Mary Anne Smart: Hi, I'm Mary Anne. And today I'm going to be talking about our paper, "Understanding Risks of Privacy Theater with Differential Privacy."
Mary Anne Smart: In recent years, concerns about mass data collection, online tracking, and other forms of digital surveillance have been receiving a lot of media attention.
Mary Anne Smart: Concerned individuals sometimes turn to privacy-enhancing technologies, such as tracker blocking browser extensions.
Mary Anne Smart: And in some cases data collectors have also embraced privacy-enhancing technologies in response to these growing concerns about privacy.
Mary Anne Smart: One technology that has become particularly popular in this space is differential privacy.
Mary Anne Smart: The purpose of differential privacy is to allow a data collector to learn general information about a population without learning too much about any particular individual.
Mary Anne Smart: In other words, differential privacy allows for aggregate data analysis while still offering a form of provable privacy protection for individuals.
Mary Anne Smart: With any kind of data collection and analysis, there exists an intrinsic trade-off between privacy for data subjects and utility for data analysts.
Mary Anne Smart: For example, imagine that we want to publish a data table about alumni giving. We might be interested in understanding the effects of different variables, like college major, graduation year, and age.
Mary Anne Smart: However, even though direct identifiers, like names or email addresses, have been removed, we can still identify some alumni uniquely. For example, there aren't many sixteen-year-old college graduates, so we can probably identify this individual.
Mary Anne Smart: We might consider reducing the granularity of the age column. This makes the data less useful for analysts, but presents a reduced privacy risk.
Mary Anne Smart: Unfortunately, these kinds of heuristics aren't always enough to protect privacy.
Mary Anne Smart: So, alternatively we could use differential privacy.
Mary Anne Smart: Here we've protected privacy by adding random noise to the data. The data will again be less useful for analysts, because it is no longer precisely accurate. However, with enough data, we'll still be able to uncover general population level trends.
Mary Anne Smart: In the case of differential privacy, a privacy parameter controls this trade-off between privacy and utility. Increasing this parameter increases utility for the data collector, but decreases the strength of the privacy protection offered to individuals.
Mary Anne Smart: So if the privacy parameter is very large, the privacy protection is no longer meaningful.
Mary Anne Smart: However, it is in this scenario that the data is most useful to the data collector. This could create a dangerous incentive to choose an inappropriately large privacy parameter and mislead users about the privacy protection that they're being offered.
Mary Anne Smart: In our study, we seek to understand how different explanations of differential privacy influence data sharing behavior. In particular, we want to know if explanations of differential privacy that provide information about the privacy parameter can prevent people from falling for privacy theater.
Mary Anne Smart: We conducted two related studies, but in this presentation I'll focus on our second study. In this study, we investigate how the level of transparency of the explanation and the strength of the privacy protection affect participants' sharing behavior.
Mary Anne Smart: In an online survey, we presented each participant with an explanation of the privacy protection and then asked whether they were willing to share their browsing history data.
Mary Anne Smart: Our explanation is the most transparent about the role of the privacy parameter, whereas the explanation adapted from an Uber blog post omits any discussion of this parameter.
Mary Anne Smart: The explanation borrowed from Apple sits somewhere in between. Although this explanation mentions the privacy parameter, it doesn't provide much context to help the reader interpret it.
Mary Anne Smart: We also test three different settings of the privacy parameter.
Mary Anne Smart: The strongest setting is comparable to many real industry deployments of differential privacy,
Mary Anne Smart: whereas the other two settings are weaker than what would normally be used in practice. We chose an extreme value for the weak setting, so that it would be clear that this case offers only privacy theater rather than meaningful privacy protection.
Mary Anne Smart: All of the explanations contain the same key bits of information.
Mary Anne Smart: For example, compare our explanation on the left and Apple's on the right.
Mary Anne Smart: Both texts explain that random changes will be made to participants' data.
Mary Anne Smart: Both provide quantitative information about the strength of the privacy protection being offered, and both explain that even this altered data will be useful when aggregated with data from other participants.
Mary Anne Smart: For both surveys we used Qualtrics to recruit participants, and we sampled participants to be roughly representative of the US population. Each study had between three hundred and four hundred participants.
Mary Anne Smart: So, contrary to our expectations, we found that neither the choice of explanation nor the choice of privacy parameter had any significant effect on participants' willingness to share their browsing history data.
Mary Anne Smart: Most people make up their minds about whether they're comfortable sharing this data before they learn about the privacy protection.
Mary Anne Smart: Fewer than twenty five percent of participants actually changed their minds about whether to share their data after reading about how their privacy would be protected.
Mary Anne Smart: In fact, participants had strong feelings about whether or not it was appropriate to share this kind of data, regardless of how it might be protected.
Mary Anne Smart: For example, some participants had no concerns about privacy, and stated that they had "nothing to hide."
Mary Anne Smart: On the other hand, other participants felt that it was unreasonable to even ask for this data, saying that "no one has a right" to that information.
Mary Anne Smart: Even when explanations of differential privacy don't change individuals' behavior, such explanations may nonetheless play an important role in shaping public discourse on issues of privacy. While our study focuses on understanding how explanations affect behavior,
Mary Anne Smart: future work might examine how corporate messaging about privacy technologies shapes views about privacy more broadly.
Mary Anne Smart: Thank you for listening, and please feel free to reach out.