Policy Design

1

• Policy Design
• Creating Effective Privacy Policies
• Presentation by Travis Pinnick
• User Experience Designer, TRUSTe
• NTIA Privacy Multistakeholder Process Mobile
  Application Transparency
• November 30, 2012
• Washington DC.

2
Problems with Privacy Policies

• Privacy Policies are difficult to read (Anton
  2007)
• Misconceptions about protections (Hoofnagle
  2008)
• Time required to read policies is too great
  (McDonald 2008)
• Lack of market differentiation (KnowPrivacy
  2009)

3
Machine-readable Policy Summaries
4
Policy Short Notice Designs
5
Icon-based policy summaries
6
Icon-based policy summaries
7
Layered Policy Design
8
Policy Summary Data in Product Design
9
User Testing - Policy Summaries

• Users dont seem to have preconceived notions of
  what categories make the most sense regarding
  privacy
• Icons aren't as important as presentation and
  finding the appropriate vehicle and context for
  delivery
• Users appreciate attempts to visually simply
  policy data, but that doesnt mean it will
  necessarily influence their behavior

10
Icon-based policy summaries
11
Icon-reading user agents
12
User Testing - Policy Summaries part 2

• Users respond positively to the idea icon-based
  summary data, but arent really able to
  articulate the meaning of the categories even
  after having viewed the descriptions
• Once again, users appreciate attempts to visually
  simply policy data, but that doesnt mean it will
  necessarily influence their behavior

13
Mobile-optimized Policies
14
Policy Summary Data in Mobile
15
Challenges

• Fundamentally, how useful is policy summary data?
• Users report caring about privacy in vast
  majorities when polled, yet this attitude is not
  reflected by their actions
• While summary data provides a helpful layer of
  transparency, theres no reason to assume it will
  affect user behavior
• Depending on whether summary data is
  self-attested or crowd-sourced, it may not be
  useful for enforcement

16
Recommendations

• An effective policy summary should
• Support a users ability to assess a site or
  apps privacy practices at an appropriate time
  and in the right context (like a decision making
  moment such as app download)
• Support a method of delivery that is informative
  without being overwhelming or intrusive to the
  user experience
• Provide only the information that is most
  relevant, like the data collection practices
  which are invisible to users