This seems 100% reasonable to me. If somebody tags me I want to see that photo - and the entire album (since context is also important). I don't want that somebody starts taging me on some photos and then sharing these photos with others without me having chance to untag myself.
Before people start forgetting real-world context here:
In the physical world, people can and do take photos with you in it. They then get these developed, and may put them in an album with the people identified.
You would have absolutely no access to this photo unless they choose to share this with you, however that may be. They can also choose to share it with their friends, possibly even form a presentation with it to a certain slice of the public, and you still have no control over this, or even access to it.
This automatic re-sharing is quite the opposite, and I suspect Google did not fully follow the logical consequences through, or purposely chose to subvert the current physical-world situation. I don't like it, I'd rather have new-to-digital features following known physical traditions until there is ample evidence that it may be a good thing to change it.
The equivalent to your analogy is the "My Pictures" folder we all have on our private computers. Google is not this. They are a giant corporation letting you store your photos with them for free and they have documented that tagging is sharing.
Google's whole goal for G+ is that it's supposed to be modeled after how life really works – circles, hangouts, etc. The picture sharing is not how things go down in the real world. When your aunt has goofy pictures of you at family gatherings, chances are she's showed them to a handful of other individuals without your consent. The pictures are hers and she shares them with her circles, regardless of who's present in those photos. The way Google is handling this seems to go against the ethos of G+.
Actually, before Google+ existed Picasa supported the ability to tag people in photos, and manage albums with limited/restricted sharing. So this is a fundamental change to functionality.
In the real world I can reject having my picture taken and I can demand it to be deleted (under circumstances) and when I am accidentally on somebody's holiday pictures they have no idea who I am anyway.
In the real world, there is no publicly searchable meta-information of my name applied to the pictures you are talking about. Some relatives asking "oh who is that?" is very different than some Nigeria scam "African Prince" looking you up on google+ or suddenly finding a less-than-charming picture of you having become the latest "meme" but no your name is connected to it.
I think I would only care if they tag me AND share the photos with others. If they intended not to share it with anybody, then I don't care whether they think I'm in the photo or not. A more reasonable approach would be something like "if a photo is shared, it must be shared with the people tagged in the photo".
As far as getting access to the entire album, not everyone uses albums for the same reason. I can't, offhand, think of a situation where the rest of the album would make a difference, but it's not unreasonable to expect that one might want to share only parts of an album with some people.
I store most of my albums by date and not necessarily by context. So if you were to go through an album I would have to explain the context of each three or four pictures. I'm very particular about whom I share photos with so having a conference photo tagged and shared doesn't bother me. Having a family photo shared because I tagged the conference photo and they were in the same date based album is a deal breaker.
This. Private tagging and public tagging should be separate. I'd love to be able to tag the pictures with my kid in it, who is 2 and has no email address or, of course, Google+ account, and a few other people/animals who also don't have these things either because they don't care to or because they're animals, because I want to orginize them. I can do this on my local computer with desktop Picasa but then I have to start worrying about loosing my local data again, the whole reason I paid for the extra storage on Picasa in the damn first place.
I don't want that somebody starts taging me on some photos and then sharing these photos with others without me having chance to untag myself.
If someone has photos of you and emails them to their friends you have no right nor expectation of notification. Maybe they might make rude comments behind your back. Not nice, but its a private conversation and they should be allowed to be rude in private.
On the other hand, if Google suddenly and unexpectedly makes my private photo album public just because I tag some people, that makes their service useless for non-public sharing of photos. I will therefore not use it and go back to sharing the photos by some other service.
The whole point of Google+ is that I can keep interaction with different circles separate. Unlike facebook I (thought I could) load photos that my friends would see but not my work colleagues. This sharing from tagging breaks that.
We are not talking about public albums. If you tag someone in a public album, then its fine to notify them. But for a private album making is effectively entirely public just because I tag one person is completely unacceptable. I have uploaded those photos with a reasonable expectation that they not be made public nor shared beyond the friends I want to share them with. If G+
That sounds fine, and what I would expect too. However, being tagged in one photo in an album shouldn't be enough to be suddenly allowed access to view every photo in the album regardless of privacy settings on that album.
