Privacy

In "The Right to Privacy" (1890), the Boston lawyers Samuel D. Warren and Louis Brandeis argued that the common law should recognise a general "right to be let alone", a phrase they took from Judge Thomas M. Cooley.^[19] Their immediate concern was that "instantaneous photographs and newspaper enterprise" had "invaded the sacred precincts of private and domestic life", a reference to the sensationalist press of the period, often described as yellow journalism.^[5] They grounded the right not in property or contract but in the protection of an "inviolate personality".^[20]

The formula proved influential but indeterminate, since it does not explain which forms of being left alone the law should protect. It has been read to include a person's right to choose seclusion from the attention of others, and to be free from scrutiny or observation in private settings such as the home.^[21] Although the concept did not define privacy precisely enough to ground comprehensive legal protection, it strengthened the notion of an individual right to privacy and began a long tradition of debate about such rights in the United States.^[21]

A second family of theories treats privacy as limited accessibility to the self. In 1890 the American journalist E. L. Godkin described private life as "the right of every man to keep his affairs to himself, and to decide for himself to what extent they shall be the subject of public observation and discussion".^[22][23] Ruth Gavison developed the idea analytically, arguing that privacy concerns the extent to which a person is known to others (secrecy), the subject of their attention (anonymity) and physically accessible to them (solitude).^[24] Sissela Bok similarly defined privacy as "the condition of being protected from unwanted access by others—either physical access, personal information, or attention".^[25]

On a narrower view, privacy is the concealment of discreditable or sensitive information. Richard Posner described it as the right of people to "conceal information about themselves that others might use to their disadvantage", and argued on economic grounds that such concealment can amount to a form of misrepresentation that impairs the efficient working of markets.^[26][27] When privacy is understood as secrecy, it is usually imagined as a selective secrecy, in which individuals keep some information private while choosing to make other information public.^[28] Critics reply that the secrecy view cannot explain why a person may retain a privacy interest in information that has already been disclosed to some people, or in information that is not discreditable at all.^[29]

The most influential definition in the information age is that of the political scientist Alan Westin, for whom privacy is "the claim of individuals, groups, or institutions to determine for themselves when, how, and to what extent information about them is communicated to others".^[30] The philosopher Charles Fried likewise argued that privacy "is not simply an absence of information about us in the minds of others; rather it is the control we have over information about ourselves".^[31] The control model underlies the fair information practice principles on which most data protection legislation is built.^[32][33] It has been criticised for presupposing that individuals are able to make informed choices about complex and opaque data practices.^[34][14]

The psychologist Carl A. Johnson tied privacy to the psychological concept of "personal control", which he modelled as a process with four stages and two kinds of behaviour–outcome relationship, the outcomes depending on both situational and personal factors.^[35] On this model, privacy consists of "behaviors falling at specific locations on these two dimensions".^[36] The four stages are outcome choice control, the selection between possible outcomes; behaviour selection control, the selection between strategies for attaining the chosen outcome; outcome effectance, the carrying out of the chosen behaviour so as to achieve the outcome; and outcome realisation control, the person's interpretation of the outcome achieved. The two dimensions are primary control, in which behaviour directly causes outcomes, and secondary control, in which it does so indirectly.^[37] Johnson treated privacy as behaviour exercising secondary control over outcomes, and argued that a person's conception of privacy itself depends on these behaviour–outcome relationships; he developed the account in dialogue with the work of Irwin Altman, and of Maxine Wolfe and Robert S. Laufer.^[38]

The philosopher Lorenzo Magnani extends the idea of control to personal identity. He argues that consciousness is partly constituted by external representations of the self, such as narratives and data stored outside the body, but that much of it consists of internal representations that remain private and are rarely externalised.^[39] Magnani describes this internal privacy as a form of "information property" or "moral capital" that is essential to free choice and personal agency. When too much of a person's identity is externalised and subjected to scrutiny, he contends, the result is a loss of control, dignity and responsibility; the protection of privacy therefore safeguards the ability to pursue personal projects free from intrusive external forces.^[40]

Helen Nissenbaum's theory of contextual integrity holds that privacy is violated not by disclosure as such but by information flows that breach the norms of the social context in which the information was shared. A patient's disclosure of symptoms to a doctor is appropriate within medicine but would violate contextual norms if passed to an employer.^[41] The theory has been widely adopted in computer science and policy analysis because it explains why aggregating individually public information can nevertheless be harmful.

