Shadow profile

Early in 2012,[3] a data breach of over six million Facebook users' personal information indicated the existence of shadow profiles, since the leaked information was not provided by users themselves. After this, Facebook started to combine user's shadow profiles with their public profiles. The combined profiles were then further shared with the users' friends if they used Facebook's Download Your Information (DYI) tool.

Some argue that users are aware of the possible privacy invasion, the potential benefits and risks while utilizing social medias. However, researches show that users upload a large amount of personal information into online space. Some researchers describe this phenomenon as users' lax attitude, and possible explanations for this behaviors are a combination of high gratification, usage patterns, and a psychological mechanism similar to third-person effect.[10] Users themselves are sometimes found as the reason of information leakage. To generate more customized results, sometimes users are willing to share their information with Internet of Things (IoTs) for their own convenience.[8] Other circumstances that users would share their information is when they feel anxious, concerned, or being able to protect themselves from privacy invasion, the more likely they will conduct privacy protection behavior. In other words, when users feel no control over privacy invasion, they are less likely to protect their information.[11]

There are also researchers argue that there is a correlation between information leakage and companies' cooperation with third-parties. Online platforms would need to find a balance between the monetization with third-parties and managing users' private information, and a study shows that higher privacy concerns from users would drive up publisher websites’ decision making and third party market structures, such that higher privacy concerns lead to higher industry concentration.[12] Even more, different situations and environmental factors while conducting online behaviors are highly likely to influence people’s behaviors, and may lead to rational/irrational decision makings.[13]

In terms of protection from the officials, by drawing reference to case law on Article 8 of the European Convention on Human Rights, some researchers conclude that the current law cannot adequately address the issue of privacy nor provide protection for open source.[14]

To address the issue of leaking personal information there exist multiple facets. One category of the solution suggests focus on users. One of the argued solutions points out the inefficiency of privacy terms that companies use to ask for users' consent, such that they are sometimes too lengthy (Facebook's privacy terms has 9,500 words),[15] involved with professional vocabularies that only few would fully understand or the users do not understand who are the other parties they are granting their information to.[16] As a result, one of the solutions is to advance the privacy terms by making them easy to read and understand.

In addition, the conversation among users is another factor that leads to information leakage such that people share their information with each other but they become incapable of controlling over the spread of those information afterwards.[17] Thus some argue that instead of focusing on what companies can do to provide a clearer picture of the possible information access, users themselves should be the primary target of controlling over their personal information online and this would work as an efficient way to ease both companies' and consumers' concerns with data collection.[16] Another proposed argument also emphasizes the focus on users, which claims that by making users fully aware of what they are doing online and the logistics behind online behaviors, they will put more trust into the virtual world and would take care of their personal information even more.[18]

Instead of merely focusing on users, some other suggest the interdependent relationship between users and online platforms or companies, and the social contract between them: while companies collect personal data and feedback from users, users would be benefited from the modified functional improvements. As a result, as companies are not merely the side notifying users about the privacy norms but being a contractor responsible for maintaining a mutually beneficial relationship with users, the privacy tension is eased.[19]

• Internet privacy
• Codes of Fair Information Practice
• Communication privacy management theory
• Alternative definitions of internet privacy concerns[20]
• Participatory surveillance