Privacy Cards: Surfacing mental models and exploring privacy concerns of voice-first ambient interfaces

Paper Title

Privacy Cards for Surfacing Mental Models and Exploring Privacy Concerns: A Case Study of Voice-First Ambient Interfaces with Older Adults

Publication Info

• Topic area: Privacy and ethics in voice-first ambient interfaces for older adults.
• Keywords: Privacy Cards, contextual integrity, voice-first ambient interfaces, older adults, ethical design, mental models, privacy concerns, participatory methods, human-computer interaction, aging in place.

Background and Problem

• Problem / challenge: Older adults often lack sufficient mental models to understand and consent to the privacy implications of voice-first ambient interfaces (VFAIs). Existing methods to explore privacy concerns are either too abstract or not tailored to this demographic.
• Significance: VFAIs hold promise for supporting aging in place but introduce privacy risks due to opaque data practices. Addressing these risks is critical to ensure ethical and inclusive design.
• Motivation and related work: Prior studies highlight gaps in older adults’ understanding of VFAIs and their privacy risks. While contextual integrity (CI) offers a robust framework for privacy, it has not been operationalized for older adults. Card-based design methods have shown promise in participatory design but have not been tailored for eliciting privacy judgments in this context.

Solution

• Proposed approach: Privacy Cards—a card-based interview protocol grounded in contextual integrity theory, designed to surface mental models and privacy concerns in older adults’ interactions with VFAIs.
• Novelty:
  1. Iterative design of Privacy Cards tailored to older adults, incorporating their language and usage logs.
  2. Operationalization of CI theory for lay audiences to evaluate information flows.
  3. Identification of ethical concerns and implications for VFAI design, including the role of emotional attachment and contextual ambiguities.
• Procedure and key techniques:
  • Developed Privacy Cards based on CI’s five parameters (Sender, Recipient, Subject, Attribute, Transmission Principle).
  • Simplified technical language for accessibility.
  • Conducted interviews with five older adults using Privacy Cards to evaluate information flows and uncover privacy perceptions.
  • Digitized Privacy Cards for remote use during the COVID-19 pandemic.

Results

• Concrete findings:
  • Participants lacked understanding of who accessed their data and the distinction between built-in VFAI functions and third-party apps.
  • Emotional attachment to VFAIs influenced privacy perceptions, with some participants treating the device as a trusted companion.
  • Evaluations of information flows were dynamic and value-based, with significant variation across participants.
  • Using Privacy Cards revealed privacy concerns even in participants who initially claimed to have none.
• Advantage over baselines:
  • Privacy Cards effectively elicited nuanced privacy concerns and mental models, addressing gaps left by traditional survey or interview methods.
  • The method uncovered specific transmission principles and contextual ambiguities that influence privacy expectations.
• Experiments / evaluation:
  • Conducted with five older adults (ages 62–85) over a five-week period using Amazon Echo devices.
  • Data included interviews, usage logs, and participant evaluations of information flows.
  • Findings were analyzed through thematic coding and grounded in CI theory.
• Limitations and future work:
  • Small sample size limited generalizability; findings may not extend to other demographics or cultural contexts.
  • Cognitive demand of the activity highlighted the need for more user-friendly privacy-preserving systems.
  • Future work could adapt Privacy Cards for larger-scale studies and other user groups.

Summary

This study introduces Privacy Cards, a novel, CI-based card protocol designed to explore privacy concerns and mental models in older adults’ interactions with VFAIs. Findings revealed insufficient understanding of data flows, emotional attachment influencing privacy perceptions, and contextual ambiguities in VFAI use. Despite cognitive demands, Privacy Cards proved effective in eliciting nuanced privacy concerns and informing ethical design practices. This work provides a foundation for creating more inclusive, privacy-preserving technologies for aging populations.