A Theory of Creepy: Technology, Privacy, and Shifting Social Norms

Privacy and Security

Article Snapshot


Jules Polonetsky and Omer Tene


Yale Journal of Law and Technology, Vol. 16, Issue 1, pp. 59-102 (2014)


Technology seems “creepy” when it pushes against social norms, but rapid technological change makes it hard to identify these norms. Following the law is not enough to avoid privacy backlash.

Policy Relevance

Firms should avoid unexpected uses of data. Firms should design technologies consistent with social values.

Main Points

  • Some business models and activities have been described as “creepy,” such as ambient social apps, which notify users when a friend is near or send messages to everyone nearby.
  • Unexpected uses of data and new products like Google Glasses are especially prone to privacy backlash; over time, new types of etiquette evolve to address privacy concerns.
  • When technology is rapidly changing and social norms are shifting, law can be a crude and belated tool for addressing concerns.
    • Changing social norms and technology can make laws irrelevant.
    • The EU cookie directive required websites to obtain explicit consent before placing a cookie, but users did not want consent pop-ups to interfere with browsing.
  • Perceptions of privacy norms are influenced by businesses, by technologies, and by individuals; individual preferences about data sharing tend to be fickle and ambiguous.
  • To avoid designing “creepy” technologies, engineers should avoid technological determinism; just because something can or has been done, does not mean it should be done.
  • Engineers should avoid “privacy lurch,” that is, they should avoid abrupt changes in the way a service works, or unanticipated data grabs (such as uploading a users’ entire address book).
  • Product designers and engineers should not assume that every user is a “superuser,” a highly tech-savvy early adopter who reads privacy policies and can easily change default settings.
  • Product designers should educate users about their data practices, offering enhanced transparency; longer privacy policies will not enhance transparency as much as other privacy options, such as a sophisticated privacy dashboard and opt-out tools.

Get The Article

Find the full article online

Search for Full Article