Putting Disclosures to the Test September 15, 2016

The future of disclosures?

Moderator:

Joseph Calandrino

Research Director, Office of Tech. 

Research & Investigation, FTC

Serge Egelman

UC Berkeley / International 

Computer Science Institute

Tamar Krishnamurti

Dept. of Engineering & Public Policy

Carnegie Mellon University

Florian Schaub

School of Information

University of Michigan
Putting Disclosures to the Test September 15, 2016

Serge Egelman

UC Berkeley / 

International Computer Science Institute
Serge Egelman, UC Berkeley / ICSI

improving disclosure 

through contextual 

integrity

Research funded by the National Science Foundation under grant CNS-1318680, and the Department of Homeland 

Security (contract FA8750-16-C-0140 administered by the Air Force Research Laboratory). No purchase necessary, 

void where prohibited, terms and conditions may apply.
how often are resources 

accessed in practice?

dynamic analysis

– modified Android OS and gave 

phones to 36 people

– hooked all API methods invoking 

permission checks

– logged contextual data surrounding 

permission requests

P. Wijesekera, A. Baokar, A. Hosseini, S. Egelman, D. Wagner, and K. Beznosov. Android 

Permissions Remystified: A Field Study on Contextual Integrity. Proceedings of the 24th USENIX 

Security Symposium, 2015.

P. Wijesekera, A. Baokar, A. Hosseini, S. Egelman, D. Wagner, and K. Beznosov. Android 

Permissions Remystified: A Field Study on Contextual Integrity. Proceedings of the 24th USENIX 

Security Symposium, 2015.
runtime requests?

213 requests per hour!

– location (10,960/day)

– reading SMS data (611/day)

– sending SMS (8/day)

– reading browser history (19/day)

asking each time is infeasible

...but 80% wanted to block at least one request

(on average, they wanted to block 35% of all requests)
what matters

expectations predicted blocking

(r=-0.39, p<0.018)

...as did app visibility

(r=0.42, p<0.001)
contextual integrity

privacy is contextual

expectations drive privacy decisions

=> only prompt when access to data is likely to 

be unexpected

Helen Nissenbaum, Privacy as Contextual Integrity. Washington Law Review 79, 2004
or better...

• automatically allow access when a user is 

likely to expect it,

• automatically deny access when a user is 

likely to not expect it,

• prompt when system cannot infer user 

expectations (and learn from it)
can we predict

privacy decisions?

field study to collect behavioral data

probabilistic prompts to measure 

user expectations
the results

133 Android smartphone users

176 million events recorded

4,224 prompt responses
features

permission information

– permission

– visibility

– time of day

user behavior

– browsing habits

– audio preferences

– screen locking habits

past decisions

– under different visibility levels

– under different foreground applications
challenging the status quo

Error Rate Average 

Prompts/User

Ask-on-first-use 19.47% 12.34

ML Model 

(behavior-only)

18.82% 0.00*

ML Model 4.27% 25.60

ML Model (lowprompt)12.67% 12.46
open questions

what is an acceptable accuracy level?

what are the legal issues?

how can this be applied in other domains?
Putting Disclosures to the Test September 15, 2016

Tamar Krishnamurti

Dept. of Engineering & Public Policy

Carnegie Mellon University
A Patient-Centered Approach to 

Informed Consent

Tamar Krishnamurti, PhD  Assistant Research Professor 

Carnegie Mellon University

The research presented was funded by ICON plc and the Swedish Foundation for 

Humanities and Social Sciences (Riksbankens Jubileumsfond) Program on Science 

and Proven Experience.
What is “informed” consent?

17

Krishnamurti, T. & Argo, N. A Patient-Centered Approach to Informed Consent: Results from 

a Survey and Randomized Trial. Medical Decision Making 2016 Aug;36(6):726-40.
Existing standards

• ICH Good Clinical Practice (GCP) 

• Dept. of Health and Human Services 

federal regulations, e.g. 

