We, the paparazzi: Developing a privacy paradigm for digital video

Iowa Law Review

Volumn 95, Issue 3, 2010, Pages 919-984

  Lipton, Jacqueline D ^a  

^a CASE WESTERN RESERVE UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

EID: 77953008876     PISSN: 00210552     EISSN: None     Source Type: Journal    
DOI: None     Document Type: Review

References (509)

1. THE BUGGLES, Video Killed the Radio Star, On THE AGE OF PLASTIC (Island Records 1979).
2. JONATHAN ZITFRAIN, THE FUTURE OF THE INTERNET-AND How TO STOP IT 211 (2008).
3. See DANIEL SOLOVE, THE FUTURE OF REPUTATION: GOSSIP, RUMOR, AND PRIVACY ON THE INTERNET 1-2 (2007) (noting that websites and newspapers around the world quickly picked up the story, resulting in the "public shaming and embarrassment" of the dog owner).
4. ZITTRAIN, supra note 2, at 211.
5. See id at 99 ("One holder of a mobile phone camera can inevocably compromise someone else's privacy. ⋯").
6. On camera phones in particular, see discussion in Alan Kato Ku, Comment, Talk Is Cheap, but a Picture Is Worth a Thousand Words: Privacy Rights in the Era of Camera Phone Technology, 45 SANTA CLARA L. REv. 679 (2005).
7. See, e.g., You Tube Video: Star Wars Kid Drunken Jedi (fantom8lz28 2006), http://www.youtube.com/watch?v=3GJOVPjhXMY (displaying an example of one of the many "Star Wars kid remixes" available on YouTube).
8. See JANET LOWE, GOOGLE SPEAKS: SECRETS OF THE WORLD'S GREATEST BIW0NAIIRE ENTREPRENEURS, SERGEY BRIN AND LARRY PAGE 290 (2009) (defining "mashup" as "[a] digital media file containing a mix of text, audio, and animation; it recombines and tweaks each work to create a derivative work. Mashup music and videos, for example, are a collage of other works").
9. See SOLOVE, supra note 3, at 44-48 (discussing the Star Wars kid example of a video- based privacy invasion that harmed an individual's reputation and caused ongoing harm to him in the real world); ZITTRAIN, supra note 2, at 211-12 (discussing the Star Wars kid scenario).
10. ZITFRAIN, supra note 2, at 212 ('The student who made the [Star Wars kid] video has been reported to have been traumatized by its circulation . ⋯"); Star Wars Kid Files Lawsuit, WIRED, July 24, 2003, http://www.wired.com/culture/lifestyle/news/2003/07/59757 ('Ghyslain [Raza] was so teased about the video, he dropped out of school and finished the semester at a children's psychiatric ward, according to a lawsuit filed in the Raza's hometown of Trois-Rivières, Quebec.").
11. ZITTRAIN, supra note 2, at 211. Zittrain describes the Bus Uncle story: The famed 'Bus Uncle" of Hong Kong upbraided a fellow bus passenger who politely asked him to speak more quietly on his mobile phone. The mobile phone user learned an important lesson in etiquette when a third person captured the argument and then uploaded it to the Internet, where 1.3 million people have viewed one version of the exchange ⋯ . Weeks after the video was posted, the Bus Uncle was beaten up in a targeted attack at the restaurant where he worked.
12. In this context I use the term "peers" in a broad sense, referring to members of society with equal access to each other via cell-phone pictures and day-to-day interactions. Unless the context otherwise requires, the term is not intended to connote particularly close personal relationships.
13. See ZITTRAIN, supra note 2, at 221. Zittrain explains: The central problem [for regulating privacy on the Internet] is that the organizations creating, maintaining, using, and disseminating records of identifiable personal data are no longer just "organizations"-they are people who take pictures and stream them online, who blog about their reactions to a lecture or a class or a meal, and who share on social sites rich descriptions of their friends and interactions.
14. Id.
15. see also Andrew J. McClurg, Kiss and Tell: Protecting Intimate Relationship Privacy Through Implied Contracts of Confidentiality, 74 U. CIN. L. REV. 887, 927 (2006) ("[T]echonology has made it much easier for people to take embarrassing pictures of others, both with and without consent, and to widely disseminate them via the Internet.");
16. Id. at 928 ('Digital cameras and camcorders are specifically designed to be connected to computers and to deliver pictures across worldwide networks in an instant.").
17. Existing privacy torts generally do not extend to activities in public places, even where one would assume the video subject had some expectation of privacy or anonymity. See infra Part II.A.2 (discussing the law's inability to resolve image subjects' concerns with online dissemination). Defamation law will not sanction the publication of truthful material. A "defamatory" statement is a false statement that potentially harms a person's reputation. Arlen Langvardt, Section 43(a), Commercial Falsehood, and the First Amendment: A Proposed Framework, 78 MINN. L REV. 309, 334 (1993) ("The common law defines defamation as the publication of a false and defamatory statement about the plaintiff. Defamatory statements, by definition, tend to harm the plaintiff's reputation.").
18. Camera Phone Predator Alert Act, H.R. 414, 111th Cong. § 3(a) (1st Sess. 2009) (requiring camera phones to emit a sound whenever a photograph is taken).
19. See Campbell v. MGN Ltd [2004]' UKHL 22, 2 A.C. 457, 491 (appeal taken from Eng.) (U.K.) (noting that the dissemination of legally taken photographs can do more damage than the taking of the photographs themselves).
20. Professor Solove has, in fact, devoted a large part of a book to these issues. DANIEL SOLOVE, THE DIGITAL PERSON 165-222 (2004) (exploring government access to private information).
21. As Professor Solove described: Computers enable marketers to collect detailed dossiers of personal information and to analyze it to predict the consumer's behavior. Through various analytic techniques, marketers construct models of what products particular customers will desire and how to encourage customers to consume. Companies know how we spend our money, what we do for a living, how much we earn, and where we live. They know about our ethnic backgrounds, religion, political views, and health problems. Not only do companies know what we have already purchased, but they also have a good idea about what books we will soon buy or what movies we will want to see.
22. Id. at 4.
23. See, e.g., Patricia Sánchez Abril & Anita Cava, Health Privacy in a Techno-Social World: A Cyber-Patzent's Bill of Rights, 6 Nw. J. TECH. INTELL PRoP. 244, ¶ 4 (2008) (describing threats to personal health information);
24. Sharona Hoffman & Andy Podgurski, In Sickness, Health, and Cyberspace: Protecting the Security of Electronic Private Health Information, 48 B.C. L REV. 331, 332-33 (2007) (same).
25. See, e.g., Electronic Privacy Information Center, Privacy? Proposed Google/DoubleClick Merger, http://epic.org/privacy/ftc/google/ (last visited Feb. 17, 2010) (expressing concern about the ability of Internet intermediaries such as Google, a search- engine company, and Doubleaick, an Internet advertising firm, to monitor users' online behavior in the context of proposed merger negotiations between Google and DoubleClick).
26. SOLOVE, supra note 3, at 203 (discussing employers' practices with respect to ascertaining and using online information about prospective hires).
27. Throughout this Article, "video" refers collectively to still images and multimedia video files. While I recognize there are important qualitative differences between these kinds of files, the aim of this Article is to draw a line between text-based privacy incursions and those incursions that involve different kinds of media. In later work, I hope to draw more subtle distinctions between different non-text formats for online information.
28. See ZITFRAIN, supra note 2, at 221 (noting that new threats to privacy arise from the dissemination of peer-based multimedia content on the Internet, as opposed to the traditional threats where organizations collated text-based data about private individuals).
29. MySpace is a social-networking service where individuals can search for and communicate with old and new friends. MySpace Press Room, Fact Sheet, http://www.myspace.com/pressroom?url=/fact+sheet/ (last visited Feb. 17, 2010).
30. Facebook descnbes itself as a "social utility that connects you with the people around you." Facebook, Press Room: About Facebook, http://www.facebook.com/press.php (last visited Feb. 17, 2010).
31. Flickr describes itself as "almost certainly the best online photo management and sharing application in the world." Filckr, About Flickr, http://www.flickr.com/about/ (last visited Feb. 17, 2010).
32. YouTube is an online file-sharing service for video files. YouTube, YouTube Fact Sheet, http://www.youtube.com/t/fact-sheet (last visited Feb. 18, 2010);
33. see aLso SOLOVE, supra note 3, at 40 ("Anybody can post videos of anybody eise on YouTube. People can post pictures of you or write about you in their blogs. Even if you aren't exhibiting your private life online, it may still wind up being exposed by somebody else.").
34. SOLOVE, supra note 3, at 38 ("Employers are looking at social network site profiles of prospective employees. Microsoft officials admit to trolling the Internet for anything they can find out about people they are considering for positions.").
35. Id. On the other hand, there is some suggestion that the widespread availability of personal information online cannot be stopped and might actually be beneficial to society.
36. See, e.g., Lior Jacob Strahilevitz, Reputation Nation: Law in an Era of Ubiquitous Personal Information, 102 NW. U. L. REV. 1667, 1736-37 (2008) (arguing that basing decisions on real information rather than dangerous and discriminatory proxies such as race actually provides social benefits overall).
37. Mosley v. News Group Newspapers Ltd, [2008] EWHC (QB) 1777, E.M.LR. 20, [16]-[23] (Eng.) (noting qualitative difference between video and text information in the privacy context);
38. Campbell v. MGN Ltd [ UKHL 22, [ 2 A.C. 457, 501 (appeal taken from Eng.) (U.K.) (noting qualitatively greater privacy harm that could occur as a result of dissemination of video images as compared with a textual account of the information in the journalist's story);
39. JON MILLS, PRIVACY: THE LOST RIGHT 35-37 (2008) (noting the importance of recognizing that information available through different modes of communication-such as text, audio tape, still images, and video recordings-have different impacts on privacy);
40. Id. at 238 ("[C]ourts may be more inclined to protect against intrusive images than intrusive words.");
41. Id. at 262-63 (describing British courts' readiness to extend privacy protections to photographs, but not to textual descriptions of particular misconduct);
42. JOHN PALFREY & URS GASSER, BORN DIGITAL UNDERSTANDING THE FIRST GENERATION OF DIGITAL NATIvES 43 (2008) ("Photographs are no longer just tangible items to be mailed to friends and family-they are computer bytes easily spread across the Internet. These friends, too, upload the pictures to their own photo- sharing sites . ⋯");
43. see also infra Part II (discussing the difference between video images and text-based data in terms of gaps in the legal framework).
44. LOWE, supra note 7, at 292 (defining "social networking" as " [w]ebsites that allow people to share ideas, information, and images and to form networks with friends, family, or other like-minded individuals").
45. That is, of course, assuming they haven't already reached that point. See generally Gaia Bernstein, When New Technologies Are Still New: Windows of Opportunity for Privacy protection 51 VILL.. L. REV. 921 (2006) (noting importance of at least thinking about making regulatory decisions to protect privacy interests before privacy-destroying norms become entrenched when the take-up of the technology reaches a critical mass).
46. JACK GOLDSMITH & TIM WU, WHO CONTROLS THE INTERNET? ILLUSIONS OF A BORDERLESS WORLD 181 (2006) ("There's no reason to doubt that most people's lives are dominated not by law but by social norms, morality, and the market, or that the Internet is deeply influenced by its code.").
47. Other commentators have noted the importance of taking a multimodal approach to protecting privacy rights online generally. See, e.g., PALFREY & GASSER, supra note 28, at 69 ("Any solution to the problem of privacy is going to require the involvement of multiple actors.").
48. Katherine J. Strandburg, Privacy, Rationality, and Temptation: A Theoiy of Willpower Norms, 57 RUTGERS L. REV. 1235, 1238 (2005). Strandburg stated: Social norms are primarily understood as means to coordinate the behavior of individuals in a social group. Thus, norms may help to solve coordination problems-by determining how pedestrians pass one another on the street-and collective action problems-by stigmatizing littering-when individually rational behavior leads to collectively undesirable results.
49. Id.
50. See Joel R. Reidenberg, Lex Infonnatica: The Formulation of Information Policy Rules Through Technology, 76 TEX. L REV. 553, 556-68 (1998) (describing how digital technology can be utilized as a form of regulatory mechanism for online conduct).
51. Ann E. Carlson, Recycling Norms, 89 CAL. L REV. 1231, 1253 (2001) ("Markets constrain behavior through price. If the price of gasoline rises dramatically, people will drive less.").
52. These may be defined as institutions with social benefits, rather than commercial profits, as their aim. See Neil M. Richards, Intellectual Privacy, 87 TEX. L. REV 387, 419-21 (2008) (describing the American Libraries Association as a regulatory institution in this sense with respect to the bill of rights it developed to protect interests of library patrons in 1939).
53. Electronic Frontier Foundation, Privacy, http://www.eff.org/issues/ privacy (last visited Feb. 18, 2010).
54. SOL0VE, supra note 3, at 107 ("Kodak's snap camera was cheap and portable. Many more people could afford to own their own camera, and for the first time, candid photos of people could be taken.").
