A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Photo tagging is a popular feature of many social network sites that allows users to annotate uploaded images with those who are in them, explicitly linking the photo to each person's profile. In this paper, we examine privacy concerns and mechanisms surrounding these tagged images. Using a focus group, we explored the needs and concerns of users, resulting in a set of design considerations for tagged photo privacy. We then designed a privacy enhancing mechanism based on our findings, and validated it using a mixed methods approach. Our results identify the social tensions that tagging generates, and the needs of privacy tools to address the social implications of photo privacy management. <s> BIB001 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> The workload needed for managing privacy and publicness in current social network services (SNSs) is placed on individuals, yet people have few means to control what others disclose about them. This paper considers SNS-users' concerns in relation to online disclosure and the ways in which they cope with these both individually and collaboratively. While previous work has focused mainly on individual coping strategies, our findings from a qualitative study with 27 participants suggest that collaborative strategies in boundary regulation are of additional importance. We present a framework of strategies for boundary regulation that informs both theoretical work and design practice related to management of disclosure in SNSs. The framework considers disclosure as an interpersonal process of boundary regulation, in which people are dependent on what others choose to disclose about them. The paper concludes by proposing design solutions supportive of collaborative and preventive strategies in boundary regulation that facilitate the management of disclosure online. <s> BIB002 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Topology-based access control is today a de-facto standard for protecting resources in On-line Social Networks (OSNs) both within the research community and commercial OSNs. According to this paradigm, authorization constraints specify the relationships (and possibly their depth and trust level) that should occur between the requestor and the resource owner to make the first able to access the required resource. In this paper, we show how topology-based access control can be enhanced by exploiting the collaboration among OSN users, which is the essence of any OSN. The need of user collaboration during access control enforcement arises by the fact that, different from traditional settings, in most OSN services users can reference other users in resources (e.g., a user can be tagged to a photo), and therefore it is generally not possible for a user to control the resources published by another user. For this reason, we introduce collaborative security policies, that is, access control policies identifying a set of collaborative users that must be involved during access control enforcement. Moreover, we discuss how user collaboration can also be exploited for policy administration and we present an architecture on support of collaborative policy enforcement. <s> BIB003 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Online Social Networks (OSNs) facilitate the creation and maintenance of interpersonal online relationships. Unfortunately, the availability of personal data on social networks may unwittingly expose users to numerous privacy risks. As a result, establishing effective methods to control personal data and maintain privacy within these OSNs have become increasingly important. This research extends the current access control mechanisms employed by OSNs to protect private information shared among users of OSNs. The proposed approach presents a system of collaborative content management that relies on an extended notion of a “content stakeholder.” A tool, Collaborative Privacy Management (CoPE), is implemented as an application within a popular social-networking site, , to ensure the protection of shared images generated by users. We present a user study of our CoPE tool through a survey-based study (n=80). The results demonstrate that regardless of whether Facebook users are worried about their privacy, they like the idea of collaborative privacy management and believe that a tool such as CoPE would be useful to manage their personal information shared within a social network. © 2011 Wiley Periodicals, Inc. <s> BIB004 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Sharing information online via social network sites (SNSs) is at an all-time high, yet research shows that users often exhibit a marked dissatisfaction in using such sites. A compelling explanation for this dichotomy is that users are struggling against their SNS environment in an effort to achieve their preferred levels of privacy for regulating social interactions. Our research investigates users' SNS boundary regulation behavior. This paper presents results from a qualitative interview-based study to identify "coping mechanisms" that users devise outside explicit boundary-regulation interface features in order to manage interpersonal boundaries. Our categorization of such mechanisms provides insight into interaction design issues and opportunities for new SNS features. <s> BIB005 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> While much attention is given to young people’s online privacy practices on sites like Facebook, current theories of privacy fail to account for the ways in which social media alter practices of information-sharing and visibility. Traditional models of privacy are individualistic, but the realities of privacy reflect the location of individuals in contexts and networks. The affordances of social technologies, which enable people to share information about others, further preclude individual control over privacy. Despite this, social media technologies primarily follow technical models of privacy that presume individual information control. We argue that the dynamics of sites like Facebook have forced teens to alter their conceptions of privacy to account for the networked nature of social media. Drawing on their practices and experiences, we offer a model of networked privacy to explain how privacy is achieved in networked publics. <s> BIB006 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Online Social Networks (OSNs) such as Facebook, Twitter, and so on recently are major impact in communication and social interaction. Users can share any information with others. However, they have concerns about losing privacy due to lack of an adequate privacy