A Face Tells More than a Thousand Posts: Developing Face Recognition Privacy in Social Networks

Abstract

What is so special about a face? It is the one personally identifiable feature that we all show in public. Faces are particularly good for identification purposes because, unlike getting a new coat or haircut, significantly altering a face to make it unrecognizable is difficult. But since most people have only a limited set of acquaintances, they can often remain anonymous when doing something personal by themselves — even in public. The use of face recognition technology in social networks shifts this paradigm. It can connect an otherwise anonymous face not only to a name — of which there can be several — but to all the information in a social network profile, including one’s friends, work and education history, status updates, and so forth.In this Article, I present two central ideas. First, applying the theory of contextual integrity, I argue that the current use face recognition technology in social networks violates users’ privacy by changing the information that they share (from a simple photo to automatically identifying biometric data) and providing this information to new recipients beyond the users’ control. Second, I identify the deficiencies in the current law and argue that law alone cannot solve this problem. A blanket prohibition on automatic face recognition in social networks would stifle the development of these technologies, which are useful in their own right. But at the same time, our traditional privacy framework of notice and consent cannot protect users who do not understand the automatic face recognition process and recklessly continue sharing their personal information due to strong network effects. Instead, I propose a multifaceted solution aimed at lowering switching costs between social networks and providing users with better information about how their data is used. My argument is that once users are truly free to leave, they will be able to exercise their choice in a meaningful way to demand that social networks respect their privacy expectations.Though this Article specifically addresses the use of face recognition technology in social networks, the proposed solution can be applied to other privacy problems arising in online platforms that accumulate personal information. More broadly, the undertaking to open up social networks and make them more transparent and interoperable could address the concern that these networks threaten to fragment the Web and lock in our personal information.