The proliferation of camera-equipped systems in domestic environments, such as Augmented Reality (AR) applications, household robots, smart glasses, and indoor security cameras, raises critical privacy concerns. Beyond capturing users and visitors, these systems record home interiors that may contain objects and contextual cues inadvertently disclosing sensitive information, such as socioeconomic status cues, social or family structure, cultural or religious affiliation, and daily routines or habits. Yet, a systematic understanding of object-level privacy risks in this context remains limited. To address this gap, we conducted a user study with 210 participants, each annotating 18 images from a dataset of 279 home interior images, yielding 541 unique image–object sensitivity assessments. Based on these annotations, we introduce a multidimensional categorization scheme that integrates sensitivity scales, object categories (e.g., windows, bystanders), and information types (e.g., personal data, social circles). We further evaluate the capability of Vision–Language Models (VLMs) to infer sensitive information from images, including content that appears inconspicuous at first glance. Our analysis shows that VLMs correctly identify the objects’ sensitivity degree within images with up to 70%, and few-shot learning techniques further enhance the object sensitivity inference.

The rapid proliferation of Internet-of-Things (IoT) devices raises privacy concerns, as these devices collect extensive information about both users and bystanders. Yet users often remain uninformed of how such devices handle their data. In response, various privacy labels have been proposed, but although many designs have undergone user evaluation, we still lack a clear understanding of which privacy-related features users consider important to be informed about, and how these priorities differ across user profiles. Addressing this gap is essential for developing privacy communication mechanisms that genuinely align with users’ preferences. This paper reports a study (N = 565) examining how users prioritize different privacy features in IoT devices and why. Our findings reveal which properties users value most, how these priorities differ across gender, age, technical affinity, and privacy concern, and which features are interpreted as baseline expectations rather than choices (e.g., encryption and updates). We also identify context-dependent features, such as multi-user management, that are rejected by numerous single-household users. Moreover, we show that users’ privacy concerns predict preferences more strongly than demographics. Notably, open-source property elicits polarized reactions, serving as a sign of trust for some and a perceived security risk for others. Drawing on these insights, we advocate for adaptive privacy labels that automate security baseline privacy expectations (e.g., features like operational security, secure defaults, and updates) while foregrounding user sovereignty (e.g., features like data storage location, cloud provider, jurisdiction) and contextual factors (e.g., living alone), moving beyond one-size-fits-all privacy labels toward dynamic decision-support solutions.

Due to their limited ability to reason about the social context in which they are used, smart speakers pose significant privacy risks by responding in ways that may violate people's implicit social boundaries. We conducted a cross-cultural vignette study (N = 944) in Germany and Singapore to investigate how situational factors—specifically social context (bystander relationships and closeness), physical context (location), and interaction context (topic and deceptive intent)—regulate user preferences for smart speaker responses. Our results demonstrate that these factors are superior predictors of response preferences than dispositional user traits (i.e., intrinsic personal traits). We identify two distinct social dynamics: a structural influence for professional relationships (e.g., boss) that persists regardless of social closeness, and a closeness-based influence for personal relationships. We further demonstrate that deceptive intent drives privacy-seeking behaviour, acting as a tool for social impression management. In parallel, we evaluate how LLMs respond to the same scenarios, revealing mismatches between model behaviour and human expectations, particularly in culturally contingent situations. These mismatches expose new privacy risks arising from socially miscalibrated AI reasoning. We conclude with design strategies to better align device behaviour with these social nuances.

