I recently learned that moderators have unrestricted access to users’ followed posts simply by viewing their profiles. It's worrying and seems odd, especially considering that saved posts and voting history are kept private by design.
Is this information necessary for moderators to perform their duties? If so, what specific moderation tasks require unrestricted access to followed posts data, and what insights can be gained from the list of followed posts that aren’t available through other data already available to mods?
Given that moderator access to sensitive private information like real names, email addresses, and IP addresses is logged to prevent abuse, why isn’t access to follow lists treated similarly if it's freely viewable by mods?
I know that moderators are restricted from having access to voting history to protect user privacy. In cases of suspected voting fraud, they must escalate the issue to Stack Exchange staff for investigation. This process ensures that there’s a valid reason before accessing a user’s voting history. SE staff have even declined a feature request to allow moderators to invalidate votes directly, emphasizing the importance of user privacy.
Why aren’t followed posts given the same level of privacy protection, where mods need to justify their request before gaining access?
This issue becomes particularly concerning on SE sites focusing on personal, academic, or professional topics like The Workplace SE, Law SE, Interpersonal Skills SE, MathOverflow, Academia SE, etc. Think about it: the set of topics a person is interested in, combined with their posts, profile information, IP address (which can estimate location), and email address, could potentially be enough for an abusive actor to identify or doxx them. It might even allow someone to pinpoint which institution or company they're studying or working at, even if the user hasn't explicitly shared this private information. It's worrying that access to follow lists isn't logged, unlike email and IP address access.
Given these privacy concerns, I would like to understand why moderators have unrestricted access to users’ followed posts. And why are followed posts data not protected in the same way as saved posts and other private data? It seems like there’s a disconnect between how different types of private user data are treated, and I’m curious to understand the reasoning behind it.
