The deep integration of social networks within the digital generation has led to the rise of complex new social norms which govern activity both online and offline. The norms which govern social media are not an entirely new set of standards (they are an evolution of the standards that the previous generation abided by), but are practiced in a distinctly different environment in which instant, digital communication is almost universal. These norms, which range from the proper frequency of Instagram posts to how much information is appropriate to share on hookup apps, are not consistently followed. Like all social environments, there will always be outliers. Still, the vast majority of social interactions and online profiles abide by these standards.

For a generation that supposedly doesn’t care about privacy, a surprising number of these social norms deal explicitly with the appropriate disclosure of information. While large gaps remain in the social code—for example, whether or not permission is required to post a photo of someone else in many cases is ambiguous—the norms trend in favor of privacy. Despite the ubiquity of social media, however, the social norms which developed alongside it have not yet caught up to the speed at which social media has ingrained itself in the digital generation. Large portions of online activity go unaddressed: whether or not permission is required to post a photo of another person, for example, remains ambiguous.

Society is governed social codes (which lead to social norms), however the law has yet to catch up to the speed at which the Internet—and particularly social media—has developed. In cyberspace, an area notoriously devoid of legal precedent, social norms are doubly important. This chapter is an analysis of these fundamental social norms as they relate to digital natives and privacy.

These norms and codes are too numerous and complex to be discussed in their entirety. More importantly, however, they are not all relevant to privacy: the norms about proper filter use and commenting-etiquette have no meaningful implications on anyone’s privacy. In the following section, I will discuss the privacy-related social rules which dictate activity on traditional, follower-based social networks (such as Instagram and Facebook), Snapchat, hookup apps (most notably Tinder), and offline.


On traditional social networks such as Instagram and Facebook, there is a general expectation to ‘tag’ people in photos. Simply put, tagging is the act of declaring the people who are in a photo. When someone is tagged, they will be notified, and the photo that they are tagged in will be visible on their profile page. On Facebook, tagging also allows for the photo to be displayed on the feeds of the tagged users’ friends, allowing for a photo to find a greater audience and achieve higher levels of engagement.

In many ways, tagging is considered a sign of respect and acknowledgement among digital natives: doing so notifies the members of a photo that it has been published, allows them the option to display it on their profile, and on Facebook, sometimes inserts the photo into the feeds of the tagged users’ friends. While tagging is not always possible (Instagram has a limit of 20 tags per photo), it is can be considered hurtful to tag some members of a photo and not others. (As a result, it is not uncommon to see large group photos remain untagged for fear of excluding someone.)

Tagging the members of a photo ensure that these members are aware that the photo is shared. Privacy is about control over one’s own information, and this control cannot be exercised if one does not know what information is available about oneself. For example, if a rude, sensitive, or otherwise inappropriate photo is posted of me online, I can only control the fallout if I am aware that the photo exists. If I am tagged in the photo, I will be notified and can therefore act accordingly. Whether or not it was correct for someone else to post the photo of me without my prior permission is a different question altogether (predictably, my answer leans towards ‘no’)

In the unescapable competition for followers online, tagging can provide a distinct advantage. On Facebook especially, being tagged in someone else’s photo can introduce a user to an audience far beyond their normal network. While there will most likely be some degree of overlap between the friends or followers of the poster of a photo and those tagged in the photo, there is usually still a sizeable group of users who are not common between the all users. When other users see the photo, they may like the photo, as well as follow or friend the tagged users.

I’ve found that on Instagram, I receive an influx of follower requests whenever I am tagged in a photo. Usually these requests come from people I am already acquainted with but simply haven’t followed (I’m not very diligent about keeping my online social networks representative of my offline social networks), but this is to be expected: tagging is meant to be less of a form of introduction and more of a means of recognition. Still, tagging remains an effective tool for expanding one’s online social network, and the pressure to always is a consequence of the obsession with followers.

"In general, I like when people tag me in posts because I see it as a form of acknowledgement of my presence. It depends on the person who tags me whether I will get more follower requests, though, because if it’s one of my friends who tagged me, it’s likely that we have the same people following us already so I won’t get very many requests from that. Also in general, I try to only accept follower requests from people I’ve met in person. But in general, I like to be tagged."

Tagging, however, is not always celebrated. Because tagging would allow anyone a certain degree of control of the profile (and on Facebook, friends’ feeds) of any other user, Facebook and Instagram allow users to choose which of the photos they are tagged in to make visible on their profile, and whether photos they are tagged in should be visible by default. On my personal Instagram account, I have set photos that I am tagged in to not automatically appear on my profile. I do this so that I maintain complete control over what is available about me to my followers: if I am tagged in a photo I either don’t like or don’t approve of, it will never appear on my profile. With this setting enabled, however, a potentially malicious user—a cyberbully or otherwise—could ‘taint’ my image by tagging me in an inappropriate or offensive photo. Still, Instagram allows for photos to be selectively hidden from one’s profile, so any damage done by a malicious user would be temporary.

The dangers of tagging are amplified on Facebook. Because photos a user is tagged in can appear in the feeds of the tagged user’s friends, a malicious user who hopes to embarrass, defame, or humiliate another user can simply post whatever photo they’d like, tag the targeted user, and hope that the photo appears on the feeds of the targeted user’s friends. Fortunately, it is not difficult to change Facebook’s privacy settings to avoid such a scenario—an entire section of the privacy settings are devoted to ‘Timeline and Tagging,’ and Facebook offers a tool to audit all the photos that you’re tagged in—but it’s easy to overlook these settings.

