# Towards Displaying Privacy Information with Icons

Leif-Erik Holtz, Katharina Nocun, Marit Hansen

► To cite this version:

Leif-Erik Holtz, Katharina Nocun, Marit Hansen. Towards Displaying Privacy Information with Icons. 6th International Summer School (ISS), Aug 2010, Helsingborg, Sweden. pp.338-348, 10.1007/978-3-642-20769-3_27. hal-01559458

HAL Id: hal-01559458

https://inria.hal.science/hal-01559458

Submitted on 10 Jul 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Towards displaying privacy information with icons

Leif-Erik Holtz<fnref n="1" />, Katharina Nocun<fnref n="1" />, Marit Hansen<fnref n="1" />

¹ Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstr. 98,
24103 Kiel, Germany
primelife@datenschutzzentrum.de

**Abstract.** European data protection regulation obliges every service provider to show a privacy policy on his web site. Many privacy policies are too long, too complicated to understand, and reading them is hardly appealing. To enhance the user's awareness on who is collecting and handling their personal data for what purpose and to depict core information of the policy, privacy icons could be used in addition to written policies. Further, specific privacy icons could be helpful for expressing possible, planned or performed data processing between individuals, e.g., in social networks.

**Keywords:** privacy icons, privacy policies, privacy pictograms, social networks

## 1 Introduction

Every person has an individual view on her privacy, what to protect and what information to share with others. Effective protection of informational privacy [1] requires clarity on the data processing and possible consequences for the individual so that rendering a decision on when to disclose which personal data to whom bases on correct information. However, users are rarely aware of the planned or actual data processing or other aspects possibly relevant to their privacy. Sometimes the necessary information is not given by the data controllers, but even if they show the legally demanded information in their web site's privacy policy, most users refrain from studying it.

This was the reason for proposals of machine-readable privacy policies that could be interpreted by the user's machine according to her preferences. The most popular attempt was the specification of P3P – Platform for Privacy Preferences by the World Wide Web Consortium [2]. Still, P3P or other policy languages that are being developed lack widespread implementations.

<footnote n="1">¹ The research leading to these results has received funding from the European Community's Seventh Framework Programme (FP7/2007-2013) under grant agreement n° 216483. The information in this document is provided “as is”, and no guarantee or warranty is given that the information is fit for any particular purpose. The above referenced consortium members shall have no liability for damages of any kind including without limitation direct, special, indirect, or consequential damages that may result from the use of these materials subject to any liability which is mandatory due to applicable law.</footnote>
The Art. 29 Data Protection Working Party pursued another approach: multi-
layered privacy policies [3] should display the most relevant information on the first
layer: the identity of the controller, the purposes of processing and any additional
information which in view of the particular circumstances of the case must be
provided beforehand to ensure a fair processing. This first layer, the so-called “short
notice”, should be directly visible to all users concerned. The second and third layer
would give more detailed information to interested persons. However, also this
approach is rarely implemented. Instead, privacy policies consist of legalese that is
not appealing to most users, and in addition they often lack preciseness or leave out
important parts to enable data protection authorities to assess whether the outlined
data processing is legally compliant or not.

Another approach of showing core aspects of a privacy policy is the approach of using (privacy) icons. In general icons are used to visualize specific statements or properties, e.g., for emergency fire exits or subway stations. Well designed icons may allow for quick comprehensibility for everybody who is not visually impaired. Note that often today's icons are not fully self-explaining, but can either be understood from the context they are used in or they belong to the general knowledge that has to be learned. Privacy icons should offer at least some valuable information on a first-glance basis for users and point to core issues related with the processing of data in a given case.

The PrimeLife project investigates in designing such icons for different scenarios and testing them with users [4]. This text will provide insight into PrimeLife's work in progress on privacy icons. It is organized as follows: Since various privacy icon sets have been proposed in the last few years, section 2 will discuss related work. Section 3 shows some privacy icons that are currently being evaluated: some are designated to be used in e-commerce or other classical client-server scenarios, others are rather relevant in social networks or in peer-to-peer settings. Section 4 provides first results of a user test and an online survey for evaluation of alternative privacy icons in the PrimeLife project. Section 5 summarizes the results and gives an outlook.

## 2 Related work

“Privacy icons” are understood as simplified pictures expressing privacy-related statements. Various areas of use can be distinguished [5]:

1. statements on results of data protection audits or similar evaluations concerning informational privacy relevant components of data processing, e.g., privacy seals or trust marks,

2. statements on how well a situation matches the privacy preferences of a user, e.g., Cranor's PrivacyBird for P3P [6],

3. statements from privacy policies on planned or performed processing of potentially personal data or on guarantees concerning the use of these data, e.g., proposals from Rundle [7], Mehldau [8], Helton [9] and Raskin [10] as well as the evaluative approach in the KnowPrivacy report [11],

4. statements on how personal data may be used by others, e.g., Bickerstaff strengthening the user's perspective and proposing "Privacy Commons"
analogue to “Creative Commons” [12], an icon set tailored to users in social
networks by Iannella and Finden [13], or the Privicon proposal that senders
of e-mails should be able to express easily how recipients should handle the
message [14].

Except for some trust marks and certain security-related icons, e.g., the SSL lock in web browsers showing the encryption status, none of the icon proposals in the privacy area has gained much outreach, yet. In addition, legal departments may advise service providers against implementing privacy icons in addition to (or even instead of!) their policy because they cannot be as expressive as the privacy policy which may cause a misunderstanding by users or supervisory authorities. However, current work being done on privacy icons does not aim at expressing all possible privacy-related aspects by these pictograms and thereby substitute the privacy policy. It is even pointed out that icons may be valuable for illustrating privacy policies to help users in understanding the text of the policy as well as getting used to the icons and learning on the fly what the icons stand for [4].

Research on icons especially for social networks that combine both pictograms for the privacy policy of the provider and pictograms for expressing the peer-to-peer aspects of social networks are still in the early stages of development [13].

3 Approaches to implement privacy icons

Privacy icons could have a vast area of usage: for indicating rights and limitations for
own data provided via e-mail, social networks or blogs, for web sites showing
prominently their illustrated privacy policy, for web sites providing machine-readable
policies to be interpreted by the user's software, or even for third-party services
commenting others' privacy policies [e.g., 11].

Today, the use of icons alone, i.e., without a written privacy policy spelling out the details, cannot be a sufficient substitute for the information that has to be provided to the user. Thus, privacy icons can be used in association with a written privacy policy. It is important to note that the documents from the Art. 29 Working Party such as [3] do not oppose the idea of icons. Catchy icons may be more attractive and informative for a large group of people than lengthy texts in a technical or legal language.

In the PrimeLife project icon sets have been developed for general use as well as
for specific use in social networks, as exemplarily shown in the following sections.

3.1 Icons for general usage

The developed icon set for general usage includes categories like types of data,
purposes and data processing steps. Fig. 1 shows a few examples of icons for general
usage.
<figure><img src="image_2.png" /><figcaption>Fig. 1. Excerpt of possible icons for general usage</figcaption></figure>

## 3.2 Icons for an e-commerce scenario

An icon set in an e-commerce scenario or other client-server applications dealing with personal data should tackle data types that usually play a role in these settings, deal with timely erasure of data (e.g., if IP addresses are stored for a short period of time) and comprise icons for specific purposes such as shipping, cf. Fig. 2. The purpose “legal obligations” does not inform users to a sufficient extent about the exact purpose, but it calls for getting more information on at least the specific regulation obliging the data controller.

<figure><img src="image_3.png" /><figcaption>Fig. 2. Excerpt of possible icons in an e-commerce scenario</figcaption></figure>
## 3.3 Icons for a social network scenario

In social networks additional privacy-related statements are helpful for users, in particular to visualize who – mostly in addition to the provider in the social network – will get access to which information or what happens to their data on the server of the social network [13]. Fig. 3 deals with possible icons for recipients of data pieces of social network users.

<figure><img src="image_4.png" /><figcaption>Fig. 3. Excerpt of possible icons in a social network scenario</figcaption></figure>

These icons could also be used in combination with configuring privacy settings, e.g., to directly select individuals that may or must not get access to personal data. In addition they may work as reminder whenever the user looks at her profile.

Note that it is work in progress: The selection of icons in Fig. 3 is an excerpt from different strands of icon development where alternatives are evaluated in user tests.

## 4 Online survey and first test results

Privacy icons should allow for quick comprehension by all possible groups of users regardless of their cultural or social background. The different constructions of privacy and individual freedom should not hamper grasping the meaning of icons. Social factors like education and age must not restrict their user-friendliness. Furthermore, it should be possible to understand the icons within different legal frameworks.

In order to create icons that are generally understandable by an international target group, the employment of symbols which are not limited to certain areas or countries is crucial. The shape of such icons might serve as an example here: the icons that have been developed and tested have a circular shape and not, e.g., a triangular shape that is widely associated with warning symbols. The developed icons also refrain from
color use, but are simply black and white because colors like red, orange or yellow often have a warning function, too. Further, since some users are color-blind, the correct interpretation of icons should not depend on usage of colors.

Moreover, the icons should be designed in a fashion that enables a thorough depiction of information. Varied icon sets have been designed and evaluated in the PrimeLife project. One test with about 20 students from Sweden and China was performed at Karlstad University (KAU) in Sweden. The PrimeLife project has also assessed the privacy icons by way of an online survey, interviewing 70 participants from at least ten different countries.

The test results from KAU plead for the assumption that the icons shown in Fig. 4 seem to be good approaches.

<figure><img src="image_5.png" /><figcaption>Fig. 4. Excerpt of icons for general usage tested by KAU</figcaption></figure>

The results from the online survey showed similar but in particular more granulated results. For instance, the participants were asked to decide between two alternative icons or to rate them according to their understandability, clearness, and feasibility. But most importantly, every question left enough room for the interviewees to add comments or suggestions of their own and to elaborate on their points of critique or approval.

The survey returned occasionally quite surprising results. Some icons which were deemed rather suitable by the developers were rejected by the interviewees. However, the major part of the survey outcome revealed that the development of such icons were well worth the effort.

The icon for shipping might serve as a good example for an internationally comprehensible icon. In the survey an alternative icon was presented to the participants showing a posthorn (cf. Fig. 5). A few hundred years ago, the postal service was characterized by blowing a posthorn, i.e., a bugle that served as a widely noticeable audio signal. Even later when the posthorn was not used any more by the postal service, its picture can be found on letterboxes, post office vans or in company logos of public or private postal services in least in many European countries. Although most of the participants of the survey understood the meaning of this symbol, they doubted that users from abroad would be able to, since they lacked that specific knowledge. For this reason, the icon depicting a parcel was preferred by the majority of the interviewees. This example stresses the importance of knowledge regarding the historical background of some symbols, for instance. While they
seemed to be perfectly suitable inside certain areas or countries, they were deemed inappropriate for the integration into an internationally standardized set of privacy icons.

<figure><img src="image_6.png" /><figcaption>Fig. 5. Icons for shipping</figcaption></figure>

The icons for payment data (cf. Fig. 6) and medical care (cf. Fig. 7) show further examples of rather unapt icons. While the icons presented in Fig. 6 and Fig. 7 on the left side returned a very good rating, the alternative suggestions were seen as unsuitable. The accompanying comments revealed that the interviewees thought the efforts involved in making these icons understandable in an international context stood in no relation to the possible advantages of such an endeavor. The alternative icons contained various symbols which were closely designed related the meaning of health care or money respectively in several areas of the world. But the participants felt rather confused about different symbols.

<figure><img src="image_7.png" /><figcaption>Fig. 6. Icons for payment/banking data</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Fig. 7. Icons for medical data</figcaption></figure>

The survey showed that instead of gaining from this fusion, the icons rather lost the ability to transfer the intended message. For example, the depiction of different currencies made the participants think that only these three major currencies were accepted. The alternative icon for medical data was criticized for being too crowded.

