Preference-based Location SharingAre More Privacy Options Really Better?

Bart P. KnijnenburgDepartment of Informatics, UC Irvine

Alfred KobsaDepartment of Informatics, UC Irvine

Hongxia JinSamsung R&D Research Center

INFORMATION AND COMPUTER SCIENCES

Outline

Should sharing profiles be simple or complex?

What happens when you add/remove sharing options?

Users choose based of their perception of the options

A method for designing better sharing options

INFORMATION AND COMPUTER SCIENCES

Profile-based location sharing

22

Figure 5 – Locaccino privacy settings page

We address in detail the topic of privacy policies, presenting the necessary formalism in section 3.1.2.

Who Can Locate Me This page is intended to provide privacy awareness to the user, in the sense that the user can see at a given instant and free of ambiguities, the result of restriction evaluation for the group of friends. This page is also important for allowing users to confirm and correct their privacy policies, i.e., to easily evaluate whether the rules are producing the desired results at a given instant in time.

The following figure illustrates this mechanism. The group of friends of the user is basically split into two categories: the ones that can view the user current location and the ones that cannot.

INFORMATION AND COMPUTER SCIENCES

22

Figure 5 – Locaccino privacy settings page

We address in detail the topic of privacy policies, presenting the necessary formalism in section 3.1.2.

Who Can Locate Me This page is intended to provide privacy awareness to the user, in the sense that the user can see at a given instant and free of ambiguities, the result of restriction evaluation for the group of friends. This page is also important for allowing users to confirm and correct their privacy policies, i.e., to easily evaluate whether the rules are producing the desired results at a given instant in time.

The following figure illustrates this mechanism. The group of friends of the user is basically split into two categories: the ones that can view the user current location and the ones that cannot.

Why so

complex?

INFORMATION AND COMPUTER SCIENCES

22

Figure 5 – Locaccino privacy settings page

We address in detail the topic of privacy policies, presenting the necessary formalism in section 3.1.2.

Who Can Locate Me This page is intended to provide privacy awareness to the user, in the sense that the user can see at a given instant and free of ambiguities, the result of restriction evaluation for the group of friends. This page is also important for allowing users to confirm and correct their privacy policies, i.e., to easily evaluate whether the rules are producing the desired results at a given instant in time.

The following figure illustrates this mechanism. The group of friends of the user is basically split into two categories: the ones that can view the user current location and the ones that cannot.

Locaccino researchers:- Users will

otherwise err on the safe side

Decision scientists:- Depends on

perception of the options

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothing

Outside work hrs:

nothing

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothing

Outside work hrs:

nothing

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

?

?

1.

removing

the City

option

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothing

Outside work hrs:

nothing

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

? ?2.

introducing

the Exact

option

INFORMATION AND COMPUTER SCIENCES

Without Exact (!E) With Exact (+E)

Without City (!C)

With City (+C)

Main manipulation

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

INFORMATION AND COMPUTER SCIENCES

Plotting the privacy calculus

We believe that people choose based on their perception of the options

How do people perceive these options?

Privacy calculus:Trade-o! between privacy and benefit

E

B

N

privacy -->

bene

fits

-->

C

INFORMATION AND COMPUTER SCIENCES

Plotting the privacy calculus

For each recipient, rate privacy and benefit (-3 to 3):

“I do not want [recipient] to know where I am” (Privacy)“My location could be useful for [recipient]” (Benefit)- For apps/coupons: “I could

benefit from [recipient]”

Plot the average Privacy and Benefit of each option on a plane

E

B

N

privacy -->

bene

fits

-->

C

INFORMATION AND COMPUTER SCIENCES

Plotting the privacy calculus

For each recipient, rate privacy and benefit (-3 to 3):

“I do not want [recipient] to know where I am” (Privacy)“My location could be useful for [recipient]” (Benefit)- For apps/coupons: “I could

benefit from [recipient]”

Plot the average Privacy and Benefit of each option on a plane

E

B

N

privacy -->

bene

fits

-->

C

INFORMATION AND COMPUTER SCIENCES

Plotting the privacy calculus

For each recipient, rate privacy and benefit (-3 to 3):

“I do not want [recipient] to know where I am” (Privacy)“My location could be useful for [recipient]” (Benefit)- For apps/coupons: “I could

benefit from [recipient]”

