Usability of Privacy Control and Disclosure Mechanisms
Open AccessAllowing people to make informed choices about how their personal information is collected, used, shared, and stored has become a key challenge with the rapid and unrestrained growth of technology. New privacy control and disclosure mechanisms have recently been developed to help give people who access online applications and services greater power over their personal information and how it is used, as well as to increase transparency and accountability for organizations that collect and process this information. These mechanisms include dashboards for people to manage their data collection, third-party account access, and advertising settings. An additional disclosure mechanism is app-based privacy nutrition labels that aim to simplify and standardize communication of privacy behavior. However, despite the implementation of new privacy control and disclosure mechanisms, their usability and effectiveness do not always align with expectations. In this dissertation, we identify and address the shortcomings of these mechanisms in order to enhance their performance and improve their outcomes. Specifically, we investigate i) people’s security and privacy perceptions of privacy dashboards, third-party account access controls, and targeted advertising settings, ii) people’s understanding of advertisement inferences made about them based on their past online activity, iii) the current state of the app-based privacy label ecosystem, and iv) the impact of privacy labels on consumers’ privacy and security risk perception and willingness to install apps.To address the above, we completed four human subject usability studies and an app ecosystem measurement study. Specifically, we conducted a study to understand if Google's My Activity, as an example of a privacy dashboard, increases or decreases user concerns and benefits regarding data collection. Subsequently, we performed an interactive user study where participants both reviewed a selection of their own activities they performed on Google and assigned advertising interests they believed that Google learned about them from those activities. Next, we performed a multi-part online survey where we asked participants about how they managed third-party access to their Google accounts. To measure the Apple App Store ecosystem we collected and analyzed 36 weekly snapshots of 1.6 million app-based privacy labels between July 15, 2021 and March 17, 2022. Finally, we conducted an online user study which looked at factors influencing risk perception and willingness to install iOS applications after exposure to Apple’s privacy labels.We show that while privacy dashboards may increase awareness of data collection, the net result may be that dashboard interactions decrease users’ concern for data collection while at the same time increasing their perceptions of the benefit of data collection. We argue that providing transparency into the data food chain offers some promise to improving dashboards. Furthermore, our results suggest opportunities for design improvements to the current third-party access management tools: for example, providing permission controls, tracking recent access, and automatically revoking access due to app disuse.We expose the scope and prevalence of data tracking in the iOS app ecosystem, and we find that many apps indicate that they do not collect any data, even apps that would seem likely to collect or link data. Finally, we find that privacy labels increase privacy and security risk perception, and decrease willingness to install an app, but suffer from usability issues regarding the way people understand the terminology used on the label. We recommend improvements to usability of the privacy labels, including improving the data category descriptors, removing technical jargon, and integrating the privacy label into the applications permissions controls.
- All rights reserved
Notice to Authors
If you are the author of this work and you have any questions about the information on this page, please use the Contact form to get in touch with us.