CoChat
Sign Up
Cited by 4Privacy, Security, and Data ProtectionDigitalization, Law, and RegulationPrivacy-Preserving Technologies in Data

Privacy Policies on the Fediverse: A Case Study of Mastodon Instances

Open access
Tosch, Emma, Garcia, Luis, Li, Cynthia, Martens, Chris·2024·Proceedings on Privacy Enhancing Technologies
DOI 10.56553/popets-2024-0138
Open this paper in CoChat — free accountOpen PDF

Abstract

Free and open source social platform software has dramatically lowered the barrier to entry for anyone to set up and administer their own social network. This new population of social network administrators thus assume data management responsibilities for sociotechnical systems. Administrators have the power to customize this software, including data collection and data retention, potentially leading to radically different privacy policies. To better understand the characteristics — e.g., the variability, prohibitions, and permissions — of privacy policies on these new social networking platforms, we have conducted a case study of Mastodon. We performed a text analysis of 351 privacy policies and a survey of 104 Mastodon administrators. While most administrators used the default policy that ships with the Mastodon software, we observed that approximately ten percent of our sample tailored their privacy policies to their instances and that some administrators conflated codes of conduct with privacy policies. Our findings suggest the existing market-based individualistic frameworks for thinking about privacy policies do not adequately address this emerging community.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.56553/popets-2024-0138

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Prior work on decentralized social media rarely considers how the underlying protocols structure and shape the systems being examined.

    “Focused on user experiences in the context of specific app implementations such as mastodon.socialand Bluesky [5,49,82,109,119], this work rarely considers how the underlying protocols structure and shape the systems being examined.”

    From Seeing the Politics of Decentralized Social Media Protocols (2026) · cites this paper as [109]

    The Abstract identifies this as a Mastodon case study of privacy policies and administrator experiences, so it supports the sentence’s example of research focused on a specific implementation. But §2, “Mastodon and the Fediverse: Background and Related Work” (page unavailable), discusses ActivityPub and how it enables different interaction models. The paper does not establish that prior work rarely considers how protocols shape decentralized social media. (LLM, conf=0.79)

    Experimental — accuracy not yet measured

  • Because Space curation is shared between Client and Server operators in ActivityPub and Nostr, the experience can become fragmented, at times increasing the risk of exposing users to content they find harmful or unwelcome.

    “Because Space curation is shared between Client and Server operators in these protocols, the experience can become fragmented, at times increasing the risk of exposing users to content they find harmful or unwelcome [56,109].”

    From Seeing the Politics of Decentralized Social Media Protocols (2026) · cites this paper as [109]

    The Introduction (section 1; page unavailable) says ActivityPub instances are independently governed and can have markedly different rules and user experiences. The Q30 discussion describes server-level moderation practices. Our copy does not establish that curation is shared between client and server operators in both ActivityPub and Nostr, or that fragmentation increases users’ exposure to harmful or unwelcome content. (LLM, conf=0.78)

    Experimental — accuracy not yet measured

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 82

  1. Lada Adamic and Eytan Adar. 2005. How to Search a Social Network. Social Networks 27, 3 (2005), 187-203.
  2. Raghav Ahooja. 2023. Section 230 and the Fediverse: The 'Instances' of Mastodon's Immunity and Liability. SSRN.
  3. Jacopo Anderlini and Carlo Milani. 2022. Emerging Forms of Sociotechnical Organisation: The Case of the Fediverse. Digital Platforms and Algorithmic Subjectivities 167 (2022), 167-181.
  4. Manon Arcand, Jacques Nantel, Mathieu Arles-Dufour, and Anne Vincent. 2007. The impact of reading a web site's privacy statement on perceived control over privacy and perceived trust. Online Information Review 31, 5 (2007), 661-681.
  5. Glenn Bass, Lorraine Kenny, Guinee Sarah, and Madeline Wood. 2019. Sym- posium: The Tech Giants, Monopoly Power, and Public Discourse, Glenn Bass (Ed.). Knight First Amendment Institute at Columnia University.
  6. Michael Bernstein, Andrés Monroy-Hernández, Drew Harry, Paul André, Kat- rina Panovich, and Greg Vargas. 2011. 4chan and/b: An Analysis of Anonymity and Ephemerality in a Large Online Community. In Proceedings of the Interna- tional AAAI Conference on Web and Social Media, Vol. 5. 50-57.
  7. Ames Bielenberg, Lara Helm, Anthony Gentilucci, Dan Stefanescu, and Hong- gang Zhang. 2012. The Growth of Diaspora -A Decentralized Online Social Network in the Wild. In 2012 Proceedings IEEE INFOCOM Workshops. IEEE, 13-18.
  8. Steven Bird, Ewan Klein, and Edward Loper. 2009. Natural language processing with Python: analyzing text with the natural language toolkit. " O'Reilly Media, Inc. ".
  9. Danielle Keats Citron and Daniel J Solove. 2022. Privacy Harms. Boston Univer- sity Law Review 102 (2022), 793-863.
  10. Wayne L Cornelius. 1985. UTILIZATION OF AN ELECTRONIC BULLETIN BOARD. (1985).
  11. Geoffrey Cramer. 2023. An Empirical Study of Trust & Safety Engineering in Open-Source Social Media Platforms. Ph. D. Dissertation. Purdue University.
  12. Lorrie Faith Cranor. 2003. P3P: Making privacy policies more useful. IEEE Security & Privacy 1, 6 (2003), 50-55.
  13. Lorrie Faith Cranor. 2005. Giving Notice: Why Privacy Policies and Security Breach Notifications aren't Enough. IEEE Communications Magazine 43, 8 (2005), 18-19.
  14. Lorrie Faith Cranor. 2012. Necessary but not sufficient: Standardized mecha- nisms for privacy notice and choice. J. on Telecomm. & High Tech. L. 10 (2012), 273.
  15. Kimberlé Crenshaw. 1991. Mapping the Margins: Intersectionality, Identity Politics, and Violence against Women of Color. Stanford Law Review 43, 6 (1991), 1241-1299. http://www.jstor.org/stable/1229039
  16. Chinmaya Dabral, Emma Tosch, and Chris Martens. 2022. Exploring Conse- quences of Privacy Policies with Narrative Generation via Answer Set Program- ming. Conference on Programming Languages and the Law.
  17. Anastasia Danilova, Alena Naiakshina, Stefan Horstmann, and Matthew Smith. 2021. Do you Really Code? Designing and Evaluating Screening Questions for Online Surveys with Programmers. In 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE). IEEE, 537-548.
  18. Henry DeYoung, Deepak Garg, Limin Jia, Dilsun Kaynar, and Anupam Datta. 2010. Experiences in the logical specification of the HIPAA and GLBA privacy laws. In Proceedings of the 9th annual ACM workshop on Privacy in the electronic society. 73-82.
  19. Don A. Dillman, Jolene D. Smyth, and Leah Melani Christian. 2014. Internet, phone, mail, and mixed-mode surveys: The tailored design method. John Wiley & Sons.
  20. Dror G Feitelson. 2023. "We do not appreciate being experimented on": De- veloper and Researcher Views on the Ethics of Experiments on Open-Source Projects. Journal of Systems and Software (2023), 111774.
  21. Jonathan Flowers. 2022. The Whiteness of Mastodon. https://techpolicy.press/the- whiteness-of-mastodon/
  22. Seth Frey, PM Krafft, and Brian C Keegan. 2019. " This Place Does What It Was Built For" Designing Digital Institutions for Participatory Change. Proceedings of the ACM on Human-Computer Interaction 3, CSCW (2019), 1-31.
  23. Ujwal Gadiraju, Ricardo Kawase, Stefan Dietze, and Gianluca Demartini. 2015. Understanding Malicious Behavior in Crowdsourcing Platforms: The case of online surveys. In Proceedings of the 33rd Annual ACM Conference on Human Factors in Computing Systems. 1631-1640.
