Hi, welcome to the presentation of our paper on online privacy! My name is S. Shyam Sundar,
and I am presenting this paper on behalf of my co-authors Jinyoung Kim, Mary Beth Rosson
and Maria Molina, all from Penn State. In this paper, we study the role played by cues
on media interfaces that influence our online information disclosure.
We have known for some time that our privacy attitudes are malleable and that cues in the
context can sometimes shape how much we disclose. For example, we disclose more intimate details
about ourselves in a warm room with soft lighting compared to a cold room with fluorescent lighting.
One study found that survey respondents were more likely to admit to even incriminating
behaviors when the interface featured a cartoon image of a devil, asking with a wicked smile,
“How BAD Are U???”, compared to one featuring an emblem of Carnegie Mellon University, ostensibly
conducting an “Executive Council Survey on Ethical Behavior”. The interface on the
left was designed to look “unprofessional” whereas the one on the right was designed
to appear “professional” by the researchers. But, there’s more to it than professional-looking
design. Why should an unprofessional design elicit more disclosure? We think there’s
an internal logic to how each contextual cue contributes to privacy decision-making. The
unprofessional design may signal lack of accountability compared to the professional one on the right,
so it is safe to disclose illegal behaviors. This kind of quick logic is what we call cognitive
heuristic.
More generally, we think users disclose information based on cognitive heuristics or mental shortcuts
(i.e., rules of thumb) often triggered by contextual cues in the situation or on the
interface.
So, we set out to identify key heuristics in three different privacy contexts identified
in the literature. I will touch upon a couple of examples under each context. First, in
the social context
We have the authority heuristic. If we come across a credible authority on the interface,
we are likely to think that our private information is safe on that site, thus making us disclose
more personal information. Like, when we see the FDIC logo on a bank site, we think our
account information is safe and proceed to reveal our social security number.
Another heuristic in the social context is the bandwagon heuristic, which is the idea
that if others, especially peers, have disclosed their private information, then it is safe
for me to do so as well. Kind of like herd behavior.
In the personal context…
We have the control heuristic, which is the mental shortcut that if a site gives me control
over my privacy settings, then it must be safe to disclose to that site.
Another one in the personal context is the instant gratification heuristic, which privileges
immediacy over delayed gratification. People have been known to part with important personal
information in exchange for time-sensitive deals!
Examples of heuristics in the technological context include
Transparency heuristic. Just the good faith attempt to make terms and conditions is sufficient
to assure some users of the credibility of the site or app.
And the Machine Heuristic, on which we had a whole paper at CHI 2019. If you identify
machine as your data handler, then users apply their stereotypes about machines to judge
credibility—that they are accurate, efficient and unlikely to gossip with others based on
your personal information, for example. In all, we considered 12 such heuristics in
this study.
We set out to determine if these heuristics could indeed be driving our privacy decision-making,
by conducting a survey of 786 US adults, in which we provided 12 scenarios, with each
one featuring a distinct cue designed to trigger one of the 12 heuristics.
Here are some examples of scenarios. As you can see on the left, a screenshot of a bank
site shows the authority cue of a security seal TRUSTe.
On the right is a screenshot of an actual profile completion notification on LinkedIn.com,
with a message that provides a bandwagon cue.
Couple more examples here. On the left is a privacy setting page on Facebook providing
plenty of control to users as a way of triggering the Control heuristic.
On the right is a hypothetical interaction with a machine agent, Apple’s Siri in this
case, to cue the Machine heuristic.
After viewing each scenario, survey respondents were asked to indicate their willingness to
disclose their own personal information in such a scenario, followed by questions about
their reasons for disclosing or not disclosing it. We also asked all respondents about their
general level of privacy concerns, and tried to ascertain if they are power users. We also
measured their demographics such as age and gender.
But, most importantly, toward the end of the survey, we measured their cognitive accessibility
of the 12 heuristics under consideration in this study. We wanted to find out the extent
to which the rules of thumb pertaining to each heuristic was really applicable in the
mind of each respondent. We assessed this by asking them to rate the degree to which
they believed in each of the 12 heuristics as general truisms, like belief in authority
or belief in wisdom of the crowds, without making any references to the scenarios.
