Many social network sites (SNSs) have become available around the world and users’ online social networks increasingly include contacts from different cultures. However, there is lack of investigation into the concrete cultural differences in the effects of contextual factors and privacy concerns on users’ privacy decisions on social network sites (SNSs). The goal of this paper is to understand how contextual factors and privacy concerns cast different impact on privacy decisions, such as friend request decisions, information disclosure and perceived risk, in different countries. We performed a quantitative study through a large-scale online survey across the US, Korea and China to model the relationships between contextual factors, privacy concerns and privacy decisions. We find that the contextual influence and focus of privacy concerns vary between the individualistic and collectivistic countries in our sample. We suggest that multinational SNS service providers should consider different contextual factors and focus of privacy concerns in different countries and customise privacy designs and friend recommendation algorithms in SNSs in different countries.

Friend request acceptance and information disclosure constitute 2 important privacy decisions for users to control the flow of their personal information in social network sites (SNSs). These decisions are greatly influenced by contextual characteristics of the request. However, the contextual influence may not be uniform among users with different levels of privacy concerns. In this study, we hypothesize that users with higher privacy concerns may consider contextual factors differently from those with lower privacy concerns. By conducting a scenario‐based survey study and structural equation modeling, we verify the interaction effects between privacy concerns and contextual factors. We additionally find that users' perceived risk towards the requester mediates the effect of context and privacy concerns. These results extend our understanding about the cognitive process behind privacy decision making in SNSs. The interaction effects suggest strategies for SNS providers to predict user's friend request acceptance and to customize context‐aware privacy decision support based on users' different privacy attitudes.

Researchers are building Internet of Things (IoT) systems that aim to raise users’ privacy awareness, so that these users can make informed privacy decisions. However, there is a lack of empirical research on the practical implications of informed privacy decision-making in IoT. To gain deeper insights into this question, we conducted an online study ( N = 488) of people’s privacy decision-making as well as their levels of privacy awareness toward diverse IoT service scenarios. Statistical analysis on the collected data confirmed that people who are well aware of potential privacy risks in a scenario tend to make more conservative and confident privacy decisions. Machine learning (ML) experiments also revealed that individuals overall privacy awareness is the most important feature when predicting their privacy decisions. We verified that ML models trained on privacy decisions made with confidence can produce highly accurate privacy recommendations for users (area under the ROC curve (AUC) of 87%). Based on these findings, we propose functional requirements for privacy-aware systems to facilitate well-informed privacy decision-making in IoT, which results in conservative and confident decisions that enjoy high consistency.

Privacy researchers have suggested various granular audience control techniques for users to manage the access to their disclosed information on social network sites. However, it is unclear how users adopt and utilize such techniques in daily use and how these techniques may impact social interactions with others over time. In this study, we examine users' experience during everyday use of granular audience control techniques in WeChat, one of the most popular social network applications in China. Through an interview study with 24 WeChat users, we find that users adjust their configurations and develop rationales for these configurations over time. They also perceive mixed impacts of WeChat's privacy settings on their information disclosure and social interactions, which brings new challenges to privacy design. We discuss the implications of these findings and make suggestions for the future design of privacy settings in SNSs.

Live streaming is a new media format that simultaneously records and broadcasts in real time, in multiple channels including video, audio, and text. A new application area of live streaming is in the video game community, where players stream their gameplay. Since most of the streamed games are team-based, one's live streaming may involve other players' gameplay and disclosure. In the present paper, we aim to understand the attitudes and strategies of players who have been streamed by others in video game live streaming. From an interview study with 20 World of Warcraft (WoW) players, we found that participants had concerns about being streamed due to different factors, and adopted individual and collaborative strategies to cope with their concerns. We discuss privacy challenges in live streaming and present design implications for live streaming tools to improve privacy management.