protection provided by the OSNs. The information posted by the user (owner) might leak to unwanted target users. Especially, when collaborative information (e.g. text, photo, video, link), which has associated with the owner and multiple users (co-owners) in the real world, is posted into the OSNs, the co-owners do not have permission to control and might not be aware their information that is being managed by others. To overcome, collective privacy protection (CPP) is proposed to balance between the collaborative information sharing and the privacy protection for the owner and co-owners by majority vote. It enables the owner to create the privacy policy and the co-owners to make a decision in the privacy policy by vote. It additionally identifies and solves the privacy conflicts because at least one co-owner intends to keep private. <s> BIB007 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> The lack of multi-party privacy management support in current mainstream Social Media infrastructures makes users unable to appropriately control to whom co-owned items are shared. Computational mechanisms that are able to merge the privacy preferences of multiple users into a single policy for these kind of items can help solve this problem. As privacy preferences may conflict, these mechanisms need to consider how users' would actually reach an agreement in order to propose acceptable solutions to the conflicts. We propose the first computational mechanism to resolve conflicts for multi-party privacy management in Social Media that adapts to different situations that may motivate different users' concessions and agreements. <s> BIB008 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Items shared through Social Media may affect more than one user's privacy—e.g., photos that depict multiple users, comments that mention multiple users, events in which multiple users are invited, etc. The lack of multi-party privacy management support in current mainstream Social Media infrastructures makes users unable to appropriately control to whom these items are actually shared or not. Computational mechanisms that are able to merge the privacy preferences of multiple users into a single policy for an item can help solve this problem. However, merging multiple users’ privacy preferences is not an easy task, because privacy preferences may conflict, so methods to resolve conflicts are needed. Moreover, these methods need to consider how users’ would actually reach an agreement about a solution to the conflict in order to propose solutions that can be acceptable by all of the users affected by the item to be shared. Current approaches are either too demanding or only consider fixed ways of aggregating privacy preferences. In this paper, we propose the first computational mechanism to resolve conflicts for multi-party privacy management in Social Media that is able to adapt to different situations by modelling the concessions that users make to reach a solution to the conflicts. We also present results of a user study in which our proposed mechanism outperformed other existing approaches in terms of how many times each approach matched users’ behaviour. <s> BIB009 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Social network services enable users to share large quantities of private information. Often, the shared information concerns individuals who are members of the social network but did not upload the information to the service. In such situations, inappropriate sharing preferences can cause conflict and threaten users’ privacy. Since related studies suggest that users prefer to solve multi-party privacy conflicts through negotiation, we introduce a novel approach based on negotiation through arguments. In our approach, users propose privacy settings and support their proposals with logical arguments. The final decision is based on a setting supported by sound arguments. <s> BIB010 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Users of social network services (SNSs) have to cope with a new set of privacy challenges because personal information on an SNS is often co-owned and co-managed by various distributed social ties. Using a multi-methods and multinational approach, we investigated Facebook users' privacy behavior by focusing on how they co-manage private information. Our findings from focus-group interviews (n = 28) and online surveys (n = 299) suggest that Facebook users primarily apply four different practices of privacy management: collaborative strategies, corrective strategies, preventive strategies, and information control. The four dimensions of privacy management display selective relationships with theoretical antecedents (e.g., self-efficacy, collective-efficacy, attitudes, privacy concern), indicating that each behavior is motivated by a different combination of conditions. Implications for research and practice are discussed. <s> BIB011 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Although information sharing on social networking sites (SNSs) usually involves multiple stakeholders, limited attention has been paid so far to conceptualizing users' information practices as a collaborative process. To fill this gap in the literature, we develop a survey study to examine collaborative privacy management strategies involving co-owners of shared content. By conducting two online surveys (N = 304, 427) with different samples, our findings show how individuals protect online privacy collaboratively and how their autonomous decision making regarding privacy management is shaped by the interdependent use of SNSs with their social connections. We discuss theoretical implications to privacy research and suggest design guidelines for better supporting users' needs for collaborating with their social ties to achieve collective privacy goals. <s> BIB012 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Social network services (SNSs) enable users to conveniently share personal information. Often, the information shared concerns other people, especially other members of the SNS. In such situations, two or more people can have conflicting privacy preferences; thus, an appropriate sharing policy may not be apparent. We identify such situations as multiuser privacy scenarios. Current approaches propose finding a sharing policy through preference aggregation. However, studies suggest that users feel more confident in their decisions regarding sharing when they know the reasons behind each other’s preferences. The goals of this paper are (1) understanding how people decide the appropriate sharing policy in multiuser scenarios where arguments are employed, and (2) developing