Extended Reality (XR) devices are becoming available in all shapes and forms. They are foreseen to be the backbone of the Metaverse, which is expected to increasingly lead toward more interconnected XR experiences in the future. However, these devices include a large number of sensors that collect sensitive data about users and their surroundings, thus posing threats to their privacy. Until now, research on how users perceive these threats has rather focused on either Mobile Augmented Reality (MAR), Mixed Reality (MR), or Virtual Reality (VR). Still, adopting a global vision including all these technologies, i.e., XR, is necessary to understand the potential differences in privacy between users that future cross-platform experiences may cause. This understanding is needed to bring usable Privacy-Enhancing Technologies (PETs) to XR users. In this paper, we therefore consider different XR technologies together, and analyze users’ related privacy perceptions. By doing so, we observe differences and similarities between each of these technologies by comparing them against each other. In our study, 20 participants have visited a virtual house guided by a real-estate agent, with a cross-platform application that we developed for (1) Android (MAR), (2) Microsoft Hololens (MR), and (3) Meta Quest 2 (VR). They tested our application with two of these devices. We then conducted a semi-structured interview to gather comparisons and insights on their experience with both technologies, including permission requests, sensor data collection, and privacy perceptions. Our findings suggest that our participants are more concerned about MAR and MR than VR . We found they were less aware about the use of camera and eye tracking data than microphone data in the context of our application. In addition, half of our participants were more concerned about XR than more common technologies (i.e.,computers, smartphones), despite overall low concerns on XR and low awareness on biometric data sensitivity. These insights underline aspects that must further be developed to raise XR users’ awareness and help them in better controlling their privacy, such as more adapted sets of permissions to track surfaces in XR.

Smart speakers pose privacy risks to users and bystanders. We do not know how these risks are perceived depending on different factors, such as the potential privacy violators, the nature of the privacy violation, the different user groups, and culture. Understanding these perceptions is crucial to providing adequate privacy solutions and legislation. To this end, 1,768 participants from Germany and the UK answered our online-questionnaire about their perceptions of five different actors’ possibilities , intentions , and legal bases to commit five privacy violations: data access, data inference, overhearing conversations, secondary use, and passing data along. Participants expressed mild concerns about the main user but greater worry about manufacturers and the state. We observe growing concern among younger people, especially in the UK and that users who do not own the smart speaker are the least concerned group. Our approach can be used to better differentiate perceptions of concerns in other contexts.

Voice assistants, as provided by smart speakers, have become ubiquitous. Current authentication methods in these systems, however, rely on wake words, posing a risk due to the susceptibility to replay attacks. Additionally, user data stored on servers could expose sensitive information. This study suggests an approach to improve user authentication and profile management in smart speakers, reducing risks tied to external data processing and storage. We propose a two-fold solution for continuous user authentication and local user profiles. This approach prevents unauthorized access to sensitive data and grants users access to their local recordings. Our method differs from current practices in two ways: (1) It authenticates users based on complete voice commands, reducing the risk of replayed wake word attacks, and (2) it operates locally, avoiding the transfer of sensitive data to external servers. We offer a proof-of-concept with Alexa Voice Service (AVS) integration and a thorough evaluation using voice datasets and a study with 17 participants. We tested our approach under various conditions, including accents, background noise, and muffled speech. Legitimate users are identified with 93% precision, 95% recall, 94% F1-score, and 99% accuracy, while illegitimate users are recognized with 99% accuracy across these metrics.

Billions images are shared daily on social networks. When shared with an inappropriate audience, user-generated images can, however, compromise users' privacy and may have severe consequences, such as dismissals. To address this issue, different solutions were proposed, ranging from graphical user interfaces to Deep Learning (DL) models to alert users based on image sensitivity prediction. Although these models show promising results, they are evaluated on datasets relying on small participants' samples. To address this limitation, we first introduce SensitivAlert, a dataset that re-annotates the previously annotated images from two existing datasets, but using a German-speaking cohort of 907 participants. We then leverage it to classify images according to two sensitivity classes---private or public---using recent transformer-based DL models. In our evaluation, we first consider consensus-based generic models using our dataset as benchmark based on image content itself and its associated user tags. Moreover, we show that our fine-tuned models trained on our dataset better reflect users' image privacy conceptions. We finally focus on individual user's privacy estimation by investigating three approaches: (1) a generic approach based on participants' consensus for fine-tuning, (2) a user-wise approach based on user's privacy preferences only, and (3) a hybrid approach that combines individual preferences with consensus-based preferences. Our results finally show that the generic and hybrid approaches outperform the user-wise one for most users, thus ensuring the feasibility of image privacy prediction preferences at the individuals' level.

According to the European General Data Protection Regulation and the principle of Privacy-by-design developers should embed methods of privacy protection into their projects at an early stage. However, studies show that developers are either lacking the tools or the training to apply the appropriate methods. Hence, to ensure the development of privacy-preserving software it is important to understand developers’ issues with methods of privacy-preserving computation. To this end, we have sent a questionnaire to 407 participants with diverse backgrounds to investigate their perceptions of privacy in general and of the methods k-anonymity, differential privacy, homomorphic encryption, and secure multi-party computation in particular. We compared the results to developers’ issues on Stack Overflow. We observe that raising the awareness about these methods increases developers’ willingness to use them in the future. We also validate previously known privacy-related issues developers face. Including privacy-preserving methods in programming education and, thereby, raising developers’ awareness could therefore enhance the privacy protection of software products.

A promising approach to further increase the safety of Vulnerable Road Users (VRUs) are cooperative collision avoidance systems. Cooperative collision avoidance systems actively integrate the VRUs in collision detection by using movement data from a VRU’s mobile device. While in recent years great attention was payed to solve technical challenges, e.g., regarding communication and sensor accuracy, little attention was payed to threats of privacy. However, the use and collection of such data poses certain privacy risks to the VRU. These privacy risks cannot be addressed by encryption alone. While some pseudonymisation approaches are used to protect the identity and location of VRUs, in this paper, we analyse to which extent the perturbation of movement data, specifically the speed data, can prevent the linkage of this data to a particular VRU, thus reducing the probability that this specific VRU can be identified. At the same time, we evaluate the trade-off between the probability of User Identification and the probability of collision detection. The evaluation is based on a standardised urban collision scenario between pedestrians and vehicles from the European New Car Assessment Programme. Our results show that privacy and "survival" are not mutually exclusive.

Abstract The processing of employees’ personal data is dramatically increasing, yet there is a lack of tools that allow employees to manage their privacy. In order to develop these tools, one needs to understand what sensitive personal data are and what factors influence employees’ willingness to disclose. Current privacy research, however, lacks such insights, as it has focused on other contexts in recent decades. To fill this research gap, we conducted a cross-sectional survey with 553 employees from Germany. Our survey provides multiple insights into the relationships between perceived data sensitivity and willingness to disclose in the employment context. Among other things, we show that the perceived sensitivity of certain types of data differs substantially from existing studies in other contexts. Moreover, currently used legal and contextual distinctions between different types of data do not accurately reflect the subtleties of employees’ perceptions. Instead, using 62 different data elements, we identified four groups of personal data that better reflect the multi-dimensionality of perceptions. However, previously found common disclosure antecedents in the context of online privacy do not seem to affect them. We further identified three groups of employees that differ in their perceived data sensitivity and willingness to disclose, but neither in their privacy beliefs nor in their demographics. Our findings thus provide employers, policy makers, and researchers with a better understanding of employees’ privacy perceptions and serve as a basis for future targeted research on specific types of personal data and employees.

The increasing number of fitness tracking wearables deployed worldwide poses challenges to the privacy of their users, esp. in terms of transparency. Privacy notifications facilitate transparency by providing users with situational awareness about the processing of their personal data. We present the results of two online surveys including English-speaking (nEng=154) and German-speaking (nGer=150) users of fitness tracking devices from Europe, conducted to elicit determinants of notification settings. We found evidence for the perceived usefulness of privacy notifications, and for concordant predictors in terms of when and how users prefer to be notified about personal data processing in 12 scenarios related to fitness tracking.

Abstract Applied privacy research has so far focused mainly on consumer relations in private life. Privacy in the context of employment relationships is less well studied, although it is subject to the same legal privacy framework in Europe. The European General Data Protection Regulation (GDPR) has strengthened employees’ right to privacy by obliging that employers provide transparency and intervention mechanisms. For such mechanisms to be effective, employees must have a sound understanding of their functions and value. We explored possible boundaries by conducting a semi-structured interview study with 27 office workers in Germany and elicited mental models of the right to informational self-determination, which is the European proxy for the right to privacy. We provide insights into (1) perceptions of different categories of data, (2) familiarity with the legal framework regarding expectations for privacy controls, and (3) awareness of data processing, data flow, safeguards, and threat models. We found that legal terms often used in privacy policies used to describe categories of data are misleading. We further identified three groups of mental models that differ in their privacy control requirements and willingness to accept restrictions on their privacy rights. We also found ignorance about actual data flow, processing, and safeguard implementation. Participants’ mindsets were shaped by their faith in organizational and technical measures to protect privacy. Employers and developers may benefit from our contributions by understanding the types of privacy controls desired by office workers and the challenges to be considered when conceptualizing and designing usable privacy protections in the workplace.

Crowdsensing applications rely on volunteers to collect sensor readings using their mobile devices. Since the collected sensor readings are annotated with spatiotemporal information, the volunteers' privacy may be endangered. Existing privacy-preserving solutions often disclose the volunteers' location information to either a central third party or their peers. As a result, the volunteers need to trust these parties to respect their privacy. In this paper, we present a distributed approach based on the concept of multi-party computation, which does not require a trusted party and protects the location information against curious users. We evaluate the performance of our approach and show its feasibility by means of extensive simulations based on a real-world dataset. We further implement a proof-of-concept to test its performance under realistic conditions.

Mobile crowdsourcing applications leverage volunteers to collect information using their personal devices. It is hence vital to foster the volunteers' engagement and their contributions to ensure the long-term viability of these applications. A method to reach this goal is to notify participants about new tasks in their physical proximity. Such location-based notifications can however impact the users' experiences, disclose their location, and/or incur additional resource consumption. In this paper, we therefore investigate the potential worthiness of introducing location-based notifications in the wild. Our analysis includes the perspectives of both potential users and campaign managers. To this end, we have conducted two questionnaire-based studies counting 335 participants in total. By doing so, we gain insights about the participants' expectations and the value attributed to invested resources. We further identify significant factors that influence their readiness to activate this new function. Finally, we measure the impact of job alerts and rewards on both the quantity and quality of users' contributions. Consequently, our findings can help campaign administrators in the design of future crowdsensing applications.

Even avid users of mobile applications turn a blind eye to privacy settings. Still mobile applications remain the key means by which users share sensitive personal information. It is unclear if users just do not care, if they are missing the appropriate tools or user interfaces, or if they live in the delusion of being in control of their data. We argue that non-user-friendly design presents a key obstacle in making privacy controls work: it hinders users to effectively set up and maintain privacy settings. Our ultimate goal is to support the user by automatically suggesting access control lists based on an analysis of her communication metadata. To guide us in the design of such privacy suggestions, we perform an explorative questionnaire-based study with 42 participants. Our results confirm that users are overtaxed with existing schemes. We identify the expectations and preferences of users, thus facilitating the design of improved solutions.

Access control is a key principle to protect user privacy online. The combination of both the wealth of user-generated data in online social networks and overly complex user interfaces lead to a high user burden for privacy control, hence making the observance of the above principles difficult. We investigate how communication metadata on smartphones can facilitate providing tailored suggestions for restricted audience groups, thus limiting the sharing of data to the intended users only. To this end, we have performed a user study collecting a dataset including contact names, calls, SMS, MMS, and e-mail on personal smartphones in everyday use. In this paper, we examine which are the key features determining the social relationship category of a contact using machine learning. We obtain promising results for an automated classification of contacts into work-related, family-related and other social-interaction-related, thus enabling the possibility of user assistance for privacy control. Obtaining a more fine-grained categorization of the latter category into acquaintances, friends, and university-mates is shown to be difficult, since these categories blur in our study group.

Every day, we carry our mobile phone in our pocket or bag. When arriving at work or to a meeting, we may display it on the table. Most of the time, we however do not change the ringtone volume based on the new phone location. This may result in embarrassing situations when the volume is too loud or

The Internet of Things will encompass a rich variety of sensing systems including mobile phones, embedded sensor and actuator platforms, and even smart electricity meters. Through their collaborative operation, billions of such devices will realize the vision of smart homes, smart cities, and beyond

Current mobile sensing applications typically annotate the collected sensor readings with spatiotemporal information before reporting them to a central server. Such information can however endanger the users' privacy, as it reveals insights about their daily routines. Users must therefore trust the application administrators not to misuse the reported information. To diminish user dependence on administrators trustworthiness, we propose a privacy-preserving collaborative scheme, in which users exchange the collected sensor readings at opportunistic encounters. We model malicious administrators attempting to identify exchanged sensor readings based on spatial disparity by applying four state-of-the-art outlier detection algorithms. We thoroughly investigate the influence of different exchange patterns and the parameters of the algorithms on their performance based on a real-world dataset. The results for location traces of 20 users gathered during 14 days show that our algorithm achieves a high level of privacy protection.

