Social Networking Sites (SNS) are growing exponentially and have undoubtedly become an intrinsic part of our lives. This is accompanied by a spike in the amount of time spent by users online, namely teenagers and young adults who allocate an average of three hours a day for various types of SNS. From commenting, posting sharing opinions to selfies and videos, they expose numerous pieces of personal information, jeopardizing their privacy. Specifically, this self-disclosure is driven by various factors including the individual's sharing needs, the information being shared as well as the target audience. As such, it is a multi-layered issue to which the one-size-fits-all interventions, currently being used, have not proven to be most efective. This paper proposes a novel harm-aware recommender system-based solution to help the user take privacy-preserving decisions while using social media. This novel take on self-disclosure mitigation leverages notions from behavioural economics as well as psychological measurements. One of the contributions of this paper is the conception of the disclosure appetite, which is a user-specific term that encompasses their perception and their drive to reveal their private information. The tailored privacy-aware recommendations rely on the psychometric value that is the disclosure appetite as well as the sensitivity of the data being revealed. Through a trade-of between the two parameters, the system aims to mitigate the privacy compromise while considering the preferences of the user. In the era of oversharing and living virtually, this system that handles private data, with the intention of preserving it, is more crucial than the common uses of recommenders. In most of those cases, the extent of personal information exchanged does not go beyond preferences. Whereas the consequences and preventive potential of this work can have a bigger impact on multiple facets of the users' lives. Finally, an empirical evaluation is conducted using participants from the US, Canada and Europe.
Recommender systems play a big role in most of the content consumed by users online. From
streaming platforms like Netflix and shopping services like Amazon to personalized assistants
like Siri and Cortana, a multitude of applications have been integrated into our daily lives.
Initially, the major focus of these recommenders was to get to know the user and deliver
bettertailored suggestions in numerous contexts. The better the results are, the more engagement the
system gets from the user and the more lucrative deploying recommender systems becomes for
companies. In the 1990s and early 2000s, there was a surge of filtering techniques applied to
reallife situations to enhance the weave of information tapestry [
It is a term that we introduce as the personalized level of disclosure that is acceptable or necessary to the user. It is inspired by the “risk appetite”, which is defined for organizations. – An objective representation of personal data in order of sensitivity, which is an updated version of a well-established social penetration theory; – A novel user-centric harm-aware recommender system to mitigate self-disclosure through personal and objective considerations using a Rasch model approach. Based on a compromise between the two, the system recommends that the user deletes or keeps each piece of data in the original input.
The paper is organized as follows: Section 2 discusses existing work that relates to our research. Section 3 details the recommender system, Section 4 reports on the evaluation of the platform and in Section 5, a discussion ensues from the findings. Finally, we conclude this paper and shed light on future directions.
Solove [
Although there are user-centric approaches on the system side such as developing
privacypreserving protocols [
Another way to remedy the issue is the use of nudges to discourage users from harmful actions [16], an approach that has become a popular practice. Nudges are either positive behaviour reinforcements or ill-advised activity deterrence called preventive nudges and in both cases, the aim is the wellbeing of the person. Prompts, cues, notifications are all forms of nudges, which can rely on general knowledge or user-specific parameters. Their mechanisms can be clustered into four major categories: decision information, decision structure, decision assistance, and social decision appeal [17]. Existing applications of these concepts to disclosure mitigation include the platform [18] that relies on a user’s disclosure preferences, and risk aversion to deliver nudges and to auto-adapt following the user’s reaction. User-centric solutions [19] have been garnering attention as the belief grows that privacy protection is not a one size ifts all concept [ 20]. In more critical contexts such as mobile payment, privacy-preserving recommendations play a very important role in reinforcing the opinion of experts on secure online purchases [21]. There is a gap between the ubiquity of card fraud cases and the buyer negligence to adopt the recommended measures, and the research concluded that implementing nudges can help users make better and more informed decisions. Regarding privacy-concerned recommender systems that aim to alleviate incidents on social media [22], the example of YourPrivacyProtector [23] fits this category. Based on simple machine learning techniques, the proposed solution shows great promise in assisting Facebook users by suggesting a diferent privacy setting than the default one. Another example of privacy settings recommendations is SPAC [24], which learns the user’s behavioural patterns and uses their history and profiles in order to predict the best configuration.