a computational model to predict an appropriate sharing policy for a given scenario. We report on a study that involved a survey of 988 Amazon Mechanical Turk (MTurk) users about a variety of multiuser scenarios and the optimal sharing policy for each scenario. Our evaluation of the participants’ responses reveals that contextual factors, user preferences, and arguments influence the optimal sharing policy in a multiuser scenario. We develop and evaluate an inference model that predicts the optimal sharing policy given the three types of features. We analyze the predictions of our inference model to uncover potential scenario types that lead to incorrect predictions, and to enhance our understanding of when multiuser scenarios are more or less prone to dispute. <s> BIB013 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Users often share information about others; sometimes this inadvertently violates others’ privacy. Thus, here the authors propose SoSharP, an agent-based approach to help users maintain their own and others’ privacy by guiding a selection of sharing policies in multiuser scenarios. SoSharP learns incrementally and asks for users’ input only when required, reducing users’ effort. <s> BIB014 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Online privacy is not just about what you disclose about yourself, it is also about what others disclose about you. <s> BIB015 </s> A Survey on Interdependent Privacy <s> Cooperative Approaches. <s> Everyone holds personal information about others. Each person’s privacy thus critically depends on the interplay of multiple actors. In an age of technology integration, this interdependence of dat... <s> BIB016
We focus here on solutions where individuals interact and collaborate together to progressively and collaboratively reach a decision regarding information sharing and access control rules. Unlike the solutions described above, individuals collaborate relying on communications to negotiate the sharing rules and the audience of content, to obtain commonly acceptable results. Besmer and Richter Lipford propose a corrective method as a collaborative access-management tool for photo sharing on FB: it enables co-owners (i.e., individuals who appear on the photo) to suggest restrictions to the owner (i.e., the uploader) BIB001 . The authors use three focus groups (with a total of N = 14) from a U.S. university population (from staff and students) to identify the concerns of individuals and the coping mechanisms they use to limit the negative effects of shared photos. The results show that individuals are concerned about photos that could affect their social images. The main coping mechanisms used by co-owners are (1) individuals change their behavior to avoid appearing on undesired pictures, (2) they share through private channels (e.g., instant messaging and e-mails) to limit the audience and, (3) they interact outside of the OSN platform to negotiate photos sharing rules. The authors test their tool through an in-lab study (N = 17). Interviewees reported that collaborative strategies improve long-term relationships, with benefits such as satisfaction, trust, and affection. Lampinen et al. study preventive and corrective strategies, respectively, employed before and after the upload of a new content that creates privacy conflicts, used by individuals to regulate their privacy boundaries BIB002 ]. The authors collected qualitative data from interviews and focus groups (with a total of N = 27) from a student population in Finland. Their results show that interviewees employ both individual and collaborative strategies to manage access control. For preventive strategies, to block new publications, they employ the technique of separating audiences and rules of thumb (e.g., not make choices that do not match their own privacy rules). For corrective strategies, individuals use delete comments, untag, and ask the owner to delete content. The results show that individuals more easily use individual strategies, that do not require others' decisions. Carminati and Ferrari present a global architecture for collaborative access control on any kind of data, including data shared between multiple OSN users BIB003 . For data shared between more than one user, the proposed system relies on a module that requests feedback from all users involved in the requested file, before granting others access to it (based on some predefined policy, e.g., majority vote). Squicciarini et al. propose a collaborative privacy management tool, named CoPE: it enables OSN users featured in some shared content (referred to as co-owners) to determine which users of the social network can access this content BIB004 ]. The authors focus and implement their solution for (group) pictures shared on FB. Simply stated, each co-owner simply specifies a set of users who can access the shared content; and the final access control list is obtained by intersecting the individual lists specified by the co-owners. To reduce the risk of conflicts, Wisniewski et al. identify coping mechanisms that use privacy boundary regulation BIB005 ]. The authors identify the different mechanisms by interviewing individuals (N = 21) recruited via e-mails and through snowball sampling on FB. Their results show that individuals mostly manage their boundaries by controlling the audience with the following methods: (1) filter friend requests, (2) ignore posts from other OSN users, (3) to prevent others from finding them, they use pseudonyms, (4) to avoid any conflicts, they withdrawal with self-censorship (e.g., interacting less with other users, not posting content), (5) to find compromise, they reach mutual sharing decisions and they communicate outside the OSN (e.g., with private communication). The results of the study highlight the lack of collaborative tools integrated into OSN platforms; this lack forces individuals to use side-channels to communicate such as private messages or face-to-face. Marwick and Boyd focus on teenagers privacy management and on networked privacy (a concept similar to interdependent privacy; see Section 2) BIB006 . The authors study the strategies used by interviewing and observing teenagers (N = 166) from the U.S. population. Their results show that teenagers employ different coping mechanisms to control the access to the content shared online. The interviewees report that they manually filter content by sharing new content to different groups, and employ social steganography (e.g., talk about someone without explicitly tagging or mentioning them) to code their posts so that only friends who share a common context can understand the (hidden) meaning. They also rely