Hello! I'm Hannah Hutton and I'm a PhD researcher at the University of Bath in the UK.
I'm going to talk about some work we did exploring
user motivations behind iOS App Tracking Transparency decisions.
Let's start by talking about what "app tracking" is.
Well, if you've got an iPhone you've probably seen one of these prompts, which is an app
asking if it can track your activity. Since April 2021, iOS apps have had to
ask for permission to do this, whereas before this they just did it anyway.
This prompt pops up the first time you use an app, and asks if you want to allow that app
to track your activity on other apps, so if you clicked "Allow" on this prompt here from Facebook,
Facebook would be able to see what you're doing on the other apps on your phone.
They're doing this for advertising purposes, so if you agree to tracking,
that app will be able to show you ads that are more relevant to your
interests in exchange for allowing them to collect data on what you're doing.
We were interested in how this feature was being used, and what motivated the decisions being made.
We hypothesised that people with a higher privacy concern would accept tracking for fewer apps,
since all they're getting in return for their activity data is more targeted advertising.
We collected data on the tracking decisions made by 312 people - which
apps had requested tracking and whether they had accepted or rejected these
requests - as well as a reason why they had responded to each request in this way.
Participants also completed a privacy concern scale.
So what did we find out? Well, there was no significant correlation
between privacy concern and the percentage of apps that people had accepted tracking for.
Now this was a little bit of a surprise for us, so at this point we were quite relieved that we'd
collected the reasons why our participants had accepted or rejected tracking. We had a
look at these reasons in a bit more detail to see if we could work out what was going on.
Despite there being no correlation between privacy concern and tracking acceptance,
we found that just over half of our participants had talked about their
privacy or security concerns in their responses.
Most of these responses were general statements about wanting to protect their privacy or not
wanting to share their data, but there were also some specifically targeted statements referencing
individual companies and their reputation for privacy protection and data handling. As you can
perhaps imagine, the majority of these responses were directed at Facebook, Instagram, and TikTok.
Naturally, there was a significant difference between the participants in this group and
those not in this group for scores in the privacy concern scale, and for rate of tracking acceptance
- so these participants scored higher for privacy concern and had lower tracking acceptance rates.
Worryingly, 43% of our participants
had incorrect beliefs about what tracking is or what it involves.
There were a lot of responses saying things like they needed to accept tracking for the
app to work, or that by rejecting tracking they would stop seeing ads entirely,
which is not true - they'll just see ads that are less relevant to their interests.
By far the most common misconception, however, was that "tracking" meant location tracking.
Nearly a quarter of our participants talked about location in their responses,
such as they didn't want to share their location with the app, or that they had
to accept tracking because the app needed their location in order to function properly.
This was quite a common response for food delivery apps, such as Uber Eats or Deliveroo,
where the app does need to have your location to show you nearby restaurants, but they don't
need to track your activity data - that's not something that they need for the app to work.
There were also 95 participants that talked about what they could get out of tracking,
whether that was they had accepted tracking requests because they wanted some benefit from it,
or that they had rejected tracking because they weren't interested in these benefits.
Interestingly, the majority of these participants talked about things that weren't actual benefits
that tracking provides, so there's quite a bit of overlap here with the misconceptions category.
For example, participants talked about receiving discount vouchers or personalised
content based on their activity data, which is not what tracking is used for.
Only 31 of these 95 participants talked about personalised advertising in these
responses - which is the only benefit that they would get from accepting tracking.
So what does this all mean?
Well, as you might have guessed from how prevalent the misconceptions are,
there's a real need to make sure that people are able to understand exactly what is being
asked of them when they're presented with these tracking requests, and of course the same also
goes for any other systems where users have to make decisions that affect their privacy.
The term "tracking" seemed to cause a lot of confusion for our participants,
and there's definitely potential for some work to
be done to determine a better phrasing of these requests to try and mitigate this.
There's also the issue that some of the tracking request prompts were quite vague when asking for
permission. This one here from ASOS talks about a "personalised experience" which
doesn't necessarily imply targeted advertising - to someone who knows nothing about tracking,
it sounds more like they'll give you recommendations within the app itself.
Now, one of the most interesting things that came out of this study was that we
didn't find any correlation between privacy concern and acceptance of tracking requests.
This isn't necessarily something that can be explained by the Privacy Paradox - where people
claim to care about their privacy but behave contrary to that by,
for example, accepting tracking of their smartphone activity data.
Our group that discussed privacy or security in their responses had higher scores in the
privacy concern scale and lower rates of tracking acceptance - they said they cared a lot about
their privacy and they also acted accordingly, in that they rejected tracking more often.
Even for those who had high scores in the privacy concern scale who had also
accepted a high percentage of their tracking requests, this isn't necessarily paradoxical.
Over 40% of participants had misconceptions about tracking, and a lot of these misconceptions
revolved around believing that they needed to accept tracking for their app to work properly.
So it may not be that they're giving away their data because they don't actually
value their privacy when they say they do - it's just a case of incorrect beliefs.
Asking users for permission to track their activity is undoubtedly a step in the right
direction from Apple, but at the moment these tracking requests are not well understood and
more work needs to be done to ensure that users know exactly what they're agreeing
to when they click "Allow". Thank you for listening.