Tagging is very rarely used for malicious purposes, however, and most users do pay close attention to the photos that are visible on their profile. Indeed, selecting what tagged photos to display and which photos to hide is among the standard routine of an avid social media user. Most tagged photos are not removed in response to any form of bullying—instead, they are most commonly removed because they are considered unflattering.

"I include maybe one out of every ten photos I’m tagged in on my Instagram profile. Some of the photos I choose to hide from my profile because I don’t look good in them, and some of the photos I hide because you can’t even see me in them (sometimes my friends tag me in posts they find funny, even if they have no relation to me). Once, though, someone posted a really embarrassing photo of me on Facebook and tagged me, and it was shown to all of my friends… the photo was of me really sick after a party, and they posted it before class elections. I was running for school co-presidents, and a lot of people saw that photo. It was bad. Let’s just say I lost by a lot. And because they tagged me in the photo and marked the location as my school, I think that Facebook’s algorithm was more likely to show my classmates and my friends the photo than if [the poster] had just posted it on his account himself. Everyone saw."

Most of the photos I have been tagged in have not made it to my profile. Still, I encourage people to tag me in photos even when I have no plans to include the photo on my profile: tagging, after all, is a valuable way to expand one’s online social network. And I admit that when I’m not tagged, I can feel a bit hurt.


Even more central to social media than tagging is creeping. Few forms of online harassment are as normalized and accepted as creeping. Defined simply as the act of scouring old social media posts of another person (and sometimes also referred to as social media stalking, online stalking, or backstalking), creeping is among the most pervasive and normalized online privacy violations. Unlike many other more sophisticated forms of digital surveillance, such as browser tracking and complex malware, creeping requires no technical skill. Instead, creeping requires only a tenacious determination to scroll. Furthermore, creeping is not nearly as demonized as other forms of online harassment—BuzzFeed features multiple ‘are you a social media stalker?’ quizzes and articles on its website, and creeping is often depicted in a humorous manner in the online media, a product of the insignificance with which the online community regards creeping.

Not only is creeping destigmatized, however, it is also distressingly easy to pull off: a stalker simply needs a computer, an internet connection, and an accepted friend request. (NOTE: For private accounts only.) Time-sensitive social media privacy settings have yet to reach the Facebook, Twitter, and Instagram preferences dashboards—a post from 2013 is just as public as a post from last week—making all social media users vulnerable to creeping. While it is important to differentiate between the not-illegal (but only borderline ethical) creeping and the much more serious cyberstalking (which is a crime among the likes of harassment and stalking), the dangers of social media creeping cannot be understated.

"I try to be minimal with the information I share on social media, because I know there are people who can uncover information through social media that I would not want certain people to have. It’s scary that there is information about some of us online without us even being aware or remembering it. I think that people underestimate the amount of possibilities that can happen with the slightest bit of information."

Given the vast amounts of information digital natives share online, there are few elements of one’s identity which cannot be determined or deduced from one’s social media footprint. A 2013 Pew Research study found that over 90% of teens shared their real names and photos of themselves on social media. Slightly more than 80% shared their birthdate, and around 70% shared their general location and school name. Around 80% also shared their interests, such as their favorite music and movies. (By contrast, only 20% shared their phone number, and roughly 24% shared videos of themselves.)

To demonstrate the sheer wealth of the information available about digital natives online, I creeped—with permission, of course—on a personal friend named Emily. She is an avid Facebook and Instagram user, and I am connected with her on both platforms. I didn’t know much about Emily’s life before I met her in September 2015, but navigating through her Facebook and Instagram accounts have given me a dangerous sense of borderline omniscience.

From just a quick glance at her Facebook profile, I was able to determine a few basic facts about her life: her birthday is June 3rd, she lives in Hong Kong but goes to high school in the United States, and is sixteen years old. She has a sister named Josephine who lives at home in Hong Kong. I knew all this already, of course, but this information alone is enough to impersonate familiarity: a potential stalker or predator could use this information to masquerade as an old friend and develop a false sense of trust. Such a predator could approach her while in Hong Kong and ask how she was enjoying school in the United States, and how Josephine was doing. By asking these personal questions, the predator could establish a trusting acquaintance with Emily, despite the fact that they had never previously met.

The threat of false acquaintance is a very real one, especially among young children and teens. While "do not talk to strangers" is common advice, such advice is useless when strangers can easily mask themselves as family friends. This vulnerability—and it is a vulnerability in human behavior, not the social media platforms themselves—is made possible only by a few points of information: family members, place of study, and age. All of which I was able to easily determine about Emily in a single glance at her Facebook homepage.

Diving deeper into Emily’s profile reveals much more about her life. Before attending an elite New England boarding school, Emily attended Diocesan Girls’ School in Hong Kong. She is an active rower, and candid photos of her teammates decorate her Facebook and Instagram pages. In the United States, her closest friends are Lara, Alexandra, Natalie, and Sophie. At home in Hong Kong, her best friends are Christie, Tessa, and Jess. She spends her holidays with family in Japan, but in 2016 traveled to Los Angeles to visit Lara. There, they visited Six Flags and the piers, as well as a variety of other dining spots that Lara suggested.

More illusory of Emily’s identity than her general whereabouts, however, are the substance of her posts. She avoids crafting political commentaries (on Facebook, however, these are more aptly called rants)—yet her feed is littered with likes of unashamedly-liberal news stories. Most of her own posts, though, are simply birthday wishes to all of her 400+ friends, perhaps demonstrative of her somewhat withdrawn and private character.

"I do try to keep my Facebook private, only posting pictures that I am comfortable with my parents and relatives seeing. However, when presented with the idea that many can use this information for malicious purposes, I am surprised by how much they can know about me just from my profile. I also often forget about things that I posted when I was younger, which are likely to cause embarrassment if rediscovered."

Despite her privacy-inclined tendencies, a bit of Facebook digging and clever searching reveals long and drawn out directed posts to her friends about a "relationship" she had in eighth grade. In these posts, which are dated from 2014, Emily describes her discontent at her partner’s flirtatiousness with other girls. Emily has probably forgotten that these posts exist, but a single ‘like’ on my part could propel them back up to the top of her feed—and the feeds of her friends. More importantly, however, I have been given an uninvited glimpse into the causes of the ups and downs of Emily’s romantic life, yielding information which could be used by a predator to manipulate her emotionally.

If I were to like one of Emily’s old posts, most likely by accident as I was scrolling, she would immediately receive a notification. While Emily would certainly suffer most of the embarrassment in such a scenario (her eighth grade romantic activities—which are not a high point for anyone—would be revealed to all my Facebook friends), I would experience some degree of embarrassment as well. Indeed, I would be seen as a creeper not only by Emily but also by all my Facebook friends who saw on their feed that I liked a four year old photo.

Because there is no scenario in which Emily’s old post could appear on my Facebook feed (unless, of course, one of my friends shared or liked it), by liking the post it is made clear that I was creeping through Emily’s old posts. And, because creeping is considered to be strange (and desperate—if the creeper and the creeped are of the opposite sex, due to heteronormativity), I run the risk of being branded as a social outcast. (NOTE: Not already true though?)

"When someone likes my photo from two years ago, I think that person is a creep! It doesn’t matter who is “stalking"—looking through my photos from years ago. It doesn’t matter who the person is, it still creeps me out. Even if it is a very close family relative. I know that sharing personal stuff on social media is risky because you have to sacrifice privacy, but I kinda tolerate the creeping.”

On Instragram, the fallout of liking an old post is lessened. Because an Instagram feed is limited to only recent posts, liking someone else’s old post would not propel that post—and the fact that you liked it—to the top of all your followers feeds. Instead, the person whose photo was liked would merely be sent a notification. There would be considerable embarrassment for the creeper—and rightfully so—but much less for the creeped.

This ‘like’ would probably have happened accidentally. On Facebook, it is not difficult to accidentally click the ‘like’ or ‘share’ button while scrolling, and it is similarly easy to accidentally double-tap while swiping upwards to scroll. By virtue of the sheer unpredictability of ‘liking’ a post while creeping—and subsequently revealing one’s activity to the person being creeped on and possible all of one’s friends—there is an inherent danger in creeping. Unless one is able to disable ‘liking’ on Instagram and Facebook (which cannot be done), there is an unavoidable risk in creeping. This risk of exposure is arguably the only deterrent from creeping: if it went undetected, creeping would have no drawbacks apart from maybe an internal feeling of shame, and social media users would have no incentive to not stalk their friends, enemies, and exes online.

Liking an old photo is only embarrassing because creeping is considered strange, rude, and sometimes desperate. Still, social media creeping has been normalized and satirized to the point that digital natives openly call themselves social media stalkers. It usually takes the form of a self-deprecating joke, but it is dangerous nonetheless: by normalizing creeping, society tolerates a digital form of stalking. Regardless, social media stalking is a recurring topic of online humor and entertainment. BuzzFeed has published numerous quizzes, articles, and videos about creeping, all of which portray creeping in a non-serious manner.

image alt text

A popular BuzzFeed online quiz.

The popularity of these BuzzFeed quizzes, videos, and articles is indicative of the near universal relatability of creeping among native social media users. Very few of us can truly admit that we have never scoured through the posts of an acquaintance, crush, or even a complete stranger to learn more about them. The near ubiquity of social media creeping leads one to wonder whether creeping is really a strange act at all, or rather simply another feature of feed-based social media that all of us—despite the stigma we hold against it—do ourselves. Creeping, for the worse or for the better (but mostly for the worse), has become a social media norm.

In fact, it is often difficult to distinguish between creeping and standard social media: creeping, after all, is simply searching social media for information that has been shared publicly but has disappeared over time from feeds. While social media stalking is in some cases very obvious, such as when a seven year old photo is liked, it can be much more ambiguous in others: take, for example, when someone quickly scrolls through the feed of someone who requested to follow them on Instagram or friend them on Facebook. This is much less creeping as it is due diligence—it is important to vet the people with whom we share our online lives—but in many ways is still creeping: the person vetting the prospective follower is combing through their history in order to verify they are someone the person feels comfortable sharing with. The lines between creeping, browsing, and due diligence, then, are blurred.

This is principally the fault of social media, not social media users. It would be simple for Facebook to prevent creeping on their platform: all they would need to do is implement time-based privacy settings. For example, they could create an option which would allow for a user to make only their past month of activity visible to their friends. This would protect the user from forgetting about potentially embarrassing old posts that remain public, like Emily did of her eighth grade posts about her then-boyfriend.

Such privacy settings are not available, however, and users are left with little more than a binary decision to make in terms of their historical data: deactivate their account and share nothing at all, or share posts regardless of their age. While it would also be possible for a user to manually delete their old posts, this would require a tremendous effort. Predictably, most social media users consider themselves too invested in the networks they have developed online to delete their accounts, are too lazy to manually delete their old posts, and instead choose to continue normally. This lack of choice for the user puts the weight of preventing social media creeping—preventions which I believe are necessary—on the platforms themselves.

