Research aims to automatically answer user questions on online privacy policies

Internet users may soon have a way to have their questions about online privacy policies answered automatically, thanks to a new multi-institution research project that includes Penn State.

The project is funded by a recent $1.2 million multi-institution grant from the National Science Foundation, with $437,000 allocated for Penn State. The project aims to enable people to ask questions about the privacy issues that matter to them when reviewing privacy policies.

Currently, more than 90% of people consent to legal terms and conditions without reading them, according to a 2017 Deloitte survey. Reasons range from complex language, lack of time, length of the material and general indifference.

But with recent news stories focused on privacy concerns surrounding websites and mobile applications, consumers are taking greater caution to understand what personal information is being collected, and whom they're it sharing with, according to Shomir Wilson, assistant professor in the College of Information Sciences and Technology and a principal investigator on the project.

"We're interacting with the internet using computers and mobile phones on an enormous scale every day," said Wilson. "To get access, we sometimes have to agree to share personal information."

And while companies have the legal obligation to provide privacy policies, there is a big gap between the information shared and information that the common user can understand. Additionally, some users may not care if their information is shared, while others have stronger privacy concerns.

"Privacy is different for everyone," he said. "It's not necessarily about secrets, but about control over your information and the ability not to be bothered. Different people have different preferences."

The researchers will create software in the form of mobile applications, web browser plugins and interactive websites by developing and using algorithms in the areas of natural language processing, machine learning, and knowledge representation and reasoning. The interdisciplinary project aims to reinvent notice and choice—the idea that privacy policies are sufficient because users are given notice about how their information will be used and choices about what they can do in regards to the policy, such as opting out of certain features.

"We hope to release some prototype technologies that can help people understand the privacy policies of apps and websites," said Wilson. "We also hope to produce and release technology that nonprofits and other organizations can adopt to make this process of informing users easier."

Wilson said that they hope this shift from lengthy and difficult-to-understand policies to interactive privacy dialogues will help users be more informed and thoughtful about how they're sharing their data.

"If users are given privacy information in ways they can understand, they're more likely to make decisions that align with their interests and feel secure," he said.