Privacy principles in social media

Parents share over 60 photos of their kids every month. AI needs as few as 15–20 images to generate a realistic deepfake face. What rules do you follow before posting photos of your kids online? And once something is online, it can be copied, scraped, indexed, and stored forever. The Pause Before You Post campaign from Data Protection Commission Ireland highlights a reality many families still underestimate: We are raising children in the first generation where their digital identity exists before they understand what privacy means. Some numbers that should make every parent think: + Parents post on average 63 photos of their child per month + Research shows AI models can recreate a face with 20 or fewer images + Over 70% of parents share kids’ photos publicly at least once a week + Billions of images are scraped online to train AI systems every year + Studies found ~50% of child images on criminal forums originated from public social media posts + Over 80% of photos contain metadata or visual clues about location or routine + By age 13, many kids already have thousands of images of themselves online The campaign shows how small details become data points: A school logo → location A birthday cake → date of birth A sports uniform → schedule A street sign → home area A group photo → social circle With modern AI, these are not random details. They are structured data. Face recognition, generative AI, and large-scale scraping systems can now connect identity, location, habits, and relationships in seconds. We are entering a world where: 🔹 Every photo can train an AI model 🔹 Every face can be cloned 🔹 Every post can be archived forever 🔹 Every detail can be cross-referenced 🔹 Every child can have a digital footprint before adulthood What should parents do today? ✔ Make accounts private ✔ Avoid posting school names, uniforms, and routines ✔ Disable location tagging ✔ Don’t post full names + birthdays together ✔ Ask kids before posting their photos ✔ Assume anything public can be reused by AI This isn’t paranoia. This is parenting in the AI era. #Innvation #Ai #ChildSafety #Privacy #Deepfakes #GenerativeAI #DataAwareness #TechEthics #SocialMediaSafety #ParentingInTheAIera #OnlineSafety #CyberSecurity #ProtectKidsOnline

The TikTok privacy debate did not end with the US agreement. It has escalated. TikTok has updated its US Privacy Policy. It is now one of the most aggressive data collection regimes of any mainstream consumer platform. It explicitly acknowledges the collection and processing of sensitive personal information under US state privacy laws. Named directly: • Racial or ethnic origin. • Religious or philosophical beliefs. • Mental and physical health data. • Sexual orientation. • Transgender or nonbinary status. • Citizenship or immigration status. • Precise location data. The policy goes further. TikTok is collecting far more than what users consciously share. Under the updated policy, it gathers what you provide, what it observes automatically, and what it receives from third parties. That includes account details and identity verification documents, private messages, drafts and unpublished content, AI prompts and interactions, clipboard content, purchase and payment data, contact lists and social graphs, and an extensive set of technical signals such as device identifiers, keystroke patterns, battery state, audio configurations, and activity tracked across devices. This is not incidental data leakage. It is formalized, permitted, and documented. Images and video are treated as analyzable environments. TikTok states that it "identifies objects and scenery, detects faces and other body parts, extracts spoken words, and collects metadata describing how, when, where, and by whom content was created." Post a photo near the Golden Gate Bridge and you are not just sharing a moment. You are generating structured data about place, time, environment, and your body, or body parts. Photos and videos are not just content. They are raw material for computer vision, biometric analysis, and location inference. Tik Tok will use all of the collected data, and maintains the right to sell all of it to interested third parties, from vendors to the federal government. Leaders must act on this immdiately. Privacy policies are not background reading. They are power documents. When they change, accountability shifts with them. If you are a user, a parent, a school, a youth facing organization, nonprofits, and public institutions that use TikTok as a communications channel, the update changes the governance calculus. Engagement is not a neutral act. It carries serious legal and ethical obligations tied to data protection, duty of care, and institutional risk. The new policy deserves close reading. At this stage of platform power, and scale of data collection, policy literacy is a governance responsibility, not a personal preference. Read the policy here: https://lnkd.in/ejbm8THx

