By the user, for the user: A user-centric approach to quantifying the privacy of websites

TL;DR

This paper introduces a user-centric privacy scoring system for websites that incorporates user perceptions and preferences, aiming to better inform users about privacy risks based on their understanding.

Contribution

It presents a novel methodology and proof-of-concept tool that weights trackers according to user perceptions and website context, enhancing privacy assessment accuracy.

Findings

Survey of 43 users on tracker perceptions

Development of a privacy scoring system

Initial validation with bootstrap data

Abstract

Third-party tracking is common on almost all commercially operated websites. Prior work has studied in detail the extent of third-party tracking on the web, detection of third-party trackers, and defending against third-party tracking. Existing research and tools have also attempted to inform web users of trackers and the extent of their privacy violations. However, existing tools do not take into account users' perceptions of and understanding of the extent of trackers on the web. Taking these factors into account is important for the usability of such tools so that users can be aware and protect themselves to a reasonable and necessary extent that aligns with their overall comfort with trackers. In this paper, we elicit user perceptions and preferences about different trackers on various websites through an online survey of 43 users. We use this data to bootstrap a privacy scoring system. This scoring system weights the usage of trackers and the dispersion of user data within a page to third parties, with the type of website being visited. Our work presents a proof-of-concept methodology and tool to calculate a user-centric privacy score with preliminary bootstrap user data. We conclude with concrete future directions.