Privacy

Subscribe to Privacy

In September 2020, the California legislature sent a bill to the Governor’s desk which would bar a social media company from opening an account for anyone it “actually knows” is under the age of 13, absent parental consent. The bill, passed with bipartisan support within the legislature, aims to bring social media companies in line with existing federal and California law requiring parental consent before a minor’s personal information is obtained online or sold. (The California Consumer Privacy Act (CCPA) prohibits companies from selling a minor’s personal information without obtaining the authorization of the consumer’s parent or guardian if the business has actual knowledge the consumer is less than 16 years old.)

Social media users may have a reasonable expectation of privacy in their internet browsing data, according to a recent decision of the United States Court of Appeals for the Ninth Circuit Court.

Users of a social media platform brought a class action against its owner, alleging that the company tracked users’ browsing histories when they visited third-party websites, and then compiled those browsing histories into personal profiles which were sold to advertisers to generate revenue. The company did not dispute that it engaged in these tracking practices even after its users had logged out of the site. Plaintiffs complaint alleged, among other claims, violation of the California Invasion of Privacy Act (“CIPA”), and common law invasion of privacy.

Social media has made sharing personal and professional updates easy and, in most cases, highly targeted. Facebook, Instagram, and Twitter, as well as the proliferation of new social media platforms have created a window into the lives of those who are active on these platforms. One of the biggest tensions created by social media is that, while businesses are constantly looking for metrics and strategies that will enable them to advertise their content to the user at the most opportune moment, individuals seek to cut down on their social media consumption. The rise of wearable technology (e.g. smartwatches or technology-embedded clothing) has the power to revolutionize this push/pull dynamic.

On June 13, 2019, the 9th Circuit handed down a decision in Duguid v. Facebook, Inc., 926 F.3d 1146 (9th Cir. 2019), which has at least partially brought into question the future of the Telephone Consumer Protection Act (“TCPA”).

Around January 2014 Facebook started sending Noah Duguid sporadic text messages, alerting Duguid that an unrecognized browser was attempting to access his Facebook account. The messages followed a template akin to “Your Facebook account was accessed [by/from] <browser> at <time>. Log in for more info.” While this type of message may be alarming to the everyday Facebook user believing their account may be hacked, these text messages alarmed Duguid for a completely different reason – he does not have a Facebook account.

Online privacy is a fantasy for many people. We voluntarily post information about every aspect of our lives. Information we do not publicize can often be extracted from website data or our personal accounts (email, social media, etc.). Our privacy and sensitive information is often in jeopardy. What happens when our private and sensitive information is disseminated online to millions of people against our will? This is known as doxing.

In 2017, LinkedIn made several updates to its Terms of Service – comprised of its Privacy Policy and User Agreement – to provide for new LinkedIn features and give users some choices over how their information is used.

In general, the changes revolve around new features that are intended to increase profile visibility and make it easier for users to share and connect with each other. LinkedIn permits users to opt in or out of these features to accommodate individual privacy preferences.

The Advocate General to the Court of Justice of the European Union (CJEU) Yves Bot caused a sensation with his unexpected opinion concerning the admissibility of social media fanpages under EU data protection law. According to the opinion of Mr. Bot, the operator of a social media fanpage is “jointly responsible for the processing and collection of personal data together with” the social media operator.

Further, the operator of a fanpage of a social network is deemed to be a controller “with regard to the phase of processing of personal data consisting in the collection of data on the persons visiting this site by this social network with a view to the production of visitor statistics relating to this site.”

Experiencing virtual reality

The line between the digital world and the physical world is becoming increasingly blurred as we enter an era of virtual reality (VR).  VR can be defined as a “computer technology that uses virtual reality headsets…to generate realistic images, sounds and other sensations that simulate a user’s physical presence in a virtual or imaginary environment.”  In other words, VR uses computers to create a virtual environment that feels as close to reality as possible.

VR will have a significant impact on social media. Instead of communicating through texts, pictures and videos, VR technology will allow two or more people to feel as though they are in the same room together even though each person is in the comfort of their own home, using their own VR system.  Companies are already introducing social VR apps that allow users to communicate with each other through the use of avatars in a 3D environment.