The subject of social networking has come up several times on this blog. I have talked about how many researchers consider social networking to be one of the more vulnerable areas on the internet today (from a security perspective). I have also talked about some privacy concerns that affect social networking.

Today, I am going to cover a very interesting piece of research that was prepared by Joseph Bonneau and Sören Preibusch from the Computer Laboratory at the University of Cambridge. Entitled, "The Privacy Jungle: On the Market for Data Protection in Social Networks", this research took a sample of 45 social networking sites and analyzed each from a privacy perspective. This paper is relatively short and extraordinarily easy to read, so I suggest that you read the entire paper if you are interested in social networking and privacy.

However, I would like to discuss a few of the more interesting conclusions that the researchers reached. First, they found a marked positive relationship between the age of a social networking platform and its devotion to privacy. Essentially, as a site ages, it does a much better job of protecting its users' privacy. This could be due to several factors. For example, as a site ages, it (hopefully) starts to earn more revenue. More revenue means that they have more money to spend on better privacy policies and staff to devote themselves to user privacy. This could also be because as a site ages, its number of users (and public profile) increases. And, as its profile increases, media pressure also increases. Consider the Privacy Commissioner of Canada's recent findings against Facebook - would the Privacy Commissioner have devoted those resources if Facebook only had 100,000 users? And would the media have reported on these findings if nobody knew who Facebook was?

They also reported on something that followers of social networking have noticed for years. Social networking sites tend to hide their privacy policies behind obscure, legal jargon. However, Bonneau and Preibusch proposed an interesting reason behind this lack of accessible information. In their mind, this all has to do with something they call 'the privacy communication game'.

Without going into too much detail, the privacy communication game is a complex set of compromises that site owners must make to please different people with different views of the importance of privacy. People who do not care that much about privacy tend to get a little bit scared if a sign-up process contains too much information on their privacy. In this regard, it seems like they are concerned about privacy, it is just that privacy is not a front of mind concern. And, those who care deeply about privacy will read privacy policies and complain (loudly) if certain clauses are against what they believe in. Consequently, site operators have to 'hide' privacy policies to avoid spooking those who are not terribly concerned, and they have to 'hide' certain clauses behind difficult language to minimize the chances that others will complain about perceived violations!

All in all, Bonneau and Preibusch found that social networking sites as a whole fail to provide adequate privacy control. However, they made a few recommendations that could help protect the legions of people who are interested in social networking. For example, they suggest that legislation might be required to help the social networking/privacy markets function properly. They also suggest that sites adopt a standardized set of policy labels - similar to those that are attached to movies. A standardized set of labels would help users instantly recognize that 'Site A' is significantly more concerned with their privacy than 'Site B'. Finally, they also recommend that sites do what they can to increase awareness of the privacy pitfalls that social networking contains. They suggest web based interfaces that will show users what information a site collects and what it is used for.