  24. Robert W Gehl. 2015. The case for alternative social media. Social Media+ Society 1, 2 (2015), 2056305115604338.
  25. Sarah Gilbert. 2023. Towards Intersectional Moderation: An Alternative Model of Moderation Built on Care and Power. Proceedings of the ACM on Human- Computer Interaction 7, CSCW2 (2023), 1-32.
  26. Leo A Goodman. 1961. Snowball sampling. The annals of mathematical statistics (1961), 148-170.
  27. Guido Governatori, Vineet Padmanabhan, Antonino Rotolo, and Abdul Sattar. 2009. A defeasible logic for modelling policy-based intentions and motivational attitudes. Logic Journal of IGPL 17, 3 (2009), 227-265.
  28. Thomas Groß. 2021. Validity and reliability of the scale internet users' informa- tion privacy concerns (iuipc). Proceedings on Privacy Enhancing Technologies (2021).
  29. Hana Habib, Sarah Pearman, Jiamin Wang, Yixin Zou, Alessandro Acquisti, Lorrie Faith Cranor, Norman Sadeh, and Florian Schaub. 2020. "It's a scavenger hunt"': Usability of Websites' Opt-Out and Data Deletion Choices. In Proceedings of the 2020 CHI Conference on Human Factors in Computing Systems. 1-12.
  30. Oliver L Haimson, Daniel Delmonaco, Peipei Nie, and Andrea Wegner. 2021. Disproportionate removals and differing content moderation experiences for conservative, transgender, and black social media users: Marginalization and moderation gray areas. Proceedings of the ACM on Human-Computer Interaction 5, CSCW2 (2021), 1-35.
  31. M Hassett, C Lowder, and D Rutan. 1992. Use of computer network bulletin board systems by disabled persons.. In Proceedings of the Annual Symposium on Computer Application in Medical Care. American Medical Informatics Associa- tion, 151.
  32. Jiahui He, Haris Bin Zia, Ignacio Castro, Aravindh Raman, Nishanth Sastry, and Gareth Tyson. 2023. Flocking to mastodon: Tracking the great twitter migration. In Proceedings of the 2023 ACM on Internet Measurement Conference. 111-123.
  33. Stefan Albert Horstmann, Samuel Domiks, Marco Gutfleisch, Mindy Tran, Yasemin Acar, Veelasha Moonsamy, and Alena Naiakshina. 2024. "Those things are written by lawyers, and programmers are reading that. " Mapping the Com- munication Gap Between Software Developers and Privacy Experts. Proceedings on Privacy Enhancing Technologies 1 (2024), 151-170.
  34. Sohyeon Hwang, Priyanka Nanayakkara, and Yan Shvartzshnaider. 2023. Whose Policy? Privacy Challenges of Decentralized Platforms. In CHI'23 Workshops: Designing Technology and Policy Simultanesouly: Towards a Research Agenda and New Practice.
  35. Jane Im, Ruiyi Wang, Weikun Lyu, Nick Cook, Hana Habib, Lorrie Faith Cranor, Nikola Banovic, and Florian Schaub. 2023. Less is Not More: Improving Findabil- ity and Actionability of Privacy Controls for Online Behavioral Advertising. In Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems. 1-33.
  36. Ramkumar Janakiraman, Joon Ho Lim, and Rishika Rishika. 2018. The Ef- fect of a Data Breach Announcement on Customer Behavior: Evidence from a Multichannel Retailer. Journal of Marketing 82, 2 (2018), 85-105.
  37. Carlos Jensen, Colin Potts, and Christian Jensen. 2005. Privacy practices of Internet users: Self-reports versus observed behavior. International Journal of Human-Computer Studies 63, 1-2 (2005), 203-227.
  38. Shagun Jhaver, Seth Frey, and Amy X Zhang. 2023. Decentralizing Platform Power: A Design Space of Multi-level Governance in Online Social Platforms. Social Media+ Society 9, 4 (2023), 20563051231207857.
  39. Michael Karanicolas. 2021. Too Long; Didn't Read: Finding Meaning in Platforms' Terms of Service Agreements. University of Toledo Law Review 52 (2021), 1-25.
  40. Patrick Gage Kelley, Joanna Bresee, Lorrie Faith Cranor, and Robert W Reeder. 2009. A" nutrition label" for privacy. In Proceedings of the 5th Symposium on Usable Privacy and Security. 1-12.
  41. Nancy S Kim. 2022. Adhesive Terms and Reasonable Notice. Seton Hall Law Review 53 (2022), 85-147.
  42. Jon Kleinberg. 2001. Small-world phenomena and the dynamics of information. Advances in neural information processing systems 14 (2001).
  43. Jon M Kleinberg. 2000. Navigation in a small world. Nature 406, 6798 (2000), 845-845.
  44. John Kretzmann and John P McKnight. 1996. Assets-based Community Devel- opment. Nat'l Civic Rev. 85 (1996), 23.
