Data is the new currency. Every second we spend on the internet is an opportunity for companies to collect, process and sell our information without our consent. 

The consequences? More and more Americans are feeling concerned and just plain confused about their lack of agency and control. 

For a long time, internet users have begrudgingly accepted this lack of privacy. But University of Michigan School of Information associate professor of information Florian Schaub is helping users gain a little more control over their data. 

He, along with researchers at Carnegie Mellon University, Fordham University and former UMSI doctoral candidate Yixin Zou have developed and evaluated a privacy choice icon. This icon, now enacted into California law, requires websites that profit off user data to implement an opt-out link on their platforms. The icon has to appear next to a “Your Privacy Choices” or “Your California Privacy Choices” link.The research team went through a multi-stage design and user research process to ensure that the final icon clearly conveys the presence of choices related to privacy and does not confuse consumers.

“If people know how their data is being monetized, they would probably be very unhappy,” he says. “I hope this icon is something people look for and recognize as a tool they can use to better control how their data is used.” 

Historically, searching for opt-out options can be puzzling. Sometimes, it’s in a user’s account settings. It can also be found in the hundreds of pages of privacy policy documents companies dish out to users, knowing they won’t read them. 

“Companies in the U.S need to provide you with a privacy policy, so you can decide which service you trust with your data,” says Schaub. “But that fails on so many levels. People don’t read privacy policies, and even if you were to read them, they’re written so vaguely because they cover all the services and products a company offers. If you want to understand what actual data a company is collecting about you, say when you watch a Youtube video or talk to your Alexa device, or how that data is then used later the privacy policy is often of little help..” 

Schaub is hoping the icon will be made into law in states outside of California to signal to consumers where they can find their privacy choices. 

But Schaub also cautions that giving consumers the option to opt-out of some practices is not enough. “I think ultimately if we want to improve privacy protections, we need better guardrails in terms of what companies can and cannot do with user data,” Schaub says.

Schaub has long been working on research focused on human-centered privacy and security, paving new ways of understanding people’s needs and designing solutions that center their concerns. He advised former UMSI doctoral candidate Yixin Zou, who is currently a tenure-track faculty member at the Max Planck Institute for Security and Privacy in Bochum, Germany.

She worked with the research team on designing and implementing the icon. 

“Seeing the research’s tangible impact on the California privacy regulation, which has possible impact beyond California consumers, is really the most exciting part,” Zou says. “I think the two key ingredients for this impact to happen are proactively refocusing our research in ways to answer policymakers’ questions and staying engaged in the policymaking process while quickly reacting to changes.

I learned a lot of valuable lessons from this experience and with my new position, I am excited to apply these lessons in possible collaborations with regulators and policymakers in Europe.”

See an example of how the privacy choice icon works by visiting companies like Verizon, Hyundai and Spotify. The icon is located at the bottom header of their websites. Though people outside of California can use the icon, companies are currently not obligated to honor the opt out requests of consumers if they are not located in California. This might change with more and more states adopting state-level privacy laws and Congressional efforts to pass a federal privacy law.

To learn more about the research that led to the privacy choices icon see Florian Schaub and Lorrie Cranor’s recorded presentation from the 2020 USENIX Conference on Privacy Engineering Practice and Respect.

RELATED

The full research team for this project includes Yixin Zou (formerly U-M, now MPI-SP), Hana Habib (CMU), Yaxing Yao (UMBC), Joel Reidenberg (Fordham University), Alessandro Acquisti (CMU), Norman Sadeh (CMU), Lorrie Cranor (CMU) and Florian Schaub (U-M). 

Check out more research on human-centered privacy and security by Florian Schaub by visiting his UMSI faculty profile.