Testing for Transparency: designing privacy-informing systems for young people

The aim of my PhD is to assess emerging privacy policy presentation techniques ("policy presentations") by studying the impact they have on children and young people. It is well established that the current 'consent-and-notice' approach to managing user privacy has not been effective online [5] [7]. Consent-and-notice refers to the approach of providing a privacy notice at the point of a user's contact with an online service, and then asking for that user to consent (or to withdraw consent) toward the privacy practices that have been explained within it. This approach has been criticised for its lengthiness, the timing of when notices are displayed, and the power asymmetry it encourages, amongst other things [2] [3].

One method of addressing the problems inherent in notice-and-consent is to alter how website privacy practices are presented to people. Privacy researchers have suggested and tested using alternative formats, visual and other mediums including short or 'layered' notices, privacy nutrition labels, graphics and privacy dashboards to name a few.

It is assumed that alternative policy presentations could provide a means of enhancing the transparency of online privacy policies, and therefore positively affect the habits of internet users. Although counter-arguments do exist, and the evidence supporting this assumption is mixed [4][6], this appears to be a direction that the industry is taking to alter practice, particularly as it relates to children: Recently, the Information Commissioner's Office (ICO) recommended using novel presentation formats in their guidelines for transparency within the Age Appropriate Design Code, their guidelines for creating GDPR-compliant, child-facing internet services. Young people have expressed concerns about the ways their data is used and how privacy policies are presented to them, and there is some evidence that they would welcome attempts to tailor solutions to them [1] [7]. If the former assumption about transparency is correct, alternative policy presentations designed with young people in mind could encourage their engagement, lead them to better understand terms of service, and result in them adopting better privacy practices. However, research on novel approaches to displaying privacy policies designed by and for young people is lacking. My PhD will explore these alternative privacy policy presentations to see whether their use can have an effect on young people's privacy practices, and to what extent the co-creation of policy presentation formats can increase their effectiveness.

We will collaborate with over 40 partners drawn from across FMCG and Food; Creative Industries; Health and Wellbeing; Smart Mobility; Finance; Enabling technologies; and Policy, Law and Society. These will benefit from engagement with our CDT through the following established mechanisms:

- Training multi-disciplinary leaders. Our partners will benefit from being able to recruit highly skilled individuals who are able to work across technologies, methods and sectors and in multi-disciplinary teams. We will deliver at least 65 skilled PhD graduates into the Digital Economy.

- Internships. Each Horizon student undertakes at least one industry internship or exchange at an external partner. These internships have a benefit to the student in developing their appreciation of the relevance of their PhD to the external societal and industrial context, and have a benefit to the external partner through engagement with our students and their multidisciplinary skill sets combined with an ability to help innovate new ideas and approaches with minimal long-term risk. Internships are a compulsory part of our programme, taking place in the summer of the first year. We will deliver at least 65 internships with partners.

- Industry-led challenge projects. Each student participates in an industry-led group project in their second year. Our partners benefit from being able to commission focused research projects to help them answer a challenge that they could not normally fund from their core resources. We will deliver at least 15 such projects (3 a year) throughout the lifetime of the CDT.

- Industry-relevant PhD projects. Each student delivers a PhD thesis project in collaboration with at least one external partner who benefits from being able to engage in longer-term and deeper research that they would not normally be able to undertake, especially for those who do not have their own dedicated R&D labs. We will deliver at least 65 such PhDs over the lifetime of this CDT renewal.

- Public engagement. All students receive training in public engagement and learn to communicate their findings through press releases, media coverage.

This proposal introduces two new impact channels in order to further the impact of our students' work and help widen our network of partners.

- The Horizon Impact Fund. Final year students can apply for support to undertake short impact projects. This benefits industry partners, public and third sector partners, academic partners and the wider public benefit from targeted activities that deepen the impact of individual students' PhD work. This will support activities such as developing plans for spin-outs and commercialization; establishing an IP position; preparing and documenting open-source software or datasets; and developing tourable public experiences.

- ORBIT as an impact partner for RRI. Students will embed findings and methods for Responsible Research Innovation into the national training programme that is delivered by ORBIT, the Observatory for Responsible Research and Innovation in ICT (www.orbit-rri.org). Through our direct partnership with ORBIT all Horizon CDT students will be encouraged to write up their experience of RRI as contributions to ORBIT so as to ensure that their PhD research will not only gain visibility but also inform future RRI training and education. PhD projects that are predominantly in the area of RRI are expected to contribute to new training modules, online tools or other ORBIT services.