Privacy may be understood as a prerequisite for the development of a sense of self-identity. Privacy barriers, in particular, are instrumental in this process. According to Irwin Altman, such barriers "define and limit the boundaries of the self" and thus "serve to help define [the self]."^[42] This control primarily entails the ability to regulate contact with others.^[42] Control over the "permeability" of the self's boundaries enables one to control what constitutes the self and thus to define what is the self.^[42]

Several philosophers present privacy as a condition for the development of personhood. Jeffrey Reiman argued that privacy is a social ritual by which a society recognises, and conveys to the individual—that one's physical existence is under one's moral ownership.^[43] Hence, a moral right to self-determination devirated from the notion of privacy.^[43] Stanley Benn grounded privacy in respect for persons as choosers, observing that covert observation alters the conditions under which a person chooses without one's knowledge.^[44] Joseph Kupfer linked privacy to the formation of an autonomous self-concept, drawing on studies of child development and on Erving Goffman's account of "total institutions", in which the systematic deprivation of privacy erodes inmates' sense of self.^[45][46] In his understanding, an autonomous self-concept entails a conception of oneself as a "purposeful, self-determining, responsible agent" and an awareness of one's capacity to control the boundary between self and other—that is, to control who can access and experience one's and to which extent.^[45] In United States constitutional law, a related "decisional" conception of privacy protected choices about contraception, abortion and intimate relationships.^[47][34]

In addition, privacy may be seen as a state that fosters personal growth, a process integral to the development of self-identity. Hyman Gross suggested that, without privacy—solitude, anonymity, and temporary releases from social roles—individuals would be unable to freely express themselves and to engage in self-discovery and self-criticism.^[45] Such self-discovery and self-criticism contributes to one's understanding of oneself and shapes one's sense of identity.^[45]

In a way analogous to how the personhood theory imagines privacy as some essential part of being an individual, the intimacy theory imagines privacy to be an essential part of the way that humans have strengthened or intimate relationships with other humans.^[48] Because part of human relationships includes individuals volunteering to self-disclose most if not all personal information, this is one area in which privacy does not apply.^[48]

James Rachels advanced this notion by writing that privacy matters because "there is a close connection between our ability to control who has access to us and to information about us, and our ability to create and maintain different sorts of social relationships with different people."^[49] On this view privacy allows people to calibrate what they disclose to friends, colleagues and strangers, and so makes intimate relationships possible.^[49] Hence, protecting intimacy is also at the core of the concept of sexual privacy. The legal scholar Danielle Citron has built on this tradition to argue that "sexual privacy" deserves recognition as a distinct and especially weighty interest.^[50]

Alan Westin defined four states—or experiences—of privacy: solitude, intimacy, anonymity, and reserve. Solitude is a physical separation from others;^[51] Intimacy is a "close, relaxed; and frank relationship between two or more individuals" that results from the seclusion of a pair or small group of individuals.^[51] Anonymity is the "desire of individuals for times of 'public privacy.'"^[51] Lastly, reserve is the "creation of a psychological barrier against unwanted intrusion"; this creation of a psychological barrier requires others to respect an individual's need or desire to restrict communication of information concerning themself.^[51]

In addition to the psychological barrier of reserve, Kirsty Hughes identified three more kinds of privacy barriers: physical, behavioural, and normative. Physical barriers, such as walls and doors, prevent others from accessing and experiencing the individual.^[52] (In this sense, "accessing" an individual includes accessing personal information about them.)^[52] Behavioral barriers communicate to others—verbally, through language, or non-verbally, through personal space, body language, or clothing—that an individual does not want the other person to access or experience them.^[52] Lastly, normative barriers, such as laws and social norms, restrain others from attempting to access or experience an individual.^[52]

Physical privacy may be defined as the prevention of "intrusions into one's physical space or solitude".^[53] An example of a legal basis for physical privacy is the Fourth Amendment to the United States Constitution, which guarantees "the right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures".^{[54] [55]}

Physical privacy may be a matter of cultural sensitivity, personal dignity or shyness, and may also involve concerns about safety, for example on the part of people who fear becoming victims of crime or stalking.^[56][57] It can involve protection against being watched, directly or through recorded images, during intimate behaviour or while exposing intimate parts, and against unauthorised access to one's possessions or places. Means of securing it, often for reasons of modesty, include clothing, walls, fences, privacy screens, cathedral glass and window coverings.

