CAREER: Presentation and Mitigation of Privacy Risks for Online Users

让在线系统的用户“了解隐私”是一个长期的挑战，因为用户了解正在使用的在线服务的隐私实践和控制。几十年来，“通知和选择”框架一直是在线隐私披露和控制的管理实践。隐私声明以冗长的隐私政策形式出现，告知用户网站、设备、应用程序或服务提供商如何处理他们的数据。通知为用户做出选择铺平了道路。通过在线设置和菜单，用户可以选择加入数据收集，授权将其数据传输给第三方广告网络，或控制其数据共享的程度。然而，在目前的形式下，策略很难让用户理解，控制设置也不方便用户使用。虽然一些提供商已经改进了其隐私政策的可读性，但这些通知仍然很长，很难遵循。此外，不可访问的隐私设置使得用户很难有效地控制自己的隐私。因此，用户更有可能依赖默认选项，而不是为他们使用的每项服务微调设置。当服务提供商的行为与用户的隐私偏好不匹配时，就会产生隐私风险。为用户提供理解和控制其数据处理方式的方法仍然是一个悬而未决的问题。本项目探讨并解决与开发接口相关的挑战，以呈现和减轻用户的在线隐私风险。这项研究的主要影响是更有效地教育用户关于隐私风险，并为他们提供用户友好的工具来减少这些风险。本项目的研究有三个重点：(i)设计更好的隐私增强界面的基于技术问题的方法：使用基本的隐私界面来探索用户认为缺失和不方便的设计元素，这一重点旨在制定一套用户驱动的指导方针，以设计更容易采用和使用的隐私界面；（ii）使服务提供商的隐私实践和控制具有机器可读性的综合框架：通过在隐私文本的自然语言处理和在线隐私菜单的自动分析方面的贡献，该框架克服了在线平台在其隐私实践和控制的呈现中由于异质性、模糊性或复杂性而带来的挑战。它通过将用户数据与提供者的细粒度隐私实践和控制相关联，自动将服务提供者的隐私实践和控制概念化为图形。该框架还可以通过查询其自动生成的图形来设计新的接口，而无需服务提供商的协作，从而解决可扩展性问题；（iii）一组可用于理解和控制隐私风险的可用界面，而无需提供商采用更改：将确定的设计指南与框架的查询功能相结合，这里的重点是一个对话界面，允许用户查询隐私实践并使用自然语言查询控制隐私设置，即使在ui有限的设备上也是如此。它还引入了隐私提示，将隐私作为用户购买服务时的一个因素。这些方法将通过与DuckDuckGo和其他公司的合作在实际系统中进行测试。开发的产品将以浏览器插件、应用程序和api的形式向公众提供。一系列的教育举措，包括面向公众的隐私模块，将隐私作为本科课程的设计维度，以及研究生阶段的高级隐私课程，都是对研究工作的补充。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

It is a long-standing challenge to make the users of online systems "privacy-aware" where one understands the privacy practices and controls of the online service being used. For decades, the "Notice and Choice" framework has been the governing practice for the disclosure and control of online privacy practices. Privacy notices, manifesting in lengthy privacy policies, inform users about how websites, devices, apps, or service providers handle their data. Notices pave the way for choices to be made by users. Through online settings and menus, users can opt-in for data collection, authorize the transfer of their data to third-party ad networks, or control the extent to which their data is shared. However, in their current forms, policies are hard for users to comprehend, and control settings are not user-friendly. While some providers have improved the readability of their privacy policies, these notices remain long and hard to follow. Further, unreachable privacy settings make it very hard for users to control their privacy effectively. Thus, users are far more likely to rely on default options rather than fine-tuning their settings for each service they use. When the service provider's behavior does not match the user's privacy preferences, privacy risks arise. Providing users with the means to understand and control how their data is handled remains an open problem. This project explores and addresses the challenges associated with developing interfaces to present and mitigate online privacy risks for users. The main impact of this research is to educate users more effectively about privacy risks and to offer them user-friendly tools to reduce these risks. The research in this project has three thrusts: (i) Technology probes-based methodology for designing better privacy-enhancing interfaces: Using basic privacy-interfaces to probe users about what they perceive as missing and inconvenient design elements, this thrust aims to develop a set of user-driven guidelines for designing privacy interfaces that are easier to adopt and use; (ii) A comprehensive framework to make the privacy practices and controls of service providers machine-readable: Through contributions in the natural-language processing of privacy text and the automated analysis of online privacy menus, this framework overcomes challenges due to heterogeneity, vagueness, or complexity in an online platform's presentation of its privacy practices and controls. It automatically conceptualizes the privacy practices and controls of a service provider as a graph by associating the user's data with the provider's fine-grained privacy practices and controls. The framework will also enable designing new interfaces through querying its automatically generated graph without collaboration from the service provider, thus addressing scalability; (iii) A set of usable interfaces for understanding and controlling privacy risk without requiring providers to adopt changes: Combining the identified design guidelines with the framework's querying capabilities, the focus here is a dialog interface that allows users to inquire about privacy practices and control privacy settings using natural-language queries, even on UI-limited devices. It also introduces privacy nudges to add privacy as a factor when users are shopping for services. The methodologies will be tested in real systems through collaboration with DuckDuckGo and other companies. The developed products will be made available to public as browser plugins, apps, and APIs, as appropriate. A set of education initiatives, including privacy modules for the public, privacy as a design dimension for capstone undergraduate classes, and an advanced privacy course at the graduate level, complement the research effort.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.