On Consent in Online Social Networks: Privacy Impacts and Research Directions

The EU General Data Protection Regulation (GDPR) recognizes data subject’sconsent as a legitimate ground of data processing. At present, consent mechanisms in OSNs areeither non-existent or not GDPR compliant. While the absence of consent means a lack of controlof the OSN user (data subject) on his personal data, non-compliant consent mechanisms can givethem a false sense of control, encouraging them to reveal more personal data than they would haveotherwise. GDPR compliance is thus the only way to obtain meanigful consents, thereby protectinguser privacy. In this paper, we discuss the characteristics of valid consent as per the GDPR, analyzethe present status of consent in OSNs and propose some research directions to arrive at GDPRcompliant consent models acceptable to users and OSN providers (data controller). We observethat evaluating privacy risks of consents to data processing activities can be an effective way tohelp users in their decision to give or refuse consents and hence is an important research direction