Government agencies, corporations and other organisations may wish to keep their activities or secrets from other organisations or individuals, and adopt security practices and controls to keep information confidential. They may also seek legal protection for such information. A government may invoke executive privilege^[58] or designate information as classified, and a company may protect valuable proprietary information as trade secrets.^[55]

Political scientists such as Priscilla Regan have criticised accounts that treat privacy solely as an individual interest to be balanced against collective goods. Regan argued that privacy also has shared perceptions, public values, and collective components, since it sustains democratic participation and limits the power of government and organisations; in her view, recognising this would strengthen privacy's position in policy-making.^[60] David Flaherty's comparative study of data protection in five countries similarly treated privacy protection as a matter of controlling the surveillance capacities of the modern state.^[61] He believed believes networked computer databases pose threats to privacy and forwarded an idea of privacy as information control.^[61] More recent work emphasises that the burdens of weak privacy protection fall unequally: Scott Skinner-Thompson argues that marginalised groups are both more often required to disclose personal information and more severely harmed by exposure.^[62]

Richard Posner and Lawrence Lessig focus on the economic aspects of personal information control. Posner criticizes privacy for concealing information, which reduces market efficiency. For Posner, employment is selling oneself in the labour market, which he believes is like selling a product. Any 'defect' in the 'product' that is not reported is fraud.^[63] For Lessig, privacy breaches online can be regulated through code and law. Lessig claims "the protection of privacy would be stronger if people conceived of the right as a property right",^[64] and that "individuals should be able to control information about themselves".^[65]

There have been attempts to establish privacy as one of the fundamental human rights, whose social value is an essential component in the functioning of democratic societies.^[66] Leslie Regan Shade argues that the human right to privacy is necessary for meaningful democratic participation, and ensures human dignity and autonomy. Privacy depends on norms for how information is distributed, and if this is appropriate. Violations of privacy depend on context. The human right to privacy has precedent in the United Nations Declaration of Human Rights: "Everyone has the right to freedom of opinion and expression; this right includes freedom to hold opinions without interference and to seek, receive and impart information and ideas through any media and regardless of frontiers."^[8] Shade believes that privacy must be approached from a people-centered perspective, and not through the marketplace.^[67] Dr. Eliza Watt, Westminster Law School, University of Westminster in London, UK, proposes application of the international human rights law concept of "virtual control" as an approach to deal with extraterritorial mass surveillance by state intelligence agencies. Dr. Watt envisions the "virtual control" test, understood as a remote control over the individual's right to privacy of communications, where privacy is recognized under the International Covenant on Civil and Political Rights (ICCPR) Article 17. This, she contends, may help to close the normative gap that is being exploited by nation states.^[68]

Lack of privacy in public spaces, caused by overcrowding, increases health issues in animals, including heart disease and high blood pressure. Also, the stress from overcrowding is connected to an increase in infant mortality rates and maternal stress. The lack of privacy that comes with overcrowding is connected to other issues in animals, which causes their relationships with others to diminish. How they present themselves to others of their species is a necessity in their life, and overcrowding causes the relationships to become disordered.^[69]

Some philosophers have argued that non-human animals, too, have interests in privacy. Angie Pepper contends that animals kept in zoos are wronged by constant exposure to observation, because it deprives them of control over how and when they are seen by others.^[70] The naturalist David Attenborough suggested in 2016 that zoos should allow visitors to view gorillas through peepholes rather than glass panels because the animals "value their privacy".^[71] Studies of the "visitor effect" have reported that the presence of human audiences can be associated with changes in behaviour, including increased aggression and reduced social interaction, in a number of primate species.^[72]

Some philosophers doubt that privacy is a distinct value at all. Judith Jarvis Thomson argued that the "right to privacy" is a cluster of rights each of which derives from other rights, such as rights over one's property and person.^[73] Economic critics, notably Posner, argue that much privacy protection permits people to conceal information that others legitimately need.^[27] Feminist scholars have pointed out that appeals to the privacy of the home and family have historically shielded domestic violence and the subordination of women from public scrutiny; Catharine MacKinnon criticised the privacy rationale of Roe v. Wade on this ground, while Anita L. Allen defended privacy as a good that women have historically been denied.^[74][75]

Distinctions between public and private domains appear in many early societies. In his comparative study, the sociologist Barrington Moore examined conceptions of privacy in classical Athens, in the Hebrew Bible and in ancient China, concluding that some desire for privacy appears in all of them while its content varies with social structure.^[4] Aristotle's distinction between the polis, the sphere of political life, and the oikos, the household, is frequently cited as an early statement of the public–private division in Western thought.^[76] Hannah Arendt later drew on the same distinction in her account of the decline of the public realm in modern society.^[77]

Religious texts also address intrusion. The Quran enjoins believers not to spy on one another (49:12) and not to enter houses other than their own without permission (24:27), verses that have informed the treatment of privacy in Islamic jurisprudence.^[78] In Sinosphere, the term yinsi (隱私) or siyin (私隱) long carried connotations of shameful secrecy, and historians have traced how Confucian and later conceptions of the private (私) and public (公) diverged from Western liberal ones.^[79]