In order to create icons that are generally understandable by users of all ages, it is crucial to employ symbols that are not limited to a specific time or technology used in a certain period of time. This might be depicted with the example in Fig. 8: The symbol for storage consists of a floppy disk pictogram. This icon got a good rating in

<footnote n="2">² The approval rates are relative values compared to alternative icon proposals.</footnote>
the KAU test. Although this icon was very easy to recognize and to link to the process of data storage, most participants of the online survey still felt uncomfortable about it. They argued that younger generations of internet users might not be used to a floppy disk pictogram since they had never used this storage medium and preferred CD-ROM or USB devices instead. Because of this critique most survey participants rated this icon as inadequate.

<figure><img src="image_9.png" /><figcaption>Fig. 8. Icon for storage</figcaption></figure>

In order to create icons which are easily as well as intuitively recognizable, the symbols employed must be as simplified as possible. Especially when there is only very limited space for an icon, the recognizability of such icons must still be ensured. Thus, a high degree of simplification is essential. Some comments therefore suggested to concentrate on certain aspects of an icon. For instance, one of the icons meaning pseudonymization depicts a person wearing a mask. Several participants proposed to utilize only the mask instead and to employ simplifications rather than detailed depictions (cf. Fig. 9).

<figure><img src="image_10.png" /><figcaption>Fig. 9. Icon for pseudonymization</figcaption></figure>

In order to clarify that every privacy icon is part of a larger set of icons, they must also adapt a common design. Some sets of icons which were presented in the survey transferring the same messages used different margins or varied in quality of design (cf. Fig. 10). This was perceived as highly suggestive. Therefore, it is required to define certain standards – such as a circular shape – for all basic parameters of the design in order to standardize their appearance.

<figure><img src="image_11.png" /><figcaption>Fig. 10. Different design styles</figcaption></figure>
The survey has not only supported the endeavours to find crucial aspects for the development of an internationally standardized set of icons, but has also revealed that the previous efforts had been fruitful. There were a couple of icons that were perceived as outstanding ways of depicting complex content by more than three quarters of the participants (cf. Fig. 11). The high approval rate might testify to the success of one of the project's goals, namely the depiction of complex scenarios of data processing in online services.

<figure><img src="image_12.png" /><figcaption>Fig. 11. Examples for very well fitting icons</figcaption></figure>

The intermediate results of the tests indicate shortcomings of the existing approaches as well as good solutions and will therefore help developing final icon sets. Future surveys might help to identify further suitable icons and to develop an overall concept of privacy icons which could enhance users' control of their privacy management in day-to-day life.

Still there are some predicaments for a significant result which are important for the design of future surveys. The number of questioned male and female participants should be balanced in order to be representative for the population. Also people of every age should be asked to prevent difficulties in understanding for certain groups. Furthermore the set should include interviewees from different cultures and countries as well as people of different educational background to guarantee the significance of the results on a wider scale. Taking these aspect in consideration, future surveys will improve the efforts to create a set of icons that fits to the scope and the scale of the intended purposes and help to make privacy issues better understandable for the users of the World Wide Web.

# 5 Conclusions and outlook

Privacy icons may be important means of conveying relevant information about the processing of personal data to a user and thereby enhance her awareness concerning her privacy. Also there are several obstacles when trying to develop and promote icon schemes that are understandable world wide, the amount of research groups working on that topic and exchanging their ideas looks promising for getting at least a few – hopefully standardized – icons in at least some specific areas. However, clarity on the meaning and extent of legal binding should be achieved.

The icons that are being developed in the project PrimeLife have been evaluated in user tests that involve individuals from different cultures (e.g., Swedish and Chinese users). These tests confirm that indeed there may be cultural differences in understanding specific icons, e.g., the interpretation of a posthorn in the meaning of
postal services was not understood by the Chinese test users. The preliminary results show that the large icon sets should be reduced to that extent and complexity that interested users will be able to understand and to deal with. The usability should be improved, among others, by providing information about the icons' meaning via the mouse-over function and links to the concerning part of the written privacy policy. In the next iteration, the improved icon sets and proposals for their integration in applications will be evaluated again and put forward for public discussion.

