Control and Transparency:

Presentation on theme: "Control and Transparency:"— Presentation transcript:

Control and Transparency:Are they sufficient conditions for privacy protection?Laura Brandimarte – Heinz College, Carnegie Mellon UniversityJoint work with (in alphabetical order):Alessandro Acquisti, Idris Adjerid, George Loewenstein

Responses to privacy incidents in the US

US policy makers have been using two

approaches:

Fines on firms with privacy-invasive practices (Google Buzz settlement, Facebook Sponsored Stories settlement)

Responses to privacy incidents in the US

US policy makers have been using two

approaches:

Fines on firms with privacy-invasive practices (Google Buzz settlement, Facebook Sponsored Stories settlement)

Reliance on industry self-regulation, focusing on:

Control (choice)

Transparency (notification)

Responses to privacy incidents in the US

US policy makers have been using two

approaches:

Fines on firms with privacy-invasive practices (Google Buzz settlement, Facebook Sponsored Stories settlement)

Reliance on industry self-regulation, focusing on:

Control (choice)

Transparency (notification)

Examples: FTC White Paper on Consumer and Privacy, White House Consumer Bill of Rights

Vast consensus both from industry and privacy advocates

Responses to privacy incidents in the US

What

if control and transparency were not enough?

Misplaced confidences:Privacy and the Control Paradox

Laura Brandimarte Alessandro Acquisti George Loewenstein

Misplaced confidences

Question: we

need controls

to manage our online privacy, but could more perceived

control

over release of private information

reduce

privacy

concerns

to the point that we will be more likely to disclose, even when the

objective risks

associated with disclosure (access and usage by others)

increase?

Misplaced confidences

Theoretical background

Perceived control affects perceived risk and increases risk-taking (

Slovic

, 1987; Weinstein, 1984)

Perceived control increases users’ trust towards a visited website (Hoffman, Novak & Peralta, 1998)

Release of information is what people have direct control over, whereas access and usage involve behaviors by others. People overestimate the importance of their own actions relative to others’ (

Gilovich

,

Medvec

&

Savitsky

, 2000;

Galinsky

, 2002)

Access and usage of information by others are both uncertain and distant in time, therefore less salient, which reduces their influence on disclosure decisions (Klein, 1998;

Slovic

, 1975)

Misplaced confidences

Three experiments manipulating control over disclosure and/or accessibility

DV: willingness to answer non compulsory, sensitive questions

Main finding: Control over disclosure may have the unintended effect of lowering privacy concerns, thus increasing willingness to disclose, even when risks of disclosure increase

Misplaced confidences – Study 3

Design of Study 3: 4 conditions, between-subjects. Survey on “ethical behaviors” (sensitive questions, pre-tested for level of intrusiveness)

Condition 1: if you answer, then answers will be published

Condition 2: check a box if you allow publication of

all

answers

Condition 3: check a box for

each question

if you allow publication of

that

answer

Condition 4: same as Condition 2 but with demographics (identifying info)

Providing implicit or explicit control over disclosure

Misplaced confidences – Study 3

Misplaced confidences – Study 3

Main result: As long as people perceive control over disclosure, they will indeed disclose, even if the objective risks increase dramatically. Reported privacy concerns mediate this effect

134 students

(67 males, average age = 21.9, SD = 2.72

)

All

participants in Conditions 2 and 4 checked the publication permission

box

A

ll

participants in Condition 4 granted permission to publish all three demographic

items

Main effect of control over information release was significant: F(3,130) = 33.53, p < 0.001

Two-way interaction between condition and question intrusiveness was significant: F(3,130) = 11.98, p < 0.001

Voluntarily revealing demographic information in the Demographics condition did not affect willingness to answer sensitive questions, even though the objective risk of disclosure was higher

Misplaced confidences – Study 3

P

articipants who

had an explicit option to publish

their answers

felt less

privacy

concerned

and thus became more likely to not just

answer

, but

also

allow the

publication

of their answers

Implicit control: only 15% of participants answered ALL questions.Explicit aggregate controls: 37% answered and gave permission to publish ALL their answers.Explicit granular controls: 28% answered and gave permission to publish ALL their answers.Explicit aggregate controls with demographics: 39% answered and gave permission to publish ALL their answers and their gender, age, and birth country (making them easier for a stranger to identify).

