Privacy settings are the part of a social networking website, web browser, or other piece of software, that allows a user to control who sees information about the user. With the growing prevalence of social networking services, opportunities for privacy exposures also grow. Privacy settings allow a person to control what information is shared on these platforms.
Many social networking services (SNS) such as Facebook, have default privacy settings that leave users more prone to sharing personal information. Privacy settings are contributed to by users, companies, and external forces. Contributing factors that influence user activity in privacy settings include the privacy paradox and the third person effect. The third person effect explains why privacy settings can remain unchanged throughout time. Companies can enforce a principle of reciprocity (PoR) where users have to decide what information they are willing to share in exchange for others’ information.
With the growing focus on internet privacy, there are technologies and programs designed to enhance and encourage more privacy setting activity. Applications such as the Personal Data Manager (PDM) are used to improve the efficiency of privacy setting management. Privacy by design can enhance privacy settings through incorporating privacy notifications or prompting users to occasionally manage their privacy settings.
Significance
SNS are designed to connect people together online. Users share information and build relationships online. Privacy leaks can still occur even with privacy settings intact. Users’ connections on SNS can reveal personal information such as having friends from the same university can lead to an inference that a person attends that university. Furthermore, even if a person has strict privacy settings enabled, their privacy can still be leaked through their connections who may not have as many privacy settings in place. This calls for enhanced privacy settings that can tolerate different privacy settings while allowing online connections.
The ability to control who views their content influences users’ decision to share or not share images on SNS such as WeChat or Qzone. Different communities call for different levels of privacy. For example, an individual is more likely to share a photo of themselves and a close friend with their close friend circle and family than strangers. This reveals a need for fine privacy settings that allow users more flexibility in their SNS sharing ability. Hu Xiaoxu et al. suggests privacy settings should encourage social networking on SNS while simultaneously protecting user privacy.
Default settings
Privacy settings for SNS have default settings that set up users to automatically share personal information the user has inputted. For example, Twitter users are automatically prone to a public profile when an account is first made. Furthermore, SNS privacy policies have shown to be too complex for consumers to fully understand, leading to personal information being shared regardless of user awareness. Even after a user deletes their Facebook profile, Facebook can still use and sell user information according to their privacy policy. Facebook's default settings allow friends to view a person's profile and anyone to search for one's profile. Default settings can be chosen due to their convenience; users do not have to exert as much effort to choose default settings compared to personalizing privacy settings.
Users' role in privacy settings
Theories Privacy settings are situated in the framework of the communication privacy management theory. This theory states that privacy management involves setting boundaries and agreements with individuals, highlighting that once information is shared, it is now their information as well. In a study about teenagers and their privacy, it was revealed that privacy concerns was the biggest contributor to management both personal and interpersonal privacy (see Privacy concerns with social networking services). Privacy settings can be inaccessible or effortful to implement. Teenagers that feel fatalistic toward their personal privacy are more likely to depend on interpersonal privacy techniques. De Wolf's study revealed that teenagers used more personal privacy techniques than interpersonal privacy management, which emphasizes the need for accessible, clear privacy settings.
Voluntary servitude is an idea that states people knowingly give their support to authoritative figures by subjecting themselves to servitude. In the sense of social media, voluntary servitude is how users expose their information to companies and perpetuate data collection and monetization. Romele et al. offers a possible explanation to voluntary servitude through the System Justification Theory. This theory states that people learn to internalize societal hierarchies and perpetuate their existence. Users are complying to the power hierarchy by allowing their information to be extracted from these companies, through methods such as sharing personal information with close family and friends which can be harvested by companies and third parties.
The theory of planned behavior aligns beliefs, attitudes, norms and behavior together. In a study that surveyed undergraduate students on their Facebook use, a majority responded that when their close friends think privacy protection is important or engage in privacy protection activity, they are more likely to have intentions to also engage in privacy protection behavior.
