Youth, Privacy, and Online Media

Abstract

Source: Gry Hasselbalch Lapenta and Rikke Frank Jørgensen, https://web.archive.org/web/20150425065351/http://firstmonday.org/ojs/index.php/fm/article/view/5568/4373
This work is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 License.

Introduction

One of the characteristics of the Internet era is the way it changes the modalities for public and private life. The Internet extends the public sphere with online services and an infrastructure in which life and practices are recorded, made trackable and shareable. Ubiquitous computing internalizes public life in the private sphere of the individual. Thus, increasingly private life requires a special effort, which is an option that one has to activate. As addressed by a wide range of scholars, this fundamentally challenges the protection of the right to privacy, and more generally the conditions for exercising public and private life in the online domain. The discussion about the right to privacy in the context of online media and its practical implementation has been subject of debate in global policy discussions since the 1990s. Here, online privacy has predominantly been described as a form of protection of internet users' legal right to privacy or as a protection of "the liberal self". "Privacy" and particularly "online anonymity" have also lived through a stage of more negative connotations, blamed for aiding and effecting identity theft, trolling, bullying, terrorism, and illegal sharing of copyrighted material. Thus, it can be argued that "Privacy has an image problem". However, whereas discourses concerning these concepts until recently were created mainly in the domains of politics, business, activism and technology development, discussions concerning privacy and online anonymity have now reached a more "popular sphere", which includes the ordinary users of the Internet and mainstream media. This "popular momentum" was infused by the still ongoing revelations by the American NSA-contractor Edward Snowden of the NSA's Internet surveillance programs, yet one can also argue that it was a process in the making for several years. Ordinary Internet users are over the past years increasingly demanding the opportunity to create their own circles of inclusion and exclusion online and have control over the contexts in which they share their data.

The notion of "youth" is often used in policy-making, in media accounts and in business development as symbolic constituents of the future student, consumer, employee, citizen as well as the transformation of social and organizational norms in the Internet era. Terms such as Generation Y and Millennials, the Net generation or Digital Natives are employed to designate a gap between an older generation of business developers and policy-makers (and teachers and parents) and a generation that are growing up with digital media as a natural extension of their everyday life and practices. Similarly, this depiction of a generation of media savvy young people has found its way into discussions concerning online privacy and data protection. One argument is that we see a culturally diminishing interest in privacy as particularly young people are growing up with open networks and many are avid online sharers that willingly develop their everyday lives in intrinsically public social networks. Thus, privacy is, so to speak, "no longer a social norm". An argument as such, will normally precede a case for lesser need for privacy control and more open networks. However a number of recent surveys among youth, including the survey presented in this paper, fundamentally challenges and rejects this argument. These surveys illustrate how youth deal with issues of control over the treatment of their data on a daily basis even in a context where online sharing is indeed the default.

This paper is structured as follows: Firstly, it briefly outlines the right to privacy in an online context, including its policy implications, how it relates to youth and social media, and its relation to online public life. Secondly, it presents the results of the Danish study, focusing in particular on the respondents' perceptions of online social life; their strategies and practices to preserve and control online privacy, and their knowledge and assessment of privacy risks. Thirdly, these results are discussed with a view to the ongoing transformation of privacy in an online context. In conclusion and based on the previous discussions and study findings, three open questions to public policy-making are raised.

Online privacy

The right to privacy is stipulated in Article 12 of the Universal Declaration of Human Rights, Article 17 of the International Covenant on Civil and Political Rights, as well as numerous international and regional human rights treaties and conventions. The right to privacy essentially protects the integrity of the individual and his or her home, family, and correspondence. A common denominator for the different areas of privacy is access control: thus control over what others know about us; control over private decisions and actions; and control over a physical space. The right to privacy builds on the presumption that a zone of autonomy around the individual is central to individual freedom and self-determination: 'In order to behave in a self-determined fashion, we must in general believe and be able to presume that we are not being observed, eavesdropped on, deceived about what data is collected and shared with others, or about the presence of others, and about what those present know about us'. Fried argued that privacy is important because it renders possible important human relationships. Privacy provides "the necessary context for relationships which we would hardly be human if we had to do without the relationships of love, friendship and trust". The right to privacy applies to the off-line and online sphere equally . However, the individual's right to privacy has evolved alongside the structural transformation of the public sphere. Accordingly, the concept "online privacy" is often used to present the specific challenges and implications posed to the right to privacy by the Internet.

