A User-Centric Approach to Usable Privacy for IoT Trigger-Action Platforms

Licentiate thesis, 2025

This licentiate thesis analyzes the diversity of Internet of Things (IoT) Trigger-Action Platforms (TAPs) users' privacy concerns and preferences for proposing privacy profiles as a basis for usable privacy management. IoT TAPs host applications created by users or service providers based on automated interactions between IoT devices and online services. Despite the benefits of TAPs, their automation capabilities raise privacy concerns, as they necessitate the collection and sharing of personal data. The research presented in this thesis is the first step for a human-centred design for a usable privacy permission system for IoT TAPs.

The research, grounded in a triangulation approach, combines qualitative insights from focus groups with a large-scale quantitative survey (N=301) and expert reviews. Initial focus groups explored user-defined privacy factors concerning TAPs, revealing concerns, especially regarding transparency, control, confidentiality and trust. These qualitative findings were then used to find differences and similarities between IoT TAP and general IoT for investigating specific privacy factors for IoT TAPs that go beyond those that users have for general IoT, such as their reliance on automation and the integration of trigger-action functionalities. Second, these findings provided input for the development and validation of a comprehensive questionnaire to measure users' privacy concerns and data sharing preferences in various TAP scenarios. The quantitative study based on the questionnaire identified three clusters: High Privacy, Medium Privacy, and Basic Privacy which were each characterized by data sharing preferences. This clustering forms the basis for proposing privacy profiles that can guide the design of more usable privacy management systems for TAPs. It supports a context-specific approach to privacy management.
The three studies provide directions to a recommendation system for enhancing privacy within the evolving context of IoT TAPs, towards personalized privacy assistants.