Preference-based Location Sharing: Are More ... - Semantic Scholar

Proceedings of the 2013 ACM SIGCHI Conference on Human Factors in Computing Systems, Paris, France

Preference-based Location Sharing: Are More Privacy Options Really Better? Bart P. Knijnenburg Department of Informatics University of California, Irvine and Samsung R&D Research Center [email protected]

Alfred Kobsa Department of Informatics University of California, Irvine, USA [email protected]

ABSTRACT

We examine the effect of coarse-grained vs. fine-grained location sharing options on users’ disclosure decisions when configuring a sharing profile in a location-sharing service. Our results from an online user experiment (N=291) indicate that users who would otherwise select one of the finer-grained options will employ a compensatory decision strategy when this option is removed. This means that they switch either in the direction of more privacy and less benefit, or less privacy and more benefit, depending on the subjective distance between the omitted option and the remaining options. This explanation of users’ disclosure behavior is in line with fundamental decision theories, as well as the well-established notion of “privacy calculus”. Two alternative hypotheses that we tested were not supported by our experimental data. Author Keywords

Privacy calculus; information disclosure; decision making; location-sharing services. ACM Classification Keywords

H.1.2. Models and principles: User/machine systems, H5.2. Information interfaces and presentation: User interfaces– evaluation/methodology, theory and methods, K.4.1. Computers and society: Public policy issues–privacy. General Terms

Design; Experimentation; Human Factors; Theory. INTRODUCTION

As smartphones become pervasive, location-based services are becoming increasingly popular. As of May 2011, 74% of smartphone owners use their phone to access locationbased information. Despite this, location-sharing services (LSS) are far less popular: only 18% of smartphone users “check in” to services like Foursquare to share their locations with their friends [42]. Recent research has shown that privacy problems are one of the main reasons for the relatively low adoption of LSS Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. CHI 2013, April 27–May 2, 2013, Paris, France. Copyright © 2013 ACM 978-1-4503-1899-0/13/04...$15.00.

Hongxia Jin Samsung R&D Research Center 75 West Plumiera Dr. San Jose, CA 95134, USA [email protected]

[8,19,28,40]. Consequently, some researchers suggest that LSS need to give users more control over who sees what and when [12,25,32]. Even though an increase in control may also increase the complexity of the LSS user interface, these researchers suggest that users would rather not share their location at all without fine-grained controls [5,37]. However, existing LSS such as Google Latitude do not offer fine-grained sharing controls. Are they missing out on a wealth of location data that could be used, e.g., for better personalization? Our study provides a deeper insight into users’ choice behavior in coarse-grained vs. fine-grained location sharing systems. When providing users with fewer location-sharing options in an online experiment (N=291), we saw an increase in the number of users choosing the option(s) that are subjectively closest (in terms of perceived privacy and benefit) to the removed option. This result suggests that users who would otherwise choose the removed option made a deliberate choice between a more secretive and a more revealing option, depending on their perception of the remaining options in relation to the removed option. If system designers want to improve location-sharing, they therefore should take users’ perception of the presented sharing options into account. In this paper, we first define our scope and discuss related work. We then present two theories about what happens when certain sharing options are removed, and develop our research hypotheses based on these theories. The next section describes our user experiment to test these hypotheses. We then show that neither of the two theories is supported by the data, present an alternative explanation of the effects, and provide additional evidence for this explanation. We conclude with design implications, limitations, and suggestions for future work. RELATED WORK Control in Location-Sharing Services

In LSS, control over one’s location sharing comes in two flavors. On the one side there are “check-in” based LSS such as Foursquare. These systems use an active form of location sharing: the user has to actively check in to share her location. Users of such LSS have a high level of control over their location sharing, at the price of having to check in every time they want others to know where they are.

On the other side there are “always on” LSS such as Google Latitude. These systems use a passive and continual form of location sharing: the phone periodically pushes its location to a server without any user intervention. In such systems, users usually control their location sharing by setting and updating their preferences in a sharing profile. This profile typically has a set of user-defined rules that determine what the system will share when, and with whom [5,37,39]. This paper primarily applies to “always on” LSS. Sharing Profile

From a privacy perspective, the sharing profile is an essential element in “always-on” LSS, and has been the topic of extensive research. Looking at how users specify such sharing profiles, some researchers have concluded that users need adequate feedback about who tried to access their location [39] and about the implications of existing and new disclosure rules [35]. An important question is whether it is possible to create accurate sharing profiles at all: location-sharing preferences may be so wayward or ephemeral that no stable rules can accurately capture them. Several researchers found though that there seems to be enough regularity in users’ locationsharing behavior that a sharing profile could capture their underlying preferences [3,5,32,38]. Another important question is how detailed sharing profiles should be. More detailed profiles will better reflect users’ location-sharing preferences, but they may be too difficult and time-consuming to specify manually [11,32,33] or to infer automatically [5,38]. Less detailed profiles, on the other hand, may reduce users’ perceived control [39]. Moreover, since simpler profiles may not be able to capture users’ exact sharing preferences, they increase the risk of over-sharing (if the user selects an option that is more revealing than what she ideally wanted), and/or the lost opportunity of under-sharing (if the user selects an option that is more secretive than what she ideally wanted). In terms of accurately capturing users’ sharing preferences, researchers have argued that, up to a certain point, more options are better [5,37,38,39]. For example, Benisch et al. [5] used experience sampling to gather users’ locationsharing preferences, and then tried to model these preferences post hoc using different levels of profile detail. Their results show that users’ profiles are most accurately captured when users make separate settings for each different user group, time of day, and location. Toch et al. [38] show similar results for user group and location. Users’ decision behavior may be a complicating factor though. Privacy decisions are among the hardest decisions to make, because they have delayed and uncertain repercussions that are difficult to trade off with the possible immediate gratification of disclosure [1,2]. Empirical privacy research demonstrates that users’ decisions are influenced by the way the decision is presented to them. For example, the default value of privacy settings and the order in which

information requests are presented significantly influence users’ level of disclosure [9,20,22,23]. WHAT HAPPENS WHEN OPTIONS ARE REMOVED?

