Escaping the Privacy Paradox: Evaluating the Learning Effects of Privacy Policies With Serious Games

Abstract

Privacy Policies inform users about how their personal data is managed while fulfilling the obligatory requirements. Past studies have shown that users often do not read privacy policies, cannot comprehend the long and complex policy documents, and resort to providing their consent without knowledge. To enable users to make an informed decision, we explored serious games as a new medium to improve their understanding of privacy policies. In a mobile escape room game, users engage with the data collection and processing by solving different puzzles. We validated the game concept in a user study by comparing it to a conventional textual policy. Our findings show that the game promoted greater information recall in users. However, a trade-off seems to exist between frustration, duration and understanding. We show strategies for turning a privacy policy into game elements for a mobile escape room game and incorporating privacy information into different puzzles. We recommend that the choice of a privacy policy format should vary in a case-by-case scenario and should accommodate different target audiences.