Appendix: Privacy Issues in Recommender Applications
Privacy is an important issue in recommender applications. In order to provide personal recommendations, recommender systems must know something about the customers. Indeed, the more the recommender systems know, the better recommendations they can provide. Furthermore, E-commerce sites can learn a great deal about customers without the customers' awareness or consent. Customers are quite reasonably concerned about what information is collected, whether it is stored, and how it is used.
In the following, we consider aspects of the privacy issue of particular concern to E-commerce recommender applications. We first examine the types of personal data that customers may want to protect and that businesses may want to use. We then examine the issue of privacy policies and trusted brands and a social mechanism for ensuring privacy. Finally, we explore technological approaches for automating enforcement of privacy policies.
Personal Data
Customers shopping at web sites today make extensive information available to the site:
• Explicitly provided preference information such as product ratings, comments, or registered attributes of interest.
• Implicitly provided preference information including the products and information viewed, time spent viewing, searches performed, items explored or placed in a shopping cart, and even the site from which the customer navigated to the E-commerce site.
• Transactional information when products are purchased including forms of payment, account numbers, shipping addresses, and products purchased and shipped to each address.
• Explicitly provided identification information such as name, address, e-mail address, and phone number.
• Implicitly provided identification information such as the IP address (and therefore often the name) of the machine or domain from which the customer is browsing.
In addition to this already-extensive set of information, many customers have begun to realize that a small set of identity information is sufficient for businesses to acquire extensive additional information from other businesses or data collection agencies. Accordingly, it is not surprising that customers want the ability to browse and even shop at a web site with some assurance that their information will not be used for nefarious purposes. Moreover, customers are quite wary of data being collected without their awareness or consent; they do not like the feeling of being monitored.
At the same time, however, businesses can make good use of this information. By learning more about a customer's preferences, they can provide extensive personalization. By learning customer demographic information such as ZIP codes, they can customize the site by selecting weather-appropriate products, featuring products that match local tastes, and displaying prices with actual shipping charges. Of course, by sharing customer information with partners, businesses can develop a greater collection of information and thereby better understand their customers.
Given this apparent conflict, it is therefore no surprise that many customers want businesses to promise that they will limit their use and storage of personal data. While some places have laws enforcing standard storage and use restrictions, most e-businesses instead provide these assurances through privacy policies.
Privacy Policies
Privacy policies are statements by businesses that explain what information they collect and how they use it. A common element of privacy policies is a promise not to sell the information to other sites without user permission. Studies suggest that consumers are very concerned about the possibility of their information being shared by many sites. Other privacy policy promises include not using the customer's e-mail address for advertising and not calling the customer's phone number except in connection with an order.
Privacy policies are important to recommender systems because they often restrict the ability of the business to share their data with other businesses. The strongest privacy policies even limit the ability of the business to collect data about their customers at all, which makes personalized recommendations impossible.
The privacy policies on many web sites do not help alleviate consumer fears very much. Part of the reason is that these policies are often written in confusing legalese. Not only are the policies hard to understand, but they often reserve the right to change the policy at any later time, without notice, and may reserve other rights like the use of information for "business interests," which could broadly include selling private information for money or bartering it for other information. Another reason for the lack of confidence is the trend toward consolidation in the industry, which means that using personal information "within the company" may include sharing it with a variety of unexpected sites. Finally, it is difficult to determine whether privacy policies are actually being followed. Customers who shop at a web site and later receive junk e-mail may legitimately wonder whether the site violated its policy; such violations are extremely hard to prove.
Privacy policies will be more useful once they are standardized and once simple consumer-recognized representations are available. For instance, TRUSTe and BBBOnline are both working to create consumer brands that represent trust for E-commerce sites. These brands may create special logos that consumers learn to recognize as an assurance that the site meets a particular level of privacy protection. To date, however, no such trusted brand name has emerged, in part because of confusion on the part of E-commerce sites, in part because of confusion on the part of consumers, and in part because of missteps by the privacy brands themselves. TRUSTe, for instance, earned widespread disapproval for its slow reaction to Real.com secretly recording customer information and transmitting it to its servers while displaying the TRUSTe banner.
Indeed, it is the lack of a trusted brand name and the general difficulty of enforcing privacy policies that has led to the development of technological approaches to protecting privacy.
Technological Approaches
There are two current technological directions for protecting privacy. The first direction assumes that the businesses cannot be trusted or audited and thus attempts to disguise or scramble personal information. The second direction attempts to automate the negotiation and enforcement of privacy policies.
There is a long history of "anonymizing" techniques for electronic communication. Hackers and whistle-blowers alike have learned to send messages through anonymizers or even to set up new e-mail boxes for one-time use. Some of these techniques can help protect E-commerce consumers as well. Customers can reject cookies to prevent sites from recognizing them on future visits. They can hide their true IP address by browsing through firewalls or proxies that aggregate many people behind a single address or by browsing through trusted anonymizers. Of course, these approaches have their limitations. The anonymizer itself must be trusted, lest it sell its mappings to the business. Also, E-commerce applications that require payment and delivery present two new problems. While digital cash has been used for some applications, it is still not widely accepted. Also, today's delivery services require an address to which merchandise can be shipped. It is conceivable that privacy concerns may result in the reemergence of digital cash or "single-use" credit card numbers and the creation of trusted delivery services that accept deliveries to a one-time pseudonym, but these services do not yet exist.
Anonymizing techniques are disasters for recommenders, because they make it impossible for the recommender to easily recognize the customer, limiting the ability even to collect data, much less to make accurate recommendations. If recommenders are to be successful in the long-term, alternatives must be developed that alleviate consumer concerns about privacy while maintaining the notion of persistent identity.