Since external factors often influence users’ privacy decisions, it is quite likely that the available options in a sharing profile will have an influence. In this section, we juxtapose two theories of what happens when sharing options are made coarser-grained (i.e., if fewer options are provided between “sharing everything” and “sharing nothing”). Users Err on the Safe Side (ESS)

Some researchers suggest that users who would normally go for one of the finer-grained options will “err on the safe side” when their preferred option is omitted, and rather not share their location at all [5]. Several researchers use this point to even argue that finer-grained options are necessary to increase users’ level of location-sharing [7,16,31]. Some evidence for this “err on the safe side” argument (ESS) comes from Sadeh et al. [32] and Sousa [35], who show that users initially limit their sharing, but over time tend to update their profiles to share more. Tang et al. [37] compare how users write location-sharing rules when given more (fine-grained) versus fewer (coarse-grained) options. They asked participants to write rules that could be targeted to a certain time/day, location or mood. Half of the participants could merely choose to either share their exact location (address) or nothing at all; the other half could additionally choose to disclose their general semantic location (type of place), specific semantic location (name of place), or general geographic location (city/neighborhood). Tang et al. show that having more options indeed increases sharing (i.e. without these options, participants erred on the safe side), and also reduces the complexity of the created rules. Participants in Tang et al.’s study wrote their rules on paper, so their findings may have partially been determined by the fact that their rule-definition task was performed outside the restrictions of a real interface. E.g., the “general geographic location” option is defined as “city or neighborhood”, but how does the system decide between the two? Due to its vague definition, users may have interpreted this option flexibly, in the way that was most favorable for them. This may explain the increased appeal of this option (participants chose it 45% of the time), and the simpler rules in this condition. A real system would need to resolve such ambiguous options. Moreover, the widgets of a real UI would give users cues of the type of rules that can be created, rather than receiving instructions to that extent from an experimenter. Finally, a mobile sharing-profile interface should arguably offer a more structured interaction than the rule definition interface emulated by Tang et al. [37] and implemented in Locaccino, the LSS used in [32] and [35]. ESS suggests that users of a location-sharing service have a “true” sharing preference that can be expressed on a continuous scale (cf. [11]). The sharing options offered by the system are discrete points on this same scale. According to

ESS, users will choose the option that is closest to, but never more revealing than, their true preference. For instance, in line with Tang et al.’s [37] manipulation, Figure 1 presents four options for location-sharing: users can choose to share nothing (N), their current city (C), their current city block (B), or their exact GPS coordinates (E). In example 1, the user’s “true” preference is somewhere between City and Block, hence this user chooses the City option. However, if the City option were not available (−C), the user would choose to share Nothing. Importantly, adding or removing the City option should only affect how many users choose Nothing and not how many users choose Block or Exact. And since users are only expected to move between N and C, the sum of N+C (and therefore also of B+E) should remain the same. In other words: H1a. The ratio N+C : B+E is constant between +C and −C. Example 2 of Figure 1 presents a corollary, which is not explicitly suggested by the proponents of ESS but follows the same logic. In this case, we examine the addition or removal of the most extreme option, Exact. Again, removing the Exact option should lead some users to share Block instead (since their “true” preference is at or beyond E), but nothing should happen with users who choose to share Nothing or City. Users are only expected to move between B and E, i.e. the sum of B+E (and of N+C) should remain the same. In other words: H2a. The ratio N+C : B+E is constant between +E and –E. Example 1: with/without city

high the Benefits of a certain option are, users will not choose it if its Privacy is not at least as high as their true sharing preference (cf. Figure 1). However, such a non-compensatory strategy for privacyrelated decisions is incompatible with the commonly accepted idea that people use a privacy calculus [13,24] for making disclosure decisions. In privacy calculus, users see privacy as a commodity [10,14,15] and explicitly weigh the plusses and minuses of a privacy-related decision, i.e., they trade off Privacy and Benefit. The privacy calculus is rather in line with a compensatory style of decision-making [6]. The fundamental theory of compensatory decision-making is Luce’s choice axiom (LCA) [18,27]: for a rational decision maker, the probability of selecting an item from a pool of items is not affected by the absence or presence of any specific other item. Thus, in the absence of the City option (−C), LCA predicts that users should “err” on both sides proportionally, as the relative share of the remaining options (N, B and E) does not change. In other words: H1b. The ratio N : B+E is constant between +C and –C. The same should be true for the Exact option; in the absence of this option (−E), LCA predicts that the other options should maintain the same ratio, or: H2b. The ratio N+C : B is constant between +E and −E. ONLINE USER EXPERIMENT

We tested the two alternative hypotheses for each of the two examples using an online user experiment in which we manipulated the availability of the City and Exact options.

With city (+C) N

C

B

E

B

E

Without city (−C) N

Example 2: with/without exact With exact (+E) N

C

B

E Without exact (−E)

N C B Figure 1. Two examples of the “err on the safe side” theory. Users will select the available option (circle) closest to but more private than their true sharing preference (arrow).

