Why is privacy so hard? After so much negative press and data breaches, why are we still constantly tracked online and on smartphones? This article, based on a talk at UCSD's Halıcıoğlu Data Science Institute, explains privacy's complexity through 11 key points. First, privacy is a broad, ill-defined term with no universal definition—it includes 'the right to be alone,' control over data, anonymity, contextual integrity, and more. Each perspective leads to different solutions: 'right to be alone' inspires do-not-call lists, while 'right to be forgotten' enables search engine deletions.

Second, privacy risks span relationships with friends, family, employers, governments, and hackers—each presenting unique threats like overprotective parents, workplace monitoring, civil liberty concerns, or personal safety risks. Procedural approaches (e.g., GDPR cookie notices) focus on rule compliance but often fail to improve real-world outcomes. Outcome-oriented methods like k-anonymity and differential privacy offer measurable guarantees but only work with large datasets and fail in small-group interactions where identities are already known.

The article argues these limitations will worsen with the Internet of Things, where pervasive sensing and data aggregation will amplify existing privacy failures unless fundamentally new approaches emerge.