  45. Ravi Kumar, Jasmine Novak, and Andrew Tomkins. 2006. Structure and evolution of online social networks. In Proceedings of the 12th ACM SIGKDD international conference on Knowledge discovery and data mining. 611-617.
  46. Lucio La Cava, Sergio Greco, and Andrea Tagarelli. 2021. Understanding the growth of the Fediverse through the lens of Mastodon. Applied network science 6 (2021), 1-35.
  47. Lucio La Cava, Sergio Greco, and Andrea Tagarelli. 2022. Network analysis of the information consumption-production dichotomy in mastodon user behaviors. In Proceedings of the International AAAI Conference on Web and Social Media, Vol. 16. 1378-1382.
  48. Jialiu Lin, Shahriyar Amini, Jason I Hong, Norman Sadeh, Janne Lindqvist, and Joy Zhang. 2012. Expectation and purpose: understanding users' mental models of mobile app privacy through crowdsourcing. In Proceedings of the 2012 ACM conference on ubiquitous computing. 501-510.
  49. Alice E Marwick and Danah Boyd. 2011. I tweet honestly, I tweet passionately: Twitter users, context collapse, and the imagined audience. New media & society 13, 1 (2011), 114-133.
  50. Peter Mayer, Yixin Zou, Byron M. Lowens, Hunter A. Dyer, Khue Le, Florian Schaub, and Adam J. Aviv. 2023. Awareness, Intention,(In) Action: Individuals' Reactions to Data Breaches. ACM Transactions on Computer-Human Interaction (2023).
  51. Peter Mayer, Yixin Zou, Florian Schaub, and Adam J Aviv. 2021. " Now I'm a bit {angry:}" Individuals' Awareness, Perception, and Responses to Data Breaches that Affected Them. In 30th USENIX Security Symposium (USENIX Security 21). 393-410.
  52. Abraham Mhaidli, Selin Fidan, An Doan, Gina Herakovic, Mukund Srinath, Lee Matheson, Shomir Wilson, and Florian Schaub. 2023. Researchers' Experiences in Analyzing Privacy Policies: Challenges and Opportunities. Proceedings on Privacy Enhancing Technologies 4 (2023), 287-305.
  53. Abraham H Mhaidli, Yixin Zou, and Florian Schaub. 2019. "We Can't Live Without {Them!}" App Developers' Adoption of Ad Networks and Their Con- siderations of Consumer Risks. In Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019). 225-244.
  54. Matthew N Nicholson, Brian C Keegan, and Casey Fiesler. 2023. Mastodon Rules: Characterizing Formal Rules on Popular Mastodon Instances. In Companion Publication of the 2023 Conference on Computer Supported Cooperative Work and Social Computing. 86-90.
  55. Razieh Nokhbeh Zaeem and K Suzanne Barber. 2021. A Large Publicly Available Corpus of Website Privacy Policies Based on DMOZ. In Proceedings of the Eleventh ACM Conference on Data and Application Security and Privacy. 143- 148.
  56. Charlie Parker, Sam Scott, and Alistair Geddes. 2019. Snowball sampling. SAGE research methods foundations (2019).
  57. Fabian Pedregosa, Gaël Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, et al. 2011. Scikit-learn: Machine learning in Python. the Journal of machine Learning research 12 (2011), 2825-2830.
  58. Lucy Pei and Bonnie Nardi. 2019. We Did it Right, but It was Still Wrong: Toward Assets-based Design. In Extended Abstracts of the 2019 CHI Conference on Human Factors in Computing Systems. 1-11.
  59. Irene Pollach. 2007. What's wrong with online privacy policies? Commun. ACM 50, 9 (2007), 103-108.
  60. Andrea Prat and Andrea Valletti. 2022. Attention Oligopoly. American Economic Journal: Microeconomics 14, 3 (2022), 530-557.
  61. Robert W Proctor, M Athar Ali, and Kim-Phuong L Vu. 2008. Examining usability of web privacy policies. Intl. Journal of Human-Computer Interaction 24, 3 (2008), 307-328.
  62. Sheizaf Rafaeli. 1984. The electronic bulletin board: A computer-driven mass medium. Social Science Micro Review 2, 3 (1984), 123-136.
  63. Sheizaf Rafaeli and Robert J LaRose. 1993. Electronic bulletin boards and "public goods" explanations of collaborative mass media. Communication Research 20, 2 (1993), 277-297.
  64. Aravindh Raman, Sagar Joglekar, Emiliano De Cristofaro, Nishanth Sastry, and Gareth Tyson. 2019. Challenges in the Decentralised Web: The mastodon case. In Proceedings of the Internet Measurement Conference (ACM IMC). 217-229.
  65. Joel R Reidenberg, Travis Breaux, Lorrie Faith Cranor, Brian French, Amanda Grannis, James T Graves, Fei Liu, Aleecia McDonald, Thomas B Norton, Rohan Ramanath, et al. 2015. Disagreeable Privacy Policies: Mismatches between Meaning and Users' Understanding. Berkeley Tech. LJ 30 (2015), 39.
