The Right to Intimate Privacy

Earlier this year, Washington Post columnist Geoffrey Fowler attempted to read the privacy policies of the apps he regularly uses on his phone. The task, it turned out, was practically impossible because of the unending legalese. According to researchers at Carnegie Mellon University, it would take the average internet user 244 hours to read every privacy policy of every website they visited in a year. So it is no surprise that nearly 60 percent of Americans reported feeling confusion about their online privacy rights, according to a 2019 Pew Research Center report. The public has no clear understanding of what digital actions are recorded and used by companies and third parties.

All our social media activity—our likes, connections, habits, images, posts, and stories—as well as our online searches contribute to a continuously growing digital record. This ongoing narrative tells others not only who we are but also who we believe ourselves to be. It is an autobiography that is somehow reported and written by others.

This link between selfhood and privacy animates Danielle Keats Citron’s new book, The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age. The Jefferson Scholars Foundation Schenck Distinguished Professor of Law at the University of Virginia, Citron explores how “intimate privacy” is eroded by companies and third parties that can legally access and sell personal data because it is not covered by American consumer protection law.

Citron contends that intimate privacy constitutes a second or digital self and should therefore be protected as a civil right. Privacy, she says, pertains not only to financial security but also to aspects of our intimate selves—our private messages and personal searches that communicate medical and/or sexual information about our bodies, from searches about health symptoms to images shared on dating apps.

For Citron, intimate privacy is fundamental to self-expression and self-discovery. Her notion of privacy encompasses two of its usages: secrecy and bodily autonomy. Intimate privacy also facilitates our ability to build intimate relationships with others. “Our close relationships are central to human flourishing,” she observes, “and they require intimate privacy to thrive.”

Her examples illustrate how our privacy is violated and how we are harmed because our intimate privacy is not a civil right. Former intimate partners, for example, can use nude images for blackmail or revenge. Voyeurs can surreptitiously capture intimate images and distribreguute them without consequence, which can be capitalized upon by businesses to turn a profit. And the government can collect intimate data to criminalize its residents—an emerging reality since the recent Supreme Court decision to overturn the federal right to an abortion has allowed states to enact laws to track and identify people who search online for reproductive health- and abortion-care information.

Citron’s notion of selfhood as an amalgam of both a physical body and a body of knowledge has long roots, particularly in technology. At its most basic level, the creation of writing produced a sort of externalization of the self into words, first onto skins and paper, and then onto screens. We produce units of information about ourselves, not just in writing but now in data sets. However, someone else—some other structure of power—will have its own interpretation and use of this information. So, this self is a site of contestation over power.

Citron’s book thus attempts to reframe how we think of the self—whether the physical body, speech, or data—and how power structures attend to and protect that self. An inherent tension exists in the idea of a data self because it is at once a collection of who we are and a mass of data about us, which can be used to do everything from serving us comparatively innocuous ads to far more insidious things like tracking us, invading our privacy, and exposing us to harm. When the individual is a collection of data points, each with various degrees of monetary worth, then the self is invariably commodified.

Citron examines how intimate privacy is violated into two dimensions: private sector violations and interpersonal violations. The two are distinct yet overlap, as corporations can appropriate private information that is nonconsensually shared online for their own use and profit.

“Spying Inc.” is the nickname she gives to private sector companies, including social media, that exploit our intimate privacy by collecting personal data and then—whether through carelessness or the exploitation of legal loopholes—selling this information to data brokers, which are the companies that aggregate and sell that data to advertisers. The irony of Spying Inc., Citron points out, is that its very operations are a significant reason why the notion of intimate privacy arose in the first place.

Grindr, for example, not only collects its users’ data about their physical characteristics, HIV status, and gender and sexual identities, but also then sells that data to third-party data brokers, who then sell it to the highest bidder. The effects of this kind of invasion can be chilling because once the information is sold, it can be used in unexpected and harmful ways. As Citron writes, “A man told Vox that he removed his HIV status from his Grindr profile because when the ‘wrong people’ find out, lives, careers, and family relationships are imperiled.” The impact of this privacy invasion is not simply that of the unforeseen consequences. Just as important, our knowledge that privacy invasions are a possibility every time we go online has made us anxious and fearful.

