Addressing 'blind' consent : a study on users perception on privacy policies and a tool to enhance their understanding of them

Abstract

This research was conducted in the context of the University of Cyprus, Computer Science Master’s Dissertation. The research’s purpose was to define and address the gap between Privacy Policies comprehension by end-users and their ‘Blind’ Consent. In order to achieve this, research was conducted in terms of Privacy in Software Engineering and Usable Privacy. This dissertation initially provides a Systemization of Knowledge through comparative tables reviewing the literature and finding common ground between research papers. After that, the need to create a software tool arose in order to assess user’s understanding in various types of online platforms through an easy-to-use visual form. This was done through the OhKéy platform, where existing web platforms’ Privacy Policies were gathered, the GDPR part was extracted, anonymized and grouped in small ‘clickable boxes’ based on their GDPR context. Users could select each one to assess their text in terms of comprehensibility based on a set of pre-defined terms using a one-to five Likert scale rating. 1098 annotations were gathered in total. This thesis , towards achieving the initial objectives, analyzed in depth the negative annotations. The result showed crucial need for Enhancing privacy policies with elements that will address the issues recognized. Therefore the AlRíght Policy Generation tool links Policy Makers and end-users by introducing a panel for Policy Makers and Web Developers to insert the Privacy Policy text and along with other functionalities like summaries, important question answering and media, to create an Enhanced Privacy Policy form. The outcome could be downloaded by the Policy Makers and Web developers in order to be used in their actual platforms. The tool’s purpose was to address ‘Ambiguity’, ‘Vagueness’, ‘Language Difficulty’, ‘Verbosity’ ‘Suspiciousness’ and ‘Complexity’ by providing users with many options through the policy reading procedure. Very positive results of the AlRíght tool were gathered in two different surveys regarding User Experience (with Policy makers and Web developers) and End-users evaluation.