Context plays an important role in shaping users’ privacy attitudes and behaviors. Users manage their personal information disclosure according to the norms of the specific context. Information sharing that is appropriate in one context may become inappropriate in another due to different norms. Such contextual information norms may vary in different national cultures. For example, users in different countries have different attitudes towards medical information sharing. Hence, as many technologies have become available around the world and users increasingly share information online with people from different countries and cultures, there is an urgent need of investigation into the concrete cultural differences in contextual information norms in the use of technologies. Such investigation is important to understand how users in different cultures manage their information privacy differently and to inform the privacy design for technologies that are used globally.

The goal of this dissertation is to understand how contextual information norms differ in different national cultures. To answer this, I conduct three cross-cultural quantitative studies. In the first study, I focus on the cross-cultural differences in contextual information norms when users share their personal information with organizations, such as governments, companies, third parties, employers, etc. Through machine learning and regression analysis on a large-scale survey data from eight countries, I model how the contextual impact differs in different national cultures. In the second and third study, I study cross-cultural differences in contextual impact in users’ interpersonal information disclosure on social network sites (SNS). The second study is about how the social context of other people sharing on SNSs (social norms) influences users’ information disclosure. The third study is about how contextual factors that characterize interpersonal relationships influence users’ privacy decisions on SNS friend requests. The findings from these three studies show that contextual information norms vary across different national cultures, especially between individualistic and collectivistic cultures. I discuss the theoretical implications based on these findings and suggest design practices on how to customize privacy support in technologies for users in different national cultures. This work contributes to multiple domains of literature including privacy, context-aware systems, cross-cultural studies and human-computer interaction.

Smartphone apps and websites increasingly ask users to make privacy decisions, e.g., to grant or deny app permission to access their location. Previous research indicates that people are often unable to make these decisions in a reasonable manner due to limits of their available time, motivation, and cognitive decision-making abilities. This problem will continue to grow in ubiquitous computing environments like the Internet of Things (IoT), as an array of IoT devices around the user unobtrusively collects (or infers) his/her personal information. Even though this practice may enable IoT systems to realize highly personalized services for their users, it also raises privacy concerns that may lead users to stop using the service. Therefore, providing IoT services with minimized privacy risks is crucial for both protecting user privacy and keeping IoT ecosystems sustainable. One possible way to achieve this aim is to assist users with making better privacy decisions, by predicting decisions based on their and/or fellow users' historical decision-making behaviors and recommending the privacy settings accordingly (i.e., privacy decision support). To make it a reality, we investigated how to computationally model and predict people's privacy decision-making in IoT. Through both online and situated survey studies, we collected user-stated privacy attitudes and decisions toward a wide range of IoT service scenarios. We then extracted a set of context- and user-specific factors that could impact IoT users' privacy decision-making via statistical analysis on the collected dataset. Based on this dataset, we also conducted a series of machine learning experiments so as to figure out the most suitable approach for constructing predictive models. These models are trained to infer the optimal privacy decisions toward IoT services that the user had never interacted with. Regarding this, we presented several practical insights we gained from building privacy decision prediction models. Lastly, we designed and proposed a novel privacy-aware system that aims not only to increase users' awareness about privacy implications of using IoT services but also to gather their privacy decision samples made with confidence, which can be utilized as high-quality training data for continuously updating machine learning models for the realization of privacy decision support in IoT.

As an increasingly important part of our social, professional and financial lives happens online, the frequency with which we have to deal with privacy problems is ever on the rise. In this dissertation I answer the question: How can we help users to balance the benefits and risks of information disclosure in a user-friendly manner, so that they can make good privacy decisions?

After briefly motivating this question in Chapter 1, I first discuss problems with existing answers to this question in Chapters 2 and 3. In Chapter 2, I explain how providing transparency and control does sufficiently not help users in making better privacy decisions. Specifically, I demonstrate that people’s privacy decisions fall prey to all sorts of decision biases, and that most privacy decisions are too complex for people to fathom. In effect, many people refrain from exploiting the provided transparency and control altogether.

In Chapter 3, I explain how “privacy nudging” is also not sufficient in its presently studied form. Specifically, I demonstrate that although nudges relieve some of the burden of privacy decision making, they tend to overlook the inherent diversity of users’ privacy preferences and the context-dependency of their decisions.

The main argument of this dissertation is that because of these shortcomings of transparency-and-control and privacy nudges, privacy scholars need to move beyond the “one-size-fits-all” approach to privacy embodied in both nudges and transparency and control. I argue that because of the high variability and context-dependency of people’s privacy decisions, nudges need to be tailored to the user and her context.

In several studies, I contextualize users’ privacy decisions by showing how disclosure depended on the person’s privacy profile, the type of information, and the recipient of the information (Chapter 4). Then, I present the idea of a “privacy adaptation procedure” and demonstrate its merit in Chapter 5. Finally, I test a complete implementation of the privacy adaptation procedure in Chapter 6. The results of this final study cause reserved optimism regarding the feasibility of user-tailored privacy decision support.