{"id":18471,"date":"2019-11-03T01:57:19","date_gmt":"2019-11-03T01:57:19","guid":{"rendered":"https:\/\/www.lifeandnews.com\/articles\/?p=18471"},"modified":"2019-11-04T11:34:29","modified_gmt":"2019-11-04T11:34:29","slug":"website-privacy-options-arent-much-of-a-choice-since-theyre-hard-to-find-and-use","status":"publish","type":"post","link":"https:\/\/www.lifeandnews.com\/articles\/website-privacy-options-arent-much-of-a-choice-since-theyre-hard-to-find-and-use\/","title":{"rendered":"Website privacy options aren&#8217;t much of a choice since they&#8217;re hard to find and use"},"content":{"rendered":"<p><a href=\"https:\/\/theconversation.com\/profiles\/hana-habib-866787\">Hana Habib<\/a>, <em><a href=\"http:\/\/theconversation.com\/institutions\/carnegie-mellon-university-970\">Carnegie Mellon University<\/a><\/em> and <a href=\"https:\/\/theconversation.com\/profiles\/lorrie-cranor-399487\">Lorrie Cranor<\/a>, <em><a href=\"http:\/\/theconversation.com\/institutions\/carnegie-mellon-university-970\">Carnegie Mellon University<\/a><\/em><\/p>\n<p>You\u2019ve probably encountered a pair of shoes that won\u2019t stop following you around the internet, appearing in advertisements on different sites for weeks.<\/p>\n<p>Today, the vast majority of advertising is targeted \u2013 that is, you see an ad because an advertiser thinks that you, specifically, might be interested in what they have to offer. You may have visited a store page for a pair of shoes, or maybe there\u2019s something in your internet browsing history that places you in their target demographic.<\/p>\n<p>While many websites offer a way to opt out of targeted advertisements or unwanted emails, <a href=\"https:\/\/scholar.google.com\/citations?hl=en&amp;user=ROhRS9gAAAAJ\">we<\/a> <a href=\"https:\/\/scholar.google.com\/citations?hl=en&amp;user=kIUqgbcAAAAJ\">discovered<\/a> in <a href=\"https:\/\/www.usenix.org\/conference\/soups2019\/presentation\/habib\">our recent research<\/a> that exercising privacy choices isn\u2019t always easy. But that helped us formulate some simple solutions that could make things easier for users around the web.<\/p>\n<h2>Anything but standardized<\/h2>\n<p><a href=\"https:\/\/scholar.google.com\/citations?user=3sEYZIEAAAAJ&amp;hl=en&amp;oi=ao\">Our<\/a> <a href=\"https:\/\/scholar.google.com\/citations?user=2XCryp4AAAAJ&amp;hl=en&amp;oi=ao\">team<\/a> of <a href=\"https:\/\/scholar.google.com\/citations?user=zg29qGEAAAAJ&amp;hl=en&amp;oi=ao\">research<\/a> <a href=\"https:\/\/scholar.google.com\/citations?user=X57uzqcAAAAJ&amp;hl=en&amp;oi=ao\">collaborators<\/a> examined the privacy choices available on 150 English language websites. On each site, we searched for three common types of privacy choices: requests to be removed from \u2013 that is, opt out of \u2013 email marketing, opt-outs for targeted advertising and data deletion choices. For each privacy choice, we noted where on the website it was located and the steps required to exercise the choice.<\/p>\n<p>The good news is that most websites do offer relevant opt-outs or data deletion options. Eighty-nine percent of sites with email marketing or targeted advertising offered opt-outs for those practices, and 74% had a way for users to request their data be deleted.<\/p>\n<p>More good news: Nearly all websites had a privacy policy link on their homepage, and many of these policies included privacy choices.<\/p>\n<p>The bad news is that the privacy policies we surveyed were long \u2013 on average 3,951 words. They were difficult to read, with only one-third including a table of contents. These policies were written well above the eighth grade reading level <a href=\"https:\/\/privacyrights.org\/resources\/lost-fine-print-readability-financial-privacy-notices-hochhauser\">considered appropriate for the general public<\/a>. Worse, the sections containing privacy choices were even harder to read and understand than the rest of the policy, requiring university-level reading ability.<\/p>\n<p>Key terms aren\u2019t standardized across privacy policies on different sites. When we examined privacy policy section headings, we looked for phrases that appeared in multiple policies, such as \u201cyour choices\u201d and \u201copt out.\u201d Unfortunately, we did not find much consistency.