Historians of private life in Europe have associated the growth of privacy with changes in domestic architecture, the separation of household from workplace, literacy and the rise of individual religious practice.^[80] Jürgen Habermas traced the emergence, in the eighteenth century, of a bourgeois "public sphere" formed by private persons coming together to debate matters of common concern, which presupposed a protected intimate sphere of the family.^[81]

Liberal political theory gave the distinction normative force. John Stuart Mill's On Liberty (1859) argued that the only legitimate ground for interfering with an individual's liberty against his will is to prevent harm to others, and defended a domain of conduct that "merely concerns himself".^[82] At the end of the eighteenth century Jeremy Bentham proposed the Panopticon, a prison in which inmates could be watched at any time without knowing whether they were being observed; Michel Foucault later took it as a model of a disciplinary power that induces people to regulate their own behaviour.^[83]

As technology has advanced, the ways in which privacy is protected and violated have changed with it. Technologies such as the printing press and, later, the Internet increased the capacity to share information and so created new ways in which privacy could be breached. The expansion of the popular press, cheap portable photography and the telegraph and telephone made the protection of private life a recurrent legal issue in the nineteenth century. Warren and Brandeis's article of 1890, written chiefly in response to the growth of newspapers and photography made possible by new printing technologies, is generally regarded as the first publication advocating a right to privacy in the United States.^[5][84] Courts in the United States gradually recognised various privacy claims in tort, which the legal scholar William Prosser systematised in 1960 into four distinct torts (see below).^[85]

The twentieth century added the experience of totalitarian states that relied on systematic surveillance and informants. George Orwell's dystopian novel Nineteen Eighty-Four (1949) depicts the life of Winston Smith in Oceania, a totalitarian state in which the ruling Party, led by Big Brother, maintains its power through mass surveillance and the suppression of free speech and thought; the novel is a sustained commentary on the effects of totalitarianism on privacy and censorship.^[86][87] It became a lasting reference point in debates about surveillance. The technology commentator Kalev Leetaru, for example, has argued that the novel anticipated a world in which large social media companies, rather than governments, monitor users' data and decide what may be said online, ultimately for commercial ends.^[88]

From the 1960s, the computerisation of government and commercial records generated widespread public concern about the effect of technology on privacy.^[89] In 1964 the journalist Vance Packard warned in his best-selling The Naked Society that privacy was "evaporating".^[90][91] Westin's Privacy and Freedom (1967) documented the new pressures from surveillance technology and argued that, as records were computerised, individuals should be able to determine for themselves how information about them was communicated, a view that laid foundations for modern information privacy law.^[30][90]

Legislatures responded first in Europe. The German state of Hesse enacted the world's first data protection statute in 1970, followed by Sweden's national Data Act in 1973.^[7] In the United States, a 1973 report of the Department of Health, Education and Welfare formulated a code of fair information practices, which informed the Privacy Act of 1974.^[32] Internationally, the OECD adopted its non-binding Guidelines on the Protection of Privacy and Transborder Flows of Personal Data in 1980, and the Council of Europe opened for signature in 1981 the Convention 108, the first binding international treaty on data protection.^[33][92] In 1983 the German Federal Constitutional Court derived from the Basic Law's guarantees of human dignity and personality a right to "informational self-determination", striking down parts of a planned national census.^[93]

The commercial Internet and mobile computing transformed the scale of personal data processing. The European Union harmonised national laws through the Data Protection Directive of 1995, which was replaced by the General Data Protection Regulation (GDPR) in 2018.^[94][95] In 2013, documents disclosed by the former contractor Edward Snowden revealed the extent of bulk data collection by the United States National Security Agency and its partners, beginning with a court order requiring the telephone company Verizon to hand over its customers' call records on a daily basis.^[96] The disclosures prompted litigation, legislative reform and the adoption by the United Nations General Assembly of a resolution on "The right to privacy in the digital age".^[97]

Article 12 of the Universal Declaration of Human Rights provides that "No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation."^[8] Article 17 of the International Covenant on Civil and Political Rights gives the guarantee binding force, prohibiting "arbitrary or unlawful interference" with privacy.^[9] In 2013 the General Assembly affirmed that the rights people have offline must also be protected online, including the right to privacy;^[97] the Human Rights Council subsequently created the mandate of Special Rapporteur on the right to privacy.^[98]

