# Extending Comparison Shopping Sites by Privacy Information on Retailers

Ulrich König, Marit Hansen

► To cite this version:

Ulrich König, Marit Hansen. Extending Comparison Shopping Sites by Privacy Information on Retailers. 7th PrimeLife International Summer School (PRIMELIFE), Sep 2011, Trento, Italy. pp.171-186, 10.1007/978-3-642-31668-5_13. hal-01517611

HAL Id: hal-01517611

https://inria.hal.science/hal-01517611

Submitted on 3 May 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Extending Comparison Shopping Sites by Privacy Information on Retailers

Ulrich König and Marit Hansen

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstr. 98,
24103 Kiel, Germany
{ukoenig, marit.hansen}@datenschutzzentrum.de

**Abstract.** On the Internet, comparison shopping sites have become important starting points for customers who aim at buying goods online. These sites compare prices of all kinds of products, and several of them give information on shipping costs or on the reputation of the online shopping sites offering the goods, gathered from previous customer experiences. However, currently there is no quick and easy way for customers to compare privacy criteria regarding these online shops or to match whether a shop fulfils one’s privacy preferences. Instead, the customer needs to read and understand each privacy policy if she is interested in privacy-relevant properties of the shop. This paper introduces a method to compare privacy-relevant properties of online shops insofar they can be automatically assessed. It shows how this functionality can be incorporated in the output of comparison shopping sites when listing products and retailers for a customer’s search.

*Keywords:* Comparison Shopping Site, Price Comparison Service, Privacy Criteria, Transparency, Online Shopping, Retailer.

## 1 Introduction

Users on the Internet often start their sessions at dedicated entry points, which they repeatedly visit, in particular search engines offered by big companies or other websites with integrated search functionality. For online shopping, comparison shopping sites – also known as “price comparison services”, or simply “price engines” – perform specialised searches on products, showing the lowest prices and links to the retailers. In addition to the price of the product and costs for shipping, some comparison shopping sites collect and show information on each retailer gained from prior user experiences, e.g., whether the customers were satisfied, which problems occurred and how well the customer service worked. Sometimes evaluation reports of the products are shown, too. Therefore, comparison shopping sites aim at providing the users all necessary information to decide where to buy which product in a clear way.

We believe that the transparency on the currently given characteristics of the product and the retailer could easily be extended by information on the privacy
policy of the retailer or other privacy-relevant properties that may play a role
in online shopping. In this text, we describe our concept on how to identify the
most relevant and at the same time easily accessible privacy-related factors, how
the comparison shopping site can collect this information and how the data can
be presented to interested users in an understandable way.

The text is organised as follows: After having mentioned related work in
Section 2, Section 3 explains in more detail the setting of users employing com-
parison shopping sites for purchasing goods at retailers, the roles of the parties
involved and their various interests. In Section 4, we flesh out our approach,
followed by an exemplary implementation in Section 5. The result is visualised
in a user interface mock up, shown in Section 6. Finally, Section 7 summarises
our findings and gives an outlook.

## 2 Related Work

Since several years, transparency has been an important area of privacy research. This comprises transparency of privacy properties as well as methods to enhance transparency to improve the individual's understanding of how personal data are being handled. Apart from transparency tools in general [1] and [2], specific implementations deal with transparency of statements in privacy policies of websites, e.g., Cranor's approach of the "PrivacyFinder", a search engine that matches the Platform for Privacy Preferences (P3P) policies with the user's preferences [3]. This is motivated by the effort for reading and understanding privacy policies [4]. Further, the projects PRIME and PrimeLife have proposed practical approaches to improve transparency of privacy properties, among others, the information given to customers in the Send Data dialog of the PrimeLife prototype [5] and the work on policies and icons [6]. Exemplary listings can be found in the Appendix.

## 3 Taking a Closer Look at Our Setting

In our setting, a customer uses a comparison shopping site, operated by a
provider, to search for a specific product. Basing on the information in its
database, the comparison shopping site shows the customer a list with vari-
ous possibilities where to purchase the product at what price. For each entry
in the list, an evaluation result and a link are added so that the customer can
browse directly to the retailers of choice. The evaluation result is calculated us-
ing a "privacy evaluation function" provided by the privacy evaluation function
provider (PEFP). Such a function may take into account an assessment provided
by one or more certain privacy evaluation providers (PEPs).

The particular roles and interests of the parties involved – customer, provider
of a comparison shopping site, retailer, privacy evaluation function provider and
privacy evaluation provider – are described in the following subsections. Subse-
quently, the interactions of the different roles are illustrated.
## 3.1 Customer

The customer's interest is to optimise the purchase of a product that is offered by multiple retailers under different conditions. Thus, the customer would like to quickly understand the differences in the offers to decide where to buy the product (or to refrain from buying it at all). The decision criteria can be highly individual, but usually comprise:

- the total price, being calculated from the product price (including VAT) plus costs for shipping and payment,

- the provided options on shipping methods and payment methods,

- the reputation of the retailer, in particular regarding trustworthiness, reliability, or customer support, based on, e.g., ratings of other customers, personal experiences and public appearance,

- availability of extra services such as a 30 days money-back guarantee,

- the registered seat of the retailer and the jurisdiction for the purchase.

Currently no comparison shopping site displays explicit information on how personal data of a customer will be processed when visiting a retailer's website or buying the product. Today, the customer has to look up this information directly at each retailer's site. This is a cumbersome process because the customer would have to read each privacy policy as well as the terms and conditions, and she would have to compare the parts she is interested in. Very few users do this. Here it would be good if at least the most relevant information could be provided by the comparison shopping site so that these entries can easily be compared, too. We believe that – as a side benefit – this would have a positive effect on the general awareness of privacy issues on the Internet. However, usability is crucial here: if more information is provided in a too complex way that is hard to understand for users, they may stop using that comparison shopping site.

## 3.2 Provider of a Comparison Shopping Site

Comparison shopping site providers have a twofold interest: Firstly, they aim at offering a good and reliable service, and secondly, this service has to be adequately funded. For a good service quality, they need to collect up-to-date information on products offered by a variety of retailers, including prices and some information on the purchase process. There are multiple potential sources of the information: It can be provided directly from the retailers, or it can come from affiliate networks that put together the data, or the information can be collected by crawlers, or the sites can use crowdsourcing mechanisms, i.e., information contributed from their visitors. In our setting, we assume that crawlers are being used, but our elaborations do not depend on that.

Most comparison shopping sites do not charge the users for their service, but get payments from the retailers if the users choose their products via the site. The various comparison shopping sites compete for customers who click on a link to a retailer. Therefore some sites offer supplementary information as a benefit for the users, e.g., by adding evaluation reports on the product
from organisations or customers. Privacy information could be another option
to gain a competitive advantage. However, right now this information is not
easily available for comparison shopping sites in their established data collection
processes, but this could change, e.g., if the retailers are asked explicitly for
providing the necessary data. Again, the information would have to be shown in
a way that does not scare off users because they are too complex.

Note that in this text we do not tackle the risk for users that the comparison
shopping sites profile the users by linking their different searches, their purchases
(as being informed by the retailers) and their behaviour in selecting entries
from the shown list on products and retailers. This risk could be reduced if the
users employ anonymising tools so that the linkage between different transactions
cannot be done by the comparison shopping site. Also, users who feel uneasy
when working with one comparison shopping site may refrain from using that
service at all and choose other sites instead.

3.3 Retailer

Since comparison shopping sites have evolved into important entry points for
potential customers, the retailers have an interest to be listed in one or more
of their services. They expect that the information about them and their prod-
ucts is accurate and up-to-date. Retailers that have special offers for customers
are interested in getting this information conveyed to potential customers via
the comparison shopping site. This means that retailers that would like to ad-
vertise their customer-friendly privacy properties could profit when comparison
shopping sites display that information.

3.4 Privacy Evaluation Function Provider

The privacy evaluation function provider (PEFP) offers the function to assess
the retailers. A PEFP should be an independent person or organisation, but it
could also be another retailer. There is a reasonable chance that, e.g., consumer
assistance offices will provide such a function.

