Timing is everything?: the effects of timing and placement of online privacy indicators

ABSTRACT

Many commerce websites post privacy policies to address Internet shoppers' privacy concerns. However, few users read or understand them. Iconic privacy indicators may make privacy policies more accessible and easier for users to understand: in this paper, we examine whether the timing and placement of online privacy indicators impact Internet users' browsing and purchasing decisions. We conducted a laboratory study where we controlled the placement of privacy information, the timing of its appearance, the privacy level of each website, and the price and items being purchased. We found that the timing of privacy information had a significant impact on how much of a premium users were willing to pay for privacy. We also found that timing had less impact when users were willing to examine multiple websites. Finally, we found that users paid more attention to privacy indicators when purchasing privacy-sensitive items than when purchasing items that raised minimal privacy concerns.

REFERENCES

• 1: Mark S. Ackerman , Lorrie Faith Cranor , Joseph Reagle, Privacy in e-commerce: examining user scenarios and privacy preferences, Proceedings of the 1st ACM conference on Electronic commerce, p.1-8, November 03-05, 1999, Denver, Colorado, United States [doi>10.1145/336992.336995]
• 2: Adkinson, W., Eisenbach, J., and Lenard, T. Privacy online: A report on the information practices and policies of commercial web sites. Tech. rep., Progress&Freedom Foundation, 2002.
• 3: Annie I. Anton , Julia B. Earp , Qingfeng He , William Stufflebeam , Davide Bolchini , Carlos Jensen, Financial Privacy Policies and the Need for Standardization, IEEE Security and Privacy, v.2 n.2, p.36-45, March 2004 [doi>10.1109/MSECP.2004.1281243]
• 4: Simon Byers , Lorrie Faith Cranor , David Kormann, Automated analysis of P3P-enabled Web sites, Proceedings of the 5th international conference on Electronic commerce, p.326-338, September 30-October 03, 2003, Pittsburgh, Pennsylvania [doi>10.1145/948005.948048]
• 5: Lorrie Faith Cranor , Lawrence Lessig, Web Privacy with P3p, O'Reilly & Associates, Inc., Sebastopol, CA, 2002
• 6: Cranor, L.F., Byers, S., Kormann, D., and McDaniel, P. Searching for Privacy: Design and Implementation of a P3P-Enabled Search Engine. In Proceedings of the 2004 Workshop on Privacy Enhancing Technologies (PET2004) (May 26-26, 2004), pp. 314--328.
• 7: Lorrie Faith Cranor , Praveen Guduru , Manjula Arjula, User interfaces for privacy agents, ACM Transactions on Computer-Human Interaction (TOCHI), v.13 n.2, p.135-178, June 2006 [doi>10.1145/1165734.1165735]
• 8: Earp, J., Anton, A., Aiman-Smith, L., and Stufflebeam, W. Examining internet privacy policies within the context of user privacy values. Engineering Management, IEEE Transactions on 52, 2 (May 2005), 227--237.
• 9: Edelman, B. Adverse selection in online 'trust' certifications. In Proceedings of the 2006 Workshop on the Economics of Information Security (WEIS'06) (Cambridge, UK, 2006).
• 10: Serge Egelman , Lorrie Faith Cranor , Abdur Chowdhury, An analysis of P3P-enabled web sites among top-20 search results, Proceedings of the 8th international conference on Electronic commerce: The new e-commerce: innovations for conquering current barriers, obstacles and limitations to conducting successful business on the internet, August 13-16, 2006, Fredericton, New Brunswick, Canada [doi>10.1145/1151454.1151492]
• 11: Serge Egelman , Lorrie Faith Cranor , Jason Hong, You've been warned: an empirical study of the effectiveness of web browser phishing warnings, Proceeding of the twenty-sixth annual SIGCHI conference on Human factors in computing systems, April 05-10, 2008, Florence, Italy [doi>10.1145/1357054.1357219]