Luce’s Choice Axiom (LCA)

ESS describes a non-compensatory decision strategy [6]. In such strategies, the superiority of one select attribute of the decision cannot be offset by an inferiority in another attribute, and vice versa. Let us assume that the sharing options have the attributes Privacy and Benefit, e.g., sharing nothing is good for your Privacy, but sharing your exact location may result in additional Benefit. In ESS, the Privacy attribute trumps the Benefit attribute at any cost. Privacy is what is called a “protected value”: no matter how

Figure 2. The mockup of LocStep used in the user experiment. System

Our online user experiment considers a fictitious locationsharing app named “LocStep”, which automatically shares users’ location based on their sharing profiles. The profile specifies when and with whom LocStep should share location data at what granularity. Participants in the experiment used a mockup of an Android phone that ran LocStep (Figure 2), and interacted with it using a mouse instead of a

touch screen. As the goal of our experiment was to find out how people set their sharing preferences, participants interacted with this configuration dialog only. Participants

We recruited 300 participants through Amazon Mechanical Turk, a recruitment source that has become very popular for conducting user experiments [21]. To avoid cultural effects, we restricted participation to adults in the US. We also restricted participation to Turk workers with very good reputation, and we used several comprehension-testing questions to filter fake and careless contributions. This left us with 291 valid responses. The responses showed an adequate distribution of gender (135 males, 156 females) and age (ranging from 18 to 60, with a median of 27). Procedure

Participants were first given a short introduction to LocStep, including an example of how the system would display the location of its users on the phone screen. Naming task. Participants were asked to list the names of 3-5 of their best friends (“close family members and people you consider your best friends”), 7 of their other friends (“other relatives and friends you don't consider your best friends”), 3-5 of their close colleagues (“fellow team or project members, but no managers”), and 7 of their distant colleagues (“colleagues on other teams or projects, upperlevel management”). These circles were used in the profilesetting task to make the decisions more concrete and realistic. The categories were chosen based on [29,30]. Profile-setting task. Participants were then randomly assigned to one of 2×2x3x2 experimental conditions (see Manipulations). Depending on their assigned condition, participants created several profile settings. For each recipient (e.g. “best friends”), they selected one sharing option (e.g. “city block”) for work hours and one sharing option (e.g. “nothing”) for outside work hours. Note that these decisions had no default value: participants had to explicitly select one of the radio buttons for each decision. Evaluation task. After making the decisions, participants were asked about the reasons behind several of their sharing decisions (see Measurements).

Without exact (−E) Without city (−C)

With city (+C) Table 1. The four conditions that result from manipulating the availability of the sharing options “city” and “exact”. Range and order of who

Some LSS are only used to share one’s location with friends (e.g. Google Latitude), whereas others are also used to get coupons or other benefits (e.g. Foursquare). To make our study more generalizable, one-third of our participants received a version of LocStep that could only be used to share one’s location with friends and colleagues, while twothirds received a version with a wider rage of capabilities that could also share one’s location to get coupons (for food, retailers and events) and services from third-party apps (“Starbucks finder”, “AAA roadside assistance app”, and “BlueShield fitness tracker”). Participants in the “wide range” condition were also asked how they would share with “all other colleagues” and “all other friends”, and with “anyone else”. Moreover, half of them set their preferences for friends/colleagues first, and for coupons/apps thereafter; for the other half this order was reversed. Table 2 shows the order in each of the conditions. Each row in Table 2 had its own “page” in the system mockup. Friends/ coll. only (FC) Friends - 3-5 best - 7 other

Colleagues - 3-5 close - 7 distant

Friends/coll. −> coupons/apps (FC−>CA) Coupons - food, shopping, events

Apps - Starbucks, AAA, BlueShield

Manipulations Availability of sharing options City and Exact

The main manipulations of this paper are the availability of the sharing options City (+C vs. −C) and Exact (+E vs. −E). All participants were offered the option to share either Nothing or their city Block, but only users in the +C condition also had the option to share their City, and only users in the +E condition also had the option to share their Exact location. This leads to the four conditions in Table 1.

With exact (+E)

Friends - 3-5 best - 7 other - all other

Colleagues - 3-5 close - 7 distant - all other

Anyone else

Coupons/apps −> Friends/ coll. (CA−>FC) Friends - 3-5 best - 7 other - all other

Colleagues - 3-5 close - 7 distant - all other

Coupons - food, shopping, events

Apps - Starbucks, AAA, BlueShield

Anyone else

Table 2. The three conditions in the “range and order of who” manipulation.

Grouping of circles

Some LSS let users set their sharing preferences per individual friend (e.g. [12]), while others have settings for each circle of friends (e.g. [5,35,37,38]). Again to make our results more generalizable, we manipulated whether LocStep would ask users to evaluate each friend, colleague, coupon service and app individually, or in groups. Decisions were always shown as belonging to a certain circle, but whereas participants in the “individual” condition made separate decisions for each member of the circle, participants in the “grouped” condition made a single decision per circle. The circles are shown as bullets in Table 2. Measurements

We logged each decision in the profile-setting task, and also asked participants in the evaluation task to assess the reasons why they had made certain decisions. Specifically, we asked: “With [recipient], you decided to share [option] during work hours, and [option] outside work hours. Please explain why you did this by answering the questions below.” We evaluated the following circles in the individual / grouped condition: • your friend [best friend #1] / your best friends ([best friends]) • your friend [other friend #7] / your other friends ([other friends]) • your colleague [close colleague #1] / your close colleagues ([close colleagues]) • your colleague [distant colleague #7] / your other colleagues ([distant colleagues]) • the food coupon service / coupon services (food, shopping and event coupons) • the BlueShield fitness tracker / 3rd party apps (Starbucks finder, AAA Roadside service, and BlueShield fitness tracker) The last two circles were only evaluated where applicable. For friends/colleagues, the questions consisted of the following statements, which were rated on a 7-point scale: 1. 2. 3. 4.