Article 8 of the European Convention on Human Rights guarantees "the right to respect for [one's] private and family life, [one's] home and [one's] correspondence", subject to interferences that are in accordance with the law and necessary in a democratic society for specified purposes.^[10] The European Court of Human Rights has interpreted it broadly to cover, among other things, the retention of DNA profiles and the bulk interception of communications.^[99][100] The Charter of Fundamental Rights of the European Union distinguishes respect for private and family life (Article 7) from a separate right to the protection of personal data (Article 8).^[101]

Other regional frameworks include the APEC Privacy Framework of the Asia-Pacific Economic Cooperation, endorsed in 2004,^[102] and the African Union's Convention on Cyber Security and Personal Data Protection (the Malabo Convention), adopted in 2014.^[103]

Comparative lawyers commonly distinguish between omnibus data protection laws, which apply general principles to the public and private sectors alike, and sectoral regimes, which regulate particular industries or types of data. The European Union exemplifies the first model and the United States the second.^[7][12] James Q. Whitman attributes the difference to "two Western cultures of privacy": a continental European tradition rooted in personal dignity and honour, and an American tradition centred on liberty against the state, particularly within the home.^[12] A related policy debate opposes market-based approaches, which rely on notice and individual choice, to consumer-protection approaches, which doubt that individuals have the time or expertise to make informed choices; empirical studies have found, for example, that many online privacy policies demand a reading level beyond that of much of the population.^[104]

The relationship between police powers and privacy has been a central subject of constitutional litigation, particularly as new technologies have enabled forms of monitoring that do not involve physical entry. In Kyllo v. United States (2001), the United States Supreme Court held that using a thermal imaging device to detect heat inside a home was a search requiring a warrant.^[54] In United States v. Jones (2012), the Court unanimously held that attaching a GPS tracker to a suspect's vehicle and monitoring its movements for 28 days was a search under the Fourth Amendment; the majority relied on the physical trespass involved, while five Justices indicated in concurring opinions that long-term location monitoring would infringe a reasonable expectation of privacy in any event.^[105] The Court did not decide whether a warrant was required, because the government had not argued that the search was reasonable without one.^[105]

The European Court of Human Rights reached a different result on comparable facts in Uzun v. Germany (2010). It held that GPS surveillance of a suspect in a series of bomb attacks, lasting about three months, interfered with his private life under Article 8, but that the interference had a sufficient legal basis and was proportionate given the gravity of the offences under investigation; it found no violation.^[106] The Court regarded GPS tracking as interfering less with private life than visual or acoustic surveillance or telephone interception.^[107]

In Riley v. California (2014) the United States Supreme Court unanimously held that police generally may not search the digital contents of a mobile phone seized at arrest without a warrant, observing that modern phones hold "the privacies of life".^[108] In Carpenter v. United States (2018) a majority of five to four held that obtaining historical cell-site location records from a mobile operator is a search that generally requires a warrant, limiting the "third-party doctrine" under which information voluntarily disclosed to businesses had been treated as unprotected.^[109]

Bulk surveillance by intelligence agencies has raised analogous questions. Following the Snowden disclosures, the United States Court of Appeals for the Second Circuit held in 2015 that the NSA's bulk collection of telephone records exceeded its statutory authority, and Congress ended the programme in its existing form through the USA Freedom Act later that year.^[110] In Big Brother Watch v United Kingdom (2021), the Grand Chamber of the European Court of Human Rights accepted that bulk interception regimes are not in themselves incompatible with the Convention, but found that the British regime lacked adequate "end-to-end safeguards" and violated Article 8.^[100]

In Solove's taxonomy, information collection comprises surveillance, the watching, listening to or recording of a person's activities, and interrogation, the pressuring of a person to divulge information.^[156] Commercial collection has become a prominent concern. Companies such as Google and Meta collect large amounts of personal data through their services and platforms, including browsing habits, search histories, location information and communications, and analyse and aggregate the data into detailed user profiles used for targeted advertising. Asunción Esteve argues that these practices often take place without meaningful user consent, leave individuals with little control over how their information is used, and raise significant ethical and legal concerns under European and American data protection law.^[160]

Facial recognition and other biometric technologies allow the collection of identifying information at a distance and without the subject's knowledge, and are the subject of research into privacy-preserving alternatives.^[161] Legislatures have begun to regulate them specifically: Illinois requires consent for the commercial collection of biometric identifiers,^[152] and the European Union's Artificial Intelligence Act prohibits, subject to narrow exceptions, the use of real-time remote biometric identification in publicly accessible spaces for law-enforcement purposes.^[162]

