Keywords

1 Introduction

In the era of ubiquitous computing [57], data collection and, as such, potential privacy intrusions are omnipresent. Computing devices do not only inflate users’ everyday lives at home, but also in semi-public to public spaces. Examples include, but are not limited to, vacuum cleaning robots collecting floor maps of our homes, smart door locks providing access to our workspaces, digital ordering stations in restaurants, and security cameras in highly frequented places. In addition, the variety of devices and functionality, along with the concrete privacy implications, is huge. For instance, a particular smart TV might only provide access to online streaming services, while other smart TVs might additionally allow for voice interaction using built-in microphones.

As a result, it becomes increasingly challenging for users to stay aware of where their personal data are collected, and with whom it is shared. Moreover, not only device owners are affected, but also incidental users, even without explicit interaction [9].

In this chapter, we shed light on these challenges and illustrate current privacy awareness mechanisms (Sect. 2). However, existing mechanisms, such as, e.g., device indicators, tend to be overlooked [7, 44]. Other mechanisms, such as, e.g., labels on devices’ packaging [17, 20, 30], mainly target those who purchase and set up the devices but are rarely available to other target groups such as visitors of the environment [39] or passers-by. At the same time, privacy awareness is a prerequisite for users to be able and act upon their privacy needs [9, 40, 41]. As such, increasing privacy awareness is a necessary first step.

To address this, we set out with a design space on how and in which contexts privacy-relevant information could be brought to users (Sect. 3). We illustrate three sample scenarios in which privacy-relevant information should be easily accessible for users, along with sample applications from our prior work (Sect. 4): providing privacy-relevant information on computing devices during purchase decisions, providing privacy-relevant information on demand, and providing privacy-relevant information within the environment. Note that the scenarios cover device purchase decisions as well as devices that are already installed and in use. The chapter is complemented with directions for future research (Sect. 5) and a summary (Sect. 6).

2 Background and Related Work

An increasing number of everyday objects are equipped with computing power and interconnected, commonly being referred to as the Internet of Things (IoT) [2, 4]. Think about, e.g., smart home appliances, but also smart cars, or surveillance systems in public spaces. While providing great benefits and features, these devices pose new threats to users’ privacy [62].

In the following, we discuss the privacy challenges that arise from an IoT-infused world (Sect. 2.1) and current mechanisms aiming at increasing users’ privacy awareness (Sect. 2.2).

2.1 Privacy Challenges

Privacy, which is individual control over when, where, and how personal data are being collected and shared [13], becomes increasingly challenging as sensing and computing technologies are seamlessly integrated into our daily lives [57]. The number of devices capable of collecting personal data is steadily rising, and sensing technology is placed in both private and public places.

The variety of devices is huge. For instance, smart vacuum cleaning robots scan floor maps of our homes to operate;Footnote 1 smart fridges reorder groceries; smart electricity meters monitor energy consumption and can thus infer users’ activities [48]; smart voice assistants listen to our conversations [35]; cameras record and analyze semi-public and public spaces for security purposes; smart door locks provide access to homes or offices via biometric features [42].

Also, devices come with various functionality and data collection capabilities, with different impacts on users’ privacy. For instance, conversations—as potentially captured by a smart speaker—might be, from a privacy perspective, of different values as compared to grocery orders by a smart fridge. As a consequence, it is hard for users to correctly assess the privacy implications of specific devices, even if they have a general understanding of the technology [39].

Moreover, IoT devices are usually shared among multiple users, and the ecosystem of stakeholders is complex [23, 27, 61]. It not only includes device owners as those who set up and primarily use devices, but also secondary users such as, e.g., co-inhabitants of a smart home [9, 23, 24, 34], guests in a rental apartment [9, 38, 40], or passers-by in semi-public and public spaces [9, 46]. Manufacturers of devices, as well as providers of single services, are also relevant parties. This makes it unclear as to who is responsible for even providing privacy-relevant information and to whom.

Lastly, it is unclear what information is relevant to users in which context, for them to be able to make informed privacy decisions.

2.2 Privacy Awareness Mechanisms

An increasing number of devices in our environments are capable of collecting personal data about us with built-in sensors. This may happen inconspicuously and without direct interaction [9]. Even worse, users are oftentimes unaware of this, let alone the privacy implications of this data collection [3, 9, 34, 62].

