On Consent in Online Social Networks: Privacy Impacts and Research Directions

Overview & Synopsis

The EU General Data Protection Regulation (GDPR) recognizes data subject’s consent as a legitimate ground of data processing. At present, consent mechanisms in OSNs are either non-existent or not GDPR compliant. While the absence of consent means a lack of control of the OSN user (data subject) on his personal data, non-compliant consent mechanisms can give them a false sense of control, encouraging them to reveal more personal data than they would have otherwise. GDPR compliance is thus the only way to obtain meanigful consents, thereby protecting user privacy. In this paper, we discuss the characteristics of valid consent as per the GDPR, analyze the present status of consent in OSNs and propose some research directions to arrive at GDPR compliant consent models acceptable to users and OSN providers (data controller). We observe that evaluating privacy risks of consents to data processing activities can be an effective way to help users in their decision to give or refuse consents and hence is an important research direction.