This document discusses online privacy and the shift from opt-out to opt-in models of consent for information sharing. It notes that services like Facebook have increasingly moved to opt-out defaults that force users to accept more information sharing. However, the research project CUPID demonstrates that privacy-friendly personalization is possible using an opt-in approach consistent with European data protection principles. Overall, the document argues that opt-in models can enhance user empowerment and control over personal information compared to opt-out approaches used by many current online platforms and services.

1. Online information revelation
and privacy. Moving from opt-
out to opt-in?
19 July 2010, IAMCR, Braga, Portugal
Chris Vleugels, Griet Verhenneman, Stijn Bannier

2. Web 3.0 has arrived
• User-generated and machine-generated content
• Personalised information & recommendations
Opportunity for efficiency but threat to privacy?
• Cases: Facebook’s privacy policy vs. Flemish research
project CUPID

3. Online information revelation and privacy.
Moving from opt-in to opt-out?
• Interdisciplinary
research project in
cooperation with
industry and academics
• Supported by IBBT
• Seeks innovative
solutions to aggregate,
categorize, personalize
and distribute enriched
cultural information

4. The concept of privacy

5. Is the end of privacy near?
"The age of privacy is over”
Zuckerberg (Facebook)

6. Is the end of privacy near?
“You already have zero privacy, get over it”
McNealy (Sun Microsystems)

7. Is the end of privacy near?
“It is just as difficult to live in a self-made hell of
privacy as it is to live in a self made hell of
publicity”
Micheal Hutchence (INXS)

8. Is the end of privacy near?
“Privacy is not hiding behind screens when we
do something naughty or embarrassing, privacy
is intrinsic to liberty”
Scheinder (security technologist)

9. Is the end of privacy near?
“Privacy is not something I’m merely entitled to,
it’s a prerequisite”
Marlon Brando (actor)

10. Is the end of privacy near?
“It was said of me that I suffered from an
Obsessional Privacy.
I can only suppose it must be true”
Dirk Bogarde (actor and author)

11. Facebook’s evolving privacy policy
• Main idea: connecting people
• With friends
• With interests
• Promise privacy of the user at the center
• Default setting: strictly limited to approved friends
• However throughout the years
• FB Beacon, FB Connect, Transition tool, Open Graph
• => Forcing users to accept opt-out services

12. Facebook’s evolving default privacy settings

13. Reactions on Facebook
Pages
Groups

14. Reactions on Facebook
Petition
Tools
All these initiatives represent a small minority of the FB community
Initiators are not the average Facebook users, but privacy
organisations

15. Other indicators
Quit Facebook Day 31/05
Figures revealed by Facebook
A third of Facebook users customized their
privacy settings after the policy changes in
December 2009 (transition tool)
More open, closed or no change at all?

16. Alive or not, but still protected
“I am surprised by this sudden change of policy. I can’t
understand that, because it is in the interest of social network
sites to give users control of their privacy”
Vivianne Reding
“It is unacceptable that the company [facebook nvdr.]
fundamentally changed the default settings to the detriment of
the user”
Article 29 Working Party

17. Alive or not, but still protected
Europe guarantees protection of personal data through the Data
Protection Directive (46/95 EC)
Social Network Sites do process personal data
• Personal = relating to identified or identifiable natural persons
• Processing = any operation or set of operations performed upon personal data
The Data Protection Directive is based on 4 principles:
• Proportionality
• Finality
• Transparancy
• Legitimacy

18. Data Protection Principles
Proportionality and Finality:
need to know NOT nice to know
✗ No one can collect data for the purpose of
collecting

19. Data Protection Principles
Transparancy:
Fair processing THROUGH a guaranteed minimum level of
information
✗ Unaware users are
vulnerable users

20. Data Protection Principles
Legality:
processing after NOT before user consent
✗Consent = opt-in ≠ opt-out

21. Moving from opt-out to opt-in
• A user-centered privacy approach
• In control & ability to tweak
• Transparent recommendation engine
• Gives a justification of the recommendations and profile
use and creates greater commitment
• Leads to knowledge, trust and involvement with complex
data flows
• CUPID’s cultural profile as a personal tool to structure an
experienced abundance of event information

22. To conclude: Trading of privacy for
personalisation?
• Facebook’s opt-out model guarantees the largest
possible database … as it is a profit-organisation
• CUPID shows that privacy-friendly personalization
services and social networks compliant with European
Data Protection principles are possible and may be
appreciated
• In a user-driven and participatory media environment
consumer awareness, media literacy and self-protection
are important in order to exercise power
• Opt-in can further enhance users’ power
• Allow changes to settings after consenting!

23. Thanks for listening!
Chris.Vleugels@vub.ac.be
Griet.Verhenneman@law.kuleuven.be
Stijn.Bannier@vub.ac.be