If one wants to study privacy from an intercultural perspective, one must first validate whether there are any cultural variations in the concept of “privacy” itself. This study systematically examines cultural differences in collective privacy management strategies, and highlights methodological precautions that must be taken in quantitative intercultural privacy research. Using survey data of 498 Facebook users from the US, Singapore, and South Korea, we test the validity and cultural invariance of the measurement model and predictive model associated with collective privacy management. The results show that the measurement model is only partially culturally invariant, indicating that social media users in different countries interpret the same instruments in different ways. Also, cross-national comparisons of the structural model show that causal pathways from collective privacy management strategies to privacy-related outcomes vary significantly across countries. The findings suggest significant cultural variations in privacy management practices, both with regard to the conceptualization of its theoretical constructs, and with respect to causal pathways.

With the advent of the Internet of Things (IoT), users are more likely to have privacy concerns since their personal information could be collected, analyzed, and utilized without notice by the networked IoT devices and services. Users may want to control all such activities by explicitly expressing their privacy preferences. However, it is becoming increasingly difficult for users to do so, not only because of the cognitive burden of continuously making privacy decisions for IoT services, but also because IoT devices have no, or only very restricted, user interfaces. Intelligent software helping users make better privacy decisions will be an important component of privacy-preserving IoT environments. In order to construct such a component, we aim to verify whether it will be possible to computationally model and predict users' privacy preferences in IoT. To that end, we survey 172 participants in a simulated campuswide IoT environment about their privacy preferences regarding hypothetical personal information tracking scenarios. Then, we cluster the scenarios based on the survey responses, arriving at four clusters with distinct associated privacy preferences. Based on the clustering results, we uncover contextual factors that induce privacy violations in IoT. Finally, we build machine learning models to predict users' privacy decisions, using both contextual information and the corresponding cluster membership as training data. The final trained model shows 77% accuracy in predicting users' decisions whether or not to allow the respective IoT scenario.

Abstract The influence of cultural background on people’s privacy decisions is widely recognized. However, a cross-cultural approach to predicting privacy decisions is still lacking. Our paper presents a first integrated cross-cultural privacy prediction model that merges cultural, demographic, attitudinal and contextual prediction. The model applies supervised machine learning to users’ decisions on the collection of their personal data, collected from a large-scale quantitative study in eight different countries. We find that adding culture-related predictors (i.e. country of residence, language, Hofstede’s cultural dimensions) to demographic, attitudinal and contextual predictors in the model can improve the prediction accuracy. Hofstede’s variables - particularly individualism and indulgence - outperform country and language. We further apply generalized linear mixed-effect regression to explore possible interactions between culture and other predictors. We find indeed that the impact of contextual and attitudinal predictors varies between different cultures. The implications of such models in developing privacy-enabling technologies are discussed.

Many computer users today value personalization but perceive it in conflict with their desire for privacy. They therefore tend not to disclose data that would be useful for personalization. We investigate how characteristics of the personalization provider influence users' attitudes towards personalization and their resulting disclosure behavior. We propose an integrative model that links these characteristics via privacy attitudes to actual disclosure behavior. Using the E laboration L ikelihood M odel, we discuss in what way the influence of the manipulated provider characteristics is different for users engaging in different levels of elaboration (represented by the user characteristics of privacy concerns and self‐efficacy). We find particularly that (a) reputation management is effective when users predominantly use the peripheral route (i.e., a low level of elaboration), but much less so when they predominantly use the central route (i.e., a high level of elaboration); (b) client‐side personalization has a positive impact when users use either route; and (c) personalization in the cloud does not work well in either route. Managers and designers can use our results to instill more favorable privacy attitudes and increase disclosure, using different techniques that depend on each user's levels of privacy concerns and privacy self‐efficacy.

Many users welcome personalized services, but are reluctant to provide the information about themselves that personalization requires. Performing personalization exclusively at the client side (e.g., on one's smartphone) may conceptually increase privacy, because no data is sent to a remote provider. But does client-side personalization (CSP) also increase users' perception of privacy?

We examine the effect of coarse-grained vs. fine-grained location sharing options on users' disclosure decisions when configuring a sharing profile in a location-sharing service. Our results from an online user experiment (N=291) indicate that users who would otherwise select one of the finer-grained options will employ a compensatory decision strategy when this option is removed. This means that they switch either in the direction of more privacy and less benefit, or less privacy and more benefit, depending on the subjective distance between the omitted option and the remaining options. This explanation of users' disclosure behavior is in line with fundamental decision theories, as well as the well-established notion of "privacy calculus". Two alternative hypotheses that we tested were not supported by our experimental data.

Prior research shows that a root cause of many privacy concerns in location-sharing social media is people's desire to preserve offline relationship boundaries. Other literature recognizes lying as an everyday phenomenon that preserves such relationship boundaries by facilitating smooth social interactions. Combining these strands of research, one might hypothesize that people with a predisposition to lie would generally have lower privacy concerns since lying is a means to preserve relationship boundaries. We tested this hypothesis using structural equation modeling on data from a survey administered nationwide (N=1532), and found that for location-sharing, people with a high propensity to lie actually have increased boundary preservation concerns as well as increased privacy concerns. We explain these findings using results from semi-structured interviews.

In a mixed-methods study on adoption of location-sharing social networks (LSSN), we discovered that variations in adoption and usage behavior could be explained by one's predisposition to communicate in a certain style. Specifically, we found that certain individuals prefer a communication style we call FYI (For Your Information). FYI communicators like to infer availability and to keep in touch with others without having to interact with them, which is the predominant style in current LSSN. Using structural equation modeling on a U.S. nationwide survey (N=1021), we show how the FYI communication style predicts the adoption of LSSN while also showing a negative effect on one's desire to call someone on the phone. Moreover, we find that as age increases, FYI preference significantly decreases. In a follow-on survey (N=180), we refine the FYI construct and show that it affects users' level of disclosure and participation in social media. Furthermore, we show that it completely mediates the effect of certain Big-5 personality traits on social media participation and LSSN usage. The results suggest that to cater to a wider segment of the population, LSSN (and arguably any social media) should support an active communication style.

Personalization relies on personal data about each individual user. Users are quite often reluctant though to disclose information about themselves and to be "tracked" by a system. We investigated whether different types of rationales (justifications) for disclosure that have been suggested in the privacy literature would increase users' willingness to divulge demographic and contextual information about themselves, and would raise their satisfaction with the system. We also looked at the effect of the order of requests, owing to findings from the literature. Our experiment with a mockup of a mobile app recommender shows that there is no single strategy that is optimal for everyone. Heuristics can be defined though that select for each user the most effective justification to raise disclosure or satisfaction, taking the user's gender, disclosure tendency, and the type of solicited personal information into account. We discuss the implications of these findings for research aimed at personalizing privacy strategies to each individual user.

The recent emergence of RFID tags capable of performing public key operations enables a number of new applications in commerce (e.g., RFID-enabled credit cards) and security (e.g., ePassports and access-control badges). While the use of public key cryptography in RFID tags mitigates many difficult security issues, certain important usability-related issues remain, particularly when RFID tags are used for financial transactions or bearer identification. In this paper, we focus exclusively on techniques with user involvement for secure user-to-tag authentication, transaction verification, reader expiration and revocation checking, as well as pairing of RFID tags with other personal devices. Our approach is based on two factors: (1) recent advances in hardware and manufacturing have made it possible to mass-produce inexpensive passive display-equipped RFID tags, and (2) high-end RFID tags used in financial transactions or identification are attended by a human user (typically, their owner). Our techniques rely on user involvement coupled with on-tag displays to achieve better security and privacy. Since user acceptance is a crucial factor in this context, we conducted comprehensive user studies to assess usability of all considered methods. This paper reports on our findings.

Recommender systems increasingly use contextual and demographical data as a basis for recommendations. Users, however, often feel uncomfortable providing such information. In a privacy-minded design of recommenders, users are free to decide for themselves what data they want to disclose about themselves. But this decision is often complex and burdensome, because the consequences of disclosing personal information are uncertain or even unknown. Although a number of researchers have tried to analyze and facilitate such information disclosure decisions, their research results are fragmented, and they often do not hold up well across studies. This article describes a unified approach to privacy decision research that describes the cognitive processes involved in users’ “privacy calculus” in terms of system-related perceptions and experiences that act as mediating factors to information disclosure. The approach is applied in an online experiment with 493 participants using a mock-up of a context-aware recommender system. Analyzing the results with a structural linear model, we demonstrate that personal privacy concerns and disclosure justification messages affect the perception of and experience with a system, which in turn drive information disclosure decisions. Overall, disclosure justification messages do not increase disclosure. Although they are perceived to be valuable, they decrease users’ trust and satisfaction. Another result is that manipulating the order of the requests increases the disclosure of items requested early but decreases the disclosure of items requested later.