Users, however, want to be informed about data being collected about them and shared with device providers [18, 28, 43, 52]. Moreover, awareness of privacy implications is a prerequisite for users to be able and preserve their privacy, and to decide with whom they are willing to share their personal data [9, 40, 41]. As such, there is a need to design suitable mechanisms that help increase privacy awareness [52, 58] among all affected individuals [9, 60].

Prior work suggested mechanisms that provide general privacy information (to, e.g., support purchase decisions) and information on installed devices (i.e., that are already in use and collecting data).

2.2.1 General Privacy Information

Prior to data collection, providers of devices and services must provide privacy-relevant information. The default approach to this is privacy notices [11, 21], a textual description of which data are collected and how it is processed. These policies, however, tend to be long, are hard to understand for users, and thus are oftentimes not read thoroughly [56].

Research tried to address this challenge and make privacy-relevant information more accessible to users, to ultimately increase their awareness. Ebert et al. found that more concise and salient privacy notices can successfully increase users’ privacy awareness [15]. Others suggested ways to make privacy policies more appealing and understandable. Polisis is a framework for automated analysis of privacy policies, to, e.g., assign icons [25]. Building upon this framework, the PriBot is a chat agent that provides privacy-relevant information and can answer users’ questions [26]. Kitkowska et al. suggested visual and appealing designs for privacy policies and showed that these can successfully spark users’ curiosity and ultimately create an understanding of privacy policies [31]. Another opportunity is the use of icons based on a risk assessment [16]. Mozilla’s “Privacy not included guide” provides an emoji-based scale, assessing the privacy implications of computing devices ranging from “not creepy” to “super creepy,” based on crowd-sourced data.Footnote 2

Privacy Labels

To particularly target purchase decisions of computing devices, Kelley et al. introduced the “privacy label”, which acts similar to nutrition labels for groceries but includes information on data collection and sharing of a device. They found this representation to be easier and more comprehensible than privacy policies based on natural language [30]. Such privacy labels also make privacy information more accessible and can thus inform purchase decisions, avoiding concerns rising later on [20]. Moreover, Emami-Naeini et al. showed that critical information should be included in a primary layer (e.g., directly on a device’s packaging), while details can be moved to additional sources (such as, e.g., a website) and linked on the label [17]. These types of labels became obligatory for IoT devices in several countries (e.g., UK,Footnote 3 SingaporeFootnote 4), and for applications on Apple’s iOS.Footnote 5

2.2.2 Privacy Information on Installed Devices

Many devices that collect data communicate their status through device indicators while being in use. For example, webcams indicate via small LEDs whether they are currently on. Amazon’s Alexa provides feedback on its recording status via a light ring (e.g., red refers to “muted”) [8, 35]. Research also suggested alternatives such as, e.g., physical webcam indicators in the form of a flower [33] or an eye that mimics gaze (i.e., recording) direction [53].

To help users detect devices in their environment, Song et al. suggested attaching visual or auditory cues to devices [51]. Lumos is an augmented reality interface that can be employed on users’ personal devices and help them detect hidden IoT devices in their environment [50]. Sami et al. used smartphones emitting laser signals to detect hidden cameras via the reflection of the laser [49]. Funk et al. guided users to smart objects using smart glasses [22]. Thakkar et al. suggested four different privacy awareness mechanisms for the smart home context: a physical data dashboard, a mobile application, ambient colored light, and voice messages on privacy via a smart speaker. These mechanisms aim at targeting device owners, but also potential bystanders, with detailed information being preferred by both target groups [54].

2.3 Summary and Limitations

In times where data collection is ubiquitously present, it becomes increasingly hard for users to even be aware of potential privacy intrusions and ultimately be able to protect their privacy. Research tried to tackle these challenges by designing mechanisms that target users’ privacy awareness. However, current privacy awareness mechanisms are only effective to a limited extent. Users might overlook or not realize or understand the meaning of privacy indicators [7, 44]. Moreover, information on devices is oftentimes only available for those who purchase and configure devices, but not for potential bystanders (e.g., guests in a smart environment), who might likewise be affected. As a result, especially bystanders are uncertain about device states [1].