55. Id. at 107-08.
56. DANIEL SOLOVE, UNDERSTANDING PRIVACY 15 (2008) ("Warren and Brandeis were concerned not only with new [photographic] technology but with how it would intersect with the media. The press was highly sensationalistic at the time.");
57. Neil M. Richards & Daniel J. Solove, Privacy Other Path: Recovering the Law of Confidentiality, 96 GE0. L.J. 123, 128-29 (2007) (describing Warren and Brandeis' concern with the combination of newspaper sensationalism and new photographic technology enabling more widescale candid photography and dissemination of resulting photographs than ever before).
58. Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 HARV. L. REV. 193 (1890);
59. see also MILLS, supra note 28, at 5 (noting that concerns about the advent of popular photography were probably what spurred Warren and Brandeis to write the article); SOLOVE, supra note 3, at 109 ("Warren and Brandeis were concerned about the sensationalistic press and new technologies such as the snap camera.").
60. SOLOVE, supra note 40, at 15 ("Many scholars have proclaimed Warren and Brandeis's article the foundation of privacy law in the United States."); Richards & Solove, supra note 40, at 128 (describing Warren and Brandeis's contribution to the privacy debate as "Privacy's Defining Moment in the heading for Part I").
61. See Mosley v. News Group Newspapers Ltd, [2008] EWHC (QB) 1777. [ E.M.L.R. 20, [16]-[23] (Eng.) (noting the qualitative difference between video and text information in the privacy context);
62. Campbell v. MGN Ltd [2004] UKHL 22, [2004] 2 A.C. 457, 501 (appeal taken from Eng.) (U.K.) (noting qualitatively that greater privacy harm could occur as a result of dissemination of video images as compared with a textual account of the information in a journalist's story);
63. MILLS, supra note 28, at 35-37 (noting the importance of recognizing that information available through different modes of communication-such as text, audio tape, still images, and video recordings-have different impacts on privacy);
64. Id. at 238 ("[C]ourts may be more inclined to protect against intrusive images than intrusive words.");
65. Id. at 263 (describing British courts' readiness to extend privacy protections to photographs, but not to textual descriptions of particular misconduct).
66. Mosley, [2008] E.M.L.R. 20, [1]-[5] (describing facts in which a journalist paid a sex worker to hide a video camera in her clothing while engaging in paid sexual acts with the plaintiff).
67. See, e.g., Campbell, [2004] 2 A.C. at 502 (discussing the Press Complaints Commission Code of Practice in the United Kingdom).
68. See Ku, supra note 5, at 679 (discussing camera phones' "rapidly increasing" popularity in the United States and their increasing presence in the cellular-phone market).
69. In Campbell v. MGN Ltd, for example, a majority of the House of Lords in Britain took the view that the addition of a photograph to a news story about supermodel Naomi Campbell's drug addiction potentially confused readers as to details in the story and that the story was more accurate without the photographs. Campbell [2004] 2 A.C. at 504. But the decision was not unanimous.
70. Id. at 492 ("The argument that the publication of the photograph added credibility to the story has little weight. The photograph was not self-explanatory. Neither the place nor the person were instantly recognisable. The reader only had the editor's word as to the truth of these details.").
71. See SOLOVE, supra note 40, at 118 (describing the problem of aggregation").
72. See Patricia Śnchez Abril, A (My)Space of One's Own: On Privacy and Online Social Networks, 6 Nw. J. TECH. & INTELL. PROP. 73, 75 (2007) (raising contextualization concerns about images disseminated online).
73. With respect to the viral distribution of information online generally, see SOLOVE, supra note 3, at 62. Solove stated: In the offline world, rarely does gossip hit a tipping point.. The process of spreading information to new people takes time, and friends often associate in similar circles, so most secrets don't spread too widely. The Internet takes this phenomenon and puts it on steroids. People can communicate with tens of thousands-even millions-of people almost simultaneously. If you put something up on the Internet, countless people can access it at the same time. In an instant, information can speed across the globe.
74. Id.
75. See supra Part I (discussing cases in which the information was accurate, but was nonetheless damaging).
76. The idea of data aggregation appears as a subset of the idea of information processing in Professor Solove's "taxonomy of privacy."
77. See, e.g., SOLOVE. supra note 40, at 118 ("Aggregation is the gathering of information about a person. A piece of information here or there is not very telling, but when combined, bits and pieces of data begin to form a portrait of a person. The whole becomes greater than the parts."). Adding new information to video images might, in some contexts, resemble a form of identification as also contemplated in Professor Solove's taxonomy.
78. See id at 123 ("Identification is similar to aggregation because both involve the combination of different pieces of information, one being the identity of a person. However, identification differs from aggregation in that it entails a link to the person in the flesh.").
79. See PALFREY & GASSER, supra note 28, at 39 ("It's no secret that the digital medium is characterized by high degrees of accessibility and persistence.");
80. Id. at 53 ("Many young people are extremely likely to leave something behind in cyberspace that will become a lot like a tattoo-something connected to them that they cannot get rid of later in life, even if they want to, without a great deal of difficulty.");
81. SOLOVE, supra note 3, at 33 ("The Internet⋯ makes gossip a permanent reputational stain, one that never fades. It is available around the world, and with Google it can be readily found in less than a second.");
82. Id. at 165 (citing Professor McClurg's work suggesting that images have a quality of permanence that memories lack in the sense that people can scrutinize an image and notice details they might not see when observing the original situation);
83. ZITTRAIN, supra note 2, at 211 ("Lives can be ruined after momentary wrongs, even if merely misdemeanors.");
84. Abril, supra note 49, at 75 ("Lacking the relative transience of human memory, the digital record has increased the takes of privacy today ⋯");
85. McClurg, supra note 12, at 928 ("[P]ersons whose private information is posted on the Internet permanently lose control over that information and, hence, that aspect of their selves.").
86. SOLOVE, supra note 3, at 184 ("Copyright in a photo is owned initially by the person who takes the photo, not by the person whose photo is taken.");
87. see 17 U.S.C. § 102(a) (5) (2006) (copyright exists in original pictorial, graphic, and sculptural works);
88. Id. § 101 ("'Pictorial, graphic, and sculptural works' include two-dimensional and three-dimensional works of fine, graphic, and applied art, photographs, prints and art reproductions, maps, globes, charts, diagrams, models, and technical drawings, including architectural plans.").
89. The subject of a photograph would be the copyright owner either because she used a timer to take the picture or because someone else assigned copyright in the image to her.
90. 17 U.S.C. § 106 sets out the rights of a copyright holder to prevent unauthorized reproduction, distribution, and preparation of derivative works based on a copyrighted work. 17 U.S.C. § 106.
91. Id.,§512(c).
92. See, e.g., CAL. CIV. CODE § 1708.8(a) (West 2009). The statute states: A person is liable for physical invasion of privacy when the defendant knowingly enters onto the land of another person without permission or otherwise committed a trespass in order to physically invade the privacy of the plaintiff with the intent to capture any type of visual image, sound recording, or other physical impression of the plaintiff engaging in a personal or familial activity and the physical invasion occurs in a manner that is offensive to a reasonable person.
93. Id.
94. This would also be a shortcoming of the Camera Phone Predator Alert Act, HR. 414, 111th Cong. (2009), if it were ever enacted. It deals only with intrusive image.gathering, and not with any subsequent unauthorized dissemination.
95. Id. § 3.
96. CAL. CIV. CODE § 1708.8(f) (West 2009). The statute instructs: Sale, transmission, publication, broadcast, or use of any image or recording of the type, or under the circumstances, described in this section shall not itself constitute a violation of this section, nor shall this section be construed to limit all other rights or remedies of plaintiff in law or equity, including, but not limited to, the publication of private facts.
97. Id.
98. SOLOVE, supra note 3, at 187 ("The appropriation tort would rarely apply to the discussion on the Internet of people's private lives or the posting of their photos."). The same might be said about the right-of-publicity tort. 1 ANNE GIL5ON LALONDE, KARIN GREEN & JEROME GILSON, TRADEMARK PROTECrION AND PRACtiCE § 2B.01 (2009), available at LEXIS, Gilson on Trademarks File ('The right of publicity is the right of [ individuall to control the commercial use of his or her name, visual likeness, signature symbol, or other personal characteristics.").
99. Of course, there may be cases where the taking of the image is initially authorized, but its subsequent use in a commercial context is unauthorized. The commercial-use requirement, however, will generally not be met when peers are simply posting images of each other online.
100. Appropriation actually appears as both a distinct limb of privacy law in the Restatement (Second) of Torts, and as a stand-alone tortious action in a number of American state jurisdictions known variously as the 'right of publicity" or "personality rights tort." See RESTATEMENT (SECOND) OF TORTS § 652C (1977) ("One who appropriates to his own use or benefit the name or likeness of another is subject to liability to the other for invasion of his privacy."). For an example of a right-of-publicity tort, see CAL. CIV. CODE § 3344(a) (West 1997). The statute states: Any person who knowingly uses another's name, voice, signature, photograph, or likeness, in any manner, on or in products, merchandise, or goods, or for purposes of advertising or selling, or soliciting purchases of, products, merchandise, goods or services, without such person's prior consent, or, in the case of a minor, the prior consent of his parent or legal guardian, shall be liable for any damages sustained by the person or persons injured as a result thereof.
101. Id.
102. For a discussion of current problems and future directions with this branch of privacy law in the online context, see Patricia Sánchez Abiil, Recasting Privacy Torts in a Spaceless World, 21 HARV.J.L. & TECH. 1(2007).
103. RESTATEMENT (SECOND) OF TORTS § 652D (1977). Section 652D states: One who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of his privacy, if the matter publicized is of a kind that (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public.
104. Id.
105. Id. § 652E. Section 652E states: One who gives publicity to a matter concerning another that places the other before the public in a false light is subject to liability to the other for invasion of his privacy, if (a) the false light in which the other was placed would be highly offensive to a reasonable person, and (b) the actor had knowledge of or acted in reckless disregard as to the falsity of the publicized matter and the false light in which the other would be placed.
106. Id.
107. see also Abril, supra note 64, at 17-27 (discussing practical difficulties of individual plaintiffs in establishing requisite disclosures of private facts both in the physical world and online).
108. A "closed" network is one in which the participants have some control over who has access to information and videos they post online, while an open network is generally accessible to anyone with an Internet connection. Of course, the degree to which a "closed" network is actually closed in practice depends somewhat on the culture of its users. For example, if all Facebook users failed to use appropriate privacy settings, the network would effectively function as an open network.
109. One example of this, although not a "peer" based incursion into privacy is the "lady eating a peach" video that David Letterman repeatedly showed on his late-night television program. It embarrassed the woman who was caught on camera eating an over-ripe peach indelicately at the U.S. Open, but it did not show anything false about her. David Usborne, Peach Lady Puts Squeeze on TV Star, INDEPENDENT (London), Feb. 7, 1996, available at http:// www.independent.co.uk/news/world/peach-lady-puts-squeeze-on-tv-star- 1317718.html.
110. Jonathan B. Mintz, The Remains of Privacy's Disclosure Tort: An Exploration of the Private Domain, 55 MD. L. REV. 425, 439 (1996) ("Whether a fact is private by nature-that is, whether a reasonable person would feel seriously aggrieved by its disclosure-is the subject of some disagreement.").
111. Abril & Cava, supra note 18, at 265 (" [T]o succeed on a privacy tort claim, the disclosed information must not be of public concern. If the ⋯ information disclosed is newsworthy or of public concern, the aggrieved is precluded from recover in tort, as such recovery is preempted by the formidable First Amendment").
112. Mintz, supra note 69, at 441-42. Mint.z states: Facts of "legitimate public concern" or "newsworthy" facts, even if legally private, may be disclosed without any liability under this tort. Regardless of whether a plaintiff must affirmatively prove that facts disclosed were not newsworthy, or whether defendants can be said to enjoy a privilege or a defense, many have declared that the broad scope of the newsworthiness doctrine has "decimate the tort."
113. Id. (alteration in original) (foomotes omitted).
114. RESTATEMENT (SECOND) OF TORTS § 46 (1965).
115. Abril, .supra note 49, at 81 (noting that the tort is ineffectual in the OSN context because the conduct in question is usually not sufficiently "'extreme and outrageous'" and because many courts require "physical manifestations" of the claimed emotional distress (quoting RESTATEMENT (SECOND) 0FTORTS § 46(1) (1965))).
116. MILLS, supra note 28, at 195 ("The law [ intentional infliction of emotional distress] is still in a stage of development, and the ultimate limits of this tort have not yet been determined.").
117. See Langvardt, supra note 13, at 334 (noting that a defamation claim applies to a "statement").
118. See Id. (identifying the elements of a common-law defamation claim).
119. Jennifer Meredith Liebman, Defamed by a Blogger Legal P Self-Regulation, and Other Failures 2006 U. ILL. J.L TECH. & P0L'Y 343, 368-72 (describing different kinds of defamation remedies that may be sought online, including a retraction, an injunction, and damages).
120. Id. at 368 (noting that even if the complainant obtains a retraction by the original poster of defamatory content, the information is likely available in many other places online, including places like the Internet Archive Project that preserves information already retracted from websites).
121. 47 U.S.C. § 230(c) (1) (2006) ("No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.").
122. Council Directive 95/46, Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, 1995 O.J. (L 281) (EC) (discussing the protection of individuals with regard to the processing of personal data and the protection of the free movement of such data).
