Hi my name is Noura, in this work we explore a set
of privacy norms for smart home personal Assistants.
To give background context to our study, the adoption of smart home personal assistants
also known as SPAs, have increased over the years with more than 200M units sold in the year 2020.​
SPAs have a complex ecosystem, from users to SPA cloud service providers to third-party
skill providers. For example, once a user makes a request such as "Alexa play my favourite music"
the speaker records the request and sends it to the Amazon cloud, where it is processed
to understand what the user wants, so that an adequate third-party skill like Spotify is chosen,
and the command is sent to its server for this specific request and then back to the speaker. ​
There are over 100,000 third-party skills in Amazon Alexa offering voice-based
services from Music, Weather, Banking to Shopping and many others, this, unfortunately, makes the
flow of information complicated as it involves many stakeholders. Therefore, it is important to
have a clear understanding of the acceptable flows of information to protect users data. ​
Our study is the first to explore the acceptability of information
flows across the whole SPA ecosystem, as most prior studies tend to focus
on the smart speaker part of the story without considering third-party skills.​
Through Contextual Integrity theory, we explore the acceptability of the flow of
information privacy through a set of CI parameters and personal factors​.
We first elicit the privacy norms for data flows across the SPA ecosystem based on CI,
considering different parameters that affect acceptability.​
We study the influence that the CI parameters and personal factors have on the privacy norms.​
We identify the similarities between the elicited privacy norms based on the CI
parameters and data flow acceptability to distil more general privacy norms. ​We finally provide
recommendations for SPA and third-party skill providers based on the privacy norms studied.​
We conducted a large-scale study involving 1,700 participants
exploring the acceptability of information flows through CI theory.
We test the effects of different parameters such as recipient of information and personal factors.​
In total, we study 120 scenarios across 15 different datatypes.​
This table shows the summary of CI parameters we consider,
with the recipients covering the different stakeholders across the whole SPA ecosystem.
A detailed description of the CI parameters is highlighted in the paper​.
This figure represents the acceptability of information for user recipients.
Acceptability of datatypes with user recipients
seems to be related to the sensitivity of datatype; recipient type and purpose.
As shown datatypes "email and banking" are highly sensitive with low acceptability.
The figure for the non-users recipient is highlighted in the paper.
We conducted Binary Logistic Regression through forward stepwise method​.
CI parameters and personal factors play an important role to determine whether a flow
is considered acceptable or unacceptable.
To summarise, recipient type, datatype and personal factors such as
IUIPC scale are highly influential in the acceptability of information flows​.
We were also very interested in exploring the possibility of having a smaller,
more general subset of privacy norms that would hold across scenarios.​
Our aim was to find which contexts in the SPA ecosystem are similar
and have the same acceptability.
To this aim, we implemented data mining techniques, to be specific, association
rule mining, to elicit a subset of more abstract and general privacy norms in the SPA ecosystem.​
The details of the method are in the paper, we next show some of the rules that we have mined.​
For the user recipient model, we mined in total 11 rules.
As shown in R1 and R2, R1 shows that it is unacceptable to share information
with "close friends" when No purpose is given.
And R2 shows that when information is shared with the recipient "partner" seems to be acceptable.
For non-user recipients, R3 and R5 show two different rules.
For Datatype banking, it is unacceptable
It is unacceptable and recipient "non-relevant skills" is also unacceptable​.
Therefore, SPA providers should not allow those information flows
that are unacceptable as default settings.​
To conclude,
For user recipients, more trusted/close relationships result in higher acceptability.
However, other key aspects include the data type being asked and the transmission principles.​
When it comes to third-party skills,
a non-relevant skill collecting information is unacceptable. ​
That is, users clearly see a third-party skill should
only collect data clearly related to what service is being offered.
The association rules mined can be very useful for SPA providers to establish default privacy
settings, to avoid the burden for users to configure privacy settings,
while respecting the privacy norms of users.​
Beyond defaults, there is, of course, also space for semi-automated, dynamic privacy settings,
as we observed variability in some cases depending on the context and personal factors. ​
We give more details of the discussion in our paper​.
Thank you for listening.
​