[Paper Review] Bolder is Better: Raising User Awareness through Salient and Concise Privacy Notices

Nico Ebert, Kurt A. Ackermann+1 more|arXiv (Cornell University)|Jan 20, 2021

Privacy, Security, and Data Protection43 references38 citations

TL;DR

This study investigates whether concise, salient privacy notices improve user awareness of data practices in apps. Using a between-subjects experiment with 2,274 participants, it finds that salient, concise notices—especially those highlighting risky data practices—significantly increase information recall, suggesting that prominent, simplified privacy disclosures are more effective than traditional, hidden policies.

ABSTRACT

This paper addresses the question whether the recently proposed approach of concise privacy notices in apps and on websites is effective in raising user awareness. To assess the effectiveness in a realistic setting, we included concise notices in a fictitious but realistic fitness tracking app and asked participants recruited from an online panel to provide their feedback on the usability of the app as a cover story. Importantly, after giving feedback, users were also asked to recall the data practices described in the notices. The experimental setup included the variation of different levels of saliency and riskiness of the privacy notices. Based on a total sample of 2,274 participants, our findings indicate that concise privacy notices are indeed a promising approach to raise user awareness for privacy information when displayed in a salient way, especially in case the notices describe risky data practices. Our results may be helpful for regulators, user advocates and transparency-oriented companies in creating or enforcing better privacy transparency towards average users that do not read traditional privacy policies.

Motivation & Objective

• To evaluate whether concise privacy notices can effectively raise user awareness of data practices in real-world app contexts.
• To investigate how varying levels of saliency (visibility and placement) and risk level (privacy-friendly vs. intrusive) affect user recall of privacy information.
• To assess the effectiveness of concise notices in comparison to traditional, click-to-reveal privacy policies, especially among users who do not read lengthy policies.
• To explore whether contextual relevance and salience can counteract user inattention to privacy information, particularly for unexpected or risky data practices.

Proposed method

• Conducted a between-subjects factorial experiment with 2,274 participants recruited from an online panel.
• Used a fictitious fitness-tracking app as a realistic cover story to simulate real app usage in a controlled environment.
• Varied two independent factors: saliency (click-only notice, standalone screen notice, embedded notice) and risk level (privacy-friendly vs. privacy-intrusive data practices).
• Measured user awareness through post-feedback recall of privacy information, with no explicit instruction to read the notices.
• Collected data on intention to use, trust perception, and risk perception to assess behavioral and attitudinal outcomes.
• Used statistical analysis (ANOVA and post-hoc tests) to compare recall performance across conditions, focusing on the interaction between saliency and risk level.

Experimental results

Research questions

• RQ1 Does the saliency of concise privacy notices significantly affect users' ability to recall data practices?
• RQ2 How does the risk level of data practices (privacy-friendly vs. intrusive) moderate the effect of notice saliency on user recall?
• RQ3 Are users more likely to recall privacy information when notices are displayed prominently (e.g., standalone screen) versus hidden behind a click?
• RQ4 Does the presence of salient, concise notices about risky data practices lead to higher awareness compared to less noticeable or less concise notices?

Key findings

• Saliency significantly improves recall: users recalled privacy information best when notices were displayed on a standalone screen, compared to click-only or embedded notices.
• For privacy-intrusive practices, salient notices led to significantly higher recall (p < 0.001), indicating that users pay more attention to unexpected or risky data practices when they are clearly visible.
• The combination of high saliency and high risk resulted in the strongest recall performance, suggesting that users are particularly attentive to warnings about risky data handling.
• There was no significant difference in recall between the click-only and embedded notice conditions, indicating that non-prominent placement fails to improve awareness.
• Participants exposed to salient, high-risk notices reported higher risk perception and lower intention to use the app, showing that visibility of risky practices influences user decisions.
• The study found no significant effect on trust or intention to use in the click-only condition, suggesting that hidden notices do not influence user perception even when present.