A Survey on Interdependent Privacy <s> Technical Solutions <s> Recent years have seen a significant increase in the popularity of social networking services. These online services enable users to construct groups of contacts, referred to as friends, with which they can share digital content and communicate. This sharing is actively encouraged by the social networking services, with users’ privacy often seen as a secondary concern. In this paper we first propose a privacy-aware social networking service and then introduce a collaborative approach to authoring privacy policies for the service. In addressing user privacy, our approach takes into account the needs of all parties affected by the disclosure of information and digital content. <s> BIB001 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Online social networks (OSNs) have experienced tremendous growth in recent years and become a de facto portal for hundreds of millions of Internet users. These OSNs offer attractive means for digital social interactions and information sharing, but also raise a number of security and privacy issues. While OSNs allow users to restrict access to shared data, they currently do not provide any mechanism to enforce privacy concerns over data associated with multiple users. To this end, we propose an approach to enable the protection of shared data associated with multiple users in OSNs. We formulate an access control model to capture the essence of multiparty authorization requirements, along with a multiparty policy specification scheme and a policy enforcement mechanism. Besides, we present a logical representation of our access control model that allows us to leverage the features of existing logic solvers to perform various analysis tasks on our model. We also discuss a proof-of-concept prototype of our approach as part of an application in Facebook and provide usability study and system evaluation of our method. <s> BIB002 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> In this article, we introduce a new and general privacy framework called Pufferfish. The Pufferfish framework can be used to create new privacy definitions that are customized to the needs of a given application. The goal of Pufferfish is to allow experts in an application domain, who frequently do not have expertise in privacy, to develop rigorous privacy definitions for their data sharing needs. In addition to this, the Pufferfish framework can also be used to study existing privacy definitions. We illustrate the benefits with several applications of this privacy framework: we use it to analyze differential privacy and formalize a connection to attackers who believe that the data records are independent; we use it to create a privacy definition called hedging privacy, which can be used to rule out attackers whose prior beliefs are inconsistent with the data; we use the framework to define and study the notion of composition in a broader context than before; we show how to apply the framework to protect unbounded continuous attributes and aggregate information; and we show how to use the framework to rigorously account for prior data releases. <s> BIB003 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Online social networks' (OSNs) epic popularity has accustomed users to the ease of sharing information. At the same time, OSNs have been a focus of privacy concerns with respect to the information shared. Therefore, it is important that users have some assurance when sharing on OSNs: popular OSNs provide users with mechanisms, to protect shared information access rights. However, these mechanisms do not allow collaboration when defining access rights for joint content related to more than one user (e.g, party pictures in which different users are being tagged). In fact, the access rights list for such content is represented by the union of the access list defined by each related user, which could result in unwanted leakage. We propose a collaborative access control scheme, based on secret sharing, in which sharing of content on OSNs is decided collaboratively by a number of related users. We demonstrate that such mechanism is feasible and benefits users' privacy. <s> BIB004 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Abstract With the spread of Web-Based Social Networks (WBSNs) managing access to data is a challenging matter. Providing personalized, fine-grained access control is essential to build trusted WBSNs. WBSNs data can be associated with owners and co-owners, namely users who upload the data and users who are linked to uploaded data respectively. Thus, a privacy-friendly WBSN must allow users the management of elements related to them. In this regard, CooPeD (Co-owned Personal Data management), a system that deals with co-ownership management of decomposable objects, is proposed. CooPeD is formed by a model and a mechanism. CooPeD is developed on the bases of SoNeUCON ABC usage control model. Particularly, an extension of SoNeUCON ABC is proposed to support co-ownership management by means of access control and administrative management. In CooPeD's mechanism objects, decomposed in parts, are attached to owners and co-owners who individually set their access control preferences. The evaluation of CooPeD consists of three parts. Firstly, a feasibility analysis for different architectures of CooPeD's model and mechanism, as well as of CooPeD's mechanism in Facebook is performed. Secondly, a prototype proves the feasibility of implementing CooPeD. Lastly, a