A Design Space for Effective Privacy Notices
Total Page:16
File Type:pdf, Size:1020Kb
A Design Space for Effective Privacy Notices 1 2 3 1 Florian Schaub, Rebecca Balebako, ∗ Adam L. Durity, ∗ Lorrie Faith Cranor 1Carnegie Mellon University 2RAND Corporation 3Google Pittsburgh, PA, USA Pittsburgh, PA, USA Mountain View, CA, USA { fschaub, lorrie }@cmu.edu [email protected] [email protected] ABSTRACT website, or linked to from mobile app stores or mobile apps, Notifying users about a system’s data practices is supposed to signs posted in public places to inform about CCTV cam- to enable users to make informed privacy decisions. Yet, eras in operation. Even an LED indicating that a camera current notice and choice mechanisms, such as privacy poli- or microphone is active and recording constitutes a privacy cies, are often ineffective because they are neither usable notice, albeit one with limited information about the data nor useful, and are therefore ignored by users. Constrained practices associated with the recording. Providing notice interfaces on mobile devices, wearables, and smart home de- about data practices is an essential aspect of data protec- vices connected in an Internet of Things exacerbate the is- tion frameworks and regulation around the world [57]. While sue. Much research has studied usability issues of privacy transparency has been emphasized as an important practice notices and many proposals for more usable privacy notices for decades, existing privacy notices often fail to help users exist. Yet, there is little guidance for designers and develop- make informed choices. They can be lengthy or overly com- ers on the design aspects that can impact the effectiveness of plex, discouraging users from reading them. privacy notices. In this paper, we make multiple contribu- Smartphones and mobile apps introduce additional pri- tions to remedy this issue. We survey the existing literature vacy issues as they support recording of sensor and behav- on privacy notices and identify challenges, requirements, and ioral information that enables inference of behavior patterns best practices for privacy notice design. Further, we map out and profiling of users. Yet, comparatively smaller screens the design space for privacy notices by identifying relevant and other device restrictions constrain how users can be dimensions. This provides a taxonomy and consistent ter- given notice about and control over data practices. minology of notice approaches to foster understanding and The increasing adoption of wearable devices, such as smart reasoning about notice options available in the context of watches or fitness trackers, as well as smart home devices, specific systems. Our systemization of knowledge and the such as smart thermostats, connected light bulbs, or smart developed design space can help designers, developers, and meters, represents a trend towards smaller devices that are researchers identify notice and choice requirements and de- even more constrained in terms of interaction capabilities, velop a comprehensive notice concept for their system that but are also highly connected with each other and the cloud. addresses the needs of different audiences and considers the While providing notice and choice is still considered essential system’s limitations and opportunities for providing notice. in the“Internet of Things”(IoT) [48, 74], finding appropriate and usable notice and choice mechanisms can be challenging. The challenges of providing usable privacy notice have 1. INTRODUCTION been recognized by regulators and researchers. For instance, The purpose of a privacy notice is to make a system’s users FTC chairwoman Edith Ramirez [107] stated in the IoT con- or a company’s customers aware of data practices involving text: “In my mind, the question is not whether consumers personal information. Internal practices with regard to the should be given a say over unexpected uses of their data; collection, processing, retention, and sharing of personal in- rather, the question is how to provide simplified notice and formation should be transparent to users. The privacy notice choice.” An extensive body of research has studied usability acts as a public announcement of those practices. Privacy issues of privacy notices (e.g., [14, 33, 64, 51]) and proposed notices can take different shapes and leverage different chan- improved notice interfaces (e.g., [34, 66, 67]), as well as tech- nels, ranging from a privacy policy document posted on a nical means to support them (e.g., [75, 127, 131]). Multi- stakeholder processes have been initiated in the wake of the ∗Rebecca Balebako and Adam Durity performed this work while at Carnegie Mellon University. White House’s proposed Consumer Bill of Rights [122] to tackle transparency and control issues of mobile privacy [92] and facial recognition [93]. While such efforts have resulted in guidance for notices in the context of particular systems, they have given little consideration to usability [14]. Existing frameworks and processes for building privacy- friendly systems, such as Privacy by Design [36] or privacy Copyright is held by the author/owner. Permission to make digital or hard impact assessments [136], focus on the analysis of a system’s copies of all or part of this work for personal or classroom use is granted data practices and less so on the design of notices. Even the without fee. Symposium on Usable Privacy and Security (SOUPS) 2015, July 22–24, OECD report on “making privacy notices simple” [94] basi- 2015, Ottawa, Canada. 