Privacy Protection on Social Media Platforms: Overdisclosure of Online Behavioral Data is Labeling Users

2.1 Current Framework for Hierarchical Data Governance

The Personal Information Protection Law (PIPL) reflects the concept of hierarchical classification and governance of data (Zhang 2023). Nowadays, particularly with the widespread use of generative AI (Li, Cai, and Cheng 2023), people’s expectations of privacy have been reshaped, making the distinction between privacy, sensitive personal data, and general personal data a central issue in discussions on data protection.

Within the legal framework for personal data protection, the needs of data subjects (i.e., individuals) regarding the protection and utilization of their information can be categorized into defensive expectation and positive utilization expectation.^[2]

Privacy primarily emphasizes the confidentiality of information, which is lost once it is disclosed, thus focusing on defensive protection. Personal data, on the other hand, combines both attributes of active utilization and defensive protection. Under the General Data Protection Regulation (GDPR), the protection of privacy and the right to understand how personal data is processed are recognized as fundamental rights. According to the regulatory framework, personal data refers to any information related to an identified or identifiable natural person. A natural person is considered identifiable if they can be distinguished, either directly or indirectly, through specific identifiers such as their name, identification number, location data, online identifiers, or other factors related to their physical, physiological, genetic, psychological, economic, cultural, or social identity.

From the perspective of reasonable expectations of privacy, personal data can generally be classified into several levels. Sensitive personal data, which aligns with the consensus of reasonable societal understanding regarding private information. Data subjects are primarily concerned with protecting this information from misuse or infringement. Such data requires enhanced defensive protection, and its processing is prohibited except in specific circumstances. Under Article 9 of the GDPR, sensitive personal data includes data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person’s sex life or sexual orientation. The processing of this data requires a clear legal basis or explicit consent from the data subject. The PIPL of China defines sensitive personal data in Article 28 as personal data that, if disclosed or misused, could harm an individual’s dignity or threaten their personal or property safety, including biometric data, religious beliefs, specific identities, health data, financial accounts, location data, and data of minors under the age of fourteen. The processing of sensitive personal data can only occur if it serves a specific purpose, is necessary, and involves strict protective measures. Article 29 stipulates that the processing of sensitive personal data requires explicit consent from the individual.

General personal data, which lacks privacy sensitivity, mainly involves the Positive Utilization Expectation. In other words, data subjects expect certain data to be used within a reasonable scope to enhance service experiences or provide social convenience, rather than being completely prohibited. For example, when a user voluntarily provides information and expects it to be used to improve services, such as social interactions or targeted advertising recommendations. After obtaining general consent from the data subject, such data can be processed lawfully.

Personal data that encompasses both defensive and positive utilization expectations (referred to as third-category personal data). This category includes online behavioral data, such as users’ friend lists, group memberships, and browsing history. The sensitivity of such data and whether its processing constitutes an infringement remains debated among scholars. Contextual Integrity theory suggests that the sensitivity of personal data depends on its use context rather than the inherent nature of the data itself (Ni 2019). Furthermore, Context Abstraction theory focuses on the characteristics of the data itself. It argues that when data possesses high utility or unique identification capabilities, it can be classified as sensitive personal data. Context embedding theory, on the other hand, emphasizes external factors such as the data processor’s cognitive ability, the method of data application, and the data’s storage status, which may alter the data’s sensitivity and transform ordinary personal data into sensitive personal data (Ning 2021).

In the Katz v. United States case (1967), the U.S. Supreme Court defined the steps and standards for determining reasonable privacy expectations.^[3] These steps consist of two parts: the first involves the subjective standard, assessing whether a natural person subjectively expects their privacy to be protected. The second involves the objective standard, determining whether, based on societal norms, the individual’s expectation of privacy is reasonable and objectively recognized.