In addition, the exact device position and/or area of operation is oftentimes unclear, let alone the concrete privacy implications of certain devices and data being collected. The increasing number of devices being installed further exacerbates this issue. This calls for further research on privacy awareness mechanisms that target device owners and bystanders alike.

3 Design Space

Users’ privacy perceptions are influenced by many factors, including, e.g., the environment in which data are collected in and type of data that is collected. We argue that this information is privacy-relevant and should be made available to users, to increase privacy awareness. Based on these factors, we derive a design space for privacy awareness mechanisms for the IoT. In the following, we discuss contextual factors that impact users’ privacy perceptions, as well as types of information that are ultimately privacy-relevant and how this information could be provided.

3.1 Contextual Factors

Individual privacy perceptions and (dis)comfort with personal data being recorded are highly impacted by contextual factors, as highlighted in our previous work [46]:

Social Aspects and Trust::

Users consider trust and relationships when deciding with whom to share their personal data [19, 36, 59, 60]. For instance, users rely on friends’ opinions regarding data sharing [19] and consider who is collecting their data [36] as well as who is the owner of a particular device [40].

Environment::

Also, users’ current environment impacts their concerns. As such, data collection in private spaces (e.g., the home) is less acceptable as compared to data collection in other spaces, such as restaurants (semi-public) or public spaces [18, 37]. It is also important to users whether they are familiar with the environment [46]. In unfamiliar settings, users are particularly concerned about (hidden) data collection, especially when they consider the space private at the same time, as is the case for, e.g., rental apartments [38, 46, 51].

3.2 Privacy-Relevant Information

Privacy-relevant information can comprise various content and be made available to users in various ways.

3.2.1 Content

Depending on users’ current context, various information could become relevant for users to decide whether or not they are willing to share their personal data:

Type of Sensor(s)::

The type of sensors—and, respectively, the type of data being collected—impacts users’ privacy perceptions. For instance, cameras and microphones (i.e., video and audio recordings) are usually considered particularly sensitive [32].

Tracking Space::

The area of data collection can further help users assess privacy intrusions, particularly bystanders who are not familiar with the space devices are in [9].

Device Owner::

The relationship to the device owner crucially impacts users’ willingness to be recorded by devices [9, 19, 36, 41, 59, 60]. For instance, users are more comfortable with devices being placed in trusted environments (e.g., in friends’ homes) [39, 40, 46] as compared to devices being installed by (unknown) hosts of rental apartments [9, 38].

Purpose::

Users are more likely to accept data collection if it suits their own needs and purpose. For instance, for health-related purposes, even long-term data tracking is acceptable [5]. This particularly holds true for personal physiological data [45]. In contrast, video and audio recordings are less acceptable, regardless of the purpose [37].

3.2.2 Availability and Output

The privacy-relevant information could be made available to users in various ways. For instance, information could be provided in relation to the environment, e.g., on a personal device such as a smartphone or tablet [50], or using contextual images [51]. Another opportunity is to provide information only on specific devices similar to, e.g., the privacy labels [17, 30].

Accordingly, privacy-relevant information is available at different times. For instance, information that is bound to the device’s packaging [17, 30] is available to support purchase decisions. Hence, users would need to actively search for and inform themselves about devices to receive this information. Information that is provided independently on a personal device, however, would be always available to users as they are moving around. Lastly, privacy mechanisms can act in various degrees of proactivity (e.g., low, medium, high in the context of smart homes [29]). Privacy-relevant information could thus be provided actively, e.g., through push notifications on personal devices, e.g., when entering an unfamiliar area with data collection being in place.

4 Sample Scenarios

To further emphasize the relevance of increasing privacy awareness in the IoT, we illustrate three concrete scenarios in the following, along with sample applications. In particular, privacy awareness can and should be increased, in various ways, in the following cases: (1) supporting decisions for purchasing IoT devices with privacy-relevant information (PriCheck [55]); (2) allowing users to consult privacy-relevant information on demand (e.g., using their mobile phones, PriView (mobile) [46]); (3) providing privacy-relevant information and guidance within the environment (e.g., by means of augmented reality, PriView (HMD) [46]). For an overview of relevant design space dimensions per scenario, refer to Table 1.

