How much control are people willing to grant to a personal privacy assistant?

CyLab’s Jessica Colnago believes that in the future, the simple act of walking down the street is going to be a little weird.

“You know how every time you enter a website, and it says: ‘We use cookies. Do you consent?’ Imagine that same thing walking down the street, but for a light pole, or a surveillance camera, or an energy sensor on a house,” Colnago says.

Colnago, a Societal Computing Ph.D. student, works among a team of researchers who are currently developing personalized privacy assistants (PPAs), technologies that aim to help people make privacy decisions about devices around them. Without PPAs, Colnago says, “… it’s going to be unbearable to live in a world with IoT devices everywhere giving you notice and asking for consent.”

In a new study presented at the CHI 2020 conference, Colnago and her co-authors sought to find out how much autonomy people would feel comfortable giving to a PPA. The team conducted 17 in-depth interviews with people to explore their opinions on PPAs.

“We found that people are definitely interested in having some sort of assistance like that provided by a PPA, but what that assistance looks like varies across the board,” says Colnago. “In different scenarios with different people, they want different ways of interacting with the system.”

During the interviews, the researchers gauged participants’ reactions to three increasingly autonomous versions of PPAs. The first version would simply let users know that devices were around them. A majority of participants had positive reactions to this version, while a few viewed it negatively, saying it would fuel their anxiety.

...what that assistance looks like varies across the board.

Jessica Colnago, Ph.D. student, Societal Computing

Among the people who indicated they would like to receive such notifications, the majority indicated they would ideally also want to have some control over the data collected about them, rather than just being told about something they have no control over.

The researchers presented the study participants with a second version of a PPA, which would know users’ personal preferences on privacy, and use that information to make recommendations. A majority of participants also reacted positively to this version, though some of them would rather have the recommendations presented to them based on authoritative sources rather than their personal preferences.

The last version presented to participants was the most autonomous: the PPA would leave the user out of the decision-making process and make privacy decisions for them based on their preferences. Reception was mixed.

“I would consider owning such an appliance,” said one participant. “I don’t like to be fully controlled by a device, you know?” said another. 

“These interviews told us that there is no single version of a PPA that everyone would be comfortable with,” says Colnago. “What we develop needs to include an array of features that users can choose from to fit their individual needs and comfort levels.”

These interviews told us that there is no single version of a PPA that everyone would be comfortable with.

Jessica Colnago, Ph.D. student, Societal Computing

Moving forward, Colnago says the team aims to develop a system to actually test with users and see how they react in a more ecologically valid situation.

“We gained important insights from these 17 participants, but the scenarios we gave them were all hypothetical,” Colnago says. “We need to measure how people would actually behave.”

Other authors on the study included:

• Yuanyuan Feng, postdoctoral researcher in the Institute for Software Research (ISR)
• Tharangini Palanivel, M.S. student in Heinz College
• Sarah Pearman, Ph.D. student in Societal Computing
• Megan Ung, undergraduate student in Computer Science
• Alessandro Acquisti, professor in Heinz College
• Lorrie Cranor, director of CyLab and professor in ISR and Engineering and Public Policy
• Norman Sadeh, professor in ISR and PPA Project Director