I have nothing to hide from [recipient]. My location could be useful for [recipient]. [recipient] does not want to know where I am. I do not want [recipient] to know where I am.

For coupons and apps, we used the following statements: 1. 2. 3. 4.

I have nothing to hide from [recipient]. I can benefit from [recipient]. My location is not useful for [recipient]. I do not want [recipient] to know where I am.

• • • • • • •

Availability of city (−C vs. +C) Availability of exact (−E vs. +E) Range/order of who (FC−>CA, CA−>FC vs. FC) Closeness of person (close vs. distant) Type of person (friend vs. colleague) When (during vs. outside work hours) The interaction of the latter two variables

For coupons/apps, we used the independent variables: • • • • •

Availability of city (−C vs. +C) Availability of exact (−E vs. +E) Range/order of who (FC−>CA, CA−>FC) Grouping of circles (individual vs. grouped) When (during vs. outside work hours)

The dependent variable is different for each of the two theories. For ESS, we test the ratio N+C : B+E by modeling participants’ choices as 1 whenever the participant chooses N or C, and 0 for B and E. In this model, the coefficient for −C vs. +C tests against H1a: “the ratio N+C : B+E is constant between +C and −C”. Since participants in the –C and +C conditions have a similar distribution in their true sharing preferences (due to their random assignment to these conditions), this ratio should be 1 if ESS holds true. If it is however significantly smaller than 1, then people chose the more revealing side as well (since the proportion of N+C decreases relative to B+E). Similarly, the coefficient for −E vs. +E tests against H2a: “the ratio N+C : B+E is constant between +E and −E”. Again, if ESS holds, this ratio should be 1. If it is however significantly greater than 1, then participants evidently not only choose Block more often in the absence of Exact, but also Nothing and City. For LCA, to test against H1b, we use the ratio N : B+E (i.e. City is ignored) as dependent variable and test the coefficient for –C vs. +C. To test against H2b, we use the ratio N+C : B (i.e. Exact is ignored) as dependent variable, and test the coefficient for –E vs. +E. The Effect of The Availability of City

For friends/colleagues, Figure 3 shows how the distribution of choices differs between the participants in conditions −C and +C. Although the share of Nothing is higher in the –C condition (11.6pp1), the share of Block is also higher (17.6pp), as is the share of Exact (2.1pp, ns). Without the City option, participants became slightly more open on average. In terms of our hypotheses: H1a. The ratio N+C : B+E is 55.4% lower in the –C condition than in the +C condition. This difference is significant (p < .001), so H1a has to be rejected.

RESULTS

We tested our hypotheses by estimating the disclosure decisions using a generalized linear mixed model (GLMM) with a random intercept and a log link function. We modeled the decisions for friends/colleagues separately from the decisions for coupons/apps. For friends/ colleagues, we used the independent variables:

1

“pp” stands for “percentage point”. All pp differences are tested using a GLMM with the option as a binary dependent variable. Differences are statistically significant (p < .001), unless marked ns (not significant).

H1b. The ratio N : B+E is 13.6% lower in –C than in +C (p = .061), so H1b also has to be rejected. Figure 4 shows the same comparison for sharing with apps/coupons. The share of Nothing is only 4.3pp higher in the –C condition (ns) while the share of Block is much higher (24.2pp). The share of Exact is slightly lower (1.8pp, ns). Without the City option, almost all participants became more open on average. In terms of our hypotheses:

8.4pp). Again, not only did participants in the –E condition shift from Exact to Block, but there were also shifts further down the list. In terms of our hypotheses: H2a. The ratio N+C : B+E is 77.6% higher in –E than in +E (p < .001), so H2a has to be rejected. H2b. The ratio N+C : B is 17.3% lower in –E than in +E. This effect is not significant; H2b cannot be rejected. 70%! 60%! 50%! 40%! 30%! 20%! 10%! 0%!

H1a. The ratio N+C : B+E is 60.0% lower in –C than in +C (p < .001), so H1a has to be rejected. H1b. The ratio N : B+E is 25.4% lower in –C than in +C (p = .024), so H1b also has to be rejected. 70%! 60%! 50%! 40%! 30%! 20%! 10%! 0%!

Without city (−C)! With city (+C)! 45.0%! 33.4%!

Nothing!

40.5%! 31.3%! City!

22.9%! Block!

30.7%!

70%! 60%! 50%! 40%! 30%! 20%! 10%! 0%!

Exact!

Nothing!

14.6%!

City!

26.3%! Block!

16.2%!

39.3%! 24.0%!

15.0%! City!

Block!

27.1%! Exact!

Figure 5. The difference between +E and −E in the proportion of users choosing each sharing option for friends/colleagues.

12.4%!

50.5%! 26.6%!

33.9%!

14.5%!

Without city (−C)! With city (+C)! 35.0%!

44.5%!

Nothing!

Figure 3. The difference between +C and −C in the proportion of users choosing each sharing option for friends/colleagues. 70%! 60%! 50%! 40%! 30%! 20%! 10%! 0%!

Without exact (−E)! With exact (+E)!

16.4%! Exact!

Figure 4. The difference between +C and −C in the proportion of users choosing each sharing option for coupons/apps.

