Social Media And Privacy Laws: A Complex Relationship

Social media has become an integral part of our lives, with millions or billions of users on major platforms like Facebook, Instagram, and TikTok. However, the very nature of social media, which encourages users to share their lives with the world, poses significant privacy concerns. While social media platforms have privacy settings, they are not foolproof, and users often unknowingly share sensitive data that can be exploited by companies, scammers, and even law enforcement agencies. This data includes personal details, location information, online behaviour, and more.

The issue is further compounded by the lack of comprehensive privacy laws specifically addressing social media. While certain federal laws in the US, such as the Communications Decency Act and the Children's Online Privacy Protection Act, touch on social media privacy, they are not comprehensive. State laws have had varying levels of success in enforcing privacy policies, and social media companies' vague policies and loopholes make it challenging to hold them accountable.

As a result, users' personal information is vulnerable to data breaches, identity theft, privacy violations, and behavioural advertising, where companies use personal data to target users with advertisements.

Privacy laws and social media companies' data collection practices

Social media platforms have become powerful tools for connecting and sharing content, with millions or billions of users on major social networks. However, the extraordinary growth of social media has given platforms extraordinary access to the lives of users. Social media companies collect and exploit vast amounts of personal data, including sensitive information about individuals' activities, interests, personal characteristics, political views, purchasing habits, and online behaviours. This data is used to algorithmically drive user engagement and sell behavioural advertising.

The privacy hazards of social networks are compounded by platform consolidation, which has enabled some social media companies to acquire competitors and severely limit the rise of privacy-protective alternatives. Personal data held by social media platforms is also vulnerable to being accessed and misused by third parties, including law enforcement agencies.

Data Collection Practices

Social media companies directly ask for personal user information during the sign-up process, including full name, email address, phone number, location, date of birth, and more. Beyond this self-reported data, a lot of information is gathered indirectly through user activity online. Web tracking tools like cookies, pixels, and APIs monitor behaviours such as posts liked, content shared, pages visited, and search habits. Social media apps also leverage the smartphone's sensors, calendar, contacts list, and metadata to understand usage patterns.

Intricate social graphs are constructed through connections and interactions among users. The activities of a user's network provide additional data points for profiling. Comments, tags, and messages can give insights about relationships, preferences, and offline interactions. Face recognition algorithms applied to photos and videos also power data collection.

Privacy Laws and Social Media

There are a few federal laws that touch on social media privacy concerns, including the Communications Decency Act (CDA) and The Children's Online Privacy Protection Act (COPPA). However, no comprehensive national social media privacy laws exist yet. Regulatory agencies, such as the Federal Trade Commission (FTC), intend to expand protections due to new artificial intelligence (AI) cybersecurity concerns.

At the state level, some states have taken measures to protect social media privacy, including California, Virginia, Colorado, and Texas. These laws include requiring companies to put data security measures in place, setting liability and criminal punishment for hacking, and mandating companies to notify users about data breaches.

In terms of foreign data privacy laws, the European Union's General Data Protection Regulation (GDPR) serves as a modern standard for consumer privacy. It applies to any company that handles personal data of EU residents and allows individuals and corporations to request the deletion of their information from internet sites. While it does not protect U.S. residents directly, it has influenced how companies that operate internationally treat user data.

Privacy settings loopholes

Privacy settings on social media platforms are not always as secure as users think. For example, if a user shares a post with a friend and that friend reposts it, the original user's information could be exposed to a completely different audience. Even closed groups may not be entirely private, as postings can be searchable, including any comments.

In-network privacy features allow users to restrict access to their information by other users, but they do not prevent third parties from accessing personal data. Social media companies can change their policies and features, and these changes can sometimes cause serious data privacy issues. For instance, posts shared privately with friends or in private groups can sometimes be shared publicly without the user's permission. If a user's friends do not follow the same strict privacy settings, their information could be accessed by anyone, including scammers and employers.

