Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites

TL;DR

This study investigates how website developers consider privacy when integrating third-party services, revealing that privacy is often overlooked unless legally mandated or explicitly guided.

Contribution

It provides empirical insights into decision processes behind third-party service adoption and privacy considerations in website development.

Findings

Ease of integration drives third-party adoption

Legal requirements influence privacy considerations

Awareness of data collection increases with direct association to service purpose

Abstract

Modern websites frequently use and embed third-party services to facilitate web development, connect to social media, or for monetization. This often introduces privacy issues as the inclusion of third-party services on a website can allow the third party to collect personal data about the website's visitors. While the prevalence and mechanisms of third-party web tracking have been widely studied, little is known about the decision processes that lead to websites using third-party functionality and whether efforts are being made to protect their visitors' privacy. We report results from an online survey with 395 participants involved in the creation and maintenance of websites. For ten common website functionalities we investigated if privacy has played a role in decisions about how the functionality is integrated, if specific efforts for privacy protection have been made during integration, and to what degree people are aware of data collection through third parties. We find that ease of integration drives third-party adoption but visitor privacy is considered if there are legal requirements or respective guidelines. Awareness of data collection and privacy risks is higher if the collection is directly associated with the purpose for which the third-party service is used.