Towards Usable Privacy Management for IoT TAPs: Deriving Privacy Clusters and Preference Profiles

2025-11-14

AI Summary

IoT trigger-action platforms (TAPs) suffer from coarse-grained privacy controls and high user configuration overhead. To address this, we propose an empirically grounded privacy preference modeling approach: through a survey and online experiments with 301 participants—analyzed via clustering and factor vignette methods—we identify three distinct privacy clusters (low, medium, high) exhibiting significant differences in fine-grained sharing preferences across data types, recipients, and purposes. Our key contribution is mapping users’ privacy concerns and transparency requirements onto structured, semi-automatically assignable configuration profiles. This yields the first empirically driven framework for designing TAP privacy mechanisms that simultaneously achieve fine-grained control and practical usability.

Technology Category

• Knowledge Representation and Reasoning: Preferences
• Machine Learning: Privacy
• Humans and AI: Learning Human Values and Preferences

Application Category

• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems
• Security and Privacy: Data transparency and provenance
• Economics, Online Markets and Human Computation: The sharing economy

Abstract

IoT Trigger-Action Platforms (TAPs) typically offer coarse-grained permission controls. Even when fine-grained controls are available, users are likely overwhelmed by the complexity of setting privacy preferences. This paper contributes to usable privacy management for TAPs by deriving privacy clusters and profiles for different types of users that can be semi-automatically assigned or suggested to them. We developed and validated a questionnaire, based on users'privacy concerns regarding confidentiality and control and their requirements towards transparency in TAPs. In an online study (N=301), where participants were informed about potential privacy risks, we clustered users by their privacy concerns and requirements into Basic, Medium and High Privacy clusters. These clusters were then characterized by the users'data sharing preferences, based on a factorial vignette approach, considering the data categories, the data recipient types, and the purpose of data sharing. Our findings show three distinct privacy profiles, providing a foundation for more usable privacy controls in TAPs.

Problem

• IoT TAPs offer coarse-grained privacy controls overwhelming users
• Users struggle with complex privacy preference settings in IoT platforms
• Need automated privacy profiles based on user concerns and requirements

Innovation

• Deriving privacy clusters for user categorization
• Creating preference profiles using factorial vignettes
• Semi-automated assignment of privacy settings