Reading Over Your Shoulder: Social Readers and Privacy Law

By Margot Kaminski

My friends, who are generally well educated and intelligent, read a lot of garbage.  I know this because since September 2011, their taste in news about Justin Bieber, Snooki, and the Kardashians has been shared with me through “social readers” on Facebook.{{1}}  Social readers instantaneously list what you are reading on another website, without asking for your approval before disclosing each individual article you read.  They are an example of what Facebook calls “frictionless sharing,” where Facebook users ostensibly influence each other’s behavior by making their consumption of content on other websites instantly visible to their friends.{{2}}  Many people do not think twice about using these applications, and numerous publications have made them available, including the Washington Post, Wall Street Journal, and Guardian.{{3}}

I intend to prompt conversation about social readers on three fronts.  First, social readers are part of a shift toward real name policies online, and, for a number of reasons, should remain opt-in rather than becoming the default setting.  Second, if people do choose to use these applications, they should know that they are making that choice against a backdrop of related battles in privacy law concerning the right to consume content without a third party sharing your activity more broadly.  And third, when individuals choose to use these applications, they may be sharing their habits more widely than they think.

I.  Social Readers and Online Real-Name Policies

Social readers are part of a larger trend toward linking online activity to Internet users’ real identities.  Unlike America Online’s use of invented screen names, the two major social networks, Facebook and Google+, require users to register with their real names or verified pseudonyms.{{4}}  Both Google and Facebook aim to link user activity outside of the social network to one identifiable, real name profile, although Google’s aspirations currently appear limited to other Google services, while Facebook’s ambitions are broader.{{5}}  This real-name model is desirable to online companies and their supporting advertisers because it is easier to advertise to someone if you know who he or she is, and know all of his or her online behavior.

Business concerns are not the only motivating factor behind the shift toward real-name policy.  There is also an argument that real-name policies on comment forums may make people behave more civilly toward each other, because they are part of a social community that imports accountability into the online context.{{6}}  This has been compelling to some newspapers.  The Huffington Post, for example, has a Social News feature that encourages readers to log in through their Facebook accounts and comment on articles under their real identities.{{7}}  However, shifting to real name policy creates other problems, such as preventing pseudonymic or anonymous whistleblowing by commenters, and chilling more controversial or critical speech.{{8}}

Social readers are part of this potential collapse of anonymous or pseudonymic online activity.  It used to be the case that reading an article on the New York Times was a separate activity from communicating to your friends on a social network.  Social readers, however, import your reading activity from the newspaper website into your social network and broadcast it instantaneously under your real name.  Your presence on the other website is no longer anonymous.

Despite the potential benefits to companies, the decision to allow instantaneous sharing of all content consumed elsewhere connected to a user’s real identity should remain firmly in the hands of Internet users.  As individuals, we construct discrete identities for different circumstances: one for work, one for home, one for our closest friends.{{9}}  This is in fact the idea behind Google+’s “Circles” feature, which allows a user to tailor the parts of his or her identity that are visible to each “Circle,” whether it be friends, co-workers, or family.{{10}}  For a social network to retain value by mirroring reality, it needs to allow us to retain these distinctions.  Before social readers, one’s decision to read US Weekly at the gym would not be broadcast to one’s coworkers.  If one is forced to sign up for an US Weekly social reader, however, one’s network would see every article read.  This first point is about one’s relationship as an individual to other individuals: we should each be able to control the parts of our identity we want shown to other people.  We do this in real life; we should be able to do this online.  There may also be a benefit to media companies of allowing individuals to be pickier in their sharing: friends might take recommendations more seriously if they are deliberate and limited, rather than a list of everything their mutual friend haphazardly read.{{11}}

Already, some companies have experienced a backlash from making such pervasive sharing the default option for their software.  For example, in September 2011, the music service Spotify announced a partnership with Facebook that would allow new users to sign up only if they have a Facebook account.{{12}}  Users started seeing their music playlists automatically shared on Facebook; they could opt out of the service, but only by manually disabling the sharing feature.{{13}}  In response to a strong negative reaction, Spotify rolled out a more visible new privacy feature to allow users to “hide their guilty pleasures,” according to the Spotify CEO.{{14}}  The strong reaction to Spotify’s automatic frictionless sharing, and the fact that many newspapers have decided not to create social reader applications at all, shows that if users’ interests are kept in mind, frictionless sharing should remain an option, not the default.

II.  Social Readers and Other Privacy Law Battles

Coincidentally or consequentially, the legal debate over privacy and media consumption has taken on new dimensions at the same time that companies move toward frictionless sharing.  As people on Facebook allow the Washington Post to broadly share every article they have ever read, others are fighting to protect reader records from third parties.

First, it’s important to address whether, and why, reader privacy is important.  Librarians are adamant about the importance of reader privacy.{{15}}  The American Library Association has affirmed a right to privacy for readers since 1939,{{16}} and states that “one cannot exercise the right to read if the possible consequences include damage to one’s reputation, ostracism from the community or workplace, or criminal penalties.  Choice requires both a varied selection and the assurance that one’s choice is not monitored.”{{17}}  This concern comes in part from a historical awareness of how the government might abuse knowledge of citizens’ reading material.  Reading material can be used by the government to track dissidence.  Famously, Joseph McCarthy released a list of allegedly pro-communist authors, and the State Department ordered overseas librarians to remove such books from their shelves.{{18}}  Imagine if social readers had existed during the McCarthy era—the government would have been able to check each person’s virtual bookshelf for blacklisted material.  With the advent of data mining, the reading choices that seem innocuous to you can cumulatively be indicative of patterns, intent, or allegiances to others, including law enforcement.{{19}}

The United States has surprisingly scattered law on the question of readers’ privacy.  There is no federal statute explicitly protecting it.  This means that companies are not specifically prohibited on a federal level from sharing your reading history with others.  In practice, librarians usually require a court order for the government to obtain reader records, and most states make that requirement explicit.{{20}} The PATRIOT Act famously raised ire from librarians by permitting the government under certain circumstances to request library patron records secretly and without judicial oversight.{{21}}

Although there is no federal reader privacy statute, related laws concerning library patrons exist in forty-eight states.{{22}}  Recently, there has been a push at the state level to expand protections for reader privacy beyond libraries.  The California Reader Privacy Act, which was signed into law in October 2011 and took effect in January 2012, extends the type of protections traditionally afforded to library patrons to all books and e-books, although it does not extend to other types of reading online.{{23}}  Government entities must obtain a warrant before accessing reader records, and booksellers or providers must be afforded an opportunity to contest the request.  Booksellers must report the number and type of requests that they receive.{{24}}  Requests made in the context of civil actions must show that the requesting parties are using the “least intrusive means” and have a “compelling interest” in the records, and must obtain a court order.

The First Amendment could arguably protect readers from the discovery of their reading history by the government or by third parties using the court system to obtain the information.  A series of cases have given rise to a standard protecting the anonymity of online speakers.{{25}}  Julie E. Cohen has suggested that the First Amendment should extend its protections to a similar right to read anonymously.{{26}}  However, there has not yet been a case where a litigant has successfully made this argument to protect digital reader records under the First Amendment.

We do have one federal law protecting user privacy during content consumption: the Video Privacy Protection Act (“VPPA”),{{27}} which prohibits the disclosure of personally identifiable video rental information to third parties without a user’s specific consent, and prohibits disclosure of the same to police officers without a warrant.{{28}}  This strangely precise piece of law arose after Supreme Court nominee Robert Bork had his video rental records disclosed in a newspaper.{{29}}

Companies have realized, however, that VPPA is a hurdle to their business models.  In December 2011, the House of Representatives passed H.R. 2471, amending VPPA to allow the disclosure of video rental records with consent given in advance and until that consent is withdrawn by the consumer.{{30}}  This change would allow companies such as Netflix to get a one-time blanket consent to disclose user records through frictionless sharing on Facebook.  The Senate Judiciary Committee held a hearing on H.R. 2471 on January 31, 2012, at which many privacy concerns were raised.{{31}}

III.  Oversharing

Those who currently use social readers may be sharing their reading activity far more broadly than they expect.  Your close friends are not the only ones who can see your Facebook profile.  A Freedom of Information Act (“FOIA”) lawsuit by the Electronic Frontier Foundation revealed that law enforcement agencies use social media to obtain information about people by going undercover on social media sites to gain access to nonpublic information.{{32}}  And even if no police officer or other informant has posed as a friend of yours, using a social network to broadcast your reading records means you have shared those records with a third party—the social network itself—which under United States v. Miller means the police may not need a warrant to obtain those records from the social network.{{33}}

Perhaps more significantly, even if we get rid of the Miller doctrine, as Justice Sotomayor recently suggested, the wholesale sharing of your reading history with Facebook friends may ultimately impact the Supreme Court’s understanding of what constitutes a “reasonable expectation of privacy.”{{34}}  In the 1967 seminal Supreme Court case on wiretapping, Katz v. United States, Katz placed a phone call in a public phone booth with the door closed, and was found to have a reasonable expectation of privacy in the phone call, so a warrant was required for wiretapping the phone.{{35}}  Justice Alito recently contemplated that we may be moving toward a world in which so many people share information with so many friends that social norms no longer indicate a reasonable expectation of privacy in that information.{{36}}  Without a reasonable expectation of privacy, there will be no warrant requirement for law enforcement to obtain that information.  This analysis is troubling; sharing information with your friends should not mean that you expect it to be shared with law enforcement.  This would be like saying that just because you sent wedding invitations to 500 of your closest friends, the government is justified in opening the envelope.  The size of the audience for private communication should not change the fact that it is private.

The recent trend toward social readers and other types of frictionless sharing may at first glance seem innocuous, if inane.  But it has occurred just as privacy advocates are pushing to create more privacy protections for readers through state laws, and may result in the loss of VPPA, the one federal law that protects privacy in content consumption.  And users may not understand that sharing what they read with friends may mean sharing what they read with the government, as well.  That is a whole lot more serious than just annoying your friends with your taste for celebrity gossip.  Indeed, it may be another step toward the death of the Fourth Amendment by a thousand cuts.{{37}}

Facebook

Twitter

Linkedin

email

Print