An Empirical Study of Consumer Perceptions and Comprehension of Web Site Privacy Policies

Abstract

Abstract-The U.S. legislation at both the federal and state levels mandates certain organizations to inform customers about information uses and disclosures. Such disclosures are typically accomplished through privacy policies, both online and offline. Unfortunately, the policies are not easy to comprehend, and, as a result, online consumers frequently do not read the policies provided at healthcare Web sites. Because these policies are often required by law, they should be clear so that consumers are likely to read them and to ensure that consumers can comprehend these policies. This, in turn, may increase consumer trust and encourage consumers to feel more comfortable when interacting with online organizations. In this paper, we present results of an empirical study, involving 993 Internet users, which compared various ways to present privacy policy information to online consumers. Our findings suggest that users perceive typical, paragraph-form policies to be more secure than other forms of policy representation, yet user comprehension of such paragraph-form policies is poor as compared to other policy representations. The results of this study can help managers create more trustworthy policies, aid compliance officers in detecting deceptive organizations, and serve legislative bodies by providing tangible evidence as to the ineffectiveness of current privacy policies.Index Terms-E-commerce, end user computing management, healthcare, privacy management, privacy policy, trust, user computer interaction.

Trust and information privacy concerns in electronic government

“…Often the necessary information can be found in online privacy statements (Vail, Earp, & Anton, 2008). Chapters 8 and 9 will discuss the results of studies on privacy statements on government websites.…”

“…The study also shows that users consult privacy policies to acquire information on how their personal data will be used by organizations that collect them (Milne & Culnan, 2004), considering that privacy policies are often the only means for users to know how organizations will use and process their data (Vail, Earp, & Anton, 2008). Privacy statements could also serve as a basis for decision-making (Jansen & Potts, 2004).…”

“…In most cases, online privacy statements are the only sources of information for users to be adequately informed of organizational usage and processing of people's personal data (Vail, Earp & Anton, 2008). Internet users who are very concerned about their information privacy would be expected to consult online privacy statements before opting to disclose personal information (Jensen & Potts, 2004;Pan & Zinkhan, 2006).…”

“…Whenever users are uncertain about how online organizations will deal with their personal data, privacy statements are often the only sources of information for them to be adequately informed of organizational practices involving their data (Vail et al, 2008), just as privacy statements can also serve as bases for users to decide whether or not they will disclose requested personal data (Jensen & Potts, 2004). Reading online privacy statements is regarded as one of the many online privacy protection behaviors internet users resort to (Milne, Rohm, & Bahl, 2004) and is seen as part of an overall strategy of managing perceived risks involved in online disclosures of personal data (Milne & Culnan, 2004).…”

“…Often they are the only means for internet users to know how organizations will process and use their personal data (Vail et al, 2008). Privacy statements should instead be regarded as crucial sources of information for users who are concerned about their online information privacy, which could be significantly impacted by the perceived risks of divulging personal data through the internet.…”