Since the provided function has to process all the provided retailer data in the
same way, it is not easy to manipulate the evaluation function so that only one
particular retailer will get a good rating without being noticed. The comparison
shopping site would provide a customer feedback system to evaluate and rate
the different privacy evaluation functions. This could influence the decision of
the customer which privacy evaluation function(s) to choose.

Note that there is a risk that retailers adopt their systems to yield good results
in the automatic assessment without really behaving privacy-friendly. However,
it is already the case that users cannot be sure that statements in a privacy
policy are realised in the promised way. At least the privacy evaluation function
should be documented in a way that enables all parties involved to understand
the criteria, the assigned values and their weighting factors – this would also
enable a discussion on the quality of the function and could lead to the provision
of improved versions. Also, individualised functions may be possible. Another
option is to incorporate ratings by a privacy evaluation provider.

**3.5 Privacy Evaluation Provider**

Privacy evaluation providers evaluate the retailer's privacy practice. This could result in a privacy seal, based on the assessment of defined criteria. Depending on the privacy evaluation provider, one or more marks may be assigned to different properties. These marks – or the existence of a valid, acknowledged privacy seal – can be parameters in the privacy evaluation function provided by the PEFP.

3.6 Interaction Overview

How these five major roles interact in the process of dealing with a customer's
request to a comparison shopping site, is shown in Figure 1: Beginning with
the customer's request, the comparison shopping site offers the choice of a pri-
vacy evaluation function provider so that the preferred function will be applied.
Another option, not displayed in the figure, would be a direct relation between
customer and privacy evaluation function provider to use the respective func-
tion. The comparison shopping site applies the privacy evaluation function from
the PEFP to the database that contains crawled entries about the products
and retailers, including data on privacy-relevant properties. In case the privacy
evaluation function works with parameters gathered from privacy evaluation
providers, these are fetched as well. Finally, the comparison shopping site dis-
plays the assembled response to the customer's request. Further, an optional
feedback from the customer on the quality of the privacy evaluation function
may be transferred via the comparison shopping site to the PEFP.

<figure><img src="image_2.png" /><figcaption>Fig. 1. Interaction between different roles.</figcaption></figure>

The sequence chart, depicted in Figure 2, clarifies how the various requests
are transmitted and dealt with. It distinguishes between mandatory and optional
communication and shows where caching may be possible.
<figure><img src="image_3.png" /><figcaption>Fig. 2. Interaction between different roles as sequence chart.</figcaption></figure>

## 4 The Privacy Evaluation Function – a First Approximation

An easy way for a privacy evaluation function which result should be displayed would be to shift the effort to professional auditors. However, the mere display of an awarded privacy seal would not solve the problem because users would have to be experts to compare different seals and to understand which parts of the service or website belong to the target of evaluation and which parts are out of the seal's scope. Further, the penetration of the market with meaningful privacy seals, i.e., with clearly defined and openly accessible criteria and quality assurance in its process, is currently rather low.

So if privacy seals can only be an optional cornerstone, the privacy evaluation function has to be given more thought: The set of privacy-relevant properties to be evaluated should reflect what is (or should be) most relevant for users when deciding on the retailer or the purchase process. For practical reasons it is important which data can be easily provided and interpreted by comparison shopping sites and held up-to-date.

The information needed in order to evaluate privacy-relevant properties of retailers can be divided into two categories:

1. The first category contains the information that can be gathered without the co-operation of the shopping sites. So the website can be checked for the needed information in a fully automated, semi-automatic or manual process.

2. The second category comprises the information that has to be provided by the retailers itself. The incentive for retailers to provide the needed information could be to get better attention by customers on the comparison shopping site.
It seems reasonable to strive for gathering the information from the retailers' sites as described in Table 1, divided into the sections IT security information, data protection information, contact information, and evaluation information.

