the preferences of each user affected by an item count as one vote (sometimes weighted) for sharing/not sharing. Then, a voting rule models how each of these mechanisms aggregates votes together. For instance, in majority voting, 5 the preference of the majority of users is taken as the decision to be applied to the content. Another example would be veto voting, 35 so that if there is one of the users affected by the content who opposes sharing, then the content is not shared. The main problem with these approaches is that they always aggregate preferences in the very same way. For instance, using majority voting always means that even when content can be very sensitive and lead to privacy violations for one user, it will be shared if the majority of users wishes to. In contrast, always using veto voting may be too restrictive and impact the known benefits users get from sharing in social media. 29 Subsequent works12 recognize this issue and consider more than one way of aggregating user preferences. However, it is up to the one who uploads the item to decide the aggregation method to apply. This requires the user who uploads the item to anticipate the consequences for others, which may be a very difficult task as discussed earlier, and it may not always render the optimal solution.

Adaptive approaches. These ap-
proaches automatically infer the best
way to solve a MPC based on the par-
ticular situation. 32 These approaches
model a situation considering factors
such as the individual preferences of
each user, the sensitivity of the con-
tent, or the relationships to the poten-
tial audience. Then, a particular situa-
tion instantiates particular concessions
that are known to happen when people
negotiate offline an agreement about
sharing co-owned items. 2, 18, 40 Thus,
these approaches automatically adapt
to the situation at hand, turning as
restrictive as veto voting if the situa-
tion requires so (for example, if the
item is very sensitive), or suggesting
sharing in other situations (for exam-
ple, someone having special interest
in sharing and the others not caring
much about it). While these approach-
es capture the known situations of
when concessions happen during
offline negotiations, it is difficult to
model all possible situations, and they
five main approaches (summarized in
Table 2), highlighting their strengths
and limitations. Note that other works
in addition to those discussed have
also been published but we could not
include all of them due to the space
and maximum references allowed, and
have instead included those we consid-
ered the most representative of each
approach.

Manual approaches. The first re-
search stream proposed support for
MP by helping users to identify where
MPCs can or did occur. 2, 39 For instance,
Wishart et al. 39 present a way to specify
strong and weak sharing preferences
so that these preferences could be in-
spected to find conflicts. Also, Besmer
et al. 2 introduce a system whereby us-
ers tagged in a photo can contact the
user who uploaded the photo to ask to
remove it or to restrict the audience of
the photo, which resembles the func-
tionality Facebook introduced some
time later. 7 While these approaches
represented a stepping-stone, recog-
nized the problem of MP, and pro-
posed a partial solution to it, they left
all the negotiation process to resolve
detected conflicts to happen without
any particular technical aid. That is,
users must resolve every potential MPC
in a manual way, which may become
an unbearable burden considering the
massive amount of content uploaded
and the number of friends that users
have in social media.
Auction-based approaches. Another
research stream proposed solving po-
tential MPCs using a bidding mecha-
nism. 30 Users bid for the sharing deci-
sion they would prefer the most and
the winning bid determines the shar-
ing decision that will be taken for a par-
ticular item. These approaches were
the first ones to consider a semiauto-
mated method to aid users in collec-
tively defining a sharing decision—for
example, the outcome of the auction
is computed automatically from the
bids users specify. However, users may
have difficulties comprehending the
mechanism and specifying appropri-
ate bid values in auctions, and users
are required to bid for each and every
item co-owned with others.

Aggregation-based approaches. These approaches suggest a solution to a MPC by aggregating the individual privacy preferences of all users involved. They can be abstractly conceptualized as voting mechanisms, where

 

Table 2. Summary of MP approaches with example references.

Approach Short Description Main Drawbacks

Manual2, 39 Users are provided with a way of
detecting MPCs, and they can manually
resolve them when detected.

It may easily become a burden on the users, as they do not provide automated support for conflict resolution.

Auction-based30 Users gain fictitious money they can
invest in auctions bidding for the most
desired sharing decision for co-owned
items.

Users may have difficulties to understand and manage the process appropriately.

Aggregation-based5, 12, 35 Individual privacy preferences of all users are aggregated using a rule or set of rules to produce a joint sharing decision.

Individual privacy preferences are aggregated in the same way or the uploader chooses the method to aggregate.

Adaptive32 Different situations are modeled
based on a number of factors and a
different sharing decision is suggested
depending on the situation.
It is difficult to model all possible
factors that determine a situation
and the best method to achieve an
optimal sharing decision.
Game-theoretic13, 17, 25, 31 Users or automated software agents
negotiate a solution following
an established protocol. Both
the protocol and the negotiation
strategies are analyzed using
game-theoretic solution concepts.

Users’ behavior in social media seems not to be perfectly rational as there are many very social idiosyncrasies that play a role in MP.

Fine-grained14, 36 Users define individualized access
control decisions over personally
identifying objects within a photo, for
example, users deciding whether or not
their faces are blurred.

Blurring objects (for example, faces) within a photo may not be the optimal solution in terms of the utility of the information shared and/or protecting users’ privacy.