How Service Providers Conceptualize Users and the Implications for Privacy
Authors:   , McDonald Nora , Forte Andrea 
Published: July 2021

In any online environment, users increasingly understand themselves to be relinquishing much of their control over privacy to the oversight and regulation of others, and must hope (although they may not necessarily believe) that those agents (and their policies) are working to protect them against privacy encroachment. To achieve privacy in a networked culture requires that network gatekeepers not collect or use others' data, or that users conceal and obfuscate as much as possible-moving beyond traditional notions of concealment through privacy settings, built on metaphors for physical barriers that no longer serve us well. Users who perceive themselves to be under threat might achieve some additional privacy through (selective) anonymity or pseudonymity-which are forms of more proactive privacy. But the agents of privacy regulation in online spaces (and the offline spaces permeated by our devices) are in all cases service providers (those who administer online platforms like open collaboration, social networks, and even internet resources and archives such as librarians), and service providers establish the rules of the road for platform access/participation on internet platforms. That is, users are dependent on service providers, who determine the terms of access and the parameters of user activity. Users must, in turn, trust that their interests and safety are insured. Research has demonstrated that there are misalignments between the privacy protections service providers offer and the perceived privacy risks experienced by users-particularly users of the internet with heightened vulnerabilities to the consequences of encroachment. For their part, service providers sometimes perceive risks and threats to their organizations that might discourage them providing privacy that protects certain vulnerable users. They may view provision of greater privacy as either too challenging or as posing unacceptable risks to their mission and their community. Alternatively, they may not be sufficiently sensitive to the risks that trouble or threaten their users. Theories of internet privacy have focused on the way in which individual control or group norms help shape privacy values held by users, but researchers have yet to ask how service providers perceive threats and privacy norms of others and how they adjudicate the protections needed by others with the protections they require for fulfillment of their own mission. Furthermore, these theories discount how the social construction of values, norms, and perspectives of service providers shape the types of privacy that users can achieve, and why those perspectives tend to overlook and leave unprotected the most vulnerable among us. This dissertation set out to qualitatively identify what threats service providers perceive, whether and why they are enjoined to the ideals (or urgent needs) of user privacy, and how their perceptions of users may influence what privacy and anonymity protections they provide to users. To accomplish these objectives, I looked at this issue from the perspective of both library and, to the extent I could, social media service providers, defined as organizations that provide the tools and/or infrastructure for accessing internet services and resources. I conducted qualitative research to understand how library service providers perceive privacy/anonymity and security threats to their organization and users, and how these perceptions influence the privacy they offer. I performed critical discourse analysis of social network service providers' blog posts to better understand their efforts to control and normalize discourse around user and platform privacy and anonymity. I build on these studies to advance our thinking about the role of norm-based theories in accounting for vulnerable users, and use these findings to develop insight into how we might frame these questions going forward.