With regard to the availability of City, neither of the two theories seems to fit the data. In ESS, we would expect a higher percentage of participants to share Nothing only when City is removed. In LCA, we would expect the ratio of other options to remain constant. In our data though, the percentage of participants sharing Block increases more than the percentage of participants sharing Nothing. The Effect of The Availability of Exact

For friends and colleagues, Figure 5 shows how the distribution of choices differs between the participants in conditions −E and +E. In the −E condition, the share of Block is higher (15.1pp), but the share of Nothing and City are also higher (10.6pp and 1.2pp, ns). So, not only did participants in the −E condition shift from Exact to Block, but there were also shifts further down the list. In terms of our hypotheses: H2a. The ratio of N+C : B+E is 61.1% higher in–E than in +E (p < .001), so H2a has to be rejected. H2b. The ratio of N+C : B is 24.4% lower in –E than in +E. This effect is not significant; H2b cannot be rejected. Figure 6 shows the same comparison for sharing with apps/coupons. The share of Block is 18.7pp higher, but the shares of Nothing and City are also higher (5.9pp, ns and

Without exact (−E)! With exact (+E)!

35.6%! 17.0%!

47.4%!

29.8%! 8.6%! Nothing!

City!

28.7%! Block!

32.9%! Exact!

Figure 6. The difference between +E and −E in the proportion of users choosing each sharing option for coupons/apps.

For the effect of the availability of Exact, LCA seems to fit the data much better than ESS. However, since neither theory seems to fit the data for the effect of the availability of City, we now present a more comprehensive theory. ALTERNATIVE EXPLANATION OF THE RESULTS

Neither ESS nor LCA tells the entire story. This is no surprise though: some researchers who coined ESS have proposed to further “examine whether fine-grained privacy controls result in more or less data sharing” [4], and decision-making researchers have found several effects that qualify the choice axiom [18,34]. More recent decision making research has shown that people do not follow strictly compensatory or non-compensatory strategies, but that their decisions instead depend on their subjective perception of the available choice options. Below we present two theories that originate from this research, and demonstrate that they present a more accurate explanation of the results of our experiment. Tversky’s substitution effect (TSE)

The first of these theories is Tversky’s substitution effect2 (TSE) [18,41]: if option A is subjectively close3 to option 2

Tversky coined the effect describing the “Elimination By Aspects” decision strategy; a non-compensatory strategy. The substitution effect thus introduces a non-compensatory component to a compensatory decision process. 3

Note that Luce agreed that his theory does not work when choice options are perceived as sufficiently similar [26].

B, then A serves as a substitute for B. In such a case, the absence of A will mainly increase the share of option B, and not so much the share of another option C. In other words: If A is closer to B than to C, the ratio B : C will be higher in the −A than in the +A condition. If instead A is closer to C, the effect will be reversed. Combining the substitution effect with LCA, we can qualify H1:

than ESS or LCA. However, this explanation rests on unproven predictions about the ‘subjective distance’ between choice options. Thus, to measure the subjective distances between sharing options, we need to deconstruct the utility of each option into its underlying attributes or part-worth utilities [17,36], which are, as we reasoned before, Privacy and Benefit.

• If and only if the City option is subjectively distinct from both Nothing and Block, LCA holds and the ratio N : B+E will stay the same between +C and –C (i.e. users will prefer both sides proportionally when the City option is removed).

To measure the perceived Privacy and Benefit of each sharing option, we asked participants for a subset of their decisions how they perceived the benefits and privacy of the chosen option. Specifically, for their friends/colleagues, we asked them to indicate their agreement on a scale from −3 to +3 with the statements: “I do not want [recipient] to know where I am” (Privacy) and “My location could be useful for [recipient]” (Benefit). For apps/coupons, we asked them to what extent they agreed with “I do not want [recipient] to know where I am” (Privacy) and “I could benefit from [recipient]” (Benefit).

• If and only if Exact is more distant, it will affect N and C as well. Due to the compromise effect. In this case, introducing the “extreme” option Exact increases sharing across the board. PART-WORTH UTILITY MAPPING

The previous section described how the combination of TSE and SCE might explain our results more accurately

Benefit -->!

Benefit -->!

With exact (+E)

48.8!

29.3! 2! 29.7! 1!

0! -2!

0!

-1! 0! -1!

1!

2!

-2!

26.9! 32.6!

2! 1! 40.4!

0! -2!

-1! 0! -1!

1!

2!

-1! 0! -1!

Exact Block City Nothing

41.0! 1!

2!

-2! Privacy -->! Benefit -->!

Benefit -->!

-2! Privacy -->!

24.8!

-2!

-2! Privacy -->!

2! 18.6! 1! 29.9! 26.7! 0! -1! 0! 1! 2! -1! -2! Privacy -->!

Table 3. Subjective position and choice proportion (size and label) of each option, for sharing with friends/colleagues. With exact (+E) Benefit -->!

Without Exact (−E) 61.5! 2! 1! 38.5! 0! -2!

1!

2!

-2!

Privacy -->!

-2! 2!

35.9!

31.9! 1!

32.2!

0! -2!

-1! 0! -1! -2!

31.3! 2! 37.2!1! 0!

-1! 0! -1!

Benefit -->!

• If and only if Exact is subjectively close to Block, its availability will mainly affect B due to the substitution effect.

1!

Benefit -->!

TSE and SCE act simultaneously: going from –E to +E, the substitution effect decreases the share of Block in favor of Exact, while the compromise effect decreases the share of Nothing or City in favor of Block. Moreover, the distance between Block and Exact will determine the relative strength of each effect. Specifically, we can specify H2:

51.2!2!