  66. Alan Z Rozenshtein. 2023. Moderating the fediverse: Content moderation on distributed social media. J. Free Speech L. 3 (2023), 217.
  67. Eduard Sabo, Mirela Riveni, and Dimka Karastoyanova. 2023. Decentralized Networks Growth Analysis: Instance Dynamics on Mastodon. In International Conference on Complex Networks and Their Applications. Springer, 366-377.
  68. Florian Schaub, Rebecca Balebako, Adam L. Durity, and Lorrie Faith Cranor. 2015. A design space for effective privacy notices. In Eleventh symposium on usable privacy and security (SOUPS 2015). 1-17.
  69. H. Jeff Smith. 1993. Privacy policies and practices: Inside the organizational maze. Commun. ACM 36, 12 (1993), 104-122.
  70. H Jeff Smith, Tamara Dinev, and Heng Xu. 2011. Information privacy research: an interdisciplinary review. MIS quarterly (2011), 989-1015.
  71. Daniel J Solove and Danielle Keats Citron. 2017. Risk and Anxiety: A theory of Data-breach Harms. Texas Law Review 96 (2017), 737-786.
  72. Mukund Srinath, Soundarya Sundareswara, Pranav Venkit, C Lee Giles, and Shomir Wilson. 2023. Privacy Lost and Found: An Investigation at Scale of Web Privacy Policy Availability. In Proceedings of the ACM Symposium on Document Engineering 2023. 1-10.
  73. Marshall Steinbaum. 2022. Establishing Market and Monopoly Power in Tech Platform Antitrust Cases. The Antitrust Bulletin 67, 1 (2022), 130-145.
  74. Chris R. Surfus. 2023. A Statistical Understanding of Disability in the LGBT Community. Statistics and Public Policy 10, 1 (2023), 2188056. https://doi.org/ 10.1080/2330443X.2023.2188056 · DOI
  75. Jenny Tang, Hannah Shoemaker, Ada Lerner, and Eleanor Birrell. 2021. Defining Privacy: How Users Interpret Technical Terms in Privacy Policies. Proceedings on Privacy Enhancing Technologies (2021).
  76. Perry W Thorndyke. 1977. Cognitive structures in comprehension and memory of narrative discourse. Cognitive psychology 9, 1 (1977), 77-110.
  77. Christine Utz, Sabrina Amft, Martin Degeling, Thorsten Holz, Sascha Fahl, and Florian Schaub. 2023. Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites. Proceedings on Privacy Enhancing Technologies 1 (2023), 5-28.
  78. Jessica Vitak. 2012. The impact of context collapse and privacy on social network site disclosures. Journal of broadcasting & electronic media 56, 4 (2012), 451-470.
  79. Shomir Wilson, Florian Schaub, Aswarth Abhilash Dara, Frederick Liu, Sushain Cherivirala, Pedro Giovanni Leon, Mads Schaarup Andersen, Sebastian Zim- meck, Kanthashree Mysore Sathyendra, N Cameron Russell, et al. 2016. The creation and analysis of a website privacy policy corpus. In Proceedings of the 54th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 1330-1340.
  80. Kou Zhongbao and Zhang Changshui. 2003. Reply networks on a bulletin board system. Physical Review E 67, 3 (2003), 036117.
  81. Matteo Zignani, Sabrina Gaito, and Gian Paolo Rossi. 2018. Follow the "mastodon": Structure and evolution of a decentralized online social network. In Proceedings of the International AAAI Conference on Web and Social Media, Vol. 12. 541-550.
  82. Diana Zulli, Miao Liu, and Robert Gehl. 2020. Rethinking the "social" in "social media": Insights into topology, abstraction, and scale on the Mastodon social network. New Media & Society 22, 7 (2020), 1188-1205.

Cited by

Sorted by citations

Related

Authors
Tosch, E., Garcia, L., Li, C., & Martens, C.
Affiliations
  • Northeastern University (US)
  • Independent Researcher
ORCID
Venue
Proceedings on Privacy Enhancing Technologies
Publisher
Privacy Enhancing Technologies Symposium Advisory Board
Published
2024-10
Volume
2024
Issue
4
Pages
700-733
ISSN
2299-0984 (ISSN-L)
DOI
10.56553/popets-2024-0138
OpenAlex
W4400381942
Cited by
4
References
1
Citations by year
2026: 3 · 2025: 1
FWCI
2.88
Type
journal article
Language
en
Open access
Licence
Locations
Proceedings on Privacy Enhancing Technologies (publishedVersion, cc-by)
Funders
National Science Foundation (1846122, 2330961)
Topics
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
  • Social Sciences › Law › Digitalization, Law, and Regulation
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
Keywords
privacy policies, Mastodon, Fediverse, data retention, data collection, free and open source software, codes of conduct, user permissions

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review