Using Pictograms to Make Privacy Agreements More Accessible

Privacy agreements fulfill the important role of helping users understand how their data will be used by data collecting entities. The role of privacy agreements is to not only provide users with the chance to decide whether they want to disclose their data to an entity but also foster trust and reduce users' concerns about data sharing.

Many users are concerned about personal data collection, and privacy agreements may alleviate these concerns. However, due to the complexity of privacy agreements, there are barriers to understanding data use, which result in users agreeing to terms that they do not fully comprehend. The investigators explore the use of pictograms as a potential way to improve the transparency of privacy agreements and users' understanding of privacy agreements.

An evaluation was conducted to test whether the addition of the pictograms made reading privacy agreements more efficient and less frustrating for users. For this purpose, a questionnaire was developed along with 2 versions of a privacy agreement. The control group (31 participants) received the traditional version of the privacy agreement while the experimental group received the version of the privacy agreement that included the pictograms created by us (29 participants). The privacy agreement was an imaginary privacy agreement about the Fit-bit and the talked about the collection of health data through the wearable. Participants were recruited by using Amazon Mechanical Turk.

The survey was closed and distributed through Amazon Mechanical Turk-a website that allows people to fill out surveys for a small monetary gain. The administration of the survey was performed via Amazon Mechanical Turk, and security for the survey and the assurance that there were no duplicate responses were provided by the website. All questions were multiple-choice questions, and if there was a question that was not properly filled, the data for that whole entry were discarded.

The target population was people who had some understanding of technology, and the sample was a convenience sample.

The survey was cleared by the University of Waterloo ethics board (application number: 4060 Privacy Agreement for Sharing Health Data). The survey was voluntary, and participants could stop participating at any moment. At the start of the questionnaire, the participants were told about the purpose of the study, its length, the possible risks, and the benefits of taking the survey. They were then asked for informed consent. The only personalized information collected was employment status, sex, age, ethnicity, and the places where participants lived.

Both groups were quizzed on the content of their version of the privacy agreement and were later asked to rate their perceived level of frustration when looking for the answers. Participants were then asked for suggestions about changes to the privacy agreement and the pictograms.

The 4-part questionnaire was developed by using Qualtrics (Qualtrics International Inc)-a web-based tool-and beta tested via a pilot study to assess its feasibility. The first part asked demographic questions about participants' age, sex, ethnicity, occupation, education, country of residence, and region. The investigators used the second part to compare the performance of the control group to that of the experimental group for part 3. In the second part, the control group was given the traditional version of the privacy agreement, whereas the experimental group was given the version of the privacy agreement with a group of pictograms that summarized its content, which appeared before the written section.

Participants were then asked to answer 5 questions that quizzed them on the content of the privacy agreement that they had received. For both groups, all questions were about the information represented by the pictograms.

The questions were as follows:

• Question 1: "Is your information being collected?"
• Question 2: "Can you opt out of some services?"
• Question 3: "Will your data be identifiable when shared?"
• Question 4: "Is your location being collected?"
• Question 5: "Can third parties have access to your data?" Each participant's response was timed to assess how quickly participants could find the correct answers based on the information presented in their version of the privacy agreement. Time data were compared between the control group and the intervention group.

The third part of the questionnaire asked participants to rate their frustration levels while answering part 2, their level of concern, and their previous knowledge about data privacy. In total, there were 9 pages in the survey, which included the option to return to the previous pages before the end of the survey.

Inclusion criteria

• people that understand technology enough to understand data collection and data privacy.

Exclusion criteria

• people that are not tech savvy enough to use things that require privacy agreements