I'm with you. This is how it works on Facebook and I suspect this is how the majority of people expect it to work. Not only that, this is not only the behavior I expect but the behavior I want. I suppose it might be OK with me if someone tagged me in a photo that was private just to the person who took it.
But it would be a huge, huge problem if someone could tag me in a photo and share it to some circles that didn't include me. Fake-tagging people or tagging people in embarrassing photos is a major problem on FB, and the privacy issue here goes two ways: the person you tagged also has their own privacy concerns. What if you tagged an embarrassing photo of me, shared it with a circle of hundreds of co-workers (that you excluded me from), and then not only do I not know the picture is out there, but co-workers can see it by visiting my profile and looking at pictures tagged of me? That would be orders of magnitude worse than the status quo.
I'm trying to think of how you design a system that respects both my concerns and those of the OP, and I can't come up with anything that would be intuitive. (Suppose that you could tag an album full of people and keep it private to yourself, but sharing it with a family circle caused it to also be shared with everyone you tagged? That really would break user expectations). I think the current implementation might be the best one, perhaps with more of a warning in the UI that tagging shares with the person tagged. In essence this is not a privacy complaint, it's a feature request: people want to use tags for a different purpose (organizing private albums) than they are designed for.
It hasn't always been the case, but Facebook has a setting called "Who can see photos and videos I'm tagged in". There's also "Let friends of people tagged in my photos and posts see them."
What if you tagged an embarrassing photo of me, shared it with a circle of hundreds of co-workers (that you excluded me from), and then not only do I not know the picture is out there, but co-workers can see it by visiting my profile and looking at pictures tagged of me?
Let's break this down and relate it to physical (they're both real) photos:
What if you tagged an embarrassing photo of me
Considering only viewing the page for the photo at this point: With physical photos it's possible to write someone's name on them, and online it's always possible to add a description identifying who is in a photo, so being able to tag anyone doesn't increase the information storage of the system.
shared it with a circle of hundreds of co-workers (that you excluded me from)
People can show physical photos of you to other people without you knowing. They can send or grant access to digital photos without you knowing. Being able to grant access to photos of you on a social network is just an extension of this. Granting access so that people can see the photos when viewing an album or see an album in an album list is (or could be) separate from where or how that permission to view the photo is made known.
and then not only do I not know the picture is out there
We don't know that about physical photos, or photos that are sent in emails.
but co-workers can see it by visiting my profile and looking at pictures tagged of me?
Now this would be problem. There shouldn't be anything viewable on your profile by other people that you can't see yourself. Photo's should only be able to be shared and sent in private by explicitly sending a message to a group of people.
I don't think that scenario is possible with G+ at the moment. Tagging someone in a photo automatically gives that person access to the photo.
What G+ currently lacks is a way to tag someone without giving that person access to the photo. That's not perfect but it's better than the alternative which you described. Hopefully they'll find a way of making it possible to tag someone in private without putting it in front of people in ways that it's not possible in the physical world. You can't pin embarrassing photos on people without them noticing.
Agreed - in fact, in the UK the Data Protection Act makes this a legal requirement (not that Google have to abide by UK law).
You could change it such that users can only see the individual pics they're tagged in, and not all pics in the parent album. That may be preferable, but makes the situation more complex and means you can't see the picture you were tagged in in context.
As you say, communicating how the security works is likely a better approach than changing the security model.
My expectation would be that the specific photos I tag Person A in are automatically visible to Person A. I think this is reasonable, and other concerns come up if a person is unable to see which photos they are tagged in.
Making the entire album visible to Person A, I think, is not as reasonable.
Why should Person A be able to see the photos they are tagged in if the photos have never been shared? If I have lots of albums on Picasa and I never share any of them but I tag everyone in them, that's pretty clearly for my benefit and not the benefit of the individuals in the photos. There's no harm to Person A by being tagged in my private album, nor is there really any benefit to Person A by having the photo automatically shared.
I think it's reasonable to share a photo where Person A is tagged only if the photo has been shared. Tagging and sharing are separate actions as far as most people are concerned so there's not a good reason I can see for the UI performing both actions on a tag event.
Because its me. If you have a picture of me and want to link it to my profile information then I think it would be reasonable for me to know you have that picture. There is obvious benefit for me to have that picture shared with me and aware that it exists instead of it being hidden away in your private collection.
Tagging is sharing. I see tagging as creating a link between the photo and my google+ profile. Maybe there should be a second option of labeling my name but not linking to my profile and thus keeping the label private, which is odd but seems more like what you want.
Do you also think it would be reasonable if Google copied me on your Gmail conversations everytime you mentioned my first name or anything I've created? I don't see how they owe you anything for privately linking to your profile.
It's completely and utterly irrelevant that it's you. I took the picture, it's MY picture. I have thousands of physical pictures captured on 35mm film. I have names and dates written on them, should I have to give a copy of all of those pictures to the people that are in them simply because I put their name on the back? Should I have to give them a copy because I wrote their URL on the back? The additional meta data of the link to your profile is not ANY greater than a simple label so long as that picture is private.
But it isn't irrelevant, I have a vested interest in the picture from the fact that I'm in the picture. Photos of me are extremely valuable to me and I would think most people have that opinion but maybe I'm wrong. This 'force sharing' leads to a Pareto improvement in both the google+ network and society. I honestly do not understand the situation where sharing a picture of me with me makes it less valuable for you.
In the case of physical photos, no I dont think you need to give everyone a copy because that would take effort on your part. Sharing on google+ is costless.