Mobile phones are increasingly leveraged as sensor platforms to collect information about user's context. The collected sensor readings can however reveal personal and sensitive information about the users and hence put their privacy at stake. In prior work, we have proposed different user interfaces allowing users to select the degree of granularity at which the sensor readings are shared in order to protect their privacy. In this paper, we aim at further increasing user awareness about potential privacy risks and investigate the introduction of picture-based warnings based on their current privacy settings. Depending on their privacy conception and the proposed warnings, users can then adapt their settings or leave them unchanged. We evaluate the picture-based warnings by conducting a user study involving 30 participants. The results show that more than 70% of the participants would change their settings after having seen the picture-based warnings.

By leveraging smartphones as sensing platforms, mobile sensing applications can collect information in an unprecedented quantity and granularity. The transmission of unprocessed sensor readings can, however, pose severe threats to the users' privacy. To protect their privacy, users can apply filters to eliminate privacy-sensitive elements of the sensor readings prior to transmission. The resulting privacy protection depends on the configuration of these filters, which is controlled by the users through a privacy interface. In this paper, we study interface elements for the realization of this interface in order to foster its acceptance and maximize the efficacy of the provided privacy protection. To this end, we have implemented six graphical privacy interfaces, which have been evaluated by 80 participants of our user study. The results show a preference of the users towards differently colored and sized elements to visualize the current level of privacy protection and define their preferred privacy settings.

Reputation systems rate the contributions to participatory sensing campaigns from each user by associating a reputation score. The reputation scores are used to weed out incorrect sensor readings. However, an adversary can deanonmyize the users even when they use pseudonyms by linking the reputation scores associated with multiple contributions. Since the contributed readings are usually annotated with spatiotemporal information, this poses a serious breach of privacy for the users. In this paper, we address this privacy threat by proposing a framework called IncogniSense. Our system utilizes periodic pseudonyms generated using blind signature and relies on reputation transfer between these pseudonyms. The reputation transfer process has an inherent trade-off between anonymity protection and loss in reputation. We investigate by means of extensive simulations several reputation cloaking schemes that address this tradeoff in different ways. Our system is robust against reputation corruption and a prototype implementation demonstrates that the associated overheads are minimal.

The presence of multimodal sensors on current mobile phones enables a broad range of novel mobile applications including, e.g., monitoring noise pollution or traffic and road conditions in urban environments. Data of unprecedented quantity and quality can be collected and reported by a possible user base of billions of mobile phone subscribers worldwide. The collection of detailed sensor and location data may however compromise user privacy. In this paper, we present a decentralized mechanism to preserve location privacy during the collection of sensor readings. As most sensor readings are geotagged, we propose to exchange them between users in physical proximity in order to jumble the paths followed by the users. We evaluate different strategies to exchange and report the sensor readings to the application using real-world GPS traces of mobile users. The results demonstrate the feasibility and efficacy of our proposed scheme, which can obfuscate up to 100% of the visited locations in the best instances.

Wireless Community Networks (WCN) are formed by the integration of user-operated wireless sensor networks that are internetworked by wireless mesh networks available within urban communities. WCNs enable novel applications for the members of the community. These include different sensing applications, where individuals contribute sensor data for further use within their community at large or with well-defined restrictions to certain users. Sensing application scenarios for WCNs differ from traditional sensor network applications with respect to their security and privacy requirements. In this paper, we define three representative scenarios-personal sensing, designated sensing, and community sensing. These scenarios are then studied with respect to their privacy and security implications. In particular, we identify main research questions and highlight the challenges of using various security and privacy approaches from networking and cryptography to make sensing applications in WCNs security and privacy aware.

In wireless sensor networks, energy is commonly a scarce resource, which should be used as sparingly as possible to allow for long node lifetimes. It is therefore mandatory to put a focus on the development of energy-efficient applications. In this paper, we analyze the achievable energy gains when packet payloads are compressed prior to their transmission. As the radio transceiver chips are the predominant power consumers on most current sensor node platforms, we present how local compression of data can be successfully employed to preserve energy. We compare two lossless mechanisms to eliminate redundancies in the packets with regard to the overall energy savings. The results prove that data compression is a viable approach to reduce a platform's energy consumption, as it can reduce the radio transmission durations of packets and thus shorten the duty cycles of the radio device.