Location settings on a device may still track a user's whereabouts, even if they are disabled. Public Wi-Fi, cellphone towers, and websites can be used to target a device's location.

Users should be aware that advertisers and scammers can gain access to sensitive data, even if their accounts are set to private. This includes profile information, status updates, location data, personal interests, shared content, and posts from friends and family.

Location settings and tracking

Social media apps often request permission to access a device's location services, ostensibly to provide personalized experiences or relevant information. While this can enhance the user experience, it also enables the creation of detailed profiles based on an individual's habits, preferences, and routines. This data is highly sensitive and can be exploited by malicious actors for stalking, identity theft, or other nefarious purposes. Additionally, aggregated location data can be sold to advertisers, who use it to target individuals with tailored advertisements without their explicit consent.

The constant monitoring of user locations by social media apps creates a digital footprint that can be used to build comprehensive profiles of individuals, potentially infringing upon their right to privacy. This data can be accessed and misused by third parties, including law enforcement agencies, advertisers, and malicious actors. As a result, users may unknowingly expose sensitive information about their whereabouts, routines, and personal preferences.

To protect their privacy, users should be cautious about enabling location services and granting permission to access their location data. They should review app permissions and disable location tracking when it is not essential. Adjusting privacy settings to limit location sharing and choosing to disable location sharing altogether can also help mitigate the risks associated with location tracking.

Location tracking on social media platforms has become an integral part of our daily lives. While it offers convenience and enhances user experiences, it also raises complex issues surrounding personal privacy. Users should be aware of the potential risks and take proactive steps to safeguard their location data and ensure their privacy.

Children's privacy on social media

Parents and caregivers can take steps to protect children's privacy online. These include limiting personal information in profiles, setting accounts to private, avoiding posting detailed public photos, and restricting who can connect with and follow the child. It is also important to review how data is shared with third parties and to restrict advertising.

In addition, it is crucial to monitor the child's device settings and enable parental controls to restrict access to certain sites and set time limits. However, it is important to remember that children can find ways around these controls, so open communication and a strong relationship with the child are vital.

Furthermore, children's privacy on social media is not just about external threats but also the potential violation of their privacy by parents or caregivers through "sharenting", or online sharing about parenting. This can shape a child's digital identity before they are old enough to understand the implications, and the information shared can follow them into adulthood. While parents have a right to free speech, this can conflict with a child's interest in privacy.

To address these concerns, some states have proposed or enacted laws that focus on parental consent for children's social media use and data collection. These laws aim to protect children's privacy and give parents more control over their children's online activity.

Workplace social media privacy

Social media privacy in the workplace is a complex issue that varies depending on the jurisdiction. Generally, there is no federal law preventing employers from asking employees or applicants for their social media usernames, passwords, or other private information. However, over half of the states in the US have enacted laws to protect employees and applicants from such requests. These laws often prohibit employers from gaining access to private social media information or content through various means, such as requesting login information or asking employees to access their personal social media in the employer's presence.

Some states explicitly mention that employers are not prohibited from viewing publicly available information about an employee or applicant online. Additionally, employers may have the right to request certain information if it is relevant to an investigation or if it pertains to compliance with specific laws, regulations, or prohibitions. For example, employers may need to ensure compliance with securities law, financial law, or investigate the unauthorized downloading of proprietary information. In these cases, employees and applicants are typically protected from retaliation for providing the requested information.

It is important to note that these laws and their enforcement vary by state. Some states enforce social media workplace privacy laws through their labor department or another state agency, while others allow employees and applicants to take civil action against the employer for violations. Penalties for violations can include civil penalties, damages, job reinstatement, and attorney's fees.

To protect their privacy, employees should be aware of the specific laws and regulations in their state regarding workplace social media privacy. Additionally, employers should develop comprehensive social media policies that comply with applicable laws to reduce the risk of legal disputes.

Frequently asked questions