Users of social recommender systems may want to inspect and control how their social relationships influence the recommendations they receive, especially since recommendations of social recommenders are based on friends rather than anonymous "nearest neighbors". We performed an online user experiment (N=267) with a Facebook music recommender system that gives users control over the recommendations, and explains how they came about. The results show that inspectability and control indeed increase users' perceived understanding of and control over the system, their rating of the recommendation quality, and their satisfaction with the system.

Instant messaging (IM) has evolved into an important tool for collaborative work. It supports informal near-synchronous communication and fosters awareness of the online presence of one's communication partners. Like all awareness systems, IM runs into concerns regarding privacy. Drawing upon prior literature and exploratory interviews, we postulate a model that posits impression management as an underlying cause for privacy desires of IM users. We verify our hypotheses using linear structural modelling on data from a large online survey of IM users across the US. The model establishes that the desire for privacy in IM arises due to the desire for impression management (both directly, as well as indirectly through the desire for visibility of one's impression to oneself). Based on this model, we suggest that IM systems could support privacy needs of users better by providing them with more knowledge and control over aspects that affect their IM-conveyed impression on others (i.e. by making impression management functionality available). Specifically, to help convey and sustain appropriate impressions on IM contacts, IM systems should allow for increased visibility of one's actions to oneself, facilitate easy comparison of one's practices with those of others, and allow one to view oneself from the perspective of others and to make finer-grained adjustments to IM settings than is possible today.

Recent privacy controversies surrounding social networking sites demonstrate that the mere availability of settings is not enough for effective privacy management. We investigated whether the aggregated privacy choices of one's social circle might guide users in making informed privacy decisions. We conducted an experiment in which users specified preferences for six privacy-relevant settings in Instant Messaging. In one condition, users were provided with information indicating the privacy preferences of the majority of their ``buddies." Our results suggest that while this information did influence user choices, the effect was secondary to that of the ``privacy-sensitivity" of the system feature controlled by the particular setting. Frequency of IM usage was also associated with privacy choices. The experiment data coupled with user comments suggest several usability improvements in interfaces for specifying privacy preferences.

As recommender systems are increasingly deployed in the real world, they are not merely tested offline for precision and coverage, but also "online" with test users to ensure good user experience. The user evaluation of recommenders is however complex and resource-consuming. We introduce a pragmatic procedure to evaluate recommender systems for experience products with test users, within industry constraints on time and budget. Researchers and practitioners can employ our approach to gain a comprehensive understanding of the user experience with their systems.

Instant Messaging (IM) is a useful tool for collaborative work. However, the awareness and communication features of IM pose a tension with privacy desires. Inadequate support for managing privacy could lead to suboptimal use of IM and thereby undermine its benefits. We conducted interviews and an Internet survey to understand privacy attitudes and practices in IM usage. Based on the findings from these studies, we designed an IM plugin to improve the support for privacy management in current IM systems. The plugin detects conflicts in privacy preferences, notifies the parties involved, and allows negotiation of a resolution. It also encrypts the communication channels and archives, allows different privacy preferences for different contact groups, and provides visualizations to facilitate the comparison of one’s own IM activities with those of any IM contact group. A usability evaluation of the plugin indicated that it can be expected to succeed in its goal of providing IM users with better privacy management.

No abstract available.

Secure Device Pairing is the bootstrapping of secure communication between two previously unassociated devices over a wireless channel. The human-imperceptible nature of wireless communication, lack of any prior security context, and absence of a common trust infrastructure open the door for Man-in-the-Middle (aka Evil Twin) attacks. A number of methods have been proposed to mitigate these attacks, each requiring user assistance in authenticating information exchanged over the wireless channel via some human-perceptible auxiliary channels, e.g., visual, acoustic or tactile.

