The Impact of Salient Privacy Information on Decision-Making Submitted in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Engineering and Public Policy Janice Y. Tsai B.S., Mathematical Methods in the Social Sciences, Northwestern University M.L.I.S., School of Communication and Information, Rutgers M.S., Engineering and Public Policy, Carnegie Mellon University Carnegie Mellon University Pittsburgh, PA December 2009 Thesis Committee: Lorrie F. Cranor, Chair Alessandro Acquisti Baruch Fischhoff Jason Hong Peter Swire Keywords: Privacy, Online Privacy, Mobile-Location Privacy, Technology Adoption, Behavioral Economics Copyright c 2009 Janice Y. Tsai. This work is licensed under the Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-nd/3.0/us/ or send a letter to Creative Commons, 171 Second Street, Suite 300, San Francisco, California, 94105, USA. To grandparents and to my husband Richard W. Sharp III, without whom this would not have been possible. iv Acknowledgments I recently took a trip to Taiwan to visit my grandparents. At their apartment, my grandfather proudly displayed the bookshelf of the theses of his children and grandchildren. The value that my parents and grandparents placed on education makes it possible for me to complete my PhD today. I was drawn to the Department of Engineering and Public Policy because the person who would become my advisor, Lorrie Cranor, took the time to thoughtfully answer my email inquiry about graduate studies at Carnegie Mel- lon. I am thankful for her willingness to always make time for her students. She has been a truly inspirational advisor, and has helped me to transform as a researcher. Her support and encouragement enabled me to pursue and complete my PhD. I am privileged to be a member of the Department of Engineering and Pub- lic Policy. Granger Morgan has created a program whose alumni change the world. I thank him for his vision as well as Patti Steranchak, Vicki Finney, and Barbara Bugosh who make EPP thrive. I would especially like to mention Patrick Wagstrom, whose advice continues to be useful and wise; and Jenny Logue for her encouragement. No one could wish for better collaborators than those found in the CUPS Laboratory. I thank Alessandro Acquisti for his intellectual input: our discus- sions have been essential in my involvement in the areas of behavioral eco- nomics and privacy. Serge Egelman was an instrumental partner in our Privacy Finder research. Patrick Gage Kelley has been a good friend and provided in- sightful comments on my work. I have appreciated the camaraderie provided by Steve Sheng and Aleecia McDonald, my fellow CUPS Lab EPP students. I would also like to recognize Julie Downs and Mandy Holbrook for their advice and expertise in survey design and analysis, Ponnurangam Kumaraguru for his attention and feedback in presentations, and Jennifer Lucas for her admin- istrative knowledge and ability to get things done at Carnegie Mellon. I would like to thank the CMU Mobile Commerce Lab and Norman Sadeh for his leadership of the group; Jason Hong for his input related to location- sharing, privacy, and HCI; and Paul Hankes Drielsma and Eran Toch for their insights and conversations regarding feedback and expressiveness. My friends have contributed a significant amount to my life. I would like to thank Scott Craver for being my inspiration to make a difference in the arena of technology policy, Kate and Pat Zimmerman for their enthusiasm, and Eugene Cheung for always listening. Finally, this work is funded in party by the National Science Foundation un- der Cyber Trust grant CNS-0627513 and by the Army Research Office contract no. DAAD19-02-1-0389 to Carnegie Mellon University’s CyLab. vi Abstract People value their privacy; however, they typically do not make the protec- tion of their privacy a priority. Privacy is oftentimes not tangible, complicating the efforts of technology users to express and act according to their privacy needs. Additionally, people may not be fully aware of the risks they are sub- jecting themselves to once they use the Internet for financial transactions, or create profiles on online social networks. Companies post privacy policies inform people about their informational practices; but, this information is ex- tremely difficult to use and typically not considered in users’ decision-making processes. Privacy concerns have also had an impact on users’ adoption of new tech- nologies that share personal information. A plethora of mobile location-finding technologies applications have become available over the last two decades, but the products and services offered by the technology developers may not comprehensively address the privacy implications and