While recent usable privacy and security (UPS) research has made progress in moving beyond “the average user,” a systematic account of how UPS researchers navigate diversity and inclusion in their work remains lacking. Through 20 in-depth semi-structured interviews with experienced researchers, we examine how and why they recruit diverse, underserved populations in their work, as well as the challenges they face in doing so, including conceptual difficulties in defining who is underserved, limited access to target populations, and inflexible peer review and publishing norms. Participants also reflected on their own positionality when planning and conducting studies, often expressing uncertainty about how to account for and articulate their positionality. We identify strategies researchers use to overcome challenges and highlight areas where collective action from the research community and institutions is needed to foster greater inclusion in UPS research practices.

Mobile telehealth apps can provide valuable services, but they raise significant privacy and security concerns, as they collect health-related and other sensitive personal information. We conducted two surveys (𝑁 = 1, 256 total) to examine US users’ privacy expectations about Android telehealth and teletherapy apps’ data practices and legal privacy protections for the data they collect, gaps between those expectations and actual practices and protections, and how privacy perceptions and behavioral intentions are affected by privacy disclosures. In Survey 1, we explored participants’ privacy perceptions and intentions about 10 telehealth apps, first after reading just the general description from the Google Play Store, then after reading the Data Safety section (DSS). Survey 2 explored broader privacy expectations regarding telehealth apps, regulatory awareness, and preferred legal protections. Findings indicate that participants perceived apps provided by independent developers as less likely to protect privacy than apps offered by healthcare providers. However, participants often had inaccurate privacy expectations and overestimated legal safeguards, potentially leading to uninformed privacy decisions. DSSs significantly affected participants’ expectations about data practices and legal protections and their likelihood of using the app—but while DSSs often increased participants’ confidence in their privacy expectations, they did not necessarily improve their accuracy.

This paper explores how personal attributes, such as age, gender, technological expertise, or “need for touch”, correlate with people’s preferences for properties of tangible privacy protection mechanisms, for example, physically covering a camera. For this, we conducted an online survey (N = 444) where we captured participants’ preferences of eight established tangible privacy mechanisms well-known in daily life, their perceptions of effective privacy protection, and personal attributes. We found that the attributes that correlated most strongly with participants’ perceptions of the established tangible privacy mechanisms were their “need for touch” and previous experiences with the mechanisms. We use our findings to identify desirable characteristics of tangible mechanisms to better inform future tangible, digital, and mixed privacy protections. We also show which individuals benefit most from tangibles, ultimately motivating a more individual and effective approach to privacy protection in the future.