Paper presented at CHI 2013 in Paris

1. Preference-based Location Sharing
Are More Privacy Options Really Better?
Bart P. Knijnenburg
Department of Informatics, UC Irvine
Alfred Kobsa
Department of Informatics, UC Irvine
Hongxia Jin
Samsung R&D Research Center

2. INFORMATION AND COMPUTER SCIENCES
Outline
Should sharing profiles be simple or complex?
What happens when you add/remove sharing options?
Users choose based of their perception of the options
A method for designing better sharing options

3. INFORMATION AND COMPUTER SCIENCES
Profile-based location sharing
Figure 5 – Locaccino privacy settings page
We address in detail the topic of privacy policies, presenting the necessary formalism in
section 3.1.2.
Who Can Locate Me
This page is intended to provide privacy awareness to the user, in the sense that the

4. INFORMATION AND COMPUTER SCIENCES
Why so
complex?

5. INFORMATION AND COMPUTER SCIENCES
Locaccino
researchers:
-Users will
otherwise err on
the safe side
Decision scientists:
-Depends on
perception of
the options

6. (part 2/3)
Preferences for sharing your
location with friends
Use the demo phone on the right to set your sharing preferences for
different people at different times.
Note that there are several pages of preferences, and on some pages
you may have to scroll down.
On the different pages you will find settings for sharing with:
Your friends
Your colleagues
Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Steven,
Frank
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Continue

7. (part 2/3)
aring your
ds
t your sharing preferences for
references, and on some pages
tings for sharing with:
Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Steven,
Frank
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Continue
(part 2/3)
aring your
ds
t your sharing preferences for
references, and on some pages
tings for sharing with:
Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Steven,
Frank
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Continue
(part 2/3)
aring your
ds
t your sharing preferences for
references, and on some pages
tings for sharing with:
Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Steven,
Frank
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Continue

8. Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:
ages Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:

9. Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:
ages Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:
ages Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:
?
?
1.
removing
the City
option

10. Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:
ages Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:
? ?2.
introducing
the Exact
option

11. INFORMATION AND COMPUTER SCIENCES
Without Exact (−E) With Exact (+E)
Without
City (−C)
With
City (+C)
Main manipulation
g preferences for
and on some pages
ring with:
Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
r
es Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
es Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Steven
Frank
During work hrs: Outside work hrs:
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Steven
Frank
During work hrs:
nothing
Outside work hrs:
nothing
and on some pages
ring with:
Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas,
Frank
During work hrs:
ring with:
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas,
Frank
During work hrs:
nothing
g preferences for
and on some pages
ring with:
Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
g preferences for
and on some pages
ring with:
Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
g preferences for
and on some pages
ring with:
Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
g preferences for
and on some pages
ring with:
Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location

12. INFORMATION AND COMPUTER SCIENCES
Plotting the privacy calculus
We believe that people
choose based on their
perception of the options
How do people perceive
these options?
Privacy calculus:
Trade-off between
privacy and benefit
E
B
N
privacy -->
benefits-->
C

13. INFORMATION AND COMPUTER SCIENCES
Plotting the privacy calculus
For each recipient, rate
privacy and benefit (-3 to 3):
“I do not want [recipient] to
know where I am” (Privacy)
“My location could be useful
for [recipient]” (Benefit)
- For apps/coupons: “I could
benefit from [recipient]”
Plot the average Privacy and
Benefit of each option on a
plane
E
B
N
privacy -->
benefits-->
C

14. INFORMATION AND COMPUTER SCIENCES
Plotting the privacy calculus
For each recipient, rate
privacy and benefit (-3 to 3):
“I do not want [recipient] to
know where I am” (Privacy)
“My location could be useful
for [recipient]” (Benefit)
- For apps/coupons: “I could
benefit from [recipient]”
Plot the average Privacy and
Benefit of each option on a
plane
E
B
N
privacy -->
benefits-->
C

15. INFORMATION AND COMPUTER SCIENCES
Plotting the privacy calculus
For each recipient, rate
privacy and benefit (-3 to 3):
“I do not want [recipient] to
know where I am” (Privacy)
“My location could be useful
for [recipient]” (Benefit)
- For apps/coupons: “I could
benefit from [recipient]”
Plot the average Privacy and
Benefit of each option on a
plane
E
B
N
privacy -->
benefits-->
C

16. INFORMATION AND COMPUTER SCIENCES
Plotting the privacy calculus
For each recipient, rate
privacy and benefit (-3 to 3):
“I do not want [recipient] to
know where I am” (Privacy)
“My location could be useful
for [recipient]” (Benefit)
- For apps/coupons: “I could
benefit from [recipient]”
Plot the average Privacy and
Benefit of each option on a
plane
E
B
N
privacy -->
benefits-->
C
High privacy, low benefit

17. INFORMATION AND COMPUTER SCIENCES
Plotting the privacy calculus
For each recipient, rate
privacy and benefit (-3 to 3):
“I do not want [recipient] to
know where I am” (Privacy)
“My location could be useful
for [recipient]” (Benefit)
- For apps/coupons: “I could
benefit from [recipient]”
Plot the average Privacy and
Benefit of each option on a
plane
E
B
N
privacy -->
benefits-->
C
Low privacy, high benefit

18. Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:
ages Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:
ages Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:
?
?
1.
removing
the City
option

19. INFORMATION AND COMPUTER SCIENCES
Decision theory hypotheses:
Three situations:
1. City is subjectively distinct
from Nothing and Block:
-Luce’s Choice Axiom
holds
-The ratio N : B+E will stay
the same
Users will prefer both sides
proportionally when City is
removed
E
B
N
privacy -->
benefits-->
C
privacy -->

20. INFORMATION AND COMPUTER SCIENCES
Decision theory hypotheses:
2. City is subjectively closer
to Nothing than to Block:
-Tversky’s Substitution
Effect holds
-C is a substitute for N
-When we remove C,
N will increase more
than B+E
Users will err on the safe side
E
B
N
privacy -->
benefits-->
C

21. INFORMATION AND COMPUTER SCIENCES
Decision theory hypotheses:
3. City is subjectively closer
to Block than to Nothing:
-Tversky’s Substitution
Effect holds
-C is a substitute for B
-When we remove C,
B will increase more
than N
Users will prefer the more
revealing side
E
B
N
privacy -->
benefits-->
C

22. Results
Without Exact (−E) With exact (+E)
Withoutcity(−C)Withcity(+C)
48.8
51.2Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
Privacy -->
26.7
29.9
18.6
24.8
Benefit-->
Privacy -->
Exact
Block
City
NothingWithout Exact (−E) With exact (+E)
Withoutcity(−C)y(+C)
48.8
51.2
Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
26.7
29.9
18.6
24.8
Benefit-->
Exact
Block
City
Nothing

23. Without Exact (−E) With exact (+E)
Withoutcity(−C)Withcity(+C)
48.8
51.2Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
Privacy -->
26.7
29.9
18.6
24.8
Benefit-->
Privacy -->
Exact
Block
City
Nothing
Results
Size:
percentage
of people
choosing
this option

24. Results
W
Without Exact (−E) With exact (+E)
Withoutcity(−C)Withcity(+C)
Privacy --> Privacy -->
48.8
51.2Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
Privacy -->
26.7
29.9
18.6
24.8
Benefit-->
Privacy -->
Position:
perception
in terms of
privacy and
benefit

25. Results
Without Exact (−E) With exact (+E)
Withoutcity(−C)Withcity(+C)
48.8
51.2Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
Privacy -->
26.7
29.9
18.6
24.8
Benefit-->
Privacy -->
Exact
Block
City
Nothing
left vs.
right:
comparison
of without
vs. with
Exact

26. Results
Without Exact (−E) With exact (+E)
Withoutcity(−C)Withcity(+C)
48.8
51.2Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
Privacy -->
26.7
29.9
18.6
24.8
Benefit-->
Privacy -->
Exact
Block
City
Nothing
bottom
vs. top:
comparison
of with vs.
without
City

27. Without Exact (−E) With exact (+E)
Withoutcity(−C)Withcity(+C)
48.8
51.2Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
Privacy -->
26.7
29.9
18.6
24.8
Benefit-->
Privacy -->
Results
City is closer to Block
(0.45pts) than to Nothing
(2.25pts)
Substitution effect!
Only the share of Block
differs significantly
between –C and +C
(24.2pp)
Exact
Block
City
Nothing

28. Without Exact (−E) With exact (+E)
Withoutcity(−C)Withcity(+C)
48.8
51.2Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
Privacy -->
26.7
29.9
18.6
24.8
Benefit-->
Privacy -->
Results
Distance from City to
Nothing and Block is more
equal
Luce’s choice axiom!
Both Nothing (14.3pp)
and Block (9.1pp) differ
between –C and +C
Effect on Nothing is
larger, because City is
somewhat closer to
Nothing
Without Exact (−E) With exact (+E)
Withoutcity(−C)y(+C)
48.8
51.2
Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
26.7
29.9
18.6
24.8
Benefit-->
Exact
Block
City
Nothing

29. Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:
ages Best friends
John, Dave, Ethan
During work hrs:
nothing
city
city block
exact location
Outside work hrs:
nothing
city
city block
exact location
Other friends
Ben, Robert, Thomas, Mike, Paul, Stev
Frank
During work hrs: Outside work hrs:
? ?2.
introducing
the Exact
option

30. INFORMATION AND COMPUTER SCIENCES
Decision theory hypotheses:
Two situations:
1. Exact is subjectively close
to Block:
-Tversky’s Substitution
Effect holds
-E is a substitute for B
Only B will decrease when
E is introduced
E
B
N
privacy -->
benefits-->
C

31. INFORMATION AND COMPUTER SCIENCES
Decision theory hypotheses:
2. Exact is more distant:
-Simonson’s Compromise
Effect holds
-B is no longer an extreme,
but a compromise
-B attracts some from C
and N
-Still some Substitution of
B to E
In sum: Sharing increases
across the board
B
N
privacy -->
benefits-->
C
E

32. INFORMATION AND COMPUTER SCIENCES
W
Without Exact (−E) With exact (+E)
Withoutcity(−C)Withcity(+C)
Privacy --> Privacy -->
48.8
51.2Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
Privacy -->
26.7
29.9
18.6
24.8
Benefit-->
Privacy -->
Results
Exact is subjectively close
to Block
Substitution effect!
the availability of Exact
mainly affects the share of
Block (21.5pp)
Without Exact (−E) With exact (+E)
Withoutcity(−C)Withcity(+C)
48.8
51.2
Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
Privacy -->
26.7
29.9
18.6
24.8
Benefit-->
Privacy -->
Exact
Block
City
Nothing

33. INFORMATION AND COMPUTER SCIENCES
W
Without Exact (−E) With exact (+E)
Withoutcity(−C)Withcity(+C)
Privacy --> Privacy -->
48.8
51.2Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
40.432.6
26.9
Benefit-->
Privacy -->
26.7
29.9
18.6
24.8
Benefit-->
Privacy -->
Results
Exact is further away
from Block
Compromise effect!
Block is only reduced by
8.3pp, as it regains some
share from Nothing
(reduced by 13.7pp)
Without Exact (−E) With exact (+E)
Withoutcity(−C)
48.8
51.2
Benefit-->
Privacy -->
41.0
29.7
29.3
Benefit-->
Privacy -->
Exact
Block
City
Nothing

34. INFORMATION AND COMPUTER SCIENCES
Two conclusions
1. With fewer options, users do not just “err on the safe side”
Instead, they deliberately choose the subjectively closest
remaining option
2. An extreme option does not just increase sharing among
those who already share a lot
Instead, it increases sharing across the board

35. INFORMATION AND COMPUTER SCIENCES
Applying these results
Problem: when designing the ‘optimal’ set of options, users’
choice depends on the available options
Problem for user tests!
Combinatorial explosion of the experimental conditions
More efficient approach:
-Ask a sample of users about the perceived Privacy and
Benefit of the options
-Map them on a plane

36. INFORMATION AND COMPUTER SCIENCES
Applying these results
Benefit-->
Privacy -->
6. Introduce to increase overall sharing
2. Remove one redundant option
1. Remove this dominated option
3. Introduce an option to
close this gap
4. If desired, remove the left option
to increase the right option
5. If desired, replace this option
with one that is perceptually close

37. INFORMATION AND COMPUTER SCIENCES
Take-home message
Do you want to design an optimal list of
(location-sharing) options?
Measure the subjective perceptions of
the options, and apply decision theories
to decide which are best!
Paper draft: http://bit.ly/chi2013privacy
More papers: www.usabart.nl
Follow me on Twitter: @usabart

38. INFORMATION AND COMPUTER SCIENCES
Guide for questions:
1. With fewer options, users do not just “err on the safe side”
Instead, they deliberately choose the subjectively closest
remaining option
2. An extreme option does not just increase sharing among
those who already share a lot
Instead, it increases sharing across the board
3. If you want to design the optimal set of options, measure
the perception of the options
And apply decision theories to argue which are best