<table><caption>**Table 1.** How information about retailer can be gathered: A = automatically; S = semi-automatically; M = manually; P = has to be provided by retailer.</caption><thead><tr><th>Type of information</th><th>Attributes</th><th>How to gather</th></tr></thead><tbody><tr><td colspan="3"><strong>IT security information</strong></td></tr><tr><td>Transport layer security</td><td>values={ whole website, checkout process, none}</td><td>A</td></tr><tr><td>IT audit, scope, status</td><td>values={ IT Baseline Protection (BSI), ISO 2700x, COBIT, ITIL}</td><td>M/P</td></tr><tr><td colspan="3"><strong>Data protection information</strong></td></tr><tr><td>Data protection officer, contact information</td><td></td><td>S</td></tr><tr><td>Audit/privacy seal, scope</td><td></td><td>S</td></tr><tr><td>Cookies</td><td>values={session/permanent, first-party/third-party, purpose (M)}</td><td>A</td></tr><tr><td>Web tracking</td><td></td><td>S</td></tr><tr><td>P3P privacy policy</td><td></td><td>A</td></tr><tr><td>Human-readable privacy policy</td><td></td><td>S</td></tr><tr><td>Downstream data controller</td><td>Who, purpose, data retention period</td><td>P</td></tr><tr><td>Collected data</td><td>What data (M), purpose (P), data retention period (P)</td><td>M/P</td></tr><tr><td colspan="3"><strong>Contact information</strong></td></tr><tr><td>E-mail</td><td></td><td>S</td></tr><tr><td>Phone</td><td></td><td>S</td></tr><tr><td>Address</td><td></td><td>S</td></tr><tr><td>Type of business entity</td><td></td><td>S</td></tr><tr><td>Person in charge</td><td></td><td>S</td></tr><tr><td colspan="3"><strong>Evaluation information</strong></td></tr><tr><td>Wrong data provided by retailer</td><td></td><td>M</td></tr></tbody></table>

## 5 Implementing a Privacy Evaluation Function for a Retailer's Privacy-Relevant Properties

A related approach from another area on the Internet is the Firefox Plugin “Adblock Plus” for blocking advertisements on websites. It shows the benefit of evaluation methods that are constantly adapted. Here, the rules what to block are stored in dedicated blocking lists that users can subscribe from third parties. These lists differ in target language, purpose what to block and the list creators'
opinion what to block. They are frequently updated in order to adapt to changes
in the advertisements.

The lesson learnt from Adblock Plus is to choose a dynamic approach instead
of sticking to a static algorithm that can be tricked more easily. Instead, the
provision of an interface so that third parties can create their own rules to
evaluate privacy-relevant properties of retailers, leads to flexible solutions where
customers can choose which rule(s) should be applied. It should also be possible
to combine different rules from different organisations.

## 5.1 Interface Definition

To compute the evaluation, a more complex grammar than that for ad blocking
is needed. JavaScript with a reduced instruction set might be fitting the purpose.
JavaScript is easy to use, runs in most browsers and can be executed on the server
side. To provide data to the evaluation function, JavaScript Object Notation
(JSON) will work well together with JavaScript.

An evaluation function, provided by a privacy evaluation function provider,
could look like Listing 1.9 (for the listings, see Appendix). This function would be
called for every retailer. It could run in the customer's browser or on the server of
the comparison shopping site. To prevent cross-site scripting or similar attacks,
the JavaScript syntax has to be limited to very basic functions before execution.
In Listings 1.1 to 1.7, a possible subset of JavaScript is described that could be
used for the evaluation function. It includes all needed mathematical methods,
operators, and constants. In addition, all the string manipulation methods are
included. Loops and branches are also possible, but it is advised to limit the
execution time for the processing time of one shop to a defined value.

## 5.2 Information Flow for the Evaluation Code

To provide or update the evaluation function, it has to be transferred from
the privacy evaluation function provider to the comparison shopping site. The
comparison shopping site will process information gathered from the retailer's
site with the transferred function and store the result in its database. If the
customer selects this specific evaluation function, the results will be displayed
accordingly.

In principle, it is also possible to process the function in the customer's
browser. This makes sense, e.g., for the development of new evaluation func-
tions, or if a customer would like to apply a function that is not supported by
the comparison shopping site for whatever reason. In this case, the compari-
son shopping site (or each contemplable retailer) has to provide the information
gathered from the retailer's site. To achieve this, the same JSON format could
be used, as employed for the comparison shopping site's internal processing.