• 12: B. J. Fogg , Jonathan Marshall , Othman Laraki , Alex Osipovich , Chris Varma , Nicholas Fang , Jyoti Paul , Akshay Rangnekar , John Shon , Preeti Swani , Marissa Treinen, What makes Web sites credible?: a report on a large quantitative study, Proceedings of the SIGCHI conference on Human factors in computing systems, p.61-68, March 2001, Seattle, Washington, United States [doi>10.1145/365024.365037]
• 13: Julia Gideon , Lorrie Cranor , Serge Egelman , Alessandro Acquisti, Power strips, prophylactics, and privacy, oh my!, Proceedings of the second symposium on Usable privacy and security, July 12-14, 2006, Pittsburgh, Pennsylvania [doi>10.1145/1143120.1143137]
• 14: Nathaniel S. Good , Jens Grossklags , Deirdre K. Mulligan , Joseph A. Konstan, Noticing notice: a large-scale experiment on the timing of software license agreements, Proceedings of the SIGCHI conference on Human factors in computing systems, April 28-May 03, 2007, San Jose, California, USA [doi>10.1145/1240624.1240720]
• 15: Harry Hochheiser, The platform for privacy preference as a social protocol: An examination within the U.S. policy context, ACM Transactions on Internet Technology (TOIT), v.2 n.4, p.276-306, November 2002 [doi>10.1145/604596.604598]
• 16: Carlos Jensen , Chandan Sarkar , Christian Jensen , Colin Potts, Tracking website data-collection and privacy practices with the iWatch web crawler, Proceedings of the 3rd symposium on Usable privacy and security, July 18-20, 2007, Pittsburgh, Pennsylvania [doi>10.1145/1280680.1280686]
• 17: Milne, G.R., and Culnan, M.J. Strategies for reducing online privacy risks: Why consumers read (or don't read) online privacy notices. Journal of Interactive Marketing 18, 3 (Summer 2004), 54--61.
• 18: Trevor Moores, Do consumers understand the role of privacy seals in e-commerce?, Communications of the ACM, v.48 n.3, p.86-91, March 2005 [doi>10.1145/1047671.1047674]
• 19: Irene Pollach, What's wrong with online privacy policies?, Communications of the ACM, v.50 n.9, p.103-108, September 2007 [doi>10.1145/1284621.1284627]
• 20: Sherman, E. Privacy policies are great-for phds, September 4, 2008. http://industry.bnet.com/technology/1000391/privacy-policies-are-great-for-phds/.
• 21: Jennifer Sobey , Robert Biddle , P. C. Oorschot , Andrew S. Patrick, Exploring User Reactions to New Browser Cues for Extended Validation Certificates, Proceedings of the 13th European Symposium on Research in Computer Security: Computer Security, October 06-08, 2008, Málaga, Spain [doi>10.1007/978-3-540-88313-5_27]
• 22: TRUSTE. TRUSTe Fact Sheet, 2008. http://www.truste.org/about/fact_sheet.php.
• 23: Tsai, J., Egelman, S., Cranor, L., and Acquisti, A. The effect of online privacy information on purchasing behavior: An experimental study. In Proceedings of the 2007 Workshop on the Economics of Information Security (WEIS'07) (Pittsburgh, PA, USA, 2007).
• 24: Tara Whalen , Kori M. Inkpen, Gathering evidence: use of visual security cues in web browsers, Proceedings of Graphics Interface 2005, May 09-11, 2005, Victoria, British Columbia
• 25: Min Wu , Robert C. Miller , Simson L. Garfinkel, Do security toolbars actually prevent phishing attacks?, Proceedings of the SIGCHI conference on Human Factors in computing systems, April 22-27, 2006, Montréal, Québec, Canada [doi>10.1145/1124772.1124863]

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.1 MODELS AND PRINCIPLES
      H.1.2 User/Machine Systems

Additional Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)

General Terms:
Design, Experimentation, Human Factors, Security

Keywords:
mental models, privacy, privacy policies, timing, usable privacy and security, website indicators