Using Pictograms to Make Privacy Agreements More Accessible

Exploring the Use of Pictograms in Privacy Agreements to Facilitate Communication Between Users and Data Collecting Entities: Randomized Controlled Trial

Background: Privacy agreements can foster trust between users and data collecting entities by reducing the fear of data sharing. Users typically identify concerns with their data privacy settings, especially when it comes to health data, but due to the complexity and length of privacy agreements, users opt to quickly consent and agree to the terms without fully understanding them. Objective: This study explores the use of pictograms as potential elements to assist in improving the transparency and explanation of privacy agreements. Methods: During the development of the pictograms, the Double Diamond design process was applied for 3 instances of user interactions and 3 iterations of pictograms. The testing was done by performing a comparative study between a control group, which received a fictional privacy agreement about a health tracking wearable with no pictograms, and an experimental group, which received pictograms. The pictograms were individually tested to assess their efficacy by using an estimated comprehension of information symbols test.

Privacy agreements fulfill the important role of helping users understand how their data will be used by data collecting entities. The role of privacy agreements is to not only provide users with the chance to decide whether they want to disclose their data to an entity but also foster trust and reduce users' concerns about data sharing. Many users are concerned about personal data collection, and privacy agreements may alleviate these concerns. However, due to the complexity of privacy agreements, there are barriers to understanding data use, which result in users agreeing to terms that they do not fully comprehend. The investigators explore the use of pictograms as a potential way to improve the transparency of privacy agreements and users' understanding of privacy agreements. An evaluation was conducted to test whether the addition of the pictograms made reading privacy agreements more efficient and less frustrating for users. For this purpose, a questionnaire was developed along with 2 versions of a privacy agreement. The control group (31 participants) received the traditional version of the privacy agreement while the experimental group received the version of the privacy agreement that included the pictograms created by us (29 participants). The privacy agreement was an imaginary privacy agreement about the Fit-bit and the talked about the collection of health data through the wearable. Participants were recruited by using Amazon Mechanical Turk. The survey was closed and distributed through Amazon Mechanical Turk-a website that allows people to fill out surveys for a small monetary gain. The administration of the survey was performed via Amazon Mechanical Turk, and security for the survey and the assurance that there were no duplicate responses were provided by the website. All questions were multiple-choice questions, and if there was a question that was not properly filled, the data for that whole entry were discarded. The target population was people who had some understanding of technology, and the sample was a convenience sample. The survey was cleared by the University of Waterloo ethics board (application number: 4060 Privacy Agreement for Sharing Health Data). The survey was voluntary, and participants could stop participating at any moment. At the start of the questionnaire, the participants were told about the purpose of the study, its length, the possible risks, and the benefits of taking the survey. They were then asked for informed consent. The only personalized information collected was employment status, sex, age, ethnicity, and the places where participants lived. Both groups were quizzed on the content of their version of the privacy agreement and were later asked to rate their perceived level of frustration when looking for the answers. Participants were then asked for suggestions about changes to the privacy agreement and the pictograms. The 4-part questionnaire was developed by using Qualtrics (Qualtrics International Inc)-a web-based tool-and beta tested via a pilot study to assess its feasibility. The first part asked demographic questions about participants' age, sex, ethnicity, occupation, education, country of residence, and region. The investigators used the second part to compare the performance of the control group to that of the experimental group for part 3. In the second part, the control group was given the traditional version of the privacy agreement, whereas the experimental group was given the version of the privacy agreement with a group of pictograms that summarized its content, which appeared before the written section. Participants were then asked to answer 5 questions that quizzed them on the content of the privacy agreement that they had received. For both groups, all questions were about the information represented by the pictograms. The questions were as follows: Question 1: "Is your information being collected?" Question 2: "Can you opt out of some services?" Question 3: "Will your data be identifiable when shared?" Question 4: "Is your location being collected?" Question 5: "Can third parties have access to your data?" Each participant's response was timed to assess how quickly participants could find the correct answers based on the information presented in their version of the privacy agreement. Time data were compared between the control group and the intervention group. The third part of the questionnaire asked participants to rate their frustration levels while answering part 2, their level of concern, and their previous knowledge about data privacy. In total, there were 9 pages in the survey, which included the option to return to the previous pages before the end of the survey.

Two groups were randomly created. Both groups were given an imaginary privacy agreement about a wearable that would collect health data from the participant. Group 1 was given that privacy agreement with only words and group 2 was given the privacy agreement with the addition of pictograms at the top. Those pictograms were meant to summarize the content of the privacy agreement and highlight the most important parts.

This group was given the same privacy agreement of the control group, but with the addition of pictograms that summarized the information.

The intervention consisted of a modified privacy agreement talking about health data. Instead of presenting all of that information through text, the investigators added pictograms that summarized the key points at the beginning.

This outcome was based on the premise that through the use of pictograms people would understand privacy agreements better and take less time to find the answers. The investigators measured it using a questionnaire and measured if people could correctly guess what were their rights. For example, the questionnaire would ask the participant "is your data being collected?" and then the participant would choose "yes", "no", "I don't know", and "I don't want to read all of that". With this the investigators were able to measure if they were actually understanding their right regarding their health data, which were presented in the privacy agreement. Each correct answer gets 1 point and the privacy agreement with the most points at the end had the template that made it easier for the participants to understand their rights. The higher the score, the better the outcome.

This outcome was based on the premise that through the use of pictograms people would experience less frustration when trying to find specific information and understand their rights in a privacy agreement. The investigators measured this using a self-reporting questionnaire where the participants would report what was their level of perceived frustration after reading the privacy agreement. This was measured using a Likert Scale of 5 points where 1 was very frustrated and 5 was neutral. The lower the score, the more frustrated participants reported being.

Overall understanding of the meanings of the pictograms as measured by the Estimated Comprehension of Information Symbols

This outcome sought to see how effective the privacy agreements were in conveying information. For this the investigators used Estimated Comprehension of Information Symbols. The test comprised of showing a pictogram and a description of what it was meant to represent to a participant, and then asking them to guess what percentage of the population they thought would understand the meaning. If the average is less than 47% than the pictogram is not understandable. If it's above 87% then it can be considered a success. In between 47% and 87% the test needs to be repeated with a regular comprehension test. Therefore, a higher score means a better outcome.

Inclusion Criteria: people that understand technology enough to understand data collection and data privacy. Exclusion Criteria: people that are not tech savvy enough to use things that require privacy agreements

Ugaya Mazza L, Fadrique LX, Kuang A, Donovska T, Vaillancourt H, Teague J, Hailey VA, Michell S, Morita PP. Exploring the Use of Pictograms in Privacy Agreements to Facilitate Communication Between Users and Data Collecting Entities: Randomized Controlled Trial. JMIR Hum Factors. 2023 Jan 25;10:e34855. doi: 10.2196/34855.