Inferring Unknown Privacy Control Policies in a Social Networking System

Social networking systems (SNSs) such as Facebook allow users to control accesses to certain information belonging to them via a set of privacy settings. However, due to various potential system design considerations and usability restrictions such settings are never complete, i.e., not all the applicable policies to information related to a user are configurable. In fact, access to user information is governed by the collection of the privacy settings and a set of fixed policies specified by the SNS. We observe that an SNS such as Facebook is less than transparent about such fixed policies; although some might be communicated to users via help pages and nudges (e.g., profile picture is public on Facebook), they tend to be incomplete and inaccurate. In this paper, we propose an approach to infer the enforced privacy control policy by an SNS and consequently the unknown policies to the user given the explicit privacy settings and other policies communicated to the users by the SNS. Such an approach helps end users understand better the implicit policies imposed by the system and can be leveraged by an SNS operator to improve the transparency of their system.