When it comes to online privacy, be informed and assume the worst, says Jennifer Golbeck.

“Lots of apps are collecting the kind of data that Facebook is collecting. Lots of places that have your data are making it available to third parties,” says Golbeck, an associate professor of information studies at the University of Maryland and director of the university’s Social Intelligence Lab, says.

In the latest issue of Currents, Golbeck sat down with CASE’s Julie Bourbon to share what users can do to protect their online data. Here are some takeaways.

Julie Bourbon: Let’s talk about some developments in online privacy.

Jennifer Golbeck: What we’re finding out—and the important thing is that this does not just apply to Facebook—is that many apps are collecting the kind of data that Facebook is collecting. There are a lot of places that have your data and are making it available to third parties, whether they’re selling it or it’s just getting out there, as happened with Cambridge Analytica. So I hope that people will stop thinking that these warnings are just worst-case scenarios and see that this kind of massive surveillance is more extreme than they thought it was and that it’s happening right now.

I have been warning about this for years, so this has been a Cassandra moment for me. Any developer has known for a long time that this was possible.

For instance, as people have begun downloading the archives of their Facebook data, they’ve found that Facebook has data from their phones that they didn’t realize was being collected: text messages, phone call logs, contact lists. Again, many of us knew was happening and so for me it wasn’t a surprise, but a lot of people were shocked by that. If you have the Facebook app installed on your phone, it’s tracking all of that.

And another interesting thing that hasn’t gotten much attention is that Facebook has been saving any video that you recorded in the app, even if you didn’t post it, even if you thought you were just turning the camera on for yourself. If you were ever using the record function and thought, let me turn Facebook on real quick, it has kept every video. That one actually surprised even me!

JB: It seems overwhelming. How should a person begin to address some of these issues?

JG: There are a few ways. People talk about the convenience of many of these devices. Take a smart speaker. It has many convenient functions, and you decide it’s worth the trade-off. But the problem is, if you have been surprised by any of the news about privacy violations, you are uninformed about what the trade-off is. And I believe that is an intentional problem created by these companies. They want the users to remain ignorant about how much data is being collected and what’s being done with it. They are very opaque. There is no regulation that says they have to be transparent. But you had better be sure that you know what they’re collecting and what they might do with it and think about the worst cases, because those will happen as the actual trade-off that you’re making.

Step one is you really have to make yourself informed about all of the possible things that could be done with this data.

A lot of people think, well, it’s convenient that the Alexa, just to use an example, can do x, y, and z for me. But I don’t think they’re weighing that against, say, the police and some hackers who want to blackmail me, or when I’m in the middle of a divorce and custody battle, and my ex’s lawyers are going to access transcripts of our conversations. Are you really willing to make that trade-off? I’m not saying that will happen, but you need to consider that as a possibility if you’re allowing yourself to be surveilled.

Step one is you really have to make yourself informed about all of the possible things that could be done with this data, and how people want to exploit you, because that’s what it comes down to. And then make your decision about whether it’s worth the trade-off from there. And some people will say yeah, I’m not worried about that. But a lot of people, if you put it to them that way, start to say oh, maybe that’s a bigger trade-off than I thought it was.

JB: What about social media?

JG: For my social media accounts, for anything that’s even remotely personal, I treat them much more as ephemeral platforms. I don’t use Facebook as a place to keep an archive of everything that I’ve ever done in my life. Facebook is making money off of that, so why would I want to give them that data? At some point I downloaded an archive of everything I had ever posted—it took forever!—and then I used the Facebook timeline cleaner that runs in your browser and deletes old data. Every two weeks, I run that tool and it deletes everything that’s more than two weeks old, so there’s just a little bit of data there. And sure, Facebook may have an archive of it, but it means that no third party, whether it’s a person or a company, like a Cambridge Analytica, can access it.

I would love to see Facebook introduce a feature that allows you to set an expiration date for old posts. But until then, it’s important for people to stop thinking of these companies as neutral places to store data, or as a public diary, a place to keep all of their pictures and all of the things they did. Because Facebook is using that to make money, and they’re giving access to all kinds of people who might use it in really manipulative ways. They might use it to conduct psychological experiments on you, which is what Cambridge Analytica was doing.

So again, be informed of that, and assume the worst, because Cambridge Analytica will not be the worst case that comes forward. You’re losing a little bit by not having everything stored in one place, but how often do people actually go through their archives? Not that often. And if you really want it, if you have your kids’ pictures up there, download your Facebook archive and put it someplace where it’s not being sold and used. That’s a really practical thing you can do that gives you back 90 percent of the control.

Read the full interview with Golbeck in July/August Currents.