survey study assesses the acceptance of CooPeD. <s> BIB005 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> As the development of mobile devices and applications, mobile privacy has become a very important issue. Current researches on mobile privacy mainly focus on potential leakages on a particular device. However, leakage of sensitive data on a mobile device not only violates the privacy of the phone (or data) owner, but also violates the privacy of many other people whose information are contained in the data directly or indirectly (they are called data involvers). To address such problems, we introduce a collaborative privacy management framework, which aims to provide fine-grained data privacy protection for both data owners and data involvers in a distributed manner. Based on individual privacy policies specified by each user, a collaborative privacy policy is generated and enforced on different devices automatically. As a proof-of-concept prototype, we implement the proposed framework on Android and demonstrate its applicability with two case studies. <s> BIB006 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> In social computing, multiple users may have privacy stakes in a content e.g., a tagged photo. They may all want to have a say on the choice of access control policy for protecting that content. The study of protection schemes for multiple stakeholders in social computing has captured the imagination of researchers, and general-purpose schemes for reconciling the differences of privacy stakeholders have been proposed. ::: ::: A challenge of existing multiple-stakeholder schemes is that they can be very complex. In this work, we consider the possibility of simplification in special cases. If we focus on specific instances of multiple stakeholders, are there simpler design of access control schemes? We identify two design patterns for handling a significant family of multiple-stakeholder scenarios. We discuss efficient implementation techniques that solely rely on standard SQL technology. We also identify scenarios in which general-purpose multiple-stakeholder schemes are necessary. We believe that future work on multiple stakeholders should focus on these scenarios. <s> BIB007 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Social media involve many shared items, such as photos, which may concern more than one user. The challenge is that users’ individual privacy preferences for the same item may conflict, so an approach that simply merges in some way the users’ privacy preferences may provide unsatisfactory results. Previous proposals to deal with the problem were either time-consuming or did not consider compromises to solve these conflicts (e.g., by considering unilaterally imposed approaches only). We propose a negotiation mechanism for users to agree on a compromise for these conflicts. The second challenge we address in this article relates to the exponential complexity of such a negotiation mechanism. To address this, we propose heuristics that reduce the complexity of the negotiation mechanism and show how substantial benefits can be derived from the use of these heuristics through extensive experimental evaluation that compares the performance of the negotiation mechanism with and without these heuristics. Moreover, we show that one such heuristic makes the negotiation mechanism produce results fast enough to be used in actual social media infrastructures with near-optimal results. <s> BIB008 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Differential privacy provides a rigorous standard for evaluating the privacy of perturbation algorithms. It has widely been regarded that differential privacy is a universal definition that deals with both independent and correlated data and a differentially private algorithm can protect privacy against arbitrary adversaries. However, recent research indicates that differential privacy may not guarantee privacy against arbitrary adversaries if the data are correlated. In this paper, we focus on the private perturbation algorithms on correlated data. We investigate the following three problems: (1) the influence of data correlations on privacy; (2) the influence of adversary prior knowledge on privacy; and (3) a general perturbation algorithm that is private for prior knowledge of any subset of tuples in the data when the data are correlated. We propose a Pufferfish definition of privacy, called Bayesian differential privacy, by which the privacy level of a probabilistic perturbation algorithm can be evaluated even when the data are correlated and when the prior knowledge is incomplete. We present a Gaussian correlation model to accurately describe the structure of data correlations and analyze the Bayesian differential privacy of the perturbation algorithm on the basis of this model. Our results show that privacy is poorest for an adversary who has the least prior knowledge. We further extend this model to a more general one that considers uncertain prior knowledge. <s> BIB009 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Privacy preserving on data mining and data release has attracted an increasing research interest over a number of decades. Differential privacy is one influential privacy notion that offers a rigorous and provable privacy guarantee for data mining and data release. Existing studies on differential privacy assume that in a data set, records are sampled independently. However, in real-world applications, records in a data set are rarely