Hi everyone I am Maximilliane Windl
from the university of Regensburg and
today I present you our work on the
implementation and in-situ assessment of
contextual privacy policies. A big part
of our lives happens online - now more
than ever. We shop chat with friends and
share our most personal moments. While we
do that a huge amount of data is
generated which is used for many
different purposes like the
personalization of ads or content. This
becomes a problem when this data is
leaked and abused for criminal offences.
Therefore it is very important for users
to know what happens to their data how it
is protected and which options are
available for users to control the usage
and collection of their data. The most
established and actually also pretty
much the only way to inform users about
their rights and choices concerning their
privacy are privacy policies. That long
text which is mostly hidden somewhere
and which describes which data is
collected and what is done with it. That
sound sensible but there's a problem:
Almost nobody reads them. According to a
study by Obar from 2016 around 74% of
all users don't read privacy policies at
all
and those that do read privacy policies
take on average 73 seconds to read a
whole privacy policy which has an
average a length of 2,700 words. That
would mean a reading speed of 37 words
per second. That's pretty fast, right? Why
is that? In general users are interested
in what happens to their data but
oftentimes users actions don't match
their intention. This phenomenon is
called the privacy paradox. In the case
of privacy policies the main problems
are their length, the difficult legal
language in which they are written, that
they are often hidden somewhere at the
end of a page and that is often hard for
users to make a connection between the
abstract wording of a privacy policy and
their actual behavior. In the past
researchers have suggested several
approaches to improve privacy policies
and to evolve them from a
purely textual representation. Kelley et al.
transferred privacy policies to the
format of nutrition labels. Cranor et al.
built a browser extension which points
out aspects of the privacy policies
depending on user preferences. Tsai et al.
added privacy information to search
results and contextual privacy policies
which are also the focus of our work.
They were first proposed in 2004 by Lederer
et al. They remedy important
shortcomings of privacy policies by
splitting them up and displaying only
relevant parts directly in the context
of the current user. A first controlled
evaluation of CPP's with users was
conducted by Ortloff et al. in 2018. Due
to several reasons none of the existing
approaches is currently adapted in
praxis. Contextual privacy policies
seem to be among the most promising
ideas, but they are not implemented so
far, so we do not know whether users accept
them and whether they really help users
understand the implications of privacy
policies. We implemented contextual
privacy policies as a browser extension
for seven of the most popular websites
in Germany. Those are: Google, Facebook,
YouTube, Twitter, eBay, Amazon and eBay
Kleinanziegen. We extracted relevant
information and situations from privacy
policies from those web sites and
defined suitable action triggers. Here
you can see the CPPs in action. As soon
as the user enters the query, the CPP box
is displayed, informing the users about
the kinds of data collected in this
exact moment and this exact context. Here
the context is searching for
something on Google. We evaluated CPPs
by installing them on the participants'
computers for one week. During this time,
they were instructed to keep on using
their browsers as usual. To get an
impression of the participants behavior,
we did pre and post study interviews and
also collected data through the
extension. These data were: automatic
locks - a timestamp, when a CPP-info was
displayed and the number of appearances.
Additional feedback which could be given
at any time by clicking the extensions
icon in the browser's toolbar, and diary
entries which are collected through a
pop-up window which appeared at most
once every hour. In this diary entry, the
users were asked for benefits of the
provided privacy information. If and how
this information will affect their
behavior and to rate the relevance of the
information. In total we had 15
participants which provided valid data.
8 of those who were male, 7 were
female. We used a thematic analysis
approach as described by Braun and Clarke to
analyze our interview data. We first
transcribed the interviews, then followed
several rounds of coding the utterances,
did discussions to resolve any
differences in the coding, and finally
grouped the codes into categories. This
resulted in two large groups: References
about data in the widest sense of the word,
and utterances about the CPP's themselves.
Each of those groups has two categories.
For the first group "utterances about
data", these categories were "data
collection" with the sub categories
"approval", "disapproval" and "neutral" and
"behavior" with the sub categories "change",
"no change", and "current behavior". The
second group "utterances about CPPs" had
the categories "consideration for future
use" with the sub categories "novelty of
information" and "feature requests" and
"additional feedback" with the
subcategories "feedback on the text" and
"feedback on the look".
Due to our mainly qualitative approach
and the small number of participants,
we were not able to make any further
statistically significant claims. However,
some interesting tendencies emerge from
the data nevertheless. We measured how
participants assess the relevance of a
given CPP information concerning the site,
the situation and the participant.
Interestingly, the largest amount of
variance was measured between
participants which leads us to believe
that the assessed relevance of a privacy
information mainly depends on personal
opinions, how concerned users are about their
data in general and whether they see a
benefit in the collection of their data or
not. Through the analysis of our
qualitative data, we found that
participants assessed the CPP
information
less relevant, the more often they were
confronted with it. This intuitively
makes sense so we checked whether we can
see the same trend in the quantitative
data. But there was no clear tendency. The
assessed relevance decreases until day
four but after that it is fluctuating.
The problem is that not all participants
saw CPPs every day and, as seen in the
previous plot, relevance ratings varied
a lot between participants. For some
participants, there was a decrease in
relevance over time, but for some, there
wasn't. Our study allows for design
suggestions for the further development of
CPPs or similar systems. These are:
keeping novelty is important for the
relevance of privacy information. Users
want a way to comprehend the information
of the privacy policy faster and more
easily. The phrasing of the privacy
policy should be adjusted to the person
reading it. People need help on how to
adjust the behavior, and people being
okay with their data being collected
strongly depends on personal assessments,
so CPPs should be adaptable. To summarize
our contribution: We developed contextual
privacy policies which provide privacy
information in a shorter, clearer
structure and within context. We
implemented a system to display CPPs in
a naturalistic environment. We showed
that users prefer CPPs over traditional
policies. We provide feedback and design
suggestions for further development of
CPPs and similar systems and we also
provide the code for the system on
GitHub.
Thank you very much for listening and
your interest in our work.