Hello, I’m Alisa Frik. Today I will talk about a study that we conducted
together with the colleagues from the University of California Berkeley
about users’ expectations about and use of smartphone privacy and security settings.
Smartphones are the most commonly used type of communication technology.
Over 80% of people in the world have a smartphone.
Thus, smartphone settings remain one of the main models for information privacy and security
controls, and their usability is especially important for protecting users' privacy.
For instance, those settings allow users to opt out of data tracking and ad personalization,
set passcode for unlocking the screen, enable 2-factor authentication, automatic updates, etc.
Yet, users do not always fully understand the implications of changing their
privacy and security settings. Confusing information architecture,
poor usability and jargon make it even harder to navigate those settings.
The knowledge, skills, and experience with technology in general,
and privacy and security specifically, may vary across different socio-demographic groups.
Thus, poor usability of smartphone setting menus
may disproportionately affect certain vulnerable populations,
e.g. children, older adults, lower income, lower education, and marginalized communities.
However, little research has been conducted to investigate that.
While some prior research focuses on specific socio-demographic groups
or particular settings in isolation (e.g., screen locking),
to the best of our knowledge no prior work offers the broad examination of users’ opinions about
smartphone privacy and security settings, and comparisons across socio-demographic groups.
Moreover, while prior work explores the convenience of using certain smartphone settings
(e.g. the burden of repeatedly typing a passcode to unlock the smartphone),
little research explored the perceived difficulties with finding and enabling privacy
and security settings. These differences highlight the valuable contribution of our research.
In this study we answer the following research questions:
Are users aware of privacy/security settings available on their smartphones,
and their default configurations? Have users configured smartphone
privacy and security settings in the past? Do they intend to configure them in the future?
What are users’ perceptions of self-efficacy (or perceived difficulty)
of configuring privacy and security settings, and what difficulties do they anticipate?
What are users’ understanding of the implications of changing certain smartphone privacy/ and
security settings, including the impact on overall user experience with their smartphones,
and the perceived effectiveness in protecting from common privacy and security risks?
What are the differences among users with different socio-demographic backgrounds (e.g.,
age, gender identity, income, education, race and ethnicity) and digital experience in
terms of their past behaviors (whether they configured smartphone privacy/security settings
in the past, intentions to configure them in the future, perceived difficulty of
configuring these settings, and the impact on overall user experience with their smartphones?
To select settings for our study, first, we created a list of privacy
security settings available in the latest versions of Android and iOS in August 2020
when we were preparing for the study. Because of the heterogeneity in use and
settings availability in specific apps, we did not include app settings in our analysis to achieve
more generalized results, and focused only on the settings provided by the most popular mobile
operating systems and their default browsers (Safari for iOS and Chrome for Android).
Then 2 researchers independently rated settings’ privacy/security impact,
discussed in a seminar with 8 security researchers and resolved disagreements.
The final list included 19 settings we used in the study.
To this end, we conducted an online survey of 178 smartphone users with diverse backgrounds
and demographics residing in the United States. Each of the survey participants answered
questions about 3 settings selected at random from our list of 19 settings.
Our participants are diverse in terms of age,
gender, race and ethnicity, education level, employment and income. Please
refer to the paper for more details about participants’’ demographics.
As with any research, our study has a number of limitations.
For instance, the generalisability of our results is potentially limited
by limited sample size and settings selection, and social desirability and overconfidence bias
stemming from the self-reported answers. Future work is called to complement survey results with
the behavioral data from the cognitive interviews or field experiments in realistic settings,
with a larger sample size and a wider selection of settings.
For the sake of time, in this presentation, I’ll be able to
highlight only a few high-level insights. For more details please refer to the paper.
I’ll start with the insights about the impact of socio-demographic factors. We found that
Higher age is associated with less frequent engagement with privacy and security settings,
elevated expectations of difficulties with configuring them, and lower concern about
privacy and security risks. Hispanic/Latinx participants
reported less frequent engagement with privacy and security settings.
Biracial participants had less privacy and security concerns, and were more likely
to expect difficulties with configuring smartphone privacy and security settings
and their negative impact on user experience. Females were also less concerned about privacy
and security risks. Finally, participants,
who use their smartphone less frequently (e.g. once a day vs multiple times a day) anticipate
more difficulties with configuring the settings, and users who anticipate such
difficulties engage less in configuring privacy and security settings on their smartphones.
Interestingly, we found that age and race/ethnicity have a statistically significant
impact on the past behaviors of configuring the smartphone privacy and security settings,
but not on the intentions to do so in the future. It can be related to the fact that various
socio-demographic groups may be similarly willing to configure their privacy and security settings,
but differences in self-efficacy, smartphone experience,
knowledge and skills prevent some of them from actually enabling the settings.
These findings suggest that certain socio-demographic groups may feel less prepared
or willing to use smartphone settings to protect their information privacy and security. Thus,
user education and interventions increasing the perceived self-efficacy are especially
important for infrequent users and those with low esteem of their personal technical abilities.
Regarding other research questions, we found that many participants are not aware of the
available smartphone settings to counter privacy and security risks, and have not changed them on
their devices, due to the anticipated difficulties with configuring the settings and expected
negative impact on user experience. Yet, many of them are willing to change them in the future.
While on average, more than half of our participants expect settings to be easy
to configure, up to a third of participants anticipate difficulties with these tasks
due to expected poor information architecture, lack of experience
and knowledge, or technical limitations. Some participants believe that manufacturers
make these settings hard to find and understand on purpose, to maximize data collection.
Finally, we found that some socio-demographic groups (such as older adults, racial/ethnic
minorities, and females) are particularly vulnerable to online risks, as many of them
are less concerned about online privacy and security, engage less in configuring smartphone
privacy and security settings, anticipate more difficulties with configuring them, and
expect their negative impact on user experience. The paper provides recommendations for improving
awareness, discoverability, transparency, comprehension, and usability of smartphone
privacy and security settings. Please refer to the
paper to learn more about that. Thank you for your attention.