Disclaimer: I have not tested whether or not this actually happens, so I'm taking the original article (and its comments) by their word. I do find it irritating though that anyone can apparently see the action of me tagging myself in a photo in my stream, regardless of the privacy settings of that photo.
There's more than the privacy issue. If the tagged person does not have a Google+ account, then Google+ sends an email with subject "<Name of person tagging photo> invited you to join Google+" for every photo tagged. Spammy.
On the other hand at least you get notified that your name and face are now publicly viewable on the intarwebs somewhere. The question is what you can then do about it.
I read it when I opened my G+ account, and it sounded to me pretty much like Buzz all over again. Hope that gets fixed soon.
Only because some guy you barely know made his way into one of your holiday photos, it doesn't mean you want to share your complete vacations with him. Probably not even that one picture, why should you be forced to?
I think it is more of a managing expectations issue. Consider another situation: you pay me $25 via check. I can now debit your bank account for $100,000. Surprised? "Don't write checks." doesn't quite cover it, does it?
Of course, the counterpoint: Flickr's been doing this for as long as they've had the ability to tag people in photos. If you've got a photo whose privacy setting wouldn't allow the person to see it, though, they do pop up a notice saying that tagging someone gives them access to it.
That is sure going off-topic, but - seeing that I never used checks in 30 years of my life, they are very 'popular' and common over here in Israel now.
Can you share your bad experiences? For me that stuff was never relevant and something I heard 'old people' talk about. I feel like someone invites me to a party and wants to play the gramophone for us..
"... due to an unfixable security flaw in the way funds are now transferred electronically, worldwide, it is no longer safe to write personal checks" - Donald Knuth, on reasons for no longer writing his famous reward checks. Google for more info.
The bad experiences stem from the fact that handing someone a check is literally handing them your bank account, and asking them to only withdraw as much as you wrote on it. There's essentially no protection except in the form of after-the-fact insurance to get you some of your money back in some situations.
Which is similar to credit cards and debit cards, really. Sure, with CCs you can do a charge-back - but that's just a form of insurance. If the person who got your money withdrew it and left, the CC company would be left paying out of pocket (hence the large interest rates).
It's ass-backwards. Since the internet appeared, banks should have been giving us ways to safeguard against this - for example, fixed-value transactions with a unique key. But we've got essentially nothing.
It's a learning issue. G+ is new and people don't know how it works. "I drove 1000 miles then ran out of gas stranded on the highway!!!!! Fix it!!!!!"
We could argue all day about whether it's on Google to make an out of the box friendly UX (but remember, you can't please everyone) or on the user to figure it out and make the most of it. The old Apple vs Microsoft
There's one more privacy feature/annoyance with photos on Google Plus. Apparently when I share an album with someone, that person in turn can share that album with other people and can also see who else I've shared it with. Now what's the point of a private album if everyone else can share my album. I like how Facebook solves this problem. You, as the album owner get to choose who sees the album. People who you've set the visibility as true cannot see who else I've shared it with.
Only allowing the owner to share an album is a false sense of security. If someone can see your album, they could just as easily download the photos and make them public.
Instead of disallowing it outright, I'd rather they make it clear that you're sharing content with a wider audience. One solution would be to require that the owner approves the share, similar to how tagging is handled.
That problem is inherent with posting something online. The best any service can do is make it difficult for someone to accidentally violate their friends' privacy.
This, in my opinion, is where Google+ is failing: sharing makes it very easy to make private posts visible to an audience larger than the author intended.
This, in my opinion, is where Google+ is failing: sharing makes it very easy to make private posts visible to an audience larger than the author intended.
In addition to G+ reminding users when resharing a limited post that it was intended for a smaller audience and to be mindful of that, the original poster can also disable resharing entirely.
That's definitely the hardest part. I figure that if people have gone to the effort of getting around that limitation when I've pretty clearly asked them not to, then it's not someone I need to be sharing with again in the future. I have at least one family member I no longer give pictures of my son to for this reason.