Special attention will be given to possibilities of combining the icon approach with machine-readable service policies and user preferences. The development in this research field over the last decade, starting from the work on P3P [2], has meanwhile led to the PLING working group with ongoing discussion on languages and frameworks as well as their interoperability [14]. While the singular use of either privacy icons or machine-readable policies have already some advantages, their combination can be even more fruitful, provided that their semantics including legal effects and conditions are clear, service providers and system developers see the benefit, and at best the data protection authorities give their blessing.

## References

1. Solove, D.: Understanding Privacy. Harvard University Press (2008)

2. Platform for Privacy Preferences (P3P) Project: P3P1.0 Specification, W3C Recommendation 2002 / P3P1.1 Specification, W3C Working Group Note 2006 http://www.w3.org/P3P/ (2002/2006)

3. Art. 29 Working Party: Opinion 10/2004 on More Harmonised Information Provisions, WP 100, 11987/04/EN, November 2004. Available at http://ec.europa.eu/justice_home/fsj/privacy/docs/wpdocs/2004/wp100_en.pdf (2004)

4. Fischer-Hübner, S., Wästlund, E., Zwingelberg, H. (eds.): UI prototypes: Policy administration and presentation version 1. Deliverable D4.3.1 of the EC FP7 project PrimeLife, http://www.primelife.eu/images/stories/deliverables/d4.3.1 ui prototypes- policy_administration_and_presentation_v1.pdf (2009)

5. Hansen, M.: Putting Privacy Pictograms into Practice – A European Perspective. In: Fischer, S., Maehle, E., Reischuk, R. (eds.): Proceedings of Informatik 2009 – Im Focus das Leben. LNI P-154, pp. 1703–1716. Köllen Verlag, Bonn (2009)

6. Cranor, L.F.: Privacy Policies and Privacy Preferences. In: Cranor, L.F., Garfinkel, S. (eds.): Security and Usability – Designing Secure Systems That People Can Use. O’Reilly, Sebastopol, pp. 447–471 (2005)

7. Rundle, M.: International Data Protection and Digital Identity Management Tools. Presentation at IGF 2006, Privacy Workshop I, Athens, http://identityproject.lse.ac.uk/mary.pdf (2006)

8. Mehldau, M.: Iconset for Data-Privacy Declarations v0.1. http://netzpolitik.org/wp- upload/data-privacyicons-v01.pdf (2007)

9. Helton, A.: Privacy Commons Icon Set. http://aaronhelton.wordpress.com/2009/02/20/privacy-commons-icon-set/ (2009)

10. Raskin, A.: Privacy Icons – Making your online privacy rights understandable. Project web site http://www.drumbeat.org/project/privacyicons (2010)

11. Gomez, J., Pinnick, T., Soltani, A.: KnowPrivacy, June 1, 2009, http://www.knowprivacy.org/report/KnowPrivacy_Final_Report.pdf – therein: Policy Coding Methodology: http://www.knowprivacy.org/policies_methodology.html (2009)
12. Bickerstaff, R.: Towards a Commons Approach to Online Privacy – a “Privacy Commons”. Presentation at SCL Information Governance Conference 2008, London, May 2008. Available at http://www.healthymedia.co.uk/scl-2008-may-governance/pdf/scl-2008-05-privacy-commons-roger-bickerstaff.pdf (2008). Updated presentation: Towards a Commons Approach to Online Privacy for Social Networking Services – a “Privacy Commons”.
http://www.ico.gov.uk/upload/documents/pio_conference_2009/roger_bickerstaff_birdand_bird_presentation.pdf (2009)

13. Iannella, R., Finden, A.: Privacy Awareness: Icons and Expression for Social Networks. 8th International Workshop for Technical, Economic and Legal Aspects of Business Models for Virtual Goods incorporating the 6th International ODRL Workshop, Namur, Belgium.
http://semanticidentity.com/Resources/Entries/2010/7/1_Virtual_Goods_+_ODRL_Works hop_2010_files/vg+odrl2010-ws-paper.pdf (2010)

14. Privicons project. http://www.privicons.org/projectsicons/ (2010)

15. W3C Policy Languages Interest Group (PLING).
http://www.w3.org/Policy/pling/wiki/Main_Page (2010)