@itai Yes, I do see your suggestion as an intermediate and feasible position. Although I must say that the possibility of being tagged by others should be disable by default, and that is a point I consider central and very important, and not just a matter of policy of use.

I don't think that we need that feature but here is an idea to solve the privacy issue if anyone would like to implement it:

When implementing this feature we have to deal with "bad pods" which could allow tagging users without their permission. Therefore users should only be able to tag themselves in photos. They are able to add a tag but there is no way to associate another user with that tag so the only user that is associated with that tag is the user who added it.

We could allow contacts to send a "message" to a user and ask him to tag himself on a photo. We could even implement a feature "automatically add a tag if a contact suggests it" but IMO it should be always the user who tags himself.

When implementing this feature we have to deal with “bad pods” which could allow tagging users without their permission. Therefore users should only be able to tag themselves in photos.

@steffenvanbergerem, I don't understand - if allowing to be tagged by others is a user setting how is the pod relevant?

We could allow contacts to send a “message” to a user and ask him to tag himself on a photo.

That's the option to be tagged by others after own authorization :)

@itai This is an important implementation detail. When you are able to tag a contact in a photo then you can modify your pod's code to do that without the contact's permission. When you are just able to add a tag but not to add an associated user to that tag then you are the only user who could be associated with that tag.

@steffenvanbergerem, If I you understood correctly:
1. My suggesion: User A "tags" user B in a photo. User B set his options to be tagged only after authorization, he sees the photo and authorizes, so he is tagged in the photo.
2. Your suggestion: User A "tags" user B in a photo. User B receives a special 'message' to tag himself, and does so.

Security and privacy wise these seem the same to to me, except that in option 2 user B needs a few more clicks to actually tag himself, instead of just clicking 'authorize'. If someone goes the length of changing the code to tag users without authorization he could also do it option 2.
And one could just send a private message and ask someone to tag himself.

@itai As I said this is an (important) implementation detail. In both cases the user experience could be basically the same. The "special message" shouldn't be a regular private message. It could be something like a notification and when the user agrees he is automatically tagged in the photo. Like I said this is just about who is able to tag someone. I'll try to explain that:

option 1:
User A: asks for authorization
User B: accepts
User A: adds tag

option 2:
User A: asks user B to tag himself
User B: tags himself (automatically)

When choosing option 2 we don't have to implement any authorization process and we don't have to think about how to prevent User A from tagging User B without his permission.

OK I understand, so user experience for user B would be the same - no need to manually tag from his perspective, just 'authorize'. Sounds good to me.