Effects of privacy policy visualization on users’ information privacy awareness level

Abstract

Purpose The purpose of this paper is to propose visualization techniques as a new representation for privacy policies instead of traditional textual representation and to examine empirically their effects on users’ information privacy awareness level. Design/methodology/approach The authors selected as a case the privacy policy of Instagram and conducted two empirical investigations, each one with three interventions and each representing a different version of the Instagram privacy policy to users. Through a pre- and a post-questionnaire, the authors examined the effects that each representation technique had on the users’ privacy awareness level. Findings The paper finds that visualized privacy policies lead to higher privacy awareness levels than conventional textual ones, especially when icons are included. Research limitations/implications The authors implemented two new representation techniques offering beneficial guidelines for designing more attractive privacy policy representations. However, the samples are rather limited for generalization to the wide population; nonetheless, they are significant to demonstrate the effect of visualized techniques. The findings might also be subject to bias (e.g. brand bias), although the authors took necessary methodological actions to prevent bias. Practical implications The results and the methodology of the paper could guide practitioners for the representation of a privacy policy, given that the authors provide systematic and concrete steps. Originality/value This paper examines the value of privacy policy visualization as a new approach for enabling user privacy awareness, as well as implements two visualization techniques for a given privacy policy. The paper and its findings should be useful for researchers, as well as for practitioners.

Enhancing consumer perceptions of privacy and trust: a GDPR label perspective

“…We provide further support for studies advocating visualized privacy policies (e.g. Soumelidou and Tsohou, 2019) as a means to not just inform consumers and meet regulatory requirements, but by providing consumers with the level of control they desire through a user customizable privacy mechanism, and consequently build their privacy and trust perceptions. It is thus recommended that E-commerce vendors based within Europe and all vendors transacting with European citizens consider adopting the privacy label approach to communicate their privacy practices to current and potential customers.…”

“…The choice of an e-commerce website is important as it represents a widely used and transactional context in contrast to IOT devices and social media. By using a fictional website, we remove any bias associated with existing brands and move beyond the tendency of existing studies to either compare visualized policies to written policies or focus on perceived effectiveness of written policies (Soumelidou and Tsohou, 2019).…”

Privacy Rating: A User-Centered Approach for Visualizing Data Handling Practices of Online Services

“…Privacy visualizations, as advocated and developed by several researchers [18]- [34], may be a viable way to address this communication challenge. More than verbal information, visualizations can draw the attention of users who are not aware of privacy risks [24], [33], [56] and force service providers to translate complex privacy information into manageable, standardized privacy information.…”

User preferences for privacy features in digital assistants

“…For example, users would have to spend 244 h each year just to read the privacy policies of every website they visit (Gluck et al 2016). To lower users' effort and raise awareness, some researchers attempt to visualize privacy policies (Soumelidou and Tsohou 2020). For example, "The Usable Privacy Policy Project" coordinated by Prof. Sadeh and Prof. Acquisti has been tackling this problem since 2013 (Carnegie Mellon University 2017).…”

“…Algorithms: Users learn about the data and the calculations behind the decision. Amount of information shown to the user (Cranor et al 2006;Soumelidou and Tsohou 2020;Friedewald and Pohoryles 2016) Privacy policy: General data processing conditions can be taken from the privacy policy of the DA. There is no further editing.…”