# User Perception of Facebook App Data Access: A Comparison of Methods and Privacy Concerns
## 3 Experimental Design
### Pre- and Post-Test Questionnaires
#### 3.1.1 Demographic and Background Questions  
We collected basic demographic information about our subjects: age, gender, the country where they grew up, and education level. We used this to determine if any demographic features impacted subjects' privacy attitudes. Next, we wanted to gain a basic understanding of subjects' privacy attitudes. We included the Westin/Harris Privacy Segmentation Model [15; 16], which uses three questions to group users into three categories: privacy fundamentalists, privacy pragmatists, and privacy unconcerned. This survey has three statements, to which users respond \"strongly disagree\", \"somewhat disagree\", \"somewhat agree\", or \"strongly agree\":  
1. Consumers have lost all control over how personal information is collected and used by companies. 2. Most businesses handle the personal information they collect about consumers in a proper and confidential way. 3. Existing laws and organizational practices provide a reasonable level of protection for consumer privacy today. Privacy fundamentalists agree with statement 1 and disagree with statements 2 and 3. Privacy unconcerned subjects disagree with statement 1 and agree with statements 2 and 3. All other subjects are considered privacy pragmatists [15; 16]. In addition, we included questions adapted from the survey instrument in [17], designed to elicit general attitudes and behavior related to privacy online. We adapted some questions to be Facebook specific. These questions are shown in Table 1 and were rated on a 5-point Likert scale from \"Never\" to \"Always\" in accordance with the initial survey design. In the second half of the pre-test, we asked users about their Facebook-specific questions. These were also adapted from questions in the [17] survey instrument. Subjects answered each on a 5-point Likert scale ranging from \"Not at all\" to \"Very much\" in accordance with the original survey design. These questions are shown in Table 2. Significant increases are marked * for \(p<0.05\) and ** for \(p<0.01\). \begin{table}
\begin{tabular}{l r} \hline \hline
**Question** & **Average Score** \\ \hline
**Do you...** & \\ read a website’s privacy policy before you register your information? & 2.21 \\ look for a privacy certification on a website before you register your information? & 2.48 \\ read license agreements fully before you agree to them? & 1.79 \\ block people on Facebook that you do not want to see your information? & 3.63 \\ use apps on Facebook? & 59.1\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Questions regarding general online privacy concerns. Each question is rated on a 5 point Likert scale from “Never” (1) to “Always” (5), except for the final question which is shown as the percentage of yes answers. Finally, we asked subjects to tell us if they believed Facebook apps could or could not access specific types of personal information These are shown in Table 3.  
With the right permissions, apps can access any of the data points listed here, though not all apps can do it all the time, and users have the ability to deny this access in some cases. Some information, like name, gender, and profile photo, can be accessed by all apps with basic permissions. Other information can be accessed, but only when apps explicitly request extended permissions. There are also varying levels of extended permissions. For some extended permissions, a user has no way to deny the access except by refusing to install the app. In other cases, the user can install the app but deny access. For very sensitive types of information, like access to a user's inbox, clear additional dialogue boxes are shown to alert users about the permission they are granting.