– The purpose of the trial

– The trial treatment(s) 

– Random assignment 

– The reasonably expected benefits

– Participation is voluntary etc. etc. 

18
New technologies, new options

19
Research Questions

1. What consent information do patients care about ?

2. Can we generate a patient-centered consent form that 

meets normative guidelines?

3. Can these be delivered in different media?

4. Are patient-centered consent forms at least as good

as traditional consent forms?

20
Mturk sample

• 118 Asthma patients

• Age range 21-61years ; 44% female

• Randomly assigned to 4.5 page excerpt from 17 page 

clinical trial informed consent document

• Embedded attention checks: 

– 82% successfully completed at least one of the two

21
Consent Priority Selection

22
23

Consent Priority Rating
24

% of people selecting a 

specific sentence 

% of people 

selecting specific 

concepts

Conceptual category of 

specific sentence

Automatic consent form generator
Resulting patient-designed form

25
Did it meet normative criteria?

– The trial treatment(s) and random assignment 

– The trial procedures to be followed

– The reasonably foreseeable

– The reasonably expected benefits

– Participation is voluntary etc., etc., 

26
27

New technologies, new options
Lab-based Evaluation

28

• 76 Asthma patients

• Age range 20-63 ; 54.3% female

• Randomly assigned to patient-centered (written or video) 

or traditional consents
29

Knowledge Score

1

2

3

4

5

6

7

8

9

10

11

12

P-C paper P-C video Traditional

Note: bars show standard errors

No lost knowledge with patient-centered(P-C) formats
Strongly 

disagree

Strongly 

agree

How much do you agree with the following statement: 

The benefits of this clinical trial outweigh the risks

30

1

2

3

4

5

P-C paper P-C video Traditional

No difference in perceived risks or benefits
Not at all 

engaged

Completely 

engaged

P =.01, d = .72 

P =.06, d = .57

How engaged were you in reading the consent form?

31

1

2

3

4

5

P-C paper P-C video Traditional

Patient-derived formats are more engaging
Take-aways and next steps

32

• Greater engagement in patient-centered consent with 

large effect sizes

• No differences found in critical decision factors

• Open questions include:

• Mturk reliability 

• How does affect, type of risk, chronicity of disease etc. 

play a role
Thank you

Contact information

Tamar Krishnamurti

Carnegie Mellon University, 129 BH

Pittsburgh, PA 15213

tamar@cmu.edu

Website:

https://www.cmu.edu/epp/people/faculty/tamar-krishnamurti.html

33
Putting Disclosures to the Test September 15, 2016

Florian Schaub

School of Information

University of Michigan
Contextualizing and Personalizing 

Privacy Notices and Controls

Florian Schaub

Putting Disclosures to the Test

Federal Trade Commission

Sept. 15, 2016

The research presented was funded in part by the National Science Foundation, the Defense Advanced Research Projects Agency, 

the Air Force Research Laboratory, Google, Inc., Yahoo! Inc., and the Carlsberg Foundation.
36

privacy policies are too complex
37

privacy policies are too complex

how can we reduce information overload and 

enable informed privacy decision making?
38

simplifying disclosures based on expectations

38
39

simplifying disclosures based on expectations

39

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

privacy policy

www.fitbit.com/

legal/privacy-policy

3,500 words

layered notice

www.fitbit.com/privacy

1,300 words
40

simplifying disclosures based on expectations

40

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

our compact disclosure format
41

simplifying disclosures based on expectations

41

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

determine privacy expectations / awareness of data practices

• online survey with amazon mechanical turk (n=70)

