Managing Potentially Intrusive Practices in the Browser: A User-Centered Perspective
Authors: Daniel Smullen (Carnegie Mellon University), Yaxing Yao (University of Maryland, Baltimore County), Yuanyuan Feng (Carnegie Mellon University), Norman Sadeh (Carnegie Mellon University), Arthur Edelstein (Mozilla), Rebecca Weiss (Mozilla)
Volume: 2021
Issue: 4
Pages: 500–527
DOI: https://doi.org/10.2478/popets-2021-0082
Abstract: Browser users encounter a broad array of potentially intrusive practices: from behavioral profiling, to crypto-mining, fingerprinting, and more. We study people’s perception, awareness, understanding, and preferences to opt out of those practices. We conducted a mixed-methods study that included qualitative (n=186) and quantitative (n=888) surveys covering 8 neutrally presented practices, equally highlighting both their benefits and risks. Consistent with prior research focusing on specific practices and mitigation techniques, we observe that most people are unaware of how to effectively identify or control the practices we surveyed. However, our user-centered approach reveals diverse views about the perceived risks and benefits, and that the majority of our participants wished to both restrict and be explicitly notified about the surveyed practices. Though prior research shows that meaningful controls are rarely available, we found that many participants mistakenly assume opt-out settings are common but just too difficult to find. However, even if they were hypothetically available on every website, our findings suggest that settings which allow practices by default are more burdensome to users than alternatives which are contextualized to website categories instead. Our results argue for settings which can distinguish among website categories where certain practices are seen as permissible, proactively notify users about their presence, and otherwise deny intrusive practices by default. Standardizing these settings in the browser rather than being left to individual websites would have the advantage of providing a uniform interface to support notification, control, and could help mitigate dark patterns. We also discuss the regulatory implications of the findings.
Keywords: Browsers, privacy, security, usability, settings, preferences, understanding, mental models, interaction design
Copyright in PoPETs articles are held by their authors. This article is published under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 license.