Individuals have a right to privacy not only in the private domain but also when acting in the public space, 'as a kind of private sphere which is inherent in the individual person and which accompanies the person when moving about'. Not least in the context of social media platforms it is important to bear the right to privacy in public spaces in mind. The right to privacy relates to individual control, and not necessarily to a private intimate realm.

The contemporary debate about online privacy typically portrays privacy as a good to be traded off against other goods, inspired by Westin's U.S.-based taxonomy. The taxonomy divides the population into the privacy unconcerned, the privacy pragmatics, and the privacy fundamentalists. Whereas privacy fundamentalists will only be satisfied with the highest and therefore unrealistic level of privacy protection, the privacy unconcerned pays little attention to the treatment of their personal information. The privacy pragmatics on the contrary will consent to a continuous erosion of privacy in the name of convenience. The framing is convenient for those who benefit from eroding privacy standards assuming that either people don't care about privacy or they care more about other values. It leaves little room, however, for a more dynamic understanding of what privacy is about, and what purpose it serves. If privacy is ultimately about boundary management along dimensions that are both spatial and informational, as suggested by some scholars, it becomes crucial to understand how this boundary management plays out in the online domain with its specific material and informational characteristics.

While online privacy is widely researched ­– especially from a technical and legal perspective ­– limited research examines the sense-making and actual practices that unfold around privacy in social media platforms. Scholars such as boyd, boyd and Marvick, Tufekci and Raynes-Goldie have been pioneers in the area, however, largely with empirical studies based on experiences in the U.S. At the European level, several quantitative surveys have been conducted regarding online behavior and privacy expectations ­– such as EU kids online and the EU-funded CONSENT project ­– but rarely supplemented by more qualitative studies. Outside North America, there are limited studies that address users' privacy perceptions and strategies from a qualitative perspective, despite the growing empirical as well as theoretical importance of understanding these practices.

Online privacy and youth

In the literature on youth, privacy and social media, at least two conflicting perspectives on privacy are frequently presented. On the one hand, those arguing that the age of privacy is over and that youth prioritize convenience over privacy, framed as the 'privacy paradox'. On the other hand those that argue that youth do care, however, they balance opportunities and risks in their use of social media sites, which creates a 'privacy dilemma'. Utz and Kramer confirmed Tufekci's findings that users balance the costs and benefits of disclosure and privacy. In line with Bechmann, they argue for the importance of social norms in users' decision-making processes. For example, if a user's friends are more privacy aware, then that user generally is as well. Moreover, their findings suggest that concern about privacy is directly linked to stricter privacy controls, pointing towards education and awareness raising as crucial elements in shaping privacy behaviors. In the Danish survey "Teens' private and public lives on social media" released in February 2013, seven months prior to the study discussed in this paper, only 16 percent of the teens interviewed did not find it important if what they share on social media was seen beyond the circles of their friends, while 51 percent claimed that it was crucial that they retained control over whom has access to their information. Similarly, the Pew Research Center's survey report "Teens, social media and privacy" from 2013 concluded: "What emerges is a portrait of teens who engage in a range of behaviors to manage the boundaries of their 'social privacy' online. Far from being privacy indifferent, these youth are mindful about what they post". Scholars such as boyd have illustrated the complex nature of privacy as it plays out on social media platforms, arguing that teens' understanding of privacy is related to their ability to control a social situation rather than to particular properties of information. In their empirical studies, boyd and Marvick found that young people develop complex social strategies to maintain privacy on social media platforms.

Thus, if we are to argue that the practices of young people serve as an indicator of what the future might hold, findings such as these may equally serve as tools to help interpreting the right to privacy in an online context. Previous studies as well as the Danish study presented below suggest that privacy is not a decreased social norm with little contemporary significance. On the contrary, these studies of young people's practices on social media platforms illustrate the emergence of a new privacy norm that corresponds to the structural conditions of online social life. Thus, as a priority it does not draw its typology from "private" or "public" space, but leans more towards discourses of personal empowerment and control.