independent. The relationships among records are referred to as correlated information and the data set is defined as correlated data set. A differential privacy technique performed on a correlated data set will disclose more information than expected, and this is a serious privacy violation. Although recent research was concerned with this new privacy violation, it still calls for a solid solution for the correlated data set. Moreover, how to decrease the large amount of noise incurred via differential privacy in correlated data set is yet to be explored. To fill the gap, this paper proposes an effective correlated differential privacy solution by defining the correlated sensitivity and designing a correlated data releasing mechanism. With consideration of the correlated levels between records, the proposed correlated sensitivity can significantly decrease the noise compared with traditional global sensitivity. The correlated data releasing mechanism correlated iteration mechanism is designed based on an iterative method to answer a large number of queries. Compared with the traditional method, the proposed correlated differential privacy solution enhances the privacy guarantee for a correlated data set with less accuracy cost. Experimental results show that the proposed solution outperforms traditional differential privacy in terms of mean square error on large group of queries. This also suggests the correlated differential privacy can successfully retain the utility while preserving the privacy. <s> BIB010 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> The capabilities of modern devices, coupled with the almost ubiquitous availability of Internet connectivity, have resulted in photos being shared online at an unprecedented scale. This is further amplified by the popularity of social networks and the immediacy they offer in content sharing. Existing access control mechanisms are too coarse-grained to handle cases of conflicting interests between the users associated with a photo; stories of embarrassing or inappropriate photos being widely accessible have become quite common. In this paper, we propose to rethink access control when applied to photos, in a way that allows us to effectively prevent unwanted individuals from recognizing users in a photo. The core concept behind our approach is to change the granularity of access control from the level of the photo to that of a user's personally identifiable information (PII). In this work, we consider the face as the PII. When another user attempts to access a photo, the system determines which faces the user does not have the permission to view, and presents the photo with the restricted faces blurred out. Our system takes advantage of the existing face recognition functionality of social networks, and can interoperate with the current photo-level access control mechanisms. We implement a proof-of-concept application for Facebook, and demonstrate that the performance overhead of our approach is minimal. We also conduct a user study to evaluate the privacy offered by our approach, and find that it effectively prevents users from identifying their contacts in 87.35% of the restricted photos. Finally, our study reveals the misconceptions about the privacy offered by existing mechanisms, and demonstrates that users are positive towards the adoption of an intuitive, straightforward access control mechanism that allows them to manage the visibility of their face in published photos. <s> BIB011 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> The ubiquity of portable mobile devices equipped with built-in cameras have led to a transformation in how and when digital images are captured, shared, and archived. Photographs and videos from social gatherings, public events, and even crime scenes are commonplace online. While the spontaneity afforded by these devices have led to new personal and creative outlets, privacy concerns of bystanders (and indeed, in some cases, unwilling subjects) have remained largely unaddressed. We present I-Pic, a trusted software platform that integrates digital capture with user-defined privacy. In I-Pic, users choose alevel of privacy (e.g., image capture allowed or not) based upon social context (e.g., out in public vs. with friends vs. at workplace). Privacy choices of nearby users are advertised via short-range radio, and I-Pic-compliant capture platforms generate edited media to conform to privacy choices of image subjects. I-Pic uses secure multiparty computation to ensure that users' visual features and privacy choices are not revealed publicly, regardless of whether they are the subjects of an image capture. Just as importantly, I-Pic preserves the ease-of-use and spontaneous nature of capture and sharing between trusted users. Our evaluation of I-Pic shows that a practical, energy-efficient system that conforms to the privacy choices of many users within a scene can be built and deployed using current hardware. <s> BIB012 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> The collaborative nature of content development has given rise to the novel problem of multiple ownership in access control, such that a shared resource is administrated simultaneously by co-owners who may have conflicting privacy preferences and/or sharing needs. Prior work has focused on the design of unsupervised conflict resolution mechanisms. Driven by the need for human consent in organizational settings, this paper explores interactive policy negotiation, an approach complementary to that of prior work. Specifically, we propose an extension of Relationship-Based Access Control (ReBAC) to support multiple ownership, in which a policy negotiation protocol is in place for co-owners to come up with and give consent to an access control policy in a structured manner. During negotiation, the draft policy is assessed by formally defined availability criteria: to the second level of the polynomial hierarchy. We devised two algorithms for verifying policy satisfiability, both employing a modern SAT solver for solving subproblems. The performance is found to be adequate for mid-sized organizations. <s> BIB013 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Preserving privacy of posts in online social networks is difficult. One reason for this is that a post can be related to the poster as well as various others that are related to the post. Hence, it is possible to share information that pertains others without their consent. This pathological situation often leads to privacy violations that are hard to revert. Recent approaches advocate use of agreement technologies to enable stakeholders of a post to discuss the privacy configurations of a post. This allows related individuals to express concerns so that various privacy violations are avoided up front. This paper continues in the same line by proposing to use negotiation for reaching privacy agreements among users and introduces a negotiation architecture that combines semantic privacy rules with utility functions. We study various negotiation strategies that are inspired from negotiations in e-commerce. We discuss meaningful metrics for measuring privacy negotiation outcomes. We compare various strategies on a benchmark set of scenarios, similar to the ones that appear in real life social networks. <s> BIB014 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Online social network (OSN) users are exhibiting an increased privacy-protective behaviour especially since multimedia sharing has emerged as a popular activity over most OSN sites. Popular OSN applications could reveal much of the users’ personal information or let it easily derived, hence favouring different types of misbehaviour. In this article the authors deal with these privacy concerns by applying fine-grained access control and co-ownership management over the shared data. This proposal defines access policy as any linear boolean formula that is collectively determined by all users being exposed in that data collection namely the co-owners. All co-owners are empowered to take part in the process of data sharing by expressing (secretly) their privacy preferences and, as a result, jointly agreeing on the access policy. Access policies are built upon the concept of secret sharing systems. A number of predicates such as gender, affiliation or postal code can define a particular privacy setting. User attributes are then used as predicate values. In addition, by the deployment of privacy-enhanced attribute-based credential technologies, users satisfying the access policy will gain access without disclosing their real identities. The authors have implemented this system as a Facebook application demonstrating its viability, and procuring reasonable performance costs. <s> BIB015 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Many modern databases include personal and sensitive correlated data, such as private information on users connected together in a social network, and measurements of physical activity of single subjects across time. However, differential privacy, the current gold standard in data privacy, does not adequately address privacy issues in this kind of data. This work looks at a recent generalization of differential privacy, called Pufferfish, that can be used to address privacy in correlated data. The main challenge in applying Pufferfish is a lack of suitable mechanisms. We provide the first mechanism -- the Wasserstein Mechanism -- which applies to any general Pufferfish framework. Since this mechanism may be computationally inefficient, we provide an additional mechanism that applies to some practical cases such as physical activity measurements across time, and is computationally efficient. Our experimental evaluations indicate that this mechanism provides privacy and utility for synthetic as well as real data in two separate domains. <s> BIB016 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> According to the current design of content sharing services, such as Online Social Networks (OSNs), typically (i) the service provider has unrestricted access to the uploaded resources and (ii) only the user uploading the resource is allowed to define access control permissions over it. This results in a lack of control from other users that are associated, in some way, with that resource. To cope with these issues, in this paper, we propose a privacy-preserving system that allows users to upload their resources encrypted, and we design a collaborative multi-party access control model allowing all the users related to a resource to participate in the specification of the access control policy. Our model employs a threshold-based secret sharing scheme, and by exploiting users' social relationships, sets the trusted friends of the associated users responsible to partially enforce the collective policy. Through replication of the secret shares and delegation of the access control enforcement role, our model ensures that resources are timely available when requested. Finally, our experiments demonstrate that the performance overhead of our model is minimal and that it does not significantly affect user experience. <s> BIB017 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Databases can leak confidential information when users combine query results with probabilistic data dependencies and prior knowledge. Current research offers mechanisms that either handle a limited class of dependencies or lack tractable enforcement algorithms. We propose a foundation for Database Inference Control based on ProbLog, a probabilistic logic programming language. We leverage this foundation to develop Angerona, a provably secure enforcement mechanism that prevents information leakage in the presence of probabilistic dependencies. We then provide a tractable inference algorithm for a practically relevant fragment of ProbLog. We empirically evaluate Angerona's performance showing that it scales to relevant security-critical problems. <s> BIB018 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Current collaborative photo privacy protection solutions can be categorized into two approaches: controlling the recipient, which restricts certain viewers' access to the photo, and controlling the content, which protects all or part of the photo from being viewed. Focusing on the latter approach, we introduce privacy-enhancing obfuscations for photos and conduct an online experiment with 271 participants to evaluate their effectiveness against human recognition and how they affect the viewing experience. Results indicate the two most common obfuscations, blurring and pixelating, are ineffective. On the other hand, inpainting, which removes an object or person entirely, and avatar, which replaces content with a graphical representation are effective. From a viewer experience perspective, blurring, pixelating, inpainting, and avatar are preferable. Based on these results, we suggest inpainting and avatar may be useful as privacy-enhancing technologies for photos, because they are both effective at increasing privacy for elements of a photo and provide a good viewer experience. <s> BIB019 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Photo sharing is an attractive feature which popularizes online social networks (OSNs). Unfortunately, it may leak users’ privacy if they are allowed to post, comment, and tag a photo freely. In this paper, we attempt to address this issue and study the scenario when a user shares a photo containing individuals other than himself/herself (termed co-photo for short). To prevent possible privacy leakage of a photo, we design a mechanism to enable each individual in a photo be aware of the posting activity and participate in the decision making on the photo posting. For this purpose, we need an efficient facial recognition (FR) system that can recognize everyone in the photo. However, more demanding privacy setting may limit the number of the photos publicly available to train the FR system. To deal with this dilemma, our mechanism attempts to utilize users’ private photos to design a personalized FR system specifically trained to differentiate possible photo co-owners without leaking their privacy. We also develop a distributed consensus-based method to reduce the computational complexity and protect the private training set. We show that our system is superior to other possible approaches in terms of recognition ratio and efficiency. Our mechanism is implemented as a proof of concept Android application on Facebook’s platform. <s> BIB020 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> In instant messaging systems, photos have become an expressive form of real-time content sharing among users. Unfortunately, faces of stakeholders, who are depicted in the shared photos, may be exposed to unexpected viewers. This may lead to privacy leakages. In this paper, an approach is proposed to prevent such leakages, which is based on access control and face recognition. Each time a photo is sent, all stakeholders are recognized, and their faces are hidden from viewers. At the same time, stakeholders will be notified about the photo, and can decide to reveal their own faces to some proper viewers later. On the other hand, similar photos are exploited to automate this revealing process when possible, so as to reduce the impact of access control on user experiences. Besides, a proof-of-concept system is constructed and its performance is evaluated. The results indicate that this approach can be applied in instant messaging systems without too much overhead. <s> BIB021 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Cloud storage services, like Dropbox and Google Drive, have growing ecosystems of 3rd party apps that are designed to work with users' cloud files. Such apps often request full access to users' files, including files shared with collaborators. Hence, whenever a user grants access to a new vendor, she is inflicting a privacy loss on herself and on her collaborators too. Based on analyzing a real dataset of 183 Google Drive users and 131 third party apps, we discover that collaborators inflict a privacy loss which is at least 39% higher than what users themselves cause. We take a step toward minimizing this loss by introducing the concept of History- based decisions. Simply put, users are informed at decision time about the vendors which have been previously granted access to their data. Thus, they can reduce their privacy loss by not installing apps from new vendors whenever possible. Next, we realize this concept by introducing a new privacy indicator, which can be integrated within the cloud apps' authorization interface. Via a web experiment with 141 participants recruited from CrowdFlower, we show that our privacy indicator can significantly increase the user's likelihood of choosing the app that minimizes her privacy loss. Finally, we explore the network effect of History-based decisions via a simulation on top of large collaboration networks. We demonstrate that adopting such a decision- making process is capable of reducing the growth of user privacy loss by 40% in a Google Drive-based network and by 70% in an author collaboration network. This is despite the fact that we neither assume that users cooperate nor that they exhibit altruistic behavior. To our knowledge, our work is the first to provide quantifiable evidence of the privacy risk that collaborators pose in cloud apps. We are also the first to mitigate this problem via a usable privacy approach. <s> BIB022 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> In an effort to support users' decision making process in regards to shared and co-managed online images, in this paper we present a novel model to early detect images which may be subject to possible conflicting access control decisions. We present a group-based stochastic model able to identify potential privacy conflicts among multiple stakeholders of an image. We discuss experiments on a dataset of over 3000 online images, and compare our results with several baselines. Our approach outperforms all baselines, even the strong ones based on a Convolutional Neural Network architecture. <s> BIB023 </s> A Survey on Interdependent Privacy <s> Technical Solutions <s> Individuals share increasing amounts of personal data online. This data often involves–or at least has privacy implications for–data subjects other than the individuals who shares it (e.g., photos, genomic data) and the data is shared without their consent. A sadly popular example, with dramatic consequences, is revenge pornography. In this paper, we propose ConsenShare, a system for sharing, in a consensual (wrt the data subjects) and privacy-preserving (wrt both service providers and other individuals) way, data involving subjects other than the uploader. We describe a complete design and implementation of ConsenShare for photos, which relies on image processing and cryptographic techniques, as well as on a two-tier architecture (one entity for detecting the data subjects and contacting them; one entity for hosting the data and for collecting consent). We benchmark the performance (CPU and bandwidth) of ConsenShare by using a dataset of 20k photos from Flickr. We also conduct a survey targeted at Facebook users (N = 321). Our results are quite encouraging: The experimental results demonstrate the feasibility of our approach (i.e., acceptable overheads) and the survey results demonstrate a potential interest from the users. <s> BIB024
In this section, we describe the technical solutions (e.g., architectures, software tools) proposed in the literature to address interdependent privacy issues. Note that there is an active line of research (mostly in the database community) devoted to the case of aggregate queries on correlated records and differential privacy (see Section 4.5), including , BIB003 , , BIB016 , BIB009 , and BIB010 , to name a few. Yet, because these solutions do not focus directly on interdependent privacy, we do not describe them in this survey. We summarize the results of this section in a synthetic table presented at the end of the section (Table 4 , on page 32). Wishart et al. propose an access control solution where data co-owners can arbitrarily restrict the permissions on the co-owned data, i.e., veto voting (see Section 3.5) BIB001 . In case of conflict with a co-owner who applies too many restrictions on the data access, either the restrictive policy is applied as such or the content is modified (i.e., blur the face or crop it) so that this co-owner is no longer affected by the data sharing. Hu et al. propose a model for detecting and resolving privacy conflicts in OSNs ]. To detect potential conflicts for some content, the owner must tag other users involved in the content when publishing the content. The algorithm solves conflicts based on the trust relationships between the users and the sensitivity and visibility of the content, and, finally, it balances data sharing benefits and privacy risks. In their follow-up work, the authors present a multi-party access control model for OSNs BIB002 ]. In particular, they define four different user roles in their framework: owner (e.g., uploading a content in her own space), contributor (e.g., uploading the content to someone else's place), stakeholders (e.g., individuals being tagged), and disseminators (e.g., individuals sharing on her own space a content from another space). They aggregate the policies from all the involved users to decide whether to deny or grant access, and they rely on a voting mechanism in the cases of privacy conflicts between users. Beato and Peeters propose a collaborative access control based on secret sharing BIB004 . The owner encrypts the content with a random key and sends for each co-owner the content, the key (to decrypt the content and make a decision) and a share of the secret. Then co-owners give their share to other users (i.e., the targeted audience) so that only users with a higher number of shares than a defined threshold can decrypt the content. González-Manzano et