CHI 2020 Late-Breaking Work

CHI 2020, April 25–30, 2020, Honolulu, HI, USA

All in One! User Perceptions on
Centralized IoT Privacy Settings
Karola MarkyTU Darmstadt, Germany
Keio University, Japan
marky@tk.tu-darmstadt.deKai Kunze
Keio University, Japan
kai@kmd.keio.ac.jp

Verena Zimmermann
Alina Stöver
Philipp Hoffmann
TU Darmstadt, Germany
zimmermann@psychologie.tudarmstadt.destoever@psychologie.tudarmstadt.deph.hoffmann@stud.tudarmstadt.de

Max Mühlhäuser
TU Darmstadt, Germany
max@tk.tu-darmstadt.de

Abstract
IoT devices deliver their functionality by accessing data.
Users decide which data they are willing to share via privacy settings interfaces that are typically on the device, orin the app controlling it. Thus, users have to interact witheach device or app which is time-consuming and settings
might be overlooked. In this paper, we provide a steppingstone into a multi-device interface for adjusting privacy settings. We present three levels of information detail: 1) sensor name 2), sensor name and information about captured
data and 3) detailed information on each collected data typeincluding consequences. Through a pre-study with 15 participants, we found that users prefer the access to detailed
information because this offers the best decision support.
They also wish for a clear status communication, a possibility for rule-based settings, and delegation options.

Author Keywords
Smart Home; Internet of Things; Privacy Decision Support
Figure 1: We investigate threedifferent levels of information foradjusting privacy settings of IoT
devices.

Permission to make digital or hard copies of part or all of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor proﬁt or commercial advantage and that copies bear this notice and the full citationon the ﬁrst page. Copyrights for third-party components of this work must be honored.
For all other uses, contact the owner/author(s).
CHI ’20 Extended Abstracts, April 25–30, 2020, Honolulu, HI, USA.
© 2020 Copyright is held by the author/owner(s).
ACM ISBN 978-1-4503-6819-3/20/04.
http://dx.doi.org/10.1145/3334480.3383016

Introduction and Background
User settings are a collection of individual decisions that auser makes to determine how electronic devices should act.
Privacy settings, in particular, reﬂect the user’s decisions
on how a device should collect, handle or share their data.
They are widely used in, for instance, social networks [4,10], online browsers [9], and IoT devices [2, 1].

LBW071, Page 1

CHI 2020 Late-Breaking Work

CHI 2020, April 25–30, 2020, Honolulu, HI, USA

The last mentioned IoT devices can deliver many beneﬁts. Smart home devices, in particular, can improve home
security, or the control over energy consumption (cf. [8]).
But these beneﬁts can only be delivered if the devices haveaccess to data. The users of smart home devices accept
sacriﬁcing privacy for convenience [15, 5]. On the other
hand, smart home devices should offer their users means
to adjust the data collection to match their personal privacy
needs [5, 12, 16]. Thus, users have to decide which data
they are willing to share with each smart home device via
privacy settings interfaces.
These interfaces are typically located either on the speciﬁc device, or in the app for controlling it. Therefore, users
have to interact with each device or app which is 1) timeconsuming, 2) settings might be overlooked, and 3) laymen
might struggle in comprehending the settings.
To tackle these issues, we provide a stepping stone intoa multi-device interface for adjusting privacy settings. In a
pre-study with 15 participants, we investigated three distinct
levels of information detail: 1) name of the sensor 2), andname of the sensor and information what this sensor does3) detailed information on each collected data type including consequences. After interacting with each interface, we
provided a questionnaire to collect preliminary feedback
aiming to inform further studies. Our study shows that users
prefer the ability to access detailed information on eachsensor because this supports them best in making theirdecision. They furthermore wish for a clear status communication of the sensor, dynamic settings that are based on
rules, and delegation options. Our pre-study aims to informfuture studies of multi-device interfaces.

Settings Information Levels
The level of details of the presented information plays animportant role in making a decision. For designing themulti-device interface for adjusting privacy settings, we
commenced by investigating different levels of information
to support the users in making privacy-related decisions.
Hereby, we consider the following three levels of information
detail: 1) minimal information, 2) medium information, and
3) detailed information. Details about each level are given
below.
1) Minimal Information
In the minimal information level, we only provided the namesof the sensors which are implemented in the device, e.g.
"fridge content camera". Next to the sensor name, we placeda switch for controlling the sensor by switching it on or off
Figure 2 shows a mockup of the minimal information level.

