The Case for Online Obscurity

Privacy and Security and Internet

Article Snapshot


Woodrow Hartzog and Frederic Stutzman


California Law Review, Vol. 101, No. 1, pp. 1-50, 2013


Information on the Internet can be hard to find. Internet users rely on obscurity to protect their privacy. But courts treat information posted online as public. Defining “obscurity” better could help courts recognize when users need more privacy protection.

Policy Relevance

Requiring companies to keep information obscure could help remedy privacy harms.

Main Points

  • From 80 to 99 percent of the World Wide Web is hidden from most searches; users expect that it will remain so, and this is central to their expectation of privacy.
  • Obscurity is a normal part of social interactions; humans can really get to know only about 150 people and can recognize only about 2000.
    • Interactions with strangers give us more freedom.
    • People use obscurity to defend ourselves or pursue goals.
  • People try to keep information posted online obscure by using pseudonyms, maintaining separate Facebook accounts for family, personal, or business use, or by other strategies.
  • Courts usually protect information as private only when kept in near total secrecy.
    • Courts rule that those who post information on the Internet renounce privacy rights by making the information public.
    • This public/private dichotomy fails to recognize how people think about privacy online.
  • In 1989, the Supreme Court recognized “practical obscurity,” ruling that the privacy of public records that can only be found by a burdensome search should be protected.
  • Courts are more likely to recognize privacy rights in information posted on the Internet if it has been protected with a password; if an ordinary search engine can find the information, it is unlikely to be protected.
  • Courts should consider four factors in deciding whether information is obscure:
    • Is the information visible using an ordinary search?
    • Is access to the information restricted by a password or some other method?
    • Whether the individual has disclosed his or her identity?
    • Would the information be clear and comprehensible only to those meant to receive it?
  • Courts should decide on a case by case basis whether users should be able to sue for unauthorized sharing of obscure information.
  • Policymakers should consider requiring online services to keep some information obscure.


Get The Article

Find the full article online

Search for Full Article