123. Most of the articles of the Directive apply to Member States of the European Union. However, some provisions impact transfers of data to third countries. See id. arts. 25-26.
124. Id.
125. Id.art.2(a).
126. Id.art.2(b).
127. Council Directive 95/46 art. 3(2);
128. see Opinion 5/2009 on Online Social Networking, § 3.1 (June 12, 2009), available at http://ec.europa.eu/justice-home/fsj/privacy/docs/wpdocs/ 2009/wpl63-en.pdf (discussing application of the "purely personal or household use" exemption in the online social-networking context).
129. Of course, in the United States, there is a possibility that actions against online service providers relating to the posting of information by users of the service would fail because of the operation of 47 U.S.C. § 230(c) (1) (2006). which immunizes Internet intermediaries from suit with respect to the speech of others.
130. Case C-101/01, Criminal Proceedings Against Rodil Lindqvist, 2003 E.C.R. 1-12971, paras. 46-48, available at http://eur-lex.europa.eu/LexUriServ/ LexUriServ.do?un=CELEX:62001J0101:EN:HTML.
131. Id. para. 47.
132. A recent opinion by the European Commission Working Group reviewing the Data Protection Directive in the social-networking context attempted to clarify the application of the "personal or household use" exception to social networks. See Opinion 5/2009 on Online Social Networking, supra note 85, § 3.1.1. The Working Group stated: Typically, access to data⋯ contributed by a user [of an OSNJ] is limited to self- selected contacts. In some cases, however, users may acquire a high number of third party contacts, some of whom he may not actually know. A high number of contacts could be an indication that the household exception does not apply⋯.
133. Id.
134. Case C-101/01, Criminal Proceedings Against Bodil Undqvist, 2003 E.C.R. 1-12971, para. 15, available at http://curia.europa.eu/jurisp/cgi-bin/gettext. pl?lang=en&num=79968893C19010101&doc=T&seance=ARRET.
135. Council Directive 95/46 art. 8(1), Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data, 1995 O.J. (L 281) (EC) ("Member States shall prohibit the processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, and the processing of data concerning health or sex life." (emphasis added)).
136. OSNs can also change terms at any time without notice to the consumer. In fact, in the early da of the Internet, a Canadian court expressly recognized a general Internet service provider's ability to do just that-and was prepared to enforce the changed terms. 1267623 Ontario Inc. v. Nexx Online, Inc., No. C20546/99, 1999 O.T.C. LEXIS 1670, *21 (Ont. Super. Ct.June 14, 1999) (Can.) ("[Defendant] is permitted to add terms to the Contract precluding a client sending unsolicited bulk e-mail directly, or through a third party.");
137. Abril & Cava, supro note 18, at 267 (noting that online contracts are effectively built on shifting sands and can be changed unilaterally without notice to consumers).
138. See, for example, clause 7.B of YouTube's terms of service which provides that YouTube reserves the right to decide whether Content or a User Submission is appropriate and complies with these Terms of Service for violations other than copyright infringement, such as, but not limited to, pornography, obscene or defamatory material, or excessive length. YouTube may remove such User Submissions and/or terminate a User's access for uploading such material in violation of these Terms of Service at any time, without prior notice and at its sole discretion.
139. YouTube, Terms of Service, http://www.youtube.com/t/terms (last visited Feb. 18, 2010). However, note that some commentators have suggested that many of these policies are not actually enforced in practice.
140. Abril, supra note 64, at 14 n.84 (noting that there is little to no apparent enforcement of MySpace's terms of use as an example of lack of effective policing by online social network services providers).
141. See, e.g., Yahoo!, Yahoo! Terms of Service, cl. 6, http://info.yahoo.com/ legal/us/yahoo/utos/utos-173.html (last visited Feb. 22, 2010) (relating to "Member Conduct"); YouTube, supra note 93, cI. 6(b) (relating to "Your User Submissions and Conduct").
142. Yahoo!, supra note 94 (emphasis added).
143. YouTube, supra note 93, cI. 6(d) (emphasis added).
144. Facebook, Statement of Rights and Responsibilities, ci. 2, http://www.facebook.com/tenns.php (last visited Feb. 18, 2010).
145. Id.
146. see also Facebook, Content Code of Conduct, http://www.facebook.com/ codeofconduct.php (last visited Feb. 18, 2010). Facebook further provides its users with a set of privacy principles organized around two "core principles," the second of which states: "There is an increasing amount of information available out there, and you may want to know what relates to you, your friends, and people around you. We want to help you easily get that information."
147. Facebook, Facebook's Privacy Policy, http://www.facebook.com/policy.php (last visited Feb. 18, 2010).
148. Facebook, supra note 97.
149. Id. cl. 5(7).
150. YouTube Video: Otters Holding Hands (cynthiaholmes 2007), http://www.youtube.com/watch?v=epUk5T2Kfno.
151. See S0LOVE, supra note 40, at 24-29 (critiquing property-based theories of privacy); Jessica Litman, Information Privacy/Infonnation Property, 52 STAN. L. Ray. 1283, 1288-95 (2000) (describing various theories of private information as property).
152. See SOLOVE, supra note 40, at 27 (discussing the difficulties of extending property concepts to personal information). Solove stated: Extending property concepts to personal information ⋯ has difficulties. Information can be easily transmitted and, once known by others, cannot be eradicated from their minds. Unlike physical objects, information can be possessed simultaneously within the minds of millions. This is why intellectual-property law protects particular tangible expressions of ideas rather than the underlying ideas themselves. The complexity of personal information is that it is both an expression of the self and a set of facts-a historical record of one's behavior.
153. Id.
154. see also Litman, supra note 102, at 1294-95 (discussing the disadvantages of a privacy-as- property solution). litman stated: Whether or not it could be easily implemented, a privacy-as-property solution carries with it some serious disadvantages. Our society has a longstanding commitment to freedom of expression. Property rights in any sort of information raise significant policy and free speech issues. Facts are basic building blocks: building blocks of expression; of self-government; and of knowledge itself When we recognize property rights in facts, we endorse the idea that facts may be privately owned and that the owner of a fact is entitled to restrict the uses to which that fact may be put. That notion is radical. It is also inconsistent with much of our current First Amendment jurisprudence. Thus, the idea of creating property rights in personal data raises fundamental constitutional issues. If it looked likely that a property rights model would prove to be an effective tool for protecting personal data privacy, it might be worthwhile to balance the privacy and free speech interests to see which one weighed more⋯. [H]owever, a property rights model would be ineffective in protecting data privacy. It would, in all likelihood, make the problem worse.
155. Id.
156. see alsoo Richard Posner, The Right of Privacy, 12 GA. L. REV. 393, 397-401 (1978) (critiquing theories that favor personal property tights in private information);
157. Diane Leenheer Zimmerman, Infonnation as Speech, Information as Goods: Some Thoughts on Marketplaces and the Bill of Rights, 33 WM. & MARY L. REv. 665 (1992) (arguing that the increasing commodification of information potentially impinges on First Amendment freedoms);
158. Diane Leenheer Zimmerman, Is There a Right to Have Something to Say? One View of the Public Domain, 73 FORDHAM L. Ray. 297, 348-49 (2004) (discussing why it is risky to allow individuals to own the use of their life stories). Zimmerman stated: [F]rom the birth of the common law right of privacy, courts recognized that there is a downside to granting individuals control over how others can use information about them. It significantly strips others of the wherewithal to form their own ideas, utilize their own observations, and communicate about these things with friends, colleagues, and fellow citizens. The fear of this unconstitutional consequence is why broad newsworthiness rules have cabined the tort almost to the point of annihilation. This strongly suggests that the ability to use speech goods is a necessary element of what the First Amendment protects, and that, as a result, it is very risky to allow individuals to 'own' or control use of their life stories.
159. Id.
160. See, e.g., YouTube, supra note 93, ci. 7.B. It states: YouTube reserves the right to decide whether Content or a User Submission is appropriate and complies with these Terms of Service for violations other than copyright infringement, such as, but not limited to, pornography, obscene or defamatory material, or excessive length. YouTube may remove such User Submissions and/or terminate a User's access for uploading such material in violation of these Terms of Service at any time, without prior notice and at its sole discretion.
161. Id.
162. 47 U.S.C. § 230(c)(l) (2006) ("No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider.").
163. ZITTRAIN, supra note 2, at 218 (noting that a person's "friends" network online includes their "friends' friends' friends");
164. see Abril & Cava, supra note 18, at 255 ("The online social networking environment has brought about a sweeping change in its users' notions of intimacy, friendship, and confidentiality.").
165. See, e.g., James Grimmelmann, Saving Facebook, 94 IowA L. REv. 1137, 1154-56 (2009) (noting the shortcomings of the term "friend" in the online-networking context).
166. Id. at 1175 ("Facebook 'friends' include not just people we'd call 'friends' offline but also those we'd call 'acquaintances' (to say nothing of the Fakesters). Contact links are a mixture of what sociologists would call 'strong ties' and 'weak ties.'").
167. For example, Facebook's information on finding friends online states: "Your friends on Facebook are the same friends, acquaintances and family members that you communicate with in the real world." Facebook, Find Your Friends on Facebook, https://register.facebook.com/findfriends.php?ref-friends (last visited Feb. 18, 2010). Facebook also prohibits the use of aliases online so that people who think they are being contacted by someone they actually know are really being contacted by that person. For example, the User Conduct clause of Facebook's Terms of Use prohibits impersonating any person, falsely representing yourself and creating a false identity. Facebook, supra note 98.
168. Grimmelmann, supra note 107, at 1162-63.Facebook is great at making us feel like we know lots of people. ⋯ The pictures, names, and other informal touches make each contact look like a well-known friend. That's socially satisfying, but primate brains only seem capable of maintaining between one and two hundred close relationships at a time. Everyone else isn't a close friend, and that socially thick sense of mutual personal obligation that keeps confidences confidential doesn't always operate as strongly as we expect.
169. Id.
170. Craig Wilson, The Final Word: Sorry, Charlie,Imaginary Friends Come and Go, USA TODAY, June 9, 2009, http://www.usatoday.com/life/columnist/finalword/ 2009.06-09-final-word-N. htm (noting that "friends" on social-networking sites are very much like the imaginary friends of one's childhood days). Of course, the practical problems can potentially be greater on an open network that does not even attempt to limit dissemination of information to "friends."
171. Grimmehnann, supra note 107, at 1174 ("[A)s clay Shirky observes, "'[F]riend of a friend of a friend" is pronounced "stranger. "'" (second alteration in original)). One could argue that in the online world individuals have a responsibility to exercise more care than they currently do about who they befriend. The problem is that this is easier said than done. In the real world there are physical constraints on who can be befriended and how many friends one can make-in terms of time and geography. Additionally, in the physical world, one can glean more cues than in virtual space about whether the rewards of befriending someone outweigh the risks. These cues come from watching the person interact in real-world situations. In physical spaces, we also recognize different "levels" of friendship. We can thus repose less trust in someone we do not know very well. In the OSN context, however, the choice is effectively binary-someone is either your "friend," entitling them access to anything you post online, or they are not your friend, and therefore not entitled to access your online materials at all. SOL0VE, supra note 3, at 202 (noting that technologies like Facebook require a binary definition of the term "friend"-a "friend" is permitted access to your information but a non-friend is not-while a social network in the real world is much more complex). There are no gradations of friendship online, although there is no necessary technological impediment to developing such levels. A system could be developed in the future that would allow users to exercise discretion about who received what, and how much, information from them. This could be done by building more "levels of friendship" into OSN technologies. Thus, one could identify online peers as either "good friends,""friends," or " acquaintances" and differentiate levels of access to personal information accordingly. Abril & Cava, supra note 18, at 272 (suggesting the development of levels or "zones" of relationships in the context of private health information available online);
172. Grimmelmann, supra note 107, at 1172 (noting the generally binary nature of friendship online, but that technical architectures can develop to increase precision of connections online-although Grimmelmann himself is skeptical about the benefits of this approach).
173. Abril & Cava, supra note 18, at 267 ("Spotty enforcement and lack of mechanisms for dispute resolution further weaken the power of contract law online.").
174. Id. ("Website contracts are built on shifting sands. The professed ability of many operators to change terms of use at any moment and without prior notice leaves users in a constant state of uncertainty about their rights and privacy expectations."). This might also explain an unusual finding in a survey recently conducted by Professors Levin and Abril in which more college-student respondents said they "understand" an OSN's privacy policy than admitted to actually reading the privacy policy. Professors Levin and Abril suggest that this could mean that the recipients asswne they know what is in policies without actually reading them because they have general familiarity with terms that usually appear in these policies.
175. Avner Levin & Patricia Sanchez Abril, Two Notions of Privacy On1ine 11 VAND.J.ENT. & TECH. L. 1001, 1035 (2009).
176. Abril & Cava, supra note 18, at 267 ("[T]erms of use and privacy policies vary from website to website, making true understanding of each contract.., difficult and impracticable, especially since most users visit several websites a day.").
177. Id. ("Many user contracts are written abstrusely or in a legalistic style, dissuading even the most punctilious consumer from taking time out of her online pursuit to carefully read and understand them.").
