Reversing the Privacy Paradox: An Experimental Study

Abstract

This study and paper represent a collaboration between a privacy scholar and a PhD in human-computer interaction aimed at testing the efficacy of user experience as a form of privacy notice. Notice is among the only affirmative requirements websites face with respect to privacy. Yet few consumers read or understand privacy policies. Indeed, studies show that the presence of a link labeled “privacy” leads consumers to assume that the website has specific privacy practices that may or may not actually exist.

One alternative to requiring consumers to read lengthy prose or decipher complex symbols is to influence a user’s mental model of the website directly by adjusting the user interface. Use of particular design elements influences users’ cognitive and affective perceptions of websites and can affect behaviors relevant to privacy.

We intend to present the results of an ongoing, experimental study designed to determine how strategies of “visceral notice” compare to traditional notice. Drawing on a rich literature in human-computer interaction, social psychology, and cognitive psychology, we examine whether website design features can instill in people a more accurate understanding of information practice than a privacy policy.

The experimental study features a between-participants design manipulating a single factor — design feature — with eight unique conditions. The eight design features include two instances of traditional notice: a link to a typical privacy policy, and a link to privacy policy featuring simplified language and an intuitive presentation of information. Visceral notice features were inspired by strategies identified in the social psychology literature to affect attitudes and behaviors associated with privacy. These strategies include self-awareness, informality, and anthropomorphism. A control condition with no privacy policy or design feature will also be evaluated.

Study participants will be assigned to use one of eight websites, each with a distinct design feature. Approximately 120 participants will be recruited online and complete the study at their personal computer, promoting external validity. Participants will be told they are evaluating a search engine, and must use the website’s search engine to find answers to a quiz.

Our study design enables the collection of both behavioral data and users’ cognitive and attitudinal evaluations of the site. We will measure user navigation behavior, the disclosure of personal data, such as home town, and the disclosure of incriminating personal experiences, such as downloading pirated music. Using a post-task questionnaire, we will determine participants’ mental models of the website’s data usage and policies, as well as participants’ evaluations of the website’s likely use of their personal information.

These measures will enable us to compare the effects of each of the eight design features on perceptions of privacy. We will compare traditional notice strategies with visceral notice strategies. While traditional notice is the current standard under the law, we anticipate visceral notice strategies will prove superior in eliciting accurate perceptions of the website’s information policies, and will generate less disclosive behavior. We will discuss the implications of the study’s results for both law and design.