Plot the average Privacy and Benefit of each option on a plane

E

B

N

privacy -->

bene

fits

-->

C

INFORMATION AND COMPUTER SCIENCES

Plotting the privacy calculus

For each recipient, rate privacy and benefit (-3 to 3):

“I do not want [recipient] to know where I am” (Privacy)“My location could be useful for [recipient]” (Benefit)- For apps/coupons: “I could

benefit from [recipient]”

Plot the average Privacy and Benefit of each option on a plane

E

B

N

privacy -->

bene

fits

-->

C

High privacy, low benefit

INFORMATION AND COMPUTER SCIENCES

Plotting the privacy calculus

For each recipient, rate privacy and benefit (-3 to 3):

“I do not want [recipient] to know where I am” (Privacy)“My location could be useful for [recipient]” (Benefit)- For apps/coupons: “I could

benefit from [recipient]”

Plot the average Privacy and Benefit of each option on a plane

E

B

N

privacy -->

bene

fits

-->

C

Low privacy, high benefit

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothing

Outside work hrs:

nothing

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

?

?

1.

removing

the City

option

INFORMATION AND COMPUTER SCIENCES

Decision theory hypotheses:

Three situations:

1. City is subjectively distinct from Nothing and Block:- Luce’s Choice Axiom

holds

- The ratio N : B+E will stay the same

Users will prefer both sides proportionally when City is removed

E

B

N

privacy -->

bene

fits

-->

C

privacy -->

INFORMATION AND COMPUTER SCIENCES

Decision theory hypotheses:

2. City is subjectively closer to Nothing than to Block:- Tversky’s Substitution

E"ect holds

- C is a substitute for N

- When we remove C, N will increase more than B+E

Users will err on the safe side

E

B

N

privacy -->

bene

fits

-->

C

INFORMATION AND COMPUTER SCIENCES

Decision theory hypotheses:

3. City is subjectively closer to Block than to Nothing:- Tversky’s Substitution

E"ect holds

- C is a substitute for B

- When we remove C, B will increase more than N

Users will prefer the more revealing side

E

B

N

privacy -->

bene

fits

-->

C

Results

Without Exact (!E) With exact (+E) W

ithou

t city

(!C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

48.8

51.2 B

enefi

t -->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8 B

enefi

t -->

Privacy -->

48.8

51.2

Ben

efit

-->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

Exact Block City Nothing Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit

-->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

Exact Block City Nothing

Without Exact (!E) With exact (+E) W

ithou

t city

(!C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

48.8

51.2 B

enefi

t -->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8 B

enefi

t -->

Privacy -->

48.8

51.2

Ben

efit

-->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

Exact Block City Nothing

Results

Size:

percentage

of people

choosing

this option

Results

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E) W

ithou

t city

(!C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2 B

enefi

t --

>

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8 B

enefi

t -->

Privacy -->

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

Exact Block City Nothing

Position:

perception

in terms of

privacy and

benefit

Results

Without Exact (!E) With exact (+E) W

ithou

t city

(!C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

48.8

51.2 B

enefi

t -->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8 B

enefi

t -->

Privacy -->

48.8

51.2

Ben

efit

-->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

Exact Block City Nothing

left vs.

right:

comparison

of without

vs. with

Exact

Results

Without Exact (!E) With exact (+E) W

ithou

t city

(!C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

48.8

51.2 B

enefi

t -->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8 B

enefi

t -->

Privacy -->

48.8

51.2

Ben

efit

-->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

Exact Block City Nothing

bottom

vs. top:

comparison

of with vs.

without

City

Without Exact (!E) With exact (+E) W

ithou

t city

(!C)

With

city

(+C)

48.8

51.2 B

enefi

t -->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8 B

enefi

t -->

Privacy -->

Results

City is closer to Block (0.45pts) than to Nothing (2.25pts)

Substitution e!ect!Only the share of Block di!ers significantly between –C and +C (24.2pp)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit

-->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

Exact Block City Nothing

Without Exact (!E) With exact (+E) W

ithou

t city

(!C)

With

city

(+C)

48.8

51.2 B

enefi

t -->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8 B

enefi

t -->

Privacy -->

Results

Distance from City to Nothing and Block is more equal

Luce’s choice axiom!Both Nothing (14.3pp) and Block (9.1pp) di!er between –C and +C E!ect on Nothing is larger, because City is somewhat closer to Nothing