178. See Levin & Abril, supra note 114, at 1010-17 (comparing American and European attitudes to privacy in terms of whether privacy is theoretically regarded as a "control" right or an aspect of human dignity);
179. SOLOVE, supra note 3, at 110-13 (comparing "libertarian" and "authoritarian" approaches to privacy).
180. Strahilevitz, supra note 27, at 1737. Strahilevitz suggests: [T]here will be settings in which the government can reduce the prevalence of unlawful discrimination by publicizing previously private information about individuals. For example, the best available empirical evidence suggests that publicizing criminal history information could reduce racial discrimination in the employment of blue-collar and service workers⋯. [A] similar strategy might reduce the prevalence of statistical discrimination in the prescription of narcotics and the pricing of automobile insurance premiums.
181. Id.
182. As in the dog-poop girl example. See supra text accompanying notes 2-5.
183. As in the AutoAdmit case, which involved the unauthorized posting of sexually explicit information about Yale students, one of whom alleged she lost a job offer as a result of the posting. Isaac Arnsdorf, AutoAdmit Case Moves Forward YALE DAILY NEws, Jan. 31, 2008, available at http://www.yaledailynews. com/articles/view/23231.
184. As in the Bus Uncle example. See supra text accompanying note 10.
185. As in the case of Star Wars kid. See supra text accompanying notes 6-9.
186. The first three issues are addressed infra Part III, while the final issue about the practicality of regulating for video privacy online is addressed infra Part IV, along with the discussion of a suggested framework for video-privacy regulation.
187. SOLOVE, supra note 3, at 105-10 (describing nineteenth.century approaches to privacy).
188. In fact, even Professor Solove's groundbreaking attempts to create a conception or taxonomy of privacy are not pinned down to one concrete, unifying theory. SOLOVE, supra note 40, at 105. Solove argues: My taxonomy's categories are not based upon any overarching principle. We do not need overarching principles to understand and recognize problems. ⋯ If we focus on the problems, we can better understand and address them. I aim to shift the approach to a bottom-up focus on problems that are all related to each other, yet not in exactly the same way.
189. Id.
190. see also Daniel Solove, Conceptualizing Privacy, 90 CAL. L. REv. 1087, 1129 (2002) ("[T]his Article advances an 'approach' to understanding privacy rather than a definition or formula for privacy⋯. My approach is from the bottom up rather than the top down because it conceptualizes privacy within particular contexts rather than in the abstract").
191. Solove, supra note 125, at 1129.
192. Id.
193. Jacqueline Lipton, Mapping Online P'dvacy, 104 Nw. U. L. REV. (forthcoming 2010).
194. Of course, there are costs and benefits to this approach. Organic development can fail to take into account the complex matrix of interests that need to be balanced, such as the need to balance free-speech interests against property interests and to distinguish different types of information speech and information property.
195. See, e.g., Zimmerman, Information as Speech, supra note 103. It is also possible that an organic approach might miss a critical period for regulatory decision-making after which regulations are difficult to implement and enforce, particularly if they would contradict entrenched social norms of behavior.
196. See Gaia Bernstein, The Parodoxes of Technological Diffusion: Genetic Discrimination and Internet Privacy, 39 CONN. L REv. 241, 249 (2006) (exposing instances when the interaction of privacy and technological diffusion underlie social tensions);
197. Bernstein, supra note 30, at 937 (discussing why timing is vital in combating the entrenchment of non-privacy norms). These articles are advocating an approach that allows some organic, incremental development while at the same time remaining sensitive to points at which legal regulation-or other regulatory approaches discussed infra Part IV-are -are necessary.
198. BEVERLY W.PATIISHALL, DAvID C. HILLLARD & JOSEPH N. WELCH II, TRADEMARKS AND UNFAIR COMPETITION DESKBOOK § 1.02 (2d ed. 2003).
199. See Mark A. Lemley, The Modern Lanham Act and the Death of Common Sense, 108 YALE L.J. 1687, 1693-94 (1999) (noting that in the context of U.S. law it is very difficult to find a rationale for treating trademarks as a form of property). This may be compared with jurisdictions like the United Kingdom and Australia where trademarks are explicitly defined as a form of personal property in the relevant legislation. Trade Marks Act, 1995, § 21(1) (Austl.) (specifically defining a "trade mark" as a personal property right);
200. Trade Marks Act, 1994, § 2(1) (U.K) ("A registered trade mark is a property right obtained by the registration of the trade mark under this Act and the proprietor of a registered trade mark has the rights and remedies provided by this Act.").
201. SeeJacqueline Lipton, Protecting Valuable Commercial Informahon in the Digital Age: Law, Policy, and Practice 6 J. TECH. L & P0L'Y 1, 9-15 (2001), available at http://grove.ufl.edu/~techlaw/vol6/issuel/lipton.html (comparing the theoretical treatment of trade secrets in different jurisdictions, including Australia, the United Kingdom, and the United States).
202. For example, in some contexts domain names have been regarded as a form of intangible personal property. 15 U.S.C. § 1125(d) (2) (A) (2006) (allowing in rem proceedings against domain names as property in certain circumstances);
203. Kremen v. Cohen, 337 F.3d 1024, 1024-30 (9th Cir. 2003) (treating domain names as property for the purposes of California's conversion law);
204. see also MILTON L MUELLER, RULING THE ROOT: INTERNET GOVERNANCE AND THE TAMING OF CYBERSPACE 58-61 (2002) (discussing the nature of claims to property rights in domain names). In other contexts, domain names are regarded as the object of a contractual license with a registering authority.
205. See Network Solutions, Inc. v. Umbro Int'l, Inc., 529 S.E.2d 80, 86 (Va. 2000) (refusing to regard domain names as a new form of property for the purpose of garnishment proceedings).
206. Arbitral decisions on domain names are actually very common under the Uniform Domain Name Dispute Resolution Policy incorporated by reference into many domain name contracts. Internet Corporation for Assigned Names and Numbers, Uniform Domain Name Dispute Resolution Policy, http://www.icann.org/en/udrp/ udrp-policy-24oct99.htm (last visited Feb. 18, 2010).
207. SOL0VE, supra note 40, at 24-29 (critiquing property-based theories of privacy); Litman, supra note 102, at 1288-94 (describing various theories of private information as property).
208. See Litman, supra note 102, at 1294-95 (arguing that the increasing commodification of information potentially impinges on First Amendment freedoms); Zimmerman, Informadon as Speech, supra note 103, 665-68 (same);
209. Zimmerman, The Public Domain, supra note 03, at 310, 348-49 (same).
210. In a federal system, the propertizanon of information can raise constitutional questions about which level of government has legislative competence to enact relevant laws. Perhaps even more significantly, some have argued that no government may have constitutional competence to recognize or create property rights in factual personal information because of potential encroachments on First Amendment freedoms.
211. See SOLOVE, supra note 3, at 129-32 (describing problems in attempting to balance privacy torts with the idea of free speech);
212. Eugene Volokh, Freedom of Speech and Information Privacy: The Troubling Implications of a Right to Stop People from Speaking About You, 52 STAN. L REV. 1049, 1060-61 (2000) (suggesting that toruous approaches to protecting privacy cannot be reconciled with the First Amendment, but that contractual approaches may avoid this criticism);
213. Zimmerman, The Public Domain, supra note 103, at 298, 312, 366-69 (arguing in favor of a mandatory public domain, which may encroach on the government's ability to create property rights that would interfere with the public domain of information and ideas);
214. Diane Zimmerman, Requiem for a Heavyweight: A Farewell to Warren and Brandeis's Privacy Tort, 68 CORNELL L REV. 291, 306-20 (1983) (suggesting that torts prohibiting true speech cannot be reconciled with the First Amendment).
215. A. Michael Froomkin, The Death of Privacy?, 52 STAN. L REV.'. 1461, 1502-03 (2000) (noting that the value of a piece of data in a consumer's hands is much less than the value of the aggregated data about many consumers in a data aggregator's hands).
216. See, e.g., Jacqueline Lipton, Balancing Private Rights and Public Policies: Reconceptualizing Property Rights in Databases 18 BERKELEY TECH. L.J. 773, 776 (2003) (suggesting that property interests in databases should benefit those that 'invested time, effort, or financial resources in creating the database);
217. Jerome Reichman & Pamela Samuelson, Intellectual Property Rights in Data?, 50 VAND. L REv. 51, 54 (1997) (discussing how databases need protection from free- riding competitors).
218. Froomkin, supra note 137, at 1502-03.
219. Ann Bartow, Our Data, Ourselves: Privacy, Propertization, and Gender, 34 U.S.F. L REV. 633,687 (2000). Bartow stated:Simply put. if information about us is to be bought and sold, the initial purchase should be from us, since we are the ultimate content providers. If intangible property rights are rewards for the effort expended in creating the thing to be protected, we are entitled to ownership of our personal information.
220. Id.
221. There may be a justification for imputing a property right to the OSN provider in respect of its meta-collection of data on the grounds that OSN operators do utilize this data for commercial purposes. However, even that argument is tenuous in situations where an OSN does not transact with the data per se, but rather utilizes its vast user base as an incentive to attract advertisers. This may be changing in practice. Recent attempts at social-ad programs by some OSNs do utilize specific data about individuals and their online relationships with friends to better target advertising to their users. Posting of Megan McCarthy to Epicenter, http://blog.wired.com/business/2008/O1/ facebook-ads-ma.html (Jan. 2, 2008, 3:20 pm);
222. Posting of William McGeveran to Info/Law. http://blogs.law.harvard.edu/ infolaw/2007/11/08/facebook-social-ads/ (Nov. 8,2007).
223. In fact, Professor Charles Fried implicitly accepted the proprietary nature of privacy in the context of interpersonal relationships where the privacy right would have no real economic value, but only social value. Charles Fried, Privacy, 77 YALE L.J. 475. 487 (1968) (describing privacy as a form of "moral capital for personal relations" and referring to holding "title" to information about oneself).
224. Courtney C. Tedrowe, Conceptual Severance and Takings in the Federal Circuit, 85 CORNELL. L. REv. 586, 591 (2000) (identifying classic property rights as including rights of exclusion, disposition, and use).
225. For example, details of a credit card or postal address are required for payment or shipping purposes.
226. See Jerry Kang, Information Privacy in Cyberspace Transactions, 50 STAN. L REv. 1193, 1198 (1998) (describing how, in a visit to a mall, pinpoint information about a person's movements and identity is not recorded-with the exception of credit card purchases).
227. See id. (contrasting how "in cyberspace, the exception becomes the norm").
228. Bartow, supra note 140, at 704 ("Once I own my own data, I personally look forward to formulating a reverse 'click-wrap' license, whereby any enterprise that wants me to visit its web site will have to agree to MY list of terms and conditions ⋯").
229. Maybe such arguments would be justified on the basis of unjust enrichment. In other words, data-aggregating businesses are unjustly enriched by individuals if they can put together valuable consumer profiles using information "belonging to" consumers without compensating them for it. However, this analysis assumes the existence of an underlying property or quasi-property right in the plaintiffs personal information, so it is again circular. Andrew Kull Rationalizing Restitution, 83 CAL. L. REv. 1191, 1214 (1995). Kull stated: Restitution can be seen as an aspect of the legal protection of property, and many instances of what the law characterizes as unjust enrichment might be described by saying that the defendant has received property of the plaintiff by means of a transfer that was legally ineffective to convey ownership.
230. Id.
231. SOLOVE, supra note 40, at 29-34 (critiquing 'personhood" theories of privacy); Abril, supra note 64, at 7-8 ("[O]thers have defined privacy in terms of personhood, intimacy,secrecy.");
232. Fried, supra note 142, at 483 (describing privacy as an "aspect of personal liberty");
233. Solove, supra note 125, at 1116-21 (discussing personhood theories of privacy);
234. Daniel J. Solove, "I've Got Nothing to Hide" and Other Misunderstandings of Privacy, 44 SAN DIEGO L.REV.745, 760-61 (2007) (noting that many theories of privacy view the notion of privacy as individual right related to protecting the individual's personal dignity).
235. See Jacqueline Lipton, Celebrity in Cyberspace: A Personality Rights Paradigm for Personal Domain Name Disputes 65 WAsH. & LEE L. REV. 1445, 1488 (2008) (explaining the right publicity as one based on both property theory and personhood).
236. See, e.g., Alice Haemmerli, Whose Who? The Case for a Kantian Right of Publicity, 49 DUKE L.J. 383, 392-411(1999) (explaining the confusion surrounding the right of publicity);
237. Mark P. McKenna, The Right of Publicity and Autonomous Self-Definition, 67 U. Prrr. L REv. 225, 225-32(2005) (discussing the right-of-publicity context).
238. SOLOVE, supra note 40, at 105. Solove stated: My taxonomy's categories are not based upon any overarching principle. We do not need overarching principles to understand and recognize problems⋯ If we focus on the problems, we can better understand and address them. I aim to shift the approach to a bottom-up focus on problems that are all related to each other, yet not in exactly the same way. If we study the problems together, we can better understand the entire cluster.
239. Id. see also Lipton, supra note 127.
240. Bernstein, supra note 30.
241. Scott McNealy, CEO of Sun Microsystems, said famously in 1999: "You have zero privacy ⋯. Get over it." Polly Sprenger, Sun on Privacy: 'Get Over It WiRED, Jan. 26, 1999, http://www.wired.com/po1itics/1aw/news/1999/ O1/17538 (last visited Feb. 18, 2010).
