The Internet of Things (IoT) devices are rapidly increasing in popularity, with more individuals using Internet-connected devices that continuously monitor their activities. This work explores privacy concerns and expectations of end-users related to Trigger-Action platforms (TAPs) in the context of the Internet of Things (IoT). TAPs allow users to customize their smart environments by creating rules that trigger actions based on specific events or conditions. As personal data flows between different entities, there is a potential for privacy concerns. In this study, we aimed to identify the privacy factors that impact users’ concerns and preferences for using IoT TAPs. To address this research objective, we conducted three focus groups with 15 participants and we extracted nine themes related to privacy factors using thematic analysis. Our participants particularly prefer to have control and transparency over the automation and are concerned about unexpected data inferences, risks and unforeseen consequences for themselves and for bystanders that are caused by the automation. The identified privacy factors can help researchers derive predefined and selectable profiles of privacy permission settings for IoT TAPs that represent the privacy preferences of different types of users as a basis for designing usable privacy controls for IoT TAPs.

Usable explanations of privacy-enhancing technologies (PETs) help users make more informed privacy decisions, but the explanations of PETs are generally geared toward individuals with more technical knowledge. To explain functional encryption (FE) to experts and laypersons, we investigate structural and functional explanations and explore users' interests and preferences, as well as how they affect users' comprehension and decisions about sharing data. To this end (with an EU-based population), we conducted four focus groups, in combination with walk-throughs, with 13 participants in the first study, followed by an online survey with 347 experts and 370 laypersons. Both explanations were considered useful in fulfilling the different needs of participants interested in the privacy policy information. Participants, regardless of their expertise, trusted and were more satisfied with the structural explanation. However, functional explanations had a higher contribution to all participants' comprehension. We, therefore, recommend combining both types of explanations for a usable privacy policy.

The graphical and interactive design of a consent form helps individuals to keep control and pay attention to the information that they are disclosing. In the context of mobile apps we propose and test alternative interaction design solutions for selecting personal information on permission dialogues, namely using checkboxes, a drag-and-drop selection, and a swiping action. We test each proposed design and compare the results in terms of their usability and effectiveness in helping users to be more attentive and aware of their data flow, in other words, to provide their informed consent. This study demonstrates that checkboxes while speedy do not engage the user as much as drag-and-drop or swiping. User satisfaction is positively impacted by these newer ways of giving consent.

Privacy notifications issued by Transparency-Enhancing Tools (TETs) constitute a conceptual means of informing users of online data services about how their personal data are processed. We elicit a set of design requirements that reflect the particularities of privacy notifications received on mobile phones. Pursuing the principles of human-centered design, we evaluate the efficacy of a prototypical implementation for the context of personal health tracking in an iterative lab study. Our findings show that privacy notifications have the potential to facilitate usable transparency and informed decision-making in terms of improving privacy in the designated usage context. The feedback obtained during the evaluation of the prototype lends itself to a refined set of design requirements. We discuss these requirements as building blocks that can help designers create usable artifacts that accommodate the needs of users of mobile health services.

Privacy notices and consent forms are the means of conveying privacy policy information to users. In Europe, a valid consent needs to be confirmed by a clear affirmative action. Despite previous research, it is not yet clear whether user engagement with consent forms via different types of interactions for confirming consent may play a significant role in effectively drawing user attention to the content, even after repeated exposure. We investigate, in a laboratory study, how different types of interactions that engage users with consent forms differ in terms of their effectiveness, efficiency, and user satisfaction. In addition, we examine if and how habituation affects user attention and satisfaction, and the time they spend on giving their consent. We conducted a controlled experiment with 80 participants in four different groups where people either were engaged actively with the policy content via Drag and Drop (DAD), Swipe, or Checkboxes, or were not actively engaged with the content (as the control condition) in a first-exposure phase and in a habituation phase. We measured user attention to consent forms along multiple dimensions, including direct, objective measurements and indirect, self-reported measures. Our results show that the different types of interactions may affect user attention to certain parts of policy information. In particular, the DAD action results in significantly more user attention to the data items compared to other groups. However, with repeated exposure to consent forms, the difference disappears. We conclude that user engagement with policy content needs to be designed with care, so that attention to substantial policy information is increased and not negatively affected.

Only a few studies have addressed the users' conception of how fingerprint recognition used for different purposes on mobile devices works. This study contributes by investigating how different groups of individuals think that the fingerprint recognition works, why they think so, and also by pointing out differences in pin code and fingerprint issues. The study furthermore yields some results concerning individuals' attitudes towards how sensitive the use of fingerprint sensors is: non-users tended to be more afraid of third-party access than users. On the other hand, users tended to regard the fingerprint pattern as more sensitive than non-users.