## 5.3 Example of an Evaluation Function

This subsection shows an example how essential privacy-relevant properties could
be evaluated. Our approach breaks down the data into small groups. Every group
has a coefficient to determine the impact factor of the single group result into the
final result as shown in 3. The result of every group consists of a tuple with two

<figure><img src="image_4.png" /><figcaption>Fig. 3. Elements of the example evaluation function. Values: coefficient / limit.</figcaption></figure>

numbers. The first number is called “value” and contains the actual result of the
evaluation. The second number called “limit” and contains an upper bound for
the complete evaluation function. Both digits are floating point numbers. The
interval between 1 and −1 is used to return the evaluation score. 1 is the best
possible score, expressing an overall good result of the evaluation of privacy-
relevant properties, while 0 represents a bad score. A value of −1 might be used
to express an assessment result that is definitely below the threshold and stands
for a no-go. A “value” bigger than 1 or smaller than −1 is used to express that
the result of the group should be ignored. An empty stub for a group can be
found in Listing 1.9. The code to combine the group result is shown in Listing
1.8.

To finally get a result, the groups must be defined. The example shown in
Table 2 chooses a fairly simple approach to illustrate the method, but much more
complex scenarios are possible. Note that in the example only information that
can be detected automatically is being used.

5.4 Other Possible Properties to be Evaluated

The exemplary evaluation function described earlier is just a very basic approach,
pursuing the objective to be as effortless as possible. Forward-thinking, it is
desirable to introduce a more sophisticated evaluation. A first step toward this
aim could be to create more complex “groups” as mentioned above.

The purposes for data transfer are a good example for more complex at-
tributes to evaluate: In most shopping scenario cases the customer has to trans-
fer some personal data to the retailer. These data are being used to process the
shopping transaction. The retailer also has to store some information for legal
reasons. Nevertheless, many retailers store more than the minimal information,
<table><caption>**Table 2.** Evaluation of single groups of retailer attributes</caption><thead><tr><th></th><th></th><th></th></tr></thead><tbody><tr><td>Presence of human-readable privacy policy</td><td></td><td>Coefficient = 0.01</td></tr><tr><td>Yes</td><td>Value = 1</td><td></td></tr><tr><td>No</td><td>Value = 0</td><td>Limit = 0.01</td></tr><tr><td>User tracking usage</td><td></td><td>Coefficient = 1</td></tr><tr><td>User tracking is used</td><td>Value = 0</td><td>Limit = 0.1</td></tr><tr><td>User tracking is not used</td><td>Value = 1</td><td></td></tr><tr><td colspan="3">This is a very basic approach. A more sophisticated solution could distinguish between legally compliant tracking services, e.g., with an appropriate privacy seal, and privacy-invasive tracking services.</td></tr><tr><td>3rd Party Cookies usage</td><td></td><td>Coefficient = 0.75</td></tr><tr><td>Long-lasting Cookies are used</td><td>Value = 0</td><td></td></tr><tr><td>Session Cookies are used</td><td>Value = 0.5</td><td></td></tr><tr><td>No 3rd Party Cookies are used</td><td>Value = 1</td><td></td></tr><tr><td>1st Party Cookies usage</td><td></td><td>Coefficient = 0.25</td></tr><tr><td>Long-lasting Cookies are used</td><td>Value = 0</td><td></td></tr><tr><td>Otherwise</td><td>Value = 1</td><td></td></tr><tr><td>Presence of 3rd Party Elements</td><td></td><td></td></tr><tr><td>No 3rd Party elements are included into website</td><td>Value = 1</td><td></td></tr><tr><td>3rd Party elements from other websites are included and these websites can be evaluated</td><td>Value = "Value of evaluation"</td><td></td></tr><tr><td>3rd Party elements from secure countries are included into website</td><td>Value = 0.5</td><td>Limit = 0.75</td></tr><tr><td>3rd Party elements from insecure countries are included into website</td><td>Value = 0</td><td>Limit = 0.5</td></tr><tr><td>SSL is used</td><td></td><td>Coefficient = 0.75</td></tr><tr><td>SSL is enabled for the whole website</td><td>Value = 1</td><td></td></tr><tr><td>SSL is enabled for transfer of personal information</td><td>Value = 0.5</td><td></td></tr><tr><td>SSL is not enabled</td><td>Value = 0</td><td></td></tr><tr><td colspan="3">"Enabled" means in this context that it is the default for the user and there is no certificate warning or other warnings (e.g., unsecure objects included) on all major browsers with market share over 5%.</td></tr><tr><td>P3P is used</td><td></td><td>Coefficient = 0.75</td></tr><tr><td>P3P is present and complete</td><td>Value = 1</td><td></td></tr><tr><td>P3P is present and incomplete</td><td>Value = 0.25</td><td>Limit = 0.5</td></tr><tr><td>P3P is missing</td><td>Value = 0</td><td>Limit = 0.25</td></tr></tbody></table>
keep them longer than needed and transfer them to process the order. The “data
to transfer” section in the PrimeLife Checkout demonstrator gives an example
how this could be visualised [7]. The evaluation of the data transfer should return
a good result if the customer had the free choice to place the order where data
processing is restricted to the minimal extent that is necessary for the purpose.
If not, the evaluation has to find a weight for the loss of privacy for the customer
and return an adequate result to express that not the best privacy level is being
achieved.

