CAREER: Presentation and Mitigation of Privacy Risks for Online Users

让在线系统的用户了解正在使用的在线服务的隐私做法和控制，这是一个长期存在的挑战。几十年来，“通知和选择”框架一直是披露和控制在线隐私做法的管理做法。隐私通知体现在冗长的隐私政策中，告知用户网站、设备、应用程序或服务提供商如何处理他们的数据。通知为用户的选择铺平了道路。通过在线设置和菜单，用户可以选择加入数据收集，授权将他们的数据传输到第三方广告网络，或控制他们的数据共享的程度。然而，在目前的形式下，策略很难让用户理解，控制设置也不友好。虽然一些提供商已经提高了隐私政策的可读性，但这些通知仍然很长，很难遵循。此外，无法访问的隐私设置使用户很难有效地控制他们的隐私。因此，用户更有可能依赖默认选项，而不是微调他们使用的每项服务的设置。当服务提供商的行为与用户的隐私偏好不匹配时，隐私风险就会出现。为用户提供了解和控制如何处理他们的数据的方法仍然是一个悬而未决的问题。这个项目探索并解决了与开发界面相关的挑战，以呈现和减轻用户的在线隐私风险。这项研究的主要影响是更有效地教育用户隐私风险，并为他们提供用户友好的工具来降低这些风险。这个项目的研究有三个重点：(I)基于技术探测的方法来设计更好的隐私增强界面：使用基本的隐私界面来调查用户认为缺失和不方便的设计元素，这个重点旨在开发一套用户驱动的更容易采用和使用的隐私界面设计指南；(2)使服务提供商的隐私做法和控制具有机器可读性的综合框架：通过在隐私文本的自然语言处理和在线隐私菜单的自动分析方面的贡献，该框架克服了由于在线平台呈现其隐私做法和控制的异质性、模糊性或复杂性而带来的挑战。它通过将用户数据与服务提供商的细粒度隐私实践和控制相关联，自动将服务提供商的隐私实践和控制概念化为图形。该框架还将能够通过查询其自动生成的图形来设计新的界面，而无需与服务提供商协作，从而解决可伸缩性问题；(Iii)一套可用界面，用于了解和控制隐私风险，而无需提供商采取更改：将已确定的设计指南与框架的查询能力相结合，这里的重点是一个对话界面，允许用户使用自然语言查询来查询隐私实践并控制隐私设置，即使在用户界面受限的设备上也是如此。它还引入了隐私微调，将隐私作为用户购买服务时的一个因素。这些方法将通过与DuckDuckGo和其他公司的合作在真实系统中进行测试。开发的产品将酌情以浏览器插件、应用程序和API的形式向公众提供。一系列教育举措，包括面向公众的隐私模块，将隐私作为顶峰本科课程的设计维度，以及研究生水平的高级隐私课程，都是对研究工作的补充。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

It is a long-standing challenge to make the users of online systems "privacy-aware" where one understands the privacy practices and controls of the online service being used. For decades, the "Notice and Choice" framework has been the governing practice for the disclosure and control of online privacy practices. Privacy notices, manifesting in lengthy privacy policies, inform users about how websites, devices, apps, or service providers handle their data. Notices pave the way for choices to be made by users. Through online settings and menus, users can opt-in for data collection, authorize the transfer of their data to third-party ad networks, or control the extent to which their data is shared. However, in their current forms, policies are hard for users to comprehend, and control settings are not user-friendly. While some providers have improved the readability of their privacy policies, these notices remain long and hard to follow. Further, unreachable privacy settings make it very hard for users to control their privacy effectively. Thus, users are far more likely to rely on default options rather than fine-tuning their settings for each service they use. When the service provider's behavior does not match the user's privacy preferences, privacy risks arise. Providing users with the means to understand and control how their data is handled remains an open problem. This project explores and addresses the challenges associated with developing interfaces to present and mitigate online privacy risks for users. The main impact of this research is to educate users more effectively about privacy risks and to offer them user-friendly tools to reduce these risks. The research in this project has three thrusts: (i) Technology probes-based methodology for designing better privacy-enhancing interfaces: Using basic privacy-interfaces to probe users about what they perceive as missing and inconvenient design elements, this thrust aims to develop a set of user-driven guidelines for designing privacy interfaces that are easier to adopt and use; (ii) A comprehensive framework to make the privacy practices and controls of service providers machine-readable: Through contributions in the natural-language processing of privacy text and the automated analysis of online privacy menus, this framework overcomes challenges due to heterogeneity, vagueness, or complexity in an online platform's presentation of its privacy practices and controls. It automatically conceptualizes the privacy practices and controls of a service provider as a graph by associating the user's data with the provider's fine-grained privacy practices and controls. The framework will also enable designing new interfaces through querying its automatically generated graph without collaboration from the service provider, thus addressing scalability; (iii) A set of usable interfaces for understanding and controlling privacy risk without requiring providers to adopt changes: Combining the identified design guidelines with the framework's querying capabilities, the focus here is a dialog interface that allows users to inquire about privacy practices and control privacy settings using natural-language queries, even on UI-limited devices. It also introduces privacy nudges to add privacy as a factor when users are shopping for services. The methodologies will be tested in real systems through collaboration with DuckDuckGo and other companies. The developed products will be made available to public as browser plugins, apps, and APIs, as appropriate. A set of education initiatives, including privacy modules for the public, privacy as a design dimension for capstone undergraduate classes, and an advanced privacy course at the graduate level, complement the research effort.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.