The mosaic effect on user identification: Implications for privacy

Abstract

Objective: To characterize the mosaic effect in the collection of personal data in online services, from the perspective of Information Science, presenting implications for user privacy. Method: Exploratory research with a qualitative approach, descriptive in nature. The Content Analysis method and the categorical analysis technique were used, analyzing the messages contained in the Privacy Policies of two of the most used online services in Brazil in 2023, TikTok and Spotify. Results: The study revealed three sources of personal data collection: data provided by the user to the data holder, data automatically collected by the data holder, and personal data received by the data holder from external agents. When reorganized, data from these sources can reveal personal information not initially foreseen during the collection phase, characterizing the mosaic effect. Among the privacy implications, the mosaic effect enables the recombination of these data, potentially indicating, for example, the frequency and duration of the user's presence at a specific location, thereby constituting a surveillance action. Conclusions: The need to investigate the mosaic effect is one of the consequences arising from the increased complexity and volume of data available in online services, which recombine data to generate new interpretations with the potential to identify users, and consequently, implications for their privacy.