Problem Summary

Users usually lack awareness over disclosing their personal information in contexts related to permission or authorisation requests due to several issues like overlooking long permission lists, unawareness of potential third-party access to their data, the sensitivity of the disclosed data and a clear risk assessment of accepting such requests.

Rationale

Providing users with comprehensive insights into privacy threats arising from permission requests to disclose their data would enhance awareness, guiding users in making privacy-informed decisions.

Solution

A comprehensive privacy notification enhanced interface that combines a user-friendly privacy summary that is icon-based or utilises a privacy meter. The purpose here is to present users with a privacy summary interface that visually communicates privacy risks in contexts where they have to analyse the impacts of permission granting to their personal data. What summary interface would communicate better depends on the context. The central unity of analysis is the permission, but its aggregation depends on the approach taken by the researchers.

Kang et al. [1] calculated the privacy risk by counting the number of privacy-sensitive permissions in the app's request, dividing that count by the maximum number of dangerous permissions, and using this ratio as the privacy risk score. Results are communicated to users via a privacy meter, leveraging users' familiarity with similar meters, such as those used for password strength warnings. Also using the popular appearance of password strength meters to communicate privacy risks to users, Tucker, Tucker and Zheng [6] assessed app permissions for potential misuse and advantages to determine privacy risks.

Bal, Rannenbert and Hong [2] introduced a privacy risk communication system for Android that provides users with privacy risk information based on the second-order (threats to privacy coming from user-profiling and data-mining capabilities based on the long-term data access behaviour of apps) privacy risk perspective. Liccardi et al. [3], a sensitivity score is calculated based on the presence of sensitive permissions in an app's permission list, provided that network permission (full internet access) is also present. The results are communicated to users using icons that inform the sensitivity score.

Paturi, Kelley, and Mazumdar [4] employed multiple methods to establish privacy categories, which they referred to as 'privacy granules.' These methods included analysing permission requirements and app features, and conducting both static and dynamic code analysis, including the examination of third-party libraries. The results of this analysis are communicated to users considering two categories, namely app providers and third-party libraries. Within each category, privacy risks are presented according to location, identity and query privacy granules. The icons representing these privacy granules were validated by users.

Lin et al. [5] explored the idea of privacy based on user expectations of what an application should or should not do. Results are presented to users as a percentage, illustrating the extent to which these expectations were violated. To measure this violation of expectations, the authors analysed the privacy permissions of a group of apps and conducted a survey to confirm instances where the apps diverged from users' expectations. Using the survey results, they created a prototype privacy summary indicating how other users feel about the app requesting certain permission.

Kelly, Cranor and Sadeh [7] presented a short "Privacy Facts" display as a prototype implemented as a modification to the Android marketplace interface. This simplified display, which fits on the main application display screen, presents a checklist of data practices, including types of information collected (e.g., personal, location) and usage (e.g., advertising, analytics), and can assist users in selecting apps that request fewer permissions.

Platforms: personal computers, mobile devices

Related guidelines: Enhance Privacy Awareness by Communicating Privacy Risks, Encourage Users to Consider Privacy Implications Before Sharing Online, Communicate Privacy Risk with Colour-Coded Privacy Indicators

Example

Screenshots of the proof-of-concept version of Styx [2]. (See enlarged)

From left to right summary interfaces for privacy granules [4] and for sensitivity score within the permission list [3]. (See enlarged)

From left to bottom right summary interfaces for user expectations [5], privacy pal [6] and privacy meter [1]. (See enlarged)

Privacy facts display [7]. (See enlarged)

• Helps users to compare different applications regarding their privacy properties [2].
• Users largely favoured the icon-based privacy interface, making identifying threats and queries easier than traditional permission lists. User studies highlighted that icons, with simple designs and accurate threat representations, captured users' attention more effectively than text-heavy descriptions [4].
• Users exhibited improved accuracy in specifying the resources utilised by target apps. Additionally, the study highlighted that users feel more at ease when informed about the necessity of their sensitive resources [5].
• Moving privacy/permissions information to the main screen clearly and simply can influence user decision to choose apps that request fewer permissions, particularly when applications are similar [7].

• Developing a scalable privacy evaluation system entails merging automated application analysis with crowdsourcing techniques. It's vital to conduct effectiveness tests, especially when users briefly view the interface (e.g., for 5-10 seconds). Challenges persist in determining the necessity of accessing sensitive resources and understanding their impact on user privacy perception [5].
• Needs further testing of the interface and long-term effects on user perceptions and behaviour [2][4].

Considering the design space for privacy notices [8], this guideline can be applied to the following dimensions:

Transparency [9] is the main privacy attribute since this mechanism involves the proactive distribution of information to users, promoting visually accessible communication of privacy information.
The research papers collectively underscore the importance of making privacy information accessible and understandable to enhance user awareness and decision-making. Other related privacy attributes: