start	end	text
2060	7980	So welcome everyone to our conversation about consumer privacy, usable privacy,
7980	13860	how do we actually build privacy for consumers in a way that they can actually exercise their
13860	18680	data rights. Unfortunately, one of the trends that we're seeing as laws and regulations become
18680	25220	more complex, it's increasingly difficult for companies to provide the ability for consumers
25220	29820	to actually exercise those rights. And so one of the things that we are concerned about as
29820	34800	privacy professionals is making sure that consumers actually have the ability to exercise
34800	39960	those rights. Otherwise, they really don't get the full protections that are granted to them
39960	46160	under the law, depending on where they live. By way of introduction, my name is Melanie Ensign.
46160	52680	I am the founder and CEO of a new company called Discernible. It's a communications firm dedicated
52680	59140	specifically to security, privacy, and risk organizations. And I am very excited to be joined
59140	66360	by a number of esteemed colleagues today who have a lot of experience, not just in security and
66360	74080	privacy, but in building tools and in being part of the process for building and thinking about
74080	81920	how do we make privacy a user-centric experience. So a couple of expectations setting things right
81920	88000	off the front. None of us here are lawyers. Nothing we say is going to be legal advice.
88000	95300	We're also not legal experts. And so we're not going to debate the merit of the law or try to
95300	102580	interpret the law. But we are on the receiving end of these legal obligations. And we do have
102580	109220	the professional responsibility to advise or lead the building of their subsequent products and tools
109220	115080	for consumers so that they can exercise those rights. So just a disclaimer up front that none
115080	122060	of us are lawyers. Troll us if you like. There'll be plenty of lawyers in the comment section who
122060	127560	can actually provide the legal guidance that you're looking for. So with that said, I'm going
127560	131940	to ask each of the panelists to introduce themselves and tell us a little bit about
131940	137580	their experience in privacy and specifically their perspective and worldview in terms of how
137580	142740	they approach this particular challenge given their function and expertise. So Megan, let's
142740	150240	start with you. Sure. No trolling, please. I beg you. My name is Megan DeBlois. Super excited
150240	154340	to be on this panel. I'm an information security advisor and technologist over at
154340	161800	Internews. Internews itself is an international non-profit. We work on media development
161800	168160	really focused on empowering local information sources worldwide while connecting and giving
168160	174020	people voice. So that's kind of the area that I tend to focus in. But at the organization,
174020	180000	I wear two hats. So internally, I help improve our information security processes, procedures,
180000	187040	and practices org-wide. And externally, I work with a pretty diverse group of civil society
187040	193860	folks to help improve them on their information security needs from organizational security
193860	199880	assessments to risk reduction strategy design and development to threat analysis and sharing.
200340	206000	A big part of that and a big part of our approach at Internews when it comes to privacy and security
206420	210820	is really trying to keep our users at the center, whether that's going to be an organization or
210820	215960	civil society group that we're working with or the developer communities in the open source world who
215960	220620	were trying to build capacity around their abilities in creating these really important
220620	227040	security and privacy products for really amazing communities, but often who are targeted.
228080	229740	Yeah, and that's me.
231580	237800	All right. Hi, everybody. I'm Ben Brook, the co-founder and CEO of Transcend. So Transcend
237800	243560	is a data privacy infrastructure company. And what we do is we enable other companies to honor their
243560	249320	users' data rights. So users can't really exercise their data rights today, even though it is their
249320	255600	legal right. And you can go to any major company's privacy policy and see that for yourself. So we've
255600	262400	made a series of breakthroughs in tech that enables any company to give their users data rights in a
262400	267500	way that's completely on demand and you should have it in seconds. So what we're doing is we're
267720	273640	replacing a lot of broken internal processes that are both resulting in noncompliance and
273640	280740	and that have been an issue in terms of user experience. So if we're successful, the hope is
280740	286160	that we're going to make it easier for everybody to have the ability to control their personal data.
287940	294760	Hi, everyone. I'm Marietza Johnson. I'm a UX researcher at Google Research. And for about
294760	299360	the past 10-ish years, I've been really focused on this question of how do we make it easy for
299360	304160	people to manage their data and the security and privacy decisions that they're faced with
304160	310460	in their daily lives with the technology that they use. This focus has taken me to a bunch of
310460	316880	different kind of places where I can exercise those interests. Right now I'm at Google Research
316880	322660	working on a tool for what we're calling meaningful control over data in a distributed system.
322880	329120	I tweet a lot. You can see a project description on Twitter if you're interested in that. I think
329120	335860	it's super fun. Also, I used to be on Facebook as a member of their privacy product review process
335860	342020	and have also done some academic work just doing some research on looking at how do people
342020	348360	understand this stuff, attitudes, behaviors, comprehensibility. So glad to be here.
350120	357560	I'm Zach. I lead the global privacy product team at Uber. I focus on building user-facing features
358280	365980	that build trust with our users. I also work on developing systems and services in response to
365980	372660	new and emerging laws to allow users to exercise their rights over those laws.