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit

-->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

Exact Block City Nothing

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothing

Outside work hrs:

nothing

(part 2/3)

Preferences for sharing yourlocation with friendsUse the demo phone on the right to set your sharing preferences fordifferent people at different times.Note that there are several pages of preferences, and on some pagesyou may have to scroll down.On the different pages you will find settings for sharing with:

Your friendsYour colleagues

Best friends

John, Dave, Ethan

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Other friends

Ben, Robert, Thomas, Mike, Paul, Steven,Frank

During work hrs:

nothingcitycity blockexact location

Outside work hrs:

nothingcitycity blockexact location

Continue

? ?2.

introducing

the Exact

option

INFORMATION AND COMPUTER SCIENCES

Decision theory hypotheses:

Two situations:

1. Exact is subjectively close to Block:- Tversky’s Substitution

E"ect holds

- E is a substitute for B

Only B will decrease when E is introduced

EB

N

privacy -->

bene

fits

-->

C

INFORMATION AND COMPUTER SCIENCES

Decision theory hypotheses:

2. Exact is more distant:- Simonson’s Compromise

E"ect holds

- B is no longer an extreme, but a compromise

- B attracts some from C and N

- Still some Substitution of B to E

In sum: Sharing increases across the board

B

N

privacy -->

bene

fits

-->

C

E

INFORMATION AND COMPUTER SCIENCES

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E) W

ithou

t city

(!C)

With

city

(+C)

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit

-->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2 B

enefi

t -->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8 B

enefi

t -->

Privacy -->

Exact Block City Nothing

Results

Exact is subjectively close to Block

Substitution e!ect!the availability of Exact mainly a!ects the share of Block (21.5pp)

Without Exact (!E) With exact (+E) W

ithou

t city

(!C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8 B

enefi

t -->

Privacy -->

48.8

51.2

Ben

efit

-->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

Exact Block City Nothing

INFORMATION AND COMPUTER SCIENCES

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E) W

ithou

t city

(!C)

With

city

(+C)

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit

-->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2 B

enefi

t -->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8 B

enefi

t -->

Privacy -->

Exact Block City Nothing

Results

Exact is further away from Block

Compromise e!ect!Block is only reduced by 8.3pp, as it regains some share from Nothing (reduced by 13.7pp)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

Without Exact (!E) With exact (+E)

With

out c

ity (!

C)

With

city

(+C)

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3 B

enefi

t -->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit

-->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

48.8

51.2

Ben

efit -

->

Privacy -->

41.0 29.7

29.3

Ben

efit -

->

Privacy -->

40.4 32.6

26.9

Ben

efit -

->

Privacy -->

26.7 29.9

18.6

24.8

Ben

efit -

->

Privacy -->

Exact Block City Nothing

INFORMATION AND COMPUTER SCIENCES

Two conclusions

1. With fewer options, users do not just “err on the safe side”Instead, they deliberately choose the subjectively closest remaining option

2. An extreme option does not just increase sharing among those who already share a lot

Instead, it increases sharing across the board

INFORMATION AND COMPUTER SCIENCES

Applying these results

Problem: when designing the ‘optimal’ set of options, users’ choice depends on the available options

Problem for user tests! Combinatorial explosion of the experimental conditions

More e"cient approach: - Ask a sample of users about the perceived Privacy and

Benefit of the options

- Map them on a plane

INFORMATION AND COMPUTER SCIENCES

Applying these results

Ben

efit

-->

Privacy -->

6. Introduce to increase overall sharing2. Remove one redundant option

1. Remove this dominated option

3. Introduce an option to close this gap

4. If desired, remove the left option to increase the right option

5. If desired, replace this option with one that is perceptually close

INFORMATION AND COMPUTER SCIENCES

Take-home message

Do you want to design an optimal list of

(location-sharing) options?

Measure the subjective perceptions of

the options, and apply decision theories

to decide which are best!

Paper draft: http://bit.ly/chi2013privacy More papers: www.usabart.nl Follow me on Twitter: @usabart

INFORMATION AND COMPUTER SCIENCES

Guide for questions:

1. With fewer options, users do not just “err on the safe side”Instead, they deliberately choose the subjectively closest remaining option

2. An extreme option does not just increase sharing among those who already share a lot

Instead, it increases sharing across the board

3. If you want to design the optimal set of options, measure the perception of the options

And apply decision theories to argue which are best