"I need a better description'': An Investigation Into User Expectations For Differential Privacy

TL;DR

This study explores user perceptions and expectations of differential privacy through surveys, revealing that users care about specific information leaks, are more willing to share data when risks are low, and that descriptions of differential privacy influence their expectations.

Contribution

It provides empirical insights into user privacy expectations and introduces a framework for understanding willingness to share data with differentially private systems based on user concerns and descriptions.

Findings

Users care about specific information leaks protected by differential privacy.

Willingness to share data increases when leak risks are perceived as low.

Descriptions of differential privacy in the wild can mislead user expectations.

Abstract

Despite recent widespread deployment of differential privacy, relatively little is known about what users think of differential privacy. In this work, we seek to explore users' privacy expectations related to differential privacy. Specifically, we investigate (1) whether users care about the protections afforded by differential privacy, and (2) whether they are therefore more willing to share their data with differentially private systems. Further, we attempt to understand (3) users' privacy expectations of the differentially private systems they may encounter in practice and (4) their willingness to share data in such systems. To answer these questions, we use a series of rigorously conducted surveys (n=2424). We find that users care about the kinds of information leaks against which differential privacy protects and are more willing to share their private information when the risks of these leaks are less likely to happen. Additionally, we find that the ways in which differential privacy is described in-the-wild haphazardly set users' privacy expectations, which can be misleading depending on the deployment. We synthesize our results into a framework for understanding a user's willingness to share information with differentially private systems, which takes into account the interaction between the user's prior privacy concerns and how differential privacy is described.