372680	380340	And the last thing that I'll describe is I guess a little bit different than your traditional
380340	386200	product role because I'm also charged with consulting and reviewing the product launches
386200	392380	of other teams across Uber that pertain to privacy. And that can take on many different
392380	400400	forms from early in the idea phase to just before launch to post-launch and remediation
400400	408680	and anything under that sun. So that's me. Awesome. Thank you so much for being here and
408680	417740	lending us your expertise today. So let's start with operationalizing privacy and in the steps
417740	424580	that actually come after these protections are codified in law. So once a law or new regulation
424580	431160	is passed, particularly those that are then going to require some additional engineering or product
431160	437960	development, there's a different type of skill set that's needed to work alongside our legal
437960	444560	colleagues in order to actually bring that to life. So policy and regulations is one piece of
444560	449320	it. But especially now with the new types of regulations we're seeing, there are very real
449320	455920	technical requirements and changes that have to happen in order for companies to comply with those
455920	461620	new obligations. And I want us to dive a little bit more into what that actually looks like in
461620	468420	practice in terms of these different functions working together. So Ben and Zach, let's start
468420	474980	with you. Based on your experience, and Ben, I know that you're working externally and helping
474980	481440	these companies kind of repair or build some of these broken systems. And Zach, you're obviously
481440	487320	in-house at Uber. What does the typical process look like from the perspective of those internal
487320	494200	privacy product and engineering teams once a protection has been codified in law or in a new
494200	503220	regulatory standard? Sure. So when a new privacy law has been encoded, there's usually a period
503220	507960	before it comes into an effect, which means there's a huge surge of preparatory work inside
508100	512800	a business. And that can include everything from updating contracts and policies, doing risk
512800	518680	assessments, and building frameworks for the company to operate under. And then after the
518680	524480	laws come into effect, there's a few new processes. So of course, as Zach alluded to, new product lines,
524480	528460	you have to make sure that you're applying those frameworks. But what's really unique about these
528460	534120	modern privacy laws like GDPR and CCPA is that there's also this new set of indefinitely recurring
534120	540680	processes around user data rights. And so these are things like the right of access to your data
540680	546960	and the right to be forgotten. So that means companies now have a consistent stream of
546960	552520	requests coming in, typically via support channels. And so that means the support and the legal teams
552520	559260	are now receiving these requests and working to manually authenticate users over an email
559260	564760	conversation. You can imagine how that would be at high risk to social engineering, where users
564760	571540	are making claims to accounts, asking to erase that account or to get access to all of the data
571540	578220	in that account. And then after that's been received, there's also an incredible manual
578220	583680	process that happens inside many companies today, where it's basically the entire org
584380	591020	is going across dozens, if not hundreds, of their data systems and their vendors to go and scrub
591020	595700	that data. And so that ends up being almost every part of the company. And whether it's sales and
595700	601860	marketing or support or analytics, people are logging into their respective tools and scrubbing
601860	609320	data or exporting and emailing it over to legal. And so in short, there's an incredible
609320	615100	amount of very cumbersome and manual processes happening today. And it's sort of like
615100	620560	this temporary solution. It seems like we're in a lot of businesses today. And again,
620560	624070	these processes are still at high risk of social engineering.
625380	631640	Yeah, so I'll jump in there. I think, as has been described, when you're just
631640	639000	starting out and you perhaps don't have that much of an established privacy team, these efforts can
639000	644840	be pretty unstructured and ad hoc. And there's a lot of manual efforts that take place
644840	648520	throughout your company to try to comply with these new laws.
648660	656780	At Uber, we've been working on this for five plus years, if not more, at least as long as
656780	663960	I've been there. And what I would say is to get to the best outcome is definitely a collaborative
663960	672840	process across legal product and engineering. So the way it works for us when a new law comes
672840	680020	into effect, as Ben said, our legal team takes some time to digest that law. And depending on
680020	686160	how complex it is, it could be something as large as GDPR, or one article that's something very
686160	694480	small in a single state or even region that we need to respond to. So that can take anywhere
694480	702680	from a couple of weeks to several months. But eventually, the legal team will get back to us
703350	709980	with a set of legal requirements. My team then, on the product side, reviews those
710600	716190	requirements to convert them into a PRD, or a product requirements document.
716540	723580	In order to do that, we assess the requirements that we receive in kind of three areas
724440	730980	to make sure that we're going to implement and launch something that complies with the law,
730980	738840	but that is also practical. So one of the things we consider is the implications for the user
738840	745040	experience of the requirements that have been shared over with us. Another thing is the feasibility
745040	751400	from an engineering perspective of what's been shared over. And the other thing is the impact
751400	758620	to the business. You know, a lot of times, new and emerging privacy laws might be at odds
758620	764860	with what your team wants to do or your company wants to do on the marketing side, for instance.
765000	772060	If you're providing users with more controls to opt out of ad targeting or something like that.
772060	777460	And so, you know, we are trying to do these things in the right way in compliance with the law,
777460	785300	but also optimize to fit our business, as I said. So once we've kind of rationalized the requirements
785300	790340	we've received and we then have a follow-up conversation with our legal team to make sure
790340	795560	that they are paying with the direction that we're recommending and the timeline we've set forth
795560	802560	for which we could deliver on, we will define a set of metrics or key performance indicators.
802600	811260	And these usually serve the purpose of mitigating the risk of being in non-compliance.
811260	818780	We will design our metrics in that sense, in particular, if it's something to do with
818780	826320	complying with a new law. And then finally, we will have a design review with stakeholders across
826320	834700	Uber that could be impacted by the changes that we're going to make. And those stakeholders will
834700	840340	be from legal, from policy, from other engineering and product teams. And we'll walk through exactly
840340	845800	what's going to change or be introduced into the experience, how it's going to work end-to-end,
845800	851920	and we'll get some feedback. And then we'll be all aligned across the company on moving forward.
852700	855900	And then from there, we just start building.
856240	862560	So that's kind of how it works in-house at a little bit more of a mature privacy operation.
