When Danielle K. Citron first started working on privacy issues in 2005, our intimate lives were still relatively free from digital surveillance, with Facebook in its infancy and Google Maps and the iPhone not yet in existence.

What began first as a slow erosion has since gathered into a landslide, and when the MacArthur Foundation gave Citron, a professor at the University of Virginia School of Law, a $625,000 “genius grant” in 2019, she took a sabbatical to write a book that would frame the stakes for people who still don’t understand why intimate privacy matters.

“The Fight for Privacy: Protecting Dignity, Identity and Love in the Digital Age,” surveys the damage done to privacy rights around the world, makes the case for understanding intimate privacy as a civil and human right, and offers a roadmap for law, industry and individuals to protect those rights.

“Intimate privacy should be treated as a human and civil right because without intimate privacy, we have difficulty developing identities, enjoying self-respect and social respect, and opening up to others so that we can forge relationships and fall in love,” Citron said. “The book is about the central role that intimate privacy plays in our lives, and why we need privacy around our bodies, our health, our reading habits, our thoughts, our close relationships, our sexual orientation, sex and gender.”

Citron interviewed 60 people who understand what’s at stake because their lives were upended by violations of their intimate privacy. One such victim, a lawyer Citron calls “Joan” in the book, spent three years picking up the pieces of her life after someone secretly taped her showering in a hotel bathroom and then tried to extort her for more nude images. When she refused, the person posted clips of her using the bathroom on thousands of adult sites and adult hookup sites. (In his initial email to Joan, the extortionist said he would refrain from posting the material if she sent him more videos of herself in compromising situations. This type of intimate privacy violation is often referred to as “sextortion.”)

“In addition to posting the video online, the extortionist emailed the video to her work colleagues and friends from graduate school, and presumably he got all that information from her LinkedIn account,” Citron said. “It was a horrifying thing that she had to then go and talk to her boss about.”

She shuttered her social media accounts as she tried (unsuccessfully) to erase the nonconsensual damage to her online identity. She lost contact with friends, delayed her wedding by two years and gave up certain career aspirations.

“All the ways that social media allowed her to connect with other people was the way he was exploiting her,” Citron said. “It changed the arc of her life, and Joan’s experience is resonant with so many people's experiences. It’s just a wholesale disruption of how you feel about yourself and your emotional safety and physical safety.”

As Citron explains in her book, there are more than 9,500 sites whose very existence is predicated on exploiting intimate privacy violations. Some sites make a game of it, offering rewards and prizes for popular “nudes,” usually of women and gender and sexual minorities. Posters include victims’ home addresses and social media handles. Sites get away with the abuse because federal law gives them immunity from liability for content posted by third parties.

“We have Section 230 of the Communications Decency Act to thank for that,” Citron writes in the book. Citron argues in her book that courts have read the law so broadly that it makes a mockery of its stated purpose, which was to incentivize self-monitoring to combat online abuse and other “offensive” material, the statute’s language.

Citron, who is the Jefferson Scholars Foundation Schenck Distinguished Professor in Law and the Caddell and Chapman Professor of Law at UVA, writes and teaches about privacy, free expression and civil rights, and serves as the inaugural director of the school’s LawTech Center, which focuses on pressing questions in law and technology. She also co-hosts the Law School podcast “Common Law.”

Her research and writing on privacy have earned her accolades and respect from industry and government leaders around world. She is a member of Facebook’s Non-Consensual Intimate Imagery Task Force and an adviser and a member of Twitter’s Trust and Safety Task Force. (She has advised Twitter since 2009.) She is an adviser to the dating app Bumble, the music streaming service Spotify and the video sharing platform TikTok.

The privacy invasions she sees go beyond the video voyeurism and “sextortion” Joan suffered. Spyware apps can turn a person’s own computer or cell phone against them, providing an ongoing window into their intimate life. The most recent trend, according to Citron, is “deepfake” sex videos. There are now more than 50,000 such videos online and nearly all of them victimize women.

“You take someone’s face — usually a woman’s — you morph it into real porn and then post it online,” Citron said. “You give an abuser a technology, they’re going to abuse it.”

And those examples only captured the privacy invasions committed by individuals.

Companies are spying on people’s intimate lives in ways that are hard for the average person to begin to comprehend.

“Unfortunately, we have so little protection around the collection and sale of our intimate information that when period-tracking apps sell our information to data brokers who then sell it to law enforcement, it’s now a problem for women’s safety and their freedom, because there will soon be over 25 states that have laws criminalizing abortion,” Citron said.

That intimate information — location data, data obtained from spyware, data from period-tracking apps — could be circumstantial evidence that someone has obtained an abortion in violation of state law.

Citron is working with staff for U.S. Sen. Elizabeth Warren on the Health and Location Privacy Protection Act and with U.S. Rep. Sara Jacobs on the My Body, My Data Act. Both bills aim to prevent the collection and storage of intimate health and location data, and to prevent the sale of it to law enforcement without a subpoena or warrant.

She advocates for amending Section 230, which immunizes websites trafficking in nonconsensual porn, to exclude bad actors specializing in intimate privacy violations and stalking. She also recommends creating a “duty of care” that websites must meet in order to qualify for immunity in cases involving intimate privacy violations and cyberstalking.

Citron has also advised several foreign countries on intimate privacy issues, including South Korea, which has since passed some of the most comprehensive laws of any country around the world.

After her last book, “Hate Crimes in Cyberspace,” was published in 2014, then-California Attorney General Kamala Harris convened a task force of experts and tech industry leaders to deal with nonconsensual porn. Four months later, Google and Bing announced they would de-index nonconsensual intimate imagery in name searches.

“I’m not giving up hope,” Citron said. “We have a lot of work to do, but if you can see that kind of change in four years in South Korea, and the kind of change we’ve seen in California and Silicon Valley, we can do this. It just needs all of us.”

W.W. Norton and Penguin UK will release “The Fight for Privacy” on Oct. 4.

Founded in 1819, the University of Virginia School of Law is the second-oldest continuously operating law school in the nation. Consistently ranked among the top law schools, Virginia is a world-renowned training ground for distinguished lawyers and public servants, instilling in them a commitment to leadership, integrity and community service.