And, we discovered that their belief in a given heuristic predicted their willingness
to disclose in a scenario featuring an interface cue designed to trigger that heuristic. You
can see this in Step 2 of the multiple regression output. Belief in Authority heuristic positively
predicted disclosure in the Authority scenario, after controlling for demographics and other
individual differences. This was true in all six scenarios pertaining to social context
of privacy.
In fact, this effect was significant In all 12 scenarios, thus supporting our main hypothesis.
It was even true in the case of two heuristics that are negative in nature. Publicness is
the rule of thumb which says it is not secure to manage personal business in public. Mobility
heuristic is the rule that mobile devices are inherently unsafe for protecting one’s
privacy. As you can see on the far right side of this regression output, they both negatively
predicted disclosure intentions.
Just to break it down, if a person showed strong belief in the general statement about
Authority Heuristic, that a popular opular name, brand, or organization can guarantee
the security of a website, it means this heuristic is at the forefront of their mind, what we
call cognitively accessibile. When such a person encounters a bank site featuring a
cue to an authority, such as the TrustE in this example, they are more likely to disclose
personal information to the site compared to a person who does not have as strong a
belief in authority.
Similarly, individuals with a strong belief in following the crowd will disclose more
when they see a cue appealing to their bandwagon tendency than individuals with lesser belief
in following the crowd. Similar results were found for all 12 scenarios.
This provides support for the proposition that privacy decisions are shaped, at least
in part, by cognitive heuristics triggered by cues in the interaction context.
But, Cognitive heuristics are not the only reasons for disclosure
Rationales based on heuristics are likely to be driven by specific cues in the interaction
context whereas other rationales may reveal other reasons (e.g., personal motivations
or perceived norms) that are not attributable to specific cues on the interface
So, we examined both cue-related rationales for disclosure and non-cue related rationales
for disclosure, and we found that 19 out of 30 significant rationales pertained in some
way to interface cues that we expected would trigger heuristics.
When we looked at the open-ended responses to questions why they would or would not disclose
in each of the 12 scenarios, we came across several that revealed the operation of the
heuristic.
To sum up, our data show that cognitive heuristics play a significant role in online privacy
disclosures.
This has several theoretical implications. For example, it can explain why, despite claiming
to be careful about privacy, a lot of online users disclose a lot of personal information
online. They are probably making decisions on the fly, jerked into action by interface
cues that prey on commonly accessible heuristics. Of course, cues and the heuristics they trigger
may not have the same effect on all sites. They probably compete with prior user experience
in a given site, as we saw with some of the significant associations with non-cue related
rationales for disclosure.
And the reality of online spaces is that there are often multiple cues present, which may
simultaneously trigger multiple heuristics that may compete with one another. Which provides
an exciting topic for future research!
Next, we address the So What question: So what if cues trigger heuristics that lead
to disclosure of private information? Our findings reveal that online users are
less mindful when they make important privacy decisions. Which means it is VERY important
to induce some mindfulness into the process by
Serving a media literacy function Calling for alerts
Design of nudges Curtailing the triggering of heuristics
And providing more interactivity
Media literacy is a major design need. Online media users should become more aware of the
fundamental discovery that they may be swayed in their decision-making by interface cues
that prey upon commonly held beliefs.
This can motivate the design of alerts in places where they are about to enter personal
information, by calling attention to the cue and/or the heuristic in that particular situation.
This will likely make them think twice about entering that information.
Along the same lines, users could be nudged into protecting their personal information
by providing them information about how some of the seemingly persuasive cues they see
on the site could easily have been manipulated by bad actors.
A more extreme design suggestion would be to remove the cue entirely so that we can
eliminate the risk of it triggering a heuristic, as Instagram did recently by removing # of
likes in several countries. The absence of this cue will automatically avoid the possibility
of bandwagon heuristic influencing the decision. Similarly, other cues identified in our study
could be eliminated by design so that we can prevent them from swaying privacy decision-making.
Finally, more can be done to encourage users’ deliberate action on the interface. Research
has shown that when users deliberately act on the affordances of an interface, they are
more mindful in their interactions, engaging with the content in a more meaningful manner.
This can also prevent privacy heuristics from contributing to expedient decision-making
and help online users protect their privacy.
That’s a brief overview of our paper. Thanks for listening. Please feel free to reach out
to us if you haave any questions or comments.