Nudges for Privacy and Security: Understanding and Assisting Userss Choices Online

Acquisti, Alessandro; Adjerid, Idris; Balebako, Rebecca; Brandimarte, Laura; Cranor, Lorrie Faith; Komanduri, Saranga; Leon, Pedro Giovanni; Sadeh, Norman; Schaub, Florian; Sleeper, Manya; Wang, Yan; Wilson, Shomir

doi:10.2139/ssrn.2859227

Cited by 105 publications

(221 citation statements)

References 114 publications

Supporting

Mentioning

214

Contrasting

Unclassified

Order By: Relevance

“…Instead, the notice content was replaced with an invitation 1 The legal bases for storing the cookie that remembers the banner ID are Article 6(1)(e) GDPR (public interest in conducting this study) and Article 6(1)(c) GDPR (compliance with a legal obligation) for storing the consent cookie. 2 In all experiments, all texts in the consent notice and survey were in German to match the website's language. Survey responses were also in German.…”

Section: Study Setupmentioning

confidence: 99%

“…Prior work has shown that the design and architecture of choices heavily influences people's decisions [43,50]. While this effect has also been shown successful in improving user privacy [1,2], in practice it is most often used to make users share more information [10]. Website owners often have an interest in getting visitors to agree to the use of cookies and hence highlight certain choices in the consent notice to nudge visitors towards accepting.…”

Section: Experiments 2: Number Of Choices Neutral Presentation Vs Numentioning

confidence: 99%

See 1 more Smart Citation

(Un)informed Consent

Utz

Degeling

Fahl

et al. 2019

Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

Self Cite

252

View full text Add to dashboard Cite

Since the adoption of the General Data Protection Regulation (GDPR) in May 2018 more than 60 % of popular websites in Europe display cookie consent notices to their visitors. This has quickly led to users becoming fatigued with privacy notifications and contributed to the rise of both browser extensions that block these banners and demands for a solution that bundles consent across multiple websites or in the browser. In this work, we identify common properties of the graphical user interface of consent notices and conduct three experiments with more than 80,000 unique users on a German website to investigate the influence of notice position, type of choice, and content framing on consent. We find that users are more likely to interact with a notice shown in the lower (left) part of the screen. Given a binary choice, more users are willing to accept tracking compared to mechanisms that require them to allow cookie use for each category or company individually. We also show that the widespread practice of nudging has a large effect on the choices users make. Our experiments show that seemingly small implementation decisions can substantially impact whether and how people interact with consent notices. Our findings demonstrate the importance for regulation to not just require consent, but also provide clear requirements or guidance for how this consent has to be obtained in order to ensure that users can make free and informed choices. CCS CONCEPTS• Security and privacy → Usability in security and privacy;• Human-centered computing → Empirical studies in interaction design; • Social and professional topics → Governmental regulations.

show abstract

Section: Study Setupmentioning

confidence: 99%

Section: Experiments 2: Number Of Choices Neutral Presentation Vs Numentioning

confidence: 99%

(Un)informed Consent

Utz

Degeling

Fahl

et al. 2019

Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security

Self Cite

252

View full text Add to dashboard Cite

show abstract

“…Further research is therefore essential in order to gain a comprehensive understanding on the impact of nudging on privacy outcomes. Despite the inconclusive evidence about privacy nudging in the literature, as Acquisti et al pointed out in [1], "whenever a designer creates a system, every design choice inescapably influences the user in some way", so nudging is not a choice but a fact. It deserves highlighting that nudges can also be unintended or even malicious.…”

Section: Privacy Nudgingmentioning

confidence: 99%

From Data Disclosure to Privacy Nudges: A Privacy-Aware and User-Centric Personal Data Management Framework

Lü

Ioannou

et al. 2019

Communications in Computer and Information Science

View full text Add to dashboard Cite

0000−0002−0583−2688] , Shujun Li 1( )[0000−0001−5628−7328] , Athina Abstract. Although there are privacy-enhancing tools designed to protect users' online privacy, it is surprising to see a lack of user-centric solutions allowing privacy control based on the joint assessment of privacy risks and benefits, due to data disclosure to multiple platforms. In this paper, we propose a conceptual framework to fill the gap: aiming at the user-centric privacy protection, we show the framework can not only assess privacy risks in using online services but also the added values earned from data disclosure. Through following a human-in-the-loop approach, it is expected the framework provides a personalized solution via preference learning, continuous privacy assessment, behavior monitoring and nudging. Finally, we describe a case study towards "leisure travelers" and several future areas to be studied in the ongoing project.

show abstract

“…In a cloud computing context, Ramokapane et al [28] have found that users fail to delete contents because of poorly designed interfaces. Acquisti et al [29] provide an overview of how users can be better assisted in their security choices.…”

Section: Related Workmentioning

confidence: 99%

User Perception and Expectations on Deleting Instant Messages, or "What Happens If I Press This Button?"

Schnitzler¹,

Utz²,

Farke³

et al. 2018

Proceedings 3rd European Workshop on Usable Security

View full text Add to dashboard Cite

Abstract-Contemporary mobile messaging provides rich text and multimedia functionality leaving detailed trails of sensitive user information that can span long periods of time. Allowing users to manage the privacy implications both on the sender and the receiver side can help to increase confidence in the use of communication applications. Recently, in October 2017, one of the mobile messengers with the largest user base, WhatsApp, has introduced a feature to delete past messages from communication, both from the sender's and the receiver's logs.In this paper, we report on a study with 125 participants conducted in a between-subjects design. We explore the actual demand for deleting mobile messages, and we investigate how well users comprehend this functionality as implemented in popular messaging applications. We found statistically significant differences in users' understanding of message deletion between our three test conditions, comprising WhatsApp, Facebook Messenger, and Skype. 80 % of participants in the WhatsApp condition could correctly assess the effects of deleting messages, compared to only 49 % in the Skype condition.Our findings indicate that users demand a message deleting functionality and that they can more precisely estimate the capabilities of a deletion function when its effects are transparently explained in the application's user interface.

show abstract

Nudges for Privacy and Security: Understanding and Assisting Userss Choices Online

Cited by 105 publications

References 114 publications

(Un)informed Consent

(Un)informed Consent

From Data Disclosure to Privacy Nudges: A Privacy-Aware and User-Centric Personal Data Management Framework

User Perception and Expectations on Deleting Instant Messages, or "What Happens If I Press This Button?"

Contact Info

Product

Resources

About