Actually, the album is very important too. The album as a whole makes a story and by tagging photos you can make up actors of that story. For example, what about if album is "actors of porn movie X" or something like (the title of album could be more innocent) and one of photos in that album has you tagged?
Regarding sharing, why would you want to tag somebody with his/her public profile without even telling him/her that?
I went to see a live act on the night of my drunken party. I liked the singer's music and want to remember who they are later. I really don't think the singer needs to have access to my photo album from that night.
The album is only relevant if you create your albums based on context. I don't take that many pictures any more and so most of my albums are based on dates. For example I have an album that contains all pictures from January 2011, there's about 15 pictures in it and they are from 3 different events. Having access to the album does't provide any additional benefit to the people in the pictures because only two or three of the other 14 pictures would be relevant to them in the first place.
I think it does make some intuitive sense (even if there is confusing messaging on this). If i tag someone in a picture, then clearly they should be able to see that picture (i mean they were there when it was taken so there should be no problem with that). Extending this to the album level makes some sense because presumably everything in an album is related to a particular event (so that person who was tagged would have been there for all of that).
That being said there probably just needs to be better messaging on this so that users understand what exactly it means to tag someone.
1) It would make sense if you see the world only as one big group (i.e. without any "circles"), like Facebook does. But having different levels an types of relationships is G+'s strong point. This totally contradicts this point.
2) In Picasa, the setting was "private" and it was private. Now, that suddenly changes and there is no way back. Many people have relied on the former policy and know have a big "surprise, you are screwed" flashing on their screen. Not good.
And there are more reasons, but these two are already more than sufficient.
Allowing someone that was tagged in a photo to see the photo is fine with me. Letting them see the entire album doesn't make a bit of sense because there's not really a good way to automatically determine if the rest of the pictures in the album are relevant to that person.
While you might make an album based on events I tend to make albums based on dates. During periods where I don't take a lot of pictures I might have all of the pictures in an album for a specific month. If I then tag a friend in a picture from a baseball game we went to he now has access to all of the pictures in that album which might include pictures from a private family outing or event. Could my organizational habits be changed? Sure, but I shouldn't have to.
The much bigger problem I have with this is that the people tagged in your albums not only get the ability to see the entire album, but to re-share the album. I am extremely meticulous in whom I share anything with. I disable re-sharing on 99% of my posts that are to family and friends. I disable re-sharing on ALL of my shared photos. By using the tagging feature my desire to limit sharing is completely ignored. So while I might want to tag someone in a picture for my own benefit, especially if it was at an event where maybe I didn't know everyone very well, I won't use it if the albums are shared without my consent.
edit: I just noticed that referencing someone with the +name or +email address notation in photo comments has the same effect of sharing the photo + album + re-share
Probably not that many. I don't use facebook in large part due to their "everything is public" attitude so it doesn't surprise me. Google+ started off with the circles model and a control whom who share with model so this does surprise me.
I agree that people should be able to see photos tagged with their name, though it's not a certainty that they were there. People often tag (e.g.) pictures of their kids with the names of the grandparents, so the grandparents will be sure to see them. On the dark side, there are also users who tag people maliciously (tagging a picture of Hitler with their boss's name, say).
I don't agree with letting them see the whole album by default. Albums aren't necessarily associated with an event. If you have an album called "Family", you might want to let your buddy see the pictures of the family barbecue he attended, without necessarily sharing the picture of your wife breastfeeding.
Extending this to the album level makes some sense because presumably everything in an album is related to a particular event (so that person who was tagged would have been there for all of that).
I have many albums broken out by date. The fact that you were playing basketball with me at 10am doesn't mean you were at my sister's house that evening.
Google is making social take a lot more energy than I care to give it. Circles seemed OK. But now having to break up my albums and tagging into visibility units is absurd. It's easier to just quit.
G+ is making me really appreciate Facebook -- which I NEVER thought I'd say.
You hit the big UI problem and where Google failed. The fact that I tagged a picture has nothing to do with visibility. I added a personal note to the picture to give me more information. A simple discrete event. The fact somebody decided to add a part to the use case that now shares the photo is really bad design.
Folks really need to stop themselves from making user actions have much longer reach than what the user actually did. It would probably be fine to have a "share button" appear next to the tag of the person's name. That shows that the picture is still private, but you might now want to share it with that specific person.
One could argue that if you take a photo of someone, they ought to know that you took it of them. In fact that's an argument in support of auto-tagging. You can always untasg.
I guess that's an argument, but I really cannot figure out a good reason for it. If I write on the back of a photo that I took the people on the photo, I have no obligation to send them a copy of the photo. It also creates some serious distraction for anyone with a public career. Does a singer need to be notified about every fan who takes her picture?
Let's go a bit further down this hyper-connected, automatic world. Let's say Google Plus implements facial recognition. Seems like a good idea, saves you some time. So, I upload a ton of photos and they get automatically tagged. It would be very hard to consider anything private under those circumstances. Worse, I am truly using "the cloud". Maybe some of those photos need to be deleted or edited.
At the end of it all, I wrote a note on a picture. Having additional things happen without permission is just a bad UI choice and leads to problems and apologies. And since someone decided the whole album is now shared, it could lead to some physical danger.
If I take a photo in public it may contain people that I don't even know. I have no obligation to give those people a copy of the photo nor do I have any obligation to tell them they were in my photo. This happens a LOT in popular public places and tourist attractions.
If I don't know them I'm not going to tag them because I have no idea who they are, but I may want to share the event with people that I do know. Now with auto tagging these people I don't know are tagged in my photos and I have to share not only my photo of them with them, but the entire album? That seems to be really over reaching. Auto tagging and automatic sharing seems like the worst possible option to me.