Privacy as a policy topic

Whereas online privacy has been debated for years, recent developments such as the Snowden revelations and growing privacy challenges related to big data have taken the debate to a new level of international policy awareness. Examples of this increased policy focus include the adoption of the first U.N. General Assembly Resolution on The Right to Privacy in the Digital Age; the on-going reform of the EU data protection regime; and the growing attention towards the privacy impact of technology companies inspired by ­– among others ­– the U.N. "Guiding principles on business and human rights".

These policy discourses are inherently part of and influenced by social structures as stressed by critical discourse analysis that rejects the possibility of a value-free society and rather than denying such relations plead to study their formation. As argued by Jørgensen, Internet-related policy-making draw upon different metaphors and conceptual framings of public and private, rendering some policy choices more obvious than others. For example, it makes a difference whether a social network site is framed primarily as a commercial service; or as a public platform that is part of the public sphere/public discourse. In the first case the company would usually be given a wider margin in defining their service even when this includes certain limitations on rights and freedoms, for example, limits on the type of expressions allowed within the platform. In contrast, if the social network site is framed primarily as a platform for public discourse it seems less obvious to allow for a more restricted version of freedom of expressions, compared to other public spaces. The ambiguity as to the framing of major Internet companies is illustrated by the recent ruling on Google Spain SL concerning the company's obligations vis-`-vis online privacy. In the ruling, the court stated that Google is responsible for the processing of its users personal data, including data which appears on third-party Web sites. In consequence, the company might in certain cases be requested to de-index links to Web sites containing personal data. Whereas many privacy advocates have welcomed the decision as a step towards a "right to be forgotten" on the Internet, concern has also been raised that this places Google in a situation where they might be intrigued to restrict the general access to information on the Internet, with negative impact on freedom of information. The case is illustrative of some of the current challenges related to the role and duties of the private companies that control public infrastructure and public life on the Internet. The case also reiterates how discourse defines and confines the right to privacy, thus in order to adequately address online privacy as a policy topic, it is crucial to understand not only the practices and strategies that users deploy but also to critically address the policy framing of the social media platforms that facilitate online public life.

Online public life

In the twenty-first century, electronic media have effected a gradual reorganization of our social spaces and places. The invention and popularization of the World Wide Web in the 1990s further contributed to the transformation of the structural conditions of public life and the private life of the individual. The result is the emergence of new actors, a redistribution of roles and responsibilities and new types of power relations in an increasingly global public sphere.

'Public' and 'private' have served as meta categories in Western academic discourse, legal practice, and policy debates since classical antiquity. The distinction may be used to describe a boundary between the private world of intimacy and the public world of sociability, or the public (visible, open for all) character of processes as opposed to private processes (closed, limited entry), or particular interests (economic or individual) as different from general (public) interest. The public/private dichotomy has been subject to criticism, including whether the distinction is in fact meaningful. It has also been suggested to include a third category, 'the social', or a 'third place'.

Scholars such as Jacobs, Sennett, Elias, and Oldenburg have presented the public as a diverse complex of encounters in the public spaces of streets, parks, neighbourhoods, and cafes, and its ability to encourage public life is closely related to how these zones facilitate the flow of everyday movement and activity. The notion of public is thus linked to sociability, which may be both intentional and non-intentional, and to the spatial organization of social life. Public spaces have many purposes in social life. They allow people to make sense of the social norms that regulate society, they let people learn to express themselves and learn from the reactions of others, and they let people make certain acts or expressions 'real' by having witnesses acknowledge them. Online public spaces differ from physical public spaces by being mediated, searchable, and potentially global. Further, the interaction may be recorded or copied and there may be invisible audiences or audiences who were not present at the time of the conversation. In the Danish study presented below, online social media is referred to as a semi-public space. As such it represents a space, which is in principle open to everyone, yet at the same time owned and controlled by a private company and governed by their terms of service. These terms of service define the boundaries for privacy within the platform and turn a seemingly public space into de jure private places.

The Danish focus group study "Teens' private and public lives on social media": Methodology

Strategies to control privacy and identity

One of the purposes of the Danish study was to understand in more detail the strategies that youth deploy to protect or control privacy. In all of the 11 focus groups the respondents were very aware of the way in which they represent themselves to their friends and family as well as reflective of the methods they use to control images and content. All in all, controlling one's self-representation on social profiles seemed to be a very conscious effort. There was a reflective awareness of what is respectively good and bad behavior in relation to sharing images and information with and about others. Among the interviewed, there were for example clear limits to what one shares on Facebook. Some of the mentioned examples of what not to share included very emotional status updates about personal matters – parents' divorce, break up with girlfriends and boyfriends, etc.

