Thread by @v0max

A primer on privacy as "contextual integrity" and why privacy notices on mobile platforms (both Android and iOS) are insufficient for attaining informed consent. Thread:

If your doctor asked for permission to collect your medical history, you would probably say yes.

1/

However, if that doctor asked to collect your medical history to give to marketers for advertising purposes, you would probably decline.

The difference is, in the first case, you're making assumptions about how the data will be used based on who is making the request.

2/

Knowing just the type of data requested and the requester are insufficient to make an informed decision: people also consider the purpose and other constraints (e.g., will data be resold, stored securely, etc.), which are equally important factors.

3/

These other factors are *assumed* (often incorrectly!) when not specified explicitly.

"Of course my data will be transmitted securely" or "I assume that Yelp is only collecting my location data to show me things nearby."

4/

We found that when users see that an app wants access to location data, without any other information, many people assume it's for desirable location-based festures (though it could just as easily be a signal for undesirable long-term tracking):

blues.cs.berkeley.edu/blog/2014/07/3…

5/

On current mobile platforms, users are asked to make privacy decisions based on their knowledge of the app making the request and the data type requested.

No information about how the data will be used or with whom it will be shared (and under what constraints) is presented.

6/

Naturally, this leads to incorrect assumptions, which shouldn't be construed to mean a user has consented to all uses of their data (e.g., location tracking).

Nonetheless, adtech companies continue to claim their data is collected with consent. This is disingenuous at best.