I'm with you. This is how it works on Facebook and I suspect this is how the majority of people expect it to work. Not only that, this is not only the behavior I expect but the behavior I want. I suppose it might be OK with me if someone tagged me in a photo that was private just to the person who took it.
But it would be a huge, huge problem if someone could tag me in a photo and share it to some circles that didn't include me. Fake-tagging people or tagging people in embarrassing photos is a major problem on FB, and the privacy issue here goes two ways: the person you tagged also has their own privacy concerns. What if you tagged an embarrassing photo of me, shared it with a circle of hundreds of co-workers (that you excluded me from), and then not only do I not know the picture is out there, but co-workers can see it by visiting my profile and looking at pictures tagged of me? That would be orders of magnitude worse than the status quo.
I'm trying to think of how you design a system that respects both my concerns and those of the OP, and I can't come up with anything that would be intuitive. (Suppose that you could tag an album full of people and keep it private to yourself, but sharing it with a family circle caused it to also be shared with everyone you tagged? That really would break user expectations). I think the current implementation might be the best one, perhaps with more of a warning in the UI that tagging shares with the person tagged. In essence this is not a privacy complaint, it's a feature request: people want to use tags for a different purpose (organizing private albums) than they are designed for.
It hasn't always been the case, but Facebook has a setting called "Who can see photos and videos I'm tagged in". There's also "Let friends of people tagged in my photos and posts see them."
What if you tagged an embarrassing photo of me, shared it with a circle of hundreds of co-workers (that you excluded me from), and then not only do I not know the picture is out there, but co-workers can see it by visiting my profile and looking at pictures tagged of me?
Let's break this down and relate it to physical (they're both real) photos:
What if you tagged an embarrassing photo of me
Considering only viewing the page for the photo at this point: With physical photos it's possible to write someone's name on them, and online it's always possible to add a description identifying who is in a photo, so being able to tag anyone doesn't increase the information storage of the system.
shared it with a circle of hundreds of co-workers (that you excluded me from)
People can show physical photos of you to other people without you knowing. They can send or grant access to digital photos without you knowing. Being able to grant access to photos of you on a social network is just an extension of this. Granting access so that people can see the photos when viewing an album or see an album in an album list is (or could be) separate from where or how that permission to view the photo is made known.
and then not only do I not know the picture is out there
We don't know that about physical photos, or photos that are sent in emails.
but co-workers can see it by visiting my profile and looking at pictures tagged of me?
Now this would be problem. There shouldn't be anything viewable on your profile by other people that you can't see yourself. Photo's should only be able to be shared and sent in private by explicitly sending a message to a group of people.
I don't think that scenario is possible with G+ at the moment. Tagging someone in a photo automatically gives that person access to the photo.
What G+ currently lacks is a way to tag someone without giving that person access to the photo. That's not perfect but it's better than the alternative which you described. Hopefully they'll find a way of making it possible to tag someone in private without putting it in front of people in ways that it's not possible in the physical world. You can't pin embarrassing photos on people without them noticing.
Agreed - in fact, in the UK the Data Protection Act makes this a legal requirement (not that Google have to abide by UK law).
You could change it such that users can only see the individual pics they're tagged in, and not all pics in the parent album. That may be preferable, but makes the situation more complex and means you can't see the picture you were tagged in in context.
As you say, communicating how the security works is likely a better approach than changing the security model.
My expectation would be that the specific photos I tag Person A in are automatically visible to Person A. I think this is reasonable, and other concerns come up if a person is unable to see which photos they are tagged in.
Making the entire album visible to Person A, I think, is not as reasonable.
Why should Person A be able to see the photos they are tagged in if the photos have never been shared? If I have lots of albums on Picasa and I never share any of them but I tag everyone in them, that's pretty clearly for my benefit and not the benefit of the individuals in the photos. There's no harm to Person A by being tagged in my private album, nor is there really any benefit to Person A by having the photo automatically shared.
I think it's reasonable to share a photo where Person A is tagged only if the photo has been shared. Tagging and sharing are separate actions as far as most people are concerned so there's not a good reason I can see for the UI performing both actions on a tag event.
Because its me. If you have a picture of me and want to link it to my profile information then I think it would be reasonable for me to know you have that picture. There is obvious benefit for me to have that picture shared with me and aware that it exists instead of it being hidden away in your private collection.
Tagging is sharing. I see tagging as creating a link between the photo and my google+ profile. Maybe there should be a second option of labeling my name but not linking to my profile and thus keeping the label private, which is odd but seems more like what you want.
Do you also think it would be reasonable if Google copied me on your Gmail conversations everytime you mentioned my first name or anything I've created? I don't see how they owe you anything for privately linking to your profile.
It's completely and utterly irrelevant that it's you. I took the picture, it's MY picture. I have thousands of physical pictures captured on 35mm film. I have names and dates written on them, should I have to give a copy of all of those pictures to the people that are in them simply because I put their name on the back? Should I have to give them a copy because I wrote their URL on the back? The additional meta data of the link to your profile is not ANY greater than a simple label so long as that picture is private.
But it isn't irrelevant, I have a vested interest in the picture from the fact that I'm in the picture. Photos of me are extremely valuable to me and I would think most people have that opinion but maybe I'm wrong. This 'force sharing' leads to a Pareto improvement in both the google+ network and society. I honestly do not understand the situation where sharing a picture of me with me makes it less valuable for you.
In the case of physical photos, no I dont think you need to give everyone a copy because that would take effort on your part. Sharing on google+ is costless.
Actually, the album is very important too. The album as a whole makes a story and by tagging photos you can make up actors of that story. For example, what about if album is "actors of porn movie X" or something like (the title of album could be more innocent) and one of photos in that album has you tagged?
Regarding sharing, why would you want to tag somebody with his/her public profile without even telling him/her that?
I went to see a live act on the night of my drunken party. I liked the singer's music and want to remember who they are later. I really don't think the singer needs to have access to my photo album from that night.
The album is only relevant if you create your albums based on context. I don't take that many pictures any more and so most of my albums are based on dates. For example I have an album that contains all pictures from January 2011, there's about 15 pictures in it and they are from 3 different events. Having access to the album does't provide any additional benefit to the people in the pictures because only two or three of the other 14 pictures would be relevant to them in the first place.
I think it does make some intuitive sense (even if there is confusing messaging on this). If i tag someone in a picture, then clearly they should be able to see that picture (i mean they were there when it was taken so there should be no problem with that). Extending this to the album level makes some sense because presumably everything in an album is related to a particular event (so that person who was tagged would have been there for all of that).
That being said there probably just needs to be better messaging on this so that users understand what exactly it means to tag someone.
1) It would make sense if you see the world only as one big group (i.e. without any "circles"), like Facebook does. But having different levels an types of relationships is G+'s strong point. This totally contradicts this point.
2) In Picasa, the setting was "private" and it was private. Now, that suddenly changes and there is no way back. Many people have relied on the former policy and know have a big "surprise, you are screwed" flashing on their screen. Not good.
And there are more reasons, but these two are already more than sufficient.
Allowing someone that was tagged in a photo to see the photo is fine with me. Letting them see the entire album doesn't make a bit of sense because there's not really a good way to automatically determine if the rest of the pictures in the album are relevant to that person.
While you might make an album based on events I tend to make albums based on dates. During periods where I don't take a lot of pictures I might have all of the pictures in an album for a specific month. If I then tag a friend in a picture from a baseball game we went to he now has access to all of the pictures in that album which might include pictures from a private family outing or event. Could my organizational habits be changed? Sure, but I shouldn't have to.
The much bigger problem I have with this is that the people tagged in your albums not only get the ability to see the entire album, but to re-share the album. I am extremely meticulous in whom I share anything with. I disable re-sharing on 99% of my posts that are to family and friends. I disable re-sharing on ALL of my shared photos. By using the tagging feature my desire to limit sharing is completely ignored. So while I might want to tag someone in a picture for my own benefit, especially if it was at an event where maybe I didn't know everyone very well, I won't use it if the albums are shared without my consent.
edit: I just noticed that referencing someone with the +name or +email address notation in photo comments has the same effect of sharing the photo + album + re-share
Probably not that many. I don't use facebook in large part due to their "everything is public" attitude so it doesn't surprise me. Google+ started off with the circles model and a control whom who share with model so this does surprise me.
