Expecting the Unexpected: Understanding Mismatched Privacy Expectations Online

Online privacy notices are supposed to act as the primary mechanism to inform users about the data practices of online services. In practice, users ignore notices as they are too long and complex to read. Instead, users rely on formed expectations to determine with which site they feel comfortable interacting. Mismatches between actual practices and a user’s expectations may result in users exposing themselves to unanticipated privacy risks – even if the practices were disclosed in a privacy notice. One approach for mitigating these risks is to highlight elements of privacy notices that users do not likely expect. We present an approach for identifying such mismatches and analyze the results of a study based on this approach. Our findings suggest that focusing on mismatches could help design privacy notice interfaces that significantly reduce user burden. Author