The story of privacy.

In the account Herodotus gives us, Gorgo, the Spartan queen, suggests scraping away the wax. Once they do, they find the warning on the wood underneath, where it has been all along.

The man who sent it, Demaratus, needed the message to survive the journey without becoming readable to everyone along the way. If he had destroyed the words, there would have been nothing to deliver. By hiding them, he could hope to get them past the people who might stop the warning and into the hands of people who could use it.

After reading it, the Spartans passed the warning on to the other Greeks. The message had reached its first readers, and they could now decide who else should know. If you wanted a secret to stop with the person who received it, you would need something the wax couldn't provide: that person's cooperation.

In Ovid's telling, the barber is afraid to tell anyone, but keeping the secret to himself becomes unbearable. He finds a place where he can dig a hole, leans down and whispers into it, then covers the hole with earth. He has finally said the thing out loud without telling another person.

That should have been the end of it. Instead, reeds grow from the spot, and when the wind moves through them, they repeat what he buried.

The talking reeds belong to a myth, but the barber's predicament is familiar enough. He has tried to find a way to let something out while convincing himself it will go no further. From the king's side, the distinction doesn't help much: the secret has left the one person who was meant to keep it.

Midas can cover his ears again, but the barber will still know. Keeping that part of his life private now depends on somebody else's decisions, and at least in this case he knows who that somebody is. A message sent across a country might pass through people its sender would never meet.

Other locked letters carried more ordinary requests. A century later, a man named Jacques Sennacques wrote to his cousin asking for a certified copy of a death notice. He folded and sealed the letter, but it never reached its recipient. It stayed among the undelivered mail in a postmaster's trunk, with the request still inside.

That was in 1697. While other letters were being opened, read and answered, this one remained closed. The paper survived long enough for a very different reader to come along, centuries later.

A paper lock gave a recipient something to inspect, but it couldn't report back to the sender. Once the letter left, someone could be examining it without the writer ever knowing. If you couldn't establish who was looking, you had to decide how to act with that uncertainty.

That difficulty was meant to do some of the work of supervision. If you couldn't establish that you were alone, you might behave as though you weren't, postponing what you wanted to do or deciding against it altogether. The uncertainty would follow you through time that nobody was actually spending looking at you.

Jeremy Bentham published this proposed Panopticon in 1791. The central-inspection idea came from his brother Samuel, who was working in Russia and wanted experienced craftsmen to supervise and train other workers from a central position. Jeremy adapted it into a prison where a small number of inspectors could oversee many people, and where the people being watched would have much less information about the watcher.

He presented that as a practical improvement, with better discipline and work at a lower cost. But he still called for actual inspections. An empty tower couldn't be counted on to do the job indefinitely, because people who repeatedly got away with breaking a rule could learn how weak the supervision really was. The design depended on making it difficult to tell when inspection stopped, while giving people reason to believe it happened.

Bentham pursued the prison project without getting a prison built strictly to his design. Its promised advantages remained claims about how the proposal would work. But within the proposal, the unequal view was deliberate: one person could inspect another person's life while revealing very little about their own presence.

With the letter, you wanted evidence that another person had looked. Here, withholding that knowledge was part of the mechanism. Your behavior could change before anyone took a secret away, simply because you couldn't tell whether you had an audience.

If you've ever typed a post, imagined who might read it and then softened what you were going to say, you've met a smaller, everyday version of that pressure. You might be avoiding an argument, protecting your job or choosing the version of yourself that usually gets a warm response. Those are different pressures from a prison guard, but an audience doesn't have to speak before you start answering to it.

The tower still depended on a physical arrangement: someone had to be in a position to look while you were there. A photograph would let the looking continue after the moment, and after the people in it, had gone.

Photography was already decades old. What cameras like this helped change was how easily people could take it into ordinary life, including moments when the person being photographed had made no particular decision to become a portrait.

The wider problem was troubling people at the time. In 1890, two lawyers, Samuel Warren and Louis Brandeis, wrote about newspapers reaching into domestic life, photographs circulated without permission and the commercial appetite for personal details. Their argument for a right to privacy included a point that still gets lost: something could be true and still be something you hadn't agreed to have published.

