Problem Summary

Permission or Authorization Dialogues are commonly used to obtain user consent for collecting and using personal data, allowing users to choose the information they consent to share. These dialogues are typically used during account creation or when accessing a service. According to GDPR Art. 4(11), consent must be freely given, sspecific, informed and unambiguous, requiring affirmative action. Traditional static dialogues often fail to ensure users fully understand and consider their data-sharing choices, necessitating more interactive approaches to achieve true informed consent.

Rationale

The intention is to engage users more actively in the consent process, ensuring they reflect on the information they are selecting to share. By implementing interactive elements such as drag-and-drop interfaces and knowledge testing, users are encouraged to carefully consider their data-sharing choices, leading to more informed and transparent consent. This approach aims to enhance user engagement and ensure compliance with legal requirements.

Solution

Interactive user interfaces, such as drag-and-drop and question-and-answer formats, are designed and validated to allow users to select personal information they consent to share. These methods have been shown to improve user engagement, understanding, and recall of the data-sharing terms, ensuring more informed and transparent consent.

Lindegren et al. [1] conducted a study evaluating three different designs for engaging users when providing their consent on smartphones. The study compared the usability and effectiveness of three interaction designs: checkboxes, drag-and-drop (DAD), and swiping. The results showed that the DAD and swiping methods improved user recall of the information they shared, although they took longer to complete than checkboxes. The study concluded that more interactive methods like DAD and swiping could enhance user engagement and awareness in permission dialogues.

Karegar et al. [2] proposed innovative user interface (UI) designs to enhance informed decision-making in social login contexts, ensuring compliance with GDPR requirements. They introduce 'Drag and Drop' (DAD) and 'Question and Answer' (Q&A) interfaces to engage users in the consent process actively. The DAD interface allows users to select and drag personal information they consent to share, while the Q&A interface involves users in answering questions to confirm their understanding of the data-sharing terms. These methods are designed to improve user awareness and recall of shared information, ultimately leading to more informed and transparent consent.

Platforms: personal computers, mobile devices

Example

Drag-and-drop interface for selecting personal information to share [1]. (See enlarged)

Q&A interface [2]. (See enlarged)

Drag&Drop interface [2]. (See enlarged)

• A between-subject user study found that the new UIs, including 'Drag and Drop' (DAD) and interactive knowledge testing, significantly enhance users' ability to provide informed consent compared to traditional social network authorization dialogues. Users had higher satisfaction and better recall with DAD than with swiping and checkboxes, ensuring they actively engage with and understand their data-sharing choices [1][2].

• It takes more time for users to complete the sharing/consent activity with the new UIs, and the robustness of the method against habituation needs further testing. Bridging the gap between legally compliant authorization dialogues and user-friendly ones is a work in progress, involving the exploration of various affirmative actions to enhance user attention to disclosed information, improving methods to prevent habituation, and clearly presenting data processing purposes [1][2].

Privacy choices give people control over certain aspects of data practices. Considering the design space for privacy choices [3], this guideline can be applied in the following dimensions:

Control [4] is the main privacy attribute that is addressed by this guideline. This attribute involves the data subject's ability to provide consent for collecting and processing their data and the extent to which they can opt out of data collection or processing. The guideline aims to enhance user engagement and attention during the consent process, ensuring that users make informed and self-determined decisions about the information they share. Interactive consent forms like drag-and-drop interfaces and knowledge testing methods directly improve user control over their personal data by making the consent process more transparent and user-friendly. Other related privacy attributes: