Workshop on the Future of Privacy Notices and Indicators: Will Drones Deliver My Privacy Policy?

In this paper, we describe a user-centered privacy policy design project that we undertook at Stanford Legal Design Lab, in order to generate new models of business-to-consumer communications around data privacy. From our preliminary user research, rapid prototyping and testing, and refinement of new privacy communication designs, focused on a very particular archetype—20-40 year old who is tech-savvy yet largely disinterested in privacy policies—we propose a series of new concept designs for technology companies to use when presenting the terms of their privacy policies, as well as general principles to ensure that communication of these policies are more engaging and actionable to this type of target user.

Traditional mechanisms for delivering notice and enabling choice have so far failed to protect users' privacy. Users are continuously frustrated by complex privacy policies, unreachable privacy settings, and a multitude of emerging standards. The miniaturization trend of smart devices and the emergence of the Internet of Things (IoTs) will exacerbate this problem further. In this paper, we propose Conversational Privacy Bots (PriBots) as a new way of delivering notice and choice through a two-way dialogue between the user and a computer agent (a chatbot). PriBots improve on state-of-the-art by offering users a more intuitive and natural interface to inquire about their privacy settings, thus allowing them to control their privacy. In addition to presenting the potential applications of PriBots, we describe the underlying system needed to support their functionality. We also delve into the challenges associated with delivering privacy as an automated service. PriBots have the potential for enabling the use of chatbots in other related fields where users need to be informed or to be put in control.