They also distinguished telling a person something privately from giving permission to publish it for everyone. Letting someone read your letter did not, in their argument, automatically give that person the right to print it.

By then, the barber's problem had grown. There could be a person who saw you, another who made a copy and another who found an audience for it, and you might never have agreed to any of them being involved. Keeping something private couldn't depend entirely on choosing trustworthy people when you weren't always the one choosing.

It required other people to recognize a limit on what they could do with your life, even when they had managed to get hold of a piece of it.

The declaration made that protection something everyone should have. You didn't need the importance of a queen writing a final letter, or a message that could change the course of a war. An ordinary family's home and correspondence belonged within it too.

Applying that to a powerful institution is harder than asking a friend to keep a confidence. The declaration set a standard; it wasn't itself a treaty that made all those protections immediately enforceable everywhere. Someone still had to make the protection work when the institution doing the watching had the authority, staff and records to continue.

And that leaves a difficult question for the person on the other side of it: if those limits have already been ignored, how do you find out what was done to you?

Some of what survived was already in pieces. Roughly sixteen thousand bags held documents torn up by hand, and archivists would spend years trying to fit the fragments together. That work is still incomplete; a bag of surviving paper doesn't mean every page, or every person's story, can be recovered.

From 1992, people began regularly gaining access to their own files. The record that had once helped an institution observe someone could now help that person understand what had happened to them and seek accountability.

Opening the records did not mean making every detail about everybody available to everyone. The archive protects other victims' and third parties' information when preparing files for individual access. People could gain knowledge about what had been done to them without being handed unrestricted access to every other life appearing on the same pages.

The papers were still sensitive. What changed was who could use them and for what purpose, and that makes this a harder question than whether private information should simply be kept or destroyed. Sometimes keeping the record is what gives the person inside it a chance to act.

Here, there were offices people could enter and files they could ask to inspect. As more of everyday life moved online, a family picture could end up in places its owner didn't even know to ask about.

That changes what getting it back involves. If the school removes its page, the relative still has the download. If a search engine removes its result, the website holding the photograph may still be there. Deleting the copy you can see doesn't tell you what happened to all the others.

You can find some public copies through reverse-image search, but the results depend on what that service has indexed. They can't show you an inventory of every private account, phone or family chat holding the picture. Asking one person to remove it may solve that particular copy without telling you where the next one went.

The person who passed it on might have had nothing worse in mind than showing someone a grandchild. That is part of what makes it difficult. Their reason for sharing can be affectionate, while the audience they create is much larger than the one you chose.

The audience you picture can also leave out the company running the app. You might be alone in your kitchen, looking up something about your child without posting a word. The websites and apps you use can still record searches, pages visited and time spent there. Some of that activity can feed advertising systems, even though you never thought of it as something you were sharing.

In 2024, the U.S. Federal Trade Commission reported extensive collection and use of personal information by major social media and video services, including information about people who weren't users. It also found inadequate protection for children and teenagers. This kind of observation can be automated: a system can use a record of your activity without a person sitting there reading it as it happens.

That doesn't mean every private message is being read. End-to-end encryption is designed to let the service carry a message without being able to read its contents, and that protection matters. A recipient can still keep or pass on what you send, while separate browsing or app activity may be recorded under different rules. Being alone with your phone doesn't tell you which protections you have.

And every copy that remains can outlive the reason anyone wanted it. People change phones, forget accounts, stop visiting websites, while the material stays available for someone to find later. You have to think about the reader who might arrive years from now, too.

The reader who eventually finds something may have very little in common with the person it was meant for. They may also have ways of examining it that didn't exist when it was sent.

That doesn't mean a camera pointed at an envelope can read through it. The researchers needed physical access and specialized equipment, and they were recovering marks that were still present on the paper. The important part of the comparison is that the information had survived its concealment.

But a machine can also produce something that looks like a discovery without recovering what was originally there. A year before the letter research was reported, a system called PULSE showed tiny, indistinct faces turning into detailed portraits. It was easy to look at those results and think the missing people had been found, but the researchers explained that the system generated imaginary faces.

A convincing face and a recovered identity are different results. The letter researchers had evidence of writing inside their packet; a generated portrait looking plausible doesn't by itself establish who was in the original photograph. Equally, that doesn't make every blur safe: some forms of blur and pixelation retain information that can help recognition.

For a picture you're about to share, this leaves a useful question: what information will actually remain in the copy you send? Something that looks hidden to you may still be there, while information removed from that copy can't be recovered from those removed pixels. Someone may still identify a person through other clues or other photographs, which is why the rest of the picture matters too.

A surviving picture gives a later viewer something to examine. An account invitation can go further by continuing to show someone what is happening now, long after the reason you invited them has gone.

There are versions of this elsewhere in a family. A location share keeps running after the trip, or a recording stays in a toy's online account after the toy has been unplugged. The physical activity ends, which makes it easy to feel that the connection has ended with it. Often there is a separate permission or stored copy to deal with.

When an organization keeps records about a family, who can look at them matters too, even if the family never supplied those records themselves. A roadside plate reader, for example, can turn a car passing a camera into a record of a vehicle, place and time. Decisions about which agencies can search that record happen somewhere beyond the car.

In 2025, an Illinois audit found that U.S. Customs and Border Protection had gained access to Illinois plate-camera data in violation of state law, and the state ordered that access shut off. Discovering the access gave the state something specific to challenge: who was able to use records that had already been collected.

That finding concerned vehicle records. Covering a child's face in a video wouldn't change what a plate camera recorded about the car carrying them. The Flock guide follows the audit and other documented problems, because parents also need ways to find out what institutions are keeping and question who is allowed to use it.

By this point, the picture on your phone is only one part of what other people might be able to know. There can be saved copies, live invitations and records held by organizations you never chose to share with. Closing one of those routes still matters, but it doesn't close the others for you.

Some of those decisions belong to the people and institutions holding the records, and they need to be answerable for them. Others begin with the copy we choose to send. In our case, there is a reason for sending it: the videos show parents something they can do with their own children.

Seen on its own, a covered face can look like a very small decision. And it is a small decision compared with all the ways information about a family can travel. But the size of the wider problem doesn't make the detail inside that decision irrelevant. Someone watching a useful demonstration doesn't need our children's names to learn from it.

Preparing that public copy is only the beginning. Once somebody has it, they can keep it, pass it on and examine it in ways we didn't have in mind when we recorded it. That makes what we leave out matter, and it also means we have to pay attention to who has access to the fuller picture.

Our face-covering tool helps prepare that copy, but placing a cover over a face leaves the rest of the recording as it was. An address or school badge needs its own cover, and a name spoken in the audio needs a separate edit. Different effects also leave different amounts of facial detail, which the technology guide explains. The actual file still needs to be watched and listened to before it leaves your device.

Covering a face also doesn't remove the experience of being filmed. Leaving some moments unrecorded gives a child room to be silly, get something wrong or change their mind without that moment becoming something for other people to watch. A family afternoon doesn't always need a future audience.

If you're deciding about your own family picture, begin with who you wanted to show it to. A photograph meant for the grandparents can go to them through a private family album or message, while a separate, more limited version can be prepared if there's a reason to post publicly. The people receiving the private copy also need to know whether you're comfortable with them passing it on.

That conversation is part of the decision. Otherwise you've chosen an audience that the next person knows nothing about, and they're making a new choice for you. If it has already become awkward, there are ways to ask family to keep the pictures private without having to turn every conversation into an argument.

And if a school, platform or another person already has material about your child, the question doesn't end with what you could have left out. You can ask what they hold, who can access it and what they will do with a request to restrict or remove it. Their answer might reveal another copy or a limit you need to deal with. Your precautions don't make them less responsible for what they do.

For us, having our children in public videos can coexist with keeping parts of their lives to themselves. Privacy still matters in what we leave out, who gets the fuller picture and what we ask those people to do with it.

You can watch us play, see how a movement works and try it with your own baby. The rest of our children's lives doesn't have to come with the video.