Figure 2: Mockup of the minimal information level

LBW071, Page 2

CHI 2020 Late-Breaking Work

CHI 2020, April 25–30, 2020, Honolulu, HI, USA

Figure 3: Mockup of the medium information level2) Medium Information
The medium information level extends the minimal levelwith a description of each sensor. This description provides
information why this sensor is needed. For instance, "thefridge content camera is needed to show the fridge’s content to you in the mobile app" (see Figure 3).
3) Detailed Information
The detailed information level provides a pop-up for eachsensor. This pop-up contains detailed information why thesensors is needed, the consequences of its deactivation, as
well as the parties who have access to the data collectedby the sensor. For instance, "The fridge content camera
is needed to show the fridge’s content to you. The appthat you use to access the camera picture has access to
it. If you switch the camera off you can no longer see yourfridge’s content in the app" (see Figure 4).
We implemented a prototype interface for each of the three
information levels as an Android app on tablet-PC. Eachprototype provided settings for 24 IoT devices that are already available on the market. The devices were grouped

Figure 4: Mockup of the detailed information level

into categories by the device type, such as smart health orsmart household devices.

MethodTo investigate user perceptions of the three settings interfaces and the detail of the provided information, we conducted a pre-study with 15 participants.
To be able to compare the different information levels withthe same participants, we opted for a within-subjects design. The order of the conditions was given by a Latin squarein order to avoid sequence effects. The procedure of our
pre-study was as follows:
The participants were invited in our lab. We provided themwith a consent form that included the study’s data protection policy which is also compliant to the GDPR and national laws. After signing the consent form, the participant
ﬁlled in a questionnaire which asked for demographics andprevious experiences with the usage of smart home and IoT
devices.

LBW071, Page 3

CHI 2020 Late-Breaking Work

Figure 5: Bar chart of theexecution time.

Figure 6: Bar chart of thepreference shares regarding thebest subjective decision support.

CHI 2020, April 25–30, 2020, Honolulu, HI, USA

The participants were instructed to interact with the settingsinterfaces on a tablet. In particular, we asked them to adjust
the settings of three devices for each condition according
to their personal needs. The three devices were randomly
assigned. After adjusting the settings, the participants could
freely explore the app and interact with it.

Execution TimeWe obtained the execution time from analyzing the screenrecordings of the interaction. As execution time, we consider adjusting the three assigned settings without the free
exploration. Figure 5 depicts the execution time in the different information levels.

When the participant reported completion of adjusting thesettings and exploring, the examiner proceeded to the next
condition. The interaction of the participant with the interface was recorded by a screen-capturing software.

In the minimal information level, the participants neededon average 83.5 seconds (SD = 45.1, M in = 25s,
M ax = 173s), in the medium level, the needed 135 seconds (SD = 82.0, M in = 44s, M ax = 339s), and in
the detailed level they needed 181.7 seconds (SD = 51.4,
M in = 72s, M ax = 242s). We analyzed the execution
with a Friedman test which reveals signiﬁcant differences
between the three conditions with χ2 (2) = 5.18, p = 0.012.

After interacting with all three conditions, the participantsreceived a questionnaire. In this questionnaire, we asked
the participants for their favorite level of information. We
also asked which interface supported them best to adjust
the settings matching their privacy needs and were theywould like to receive privacy-related information. The participants could also provide further general app-independent
feedback and feedback for the three tested apps. Finally,
the examiner thanked the participants and gave them thepossibility to ask questions. We did not compensate theparticipants for participation.
Participants
Fifteen participants took part in our study. We recruitedthem via mailing-lists and forums. Three of them identiﬁed
as female, eleven as male and one participant preferred not
to answer. Their average age was 27.4 years (SD = 13.3,
M in = 18, M ax = 57). All participants either owned atablet-PC or a smartphone, twelve were Android users andthree used iOS. Furthermore, nine participants were active
users of smart home or IoT devices.