863760	870500	Awesome. Thanks. Megan and Marta, I want to ask you, does the process look any different
870500	876320	from the perspective of end-users or even developers in the field that you're working
876320	883280	with? We've heard from Ben and Zach a little bit, like the chaos-to-order evolution that's
883280	889480	happening inside companies. What does it look like externally to those who are either the
889480	895500	users of these services or perhaps other developers who aren't in the position of
895500	905540	having these more mature privacy organizations? Sure. So if I can go first. Again, I think it's
905540	912000	important to kind of frame up my experiences and observations here. It's really more tailored to
912680	918040	leading and working on open-source projects and working with at-risk communities.
919480	923460	In the past life, I led a project that was really, really aiming at building the capacity
923460	927600	of developers and creating feedback loops among their users, which tended to be more
927600	934400	at-risk communities. So that's kind of where I'm coming from with my input and observation.
934400	939080	From the developer side of things, again, coming from open-source landia,
939080	946240	where you have very few resources, including human capacity, this looks dramatically different.
947000	952380	The vast majority of security and privacy tool developers who I've worked with are super
952380	956280	concerned about privacy. Naturally, they're creating security and privacy tools specifically
956280	964380	to give users more privacy online. And because of this, we see that a lot of them try really hard
964380	969780	to capture the least amount of data as possible. So most of them have no trackers. Most of them
969780	981280	intentionally do not collect user data at a very, very basic level. I think a lot of smaller
982100	988300	businesses, if you're operating with European users, I think that put definitely a lot of strain
988300	995300	on those communities who have very little capacity to begin with. But at the end of the day,
995300	1001600	I think the general thought process around privacy in those communities is sort of it's an all or
1001600	1009680	nothing. I'm either going to... in the open-source community, in my observation is that they just
1009680	1015420	really don't want to collect anything. And that impacts them, not just from a UX perspective,
1015420	1020160	because they're not able to make really important insights to improve their tools and roadmap to
1021260	1026320	actually make insightful decisions on the usability front. And I don't think it's an
1026320	1032080	all or nothing game. One of the projects that we've been supporting is a project by the Guardian
1032080	1036940	Project who has created an amazing and is continuing to create an amazing tool for
1036940	1043540	Android applications called Clean Insights to be more plug-and-playable with these open-source
1043540	1047640	tools or other products that want to be more privacy-respecting in the analytics that they're
1047640	1054140	capturing. I think more things like this will be really important as more legislation and more
1054140	1061320	regulation starts to happen around the globe. From an end-user perspective, I think that
1061900	1065580	for me, and I don't think this is really specific to civil society, I think there's
1065580	1069500	just still a really large gap in user understanding of their digital rights.
1069680	1075460	So GDPR happened, I would say, you know, the vast majority of folks around the globe probably
1075460	1082080	didn't know exactly what that means for them as a user. And the before and after that they
1082080	1086380	really saw was they got a lot of emails in their inboxes saying privacy policies were changing for
1086540	1091800	a lot of different companies. And that's sort of like a very end-user perspective of, you know,
1091800	1098120	not truly knowing exactly how to engage with or activate these new rights that they
1098120	1104820	might have. I think the other really important thing to note is that for a lot of at-risk communities
1104820	1111240	or targeted groups that are using products, their calculus isn't necessarily privacy
1112000	1117060	from, you know, companies is at the top. They're really threat modeling and trying to understand,
1117060	1123140	you know, what it is I'm trying to protect here. And, you know, they're building
1123140	1128020	on this trade-off between sort of, do I really need this really important security
1128740	1134060	encryption protocol being used in this particular product versus a more privacy
1135000	1143140	preserving application that, you know, isn't going to be used as much in my network or it's difficult
1144720	1152040	to use. So it's more of a threat modeling challenge rather than a sort of privacy calculation.
1153020	1158840	And our approach at Internet News has been really pragmatic in trying to, you know,
1158840	1164220	get the individual, get the community, get the organization to be more secure today than they
1164220	1169960	were tomorrow. And that's the ultimate priority from an end-user's perspective.
1172040	1175800	I love that as a build into how I would be thinking about it because I feel like
1175800	1180840	product teams need to really be thinking about the threat model and how the different groups
1180840	1186940	they aim to serve may have different needs and basically taking care of, you know,
1186940	1192280	as much as they can. But then inevitably we do get into situations where individuals are making
1192280	1198540	their own decisions about, you know, which setting to use, which control do I consent to this?
1198840	1203000	And to me, I always think about it, I want to start from the human-centered perspective.
1203360	1207820	Like, we can't assume that people are reading privacy policies. We can't assume that people
1207820	1212100	are seeing all the great material that we put out when we're promoting a new privacy feature
1212100	1216400	or a new security feature. So then if you're starting from the point of view of the thing
1216400	1222800	that they see is the UI and the user experience, what is that? How are they using the tool?
1222880	1228700	So, of course, we're always mindful. You're diligent in implementing controls that respect
1228700	1233840	the regulations and meet the regulations. I feel like that's one way to look at it. But then if
1233840	1239900	jump over to the human-centered point of view, you start to ask different questions. So then for
1239900	1245520	the context that you're building a product or a service, how is it being used? Like, who's using
1245520	1249900	it? How are they using it? What are their expectations? What's their attitude toward the
1249900	1256040	data use? And how do you design an experience that matches that as best as you can? I love the way,
1256040	1259980	Megan, that you alluded to kind of the difficulties that we have right now where
1260540	1266340	in some situations, it's quite a complicated system. How do you communicate succinctly and
1266780	1270560	comprehensively to somebody about all the ways in which data is collected and used?
1271520	1276760	Of course, people, I feel like we constantly hear things like, you know, oh, people don't care. If
1276760	1280680	they cared, they wouldn't do this. If they cared, they wouldn't do that. But privacy and security
1280680	1285960	aren't the top level concern. Just because they're not your top priority doesn't mean you don't care.
1285960	1290540	So maybe it's you care more about something else right now, or maybe you'll care more about that
1290540	1294920	at a later point in time. So then how do you kind of take all these different perspectives and put
1294920	1300100	it into a UX that makes sense? So I'd say that's where my role comes in. So I'm always interested
1300100	1304540	in, you know, how can we take a human-centered approach? How can we ask these questions about
1304540	1310540	what do people need, and then design a user research program around evaluating whether or
1310540	1316980	not we've met the goals there. So it's building on top of regulation, hopefully always going well
1316980	1323120	beyond, but definitely something that, you know, is a constant work in progress.
1324380	1328420	Yeah, one of the things that I've often advised companies that I've been working with is
1328420	1336540	you don't get credit for hitting the legal minimum, you know, and truthfully, you're,
1336540	1340620	you know, Marta, I think you said it best, like the people that you're serving are actually
1340620	1345760	expecting more from you because they're expecting that you know better than even the lawmakers in
1345760	1351160	terms of how to build better products and better experiences. So I want to shift gears
1351820	1357100	just briefly to take a moment to talk about privacy policies and kind of why they're so
1357100	1363420	unpopular and seem to be a pretty focused target for a lot of public scrutiny, which we could
1363420	1372080	debate all day whether or not that is deserved or not. But I think the problematic aspects of
1372080	1378720	privacy policies are often interpreted publicly as, you know, a company not caring about privacy
1378720	1385240	or not wanting to inform consumers. And, you know, we've all worked on this challenge for years.
1385240	1390580	We know that that's not true. We know that the problems that exist in privacy policies are not
1390580	1397300	reflective of a company's actual commitment and investment level in privacy. And even
1397300	1402840	companies with strong privacy commitments and protections have difficulty creating policies
1403510	1411760	that consumers can easily access and understand. And so I want to ask each of you, and Marta,
1411760	1416940	you know, I'd love to start with your thoughts just in terms of what is the actual intent of
1416940	1422720	these policies? And should we still be relying on this type of documentation to inform and educate
1422720	1430680	consumers about the data practices of the different businesses and services that they use? I've even
1430680	1437180	heard from a couple of folks in the EU that, you know, terms of service and privacy policies
1437640	1443640	are no longer going to be considered sufficient in terms of informed consent because of how
1443640	1450320	complicated they are for consumers to understand. I think it is a valid argument that, you know,
1450320	1456300	this very long legal document cannot... nobody realistically expects that consumers are reading
1456300	1461700	that and understanding it and processing what that means for them. So obviously, again, since
1461700	1466340	none of us are lawyers, without getting into all the legal definitions of consent and informed
1466340	1472400	consent and all of that, what are your thoughts in terms of how we could, you know, either improve
1472400	1478380	policies or perhaps look at other channels and avenues through which to educate consumers about
1478380	1484720	data practices as well as their rights? Okay, so from my previous answer, you won't be surprised
1484720	1490200	to hear that I think you could do a lot more than a privacy policy. And there's a big opportunity to
1490780	1496280	do a better job of both crafting, living, and communicating your privacy narrative. And not
1496280	1502380	just a privacy narrative, but like, how data is used. Like, how is data collected? How is it used?
1502380	1508760	How is it stored? And how are you deleting it? I think that we're seeing a lot of progress in this
1508760	1515260	area. At Google, I think it was about a year ago, we had this new feature, so private set
1515260	1520660	intersection, which for the cryptography community is an amazing, cool, sexy result, and they want to
1520660	1525380	be talking about it. But usually you'd see that in an academic paper, and it would go to the academic
1525380	1531200	community, folks would talk about it, and it'd be a neat talking point. I was super excited to see
1531200	1539020	that this one innovation had basically like a full-com strategy. So it was an academic paper,
1539020	1545760	it was a blog post, it was a kind of infographic diagram to explain what it meant, plus a YouTube
1545760	1552500	video. And that to me was great. It's basically, who's the audience? Like, who are the audiences
1552500	1559060	who need to see this information and understand it? And how do we cater it to them? So I would
1559060	1566380	love to see a lot more like that. I mean, like I said, I've worked in privacy and use human-centered
1566380	1573780	privacy for a long time, and I don't read privacy policies. Like, I have better things to do than
1573780	1580300	read a privacy policy. I never read them. And like, I've read a few because I'm supposed to,
1580300	1585460	because I should know what they look like. But I have better things to do. So I'm all for
1585460	1592100	better ways of communicating. I feel like I have like a habit of also wanting to figure out how
1592100	1596840	to teach these concepts. And I think taking more of an education approach, taking the burden of
1597700	1604560	explaining complicated topics is more of... it's what we should be doing as the creators of these
1604560	1609510	systems. So I think there's a lot of room for improvement.
1611640	1619320	Yeah, I agree with that. I think policies are... because they're legally required and
1619320	1624720	they're highly regulated, companies are incentivized to be as broad and non-committal
1624720	1630100	as possible in those privacy policies. So what you end up getting is these like long walls of
1630100	1639880	legal text. And effectively, you need a law degree to like decipher it properly. So if you're
1639880	1644240	thinking about compliance, and I think like one theme of this panel is that compliance is like
1644240	1649740	the bare minimum, but companies now should be thinking about trust as well and like how to
1649740	1658080	go past that bar. And policies just don't cut it because they are regulated like documents and
1658640	1664000	it's very hard to find a compromise within the privacy policy. You may be able to have a more
1664000	1668300	accessible policy, but at the end of the day, companies are indeed like incentivized to be
1668300	1674440	non-committal there. So I think, and this is something we think about a lot, is like how can
1674440	1683440	we help educate and inform users? How can we help our customers actually create a place where users
1683440	1689680	can go to understand the data practices of this company? What type of data specifically are they
1689680	1694640	collecting? How are they using that information? Who are they sharing it with, if anyone?
