CHI 2005 �� PAPERS: Privacy 1 April 2���7 �� Portland, Oregon, USA Location Disclosure to Social Relations: Why, When, & What People Want to Share Sunny Consolvo, Ian E. Smith, Tara Matthews, Anthony LaMarca, Jason Tabert, and Pauline Powledge Intel Research Seattle 1100 NE 45th Street, 6th Floor, Seattle, WA 98105 [sunny.consolvo, ian.e.smith, anthony.lamarca, pauline.s.powledge]@intel.com, tmatthews@cs.berkeley.edu, jrtabert@u.washington.edu ABSTRACT Advances in location-enhanced technology are making it easier for us to be located by others. These new technologies present a difficult privacy tradeoff, as disclosing one���s location to another person or service could be risky, yet valuable. To explore whether and what users are willing to disclose about their location to social relations, we conducted a three-phased formative study. Our results show that the most important factors were who was requesting, why the requester wanted the participant���s location, and what level of detail would be most useful to the requester. After determining these, participants were typically willing to disclose either the most useful detail or nothing about their location. From our findings, we reflect on the decision process for location disclosure. With these results, we hope to influence the design of future location- enhanced applications and services. ACM Classification Keywords H.5.3. [Information Interfaces and Presentation]: Group and Organization Interfaces ��� evaluation/methodology, computer-supported cooperative work H.5.2. [Information Interfaces and Presentation]: User Interfaces ��� evaluation/methodology, user-centered design. Author Keywords Experience sampling, privacy, location-enhanced computing, ubiquitous computing, privacy classification, social relations INTRODUCTION Imagine that it is a Saturday afternoon in the not too distant future and your boss sends a request for your location to your mobile phone. Or perhaps the request is from your spouse and you are at his favorite store purchasing a gift for him. How should you (or your phone) respond? Advances in location-enhanced technology are making it easier for us to be located by others. Services such as OnStar���s Driving Directions, mMode���s Find Things or People Nearby, and Enhanced 911 have already brought this technology to automobiles, mobile phones, and personal digital assistants. These new technologies present a difficult privacy tradeoff, as disclosing one���s location to another person or service could be risky, yet valuable. Recent investigations in location-enhanced technology have focused on software infrastructures for managing this disclosure [10,12], however little work has explored how users conceive of this disclosure or would disclose in the actual situation when they receive a request. Accordingly, in an effort to influence the design of location-enhanced technologies, we are investigating whether and what users are willing to disclose about their current location to people they know. For example, when users are willing to disclose something about their location, do they want to disclose the exact address, a generic name for the place (e.g., ���home��� or ���work���), the name of the neighborhood, city, or something else? What helps users decide what to disclose? Who is requesting? Where they are when they receive a request? What they are doing? How they feel? To explore this, we conducted a three-phased formative study with 16 non-technical participants. We employed various techniques, both in-lab and in situ, to uncover user concerns: two weeks of Experience Sampling where participants received hypothetical requests from people they knew, a nightly voicemail diary study, questionnaires, a privacy classification survey, exercises, and interviews. The most notable results are that: ��� participants want to disclose what they think would be useful to the requester or deny the request. We saw no evidence of participants intentionally blurring their location, i.e., disclosing something vague, to protect their privacy, and Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. CHI 2005, April 2���7, 2005, Portland, Oregon, USA. Copyright 2005 ACM 1-58113-998-5/05/0004���$5.00. 81

CHI 2005 �� PAPERS: Privacy 1 April 2���7 �� Portland, Oregon, USA ��� participants��� privacy classification, as determined by the Westin/Harris Privacy Segmentation Model [18], was not a good predictor of how they would respond to requests for their location from social relations. From the results, we reflect on the decision process participants went through to determine whether and what to disclose about their location to social relations. Understanding this decision process and other factors that go into their decisions could inspire the design of better location-enhanced applications and services. In this paper, we begin by describing the study design, including details of the three phases and the participant profiles. We follow with a discussion of our key findings. We then reflect on the participants��� decision process for disclosing location to social relations, discuss related work, and conclude. STUDY DESIGN To help us understand what is important to users when choosing whether and what to disclose about their current location to their social relations, we conducted a three- phased study in July 2004 with 16 non-technical participants in the Seattle area. In Phase 1, we investigated the structure of participants��� social networks and how they thought they would use location-enhanced computing. In Phase 2, participants responded in situ to hypothetical requests for their location from their social relations over a 2-week period, and in Phase 3, participants reflected on their experiences in the study and their attitudes about location-enhanced computing. In this section, we describe each phase, the two location-enhanced application ideas that provided context for our explorations, and the profiles of the study participants. Methodology for Phases 1-3 PHASE 1. Phase 1 familiarized us with the participants��� backgrounds, helped us understand the structure of their social networks, and allowed us to explore what they thought would be important in deciding whether and what to disclose about their location to social relations. It was conducted in our lab, one participant at a time1. Prior to arriving for their first session, participants completed a demographic questionnaire that included a privacy classification survey: the Westin/Harris Privacy Segmentation Model [18], sometimes called the ���Westin survey.��� Upon arriving for Phase 1, participants signed a release form and completed exercises designed to: ��� identify the people in and structure of their social network and create a ���buddy list��� of people with whom they might want to exchange location information, 1 There were two sessions of two participants each. ��� uncover the factors they believed would be important in deciding whether and what to disclose to specific people on their buddy list, and ��� gather their initial thoughts on two proposed location- enhanced applications. The names used for the hypothetical requests came from the ���buddy list��� that participants created of up to 17 people2 from their social networks. We required certain social relations to be on the ���buddy list��� to explore commonalities in the way participants treated members of the same social group (e.g., family, co-workers, etc.). The list included: ��� spouse/significant other, ��� two family members of the participant���s choosing, ��� manager, ��� two co-workers of the participant���s choosing, and ��� up to 11 others from the participant���s social network with whom he would want to participate in the single- request application described below. Participants included an average of 14 people on this list, (the range was 8-17). Phase 1 sessions lasted from 90-120 minutes each. Data was collected in the form of evaluator notes and materials completed by the participants. PHASE 2. In Phase 2, Experience Sampling Method (ESM) [4,6] was used to capture participant responses to in situ, hypothetical requests for their location from people on the buddy lists created in Phase 1. Participants also answered a variety of ESM questions about their context at the time of each request. It was administered on Palm m500s that we provided, using software [13] for running ESM on PalmOS devices. During ESM, participants received 10 randomly timed questionnaires everyday for two weeks from 9am-9pm on weekdays and 10am-10pm on weekends. Each questionnaire was composed of several questions and took approximately 2-3 minutes to complete. Questionnaires included questions about: ��� context, e.g., Where are you? What are you doing? With whom are you? (Figure 1) and ��� what the participant would want to disclose about his location based on a hypothetical request from a social relation on his buddy list. The questionnaires were customized to include people, places, activities, and other contexts that were meaningful to each participant. For example, instead of asking what a participant would be willing to disclose to a request from a 2 We chose 17 because it is within the range of active social relations for Westerners (typical range is 10-30 [14]), allowed for a sufficient number of hypothetical requests from each buddy list member, and kept the time to fill out the Phase 2 ESM questionnaires manageable for participants. 82