Interestingly, not all social media platforms are vulnerable to creepers. For example, Snapchat is not vulnerable to creeping whatsoever. Because Snapchat consists mostly of expiring direct video messages and publically-shared video ‘stories’ which disappear after twenty-four hours, no historical data—public or otherwise—is available on the platform for a creeper to exploit. While a particularly determined creeper could archive all the photos someone posts on their publically-accessible story, the poster would be notified of such screenshots and would likely either call out or block the user. Regardless, the creeper has no possibility of stealth, and would have to devote significant time to capturing each of the poster’s stories within twenty-four hours. And most social media stalkers have little interest in this form of manual archival. To them, that is the job of the platform itself.

Creeping, ultimately, is simply a social media norm which developed out of natural human curiosity, naïve trust among social media users, and the negligence of social media platforms like Facebook and Instagram to not offer adequate privacy settings. While creeping satirized online and used as a self-deprecating descriptor, it remains a dangerous privacy violation: the vast data that natives share about themselves on social media can be used to control and embarrass them by someone with merely a willingness to scroll.

Although creeping is discouraged, its normalization in native culture has allowed for it to be tolerated. The idea of being ‘stalked’ on social media causes natives—and anyone, for that matter—to become uncomfortable, but is still no ground for serious discontent. And, given the state of social media today, there are few ways to protect oneself against creeping apart from either deactivating one’s account or trimming down on one’s followers. Both actions, however, would damage oneself in the overwhelming competition for attention online—followers, likes, shares, and all the other metrics by which natives measure themselves. Thus, natives find themselves in a difficult situation: be stalked, or be forgotten.

Permission to Post

Unlike creeping and tagging, in which the norms are well established (creeping is bad, tagging is good), much more ambiguity surrounds posting photos of other people. Whether permission is or is not necessary to post a photo of someone else remains somewhat enigmatic. Some request permission from each and every member of a photo before posting. Others—and I myself fall into this category—request permission from everyone in a photo before posting most of the time, unless it is a formal group photo in which there is an expectation that it will be posted (take, for example, a group photo at a family reunion). Others never request permission at all, and freely post photos of anyone anytime they like. They may sometimes request permission, but that is the exception, not the rule. And, unfortunately, all of these methods—seeking permission always, conditionally, and never—are socially acceptable.

Sometimes, however, it is not feasible to ask every member of a photo whether they feel comfortable sharing it online. And, in some cases, it is not necessary. For example, in group photos such as the one shown below, there is an expectation that the photo will be shared. The photo is clearly organized, and each member of the photo knows that they are being photographed. As such, it is not necessary to seek permission from every person present in the photo before sharing it.

image alt text

An organized group photo. Wikimedia Commons.

If anyone were to share this photo on social media, it is unlikely that any member of the photo would have any objections. After all, there is an expectation in group photos that the photo will be shared freely. One member of the photo does not have the social agency to disallow everyone else from distributing the photo, and a refusal to honor such a request would not be taken as strange or rude—instead, it would be the requester who would be considered rude. Almost without exception, the photo may be freely shared.

Not all group photos have the same expectation of free sharing, however. In smaller group photos, for example, in which there are only four or less people, it is socially acceptable for one of those members to request the others not to share the photo. (Usually, such a request would be accompanied by an offer to retake the photo.) If there are no objections to the photo, however, it remains largely ambiguous whether the photo may be shared without permission.

In some social circles, I have found that the expectation for nearly every photo taken is that it will be shared on social media platforms like Snapchat, Facebook, or Instagram. Rarely are photos taken for the keepsake. Instead, the almost singular intent is to share. In these circles, an absence of an objection to the photo is taken by all as permission that the photo may be posted online. In other circles, however, this is not the case. These circles, in which social media is usually less popular, often consider group photos to merely be personal keepsakes, and there is no assumption that the photo will find its way online. In these circles, explicit permission from each member of the small group photo is necessary before posting, and doing so without this permission will likely be taken as rude. Whether or not permission is required in small group photos depends on the group itself. There is no universally expected behavior, and therefore no norm.

In individual or candid photos, permission should be requested from all those included in the photo, but this is not generally considered necessary. The norms which govern social media have yet to address this scenario, leaving natives to decide for themselves what the proper action should be. Some natives are perfectly comfortable with photos being posted of them online by their friends without their permission, and others are much less complacent. I fall into the latter category. While what natives—and anyone, for that matter—are comfortable in regard to photo sharing depends on who took the photo, who is in the photo, and perhaps most importantly, how one looks in the photo, there are four general and distinct scenarios: non-candid photos with permission—though likely conditional—to post, non-candid photos with permission explicitly not given to post, non-candid photos with permission unspecified or unclear, and candid photos. Each of these scenarios carry different social expectations and different conditions of sharing.

Non-candid, permission given. In this scenario, in which the members of a photo are not only aware that a photo has been taken but have also given their explicit permission to a prospective poster that they may share the photo, there is little ambiguity. Those pictured in the photo have given permission for the photo to be shared, and further permission is not required. Still, this permission is often conditional on when the photo is posted, who posts the photo, to whom the photo is shared, and where the photo is shared.

The assumption in taking a photo for social media is that the photo will be posted not long after it is taken. While not a rule, it can surprise natives if a photo of them from three years ago, even if they gave permission to share it at the time, resurfaces on their feed three years later. This can be more appropriate in certain social contexts—"throwback Thursdays" (“TBT’s”), for example—but posting an old photo of someone else “out of the blue” is uncommon, and would be considered abnormal.

Albeit somewhat obvious, there is also a general expectation that only people directly involved with a photo may post it. Furthermore, permission to post a photo is generally granted to someone (and not as a general relinquishment of rights), but it is not uncommon for this permission to be generalized—perhaps incorrectly—to all those involved with a photo. For example, I recently found myself taking a photo with two close friends of mine, one who has roughly 250 followers on Instagram (most of whom are my friends as well), and the other with closer to 1,250 followers (most of whom I didn’t know). I gave permission to my friend with 250 followers to post the photo on her Instagram account, however my friend with 1,250 mistakenly interpreted my statement as giving him permission as well. The sheer size of his followers and the fact that I did not know most of them personally made me uncomfortable. I chose not to confront this friend about the post—I didn’t want to cause an awkward scenario, especially because I didn’t know this person that well—but his actions still speak towards a larger issue of conflated permission among digital natives.

Not only is permission usually conditional on when and by who a photo is shared, it is also conditional on where the photo is shared. Posting a photo on one’s Snapchat "story" (twenty-four hour long timelines visible to all of one’s friends) is considered to be fundamentally different from posting a photo on Instagram: the Snapchat story lasts for twenty-four hours while the Instagram posts lasts indefinitely, and the audience of an Instagram post tends to be much larger than that of a Snapchat story. The differences between platforms can often be more striking than format (like that between Instagram and Snapchat). Indeed, the difference between sharing a photo on a Snapchat story and via an Instagram post are largely a difference of how long the photo is shared and to whom the photo is shared, effectively a combination of the previous two conditions of permission: when and to whom.

The condition of where a photo is shared is not merely a combination of when and to whom, however. For example, using a photo as one’s Tinder (NOTE: Tinder is a "dating app" (though more aptly described as a hookup app).) profile picture—if you consider Tinder to be a social network at all—is very different than posting that photo on Snapchat or Instagram. While it is true that part of the difference between Snapchat or Instagram and Tinder is the audience (Snapchat and Instagram are usually to share with friends, while Tinder is to share with prospective—but unknown—partners), there exists a more fundamental separation between the networks: their purpose. For most users, Instagram and Snapchat are platforms to connect with friends on. Tinder, on the other hand, is a platform to connect with prospective romantic—but more often simply sexual—partners on. Therefore, intention becomes an important question when taking a photo. Is the photo meant to update friends on one’s whereabouts and social associations, or is the photo meant to showcase oneself for potential partners? As such, the condition of where a photo is shared online is as much a combination of previous conditions—when and to whom—as it is a condition of why a photo is shared.

Non-candid, permission unknown or ambiguous. Unfortunately, more often than not, these conditions are neither asked nor stated, let alone clarified. Digital natives frequently find themselves forced to navigate situations in which they are neither allowed nor disallowed to post a non-candid photo (an important qualification, as the next section will demonstrate) of their friends. While a non-group photo should never be shared without the explicit permission of those pictured in the photo, natives often act otherwise, instead relying on their own social instinct to determine right from wrong. Usually, social instinct correctly guides digital natives to the right decision of whether or not to post. And, while it is not unheard of for members of photos to ask that a photo be taken down, it is admittedly rare: in the interviews conducted for this book, 90% of participants said that they have never been asked to take a photo down. Digital natives’ social privacy instinct is formidable in its accuracy.

In most photo-posting scenarios, this intuition takes charge. In making their decision whether or not to post a photo, there are four major factors that digital natives consider, each corresponding to the one of the four major conditions of permission mentioned previously: their relation to those pictured in the photo (who), time since the photo was taken (when), on what platform they are posting the photo (where), and with whom they are sharing the photo (to whom). (There are of course other social factors at play—for example, whether those pictured in the photo are still on good terms with one another—but these are too complex to distill and discuss with any degree of certainty.)

Who. The most important factor is the relationship between those pictured in the photo the prospective poster. Indeed, if all those pictured in the photo are close friends with prospective poster, the poster is more likely to consider posting the photo appropriate. Interestingly, the closer the members of a photo are with the poster of the photo, the more comfortable they are reaching out to the poster to request that the photo be taken down. Still, the poster is likely to view their relationship with those pictured as a form of trust that—provided the photo is otherwise appropriate—enables the poster to distribute the picture freely.

Often, the prospective poster is also pictured in the photo, giving them a false sense of ownership over the photo and its distribution: many believe that by being present in the photo, they have a right to post the photo however and wherever they choose. This is done with some regard for the other members of the photo—all other social considerations remain—but weight significantly less weight in the final decision. For example, a prospective poster may be so satisfied with how they appear in a photo that they neglect to consider how the other members of a photo would respond to their own image. After all, how one is seen is incredibly important to digital natives (and teens in general), online or not.

When. Similarly important when considering whether a photo is appropriate to post is the time that has elapsed since a photo was taken. If a photo is a year old, it may be less appropriate—with the exception of an occasional "throwback Thursday"—to post than a photo which is only a few hours old. Somewhat counterintuitively, however, it is not age that determines whether it is a right time to post a photo. Instead, it is social relevance. Was this photo taken at an event which occurred recently? Does a recent or current event involving those in the photo suddenly propel the photo back to relevance? If the photo is a throwback, is it Thursday? Is it a special holiday, such as Mother’s Day, which would make posting the photo suitable? These questions demonstrate that it is not the raw age of a photo which determines its suitability to post, but rather its relevance to external circumstances.

