Self-Defense

I am a privacy researcher with a confession to make. I’m not any better at protecting my privacy than you are. For 17 years I’ve been interviewing people about their privacy concerns, studying how companies collect and use personal information, and researching the latest surveillance techniques. I attend privacy conferences, read privacy books, and have written a couple myself. But when friends ask me how to protect their privacy, I don’t have much to tell them. Like most people, I want more privacy but find it difficult to get: few products allow us such control (see “Ultraprivate Smartphones”).

My Web browsers are cluttered with privacy tools I’ve installed. One, Ghostery, tells me how many companies are trying to track me on every site I visit (it reports nine on technologyreview.com). I’ve set up Ghostery to block all tracking, but I often turn it off because that stops some e-commerce sites from working. As a result, several pairs of shoes and a sweater are currently following me around the Internet. I am concerned about trackers learning more about me, but taking steps to prevent that would be inconvenient.

A few years ago my students and I conducted a study where we watched dozens of people use privacy tools. Participants struggled with them, and some who believed they had protected their privacy actually failed to do so. In another study we surveyed over a thousand people about the AdChoices icon that the ad industry uses to notify people about behavioral advertising. Most respondents were unfamiliar with it and afraid to click on it.

As we’ve learned more about U.S. surveillance capabilities, encrypted e-mail seems to make sense. Yet having used encryption tools off and on for over two decades, I still find e-mail encryption too cumbersome to bother with.

I can maintain some privacy through self-censorship: I think carefully before I post to social networks, refrain from transmitting some types of information via e-mail, and avoid some websites altogether. But I regularly expose my kids’ photos to Facebook and my Web browsing to hundreds of tracking companies. I hope they will all keep this information to themselves, but I know they will not.

Research suggests that people really do care about privacy and are even willing to pay a little to protect it. But there isn’t one easy thing they can do that will make much difference, and doing many different things is tricky even for experts. If we want to make privacy practical for everyone, we need privacy tools that are built seamlessly into the software and services we use.

Lorrie Faith Cranor is director of the CyLab Usable Privacy and Security Laboratory at Carnegie Mellon University.