Most of these assistants and recommenders consider the privacy of a post being shared as a whole rather than put a value on each personal piece of information. Other approaches [18] put metaphorical price tags on diferent bits of data in order of sensitivity. This paper falls within the latter scope and instead of opting for an all or nothing method, aims to mitigate harms in order of sensitivity while also considering personal preferences. For this reason, data is regarded as a group of items appraised diferently by the system and recommendations are based on the Rasch model [25] that incorporates singular objective values and a person measure. This duality of recommender systems and the Rasch model has been explored in other contexts before. Existing work includes tailoring goals for nutrition assistance systems [26], in which the proposed app ofers dietary tracking, visual feedback, and personalized recipe recommendations and showed higher success in comparison with the non-user-specific alternative. Similarly to this research and in the domain of energy conservation and health, the Rasch model, once again is used and proves its fit for modelling user behaviour [ 27]. Knijnenburg [28] proposes a user-tailored approach that considers the benefits and privacy loss for commercial use. The paper demonstrates and justifies the failure of the existing generic nudges, persuasive cues, and all one-size-fits-all approaches as efective privacy-preserving solutions. Our work falls within the same scope of personalizing harm-aware recommendations with the aim of increasing their acceptance rates amongst users. However, to the best of our knowledge, it presents the first Rasch model-based recommender system for disclosure mitigation on social media. Moreover, it has consideration for diferent contexts, which are the social circles involved in the disclosure. Thanks to our proposed approach, privacy preservation can progress beyond the restrictive all or nothing solutions, but more importantly, the emphasis is put on the need for a user-centric approach. The need and desire for disclosure is a highly subjective matter, as a result, the mitigation is equally tailored by the individual’s preferences. The next section sets the foundations for user modelling and provides the disclosure appetite measure that is used along with the objective data parameters to limit the disclosure and its infringement upon privacy; an approach that shows potential in addressing self-disclosure.
This section details the harm-aware recommender system. Specifically, when potential data disclosures are detected, the private data shared are reported along with the context. The recommender system receives this information then, retrieves the user-specific disclosure appetite and the sensitivity of the data in question. Upon receiving the disclosure mitigating recommendation, the user acts by either accepting or rejecting the prompt. The proposed system is agnostic to the mechanism and technology behind disclosure detection. Various techniques could be used, ranging from a simple search using keywords to more sophisticated and cuttingedge solutions such as Google Cloud Natural Language. However, disclosure detection is not in the scope of the current paper and is not detailed further. Specifically, what is of interest is the personalized privacy-preserving and disclosure-mitigating recommendations that come after a disclosure is detected.
Disclosure mitigating recommendations are based on the trade-of between the user’s preferences, motivations and data sensitivity. This can also be interpreted using the privacy calculus theory that compares risks and benefits. To achieve this 2-parameter based system, we choose to work with Item Response Theory (IRT) as this paradigm, by design, is user-centric and fits our design. The model takes as input “user ability” and “item dificulty ” and the output is the probability of them answering the question correctly. The proposed system is built on the foundations of the Rasch model, a special case of IRT based on personal and objective parameters. The original Rasch model: = ∈ {0, 1} is the dichotomous random variable where, = 1 denotes the correct answer, = 0 an incorrect response to a given assessment item. In the Rasch model for dichotomous data, the probability of outcome = 1, which is a correct answer, is given by:
Where: is the ability of person and is the dificulty of item .
The adapted Rasch model: Before presenting the mathematical aspect of the model, it is worth noting that one of the main strengths of the proposed system is the fact that recommendations pertain to specific pieces of data rather than the content as a whole. It is based on mitigation instead of total elimination. In the context of the proposed recommender system, = ∈ {0, 1} is the dichotomous random variable where, = 1 denotes an accepted recommendation by user concerning item (user accepts to delete the item/piece of data). is the probability of outcome = 0 as if the user would disclose the information (reject the recommendation to delete piece of data ): In terms of accepting the recommendation: { = 0} =
: user-specific disclosure appetite, : sensitivity/value of a piece of data.
is the ℎ user’s drive, motivation and preference to disclose. It is a measure inspired by its economics counterpart: the risk appetite, the level of risk that an individual or organization is willing to accept while pursuing its objectives. In the proposed system, three contexts are considered and they represent the social circle, with whom the users are sharing their private data. These social circles are grouped into the following three categories: close friends & family, colleagues and acquaintances and the general public. As such, for each user, a separate value, one for each of social circle is maintained, reflecting the 3 variants of the disclosure appetite depending on the context. The rationale behind this approach resides in the fact that diferent contexts afect the sharing motivation and preferences [ 29], a person might have a very high drive for disclosure with family members but would be reluctant to do so with the public. A diferent person might be careless with their own data and have a similar disclosure attitude across all contexts. difers from
in the sense that the former is the same for the entire population. This concludes the general presentation of the user-specific system.