Misplaced confidences – Study 3

ConclusionsPrivacy controls may lower concerns regarding the actual accessibility and usability of information, driving people to reveal more sensitive information to larger and riskier audiencesNumerous government and corporate entities in the U.S. have advocated self-regulatory ‘choice and consent’ models of privacy protection that essentially rely on users’ awareness and controlOur findings suggest that control over personal information may be a necessary but not sufficient condition for privacy protectionTechnologies meant to assist users for better privacy decision making may end up exacerbating the risks they face

Misplaced confidences

Sleights of Privacy:Framing, Disclosures, and the Limits of Transparency

Idris Adjerid Alessandro Acquisti Laura Brandimarte George Loewenstein

Sleights of Privacy

Question:

more control over, and more information about,

how

personal data is used

seem

an

obvious improvement

over a situation in which consumers are left in the

dark. But what if, due to

human limitations and biases

, even

straightforward and accessible privacy notices

could be

predictably

manipulated

or entirely

thwarted?

Sleights of Privacy

Theoretical background

Privacy decision making is hampered by asymmetric information (Wakefield & Fleming, 2009)

Firms in general know a lot more than consumers about the way personal data is collected and used: privacy policies are hard to read and understand (

Jensen

& Potts, 2004; McDonald &

Cranor

, 2009)

Choice in general, and therefore privacy-related choice, is subject to framing effects and salience of available information (

Kahneman

&

Tversky

, 1979)

H

euristics

and biases can influence and distort the way individuals value data protection and act on privacy

concerns (

Acquisti

, 2004, 2009)

Sleights of Privacy

Two

experiments to evaluate the impact of

framing and bounded rationality

on the propensity of privacy notices to impact

disclosure

DV: willingness to answer non compulsory, sensitive questions

Main findings:

The

impact of privacy notices is sensitive to

reference dependence

, with notices framed as

increasing (decreasing)

in protection eliciting increased

(decreased) disclosure

T

he

impact

of

privacy notices on disclosure can be muted or significantly reduced by a slight

misdirection

which does not alter the objective risk of disclosure

Sleights of Privacy – Study 2

Design of Study 2: 2(access)x5(misdirection) conditions, between-subjects

Access was either limited to students or extended to faculty as well

Misdirections

: none, time delay,

department information pages, student committee, student committee and

choice

Misdirections

are actions

or states that do not alter objective privacy risks but may distract consumers from them

Cover story: University social network and survey on academic life (sensitive questions, pre-tested for level of intrusiveness), similar to Study 1 and 2 in the Misplaced Confidences paper

Sleights of Privacy – Study 2

Main Result:

misdirections

offset

the negative impact of the Student and Faculty privacy notice on disclosure of sensitive academic questions

280 participants (37% females

, average age =

21.5,

SD =

3.1)

Absent a misdirection, participants

presented with the “Student Only” notice were 26% more likely to disclose

(p<.

05) relative to participants presented the “Student and Faculty”

notice

This effect vanishes in

the conditions with a

misdirection

Sleights of Privacy – Study 2

Privacy irrelevant misdirections: time delay; request to sign up for departmentalinformation pagesPrivacy relevant misdirections: student planning committee will use participant’s profileTo plan student activities; choice (control) over sharing with the same committee

Conclusions

C

urrent

policy and design approaches focusing just on

control and transparency

may be limited in their ability to improve consumer privacy decision

making

Conclusions

C

urrent

policy and design approaches focusing just on

control and transparency

may be limited in their ability to improve consumer privacy decision

making

Worse, they may constitute a mere de-

responsibilization

strategy: choice and notification make consumers responsible for their own privacy protection, and clear institutions from the burden of

regulation

Conclusions

C

urrent

policy and design approaches focusing just on

control and transparency

may be limited in their ability to improve consumer privacy decision

making

Worse, they may constitute a mere de-

responsibilization

strategy: choice and notification make consumers responsible for their own privacy protection, and clear institutions from the burden of regulation

Human limited attention and biases may limit the effectiveness of

even simple and clear privacy

notices

Conclusions

C

urrent

policy and design approaches focusing just on

control and transparency

may be limited in their ability to improve consumer privacy decision

making

Worse, they may constitute a mere de-

responsibilization

strategy: choice and notification make consumers responsible for their own privacy protection, and clear institutions from the burden of regulation

