Testing for Transparency: designing privacy-informing systems for young people

我博士学位的目的是通过研究对儿童和年轻人的影响来评估新兴的隐私政策演示技术（“政策演示”）。众所周知，目前管理用户隐私的“同意和通知”方法在网上并不有效。“同意和通知”指的是在用户与在线服务联系时提供隐私通知，然后要求用户同意（或撤回同意）其中解释的隐私实践的方法。这种方法因其冗长，通知显示的时间，以及它所鼓励的权力不对称等问题而受到批评。解决“通知和同意”固有问题的一种方法是改变网站向人们展示隐私做法的方式。隐私研究人员已经建议并测试了使用其他格式、视觉和其他媒介，包括简短或“分层”通知、隐私营养标签、图形和隐私仪表板等。假设替代政策展示可以提供一种提高在线隐私政策透明度的手段，从而对互联网用户的习惯产生积极影响。尽管反对意见确实存在，而且支持这一假设的证据也各不相同，但这似乎是行业正在改变实践的方向，特别是在涉及儿童的情况下：最近，信息专员办公室（ICO）建议在其《适龄设计准则》（Age - Appropriate Design Code）的透明度指导方针中使用新颖的呈现格式，这是他们创建符合gdpr的、面向儿童的互联网服务的指导方针。年轻人对他们的数据被使用的方式以及隐私政策是如何呈现给他们的表达了担忧，有一些证据表明，他们欢迎为他们量身定制解决方案的尝试。如果前一种关于透明度的假设是正确的，那么为年轻人设计的替代政策演示可能会鼓励他们参与，使他们更好地理解服务条款，并导致他们采取更好的隐私保护措施。然而，关于显示由年轻人设计并为年轻人设计的隐私政策的新方法的研究还很缺乏。我的博士学位将探讨这些替代性的隐私政策演示，看看它们的使用是否会对年轻人的隐私实践产生影响，以及共同创建政策演示格式可以在多大程度上提高其有效性。

The aim of my PhD is to assess emerging privacy policy presentation techniques ("policy presentations") by studying the impact they have on children and young people. It is well established that the current 'consent-and-notice' approach to managing user privacy has not been effective online [5] [7]. Consent-and-notice refers to the approach of providing a privacy notice at the point of a user's contact with an online service, and then asking for that user to consent (or to withdraw consent) toward the privacy practices that have been explained within it. This approach has been criticised for its lengthiness, the timing of when notices are displayed, and the power asymmetry it encourages, amongst other things [2] [3]. One method of addressing the problems inherent in notice-and-consent is to alter how website privacy practices are presented to people. Privacy researchers have suggested and tested using alternative formats, visual and other mediums including short or 'layered' notices, privacy nutrition labels, graphics and privacy dashboards to name a few. It is assumed that alternative policy presentations could provide a means of enhancing the transparency of online privacy policies, and therefore positively affect the habits of internet users. Although counter-arguments do exist, and the evidence supporting this assumption is mixed [4][6], this appears to be a direction that the industry is taking to alter practice, particularly as it relates to children: Recently, the Information Commissioner's Office (ICO) recommended using novel presentation formats in their guidelines for transparency within the Age Appropriate Design Code, their guidelines for creating GDPR-compliant, child-facing internet services. Young people have expressed concerns about the ways their data is used and how privacy policies are presented to them, and there is some evidence that they would welcome attempts to tailor solutions to them [1] [7]. If the former assumption about transparency is correct, alternative policy presentations designed with young people in mind could encourage their engagement, lead them to better understand terms of service, and result in them adopting better privacy practices. However, research on novel approaches to displaying privacy policies designed by and for young people is lacking. My PhD will explore these alternative privacy policy presentations to see whether their use can have an effect on young people's privacy practices, and to what extent the co-creation of policy presentation formats can increase their effectiveness.