The proposed approach relies on the Rasch model’s representation of the trade-of between the data sensitivity and the disclosure appetite. Figure 1 represents the steps taken by the recommender system.
The following subsections detail each step of the process, starting with the estimation of the disclosure appetite and data sensitivity to tuning/fitting the model and finally performing the recommendations. Es mate disclosure appe te and data sensi vity
Fit the user-specific disclosure appe te given the anchored data sensi vity
Personalize recommenda ons using the adapted
Rasch model
At this stage, the system does not yet have preestablished values of data sensitivity nor disclosure appetite. So, the first step is to estimate these values. There are numerous Rasch estimation methods. As such, a comparison of the following four methods was performed: Joint Maximum Likelihood Estimation (JMLE), Marginal Maximum Likelihood (MMLE) Estimation, Conditional Maximum Likelihood Estimation (CMLE), Pairwise Maximum Likelihood Estimation (PMLE) [30]. Throughout this estimation process as well as the calibration and anchoring of the data sensitivity the data used is provided by participants whom we detail in the evaluation (Section 4). A “user”, in this paper, refers to an individual amongst the participants in the survey. Optimal estimation method: The estimation methods are judged based on 2 criteria: first, how well does the model fit the current data and second, how well would it fit future data that is yet to be seen. The first criterion can be measured through the goodness of fit as well as the Root Mean Square Error (RMSE). The second can be observed though the reliability value that indicates reproducibility. The reliability coeficient reflects the correlation between the true measure and the observed measure. Throughout this paper, Winsteps version 4.8.1 [31] is used for the estimations and evaluations and it relies on the Cronbach’s Alpha to calculate this metric for the disclosure appetite reliability and all the results are reported in Table 1. The global fit measure relies on Pearson chi-square and the output: the p-value is a number between 0 and 1 with higher values indicating better fit. JMLE returns the highest value of 0.82 while CMLE has the lowest 0.61.
The reliability of data sensitivity, in theory, should be at least > 0.70 to be considered acceptable and for the disclosure appetite, the reliability is considered good if it’s > 0.70 and very good if it’s > 0.80. As for RMSE, a measure of 0.05 or smaller is good fit, between 0.06 and 0.08 is reasonable and > 0.1 = poor fit. Taking all these metrics into account, JMLE outperformed MMLE, CMLE and PMLE and reported good results. Thus, the data sensitivity values that are ifxed henceforth in upcoming sections are the ones estimated using JMLE.
Modeling the data sensitivity: It is important to keep in mind that the recommender system relies on the Rasch model to establish a trade-of between “disclosure appetite” (user’s gain from disclosing information) and “data sensitivity” (user’s loss of privacy). In this section, the focus is on the latter parameter. Based on the choice of the estimation method JMLE, Table 2 reports on examples of these results per personal data type.
Overall, the model was tested on 13 pieces of data; they are, in order of highest to lowest sensitivity: Banking information, ID-Passport, Medical records, Home address, License plate, Photos of diploma, Religious belief, Political belief, Travel plans, Selfies , Charity contributions, Preferences (products and services), and Biographical data. These values are calculated based on answers given by users to disclosure scenarios (see examples in the Evaluation section).
Now that these values are obtained, it is important to proceed to the categorization or dichotomization process, which entails grouping several pieces of data together rather than viewing each one uniquely. This is crucial to prepare for generalization. For example, in the present paper, 2 types of oficial documents are considered: ID and passport so knowing how sensitive they are can give an insight into the value of a driver license. That can be achieved thanks to the generalization of the model performed in this step. While this can be achieved using simple approaches (such as equal bins), it will not really tend to the specificities of the values of data reported in Table 2. How the private information is attributed numeric levels of sensitivity and categorized is crucial as this defines the “item value” in the Rasch model and is in direct correlation with the probability of the user accepting/refusing the recommendation. Table 3 highlights the layer bounds using Andrich thresholds, which are the boundaries separating the categories. The representative element is the sensitivity value of each layer. Based on these results, this paper proposes a four-layer model for private data in order of sensitivity.
The proposed approach, in this work, to update the representation of personal data in a
layered manner based on sensitivity is inspired by the Social Penetration Theory (SPT) [32].
Specifically, SPT explains the trade-of people make while they consider revealing their private
information to gain a sense of intimacy with others. SPT proposes a six-layer model to order
data based on lowest to highest sensitivity: Biographical data, preference in clothes, food and
music, goals and aspirations, religious convictions, deeply held fears and fantasies, and concept of
self. Figure 2 illustrates the proposed 4 layers in correspondence with the thresholds from Table
3 and the diferent measures of data sensitivity such as the ones reported in Table 2.
[
Biographical data Preferences, Selfie, charity contribution Travel plans, religious and political opinions, license plate, photos of diploma Banking information, official documents (ID, passport), Medical records, home address
At this point, the Rasch model-based probability can be computed using equation 2” as the system has data sensitivity values as well as disclosure appetite values using JMLE. The purpose of fitting the model (or the calibration process) is to obtain a better, more personalized estimation of the disclosure appetite.
This is another estimation process similar to the earlier conducted JMLE. However, in this section, the data sensitivity is anchored as detailed in subsection 3.2.1. Its values are considered to be anchored and the fitting module takes them as input along with the estimated disclosure appetite by JMLE. The Anchored Maximum Likelihood Estimation (AMLE), a method based on the concept of fixing “item dificulties” and estimating “person values”, is used. It is worth reiterating that “item dificulty” corresponds to “data sensitivity” in the proposed disclosure mitigating recommender system. Table 4 shows scenarios that users respond to on a 6-point Likert scale: “Definitely no ” - “No” - “Somewhat no” - “Somewhat yes” - “Yes” - “Definitely yes ”.
Going back to the example of Alice, the user used as an example in the introduction, prior to the model fitting process, her disclosure appetite was calculated using a basic preference elicitation, and her measured disclosure appetite was 0.3. When given realistic scenarios for the system to get to know her better, she responded that with “definitely yes ” to revealing her travel plans with her colleagues and acquaintances. That data, as specified in the previous section belongs to layer 3 of the proposed personal data classification in order of sensitivity. Given this information and the context “with colleagues and acquaintances”, her disclosure appetite increases from 0.3 to 0.34. Another user, Bob, who when presented the same hypothetical scenario but answers “Strongly no”, sees a decrease in his disclosure appetite from 0.5 to 0.46. For both Alice and Bob, the values adapted here are the disclosure appetites for the specific context “colleagues and acquaintances” and none of the other 2 variables (“public” and “close friends and family”) is modified. As seen in Figure 1, at this point, the remaining step is the personalization of the recommendations.
The Rasch model introduced and explained at the beginning of section 3.1 can now be used to perform recommendations. Suppose that the system is acting as an assistant to Alice and Bob whose disclosure appetites are = 0.34 and = 0.46 respectively. These values were updated (as highlighted in section 3.2.2) following the fitting process. Both of them face the same exact scenario such as “sharing a selfie in which they are acting funny or maybe they are drinking ” and they are about to share it with colleagues and acquaintances. This piece of information belongs to layer 2 of the data sensitivity model and is given the value = 0.457 in Table 3. Alice whose disclosure appetite in this context is 0.34, has a probability of 0.457−0.340 1+ 0.457−0.340 = 0.529 of accepting the recommendation advising her not to share the photo. Bob, on the other hand, has a job with less formality and his colleagues are comfortable sharing selfies while partying. This explains his relatively higher disclosure appetite that is 0.46 and as the system got to know his preferences in the steps prior to the recommendation, the probability that he would accept to not share the data in question is 0.49 (the probability of rejecting the recommendation is 1 − 0.49 = 0.51). As a result, the system does not intervene by nudging him to reduce the disclosure. Following the recommendation, for each user who was nudged, the disclosure appetite is adapted according to their decision so if Alice accepts the recommendation she got, the value goes down but if she refuses if increases. The next step is to assess how well does the disclosure mitigating system perform beyond the theory and using real participants.
