"Your hashed IP address: Ubuntu.": perspectives on transparency tools for online advertising

Ad personalization has been criticized in the past for invading privacy, lack of transparency, and improper controls offered to users. Recently, companies started to provide web portals and other means for users to access data collected about them. In this paper, we study these new transparency tools from multiple perspectives using a mixed-methods approach. Still practices of data sharing barely changed until recently when new legislation required all companies to grant individual access to personal data stored about them. Using a mixed-methods approach we study the benefits of the new rights for users. First, we analyze transparency tools provided by 22 companies and check whether they follow previous recommendations for usability and user expectations. Based on these insights, we conduct a survey with 490 participants to evaluate three common approaches to disclose data. To complement this user-centric view, we shed light on the design decisions and complexities of transparency in online advertising using an online survey (n = 24) and in-person interviews (n = 8) with experts from the industry. We find that newly created transparency tools present a variety of information to users, from detailed technical logs to high-level interest segment information. Our results indicate that users do not (yet) know what to learn from the data and mistrust the accuracy of the information shown to them. At the same time, new transparency requirements pose several challenges to an industry that excessively shares data that even they sometimes cannot relate to an individual.

[1]  Arvind Narayanan,et al.  The Web Never Forgets: Persistent Tracking Mechanisms in the Wild , 2014, CCS.

[2]  Krishna P. Gummadi,et al.  Investigating Ad Transparency Mechanisms in Social Media: A Case Study of Facebooks Explanations , 2018, NDSS.

[3]  Nick Nikiforakis,et al.  Extended Tracking Powers: Measuring the Privacy Diffusion Enabled by Browser Extensions , 2017, WWW.

[4]  Blase Ur,et al.  Unpacking Perceptions of Data-Driven Inferences Underlying Online Targeting and Personalization , 2018, CHI.

[5]  Thorsten Holz,et al.  We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy , 2019, NDSS.

[6]  m.eik michalke,et al.  An R Package for Text Analysis , 2015 .

[7]  Norbert Pohlmann,et al.  Towards Understanding Privacy Implications of Adware and Potentially Unwanted Programs , 2018, ESORICS.

[8]  Lorrie Faith Cranor,et al.  Americans' attitudes about internet behavioral advertising practices , 2010, WPES '10.

[9]  A. Panter,et al.  APA handbook of research methods in psychology, Vol 2: Research designs: Quantitative, qualitative, neuropsychological, and biological. , 2012 .

[10]  Norbert Pohlmann,et al.  GDPiRated - Stealing Personal Information On- and Offline , 2019, ESORICS.

[11]  Yang Wang,et al.  Smart, useful, scary, creepy: perceptions of online behavioral advertising , 2012, SOUPS.

[12]  Claude Castelluccia,et al.  MyAdChoices: Bringing Transparency and Control to Online Advertising , 2016, ACM Trans. Web.

[13]  Christo Wilson,et al.  Quantity vs. Quality: Evaluating User Interest Profiles Using Ad Preference Managers , 2019, NDSS.

[14]  Michael D. Buhrmester,et al.  Amazon's Mechanical Turk , 2011, Perspectives on psychological science : a journal of the Association for Psychological Science.

[15]  Mireille Hildebrandt,et al.  The Dawn of a Critical Transparency Right for the Profiling Era , 2012 .

[16]  Blase Ur,et al.  Watching Them Watching Me: Browser Extensions Impact on User Privacy Awareness and Concern , 2016 .

[17]  Colin Potts,et al.  Privacy policies as decision-making tools: an evaluation of online privacy notices , 2004, CHI.

[18]  Vitaly Shmatikov,et al.  What Mobile Ads Know About Mobile Users , 2016, NDSS.

[19]  Yang Wang,et al.  Why Johnny can't opt out: a usability evaluation of tools to limit online behavioral advertising , 2012, CHI.

[20]  Benjamin Fabian,et al.  Large-scale readability analysis of privacy policies , 2017, WI.

[21]  Narseo Vallina-Rodriguez,et al.  Apps, Trackers, Privacy, and Regulators: A Global Study of the Mobile Tracking Ecosystem , 2018, NDSS.

[22]  Lujo Bauer,et al.  (Do Not) Track Me Sometimes: Users’ Contextual Preferences for Web Tracking , 2016, Proc. Priv. Enhancing Technol..

[23]  U. Flick,et al.  The SAGE Handbook of Qualitative Data Analysis , 2013 .

[24]  Curtis R. Taylor,et al.  The Economics of Privacy , 2016 .

[25]  Alessandro Acquisti,et al.  Raise the Curtains: The Effect of Awareness About Targeting on Consumer Attitudes and Purchase Intentions , 2017, SOUPS.

[26]  Aleecia M. McDonald,et al.  Access Denied! Contrasting Data Access in the United States and Ireland , 2016, Proc. Priv. Enhancing Technol..

[27]  Bettina Berendt,et al.  Data Mining for Information Literacy , 2012 .

[28]  H. Cooper,et al.  Research designs : quantitative, qualitative, neuropsychological, and biological , 2012 .

[29]  M. Angela Sasse,et al.  Too close for comfort: a study of the effectiveness and acceptability of rich-media personalized advertising , 2012, CHI.

[30]  Krishna P. Gummadi,et al.  Treads: Transparency-Enhancing Ads , 2018, HotNets.

[31]  Cédric Lauradoux,et al.  Security Analysis of Subject Access Request Procedures - How to Authenticate Data Subjects Safely When They Request for Their Data , 2019, APF.

[32]  Catarina Sismeiro,et al.  A Model of Web Site Browsing Behavior Estimated on Clickstream Data , 2003 .

[33]  Norbert Pohlmann,et al.  A Study on Subject Data Access in Online Advertising After the GDPR , 2019, DPM/CBT@ESORICS.

[34]  Norman M. Sadeh,et al.  What do they know about me? Contents and Concerns of Online Behavioral Profiles , 2015, ArXiv.

[35]  Ramesh Govindan,et al.  AdReveal: improving transparency into online targeted advertising , 2013, HotNets.

[36]  Martin Degeling,et al.  (Un)informed Consent: Studying GDPR Consent Notices in the Field , 2019, CCS.

[37]  Michael Carl Tschantz,et al.  Exploring User Perceptions of Discrimination in Online Targeted Advertising , 2017, USENIX Security Symposium.

[38]  Jun Wang,et al.  Real-time bidding for online advertising: measurement and analysis , 2013, ADKDD '13.

[39]  Sonia Chiasson,et al.  Privacy Concerns Amidst OBA and the Need for Alternative Models , 2018, IEEE Internet Computing.

[40]  Musa J Jafar,et al.  Exploratory Analysis Of The Readability Of Information Privacy Statement Of The Primary Social Networks , 2011 .

[41]  Wim Lamotte,et al.  Personal Information Leakage by Abusing the GDPR 'Right of Access' , 2019, SOUPS @ USENIX Security Symposium.

[42]  Arvind Narayanan,et al.  Online Tracking: A 1-million-site Measurement and Analysis , 2016, CCS.