Privacy Rarely Considered: Exploring Considerations in the Adoption of Third-Party Services by Websites

Abstract

Modern websites frequently use and embed third-party services to facilitate web development, connect to social media, or for monetization. This often introduces privacy issues as the inclusion of third-party services on a website can allow the third party to collect personal data about the website's visitors. While the prevalence and mechanisms of third-party web tracking have been widely studied, little is known about the decision processes that lead to websites using third-party functionality and whether efforts are being made to protect their visitors' privacy.We report results from an online survey with 395 participants involved in the creation and maintenance of websites. For ten common website functionalities we investigated if privacy has played a role in decisions about how the functionality is integrated, if specific efforts for privacy protection have been made during integration, and to what degree people are aware of data collection through third parties. We find that ease of integration drives third-party adoption but visitor privacy is considered if there are legal requirements or respective guidelines. Awareness of data collection and privacy risks is higher if the collection is directly associated with the purpose for which the third-party service is used.

Stuck in the Permissions With You: Developer & End-User Perspectives on App Permissions & Their Privacy Ramifications

“…First, unlike an interviewbased study, a survey would have prevented us from generating in-depth insights into developers' understanding and practices. Second, due to privacy and ethical considerations, we could not recruit participants by harvesting their email addresses from software development platforms and forums (e.g., GitHub and Google Play) or sending unsolicited emails to developers to take part in our study (for sampling issues, see [84,85,94]). For future work, researchers with access to a large pool of developers could run a survey with developers to collect more data and compare their data with our publicly available survey data.…”

How Website Owners Face Privacy Issues: Thematic Analysis of Responses from a Covert Notification Study Reveals Diverse Circumstances and Challenges

“…Many WOs rely on third-party services to implement user analytics, advertising, and consent dialogues. These services entail privacy risks for website visitors [44]. For example, consent management providers have been shown to rely on dark patterns to increase users' willingness to agree to user analytics [38,42,45].…”

“…For example, consent management providers have been shown to rely on dark patterns to increase users' willingness to agree to user analytics [38,42,45]. A popular and frequently deployed solution for user analytics is Google Analytics (GA), a service that has been criticized for tracking browsing behavior across the Web [44]. When GA is misconfigured, WOs can additionally harm the privacy of their visitors [44].…”

“…Utz et al [44] found that WOs often rely on easy-to-use default solutions, whereas website visitor privacy only plays a minor role when deciding to adopt a third-party service. Other studies focused on notifying WOs about privacy or security issues on their website [7,8,15,22,25,26,36,37,46,49].…”

“…Prior work, however, falls short in explaining the low awareness of privacy issues among WOs, and what kind of support WOs need to implement mandated privacy protection solutions, such as AIP. A first step might be to understand how the diverse group of WOs is composed in the first place, as WOs can operate websites in very different contexts, e. g., professional or private [44]. Hence, our goal is to (1) explore the circumstances of WOs, (2) identify causes for existing compliance issues, and (3) investigate how WOs try to solve existing issues and what challenges they face in doing so.…”