Beyond Privacy Labels: How Users Perceive Different Information Sources for Understanding App's Privacy Practices

TL;DR

This paper investigates how users perceive different information sources like privacy policies, reviews, and assessments to better understand app privacy practices, highlighting the importance of combining sources for improved privacy comprehension.

Contribution

It introduces a framework for integrating multiple information sources to enhance user understanding of app privacy practices, addressing limitations of traditional privacy labels.

Findings

Perceived usefulness varies based on user experience.

Trust in information sources is highly individual.

Combining sources improves privacy understanding.

Abstract

Despite having growing awareness and concerns about privacy, technology users are often insufficiently informed of the data practices of various digital products to protect themselves. Privacy policies and privacy labels, as two conventional ways of communicating data practices, are each criticized for important limitations -- one being lengthy and filled with legal jargon, and the other oversimplified and inaccurate -- causing users significant difficulty in understanding the privacy practices of the products and assessing their impact. To mitigate those issues, we explore ways to enhance privacy labels with the relevant content in complementary sources, including privacy policy, app reviews, and community-curated privacy assessments. Our user study results indicate that perceived usefulness and trust on those information sources are personal and influenced by past experience. Our work highlights the importance of considering various information needs for privacy practice and consolidating different sources for more useful privacy solutions.