Under the Chinese legal framework, Article 28 of the PIPL defines sensitive personal data as information that, if disclosed or misused, could violate an individual’s dignity or pose a threat to their personal or property safety. This includes biometric data, religious beliefs, specific identities, health data, financial accounts, location data, and data of minors under the age of fourteen. The term “etc.” provides flexibility for including other types of sensitive information. Furthermore, the phrase “specific identity” is introduced for the first time in the list of sensitive personal data under the PIPL, but the law has not yet fully defined its meaning or clarified its boundaries (Megan and Deng 2025). Some scholars argue that specific identity information refers to “certain identity information derived from biological or social constructs,” and whether it constitutes sensitive personal data depends on the context (Cheng 2021). Other scholars define it as “information that is highly likely to identify an individual, based on biological or social constructs,” using factors such as the nature of the information, the data subject, the purpose of processing, and the data processor to determine whether the data qualifies as sensitive personal data (Megan and Deng 2025). These relevant studies provide evidence for classifying personal data under defensive and positive utilization expectations within a hierarchical protection framework.

2.2 Hierarchical Classification of Online Behavioral Data in Data Protection

Online behavioral data refers to information collected from internet platforms that captures individual behaviors along with their contextual environments. This type of data primarily originates from users’ active interactions on digital platforms (Arosio 2022), such as social media, e-commerce sites, blogs, and online forums. Examples of such behaviors include clicks, views, comments, shares, and purchase records.

The legislation on personal data protection fundamentally seeks to strike a balance between competing value pursuits: while data related to personal dignity and privacy requires strict protection, general personal data tied to economic interests must also account for the needs of societal and commercial development (Li 2015). Sensitive personal data requires explicit consent, whereas general personal data only requires implicit consent, thereby increasing data flow (Ji 2018). Due to differences in how legislations define sensitive personal data, the classification of online behavioral data as sensitive varies across legal systems.

The American Privacy Rights Act (APRA), introduced in April 2024, has provided a more comprehensive definition of sensitive personal data. Compared to the categories of sensitive personal data commonly proposed in other national legislations, this act includes information such as video viewing data and online activity information from high-impact websites as part of sensitive covered data. The Act defines online activity profile as covered data that identifies the online activities of an individual (or a device linked or reasonably linkable to an individual) over time and across third-party websites, online services, online applications, or mobile applications that do not share common branding, and is collected, processed, retained, or transferred for the purpose of evaluating, analyzing, or predicting the behaviors or characteristics of an individual.

Under the current legal frameworks, the GDPR in the European Union and the PIPL in China have not yet officially classified online activity data on internet platforms as sensitive personal data, but the risks associated with this data in the online environment are increasingly approaching the threshold for such classification.

Article 28, Section 1 of the PIPL defines sensitive personal data primarily based on the high regulatory response of the law, with its protection standards increasing according to the risks of rights infringements that may arise from data processing (Ning 2021). In August 2023, China issued a public consultation notice for the national standard “Information Security Technology: Security Requirements for the Processing of Sensitive Personal Data” (Draft for Comment), further outlining China’s requirements for sensitive personal data protection. It categorizes sensitive personal data attributes into three types: data that, if disclosed or misused, may harm an individual’s dignity, personal safety, or property safety. Data falling under any of these attributes should be identified as sensitive personal data (Liu and Hua 2023). Some scholars argue that risk assessment should simultaneously meet two conditions: “the degree of general rights infringement” and “the probability of higher risk realization” (Ning 2021).

From the perspective of potential risks arising from data processing, due to the ease of searching and the rapid spread of information in the digital age, online behavioral data has a high level of identifiability in the online environment and is highly linked to an individual’s identity. Therefore, improper handling of such data poses a significant risk of infringing on personal dignity or even personal safety.

In any specific context, information may exhibit sensitivity and privacy. Privacy is not an inherent attribute of information itself but is determined by how the information is used in different contexts (Ni 2019). The sensitivity of information is context-dependent, and thus when determining the “sensitivity” of information, factors such as the nature of the information, the context of its processing, and its intended purpose should be considered (Hu 2018).

Some scholars categorize data into four types based on sensitivity and identifiability: Identifiable Data, Quasi-Identifiable Data, Sensitive Data, and Insensitive Data (Faridoon and Kechadi 2023). Identifiable attributes are those that can directly identify an individual, such as a name or social security number. Quasi-identifiable attributes are those that can indirectly identify an individual when combined with other information, such as age, gender, or zip code. Sensitive attributes are those that, if disclosed, could cause harm or embarrassment to an individual, such as medical conditions or financial information. Insensitive attributes are those that, if disclosed, do not cause harm or embarrassment, such as hobbies or preferences.

For instance, the live-stream viewing information of a user on Weibo, which is directly tied to the user’s identity, is a clear example of Identifiable Data. When the platform publicly discloses the notification that a user is watching a particular live stream, it directly associates the information with a specific individual. In contrast, if the same information were presented anonymously or in a de-identified form (e.g., showing the total number of viewers for a live stream without revealing specific viewers’ identities), it would fall under the category of Insensitive Data. When the information is combined with other data (such as the user’s social network or interest tags), it becomes Quasi-Identifiable Data, as cross-referencing could potentially infer the user’s identity or preferences. For example, in the WeChat Reading case, the reading data included online identifiers that pointed to the individual, such as reading duration, recent books read, bookshelf, and thoughts after reading, reflecting personal characteristics and preferences.^[4] Accumulating these traits could identify the individual, thus classifying the information as personal data. Similarly, if a user frequently watches a particular type of live stream, is active during specific time periods, or interacts with certain groups, these behavioral patterns enable the platform to analyze the user’s personal traits, forming a consistent behavioral profile. Even if the real-life identity is not disclosed, this behavior-based identification can still recognize the individual through pattern matching. For this present study, the online behavioral data being studied as data contains Sensitive attributes, Identifiable attributes, or Quasi-Identifiable attributes.

Based on existing definitions, it is difficult to categorize individual online behavioral data as publicly recognized sensitive information, because most individual pieces of information cannot be directly linked to a natural person’s visible identity or digital footprint. Therefore, when exploring the identifiability and sensitivity of online behavioral data, it is not sufficient to consider them in isolation; rather, the effect produced when these data points are aggregated should be taken into account.

In the digital platform ecosystem (Cheng, Xu, and Chang 2023), user profiling has become a crucial foundation for companies to optimize content distribution, resource allocation, and business decision-making. With the proliferation and advancement of AI technology, platforms are increasingly leveraging algorithms to intelligently influence the content users receive, making it a key component of their business model (Neuwirth 2024). By analyzing user behavioral data, platforms can assess and predict individuals’ interests, preferences, and consumption patterns, thereby utilizing algorithms to offer personalized recommendations that influence user interactions and decisions (Elyamany 2024).

Legal frameworks generally classify user profiling as part of personal data protection, emphasizing the autonomy of users in data processing, their right to be informed, the right to object to automated decisions, and their right to data portability (Ding 2019). However, user profiling, as a form of derivative data created through the analysis and processing of personal information, involves tagging individual characteristics, which forms a predictive model of a user’s tendencies, behaviors, and identity attributes through data mining.

The concept of “identity” in personal information recognition encompasses two layers of meaning: “personal characteristics” and “personal identity.” Whether the recognition of specific identity information refers solely to “personal identity” or includes both “personal characteristics” and “personal identity” remains a point of divergence across different jurisdictions (Megan and Deng 2025). However, the recognition of personal characteristics is too general in the context of identifying personal information, and as long as it does not reach the level of identifying an individual’s identity, it does not pose significant harm to the individual’s dignity or personal safety. For the purpose of this paper, the focus is placed on “personal identity.” However, personal identity should not only include traditional legal notions of natural person identity, such as name, national identification number, date of birth, etc., but also encompass digital identities closely related to one’s personality.

The study of the recognition of personal information identity essentially explores whether the disclosure of such information would affect one’s dignity or personal integrity. Therefore, it is crucial to examine the relationship between the recognition of personal information identity and an individual’s personality. In the current era of the internet, a new layer of identity has emerged in the form of digital identity in the online world. Although this identity is “virtual” and not directly inscribed on an ID card, it reflects an individual’s self-identification, affecting user’s dignity and safety (Cheng and Gong 2024).

Personal identity is largely shaped by the social groups to which an individual belongs, as well as their position and role within these groups (Turner and Oakes 1986). For example, among younger internet users, “fandom” has become a typical form of digital self-identification. Fandom, which refers to an individual’s affiliation with a particular celebrity, TV show, game, literary work, or other cultural phenomenon on social networks, has evolved beyond merely expressing interest to become a highly emotional identity marker. The disclosure of this information can directly affect an individual’s sense of security and autonomy in social spaces and even lead to online harassment, group antagonism, or “doxxing” in real life.

In the current internet environment, the threshold for “becoming a fan” within strictly organized fan communities has become increasingly high, often involving complex, ritualized behaviors (Zheng and Tan 2022). For example, in many fan communities, an individual may only be recognized as a fan after purchasing a certain amount of cultural products, merchandise, or other related items endorsed or produced by a celebrity. This ties into specific consumer behaviors and the act of self-identifying in particular social contexts. On platforms like Weibo, some fan communities even do not allow users to follow or post about more than one celebrity with the same account. Users must meet certain criteria to be recognized as “fans,” with some social platforms even offering specific titles or levels within fan communities, which require completing “tasks” to earn higher status. Being designated as a “Big Fan” within a fan circle can grant an individual a higher degree of influence and recognition within the community.

It has been argued that an individual’s self-identity is constructed through comparison and affiliation within social groups (Tajfel and Turner 2001). Fans strengthen their self-identity by engaging in competitive and comparative behaviors such as “leveling up” and “voting” while paying a cost in the process. Consumption is not merely about acquiring material goods but also serves as an important means of self-expression and identity formation. By consuming specific products and cultural goods, individuals establish their position in society and reinforce their personal identity (Bourdieu 1984). Through purchasing behaviors, individuals externally display their identity, with the more they spend, the stronger their sense of identification and belonging (Simmel 2011). Individuals tend to strengthen their self-identity by associating with specific groups, such as fan communities. Buying celebrity-endorsed products and participating in particular fan activities are ways in which individuals “prove” their identification and integration into the group, gradually reinforcing their sense of self. In fan communities, there is no clear boundary between artists and consumers. All fans are potential creators, with talents that are yet to be discovered, cultivated, and developed. Every fan, regardless of how small their contribution, can add to the cultural wealth of the broader community (Jenkins 1992). Unlike simple admiration or affection, fans, who invest money, time, and other forms of value, demonstrate their inner sense of self-worth through their identity within the community.

An individual’s online identity, as a form of self-identification, reflects autonomy, which forms the cornerstone of the theory of dignity in human rights (Kant et al. 2002). The creation of an individual’s online identity is driven by the aggregation of various online behavioral data disclosed by platforms, such as recent participation in online communities, currently watched live streams, liked posts, and so on. When these pieces of information are conspicuously disclosed and aggregated together, they form a user’s digital identity card on the internet.

From an informational perspective, once data possesses the ability to identify and link individuals, even if it does not directly identify one’s identity, it can influence platform decisions, thereby having substantial impacts on individual rights. Therefore, the boundary of personal information is not solely defined by the ability to directly identify identity but rather depends on the strength of the correlations between data and the extent to which the information handler’s technological capabilities can recognize personal characteristics (Megan and Deng 2025). The aggregation of online behavioral data to form a user’s “digital identity card,” due to its close connection with personal identity, is a key factor in infringing on individual’s general rights to social freedom and is also the source of higher risks, such as online harassment and doxxing.

Under the private law system, individuals shape their social roles and develop their personalities through contracts, market transactions, and commercial images. The violation of personal dignity can be concretized as the obstruction of an individual’s social interaction abilities (Zhang 2022).

