"It's a scavenger hunt": Usability of Websites' Opt-Out and Data Deletion Choices

We conducted an in-lab user study with 24 participants to explore the usefulness and usability of privacy choices offered by websites. Participants were asked to find and use choices related to email marketing, targeted advertising, or data deletion on a set of nine websites that differed in terms of where and how these choices were presented. They struggled with several aspects of the interaction, such as selecting the correct page from a site's navigation menu and understanding what information to include in written opt-out requests. Participants found mechanisms located in account settings pages easier to use than options contained in privacy policies, but many still consulted help pages or sent email to request assistance. Our findings indicate that, despite their prevalence, privacy choices like those examined in this study are difficult for consumers to exercise in practice. We provide design and policy recommendations for making these website opt-out and deletion choices more useful and usable for consumers.

[1]  Colin M. Gray,et al.  The Dark (Patterns) Side of UX Design , 2018, CHI.

[2]  Yang Wang,et al.  Nudges for Privacy and Security , 2017, ACM Comput. Surv..

[3]  Lorrie Faith Cranor,et al.  An Empirical Analysis of Data Deletion and Opt-Out Choices on 150 Websites , 2019, SOUPS @ USENIX Security Symposium.

[4]  R. Shay,et al.  AdChoices? Compliance with Online Behavioral Advertising Notice and Choice Requirements. Revised Version , 2011 .

[5]  Kassem Fawaz,et al.  The Privacy Policy Landscape After the GDPR , 2018, Proc. Priv. Enhancing Technol..

[6]  Steven M. Belz,et al.  The user action framework: a reliable foundation for usability engineering support tools , 2001, Int. J. Hum. Comput. Stud..

[7]  Lorrie Faith Cranor,et al.  Exploring How Privacy and Security Factor into IoT Device Purchase Behavior , 2019, CHI.

[8]  Leyla Bilge,et al.  Can I Opt Out Yet?: GDPR and the Global Illusion of Cookie Control , 2019, AsiaCCS.

[9]  A.,et al.  Cognitive Engineering , 2008, Encyclopedia of GIS.

[10]  Daniel D. Suthers,et al.  I'm supposed to see that?' AdChoices Usability in the Mobile Environment , 2018, HICSS.

[11]  Benjamin Fabian,et al.  Large-scale readability analysis of privacy policies , 2017, WI.

[12]  Alexander De Luca,et al.  "If I press delete, it's gone" - User Understanding of Online Data Deletion and Expiration , 2018, SOUPS @ USENIX Security Symposium.

[13]  Melanie Volkamer,et al.  What Deters Jane from Preventing Identification and Tracking on the Web? , 2014, WPES.

[14]  Lorrie Faith Cranor,et al.  Americans' attitudes about internet behavioral advertising practices , 2010, WPES '10.

[15]  Colin Potts,et al.  Design of Everyday Things , 1988 .

[16]  Yang Wang,et al.  Smart, useful, scary, creepy: perceptions of online behavioral advertising , 2012, SOUPS.

[17]  John C. Mitchell,et al.  Third-Party Web Tracking: Policy and Technology , 2012, 2012 IEEE Symposium on Security and Privacy.

[18]  Blase Ur,et al.  What do online behavioral advertising privacy disclosures communicate to users? , 2012, WPES '12.

[19]  Martin Degeling,et al.  (Un)informed Consent: Studying GDPR Consent Notices in the Field , 2019, CCS.

[20]  Thorsten Holz,et al.  We Value Your Privacy ... Now Take Some Cookies: Measuring the GDPR's Impact on Web Privacy , 2019, NDSS.

[21]  Arieh Waldman Cognitive Biases, Dark Patterns, and the 'Privacy Paradox' , 2019, Current opinion in psychology.

[22]  A. Azzouz 2011 , 2020, City.

[23]  Lujo Bauer,et al.  (Do Not) Track Me Sometimes: Users’ Contextual Preferences for Web Tracking , 2016, Proc. Priv. Enhancing Technol..

[24]  Dear Mr Sotiropoulos ARTICLE 29 Data Protection Working Party , 2013 .

[25]  Anja Feldmann,et al.  Annoyed Users: Ads and Ad-Block Usage in the Wild , 2015, Internet Measurement Conference.

[26]  Arvind Narayanan,et al.  Characterizing the Use of Browser-Based Blocking Extensions To Prevent Online Tracking , 2018, SOUPS @ USENIX Security Symposium.

[27]  Blase Ur,et al.  Watching Them Watching Me: Browser Extensions Impact on User Privacy Awareness and Concern , 2016 .