The proposed recommender system estimates the disclosure appetites of users and the personal data sensitivity, then adapts the person’s value, and provides more personalized, privacypreserving recommendations. This section provides insights on the diferent points to evaluate and corroborate: – The calibration and validation of the disclosure appetite values (to determine how accurate the user model is) – The context-specific disclosure appetite consideration (to corroborate the need to consider disclosure context) – The evaluation of the overall personalized recommender system as an efective harmaware system.
There is no preexisting available dataset that can be used for the evaluation. Hence, 800 people were recruited over a period of 4 days using Amazon’s Mechanical Turk [33]. The demographics are reported in Table 5. The participants are equally divided from two geographical locations: Europe and North America (US and Canada). The survey has a total of 40 questions and was hosted on Limesurvey [34].
Before completing the survey, respondents are presented with a consent form providing the purpose of the research, afiliation of the researchers and information on the anonymity of the responses and the right of withdrawal. The participants are not required to submit any uniquely identifiable information (real name, email, phone number, etc.) and they remain anonymous throughout the entire process.
The survey is composed of three linked sections shown in Figure 3. The evaluation is based on a 10-fold cross-validation meaning that 9 folds are used for estimation and calibration and 1 fold for the tests.
Sec on 1 •1.1) Used to estimate β and δ parameters Section 2+3 •1.2) Used to calibrate β values given that δ values are ixed (anchored) based on 1.1)
Sec on 1 Section 2+3 •2.1) Used to estimate β given thatδ values are anchored based on 1.1) and β calibrated based on 1.2) •2.2) Used to evaluate: The calibration of the model as well as the entire system through the calculation of accepted recommendations Batch 1 : Estimation & calibration Batch 2 : Testing
Table 6 shows an example of a question flow that the participant answers in the survey. Section 1, 2 and 3 follow the reasoning “what does the user prefer to share?”, then: “What would they actually share given specific situation?” and finally: “Do they accept the personalized disclosure mitigating recommendations?”.
Now that the premise of the evaluation is explained, next is a report on the results.
This section is dedicated to observations made and results recorded through the evaluation process of the system. Figure 4 shows that the probability to accept the recommendation depends on: – The user-specific disclosure appetite: the higher the disclosure appetite the less likely the user is to accept. – The item sensitivity: the higher the sensitivity, the more likely the participant is to accept the recommendation.
Sensi vity=0,9 Sensi vity = 0,02
Sensi vity = 0,5
For a person whose disclosure appetite is 0.5, the probability of them accepting the recommendation and proceeding to conceal a piece of information with the sensitivity 0.02 is 0.1. For the same person, the probability is 0.38 if the piece of data in question is highly sensitive (0.9 sensitivity). So the probability increases with the increase of sensitivity. Comparing a person with a disclosure appetite of 0.8 and someone with a 0.2 measure, Figure 4 shows that the higher the appetite, the less likely it is that the recommendation would be accepted. Previously, it was detailed that each section serves a diferent purpose in the evaluation process. Section 2 of batch 2 (testing batch), which presents the hypothetical scenarios as in Table 6, is used to better ift the model and tailor it. To assess the impact of this process, an evaluation of how well the recommendations are received by the user (accepting is the desired outcome) with or without calibration is used and reported in Table 7.
The probability of the user accepting to delete a specific piece of data is calculated prior to and post-calibration and is then compared to the actually reported action of the user. An error occurs when the two do not match, namely if the probability is 0.6 > 0.5 but the user does not accept the recommendation, this is an estimation error that the system reports and Table 7 records these values across the diferent layers of personal data specified in Figure 2.
One of the foundations of the proposed system is the consideration of the context, which is the audience with whom the data is shared. Table 4, shows examples of diferent scenarios with the corresponding context. Each user has three diferent disclosure appetites depending on whether the private information is being shared with “close friends and family”, “colleagues and acquaintances” or the “public”. The results reported in Figure 5 corroborate this approach. Figure 5 (a) highlights the results of using one single value for each user across all contexts, which means that if the user decides to share data with their family members, their overall disclosure appetite increases as a result, the system assumes that the user’s drive to share with the public has increased as well. This has led to a lack of understanding of the user’s attitude, which is backed up by the results namely the percentage of accepted recommendations regarding disclosure with close friends and family in particular. Associating a value with each context in Figure 5 (b) has led to an increase from 3% to 59% for the age group 18-24, from 27% to 47% for people aged 25-34 and a 20% diference for the category 45+.