The respondents all used the "privacy tools" provided for them on the social media platform, for example, to create groups and to control their timelines. Moreover, they were consciously aware of the limits of these tools: "And if there are some embarrassing pictures from some parties then I usually make them invisible to all, for example if someone tags a picture of me at a party where there has been an embarrassing situation. Then you can make it 'not allowed on timeline'. But I can't delete the picture" (boy, 16 years old).

Many of the respondents' activities on Facebook took place in thematic groups created for specific purposes and for invitees only. The groups usually reflected already established social contexts such as the school class, the girls in the class, the football team, etc. In addition to the privacy management tools available, the respondents relied on commonly shared social norms to manage their privacy. These social norms were constantly in play and frequently emphasized by the respondents. The respondents were particularly reflective about the use of images and photos. For example, many of the respondents described a "filtering" process that all pictures went through either before they were posted or just after they were posted. Again, some pictures would not even make it to the Facebook Timeline as they were deemed "not suitable for Facebook". Others would be deleted just after being posted if deemed unfit based by comments. As one 17-year-old girl put it: "But you also look at the picture yourself one more time and think if you would like it yourself to have it posted. I rarely think about it. There are also pictures that are taken to look ugly just for fun. But in that case it doesn't even cross my mind to post it on Facebook. That is just not Facebook material". The "image filtering process" was by several of the respondents described as the result of "common sense", but when asked in more details about what this "common sense" implied, they found it difficult to explain. Still, the implicitly shared social norms for the use of pictures created an expectation among the respondents that they might control their privacy by shared norms on how to respond to specific types of behavior: "It is also a sort of unwritten rule that if you hint that something needs to be deleted. Then you delete the picture. You can write "Yieks!" or "ehr". Or just "delete". Then it should be deleted within 1 minute. I mean, you see it immediately on your mobile and then you can write. Then it will be deleted quite quickly" (girl, 17 years old).

When asked about privacy on social media, the respondents mostly related it to privacy from parents and teachers' prying eyes and involvement. One simple way to protect their privacy and be able to experiment without having to be accountable to their parents was to defer to be friends with them (often they deleted their parents from friends lists without their parents' knowledge). Moreover, some of the respondents who were in fact friends with their parents expressed a need to articulate and establish explicit rules. For example, a 17-year-old boy noted: "I told them that they should not be the first to 'like'. And they cannot post anything on my wall. I kind of have an 'embarrassment code' with my parents".

The role of social media in everyday life

The study aimed to understand the role that online media play in the lives of young people via a cluster of questions related to the respondents perceptions and use of social media. The interviewed portrayed social media (Facebook in particular) as the central platform to communicate with friends and to keep up with social and school activities. They depicted themselves as "always on" via their smart phone, and described social media as an integral part of their lives. Thus, social media acted as the infrastructure of young people's everyday lives used for several purposes from entertainment, maintenance of social networks to 'staying updated' on social events in the network. Moreover, general 'social information' search and relationships with other people were also reinforced and confirmed via social media. For example, as explained by several respondents you are not truly a couple until it has been announced on Facebook. The respondents highlighted the personal investment which their social media profiles represent, and pictured their Facebook profile as an extension of themselves. As one 17-year-old boy described it, when picturing the scenario that Facebook one day would close down: "... it is kind of like you have invested so much time in it and so much focus on how you present yourself. And this is your friends. So it's kind of like a project. It's part of you. So it's a bit like not being able to talk. It's a tool of communication which is very integrated in you". But perhaps most importantly the respondents view their social media profiles as an integrated part of their identity: "One's life is not just pictured on Facebook. It is Facebook". (boy, 17 years old)

