Increasing the Influence of Permission Safety on App Selections by Changes in Visual Representation

Abstract

Previous studies have shown that inclusion of a permission safety score/cue in the early stage of selecting an app assists users in making safer choices (Chen, Gates, Li, & Proctor, 2015; Gates, Chen, Li, & Proctor, 2014; Rajivan & Camp, 2016). Yet, user ratings were typically weighted more in app-selection decisions than a summary permission safety score, suggesting that app-associated risks are not fully understood or known by users. In daily interactions, people make privacy decisions not just based on rational considerations but also on heuristics (e.g., take the first, Dogruel, Joeckel, & Bowman, 2015). Interfaces of popular online services and systems sometimes exploit these heuristics and biases to nudge people to act in ways that are not always aligned with their own intentions (Stutzma, Gross, & Acquisti, 2013). On the contrary, the goal of present study was to evaluate various formats for presenting the permission safety scores to nudge users to make decisions that are in better agreement with their security and privacy objectives. With 2 studies, we found that a 3-color representation of permission safety promotes safe behavior and communicates privacy of apps well. In Experiment 1, the permission safety score was placed above or below the user rating, and it was conveyed by a number from 1 to 5 paired with a shield or lock icon. The user rating was presented as a number from 1 to 5, paired with a gray star. Participants completed six app-selection tasks, in which, for each, two apps out of six were chosen. The percentage of app selection was higher with increased safety as well as increased user ratings. Permission safety interacted with user rating: For apps with lower user ratings the permission safety did not influence app selection, but for apps with higher user ratings an increased permission safety score led to more app selection. However, neither location (above or below) nor the icon type showed a main effect, nor did they interact. In Experiment 2, the 3-level permission safety score was conveyed by color (red, yellow, green), emoticons (frown, neutral, smile), color with emoticons, or a number from 1 to 3 paired with a lock icon. Participants performed the same tasks as Experiment 1. The results were similar as Experiment 1 except that presentation format interacted with permission safety score. Further analysis showed that that the permission safety score had more influence on app selection when it was represented by conditions with color coding, indicating that permission safety was weighted more in the app-selection decisions when permission safety was presented with 3-color-coding. The role of color in enhancing risk perception is consistent with the role of color in enhancing hazard perception in warning literature (Wogalter, 2006). Given the relative quickness of the decision and the limited cues that users consider during app selection, their attention should be directed to more important app-specific privacy characteristics. Our results provided evidence that 3-color coding can shift users’ attention and influence users to make safer app selections. In designing a visual privacy rating to nudge people away from risky apps, leveraging visual attributes that are prevalent for conveying valence is recommended.