• participants asked to look at a specific fitness wearable

• rate likelihood of certain data collection and 

sharing practices

• actual practices mixed in with fictitious practices
42

simplifying disclosures based on expectations

42

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

determine privacy expectations / awareness of data practices

true

true

true

true

false

false

false

false

false
43

simplifying disclosures based on expectations

43

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

baseline expectations / awareness

0 10 20 30 40 50 60 70 80 90 100

Steps

Distance

Info Posted to Profile

When Exercising

Heartrate

Stairs Climbed

Name

Sleep

Exercise Comp. to Friend

Weight

Height

Location Specific

Fitbit Friends

Companies Providing Services

Directed Organizations

Government

Where to Find Privacy Policy

Use Fitbit Without an Account

Selling Data Conditions

Data Retention Policy

Sharing with

Sharing w

Sharing with

Collection of Location (Specific) Sharing with

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Misc. Share Collection

Sharing with

Collection of 

% correct
44

simplifying disclosures based on expectations

44

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

baseline expectations / awareness

0 10 20 30 40 50 60 70 80 90 100

Steps

Distance

Info Posted to Profile

When Exercising

Heartrate

Stairs Climbed

Name

Sleep

Exercise Comp. to Friend

Weight

Height

Location Specific

Fitbit Friends

Companies Providing Services

Directed Organizations

Government

Where to Find Privacy Policy

Use Fitbit Without an Account

Selling Data Conditions

Data Retention Policy

Sharing with

Sharing w

Sharing with

Collection of Location (Specific) Sharing with

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Misc. Share Collection

Sharing with

Collection of 

85%
45

simplifying disclosures based on expectations

45

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

exclude most expected practices (85%)

full medium (85%)
46

simplifying disclosures based on expectations

46

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

baseline expectations / awareness

0 10 20 30 40 50 60 70 80 90 100

Steps

Distance

Info Posted to Profile

When Exercising

Heartrate

Stairs Climbed

Name

Sleep

Exercise Comp. to Friend

Weight

Height

Location Specific

Fitbit Friends

Companies Providing Services

Directed Organizations

Government

Where to Find Privacy Policy

Use Fitbit Without an Account

Selling Data Conditions

Data Retention Policy

Sharing with

Sharing w

Sharing with

Collection of Location (Specific) Sharing with

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Collection of 

Misc. Share Collection

70%

Sharing with

Collection of 
47

simplifying disclosures based on expectations

47

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

compact disclosures

full medium (85%)

short (70%)
48

simplifying disclosures based on expectations

48

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

compact disclosures

full medium (85%)

short (70%)
49

simplifying disclosures based on expectations

49

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

testing the compact disclosures

• online survey with amazon mechanical turk (n=400)

• similar design as baseline survey

• but after looking at specific fitness wearable, participants see one 

of the compact disclosures

• plus control condition without disclosure (same as baseline)
50

simplifying disclosures based on expectations

50

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

testing the compact disclosures

findings

• participants who saw disclosure had significantly higher awareness 

of practices (% correct)
51

simplifying disclosures based on expectations

51

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

testing the compact disclosures

findings

• participants who saw disclosure had significantly higher awareness 

of practices (% correct)

• similar awareness with medium and full disclosures (no sign. 

diff.), but significant drop in awareness with short disclosure
52

simplifying disclosures based on expectations

52

J. Gluck, F. Schaub, A. Friedman, H. Habib, N. Sadeh, L.F. Cranor, Y. Agarwal. How Short is Too Short? Implications of Length and Framing on the 

Effectiveness of Privacy Notices. Symposium on Usable Privacy and Security 2016. 

testing the compact disclosures

findings

• participants who saw disclosure had significantly higher awareness 

of practices (% correct)

• similar awareness with medium and full disclosures (no sign. 

diff.), but significant drop in awareness with short disclosure

• no difference in time spent on disclosure – regardless of length
1. emphasize likely unexpected or surprising information

53

simplifying privacy notices and controls

53

F. Schaub, R. Balebako, A.L. Durity, L.F. Cranor. A Design Space for Effective Privacy Notices. Symposium on Usable Privacy and Security 2015. 

F. Schaub. B. Könings, M. Weber. Context-adaptive Privacy: Leveraging Context Awareness to Support Privacy Decision Making, IEEE Pervasive 

Computing, vol. 14(1), 2015.
1. emphasize likely unexpected or surprising information

2. contextualize information based on type of service, user 

activity and user goals

54

54

F. Schaub, R. Balebako, A.L. Durity, L.F. Cranor. A Design Space for Effective Privacy Notices. Symposium on Usable Privacy and Security 2015. 

