"It's a scavenger hunt": Usability of Websites' Opt-Out and Data Deletion Choices

Abstract

We conducted an in-lab user study with 24 participants to explore the usefulness and usability of privacy choices offered by websites. Participants were asked to find and use choices related to email marketing, targeted advertising, or data deletion on a set of nine websites that differed in terms of where and how these choices were presented. They struggled with several aspects of the interaction, such as selecting the correct page from a site's navigation menu and understanding what information to include in written opt-out requests. Participants found mechanisms located in account settings pages easier to use than options contained in privacy policies, but many still consulted help pages or sent email to request assistance. Our findings indicate that, despite their prevalence, privacy choices like those examined in this study are difficult for consumers to exercise in practice. We provide design and policy recommendations for making these website opt-out and deletion choices more useful and usable for consumers.

From Design Requirements to Effective Privacy Notifications: Empowering Users of Online Services to Make Informed Decisions

“…Several participants of our study questioned the efficacy of exercising their data subject rights because they suspected that their choices would not be honored. This lack of trust in the underlying data service is in line with what Habib et al (2020) report about a user study, in which many participants doubted that their choice to have their data deleted and to opt-out from receiving marketing e-mails and targeted ads will be respected by the service in question. A study conducted by Herrmann and Lindemann (2016) reports that respective concerns may not be unjustified.…”

“…However, the context of the studies is related to data deletion (Habib et al, 2020;Ramokapane et al, 2017), opting out from unsolicited advertisements such as marketing e-mails (Habib et al, 2020), or to managing consent for cookies received in response to visiting websites (Utz et al, 2019). The recommendations provided comprise coarse-grained guidelines, such as to improve transparency by means of accessible and intelligible information to enable decision-making (Habib et al, 2020;Ramokapane et al, 2017). To facilitate informed decisionmaking, Cranor et al (2020) suggest that the accessibility and usability of individual options to act ought to be complemented by clarifying expected outcomes and consequences.…”

How private is your period?: A systematic analysis of menstrual app privacy policies

“…Past research in the effects of new legislation such as GDPR, shows privacy policies now provide more information to the user. Yet, that does not result in them being more accessible, giving the user more control mechanisms or describing all the behaviours of the service provider accurately [16,25]. Our study demonstrates this is also true for the menstruapp space, even in those cases were companies have dedicated privacy teams.…”

From WHOIS to WHOWAS: A Large-Scale Measurement Study of Domain Registration Privacy under the GDPR

“…When filled with deceptive and misleading language, the consents can be misinterpreted by users [78], [79]. While opt-out options are provided, the practical implementation of web cookies makes it difficult for users to avoid being tracked [90], [50], [49], [27], and some even conflict with the regulations (e.g., mark acceptance even when an explicit opt-out is received from the user) [72]. Overall, these findings call for clearer guidelines for consent notices.…”