Danielle Keats Citron is a University of Virginia Law School law professor. In addition to being one of the country’s preeminent legal scholars on privacy issues, she’s also the author of The Fight for Privacy: Protecting Dignity, Identity, and Love in the Digital Age.
This book is a privacy masterpiece. It offers a comprehensive and sober discussion about how antiquated and, in many ways, inadequate our current legal system is for protecting privacy rights. It’s full of eye-popping examples of privacy violations and other situations that feel like they should be illegal and, in some cases, should be criminal.
We’re delighted to have Professor Citron as our next guest on A Little Privacy, Please! to discuss her book and the challenge of protecting intimate privacy in the digital age.
Watch the full episode of A Little Privacy, Please!
Our conversation has been edited for brevity.
A central concept in your book is that of intimate privacy. Can you explain what that is and why that is so important?
Intimate privacy refers to the privacy afforded as we manage the boundaries around information and access to our bodies, our health, and our innermost thoughts, which we document all day long by searching, posting or sharing, texting, and communicating about our sexual orientation, gender, sexual activities, and our close relationships. /p>
And so it’s descriptive, but it’s also normative. Carving out boundaries around our intimate lives is central to figuring out who we are and enjoying self-respect (the core of Warren and Brandeis’s vision of how we see ourselves often through other’s eyes), human dignity, and the ability to build relationships. We know because this is our practice. We know privacy is a “we,” not a “me” endeavor. We need intimate privacy to forge relationships, not just love relationships, but for all of us to feel safe and share in confidence our bodies, our minds, our thoughts, our vulnerable selves, and our silly selves. It is through intimate privacy and gathering that we can flourish.
You argue for changes to Section 230 of the Communications Decency Act. What should change about the law, and what impact do you think those changes will have on the level of protection for privacy rights?
Section 230 provides and affords immunity to online service providers for user-generated content, with some exceptions. Big tech companies and platforms are under no legal obligation to take down intimate privacy violations; though some do after a lot of bad PR and some work we’ve done at the Cyber Civil Rights Initiative.
There are 9,500 sites whose raison d’etre is intimate image abuse. They get to collect information, earn advertising fees, and often have subscriptions. Because of Section 230, they get a free pass from criminal and civil liability.
I’ve been calling for Section 230 reform for a long time, an unpopular thing to utter in 2008; everyone thought I wanted to ruin the internet. I have been working since the book’s publication on clarifying precisely the reform I’d like to see.
We know the cost of speech and life opportunities that intimate privacy violations and cyberstalking inflict. We have studies showing when your nude photo or a deep fake sex video is posted online and appears in a search of your name; it’s impossible to get a job, keep a job, and feel safe. And that’s also true of cyberstalking—the persistent targeting of someone with online abuse designed to silence them. Both problems are costly—most often to women and vulnerable people (minorities).
We should carve out bad Samaritans. Part of Section 230 requires good Samaritan blocking and filtering of offensive content. Entities that purposefully or deliberately solicit, encourage, or keep up intimate privacy violations, cyberstalking content, and deep fake sex imagery should not enjoy immunity. I’m not calling for strict liability—meaning they could be sued and automatically liable. The bad Samaritan carve-out would mean if you’re in a business of pain, your raison d’etre is encouraging intimate privacy violations and earning money, or your business model is online abuse, cyberstalking, or intimate privacy violations, you certainly don’t enjoy or deserve the immunity designed to encourage self-monitoring.
You’ve got to take reasonable steps; if you do, you can enjoy this legal shield. The proposed statute in the book suggests companies can enjoy immunity from liability for intimate privacy violations and cyberstalking, as well as deep fake sexual imagery like digital forgeries, if they take six reasonable steps. These should be in the proposed statute versus having courts in the common law slowly develop the same, which creates uncertainty.
The bad Samaritan carve-out would only apply to intimate privacy violations and cyberstalking content. It would carve out the worst of the worst, bad Samaritans in the business of intimate privacy violations and cyberstalking and create a duty of care comprised of six criteria for the hosting of intimate privacy and cyberstalking content. And if you take those reasonable steps, you will enjoy the legal shield.
Speaking of legal protections, why do you think Europe is so far ahead of the U.S. on this topic?
Europe is working through an online safety bill, creating duties of care for platforms in the spirit of understanding privacy as a human right, that privacy and speech can be balanced, and that privacy is essential for free expression. I think that is why they have pressed forward in a more aggressive way with their online safety bill.
Their policies concerning non-consensual imagery aren’t terrific. There have been some interesting proposals, but they’re as haphazard as we are in terms of criminal and civil penalties around individual perpetrators. They are a step ahead of us with the online safety bill and their approach and thinking about privacy, familial and data privacy, as a human right.
Why did you write The Fight for Privacy?
I wanted to make sure that the conversation about intimate privacy was a conversation with everybody.
I have two kids who are 22 and 25. They are now in law school, but as they grew up, I’d always get drawn into talking in schools wherever we lived about intimate privacy and intimate privacy violations. The people we need to listen are often parents and teachers. The parents who say, “My Johnny would never do that, my Jamie would never do that,” when in fact they are and violating intimate privacy at a terrible scale.
We need to see this project as all of ours, not just policymakers, law enforcers, state attorney generals, and the FTC. The conversation is broader. I use the book to get people thinking about this and understand that it’s not somebody else’s problem and not approach it with resignation.
It’s hard to think that what we do as individuals can protect us when our data is in thousands upon thousands of databases and being sold hand over fist, but I do think we need laws that help build in structural protections.
We’ve gone from three states that criminalized the disclosure of nonconsensual intimate imagery to 48, DC, Guam, and Puerto Rico. We need to fix these laws. They’re misdemeanors and not enforced. We’ve got work to do, but we are bringing lawmakers to the table.
At the Cyber Civil Rights Initiative, we’ve been working with the White House gender policy counsel to meet with state lawmakers to think about next steps. We have a bill to criminalize nonconsensual pornography in the House and Senate, which hasn’t been passed in seven years. I think we can move the needle with state lawmakers who are really motivated and bipartisan.
If somebody’s intimate privacy has been violated, or someone is interested in helping those victims, are there some organizations you can recommend?
In the United States, the Cyber Civil Rights Initiative was the first organization to combat online abuses and advocate for victims. We’re now a decade old; we have a hotline, recommendations for state laws, and partner organizations—e.g., the Cyber Civil Rights Legal Project.
Some of the biggest battles occur when folks go to law enforcement. Even if there are laws on the books—harassment, stalking, frat laws, and intimate privacy laws, specifically addressing sexual privacy invasions—law enforcement is beset by social attitudes that just say, “Too bad, so sad.” If you have an advocate, you may get further.
I encourage law firms to work with organizations like the Cyber Civil Rights Legal Project on pro bono work because there’s a need. There’s a legal vacuum, often due to under-enforcement of the law as much as the need to fix the law.