1695940	1702140	And then also, there's this shift now because historically, a lot of privacy law is around
1702140	1709380	disclosure. Modern privacy law, a lot of it is about choice as well. And so the choices should
1709380	1714000	be in a more interactive control panel. We are in the modern world. We don't need to use
1714000	1719660	documents only. We can also use things that are like actual user interfaces. And so when we're
1719660	1723980	talking about choice, we're often talking about control panels and ways to actually show users
1725220	1730260	that you had these choices and there are buttons you can click that will change how we operate
1730260	1735700	our platform and will have implications on your privacy. So there's a lot of exciting stuff that
1735700	1742880	we see there. And just generally sort of tailoring disclosures to the consumers.
1742880	1749640	Some people want to drill all the way deep and get a really granular idea of what the company
1749640	1755940	has. So being able to sort of layer information and let people sort of zoom in is really exciting
1755940	1763980	there. And then the other thing that we've been working on in this space is actually contextualizing
1764120	1772640	a disclosure by leveraging the right of access as well where when you say you collect this type
1772640	1778000	of information, you can actually show them a copy of that information because the user can click a
1778000	1782140	button that's going to let them download it anyway. So if you can be proactive and say here's
1782140	1788400	a specific example of like an analytics event that we would track about you, there's really
1788400	1793640	exciting like new ways of doing that. So yeah, I think companies can go really above and beyond
1793640	1799520	here. There's a lot of opportunity in this new sort of modern privacy world and a lot of
1799520	1806100	opportunity to start moving from just disclosure and compliance to increased choice and trust building.
1808270	1815130	Yeah, I'll just, you know, add to a different aspect of the challenge with the privacy policies.
1815130	1823350	As someone who used to own our sort of custom website that our privacy policy used to sit in,
1823350	1829710	I can say that like a lot of different folks contribute to writing that policy on the legal
1829710	1836150	side. So think of think of it like this lengthy novel that has many different authors who are
1836150	1841690	using words that nobody understands because they have to, you know, based on, you know, laws that
1841690	1847770	are like all over the world. And then communicating to, you know, engineers and product folks like
1847770	1855990	myself, the fact that like, we've got to deploy this in, you know, 30 different languages on
1855990	1862790	different dates because of different laws in these different markets. And we need specific appendages
1862790	1868810	for these five countries that are unique to certain regulations that have emerged there.
1868810	1875830	And by the way, in three months, there's going to be these two launches that are coming up that we
1875830	1880410	need to make an update to the policy for, but we're not ready to do that right now. And we've
1880410	1887130	got to work with, you know, you've got to work with your comms team on your strategy for letting
1887130	1892690	your customers know about all these changes in a way that isn't overwhelming. Because if you
1892690	1899690	if you get an in-app notification, an email, you know, like five times a year about a company's
1899690	1904370	privacy notice or privacy policy update, you're going to be scared. You're going to have a lot
1904370	1911110	of questions and be wondering, like, what that company is doing with your data. So I just want
1911110	1917670	to describe for folks, like, that art of, like, getting this right and appreciate that aspect of
1917670	1924170	it. But I also agree with what Maritza and Ben were saying. And, you know, what I add there is,
1924170	1929790	you know, the reality around these privacy policies is they're required, they're here to
1929790	1935970	stay, and they're going to get increasingly complex because of emerging laws around the
1935970	1943410	world. We already saw what happened with GDPR and CCPA. We have LGBT coming up. And that means
1944010	1950530	you do need, again, you do need a user-focused experience that's written in easy-to-understand
1950530	1955730	language that explains to users their rights and the controls and choices that are available
1955730	1961890	to them to exercise those rights. And I think that's a different place than your privacy policy.
1962390	1968790	It could be another website. It could be things that you do in-app. It could be, you know, norms
1968790	1974250	or best practices that you follow in all of your consent models whenever you're looking to collect
1974250	1982050	or make use of data in a different way. And it could also be thought about deeply with your UX
1982050	1987050	research team as part of the sign-up flow and unique things you might do there in terms of
1987050	1992770	even leveraging animations or video to explain, like, what's going to happen with your information
1992770	1998750	and what your choices are. So I think there's a lot of actually cool things you can do to explain
1998750	2005750	to users their rights and their roles available to them that go beyond the notice. And the last
2005750	2010270	thing I would add is you should definitely be doing research to make sure that you're focused
2010270	2017190	on, you know, what matters to your users the most as it pertains to the data that your company
2017850	2021490	collects and uses. It's certainly not a one-size-fits-all.
2022510	2029510	Huge plus one to that. Alice is so contextual and depends on your business, your customers.
2031890	2037110	Just to add on a little bit to the conversation, even though, again, I'm not building product
2037110	2042710	right now, I'm working on an organization, but from, again, looking at the end users, I think
2042710	2050310	it's truly unfair to ever expect end users to understand or comprehend a privacy policy at
2050310	2054670	scale. And I think we're kind of all in agreement there that it's not enough to have a privacy
2054670	2062270	policy. Sort of using the same metaphors that we use in training, you know, we say in security
2062270	2067690	education, if you have to provide a training for your tool, you're not going to scale that tool
2067690	2071350	like you would if you don't need a training. And that's the same thing in this instance. You're
2071350	2077890	not going to scale people engaging or activating these new rights that they have unless it's truly
2077890	2096940	like embedded in your product or get interested and actually take a look at what data that is
2096940	2101080	being collected and stored and how it's being stored. I think the other piece of this for me
2101080	2106640	is also transparency. Huge bend on what you were saying about building trust. I think
2106640	2112700	transparency is one way to build this trust, and we need a lot more of it. Understanding data
2112700	2118840	practices and the governance of data by company is a super important part of that, but shouldn't
2118840	2125100	be buried, I would argue, in a privacy policy. That should be more, you know, bubble that up
2125560	2130880	at a user level that a user would come across in their engagement with your product.
2133100	2139060	So, I want to move the discussion now into some of the specific usability challenges that we see
2139060	2147120	in the technical and in UX blockers that actually can prevent us from offering better accessibility
2147120	2156300	and usability for privacy enabling tools or even processes, right? So, I want to dig a little bit
2156300	2162880	deeper into some examples of difficult either compromises or tradeoffs, you know, that we've
2162880	2168180	made in our careers to either meet these legal obligations at the expense of user experience
2168180	2176660	accessibility or usability, as well as, you know, the limitations of UX research and testing and
2176660	2182580	where we might be able to grow in that area as well to make sure that we're not excluding,
2183080	2189660	you know, specific populations and groups of people so that everybody really can have access
2190180	2197180	to their data rights. So, Zach, let's start with you just in terms of what are some of those,
2197180	2203240	you know, specific usability challenges or some of the tradeoffs that you've seen in trying to
2203240	2206960	build a product that's both compliant with these regulations but also
2206960	2213900	easy to use so people can exercise their rights? Yeah, what that immediately makes me think of is
2214340	2220540	when we what we went through as a company with managing and navigating GDPR. So, when that
2220540	2228320	law came into effect, it was so large and so comprehensive and, you know, something we hadn't
2228320	2235620	seen before that we spent that entire year just heavily focused on complying with erasure and
2235620	2241700	different export kind of laws that were or articles that were part of that law and updating
2241700	2248280	our consent UI across all apps and services. And so, this meant there wasn't a whole lot of time
2248280	2256240	left after that for our team to spend on user-facing experiences. And I don't think that
2256240	2263580	was the intention at all. And the interesting thing is that as a team, we felt that we had
2263580	2270180	made a huge amount of progress for user privacy. And this is 2018 and according to the regulations,
2270180	2275600	but that our users couldn't necessarily see it. And we didn't necessarily feel comfortable,
2276280	2281820	you know, bragging about it or doing a whole lot of comms around it because we were required to
2281820	2289220	make a lot of these changes by law. So, it wasn't us, you know, going beyond expectations.
2289220	2295560	But we had this realization that ultimately if our users can't see the changes we're making
2296260	2304060	or if there are products that users won't take advantage of very often, it may not move the
2304060	2309660	needle on trust, right? Which has come up many times in this conversation. It may not move the
2309660	2316480	needle as much on trust as new user-facing controls or products that are really designed
2316480	2323240	to drive that trust home. So, for me, that's really the trade-off. And, you know, in any given
2323760	2331160	year, it's something that we actively think about. We want to make sure to comply and do our best to
2331160	2336780	comply with every new law that's coming out around the world. You know, we're a global company and
2336780	2343240	we'd like to think that we have, you know, good and always improving relationships with different
2343240	2349320	regulatory bodies around the world. But we also need to make sure that our roadmap consists of
2349320	2357920	enough things that are going to raise transparency, improve choice, and communicate to our users
2358600	2365240	how much that we value their privacy and want them to really understand it. So, that's what
2365240	2372610	I'd say the trade-off is. Megan, anything that you would want to add from your perspective?
2373750	2381350	Sure. So, very, again, not coming from a private sector background, I can't help but wonder what
2381350	2387430	types of incentives there are for companies to refine that user experience to activate, for users
2387430	2393310	to activate certain privacy rights. And so, I'm kind of super interested to hear about, from other
2393310	2401230	panelists, actually, to understand how companies are working through that whole flow and that
2401230	2406490	whole user experience. Because if you make that a blocker, you're not going to get, you know, people
2406490	2412890	activating in trying to, you know, put forward these particular rights that are now granted to
2412890	2420630	them, even if they're aware of it. I think, you know, understanding how much user testing is
2420630	2426790	actually going on there, it would be super interesting to me. I think from, again, from a
2427520	2434810	sort of trade-off point of view here, I think really understanding,
2434810	2442230	again, knowing your audience, knowing your users, and having real recipes to give to
2442230	2448150	the people building products on how to operationalize this sort of UX experience
2448150	2454970	when it comes to privacy, be it due to compliance or regulation reasons, or data protection reasons,
2455770	2463770	or, you know, other security privacy reasons that you might be trying to initiate at
2463770	2469230	your particular company. So, I super want to listen to some of the other perspectives.