This paper presents an exploration and analysis of attitudes towards everyday tracking and recording technologies (e. g., credit cards, store loyalty cards, store video cameras). Interview participants reported being highly concerned with information privacy. At the same time, however, they also reported being significantly less concerned regarding the use of everyday technologies that have the capabilities to collect, process, and disseminate personal information. We present results from this study that both identify and begin to explain this discrepancy.

RFID technology has raised a number of both real and imagined security and privacy fears and concerns. Since roughly 2001, a number of researchers have stepped up to the plate and proposed techniques for strengthening RFID security and privacy, while others have focused on attacking (and demonstrating weaknesses in) currently deployed RFID systems. Despite a few PhD theses devoted to this topic, it remains to be seen whether there are any new long-term fundamental issues involved in RFID security & privacy. Therefore, this panel's goal is to present and debate the panelists' diverse perspectives on the future (or lack thereof) of RFID security and privacy research.

Software product line architectures (PLAs) have been widely recognized as a successful approach in industrial software development for improving productivity, software quality and time-to-market. In this paper, we focus on the usage of a PLA for a quite different purpose, namely, handling privacy constraints in Web personalization. To provide personalized services such as customized recommendations, a personalized Website collects users' personal data, which raises various privacy concerns. We aim at reconciling the benefits of web personalization with privacy constraints that come from users themselves as well as from privacy legislations and regulations that apply to a given user. We propose a dynamic, privacy-enabling personalization infrastructure and conceive it as a PLA. This infrastructure allows for dynamically selecting and instantiating personalization architectures that provide personalized services to each individual user and comply with the prevailing privacy constraints.

Representation components of user modeling servers have been traditionally based on simple file structures and database systems. We propose directory systems as an alternative, which offer numerous advantages over the more traditional approaches: international vendor-independent standardization, demonstrated performance and scalability, dynamic and transparent management of distributed information, built-in replication and synchronization, a rich number of pre-defined types of user information, and extensibility of the core representation language for new information types and for data types with associated semantics. Directories also allow for the virtual centralization of distributed user models and their selective centralized replication if better performance is needed. We present UMS, a user modeling server that is based on the Lightweight Directory Access Protocol (LDAP). UMS allows for the representation of different models (such as user and usage profiles, and system and service models), and for the attachment of arbitrary components that perform user modeling tasks upon these models. External clients such as user-adaptive applications can submit and retrieve information about users. We describe a simulation experiment to test the runtime performance of this server, and present a theory of how the parameters of such an experiment can be derived from empirical web usage research. The results show that the performance of UMS meets the requirements of current small and medium websites already on very modest hardware platforms, and those of very large websites in an entry-level business server configuration.

We present an analysis of privacy attitudes and practices in Instant Messaging based on responses to an online questionnaire. On a 7-point Likert scale, the reported concern about IM privacy spanned the whole range, with the average being slightly below "medium". Respondents' justifications for privacy concerns revealed that the main contributing factors were: sensitivity of content, personal disposition towards privacy, understanding of technology, and potential persistence of conversations. Expectations for various categories of contacts differed significantly. Our findings indicate that it may be useful to leverage grouping functionality for privacy management. We also propose making the underlying technology more transparent.

We report results from a study on the adoption of an information visualization system by administrative data analysts. Despite the fact that the system was neither fully integrated with their current software tools nor with their existing data analysis practices, analysts identified a number of key benefits that visualization systems provide to their work. These benefits for the most part occurred when analysts went beyond their habitual and well-mastered data analysis routines and engaged in creative discovery processes. We analyze the conditions under which these benefits arose, to inform the design of visualization systems that can better assist the work of administrative data analysts.

We describe a model of the process by which people solve problems using information visualization systems. The model was based on video analysis of forty dyads who performed information visualization tasks in an experiment. We examined the following variables: focused questions vs. free data discovery, remote vs. collocated collaboration, and systems judged to have high and low transparency. The model describes the stages of reasoning and generating solutions with visual data. We found the model to be fairly robust across task type, collaborative setting, and system type, though subtle differences were found. We propose that system transparency can support some stages of the process, and that support is needed in the last stage to help users translate their findings from visual to written representations.