Results

To further investigate these differences, we ran Wilcoxon
tests with a Bonferroni correction to account for multiple
testing. The tests reveal signiﬁcant differences between theminimal and the medium information level (p = .04), as well
as between the minimal and the detailed information level(p = .021). Differences between the medium and detailed
information levels could not be found (p = 1.00).
User Preferences
In the ﬁnal questionnaire, we asked the participants whichof the presented settings interfaces supported them best in
making a decision that matches their privacy needs. Figure
6 depicts the shares of the different levels.
None of the participants stated that the minimal information
would be sufﬁcient for them. When asked to explain theiranswer, they named the missing explanations as a reason.
E.g. P10 stated the following: "This app did not offer any
explanation." 1

In this section, we report the results of our study.
1

All comments were translated from German.

LBW071, Page 4

CHI 2020 Late-Breaking Work

CHI 2020, April 25–30, 2020, Honolulu, HI, USA

One third of participants (N = 5) said that the medium
level of information was best for them to mark their decision. Sample comments from the participants are:• "App 1 offered too little information, App 3 offered too
much information.", P1• "The amount of information was clearest in this app,so I can well imagine reading and understanding allof it.", P7
Two thirds of the participants (N = 10) felt that the detailed
information level supported them best. Their comments are:• "The pop-ups with detailed information about the setting you want to change is very helpful. It gives precise information about the effects [...] Minimal priorknowledge is required. Experts do not need to readthe text, for all others the text is helpful." , P3
• "This app provided the most contextual information,
making a well-considered choice easy.", P5
Besides the interface-speciﬁc questions, we also asked
general ones about the information that the participants
expected or wished to receive within a settings interface.
Thirteen of the ﬁfteen participants wanted to receive information about the speciﬁc sensors and their purpose. When
asked where they would expect such information, one participant stated that they wanted to receive it from the vendor’s website, three participants would have liked to haveit in the device’s manual, and thirteen would have liked to
get this information directly in the settings. Multiple answers
were possible in this question. One participant did express
the need for the access to any information. When asked to
explain their answer that said "as an expert, I already know
this information."

User Wishes and Suggestions
Finally, we asked the users how the interfaces could be further improved to better match their individual privacy needs.
Here, we received three groups of answers: 1) the wish forsecurity-related information (e.g., information on encryption), 2) the wish for rule-based settings (e.g., setting a timeframe for data capturing) and 3) the wish for delegation options (e.g., delegating settings to an assisting software).
In the ﬁrst group of answers, the participants stated, thatthe detailed information level should also contain information related to security. For instance, P12 said: "Upon request, further technical background information, such as
the method of transmission of the data, whether and whichencryption methods are used and similar."
The wish for rule-based settings considers that the presented interface only provided a static setting. The users
either switch the sensor on or off. Settings could enable
users to set rules when the sensors are on (time-based),or restrict the number of times that the sensor can capture
data. For instance, the fridge’s content camera could beswitched off over night.
Finally, the wish for delegation refers to the possibility to leta trusted entity, such as a software or another person, suchas an expert, adjust the settings for the user.

Discussion and Future Directions
We investigated a ﬁrst prototype for a multi settings interface for adjusting the privacy settings of IoT devices. Suchan interface could be part of a general control screen forsuch devices that is placed in the user’s home.
Information Level and Placement
The majority of participants reported that the detailed information level supported them best in adjusting the settings
LBW071, Page 5

CHI 2020 Late-Breaking Work

CHI 2020, April 25–30, 2020, Honolulu, HI, USA

matching their privacy needs. This was despite the additional time they needed to make the settings. The participants valued the additional information and stated that itshould be available even if it is not read by every user.
The vast majority of participants would expect to receive
detailed information about the sensors, the data they capture and the recipients of the data in the settings. Therefore, privacy settings should offer such data. Future studies
should also consider the changing needs for privacy-related
information over time [6] and evaluate adaptable solutions.
Rule-Based Settings
Our participants expressed that static settings that offer
switching on and off do not reﬂect all of their needs. Future studies should consider possibilities to set rules forsettings. Instead, a setting is either on or off, it could be
conﬁgured based on an underlying rule. Each a rule canbe time-based meaning that users can set a time frame inwhich the sensor is allowed to capture data. Another rule
could be limiting the number of times a sensor has accessto data. For instance, the camera in a smart fridge could beaccessed once per day. In doing so, it is less likely to capture people opening the fridge. Another example is limiting
the Internet access of a device to several times per day if
the information that is requests is not updated frequently.
Delegation
Participants can be overwhelmed with the number of decisions that they have to make. Furthermore, the decision
might be too complex for them to handle. Participants in ourstudy expressed the wish to delegate their privacy decision
to a trusted person or even to a software assistant. Privacy
assistants have already been investigated in smart homes[3] and related areas, such as smartphones [7].

