatory. Meanwhile, security breaches and corporate stupidity are making privacy a newsworthy topic on a daily basis. Lawyers and computer scientists, consumer advocates and policy makers are battling out what privacy could, should, or will mean in the era of social media and big data. And yet, no one can agree on what privacy is, who wants privacy, or what it means to have privacy in the first place.
In listening to the different rhetorics that are floating about, I can't help but be fascinated by the individual-centric frame of privacy discourse in a networked era. Critics of contemporary American capitalism might argue that this is because neoliberalism dominates both politics and economics, prioritizing the individual over institutions like governments or corporations. Analysts of tech culture like Alice Marwick might argue that Web2.0 is seeped in neoliberalism as well as a libertarian ethos that focuses entirely on the individual. And legal scholars might point out that you can't think about "harm" without focusing on the individual. Afterall, when we're talking about the politics of privacy, it's hard to avoid discussions of individual harm.
But Facebook and Twitter and blogs and social media have ushered in a networked era. We're all connected. Our data is connected. Our interactions are connected. Our privacy is connected. And privacy matters, not just for the individual, but for the collective.
When Mark Pesce's mother decided to put up a public page of her family's genealogy, she was displaying something that was of great importance to her. But not only did she reveal information about a lot of people who might not have wanted their relationships to be articulated online, she also revealed the mother's maiden name of many of her family members. This, of course, is a common security question used under the assumption that no one in their right mind would publicize this information.
When mommybloggers decide to blog the details of their lives with their children, they aren't just revealing information about themselves; they're leaving a permanent - and embarrassing - record of their children's escapades, opening the doors for immense teasing. It's ironic to watch parents complain that their kids don't care about privacy when parents are so actively involved in invading kids' privacy and revealing information about kids online.
When your friends from high school scan and upload photos from high school to Facebook, they might think they're being funny. But the pictures of you with a bong aren't going to be read in the same light by your children or your boss. This is especially painful if you're a politician and your every action is scrutinized in detail. And politicians may complain that they're being unfairly watched, but they're also unfairly watching. Politicians may complain about privacy invasions involving targeted marketing, but they're using the same techniques in their efforts to fundraise and attract voters. Every coin is two-sided.
When data mining services use data to construct a portrait of you, they may get a strange impression. It's no longer about what you do that will go down on your permanent record. Everything that everyone else does that concerns you, implicates you, or might influence you will go down on your permanent record. It's a networked world. And the people that are watching may be well intended or they may want to manipulate us into buying their goods, voting for their candidate, or believing their message. Privacy isn't about the individual's relationship to information. If we want to have privacy in this world, we need to think about what networked privacy looks like.
...
There are lots of ways to slice and dice what privacy means and countless scholars have been trying to define privacy for decades. Many of you probably have different ideas about what we mean when we talk about privacy. I'm not going to solve the definitional issue, but I want you to keep two related concepts in mind: control and agency. Privacy is a feeling that people have when they feel as though they have two important things: 1) control over their social situation; and 2) enough agency to assert control.
Control over a social situation is not the same as control over a technology. It's not about being able to manipulate privacy settings on Facebook or limit who can see what piece of content. That would be what Alessandro Acquisti calls "the illusion of control." Control over a social situation means having a deep understanding of the social situation - who's looking and why - as well as an understanding of what the norms and boundaries are. In public spaces, it can be challenging to get such control by default so people try to carve out a way of achieving control. They whisper to create privacy in public. Or they try to do things that can't be seen, like passing a note under the table. But all of this requires understanding the affordances of the space and carving out a space for privacy.
Agency is more tricky. Agency is the freedom that people have to make their own choices without being constrained by structural factors. It's really hard to achieve privacy when you have no power because a lack of agency means that it's hard to assert control over a social situation.
Privacy isn't about simply restricting access to a piece of information. It's about having enough agency to feel a sense of control over that information, its spread, and its interpretation. It's about feeling like the floor won't drop out from under you at any moment in time. People want privacy and they work hard to create it. And even when they don't have it, they often try to trick themselves into believing that they do.
One way of seeing this in everyday life is through the enactment of modesty. I always find locker room culture fascinating because people go out of their way to pretend like they can't see one another naked and exposed. Staring is socially taboo and people will look at the floor as they get dressed, pretending like no one can see them. Just like they look down when they pick their noses, hoping no one will notice. This is the human equivalent of the ostrich who buries her head in the sand to pretend like no one can see her.
And the funny thing is that we let people do this. Sociologist Erving Goffman referred to people's willingness to pretend like they don't notice as "civil inattention." To create a civil society, we purposefully pretend not to pay attention to people, to help them feel as though they have a sense of privacy. If you get into a crowded elevator and face the people in the elevator and stare at them, that's creepy. Instead, we pack ourselves in to subways and restaurants, elevators and grocery store queues pretending not to look at or listen in on the other people around us.
(At least, we do in the United States. One of my favorite things about visiting India is being reminded that civil inattention operates differently in different cultural environments.)
The more people there are, the more we pretend like they don't exist. This is one of the reasons that people who aren't from NYC think that New Yorkers are rude. The notion of "minding your own business" is a survival tactic in NYC. But when an old lady trips and falls on the curb in Manhattan, I can guarantee you that numerous New Yorkers will immediately come over to her to help her out. We're all paying attention, but we're pretending like we're not. And this is how we maintain the illusion of control in everyday life.
