Problem Summary

Traditional privacy policies are often static, making it difficult for users to navigate, understand, and enforce control over their personal data.

Rationale

Interactive privacy policies enhance transparency and user engagement. These policies' interfaces allow users to enforce their privacy preferences in real-time, providing a detailed yet comprehensible overview of data processing practices.

Solution

To implement interactive privacy policy interfaces that offer a dynamic approach to presenting privacy policies.

Drozd and Kirrane [1] highlighted that privacy policies are the "de facto standard for consent requests" and that several studies show such policies are rarely read. They proposed the CURE prototype as a solution to enhance the effectiveness of privacy consent requests. It addresses the complexities of traditional privacy policies by providing a visually engaging and interactive interface. Through customisable elements like sliders and checkboxes, CURE aims to improve users' understanding and management of their data processing consents. This approach transforms consent requests into a more user-friendly format, thereby enhancing transparency and control for users, targeting the visual and interactive presentation of consent forms within privacy policies. The code for the prototype is available at https://bit.ly/2GErFC7 .

Reinhardt, Borchard, and Hurtienne [2] presented the Visual Interactive Privacy Policy (VIPP) as a solution to the usability issues of traditional privacy policies. The VIPP incorporates interactive features like mouse-over help icons, expandable rows, and clickable cells to provide optional explanations and further information. This design lets users directly control and enforce their privacy settings within the policy interface, improving user engagement, comprehension, and transparency compared to standard static privacy policy texts.

Both studies acknowledge that the Privacy Nutrition Label does not allow direct manipulation of the privacy policy, such as managing privacy settings/consent directly. Drozd and Kirrane [1] argue that this approach does not allow users to visualise the data processing activities fully. Reinhardt, Borchard, and Hurtienne [2] incorporated a Privacy Nutrition Label enriched with control options and interactive elements into their VIPP solution, enhancing user engagement and control.

Angulo et al. [3] presented the "Send Data?" prototype, a browser extension designed to simplify privacy policy management using the PrimeLife Policy Language (PPL). The solution introduces "on the fly" privacy management, allowing users to adjust their privacy settings during online transactions. It features predefined privacy levels (High, Medium, Low) that users can customise, making the initial configuration more accessible. Additionally, the prototype uses visual elements like tables, icons, and colour-coded indicators to clearly present privacy settings and mismatches.

Platforms: personal computers

Related guidelines: Implement Visual Strategies for Effective Communication of Lengthy Privacy Policies

Example

Top: The CURE prototype: (1) Slider and (2) Consent per purpose. Bottom: Example of a detailed overview of the data processing required for the purpose of “deriving calories burned” [1]. (See enlarged)

Interactive capabilities of the Visual Interactive Privacy Policy (VIPP): Consent options, explanations and additional information [2]. (See enlarged)

The look-and-feel of the seventh iteration cycle of the "Send Data?" prototype [3]. (See enlarged)

• The UI was well received by participants in a usability evaluation, who completed tasks quickly, easily, and with minimal errors. Positive feedback included high comprehension levels of the consented information and better performance in comparison tasks against traditional consent requests and a Usercentrics solution [1].
• The Visual Interactive Privacy Policy (VIPP) builds upon the Privacy Nutrition Label proposal to address participants' concerns regarding missed information and direct privacy control options. Additionally, a pre-study indicated a preference for the simple table structure of the Privacy Nutrition Label, forming the foundation for VIPP. User focus is directed through the strategic use of coloured title rows and columns (in orange and blue) to highlight significant elements, such as a ranking of privacy policy terms derived from a user study. At the same time, less crucial aspects are nested within deeper layers [2].
• The concept of "on the fly" privacy settings is both understood and appreciated by users. Additionally, users found the selection of credentials using a card-based approach, clearly grouped by rows, to be effective [4].

• Users initially found the "Send Data?" interface confusing and needed some time to interact with it before fully grasping its purpose and benefits. This initial confusion indicates a learning curve, which may hinder immediate user comprehension and usability [3].
• Although the VIPP showed improvements over the Long Text in several areas, it did not consistently demonstrate statistically significant advantages over the Nutrition Label, despite some noticeable positive changes in terms of stimulation, novelty, and perceived control [2].
• A potential limitation of both studies is that the prototypes were evaluated only on personal computers and desktops. This restriction may not fully capture the usability and effectiveness of the interfaces on other devices, such as tablets or smartphones, which are increasingly used for internet access.

While its core objective is to enhance how privacy information is communicated to users, the guideline also integrates aspects of privacy choices [5], particularly in the control dimension. This includes allowing users to manage and enforce their privacy preferences directly within the notices, thereby adding an element of interactivity to the traditional privacy notice [4] framework.

The interactive and customisable elements of the proposed solutions are designed to empower users to decide what to share and for which purposes, aligning closely with the core elements of the Control [6] attribute. Other related privacy attributes: