The Fight to Protect Online Privacy

Last year, Edward Thomas, now 17, quit social media entirely.

It wasn’t an easy decision, especially since most of his friends use social media to message each other. But the Chicago teen worried about online companies tracking his activities and using that information to either make money or influence the kind of content shown in his feeds.

“Social media and other Big Tech companies have no legal obligation to share how they use our consumer behavior, like how much time we spend on TikTok and what we like,” Edward says. “For all I know, they could be scanning through messages I’m sending my friends.”

Many privacy experts say Edward is right to be concerned. Internet giants such as Facebook and Google have long tracked people’s internet browsing, studying their habits and using that information for advertising (see “What They Do With Your Data,” below). If, say, someone were to scroll through Instagram and then click on a website selling shoes, marketers might start targeting that person with footwear ads. It’s a big business: The digital ad industry was worth $522.5 billion in 2021 and is growing rapidly. Smartphones have made it even easier to track people’s data, including their locations and health details.

You might be surprised by how much social media companies know about you. Maybe you’ve entered your birthday and gender into your profile, and you follow a few influencers or brands. But companies can uncover a lot more than what you’ve told them, privacy experts say. These platforms can look at your friends, online activity, location, and more. They can then put together a detailed picture of who they think you are. Much of that is information you may never have disclosed, such as your political beliefs, your mental and physical health, and who lives with you. Some platforms can even use credit card numbers to monitor your offline purchases.

Edward Thomas, now 17, quit using social media last year.

It wasn’t an easy decision. It was difficult because most of his friends use social media to message each other. But the Chicago teen worried about online companies tracking his activities. He worried they were using that information to either make money or influence the kind of content shown in his feeds.

“Social media and other Big Tech companies have no legal obligation to share how they use our consumer behavior, like how much time we spend on TikTok and what we like,” Edward says. “For all I know, they could be scanning through messages I’m sending my friends.”

Many privacy experts say Edward is right to be concerned. Internet giants such as Facebook and Google have long tracked people’s internet browsing. They study user habits and use that information for advertising (see “What They Do With Your Data,” below). If someone were to scroll through Instagram and then click on a website selling shoes, marketers might start targeting that person with footwear ads. It’s a big business. The digital ad industry was worth $522.5 billion in 2021. It is growing rapidly. Smartphones have made it even easier to track people’s data, including their locations and health details.

You might be surprised by how much social media companies know about you. Maybe you’ve entered your birthday and gender into your profile. Then you follow a few influencers or brands. But companies can uncover a lot more than what you’ve told them, privacy experts say. These platforms can look at your friends. They can track your online activity, location, and more. They can then put together a detailed picture of who they think you are. Much of that is information you may never have disclosed. But they can learn about your political beliefs, your mental and physical health, and who lives with you. Some platforms can even use credit card numbers to monitor your offline purchases.

Experts are particularly worried about these companies tracking the personal data of young children and teens, putting their privacy at risk to make money. There’s also growing concern that social media platforms are using the information to figure out what will rile young people up or to play on their insecurities to get them to stay on the platforms longer, ultimately harming their mental health. That’s why some governments are trying to better safeguard minors’ online data.

Last September, for example, the European Union fined Meta (the parent company of Facebook and Instagram) roughly $400 million for breaking data privacy laws in its treatment of children’s data on Instagram. At the same time, California passed a law—similar to one passed in the United Kingdom in 2021—that will require many apps and sites to install guardrails for users under 18, such as turning on the highest privacy settings by default and preventing strangers from messaging minors.

Although some online platforms and civil liberties experts have pushed back against these efforts, many U.S. lawmakers from both parties say they remain committed to taking action.

“Big Tech has brazenly failed children and betrayed its trust,” says Connecticut Senator Richard Blumenthal, “putting profits above safety.”

Experts are particularly worried about these companies tracking the personal data of young children and teens. It puts their privacy at risk to make money. There’s also growing concern that social media platforms are using the information to figure out what will upset young people or what will play on their insecurities to get them to stay on the platforms longer. This can ultimately harm their mental health. That’s why some governments are trying to better safeguard minors’ online data.

Last September, the European Union fined Meta (the parent company of Facebook and Instagram) roughly $400 million for breaking data privacy laws in its treatment of children’s data on Instagram. At the same time, California passed a law that will require many apps and sites to install guardrails for users under 18. These changes include turning on the highest privacy settings by default and preventing strangers from messaging minors.

Some online platforms and civil liberties experts have pushed back against these efforts. But many U.S. lawmakers from both parties say they remain committed to taking action.

“Big Tech has brazenly failed children and betrayed its trust,” says Connecticut Senator Richard Blumenthal, “putting profits above safety.”

Avoiding social media won’t protect you entirely, according to experts. Your number is probably in many other people’s phones, and when they upload their contacts to find friends on an app, your number’s included. That helps online companies figure out your social network, which lets them infer things about you.

Several platforms have been accused of exploiting children’s data. In Meta’s case, European regulators found that the terms of service agreement included language that effectively meant users must either allow their data to be used for personalized ads or stop using Meta’s services altogether. (In a statement, Meta said its approach respects the law and that it would appeal the decision.)

Other companies have faced similar charges. In 2019, Google and the operators of TikTok (then known as Musical.ly) each agreed to pay multimillion-dollar federal fines in the U.S. to settle charges that they had collected personal information from children without parental permission and used it to target kids with ads. And in December, Epic Games, the creator of Fortnite, agreed to pay $275 million to settle accusations that it had illegally collected children’s personal data.

Instagram in particular has been under scrutiny in Europe and the U.S. for its policies related to children, including how its recommendation algorithm—which determines what posts users see—affects self-esteem and mental health. Edward, for example, noticed that Instagram kept showing him content that negatively affected his body image.

“I felt like, OK, I’m trying to step away from this, but at the same time, I’m also continuing to be fed the same content that’s not helping me,” Edward says. “That was my first realization that social media is not just something that I’m controlling, but somebody else is also controlling it from behind and I’m almost victim to it.”

Avoiding social media won’t protect you entirely, according to experts. Your number is probably in many other people’s phones. When they upload their contacts to find friends on an app, your number’s included. That helps online companies figure out your social network, which lets them infer things about you.

Several platforms have been accused of exploiting children’s data. In Meta’s case, European regulators found that the terms of service agreement included language that effectively meant users must either allow their data to be used for personalized ads or stop using Meta’s services altogether. In a statement, Meta said its approach respects the law and that it would appeal the decision.

Other companies have faced similar charges. In 2019, Google and the operators of TikTok (then known as Musical.ly) each agreed to pay multimillion-dollar federal fines in the U.S. to settle charges. The charges included that they had collected personal information from children without parental permission. The information was then used to target kids with ads. And in December, Epic Games, the creator of Fortnite, agreed to pay $275 million to settle accusations that it had illegally collected children’s personal data.

Instagram in particular has been under scrutiny in Europe and the U.S. for its policies related to children. This includes how its recommendation algorithm, which determines what posts users see, affects self-esteem and mental health. Edward, for example, noticed that Instagram kept showing him content that negatively affected his body image.

“I felt like, OK, I’m trying to step away from this, but at the same time, I’m also continuing to be fed the same content that’s not helping me,” Edward says. “That was my first realization that social media is not just something that I’m controlling, but somebody else is also controlling it from behind. I’m almost victim to it.”

For a long time, there weren’t many regulations about how social media companies should handle users’ private data, particularly for those under 18. In 1998, the federal government enacted the Children’s Online Privacy Protection Act (COPPA), which compelled most popular online services in the country to bar users under age 13—but many young people have found ways around that.

Some governments have begun exploring what else can be done to keep children safer online. The first major change came in 2020, when the U.K. passed sweeping new online protections for minors. The rules required social networks, gaming apps, and other online services that are likely to be used by people under 18 to overhaul how they handle users’ personal information. In particular, the regulations require platforms to turn on the highest possible privacy settings by default for minors and turn off by default data-mining practices like targeted advertising and location tracking.

“This is a significant shift in the landscape,” Elizabeth Denham, Britain’s information commissioner who drafted the rules, said at the time. “The code is a set of principles and standards that require companies to think about, to focus on, and to be accountable for the way they are serving children.”

For a long time, there weren’t many regulations about how social media companies should handle users’ private data, particularly for those under 18. In 1998, the federal government enacted the Children’s Online Privacy Protection Act (COPPA). It compelled most popular online services in the country to bar users under age 13. Many young people have found ways around that.

Some governments have begun exploring what else can be done to keep children safer online. The first major change came in 2020, when the U.K. passed sweeping new online protections for minors. The rules required social networks, gaming apps, and other online services that are used by people under 18 to overhaul how they handle users’ personal information. In particular, the regulations require platforms to turn on the highest possible privacy settings by default for minors. It also requires that they turn off default data-mining practices like targeted advertising and location tracking.

