Design a Privacy Control System

Question

Design a privacy and access control system for social media posts. Support visibility settings like Only Me, Friends Only, Custom Lists, and Public. Cover efficient access checks at read time and handling cascading privacy changes.

Codemia · Accepted Answer

### Functional Requirements 1. **Visibility Settings**: Users can set visibility for their posts as 'Only Me', 'Friends Only', 'Custom Lists', or 'Public'. 2. **Access Control**: Implement efficient access checks for each post based on the user's visibility settings. 3. **Cascading Changes**: If a user changes their privacy settings, all affected posts should update automatically. 4. **User Management**: Support for managing friend lists and custom lists for privacy settings. 5. **Audit Logs**: Maintain logs of visibility changes for compliance and user review. ### Non-Functional Requirements 1. **Scalability**: The system should handle millions of users and posts efficiently. 2. **Latency**: Access checks should occur in under 100ms. 3. **Consistency**: Ensure strong consistency across privacy settings and posts, especially during cascading changes. 4. **Availability**: The system should achieve 99.99% uptime to ensure users can always access their posts. ### Capacity Estimation Assuming Meta has approximately 3 billion users, let's estimate the scale: - **Posts per User**: Average of 100 posts per user. - **Total Posts**: 3 billion users * 100 posts/user = 300 billion posts. - **Visibility Changes**: Assuming a user changes the visibility of their posts once a month, we estimate: - 3 billion visibility changes/month / 30 days = 100 million changes per day. - **Read Operations**: If each user reads an average of 10 posts per day: - 3 billion users * 10 posts = 30 billion reads per day. Overall, the system should handle 30 billion reads and 100 million writes per day. ### High-Level Architecture The architecture consists of the following components: 1. **Frontend Application**: User interface for posting and managing visibility settings. (React) 2. **API Gateway**: Routes requests to appropriate services. (NGINX) 3. **Privacy Control Service**: Main service that handles visibility settings and access checks. (Node.js) 4. **Post Storage**: Stores posts with visibility settings. (Cassandra for distributed storage) 5. **User Management Service**: Manages user profiles, friends, and custom lists. (Spring Boot) 6. **Cache Layer**: Redis for caching frequently accessed posts and visibility settings to reduce read latency. 7. **Audit Log Service**: Logs changes to visibility settings for compliance. (Kafka for event streaming) This architecture supports horizontal scaling for both read and write operations. ### Data Model #### Posts Table | Column Name | Data Type | Description | |-------------------|-------------------------|-----------------------------------------------| | post_id | UUID | Unique identifier for the post. | | user_id | UUID | ID of the user who created the post. | | content | TEXT | Content of the post. | | visibility | ENUM('Only Me', 'Friends Only', 'Custom', 'Public') | Privacy setting of the post. | | created_at | TIMESTAMP | Timestamp of when the post was created. | | updated_at | TIMESTAMP | Timestamp of the last visibility change. | #### User Table | Column Name | Data Type | Description | |-------------------|-------------------------|-----------------------------------------------| | user_id | UUID | Unique identifier for the user. | | friends | LIST | List of friend user IDs. | | custom_lists | MAP> | Custom visibility lists with user IDs. | ### Key Trade-Offs 1. **Consistency vs. Availability**: Choosing Cassandra allows for high availability and scalability, but it may lead to eventual consistency issues. Strong consistency was prioritized for privacy settings, ensuring users see the correct visibility without delay. 2. **Caching Strategy**: Using Redis as a cache layer improves read performance but requires handling cache invalidation carefully, especially with cascading changes. This trade-off was made to reduce load on the database during peak read times. 3. **Complexity of Custom Lists**: Supporting custom lists adds complexity to the user management service but provides flexibility for users. This was deemed necessary to accommodate varying privacy preferences.

Design a Privacy Control System

Meta

How to Approach This

Sharpen Your Skills on Codemia

Sample Answer

Requirements

Functional Requirements

Capacity Estimation

Capacity Estimation

Submit Your Answer

Meta Software Engineer Interview Guide

Related Questions

Design a high-throughput Inventory Management System

Design a low-latency Rate Limiting System

Design a fault-tolerant Payment System

Design a fault-tolerant Messaging System

Design Walmart Product Search