Why all the fuss about privacy and privacy policies?

In our recent podcast we talked about why individuals need more power when it comes to privacy policies, and why data protection regulation has a long way to go before we get to an acceptable level of transparency.

But why does all of this matter? If people don't read privacy policies, isn't it because they don't really care? There's some truth in that, but...

Personal data = POWER

People might care more about their online privacy if the full power of online service providers, especially social media apps like Facebook, were more obvious to us as ordinary internet users. I'm going to focus on Facebook here.

We generally don’t feel like we are giving up much power by allowing collection and analysis of our personal data in exchange for access to a social network that we value. Certainly, we tend not to register the fact that we are giving Facebook enormous power to influence us on the deepest level, simply by using it in an ordinary way.

Very few people are conscious of just how much data Facebook and like organisations hold about them, or how powerful the insights derived from data aggregation and analysis can be. Some organisations hold thousands of data points about individuals, from age and marital status, to hair and eye colour, address, credit card details, and consumption habits.

It doesn’t take much data to work out very sensitive things about you

One study showed that, using only Facebook ‘likes’, it’s possible to automatically and accurately predict a range of highly sensitive personal attributes including: sexual orientation, ethnicity, religious and political views, personality traits, intelligence, happiness, use of addictive substances, parental separation, age, and gender.

But Facebook isn't just analysing likes. Facebook's algorithms analyse every action by every user as a signal, cross-reference it against the actions of millions of other users, and feed everything back into the system. They literally know more about you than you know about yourself.

Another study showed that Facebook was able to influence users’ emotions by changing the contents of their newsfeeds.

It's not hard to imagine how data analysis and emotional manipulation might be combined.

Jedi mind tricks?

Say you’re a person who eats chocolate when you’re sad. This is probably a pretty easy correlation to work out, given the masses of data Facebook has about you and millions (billions?) of people whose 'signals' closely match yours.

This information is worth buying, and Facebook makes a lot of money by selling it.

If a chocolate maker knows there’s a correlation between how low you (or people like you) feel, and how much chocolate you buy, they can target their online advertising with this in mind. They can work out exactly when you’re sad, and advertise chocolate when you’re at your bluest.

It’s no great leap to then imagine chocolatiers doing deals with Facebook to (1) find out what makes you sad and then (2) arrange your newsfeed to make you sad and then (3) show a link for buying chocolate at the optimal point in your feed. And that’s a relatively harmless example.

The targeting of more dangerous, addictive products and services like alcohol and gambling hardly bears thinking about.

We see a similar picture with political organisations. The recent spotlight on Cambridge Analytica has shown how political organisations with access to data aggregation and analysis from social networks can tailor political messages individually, knowing exactly what is likely to push the individual target’s buttons.

How do we shield our minds?

Better awareness of how we're being watched and manipulated is crucial. It is not, however, a solution by itself.

Awareness alone does not translate into actual individual power and agency to change things. Protecting your privacy takes time and work. One study gave a point estimate of 244 hours per person per year to read all privacy policies relevant to that person’s internet use. That time cost is prohibitive. People who are serious about privacy can delete their social media accounts, but that comes with a ‘punishing network effect’. You lose contact with many people for whom Facebook is the main way of keeping in touch. Otherwise, it’s head in the sand.

All in all, pretty troubling, but I’m optimistic we can gradually re-empower people with the right technology and tools. We're at a point where it's worth trying crazy ideas about privacy.

Our new and improved version of Codepact, called Treescribe, is now available in beta!