It can happen that privacy is not harmed when information is available, but that the harm can come when that information is collected as a set, then processed together in such a way that the collective reporting of pieces of information encroaches on privacy.^[163] Actions in this category which can lessen privacy include the following:^[163]

1. data aggregation, which is connecting many related but unconnected pieces of information
2. identification, which can mean breaking the de-identification of items of data by putting it through a de-anonymization process, thus making facts which were intended to not name particular people to become associated with those people
3. insecurity, such as lack of data security, which includes when an organization is supposed to be responsible for protecting data instead suffers a data breach which harms the people whose data it held
4. secondary use, which is when people agree to share their data for a certain purpose, but then the data is used in ways without the data donors' informed consent
5. exclusion, which is the use of a person's data without any attempt to give the person an opportunity to manage the data or participate in its usage

Count not him among your friends who will retail your privacies to the world. — Publilius Syrus

Information dissemination is an attack on privacy when information which was shared in confidence is shared or threatened to be shared in a way that harms the subject of the information.^[163] There are various examples of this. Breach of confidentiality is when one entity promises to keep a person's information private, then breaks that promise.^[163] Disclosure is making information about a person more accessible in a way that harms the subject of the information, regardless of how the information was collected or the intent of making it available.^[163] Exposure is a special type of disclosure in which the information disclosed is emotional to the subject or taboo to share, such as revealing their private life experiences, their nudity, or perhaps private body functions.^[163] Increased accessibility means advertising the availability of information without actually distributing it, as in the case of doxxing.^[163] Blackmail is making a threat to share information, perhaps as part of an effort to coerce someone.^[163] Appropriation is an attack on the personhood of someone, and can include using the value of someone's reputation or likeness to advance interests which are not those of the person being appropriated.^[163] Distortion is the creation of misleading information or lies about a person.^[163]

Invasion of privacy, a subset of expectation of privacy, is a different concept from the collecting, aggregating, and disseminating information because those three are a misuse of available data, whereas invasion is an attack on the right of individuals to keep personal secrets.^[163] An invasion is an attack in which information, whether intended to be public or not, is captured in a way that insults the personal dignity and right to private space of the person whose data is taken.^[163]

Invasion may further distinguished into two branches. An intrusion is any unwanted entry into a person's private personal space and solitude for any reason, regardless of whether data is taken during that breach of space.^[163] Decisional interference is when an entity somehow injects itself into the personal decision-making process of another person, perhaps to influence that person's private decisions but in any case doing so in a way that disrupts the private personal thoughts that a person has.^[163]

In 2019, contract workers for Apple and Amazon reported being forced to continue listening to "intimate moments" captured on the companies' smart speakers in order to improve the quality of their automated speech recognition software.^[164]

Several social networking services are among the most visited websites in the world. Facebook, the largest, had about 2.7 billion monthly active users in 2020.^[174] Information posted on such services can be preserved indefinitely: in 2010 the United States Library of Congress announced that it would acquire and permanently store the entire archive of public Twitter posts since 2006.^[166]

A review of scholarship on how individuals value privacy on social networking services concluded that adults seem to be more concerned about potential privacy threats than younger users, that "policy makers should be alarmed by a large part of users who underestimate risks of their information privacy", and that "traditional one-dimensional privacy approaches fall short" in this setting.^[175] The risk is compounded by research showing that sensitive traits can be inferred from a wide range of digital footprints: a study of 58,000 volunteers found that Facebook "likes" could be used to predict sexual orientation, ethnicity, religious and political views, personality and intelligence with substantial accuracy.^[176]

Social-media information can also affect employment. Rosen reported a Microsoft study finding that 75 per cent of recruiters and human-resources professionals in the United States researched candidates online, using search engines, social networking and photo-sharing sites, personal websites, blogs and Twitter, and that 70 per cent had rejected candidates on the basis of information found online. Many job-seekers have accordingly sought to manage their privacy settings and online reputations, and the practice has prompted litigation against both social media services and employers.^[166]

Selfies became a prominent form of online self-presentation in the 2010s; in 2013 a search of Instagram for the hashtag #selfie returned more than 23 million results, and #me 51 million.^[177] The cultural theorist Henry Giroux has argued that the practice is entangled with corporate and state surveillance, which turns self-exposure into a source of data.^[178] A study of 3,763 users found that women generally had greater privacy concerns than men about posting selfies, and that privacy concerns predicted lower selfie-posting activity.^[179]