Georges Grinstein Questions often asked when presenting some new model, new theory, new research or new visualization include: How useful or how usable is it? and Have you performed any tests? Visualization is an interface technology and as such includes not just software algorithms and techniques, but computer human interaction issues as well. This makes it draw from both areas, one appearing more focused on utility and the other on usability. One key step in the development of a new theory is the attempt to first solve a problem. That problem or question does not include a section; in some domain it may not even contain a utility one from most people's perspectives. We discuss both sides of the issue to clarify the role of each in the development of new visualization technologies. Position Statement Alfred Kobsa In the HCI literature one can find studies which conclude that ease of use is more important than usefulness (Hubona & Blanton 1996), that the opposite holds true (Liao and Landry 2000), and that ease of use is more important for females while the usefulness is more important for males (Yuen and Ma 2002). In this panel contribution, we will present several user studies with information visualization systems, ranging from lab experiments with closed questions to longitudinal adoption studies with administrative data analysts (Gonzales & Kobsa, 2003; Kobsa 2001, 2003; Mark et al. 2003). -------------------------------------------a e-mail: [email protected] e-mail: [email protected] e-mail: [email protected] e-mail [email protected] e-mail [email protected] Consistent with general HCI research, the results show that both factors are important in certain situations, but do not indicate a clear superiority of one factor over the other. Position Statement Catherine Plaisant Is an airplane a better vehicle than a Jaguar, a mountain bicycle or a kid scooter? It all depends of where you need to go, what your goal for the travel is, how old you are, what terrain you will encounter on the way, how long you can spend learning, and many other parameters. All those vehicles are fairly usable but they all require training except for adults using the scooter, and their utility varies enormously as a function of the task and the user. The average car drivers benefit from years of human factor engineering and a large amount of standardization, allowing them to switch from a pickup truck to a convertible in a snap. Similarly, the success of a visualization tool depends on how well it fits the needs of the users it attempts to serve, and the tasks they want to accomplish. If utility may come first for an expert tool (e.g. for discovery tasks requires days of data examination and manipulation), has to come first in public access information systems that requires immediate usability (e.g. interactive displays of census statistics) otherwise users will walk away frustrated. Usability design principles imply that designers and evaluators understand the needs of users to decide which one of the two utility or comes first, and to set levels of required utility and usability. Utility and are both attainable goals that make each other stronger. Like others, we at the University of Maryland have been developing visualization techniques and have struggled over the years to find the best way to evaluate their benefits. Many evaluations have been controlled experiments and we have found that the most useful evaluations were multi-faceted, including qualitative and quantitative measurements or performance, preference and learnability, and I will be show examples from our research. Often we also find that the observations gathered during the experiment can be as informative as the collected measurements. More recently we have been promoting the development of benchmark datasets and tasks that will allow better comparisons between tools and techniques. We have been involved in the 1st InfoVis contest, which calls for the submission of case studies of pairwise comparison of trees. Three pairs of datasets were provided: philogenies, classifications and file system usage data, 605 Proceedings of the 14th IEEE Visualization Conference (VIS’03) 0-7695-2030-8/03 $ 17.00 © 2003 IEEE and open ended tasks described. Accepted submissions will seed an online repository that can be enhanced over time with additional datasets, tasks, case studies and controlled experiment results. I will report on the results of the contest and reflect on how evaluation repository and benchmark datasets might help us understand how to judge the and utility of our tools. The contest is at: http://www.cs.umd.edu/hcil/iv03contest/ Position Statement Ben Shneiderman The answer to the question of or utility first depends on your definition of usability. For me, is more than the color of widgets and placement of text. Usability is about understanding, stating, and serving user needs. Since these needs are the requirements that shape the tool, they determine the utility. The design of excellent tools depends upon understanding how they will be used; therefore is a pre-requisite for successful utility. Position Statement John T. Stasko If the question is, Which comes first, utility or usability? my answer is yes. Both notions are vitally important in the development of information visualization techniques and systems, and they are just two sides of the same coin. When the field of information visualization formed and first grew, the computer graphics and visualization aspects dominated. More recently, an increasing emphasis on the HCI aspects of the field has emerged as we strive to better understand how people can truly benefit from our ideas. When an information visualization technique is implemented in a system, the component is crucial. Poor interface design can hamper adoption and cloud the utility benefits that may be possible. In information visualization, typically does not equate with the common notion of a system being easy to learn. Information visualization systems are complex and they often will be used extensively for long periods of time. Consequently, making a system efficient and natural to use, making functions and operations visible, and simply paying attention to the user interface are key components. This is especially true in systems where interaction and multiple views are essential. For any information visualization technique to be adopted beyond the initial idea generation, there must be some utility or value in that technique. Our field is not about making pretty pictures. It is about helping people with the complex tasks involved in data analysis and understanding. We need to do a better job of articulating the cognitive tasks that occur in data analysis (location, correlation, emphasis, association, etc.) and articulating how information visualization techniques and systems can help with these tasks. Ultimately, a kind of natural selection will occur: systems with utility and value will be adopted and used, while others will quietly fade away.

