In advising some students at UC Berkeley’s School of Information on their Masters Final Project, KnowPrivacy, I spent a good bit of time thinking about privacy policies and we even created our own set of “privacy icons” to reflect some of the features of the privacy policies analyzed. (See the KnowPrivacy profile for Google, for an example.) This experience taught us that online privacy is a HARD policy issue. Designing useful, comprehensible privacy icons that might actually get used is just one really hard part of a really hard problem.

I preface my remarks with all that in order to make clear that what follows is not intended as criticism, but feedback, which Mozilla has solicited all along the way.

Which Distinctions Matter?

A difficult problem facing anyone seeking to make privacy icons is that you have to decide which distinctions you are going to illustrate, typically based on what distinctions you think do (or should) matter to the audience for those privacy icons.

I disagree with three choices the Mozilla team made about which distinctions to illustrate with their privacy icons.

1. The Mozilla (alpha) privacy icons do not distinguish between the types of data collected.
• This is a mistake because most users don’t care if a site collects data on which web browser they used (and whether the site keeps such information forever) but many users do care if a site collects their credit card number (or health records or …) and intends to retain it.
2. The Mozilla (alpha) privacy icons’ distinction between your data being “given” to “advertisers” or not is too coarse-grained.
• The KnowPrivacy researchers found that many sites do not “give” information to anyone, but many popular websites allow third parties to place collection webbugs right there on the site’s home page. Privacy policies exploit this distinction to hide the fact that your information is leaking. While Mozilla’s explanation of this icon group seems to take this into account, there is no reason to expect that most users will understand this.
• The KnowPrivacy researchers also found that most popular sites share with “affiliates”, some share with “contractors”, some share with “advertisers” and some share with third parties generally. The icon group only references “advertisers” and a finer-grained set of distinctions might encourage greater transparency about these different sorts of sharing.
3. The Mozilla (alpha) privacy icons’ distinction between your data being sold or given away is not typically a distinction that users do (or should) care about.
• Users just want to know who has or might get their data and don’t really care what the monetary terms of the deal were when their data was given/sold to another party.

Stylistically, one thing I really like in the alpha release is the length-of-time icons for indicating how long a user’s data is kept. However, the KnowPrivacy researchers found that most popular websites do not disclose the length of retention, and so one can assume that, at present, only the infinite icon would get much use. However, perhaps these retention icons would be a sort of public shaming that might encourage sites to select a data retention time period and to disclose it.

Finally, I don’t mean to suggest that the Mozilla team should have just adopted the KnowPrivacy icons and called it a day. The KnowPrivacy icons were intended for an audience visiting the KnowPrivacy website, i.e., a user that is engaged in comparing and contrasting the policies of the most-visited websites. Mozilla’s use case is different and almost certainly requires a different set of icons to serve their purposes. However, my points above are intended to suggest that even for their purposes, Mozilla should strive to capture a different set of distinctions in the beta release.

1. Allow each team captain three opportunities over the course of the entire match to request an instant replay where any of the following are at issue:
•  A goal was denied due to a penalty of any sort. (Think U.S. v. Slovenia.)
•  The captain believes that a call or failure to call a handball, diving, or offsides was improper.
•  A corner kick is denied where the captain believes the defender last touched the ball.
•  A player is given a red card and the captain believes it was unfounded.
•  The captain believes the ball did or did not cross the plane of the goal line and was improperly called.

The replay officials would require clear and convincing evidence of an error to reverse a call.

2.  Have the clock kept by official timekeepers on the sideline with control of any scoreboard clocks. They stop the clock every time the ball crosses the plane of the sidelines and any time the official’s whistle blows and start the clock when the ball is back in play. This eliminates unpredictable stoppage time at the end of matches and also would probably allow the halfs to be shortened to 35 or 40 minutes while yielding the same amount of actual play.
3. Allow unlimited substitutions.
4. Give an automatic red card to players penalized for diving. They are removed from the match immediately and the side must complete the match without a substitution.
5. Make the goal 22 cm higher and 44 cm wider. (This adds one diameter of the ball on every side, which ought to lead to more scoring.)

Bonus idea: Forbid artificial noisemakers of any sort in the stadiums.

There you have it. Five simple suggestions that would, I think, greatly improve international soccer and which would resolve many of the greatest complaints among those who are interested in soccer, but not yet committed fans.

I just made such searches a lot easier for myself by creating this Firefox search engine plugin that searches resource.org via Google.

I typically know the citation or party name that I’m looking for, and so this search engine plugin puts your terms in quotation marks automatically so that Google searches for exactly that search phrase on resource.org.

In using this plugin so far, I get exactly the opinion I am looking for as the first link far more often than I used to when just using Google. Try it for yourself.

They found that there is a mismatch between consumer expectations and website privacy practices and posting a privacy policy alone does not bridge that gap. In particular, they’ve shed light on the use of third-party tracking via web bugs. We were surprised to learn that many of the most-visited sites on the internet state in their privacy policies that they do not share information with third parties, but then also state that they allow third parties to place web bugs on their site. Perhaps that’s not “sharing,” but inviting the third parties in to do the collecting themselves achieves the same result: users visit one site and are unaware that information about them and that visit winds up in the hands of an unknown third party.

They also found a surprising dominance by Google in the web bug space. Google operates several trackers and at least one of their trackers appears on 92 of the top 100 most-visited sites in the United States. When one looks at a larger collection of domains (nearly 400,000) that contain at least one web bug, they found a Google tracker on over 88% of those domains. While other tracking companies have good coverage of the most-visited sites, no other company came close to Google’s dominance when the domains considered was broadened.

Through a series of Freedom of Information Act (FOIA) requests, they also received data on actual consumer complaints to the Federal Trade Commission and compared those complaints with those gathered from the California Office of Privacy Protection, Privacy Rights Clearinghouse, and TRUSTe. Here they found that consumers want control over the information gathered about them and are particularly sensitive about the public display of that information. One of the take-aways from this is that while the FTC has, in the past, thought about privacy in terms of “harm” users are largely concerned instead with a lack of control.

The full report makes sound recommendations for both website operators and regulators to try to address these issues. The group received some recognition as a finalist in the Bears Breaking Boundaries Science, Technology, and Engineering Policy competition, and a group of outside judges at the School of Information’s Final Project Showcase awarded them a James R. Chen Award for their work. Today, the New York Times has a piece on their research entitled: Google is Top Tracker of Surfers in Study.