Benefit -->!

Indeed, Simonson describes such an effect, the compromise effect (SCE) [34]: Given options B and C, if option A is on the other side of B than C, and far enough removed from B (i.e. a “distant competitor”) then the presence of A will turn B into a compromise between A and C, and in turn, increase the share of B to the expense of C.

Without city (−C)

TSE leaves us with one problem: Since the Exact option is by definition closer to Block than to City and Nothing, the Exact option should always be a substitute for Block. This would bring us back to the point where ESS holds, and thus the ratio N+C : B+E should not change when Exact is introduced. Figure 5 and 6 show however that in the −E condition, the percentage of participants who choose Nothing or City goes up as well. Is there an effect at play that counteracts the substitution effect?

With city (+C)

Simonson’s compromise effect (SCE)

Without Exact (−E)

Without city (−C)

• If and only if the City option is instead subjectively closer to Block TSE predicts that B will decrease more than N between –C and +C (i.e. users will prefer the more revealing side when the City option is removed).

With city (+C)

• If and only if the City option is subjectively closer to Nothing than to Block, TSE predicts that N will decrease more than B between –C and +C (i.e. users will “err on the safe side” when the city option is removed).

1!

2!

Privacy -->!

-2!

-1! 0! -1! -2! 33.9! 2!

31.6! 1!

2!

Exact Block City Nothing

Privacy -->! 17.0!

1! 20.1! 0! -1! 0! -1! -2!

29.0! 1!

2!

Privacy -->!

Table 4. Subjective position and choice proportion (size and label) of each option, for sharing with coupons/apps.

We then mapped the average Privacy and Benefit of each sharing option onto a two-dimensional plane in Table 3 (for

sharing with friends/colleagues) and Table 4 (for coupons/ apps). The different colored “bubbles” represent the different sharing options (red = nothing, orange = city, yellow = city block, and green = exact location). The size of the bubbles, as well as their labels, represents the relative number of times each option was chosen. The position reflects the average perceived Privacy (horizontal axis) and Benefit (vertical axis) of each option. The top two panels in the tables represent the Without City (−C) conditions, while the bottom two panels represent +C. Similarly, the left two panels represent the Without Exact (−E) conditions, while the right two panels represent +E conditions. The Effect of The Availability of City

For friends and colleagues, Table 3 shows that the change in proportions between the –C and +C conditions is indeed related to the subjective position of City. In the −E condition (left side), participants perceived City to be closer to Block (Euclidian distance 0.45 points) than to Nothing (2.25 points), and hence only the share of Block differs significantly between –C and +C (24.2pp4) due to the substitution effect. In the +E condition (right side), the distance from City to Nothing and Block is more equal, and hence both Nothing (14.3pp) and Block (9.1pp) differ between –C and +C due to the choice axiom. The effect on Nothing is more pronounced, because City is somewhat closer to Nothing (Euclidian distance to Block: 1.05 points; to Nothing: 0.64 points). The overall results are in line with our expectations. For coupons and apps, Table 4 again demonstrates that the effect of the availability of City depends on its subjective position: participants perceived City to be much closer to Block (0.45 points in the –E condition and 0.47 points in the +E condition) than to Nothing (1.84 points in the –E condition and 2.03 points in the +E condition). Hence, due to the substitution effect, only the share of Block differs between –C and +C (29.6pp in the –E condition and 17.1pp in +E). This is again in line with our expectations. The effect of The Availability of Exact

Similarly, the effect of Exact also depends on its subjective position relative to the other options. For friends and colleagues, Table 3 shows that in the −C condition (top), Exact is subjectively close to Block (1.13 points), and hence the availability of Exact mainly affects the share of Block (21.5pp) due to the substitution effect. In +C (bottom), Exact is slightly further away from Block (1.29 points), and hence due to the compromise effect, Block (which is only reduced by 8.3pp) regains some share at the expense of Nothing (which is reduced by 13.7pp) when Exact is introduced. This is also in line with our expectations.

4

Again, all pp differences are tested using a GLMM with the option as a binary dependent variable, and statistically significant (p < .001) unless marked ns.

For coupons and apps, Table 4 shows that in the –C condition (top), Exact is subjectively close to Block (0.99 points). Hence the availability of Exact mainly affects the share of Block (24.3pp) due to the substitution effect. This is again in line with our expectations. In +C (bottom), however, only Block (11.8pp) and City (18.9pp) are affected by the availability of Exact, despite the fact that users perceive Exact to be far away from these options (distance: 1.75 points). This is against our expectations; the compromise effect predicts that Nothing would also be affected. DISCUSSION AND CONCLUSION

In this paper we examined the effect of coarse-grained vs. fine-grained sharing options on users’ decisions when configuring a sharing profile in an LSS. We show that when a finer-grained sharing option is removed, users do not just “err on the safe side”, but instead deliberately choose the subjectively closest remaining option. Moreover, if an “extreme” option is introduced that is sufficiently distinct from the existing options, this does not only cause some users to switch from the previously most extreme option to this new option, but it also causes some users to switch from a less extreme option to the previously most extreme option, as this option has now become a compromise instead of an extreme. In other words, such an extreme option may increase sharing across the board. The perception of sharing options plays an important role in users’ decision process. This has several implications for the design of sharing options in LSS. First of all, when designing the ‘optimal’ set of options, it is important to realize that users’ choice for a certain option depends on the other available options. Specifically, assume that designers of a location-sharing app who want to know what sharing options to give to the user decide to run experiments to determine how users would react to different combinations of sharing options. With more than a few sharing options, this approach would result in a combinatorial explosion of the experimental conditions. Our findings suggest a more efficient approach: the designers could simply ask a sample of users about the perceived Privacy and Benefit of the available options. For each option they could have users rate the statements “I would share [option] if I don’t want the other person to know where I am” (Privacy) and “I would share [option] if my location could be useful to the other person” (Benefit). They could then map the options on a plane and measure the distances between options. This allows for the following design strategies (see Figure 7): 1. The developers can omit any options that score so low on both Privacy and Benefit that they are dominated by other options. 2. For options that are subjectively very close, the developers can select the option that is most beneficial from a system perspective, and omit the other options. 3. The developers can identify regions on the graph that are not covered by a sharing option, and offer a sharing option that covers that region.

4. If the developers want to promote a certain sharing option, they can remove surrounding options. 5. The developers can specifically design new options to replace old options. 6. Developers can introduce “extreme” options (which share perceivably more or less than all existing options), to increase or decrease overall sharing. Furthermore, designers could use persuasive strategies to change users’ perception of certain sharing options. For instance, they could give users a justification by highlighting the benefits, or downplaying the privacy implications, of sharing their location with coupon services or apps [22]. Adding an “extreme” sharing option (strategy 6) is another persuasive strategy, which increases the chance that users will share some information. 6. Introduce to increase overall sharing

2

Benefit -->

2. Remove one redundant option 3

3. Introduce an option to close this gap

1 5. If desired, replace this option with one that is perceptually close Privacy --> -3

-2

3

0

0

1

2

3

-1 1. Remove this dominated option -2

4. If desired, remove the left option to increase the right option

-3

Figure 7. The described practices for selecting sharing options.

Finally, a system could try to model users’ perceptions in an effort to automate location sharing. Specifically, we could try to predict users’ relative preference for privacy and benefit in a given situation, and then suggest to them to select the sharing option that most closely fits these preferences. This method would be even more useful for check-in based LSS. In the introduction we mentioned that researchers suggest that LSS users need more control over who sees what and when. This paper makes a case to simplify the what-part of LSS profiles, but the who and the when can arguably also be simplified. For example, “privacy faces” can be used to simplify the creation of different profiles for different audiences [25]. Our results may be limited to the specific LSS used in our study. However, the universal nature of the underlying decision-making theory suggests that these results could be extended to other kinds of privacy preference configuration interfaces. This may be the most valuable contribution of our work: based on a fundamental theory from the field of

decision-making, we were able to qualify existing research in the field of LSS privacy. Decisions about privacy are inherently difficult; if we want to make privacy more usable, we will have to understand and assist users’ decisionmaking. Research on decision theory has a long track record of doing exactly this. We thus encourage researchers in the field of usable privacy to consider decision-theoretic ideas in the conceptualization of their work. ACKNOWLEDGEMENTS

We thank Martijn Willemsen and the anonymous reviewers for their valuable feedback on earlier drafts of this paper. REFERENCES

1. Acquisti, A. and Grossklags, J. What Can Behavioral Economics Teach Us About Privacy? In A. Acquisti, S. De Capitani di Vimercati, S. Gritzalis and C. Lambrinoudakis, eds., Digital Privacy: Theory, Technologies, and Practices. Taylor & Francis, 2008, 363–377. 2. Acquisti, A. Privacy in Electronic Commerce and the Economics of Immediate Gratification. EC’04 ACM Conference on Electronic Commerce, (2004), 21–29. 3. Anthony, D., Henderson, T., and Kotz, D. Privacy in Location-Aware Computing Environments. IEEE Pervasive Computing 6, 4 (2007), 64–72. 4. Balebako, R., Leon, P.G., Mugan, J., Acquisti, A., Cranor, L.F., and Sadeh, N. Nudging users towards privacy on mobile devices. CHI 2011 Workshop on Persuasion, Influence, Nudge and Coercion Through Mobile Devices, (2011). 5. Benisch, M., Kelley, P.G., Sadeh, N., and Cranor, L.F. Capturing location-privacy preferences: quantifying accuracy and user-burden tradeoffs. Personal Ubiquitous Computing 15, 7 (2011), 679–694. 6. Bettman, J.R., Luce, M.F., and Payne, J.W. Constructive consumer choice processes. Journal of consumer research 25, 3 (1998), 187–217. 7. Bokhove, W., Hulsebosch, B., Van Schoonhoven, B., Sappelli, M., and Wouters, K. User Privacy in Applications for Well-being and Well-working. Proc. AMBIENT 2012, (2012), 53–59. 8. Boyles, J.L., Smith, A., and Madden, M. Privacy and Data Management on Mobile Devices. Pew Internet & American Life Project, 2012. 9. Brandimarte, L., Acquisti, A., and Loewenstein, G. Misplaced Confidences: Privacy and the Control Paradox. Social Psychological and Personality Science, (2012). 10. Campbell, J.E. and Carlson, M. Panopticon.com: Online Surveillance and the Commodification of Privacy. Journal of Broadcasting & Electronic Media 46, 4 (2002), 586–606. 11. Chernev, A. When More Is Less and Less Is More: The Role of Ideal Point Availability and Assortment in Consumer Choice. Journal of Consumer Research 30, 2

(2003), 170–183. 12. Consolvo, S., Smith, I., Matthews, T., LaMarca, A., Tabert, J., and Powledge, P. Location disclosure to social relations: why, when, & what people want to share. Proc. CHI 2005, ACM Press (2005), 81–90. 13. Culnan, M.J. and Armstrong, P.K. Information Privacy Concerns, Procedural Fairness, and Impersonal Trust: An Empirical Investigation. Organization Science 10, 1 (1999), 104–115. 14. Davies, S. Re-Engineering the Right to Privacy: How Privacy Has Been Transformed from a Right to a Commodity. In Technology and privacy!: the new landscape. MIT Press, 1997.

