abstract

Privacy Languages: Are we there yet to enable user controls?

Authors:

Nigel ShadboltAuthors Info & Claims

WWW '16 Companion: Proceedings of the 25th International Conference Companion on World Wide Web

Pages 799 - 806

https://doi.org/10.1145/2872518.2890590

Published: 11 April 2016 Publication History

Abstract

Privacy protection is one of the most prominent concerns for web users. Despite numerous efforts, users remain powerless in controlling how their personal information should be used and by whom, and find limited options to actually opt-out of dominating service providers, who often process users information with limited transparency or respect for their privacy preferences. Privacy languages are designed to express the privacy-related preferences of users and the practices of organisations, in order to establish a privacy-preserved data handling protocol. However, in practice there has been limited adoption of these languages, by either users or data controllers. This survey paper attempts to understand the strengths and limitations of existing policy languages, focusing on their capacity of enabling users to express their privacy preferences. Our preliminary results show a lack of focus on normal web users, in both language design and their tooling design. This systematic survey lays the ground work for future privacy protection designs that aim to be centred around web users for empowering their control of data privacy.

References

[1]

Tracking protection working group charter. Technical report, Access on 16 January 2016.

[2]

R. Agrawal, J. Kiernan, R. Srikant, and Y. Xu. Hippocratic databases. In Proceedings of the 28th international conference on Very Large Data Bases, pages 143--154. VLDB Endowment, 2002.

Digital Library

[3]

R. Agrawal, J. Kiernan, R. Srikant, and Y. Xu. An xpath-based preference language for p3p. In Proceedings of the 12th international conference on World Wide Web, pages 629--639. ACM, 2003.

Digital Library

[4]

J. Angwin. Online tracking ramps up -- popularity of user-tailored advertising fuels data gathering on browsing habits. Wall Street Journal, 2012.

[5]

C. A. Ardagna, M. Cremonini, S. De Capitani di Vimercati, and P. Samarati. A privacy-aware access control system. Journal of Computer Security, 16(4):369--397, 2008.

Digital Library

[6]

P. Ashley, S. Hada, G. Karjoth, C. Powers, and M. Schunter. Enterprise privacy authorization language (epal 1.2). Submission to W3C, 2003. Accessed December 2015.

[7]

P. Ashley, S. Hada, G. Karjoth, and M. Schunter. E-p3p privacy policies and privacy authorization. In Proceedings of the 2002 ACM workshop on Privacy in the Electronic Society, pages 103--109. ACM, 2002.

Digital Library

[8]

M. Azraoui, K. Elkhiyaoui, M. Onen, K. Bernsmed, A. S. De Oliveira, and J. Sendor. A-ppl: An accountability policy language. In Data Privacy Management, Autonomous Spontaneous Security, and Security Assurance, pages 319--326. Springer, 2015.

[9]

A. Barth, J. C. Mitchell, and J. Rosenstein. Conflict and combination in privacy policy languages. In Proceedings of the 2004 ACM workshop on Privacy in the electronic society, pages 45--46. ACM, 2004.

Digital Library

[10]

P. Beatty, I. Reay, S. Dick, and J. Miller. P3p adoption on e-commerce web sites: a survey and analysis. Internet Computing, IEEE, 11(2):65--71, 2007.

Digital Library

[11]

M. Y. Becker, C. Fournet, and A. D. Gordon. Design and semantics of a decentralized authorization language. In 20th IEEE Computer Security Foundations Symposium (CSF), pages 3--15, 2007.

Digital Library

[12]

M. Y. Becker, A. Malkis, and L. Bussard. A framework for privacy preferences and data-handling policies. Technical report, Microsoft Research Cambridge Technical Report, MSR-TR-2009-128, 2009.

[13]

F. Belanger and R. E. Crossler. Privacy in the digital age: a review of information privacy research in information systems. MIS quarterly, 35(4):1017--1042, 2011.

[14]

K. Bohrer and B. Holland. Customer profile exchange (cpexchange) specification. 2000. Accessed December 2015.

[15]

M. Borghi, F. Ferretti, and S. Karapapa. Online data processing consent under eu law: a theoretical framework and empirical evidence from the uk. International Journal of Law and Information Technology, 21(2):109--153, 2013.

[16]

S. Byers, L. F. Cranor, D. Kormann, and P. McDaniel. Searching for privacy: Design and implementation of a p3p-enabled search engine. In Privacy Enhancing Technologies, pages 314--328. Springer, 2005.

Digital Library

[17]

F. Chanchary and S. Chiasson. User perceptions of sharing, advertising, and tracking. In Proceedings of the Eleventh Symposium On Usable Privacy and Security (SOUPS 2015), pages 53--67, Ottawa, July 2015. USENIX Association

[18]

L. Cranor, M. Langheinrich, and M. Marchiori. A p3p preference exchange language 1.0 (appel 1.0): W3c working draft 15 april 2002. World Wide Web Consortium (W3C), URL: http://www. w3. org/TR/P3P-preferences, 2002. Accessed December 2015.

[19]

L. Cranor, M. Langheinrich, M. Marchiori, M. Presler-Marshall, and J. Reagle. The platform for privacy preferences 1.0 (p3p1. 0) specification. W3C recommendation 16 April 2002, 2002. Accessed December 2015.

[20]

L. F. Cranor. Necessary but not sufficient: Standardized mechanisms for privacy notice and choice. J. on Telecomm. & High Tech. L., 10:273, 2012.

[21]

L. F. Cranor, M. Arjula, and P. Guduru. Use of a p3p user agent by early adopters. In Proceedings of the 2002 ACM workshop on Privacy in the Electronic Society, pages 1--10. ACM, 2002.

Digital Library

[22]

L. F. Cranor, P. Guduru, and M. Arjula. User interfaces for privacy agents. ACM Transactions on Computer-Human Interaction (TOCHI), 13(2):135--178, 2006.

Digital Library

[23]

N. Doty, H. West, J. Brookman, S. Harvey, and E. Newland. Tracking compliance and scope w3c last call working draft 14 july 2015. Technical report. Accessed in January 2016.

[24]

J. Gomez, T. Pinnick, and A. Soltani. Knowprivacy. Technical report, 2009.

[25]

L.-E. Holtz, H. Zwingelberg, and M. Hansen. Privacy policy icons. In Privacy and Identity Management for Life, pages 279--285. Springer, 2011.

[26]

J. Iyilade and J. Vassileva. P2u: A privacy policy specification language for secondary data sharing and usage. In IEEE Security and Privacy Workshops (SPW), pages 18--22. IEEE, 2014.

Digital Library

[27]

L. Kagal, C. Hanson, and D. Weitzner. Using dependency tracking to provide explanations for policy management. In 9th IEEE International Workshop on Policies for Distributed Systems and Networks. POLICY 2008, pages 54--61. IEEE, 2008.

Digital Library

[28]

S. Kasem-Madani and M. Meier. Security and privacy policy languages: A survey, categorization and gap identification. arXiv preprint arXiv:1512.00201, 2015.

[29]

J. Kolter. User-Centric Privacy -- A Usable and Provider-Independent Privacy Infrastructure (Chap 4). PhD thesis, University of Regensburg, 2009. https://www.ics.uci.edu/ kobsa/phds/kolter.pdf.

[30]

U. König. Primelife checkout. In Privacy and Identity Management for Life - PrimeLife International Summer School, Helsingborg, Sweden, August 2--6, 2010, pages 325--337. Springer, 2011.

[31]

P. Kumaraguru, L. Cranor, J. Lobo, and S. Calo. A survey of privacy policy languages. In Workshop on Usable IT Security Management (USM '07): Proceedings of the 3rd Symposium on Usable Privacy and Security. ACM, 2007.

[32]

K. Lalana. Rei: A policy language for the me-centric project. TechReport, HP Labs, 2002. Accessed December 2015.

[33]

P. G. Leon, L. F. Cranor, A. M. McDonald, and R. McGuire. Token attempt: the misrepresentation of website privacy policies through the misuse of p3p compact policy tokens. In Proceedings of the 9th annual ACM workshop on Privacy in the electronic society, pages 93--104. ACM, 2010.

Digital Library

[34]

P. G. Leon, B. Ur, Y. Wang, M. Sleeper, R. Balebako, R. Shay, L. Bauer, M. Christodorescu, and L. F. Cranor. What matters to users': factors that affect users' willingness to share information with online advertisers. In Proceedings of the Ninth Symposium on Usable Privacy and Security (SOUPS 2013), page 7. ACM, 2013.

Digital Library

[35]

A. Matheus and J. Herrmann. Geospatial extensible access control markup language (geoxacml). Open Geospatial Consortium Inc. OGC, 2008.

[36]

J. R. Mayer and J. C. Mitchell. Third-party web tracking: Policy and technology. In Security and Privacy (SP), 2012 IEEE Symposium on, pages 413--427. IEEE, 2012.

Digital Library

[37]

S. Preibusch. Managing diversity in privacy preferences: How to construct a privacy typology. In Workshop on Privacy Personas and Segmentation, co-located at the 10th Symposium On Usable Privacy and Security (SOUPS), 2014.

[38]

E. Rissanen. extensible access control markup language (xacml) version 2.0. Oasis, 2013. Accessed December 2015.

[39]

J. L. B. L. N. Sadeh and J. I. Hong. Modeling users' mobile app privacy preferences: Restoring usability in a sea of permission settings. In Symposium on Usable Privacy and Security (SOUPS), 2014. {40} S. Senecal and J. Nantel. The influence of online product recommendations on consumers' online choices. Journal of retailing, 80(2):159--169, 2004.

[40]

O. Seneviratne and L. Kagal. Httpa: Accountable http. In IAB/w3C Internet Privacy Workshop, 2010. {42} N. Shadbolt, M. Van Kleek, and R. Binns. The rise of social machines. Consumer Electronics Magazine, IEEE, 5(1), 2016.

[41]

S. Trabelsi, J. Sendor, and S. Reinicke. Ppl: Primelife privacy policy engine. In IEEE International Symposium on Policies for Distributed Systems and Networks (POLICY), pages 184--185. IEEE, 2011.

Digital Library

[42]

D. J. Weitzner, H. Abelson, T. Berners-Lee, J. Feigenbaum, J. Hendler, and G. J. Sussman. Information accountability. Communications of the ACM, 51(6):82--87, 2008.

Digital Library

[43]

J. Yang, K. Yessenov, and A. Solar-Lezama. A language for automatically enforcing privacy policies. In ACM SIGPLAN Notices, volume 47, pages 85--96. ACM, 2012.

Digital Library

Cited By

Esteves BRodríguez-Doncel V(2022)Analysis of ontologies and policy languages to represent information flows in GDPRSemantic Web10.3233/SW-223009(1-35)Online publication date: 7-Jun-2022
https://doi.org/10.3233/SW-223009
Bartsch JDehling TLauf FMeister SSunyaev A(2022)Let the Computer Say NO! The Neglected Potential of Policy Definition Languages for Data SovereigntySelbstbestimmung, Privatheit und Datenschutz10.1007/978-3-658-33306-5_22(449-468)Online publication date: 6-Apr-2022
https://doi.org/10.1007/978-3-658-33306-5_22
Hils MWoods DBöhme R(2021)Privacy Preference Signals: Past, Present and FutureProceedings on Privacy Enhancing Technologies10.2478/popets-2021-00692021:4(249-269)Online publication date: 23-Jul-2021
https://doi.org/10.2478/popets-2021-0069
Show More Cited By

Recommendations

Privacy Dashboards: The Impact of the Type of Personal Data and User Control on Trust and Perceived Risk
UMAP '20 Adjunct: Adjunct Publication of the 28th ACM Conference on User Modeling, Adaptation and Personalization

Website owners often collect personal data to, among other things, advertise more efficiently and to analyze and increase sales. They can inform users in various ways about what data they collect and how they process it. This study focuses on the use of ...
Privacy concerns in online recommender systems: influences of control and user data input
SOUPS '14: Proceedings of the Tenth USENIX Conference on Usable Privacy and Security

Recommender systems (e.g., Amazon.com) provide users with tailored products and services, which have the potential to induce user privacy concerns. Although system designers have been actively developing algorithms to introduce user control mechanisms, ...
User centricity: a taxonomy and open issues
DIM '06: Proceedings of the second ACM workshop on Digital identity management

User centricity is a significant concept in federated identity management (FIM), as it provides for stronger user control and privacy. However, several notions of user-centricity in the FIM community render its semantics unclear and hamper future ...

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences

WWW '16 Companion: Proceedings of the 25th International Conference Companion on World Wide Web

April 2016

1094 pages

ISBN:9781450341448

General Chairs:
Jacqueline Bourdeau
Tele-university (TELUQ), Montreal, QC, Canada
,
Jim A. Hendler
Rensselaer Polytechnic Institute, Troy, NY, USA
,
Roger Nkambou Nkambou
Université du Québec à Montréal, Montreal, QC, Canada
,
Program Chairs:
Ian Horrocks
University of Oxford, UK
,
Ben Y. Zhao
University of California at Santa Barbara, CA, USA

Copyright © 2016 Copyright is held by the International World Wide Web Conference Committee (IW3C2).