242. DAVID BRIN, THE TRANSPARENT SOCIETY: WILL TECHNOLOGY FORCE Us TO CHOOSE BETWEEN PRIVACY AND FREEDOM? (1998);
243. SOLOVE, supra note 16, at 73-74;
244. Strahilevitz, supra note 27, at 1668 (arguing that basing decisions on real information, rather than dangerous and discriminatory proxies such as race, actually provides social benefits overall).
245. BRIN, supra note 155
246. Strahilevitz, supra note 27 (arguing that basing decisions on real information rather than dangerous and discriminatory proxies such as race actually provides social benefits overall);
247. Volokh, supra note 136, at 1120 (arguing that the government should not use privacy torts as a proxy for anti-discrimination laws).
248. Lior Strahilevitz, A Social Networks Theory of Privacy, 72 U. CHI. L. REV. 919, 928 (2005) ("[D]issemination [of personal information] can also help the public understand existing social norms. Indeed, gossip is often central in theories of social norm enforcement and change.").
249. SOLOVE, supra note 16, at 97 ("[T]he invasion conception's focus on privacy invasions as harms to specific individuals often overlooks the fact that certain privacy problems are structural-they affect not only particular individuals but society as a whole.").
250. See e.g., Camera Phone Predator Alert Act, H.R. 414, 111th Cong. (2009) (requiring all cellular phones manufactured one year after the passage of the Act to make noise when the user takes a picture in order to protect the privacy rights of children);
251. CAL. CIV. CODE § 1708.8(b) (West 2009). The California Civil Code states: A person is liable for constructive invasion of privacy when the defendant attempts to capture, in a manner that is offensive to a reasonable person, any type of visual image, sound recording, or other physical impression of the plaintiff engaging in a personal or familial activity under circumstances in which the plaintiff had a reasonable expectation of privacy, through the use of a visual or auditory enhancing device, regardless of whether there is a physical trespass, if this image, sound recording, or other physical impression could not have been achieved without a trespass unless the visual or auditory enhancing device was used.
252. Id.
253. This problem arguably has more resonance for the United States than some other jurisdictions. In Europe, for example, both the right to privacy and the right to free expression are enshrined as basic human rights that must be balanced against each other. See Council of Europe, Convention for the Protection of Human Rights and Fundamental Freedoms arts. 8, 10, Nov. 4, 1950, 213 U.N.T.S. 221 (describing guaranteed rights to privacy and freedom of expression). The United States, on the other hand, has no express constitutional guarantee of a right to privacy unlike the right to free speech which is enshrined expressly in the First Amendment.
254. Volokh, supra note 136, at 1051 ('While privacy protection secured by contract is constitutionally sound, broader information privacy rules are not easily defensible under existing free speech law.");
255. Id. at 1122 ("[R]estrictions on speech that reveals [sic] personal information are constitutional under current doctrine only if they are imposed by contract, express or implied."). Professor Zimmerman has also argued against the constitutionality of privacy tort law on free-speech grounds. Zimmerman, supra note 136, at 320-41.
256. See infra Part W.A.5 (discussing the possible use of contracts and breach-of-confidence actions to enhance online privacy).
257. For a contrasting view, see Dawn Nunziato, The Death of the Public Forum in Cyberspace,20 BERKELEY TECH. U. 1115, 1121-28 (2005) (expressing concern that the increasing control of public forums for speech in private hands, such as OSN providers, will curtail meaningful First Amendment scrutiny and lead to arbitrasy decisions about what kinds of speech are available online).
258. MILLS, supra note 28, at 306.
259. Id.
260. See Lawrence Lessig, The Architecture of Privacy, 1 VAND. J. ENT. L. & PRAC. 56, 62-63 (1999) (identit,ing problems in current privacy protection in cyberspace and recommending a new, multiniodal approach).
261. Lawrence Lessig, The Law of the Horse: What Cyberlaw Might Teach, 113 HARV. L REv. 501, 507 (1999). The author states: Law ⋯ orders people to behave in certain ways; it threatens punishment if they do not obey. The law tells me not to buy certain drugs, not to sell cigarettes without a license, and not to trade across international borders without first ffling a customs form. It promises strict punishments if these orders are not followed. In this way, we say that law regulates.
262. Id.
263. Id. Lessig discusses: Norms control where I can smoke; they affect how I behave with members of the opposite sex; they limit what I may wear; they influence whether I will pay my taxes. Like law, norms regulate by threatening punishment ex post. But unlike law, the punishments of norms are not centralized. Norms are enforced (if at all) by a community, not by a government. In this way, norms constrain, and therefore regulate.
264. Id. Not all norms will threaten punishment for disobedience. Some norms can be maintained without any penalty for violation. Strandburg, supra note 33, at 1246-49 (discussing that "coordination norms" can be maintained without imposing sanctions for noncompliance because individuals have no incentive to deviate from norms that depend on a large group of people performing the same action in the same way "epistemic norms" do not require sanctions because individuals conform to these norms as a means of economizing information costs so there is no incentive for others to enforce the norms against individuals).
265. Lessig. supra note 167, at 507 ("Markets, too, regulate. They regulate by price. The price of gasoline limits the amount one drives-more so in Europe than in the United States. The price of subway tickets affects the use of public transportation-more so in Europe than in the United States.").
266. Id. at 507-09. Lessig finds that [T]here is a fourth feature of real space that regulates behavior-"architecture." By " architecture" I mean the physical world as we find it, even if "as we find it" is simply how it has already been made. That a highway divides two neighborhoods limits the extent to which the neighborhoods integrate. That a town has a square, easily accessible with a diversity of shops, increases the integration of residents in that town. That Paris has large boulevards limits the ability of revolutionaries to protest. That the Constitutional Court in Germany is in Karlsruhe, while the capital is in Berlin, limits the influence of one branch of government over the other. These constraints function in a way that shapes behavior. In this way, they too regulate.
267. Id. (emphasis omitted).
268. Id.at 508.
269. Id. at 507. Subsequent literature demonstrates that norms are actually more complex than this and that there are various different kinds of norms that operate in different ways. See generally Strandburg, supra note 33 (discussing several norms and the ways in which they operate). However, for the purposes of this discussion, Lessig's definition will suffice.
270. Lessig, supra note 167, at 507.
271. Strandburg, supra note 33, at 1248 ("Social norms often play a more important role than legal regulation.").
272. Id. ("When social norms are feasible they can be quite effective. Though the informal penalties for violating social norms may be less severe than the penalties available under the law, the likelihood of being penalized may be quite high.").
273. Lessig, supra note 167, at 507.
274. See Lessig, supra note 166, at 62 (analogizing online firms to firms in the physical world). Of course, Professor Lessig here may have been contemplating privacy protections for customers of service providers who are more likely to be posters of private information than victims of unauthorized postings of private information by others. However, this would depend upon the scope and nature of the privacy policy promulgated by a given online service provider. Where an online service provider offered to protect privacy of both posters and subjects of information and images, more people may be drawn to that service provider because of the signals the service provider gives about being a generally good online corporate citizen. Some online service providers do currently at least purport to protect the privacy of third parties as well as their own customers-see discussion of relevant terms of use in Parts II.B and IV.A.5.
275. Lessig, supra note 167, at 507-08.
276. LAWRENCE LESSIG, FREE CULTURE 122 (2004). Lessig stated: A fallen bridge might constrain your ability to get across a river. Railroad tracks might constrain the ability of a community to integrate its social life. As with the market, architecture does not effect its constraint through ex post punishments. Instead, also as with the market, architecture effects its constraint through simultaneous conditions.
277. Id. SoLovE, supra note 16, at 98-99 (giving examples of ways in which physical architectures can constrain behavior).
278. Lessig, supra note 167, at 509 ("[T]he architecture of cyberspace, or its code regulates behavior in cyberspace. The code, or the software and hardware that make cyberspace the way it is, constitutes a set of constraints on how one can behave.").
279. LESSIG, supra note 179, at 123 ("[T]he first point about these four modalities of regulation is obvious: They interact. Restrictions imposed by one might be reinforced by another. Or restrictions imposed by one might be undermined by another.");
280. see also Froomkin, supra note 137, at 1466 ("While there may be no single tactic that suflices to preserve the status quo, much less regain lost privacy, a smorgasbord of creative technical and legal approaches could make a meaningful stand against what otherwise seems inevitable.");
281. Lessig, supra note 166, at 63-64 (suggesting a combined architecture-market solution to protecting privacy online that relies in part on use of the Platform for Privacy Preferences ("P3P") designed by the World Wide Web Consortium ("W3C"));
282. Lessig, supra note 167, at 511-34.
283. SOLOVE, supra note 3, at 203-04;
284. Lilian Edwards & Ian Brown, Data Control and Social Netwoking Irreconcilable Ideas?, in HARBORING DATA: INFORMATION SECURI1Y, LAW, AND THE CORPORATION 202,222 (Andrea M. Matwyshyn ed.. 2009).
285. Richards, supra note 36, at 420 (discussing the American Libraries Association's role of protecting patrons' rights and freedoms in the library bill of rights in 1939 as an example of an institution playing a regulatory role in promoting individual privacy).
286. The Electronic Frontier Foundation describes itself as "the leading civil liberties group defending your rights in the digital world." Electronic Frontier Foundation, http://www.eff.org/ (last visited Feb. 18,2010).
287. The Electronic Privacy Information Center describes itself as "a public interest research center in Washington, D.C. It was established in 1994 to focus public attention on emerging civil liberties issues and to protect privacy, the First Amendment, and constitutional values." Electronic Privacy Information Center, About EPIC, http://www.epic.org/epic/about. html (last visited Feb. 18, 2010). The identification of new forms of regulatory modality is not inconsistent with Professor Lessig's work-he did not intend for his four regulatory modalities to be the last word on cyberspace regulation. LESSIG, supra note 179. at 123 ("Whether or not there are other constraints (there may well be; my claim is not about comprehensiveness), these four are among the most significant ⋯").
288. See infra Part 1V.F (discussing institutions as privacy regulators).
289. Fried, supra note 142, at 493.
290. LESIG, supra note 179, at 121 ("Law is the most obvious constraint (to lawyers, at least).").
291. PALFREY & GASSER, supra note 28, at 76 (noting that law cannot solve online privacy problems by itself).
292. In contrast, some have argued that it is necessary for decision-makers, including legislatures, to act before social norms have developed because failure to do so may result in an inability to effectively regulate consistently with norms where the need arises. Bernstein, sup-a note 30, at 943-46 (including a discussion of entrenchment of anti-privacy norms on the Internet in the context of electronic commerce).
293. SOLOVE, supra note 3, at 193 ('There is ⋯ a limit to how much the law can do. The law is an instrument capable of subtle notes, but it is not quite a violin.").
294. Id. at 187. Professor Abril has also noted that, while many traditional privacy laws are premised on a distinction between public and private conduct, this distinction has become increasingly blurred in the digital infonnation age, which has caused expectations of privacy to become unstable and difficult to ascertain. Abril. supra note 64, at 5-6;
295. see also ZITTRAIN, supra note 2, at 212 ('Even the use of 'public' and 'private' to describe our selves and spaces is not subtle enough to express the kind of privacy we might want [online].");
296. Id. at 216 ('Peer- leveraging technologies are overstepping the boundaries that laws and norms have defined as public and private, even as they are also facilitating beneficial innovation.").
297. SOLOVE, supra note 3, at 187;
298. see Richards & Solove, supra note 40, at 135-38 (discussing confidential relations).
299. SOLOVE. supra note 3, at 188.
300. See LESSIG, supra note 179, at 130 (noting that "the net effect of this massive increase in protection will be devastating to the environment for creativity");
301. Pamela Samuelson, The Copyright Grab, WIRED,Jan. 1996, available at http://www.wired.com/wired/archive/4.O1/white. paper⋯pr.html (discussing the maximalist agenda).
302. See SOLOVE, supra note 3, at 185 ('Copyright and privacy are both ways of controlling information.").
303. Id. at 184-86.
304. Id. at 184. The author considers: Is control over information really feasible? If we expose infonnation to others, isn't it too difficult for the law to allow us still to control it? Perhaps the law is reticent about granting control because of the practical difficulties. Information spreads rapidly, sometimes like a virus, and it is not easily contained.
305. Id.
306. Id. at 185 ("The copyright system focuses on the use of information-it allows certain uses and prohibits others. And it does so regardless of whether the information has been publicly exposed.").
307. Id. ("[C]opyright law provides protection even when a work can be readily copied. I don't have to take any steps to protect my work.").
308. Legitimate uses might include those traditionally associated with copyright law, such as news reporting on matters of public interest and some nonprofit educational uses. In the privacy context, certain kinds of data aggregation might also be legitimate uses if the state implements appropriate safeguards against unauthorized privacy invasions. See generally Whalen v. Roe, 429 U.S. 589 (1977) (upholding a law requiring computerized data aggregation of information relating to the prescription of certain medications and acknowledging that the state implemented appropriate information-security safeguards).
309. Professor Solove notes that copyright law provides liability when third parties facilitate a copyright violation. SOLOVE, supra note 3, at 185.