I agree that people should be able to see photos tagged with their name, though it's not a certainty that they were there. People often tag (e.g.) pictures of their kids with the names of the grandparents, so the grandparents will be sure to see them. On the dark side, there are also users who tag people maliciously (tagging a picture of Hitler with their boss's name, say).
I don't agree with letting them see the whole album by default. Albums aren't necessarily associated with an event. If you have an album called "Family", you might want to let your buddy see the pictures of the family barbecue he attended, without necessarily sharing the picture of your wife breastfeeding.
Extending this to the album level makes some sense because presumably everything in an album is related to a particular event (so that person who was tagged would have been there for all of that).
I have many albums broken out by date. The fact that you were playing basketball with me at 10am doesn't mean you were at my sister's house that evening.
Google is making social take a lot more energy than I care to give it. Circles seemed OK. But now having to break up my albums and tagging into visibility units is absurd. It's easier to just quit.
G+ is making me really appreciate Facebook -- which I NEVER thought I'd say.
You hit the big UI problem and where Google failed. The fact that I tagged a picture has nothing to do with visibility. I added a personal note to the picture to give me more information. A simple discrete event. The fact somebody decided to add a part to the use case that now shares the photo is really bad design.
Folks really need to stop themselves from making user actions have much longer reach than what the user actually did. It would probably be fine to have a "share button" appear next to the tag of the person's name. That shows that the picture is still private, but you might now want to share it with that specific person.
One could argue that if you take a photo of someone, they ought to know that you took it of them. In fact that's an argument in support of auto-tagging. You can always untasg.
I guess that's an argument, but I really cannot figure out a good reason for it. If I write on the back of a photo that I took the people on the photo, I have no obligation to send them a copy of the photo. It also creates some serious distraction for anyone with a public career. Does a singer need to be notified about every fan who takes her picture?
Let's go a bit further down this hyper-connected, automatic world. Let's say Google Plus implements facial recognition. Seems like a good idea, saves you some time. So, I upload a ton of photos and they get automatically tagged. It would be very hard to consider anything private under those circumstances. Worse, I am truly using "the cloud". Maybe some of those photos need to be deleted or edited.
At the end of it all, I wrote a note on a picture. Having additional things happen without permission is just a bad UI choice and leads to problems and apologies. And since someone decided the whole album is now shared, it could lead to some physical danger.
If I take a photo in public it may contain people that I don't even know. I have no obligation to give those people a copy of the photo nor do I have any obligation to tell them they were in my photo. This happens a LOT in popular public places and tourist attractions.
If I don't know them I'm not going to tag them because I have no idea who they are, but I may want to share the event with people that I do know. Now with auto tagging these people I don't know are tagged in my photos and I have to share not only my photo of them with them, but the entire album? That seems to be really over reaching. Auto tagging and automatic sharing seems like the worst possible option to me.
"This move goes against Google's supposed philosophy of controlled sharing within circles."
This is exactly in keeping with google's philosophy. When the pictures are public, google can use them for advertising. Google+ was created to mine date to sell ads against. Why do you think Larry tied the bonuses this year to performance in social?
On the one hand, I can understand the point of view of the people who are upset about this and there should at least be a way to disable this behavior.
On the other hand I view putting photos online (or even just having them on a computer that connects to the Internet) as basically a binary sharing of that photo with the entire world already. The Internet is like a reverse black hole that sucks in all available information and then doesn't allow it to ever be truly destroyed. That view has become so deeply ingrained that I can't bring myself to personally care about this one way or the other... I just wouldn't put pictures on Google+ (or any other site) in the first place if I wasn't okay with the idea of the entire world eventually seeing it.