The respondents mentioned Facebook, Instagram, Twitter, and Snapchat as widely used social media services, with Facebook as the key platform from which virtually all communication originates. All of the interviewed had a profile on Facebook and shared a common expectation of being reachable via Facebook: "It is kind of expected that everyone has a Facebook profile. That you can communicate with everyone there. You kind of expect that" (girl, 17 years old). For the respondents, Facebook had become the primary channel of social information and the most utilized way to organize and spread information. Thus, if you want to participate socially you need to be on Facebook: "There is a party at the school tomorrow. It might be announced on the school's website, but no one has checked it out there. Everyone is invited for an event on Facebook. So it's also used for practical information. For example that tickets can be bought on a website. And that is not mentioned on the school's website" (boy, 17 years old). It was also stressed that Facebook has taken over much of the communication that was previously exchanged via text messaging (SMS): "... if I want to contact a friend I don't use SMS anymore. You kind of expect that everyone has Facebook ... this is why I actually only use SMS to communicate with my parents. Because I'm not friends with them on Facebook" (boy, 16 years old).

Level of knowledge

The final theme of the focus group study focused on the respondents' level of knowledge and assessment of risks regarding privacy issues such as surveillance and commercial use of their data. The respondents were asked to reflect on these themes via concrete examples related to their use of – and opinions about – social media. While the respondents were very reflective and aware of the way in which they present themselves and protect their privacy with regard to their close relations, it was much more difficult for them to reflect on institutional privacy, for example, commercial use of data, data mining and surveillance.

When asked specifically about user consent, unsurprisingly, none of the interviewed had read the terms and conditions they had consented to, and most had created their profiles at a time when they were relatively young (usually under 13). "You have heard that you probably should read those terms and conditions, because we do not know our rights. But we were very young when we created it. And then we just clicked yes" (girl, 17 years old). The social value of using social media was perceived as significantly larger than the risks of potential privacy abuse. The general opinion amongst the interviewed was that if you want to use social media you need to accept the conditions which includes giving up some of the rights to your content. "I guess it doesn't matter to read it (terms and conditions) because if you want a profile then you need to accept them. It doesn't matter what it says" (boy, 16 years old).

In general, the respondents had limited knowledge about how their information and pictures might be used commercially and showed little concern on the future use of their personal data. Some did talk about personal experiences discovering that one of their images have been used by others to create fake profiles or remembered to have been puzzled over where and how other people had found out information about them. But generally the respondents found it hard to imagine that their personal data would be of interest to anyone. When asked specifically about "surveillance" many of the respondents reflected on governmental access to social media. But frequently "surveillance" was described as something remote that would take place in 'totalitarian states' far away. "I feel it's not a problem (ed. state surveillance). It's unpleasant when I think about it. But then I just want to look at Facebook again and then it does not matter" (girl, 16 years old). In cases where the respondents were asked to think further about potential state surveillance, it was described as in principle 'not okay', 'uncanny' and 'uncomfortable': "... Just the thought is indeed uncanny. If the state monitors you personally. They do not have the right to do that and they shouldn't have the right either" (boy, 17 years old). "It's a scary thought. But this only takes place in totalitarian places. But then again for instance in the United States right now where we have the NSA with Edward Snowden and all that. Where they spy on different people through social media and Google. It's not a very comforting thought" (girl, 16 years old).

In summary, in line with previous studies the respondents were very conscious about protecting their image/self-representation and flow of information amongst their peers, friends and family, whereas potential privacy risks related to the state or to private companies received limited attention. One 16-year-old girl, for example, remarked "Maybe my messages are subject to surveillance, but what can they use it for? You decide for yourself, what to share" (girl, 16 years old). The quote is indicative of a sentiment that many of the interviewed shared, namely that you exercise privacy control by decisions on what to share on Facebook and what not, yet once information is "out there", your ability to exercise control vis-`-vis Facebook is limited, whereas some social control remain. The expectation of (some) control over their social privacy was exemplified by various social norms and strategies whereby the interviewed regulated information and not least photo sharing amongst their group of peers. Generally, the respondents had limited knowledge of privacy and data protection as legal rights that the individual might claim towards the state or a private company. On the contrary the interviewed expressed that by joining Facebook, you sign away your rights, especially related to photos. More importantly, several of the interviewed expressed that in reality you have no choice but to accept Facebook's terms of use.