310. For example, the European Union and United States take very different approaches to privacy. The E.U. approach is largely codified in Directive 95/46/EC of the European Parliament and of the Council of October 24, 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "Data Protection Directive"). The United States, on the other hand, takes a more piecemeal approach to private data protection. RAVA1OND S.R. Ku &JACQUELINE D. LIPTON, CYBERSPACE LtW: CASES AND MATERIALS 544 (2d ed. 2006) ("[T]o date, the United States largely relies upon unfair and deceptive business practice law and self-regulation [to protect privacy]. In contrast, other nations, and most notably, the European Union have taken more aggressive steps to protect individual privacy in data collection.").
311. For example, 17 U.S.C. § 512 (2006) allows copyright holders to seek identifying information about alleged copyright infringers from third-party service providers.
312. See also In re Vernon Internet Servs., Inc., 257 F. Supp. 2d. 244, 246 (D.D.C. 2003) (noting that an Internet service provider challenged a subpoena served on it by the Recording Industry Association of America seeking identifying information for alleged copyright infringers utilizing the ISP's services).
313. SOL0VE, supra note 3, at 184-85 (noting that copyright law will provide remedies even when the source exposes information to the public and the information holder is not protected against potential viral distribution).
314. 17 U.S.C. § 512(c) (2006).
315. Id. The privacy analog to this would be section 230 of the Communications Decency Act of 1996, effectively immunizing ISPs for tort liability for speech posted by others utilizing their services. 47 U.S.C. § 230 (2006).
316. See, e.g., MICHELE BOLDRIN & DAVID K. LEVINE, AGAINST INTELLECTuAl.. MONOPOLY 108-10 (2008) (describing abuses of notice-and-takedown procedure by powerful corporate copyright holders);
317. (finding data that reveals "an unfortunately high incidence of questionable uses of the [takedown] process" in copyright-infringement law).
318. U.S. CONST. art. I, § 8, cI. 8 (granting Congress the power "[t]o promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries").
319. Limited privacy rights have been implied into various constitutional clauses, but there is no express grant of power for Congress to protect privacy. DANIEL J. SOLOVE, MARC ROTENBERG & PAul.. M. SCHWARTZ, INFORMATION PRiVACY Law 33 (2d ed.) ("Although the United States Constitution does not specifically mention privacy, it has a number of provisions that protect privacy, and it has been interpreted as providing a right to privacy.").
320. BOLDRIN & LEVINE, supra note 208, at 108-20;
321. LESSIG, supra note 179, at 161; Samuelson, supra note 195.
322. Of course, even digital copyright law has been bolstered in many respects by contract law and technical standards. Michael J. Madison, Legal-Ware: Contract and Copyright in the digital Age; 67 FORDHAM L. REV. 1025, 1111-43 (1998) (discussing uses of contractual and technological measures with copyright law in attempts by copyright holders to protect their rights online). This is another example of an important and necessary interaction between distinct regulatory modalities-contract, architecture (technology), and law. Privacy-law advocates considering these interactions today have an opportunity to achieve a better balance of interests in the wake of some of the arguable failures of digital copyright law.
323. See Dennis D. Hirsch, Protecting the Inner Environment: What Privacy Regulation Can Learn from Environmental Law, 41 GA. L REV. 1, 10 (2006) ("[E]nvironmental laws and policies can serve as a model for protecting privacy in the Digital Age.");
324. (unpublished work, on file with the author) (discussing how security-breach-notification laws can create an incentive for business "to better secure personal information" and for consumers to support "privacy protective behaviors" based on the EPA database about toxic emissions by companies).
325. Hirsch, supra note 213, at 8;
326. Jonathan Remy Nash, Framing Effects and Regulatoiy Chaise, 82 N0TRE DAME L REV. 313, 320 (2006) (explaining command-and-control regulatory approach in the environmental context as a government setting a particular standard with which targeted actors are required to comply).
327. Hirsch, sup-a note 213, at 8.
328. See generally American Clean Energy and Security Act of 2009, H.R. 2454, 111th Cong. (2009) (describing the program).
329. See Stephanie L Wilson, Dog Days of Climate Change: Heating the Debate for Federal Cap-and-Trade; 28 J. LAND RESOURCES & ENVIL. L. 163, 165 (2008) (describing the "cap" as"a mandatory limit on emissions from a group of polluters, such as power plants, to a level lower than current emissions").
330. See Id. at 166 (discussing how industries respond to cap and trade). Wilson states: In a perfect situation, regulators' [sic] would know exactly how much it would cost each facility to reduce emissions and would be free to classify among sources based on cost considerations. This would allow regulators to set emissions limits for each facility at the level that enables the overall target to be accomplished at minimum cost. In reality, this information is unknown. A cap-and-trade program overcomes this problem by letting the market generate the configuration of emissions levels across facilities.
331. Id. (emphasis omitted).
332. See Id. at 165-66 (explaining how industries trade allowances). Wilson states: Industries covered by the cap-and-trade program can buy and sell allowances from other entities also covered by the program. A facility will buy additional allowances if the price of the allowances is less than it costs to meet the required reduction. Conversely, a facility will sell allowances if they could reduce emissions more cheaply without the use of additional allowances, generating a profit. The cost of cutting emissions to meet the allowance limits is not the same for each regulated entity. Some plants may have more efficiently run operations, so the trading aspect of a cap-and-trade program offers economically advantageous results that cannot be matched in a mandatory scheme where all are obligated to meet the requirement no matter what the cost.
333. Id.
334. Hirsch, supra note 213, at 23 ("The privacy injuries of the Information Age are structurally similar to the environmental damage of the smokestack era. Two key concepts that have been used to understand environmental damage-the 'negative externality' and the 'tragedy of the commons'-also shed light on privacy injuries.");
335. Id. at 63 (identifying other similarities between environmental regulation and information regulation, including the fact that market players regulated by both areas of law "undergo rapid change, face stiff competition, and have the capacity for socially beneficial innovation").
336. The kinds of technologies that legislation might impose on OSN services in this respect are taken up in more detail infra Part lV.A.6.
337. See supra Part fl.A.2 (discussing limitations such as the inapplicability of tort laws when the subject of a photo or video originally consented, in peer contexts, and when there is no commercial profit motive).
338. RESTATEMENT (SECOND) OF TORTS § 652A-E (1997). The four torts are: (1) intrusion into seclusion; (2) public disclosure of private facts; (3) false light publicity and (4) misappropriation.
339. Id.
340. See generally Volokh, supra note 136 (suggesting that tortious approaches to protecting privacy cannot be reconciled with the First Amendment, but that contractual approaches may avoid this criticism);
341. Zimmerman, supra note 136 (suggesting that torts prohibiting true speech cannot be reconciled with the First Amendment).
342. See RESTATEMENT (SECOND) OF TORTS § 652D (1977) ("One who gives publicity to a matter concerning the private life of another is subject to liability to the other for invasion of his privacy, if the matter publicized⋯ (a) would be highly offensive to a reasonable person, and (b) is not of legitimate concern to the public.").
343. Abril. supra note 64, at 28.
344. Id. at 2 ("[P]rivacy is usually a function of the physical space in which the purportedly private activity occurred.");
345. Id. at 3 ('Traditionally, privacy has been inextricably linked to physical space.").
346. See Id. at 4 (explaining that concepts of physical space are no longer relevant in analyzing modem online privacy harms).
347. Id.at47.
348. Id.
349. Abril, supra note 64, at 47.
350. See RESTATEMENT (SECOND) OF TORTS § 652C (1977) ("One who appropriates to his own use or benefit the name or likeness of another is subject to liability to the other for invasion of his privacy.").
351. See 1 LALONDE, GREEN & GIL50N, sup-a note 61, § 28.01 ("The right of publicity is the right of [an individual) to control the commercial use of his or her name, visual likeness, signature symbol, or other personal characteristics.");
352. see also MILLS, supra note 28, at 173-77 (discussing technical differences between the privacy-misappropriation tort and the right-of- publicity tort).
353. See SOLOVE, supra note 3. at 187 ("The appropriation tort would rarely apply to the discussion on the Internet of people's private lives or the posting of their photos."). Of course, it is arguable that the OSN provider's complicity in the posting might amount to financial-profit motives if the OSN provider is deriving financial profit from advertising related to the online posting of video content. This proposition remains to be tested.
354. See Id. ("The appropriation tort might be expanded to encompass a broader set of problematic uses of information about a person⋯.").
355. Id.
356. MILLS, supra note 28, at 53-54 (describing additional privacy problems raised by the availability of court records on the Internet);
357. see also Mosley v. News Group Newspapers Ltd, [2008] EWHC (QB) 1777, [2008] E.M.L.R. 20, [230] (Eng.) ("[O]nce privacy has been infringed, the damage is done and the embarrassment is only augmented by pursuing a court action.").
358. Such contracts are generally upheld in the online context. See e.g., Caspi v. Microsoft Network, L.L.C., 732 A.2d 528, 532 (Nj. Super. Ct. App. Div. 1999) (finding ISP forum- selection clause enforceable).
359. RESTATEMENT (SECOND) OF TORTS § 46 (1977).
360. SOLOVE, supra note 3, at 120 ('[C]ourts in many European countries are more willing to allow people to conceal their identities when suing, thus protecting plaintiffs from bringing more attention to the gossip they are trying to stop.");
361. Id. at 121 ("More people should be allowed to sue without having their real names appear in the record. This would allow people to seek a remedy for the spread of information about them without having to increase the exposure of the information.").
362. Mosky, [2008] E.M.L.R. 20, [230] ("Claimants with the degree of resolve (and financial resources) of Mr Max Mosley are likely to be few and far between.").
363. See Lipton, supra note 127 (making this argument).
364. SOLVE, supra note 16, at 214 (giving examples of relationships of confidence protected by legal rules, including attorney-client, priest-penitent, husband-wife, and psychotherapist-patient).
365. As early as 1968, for example, Professor Charles Fried noted the importance of focusing on privacy expectations within personal relationships. Fried, supra note 142, at 482 ("In general it is my thesis that in developed social contexts love, friendship and trust are only possible if persons enjoy and accord to each other a certain measure of privacy.").
366. See Abril & Cava, supra note 18, at 268. Abril and Cava explained: Online, express confidentiality agreements are a more tenable solution. Facilitated through available technology, confidentiality agreements between users could assure a higher level of protection for those sharing private and personal information. In some instances, confidentiality agreements have been offered through online health ISPs as a prerequisite to membership. PatientsLikeMe.com includes such a clause as part of its terms of use. It states: "You agree not to disclose to any person or entity personally identifiable information about other members that you learn using this Site (whether posted in the Member Area by a member or emailed to you by a member) without the express consent of such member. You may disclose information of a general nature (that could not identify the member who provided such information or whom such information is about) to third parties outside this Site, subject to the above restriction on non-commercial use."
367. Id. (citation omitted).
368. Id. at 276. Abril and Cava explained: Cyber-patients have the duty of confidentiality to fellow patients. All information disclosed on health networking websites is privy and not to be divulged or otherwise disseminated. Users should not disclose any information obtained through the website unless specifically authorized. Similarly, disclosing cyber patients should be as clear as possible regarding the level of confidentiality they expect. Cyber-patients have the duty to obtain the consent of family members and others whose health information they disclose. Relevant information regarding the health of family members is a vital part of a complete medical record. However, cyber-patients must understand these individuals also have rights to privacy in their health information. Cyber-patients must, therefore, obtain the informed consent of their family members before posting such information on the website.
369. Id.
370. McClurg, supra note 12, at 888.
371. Id. at 887-88 (giving examples of online text.based and video disseminations of confidential information).
372. Volokh, supra note 136, at 1062. Volokh explains: I certainly do not claim that a contractual approach to information privacy, even with a large dollop of implied contract, is a panacea for information privacy advocates ⋯ . I claim only that contractual solutions are a constitutional alternative and may be the only constitutional alternative, not that they are always a particularly satisfactory alternative.
373. Id. Zimmerman, supra note 136, at 362-63 (suggesting looking into contractual solutions for protecting privacy rather than tort law).
374. Volokh, supra note 136, at 1061.
375. Id.at 1063.
376. See Richards & Solove, supra note 40, at 182 (arguing that confidentiality is an integral aspect of privacy that only breach.of-confidence actions can adequately protect).
377. SOLOVE. supra note 40, at 137 ("England, which rejects Warren and Brandeis's privacy torts, recognizes a breach-of-confidence tort. Unlike the American version. which applies only in a few narrow contexts, the English tort applies much more generally and extends even to spouses and lovers.");
378. Richards & Solove, supra note 40, at 158-60.
379. Campbell v. MGN Ltd [2004] UKHL 22, [2004] 2 A.C. 457,464-65 (appeal taken from Eng) (U.K.). The House of Lords explained: [The breach of confidence] cause of action has now firmly shaken off the limiting constraint of the need for an initial confidential relationship. .. Now the law imposes a 'duty of confidence' whenever a person receives information he knows or ought to know is fairly and reasonably to be regarded as confidential.
380. Id.
381. See Lipton, supra note 127 (discussing the changing relationships between the parties involved in privacy-threatening conduct).
