Privacy policies as decision-making tools: an evaluation of online privacy notices

ABSTRACT

Studies have repeatedly shown that users are increasingly concerned about their privacy when they go online. In response to both public interest and regulatory pressures, privacy policies have become almost ubiquitous. An estimated 77% of websites now post a privacy policy. These policies differ greatly from site to site, and often address issues that are different from those that users care about. They are in most cases the users' only source of information.This paper evaluates the usability of online privacy policies, as well as the practice of posting them. We analyze 64 current privacy policies, their accessibility, writing, content and evolution over time. We examine how well these policies meet user needs and how they can be improved. We determine that significant changes need to be made to current practice to meet regulatory and usability requirements.

REFERENCES

• 1: Adkinson, W. F., Eisenach, J. A., and Lenard T. M. "Privacy Online: A Report on the Information Practices and Policies of Commercial Web Sites" Progress and Freedom Foundation, Washington DC. March 2002
• 2: Annie I. Antón , Julia Brande Earp , Angela Reese, Analyzing Website Privacy Requirements Using a Privacy Goal Taxonomy, Proceedings of the 10th Anniversary IEEE Joint International Conference on Requirements Engineering, p.23-31, September 09-13, 2002
• 3: BBBOnLine. "Third-Party Assurance Boosts Online Purchasing: BBBOnLine Privacy, Reliability Seals Increase Consumer Confidence; Privacy Remains Public's Chief Concern (survey summary)". Arlington VA, October 17, 2001.
• 4: Bellotti, V. and Sellen. A. "Designing for Privacy in Ubiquitous Computing Environments". European Conference on Computer-Supported Cooperative Work, ECSCW '93, Milan, Italy., ACM Press. 1993
• 5: Culnan, M. J. and Milne, G. R. "The Culnan-Milne Survey on Consumers & Online Privacy Notices: Summary of Responses". Washington DC: FTC, December 2001.
• 6: Paul Dourish , Victoria Bellotti, Awareness and coordination in shared workspaces, Proceedings of the 1992 ACM conference on Computer-supported cooperative work, p.107-114, November 01-04, 1992, Toronto, Ontario, Canada [doi>10.1145/143457.143468]
• 7: Flesch, M. "The Art of Readable Writing", Macmillan Publishing, 1949
• 8: Hochhauser, M. "Lost in the Fine Print: Readability of Financial Privacy Notices." Privacy Rights Clearinghouse, July 2001.
• 9: Jupiter Research, "Security and Privacy Data." FTC Security Workshop, May 20, 2002
• 10: Marc Langheinrich, Privacy by Design - Principles of Privacy-Aware Ubiquitous Systems, Proceedings of the 3rd international conference on Ubiquitous Computing, p.273-291, September 30-October 02, 2001, Atlanta, Georgia, USA
• 11: National Telecommunications and Information Administration. "A Nation Online: How Americans Are Expanding Their Use of the Internet" Washington, D.C. February 2002
• 12: Leysia Palen , Paul Dourish, Unpacking "privacy" for a networked world, Proceedings of the SIGCHI conference on Human factors in computing systems, April 05-10, 2003, Ft. Lauderdale, Florida, USA [doi>10.1145/642611.642635]
• 13: U.S. Children's Online Privacy Protection Act of 1998, Public Law No. 105--277, October 21, 1998.
• 14: U.S. Gramm-Leach-Bliley Financial Modernization Act of 1999, Public Law No. 106--102, November 1, 1999.
• 15: U.S. Health Insurance Portability and Accountability Act of 1996, Public Law No. 104--191, August 21, 1996.
• 16: U.S. Regulatory Fair Warning Act of 1999. H.R. 881 One Hundred Sixth Congress, June 29, 1999 478.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.2 User Interfaces (D.2.2, H.1.2, I.3.6)
          Subjects: Evaluation/methodology

Additional Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.4 Hypertext/Hypermedia
          Subjects: User issues

Keywords:
WWW, consent, e-commerce, privacy, readability, usability