26. Luce, D. The choice axiom after twenty years. Journal of Mathematical Psychology 15, 3 (1977), 215–233. 27. Luce, R.D. Individual choice behavior!: a theoretical analysis. Dover Publications, Mineola, N.Y., 1959. 28. Page, X., Kobsa, A., and Knijnenburg, B.P. Don’t Disturb My Circles! Boundary Preservation Is at the Center of Location-Sharing Concerns. Proc. ICWSM 2012, (2012). 29. Patil, S., Kobsa, A., John, A., and Seligmann, D. Methodological reflections on a field study of a globally distributed software project. Information and Software Technology 53, 9 (2011), 969–980.

15. Garfinkel, S. Database Nation: The Death of Privacy in the 21st Century. O’Reilly & Associates, 2000.

30. Patil, S. and Kobsa, A. Uncovering privacy attitudes and practices in instant messaging. Proc. SIGGROUP 2005, ACM (2005), 109–112.

16. Goncalves, J., Gomes, D., and Aguiar, R.L. Low-latency privacy-enabled Context Distribution Architecture. ICC, IEEE (2012), 1917–1922.

31. Prasad, A. Exposing Privacy Concerns in mHealth Data Sharing. 2012. http://www.cs.dartmouth.edu/cms_file/ SYS_techReport/571/TR2012-711.pdf.

17. Huber, G.P. Multi-Attribute Utility Models: A Review of Field and Field-Like Studies. Management Science 20, 10 (1974), 1393–1402.

32. Sadeh, N., Hong, J., Cranor, L., et al. Understanding and capturing people’s privacy policies in a mobile social networking application. Personal and Ubiquitous Computing 13, 6 (2009), 401–412.

18. Huber, J. and Puto, C. Market Boundaries and Product Choice: Illustrating Attraction and Substitution Effects. Journal of Consumer Research 10, 1 (1983), 31–44. 19. Iachello, G., Smith, I., Consolvo, S., et al. Control, Deception, and Communication: Evaluating the Deployment of a Location-Enhanced Messaging Service. Proc. UbiComp 2005, Springer Heidelberg (2005), 213–231. 20. John, L.K., Acquisti, A., and Loewenstein, G. Strangers on a Plane: Context-Dependent Willingness to Divulge Sensitive Information. The Journal of Consumer Research 37, 5 (2011), 858–873. 21. Kittur, A., Chi, E.H., and Suh, B. Crowdsourcing user studies with Mechanical Turk. Proc. CHI 2008, ACM Press (2008), 453–456. 22. Knijnenburg, B.P. and Kobsa, A. Making Decisions about Privacy: Information Disclosure in ContextAware Recommender Systems. Accepted to the ACM Transactions on Intelligent Interactive Systems, Special Issue on Human Decision Making and Recommender Systems, (2013). 23. Lai, Y.-L. and Hui, K.-L. Internet Opt-In and Opt-Out: Investigating the Roles of Frames, Defaults and Privacy Concerns. 2006 ACM SIGMIS CPR Conference on Computer Personnel Research, (2006), 253–263. 24. Laufer, R.S. and Wolfe, M. Privacy as a Concept and a Social Issue: A Multidimensional Developmental Theory. Journal of Social Issues 33, 3 (1977), 22–42. 25. Lederer, S., Mankoff, J., and Dey, A.K. Who wants to know what when? privacy preference determinants in ubiquitous computing. Proc. CHI 2003, ACM Press (2003), 724–725.

33. Schwartz, B. The paradox of choice: why more is less. Harper Perennial, New York, 2003. 34. Simonson, I. Choice Based on Reasons: The Case of Attraction and Compromise Effects. Journal of Consumer Research 16, 2 (1989), 158–174. 35. Sousa, L.F. Privacy Policy Dynamics in Location Sharing Applications. 2009. http://docs.di.fc.ul.pt/handle/ 10455/3286. 36. Srinivasan, V. A Conjunctive-Compensatory Approach to the Self-Explication of Multiattributed Preferences. Decision Sciences 19, 2 (1988), 295–305. 37. Tang, K., Hong, J., and Siewiorek, D. The implications of offering more disclosure choices for social location sharing. Proc. CHI 2012, ACM Press (2012), 391–394. 38. Toch, E., Cranshaw, J., Drielsma, P.H., et al. Empirical models of privacy in location sharing. Proc. UbiComp 2010, ACM Press (2010), 129. 39. Tsai, J.Y., Kelley, P., Drielsma, P., Cranor, L.F., Hong, J., and Sadeh, N. Who’s viewed you? The Impact of Feedback in a Mobile Location-Sharing Application. Proc. CHI 2009, ACM Press (2009), 2003. 40. Tsai, J.Y., Kelley, P.G., Cranor, L.F., and Sadeh, N. Location-Sharing Technologies: Privacy Risks and Control. I/S: A Journal of Law and Policy for the Information Society 6, 2 (2010). 41. Tversky, A. Elimination by aspects: A theory of choice. Psychological Review 79, 4 (1972), 281–299. 42. Zickuhr, K. Three-quarters of smartphone owners use location-based services. Pew Research Center, 2012.