al. propose a co-owned personal data management system named CooPeD: it regulates the access control of co-owned objects decomposable into parts, such as photos BIB005 ] (see Section 3.5). With CooPeD, each user involved in the object (e.g., appearing in a photo) can individually manage her privacy preferences and access rights. Guo et al. propose a framework for collaborative privacy management on mobile devices to protect so-called distributed information (e.g., phone numbers appearing on multiple contact lists) BIB006 . Each user can specify which app or app category can access what type of sensitive data. Every user's policy is then enforced on all devices where the user's data appears, assuming all mobile device owners act collaboratively. Ilia et al. developed a fine-grained tool to regulate the access control of faces in photos BIB011 . The authors use a three-dimensional access control matrix that defines the object group (i.e., a photo), the objects (i.e., faces), and the subjects (i.e., users). Their approach handles conflicts of privacy policies by modifying the access control's granularity, from the whole photo to the faces of individuals in the photo. Moreover, it automatically identifies users in the photo using face recognition and blurs the faces of the users who have restricted access to it. Aditya et al. develop I-Pic, a mobile application for collecting consent from bystanders in photos BIB012 . It is based on three main principles from a user study: (i) as privacy concerns vary between individuals, privacy policies should be individual too, (ii) privacy policies should be situational, and (iii) users should comply, in general, with the privacy preferences of others. The privacy preferences of bystanders are broadcast via short-range communication (e.g., Bluetooth). The system relies on support vector machine for face recognition of the bystanders and makes use of homomorphic encryption and garbled circuits to protect bystanders' privacy. Mehregan and Fong developed two design patterns for simplifying existing access right schemes for content involving multiple users (referred to as stakeholders) BIB007 . The authors propose different design patterns for scenarios with simple annotations (such as liking, tagging, and sharing) and for those with higher-order annotations (i.e., annotations of annotations, such as replies to comments). Design principles include, among others, that every stakeholder of a content should have a say about the access control policy of this content. The authors evaluate the performance of their approach with real data from LiveJournal and show that it meets the responsiveness requirements of web applications. In a follow-up work, the authors develop a DAC model for shared resources with multiple ownership that satisfies three criteria of availability: policy satisfiability, feasibility, and resiliency BIB013 . In particular, they extend the ReBAC model (see Section 3.5) to reach a mutual access control policy among co-owners through an interactive policy negotiation protocol. The authors also design and evaluate two algorithms that both rely on a SAT solver for verifying policy satisfiability; they further demonstrate their effectiveness for mid-sized organizations. Such and Rovatsos present an automated method for detecting privacy policy conflicts in OSNs, and they resolve them using negotiation between stakeholders involved in the shared content BIB008 . The proposed approach makes use of ReBAC and of the one-step negotiation protocol. The authors further show that the space of possible compromises grows exponentially with the number of conflicts to be negotiated, and they propose three heuristics to overcome this problem. They evaluate the performance of their different approaches and show that greedy heuristics provide good trade-offs between complexity and optimality when the number of agents increases. Keküllüoğlu et al. improve upon Such and Rovatsos's work by considering multiple interactions between OSN users. They propose three negotiation strategies including one based on reciprocity between users and that takes into account previous interactions BIB014 . The authors compare their approach with state-of-the-art strategies and, with three synthetic examples, show that reciprocal privacy outperforms other strategies most of the time. Palomar et al. propose to rely on cryptographic primitives to provide fine-grained access control and co-ownership management in OSNs BIB015 . In particular, the proposed system relies on anonymous attribute-based credential algorithms and on joint random-secret sharing to ensure confidentiality of users' privacy preferences. Rathore and Tripathy propose another multi-party access control model for OSN content [Rathore and Tripathy 2016]. Users are split in groups defined by trust levels assigned by each OSN user to his contacts. When a new content is shared, all the policies of stakeholders (i.e., content (co)-owners) are collected, and access is granted if the requester satisfies a majority of stakeholder policies (that depend on the trust levels of the requester with respect to each stakeholder). In a follow-up work of BIB008 , Misra and Such propose two solutions, PAC-MAN and REACT, to recommend sharing policies to OSN users, by relying on machine learning techniques, in the case of co-owned content Such 2017a, 2017b] . They use the relationship type and strength and the shared content as attributes for their recommendation agents (i.e., features). Their results