Human limited attention and biases may limit the effectiveness of

even simple and clear privacy

notices

A way forward? We need

to expand the

concepts

of

choice transparency

to not only include clarity and ease of comprehension, but also making

privacy

risks

salient

and readily

available

to consumers when they most

need

them,

at the point of

disclosure

Examples? ‘Privacy Nudges’

Thank you!Questions…

27

Misplaced confidences – Study 1

Design of Study 1: 2 conditions, between-subjects

Survey on academic life (sensitive questions, pre-tested for level of intrusiveness)

Cover story: CMU networking website

Condition 1:

Profile automatically published

Condition 2:

profile published with 50% probability

Treatment decreases participants’ feeling of control over public release of their survey answers, while actually reducing the probability of access by others

Misplaced confidences – Study 1

Main Result: Participants with lower control over information release were significantly less willing to answer personal questions, but especially so for more intrusive questions

67 students in Condition 1, 65 in Condition 2 (62

males, average age =

21.5,

SD =

2.85)

Participants were less likely to answer the more intrusive questions than the less intrusive ones: t(130) = 11.41, p < 0.001

Main effect of control was significant: F(1,130) = 7.71, p < 0.001

Two-way interaction between condition and question intrusiveness was significant: F(1,130) = 32.43, p < 0.001

Misplaced confidences – Study 1

Participants with lower control over information release were significantly less

willing to answer personal questions, but especially so for more intrusive questions

Misplaced confidences – Study 2

Design of Study 2: 4 conditions, between-subjects

Survey on academic life (sensitive questions, pre-tested for level of intrusiveness)

Cover story: same as study 1 (CMU networking website)

Condition 1:

Profile automatically published and visible to students only

Condition 2: P

rofile published with 50% probability and visible to students only

Condition 3: Profile automatically published and visible to students and faculty

Condition 4:

P

rofile published with 50% probability and visible to students and faculty

Treatments decreased participants’ feeling of control over public release of their survey answers or increased their direct accessibility

Misplaced confidences – Study 2

Main Result: Reassurances about control over public release seemed to decrease participants’ attention to issues of actual accessibility

200 participants (80

males, average age =

21.3,

SD =

2.23)

Main effect of control on question-responding was significant: F(1,196) = 36.4, p < 0.001

Significant two-way interaction between control over release and question intrusiveness: F(1,196) = 15.67, p < 0.001

Main effect of accessibility by faculty also significant: F(1,196) = 7.86, p < 0.01

But, as predicted, effect of accessibility was smaller in the case of certain publication: significant interaction of control and accessibility (F(1,196) = 4.12, p < 0.05)

Misplaced confidences – Study 2

When disclosure was uncertain, participants were less willing to answer intrusive

questions if the audience was composed of students and faculty as compared to

students only (t(98) = 3.92, p < .001). This difference was, however, smaller and barely

significant when disclosure was certain (t(98) = .864, p = .052)

Sleights of Privacy – Study 1

Design of Study 1: 2-survey study, 4 conditions, between-subjects

Condition 1:

Low

privacy

protections

(

identified

survey

,

through

email

address

)

which

did

not

change

across

the 2

phases

Condition 2:

Decreasing

p

rivacy

protections

,

from high (anonymous survey) to low

Condition 3: High

privacy

protections

which

did

not

change

across

the 2

phases

Condition 4: Increasing

privacy

protections

,

from

low

to

high

Surveys on sensitive behaviors, such as drug use or related to sex-life

Sleights of Privacy – Study 1

Design of Study 1

Main Result: People tend to disclose more (less) if provided with increasing (decreasing) levels of protection than when they perceive no change, but in fact end up with the same level of protection386 participants (43% females, average age = 30, SD = 13.5)In Survey 1, participants disclosed more if they were provided high protection, but this effect vanishes in Survey 2, suggesting that people may fall into some default mode of disclosureFor the most sensitive questions, participants presented decreasing protection disclosed 14% less (p<.05) than participants that were presented no change in privacy noticesParticipants that were presented increasing privacy protection shared 11% more (p<.05) than participants that were presented no change in privacy notices

Sleights of Privacy – Study 1

Sleights of Privacy – Study 1