Legally compliant personalised prioritisation of privacy policy information shows no effect on user engagement, comprehension, or workload

Bibliographic Data

ID21451961
AuthorsMeihe Xu (Maastricht University, Maastricht, corresponding author), Jannis Strecker-Bischoff (University of St.Gallen), Clement Guitton (0000-0003-2009-9047, University of St.Gallen), Kenan Bektaş (0000-0003-2937-0542, University of St.Gallen), Aurelia Tamò-Larrieux (University of Lausanne, Lausanne), Simon Mayer (0000-0001-6367-3454, University of St.Gallen)
Year2026
Pages1-25
Publication date2026-06-29
Open AccessYes
TypeARTICLE
VenueBehaviour and Information Technology (JOURNAL)
Journal identifiersISSN: 0144-929X • E-ISSN: 1362-3001
PublisherInforma UK Limited (PUBLISHER • GB)
DOI10.1080/0144929x.2026.2692098
OpenAlexW7166565881
LanguageEN
References cited93

Privacy policies function as both legal documents and information sources for users, but their length and complexity often discourage engagement. In this paper, we investigate whether a personalised approach can address this issue by prioritising information that concerns individual users most while maintaining a policy’s legal compliance on disclosure. We first explored whether personal characteristics can be used to predict a person’s most concerned category and, hence, serve as a baseline for personalisation. We then conducted an eye-tracking experiment and interviews (n = 30) to understand the effectiveness of personalised reordering of privacy policies. In the interviews, many participants perceived personalised reordering as helpful, although others raised concerns about the invasion of privacy through this personalisation. The eye-tracking results indicate that personalised reordering leads to higher engagement for the first few sentences of a privacy policy. Based on our findings, we present design recommendations for creating legally compliant forms of privacy disclosures that encourage user engagement as well as discussions and implications on privacy disclosure compliance

Confidentiality · Information privacy · Information system · Information technology · Patient privacy · Privacy policy · Task (project management) · Workload · Behavioral Health and Interventions · Ethics and Social Impacts of AI · Privacy, Security, and Data Protection

Tools

Open DOIOpen Access