“Most Companies Share Whatever They Can to Make Money!”: Comparing User’s Perceptions with the Data Practices of IoT Devices

Abstract

With the rapid deployment of Internet of Things (IoT) technologies, it has been essential to address the security and privacy issues through maintaining transparency in data practices, and designing new tools for data protection. To address these challenges, the prior research focused on identifying user's privacy preferences in di↵erent contexts of IoT usage, user's mental model of security threats, and their privacy practices for a specific type of IoT device (e.g., smart speaker). However, there is a dearth in existing literature to understand the mismatch between user's perceptions and the actual data practices of IoT devices. Such mismatches could lead users unknowingly sharing their private information, exposing themselves to unanticipated privacy risks. To address these issues, we conducted a lab study with 42 participants, where we compared the data practices stated in the privacy policy of 28 IoT devices with the participants' perceptions of data collection, sharing, and protection. Our findings provide insights into the mismatched privacy perceptions of users, which lead to our recommendations on designing simplified privacy notice by highlighting the unexpected data practices.

Privacy in smart speakers: A systematic literature review

“…43 When specific privacy-impacting features are examined, users are unaware of them, as in the case of undesired recordings. 35 A detailed examination of the perception of privacy/security issues in four function categories (built-in skills, third-party skills, management of smart home devices, and shopping) is carried out in Abdi et al 30 The same conclusion is reached in Al-Ameen et al 37 The perception of data collection, sharing, and protection also appears at odds with the data practices stated in the privacy policy of manufacturers. 37 Also, the uncritical acceptance of smart speakers appears to be favored by the diffusion of unboxing videos on YouTube.…”

“…35 A detailed examination of the perception of privacy/security issues in four function categories (built-in skills, third-party skills, management of smart home devices, and shopping) is carried out in Abdi et al 30 The same conclusion is reached in Al-Ameen et al 37 The perception of data collection, sharing, and protection also appears at odds with the data practices stated in the privacy policy of manufacturers. 37 Also, the uncritical acceptance of smart speakers appears to be favored by the diffusion of unboxing videos on YouTube. 39 The benefits and costs of three different policy management approaches are examined in Kang and Oh, 46 where privacy calculus is adopted.…”