382. Richards & Solove, supra note 40. at 178-81.
383. This is an extension of the idea of drawing on the environmental- regulation model to encourage markets, and in this case individuals as well, to behave in a particular way.
384. Edwards & Brown, supra note 182, at 224 (describing how the Directive on Privacy and Electronic Communications in the European Union could be used to promote default privacy settings (citing Council Directive 2002/58, Directive on Privacy and Electronic Communications, 2002 O.J. (L 201) 37 (EC), available at http://eur-lex.europa.eu/pri/en/oj/dat/2002/L201/L20120020731en00370047.pdf)) . Professors Edwards and Brown suggest that legislating mandatory privacy default settings may prove more effective in protecting individual privacy than leaving the market to its own devices.
385. Id.
386. This is effectively what many closed networks do now. Facebook, for example, does not let a user access another's profile unless the second user accepts the first as a "friend."
387. Of course, for privacy-protection purposes, this would require permission of the image subject as well as potentially the image owner, which could be unwieldy in practice.
388. See, e.g., Danielle Keats Citron, Law's Expressive Value in Cimbating Qyber Gender Harassment, 108 MIcH. L. REv. 373, 404 (2009) (discussing the "expressive role" law could play in the area of cyber gender harassment);
389. Fried, supra note 142, at 493 ("By using the public, impersonal and ultimate institution of law to grant persons this control, we at once put the right to control as far beyond question as we can and at the same time show how seriously we take that right.").
390. Lee Tien, Cheap Surveillance, Essential Facilities, and Pirivacy Norms, 1999 STAN. TECH. L REV. VS 10 1 7, available at http://sdr.stanford.edu/STLR/ Symposia/Privacy/99-VS-10/ fsarticle.htm ("Because of its power, government generally can affect social norms.").
391. Of course, there are some more "foundational" things that law can do that are not discussed here because they are not likely to take hold in the United States. The obvious example is an express constitutional guarantee of privacy, such as that adopted in Europe under Article 8 of the European Convention on Human Rights.
392. SOLOVE, supra note 40, at 93 ("One of the primary ways that society intervenes in people's lives is through the enforcement of norms.").
393. Robert C. Ellickson, The Evolution of Social Norms: A Perspective from the Legal Academy, in SOCIAL NORMS 35, 35 (Michael Hechter & Karl-Dieter Opp eds., 2001);
394. see also Lessig, supra note 166, at 62 ("[Norms] are different from law-they are enforced⋯ not by the state, but by the sanctions of other members of a particular community. But they are nonetheless a source of constraint, functioning to protect privacy.").
395. Strandburg, supra note 33, at 1248.
396. Id.
397. LOWE, supra note 7, at 294 ("Web 2.0 [is a] term used to describe an evoMng generation of a participatory Web [and] the proliferation of interconnectivity and social interaction on the World Wide Web.").
398. See Bernstein, supra note 30, at 932-33 (describing similar dynamics with respect to commercial transactions on the Internet and data aggregation by Internet commerce companies).
399. Id. at 946-49.
400. Tien, supra note 262, at ¶ 17.
401. Id.
402. Id.
403. Id.
404. Id.
405. Tien, supra note 262, at ¶ 17.
406. SOLOVE, supra note 40, at 73 (citing the work of economists Alessandro Acquisti and Jens Grossklags); Eric Goldman, On My Mind: The Privacy Hoax, F0RBF.s, Oct. 14, 2002, at 42. Goldman stated, But what do these surveys really prove? Consumers may tell survey takers they fear for their privacy, but their behavior belies it. People don't read privacy policies, for example. In a survey taken last year by the Privacy Leadership Initiative, a group of corporate and trade association executives, only 3% of consumers read privacy policies carefully, and 64% only glanced at-or never read-privacy policies. Id.
407. SOLOVE, supra note 40, at 73.
408. See SOLOVE, supra note 16, at 85-86.
409. see aho id. at 87 ("Since people routinely give out their personal information for shopping discount cards, for access to websites, and even for free, some market proponents (especially the self-regulators) argue that the value of the data is very low to the individuals."); Froomkin, supra note 137, at 1502 ("[C]onsumers suffer from privacy myopia they will sell their data too often and too cheaply. Modest assumptions about consumer privacy myopia suggest that even Americans who place a high value on information privacy will sell their privacy bit by bit for frequent flyer miles."). There are other alternative explanations for consumers falling to act in privacy-protecting ways online. Bernstein, supra note 128, at 290 (suggesting that consumers are actually unaware of the extent of privacy threats online, which leads them to fail to adequately protect their privacy using already- available technological tools and social behaviors).
410. see aho id. at 87 ("Since people routinely give out their personal information for shopping discount cards, for access to websites, and even for free, some market proponents (especially the self-regulators) argue that the value of the data is very low to the individuals.").
411. Froomkin, supra note 137, at 1502 ("[C]onsumers suffer from privacy myopia they will sell their data too often and too cheaply. Modest assumptions about consumer privacy myopia suggest that even Americans who place a high value on information privacy will sell their privacy bit by bit for frequent flyer miles."). There are other alternative explanations for consumers falling to act in privacy-protecting ways online. Bernstein, supra note 128, at 290 (suggesting that consumers are actually unaware of the extent of privacy threats online, which leads them to fail to adequately protect their privacy using already- available technological tools and social behaviors).
412. SOLOVE, supra note 16, at 87; Froomkin, supra note 137, at 1502.
413. See generally Levin & Abril, supra note 114 (surveying college students about attitudes to online privacy involving OSN5).
414. See, e.g., Posting of Owen Thomas to Vafleywag, http://va1leywag.gawker. com/321802/ bank-intem-busted.by-facebook (Nov. 12, 2007, 05:06 PM) (providing an example of an employer finding an image on Facebook of an employee at a Halloween party on a day when the employee was allegedly Out of the office for a fmily emergency).
415. Tien, supra note 262, ¶ 17.
416. 1267623 Ontario Inc. v. Nexx Online, Inc., No. C20546/99, 1999 O.T.C. LEXIS 1670, *4 (Ont. Super. Ct.June 14, 1999) (Can.).
417. In 1995, for example, Intel promulgated a set of guidelines in the form of a generally available memo for the Internet community. These "Netiquette Guidelines" contained suggestions about appropriate use of email services for the then-new generation of Internet users who had not "'grown up' with the Internet." Memorandum from Sally Hambridge, Intel Corp., Netiquette Guidelines (Oct. 1995), http://www.albury.net.au/new-users/rfc1855.txt.
418. See supra Part 11.8 (listing YouTube, Flickr, Facebook, and Yahoo! as websites that provide privacy policies in their terms of use).
419. See, e.g., Facebook, supra note 98 (describing Facebook's privacy policy).
420. Id.
421. Intel's Netiquette Guidelines focus on behavior amongst individuals using text-based electronic communications services, while at the same time acknowledging the role of service providers in the behavioral equation. Intel's Netiquette Guidelines state: Individuals should be aware that no matter who supplies their Internet access, be it an Internet Service Provider through a private account, or a student account at a University, or an account through a corporation, that those organizations have regulations about ownership of mail and files, about what is proper to post or send, and how to present yourself. Be sure to check with the local authority for specific guidelines. Memorandum from Sally Hambridge, supra note 285, § 1.0. The memo also warns: "Remember that all these services belong to someone else. The people who pay the bills get to make the rules governing usage. Information may be free-or it may not be? Be sure you check." Id. § 4.1.1.
422. Flickr, Flickr Community Guidelines, http://www.flickr.com/guidelines.gne (last visited Feb. 18, 2010). In fact, Flickr expresses that its Community Guidelines are part of its terms of use so they may have contractual force in addition to reflecting desired social norms. IcL ("Don't forget that your use of Flickr is subject to these Guidelines and our Terms of Use."); see also YouTube, YouTube Community Guidelines, http://www.youtube.com/t/ communityguidelines (last visited Feb. 18, 2010) ("We Enforce These Guidelines").
423. Flickr, supra note 290.
424. Id.
425. Id. In particular, Flickr suggests ways of amicably resolving copyright disputes by encouraging a complainant to privately contact the alleged copyright violator. If that does not succeed, then the complainant is requested to file a notice of infringement with the "Yahoo! Copyright Team" who will resolve the matter. Their Community Guidelines state that If you see photos or videos that you've created in another member's photostream, don't panic. This is probably just a misunderstanding and not malicious. A good first step is to contact them and politely ask them to remove it. If that doesn't work, please ifie a Notice of Infringement with the Yahoo! Copyright Team who will take it from there. You may be tempted to post an entry on your photostream or in our public forum about what's happening, but that's not the best way to resolve a possible copyright problem. We don't encourage singling out individuals like this on Flickr.
426. Id.
427. Id.
428. YouTube's community guidelines similarly protect copyright, but do not specifically mention privacy interests. YouTube, supra note 291. The YouTube Community Guidelines state: Respect copyright. Only upload videos that you made or that you are authorized to use. This means don't upload videos you didn't make, or use content in your videos that someone else owns the copyright to, such as music tracks, snippets of copyrighted programs, or videos made by other users, without necessary authorizations. Read our Copyright Tips for more information. Id.
429. This assertion may find support in the fact that one of the most open" networks. Wildpedia, has an extremely detailed set of guidelines referred to as "Wikiquette" to assist people posting information to behave appropriately vis-à-vis other posters. See Wikipedia, Wikipedia Etiquette, http://en.wikipedia.org/wiki/Wikipedia:Etiquette (last visited Feb. 18, 2010).
430. see also CAs5 R. SUNSTEIN, INFOTOPIA How MANY MINns PRODUCE KNOWLEDGE 155 (2006) (describing Wikipedia's guidelines). Sunstein stated: When active debates are occurring about the content of articles, it is necessary to have good nonns to provide some discipline. The term "Wikiquette" refers to the etiquette that Wikipedians follow. Wildquette helps to ensure that the active debates are transferred to separate "talk pages." These are the deliberative forums on Wikipedia, in which those who disagree explain the basis for their disagreement. What is noteworthy is that the articles themselves are (mostly) solid, and that partisan debates have a specifically designed location. Id.
431. ZTTTRAIN, supra note 2, at 226 ("Facebook, for example, offers tools to label the photographs one submits and to indicate what groups of people can and cannot see them.").
432. Norms may also play a part in this distinction. Those posting to YouTube may expect public availability of content, while those posting in closed networks expect more privacy protections.
433. CORY DOCTOROW, CONTENT 183 (2008) ("It's socially awkward to refuse to add someone to your friends list-but removing someone from your friends list is practically a declaration of war.");
434. Grimmelmann, supra note 107, at 1175 ("[I]t's hard to say no to a contact request.").
435. DOCTOROW, supra note 300, at 183;
436. Grimmelmann, supra note 107, at 1175 (noting that it's equally as hard to remove contacts as to refuse contacts).
437. But see Wilson, supra note 111 (noting that people are increasingly suffering from Facebook fatigue and are beginning to "de-friend" or "de-follow" their online contacts).
438. See Henky Jenkins CONVERGENCE CULTURE: WHERE OLD AND NEW MEDIA COLLIDE 25 (2006) (describing Survivor as a popular CBS show that started die reality-television trend).
439. Id. at 25-26.
440. Id. at 36-37 ("[T]here is a thin, thin line here between investigating those who have chosen to insert themselves into the public spotlight and stalking diem at their home or workplace The community spends a great deal of time debating, exactly where you draw the line.").
441. Id. at 38.
442. Id.
443. JENKINS, supra note 302, at 38 (The brain trusts ⋯ argue that this closed-door vetting process protects privacy and ensures a high degree of accuracy once they do post their findings.").
444. PALFREY & GASSER, supra note 28, at 201 ("Tags are essentially keywords that are associated with a piece of information-for example, a photo, blog post, or video-in a keyword-based classification scheme. Tagging, in other words, is like creating a label for online content.").
445. See Edwards & Brown, supra note 182, at 212-15 (describing the role of "tagging" in the loss of control of personal data to third parties).
446. Of course, tagging also potentially assists with searching and removal of content where an image subject might have objected to its online dissemination. Thus, the technology cuts both ways here.
447. Professor Zittrain has noted that tagging may only be the beginning of the problem for online-image privacy as facial-recognition software becomes more sophisticated and video images can now be matched quite easily with tagged text descriptions. ZITTRAIN, supra note 2, at 214. Zittrain warns: Web sites like Riya, Polar Rose, and MyHeritage are perfecting facial recognition technologies so that once photos of a particular person are tagged a few times with his or her name, their computers can then automatically label all future photos that include the person-even if their image appears in the background.
448. Id:, see also PALFREY & GASSER, supra note 28, at 44 ("New, convenient services that aggregate photos and allow for image searching, with increasing amounts of metadata to help associate the images with people come online every year.").
449. Mosley v. News Group Newspapers Ltd, [2008] EWHC (QP) 1777, [2008] E.M.L.R. 20, [226] (Eng.). The court held: [C]laimant's behaviour was reckless and almost self-destructive. This does not excuse the intrusion into his privacy but it might be a relevant factor to take into account when assessing causal responsibility for what happened. It could be thought unreasonable to absolve him of all responsibility for placing himself and his family in the predicament in which they now find themselves. It is part and parcel of human dignity that one must take at least some responsibility for one's own actions. Id.
