arXiv subjects

Eman Alashwali

Publications and source records attributed to Eman Alashwali.

8 recordsLinked to original sources

arXiv2026

Users' Activity Logs: the Good, the Bad, the Misconception, and the Disastrous

Most service providers, such as Google, save logs from data generated by users while using the service. Many service providers provide users with privacy controls to manage whether, how, and for how long the data is saved and used by the service provider. While most prior studies focused on the negative side of users' activity logs, such as users' lack of awareness about the logs' privacy controls and users' privacy concerns toward their data, this work aims to provide a balanced view of users' perceptions regarding activity logs by considering the positive, negative, and extremely negative (hence disastrous) sides, as well as the misconceptions of activity logs. In this work, we present a case study of Google's Activity controls by conducting a secondary analysis of interview data from 30 Google personal account holders in Saudi Arabia. Using template analysis, we analyzed the data from the lens of four main themes: the good, the bad, the misconception, and the disastrous aspects of users' activity logs from the users' perspective. Our findings uncover new themes and use cases, offering a balanced view of users' perceptions of activity logs, and provide a better understanding and a useful source for subsequent studies on related topics. We conclude with practical recommendations for service providers, privacy researchers and experts, and users alike.

cs.HC↗

arXiv2026

Evaluating PDPL Compliance in E-Commerce Websites: Insights and Lessons Learned from Human and LLM Analyses

In 2024, Saudi Arabia's Personal Data Protection Law (PDPL) came into force. However, little work has been done to assess its implementation. In this paper, we analyzed 100 e-commerce websites operating in Saudi Arabia against the PDPL, examining the presence of a privacy policy and, if present, the policy's declarations of four items pertaining to personal data rights and practices: 1) personal data retention period, 2) the right to request the destruction of personal data, 3) the right to request a copy of personal data, and 4) a mechanism for filing complaints. Our results show that, despite national awareness and support efforts, a significant fraction of e-commerce websites in our dataset are not fully compliant: only 31% of websites in our dataset declared all four examined items in their privacy policies. Even when privacy policies included such declarations, a considerable fraction of them failed to cover required fine-grained details. Second, the majority of top-ranked e-commerce websites in our dataset (based on search results order) and those hosted on local e-commerce hosting platforms exhibited considerably higher non-compliance rates than mid- to low-ranked websites and those not hosted on local e-commerce platforms. Third, we assessed the use of Large Language Models (LLMs) as an automated tool for privacy policy analysis to measure compliance with the PDPL. We highlight the potential of LLMs and suggest considerations to improve LLM-based automated analysis for privacy policies. Our results provide a step forward in understanding the implementation barriers to data protection laws, especially in non-Western contexts. We provide recommendations for policymakers, regulators, website owners, and developers seeking to improve data protection practices and automate compliance monitoring.

cs.HC↗

arXiv2025

Two Types of Data Privacy Controls

Users share a vast amount of data while using web and mobile applications. Most service providers such as email and social media providers provide users with privacy controls, which aim to give users the means to control what, how, when, and with whom, users share data. Nevertheless, it is not uncommon to hear users say that they feel they have lost control over their data on the web. This article aims to shed light on the often overlooked difference between two main types of privacy from a control perspective: privacy between a user and other users, and privacy between a user and institutions. We argue why this difference is important and what we need to do from here.

cs.HC↗

arXiv2025

Work From Home and Privacy Challenges: What Do Workers Face and What are They Doing About it?

The COVID-19 pandemic has reshaped the way people work, normalizing the practice of working from home. However, work from home (WFH) can cause a blurring of personal and professional boundaries, surfacing new privacy issues, especially when workers take work meetings from their homes. As WFH arrangements are now standard practice in many organizations, addressing the associated privacy concerns should be a key part of creating healthy work environments for workers. To this end, we conducted a scenario-based survey with 214 US-based workers who currently work from home regularly. Our results suggest that privacy invasions are commonly experienced while working from home and cause discomfort to many workers. However, only a minority said that the discomfort escalated to cause harm to them or others and that the harm was almost always minor and psychological. While scenarios that restrict worker autonomy (prohibit turning off camera or microphone) are the least experienced scenarios, they are associated with the highest reported discomfort. In addition, participants reported measures that violated or would violate their employer's autonomy-restricting rules to protect their privacy. We also find that conference tool settings that can prevent privacy invasions are not widely used compared to manual privacy-protective measures. Our findings provide a better understanding of the privacy challenges landscape that WFH workers face and how they address them, providing useful insights to organizations' policymakers and technology designers for areas of improvements, to provide healthier work environments to workers.

cs.HC↗

arXiv2024

Detection and Impact of Debit/Credit Card Fraud: Victims' Experiences

It might be intuitive to expect that small or reimbursed financial loss resulting from credit or debit card fraud would have low or no financial impact on victims. However, little is known about the extent to which financial fraud impacts victims psychologically, how victims detect the fraud, which detection methods are most efficient, and how the fraud detection and reporting processes can be improved. To answer these questions, we conducted a 150-participant survey of debit/credit card fraud victims in the US. Our results show that significantly more participants reported that they were impacted psychologically than financially. However, we found no relationship between the amount of direct financial loss and psychological impact, suggesting that people are at risk of being psychologically impacted regardless of the amount lost to fraud. Despite the fact that bank or card issuer notifications were related to faster detection of fraud, more participants reported detecting the fraud after reviewing their card or account statements rather than from notifications. This suggests that notifications may be underutilized. Finally, we provide a set of recommendations distilled from victims' experiences to improve the debit/credit card fraud detection and reporting processes.

cs.CR↗

arXiv2024

Privacy Perceptions and Behaviors of Google Personal Account Holders in Saudi Arabia

While privacy perceptions and behaviors have been investigated in Western societies, little is known about these issues in non-Western societies. To bridge this gap, we interviewed 30 Google personal account holders in Saudi Arabia about their privacy perceptions and behaviors regarding the activity data that Google saves about them. Our study focuses on Google's Activity Controls, which enable users to control whether, and how, Google saves their Web \& App Activity, Location History, and YouTube History. Our results show that although most participants have some level of awareness about Google's data practices and the Activity Controls, many have only vague awareness, and the majority have not used the available controls. When participants viewed their saved activity data, many were surprised by what had been saved. While many participants find Google's use of their data to improve the services provided to them acceptable, the majority find the use of their data for ad purposes unacceptable. We observe that our Saudi participants exhibit similar trends and patterns in privacy awareness, attitudes, preferences, concerns, and behaviors to what has been found in studies in the US. Our results emphasize the need for: 1) improved techniques to inform users about privacy settings during account sign-up, to remind users about their settings, and to raise awareness about privacy settings; 2) improved privacy setting interfaces to reduce the costs that deter many users from changing the settings; and 3) further research to explore privacy concerns in non-Western cultures.

cs.CY↗

arXiv2024

What Do Privacy Advertisements Communicate to Consumers?

When companies release marketing materials aimed at promoting their privacy practices or highlighting specific privacy features, what do they actually communicate to consumers? In this paper, we explore the impact of privacy marketing on: (1) consumers' attitudes toward the organizations providing the campaigns, (2) overall privacy awareness, and (3) the actionability of suggested privacy advice. To this end, we investigated the impact of four privacy advertising videos and one privacy game published by five different technology companies. We conducted 24 semi-structured interviews with participants randomly assigned to view one or two of the videos or play the game. Our findings suggest that awareness of privacy features can contribute to positive perceptions of a company or its products. The ads we tested were more successful in communicating the advertised privacy features than the game we tested. We observed that advertising a single privacy feature using a single metaphor in a short ad increased awareness of the advertised feature. The game failed to communicate privacy features or motivate study participants to use the features. Our results also suggest that privacy campaigns can be useful for raising awareness about privacy features and improving brand image, but may not be the most effective way to teach viewers how to use privacy features.

cs.CR↗

arXiv2022

Saudi Parents' Privacy Concerns about Their Children's Smart Device Applications

In this paper, we investigate Saudi parents' privacy concerns regarding their children's smart device applications (apps). To this end, we conducted a survey and analysed 119 responses. Our results show that Saudi parents expressed a high level of concern regarding their children's privacy when using smart device apps. However, they expressed higher concerns about apps' content than privacy issues such as apps' requests to access sensitive data. Furthermore, parents' concerns are not in line with most of the children's installed apps, which contain apps inappropriate for their age, require parental guidance, and request access to sensitive data such as location. We also discuss several aspects of Saudi parents' practices and concerns compared to those reported by Western (mainly from the UK) and Chinese parents in previous reports. We found interesting patterns and established new relationships. For example, Saudi and Western parents show higher levels of privacy concerns than Chinese parents. Finally, we tested 14 privacy practices and concerns against high versus low socioeconomic classes (parents' education, technical background, and income) to find whether there are significant differences between high and low classes (we denote these differences by "digital divide"). Out of 42 tests (14 properties x 3 classes) we found significant differences between high and low classes in 7 tests only. While this is a positive trend overall, it is important to work on bridging these gaps. The results of this paper provide key findings to identify areas of improvement and recommendations, especially for Saudis, which can be used by parents, developers, researchers, regulators, and policy makers.

cs.CR↗