2472340	2479060	So, from my perspective, one of, you know, I'm just like, I'm running through some examples where I'm
2479060	2485940	thinking about the process that I've gone through when being brought on to convince a team
2487180	2491340	basically, you know, like, I'm always selling my stakeholders on this is the research that we
2491340	2495820	should do. At some point, I'm tapped. It's like, here's the team that's getting together. We're
2495820	2501380	going to be delivering this thing. I hear what we're supposed to do. You know, we have UX involved,
2501380	2508600	of course. Merit's a privacy person. Let's, you know, get the UXR. What do we do? And it's
2508600	2515060	changed a lot over the last couple years. I'm thinking back to stuff that happened maybe back in,
2515060	2524600	um, where at first, one of the kind of blockers that I saw to doing better usability work
2525140	2532920	for privacy controls was to open people's minds to actually think about making this a part of their
2532920	2541560	actual objectives. Like, explicitly acknowledging that designing a good experience for consent or
2541560	2547980	for disclosure or for a data-intensive tool is a thing that requires going beyond the privacy
2547980	2554580	policy. And that's a bit of a, I mean, that's a conversation that you need to, you're changing,
2554580	2558180	you're kind of, you're working on your persuasion skills, right? Like, it's not something that's
2558180	2562460	intuitive to everybody that this is a thing that should happen. So, I'm actually really thrilled
2562460	2566860	to be on a panel where everybody already agrees that this is a thing, because sometimes that can
2566860	2571720	be some work. But, um, I think that's the first part. It's basically, like, convincing stakeholders
2571720	2578800	that we can and should be setting objectives and metrics and things to measure in user testing that
2578800	2585620	are related to comprehension, understandability. At various points in my career, I'm remembering
2585620	2593740	one time where I basically convinced a team to take on a metric of people aren't upset.
2594760	2600860	So, as a usability person, that is an incredibly low bar. Like, ISO has a definition of usability,
2600860	2606780	and it is people can effectively, efficiently, with satisfaction, complete a task.
2608260	2616140	To set your bar for satisfaction at they're not pissed off, kind of low. But it's a start. So,
2616140	2621040	it's basically, like, setting at, like, maybe, you know, it's a neutral response. Maybe it's,
2621040	2624780	maybe, sure, they're a little bit, like, grumpy about it. But
2626060	2630540	through the flow, they kind of, like, they get why you've got to ask about it. So, that's one
2630540	2634740	step. Basically, like, convincing a team that these are things that we can and should measure.
2635300	2640100	And then from there, I'd say recently, like, that was years ago when that was kind of a battle that
2640100	2644440	I needed to, not a battle, but those years ago when that was kind of a conversation.
2644440	2652680	And now I think it's more having and setting high expectations. So, when I hear folks that are,
2652680	2657180	like, oh, people don't care. I'm, like, no, you're telling me you don't care. I've never
2657180	2661820	seen any evidence that people don't care. So, then how do we turn this into, you know, again,
2661820	2666400	we're working for a specific group. We have users, they have expectations. If they don't have
2666400	2670640	expectations, and they do, so that's kind of an easy thing, then, you know, what's the user
2670640	2677960	research we can pull into to support that point? And it's just kind of, I guess, forcing the
2677960	2687880	conversation, which can be difficult. I've learned over time that there's a lot of work that the
2687880	2693240	privacy community can do to establish a better baseline for having productive conversations
2693240	2700540	about how data is used to every single audience across the board. And so, even when I go into a
2700540	2705860	room and I start talking with new stakeholders on a new project, I kind of put myself in a position
2705860	2711820	of, like, let's just assume that nobody really, like, let's pretend people kind of don't know that
2711820	2717020	much about privacy. So, let's start the conversation from building up our shared vocabulary and
2717020	2722860	building up our shared understanding of what's needed here. And that's been an interesting kind
2722860	2727680	of, I guess that's, like, my continual beginner's mindset as I work through these things.
2729560	2737380	Yeah, maybe just to follow on to the definition of usability and whether users are upset.
2737480	2743440	I've submitted so many data rights requests in my lifetime, like, trying to download my data,
2743440	2748700	erase my data from various companies, and it certainly does not meet the satisfaction bar.
2748820	2755280	It can feel like you're going to the DMV, where you are, you know, calling support, emailing them,
2755280	2760120	going back and forth. I have to, like, take selfies with my government ID. I have to, like,
2760120	2765760	email all this, like, documents back and forth. And it can take, like, over a month to get access
2765760	2770460	to your data. And frankly, that just, like, builds a world where data rights are not exercisable,
2770460	2776660	even if you have them on paper. It's just... it's a terrible user experience right now,
2776660	2781460	and I think people are starting to wake up to that. And as these laws just roll through new
2781460	2785820	regions, that volume is going to keep going up for companies, and the burden on both sides is
2785820	2792840	going to go up. So I think that's a huge area for UX. I'll talk about maybe two other things here.
2792840	2802240	I think one really interesting, like, sort of paradox in this UX is there's a trade-off between
2802240	2808980	being concise and being complete in your disclosures, where everybody wants to have a
2808980	2815620	very simple, distilled disclosure around privacy. But more often than not, there's more to the
2815620	2826820	story. And actually, like, making that concise is a very hard task. And yeah, so that's one thing we
2826820	2835980	see a lot. And then the other is just that disclosure of both the choices that you have,
2835980	2841460	as well as how the company is using data, kind of has to happen both at the right time when it's,
2841460	2846320	like, contextually happening, as well as being... and it also has to be available to rediscover
2846320	2850840	later. So that means that companies have to do two things. It means that when users are
2850840	2858060	using a new feature, you have to disclose the impact of using that feature and typically offer
2858240	2864120	a consent preference there. But then also, you know, after that user has passed that point,
2864120	2869800	they have to be able to rediscover it. So you should also offer a privacy center as a company
2869800	2877620	to your customers, where they can go back and see what your data practices are in plain terms,
2877620	2883060	as well as any prior consents you've set. And hopefully, in this privacy center is also where
2883600	2887440	you have a much easier experience to exercise those data rights and
2887440	2892140	not have to sit on the phone with support for hours.
2894120	2899700	Oh, and cookie banners should definitely go away. Those are more useless than privacy policies.
2900880	2907160	Actually, Ben, that brings us to our closing topic. And we have about five minutes left.
2907240	2914680	So with the last remaining minutes that we have, I do want to ask just for your closing advice on
2914680	2922040	some pragmatic steps that we can take to actually up-level some of our industry practices. So,
2922660	2928980	you know, what are some of those like immediate pain points that we can address? And perhaps,
2928980	2934140	you know, like things that we could actually do right now, you know, while things are still on
2934140	2941740	fire. Maritza, let's start with you. Yeah. Some of the stuff that I would love to see,
2941740	2947400	I would love if everybody across the board in general was just like, be curious. Be curious
2947400	2951040	about data. Be curious about what your users' expectations are. Be curious about their
2951040	2955240	attitudes. Be curious about how you could do better. Be curious about, you know, how do you
2956980	2960800	reveal like the things that you thought were kind of unsaid or didn't need to be said?
2960860	2967800	And maybe consider saying them again. And then kind of my big hope and dream for all of
2967800	2973740	data use and data conversations is if we could get to a point where we had simple answers for
2973740	2980580	simple questions. Plus one to that. Ben, what about you?
2982780	2989720	Sure. I would say first, realize that consumers care deeply about privacy. They may not have four
2989720	2995340	years ago, but they do now. And this is a huge part of your trust equation. And then use that
2995340	3001100	as a way to go beyond compliance. We've talked about this, but there are some simple things that
3001100	3008140	you can do, whether that's getting a privacy center to be more upfront with your users about
3008140	3015160	how you're using that data. Offer a lot of consent preferences and be very clear and
3015160	3022000	concise there. And make data subject requests easier to exercise for your users.
3023960	3026720	Great. Megan, any thoughts that you'd want to add?
3027400	3033100	Just echoing that people absolutely care about privacy. I've never met, you know,
3033340	3037860	a community member who I've worked with who's like, nah, I don't really care about privacy.
3037860	3042200	They've just got a lot of other things that they care about too. And I think you put it really well
3042200	3049540	in talking about prioritization of needs that different users have. Echoing again,
3049540	3058060	figuring out how we can incentivize companies to test their UX on their exercising their data
3058060	3063920	rights workflows. I think I'm not convinced right now that they're properly incentivized to do this.
3063920	3068380	And it's only like a self-reinforcing thing. If you don't have people exercising this right,
3068380	3073340	you kind of reinforce what people don't care. So I think this is sort of an interesting problem
3073340	3079260	that where a lot of work can be done. I think specifically looking at, you know, who's doing it
3079260	3085720	well in industry right now and getting those case studies and those stories shared and told
3085720	3089260	more publicly, I think will help drive that conversation.
3090380	3094400	Great. Zach, can you bring us home with some final thoughts?
3095280	3100900	I can, I can. So I think, you know, sticking with this point of, you know, privacy is certainly
3100900	3107600	important for our users, but it may be more important at certain moments, right? When you're
3107600	3112460	using Google, what's most important to you is how well search works, right? When you're using Uber,
3112460	3118940	it's getting from A to B. When it's Instagram, it's, you know, how well can I, you know,
3119650	3125280	you know, share photos and view others' photos. But there will be moments when privacy becomes
3125280	3131280	the most important thing. And in those moments, it has to be there and it has to work for you,
3131280	3138240	or else you're scared, you're frustrated, you're mad. I read, you know, those customer complaints
3138240	3144480	from our users. And trust me, privacy is definitely important to them. So what I would say
3144480	3150800	is, you know, one longer term solution I'm thinking about is contextual and personalized
3150800	3157080	privacy experiences. So that privacy shows up when you need it. Maybe it's when you take certain
3157080	3163320	actions on our platform, or you write into customer support with certain kinds of questions,
3163320	3170560	we can then surface experience to you, experiences to you, based on your activity on the platform,
3170560	3177000	and not only rely on you to go to our privacy policy or even a privacy center, because as we
3177000	3183040	know, those are not going to be placed on the very front of an app or the front of an experience.
3183040	3189460	It's going to take a few clicks to get there. So that's one thing I'd say. The other thing that I
3189460	3196160	think is going to be important as we move forward is a point of view or best practices for what
3196160	3203660	privacy will look like in this world where it is governed a lot more by machine learning and AI,
3203660	3211380	right? Like how do we offer choice and transparency in this world that we're starting to move into?
3211380	3218360	Because it's not going to be, you know, the same as it is today with just like a bunch of toggles
3218360	3225400	on a page, like trying to deliver that in a much more complex environment where we're actually
3225400	3231920	probably going to collect more data from you and to offer you richer experiences. You know,
3231920	3238260	you can just look at what the Googles and Amazons of the world are doing with, you know, Alexa,
3238260	3241960	right? And with products like that, and they're amazing and people are going to want them,
3241960	3247960	but how do you offer privacy in those contexts? And this is a bit of a head-scratcher for me,
3248360	3254520	right now. So I think we need to be forward-looking and in that regard. So that's what I'd leave us
3254520	3263180	with. Great. Thank you so much. And thank you to each of you for sharing your expertise and
3263180	3267540	being part of this conversation today to share with the Crypto and Privacy Village
3268120	3274540	during DEF CON's safe mode. I hope you're enjoying the rest of the virtual event.
3274540	3280600	And for those that are watching, I encourage you to jump into the Discord server if you want to
3280600	3284440	have a conversation with our speakers and with the broader privacy community about some of these
3284440	3289260	issues. So thank you everyone for watching and thank you again to our panelists for sharing
3289260	3292040	their expertise with us today. Take care.