450. This is not unlike the way law can communicate norms. However, law can also enforce norms. The interplay between modes of regulation can be quite complex and paradoxical at times.
451. The Beacon program involved divulging to a user's "friends" what products the user had bought online on the premise that the user's friends may be interested in similar product. See SOLOVE, supra note 16, at 80 (citing various examples of online service providers canceling initiatives due to public outcry about privacy, including Yahoo! eliminating a reverse telephone-number search from its People Search site);
452. Grimmelmann, supra note 107, at 1147-48 (describing problems with the Beacon program); Posting of William McGeveran to Info/Law,Facebook Retreats Somewhat on Beacon Policy, http://blogs.law.harvard.edu/infolaw/2007/12/02/ facebook-retreats-socialads/ (Dec. 2, 2007) (describing a change that Facebook made to its Beacon program in response to a user protest).
453. Froomkin, supra note 137, at 1524-25 (expressing skepticism about industry self-regulation in the absence of a serious threat of government regulation);
454. Mark Lemley, Private Property, 52 STAN. L. REV. 1545, 1554 (2000) ("If we want privacy, we must be willing to accept the fact that there is no good 'market solution' and endorse some government regulation of the behavior of data collectors."); Lessig, supra note 166, at 63 ("There is much to be skeptical about with [a solution to privacy problems involving market regulation]-not the least of which being that the interests of commerce might well be different from the interests of the consumer.").
455. Froomkin, supra note 137, at 1524-25 (expressing skepticism about industry self-regulation in the absence of a serious threat of government regulation). 317. Id. at 1469 ("Data accumulation enables the construction of personal data profiles. When the data are available to others, they can construct personal profiles for targeted marketing, and even, in rare cases, blackmail."(footnotes omitted)).
456. See supra Part II.B (comparing Facebook's privacy policy to that of other websites including Yahoo! and YouTube).
457. Posting of Megan McCarthy to Epicenter, supra note 141;
458. Posting of William McGeveran to Info/Law, supra note 315.
459. SOLOVE, supra note 16, at 81-87 (describing failures of contracts and market forces in protecting privacy).
460. Transaction costs include, for example, the costs of moving relevant information and perhaps even having to set up a new e-mail account, notifying others of your new e-mail address, and establishing a new personal profile. See PALFREY & GASSER, supra note 28, at 68-69 (discussing difficulties of switching services in this context).
461. SOLOVE, supra note 16, at 82.
462. See id. (discussing the inequalities in bargaining power).
463. See id. at 83 (describing company privacy policies).
464. See id. (stating that customers generally cannot keep companies from changing privacy policies).
465. Froomkin, supra note 137, at 1527 ("A more generic problem with self-regulatory schemes, even those limited to e-commerce or web sites in general, is that they regulate only those motivated or principled enough to take part in them.").
466. In the associated context of online data aggregation and privacy concerns, Professor Froomkin has suggested the need for an approach that combines legislation, market forces, and social norms. Id. at 1528 ("One way of creating incentives for accurate, if not necessarily ideal, privacy policies would be to use legislation, market forces, and the litigiousness of Americans to create a self-policing (as opposed to self-regulating) system for web-based data collection.").
467. Lessig, supra note 166, at 63. For completeness, it should be noted that others have defined architecture more broadly in this context Professor Solove, for example, appears to contemplate that system architecture includes hardware and software as well as the default attributes of relationships between individuals and those who control or process their information. SOLOVE, supra note 16, at 97-101.
468. See World Wide Web Consortium, Platform for Privacy Preferences (P3P) Project, http://www.w3.org/P3P/Overview.html (last visited Feb. 18, 2010) (describing the function of P3P).
469. See SOLOVE, supra note 3, at 200 ("The technological design of the websites has an enormous impact on people's privacy.");
470. Froomkin, supra note 137, at 1528-33 (describing potential for use of privacy-enhancing technologies as a form of system architecture to protect privacy); Reidenberg, supra note 34, at 562-65 (discussing the impact of network architecture on security); Joel R. Reidenberg, Rules of the Food for Global Electronic Highways: Merging the Trade and Technical Paradigms, 6 HARV. J.L. & TECH. 287,296-97 (1993) (same).
471. SOLOVE, supra note 16, at 100.
472. Id. LESSIG, supra note 179, at 122 ("[A]s with the market, architecture effects its constraint through simultaneous conditions. These conditions are imposed not by courts enforcing contracts, or by police punishing theft, but by nature, by 'architecture.'").
473. See infra Part TV.E (arguing that education is important because it informs the public about issues of privacy online).
474. On Facebook, there are numerous ways for users to restrict access to profile information. Facebook, Privacy: Privacy Settings and Fundamentals, http://www.Eiicebook.com/help/#!/help/?page=419 (last visited Feb. 18, 2010). Facebook also allows users to block particular people from accessing their profiles. Facebook, Privacy: Blocking People, http://www.facebook.com/help/? page=419#/help.php?page=841 (last visited Feb. 18, 2010). Facebook describes its blocking policy. A block prevents specific people from viewing your profile. Any ties you currently have with the people you block will be broken (friendship connections, friend details, etc.). Your profile will not be visible to them and you will not appear in their search results or friend lists. Blocking is mutual, so they will also become invisible to you as well. Id.
475. Edwards & Brown, supra note 182, at 225.
476. Using the "Wayback Machine" on the Internet Archive, one can browse through historical records of eighty-five billion web pages archived since 1996. Internet Archive, The Wayback Machine, http://www.archive.org/web/ web.php (last visited Feb. 18,2010).
477. Online entities have been using copy-control technologies online in the copyright context extensively in recent years. SeeLESSIG, supra note 179, at 147-53 (providing a discussion of copy-control technologies employed by Adobe with respect to the sale of eBooks).
478. This would not be dissimilar to the Creative Commons license utilized to express copyright holders' preferences as to permitted uses of a given copyright work. Creative Commons, Creative Commons Licenses, http://creativecommons.org/ about/licenses/meet-the-licenses (last visited Feb. 18,2010);
479. see also ZlTTRAIN, supra note 2, at 225. Zittrain stated: As people put data on the Internet for others to use or reuse-data that might be about other people as well as themselves-there are no tools to allow those who provide the data to express their preferences about how the data ought to be indexed or used. There is no Privacy Commons license to request basic limits on how one's photographs ought to be reproduced from a social networking site. There ought to be. Id.
480. ZITTRAIN, supra note 2, at 226 ("Facebook ⋯ offers tools to label the photographs one submits and to indicate what groups of people can and cannot see them. Once a photo is copied beyond the Facebook environment, however, these attributes are lost."). 340. Id.
481. Solove, supra note 16, at 82 ("Companies only rarely compete on the basis of the amount of privacy they offer. People often do not weigh privacy policies heavily when choosing companies.").
482. Froomkin, supra note 137, at 1524 ("Since the economic incentive to provide strong privacy protections is either weak, nonexistent, or at least nonuniformly distributed among all participants in the marketplace, most serious proposals for self-regulation among market participants rely on the threat of government regulation ⋯.").
483. LESSIG, supra note 179, at 147-53 (discussing effectiveness of copy-control technologies in the eBook-copyright context).
484. See also SOLOVE, supra note 3, at 204. Solove stated, Education is the most viable way to shape people's choices in [regard to information disclosed online]. For example, one study indicated that people have a lot of misunderstandings about who is able to search their Facebook profiles⋯. We need to spend a lot more time educating people about the consequences of posting information online. Id.;
485. see also Edwards & Brown, supra note 182, at 220 ("[M]ore effort seems to have gone towards advising users how to act wisely on [social-networking sites] (an educational perspective), rather than in persuading [social-networking sites] to adopt clear, consistent, and non-oppressive terms in both their written documents and ⋯ their code."). Others have noted the importance of public education as a regulatory force in society as a means of educating people about privacy interests. See, e.g., Abril & Cava, supra note 18, at 271-72 (suggesting that sometimes even the mere mention of privacy on a web service raises users' caution levels); Bernstein, supra note 128, at 264 (talking about the role of genetic counselors in educating the public about privacy rights with respect to genetic testing and dissemination of personal information from genetic testing); Froomkin, supra note 137, at 1506 ("Legal rules prohibiting data collection in public are not the only possible response; defenses against collection might also include educating people as to the consequences of disclosure or deploying countertechnologies such as scramblers, detectors, or masks.").
486. Abril, supra note 49, at 87 (suggesting that Internet service providers have a role as public educators with respect to online privacy).
487. Richards, supra note 36, at 419.
488. Id. at 420-21.
489. Id. Of course, one might suggest that the idea of "institutions as regulators" is really a subset of market forces as a regulatory modality. However, there are subtle differences. Market forces are determined largely by commercial interests. Institutional interests, however, may be more aspirational and focused on the needs of bettering society generally.
490. LESSIC, supra note 179, at 281-82.
491. Id. at 282-86.
492. The PLoS is a nonprofit organization that maintains a repository of scientific work in electronic form that is "made permanently available for free." Id. at 281-82. The Creative Commons is a nonprofit corporation that assists copyright holders in granting more flexible permissions for uses of their works. Id. at 282. Creative Commons' goal: [I]s to build a layer of reasonable copyright on top of the extremes that now reign. It does this by making it easy for people to build upon other people's work, by making it simple for creators to express the freedom for others to take and build upon their work. Simple tags, tied to human-readable descriptions, tied to bulletproof licenses, make this possible. Id. Creative Commons describes its mission as follows: Creative Commons is a nonprofit corporation dedicated to making it easier for people to share and build upon the work of others, consistent with the rules of copyright. We provide free licenses and other legal tools to mark creative work with the freedom the creator wants it to carry, so others can share, remix, use commercially, or any combination thereof. Creative Commons, About, http://www.creativecommons.org/about/ (last visited Feb. 18, 2010).
493. GOLDSMITH & WU, supra note 31, at 18 (describing the EFF as an organization founded to use tools of "political participation, litigation, education, seminars, and campaigns" to develop a legal conception of cyberspace that would defend it from intrusions by territorial governments).
494. For examples, see Brief of Amici Curiae Electronic Frontier Foundation, ACLU of Ohio Foundation, Inc., American Civil Liberties Union, and Center for Democracy and Technology Supporting the Appellee and Urging Affirmance, Warshak v. United States, 532 F.3d 521 (6th Or. 2008) (No. 06-4092), 2006 WL 4670945;
495. Brief Amici Curiae of Electronic Fronter [sic] Foundation, Public Knowledge, United States Internet Industry Association, and Computer & Communications Industry Association in Support of Defendant Jammie Thomas, Capitol Records Inc. v. Thomas, 579 F. Supp. 2d 1210 (D. Minn. 2008) (Civ. No. 06-1497 (MJD/RLE)), available at http://www.eff.org/files/nlenode/capitol-v- thomas/20080620EFFAmiciBrief.pdf.
496. The Electronic Privacy Information Center describes itself as "a public interest research center in Washington, D.C. ⋯ established in 1994 to focus public attention on emerging civil liberties issues and to protect privacy, the First Amendment, and constitutional values." Electronic Privacy Information Center supra note 185.
497. Much of the EFF's funding relies on volunteer work and donations. Electronic Frontier Foundation, Volunteer, http://www.eff.org/about/ opportunities/volunteer (last visited Feb. 18, 2010).
498. EPIC relies on contributions from individual and private institutions and legal awards. ELEC. PRIVACY INFO. Cm, ENSURING ACCURACY & PRIVACY: EPIC 2005-2006 ANNUAL REPORT 3 (2005), available at http://epic.org/epic/annual- reports/2005.pdf.
499. GOLDSMITH & Wu, supra note 31, at 18-19.
500. ZITTRAIN, supra note 2, at 244-45 (suggesting that universities take on a stronger leadership role in the Internet's future development more generally).
501. See, e.g., The Computers Freedom & Privacy Conference, http://www.cfp.org/ (last visited Feb. 18, 2010) (listing various CFP conferences).
502. For example, academic institutions can facilitate public education through podcasting.
503. Fried, supra note 142, at 475.
504. Froomkin, supra note 137, at 1468-501 (providing a detailed survey of modem privacy-destroying technologies).
505. Edwards & Brown, supra note 182, at 227.
506. PALFREY & GASSER, supra note 28, at 80 (noting that solutions to cyberspace-privacy problems will ultimately have to be global).
507. CLAY SHIRKY. HERE COMES EVERYBODY: THE POWER OF ORGANIZING WIThOUT ORGANIZATIONS 237 (2008) ("An interesting effect of digital archiving is that much casual conversation is now captured and stored for posterity, so it is possible to look back in time and find simple messages whose importance becomes obvious only with the passage of time.").
508. Grimmelmann, supra note 107, at 1179: People are time-inconsistent; they care more about privacy as they age. Teens in particular are notorious risk-takers; they do dangerous things, like smoke and drive recklessly, that they later regret, even when given accurate information about the risks. Even if people in general develop more accurate expectations about how social network sites work and the privacy risks involved, hundreds of thousands of children come online each year: people who by definition don't have much experience in what to expect in terms of online privacy. Id. (footnotes omitted).
509. Id. at 1181 ("[E]ither society will significantly adjust its privacy norms or a lot of people are going to have some lifelong regrets about their youthful Internet indiscretions.").