While recent usable privacy and security (UPS) research has made progress in moving beyond “the average user,” a systematic account of how UPS researchers navigate diversity and inclusion in their work remains lacking. Through 20 in-depth semi-structured interviews with experienced researchers, we examine how and why they recruit diverse, underserved populations in their work, as well as the challenges they face in doing so, including conceptual difficulties in defining who is underserved, limited access to target populations, and inflexible peer review and publishing norms. Participants also reflected on their own positionality when planning and conducting studies, often expressing uncertainty about how to account for and articulate their positionality. We identify strategies researchers use to overcome challenges and highlight areas where collective action from the research community and institutions is needed to foster greater inclusion in UPS research practices.

Social media platforms are an effective channel for businesses to reach potential audiences through targeted advertising. As the user base of these platforms expands and diversifies, research on targeted advertising and social media needs to go beyond well-studied Western contexts. In an online survey (n=412), we compared users' privacy-related perceptions and behaviors regarding targeted ads on social media in the United States (as a baseline representing Western contexts) and three South Asian countries: Bangladesh, India, and Pakistan. We found that participants in the US perceived significantly fewer benefits and more concerns related to security and privacy about targeted ads than those in the three South Asian countries. We also identified that individual's cultural values and religious affiliations influenced the observed cross-country variances. For instance, US participants identified less with vertical collectivism and vertical individualism than South Asian participants; these two cultural dimensions were, in turn, positively associated with perceived benefits. Our findings highlight the limitation of using one's country as a proxy for culture, as our findings show users' privacy perceptions regarding targeted advertising on social media are more fundamentally associated with their cultural values and religion. We discuss the corresponding design, education, and regulatory implications for targeted advertising on social media.

While people’s perceptions of targeted ads have been studied extensively from a Western perspective (e.g., North America, Europe), we know little about users’ perceptions in the South Asian region. We interviewed 40 participants from two South Asian countries, Bangladesh and India, to explore their perceptions and practices regarding targeted ads on social media platforms. Participants identified emerging ad types, such as influencer-based ads and soft ads, through articles. In addition, participants often outweighed discounts over product quality when viewing ads. We also observed novel user mental models of targeted ads based on mobile app permissions and excessive AI usage. Participants often preferred ad control over transparency. While most participants rarely used ad settings, some controlled ads by changing mobile app permissions or muting ads on social media platforms. Participants also raised concerns about fraudulent targeted ads and privacy violations due to device sharing. We present potential design ideas to mitigate these concerns.

Due to the challenges to detect and filter phishing emails, it is inevitable that some phishing emails can still reach a user’s inbox. As a result, email providers such as Gmail have implemented phishing warnings to help users to better recognize phishing attempts. Existing research has primarily focused on phishing warnings for sighted users and yet it is not well understood how people with visual impairments interact with phishing emails and warnings. In this paper, we worked with a group of users (N=41) with visual impairments to study the effectiveness of existing warnings and explore more inclusive designs (using Gmail warning designs as a baseline for comparison). We took a multipronged approach including an exploratory study (to understand the challenges faced by users), user-in-the-loop design and prototyping, and the main study (to assess the impact of design choices). Our results show that users with visual impairments often miss existing Gmail warnings because the current design (e.g., warning position, HTML tags used) does not match well with screen reader users’ reading habits. The inconsistencies of the warnings (e.g., across the Standard and HTML view) also create obstacles to users. We show that an inclusive design (combining audio warning, shortcut key, and warning page overlay) can effectively increase the warning noticeability. Based on our results, we make a number of recommendations to email providers.

Home is a person's castle, a private and protected space. Internet-connected devices such as locks, cameras, and speakers might make a home "smarter" but also raise privacy issues because these devices may constantly and inconspicuously collect, infer or even share information about people in the home. To explore user-centered privacy designs for smart homes, we conducted a co-design study in which we worked closely with diverse groups of participants in creating new designs. This study helps fill the gap in the literature between studying users' privacy concerns and designing privacy tools only by experts. Our participants' privacy designs often relied on simple strategies, such as data localization, disconnection from the Internet, and a private mode. From these designs, we identified six key design factors: data transparency and control, security, safety, usability and user experience, system intelligence, and system modality. We discuss how these factors can guide design for smart home privacy.