I disagree. One not-insignificant use-case of Picasa Web Albums was to share photos with selected people only. Face-tagging was just another piece of metadata that could be attached to private or public photos, just like the location geo-tags, captions, timestamps, etc. It never had anything to do with sharing.
I'm not disagreeing with the fact that Google violated the principle of least astonishment here in a way that people are right to be upset about due to privacy concerns... that's what I was agreeing with on my "first hand".
I just don't have any strong emotional reaction to the situation because of my binary view of sharing on the Internet. Any site feature that allows you to share something "to selected people only" is more an illusion of security/privacy than a real thing (you can't control who THEY share it with, etc). Even if you never share the photo with others and have it marked strictly 'private', I still see putting it up online as basically "sharing it with the world" because all of the untrustworthy middlemen you introduce that have access to that data regardless of your public/private settings.
Because I don't view such public/private/partially-shared/etc features as effective security for photos/videos/writings/etc in the first place, when the way they operate changes in some unexpected way I can't work up much rage about it, though (again) I do see why other people may be upset about it.
I don't share that "binary view of sharing on the internet".
I store photos "on the internet". I also store emails in Gmail. I face-tag photos with whoever is in them, for the same reasons I tag emails with whoever they relate to.
This is as if Gmail were to automatically share my Gmail conversations whenever I mention someone in an email.
I've got a better one: You write a cheque to somebody, and suddenly your bank lets them see your transaction history.
There's a level of control and security one may sacrifice by doing things online, that doesn't mean the information is automatically public, and it definitely doesn't make it OK for Google to treat it in an entirely unexpected way that actually violates ordinary privacy/access control rules.
I agree that the public/private/partially-shared features aren't terribly effective and as such am careful about what I post. I do however find them useful. I don't allows re-sharing of my photos and I've told everyone I share photos with that I don't want them re-shared, specifically on facebook. Anyone that goes to the effort to download and share my photos clearly doesn't respect my intent or concerns and is removed from the list of people I share with.
I wouldn't say I'm "okay" with the idea of the entire world seeing all of my emails, but I accept that it is a very real possibility given the extremely insecure nature of SMTP and the other protocols involved in email handling, so I don't send (or request) anything via email that is very private.
The same can be said about the pictures: the fact that putting them online is insecure doesn't mean people have to be OK with their provider sharing stuff forcibly.
Not to mention that the transport mechanism for pictures on G+ is much safer than email, since it only goes through one server (unlike email, where there's usually at least two MTAs), and all transmission is done through HTTPS.
What's even worse that it automatically connected to Picasso which I must have used 5 or more years ago for some very private photos. When I signed up to google plus I was shocked to see these photos my ex gave me. There were under albums. I was horrified. I think connecting ur Picassa account to google plus was a bad decision. I never used it minus that one time years ago.
Fortunately I deleted them upon finding them a day later. Luckily I only had a few friends in my circle at the time.
Overall I'm not using it. I still use Facebook until everyone moves onto g plus.
Well judging by governments getting involved around the world I would say there has been sufficient questioning of the handling of privacy.
I think a lot of people where really hoping (myself included) that Google+ was going to give us the tool we wanted for social communication. But tis just another Facebook, with all the privacy concerns, and restrictions of freedom included. Everything that makes Facebook 'evil' is now part of Google.
Oddly enough a lot of musician and writer friends use pseudonyms, myself included ... or even plain nick names for that matter.
Facebook doesn't seem to ban those people as long as they have 'real activity'. So I could argue that Google is in fact on a worse 'evil' footing than Facebook right now.
After I read through the Google "what is Google+ really for" powerpoint I closed my account. It became obvious to me it was a lock-in attempt, and then went as far as saying the main 'target' of Google+ was Microsoft and Apple (because desktop apps where seeing a resurgence eroding Google business ambitious).
In my personal opinion Google+ is a very sinister piece of work which should be avoided at all costs. Because I know exactly how I would abuse it, and it appears already that Google is thinking along similar lines to me.
Picasa Web Albums was never that way. It becomes that way automagically when the same Google account is used to subscribe to Google+. That's what I'm questioning.
