Collaborative Research: SaTC: CORE: Small: Measuring, Validating and Improving upon App-Based Privacy Nutrition Labels

合作研究：SaTC：核心：小型：测量、验证和改进基于应用程序的隐私营养标签

• 批准号: 2247953
• 负责人: Christopher Kanich
• 金额: $ 20万
• 依托单位: University of Illinois at Chicago
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2023
• 资助国家: 美国
• 起止时间: 2023-06-01 至 2026-05-31
• 项目状态: 未结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=2247953&HistoricalAwards=false
• 关键词: Collaborative; Research; SaTC; CORE; Small

Smartphones collect a large amount of personal data as people use them, which can cause privacy violations when smartphone applications (“apps”) use or share the data in ways people don’t expect. Existing text-based privacy policies are hard to read and make sense of, making it hard for people to understand what a mobile app will do with their data. This has led major app stores to require apps to use standardized “privacy labels”—akin to nutrition labels—to help people make informed choices about the apps they use; however, it is unclear how well these labels work in the real world. This project will attack this question by studying how privacy labels work for three main groups: app developers who must select correct labels for their apps; app store administrators that create the policies and standards for the labels; and end users who must use them to make privacy decisions. The team will also analyze mobile apps to see how well they adhere to the promises made by their privacy labels, and how both people’s understandings of privacy labels and apps’ adherence to them changes over time. Together the work will lead to better understanding, design, and use of privacy labels for both regulators and people who use mobile apps. To address these questions, the project will apply a mixed-methods approach. For studying end users, the research team will perform iterative usability testing and longitudinal comprehension studies to gauge understanding of these new privacy labels and how it changes over time. The team will also use factorial vignettes analyzed by multivariate regressions to identify factors of both existing and hypothetical privacy label designs that might impact user decision making around installing, using, and granting permissions to apps. For studying developers and platforms, the team will conduct quantitative measurement studies using a “privacy label observatory” that will periodically collect a number of versions of both apps and their privacy labels, using dynamic software analysis of the apps to determine their use of private information. This will help answer questions about whether privacy labels become more accurate over time as developers become more familiar with them, as well as how the app ecosystem reacts to events like regulatory or company policy changes and enforcement actions. The primary outcomes of this project will be empirical data on whether these new privacy tools are working, how and why they might be failing both app developers and consumers alike, and how platforms can improve their design to make them more effective. This will include public datasets about current and historical usage of privacy labels, as well as design patterns and policy recommendations for improving the state of privacy labels and mobile app privacy.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.

智能手机在人们使用时会收集大量个人数据，当智能手机应用程序（“应用程序”）以人们意想不到的方式使用或共享数据时，可能会导致隐私侵犯。现有的基于文本的隐私政策很难阅读和理解，这使得人们很难理解移动的应用程序将如何处理他们的数据。这导致主要的应用商店要求应用使用标准化的“隐私标签”类似于营养标签帮助人们对他们使用的应用做出明智的选择;然而，目前还不清楚这些标签在真实的世界中的效果如何。这个项目将通过研究隐私标签如何为三个主要群体工作来解决这个问题：必须为他们的应用选择正确标签的应用程序开发人员;为标签创建政策和标准的应用程序商店管理员;以及必须使用它们来做出隐私决策的最终用户。该团队还将分析移动的应用程序，以了解它们在多大程度上遵守了隐私标签的承诺，以及人们对隐私标签的理解和应用程序对隐私标签的遵守情况如何随着时间的推移而变化。这项工作将使监管机构和使用移动的应用程序的人更好地理解、设计和使用隐私标签。为了解决这些问题，该项目将采用混合方法。为了研究最终用户，研究团队将进行迭代可用性测试和纵向理解研究，以衡量对这些新隐私标签的理解以及它如何随着时间的推移而变化。该团队还将使用通过多元回归分析的因子小插曲来识别现有和假设的隐私标签设计的因素，这些因素可能会影响用户在安装，使用和授予应用程序权限方面的决策。为了研究开发人员和平台，该团队将使用“隐私标签观察站”进行定量测量研究，该观察站将定期收集应用程序及其隐私标签的多个版本，使用应用程序的动态软件分析来确定它们对隐私信息的使用。这将有助于回答以下问题：随着开发人员对隐私标签越来越熟悉，隐私标签是否会随着时间的推移而变得更加准确，以及应用生态系统如何对监管或公司政策变化和执法行动等事件做出反应。该项目的主要成果将是关于这些新的隐私工具是否有效的经验数据，它们如何以及为什么会让应用程序开发人员和消费者都失败，以及平台如何改进其设计以使其更有效。这将包括有关隐私标签当前和历史使用情况的公共数据集，以及改善隐私标签和移动的应用程序隐私状况的设计模式和政策建议。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。