Mobile devices increasingly facilitate location tracking, which creates privacy problems because a user's location and preferences constitute personal information whose improper use violates the user's privacy. A study of mobility data for 1.5 million people by Yves-Alexandre de Montjoye and colleagues at the Massachusetts Institute of Technology found that four approximate points in space and time were sufficient to identify 95 per cent of individuals uniquely, and that this held even when the resolution of the data was reduced, so that coarse or blurred datasets provide little protection.^[189]

Several methods to protect privacy in location-based services have been proposed, including anonymising servers and the deliberate blurring of location information. Researchers have also proposed ways of quantifying privacy, for example in terms of entropy, so as to balance the benefit of accurate location information against the risk to privacy.^[190]

Several controversies have concerned the handling of location data. In 2017 the weather service AccuWeather was reported to be sending users' location data to Reveal Mobile, a company that monetises location data, even when users had disabled location sharing within the application.^[191] In the same year a flaw in the application programming interface of McDonald's McDelivery application in India exposed personal data, including home addresses, of 2.2 million users.^[192]

Large American technology companies have faced congressional scrutiny over such practices. In 2011 Senator Al Franken wrote to Steve Jobs after researchers found that iPhones and iPads stored an unencrypted log of approximate user locations.^[193][194] Apple attributed the practice to a software bug, but Justin Brookman of the Center for Democracy and Technology said: "I'm glad that they are fixing what they call bugs, but I take exception with their strong denial that they track users."^[195] In 2020 the State of Arizona sued Google, alleging that it had misled users and continued to collect their location information after they believed they had disabled location tracking.^[196]

The Internet has become a major advertising medium; digital advertising accounted for roughly half of global advertising expenditure in 2019.^[197] Although websites can sell advertising space without tracking users, for example through contextual advertising, advertising intermediaries such as Facebook and Google have promoted behavioural advertising, supplying code that website owners embed to track visitors through HTTP cookies and similar techniques. Tracking data are also traded among third parties as part of the mass surveillance industry, and with the spread of smartphones, software development kits from data brokers have been embedded in mobile applications, contributing to a digital advertising industry worth some US$350 billion.^[198]

Privacy scandals such as the Facebook–Cambridge Analytica data scandal, in which a political consultancy obtained data on Facebook users through a third-party application, made digital privacy a central concern for many users and formed part of the conduct addressed by the Federal Trade Commission's 2019 penalty.^[198][150] In 2021 Apple began requiring applications to ask users' permission before tracking them across other companies' applications, a change that reshaped the mobile advertising market;^[198] competition lawyers have argued that the policy may also entrench Apple's own position, and it became the subject of complaints to competition authorities in France and Germany.^[199] Google proposed to replace third-party cookies with "Federated Learning of Cohorts" (FLoC), which grouped users by browsing interests and which Google presented as less harmful to privacy. Critics argued that it would itself facilitate fingerprinting and discrimination, and the proposal attracted regulatory scrutiny; in 2022 Google replaced it with a "Topics" interface.^{[200][201][202][203]}

The ability to search for and compile information about individuals online has expanded dramatically. Directly observed behaviour, such as browsing logs, search queries or the contents of a public Facebook profile, can be processed automatically to infer secondary information about a person, such as sexual orientation, political and religious views, ethnicity, substance use, intelligence and personality.^[176] Communications metadata, information about who communicated with whom, when, where and for how long, as distinct from the content of the communication, can be similarly revealing. A study of telephone metadata contributed by volunteers found that it allowed researchers to infer sensitive information, including medical conditions, and to re-identify individuals with relative ease.^[204] Such findings undermine the distinction between "personal" and "anonymous" data, and between content and metadata, on which many legal regimes, including data-retention laws, have relied.^[189][133]

The "privacy paradox" refers to the observed discrepancy between people's stated concern for privacy and their apparently careless disclosure of personal information, particularly online.^[205][206] The term was used as early as 1998,^[207] but acquired its current sense around 2000.^[208][209] In 2006 Susan B. Barnes used it to describe young people's extensive self-disclosure on social networking sites despite their expressed concerns, and to describe the ambiguous boundary between private and public space on social media.^[210]

The evidence is mixed. Some studies have found little relationship between concern and behaviour,^[211] but others have found significant and at times strong correlations between privacy concerns and information-sharing behaviour,^[212] a meta-analysis of 166 studies found a small but significant relationship between privacy concerns and both information sharing and the use of protective measures,^[213] and a systematic review concluded that the paradox is better understood as a set of distinct phenomena than as a general law.^[214]