show that the proposed agents provide an average accuracy of more than 90%. Ilia et al. design a collaborative multiparty access control model that ensures that the privacy preferences of all co-owners of a shared content are considered and that their data is not accessible by the service provider and third parties BIB017 . The shared content is protected from the service provider with encryption by relying on the (k, n)-threshold secret sharing scheme [Shamir 122:31 1979] . To access a content, a requester then needs to retrieve enough shares from the co-owners' trusted contacts to eventually retrieve the encryption key. Experimental results show that the proposed model does not significantly affect the time to upload and access the shared content. Guarnieri et al. address the generic problem of preventing probabilistic inference caused by data dependencies in databases BIB018 ]. To do so, they propose a novel provably secure mechanism for tractable and a practical useful database inference control. This mechanism assumes that the attacker's belief is known, and it ensures that this belief does not increase for all secrets in the security policies. They formalize the various constraints given by security policies by relying on probabilistic logic programming and by making inference tractable by building polytree Bayesian networks. Finally, the authors evaluate the efficiency of their scheme with synthetic belief programs containing 1,000 to 100,000 patients and a policy with 100 secrets, and show that it takes less than 0.3 seconds to check a query's security for a database of 100,000 patients. Li et al. study eight different obfuscation methods for hiding a user in a photo shared on an OSN BIB019 . More specifically, they analyze the trade-off between (i) the effectiveness of the different obfuscation mechanisms, and (ii) the remaining photo utility, i.e., the user satisfaction and experience when looking at the obfuscated photo. The authors compare the different methods by performing a user study with N = 271 MTurk users. Their experimental results show that, despite their popularity, blurring and pixelating are ineffective at obfuscating users, and that inpainting (i.e., removing the user entirely and replacing her with something visually consistent with the image) and avatar (i.e., replacing the user with an avatar that preserves some of the elements of the initial representation) are the best options. Xu et al. propose a privacy-preserving face recognition system for automatically detecting whether someone appears in a photo shared on OSNs BIB020 ]. To protect the privacy of the OSN users, the authors develop a method to locally train their face recognition algorithm. Specifically, they rely on a support vector machine model and train it by discriminating between the users and their graph neighbors (e.g., friends) who are trusted more than random users in the OSN. The locally trained models are then shared among users to obtain a global knowledge and improve each local model in the next iteration. The authors implement a proof-of-concept Android application for FB and show through experimental and theoretical analyses that their distributed approach is both efficient and effective at recognizing OSN user faces. Li et al. propose a system for preserving individuals' privacy depicted in photos that are shared in instant messaging BIB021 ]. The faces of stakeholders (i.e., individuals appearing in the photo) are encrypted before the photo is sent and are visible, depending on the policy of each individual with respect to each potential viewer. If the viewer is permitted to see the face of a given stakeholder, then they receive the key of this stakeholder to decrypt the corresponding face. Furthermore, to improve user experience, the authors propose to automate the access control process by exploiting similarities between photos by relying on metrics such as cosine similarity between local features. Harkous and Aberer study the issue of interdependent privacy in the context of file sharing with third-party cloud applications BIB022 . They first evaluate the extent of the threat by using a real-world dataset from Google Drive and show that about 37% of the documents are shared with at least one other user. Given these results, the authors propose new privacy indicators that display the actual privacy risks (i.e., what the app has access to already) by taking into account previous permission decisions (of theirs and of their collaborators). Zhong et al. automate multiparty privacy conflict detection based on their prior work: a solution to detect privacy levels of a part of a photo BIB023 . Their solution that relies on a convolutional neural network architecture, obtains good results compared to baseline algorithms (e.g., logistic regression), with 70% accuracy on average. Olteanu et al. propose ConsenShare, a privacy-preserving system for consensual online sharing of data that have privacy implications for multiple individuals (e.g., photos, DNA), namely, interdependent and multiple-subject data BIB024 . The work focuses mostly on multimedia data, and more specifically on photos. With ConsenShare, the individuals who appear on a photo are masked until they give consent. Neither the sharing platform operators nor the users can access the masked data. The proposed solution relies on a two-tier architecture (identity and content management services) and cryptographic (i.e., public key) and computer vision techniques (i.e., face recognition).