Scalability and Other User Types
Since the amount of devices is likely to rise in the future, so
will the amount of decisions to make. Thus, we consider theinvestigation of privacy assistants in the scope of IoT andsmart homes to be an integral part of future work. A privacy
assistant could be an AI that learns the decisions that theusers make or another software that make decisions basedon the users’ privacy proﬁles [3]. Furthermore, up to now,
we investigated the settings of primary users, smart homeenvironments, however, can host other user types, such as
visitors [14, 13, 11], who also might wish to exert control
over the data collection.

Conclusion
In this paper, we report a preliminary investigation of user
perceptions on different information levels with regards toa privacy settings interface. The results of the study showthat users prefer the ability to access detailed information
within the settings. Besides, our results indicate that static
settings, meaning that the sensor is either on or off, is notenough to accurately reﬂect the users’ needs. Thus, futurestudies should also consider rule-based settings that breakthe static nature of settings. Since this was a preliminary
study, future studies should also investigate a more representative sample size.

Acknowledgement
This work has been co-funded by the German Federal Ministry of Education and Research (BMBF) within the SWC
2.0 "PrivacyGate" 01|S17050, by the Horst Görtz Foundation, by the BMBF and the Hessen State Ministry for Higher
Education, Research and the Arts within their joint supportof the National Research Center for Applied Cybersecurity
ATHENE, and JST CREST Grant No. JPMJCR16E1 Experiential Supplements.

LBW071, Page 6

CHI 2020 Late-Breaking Work

CHI 2020, April 25–30, 2020, Honolulu, HI, USA

REFERENCES[1] Paritosh Bahirat, Yangyang He, Abhilash Menon, andBart Knijnenburg. 2018. A Data-Driven Approach to
Developing IoT Privacy-Setting Interfaces. In
Proceedings of the International Conference onIntelligent User Interfaces (IUI ’18). Association for
Computing Machinery, New York, NY, USA, 165–176.
DOI:http://dx.doi.org/10.1145/3172944.3172982[2] J. Cornwell, I. Fette, G. Hsieh, M. Prabaker, J. Rao, K.
Tang, K. Vaniea, L. Bauer, L. Cranor, J. Hong, B.
McLaren, M. Reiter, and N. Sadeh. 2007.
User-Controllable Security and Privacy for Pervasive
Computing. In Proceedings of the IEEE Workshop on
Mobile Computing Systems and Applications. 14–19.
DOI:http://dx.doi.org/10.1109/HotMobile.2007.9[3] A. Das, M. Degeling, D. Smullen, and N. Sadeh. 2018.
Personalized Privacy Assistants for the Internet ofThings: Providing Users with Notice and Choice. IEEE
Pervasive Computing 17, 3 (Jul 2018), 35–46. DOI:
http://dx.doi.org/10.1109/MPRV.2018.03367733[4] Serge Egelman, Andrew Oates, and Shriram
Krishnamurthi. 2011. Oops, I Did It Again: Mitigating
Repeated Access Control Errors on Facebook. In
Proceedings of the SIGCHI Conference on Human
Factors in Computing Systems (CHI ’11). Association
for Computing Machinery, New York, NY, USA,
2295–2304. DOI:
http://dx.doi.org/10.1145/1978942.1979280[5] Pardis Emami-Naeini, Sruti Bhagavatula, Hana Habib,
Martin Degeling, Lujo Bauer, Lorrie Cranor, andNorman Sadeh. 2017. Privacy Expectations andPreferences in an IoT World. In Proceedings of the
Symposium on Usable Privacy and Security (SOUPS).
USENIX Association, Berkeley, CA, USA, 399–412.
[6] Timo Jakobi, Gunnar Stevens, Nico Castelli, Corinna
Ogonowski, Florian Schaub, Nils Vindice, Dave
Randall, Peter Tolmie, and Volker Wulf. 2018. Evolving
Needs in IoT Control and Accountability: A
Longitudinal Study on Smart Home Intelligibility.
Proceedings of the ACM on Interactive, Mobile,
Wearable and Ubiquitous Technologies 2, 4 (2018),
171. DOI:http://dx.doi.org/10.1145/3287049[7] Bin Liu, Mads Schaarup Andersen, Florian Schaub,
Hazim Almuhimedi, Shikun Aerin Zhang, Norman
Sadeh, Yuvraj Agarwal, and Alessandro Acquisti.
2016. Follow my Recommendations: A Personalized
Privacy Assistant for Mobile App Permissions. In
Proceedings of the Symposium on Usable Privacy andSecurity (SOUPS). 27–41.
[8] Davit Marikyan, Savvas Papagiannidis, and Eleftherios
Alamanos. 2019. A Systematic Review of the Smart
Home Literature: A User Perspective. Technological
Forecasting and Social Change 138 (2019), 139–154.
[9] Lynette I. Millett, Batya Friedman, and Edward Felten.
2001. Cookies and Web Browser Design: Toward
Realizing Informed Consent Online. In Proceedings of
the SIGCHI Conference on Human Factors in
Computing Systems (CHI ’01). ACM, New York, NY,
USA, 46–52. DOI:
http://dx.doi.org/10.1145/365024.365034

LBW071, Page 7

CHI 2020 Late-Breaking Work

CHI 2020, April 25–30, 2020, Honolulu, HI, USA[10] Mainack Mondal, Günce Su Yilmaz, Noah Hirsch,
Mohammad Taha Khan, Michael Tang, Christopher
Tran, Chris Kanich, Blase Ur, and Elena Zheleva.
2019. Moving Beyond Set-It-And-Forget-It Privacy
Settings on Social Media. In Proceedings of the ACM
SIGSAC Conference on Computer andCommunications Security (CCS ’19). ACM, New York,NY, USA, 991–1008. DOI:
http://dx.doi.org/10.1145/3319535.3354202[11] Katrin Wolf, Karola Marky, and Markus Funk. 2018.
We should start thinking about Privacy Implications of
Sonic Input in Everyday Augmented Reality!. In
Mensch und Computer 2018 - Workshopband.
Gesellschaft für Informatik e.V., Bonn, 353–359. DOI:
http://dx.doi.org/10.18420/muc2018-ws07-0466[12] Yaxing Yao, Justin Reed Basdeo, Smirity Kaushik, andYang Wang. 2019. Defending My Castle: A Co-Design
Study of Privacy Mechanisms for Smart Homes. In
Proceedings of the CHI Conference on Human Factors
in Computing Systems (CHI ’19). ACM, New York, NY,
USA. DOI:
http://dx.doi.org/10.1145/3290605.3300428[13] Eric Zeng, Shrirang Mare, and Franziska Roesner.
2017. End User Security & Privacy Concerns with
Smart Homes. In Proceedings of the Symposium on
Usable Privacy and Security (SOUPS). USENIX
Association, Berkeley, CA, USA, 65–80.
[14] Eric Zeng and Franziska Roesner. 2019.
Understanding and Improving Security and Privacy inMulti-User Smart Homes: A Design Exploration and
In-Home User Study. In Proceedings of the USENIX
Security Symposium (USENIX Security ’19). USENIX
Association, Berkeley, CA, USA, 159–176.
[15] Serena Zheng, Noah Apthorpe, Marshini Chetty, andNick Feamster. 2018. User Perceptions of Smart
Home IoT Privacy. Proceedings of the ACM on
Human-Computer Interaction 2, CSCW (2018), 200.
DOI:http://dx.doi.org/10.1145/3274469[16] Verena Zimmermann, Paul Gerber, Karola Marky,
Leon Böck, and Florian Kirchbuchner. 2019.
Assessing Users’ Privacy and Security Concerns ofSmart Home Technologies. i-com 18, 3 (2019),
197–216.

LBW071, Page 8