The titans that make up Spying Inc.—companies such as Facebook, Amazon, and Google—justify their commodification of personal data as a business necessity so that their social media services can continue to be free for the public. “At present, many businesses don’t (and don’t need to) charge fees for service, because they earn revenue by selling access to intimate data to third parties,” Citron explains. It is the libertarian, Silicon Valley ethos—“the ‘information must be free’ mantra”—applied to data that, she says, “set up the conditions for the surveillance of our intimate lives.”

Because she believes that intimacy privacy should be a civil right, Citron asserts that to protect our most intimate data consequently means that some digital services should not exist, at least not for free. She acknowledges the downside to this argument: “It’s true that prohibiting these third-party sales may lead to new subscription fees, which a non-trivial number of people might be unable to afford.” One alternative she suggests is for the social sector and government to fill the gaps, perhaps something analogous to state-subsidized transit passes. This tack may produce less democratic social media than exists now, but Citron is almost dogmatic in her concern with protecting data. “Even when such alternatives are not feasible, protecting intimate privacy remains the priority,” she says. “The unavailability of services to some is worth the benefit to all.”

The digital self is constitutive of the human person, Citron argues, so it’s time for the law to catch up and protect it.

If intimate privacy were constituted as a civil right, she claims, then the law would be a bulwark against the invasive nature of big tech and the state, as well as against interpersonal acts of violence. In her turn to the interpersonal dimension, Citron analyzes several cases of revenge porn, in which people spitefully use sensitive or revealing images exchanged during the time of the relationship to blackmail or simply harm their ex-partners—it is an act overwhelmingly perpetrated by men against women. Websites that house revenge porn circulate nonconsensual images for big profit and are legally protected by the First Amendment.

The circulation of these images more often than not results in consequences for the victim and not the perpetrator. In one of Citron’s examples, a high school principal was fired for having her nude images posted online, because the New York Department of Education stated that the images brought negative publicity to the school. In another, a graduate student whose ex-partner posted nude images of her online was advised by the dean of her program to change her name. Other examples involve extortion, with abusive ex-partners sending intimate images to a former lover’s professional and personal contacts. These privacy invasions result in castigation, humiliation, and social censure of victims. Citron explains that their “self-esteem is shattered. Victims feel like they have lost control over their bodies, minds, and intimate affair—that their sexual autonomy has been revoked.”

Citron offers recommendations for how privacy might be enshrined in law and how potential conflicts with the First Amendment and Section 230—which guarantees legal and financial immunity to digital platforms—might be addressed. She proposes four rules for protecting intimate privacy under the law. The first is that “entities may not collect intimate data … unless doing so would serve a legitimate purpose.” This rule would serve, for example, to prevent a website from hosting nonconsensual images. The second rule states that entities may not collect non-intimate data unless they obtain clear and meaningful consent—which, arguably, would not include rapidly scrolling through a privacy policy to click on the agreement button at the end of the page. Citron’s third rule would hold companies to duties of nondiscrimination and loyalty to ensure that the private sector “prioritize[s] people’s well-being when handling their intimate data,” she writes. The final rule establishes a direct relationship between individual and companies so that if a privacy agreement is broken, then there is a clear legal structure by which one might seek justice or recompense.

The Fight for Privacy is ultimately a call to action for activists, the public, and, most important, lawmakers. In that aim it is remarkably effective and, perhaps just as important, deeply human. In grounding what is ultimately an argument about law and policy, Citron’s book works to reframe the conversation about privacy from one concerned with abstract data to our most intimate selves. The digital self is constitutive of the human person, Citron argues, so it’s time for the law to catch up and protect it.