Making Privacy Usable: Increasing Awareness and Empowering Users

Smartphones and the Internet have become integral parts of our lives and daily activities. This online economy is largely fueled by user data. Users are often not aware that their data is being collected, what it is used for, and the associated privacy implications. Websites and data brokers analyze browsing habits and purchases in order to profile users, to target advertising, and to potentially adjust prices or credit rates. Smartphone apps track the user's location or copy their contact lists while running in the background. Wearable devices, such as fitness and activity trackers, and the Internet of Things enable even more fine-grained monitoring of users. Privacy policies and notices are supposed to provide transparency of such data practices. However, these policies are often complex and difficult to understand, and most users do not read them. Constrained interfaces on mobile devices, wearables, and smart home devices exacerbate the issue. Users also have none or limited options to control their privacy, which leaves them helpless and in a state of resignation.

In this talk, I will provide an analysis of the challenges and hurdles that currently render privacy notices and control mechanisms ineffective, and discuss our work on designing and developing usable privacy mechanisms that make users aware of potential privacy issues, empower them to control their privacy, and help them make beneficial privacy decisions. Our approach combines the semi-automatic extraction of data practices from natural language privacy policies with user-centered design to provide users with relevant and actionable privacy information in the context of online browsing, smartphone apps, and the Internet of Things.

Dr. Florian Schaub is a postdoctoral fellow in the School of Computer Science at Carnegie Mellon University. His research interests include human factors of privacy, human-computer interaction, ubiquitous computing, and mobile security. He has a doctoral degree and Diplom in Computer Science from Ulm University, and a Bachelor in Information Technology (Multimedia Technology) from Deakin University, Australia. He is a IAPP Certified Information Privacy Professional (CIPP/US) and Privacy Technologist (CIPT). His research has been featured by international print and online media, such as the Wall Street Journal, The Guardian, Wired, New Scientist, and Technology Review; as well as on CNN, BBC, and Channel 4's Gadget Man.