Sponsors

IW3C2: International World Wide Web Conference Committee

In-Cooperation

SIGWEB: ACM Special Interest Group on Hypertext, Hypermedia, and Web

Publisher

International World Wide Web Conferences Steering Committee

Republic and Canton of Geneva, Switzerland

Publication History

Published: 11 April 2016

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Abstract

Funding Sources

EPSRC

Conference

WWW '16

Sponsor:

IW3C2

WWW '16: 25th International World Wide Web Conference

April 11 - 15, 2016

Québec, Montréal, Canada

Acceptance Rates

WWW '16 Companion Paper Acceptance Rate 115 of 727 submissions, 16%;

Overall Acceptance Rate 1,899 of 8,196 submissions, 23%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

14
Total Citations
View Citations
365
Total Downloads

Downloads (Last 12 months)24
Downloads (Last 6 weeks)1

Reflects downloads up to 01 Mar 2025

Other Metrics

View Author Metrics

Citations

Cited By

Esteves BRodríguez-Doncel V(2022)Analysis of ontologies and policy languages to represent information flows in GDPRSemantic Web10.3233/SW-223009(1-35)Online publication date: 7-Jun-2022
https://doi.org/10.3233/SW-223009
Bartsch JDehling TLauf FMeister SSunyaev A(2022)Let the Computer Say NO! The Neglected Potential of Policy Definition Languages for Data SovereigntySelbstbestimmung, Privatheit und Datenschutz10.1007/978-3-658-33306-5_22(449-468)Online publication date: 6-Apr-2022
https://doi.org/10.1007/978-3-658-33306-5_22
Hils MWoods DBöhme R(2021)Privacy Preference Signals: Past, Present and FutureProceedings on Privacy Enhancing Technologies10.2478/popets-2021-00692021:4(249-269)Online publication date: 23-Jul-2021
https://doi.org/10.2478/popets-2021-0069
Heine MWessel D(2021)E-Government und Datensouveränität – Einblicke und LösungsansätzeE-Government and Data Sovereignty – Insights and SolutionsHMD Praxis der Wirtschaftsinformatik10.1365/s40702-021-00766-458:5(1081-1091)Online publication date: 19-Aug-2021
https://doi.org/10.1365/s40702-021-00766-4
Kapitsaki GDini Kounoudes AAchilleos A(2020)An overview of user privacy preferences modeling and adoption2020 46th Euromicro Conference on Software Engineering and Advanced Applications (SEAA)10.1109/SEAA51224.2020.00093(569-576)Online publication date: Aug-2020
https://doi.org/10.1109/SEAA51224.2020.00093
Kasem-Madani SMeier M(2020)Utility Requirement Description for Utility-Preserving and Privacy-Respecting Data PseudonymizationTrust, Privacy and Security in Digital Business10.1007/978-3-030-58986-8_12(171-185)Online publication date: 14-Sep-2020
https://doi.org/10.1007/978-3-030-58986-8_12
Majdoubi DBakkali H(2019)A survey of major data privacy laws, languages and approaches in smart cities environmentsProceedings of the 4th International Conference on Smart City Applications10.1145/3368756.3369013(1-8)Online publication date: 2-Oct-2019
https://dl.acm.org/doi/10.1145/3368756.3369013
Weinshel BWei MMondal MChoi EShan SDolin CMazurek MUr BCavallaro LKinder JWang XKatz J(2019)Oh, the Places You've Been! User Reactions to Longitudinal Transparency About Third-Party Web Tracking and InferencingProceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security10.1145/3319535.3363200(149-166)Online publication date: 6-Nov-2019
https://dl.acm.org/doi/10.1145/3319535.3363200
Leicht JHeisel M(2019)A Survey on Privacy Policy Languages: Expressiveness Concerning Data Protection Regulations2019 12th CMI Conference on Cybersecurity and Privacy (CMI)10.1109/CMI48017.2019.8962144(1-6)Online publication date: Nov-2019
https://doi.org/10.1109/CMI48017.2019.8962144
de Souza C(2019)A Contrastive Study of Pre- and Post-legislation Interaction Design for Communication and Action About Personal Data Protection in e-Commerce WebsitesHuman-Computer Interaction – INTERACT 201910.1007/978-3-030-29387-1_1(3-23)Online publication date: 2-Sep-2019
https://dl.acm.org/doi/10.1007/978-3-030-29387-1_1
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten