"It doesn't tell me anything about how my data is used'': User Perceptions of Data Collection Purposes

TL;DR

The paper investigates how users perceive data collection purposes described in GDPR privacy notices, using 23 semi-structured interviews with UK/Ireland participants to evaluate six common purposes and their descriptions. It finds that most purpose descriptions lack essential details (e.g., retention and deletion processes) and that naming choices influence perceived transparency, with mixed understanding across purposes. The authors propose concrete design guidelines, including clearer, non-conjunctive names, simpler, more informative descriptions, and the adoption of a consent nutrition label, aiming to move toward more meaningful informed consent within a broader consent ecosystem. They also discuss leveraging cross-domain practices from ethics and healthcare consent and acknowledge limitations such as language scope and the gap between perception and behavior. The work contributes to user-centered improvements in consent interfaces and provides a foundation for quantitative and multilingual follow-up studies.

Abstract

Data collection purposes and their descriptions are presented on almost all privacy notices under the GDPR, yet there is a lack of research focusing on how effective they are at informing users about data practices. We fill this gap by investigating users' perceptions of data collection purposes and their descriptions, a crucial aspect of informed consent. We conducted 23 semi-structured interviews with European users to investigate user perceptions of six common purposes (Strictly Necessary, Statistics and Analytics, Performance and Functionality, Marketing and Advertising, Personalized Advertising, and Personalized Content) and identified elements of an effective purpose name and description. We found that most purpose descriptions do not contain the information users wish to know, and that participants preferred some purpose names over others due to their perceived transparency or ease of understanding. Based on these findings, we suggest how the framing of purposes can be improved toward meaningful informed consent.

Figures (3)

• Figure 1: An example of a privacy notice with its listed data collection purposes.
• Figure 2: Terminology used to represent the frequency of themes in our qualitative results. This graphic was taken from kyi2023investigating.
• Figure 3: An example of a privacy notice with very specific purposes, taken from the wild.