Think Before You Share: The Hidden Cybersecurity Risks of Social Media 🚨🔐 In an era where data is the new currency, every post, check-in, or status update can serve as an intelligence goldmine for cybercriminals. What seems like harmless sharing—your vacation photos, workplace updates, or even a "fun fact" about your first pet—can be weaponized against you. 🔥 How Oversharing Exposes You to Cyber Threats 🔹 Geo-Tagging & Real-Time Location Leaks Sharing your location makes you an easy target. Cybercriminals use this data to track routines, monitor absences, or even launch physical security threats such as home burglaries. 🔹 Social Engineering & Credential Harvesting Those "what’s your mother’s maiden name?" or "which city were you born in?" quiz posts are a hacker’s playground. Attackers scrape these responses to guess password security questions or craft highly convincing phishing emails. 🔹 Metadata & Digital Fingerprinting Every photo you upload contains EXIF metadata (including GPS coordinates and device details). Attackers can extract this information, identify locations, and even map out behavior patterns for targeted cyberattacks. 🔹 OSINT (Open-Source Intelligence) Reconnaissance Threat actors don’t need sophisticated hacking tools when your social media profile provides a full dossier on your life. They correlate job roles, connections, and public interactions to execute whaling attacks, corporate espionage, or deepfake impersonations. 🔹 Dark Web Data Correlation Your exposed social media details can be cross-referenced with breached databases. If your credentials have been compromised in past data leaks, attackers can launch credential stuffing attacks to hijack your accounts. 🔐 Cyber-Hygiene: Best Practices for Social Media Security ✅ Restrict Profile Visibility – Limit exposure by setting profiles to private and segmenting audiences for sensitive updates. ✅ Sanitize Metadata Before Uploading – Use tools to strip EXIF data from images before posting. ✅ Implement Multi-Factor Authentication (MFA) – Enforce adaptive authentication to prevent unauthorized account access. ✅ Zero-Trust Mindset – Assume any publicly shared data can be aggregated, exploited, or weaponized against you. ✅ Monitor for Breach Exposure – Regularly check if your credentials are compromised using breach notification services like Have I Been Pwned. 🔎 The Internet doesn’t forget. Every post contributes to your digital footprint—control it before someone else does. 💬 Have you ever reconsidered a social media post due to security concerns? Drop your thoughts below! 👇 #CyberSecurity #SocialMediaThreats #Infosec #PrivacyMatters #DataProtection #Phishing #CyberSecurity #ThreatIntelligence #ZeroTrust #CyberThreats #infosec #cybersecuritytips #cybersecurityawareness #informationsecurity #networking #networksecurity #cyberattacks #CyberRisk #CyberHygiene #CyberThreats #ITSecurity #InsiderThreats #informationtechnology #technicalsupport