“This is a significant shift in the landscape,” said Elizabeth Denham, Britain’s information commissioner who drafted the rules. “The code is a set of principles and standards that require companies to think about, to focus on, and to be accountable for the way they are serving children.”

Some lawmakers in the U.S. are looking to follow in the U.K.’s footsteps. In September, California’s governor signed a law that will make the state the first in the nation to require online services to design their products and features with the best interests of young users in mind. A handful of other states have since begun creating regulations of their own.

But not everyone is on board. Trade groups note that laws such as these may ultimately lead to fewer online services for young people.

“Some people may see this as a victory for children, but we’ll actually see a restriction in the services that start-ups can build for kids,” says Dom Hallas, executive director of the Coalition for a Digital Economy, an advocacy group for start-ups that has received funding from tech companies such as Google, Intuit, and Stripe.

Some lawmakers in the U.S. are looking to follow in the U.K.’s footsteps. In September, California’s governor signed a law that will make the state the first in the nation to require online services to design their products and features with young users in mind. A handful of other states have since begun creating regulations of their own.

But not everyone is on board. Trade groups note that laws such as these may ultimately lead to fewer online services for young people.

“Some people may see this as a victory for children, but we’ll actually see a restriction in the services that start-ups can build for kids,” says Dom Hallas, executive director of the Coalition for a Digital Economy, an advocacy group for start-ups. It has been funded by tech companies such as Google, Intuit, and Stripe.

Although these laws apply only in the U.K. and California, experts say they may still protect minors in other places, as online services may choose to introduce their changes globally. In the wake of such legislation, many major platforms have announced new safeguards for younger users worldwide: TikTok has promised to stop sending app notifications to teens at night, for example, while Facebook and Google have begun restricting the way advertisers can tailor messages to minors on their sites.

Congress could eventually enact a federal law. Last July, senators introduced the Kids Online Safety Act (KOSA), under which platforms would have a duty to protect young people in a variety of ways, including preventing the promotion of harmful behaviors, giving parents of children under 16 the ability to opt out of algorithmic recommendations, and keeping third parties from accessing minors’ data. The bipartisan bill failed to make it out of the Senate last year, but lawmakers say they’re working to get it reintroduced this session.

Some civil liberties experts have concerns, however, arguing that legislation that singles out children would require companies to do the same, increasing their surveillance of everyone simply to identify those young users covered under the new law. Instead, they say, we should be focusing on privacy for all.

“There’s a clear need to have a federal privacy law that protects everyone,” says India McKinney, director of federal affairs for the Electronic Frontier Foundation. “Let’s do comprehensive privacy for everyone and see how that works. And if we need to put additional privacy protections in place [for kids] after that, then let’s talk about it.”

Still, other advocates—including Edward, who campaigned in favor of California’s bill—feel that these privacy efforts are moving in the right direction.

“I don’t know what’s going on with my data—and this is for the rest of my life,” Edward says. “I don’t want my data to be taken and used against me—almost manipulating me—especially at such a young age.”

Although these laws apply only in the U.K. and California, experts say they may still protect minors in other places. Online services may choose to introduce their changes globally. In the wake of such legislation, many major platforms have announced new safeguards for younger users worldwide. TikTok has promised to stop sending app notifications to teens at night. Facebook and Google have begun restricting the way advertisers can tailor messages to minors on their sites.

Congress could eventually enact a federal law. Last July, senators introduced the Kids Online Safety Act (KOSA), under which platforms would have a duty to protect young people in a variety of ways. They would be required to prevent the promotion of harmful behaviors and give parents of children under 16 the ability to opt out of algorithmic recommendations. It would also require keeping third parties from accessing minors’ data. The bipartisan bill failed to make it out of the Senate last year. Lawmakers say they’re working to get it reintroduced this session.

Some civil liberties experts have concerns. They argue that legislation that singles out children would require companies to do the same. This would increase their surveillance of everyone simply to identify those young users covered under the new law. Instead, they say, we should be focusing on privacy for all.

“There’s a clear need to have a federal privacy law that protects everyone,” says India McKinney, director of federal affairs for the Electronic Frontier Foundation. “Let’s do comprehensive privacy for everyone and see how that works. And if we need to put additional privacy protections in place [for kids] after that, then let’s talk about it.”

Still, other advocates feel that these privacy efforts are moving in the right direction.

“I don’t know what’s going on with my data—and this is for the rest of my life,” Edward says. “I don’t want my data to be taken and used against me—almost manipulating me—especially at such a young age.”

With reporting by Adam Satariano and Natasha Singer of The New York Times.

With reporting by Adam Satariano and Natasha Singer of The New York Times.