Research

Privacy settings can help ease suspicion of recommendation-making sites and apps

Just giving users a cue that they can update their privacy recommendations can give them a boost in their sense of control — and makes them think the recommendations are better, according to researchers. Credit: Penn State. Creative Commons

UNIVERSITY PARK, Pa. — When people see that they can control their privacy settings on websites and apps that offer entertainment or product recommendations, they tend to be more trusting of those sites, according to researchers.

In a study, a mock-up of an online movie recommendation system that merely suggested that users could customize privacy settings tended to boost their sense of control, which eased their privacy concerns about the site. The participants did not have to physically make those adjustments to feel that sense of control, said S. Shyam Sundar, James P. Jimirro Professor of Media Effects, co-director of the Media Effects Research Laboratory in the Donald P. Bellisario College of Communications and affiliate of Penn State's Institute for CyberScience (ICS).

"This cue, itself, is actually quite powerful in providing a sense of control and lowering privacy concerns,” said Sundar.

Participants also indicated the cue that they could adjust their privacy settings made them more willing to disclose more personal information.

Online recommendation systems typically take one of two approaches to provide unique, tailored options to the user: personalized, also known as system-picked, or customized, where the user makes the choice, according to Sundar, who worked with Bo Zhang, former doctoral student in mass communications at Penn State and currently a user experience researcher at Facebook.

Zhang said that both options offer users advantages and disadvantages. For example, personalized recommendations require little effort from the user, but because the recommendations require tracking a user’s choices, it may make users feel that their privacy is being violated. On the other hand, customization can be burdensome, requiring constant attention, as well as actions to actively make choices all the time. This has led developers to create two types of personalization models: proactive and reactive. Proactive personalization generates recommendations automatically, while a system that features reactive personalization seeks a user’s consent before it delivers recommendations.

“It turns out that these types of personalization have their problems, too," said Sundar. "Proactive personalization may feel more intrusive, while reactive personalization can overload the user with messages and requests.”

Study participants rated the movie recommendations as being higher in quality when it was delivered to them via proactive personalization, but they expressed higher privacy concerns than participants who received the same movie recommendations via reactive personalization.

“What we asked was: Is there a way to minimize people's annoyance of this proactive personalization without having to always resort to reactive personalization?” Zhang said. “Is there a middle ground, such that, before you even start using the app, you could easily customize your privacy settings throughout the site, or globally?" 

The researchers, who report their findings in an upcoming issue of the International Journal of Human-Computer Studies, said that participants who had experienced privacy violations in the past showed higher concerns about both reactive and proactive personalization. They also wanted greater control in managing their privacy. 

“For these people, it makes a real difference to actively customize instead of merely knowing that privacy customization options exist,” said Sundar. “But, for users with no prior experience of privacy violations, simply providing customization cues on the interface had the same effect as acting on customization options.”

While these cues could be used ethically by companies that want to improve user experience, Sundar said that people should be aware that malicious organizations might exploit the bias to lower a person’s guard in order to extract personal data.

For the study, the researchers recruited 326 people to review a mock online Bollywood movie recommendation site called Bollybox. The participants were recruited through Amazon Mechanical Turk, an online crowdsourcing website frequently used in studies. Of the 326 initial participants, 299 eventually completed the study.

Participants filled out a pretest questionnaire that sought demographic information, as well as measured characteristics, including the subjects’ technological expertise, interest in movies and attitudes toward online privacy. The questionnaire also probed whether the participant ever had their privacy violated.

The subjects were randomly assigned to one of the experimental conditions that tested customization and reactive and proactive personalization. The customization condition had three levels: a version without a cue that privacy settings could be modified; a version with a list of privacy setting actions; and a cue condition that just showed the existence of privacy settings. In addition to the privacy settings page, the website mockup had an "About" page and a recommendation page, where it provided recommendations either proactively or after seeking user input and consent.

While this study focused on how privacy settings affected users on online movie recommendation sites, future research could look at recommendation systems for other content types and services.

The National Science Foundation supported this work.

Last Updated June 6, 2021

Contacts