Conclusion: Privacy as a social norm in a new form

At the turn of the last century 'time' was pronounced dead. Modernist artists and authors challenged the rigid factory clock time of society as unnatural to the fluid time of the individual, and scientists and philosophers challenged its Newtonian constitution with relativist theories. Particularly, the evolution of the network society and the consequent structural reorganization of time and space posed a fundamental question about the constitution of 'time'. Although not based on a scientific paradigm, "privacy" is to the young people in this study – as well as previous studies – a "clock". Privacy is a very real and practical navigation tool based on socially negotiated and agreed upon principles of organization. One might argue that what happened to our conception of time in the last century is happening to our notions of "privacy" in this century. The friction between evolving online social practices and traditional discourses concerning the private and the public as two isolated and separated spheres, have developed into a fundamental critique of privacy as a constraint on online self expression and digital media innovation. Naturally, if we describe privacy as a specific type of space or place within the public sphere, it can only be defined as, on the one hand, "constraining" or, on the other hand, "liberating," depending on the specific stakeholder or interest. However, if we view privacy as a fundamental organizing principle for an individual to navigate in society, it will also provide an opportunity to evolve. One of the contributions of poststructuralist and postmodernist accounts of the self and social formation is the way in which social and cultural constructs alter reality. Perhaps even more central is social sciences' focus on discerning specific "principles of organization" in social systems that on the surface might appear disorganized and chaotic. To understand privacy as an evolving concept is essential to the public policy debate on privacy and data protection in the digital age, including emerging principles of organization for online social practices. A contemporary "translation" of privacy norms does not reject privacy as a fundamental human right, but underpins the freedom to rethink and translate the concept into a digital context. Time obviously never died and neither will privacy. These fundamental concepts, used as navigators to organize individual lives in society, have just evolved.

In this article, we have argued for a reformulation of "online privacy" in the global policy debate based on an evolving definition of the concept. The practices of young people on online social media platforms were used as indicators for future user behavior, thereby building a case for utilizing these and other results to inform policy-making processes. The focus group study revealed that privacy and identity management is a strong social norm for some young people, which they manage via a number of social strategies as well as technical tools. This study highlighted a core challenge to a sense of control for young people over their privacy. This challenge presented itself as a fundamental dilemma embedded in the core structure of their everyday social spaces. The respondents' sense of control over personal data was related to their pre-posting decisions (e.g., what to publish, with whom to share, etc.), creation of groups, etc. yet once data was "out there" they experienced limited control over their data and had no sense of themselves as privacy rights holders. In other words, signing off privacy rights to the social network site was seen as a necessary price to be paid in order to participate.

This study prompts a number of questions that would benefit from further exploration of future models for online privacy.

Firstly, it is often presumed that users of online social media, in particular young people, voluntarily share data. However, the respondents in this study envisioned two types of "privacy". They share data about themselves voluntarily in social circles with a view to their "social privacy" (identity and social network management), but "data sharing" with unknown entities: the "repurposing" of their data (data mining, commercial use) is perceived as a precondition for social participation and can therefore not be designated as a voluntary act. How can we reframe our conversation about "online privacy" in a way that recognizes both the individual's right to social privacy among peers and the individual's right to privacy in relation to their interaction with unknown entities?

Secondly, public life on the Internet is largely facilitated by corporations driven by commercial interests. There is a need to critically assess this development's implications for individual right to privacy. Young people in this study perceive commercial social media platforms as a primary public and social infrastructure. Yet, they at the same time acknowledge these platforms as private businesses and therefore accept that they can create terms of use that include the use of their data. As described, it makes a difference whether a social network site is framed primarily as a commercial service, or as a public platform that is part of the public sphere. Young people in this study sign off on privacy rights due to a specific framing, while their actual use of the platforms address a different type of framing. How can we reframe the conversation in public policy-making processes about the social media platforms in a way that acknowledges the role of these businesses in the development of our public infrastructures?

Finally, the primary model for social media use is a "consent model" where users agree to general terms and conditions that may include a reuse of personal data. Studies of user perceptions, knowledge and behavior, as presented in this article, illustrate how the structural conditions in which practices evolve, define and confine their sense of empowerment and control and thus the very implementation of their right to privacy. Participants in this study had very limited knowledge about the repurposing of their data. They did not exhibit any evidence that they understood how they could control the use of their personal information. Thus, we might pose a final question to policy-makers. How can we help frame the development of online business models that, as a priority, advance the structural conditions for personal control and empowerment of the user?