privacy concerns sur- rounding their use. The design considerations for these products may not pro- vide the necessarily amount of control or risk mitigation for users to ensure that their location information is not misused. In this thesis, I focus on the impact of salient privacy information on pri- vacy concerns and behavior in two contexts: online shopping and the use of a mobile-location sharing technology. I examine several case studies focusing on the evolution of privacy attitudes after people use specific technologies. Based on the examination of the use of a location-sharing system, I highlight several design considerations for mobile-location application developers to ensure they address their usersÕ privacy concerns. I use the results of online surveys and user studies to provide concrete information on the impact of feedback on the comfort with using location-sharing technology. This research shows that users will pay a premium to purchase from websites that offer better privacy policies IF that privacy information is made visible and understandable. This research points to the importance of control in the management of privacy concerns. Whether it be mandated by legislation, or recommended in industry standards or design standards, offering users control in the form of understandable pri- vacy policy information, or control over the disclosure of personal information by technology, is essential. viii Contents Acknowledgments iv Abstract vii I Overview1 1 Introduction3 1.1 Research Questions...............................5 1.2 Research Overview...............................6 1.2.1 Mobile Location Privacy Concerns Study...............7 1.2.2 Location-Sharing Feedback Study I (Locyoution)...........8 1.2.3 Location-Sharing Feedback Study II (Locaccino)...........8 1.2.4 Online Privacy Concerns Study.....................9 1.2.5 Privacy Information Purchasing Study.................9 1.2.6 Privacy Premium Survey........................ 10 1.2.7 Privacy Information Timing Purchase Study.............. 10 1.2.8 Privacy Finder Usage Study...................... 11 2 Background and Related Work 13 2.1 Information Salience.............................. 13 2.2 Privacy Concerns................................ 14 ix 2.2.1 Online Privacy Concerns........................ 14 2.2.2 Location-Based Privacy Concerns................... 14 2.3 Dimensions of Privacy Concern........................ 16 2.4 Invisible Privacy................................. 17 2.5 Previous Privacy Research........................... 20 2.5.1 The Valuation of Privacy........................ 20 2.5.2 Studies of Privacy in Location-Based Applications........... 22 2.6 Privacy Indicators................................ 23 2.6.1 P3P................................... 23 2.6.2 Privacy Finder.............................. 24 2.7 Technology Adoption in Ubiquitous Computing Environments........ 27 II Privacy Implications of Mobile Location Technologies 29 3 Mobile Location Privacy Concerns Study 31 3.1 Locating Technologies............................. 32 3.1.1 Development Platforms for Locating-Technologies.......... 34 3.2 Privacy Controls in Location-Sharing Applications............... 35 3.2.1 Method.................................. 36 3.2.2 Data Analysis.............................. 37 3.3 Location-Sharing Risk/Benefit Analysis.................... 43 3.3.1 Method.................................. 44 3.3.2 Survey Data Analysis.......................... 45 3.4 The Ability of LBS Applications to Address Users’ Perceived Risks...... 56 3.4.1 Addressing risks with privacy controls................. 57 3.4.2 Discussion and Limitations....................... 62 4 Location-Sharing Feedback Study I (Locyoution) 65 x 4.1 Technology................................... 66 4.1.1 User Interface.............................. 68 4.1.2 Home Screen.............................. 69 4.1.3 Rules Screen.............................. 70 4.1.4 Who Has Viewed Me.......................... 70 4.1.5 Facebook Privacy Settings....................... 71 4.2 Locyoution Study................................ 71 4.2.1 Method.................................. 72 4.2.2 Data Analysis.............................. 73 4.2.3 Usage.................................. 75 4.3 Results...................................... 75 4.3.1 Privacy.................................. 75 4.3.2 Feedback................................ 78 4.3.3 Rule Expressiveness.......................... 79 4.3.4 Technology Adoption.......................... 82 4.4 Discussion.................................... 84 4.4.1 Context.................................. 84 4.4.2 Control.................................. 85 4.4.3 Bells & Whistles............................