<\/p>\n<p><iframe loading=\"lazy\" id=\"2Q7Xa\" class=\"tc-infographic-datawrapper\" style=\"border: none;\" src=\"https:\/\/datawrapper.dwcdn.net\/2Q7Xa\/8\/\" width=\"100%\" height=\"400px\" frameborder=\"0\"><\/iframe><\/p>\n<p>That makes it difficult for users to scan or search for key words or phrases that might help them understand their options. Users would benefit from standardized language across all websites that describes their privacy choices.<\/p>\n<p>Even when a user manages to find a site\u2019s privacy choices, it may not be clear how to use them.<\/p>\n<p>We learned that some opt-out links, instead of leading to an opt-out tool, went to the homepage of an advertising industry association that hosts an opt-out tool, but elsewhere on the site. Other links were broken. Some policies contained multiple links to various advertising opt-outs, but the sites didn\u2019t explain the differences between the links or whether a user would need to visit one or all of them.<\/p>\n<p>One particular website we encountered, Salesforce, linked to six different advertising opt-out tools. In our view, users should not have to parse a website\u2019s complicated third-party relationships; the websites themselves should make it easy for users to opt out of targeted advertising, no matter who is serving it.<\/p>\n<h2>Uncertain effects<\/h2>\n<p>Once someone does manage to opt-out, it\u2019s not always clear what will happen.<\/p>\n<p>Most websites we visited did not tell users exactly what they could opt out of. Some websites let users request to not be tracked for advertising, while others allow users to opt out of targeted advertising but not the tracking. In this case, a hypothetical shoe ad wouldn\u2019t appear on the site, but the company advertising the shoes may learn that you visited the site.<\/p>\n<p>Only about half of the websites that offered opt-outs for targeted advertising explained whether opting out of seeing targeted ads also meant that users would not be tracked. Users might believe they are protecting themselves from tracking when in fact they are not.<\/p>\n<p>Even when the choices are clear, the pages are not always easy to use.<\/p>\n<p>For example, to opt out of all of Amazon\u2019s email communications, we had to scroll past a list of 79 options before seeing the option to \u201copt out of all marketing.\u201d<\/p>\n<p>At The New York Times, deleting the data they\u2019d gathered on us required completing 38 different actions, including finding and reading the privacy policy, following the link to the data deletion request form, selecting a request type, selecting up to 22 check boxes, filling in eight form fields, selecting four additional confirmation boxes and completing an \u201cI am not a robot\u201d test.<\/p>\n<p>Even if these design decisions are unintentional, companies are effectively deterring their users from exercising privacy choices.<\/p>\n<figure class=\"align-center zoomable\"><a href=\"https:\/\/images.theconversation.com\/files\/298564\/original\/file-20191024-170493-1jvilnc.png?ixlib=rb-1.1.0&amp;q=45&amp;auto=format&amp;w=1000&amp;fit=clip\"><img src=\"https:\/\/images.theconversation.com\/files\/298564\/original\/file-20191024-170493-1jvilnc.png?ixlib=rb-1.1.0&amp;q=45&amp;auto=format&amp;w=754&amp;fit=clip\" sizes=\"(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px\" srcset=\"https:\/\/images.theconversation.com\/files\/298564\/original\/file-20191024-170493-1jvilnc.png?ixlib=rb-1.1.0&amp;q=45&amp;auto=format&amp;w=600&amp;h=322&amp;fit=crop&amp;dpr=1 600w, https:\/\/images.theconversation.com\/files\/298564\/original\/file-20191024-170493-1jvilnc.png?ixlib=rb-1.1.0&amp;q=30&amp;auto=format&amp;w=600&amp;h=322&amp;fit=crop&amp;dpr=2 1200w, https:\/\/images.theconversation.com\/files\/298564\/original\/file-20191024-170493-1jvilnc.png?ixlib=rb-1.1.0&amp;q=15&amp;auto=format&amp;w=600&amp;h=322&amp;fit=crop&amp;dpr=3 1800w, https:\/\/images.theconversation.com\/files\/298564\/original\/file-20191024-170493-1jvilnc.png?ixlib=rb-1.1.0&amp;q=45&amp;auto=format&amp;w=754&amp;h=404&amp;fit=crop&amp;dpr=1 754w, https:\/\/images.theconversation.com\/files\/298564\/original\/file-20191024-170493-1jvilnc.png?ixlib=rb-1.1.0&amp;q=30&amp;auto=format&amp;w=754&amp;h=404&amp;fit=crop&amp;dpr=2 1508w, https:\/\/images.theconversation.com\/files\/298564\/original\/file-20191024-170493-1jvilnc.png?ixlib=rb-1.1.0&amp;q=15&amp;auto=format&amp;w=754&amp;h=404&amp;fit=crop&amp;dpr=3 2262w\" alt=\"\" \/><\/a><figcaption><span class=\"caption\">Sites use their own language to signal to users where they might delete their data.