In modern society, surveillance is no longer the traditional panoramic visibility; instead, it has become fluid, dispersed, and covert, with users unknowingly being under surveillance (Bauman and Lyon 2012). This theory is known as “Liquid Surveillance.” For example, Snapchat’s now-deleted “Best Friends” feature previously allowed users to see whom their friends interacted with the most.^[5] This feature attracted attention due to its “slightly invasive” monitoring nature, as many users used it to stalk their friends or partners, observing whom they communicated with or shared images with most often. Such features are becoming more common on modern social platforms, where users experience both the thrill of peeking into others’ lives and the anxiety of their own online image being exposed.

The obstruction of an individual’s social interaction ability due to liquid surveillance is most typically manifested on the internet as the “chilling effect.” It to individuals self-censoring out of fear of punishment or social pressure, thereby limiting their freedom of speech (Schauer 1978). This effect is particularly prominent in social media environments. Meanwhile, the intrinsic conflict between the business model of social platforms and the protection of user privacy further fuels social stratification, strengthens internal group conflicts, and intensifies inter-group opposition. For instance, in fan communities, a typical manifestation of stratification, the strong sense of boundaries within fan groups causes them to segregate themselves. Fans of different groups may encounter collective attacks from opposing groups due to differing viewpoints. Furthermore, users’ actions, such as liking posts or participating in group chats, become the basis for identity recognition, which may be used by opposing groups to target them for attacks, leading to online violence, and even offline physical confrontations. For example, a few years ago, when a user posted a complaint about a particular celebrity on Weibo, fans of that celebrity managed to uncover the university the user attended and threatened them to apologize. Many fans even contacted the university, demanding the user’s expulsion.^[6]

Because individual’s actions such as likes, follows, and social interactions can easily be accessed by other users, especially when these actions are publicly displayed on platforms’ homepages, this increases the visibility of users’ social identities. It exposes their interests and social circles, making it easy for others to label them with a fan identity. This visibility of social trajectories not only makes users’ online footprints transparent but also facilitates the revealing of their identity. In scenarios such as fan community competition, online public opinion conflicts, and discussions on politically sensitive topics, a user’s likes, comments, or participation in a group chat can be used as a basis for attacks, further exacerbating social conflicts. For instance, external parties can infer a user’s political stance, fan affiliation, or even certain private social relationships merely from their like history. In a polarized social environments, this information is often exploited to label individuals, incite group attacks, and escalate conflicts. Especially in areas involving entertainment industry disputes or societal issues, individuals can easily be labeled as “anti-fans,” “opposers,” or “having an improper stance” due to a single like or social interaction, ultimately becoming victims of online violence. To avoid being attacked due to their online activities, users may feel compelled to consider potential social risks when expressing opinions or engaging in specific discussions, forcing them into self-censorship (Mangiò, Andreini, and Pedeliento 2020). The self-censorship induced by this environment strips individuals of their rightful freedom in social spaces, obstructing their normal social interaction capabilities.

Moreover, the business model of social platforms heavily relies on the traffic effects brought about by competition within fan communities. The “Fan Economy” refers to an economic model that leverages the consumption power of fan groups, converting their emotional investment into commercial value through social media, celebrity marketing, brand endorsements, and other strategies (Sun 2017). This phenomenon is particularly dependent on social media platforms, especially large platforms like Weibo, Instagram, and TikTok. Fans not only support their idols’ careers by purchasing products endorsed by them but also generate discussions, create trends, and vote to increase the commercial value of their idols, thus attracting investments from brands. Take Weibo as an example. As one of the largest social media platforms in China, it capitalizes on fan economy to monetize traffic. For instance, Weibo encourages fan group members to vote and create ranking competitions, actively amplifying group conflicts. This escalates the sense of rivalry between fan communities, creating continuous social topics. Such “buzz” becomes one of Weibo’s key channels for monetization.

