Measure Privacy using Nissenbaum’s Theory of Contextual Integrity

A lot of time companies follows certain data practices that feel deeply invasive even though technically legal. Nissenbaum’s framework argues that privacy is not merely about secrecy, but rather about ensuring appropriate information flows.

According to Nissenbaum’s theory of Contextual Integrity, a privacy violation occurs when an information flow breaches the norms of the social context in which it originates. Every information flow is governed by five parameters: Data Subject, Sender, Recipient, Information Type, and Transmission Principle.

In 2025, Google and the developer of the popular period-tracking app Flo Health agreed to a $56 million settlement over claims they violated the privacy of millions of users. Users had inputted highly intimate health data into the app. However, investigations revealed that the app was transmitting this sensitive data to third-party platforms like Facebook and Google for targeted advertising purposes.

Applying contextual integrity, we can map exactly why this was a massive violation:

1. Data Subject: The app user.
2. Sender: The Flo Health app.
3. Recipient: Facebook/Meta (an advertising platform).
4. Information Type: Menstrual health and reproductive data.
5. Transmission Principle: Secretly shared for commercial monetization.

Users shared their data within a healthcare and wellness context, where the established norm is strict confidentiality. When the data was transmitted to an advertising context, the transmission principle was violently breached. The infamous Cambridge Analytica scandal followed the exact same pattern: data shared in a social context (a Facebook personality quiz) was transmitted to a political consulting firm without appropriate consent, violating contextual norms and resulting in a $5 billion FTC fine.

The Practical Measurement Solution: Organizations can measure the “creepiness factor” of their products before launch by tracking the Contextual Deviation Rate. During the product design phase, privacy engineers map the five parameters of any new data flow. If a feature introduces a change to any parameter that deviates from user expectations (e.g., sending wellness data to an ad broker), it registers as a contextual deviation. By tracking the number of unmitigated deviations against subsequent user churn or negative app store reviews, companies can quantify the business cost of violating contextual integrity.