Please visit the following URL for a short survey

1. Please visit the following URL for a short survey http://bit.ly/nChVj2 All instructions and questions for the survey will be displayed during this presentation and we request you to put down your answers in the space provided at the above mention webpage.

2. Please read the following narrative and answer the questions that follow Jane has never used Google before - EVER! Jane signs up for a Google account. She then logs into GMail and sends her mom an e-mail about her new apartment. Q1: Which of the following privacy policies do you think Jane just agreed to? A.) Google's privacy policy B.) Gmail's privacy policy C.) Both D.) Neither

3. Her mom responds to the email by talking to Jane on GChat. Jane's browser (IE) crashes, so she decides to try Google Chrome. She google'sfor "Chrome" and installs it. She then starts a GChat video call with her mother. Shortly after, her mom’s bandwidth slows down, so she suggests that Jane try calling the house using Google Voice. Jane calls using Google Voice and they talk for an hour about her new apartment. Later, Jane takes photos of her apartment on her phone and uploads the pictures on Google+ from her phone. She then adds her friend Mary to a circle to show her the photos. Mary shares a link with Jane to a video on Youtube of her new baby. Jane views and comments on the video, and then +1’s it. Q2: How many Google privacy policies do you think Jane just agreed to? Q3: How many privacy policies do you think Google has?

4. Google’s Privacy Policies Google (Core) Chrome Frame Location Service in Firefox Sites +1 Button Desktop Mobile Store Advertising Gears Moderator Toolbar Advisor Google+ Music Beta Trader Apps Google Notebook O3D Translator Toolkit Blogger Google TV Orkut Voice Books Google Web Toolkit Picasa Web Accelerator Buzz GroupsPostini Web History Checkout HealthPowerMeter YouTube Chrome Knol Safe Browsing Q4: How many Google privacy policies do you think Jane just agreed to? http://www.google.com/intl/en/privacy/

5. Thank you for participating in our survey.

6. Privacy Policies D. Gordon, S. Samat October 11th, 2011

7. Our Agenda • Why are privacy policies difficult to read? • How to read a privacy policy • What is P3P? Privacy Bird • P3P Compliance/Response • Recent studies in Privacy Policies Facebook’s Eroding Policy Social Navigation and Policy Configuration Service Aggregation with P3P Policy Readability • Policy Generators • Policies and Organizations • Discussion

8. Why are privacy policies difficult to read? • Time consuming May be hidden Usually very long • Difficult to understand • Not standardized • May change unexpectedly Cranor (2005), ‘Privacy policies and privacy preferences,’ Chapter 22 of Security and Usability

9. User issues • User privacy preferences are often complex and nuanced • Users tend to have little experience articulating their privacy preferences • Users often do not understand the privacy-related consequences of their behavior  • Users have differing expectations about the type and extent of privacy policy information they would like to see • Consumers believethey do not have the ability to limit or control companies’use of their information KleimannCommunication Group Inc. Evolution of a prototype financial privacy notice., February 2006 Cranor et. al. (2006), ‘User interfaces for privacy agents’

10. How to read a Privacy Policy http://www.southparkstudios.com/clips/382785/im-gonna-clickdecline

11. How to read a Privacy Policy - Facebook • Start at the end The most important portions of a privacy policy are often at the very end.  You can download a copy of everything you've put into Facebook using our download your information tool. • Note the location and language of the privacy policy Is it hidden away on a hard-to-find webpage or can it be found easily?  Does the language seem excessively vague or incomprehensible?Easy to find Language: Simple  Content: Well organized https://www.privacyrights.org/social-networking-privacy#privacy-policy

12. How to read a Privacy Policy - Facebook • Canceling your account If you decide to leave the social network, can you delete the account and remove all of your information?  Can all data be removed entirely or will some information be maintained by the social network?   Deactivate & Delete • How long is personal information stored?  Note that some information may be made ‘anonymous’ after a certain period of time, some may be deleted entirely after a certain period of time, and some may be maintained in perpetuity. Up to 90 days after deletion of account https://www.privacyrights.org/social-networking-privacy#privacy-policy

13. How to read a Privacy Policy - Facebook • Who owns the data that a user posts?   Does a user lose rights to information that he or she posts? Can it be used by marketers without the user’s explicit consent?   While you are allowing us to use the information we receive about you, you always own all of your information. • What happens when a user dies?  Does the privacy policy discuss what happens to personal information after a user dies? Will it remain online or be removed? Memorializing accounts https://www.privacyrights.org/social-networking-privacy#privacy-policy

14. How to read a Privacy Policy - Facebook • Who has access to information? Advertisers and third-party software developers Identity thieves and other online criminals Facebook shares some information with applications and other websites (with your permission) and with advertisers (anonymously) • How can a user complain?   Look for a physical address, email address, website address or phone number where users can voice concerns 1601 S. California Avenue, Palo Alto, CA 94304. https://www.privacyrights.org/social-networking-privacy#privacy-policy

15. How to read a Privacy Policy - Facebook • How will a social network notify users about changes to privacy policy? Will changes be posted to the homepage or will it only be posted in the privacy itself? If we make changes to this Privacy Policy we will notify you by publication on the Facebook Site Governance Page. • Does the social network participate in seal programs?  Social networks that participate in third-party seal or certification programs show some level of awareness of privacy concerns. Facebook complies with the EU Safe Harbor framework. All disputes are resolved through TRUSTe. https://www.privacyrights.org/social-networking-privacy#privacy-policy

16. What is P3P? The Platform for Privacy Preferences (P3P) Specification provides a standard, computer readable format for privacy policies and a protocol that enables web browsers to read and process privacy policies automatically. Cranor(2002), ’Introduction to P3P,’ Chapter 1 of Web Privacy with P3P

17. P3P Vocabulary • Who is collecting data? • What data is collected? • For what purposes will data be used? • Is there an ability to opt-in or opt-out of some data uses? • Who are the data recipients (anyone beyond the data collector)? • To what information does the data collector provide access? • What is the data retention policy? • How will disputes about the policy be resolved? • Where is the human readable privacy policy? • http://www.p3ptoolbox.org/guide/section2.shtml

18. AT&T Privacy Bird • Displays a bird icon in the top right of the user´s browser title bar and displays a different color of bird to indicate whether or not the Web site´s P3P policy matches the users preferences. The Privacy Tool can even be configured to provide an audible chirp to provide a warning. • http://www.p3ptoolbox.org/guide/section2.shtml

19. AT&T Privacy Bird Provides a page for users to set their privacy setting preferences with the settings grouped into four categories: Health or Medical Information; Financial or Purchase Information; Personally Identifiable Information; and Non-Personally Identifiable Information. By checking the box next to a setting, the user controls which warnings to receive. http://www.p3ptoolbox.org/guide/section2.shtml