Several explanations have been proposed for the gap that does exist. According to research on the attitude–behaviour gap, attitudes and behaviour are in general only loosely related.^[215] In the context of privacy, users may lack awareness of the risks and of the audiences to which their information is exposed,^[216] and may underestimate the harm of disclosure.^[14] Others attribute the mismatch to limited technological literacy and to the design of services, which make disclosure easy and protection difficult: users may not know how to change default settings even though they care about their privacy.^[217][206] The psychologists Sonja Utz and Nicole C. Krämer have shown that the paradox can arise when users must trade privacy concerns off against impression management.^[218] Others question whether the behaviour is paradoxical at all, arguing that people disclose information because participation in contemporary social and economic life requires it, and that the term obscures the structural conditions under which choices are made.^[14]

Mobile computing illustrates these difficulties. Users of applications generally know little about how their personal data are used and are often unable to interpret the information that application providers supply about collection and use.^[206] Mobile applications are often designed to prompt rapid, automatic decisions taken without assessing risk; safeguards are often hard to find when applications are downloaded and installed; and even where protective mechanisms exist, users may lack the knowledge or experience to use them.^[205] Other research finds that users choosing applications are swayed far more by cost, functionality, design, ratings and reviews than by the permissions requested.^[219]

The "privacy calculus" model holds that disclosure decisions reflect a weighing of perceived risks against expected benefits.^[220][221] The model has been extended to electronic commerce, where trust and perceived benefits were found to offset privacy concerns in decisions to transact online.^[222] Critics note that the model assumes a degree of information and rationality that users frequently lack, and that it may legitimise practices in which privacy is traded for small or illusory benefits.^[206]

Posner and Lawrence Lessig have both analysed the control of personal information in economic terms, although they reach opposite conclusions. Posner criticises privacy for allowing people to conceal information and so reducing the efficiency of markets: in his account, a person seeking employment is selling himself or herself in the labour market much as a seller markets a product, and the concealment of a material "defect" resembles fraud.^[63] Lessig argues that privacy online can be regulated both through law and through the architecture of software ("code"), and that "the protection of privacy would be stronger if people conceived of the right as a property right", so that individuals could control information about themselves.^[223]

The willingness to incur a privacy risk appears to be driven by a complex array of factors, including attitudes to risk, the value a person places on private information, and general attitudes to privacy, which are typically measured by surveys.^[224] One experiment designed to determine the monetary value of several types of personal information found that people placed relatively low values on it,^[206] and another study suggests that people value their browsing history at about the price of a cheap meal.^[225] Providing personal data may bring not only monetary returns but also greater ease of use, for example in voluntary interactions with public services.^[226] Although some commentators have argued that valuing data properly would require a "stock-market for personal information",^[227] the data broker industry regularly prices such data as it is traded between companies and governments.^[165]

Users are not always given the tools to act on their professed privacy concerns, and are sometimes willing to trade private information for convenience, functionality or financial gain, even when the gains are very small.^[228] One study found that attitudes to privacy risk do not appear to depend on whether privacy is already under threat.^[224] Approaches based on user empowerment seek to give users sufficient context to make informed decisions about privacy.

Andréa Belliger and David J. Krieger suggest that the privacy paradox should be regarded not as a paradox but as a privacy dilemma for services that cannot exist without users sharing private data.^[225] The public, however, is often not given a meaningful choice about whether to share data at all, as the cases of voice-assistant recordings and location tracking illustrate, which makes it difficult to verify claims that a service could not exist without it.^[164][196]

Encryption protects the confidentiality of communications and stored data. End-to-end encryption, in which only the communicating parties hold the keys, is now widely used in messaging services; proposals to require "exceptional access" for law enforcement have been criticised by security researchers on the ground that any such mechanism would create vulnerabilities exploitable by others.^[229] Anonymity networks such as Tor route traffic through several relays so that no single relay can link a user to the destination of his or her communications.^[230] Differential privacy provides a mathematical guarantee that the output of a statistical analysis reveals little about any individual in the dataset, and has been adopted by statistical agencies and technology companies.^[231]

"Privacy by design", a concept developed by the Ontario Information and Privacy Commissioner Ann Cavoukian, holds that privacy should be built into systems as a default setting rather than added afterwards.^[232] The GDPR gives the idea legal force by requiring controllers to implement "data protection by design and by default".^[233] Some underlying principles of this concept imply the proactive protections, anticipating privacy-invasive scenarios and defensing properly against them.^[234]

Individuals can reduce their exposure by limiting what they disclose, adjusting privacy settings and using protective tools, but researchers have stressed the limits of individual self-help where services are designed to encourage disclosure and where consent processes are complex.^[205][14] Civil-society organisations such as the Electronic Frontier Foundation and Privacy International therefore combine technical advocacy with litigation and campaigns for legal reform.