on trust and respect to ensure that friends do not post embarrassing content. Ratikan and Shikida introduce a collective privacy protection (CPP) tool for information shared on OSNs BIB007 . The CPP relies on majority voting: the owner proposes a privacy policy to all identified co-owners. Then, these co-owners accept or reject the policy (if no response is provided, the default choice is rejection to preserve privacy). The authors evaluate their solution with participants (N = 24) who observed the process as both roles (i.e., owner and co-owner) from scenarios relying on a virtual social graph and then answered a survey. Cho and Filippova study the mechanisms used by FB users to control their (networked) privacy BIB011 . The data collection was done in two steps: to extract practices to manage networked privacy, they interviewed five focus-groups (with a total N = 28) from a student population in Singapore, and to evaluate the different practices found (e.g., collaborative, preventive and corrective strategies), they collected data from an online survey (N = 299) from a U.S. and Singapore based population. The results show that individuals use corrective and preventive mechanisms but also use information control mechanisms such as censorship. Collaborative strategies, however, such as discussing rules of thumb, discussing privacy settings, asking permissions and educating, are employed outside of OSN platforms. The authors also note that privacy behaviors are affected by privacy concerns and collective efficacy (i.e., the social cohesion among a group of individuals), and they show that the management of networked privacy is mostly a collective process. Jia and Xu developed a theoretical framework of the collaborative privacy-management strategies of OSN users, based on the ownership of a content (e.g., photos), and on its access by individuals and the extension of the access (e.g., with repost) BIB012 . The authors base their work on the communication privacy-management theory and define boundary ownership (e.g., the co-owners of the content), permeability (i.e., the access rules) and linkage (i.e., the extension of the access) management. They collect their data from two online surveys from U.S.-based MTurk users (N = 304) and undergraduate students of a U.S. university (N = 427). They find that collaboration and groups characteristics have an influence on the choice of privacy policies of individuals. Such and Criado introduce an automated conflict resolution model based on concession, to help users manage the access control rules of content posted on OSNs BIB008 . Their model defines a set of individuals (co-owners who are tagged in the post) who collaboratively decide the access of a co-owned item (e.g., a group photo, managed by all the individuals who appears on the photo) for a set of target individuals (i.e., the audience of the photo) characterized by a certain type of relationship. Depending on the intimacy of relationships of the target individuals, they could have access if there is no conflict in the privacy rules. To resolve conflicts, the authors base their solution on co-owners' willingness to change their policy, depending on the sensitivity and the level of intimacy with the initial choice. In their follow-up work BIB009 , the authors test their solution using a user study with N = 50 participants (from staff and students as well as volunteers outside academia) recruited by e-mail. Each participant had to specify their privacy policy in ten different fictional scenarios. They compared the changing behavior of users to their solution and to the main existing rules, such as veto voting, majority voting, and uploader choice. Their results show that the proposed automated conflict-resolution technique outperforms the three generic rules, matching more than 80% of the concession behavior of users, followed by veto voting. Such and Criado surveys the actual techniques used to deal with multiparty privacy conflict (MPC 27 ), such as manual, auction-based, aggregation-based, adaptive, game-theoretical and fine-grained approaches BIB015 . Moreover, the authors state that the issue of the current research is the lack of large-scale real-world studies: to be able to compare different solutions and to remove bias when participants do not recognize themselves into what-if scenarios used in surveys. To manage the access to photos, Fogues et al. introduce a collaborative solution, based on the negotiation of co-owners via arguments BIB010 . These arguments support each coowner's choice of audience and are divided into three categories: consequences (the impact of sharing the content), analogy from previous experiences, exceptional cases, and popular opinion. In their follow-up work BIB013 , the authors developed an inference model to test, with a survey of individuals from MTurk (N = 988), the influence of arguments of preferences and of context in the sharing of new content online. In five different scenarios, each participant had to specify a sharing policy, depending first on contextual factors, then with preferences, and finally with the arguments associated with the preferences. Their model shows the importance of sensitivity and arguments in predicting the best sharing policy. Fogues et al. implement a recommending sharing policies agent in the case of multiparty content, which relies on the features considered in their previous work BIB013 ] and new features based on user and group characteristics (e.g., age, education level, past experience) BIB014 ]. Kamleitner and Mitchell list and study, based on a number of informal interviews, 24 typical cases that lead to interdependent privacy violations and conceptualize the problem through a framework BIB016 . In their legal analysis, focused on the EU GDPR, the authors argue that current regulations and policies are inadequate to protect against such interdependent privacy violations. The proposed framework relies on the so-called 3Rs: Realize (that some data is being communicated to a third party), Recognize (that the data has privacy implications on others who have rights), and Respect (the rights of others). For the last point (i.e., respect), the authors suggest three solutions: aborting the communication, obtaining consent from others, or modifying (e.g., anonymizing, obfuscating) the data before communicating it. And an interdependent privacy violation occurs when an individual fails one of the 3Rs. The authors further propose four classes of interventions, together with concrete examples, to prevent such failures: "Ensuring realization," "Encouraging recognition," "Educating for respect," and "Embracing alternatives."