[Johannes] Conventional privacy policies are very long and often use a difficult language.
That is why most users consent to them with little or no reading.
So the assumption of customers making informed decisions about their data online is currently not valid.
Different browser extensions were released to provide data visualization
or ratings of privacy practices but they have to be installed proactively.
So visual summaries to supplement long text policies were proposed in the field of usable privacy.
By applying design principles such as salience and layering they aim to provide a more accessible
interface to the user.
Some of them were shown to improve comprehension and others to keep users engaged longer.
But they are hardly known outside academia and rarely deployed in practice.
An explanation might be a lacking evaluation of their user experience or their effect on
measures relevant to businesses like user attitudes and conversions.
As an attempt to fill this gap we gathered user feedback in a pre study to find the best
alternative to regular privacy policies.
In seven semi-structured interviews, we wanted to find out what contents of privacy policies
are most important to users and what strengths and weaknesses existing alternatives have.
At first, subjects ranked eight typical elements of privacy policies by personal relevance.
Next, we showed them two representations from literature and three new ones we developed.
They shared first impressions, comprehension issues and general feedback for each one.
Finally, they had to choose favorites from all representations over different categories
while explaining their decisions and giving comparative feedback.
After analysing the interviews, we found out that users cared most about the collected data,
it’s usage and disclosure to third parties.
From the insights, we also derived guidelines for more accessible privacy policy designs.
From all given representations, the privacy nutrition label scored best overall while
also receiving positive feedback for it's structure and choice of contents.
But participants criticized it for being overwhelming while at the same time missing explanations,
examples and the possibility to control privacy settings directly within the Nutrition Label.
To address these shortcomings, we developed our new “Visual Interactive Privacy Policy”.
It guides the user’s attention with colors and uses less technical terms and more icons
which makes the key obsolete.
By interacting with it, users can find contextual explanations, examples and they can control
their privacy settings right within the prototype.
[Daniel] In our main study, we investigated the question whether our prototype can improve user experience,
performance and business interests.
To this end, we compared our new prototype along with a standard Long Text and a (Privacy) Nutrition Label
in an account registration context.
As a sample we used 90 students in a between-subjects design.
As dependent variables we measured the user experience using the UEQ questionnaire, several
metrics concerning business interests and the users’ performance on the basis of exposure time.
Multiple ANOVAs showed significant differences between the three policies regarding attractiveness,
stimulation, novelty, exposure time and transparency.
Pairwise comparisons between our prototype and the long text showed that exposure time,
attractiveness, stimulation, novelty and transparency were significantly higher in favor of our prototype.
Pairwise comparisons between our prototype and the nutrition label showed that only the
exposure time was significantly higher while using our prototype.
However, twice as high and our prototype also performed descriptively better regarding stimulation,
novelty, control and transparency.
For descriptive data and test statistics please refer to our paper.
In conclusion our Visual Interactive Privacy Policy was better than a Long Text in many
respects, but rarely better than a Nutrition Label, what creates opportunities for future research.
Since our new representation only performs better in terms of transparency when compared
to a Long Text, but not in terms of conversion rate, trust and control, which are usually
intertwined, future research could clarify how transparent a privacy policy presentation
must be to affect the other parameters.
Future studies could also have a more qualitative focus and find out which design changes in
our Visual Interactive Privacy Policy compared to other representations add the most value for users.
For a more detailed discussion and more opportunities for further research, please refer to our paper.
Thank you very much for listening.