User-adaptive applications cater to the needs of each individual computer user, taking for example users' interests, level of expertise, preferences, perceptual and motoric abilities, and the usage environment into account. Central user modeling servers collect and process the information about users that different user-adaptive systems require to personalize their user interaction.Adaptive systems are generally better able to cater to users the more data their user modeling systems collect and process about them. They therefore gather as much data as possible and "lay them in stock" for possible future usage. Moreover, data collection usually takes place without users' initiative and sometimes even without their awareness, in order not to cause distraction. Both is in conflict with users' privacy concerns that became manifest in numerous recent consumer polls, and with data protection laws and guidelines that call for parsimony, purpose-orientation, and user notification or user consent when personal data are collected and processed.This article discusses security requirements to guarantee privacy in user-adaptive systems and explores ways to keep users anonymous while fully preserving personalized interaction with them. User anonymization in personalized systems goes beyond current models in that not only users must remain anonymous, but also the user modeling system that maintains their personal data. Moreover, users' trust in anonymity can be expected to lead to more extensive and frank interaction, hence to more and better data about the user, and thus to better personalization. A reference model for pseudonymous and secure user modeling is presented that meets many of the proposed requirements.

The paper describes methods for generating user-tailored advice and for suitably presenting it to users, taking their capabilities and knowledge into account.

We present an empirical study investigating collaborative and individual decision-making about data using two different information visualization systems. Based on previous research, one system is considered more transparent than the other in terms of visual representation and functionality. We found that people who worked in groups were more correct in their answers for objective questions, based on searching a large dataset. These results held for the more transparent system, but not the less transparent system. In a second task, groups were more accurate in their results for a free data discovery task. Again, these results held for the more transparent system only. Subjects using this system also produced results that were higher in complexity but judged lower in importance. Groups and individuals did not differ. We suggest that given the right visualization system, groups do better than individuals in finding more accurate results, but not necessarily increased or more meaningful results.

The paper describes the modeling of a user's conceptual knowledge in the general user modeling shell system BGP‐MS. On the one hand, BGP‐MS is a workbench for the develment of a user model in a particular application domain. It supports the definition of the architecture of the individual user model, and of the architecture and the contents of user stereotypes. A rich representation language for conceptual knowledge, a partition mechanism, and flexible graphics‐based interfaces are at the disposal of the user model developer. On the other hand, BGP‐MS is a runtime user modeling tool aimed at fulfilling central tasks of a user modeling component in an application system. In this mode, the system offers a functional interface for accessing and updating the model of the current user, as well as basic domain‐independent inference mechanisms, support for inferences defined by the developer, and a customizable stereotype management utility. The usefulness of BGP‐MS will be demonstrated by illustrating how it can support the user modeling of various recently developed application systems.

The paper investigates several approaches to user modeling in natural-language dialogue systems. First, reasons are pointed out why user modeling has become so important in the last few years, and definitions are proposed for the notions of "user model" and "user modeling component." Then, techniques for constructing user models in the course of a dialogue are presented and recent proposals for representing a wide range of assumptions about a user's beliefs and goals in a system's knowledge base are surveyed. Examples for the application of user models in systems developed to date are presented, and some social implications are discussed. Finally, unsolved problems like coping with collective beliefs or resource-limited processes are investigated, and prospects for application-oriented research are outlined.