How Does Connecting Online Activities to Advertising Inferences Impact Privacy Perceptions? (2312.13813v1)
Abstract: Data dashboards are designed to help users manage data collected about them. However, prior work showed that exposure to some dashboards, notably Google's My Activity dashboard, results in significant decreases in perceived concern and increases in perceived benefit from data collection, contrary to expectations. We theorize that this result is due to the fact that data dashboards currently do not sufficiently "connect the dots" of the data food chain, that is, by connecting data collection with the use of that data. To evaluate this, we designed a study where participants assigned advertising interest labels to their own real activities, effectively acting as a behavioral advertising engine to "connect the dots." When comparing pre- and post-labeling task responses, we find no significant difference in concern with Google's data collection practices, which indicates that participants' priors are maintained after more exposure to the data food chain (differing from prior work), suggesting that data dashboards that offer deeper perspectives of how data collection is used have potential. However, these gains are offset when participants are exposed to their true interest labels inferred by Google. Concern for data collection dropped significantly as participants viewed Google's labeling as generic compared to their own more specific labeling. This presents a possible new paradox that must be overcome when designing data dashboards, the generic paradox, which occurs when users misalign individual, generic inferences from collected data as benign compared to the totality and specificity of many generic inferences made about them.
- Amazon. 2023. Amazon Ad Preferences. https://www.amazon.com/adprefs, as of December 15, 2023.
- Measuring the Facebook Advertising Ecosystem. In Symposium on Network and Distributed System Security (NDSS ’19). ISOC, San Diego, California, USA.
- Who Am I? A Design Probe Exploring Real-Time Transparency about Online and Offline User Profiling Underlying Targeted Ads. In ACM Conference on Pervasive and Ubiquitous Computing (UbiComp ’21). ACM, Virtual Conference, 88:1–88:32.
- Quantity vs. Quality: Evaluating User Interest Profiles Using Ad Preference Managers. In Symposium on Network and Distributed System Security (NDSS ’19). ISOC, San Diego, California, USA.
- The Search Dashboard: How Reflection and Comparison Impact Search Behavior. In ACM Conference on Human Factors in Computing Systems (CHI ’12). ACM, Austin, Texas, USA, 1785–1794.
- When Coding Style Survives Compilation: De-anonymizing Programmers from Executable Binaries. In Symposium on Network and Distributed System Security (NDSS ’18). ISOC, San Diego, California, USA.
- Farah Chanchary and Sonia Chiasson. 2015. User Perceptions of Sharing, Advertising, and Tracking. In Symposium on Usable Privacy and Security (SOUPS ’15). USENIX, Ottawa, Canada, 53–67.
- Automated Experiments on Ad Privacy Settings. In Privacy Enhancing Technologies Symposium (PETS ’15). Sciendo, Philadelphia, Pennsylvania, USA, 92–112.
- Yves-Alexandre De Montjoye, Laura Radaelli, Vivek Kumar Singh, and Alex “Sandy” Pentland. 2015. Unique in the Shopping Mall: On the Reidentifiability of Credit Card Metadata. Science 347, 6221 (Jan. 2015), 536–539.
- Unpacking Perceptions of Data-Driven Inferences Underlying Online Targeting and Personalization. In ACM Conference on Human Factors in Computing Systems (CHI ’18). ACM, Montreal, Quebec, Canada, 493:1–493:12.
- Are Privacy Dashboards Good for End Users? Evaluating User Perceptions and Reactions to Google’s My Activity. In USENIX Security Symposium (SSYM ’21). USENIX, Virtual Conference, 483–500.
- Transparency, Privacy and Trust – Technology for Tracking and Controlling My Data Disclosures: Does This Work?. In IFIP International Conference on Trust Management (IFIP TM ’16). IFIP, Darmstadt, Germany, 3–14.
- Rowanne Fleck and Geraldine Fitzpatrick. 2010. Reflecting on Reflection: Framing a Design Landscape. In Australian Conference on Human-Computer Interaction (OZCHI ’10). ACM, Brisbane, Australia, 216–223.
- Google, Inc. 2020. How to Personalize the Ads You See on YouTube and Google. https://www.youtube.com/watch?v=hdBTv1x7iLk, as of December 15, 2023.
- Google, Inc. 2021. AdWords API (Deprecated): Verticals. https://developers.google.com/adwords/api/docs/appendix/verticals, as of December 15, 2023.
- Google, Inc. 2022. Google My Ad Center: What is My Ad Center? https://support.google.com/My-Ad-Center-Help/answer/12155154, as of December 15, 2023.
- Eelco Herder and Olaf van Maaren. 2020. Privacy Dashboards: The Impact of the Type of Personal Data and User Control on Trust and Perceived Risk. In ACM Conference on User Modeling, Adaptation and Personalization (UMAP ’20). ACM, Virtual Conference, 169–174.
- Aleksandra Korolova. 2010. Privacy Violations Using Microtargeted Ads: A Case Study. In IEEE International Conference on Data Mining Workshops (ICDMW ’10). IEEE, Sydney, New South Wales, Australia, 474–482.
- LinkedIn Corporation. 2023. LinkedIn Ad Preferences. https://www.linkedin.com/psettings/advertising, as of December 15, 2023.
- Meta. 2023. Facebook Ad Preferences. https://www.facebook.com/adpreferences, as of December 15, 2023.
- Microsoft Corporation. 2023. Microsoft Ad Preferences. https://account.microsoft.com/privacy/ad-settings, as of December 15, 2023.
- Arvind Narayanan and Vitaly Shmatikov. 2008. Robust De-Anonymization of Large Sparse Datasets. In IEEE Symposium on Security and Privacy (SP ’08). IEEE, Oakland, California, USA, 111–125.
- Helen Nissenbaum. 2019. Contextual Integrity Up and Down the Data Food Chain. Theoretical Inquiries in Law 20, 1 (Jan. 2019), 221–256.
- U.S.Department of Justice. 2022. United States of America v. Google LLC (1:20-Cv-03010): Document 398. https://www.courtlistener.com/docket/18552824/united-states-of-america-v-google-llc/, as of December 15, 2023.
- David Pierce. 2020. Google’s New Magic Number for Storing Personal Data: 18 Months. https://www.protocol.com/google-delete-data-18-months, as of December 15, 2023.
- Prolific, Academic Ltd. 2022. A Higher Standard of Online Research. https://www.prolific.co, as of December 15, 2023.
- Emilee Rader. 2014. Awareness of Behavioral Tracking and Information Privacy Concern in Facebook and Google. In Symposium on Usable Privacy and Security (SOUPS ’14). USENIX, Menlo Park, California, USA, 51–67.
- “I Have a Narrow Thought Process”: Constraints on Explanations Connecting Inferences and Self-Perceptions. In Symposium on Usable Privacy and Security (SOUPS ’20). USENIX, Virtual Conference, 457–488.
- Designing a GDPR-Compliant and Usable Privacy Dashboard. In IFIP International Summer School on Privacy and Identity Management (IFIP SC ’17). IFIP, Ispra, Italy, 221–236.
- How Well Do My Results Generalize? Comparing Security and Privacy Survey Results from MTurk, Web, and Telephone Samples. In IEEE Symposium on Security and Privacy (SP ’19). IEEE, San Francisco, California, USA, 227–244.
- Analysis of Google Ads Settings Over Time: Updated, Individualized, Accurate, and Filtereds. In Workshop on Privacy in the Electronic Society (WPES ’23). ACM, Copenhagen, Denmark, 167–172.
- Analyzing the Impact and Accuracy of Facebook Activity on Facebook’s Ad-Interest Inference Process. In ACM Conference on Computer-Supported Cooperative Work and Social Computing (CSCW ’22). ACM, Virtual Conference, 76:1–76:34.
- Replication: How Well Do My Results Generalize Now? The External Validity of Online Privacy and Security Surveys. In Symposium on Usable Privacy and Security (SOUPS ’22). USENIX, Boston, Massachusetts, USA, 367–385.
- The Accuracy of the Demographic Inferences Shown on Google’s Ad Settings. In Workshop on Privacy in the Electronic Society (WPES ’18). ACM, Toronto, Canada, 33–41.
- Smart, Useful, Scary, Creepy: Perceptions of Online Behavioral Advertising. In Symposium on Usable Privacy and Security (SOUPS ’12). ACM, Washington, D.C., USA, 4:1–4:15.
- Privacy Risks with Facebook’s PII-Based Targeting: Auditing a Data Broker’s Advertising Interface. In IEEE Symposium on Security and Privacy (SP ’18). IEEE, San Francisco, California, USA, 89–107.
- Intuitions, Analytics, and Killing Ants: Inference Literacy of High School-Educated Adults in the US. In Symposium on Usable Privacy and Security (SOUPS ’16). USENIX, Denver, Colorado, USA, 271–285.
- What Twitter Knows: Characterizing Ad Targeting Practices, User Perceptions, and Ad Explanations Through Users’ Own Twitter Data. In USENIX Security Symposium (SSYM ’20). USENIX, Virtual Conference, 145–162.
- Oh, the Places You’ve Been! User Reactions to Longitudinal Transparency About Third-Party Web Tracking and Inferencing. In ACM Conference on Computer and Communications Security (CCS ’19). ACM, London, United Kingdom, 149–166.
- Craig E. Wills and Can Tatar. 2012. Understanding What They Do with What They Know. In Workshop on Privacy in the Electronic Society (WPES ’12). ACM, Raleigh, North Carolina, USA, 13–18.
- X Corporation. 2023. Twitter Ad Preferences. https://twitter.com/settings/ads_preferences, as of December 15, 2023.
- Hui Zang and Jean Bolot. 2011. Anonymization of Location Data Does Not Work: A Large-Scale Measurement Study. In International Conference on Mobile Computing and Networking (MobiCom ’11). ACM, Las Vegas, Nevada, USA, 145–156.
- Privacy Dashboards: Reconciling Data-Driven Business Models and Privacy. In IEEE Conference on Availability, Reliability and Security (ARES ’14). IEEE, Fribourg, Switzerland, 152–157.
- Florian M. Farke (4 papers)
- David G. Balash (7 papers)
- Maximilian Golla (5 papers)
- Adam J. Aviv (24 papers)