True or False: Your privacy rights are diminished in social media. Most people would probably say this is true, and there are certainly court decisions asserting that people give up privacy interests once they post otherwise private matters about themselves on social media.
But blaming social media for diminished privacy may be a little like blaming a nudist colony for diminished privacy. It’s not so much the destination, as the participant’s choices of where to go and what to do there.
Consider an individual’s postings on Facebook. A Facebook user may view his or her personal Facebook page as his or her domain, a little like his or her home. But a Facebook page is just one link in a colossal voluntary worldwide computer network. Except with the most stringent privacy settings, postings you make on Facebook can readily become known to many others.
Many courts have concluded, essentially, that once you post something viewable by anyone else on Facebook, you have forfeited any privacy interest in it. In one early social media privacy case, involving MySpace, a court noted, “Cynthia's affirmative act made her article available to any person with a computer and thus opened it to the public eye. Under these circumstances, no reasonable person would have had an expectation of privacy regarding the published material.”
While the term “friend” seems friendly, your Facebook friends may not be your real friends. As one court noted, “Where Facebook privacy settings allow viewership of postings by “friends,” the Government may access them through a cooperating witness who is a ‘friend’ without violating the Fourth Amendment.” The court in that case reasoned that when an individual shares a photograph with his friends on Facebook, that individual “has no justifiable expectation that his ‘friends' would keep his profile private,” and any “legitimate expectation of privacy ended when he disseminated posts to his ‘friends' because those ‘friends' were free to use the information however they wanted.”
And contrary to the prevailing belief in social media exceptionalism, social media activity isn’t really treated differently under the law. A basic principle of privacy law for years has been that your privacy rights depend upon whether you have a “reasonable expectation of privacy.” The reasonableness of your expectations has always been judged from a common-sense totality-of-the circumstances approach, regardless of the physical or virtual area of activity.
You may have a reasonable expectation of privacy with respect to a diary you keep at your bedside, but not to papers you leave visible in your workplace. Your activities in an isolated, fenced, and tree-shielded home create a stronger expectation of privacy than your activities in a high-rise apartment with the curtains open.
Social media privacy cases simply apply that long-standing “reasonable expectation of privacy” principle to Internet situations. Looking at the way Facebook and other social media sites work, most courts have concluded that once something is voluntarily posted on Facebook, it no longer carries a reasonable expectation of privacy. You give up your privacy by posting something on accessible Facebook pages.
Your privacy can be violated on Facebook, however, if others make postings invasive of your privacy. Your consent doesn’t extend to the postings of others that you don’t authorize.
State v. Bruhl
In a recent Connecticut case, for example, State v Buhl, a teenager found portions of her private diary, and her picture, posted in a manner accessible to a number of her friends and schoolmates. An acquaintance of the teen’s father was prosecuted for the postings, for breach of peace and harassment — essentially, two criminal charges based on acts that violated the teen’s privacy.
The case revealed a generational Facebook understanding gap, when some of the judges questioned whether Facebook posts counted as being “public,” and suggested that experts were needed to explain the mysterious workings of Facebook. But the state Supreme Court found that “elementary Facebook concepts,” were clear from the trial court record and didn’t require expert testimony.
As to the heart of the crime, the court viewed the defendant’s postings of the teen’s private diary notations as so vexing and personal that the posting satisfied the elements of the crime of breach of peace, including exhibition of offensive, indecent or abusive matter that is likely to annoy or alarm the target. Using language common in privacy cases, the court noted the “deeply personal” and “embarrassing” nature of the posted materials, and therefore found the postings inherently vexing and abusive. The court also found the defendant’s conduct to support a conviction for harassment.
Ultimately, privacy law protects people in social media the same way it protects them elsewhere. Your voluntary posting of personal and intimate information waives any reasonable expectation of privacy, at least as to that information. But your privacy is still protected, and fully enforceable, in social media, when another person improperly and without your permission posts private information about you.
Mark Sableman is a partner in Thompson Coburn’s Intellectual Property group. He is the editorial director of Internet Law Twists & Turns. You can find Mark on Twitter, and reach him at (314) 552-6103 or msableman@thompsoncoburn.com.