“It doesn’t tell me anything about how my data is used”: User Perceptions of Data Collection Purposes

Title of the Paper

“It doesn’t tell me anything about how my data is used”: User Perceptions of Data Collection Purposes

Paper Information

• Subject Area: User-centered privacy design and GDPR data protection research
• Keywords: GDPR, user data, data collection purposes, privacy, tracking, qualitative research, data transparency, user interface design

Research Background and Issues

• What problems or challenges did the authors identify?

  1. Privacy protection regulations such as GDPR require users to provide "informed consent," but many users do not understand the purposes of data collection they are consenting to, nor do they comprehend privacy statements.
  2. There are significant inconsistencies in the naming and description of data collection purposes across different websites, Data Protection Authorities (DPAs), and technical templates, with no unified standard.
  3. Privacy notices lack transparency, using complex terminology and unclear purpose descriptions, leaving users confused or even misled.

• Why is this issue important?

  1. Data collection and privacy issues are directly related to user rights, and a lack of transparency undermines user trust in privacy policies.
  2. Poorly designed privacy user interfaces and language can prevent users from making informed privacy decisions, conflicting with GDPR's emphasis on "fairness and transparency."
  3. Reasonable descriptions of data collection purposes can improve user awareness and enhance corporate compliance and efficiency in data management.

• Research Motivation and Related Work

  • The study addresses gaps in existing research by systematically investigating how the naming and description of data collection purposes impact user understanding.
  • Drawing on psychology and HCI research, it provides user-friendly improvement suggestions for designing transparent privacy data systems.
  • It advocates for a multidisciplinary approach (including law, technology, and HCI) to improve current consent systems.

Solutions

• What methods or solutions did the authors propose?

  1. Conducting interviews to examine user perceptions of six common data collection purposes (e.g., "essential purposes," "performance and functionality," "personalized advertising") and three types of descriptions.
  2. Proposing a framework for improving the naming and description of data collection purposes, such as avoiding technical jargon and providing more intuitive information delivery methods.
  3. Recommending user interface improvements (e.g., privacy "nutrition labels") and drawing from consent mechanisms in medical and experimental contexts to enhance existing systems.

• What is innovative about this solution?

  1. Systematically analyzed user perceptions of multiple data collection purposes, identifying specific gaps in transparency and user understanding in current naming and descriptions.
  2. Proposed new naming improvement suggestions based on psychological research (e.g., reducing the use of compound names like "performance and functionality").
  3. Suggested enhancing user privacy choice experiences through visual design and psychological support (e.g., reassurance measures).

• What are the implementation steps and key techniques used?

  1. Qualitative Methods: Conducted 23 semi-structured interviews to capture users' genuine feelings about data collection purposes in privacy notices.
  2. Coding Analysis: Used open coding and inductive analysis to extract themes from the interview results.
  3. Purpose Selection: Selected six of the most common purpose descriptions for in-depth study from a broad range of options.
  4. Feedback from Respondents: Incorporated user preferences to validate which naming and descriptions could better enhance transparency and user acceptance.

Research Findings

• What specific findings were obtained?

  1. Respondents generally found privacy notice content too vague, lacking detailed explanations of data collection purposes (e.g., data retention periods, deletion processes).
  2. Certain purpose names (e.g., "personalized advertising") were clear and understandable, but multiple purposes were easily confused (e.g., "advertising" vs. "personalized advertising").
  3. Users expressed a desire for more appealing UI designs and privacy notices that include more assurances about data security.

• How does it compare to existing solutions?

  • Systematically identified key points of user confusion and proposed solutions, such as optimizing naming rules and concealing technical descriptions of complex terms.
  • Proposed designing a single description scheme for data collection purposes to eliminate naming confusion caused by functional overlap.
  • Advocated for improving descriptive language to reduce information overload while providing dual support for legal compliance and user experience.

• What were the experimental or evaluation results?

  • Purpose names with conjunctions (e.g., "performance and functionality") and vague terms (e.g., "statistics") received negative feedback, with users preferring simpler and more intuitive terminology.
  • Users considered current privacy notice interface designs unfriendly and suggested adopting more readable icons or a "nutrition label" redesign.

• Limitations and Future Directions

  • Limitations: Respondents were limited to English-speaking regions, which may not be directly applicable to countries using other languages; the study did not address the data usage mechanisms of multiple stakeholders (e.g., ad tech providers).
  • Future Directions: The research could expand to non-English privacy notice systems, further explore user experiments with privacy "nutrition labels," and validate cross-cultural applicability.