S3D faculty present research at annual FTC PrivacyCon
CyLab faculty, postdocs, and students presented their research at the FTC’s seventh annual PrivacyCon on November 1.
The event brought together a diverse group of stakeholders, including industry representatives, consumer advocates, government regulators and academics, to discuss the latest trends and research related to consumer privacy and data security. Presentations and panel discussions focused on six areas: consumer surveillance, automated decision-making systems, children’s privacy, IoT device privacy, augmented and virtual reality, interfaces and dark patterns, and advertisement technology.
Here, we take a closer look at each of the studies presented by CyLab members during the event:
“Okay, whatever”: An Evaluation of Cookie Consent Interfaces”
- Hana Habib (Presenter)
Carnegie Mellon University - Megan Li
Harvey Mudd College - Ellie Young
New College of Florida - Lorrie Cranor
Carnegie Mellon University
Many websites have added cookie consent interfaces to meet regulatory consent requirements. While prior work has demonstrated that they often use dark patterns — design techniques that lead users to less privacy-protective options — other usability aspects of these interfaces have been less explored. In this study, researchers contribute a comprehensive two-stage usability assessment of cookie consent interfaces.
Researchers first inspected 191 consent interfaces against five dark pattern heuristics, identifying design choices that may impact usability, then conducted a large-scale participant experiment exploring the usability impact of seven design parameters. The participants were exposed to one of 12 cookie consent interfaces while performing a shopping task on a prototype e-commerce website and answered survey questions about their experience.
The study’s findings reveal that users exhibited poor awareness of available choices if a consent interface wasn’t prominent enough. Zero participants exposed to the interface in which a ‘Cookie Preferences’ button was displayed in the bottom-right corner of the browser window interacted with the button at all.
Findings show that the absence of inline options in the initial screen of the interface led to lower investment in decision-making. Participants presented with this content design, where options were available through a link embedded in the text, were more likely to report choosing the easiest option.
Researchers suggest that browser-based consent management mechanisms, including browser extensions that could automatically communicate users’ preferences, have the potential to alleviate some of the burden users face with cookie consent interfaces. However, they argue that until these mechanisms become widely adopted, it remains important to improve the usability of existing schemes.
“Behavioral advertising and consumer welfare: An empirical investigation”
- Eduardo Schnadower Mustri (Presenter)
Carnegie Mellon University - Idris Adjerid
Virginia Tech - Alessandro Acquisti (Presenter)
Carnegie Mellon University
The value that consumers derive from behavioral advertising has been more often posited than empirically demonstrated. Most empirical work in this area has focused on estimating the effectiveness of behaviorally targeted ads measured in terms of click or conversion rates. In this study, Heinz and CyLab researchers present the results of an online experiment designed to assess the consumer welfare implications of targeted behavioral advertising.
Participants were presented with alternative product offers, including products associated with ads they were targeted with online, competing products encountered through online searches, and random products they stumbled upon. The alternatives were compared along various metrics, including objective measures, such as product price and vendor quality, and participants’ self-reported evaluations, including purchase intention and product relevance.
Results show that a minority of vendors dominate both targeted ads and organic search results; however, targeted ads are more likely to present participants with smaller and less familiar vendors. The study reveals purchase intentions are higher when consumers encounter targeted ads or find competing products through online searches, as opposed to encounters with random products - a result of higher product relevance. However, the study finds product relevance is low, even in targeted ads.
“What Factors Affect Targeting and Bids in Online Advertising? A Field Measurement Study”
- Eric Zeng (Presenter)
Carnegie Mellon University - Tadayoshi Kohno
University of Washington - Rachel McAmis
University of Washington - Franziska Roesner
University of Washington
Targeted online advertising is a well-known but extremely opaque phenomenon. Though the targeting capabilities of the ad tech ecosystem are public knowledge, from an outside perspective, it isn't easy to measure and quantify ad targeting at scale. In this study, the authors look to shed light on the extent of targeted advertising on the web today.
Researchers collected data on ads seen by users on ten popular websites, including the topic of the ad, the value of the bid placed by the advertiser, and participants' perceptions of targeting. Then, they analyzed how ads were targeted across individuals, websites, and demographic groups, how those factors affected the amount advertisers bid, and how those results correlated with participants' perception of targeting.
Findings show that the primary factors affecting targeting and bid values were both the website the ad appeared on, as well as individual user profiles. Surprisingly, researchers found that high outliers in bid values may indicate retargeting. The study's measurements provide a rare in situ view of targeting and bidding across diverse users.
"Does Privacy Regulation Harm Content Providers? A Longitudinal Analysis of the Impact of the GDPR"
- Vincent Lefrere
Institut Mines Telecom - Logan Warberg
Carnegie Mellon University - Cristobal Cheyre (Presenter)
Cornell University - Veronica Marotta
University of Minnesota Twin Cities - Alessandro Acquisti
Carnegie Mellon University
While the European General Data Protection Regulation (GDPR) has received significant attention in economic research, concerns that it would adversely affect websites’ ability to provide quality content to their visitors haven’t been thoroughly investigated. In this study, researchers examine how online content providers have adapted their response to the GDPR over time and whether the new restrictions on online tracking affected downstream outcomes, such as the quantity of content those websites offer to their visitors and visitors’ engagement with the content.
The study shows evidence of websites’ reactions to the GDPR in both the United States and the European Union, including an initial reduction in the number of third-party cookies and the intensity of visitor tracking. However, reactions differ between the EU and US websites, as several months after the enactment of the regulation, tracking among EU websites bounced back.
Findings reveal a slight reduction in average page views per visitor on EU websites relative to US websites toward the end of the study’s observation period in November 2019, but showed no significant impact of the regulation on EU websites’ delivery of new content, social media engagement with new content, and ranking in both the short-term and the long term. Researchers also found no evidence of differences in survival across EU and US content providers.
While industry predictions forecasted dire consequences arising from the GDPR for content providers, the authors of the paper find websites that responded more strongly to the GDPR were less likely to be affected by such a response. In comparison, over time, websites that rely significantly on EU visitors found ways to avoid being negatively affected by the regulation.