Close friends & family Colleagues & acquaintances 100 50 0 34 5871 27 47 66 49 7078 5264
90 18-24 25-34 35-44
45+ (a) 5963
76 18-24 4754
68
This concludes the validation of the first two evaluations and the remaining one is to assess the overall performance. In other words: how well are these user-centric recommendations received by the users. To do so, it is also interesting to look at how the diferent demographic pieces of information play part in the user’s decision. The results highlighted in Figure 6 show that the percentage of accepted recommendations does not difer a lot based on whether the participant is from North America or Europe. Before going into more details, it is important to note that overall, 891 recommendations were pushed across all 800 participants. Specifically, some users displayed an attitude more inclined to disclose and were given 8 recommendations across the entire survey, for example, while other participants were less inclined, and got fewer recommendations as per the proposed Rasch model. As pointed out throughout the paper, the recommendations are tailored and not given to all users in the same situations. Moving on to the results: for the most sensitive data (belonging to layer 4), 461 recommendations were given, amongst which, 177 for European participants and 284 for North Americans. For the former group, 93% showed a willingness to accept the disclosure mitigating recommendations while the percentage is 86% for North Americans (Figure 6 (c)). There was not a large gap based on gender either. Comparing students to non-students and based on the age category yielded more noticeable diferences such as a 52% diference between participants aged 45+ and 18-24 when it comes to accepting recommendations concerning layer 2. Similarly, non-students showed a 61% willingness to accept recommendations centred around data with the same sensitivity (same layer) while students were only 14% agreeable to the prompt.
100 0 3124 14
Specifically, recommendations are only pushed to users if they declared in section 1 (of the survey) that they would not disclose a piece of data but end up saying they would when given a realistic scenario in section 2.
The evaluation has featured encouraging preliminary results. In particular, it demonstrated the utility and need for such a user-centric disclosure mitigating recommender system and its potential is corroborated by the response of the individuals to recommendations. When it comes to protecting data from the most sensitive layer (layer 4), the percentage of accepted recommendations ranged from 77% to 94% ((a) and (b) from Figure 6). These results translate to privacy preservation meaning that 94% of users were going to disclosure very crucial data but were deterred by the system, which fulfils the aim of this work. It is worth mentioning that we acknowledge the fact that in the testing setup, users are given hypothetical scenarios to respond to and are not naturally using their social media accounts and getting real-time recommendations, on their actual personal data. While this can introduce a bias in the results, the scenarios that were given in the survey were crafted such that users could relate to them, efectively mitigating and reducing the efect of this setup on the users’ responses. Nonetheless, validating this kind of system with real users and real data has its own intricacies and considerations and not just from a technical perspective. The findings of this paper further validate the privacy paradox. In fact, in the first section of the survey, individuals show a high consideration for their privacy expressing that they have never shared a piece of data only to respond in section 2 (Figure 3) saying that they would reveal that information when a specific situation arises.
Our approach to addressing the privacy paradox aims to reduce the discrepancy between the users’ judgement (how they evaluate the data sensitivity) and their behaviour when put in a particular situation (proceed with the disclosure or accept the recommendation). Bridging this gap, as proposed in this paper, is done through nudging the users, such that their behaviour conforms to their judgement. This is achieved through providing personalized recommendations that are in fact aligned with the user’s judgment. The preliminary results using a proof of concept of the personalized harm-aware recommender system show its potential, especially when dealing with the most sensitive data: 93% of Europeans and 86% of North Americans agreed with recommendations to reduce disclosure (Figure 6 (c)). When calculating the correlation between each demographic parameter and the decision to accept or refuse the recommendation, Pearson correlation is used. A high degree is reported for the criteria “age group” and “being a student vs non-student” (respectively 0.62 and 0.53 correlation), moderate for the gender (0.41) and low degree for the country (0.17). This ofers insight on the criteria to focus on in the future, to further improve the recommendations. However, in its current state, the personalized harm-mitigating recommender system already is an improvement compared to a previous preliminary study that we conducted. In fact, the purpose of that one was to investigate the need for mitigation over elimination through evaluating the acceptance rates of nudges such as “delete only this part” against “delete the entire post”. North American participants were presented with various scenarios to respond to, but the same recommendations were given to all of them (without any personalization). In the preliminary study, 68% of participants accepted the disclosure-reducing recommendations involving data that is classified as belonging to layers 2, 3 and 4. If we consider the same North American region and recommendations from the same layers, the present paper reports a 77% acceptance rate (averaging the results from Figure 6 (c)) thanks to the addition of personalization using the Rasch model.
Moving on to the context, the results in Figure 5 show that dividing the audience into three categories allows for a better tailored user-specific disclosure appetite value and as a result a better understanding of the disclosure behaviour and the probability of accepting recommendations. But another consideration is the fact that between the three social circles, users were less likely to accept to reduce oversharing with “close friends and family”. An example of this is the recorded 53% in comparison with an 82% percentage of accepted recommendations for people aged between 35-44. This can be explained by the trust that users place in closer social circles. These results are still encouraging as 53% is an improvement showing that participants are willing to change their decisions when prompted in a way that considers their preferences. Had they not received the recommendation, they responded that they would have proceeded with the disclosure, which proves the eficacy of the system. This validates the proposed user-centric approach but also highlights a future direction, which is to consider a more specific way to approach disclosure with more emotional value and trust attached to it. Figure 5 shows that the highest percentage of accepted recommendations is associated with the context “public” and the lowest with the context “close friends and family”. This further corroborates existing research [35] on friendship and how it can be a catalyst for disclosure and compromising one’s privacy. Finally, a major highlight of this paper is, not only its encouraging results during the evaluation but also the fact that the proposed user-centric recommender system can be generalized to a multitude of uses as it is agnostic to the type of data being shared. This is particularly important seeing as the field of application concerns privacy and sensitive data unlike most common uses of recommendations that are mainly concerned with preferences.
Today’s social media users are facing bigger threats than ever. The most concerning fact is that although the menaces are becoming more prevalent, users themselves, who are potential victims, are not becoming equally more aware. They need help to protect themselves as well as others around them such as the use of a security training platform [36]. This paper proposes a novel user-centric recommender system to help people achieve two conflicting goals: achieve the personal preferences for disclosure of information while protecting their privacy. The scope of this work extends beyond the generic preference-based recommendations to a more critical application. What is at stake is not simply whether the person’s preference in food or clothes is leaked but the fact that their uniquely identifiable information can be compromised. The proposed system estimates the user-specific drive for sharing their data and defines it as the disclosure appetite inspired by its economic counterpart called the risk appetite. Furthermore, this work updates the well-established social penetration and extends it to social media disclosure. The privacy-preserving recommender system uses a trade-of between the disclosure motivation and the data sensitivity to guide users through the privacy versus disclosure appetite dilemma. Being agnostic to the specific data that is shared (text, video etc.) paves the way for reusability in other applications and forms of privacy preservation. From this point onwards, the research is headed towards testing with real users in real-life scenarios and evaluating their responses to the personalized recommendations while attempting to share something on SNS.
The reported results are encouraging as a measure of the system’s efectiveness (accepted recommendations). However, we do intend to investigate the other metric: user satisfaction. Although our system considers implicit feedback in the form of accepting or rejecting the recommendation and adapts to this action, explicit feedback can further improve recommendations. An updated version of the 6-item scale by Knijnenburg et al. [37] be adapted to the social context and enhance the user experience and subsequently, the harm awareness goal. Moreover, this paper acknowledges that the issue is not simply a matter of revealing information about oneself but can extend to others. Sharing a photo that has another person in it is a form of disclosure of others that brings forth another aspect called multiparty privacy [38]. The existing techniques in this scope such as the auction, negotiation and aggregation-based mechanisms are far from ideal. Thus, it could prove to be quite challenging to extend the user-centric recommender system proposed in this paper to an optimal multiparty-aware disclosure-mitigating model. [16] A. Acquisti, L. Brandimarte, J. Hancock, A Sense of Privacy (2021). doi:1 0 . 1 1 8 4 / R 1 / 1 4 2 0 0 1 9 9 .
v 1 . [17] M. Jesse, D. Jannach, Digital nudging with recommender systems: Survey and future directions, Computers in Human Behavior Reports 3 (2021) 100052. [18] R. Ben Salem, E. Aïmeur, H. Hage, A nudge-based recommender system towards responsible online socializing, in: Proceedings of the Workshop on Online Misinformation- and HarmAware Recommender Systems (OHARS 2020), Virtual Event, Brazil, 2020. [19] E. Duriakova, E. Z. Tragos, B. Smyth, N. Hurley, F. J. Peña, P. Symeonidis, J. Geraci, A. Lawlor, PDMFRec: A decentralised matrix factorisation with tunable user-centric privacy, in: Proceedings of the 13th ACM Conference on Recommender Systems (RecSys ’19), ACM, Copenhagen, Denmark, 2019, pp. 457–461. [20] D. Wilkinson, M. Namara, K. Badillo-Urquiola, P. J. Wisniewski, B. P. Knijnenburg, X. Page, E. Toch, J. Romano-Bergstrom, Moving beyond a ”one-size fits all”: Exploring individual diferences in privacy, in: CHI Conference on Human Factors in Computing Systems, ACM, Montreal, Canada, 2018, pp. 1–8. [21] P. Story, D. Smullen, A. Acquisti, L. F. Cranor, N. Sadeh, F. Schaub, From intent to action: Nudging users towards secure mobile payments, in: Symposium on Usable Privacy and Security (SOUPS), 2020, pp. 379–415. [22] T. Khazaei, L. Xiao, R. E. Mercer, A. Khan, Understanding privacy dichotomy in Twitter, in: Proceedings of the 29th on Hypertext and Social Media (HT ’18), ACM, Baltimore, USA, 2018, pp. 156–164. [23] K. Ghazinour, S. Matwin, M. Sokolova, YourPrivacyProtector: A recommender system for privacy settings in social networks, International Journal of Security, Privacy and Trust Management 2 (2013) 11–25. [24] L. Li, T. Sun, T. Li, Personal social screen–a dynamic privacy assignment system for social sharing in complex social object networks, in: IEEE Third International Conference on Privacy, Security, Risk and Trust and IEEE Third International Conference on Social Computing, 2011, pp. 1403–1408. [25] G. Rasch, Studies in mathematical psychology: I. Probabilistic models for some intelligence and attainment tests, Nielsen & Lydiche, 1960. [26] H. Schäfer, M. C. Willemsen, Rasch-based tailored goals for nutrition assistance systems, in: Proceedings of the 24th International Conference on Intelligent User Interfaces (IUI ’19), ACM, Marina del Ray, USA, 2019, pp. 18–29. [27] A. Starke, The efectiveness of advice solicitation and social peers in an energy recommender system, in: Workshop on Interfaces and Human Decision Making for Recommender Systems (IntRS 2019), Copenhagen, Denmark, 2019, pp. 65–71. [28] B. P. Knijnenburg, A user-tailored approach to privacy decision support, Ph.D. thesis,
University of California, Irvine, 2015. [29] E. Aïmeur, Z. Sahnoune, Privacy, trust, and manipulation in online relationships, Journal of Technology in Human Services 38 (2020) 159–183. [30] D. Andrich, Rasch Models for Measurement (Quantitative Applications in the Social
Sciences), Sage Publications, 1988. [31] [Online], https://www.winsteps.com/winsteps.htm, [Accessed 2021/07/29]. [32] R. Altman, D. A. Taylor, Social penetration: the development of interpersonal relationships, 1973. [33] [Online], https://www.mturk.com/, [Accessed 2021/07/30]. [34] [Online], https://www.limesurvey.org/, [Accessed 2021/08/01]. [35] L. Yu, S. M. Motipalli, D. Lee, P. Liu, H. Xu, Q. Liu, J. Tan, B. Luo, My friend leaks my privacy: Modeling and analyzing privacy in social networks, in: Proceedings of the 23nd ACM on Symposium on Access Control Models and Technologies (SACMAT ’18), ACM, Indianapolis, USA, 2018, pp. 93–104. [36] A. Hamoud, E. Aïmeur, Handling user-oriented cyber-attacks: STRIM, a user-based security training model, Frontiers in Computer Science 2 (2020) 25. [37] B. Knijnenburg, M. Willemsen, Z. Gantner, H. Soncu, C. Newell, Explaining the user experience of recommender systems, User Modeling and User-Adapted Interaction 22 (2012) 441–504. [38] J. M. Such, N. Criado, Multiparty privacy in social media, Communications of the ACM 61 (2018) 74–81.