Table 1 Scenarios vs. Design Space: We see several scenarios in which privacy-relevant information is needed (left, Sect. 4), and how the design space dimensions would come into play in each scenario (right, Sect. 3)
Full size table

4.1 Privacy-Relevant Information for Purchase Decisions

Prior work already identified device purchases as a relevant starting point and suggested means to support users’ decision-making with privacy-relevant information, e.g., by labels on devices’ packaging [17, 20, 30]. However, devices are also oftentimes purchased online, where users are not in the hands of the actual device packaging. Users who actively search for devices should have access to privacy-relevant information during purchase decisions. As such, a promising approach is to provide privacy-relevant information in the form of a browser extension, to be easily accessible for users when forming a decision. A sample browser extension with privacy-relevant information is the Privacy Bird that notifies users if a website’s privacy policy violates their preferences [12]. This could be similarly applied to online purchase decisions as well.

PriCheck as suggested by Volk et al. [55] provides privacy-relevant information, comparable to the privacy labels [17, 20, 30], in the form of a browser extension in an online shop (see Fig. 1). In particular, it shows the name of the device along with built-in sensors and functionality visualized as icons (black refers to “included”), data protection quality, security standards, and availability of data protection information. The extension also allows to compare two devices (see Fig. 1, center) and to highlight mismatches with pre-configured privacy preferences (see Fig. 1, right). In an exploratory study (N = 11), participants comparing devices in a mock online shop using PriCheck appreciated the usability of the extension as well as the information provided and agreed that it helped them considering privacy-relevant information for their decisions [55].

Fig. 1
A set of 3 screenshots of the Pri Check browser extension. The first screenshot is of the window with a dialog box for Assistant C on one side. The second and third screenshots are of the pop-ups for menus under assistant C and assistant B, and assistant C.

PriCheck is a browser extension supporting purchase decisions with privacy-relevant information on smart devices. Figure from [55]

Full size image

Supporting Purchase Decisions with PriCheck

To summarize, PriCheck [55] supports users as follows:

Context

online purchase of smart devices, active search

Device(s)

search for one (new) device at a time, and comparison between two devices

User(s)

one user who is about to become the owner

Content

built-in sensors and functionality, data protection quality and security standards, availability of data protection information

Availability

on-demand, but within the situation (online shop)

4.2 Carrying and Consulting Privacy-Relevant Information on Demand

Users might also want to actively search for devices that are already installed and in use. Indicators in the form of, e.g., LEDs or beep sounds [51], can help users discover devices, yet yield little additional information. Other mechanisms, such as the IoT assistant,Footnote 6 list devices in users’ vicinity and allow to communicate privacy choices but do not cover other information such as the exact device position in users’ environment.

PriView, employed as a mobile application using a thermal camera dongle [46], allows users to actively scan the environment for devices (see Fig. 2 left, top). In several visualizations, it shows: device position (red frame), textual information, tracking space (bubble), device state (segmentation via the thermal camera), or built-in sensors (Fig. 2 left, bottom). This can particularly help users in unfamiliar environments that are considered private (e.g., a rental apartment), to detect devices they are uncomfortable with. Participants in an exploratory user study (N = 21) appreciated the innovative and easy-to-use mobile application. They also liked PriView being available on their personal mobile devices, while also having the possibility to put it away anytime [46].

Fig. 2
A set of photos for the Pri View concept. The first photo is of the mobile application. The second photo is of the head-mounted display using virtual reality. There are 10 smaller photos of bounded boxes and a black screen with indicated areas and icons.

PriView is a concept for privacy visualizations meant to increase users’ awareness. PriView can, e.g., be employed as a mobile application for scanning the environment on demand (left) or in a head-mounted display (HMD), enabling to provide privacy-relevant information in the environment (right). Figure from [46]

Full size image

Privacy-Relevant Information on Demand with PriView (mobile)

To summarize, PriView (mobile) [46] supports users as follows:

Context

active device search, scanning the (unfamiliar/untrusted) environment

Device(s)

potentially multiple devices that are already installed and in use

User(s)

primary users as well as bystanders, potentially unknown device owners

Content

device position (all visualizations); built-in sensors, textual information (including device owner), tracking space, recording state