Where. The platform on which the photo is being shared—Instagram, Facebook, Snapchat, etc—is another central consideration. Snapchat is most appropriate for casual, snapshot-like photos. While not at all strange or inappropriate, it would not be standard to post a formal group photo on Snapchat. Instead, Snapchat is largely filled with off-the-cuff short videos, filter-laden selfies, and vomiting rainbows. (NOTE: A reference to a popular Snapchat feature.) More importantly, however, Snapchat stories disappear after twenty-four hours, and direct messages can only be viewed once. The temporal nature of Snapchat reduces the quality of its posts, and natives are often much more open to casually posting a photo on Snapchat than on another more permanent platform. And, of course, the intention of the social platform must be considered as well: someone may be comfortable with a photo including them being posted on Instagram, but not comfortable with a photo which includes them being used as an OkCupid (another dating site) profile.

To whom. Online sharing, ultimately, is the act of distributing information to others, and the core function of social networks is determining and providing these others. Therefore, with whom a photo is being shared is another invaluable factor when inferring appropriateness. Often, social media networks only provide binary options in terms of sharing: public or with friends (an important exception being Facebook, which offers the ability to share with friends-of-friends or exclude certain friends, and Instagram, which offers no per-post privacy options at all). Because sharing options are platform-specific, I have had a difficult time discovering trends regarding their use. The most true statement possible is that it is usually considered most appropriate to share with a limited audience—i.e. not public—that also includes everyone pictured in the photo. (Large group photos, such as a photo of an entire sports team or class, are important exceptions.) Sharing with a group that intentionally (NOTE: It is possible that some members of a photo will not have an account on the necessary social media platform. This is not a concern for digital natives, who will share anyway.) doesn’t include all those pictured in the photo can often be taken by natives as "speaking about someone behind their back," and is generally discouraged.

Ultimately, the general assumption among natives is that any photo may be shared online by anyone either in the photo or involved with the taking of the photo (if those groups are separate at all). Some consideration is made for the assumed privacy preferences of those pictured, but they are merely an afterthought when compared to the level of attention paid to more personal factors (such as the anticipated response of one’s followers to a post). This is perhaps the reason that there is no standard behavior for posting photos of other people: apart from the courteous, no one thinks about it. This is not to say that digital natives are apathetic about privacy—in fact, the opposite is true: we care deeply about how we reveal ourselves to our peers, but care much less about how we affect the privacy of others.

Non-candid, permission refused. When someone says that they would like a particular photo of them not shared online, natives will almost always comply. Sharing a photo against the will of another is considered an act of aggression akin to bullying, and there are few scenarios in which it can be justified. After taking a photo with friends, if any ofthe pictured in the photo say, "Please don’t share that!", the photo will likely never see the light of day. Natives, while often oblivious to the privacy needs of others, will respect requests for privacy if it is brought to their attention.

Candid. Unlike the previous scenarios which deal mostly with the social norms regulating the distribution of photos on social media, the privacy norms of candid photos govern the initial creation. In non-candid photos, all of the subjects are aware they are being photographed. They are able to prepare themselves for the picture and craft their appearance, and stop activities that they would not want photographed (such as drinking or smoking). In candid photos, however, the subjects do not have this same agency.

Put simply, a candid photo is a photo that was taken without the knowledge of those photographed. While candid is often correctly used to mean informal, in this context it simply refers to media—and pictures specifically—that were taken without the knowledge of those captured. By this definition, surveillance footage, dashcam videos, and covert phone recordings are all forms of candid media. Whether or not a photo or video is candid is not absolute—instead, it is relative to each member of a photo. Take, for example, a staged photo of two people in which a third person, who is unaware a photo is being taken, is visible in the background. For the first two people, the photo is not candid. For the third person, however, the photo is candid. Whether or not a photo or video is candid, then, is a relative distinction.

Candid media is not innately harmful to privacy—in fact, in-home surveillance cameras often help protect the privacy and security of homeowners—but its reckless distribution, especially when without the consent of those present in the media, can have dangerous privacy implications. With few exceptions, the distribution of candid media is subject to the same social norms as discussed in the previous sections. Indeed, all of the same issues of privacy which plague the norms regarding the distribution of non-candid photos still apply to candid photos: if the subjects are made aware of the photo and give feedback on its distribution, then the photo’s distribution is directed by the same social norms as in the previous ‘permission granted’ or ‘permission refused’ sections. If the photo’s existence is not brought to the knowledge of all of those photographed, then its distribution is subject to the same norms as described in the ‘permission ambiguous’ section.

While non-candid photos afford those pictured the knowledge and agency to refuse that the photo be distributed, candid photos, by definition, are taken without the knowledge of those photographed. The difference in the privacy implications of candid and non-candid photos lies mainly in the ability—or lack thereof—of those photographed to prepare themselves. At its core, privacy is a matter of control over how one is seen and recorded. In candid photos, this control is lost.

The ubiquity of cellphones has allowed for candid photos to be taken much more easily. Phones have combined the incredible resolution once limited to the most expensive DSLR cameras into devices smaller and with more functionality than point-and-shoot cameras. Therefore, it has become common for natives—usually on Snapchat—to snap a quick photo of their friend without them noticing. These photos are usually somewhat funny: caught mid-action, the people photographed either appear contorted, are doing something embarrassing, or both.

Snapchat is a hotbed of these pictures. The platform encourages candid and off-the-cuff photos by making the central page of its app a camera. And, as it only requires two taps to then publish the photo to one’s friends via a "story" post or a direct message, Snapchat leaves little time for its users to consider the privacy implications of the post on both themselves and whoever else may be pictured. Furthermore, Snapchat photos are perceived as temporal, as direct messages can only be viewed once and stories are only visible for twenty-four hours. The speed of posting and the temporal nature of the platform discourage thoughtful consideration for the potential privacy repercussions.

