Hello.
The title of our presentation is: User awareness of privacy risks related to
the collection of fitness tracker data
While fitness trackers have proven useful to increase self-awareness and encourage behaviour
change there is a trade-off. Personal data collected by fitness trackers can leave users
open to security and privacy threats, often without their knowledge.
When personal data is collected over time, aggregated, and combined with other data,
the resulting profile can paint an accurate representation of a person's identity and
their habits, leaving them open to privacy violations that may cause them harm.
There are a number of reasons that motivated us to examine security and privacy, related
to fitness tracker use.
Based on the literature, we found a number of gaps in the research related to these devices.
We found users are ill-informed about the data collection practices associated with
their fitness trackers. While they say they care about their privacy they do little to
protect their data.
Information on user concerns about data disclosure is limited, both in terms of the type of data
users are willing to share and who they are willing to share it with.
Overwhelmingly, the literature calls for education to inform fitness tracker users about data
security and privacy, so they are able to make good choices to protect their data.
The main objective for this study was to gain an understanding of fitness tracker users'
knowledge, attitudes and behaviors related to security and privacy risks with the collection of their fitness data.
We achieved this by conducted an online survey study.
We had three main research questions: First, do users willingly or unknowingly share
their fitness tracker data? Second, are they comfortable with this data
collection and sharing? And third, do they understand the potential
implications of this type of data collection and sharing?
We conducted an online survey containing 100 questions to understand users' knowledge,
attitudes and behaviours related to their security and privacy with their fitness trackers.
We were interested in how confident users were in terms of their knowledge of data collection
and use.
We developed scenarios describing potential risks and threats related to fitness trackers
and asked how plausible and likely they believed these to be to gauge their understanding of
potential threats.
To understand their attitudes, we asked them about their concerns about security and privacy
In terms of behaviours, we asked about their data sharing practices and steps they take
to protect their data. 212 fitness tracker users were recruited through Prolific, an
online recruitment platform.
To analyze the data, we primarily used descriptive statistics and graphic representations to
summarize responses and draw insights. We also used non-parametric statistical methods
where appropriate for within-group comparisons.
We uncovered 7 main findings.
For the purposes of this presentation, I'll talk about 4 of the results:
Users' understanding of possible threats is limited.
Security and privacy concerns are inconsistent.
Users are most comfortable sharing their data with friends and they distinguish the type
of data they are willing to share and who they are willing to share it with.
I'll start the results reporting with the participant demographics.
We had 212 international participants complete the survey. 113 identified as "female",
98 as "male" and 1 identified as "other".
They ranged in age from 18 - 73 years and the majority of them had a university degree.
Participants used a variety of fitness trackers brands or digital apps with their smart phones.
The most popular tracker was the Fitbit.
Now, we'll look at users' understanding of potential threats.
We presented 20 threat scenarios.
Participants responded with "yes", "no", or "don't know" to the question of whether
the scenario could possibly occur and the likelihood
it would occur.
A heat map of "yes" responses shows that while participants thought several scenarios
were plausible, they also believed many of them were unlikely to occur.
For example, with the scenario, "A hacker denied the user access to his own account
until he paid a ransom."
70% thought this scenario was possible, while only 28% thought it was likely.
With scenarios that had been reported in the news, participant responses were rated high
for both possible and likely. For example, with the scenario, "Tracked and mapped running
routes provided and accurate picture of a user's movements."
94% thought this scenario was possible, and 83% thought it was likely.
To help us understand security and privacy concerns, we asked participants to react to
five threats using a 5- point Likert scale.
Participant responses showed contradictory concerns.
For example, with the last threat, T5 shown at the bottom, "Identity theft, due to
a data breach" shows participants were not very fearful of the threat, believed it
unlikely to occur, but believed the consequences would be severe if it did happen.
Also, they were ambivalent about their confidence in the security protections provided by developers.
We asked participants how comfortable they were sharing their data with various recipients.
A Friedman rank sum test revealed a significant difference among the recipients with whom
participants were comfortable sharing data. Post-hoc testing with pairwise comparisons
using the Nemenyi test revealed significant differences between most pairs.
The heatmap shows very few participants were `extremely comfortable' sharing data with
any recipient. Understandably, users are most comfortable sharing with those
closest to them.
To understand sharing behaviours, we asked users to indicate, the types of data they
are willing to share with the various recipients.
In general, we found participants were relatively comfortable sharing most types of data with
friends participants' comfort level decreases as
the recipient becomes further removed from the them, except in the case of information
that may be revealing or more personal in nature.
For example, if you look at the top of the Personal Data in the Friends category, more
than 85% of participants were willing to share their gender height and birthday
but less inclined to share pictures that might reveal their identity, their location or their
friends.
This trend continues across the recipient groups.
Similarly, with data presented in a graph format, they were less inclined to share more
personal information such as their weight, as shown on the lower portion of the graph
data section. You can see that only 38% of participants were willing to share that information
with friends.
Participants appeared to be most comfortable sharing statistical data with friends, but
they didn't distinguish between the individual types, possibly because of the fact that this
data is aggregated and is not as revealing as the other types of data.
To recap,
We found users do not seem to be aware of the potential uses of their personal data.
Their security and privacy concerns are inconsistent
They have preferences about type of data they are willing to share and who they are
willing to share it with.
So, based on the results of this study, we recommend:
Designing education and awareness campaigns to help users understand how enabling specific
functionalities and data sharing options impacts what data is collected and how it may be used/misused.
We also recommend:
Giving users more control over the collection and sharing of their data.
Given participants' varying comfort levels with sharing, it is evident that users should
be supported in specifying what and with whom they want to share their information.
To sum up, with this survey study, we extend previous literature by providing new insights
on sharing preferences and behaviours of fitness tracker users. More specifically, users value
the types of data collected in different ways and have distinct preferences for who they
willing to share it with.
We also provide fitness tracker-specific evidence of the contradictions and complexities of
privacy preferences and behaviours. Users are not very fearful of threats, they believe
them unlikely to occur but know that they can cause substantial harm, should they occur.
Moving forward, we are interested in developing and testing engaging, usable and relevant
interventions to increase user awareness More specifically, we are interested in investigating
how messaging and visuals can help educate users.
Our hope is that we can make users aware of the privacy risks related to the collection
of fitness tracker data so they can make informed decisions in the management of their
privacy settings.
Thank you for listening!