Legally compliant personalised prioritisation of privacy policy information shows no effect on user engagement, comprehension, or workload

Privacy policies function as both legal documents and information sources for users, but their length and complexity often discourage engagement. In this paper, we investigate whether a personalised approach can address this issue by prioritising information that concerns individual users most while maintaining a policy’s legal compliance on disclosure. We first explored whether personal characteristics can be used to predict a person’s most concerned category and, hence, serve as a baseline for personalisation. We then conducted an eye-tracking experiment and interviews (n = 30) to understand the effectiveness of personalised reordering of privacy policies. In the interviews, many participants perceived personalised reordering as helpful, although others raised concerns about the invasion of privacy through this personalisation. The eye-tracking results indicate that personalised reordering leads to higher engagement for the first few sentences of a privacy policy. Based on our findings, we present design recommendations for creating legally compliant forms of privacy disclosures that encourage user engagement as well as discussions and implications on privacy disclosure compliance.