Selected Papers of #AoIR2024: The 25th Annual Conference of the Association of Internet Researchers Sheffield, UK / 30 Oct - 2 Nov 2024 Suggested Citation (APA): Horne, C. (2024, October). A Game of Privacy Tug of War: A Historical Analysis of Privacy Settings. Paper presented at AoIR2024: The 25th Annual Conference of the Association of Internet Researchers. Sheffield, UK: AoIR. Retrieved from http://spir.aoir.org. A GAME OF PRIVACY TUG OF WAR: A HISTORICAL ANALYSIS OF PRIVACY SETTINGS Chelsea L. Horne American University Introduction The battle over privacy on social media platforms is a game of tug of war: a series of give and take with shifting landscapes of digital privacy. At the heart of this longstanding, ongoing privacy “game” are privacy settings, a key lever of power at the intersection of platforms, users, and regulation (Horne, 2023a). A now notorious example of this back and forth on privacy comes from the early days of Facebook. In 2008, Facebook deployed privacy settings that set user information to private by default (Kirkpatrick, 2010), indicating that privacy was central for Facebook and the main place where privacy was controlled and enacted was via user privacy settings. Then in 2010, Facebook made an abrupt transition on privacy when the platform switched user privacy settings to instead be public by default. Facebook CEO and Founder Mark Zuckerberg explained the company’s decision by stating that privacy was no longer a social norm (Kirkpatrick, 2010). Privacy settings were the conduit of the back and forth, the push and pull, over user privacy on social media platforms. Privacy settings are a critical mechanism for platforms to manage, control, and impact user privacy online. The policies of social media platforms and their technical design— including the choice architecture of privacy settings—"serve as a form of privatized governance directly enacting rights and regulating the flow of information online (DeNardis & Hackl, 2015). Many platforms use a rhetoric of “choice and control,” relying on privacy settings to shoulder the burden of responsibility for user privacy (Horne, 2021). Another challenge to privacy on social media platforms is that there is a wide disparity of settings choices across different platforms, with varying defaults (Horne, 2023b). Additionally, the interconnection and the technical importance of privacy settings has a clear and well-established history. This paper examines this history via a historical analysis of Meta’s changes to privacy settings. The analysis focuses on Meta as it is one of the oldest and largest of social media platforms; it also hosts a comprehensive archive of news articles, which tracks critical updates to Meta products. The study seeks to determine what privacy settings changes Meta has made, when the changes were announced, as well as analyze how these changes were framed in news articles. Methodology This study is interested in how Meta has changed its approaches to privacy via its privacy settings over the years. Meta archives public-facing press releases and news articles on its Meta Newsroom website, which features search and filter functions. The research questions for this study are : When, how, and why did Meta make changes to its privacy settings? And how does Meta shape the narrative around privacy settings? As this study is interested in studying both settings changes over time as well as how Meta shapes understandings of privacy through these changes, the dataset consisted of all Meta Newsroom articles from the Data and Privacy Topic from the beginning to present: the complete dataset consists of 264 Meta Newsroom articles. The analysis is comprised of two main parts. First, I developed a focused timeline of critical privacy inflection points encompassing the past twenty years in order to overlay these key moments to any settings changes to consider potential connections with exogenous factors. Secondly, the Meta Newsroom articles were coded for the following elements: date, Meta tags, update or new initiative, addition/change/removal, proactive or reactive, dark pattern attribute, and user benefit frame. Findings/Discussion The study’s findings offer insights into the role and deployment of Facebook/Meta privacy settings over time. This paper offers a historical and conceptual framework to understand the strategic approaches of Facebook—and later, Meta—as it adapts to shifting cultural processes, legal regulation, societal norms, and other factors. The paper offers a comprehensive analysis of the history of Facebook/Meta privacy settings, considering them through multiple perspectives: historical changes, article purpose, Meta news topic, settings language, type of settings change, and user benefit frame. One finding is that a proportionally significant number Meta Newsroom articles on Data and Privacy address privacy settings, indicating that privacy settings are indeed an important part of the platform’s privacy discourse. Further, within the scope of the dataset, there have been fifty-seven changes to privacy settings, with the majority of these changes occurring post-2018—after the Cambridge Analytica scandal and the “techlash.” This study offers insight into how Meta engages with privacy through changes to privacy settings over the years as well as an analysis into the frames deployed to explain these updates. In the literature on privacy settings, previous studies have considered when and how users change settings, examined the effectiveness of particular settings, and also analyzed privacy settings for deceptive or manipulative tactics (boyd & Hargittai, 2010; Mathur et al., 2021; Shah & Sandvig, 2008; Svirsky, 2019). Building on this scholarship, this paper tracks Meta’s historical reliance on privacy settings during pivotal moments. Repeatedly over the years, Meta would develop new privacy settings or update existing privacy settings in both reactive and proactive framing functions. That is to say, that settings changes were deployed as a way of responding to regulatory and/or normative privacy issues. In addition, Meta made changes to privacy settings as a way to demonstrate responsible harm mitigation efforts to protect its users and stay at the forefront of privacy protection. Meta has often deployed changes to privacy settings to solve existing problems in the settings (such as concerns about complicated navigation or deceptive design) or deployed changes to address emerging privacy concerns (such as implementing stronger defaults for teen users). The paper’s findings reinforce that privacy settings are one of the most important tools in the privacy landscape and a critical lever of power. In other words, privacy settings feature strongly in the tug of war over online privacy. References boyd, danah, & Hargittai, E. (2010). Facebook privacy settings: Who cares? First Monday. https://doi.org/10.5210/fm.v15i8.3086 DeNardis, L., & Hackl, A. M. (2015). Internet governance by social media platforms. Telecommunications Policy, 39(9), 761–770. https://doi.org/10.1016/j.telpol.2015.04.003 Horne, C. (2021). CHOICE AND CONTROL: AN ANALYSIS OF PRIVACY VALUES AND PRIVACY CONTROLS. AoIR Selected Papers of Internet Research. https://doi.org/10.5210/spir.v2021i0.11944 Horne, C. L. (2023a). In Settings We Trust: The Privacy Battle for Choice and Control. 217. https://doi.org/10.57912/25229699 Horne, C. L. (2023b). RULE BY DEFAULT: A CROSS-PLATFORM ANALYSIS OF PRIVACY SETTINGS. AoIR Selected Papers of Internet Research. https://doi.org/10.5210/spir.v2022i0.13022 Kirkpatrick, marshall. (2010, January 9). Facebook’s Zuckerberg Says The Age of Privacy is Over. ReadWrite. https://readwrite.com/facebooks_zuckerberg_says_the_age_of_privacy_is_ov/ Mathur, A., Mayer, J., & Kshirsagar, M. (2021). What Makes a Dark Pattern... Dark? Design Attributes, Normative Considerations, and Measurement Methods. Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems, 1–18. https://doi.org/10.1145/3411764.3445610 Shah, R. C., & Sandvig, C. (2008). SOFTWARE DEFAULTS AS DE FACTO REGULATION The case of the wireless internet. Information, Communication & Society, 11(1), 25–46. https://doi.org/10.1080/13691180701858836 Svirsky, D. (2019). Why do people avoid information about privacy? Journal of Law & Innovation, 2(1).