<\/span><br \/>\n<span class=\"attribution\"><a class=\"source\" href=\"https:\/\/www.usenix.org\/sites\/default\/files\/conference\/protected-files\/soups19_slides_habib.pdf\">Habib et al<\/a><\/span><\/figcaption><\/figure>\n<h2>Consistency is key<\/h2>\n<p>When it comes to digital privacy, we think consistency is key.<\/p>\n<p>Websites need to provide choices that are easy to find, understand and use. They should simplify things by offering one-click opt-out options that consolidate multiple links and dozens of options.<\/p>\n<p>It should go without saying that the opt-out links need to actually work.<\/p>\n<p>If websites offer users the ability to make fine-grained choices, it would be helpful to put them all in one place and adopt consistent terminology.<\/p>\n<p>Furthermore, websites need to clarify what opt-out options do.<\/p>\n<p>And perhaps most important, regulators should hold companies accountable not only for offering choices, but for choices that are specific and that consumers can actually use.<\/p>\n<p>[ <em>You\u2019re smart and curious about the world. So are The Conversation\u2019s authors and editors.<\/em> <a href=\"https:\/\/theconversation.com\/us\/newsletters\/weekly-highlights-61?utm_source=TCUS&amp;utm_medium=inline-link&amp;utm_campaign=newsletter-text&amp;utm_content=weeklysmart\">You can get our highlights each weekend.<\/a>]<!-- Below is The Conversation's page counter tag. Please DO NOT REMOVE. --><img loading=\"lazy\" style=\"border: none !important; box-shadow: none !important; margin: 0 !important; max-height: 1px !important; max-width: 1px !important; min-height: 1px !important; min-width: 1px !important; opacity: 0 !important; outline: none !important; padding: 0 !important; text-shadow: none !important;\" src=\"https:\/\/counter.theconversation.com\/content\/124631\/count.gif?distributor=republish-lightbox-basic\" alt=\"The Conversation\" width=\"1\" height=\"1\" \/><!-- End of code. If you don't see any code above, please get new code from the Advanced tab after you click the republish button. The page counter does not collect any personal data. More info: http:\/\/theconversation.com\/republishing-guidelines --><\/p>\n<p><a href=\"https:\/\/theconversation.com\/profiles\/hana-habib-866787\">Hana Habib<\/a>, Graduate Research Assistant at the Institute for Software Research, <em><a href=\"http:\/\/theconversation.com\/institutions\/carnegie-mellon-university-970\">Carnegie Mellon University<\/a><\/em> and <a href=\"https:\/\/theconversation.com\/profiles\/lorrie-cranor-399487\">Lorrie Cranor<\/a>, Professor of Computer Science and of Engineering &amp; Public Policy, <em><a href=\"http:\/\/theconversation.com\/institutions\/carnegie-mellon-university-970\">Carnegie Mellon University<\/a><\/em><\/p>\n<p>This article is republished from <a href=\"http:\/\/theconversation.com\">The Conversation<\/a> under a Creative Commons license. Read the <a href=\"https:\/\/theconversation.com\/website-privacy-options-arent-much-of-a-choice-since-theyre-hard-to-find-and-use-124631\">original article<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hana Habib, Carnegie Mellon University and Lorrie Cranor, Carnegie Mellon University You\u2019ve probably encountered a pair of shoes that won\u2019t stop following you around the internet, appearing in advertisements on different sites for weeks. Today, the vast majority of advertising is targeted \u2013 that is, you see an ad because an advertiser thinks that you, [&hellip;]<\/p>\n","protected":false},"author":44,"featured_media":18468,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3410],"tags":[310,527,526,6899,4316,549,5927,5081,881,7188,525,4315,1026,7187],"_links":{"self":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/18471"}],"collection":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/comments?post=18471"}],"version-history":[{"count":2,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/18471\/revisions"}],"predecessor-version":[{"id":18474,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/18471\/revisions\/18474"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media\/18468"}],"wp:attachment":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media?parent=18471"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/categories?post=18471"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/tags?post=18471"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}