F. Schaub. B. Könings, M. Weber. Context-adaptive Privacy: Leveraging Context Awareness to Support Privacy Decision Making, IEEE Pervasive 

Computing, vol. 14(1), 2015.

simplifying privacy notices and controls
1. emphasize likely unexpected or surprising information

2. contextualize information based on type of service, user 

activity and user goals

3. personalize information based on user characteristics and 

individual information needs

55

55

F. Schaub, R. Balebako, A.L. Durity, L.F. Cranor. A Design Space for Effective Privacy Notices. Symposium on Usable Privacy and Security 2015. 

F. Schaub. B. Könings, M. Weber. Context-adaptive Privacy: Leveraging Context Awareness to Support Privacy Decision Making, IEEE Pervasive 

Computing, vol. 14(1), 2015.

simplifying privacy notices and controls
56

personalized privacy assistants

56

learning privacy profiles from users’ privacy settings

B. Liu, M. Andersen, F. Schaub, H. Almuhimedi, S. Zhang, N. Sadeh, A. Acquisti, Y. Agarwal. Follow My Recommendations: A Personalized Privacy 

Assistant for Mobile App Permissions. Symposium on Usable Privacy and Security 2016.

84 Android users (rooted phones)

2 week field study (1 nudge per day)
57

personalized privacy assistants

57

providing personalized privacy settings recommendations

B. Liu, M. Andersen, F. Schaub, H. Almuhimedi, S. Zhang, N. Sadeh, A. Acquisti, Y. Agarwal. Follow My Recommendations: A Personalized Privacy 

Assistant for Mobile App Permissions. Symposium on Usable Privacy and Security 2016.

profile 

assignment

permission

recommendations
58

personalized privacy assistants for internet of things

58

www.privacyassistant.org

• aggregate disclosures and 

controls across IoT systems

• context-aware privacy 

decision support and 

configuration 

• personalized 

recommendations and 

adaptation
59

personalized privacy assistants for internet of things

59

www.privacyassistant.org

• aggregate disclosures and 

controls across IoT systems

• context-aware privacy 

decision support and 

configuration 

• personalized 

recommendations and 

adaptation

• machine-readable privacy 

disclosures and controls 

needed
60

summary

60

• emphasize unexpected / surprising practices in disclosures

• adapt disclosures to specific contexts

• personalize disclosures and controls

• need for machine-readable disclosures and controls
61

summary

61

• emphasize unexpected / surprising practices in disclosures

• adapt disclosures to specific contexts

• personalize disclosures and controls

• need for machine-readable disclosures and controls

• online studies effective for eliciting expectations and testing 

disclosure variants

• additionally lab and field studies under real conditions
62

summary

62

• emphasize unexpected / surprising practices in disclosures

• adapt disclosures to specific contexts

• personalize disclosures and controls

• need for machine-readable disclosures and controls

• online studies effective for eliciting expectations and testing 

disclosure variants

• additionally lab and field studies under real conditions

Florian Schaub

fschaub@umich.edu

The research presented was funded in part by the National Science Foundation, the Defense Advanced Research Projects Agency, 

the Air Force Research Laboratory, Google, Inc., Yahoo! Inc., and the Carlsberg Foundation.
Putting Disclosures to the Test September 15, 2016

The future of disclosures?

Moderator:

Joseph Calandrino

Research Director, Office of Tech. 

Research & Investigation, FTC

Serge Egelman

UC Berkeley / International 

Computer Science Institute

Tamar Krishnamurti

Dept. of Engineering & Public Policy

Carnegie Mellon University

Florian Schaub

School of Information

University of Michigan

Putting Disclosures to the Test September 15, 2016

Jessica Rich

Director, Bureau of Consumer Protection, FTC