Since a single number or another abbreviated way to express whether a set-
ting is compliant with the customer's preferences might not convey sufficient
information, further explanation should be given via a link. This is especially
relevant if other criteria seem to suggest that a specific retailer is the best choice,
e.g., because of a reliable customer service and low prices. Then the customer
should have a possibility to check whether remedy can be achieved in case of a
not-so-good score in the privacy assessment.

6 User Interface Considerations

To display the result of the evaluation of the function, the interface of the compar-
ison shopping site needs to integrate a “privacy evaluation item” in its interface
when showing the list of various retailers for the product the customer asked for.

6.1 The Privacy Evaluation Item

The item to represent the result of the evaluation should give the customer
at first sight an impression of how privacy-friendly the retailer is. Further, it
should be easy for the customer to compare the different retailers concerning
their privacy-relevant properties that have been evaluated. In our example, the
privacy evaluation function yields a decimal digit with one decimal place between
0 and 5. We round this digit to an integer and represent that by a row of
the corresponding number of small filled squares. This follows the work of [8]
regarding the Privacy Finder where a bar of four squares at the maximum was
used. This visual representation, supported by a colouring depending on the
result (see next subsection), the customers can easily compare different entries
in the list from the comparison shopping site.

6.2 Colouring

For the different major states of the privacy evaluation item, different colours
can be used to support their distinguishability. Note that colours alone would
not be sufficient because comprehension should also be possible for colour-blind
customers. Very often, the traffic light colours green, yellow and red are being
employed because of the connotations they have – even in the global context.
Nevertheless, research has shown that a red or yellow colour may irritate the
customer and prevent her from doing business with a so marked retailer [9] [10].
On the other hand, green coloured information on a retailer might be perceived as a 100% trustworthy institution to do business with. This would be critical because in the current state of development, this system can only detect a selection of privacy issues; by no means, it could prove the absence of any privacy problem. Therefore we propose for this case to use red, orange (more contrast than yellow) – deliberately resorting to a warning effect – and grey instead of green as shown in Figure 4. In addition, the customers can get more information

<figure><img src="image_5.png" /><figcaption>Fig. 4. Different states of privacy evaluation items with colouring.</figcaption></figure>

by one click to check whether the privacy criteria with bad scores are relevant to them or not.

## 6.3 Positioning

Most comparison shopping sites use a table to present the different retailers for a product, listing the retailers in one column and other relevant information in further columns. We recommend to dedicate an own column for the privacy evaluation item. Alternatively, it could be added to the customer evaluation column if present as shown in Figure 5. As stated, it is not sufficient to limit the given information to one digit and one visual item. Instead, interested customers should be able to get more details on the chosen privacy evaluation function, the evaluated properties and the specific scoring. By clicking the privacy evaluation item or the term "Privacy eval", additional information as illustrated in Figure 6 could be presented.