Privacy paradox
By accepting privacy policies and therefore agreeing to default settings set in place by companies, users are prone to oversharing information. However, users usually do not change their privacy settings unless they personally experience a privacy invasion or unintentionally share information. In a study exploring the connection between Facebook attitudes and behaviors, having a friend experience a privacy invasion (e.g. someone hacking into their profile) did not lead to one implementing privacy changes. A possible explanation for this is the third-person effect, which is the belief that one has a less chance of a privacy invasion than someone else, thinking they are safer than others. This protective mindset is flawed because anyone is susceptible to privacy invasions, and managing privacy settings can help decrease that risk.
The privacy paradox is an idea that states individuals' privacy attitudes and beliefs do not match their privacy behavior. This concept offers an explanation to why individuals may be complacent in privacy setting management. The privacy paradox intertwines with the third-person effect because individuals believe privacy is important but do not believe a privacy-related incident will happen to them over others. Recognizing personal privacy as important is a low-cost effort, but actually taking measures to protect one's privacy may be too high-cost for individuals, explaining the privacy paradox.
An extension of the privacy paradox is the discrepancy between the nothing to hide claim and the use of privacy settings. In a study of Canadian teenage use of SNS, a majority of participants that claimed they had nothing to hide still utilized privacy settings such as blocking other users. In addition, different selves were also portrayed across different SNS such as Facebook and Snapchat, which is a form of privacy in itself.
Influences Another reason users do not alter their privacy settings is a lack of knowing these settings exist. Facebook users that know privacy settings exist are more likely to change them compared to users who do not know privacy settings exist. Furthermore, with Facebook, users explain their lack of privacy setting alteration because the choice to choose who is a Facebook friend is already a form of privacy. However, Debatin et al. emphasizes that the criteria individuals use to decide who is a Facebook friend is typically relaxed, posing privacy risks for users. In a different study, it was shown that the number of friends who had a private profile increased the likelihood that a user would adopt a private profile. Furthermore, the amount of time a person spent on Facebook and women were more likely to have a private profile. A private Facebook profile was defined as changing the default settings so non-friends cannot search for their profile. If the data is valuable, privacy is prevalent on the app, and implementing privacy settings is easy, users say they are more likely to engage in privacy behavior.
Updated privacy settings In May 2020, Facebook began implementing the option to give users to delete or archive past posts from a certain time or from certain people. This "Manage Activity" option allows more security and privacy control for users. This tool is only accessible through the mobile app and has yet to be adapted to the web version of Facebook.
Companies' role in privacy settings
Policy design However, users are not the sole party involved in privacy. Companies are also responsible for implementing default privacy settings and creating options. Romele et al. acknowledges that social media companies often play a significant role in perpetuating the voluntary servitude of users. Social media privacy policies can be complex and default settings are set up to collect beneficial, profitable data to companies. In a study that examined Facebook's privacy policy from 2005 to 2015, Shore et al. found that the policy became increasingly unclear and unaccountable. A specific portion regarding the use of user personal data and third party involvement was found to be increasingly confusing. In addition to companies portraying their privacy protection as clear and beneficial for users, they also do not do anything to heighten awareness of constant data collection. An example of this is shown through Facebook ad preferences. Facebook users can have personalized ads on their feeds which Facebook portrays as a specialized, beneficial option for users but does not explicitly state that these ads largely benefit the companies and third parties involved.
Principle of reciprocity Default settings put users on a specific trajectory regarding their privacy. The principle of reciprocity (PoR) is played out in terms of privacy and sociability on these networks. PoR is the concept that users who give their privacy receive application utility in return. In a WhatsApp study testing user privacy choices (see Reception and criticism of WhatsApp security and privacy features), users were interviewed regarding the Last Seen Online (LSO) and Read Receipt (RR) option. Participants revealed a higher preference for keeping the RR on than the LSO option. Individuals were more likely to share if they have read a message in exchange for their recipients' read status, an example of the principle of reciprocity. LSO was not as practical as RR because being online was not a direct translation to reading their messages. In the study, younger participants had LSO turned off, indicating that older participants were less likely to have restrictive privacy settings. This could be because older users have closer circle of contacts and/or they do not place as much emphasis on what they share. Designing privacy settings to be reciprocal force users to make a decision on what private information they are willing to exchange for others' private information.
Profit