Generalizable Active Privacy Choice: Designing a Graphical User Interface for Global Privacy Control
Authors: Sebastian Zimmeck (Wesleyan University), Eliza Kuller (Wesleyan University), Chunyue Ma (Wesleyan University), Bella Tassone (Wesleyan University), Joe Champeau (Wesleyan University)
Volume: 2024
Issue: 1
Pages: 258–279
DOI: https://doi.org/10.56553/popets-2024-0015
Abstract: The California Consumer Privacy Act and other privacy laws give people a right to opt out of the sale and sharing of personal information. In combination with privacy preference signals, especially, Global Privacy Control (GPC), such rights have the potential to empower people to assert control over their data. However, many laws prohibit opt out settings being turned on by default. The resulting usability challenges for people to exercise their rights motivate generalizable active privacy choice --- an interface design principle to make opt out settings usable without defaults. It is based on the idea of generalizing one individual opt out choice towards a larger set of choices. For example, people may apply an opt out choice on one site towards a larger set of sites. We explore generalizable active privacy choice in the context of GPC. We design and implement nine privacy choice schemes in a browser extension and explore them in a usability study with 410 participants. We find that generalizability features tend to decrease opt out utility slightly. However, at the same time, they increase opt out efficiency and make opting out less disruptive, which was more important to most participants. For the least disruptive scheme, selecting website categories to opt out from, 98% of participants expressed not feeling disrupted, a 40% point increase over the baseline schemes. 83% of participants understood the meaning of GPC. They also made their opt out choices with intent and, thus, in a legally relevant manner. To help people exercise their opt out rights via GPC our results support the adoption of a generalizable active privacy choice interface in web browsers.
Keywords: Opt Out, Privacy Choice, Privacy Rights, Privacy Laws, Global Privacy Control, GPC, Do Not Sell, Do Not Track, DNT, Privacy Preference Signals, Usability, CCPA, CPRA, Web Privacy
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution 4.0 license.