Furthermore, Weibo’s SVIP visitor record feature exacerbates social surveillance behavior. At the end of 2023, Weibo launched a feature allowing SVIP members to view visitor records. Once activated, users’ visitor records become an exclusive benefit for paying members. Ordinary users cannot see who visited their profile, while paying members can check and even delete their visit history. They can also categorize the records into groups such as “all,” “followers,” “fans,” “non-fans,” and “verified users.” In addition to showing the visitors from the previous day, it also indicates if someone “frequently visited you yesterday” or “visited multiple times yesterday.”^[7] This mechanism not only encourages a “peeping culture” but also makes users more cautious, even fearful, in social interactions, forming a “Liquid Surveillance” environment. Surveillance behavior becomes decentralized and permeates daily social networks, where individuals are both the objects of surveillance and also the subjects of mutual surveillance (Bauman and Lyon 2012).

In response to this, the CEO of Weibo commented in the platform’s comment section, stating, “this is to cater to the demand for growth in social memberships and mutual following.”^[8] In fact, in the highly competitive fan circle environment, if a user visits the profile of a competing fan’s community, they might be viewed as engaging in “stalking” the rival fan group, thereby becoming a target of online violence. In September 2024, the Beijing Internet Court ruled on a lawsuit against Weibo for inadequate protection of personal information. While the court did not rule that Weibo had breached the contract, it did mandate changes to the platform. The number of hidden visits allowed for ordinary users was increased from three to ten.^[9] However, the differences in visitor record access privileges between SVIP and regular users still remain.

User privacy disclosure behavior is influenced by factors such as attitude, subjective norms, and perceived behavioral control (Zhang and Li 2019). When users disclose personal information, they weigh perceived benefits against perceived risks (Culnan and Armstrong 1999). If the perceived benefits outweigh the perceived risks – such as when users feel the platform’s privacy settings pose little risk but offer more accurate content recommendations or richer social interactions – users tend to disclose information. Conversely, if perceived risks outweigh the benefits, they are likely to protect their privacy. Research has shown that procedural fairness positively affects user trust in platforms, and trust reduces users’ perceived privacy risks. Procedural fairness also positively impacts distributive fairness. In other words, if users perceive the process of privacy policy development as fair, they are more likely to accept the final privacy disclosure arrangements (Weng and Lian 2024). Social media platforms that make users feel their privacy policies are unfair – such as the distinction between SVIP and regular users regarding access to visitor records on Weibo – manipulate users’ social activities for the platform’s commercial interests. This increases users’ perceived risks and reduces trust in the platform, forcing users to limit their information disclosure to avoid online violence.

Moreover, as person’s digital identity is essentially an extension of their personality (Floridi 2006), if platforms use digital identities for commercial purposes without proper regulation, it can lead to serious risks (Lambert and Smolinski 2024). Building on the traditional concept of personal dignity, some scholars have introduced the idea of “informational dignity,” which suggests that legal protection and respect should not only apply to a person’s real-world identity, but also to their digital identity. A person’s digital identity should not be manipulated, exploited, or exposed in ways that could lead to social discrimination or harm (Doyle 2011).

Recently, more social platforms have introduced features that display a user’s “fandom” and their rank within fan communities alongside their profile picture and username. For example, on QQ Music, when a user comments on a song by a particular artist, their username show their “fandom”, like “Lv 14 David Tao”, if you are identified as a David Tao fan by the platform. This label is determined by the platform’s algorithm, and if the user disagrees with the result, they must manually change it. Once the user accepts the platform’s privacy policy, this label becomes visible to the public.

In most of the time, the legal framework surrounding the use of such data is often overly broad, with platforms frequently overlooking the sensitivity of this data in their pursuit of monetization. For instance, just as traditional privacy laws prevent the display of personal characteristics like sexual orientation next to a user’s profile picture – regardless of whether the user is comfortable revealing this information – most non-dating social platforms do not inform users about how to disable such features through the privacy consent process. Instead, these features are automatically enabled when users agree to the platform’s general privacy policy. This approach contrasts with the ideal model where users should have the option to manually activate these features, similar to how platforms like Weibo allow users to choose whether to display their sexual orientation, users are not required to disclose their sexual orientation unless they manually choose to include it in their personal profile.

Likewise, the aggregation of online behavioral data, such as “fandom” status, should not simply follow the traditional informed consent model, where users passively agree to everything. Instead, users should be required to actively opt in if they wish to disclose such information.