Most candid photos are, at least in the short term, harmless. Looking at the "stories" of all of my Snapchat peers, a considerable minority of the posts are candid shots. These candid posts included a discreet video of my friend Eloise eating spaghetti (a notoriously difficult dish to eat with dignity), someone I’ve never met slipping on ice, and my friend Eliot playing tennis. It is tempting to say that these photos in and of themselves are harmless: none of the activities depicted are illegal or particularly embarrassing (with perhaps the exception of slipping on ice).

This is not necessarily true, however: much more information can be extracted from a photo than one would expect. For example, take the candid video of Eloise eating spaghetti. The photo is geotagged at a restaurant called "Frankie’s," and the video was taken at 6:55 PM. While seemingly harmless, the unchecked and non-consensual distribution of this image could have major implications for Eloise: the video reveals her whereabouts at a particular time. The video also reveals her social associations, as many of her friends are also visible in the video. This information would be valuable not only to a jealous friend, but also to a potential predator or stalker who has managed to infiltrate Eloise’s Snapchat friends list. Most troubling, however, is that Eloise has no control over the spread of the photo. Even if the person who posted the video asked for Eloise’s permission before sharing, Eloise does not have the ability to take down the video and slow down its spread if she suddenly feels uncomfortable with its existence. Privacy at its core is control, and this candid video strips Eloise both of her control over how she is recorded and of her control over its spread.

The social norms governing the distribution of photos on social media are evidently complex. There is no steadfast rule that governs all sharing—the exceptions to such a rule would outnumber the rule itself. Instead, there are merely general trends which, when compiled, can provide a small but revealing glimpse into the complex online social lives of digital natives.

In short, there are four major categories of photo sharing online that deals directly with the privacy of others: non-candid photos in which the poster has explicit permission to share, non-candid photos with explicit orders not to share, non-candid photos with ambiguous permission, and candid photos (in which permission is either impossible if those photographed never find out about the existence of the picture or subject to the same social standards of non-candid photos otherwise). Ambiguous permission is often falsely taken as implied permission, and is then subject to the same considerations as sharing with permission: For example, most teens pay close attention to how their online activity appears to their peers, but are much less conscious about the public images of others.

The greatest dangers to privacy, at least as it pertains to the relationships between natives and their peers, lie not in massive data leaks but rather in the gradual accumulation of uncontrollable disclosures, like that of Eloise. The more media that others share about her, the less control she maintains over her online image, and the more her privacy is taken away.

Mindful Reference, Artificial Ignorance

For natives, social media plays a central role in the facilitation of modern friendships. Most teens report that social media plays is critical in connecting them to their friends’ feelings and lives, and view their experiences on social media very positively. Still, natives see information shared on social media as fundamentally different from information shared with them in person or given to them via a text message. While the text message and in-person communication is directed, sharing on social media is undirected. That is, posts on social media are not geared towards one person in particular, but rather at all of the poster’s friends. There is an expectation that directed information is known: the sender knows who they shared the information with, and the recipient knows they were meant to receive it. Undirected information, however, is fundamentally different: the poster does not know exactly with whom the information is shared—all they know is that it is some subset of their friends, if their social media account is private—and the recipients of the information do not know if the information was meant exactly for them. While seemingly trivial, this distinction leads to an interesting behavior in face-to-face encounters.

When natives are speaking in-person with one another, they are careful to acknowledge where they received pieces of undirected information, but not directed information. When the source of undirected information is not shared, it is often perceived as creepy. For example, imagine that Michelle posted a photo of a concert she attended on her Instagram account. John, Michelle’s friend, saw that photo. Michelle did not tell John that she was going to the concert, but John is aware from the Instagram post that Michelle did.

If John were to ask Michelle how the concert was, he would not say "how was the concert?"—Michelle would take this statement as strange, and perhaps somewhat creepy. Internally, she might ask herself how he knew about the concert, as Michelle never shared that information directly with him. Instead, she shared it with her followers. To avoid this scenario, John might instead ask something such as, “I saw your photo on Instagram of the concert. Did you enjoy it?”. Because John acknowledged the source of his information, he and his statement no longer come across as creepy or strange.

If Michelle had texted the photo directly to John or showed him a photo of the concert in person, John would obviously not need to acknowledge how he became aware of the concert. Indeed, it would be equally strange for John to say "You told me about that concert in person. How was it?". Not only is the reference to Michelle’s and John’s previous exchange of information somewhat out of place, it is also redundant: both John and Michelle already know why John knows about the concert. They did discuss it with one another previously, of course. Perhaps this tendency is put best by an excerpt from an interview with a fifteen-year-old:

"I share a lot of information online. I post about three times a week, and I’m usually posting photos of places I’ve gone, events I’ve been at, and friends I’ve been with. Personal stuff. My account is private, I don’t want everyone to know what I’ve been up to, but what I post on my Instagram isn’t too sensitive. Still, sometimes I find it a little bit weird if people come up to me and ask something like “hey, what did you think of that party?" or something like that. Even though I know I shared photos about it on social media, I still feel better when people let me know how they know something. Like, I’d like it better if they said something like “hey, nice post last weekend! What did you think of that party?”. That way, we’re on the same page on how they know about the party. If they didn’t say anything about how they found out about the party, I might think in the back of my head that they are a little nosy and strange… I didn’t tell them about the party, after all! I wouldn’t think too much of it, but still. It would be weird. It’s sorta interesting, though, that most people always let me know how they know something if I didn’t tell them face-to-face or over text. It’s rare to see anyone not do that. Probably because they know they’d come off as creepy!”