Availability

on-demand, push notifications possible

4.3 Providing Privacy-Relevant Information and Guidance In Situ

To provide users with privacy-relevant information in arbitrary environments, augmented reality (AR) can serve as a means for in situ information and guidance. For instance, PriView employed in a head-mounted display (HMD) provides users with visualizations of potential privacy intrusions within the environment [46]. Similar to the mobile application, it shows: device position (red frame), textual information, tracking space in 3D, a general warning icon, and tracking space on the floor (Fig. 2 right). This can particularly help users in arbitrary environments to increase privacy awareness, particularly when they are new to a place. Participants of our study (N = 21) liked the visualizations being available in situ using the HMD. They wished for more details in spaces they considered private (e.g., a rental apartment), while simpler indications were sufficient in places where data collection is obvious (e.g., security cameras at a train station) [46].

In Situ Privacy-Relevant Information with PriView (HMD)

To summarize, PriView (HMD) [46] supports users as follows:

Context

information within the (unfamiliar/untrusted) environment

Device(s)

potentially multiple devices that are already installed and in use

User(s)

primary users as well as bystanders, potentially unknown device owners

Content

device position (all visualizations); built-in sensors, textual information (including device owner), tracking space, recording state

Availability

always-on, push notifications possible

5 Directions for Future Research

In the following, we illustrate and discuss interesting directions for future research that arise from privacy awareness challenges and mechanisms within the IoT.

5.1 Amount of Information

An interesting question for future research is how much information on IoT devices users will need to make informed privacy decisions. Is a simple device indicator enough to increase awareness, or would users prefer a deeper understanding of data collection and policies?

Moreover, the preferred amount of information varies depending on the environment [46]. For instance, in environments with multiple devices, including such that are firmly installed as well as such carried by passers-by, there is a high potential for an awareness mechanism to cause visual overload. As such, the amount of information should most likely be reduced, with the opportunity to still receive details on demand.

5.2 Contextualize and Adapt

As a next step, privacy awareness mechanisms could automatically adapt to the context and/or their users. For instance, different scenarios (cf. Sect. 4) might require different support for users’ privacy awareness. For purchasing a new device to install it within their own environment, users might need awareness as to how it can be configured in a privacy-preserving way. Being in unfamiliar environments with installed devices, however, rather calls for information on spaces being covered by data collection, for users to be able to avoid these as they wish. Also, for scenarios that users encounter more often (e.g., visiting a certain place), awareness cannot be assumed at first but might increase over time as a mechanism is being used in this scenario. Moreover, an awareness mechanism could also adapt to users’ prior knowledge (e.g., reduce information that users already received earlier) or technical expertise (e.g., use simpler versions for lay users, while providing more details for advanced users).

5.3 Enabling Control

While awareness is a prerequisite for users to be able to make informed privacy decisions [9, 40, 41], it is only a first step. In particular, users need to be given means to execute (or: enforce) these decisions on nearby devices. For instance, PARA is an augmented reality interface that provides privacy controls and allows users to filter data being collected about them [6]. Mobile applications, such as, e.g., the IoT assistant,6 likewise allow users to control nearby devices but require to do so for each and every device or sensor separately, increasing complexity as the number of devices rises. The PriKey tries to tackle this challenge by summarizing privacy decisions per sensor in a tangible device [47]. Personalized privacy assistants [10, 14] can recommend privacy settings or even act autonomously based on users’ privacy preferences or desired standards. This approach, however, needs to find a balance between awareness and control [10]. Future research should further look into how to build upon users’ awareness and enable privacy control, particularly for those who do not have access to a device’s interface.

6 Summary and Conclusion

In this chapter, we highlight the need for increasing users’ privacy awareness within the Internet of Things (IoT). In particular, the increasing number of devices with increasing functionality and sensors makes it challenging for users to stay aware of their personal data being collected. We shed light on design opportunities for bringing privacy-relevant information to users, as well as sample scenarios and applications: supporting purchase decision with PriCheck [55], consulting privacy-relevant on demand using PriView (mobile) [46], and providing in situ information and guidance using PriView (HMD) [46]. Promising directions for future research include investigating the necessary amount of information, adapting privacy awareness mechanisms to context, and enabling privacy control as a necessary next step.