Privacy in Online Social Networks: Theory and Practice

Abstract

At the heart of online social networks (OSNs) lies a fundamental tension between user welfare and business profitability. Despite outwardly expressing a commitment to user safety, OSNs continue to grapple with persistent privacy leakages that threaten to disrupt people’s lives in catastrophic ways and bely their professed dedication to putting users first. The inability of privacy laws to adequately prevent violations motivates us to take an ethical lens to the data practices of social networks. Under the framework of contextual integrity, we prove that current data practices fall short of ethical standards because they undermine user interests for profit-oriented goals. It is necessary to appropriately recalibrate current practices to social values and user needs. We first attempt to find a more conservative solution that would preserve the underlying structures of OSN business models. Current protections involve de-identifying user data (removing personal identifiers), but researchers have shown that de-identified data is susceptible to privacy attacks. We employ a local differential privacy model to directly privatize user survey data with the Gaussian mechanism and randomized response. We found that when the underlying population is normally distributed and follows the probit model, we can recover the original non-private probit regression techniques by conditioning on the observed noisy data. However, our method produces an inconsistent maximum likelihood estimator, suggesting that direct perturbation of data might be incompatible with prediction utility. We then analyze the normative implications of the privacy-utility tradeoff and argue that it continues to allow profitability to be prioritized over social values and quality. Thus, differential privacy is not a sufficient guarantee of privacy in the context of OSNs. We advocate for a reimagined relationship between users and OSNs, emphasizing the need for enhanced transparency, accountability, and user-centric data practices.