Making privacy visible Lorrie Faith Cranor October 19

Making privacy visible Lorrie Faith Cranor October 19, 2007 CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/

Privacy concerns seem inconsistent with behavior n People say they want privacy but they don’t take steps to protect it n Many hypotheses as to why that is • They don’t really care that much about privacy • They prefer immediate gratification now to privacy protections that they won’t benefit from until later • They don’t understand the privacy implications of their behavior • The cost of privacy protection (including figuring out how to protect their privacy) is too high • … • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 2

Making privacy visible n Communicate meaningfully about privacy risks n Make it easy for people to understand control privacy options • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 3

Requirements for meaningful control n Individuals must understand what options they have n Individuals must understand implications of their options n Individuals must have the means to exercise options n Costs must be reasonable • Money, time, convenience, benefits • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 4

Privacy policies n Inform consumers about privacy practices • Consumers can decide whether practices are acceptable, when to opt-out n Most policies require college-level skills to understand, long, change without notice • Few people read privacy policies n Existing privacy policies are not an effective way to inform consumers or give them privacy controls • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 5

Platform for Privacy Preferences Project (P 3 P) n World Wide Web Consortium (W 3 C) recommendation n Standard machine-readable (XML) format for privacy policies n Enables browsers and other tools to • Summarize privacy policies • Compare policies with user preferences • Alert and advise users n P 3 P support built into IE 6/7 and Netscape 7 • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 6

Privacy Bird n Free download of beta from http: //privacybird. org/ n “Browser n Reads helper object” for IE 6 P 3 P policies automatically n Bird icon indicates whether site matches user’s privacy preferences n Clicking on bird icon gives more information • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 7

Bird is privacy indicator 8

Red bird indicates mismatch 9

Privacy settings 10

Privacy Finder n Prototype developed at AT&T Labs, improved and deployed by CUPS n Uses Google or Yahoo! search API n Checks for P 3 P, evaluates against user’s preferences n Composes search result page with privacy annotations and links to “Privacy Report” n http: //privacyfinder. org/ • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 11

Demo 12

13

Evaluating Privacy Finder n Have enough sites adopted P 3 P for Privacy Finder to be useful? • S. Egelman, L. Cranor, and A. Chowdhury. An Analysis of P 3 P-Enabled Web Sites among Top-20 Search Results. Proceedings of the Eighth International Conference on Electronic Commerce August 14 -16, 2006, Fredericton, New Brunswick, Canada. n Will the prominent display of privacy information cause consumers to take privacy into account when making online purchasing decisions? • J. Gideon, S. Egelman, L. Cranor, and A. Acquisti. Power Strips, Prophylactics, • and Privacy, Oh My! In Proceedings of the 2006 Symposium On Usable Privacy and Security, 12 -14 July 2006, Pittsburgh, PA. J. Tsai, S. Egelman, L. Cranor, and A. Acquisti. The Effect of Online Privacy Information on Purchasing Behavior: An Experimental Study. Workshop on the Economics of Information Security, June 7 -8, 2007, Pittsburgh, PA. • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 14

Does Privacy Finder influence purchases? n Online shopping studies • Pay participants to make online purchases with their own credit cards • Some use Privacy Finder and some use generic search engine • Lab studies § Study of college students purchasing power strips and condoms, no price incentive (reimburse cost) § Study of Pittsburgh residents purchasing batteries and sex toys, with price incentive (keep the change) • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 15

Lab study design n 16 participants in each condition • Condition 1: No information • Condition 2: Irrelevant information • Condition 3: Privacy information n Products • Non-privacy Sensitive - batteries • Privacy sensitive - sex toy n Participants paid fixed amount and told to “keep the change” • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 16

Condition 1 No information • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 17

Condition 2 Irrelevant information • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 18

Condition 3 Privacy information Privacy premium: $0. 69 4. 8% • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 19

Results Batteries Sex Toy • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 20

Conclusions n Accessible privacy information affects consumer behavior n Consumers willing to pay for better privacy n Privacy Finder helps users make privacy informed decisions • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 21

Ongoing and future work n Study on impact of privacy information timing • Privacy Finder provides info in search results • Privacy Bird provides info after users have arrived at web site n Privacy Finder field study • Interested in partnering with major search engine provider n Design and testing of standardized privacy policy formats • Policies are complex and nuanced • Users don’t know privacy jargon or understand risks n Explore what people understand about privacy and ways to educate them about privacy risks • Make informed consent meaningful n Interfaces for visualizing and controlling other aspects of privacy • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 22

P 3 P Expandable Grid • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 23

Expandable Grids 24

Visitors + Alice Bob + Students + Windows computer Visitors + Visitors Students Alice Bob Cindy Dwayne Edith Visitors + Kitchen Alice Bob - Lab Students Thursday Students Alice Bob Office + + Friday Saturday Sunday Monday Tuesday Monday, 10/23/06, 9: 00 am Bob said open 10/25/06 3: 30 PM Thursday You said Bob could open You own Kitchen Key Not used Friday Saturday Heavily used Sunday Monday 25

CMU Usable Privacy and Security Laboratory http: //cups. cmu. edu/ 26

Privacy as control “the claim of individuals… to determine for themselves when, how, and to what extent information about them is communicated to others. ” - Alan Westin, 1967 • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 27

Control process “Each individual is continually engaged in a personal adjustment process in which he balances the desire for privacy with the desire for disclosure and communication…. ” - Alan Westin, 1967 • CMU Usable Privacy and Security Laboratory • http: //cups. cmu. edu/ 28