# 7 Conclusion and Outlook

In this text, we have shown how comparison shopping sites could be extended by an evaluation of privacy-relevant properties. The sketched approach stresses the value of a fairly simple solution that can be easily implemented by providers of comparison shopping sites and therefore does not inhibit its potential take-up by a too high threshold. On the one hand, the extension of comparison shopping
<figure><img src="image_6.png" /><figcaption>Fig. 5. Example how to integrate privacy evaluation results into a comparison shopping site.</figcaption></figure>

Example Shop XYZ

Privacy Evaluation: ■■□ 2.9

The Privacy Evaluation has been calculated with the [privacy evaluation function](#) created by "Some Trusted Institution".
[Switch to another privacy evaluation function here.](#)

The following values have been used to calculate the Privacy
Evaluation:

<table><caption>Fig. 6. Example how additional information about the privacy evaluation results can be presented.</caption><thead><tr><td>Checked properties</td><td>Value</td><td>Explanation</td></tr></thead><tbody><tr><td>SSL</td><td>1</td><td>?</td></tr><tr><td>User tracking</td><td>1</td><td>?</td></tr><tr><td>3<sup>rd</sup> party cookies</td><td>0.5</td><td>?</td></tr><tr><td>3<sup>rd</sup> party elements</td><td>0.5</td><td>?</td></tr><tr><td>1<sup>st</sup> party cookies</td><td>1</td><td>?</td></tr><tr><td>Human readable privacy policy</td><td>1</td><td>?</td></tr><tr><td>P3P policy</td><td>0</td><td>?</td></tr><tr><td>Privacy Evaluation Provider</td><td>0.35</td><td>?</td></tr></tbody></table>
sites would work in today's Internet ecosystem. On the other hand, because of its flexibility, it could also benefit from a potential future setting where web-sites' privacy policies are machine-readable or further privacy metrics have been elaborated.

Since the market of comparison shopping sites is quite dynamic, some of these sites are in search of outstanding functionality as a competitive advantage. The sites' providers are welcome to pick up the idea of assessing relevant privacy criteria. This could create an impetus for retailers to improve their privacy and security settings. In addition, transparency on privacy-relevant properties would strengthen the users' general privacy awareness.

The idea to focus on portals that are used by many users as entry points for their Internet usage does not only comprise comparison shopping sites, but would also be expandable to, e.g., search engines, booking sites or social networks. In fact, these are also the sites that may be critical because of their own data processing: They serve as gateways for relevant parts of the users' digital lives and may gather and link a huge amount of personal data. These are also sites that are crucial for net neutrality [11] and that may affect the Web itself because of their (almost) monopoly position. The same is true for the area of privacy, so a prerequisite for a working approach is that the chosen comparison shopping site itself is trustworthy and compliant with the user's privacy expectations.

## References

1. Hansen, M.: Marrying transparency tools with user-controlled identity management. In Fischer-Hübner, S., Duquenoy, P., Zuccato, A., Martucci, L., eds.: The Future of Identity in the Information Society. Volume 262 of IFIP International Federation for Information Processing. Springer, Boston (2008) 199-220

2. Hedbom, H.: A survey on transparency tools for enhancing privacy. In Matyas, V., Fischer-Hübner, S., Cvrcek, D., Svenda, P., eds.: The Future of Identity in the Information Society. Volume 298 of IFIP Advances in Information and Communication Technology. Springer, Boston (2009) 67-82

3. Gideon, J., Cranor, L.F., Egelman, S., Acquisti, A.: Power strips, prophylactics, and privacy, oh my! In: Proceedings of the second Symposium on Usable Privacy and Security. SOUPS '06, New York, NY, USA, ACM (2006) 133-144

4. McDonald, A.M., Cranor, L.F.: The cost of reading privacy policies. ACM Transactions on Computer-Human Interaction 4(3) (2008) 1-22

5. Angulo, J., Fischer-Hübner, S., Pulls, T., König, U.: HCI for policy display and administration. In Bezzi, M., Duquenoy, P., Fischer-Hübner, S., Hansen, M., Zhang, G., eds.: Privacy and Identity Management for Life. Volume 512 of IFIP Advances in Information and Communication Technology. Springer, Boston (June 2011) 261-278

