In the United States, identity theft resulted in corporate and consumer losses of $56 billion dollars in 2005, with up to 35 percent of known identity thefts caused by corporate data breaches. Many states have responded by adopting “data breach disclosure laws” that require firms to notify...

Internet of Things (IoT) devices create new ways through which personal data is collected and processed by service providers. Frequently, end users have little awareness of, and even less control over, these devices’ data collection. IoT Personalized Privacy Assistants (PPAs) can help overcome...

Privacy and security tools can help users protect themselves online. Unfortunately, people are often unaware of such tools, and have potentially harmful misconceptions about the protections provided by the tools they know about. Effectively encouraging the adoption of privacy tools requires...

Finding information about privacy practices can be difficult: privacy policies often do not present this information in an accessible way. People typically do not know how or for what purpose their personal information, gathered online, will be used. When asked, people frequently express...

While the effectiveness of nudges in influencing user behavior has been documented within the literature, most prior work in the privacy field has focused on ‘one-size-fits-all’ interventions. Recent behavioral research has identified the potential of tailoring nudges to users by leveraging...

Economics offer different but complementary approaches to understanding privacy and security. For this inaugural contribution to the new In Our Orbit department, I was asked to explain briefly their methodological differences and similarities, and why they matter in our thinking about security...