[论文解读] Privacy Cards for Surfacing Mental Models and Exploring Privacy Concerns: A Case Study of Voice-First Ambient Interfaces with Older Adults

Andrea Cuadra, Samar Sabie+2 more|arXiv (Cornell University)|Feb 27, 2026

Innovative Human-Technology Interaction被引用 0

一句话总结

该研究基于情境性完整性（Contextual Integrity）的隐私卡片，揭示老年人在语音为主的环境感知界面中的心智模型与隐私关注，通过一项五人现场研究进行测试。

ABSTRACT

We investigate the ethical and privacy implications of voice-first ambient interfaces (VFAIs) for aging in place through an in-depth engagement with five older adults. Our participants were in the process of becoming experienced VFAI users, and had used a VFAI-based design probe for health data reporting. We create and iteratively refine an interview protocol using Privacy Cards. We customize Privacy Cards by drawing on participants' previous interviews and device usage logs. Using Privacy Cards, we conduct interviews to surface their mental models, and explore their privacy concerns. We find insufficient mental models for proper consent. For example, participants did not know who could access their data, and experienced difficulty distinguishing built-in functionality from third-party apps. Participants initially expressed little worry about VFAI-related ethical concerns, but interviews with Privacy Cards revealed nuanced issues, resulting in various implications for future research and design.

研究动机与目标

• Develop and iteratively refine Privacy Cards to surface older adults’ mental models of VFAIs.
• Ground Privacy Cards in Contextual Integrity to analyze information flows (Sender, Recipient, Subject, Attribute, Transmission Principle).
• Customize card content using participants’ prior interviews and device usage logs.
• Assess ethical and privacy concerns that emerge when older adults engage with VFAIs via Privacy Cards.
• Derive design and research implications to inform future studies and VFAI design for aging in place.

提出的方法

• Create Privacy Cards aligned with the five Contextual Integrity parameters (Sender, Recipient, Subject, Attribute, Transmission Principle).
• Simplify CI terminology for older adults (e.g., Who Sends, Who Receives, Data, Condition).
• Iteratively adapt card values using participants’ usage logs and prior interviews.
• Use a card-based interview protocol to surface mental models and privacy concerns during VFAI interactions.
• Digitize the cards for remote administration (Zoom) and pilot in a field study.

Figure 1 . Note, this image is an embedded PDF, so zooming in may help see the graphics at a more appropriate size. This diagram depicts three phases of the Privacy Cards ’ design process: 1) Planning —Hypothetical scenario as a prompt for getting feedback from CI experts (top), and CI parameters an

实验结果

研究问题

• RQ1 RQ1: How can the Privacy Cards interview protocol help researchers elicit older adults’ mental models and concerns about privacy in VFAIs?
• RQ2 RQ2: What ethical and privacy-related issues emerge when older adults engage with VFAIs using the Privacy Cards protocol?
• RQ3 RQ3: How might insights from using Privacy Cards inform the ethical design and study of VFAIs for older adults?

主要发现

• Older adults exhibited insufficient mental models for proper consent, including unclear data access and difficulty distinguishing built-in features from third-party apps.
• Interviews using Privacy Cards revealed nuanced ethical concerns that were not evident initially, prompting new design and research considerations.
• Privacy Cards surfaced privacy norms and information-flow issues grounded in CI, highlighting implications for research methods and the design of VFAIs for aging in place.
• The approach showed potential to inform large-scale survey design and to support ethical, inclusive exploration of VFAI privacy with older adults.

Figure 2 . Privacy Cards in action during step four of P3’s session. Participants used the cards to evaluate the appropriateness of different information flows. The VFAI in the cards was labeled by the name the participant used to refer to it (i.e. Echo or Alexa).