1 USENIX Association 2015 Symposium on Usable Privacy and Security 1 cally states that one should design a simplified notice, con- plain their purpose and intentions in order to gain user ac- duct usability tests, and deploy it – the crucial point of how ceptance and avoid backlash. Furthermore, companies that to design a simplified notice is not addressed. Common pro- provide privacy-friendly and secure systems can leverage pri- posals to improve the usability of privacy notices are the use vacy notices to make users aware of privacy-friendly data of multi-layered notices [9, 26] or just-in-time notices [47]. practices. Implementing and highlighting good security and Despite the previous work on privacy notices, transparency privacy practices can further create a competitive advantage tools, and privacy mechanisms, a system designer or devel- as users may perceive the system as more trustworthy. oper has very little guidance on how to arrive at a privacy Regulators, such as data protection authorities or the FTC, notice design suitable and appropriate for their specific sys- rely on companies’ privacy notices – primarily their privacy tem and its respective characteristics. Existing best prac- policies – as an important tool to investigate and enforce reg- tices are spread throughout the literature and have not pre- ulatory compliance [31]. If a company violates its privacy viously been organized into a comprehensive design frame- policy, it provides regulators with a basis to take action; work. As a result, privacy notices are often hastily bolted for example, the FTC may treat a violation as an unfair on rather than well-integrated into a system’s interaction de- or deceptive trade practice [45, 116]. Further, data protec- sign. Designers may not be aware of the many alternatives tion authorities in Europe and other countries may assess for designing usable privacy notices and therefore do not whether the described practices meet more stringent crite- systematically consider the options. Furthermore, designers ria, such as use limitation, proportionality of data practices, and researchers do not yet have a standard vocabulary for and user access options [41, 43]. describing privacy notice options. In this paper, we make multiple contributions to ease the design of privacy notices and their integration into a system. 2.2 Hurdles to Effective Privacy Notices The goal is to help developers embed privacy notices and While privacy notices fulfill many roles for different stake- choice options into their system design where relevant, with holders, in practice most privacy notices are ineffective at in- minimal disruption to the system’s interaction flow. First, forming consumers [33, 83]. This ineffectiveness stems from we identify challenges, requirements, and best practices for hurdles that can be attributed not only to general shortcom- the design of privacy notices. Based on a survey of existing ings of the notice and choice concept [25, 33, 116], but also literature and privacy notice examples, we develop a design to the challenges in designing effective privacy notices. space of privacy notices. This design space and its dimen- Notice complexity. The different roles of privacy notices sions provide a systemization of knowledge and a taxonomy result in a conflation of requirements. Besides informing to foster understanding and reasoning about opportunities users about data practices and their choices, privacy notices for privacy notices and controls. We demonstrate the util- serve to demonstrate compliance with (self-)regulation and ity of our design space by discussing existing privacy notice limit the system provider’s liability [23]. As a result, pri- approaches in different domains. vacy notices often take the shape of long privacy policies or terms of service that are necessarily complex because the 2. BACKGROUND respective laws, regulations, and business practices are com- The concept of privacy notices is founded on the idea that plex [25]. For instance, website privacy policies are typically users of services and systems that collect or process personal long, complex documents laden with legal jargon. Indeed information should be informed about what information is it has been estimated that to read the privacy policies for collected about them and for which purposes, with whom it all the websites an American Internet user visits annually is shared, how long it is stored, and their options for con- would take about 244 hours per year [83]. Privacy policies trolling or preventing certain data practices [45, 95]. Given also read like contracts because regulators aim to enforce such transparency, users should be able to make informed them like contracts [25]. Notices may further be purpose- privacy and consent decisions.