short-paper

Can you meaningfully consent in eight seconds? Identifying Ethical Issues with Verbal Consent for Voice Assistants

Authors:

William Seymour,

Jose SuchAuthors Info & Claims

CUI '22: Proceedings of the 4th Conference on Conversational User Interfaces

Article No.: 15, Pages 1 - 4

https://doi.org/10.1145/3543829.3544521

Published: 15 September 2022 Publication History

Abstract

Determining how voice assistants should broker consent to share data with third party software has proven to be a complex problem. Devices often require users to switch to companion smartphone apps in order to navigate permissions menus for their otherwise hands-free voice assistant. More in line with smartphone app stores, Alexa now offers “voice-forward consent”, allowing users to grant skills access to personal data mid-conversation using speech. While more usable and convenient than opening a companion app, asking for consent ‘on the fly’ can undermine several concepts core to the informed consent process. The intangible nature of voice interfaces further blurs the boundary between parts of an interaction controlled by third-party developers from the underlying platforms. This provocation paper highlights key issues with current verbal consent implementations, outlines directions for potential solutions, and presents five open questions to the research community. In so doing, we hope to help shape the development of usable and effective verbal consent for voice assistants and similar conversational user interfaces.

References

[1]

2016. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). OJ L 119(2016), 1–8. http://data.europa.eu/eli/reg/2016/679/oj

[2]

Noura Abdi, Kopo M Ramokapane, and Jose Such. 2019. More than smart speakers: security and privacy perceptions of smart home personal assistants. In Fifteenth Symposium on Usable Privacy and Security (SOUPS 2019). 451–466.

[3]

Noura Abdi, Xiao Zhan, Kopo M Ramokapane, and Jose Such. 2021. Privacy Norms for Smart Home Personal Assistants. In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems. 1–14.

Digital Library

[4]

Alessandro Acquisti, Idris Adjerid, Rebecca Balebako, Laura Brandimarte, Lorrie Faith Cranor, Saranga Komanduri, Pedro Giovanni Leon, Norman Sadeh, Florian Schaub, Manya Sleeper, Yang Wang, and Shomir Wilson. 2017. Nudges for Privacy and Security: Understanding and Assisting Users’ Choices Online. ACM Comput. Surv. 50, 3, Article 44 (aug 2017), 41 pages. https://doi.org/10.1145/3054926

Digital Library

[5]

Narae Cha, Auk Kim, Cheul Young Park, Soowon Kang, Mingyu Park, Jae-Gil Lee, Sangsu Lee, and Uichin Lee. 2020. Hello There! Is Now a Good Time to Talk? Opportune Moments for Proactive Interactions with Smart Speakers. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol. 4, 3, Article 74 (sep 2020), 28 pages. https://doi.org/10.1145/3411810

Digital Library

[6]

Jide Edu, Xavier Ferrer Aran, Jose Such, and Guillermo Suarez-Tangil. 2022. Measuring Alexa Skill Privacy Practices across Three Years. In The Web Conference (WWW). ACM.

Digital Library

[7]

Jide Edu, Xavier Ferrer-Aran, Jose Such, and Guillermo Suarez-Tangi. 2021. SkillVet: Automated Traceability Analysis of Amazon Alexa Skills. IEEE Transactions on Dependable and Secure Computing (TDSC) (2021).

[8]

Yusra Elbitar, Michael Schilling, Trung Tin Nguyen, Michael Backes, and Sven Bugiel. 2021. Explanation Beats Context: The Effect of Timing & Rationales on Users’ Runtime Permission Decisions. In 30th USENIX Security Symposium (USENIX Security 21). 785–802.

[9]

Matthias Fassl, Lea Theresa Gröber, and Katharina Krombholz. 2021. Stop the Consent Theater. Association for Computing Machinery, New York, NY, USA. https://doi.org/10.1145/3411763.3451230

Digital Library

[10]

Ewa Luger and Tom Rodden. 2013. An Informed View on Consent for UbiComp. In Proceedings of the 2013 ACM International Joint Conference on Pervasive and Ubiquitous Computing (Zurich, Switzerland) (UbiComp ’13). Association for Computing Machinery, New York, NY, USA, 529–538. https://doi.org/10.1145/2493432.2493446

Digital Library

[11]

David Major, Danny Yuxing Huang, Marshini Chetty, and Nick Feamster. 2021. Alexa, Who Am I Speaking To?: Understanding Users’ Ability to Identify Third-Party Apps on Amazon Alexa. ACM Transactions on Internet Technology (TOIT) 22, 1 (2021), 1–22.

Digital Library

[12]

Clifford Nass, Jonathan Steuer, and Ellen R. Tauber. 1994. Computers Are Social Actors. In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (Boston, Massachusetts, USA) (CHI ’94). Association for Computing Machinery, New York, NY, USA, 72–78. https://doi.org/10.1145/191666.191703

Digital Library

[13]

Florian Schaub, Rebecca Balebako, and Lorrie Faith Cranor. 2017. Designing effective privacy notices and controls. IEEE Internet Computing 21, 3 (2017), 70–77.

Digital Library

[14]

Bingyu Shen, Lili Wei, Chengcheng Xiang, Yudong Wu, Mingyao Shen, Yuanyuan Zhou, and Xinxin Jin. 2021. Can Systems Explain Permissions Better? Understanding Users’ Misperceptions under Smartphone Runtime Permission Model. In 30th USENIX Security Symposium (USENIX Security 21). 751–768.

[15]

Yolande Strengers, Jathan Sadowski, Zhuying Li, Anna Shimshak, and Florian ’Floyd’ Mueller. 2021. What Can HCI Learn from Sexual Consent? A Feminist Process of Embodied Consent for Interactions with Emerging Technologies. In Proceedings of the 2021 CHI Conference on Human Factors in Computing Systems (Yokohama, Japan) (CHI ’21). Association for Computing Machinery, New York, NY, USA, Article 405, 13 pages. https://doi.org/10.1145/3411764.3445107

Digital Library

[16]

Dawei Wang, Kai Chen, and Wei Wang. 2021. Demystifying the Vetting Process of Voice-Controlled Skills on Markets. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol. 5, 3, Article 130 (sep 2021), 28 pages. https://doi.org/10.1145/3478101

Digital Library

Cited By

Zhan XXu YSarkadi S(2023)Deceptive AI Ecosystems: The Case of ChatGPTProceedings of the 5th International Conference on Conversational User Interfaces10.1145/3571884.3603754(1-6)Online publication date: 19-Jul-2023
https://dl.acm.org/doi/10.1145/3571884.3603754
Meck ASardone MCullmann J(2023)Will the Assistant Become the Driver, and the Driver Become the Assistant?Proceedings of the 5th International Conference on Conversational User Interfaces10.1145/3571884.3603753(1-5)Online publication date: 19-Jul-2023
https://dl.acm.org/doi/10.1145/3571884.3603753

Index Terms

Can you meaningfully consent in eight seconds? Identifying Ethical Issues with Verbal Consent for Voice Assistants
1. Human-centered computing
  1. Human computer interaction (HCI)
    1. Interaction paradigms
      1. Natural language interfaces
  2. Ubiquitous and mobile computing
    1. Ubiquitous and mobile computing design and evaluation methods
2. Security and privacy
  1. Human and societal aspects of security and privacy
    1. Usability in security and privacy

Recommendations

Legal Obligation and Ethical Best Practice: Towards Meaningful Verbal Consent for Voice Assistants
CHI '23: Proceedings of the 2023 CHI Conference on Human Factors in Computing Systems

To improve user experience, Alexa now allows users to consent to data sharing via voice rather than directing them to the companion smartphone app. While verbal consent mechanisms for voice assistants (VAs) can increase usability, they can also ...
The crisis of consent: how stronger legal protection may lead to weaker consent in data protection

In this article we examine the effectiveness of consent in data protection legislation. We argue that the current legal framework for consent, which has its basis in the idea of autonomous authorisation, does not work in practice. In practice the legal ...
Freely Given Consent?: Studying Consent Notice of Third-Party Tracking and Its Violations of GDPR in Android Apps
CCS '22: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security

Adopted in May 2018, the European Union's General Data Protection Regulation (GDPR) requires the consent for processing users' personal data to be freely given, specific, informed, and unambiguous. While prior work has shown that this often is not given ...

Comments

Information & Contributors

Information

Published In

cover image ACM Other conferences

CUI '22: Proceedings of the 4th Conference on Conversational User Interfaces

July 2022

289 pages

ISBN:9781450397391

DOI:10.1145/3543829

Copyright © 2022 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 15 September 2022

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Short-paper
Research
Refereed limited

Conference

CUI 2022

CUI 2022: 4th Conference on Conversational User Interfaces

July 26 - 28, 2022

Glasgow, United Kingdom

Acceptance Rates

CUI '22 Paper Acceptance Rate 12 of 33 submissions, 36%;

Overall Acceptance Rate 34 of 100 submissions, 34%

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

2
Total Citations
View Citations
234
Total Downloads

Downloads (Last 12 months)65
Downloads (Last 6 weeks)11

Reflects downloads up to 23 Feb 2025

Other Metrics

View Author Metrics

Citations

Cited By

Zhan XXu YSarkadi S(2023)Deceptive AI Ecosystems: The Case of ChatGPTProceedings of the 5th International Conference on Conversational User Interfaces10.1145/3571884.3603754(1-6)Online publication date: 19-Jul-2023
https://dl.acm.org/doi/10.1145/3571884.3603754
Meck ASardone MCullmann J(2023)Will the Assistant Become the Driver, and the Driver Become the Assistant?Proceedings of the 5th International Conference on Conversational User Interfaces10.1145/3571884.3603753(1-5)Online publication date: 19-Jul-2023
https://dl.acm.org/doi/10.1145/3571884.3603753

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

HTML Format

View this article in HTML Format.

Figures

Tables

Media

View Table of Conten