Given this, it's not surprising that we delude ourselves into believing that we have control on sites like Facebook. We want to feel like we have control, even if we're not sure of what that means. So we look to signals that give us a feeling that control is possible. And this is one of the reasons why there's a huge gap between what people say and what people do. They want privacy. They think it's possible to have privacy on Facebook. But they also share tremendously on Facebook. And so this makes outsiders think that they don't care about privacy.
One of the reasons that I love working with teenagers is because, even though they have very limited agency, they still desperately crave it and try to find it in the cracks and folds of their lives. What this means is that they don't take control for granted. They assume that they have limited control over social situations because they're constantly having control taken away from them, most notably from their parents. Surveillance is a given in their worlds, something that more teens take for granted than not. They're not thinking about corporations or governments, but parents and teachers and friends. They're worried about social privacy, not data privacy, because violations of social privacy are very real to them.
Another thing that I love about teens is that they don't automatically assume that what is common in unmediated life is better than what is possible online. The Internet may not have radically reworked people's social goals, but the architecture of social media inflects social practices is fascinating ways. Offline, we assume that our interactions are private-by-default, public through effort. Online, the opposite holds true. What this means is that achieving privacy requires fundamentally different strategies online than offline.
In the last couple of years, as parents flocked to Facebook, teens stopped being able to claim these sites as their space. No amount of telling their parents to KEEP OUT worked. So they had to find a different way to achieve privacy in these spaces. Some manipulated privacy settings to try to keep people out, but many more started looking for social solutions. One of the first things that teens started doing en masse mirrored a practice that any parent would recognize: they started encoding their meaning. Rather than trying to restrict access to content, they started to restrict access to meaning. Any parent will tell you that kids have an amazing ability to talk behind their backs right in front of them. Siblings develop coded signals to try to hide information from parents. And tweens gossip in the backseat of parents' cars, using referents to refer to things that the parents know nothing about. The same thing happens online. Teens use pronouns to refer to people and events that only those "in the know" know the reference. Others use song lyrics to fly below the radar, engaging in an act of social steganography. None of this is new, but it takes on a new scale when it takes place in Facebook.
The fact that teens are actively engaging in strategies to achieve privacy highlights how privacy is by no means dead. Kids do care about privacy, even if they struggle to achieve it. But it also shows how the desire to achieve privacy is not contradictory with the desire to participate in Facebook. But there's another important aspect to teens' efforts to achieve privacy: they recognize and understand the networked nature of it.
When teens try to achieve privacy online, they don't start by thinking about how they can lock down content. They start by thinking about how they can make certain that those in their peer group understand the boundaries.
Teens are fully aware that their peers can copy and paste content from one place to another, but they purposefully set up social hurdles to make it more difficult.
[Tell Shamika's “Whitewalling” story.]
[Tell Carmen’s Life of Brian story.]
Teens reinforce social norms through their decisions and expectations of their peers. Just because anyone could share something doesn't mean that it's appropriate to do so. This is something that, surprisingly enough, teenagers seem to understand better than adults. I've met far too many adults who believe that just because something is publicly accessible means that they have the right to look and the right to comment and the right to share. Teenagers, on the other hand, have a greater sense of civil inattention when it comes to shared content. Sure, there are plenty of teens who love to rubberneck over the latest gossip, but there are also teens who shrug their shoulders and assume that if they can't make sense of something, it wasn't meant for them in the first place.
Not all teens are innovative and savvy when it comes to navigating privacy online, and there are plenty of situations where teens invade each other's privacy in deeply disturbing ways, but it's clear that there are teens who recognize, at a guttural level, that privacy is a networked social process more than it is a structural affordance.
...
Teens may grok the networked nature of social privacy, but they're completely oblivious to data privacy issues. Yet, those who are immersed in data privacy issues aren't yet focused on the networked nature of privacy. Our laws are focused on data collection, not the usage of data. And, yet, it's at the usage level where the violations of collective privacy take place. It's not particularly creepy to know that someone is a Yankees fan if they're wearing a Yankees T-Shirt. But if your algorithm pieces together thousands of pieces of data shared by that person and their friends and develops a portrait of that person from which to judge them... that's creepy. The only thing that stops people from being creeped out by it is that they have no idea that it's happening. If you haven't read Eli Pariser book "The Filter Bubble," you absolutely should. Collecting data about people isn't in and of itself a violation of privacy, but piecing it all together and using it to stare is a serious violation of privacy norms. Which is why people scream privacy foul. It's the difference between recognizing that there are others in the locker room and staring at them as they get dressed.
Our current models of privacy are too obsessed with individual harm. From this lens, they fail to recognize how violations of privacy can be more costly to a collective than an individual. What's at stake is not the harm to the individual, but the harm to the networked public. Teenagers may be developing strategies to navigate sticky social privacy issues, but it's high time that policy makers and privacy advocates move beyond the individual-centric notion of privacy and grapple with strategies for managing privacy in networked publics. The solution to this puzzle will not be to restrict data collection or to enhance individual control over specific items of data, but to think long and hard about what happens as the data flows across networks and as the data is networked together. This requires moving beyond the individual and focusing on the collective.
Thank you!
For a deeper analysis of this issue, please check out "Social Privacy in Networked Publics: Teens' Attitudes, Practices, and Strategies." This paper, co-authored with Alice Marwick is a rich analysis of how teens' conceptualize privacy and the strategies they take to acheive it.