I’ve put online my latest draft, Facebook and the Social Dynamics of Privacy. It’s a comprehensive look at the shabby state of privacy on Facebook, and it’s been my main project this summer. My take is that it’s unfair to blame Facebook’s privacy woes entirely on Facebook; some of the privacy trouble is inherent in the very nature of social networking. The kinds of socializing that take place on Facebook—creating identities, relationships, and communities—intrinsically require people to reveal sensitive information about themselves.

Thus, I argue, law can help people understand some the risks, and it can protect them from truly unfair surprises, but it can’t make social network sites completely safe from a privacy perspective, and it shouldn’t try. The only way to make Facebook perfectly private would be to unplug its servers and drop them in the Mariana Trench. People want to socialize, and legal policy doesn’t recognize that fact will merely divert them into socializing in even riskier ways.

Here’s the abstract:

This Article provides the first comprehensive analysis of the law and policy of privacy on social network sites, using Facebook as its principal example. It explains how Facebook users socialize on the site, why they misunderstand the risks involved, and how their privacy suffers as a result. Facebook offers a socially compelling platform that also facilitates peer-to-peer privacy violations: users harming each others’ privacy interests. These two facts are inextricably linked; people use Facebook with the goal of sharing some information about themselves. Policymakers cannot make Facebook completely safe, but they can help people use it safely.

The Article makes this case by presenting a rich, factually grounded description of the social dynamics of privacy on Facebook. It then uses that description to evaluate a dozen possible policy interventions. Unhelpful interventions—such as mandatory data portability and bans on underage use—fail because they also fail to engage with key aspects of how and why people use social network sites. The potentially helpful interventions, on the other hand—such as a strengthened public-disclosure tort and a right to opt out completely—succeed because they do engage with these social dynamics.

Livejournal has, throughout its existence, wrestled with the idea of the “Everyone except you” or “Only cool people” security level. People really, really want to be able to hide their personal information from a few others close to them (let’s say, their parents, or their exes) while still having it be basically public. The fact that that’s impossible on its face, doesn’t stop the flow of demands for it nor the assumption that it already exists. I’ve written a bit (http://ansuz.sooke.bc.ca/economics/social-networking/run-a-conspiracy.php, http://ansuz.sooke.bc.ca/economics/social-networking/run-a-drama.php) on technical ways to address the issue, but of course they can’t really solve the underlying human issue.

A note on page 6: you talk about “Networks” being central to Facebook. That was true, but Facebook seems to be phasing out Networks at the moment, possibly as part of its attempts to compete with Myspace, and that may be worth mentioning. Networks have less access-control significance on Facebook now than they used to; you have more ability to join multiple networks than before and there are fewer restrictions on who can join each network; and it looks like the goal is for them to eventually have no more significance than “Groups.”

I notice that you refer to “danah boyd” consistently as such, without capitalization. That’s something I don’t think I would do in formal writing, even if I knew the person involved preferred it.

I pretty much had to stop trying to keep up with changes to Facebook as I wrote the paper, or it would have been like Achilles and the tortoise. I’ll do a round of comprehensive updating at some point in the publication cycle, but I realized I’d go crazy trying to stay on top of things in real time. I used to have an appendix that listed all of Facebook’s profile and privacy settings, which I threw out when I realized it had become incomplete within a week of when I wrote it.

As for the capitalization, that’s how her legal name is capitalized. I don’t know that I agree with her reasons for it, but it would be disrespectful not to use her preferred capitalization. And I’ve got my own precedent on my side; it was lowercase in my search engine piece from last year. (See footnote 80.)

Typo:

Cars don�t ghost ride the whip; cars people ghost ride the whip.

Great line though! (And the article looks great too, but I’m not done reading it.)