Online privacy and informed consent: The dilemma of information asymmetry

Abstract

Every day billions of users allow cloud-based internet services to collect, store, and manage their personal information. The use of this information is constrained only by long, wordy privacy agreements that users likely did not read before clicking "Agree." Even if they were to read them, would users understand these policies? We present the results of a two-part privacy survey that assessed users' knowledge and opinions of online privacy issues. We asked users not only what they think, but what they know. Results expose several key knowledge gaps, demonstrating a problem of information asymmetry between users and internet services providers, and strong dissatisfaction with the current system. These findings demonstrate that there is insufficient comprehension and voluntariness in the consent process for users to give informed consent to the collection and management of their personal information, which may in part explain the "privacy paradox."

An Online Consent Maturity Model

“…The practical option, for qualitative researchers and online, is to make information available to people, so that the material can be read and absorbed at a pace that suits the individual. In practice, it is often the case that signed consent forms have not been read and, even if they have, recollecting what has been signed is problematic [3,50].…”

“…Proposing that consent to the collection and retention of personal data be meaningful and fair has been posited as a way forward [3,60]. Building on the Fair Transaction model of consent [60], [54], argue that a strengthening of informed consent from a legal perspective could result in undermining the effectiveness of the consent mechanism itself, and thereby have a detrimental effect on trust in data processing and privacy protection.…”

“…This is an illustration of the imbalance of power that is a common characteristic of the researcher/participant relationship [14]. In this instance, this is manifest in how knowledge and information about the terms that have been agreed can be used to disadvantage participants [3] who may be inclined to withdraw from a project, yet may be unaware or uncertain that they are free to do so. This is illustrated online by the lengthy and legalistic nature of Acceptable Use Policies and agreements to consent.…”

“…are motivated to press the 'click through' button, often because of their desire to access a service. They do not, however, want to have to negotiate their way through the detail of Acceptable Use Policies, or Privacy Policies, and even if they can do so, they are unlikely to understand the content [3,29]. The impenetrable quality of consent agreements is itself open to be exploited by data gatherers.…”

The Perfect Storm: The Privacy Paradox and the Internet-of-Things

“…In the Jensen et al study, they found that concern was reduced by the mere presence of privacy policies, even if they were not read [36]. Policies are frequently written in such an obfuscated fashion that even users who care about their privacy might have little recognition of the data they are disclosing [51]. Acceptance is gradually becoming more implicit, moving from click-wrap licensing through checking a box, to browse-wrap licensing by reading a webpage [52].…”