‼️The European Data Protection Board has just published its draft Guidelines 3/2025 (version 1.0) on the interplay between the #DSA and the #GDPR. 📍The guidelines stress that the DSA often refers to GDPR concepts such as profiling, special categories of data, or transparency obligations. The EDPB outlines several areas of interplay. Content moderation under the DSA inevitably involves processing personal data, which must be based on lawful grounds under the GDPR. Notice-and-action mechanisms, complaint handling, and account suspensions also require strict adherence to data minimisation and transparency principles. On advertising, the prohibition in Article 26 DSA on using special categories of data for targeting complements GDPR restrictions, reinforcing a layered protection regime. Recommender systems, meanwhile, raise risks of automated decision-making that could trigger Article 22 GDPR. 📍For me, the most striking part of the guidelines concerns minors. Article 28 DSA obliges providers of online platforms accessible to minors to ensure a high level of privacy, safety, and security. The EDPB clarifies that these duties can justify certain data processing under Article 6(1)(c) GDPR, but only if strictly necessary and proportionate. Crucially, Article 28(3) DSA specifies that platforms are not required to process additional personal data simply to establish whether a user is a minor. 📍The guidelines strongly discourage intrusive age assurance methods such as scanning government IDs or permanently storing age data. Instead, platforms should apply privacy-preserving approaches, for example by confirming only that a user meets a threshold age without revealing their exact identity or date of birth. The EDPB emphasises that age assurance must be risk-based: stricter methods may be justified if the platform exposes children to high risks (e.g. harmful or manipulative content), while lighter-touch measures may suffice where risks are low. 📍Another important clarification is that providers must not nudge minors into choosing recommender systems based on profiling. Non-profiling options should be presented neutrally, and once selected, the platform should not continue processing data for profiling in the background. Similarly, advertisements cannot be targeted at minors on the basis of profiling, even if other GDPR grounds might otherwise permit such processing. 📍The guidelines also recognise that protecting children online must go beyond technical measures. Providers should adapt their services to address risks to minors’ wellbeing, including exposure to harmful content, pressure from personalised recommendations, and misuse of sensitive data. At the same time, measures must be designed with the GDPR principles of minimisation, proportionality, and privacy by design and by default firmly in mind. #privacy #rodo #ecommerce #platforms

I've got a useful PDF that I hope will help my privacy-minded AI professionals. 𝐒𝐭𝐚𝐫𝐭 𝐰𝐢𝐭𝐡 𝐭𝐡𝐢𝐬 𝐩𝐫𝐞𝐦𝐢𝐬𝐞 - "Social media data presents AI researchers with overlapping obligations under the GDPR, copyright law, and platform terms, yet 𝐞𝐱𝐢𝐬𝐭𝐢𝐧𝐠 𝐟𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤𝐬 𝐟𝐚𝐢𝐥 𝐭𝐨 𝐢𝐧𝐭𝐞𝐠𝐫𝐚𝐭𝐞 𝐭𝐡𝐞𝐬𝐞 𝐫𝐞𝐠𝐮𝐥𝐚𝐭𝐨𝐫𝐲 𝐝𝐨𝐦𝐚𝐢𝐧𝐬, leaving researchers without unified guidance." 𝐍𝐨𝐰 𝐮𝐬𝐞 𝐭𝐡𝐢𝐬 𝐝𝐢𝐬𝐜𝐮𝐬𝐬𝐢𝐨𝐧 𝐩𝐨𝐢𝐧𝐭. There are three intersecting legal frameworks that govern how AI researchers can access, process, and use social media data. These frameworks are data protection, intellectual property IP, and contract law. 𝐔𝐧𝐝𝐞𝐫𝐬𝐭𝐚𝐧𝐝𝐢𝐧𝐠 𝐭𝐡𝐞𝐬𝐞 𝐟𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤𝐬 𝐢𝐬 𝐞𝐬𝐬𝐞𝐧𝐭𝐢𝐚𝐥, as they shape every decision from initial data collection through model deployment. Now meet PETLP (Privacy-by-design Extract, Transform, Load, and Present), a 𝐜𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐟𝐫𝐚𝐦𝐞𝐰𝐨𝐫𝐤 𝐭𝐡𝐚𝐭 𝐞𝐦𝐛𝐞𝐝𝐬 𝐥𝐞𝐠𝐚𝐥 𝐬𝐚𝐟𝐞𝐠𝐮𝐚𝐫𝐝𝐬 𝐝𝐢𝐫𝐞𝐜𝐭𝐥𝐲 𝐢𝐧𝐭𝐨 𝐞𝐱𝐭𝐞𝐧𝐝𝐞𝐝 𝐄𝐓𝐋 𝐩𝐢𝐩𝐞𝐥𝐢𝐧𝐞𝐬. Database folks love ETL - it's how they extract, transform and load external data to centralized data repositories. This new PETLP teaches us some new insights. 1. "True anonymization" is unachievable for social media data. It exposes the legal gap between dataset creation and uncertain model distribution. 2. Conventional data pipelines treat compliance as an afterthought. But PETLP tries to remove ambiguities by directly addressing each layer of complexity in your data pipeline, such as structured extraction of data and living DPIAs. 💡 GDPR establishes fundamental principles for data handling that directly shape how AI researchers can work with social media data. Its definition of ‘processing’ encompasses virtually every research activity, from collecting posts to storing usernames and training models. 💡 This means GDPR compliance is not a one-time checkbox but an 𝐨𝐧𝐠𝐨𝐢𝐧𝐠 𝐨𝐛𝐥𝐢𝐠𝐚𝐭𝐢𝐨𝐧 𝐭𝐡𝐫𝐨𝐮𝐠𝐡𝐨𝐮𝐭 𝐭𝐡𝐞 𝐫𝐞𝐬𝐞𝐚𝐫𝐜𝐡 𝐩𝐢𝐩𝐞𝐥𝐢𝐧𝐞, from initial data collection to final model deployment. This PDF is useful for anyone using social media research. It reminds us that models trained on personal data cannot, in all cases, be considered anonymous (EDPB 2024), meaning any model publication may constitute ongoing personal data processing.

All organizations must comply with evolving privacy regulations and meet customer expectations. Clarity on what needs to be managed is critical. These are three key areas to focus on: 1) Privacy Rights Requests. 2) Consent & Communication Preference 3) Cookie Consent Management. Here are details: 1) Privacy Rights Requests (DSRs) These rights are governed by laws like GDPR (EU), CCPA (US), etc. They empower individuals to control their personal data, including: -- Access, Delete, Correct, Portability. Example: “Send me all data you have about me” -- Restrict Processing, Withdraw Consent. Example: “Pause processing my data for marketing” -- Object to Automated Decisions Example: “Request human review of a loan application instead of relying solely on an algorithm.” -- Opt-Out of Sale/Sharing Example: “Do not sell my data to third parties” (CCPA) -- Limit Sensitive Data Use Example: “Restrict use of my health data for analytics” 2) Consent & Communication Preferences Governed by: GDPR, TCPA (US), CAN-SPAM (US), CASL (Canada), etc These preferences give customers control over following engagement: -- Marketing opt-in/out (email, SMS, calls) Example: “Subscribe to product updates via email” -- Transactional notifications Example: “Receive SMS for delivery status” -- Terms acceptance Example: “Agree to app Terms of Service before use” -- Sensitive data consent Example: “Allow use of biometric data for authentication” -- Frequency & channel preferences Example: “Send me monthly newsletters, not weekly” 3) Cookie Consent Management These are governed by: ePrivacy Directive (EU), GDPR, CPRA, etc They ensure transparency and compliance with tracking technologies: -- Published cookie policy Example: “View detailed cookie categories on website” -- Consent banners (accept/reject/preferences) Example: “Choose analytics cookies only” -- Block non-essential cookies until consent Example: “No ad tracking until user opts in” -- Record and audit consent Example: “Store timestamp of user’s cookie choice” -- Editable/revocable consent Example: “Change cookie settings anytime via footer link” -- Essential cookies exempt Example: “Session cookies for login remain active”