6. Holtz, L.E., Zwingelberg, H., Hansen, M.: Privacy policy icons. In Bezzi, M., Duquenoy, P., Fischer-Hübner, S., Hansen, M., Zhang, G., eds.: Privacy and Identity Management for Life. Volume 512 of IFIP Advances in Information and Communication Technology. Springer, Boston (2011) 279-286

7. König, U.: PrimeLife Checkout – A Privacy-Enabling e-Shopping User Interface. In Fischer-Hübner, S., Duquenoy, P., Hansen, M., Leenes, R., Zhang, G., eds.: Privacy
and Identity Management for Life. Volume 352 of IFIP Advances in Information and Communication Technology. Springer, Boston (2011) 325–337

8. Tsai, J.Y., Egelman, S., Cranor, L., Acquisti, A.: The effect of online privacy information on purchasing behavior: An experimental study. Information Systems Research **22**(2) (2011) 254–268

9. Fischer-Hübner, S., Hedbom, H., Wästlund, E.: Trust and assurance HCI. In Camenisch, J., Fischer-Hübner, S., Rannenberg, K., eds.: Privacy and Identity Management for Life. Springer, Heidelberg (2011) 245–260

10. Fischer-Hübner, S., Angulo, J., Graf, C., Wästlund, E., Wolkerstorfer, P., Hochleitner, C.: Towards usable privacy enhancing technologies: Lessons learned from the PrimeLife Project. Deliverable D4.1.6 (2011)

11. Berners-Lee, T.: Long live the web: A call for continued open standards and neutrality. Scientific American **12** (2010)

## Appendix: Listings

E, LN2, LN10, LOG2E, LOG10E, PI, SQRT1\_2, SQRT2, MAX\_VALUE, MIN\_VALUE, NaN, NEGATIVE\_INFINITY, POSITIVE\_INFINITY, TRUE, FALSE

<caption>Listing 1.1. Constants</caption>

exec(), abs(), acos(), asin(), atan(), ceil(), cos(), exp(), floor(), log(), max(), min(), pow(), random(), round(), sin(), sqrt(), tan(), toExponential(), toFixed(), toPrecision(), toString(), charAt(), charCodeAt(), concat(), fromCharCode(), indexOf(), lastIndexOf(), match(), replace(), search(), slice(), split(), substr(), substring(), tolowerCase(), toUppercase()

<caption>Listing 1.2. Methods</caption>

length

<caption>Listing 1.3. Attributes</caption>

For, while

<caption>Listing 1.4. Loops</caption>

If else, switch

<caption>Listing 1.5. Evaluation</caption>

=, +=, -=, <, <=, >, >=, \&=, \^=, |=, ?:, ||, \&\&, |, \^, \&, ==, ===, !=, !==, <, <=, >, >=, <, <, >, >, > >, +, -, *, /, \%, !, ~, -, ++, --, (,), [,], .,typeof, void, delete, return, new

<caption>Listing 1.6. Operators</caption>
Var

<caption>Listing 1.7. Keywords</caption>

var balance = new Array();
balance[0] = new Object();
balance[0]["name"] = "Something";
balance[0]["coefficient"] = 0.5;
balance[0]["function"] = evalSomething;

var evalResult = 0;
var limit = 1;
var normaliser = 0;

for (var i = 0; i < balance.length; i++) {
  var c = balance[i]["coefficient"];
  var f = balance[i]["function"];
  var r = f.shopAttributes);
  //check if result is valid (within 1 and -1)
  if ((r["value"] <= 1)&&(r["value"] >= -1)) {
    evalResult += r["value"] * c;
    normaliser += c;
    if (limit > r["limit"]) {
      limit = r["limit");
    }
  }
}

evalResult /=normaliser; //normalize result
//limit result
  if (evalResult > limit) {
    evalResult = limit;
  }

<caption>Listing 1.8. Example how to compute the final result out of the “group” results</caption>
```javascript
function evalSomething.shopAttributes) {
    var limit = 1; var value = 1;
    // do something to calculate value and limit
    var result = {"value": value, "limit": limit};
    return result;
}
```

**Listing 1.9.** Stub for the evaluation function of one “group”