Somewhat paradoxically, the cause for this uneasy sentiment towards "uncited" and undirected information is the product of both natives’ deep care for privacy and a certain ignorance towards the breadth and reach of the information they share online. Natives want to understand the source of all the information known about them so that they can better control how they are perceived by their friends and the public. In other words, they want privacy. Ironically, they are often either unaware or somewhat taken aback when someone else has information about themselves that they didn’t explicitly share with that person. While they know that they distributed that information to a large group (for example, via a Snapchat story or Facebook post), they consider it strange when a member of that group then brings up that information with them without acknowledging their source.

While acknowledging one’s source for undirected information is customary, some natives often pretend that they are unaware of certain undirected information they obtained on social media in an effort to avoid any chance of coming across as creepy. Indeed, some natives fear that their knowledge of information that was knowingly shared with them via a social media post may make the poster perceive them to be strange and nosy. Despite sharing that information freely online, it is considered so sensitive and personal that natives demand an explanation for its source and some go so far as to hide the fact that they are even aware of the information. This then begs the question: if the information is so private, why was the information shared in the first place?


Some areas of social media are so deeply integrated into native culture that norms have inevitably developed around their use. Some newer areas of online activity, however, are too new or unpopular for social norms to develop. As a result, it is impossible to elude to a singly unifying social code that is followed by every member of the native generation. Online interactions are simply too numerous to discuss in such general terms: look no further than the fundamental differences between Instagram posts and Snapchat direct messages. To make matters even more complicated, native social norms vary widely across age groups and geographical regions. And, while the social codes discussed previously in this chapter do generally apply—as supported by the hundreds of interviews, quotes, and discussions that touched on these topics—acknowledging the prevalence of the exception is just as important as analyzing the rule. All statements regarding social norms require the acknowledgement of countless exceptions. Perhaps this disclaimer is already present in the idea of a social norm—it is a normal, after all, not a rule—but it is important that this idea is emphasized.

By and large, these social norms are either protective of one’s personal privacy, or protect the illusion of it. For example, the standards of tagging (covered in the "Tagging" section) dictate that within reason, all members of a photo be tagged when that photo is posted on social networks like Instagram and Facebook. While tagging ensures that all the photo’s members are aware that the photo has been shared, it provides mostly the illusion of privacy: being tagged in a photo does not, for example, delete that photo or change its privacy settings. It is still somewhat protective of privacy—knowing what information is available about oneself is a prerequisite to controlling that information—but is more an illusion of control than control itself.

The social norms surrounding social media creeping (analyzed in the "creeping" section) provide little privacy, but do protect the illusion. Indeed, the main stigma against creeping is not the act itself, but rather liking, sharing, or commenting on an old post and exposing oneself. In effect, the norms surrounding online creeping say “you may stalk, but don’t get caught!”.

Unlike the norms of tagging and creeping, the norms surrounding consent to post photos (discussed in the "Permission to Post" section) do not provide any illusion of privacy. Instead, they simply provide a lackluster defense of them. In short, these norms dictate that if you have permission to post the photo, remember it is conditional. If you have ambiguous or no explicit permission, make your best guess as to what the appropriate action would be. (This is the unfortunate standard.) And if you have explicitly not been denied permission, do not post the photo. This is hardly a striking defense of one’s privacy rights.

The norms surrounding Snapchat do defend privacy, at least as it relates to digital natives and their peers. Indeed, the norms surrounding Snapchat—don’t screenshot, don’t show posts to friends, preserve the confidentiality and temporariness temporaritly provided by the platform—do protect the privacy of all parties. The popularity of Snapchat—approaching 166 million daily users —is reassurance that young people (who constitute most of Snapchat’s user base) still find privacy attractive. The fundamental difference between Snapchat at its launch and, say, Facebook’s messenger, is that Snapchat promised privacy and security. While this promise is somewhat outdated, given the arrival of Snapchat’s live location sharing feature, it is still emblematic of the native generation’s desire for privacy.

The social standard to cite one’s source for undirected information—covered in "Mindful Reference, Artificial Ignorance"—is perhaps the most striking example of the illusion of privacy, not privacy itself, being propped up by social codes. While the references (“I saw on Snapchat that you…”) provide the correspondent an understanding of where their information is available (an effect similar to that of tagging), but this only provides an illusion of control. The information, after all, has already left their control. And as shown by artificial ignorance—how some choose to pretend to be unaware of certain information to avoid coming across as a “creeper”—the central goal is not to preserve privacy. It is to preserve the perception of privacy.

These norms are the primary regulator online. It is the fear of social isolation, not the law, that prevents people from posting inappropriate photos of others without their permission or screenshotting Snapchats. And while the law often intervenes—as it would if underage pornography was distributed, for example—it is far from the primary deterrent.

Indeed, society is mostly governed not by laws but by social codes, especially among young people who maintain larger personal social circles than their older counterparts. And just as laws are tied to nations, social codes are tied to cultures. Just as laws vary across states, provinces, and municipalities, social codes vary across subcultures and age groups. Just as laws enforce order, so do social codes. And just as dissidents of the law are expelled from society as criminals, dissidents of social codes are similarly outcast. Social codes, like laws, are supporters of order in society. This makes social codes in cyberspace—an area where the law has yet to catch up —doubly important.

Cover photo: Children's Games (1560, Pieter Bruegel the Elder), via Wikimedia Commons. Depicts the norms of the youth in a different age, but draws parallels to our own digital enlightenment.