🔐 Designing For Privacy UX. Privacy isn’t about hiding something, but protecting user’s personal space. UX guidelines on how to design more respectful, private experiences that drive long-term loyalty ↓ 🤔 When data requests feel intrusive, users enter fake data or give in. ✅ Privacy is about user’s control of what happens to their data. ✅ Privacy by default: features should work with min data required. 🚫 Don’t ask for permissions that you don’t need at the moment. ✅ Right to be forgotten → allow users to delete data in settings. ✅ Data portability → allow users to take their data with them. ✅ Hidden Unsub links downgrade email reach (marked as spam). ✅ Neutral choices → give people real choices with neutral defaults. ✅ Data you don't ask for is the data you can't lose in a breach. ✅ Explain then ask → if you need user’s data, first explain why. ✅ Try before commit → show and explain value before asking for data. ✅ Remind me later → give people time to make a decision on their terms. ✅ Contextual consent → ask for data only when user’s action needs it. ✅ Automated data decay → delete user's data not used after X months. --- In many companies, privacy is treated as a technical hurdle to be cleared off. Companies thrive on user’s data for personalization, customized offers, better AI models — but also invasive targeting, ultra-precise tracking, behavioral predictions and eventually reselling data to the highest bidder. All of it isn’t only invasive and undermines trust — it also makes for slow experiences and advertising following you everywhere you go. Predictive models know a person is pregnant based on their browsing habits before they do. And once they do, ads, offers and messages will follow you everywhere you go — before your closest relatives hear it from you. When we speak about privacy, we often assume that that’s an exaggerated problem that doesn’t really affect us much. After all, we have nothing to hide, and so there is no harm in companies knowing a few things about us. But privacy isn’t about hiding something. It’s about protecting your personal space from external influence and manipulation. It’s about protecting your personal decisions and your intimate experiences, and having a choice to share them with people you trust and care of. Most people wouldn’t feel comfortable being observed by a camera during their work or during their spare time. Yet as we move from one page to the next, that’s exactly what happens, often without our consent. And just like web performance and accessibility, privacy is a part of user's experience. The good news is that European Commission is looking into modifying the way GDPR works. So users could tick a box in browser preferences, with privacy settings turned on by default. And then websites shouldn't be allowed to ask for consent because it's already not granted. I'm looking forward to that future. I’ve also put together a few practical books and useful resources in the comments below ↓

🤦 My kids are using hacking against me! 🤦 😢 A few years ago one of my kids got in trouble for sharing something inappropriate that they were sent, with others. At the time I thought I had done enough to teach them about the right things to do with personal privacy and things of that nature. From that day on, I put stronger emphasis on making sure my kids were taking the security of their own selfs and others more serious. 🏎️ We teach teens how to drive before they get behind the wheel—so why don’t we do the same for navigating the digital world? 💻 Teens today are more connected than we ever were, but many don’t fully understand the risks of oversharing, weak passwords, or falling for online scams. As cybersecurity professionals (and responsible parents), we need to empower them with digital citizenship skills that protect their privacy and security. Here’s what we should be teaching them: 🔹 Think Before You Share – Once something is online, it’s nearly impossible to erase. Encourage them to ask: Would I be okay if this was public? 🔹 Use Strong, Unique Passwords – No more "password123"! Teach them about password managers and multi-factor authentication (MFA). 🔹 Beware of Phishing & Scams – Not everything online is what it seems. Train them to spot red flags in messages, emails, and DMs. 🔹 Privacy Settings Matter – Social media profiles should be locked down. Show them how to limit who can see their information. 🔹 Your Digital Footprint is Forever – What they post today could impact their future job opportunities or college admissions. Cybersecurity isn’t just an IT issue—it’s a life skill. Let’s start teaching our teens how to stay safe online before they learn the hard way. What’s one cybersecurity tip you wish you had learned earlier? Drop it in the comments! #Cybersecurity #DigitalCitizenship #OnlineSafety #PrivacyMatters

"Clean up your social media presence - Your online footprint can compromise your security even if your device is properly protected. Here's how to improve it: - Conduct privacy audits across all platforms. Review and restrict visibility settings for posts, photos, friends lists, and personal information. - Address historical content vulnerabilities. Use platform tools to delete or archive old posts containing sensitive information, location patterns, or personal details. - Remove metadata from photos and videos before sharing. Most digital images contain EXIF data with precise location coordinates and device information. - Control facial recognition and tagging settings. Configure platforms to require your approval before others can tag you in content... " #Prescient #Cybersecurity #DataProtection #Privacy #CISO #CSO #CEO #Legal