Problem Summary

For users to make privacy-informed decisions, information must be provided in an easily understandable way, with visual communication of privacy properties, direct feedback, and leveraging familiar concepts so that users can align their behaviour with their concerns.

Rationale

The understanding is that providing visual privacy risk level indicators that are informative, simple, and easy to understand in decision-making situations (information disclosure, app permission granting, and so on) can help the user make privacy-informed decisions.

Solution

A colour-coded privacy indicator that summarises privacy risk level. Such colour code is chosen as green (low risk), yellow (medium risk) and red (high risk) [1][2][4][5][6]or a gradation from dark-green to light-green, yellow, and orange to red [3]. The intent is to leverage, for example, the metaphor of traffic lights, which is familiar to users.

The colour-coded privacy indicator leveraged by this guideline assumes that there is a calculation or assessment of privacy risk underlying it. However, there's no universal solution and the works referenced by this guideline [1-6] took different approaches, including considering context [2][3][4][6] or building mockups with hardcoded coloured indicators, to assess users' perceptions of privacy risk [3].
Paturi, Kelley and Mazumdar [1] introduced three privacy categories they called 'privacy granules': the user location, identity and search queries. To represent threats to these privacy granules, they used the colours red (danger), green (safety) and yellow (unsure). Tucker, Tucker and Zheng [2] created a list of privacy threats and linked Facebook's requested permissions to these categories, assigning each a risk value. Bal [4] used researchers' expertise to assess various factors related to privacy, evaluated the apps' potential to extract specific private information, and aggregated these assessments to assign an overall privacy rating to each app. Kumar et al. [5] designed a dynamic probabilistic model based on Contextual Integrity and the privacy risk is calculated as a combination of instantaneous privacy risk, longitudinal privacy risk and cross-platform privacy risk. Jackson and Wang [6] calculated privacy risk considering permission requests and user privacy concerns collected using the Mobile Users' Information Privacy Concerns (MUIPC). That is, it needs a mechanism to serve as the basis for the colour coding - knowledge base, expert rating, mathematical models, crowdsource and so on.

Since users' understanding of the conveyed meaning of icons is paramount, and there are no universally accepted privacy icons set, two works have selected the icons they have used through a user validation study [3][6]. Bock and Momen [3] recognised favouritism for the label bar with written descriptions. They state that "It can also be considered as achromatopsia-friendly". The assessed label bars are similar to the bootstrap pill badges component. The authors opted for an odd-numbered (5) scale instead of three to have a gradation from 'very low' to 'very high' risk instead of 'low, medium and high' risk. The decision on the scale gradation number will depend on the use case. Example using bootstrap:

low medium high
very low low medium high very high

Platforms: personal computers, mobile devices

Related guidelines: Promote User Awareness and Decision-Making on Permission/Authorisation Requests, Enhance Privacy Awareness by Communicating Privacy Risks

Example

The privacy discrepancy interface (left) highlights the discrepancy between user privacy concerns and the riskiness of each app's permission request [6]. Privacy pal interface (top right) helps users to visualise privacy and security risks associated with granting permissions to third-party apps [2]. Summary interfaces for privacy granules (bottom right) [1]. (See enlarged)

• Leverages colour-coded schemes familiar to users and can promote better alignment of user privacy behaviours to their concerns. It also provides direct feedback so users can modify permissions to match their privacy concern levels [6].

• The studies were conducted in a controlled environment, and users' actual installation behaviour in real-world scenarios might differ [1][6].

The main purpose of a privacy notice is to inform users about personal data handling. Considering the design space for privacy notices [7], this guideline can be applied to the following dimensions:

Transparency [8] is the main privacy attribute since this mechanism involves the proactive distribution of information to users, promoting visually accessible communication of privacy risk level, and helping users to make privacy-informed decisions. Other related privacy attributes: