counteracting the negative effect of form auto-completion on the privacy calculus

Counteracting the negative effect of form auto-completion on the privacy calculus

Bart Knijnenburg, Alfred Kobsa, Hongxia Jin

Form auto-completion: the bright side

Modern browsers offer an auto-completion feature that reduces the effort of filling out web forms

�2

Bart



!Imagine such tools could fill out any form, on any website

�3



!Imagine such tools could fill out any form, on any website

!This would be particularly useful for mobile browsers

�4

Form auto-completion: the dark side

Preibusch et al. (2012) warn that such auto-completion tools may cause users to complete more form fields than they intended



!Auto-completion tools make it so easy to submit a fully completed form that users may skip weighing the benefits and risk of disclosing a certain piece of information in a specific situation (privacy calculus!)



!Auto-completion tools make it so easy to submit a fully completed form that users may skip weighing the benefits and risk of disclosing a certain piece of information in a specific situation (privacy calculus!)

!Can we overcome these problems with a better auto-completion tool?

Research outline

We introduce two new tools that we hypothesize will reinstate the privacy calculus

!Specifically, we compare three auto-completion tools: – Auto FormFiller (automatically fills

fields, users can remove manually) – Remove FormFiller (same but

users can click to remove each field)

– Add FormFiller (no automatic filling, users can click a button to fill each field)

�8

Please tell us more about yourselfBlogHeroes will assign a "guild" to you based on the information you provide below. Note that noneof the fields are required, but our classification will be better if you provide more information.

General info about mePlease provide some background info to get our matching process started.

Name (first): John (last): Smith

E-mail address: [email protected]

Gender: Male

Age (years): 23

Address: 123 Main St.City: New York State: NY Zip: 12345

What I do for a livingSome guilds write about their jobs. Tell us more about yours, and we can provide a better match.

Employment status: Employed for wages

Experience (years): 5

Current/previous job: Researcher Sector: Education / training / library

Income level: between $50K and $100K/year

Education: Doctoral

My healthSome guilds write about their health. Providing us with some info will help us match them to you.

Physical health: About average

Dietary restrictions: allergic to nuts

Birth control usage: None

> For employers

> For investors

> Contact

> About us

Please enter your informationI WRK will find jobs based on the information you enter on this form.None of the items on the form are required, but if you provide moreinformation the jobs will be a better match.

GENERAL AND CONTACT INFO

General and contact information

FIRST NAME

JohnLAST NAME

Smith clear

AGE

23 clear

GENDER

Male clear

E-MAIL ADDRESS

[email protected] clear

ADDRESS

123 Main St.CITY

New YorkSTATE

NYZIP

12345 clear

WORK EXPERIENCE

Please tell us about your education and work experience, so that wecan find a suitable job for you.

HIGHEST DEGREE EARNED

Doctoral clear

CURRENT EMPLOYMENT STATUS

Employed for wages clear

CURRENT/PREVIOUS JOB

ResearcherSECTOR

Education, library, or training clear

EXPERIENCE (IN YEARS)5 clear

Enter your details, please

Your personal Codacare health insurance policy will be based on theinformation you provide. Please note that none of the items arerequired, but the insurance will be better tailored to your needs if youprovide more information.

General information

Please provide your general information.

Name (first): (last):fill

Address:

fillCity: State: Zip:

Gender:fill

Age:fill

E-‐mail:fill

Health

Please answer the following questions about your health. This is important to find thecorrect care package.

Birth control usage:fill

Weight (lbs):fill

Research outline

People base their information disclosure decision on the perceived risk and relevance of the information

Perceived risk and relevance (and thus disclosure)

depend on the purpose-specificity of the request

The effect of risk and relevance is moderated by tool type: disclosure is more “calculated” when the add and remove tools are used

Research model

Website

Item type

Disclosure

Risk

Relevance

Tool type

Research model

Website

Item type

Disclosure

Risk

Relevance

Tool type

perceived risk and relevance

Research model

Website

Item type

Disclosure

Risk

Relevance

Tool type

purpose-specificity

Research model

Website

Item type

Disclosure

Risk

Relevance

Tool type

moderation by tool type

�14

What causes information disclosure?


Typical answer: privacy calculus (Laufer and Wolfe 1977)

�15



!Privacy calculus is like utility maximization (Li 2012): people trade off the different aspects and then choose the option that maximizes their utility (Bettman et al. 1998; Simon 1959)

�16



!Privacy calculus is like utility maximization (Li 2012): people trade off the different aspects and then choose the option that maximizes their utility (Bettman et al. 1998; Simon 1959)

!So what are these aspects that people trade off?

�17


Risk !Operationalization:

Providing my [item] to [site] is:

(-3 = very risky; +3 = very safe)

!!Relevance !Operationalization:

The fact that [site] asked for my [item] was:

(-3 = very inappropriate; +3 very appropriate) �18

Disclosure

Risk

Relevance

�19



But what causes risk and relevance?




On web forms, users selectively disclose different types of information in different extent to different types of websites (Hsu 2006)



!Social media users also share selectively with others, depending on the purpose of the information (Olson et al. 2005)



!Social media users also share selectively with others, depending on the purpose of the information (Olson et al. 2005)

!Does purpose-specificity play a role in commercial privacy as well?





Gender: Male

Age (years): 23







Education: Doctoral






In our experiment, participants: – entered a wide range of info into an auto-completion tool

– tested the tool on one of three websites

Create a ProfilePlease create your profile by entering your information below.Note that FormFiller will store the information locally on your device, and only for the duration ofthis study. We will never submit any forms automatically or disclose this information to otherswithout your active involvement.

About you:

First name: Last name:

Gender:

Age:

Address:

City: State: Zip:

E-‐‑mail:

Phone:

Tastes and Preferences:

Favorite movie:

Favorite band/artist:

Favorite food:

Favorite weekendpastime:

Last holiday location:

Political views:

Work and education:

Current/previous job: Sector:

Employment status:

> For employers

> For investors

> Contact

> About us




FIRST NAME

JohnLAST NAME

Smith clear

AGE

23 clear

GENDER

Male clear

E-MAIL ADDRESS


ADDRESS

123 Main St.CITY

New YorkSTATE

NYZIP

12345 clear

WORK EXPERIENCE



Doctoral clear




ResearcherSECTOR





General information



Address:


Gender:fill

Age:fill

E-‐mail:fill

Health



Weight (lbs):fill


In our experiment, participants: – entered a wide range of info into an auto-completion tool – tested the tool on one of three websites





Gender: Male

Age (years): 23







Education: Doctoral





> For employers

> For investors

> Contact

> About us




FIRST NAME

JohnLAST NAME

Smith clear

AGE

23 clear

GENDER

Male clear

E-MAIL ADDRESS


ADDRESS

123 Main St.CITY

New YorkSTATE

NYZIP

12345 clear

WORK EXPERIENCE



Doctoral clear




ResearcherSECTOR





General information



Address:


Gender:fill

Age:fill

E-‐mail:fill

Health



Weight (lbs):fill


In our experiment, participants: – entered a wide range of info into an auto-completion tool – tested the tool on one of three websites

Websites correspond to a particular type of info: – blogging community ⋍ personal interest items – job search website ⋍ job skills items – health insurer ⋍ health record items





Gender: Male

Age (years): 23







Education: Doctoral





> For employers

> For investors

> Contact

> About us




FIRST NAME

JohnLAST NAME

Smith clear

AGE

23 clear

GENDER

Male clear

E-MAIL ADDRESS


ADDRESS

123 Main St.CITY

New YorkSTATE

NYZIP

12345 clear

WORK EXPERIENCE



Doctoral clear




ResearcherSECTOR





General information



Address:


Gender:fill

Age:fill

E-‐mail:fill

Health



Weight (lbs):fill


Purpose-specificity will look like an interaction effect between Website and Item type

!!When the type of information requested matches the purpose of the website: – perceived risk will be lower – perceived relevance will be higher

– people will be more likely to disclose the item

Website

Item type

Risk

Relevance


Purpose-specificity will look like an interaction effect between Website and Item type

!!When the type of information requested matches the purpose of the website: – perceived risk will be lower – perceived relevance will be higher

– people will be more likely to disclose the item

Website

Item type

Disclosure

Risk

Relevance


Website

Item type

Disclosure

Risk

Relevance

odds: 0.818***

odds: 1.079***

see next slide

Model tested with 543 Mechanical Turk participants

�29

χ2(12) = 11.929, p = .451; CFI = 1.00, TLI = 1.00; RMSEA < .001, 90% CI: [.000, .011]


When the type of item matches the purpose of the website, people perceive lower risk and higher relevance

Counteracting the negative privacy effect of form auto-completion

Thirty Fourth International Conference on Information Systems, Milan 2013 11

Figure 3. Perceived Risk and Perceived Relevance per Website and Item type. The arrows point to the matching item types. Error bars are ± 1 Standard Error.

Regarding perceived Risk, we find that the interaction between Website and Item type is significant (χ2(6) = 246.41, p < .0001). Moreover, for each website, the non-matching item types are perceived as significantly more risky than the matching item type. Also, for each item type, the non-matching websites are perceived as significantly more risky than the matching website13. H3 is thus supported.

Likewise, the interaction between Website and Item type is also significant for Perceived Relevance (χ2(6) = 913.47, p < .0001). For each website, the non-matching item types are perceived as significantly less relevant than the matching item type, and for each item type, the non-matching websites are perceived as significantly less relevant than the matching website. H4 is thus supported as well.

H5+H6. Tool type ! Disclosure

The last row in Table 2 presents the effect of Tool type on Disclosure. Controlling for Perceived Risk, Perceived Relevance, and Item type, the odds of Disclosure are 6.3% higher for users of the Add tool than for users of the Remove tool, although this effect not significant (p = .631). Surprisingly then, H5 is rejected: there is no significant difference in Disclosure between the Add and Remove tools.

The planned contrast between the traditional Auto tool and the alternative tools is significant (χ2(1) = 4.037, p = .045). Controlling for Perceived Risk, Perceived Relevance, and Item type, the odds of Disclosure are 24.0% lower for users of the Remove tool compared to users of the Auto tool, a small (d = .165) but significant (p = .047) effect. The odds of Disclosure are 18.9% lower for users of the Add tool compared to users of the Auto tool, a small (d = .107) effect that is not significant (p = .130). H6 is thus partially supported: Disclosure is indeed significantly higher for the Auto tool than for the Remove tool.

Hypotheses 7 and 8

To test H7 and H8, we introduce the interaction between Tool type and Perceived Risk and Relevance (dashed lines) to the path model described in Figure 2. Unfortunately, due to the high correlation between Perceived Risk and Perceived Relevance, we were unable to fit a model that includes both effects. We therefore introduce each effect to the model separately.

H7. Tool type × Perceived Risk ! Disclosure

To model the interaction between Tool type and Perceived Risk, we create a multiple group model, comparing the Add and Remove groups against the Auto group, fixing all parameters except for the intercept and the effect of Perceived Risk. This model again has an excellent fit (χ2(86) = 99.443, p = .152; CFI = .990, TLI = .988; RMSEA = .007, 90% CI: [.000, .013]). 13 To adjust for multiple comparisons, we compared the p-values in Tables 3-5 against Bonferroni-Holm corrected α levels; see http://en.wikipedia.org/wiki/Holm-Bonferroni_method.

80% 85% 90% 95% 100%

Contact info Interests Job skills Health record

" " " -3

-2

-1

0

1

2

3

BlogHeroes I♡WRK Codacare

Perceived risk

# # #

-3

-2

-1

0

1

2

3


Perceived relevance









Hypotheses 7 and 8




80% 85% 90% 95% 100%


" " " -3

-2

-1

0

1

2

3


Perceived risk

# # #

-3

-2

-1

0

1

2

3


Perceived relevance









Hypotheses 7 and 8




80% 85% 90% 95% 100%


" " " -3

-2

-1

0

1

2

3


Perceived risk

# # #

-3

-2

-1

0

1

2

3


Perceived relevance


Website

Item type

\

Risk

! ! !

75%

80%

85%

90%

95%

100%











Hypotheses 7 and 8




80% 85% 90% 95% 100%


" " " -3

-2

-1

0

1

2

3


Perceived risk

# # #

-3

-2

-1

0

1

2

3


Perceived relevance









Hypotheses 7 and 8




80% 85% 90% 95% 100%


" " " -3

-2

-1

0

1

2

3


Perceived risk

# # #

-3

-2

-1

0

1

2

3


Perceived relevance


When the type of information requested matches the purpose of the website, people are more likely to disclose it.

�32

! ! !

75%

80%

85%

90%

95%

100%






purpose-specificity




purpose-specificity

What is the influence of the auto-completion tool?

Influence of tool type

We tested three tools: – Auto FormFiller (automatically fills

fields, users can remove manually) – Remove FormFiller (same but users

can click to remove each field) – Add FormFiller (no automatic filling,

users can click a button to fill each field)





Gender: Male

Age (years): 23







Education: Doctoral





> For employers

> For investors

> Contact

> About us




FIRST NAME

JohnLAST NAME

Smith clear

AGE

23 clear

GENDER

Male clear

E-MAIL ADDRESS


ADDRESS

123 Main St.CITY

New YorkSTATE

NYZIP

12345 clear

WORK EXPERIENCE



Doctoral clear




ResearcherSECTOR





General information



Address:


Gender:fill

Age:fill

E-‐mail:fill

Health



Weight (lbs):fill


Website

Item type

Disclosure

Risk

Relevance

Tool type

χ2(86) = 99.443, p = .152; CFI = .990, TLI = .988; RMSEA = .007, 90% CI: [.000, .013]

χ2(86) = 95.140, p = .235; CFI = .993, TLI = .992; RMSEA = .006, 90% CI: [.000, .012]

Disclosure

Risk

Relevance

Tool type


!!!!!!!Odds are closest to 1 for the Auto tool, so Risk and Relevance influence Disclosure the least for users of the Auto tool

Auto 0.863***

Remove 0.754***

Add 0.811***

Auto 0.989

Remove 1.133***

Add 1.114***

Disclosure

Risk

Relevance

Tool type


Results:

– Disclosure was not purpose-specific for users of the Auto tool

– Disclosure was purpose-specific for users of the Remove and Add tools. These tools help users consider the website’s purpose in their disclosure decisions

– Additional note: Users of the Add tool were more satisfied, despite having to click more frequently on average!

!

!

!

75%

80%

85%

90%

95%

100%


Auto

! ! !


Remove

! ! !


Add

! ! !

75%

80%

85%

90%

95%

100%






purpose-specificity

What is the influence of the auto-completion tool?

moderates effect of risk and relevance

Take-home message

People base their information disclosure decision on the perceived risk and relevance of the information

Perceived risk and relevance (and thus disclosure)

depend on the purpose-specificity of the request

The effect of risk and relevance is moderated by tool type: disclosure is more “calculated” when the add and remove tools are used

counteracting the negative effect of form auto-completion on the privacy calculus

Business