Protecting Privacy On Social Media: Is Consumer Privacy Self-Management Sufficient?

Among the existing solutions for protecting privacy on social media, a popular doctrine is privacy self-management, which asks users to directly control the sharing of their information through privacy settings. While most existing research focuses on whether a user makes informed and rational decisions on privacy settings, we address a novel yet important question of whether these settings are indeed effective in practice. Specifically, we conduct an observational study on the effect of the most prominent privacy setting on Twitter, the protected mode. Our results show that, even after setting an account to protected, real-world account owners still have private information continuously disclosed, mostly through tweets posted by the owner's connections. This illustrates a fundamental limit of privacy self-management: its inability to control the peer-disclosure of privacy by an individual's friends.Our results also point to a potential remedy: A comparative study before vs after an account became protected shows a substantial decrease of peer-disclosure in posts where the other users proactively mention the protected user, but no significant change when the other users are reacting to the protected user's posts. In addition, peer-disclosure through explicit specification, such as the direct mentioning of a user's location, decreases sharply, but no significant change occurs for implicit inference, such as the disclosure of birthday through the date of a "happy birthday" message. The design implication here is that online social networks should provide support alerting users of potential peer-disclosure through implicit inference, especially when a user is reacting to the activities of a user in the protected mode.