WAIT-A-SEC: A Human-Centered Design Approach to Privacy Communication for Social Media Oversharing

Abstract

Social media platforms often operate on extractive security logics that prioritize frictionless data sharing, leaving users disempowered and prone to oversharing sensitive information, without fully recognizing the associated privacy implications. We present WAIT-A-SEC (Warnings About Information Transfer And Sharing: Encouraging Caution), hereafter referred to as WAITASEC, an interactive proof-of-concept prototype that delivers real-time privacy alerts while users compose posts to minimize instances of oversharing. Leveraging a synthetic dataset of 90 annotated examples of realistic user-generated content, our evaluations compare three separate models 1) a rule-based regular expressions (regex) and named entity recognition (NER) through spaCy, 2) a large language model (LLM) and 3) a hybrid model that combines the previous two models as well as incorporates a knowledge graph (KG) and retrieval augmented generation (RAG) to provide context. In this hybrid approach, regex and NER yield candidate classifications, which are then validated and expanded by the LLM, utilizing RAG to retrieve relevant context from the KG before sending feedback back to the user. This classifier achieves optimal performance (Macro-F1 = 0.897; Micro-F1 = 0.834), significantly reducing critical false negatives. Grounded in Technical and Professional Communication (TPC) and active learning principles, we advocate for a warning-first design that introduces intentional pedagogical friction. This tactical approach promotes user reflection and fosters enduring privacy literacy, restoring user agency rather than relying on passive, automated redaction. This paper concludes with deployment considerations and next steps for user studies.