One such step in this direction is being taken by the Platform for Privacy Preferences (P3P) initiative of the World Wide Web Consortium (W3C). P3P is a protocol whereby a site creates a machine-readable version of its privacy policy in a format that makes it possible for computers to understand and negotiate about privacy. Customers entrust their private information to a privacy agent (possibly their web browser). When the customer visits a site, his P3P agent negotiates on his behalf with the site to learn the privacy policy. The agent then asks the customer which types of information he is willing to share with the site, given the privacy policy. Over time, the agent may learn the customer's preferences. For example, a customer may be willing to give her e-mail address or phone number if the site promises to use it only within a particular transaction. Customers benefit because they can enter information once and not have to re-type it, and they know that information will only be shared with sites that promise to use it only in ways the customer accepts. Sites benefit because customers are more likely to share information if they understand the privacy policy and are more likely to share information if they do not need to reenter it each time.
P3P also provides other mechanisms to help customers and sites create private relationships. The P3P agent establishes a unique cryptographic identity with each site, called a Pairwise Unique IDentifier (PUID). The PUID makes it more difficult for different sites to share information since each site knows the customer by a different PUID. Since many recommender systems can make recommendations based only on the users’ actions at the site, the PU
Appendix: Privacy Issues in Recommender Applications
Privacy is an important issue in recommender applications. In order to provide personal recommendations, recommender systems must know something about the customers. Indeed, the more the recommender systems know, the better recommendations they can provide. Furthermore, E-commerce sites can learn a great deal about customers without the customers' awareness or consent. Customers are quite reasonably concerned about what information is collected, whether it is stored, and how it is used.
In the following, we consider aspects of the privacy issue of particular concern to E-commerce recommender applications. We first examine the types of personal data that customers may want to protect and that businesses may want to use. We then examine the issue of privacy policies and trusted brands and a social mechanism for ensuring privacy. Finally, we explore technological approaches for automating enforcement of privacy policies.
Personal Data
Customers shopping at web sites today make extensive information available to the site:
• Explicitly provided preference information such as product ratings, comments, or registered attributes of interest.
• Implicitly provided preference information including the products and information viewed, time spent viewing, searches performed, items explored or placed in a shopping cart, and even the site from which the customer navigated to the E-commerce site.
• Transactional information when products are purchased including forms of payment, account numbers, shipping addresses, and products purchased and shipped to each address.
• Explicitly provided identification information such as name, address, e-mail address, and phone number.
• Implicitly provided identification information such as the IP address (and therefore often the name) of the machine or domain from which the customer is browsing.
In addition to this already-extensive set of information, many customers have begun to realize that a small set of identity information is sufficient for businesses to acquire extensive additional information from other businesses or data collection agencies. Accordingly, it is not surprising that customers want the ability to browse and even shop at a web site with some assurance that their information will not be used for nefarious purposes. Moreover, customers are quite wary of data being collected without their awareness or consent; they do not like the feeling of being monitored.
At the same time, however, businesses can make good use of this information. By learning more about a customer's preferences, they can provide extensive personalization. By learning customer demographic information such as ZIP codes, they can customize the site by selecting weather-appropriate products, featuring products that match local tastes, and displaying prices with actual shipping charges. Of course, by sharing customer information with partners, businesses can develop a greater collection of information and thereby better understand their customers.
Given this apparent conflict, it is therefore no surprise that many customers want businesses to promise that they will limit their use and storage of personal data. While some places have laws enforcing standard storage and use restrictions, most e-businesses instead provide these assurances through privacy policies.
Privacy Policies
Privacy policies are statements by businesses that explain what information they collect and how they use it. A common element of privacy policies is a promise not to sell the information to other sites without user permission. Studies suggest that consumers are very concerned about the possibility of their information being shared by many sites. Other privacy policy promises include not using the customer's e-mail address for advertising and not calling the customer's phone number except in connection with an order.
Privacy policies are important to recommender systems because they often restrict the ability of the business to share their data with other businesses. The strongest privacy policies even limit the ability of the business to collect data about their customers at all, which makes personalized recommendations impossible.
The privacy policies on many web sites do not help alleviate consumer fears very much. Part of the reason is that these policies are often written in confusing legalese. Not only are the policies hard to understand, but they often reserve the right to change the policy at any later time, without notice, and may reserve other rights like the use of information for "business interests," which could broadly include selling private information for money or bartering it for other information. Another reason for the lack of confidence is the trend toward consolidation in the industry, which means that using personal information "within the company" may include sharing it with a variety of unexpected sites. Finally, it is difficult to determine whether privacy policies are actually being followed. Customers who shop at a web site and later receive junk e-mail may legitimately wonder whether the site violated its policy; such violations are extremely hard to prove.
Privacy policies will be more useful once they are standardized and once simple consumer-recognized representations are available. For instance, TRUSTe and BBBOnline are both working to create consumer brands that represent trust for E-commerce sites. These brands may create special logos that consumers learn to recognize as an assurance that the site meets a particular level of privacy protection. To date, however, no such trusted brand name has emerged, in part because of confusion on the part of E-commerce sites, in part because of confusion on the part of consumers, and in part because of missteps by the privacy brands themselves. TRUSTe, for instance, earned widespread disapproval for its slow reaction to Real.com secretly recording customer information and transmitting it to its servers while displaying the TRUSTe banner.
Indeed, it is the lack of a trusted brand name and the general difficulty of enforcing privacy policies that has led to the development of technological approaches to protecting privacy.
Technological Approaches
There are two current technological directions for protecting privacy. The first direction assumes that the businesses cannot be trusted or audited and thus attempts to disguise or scramble personal information. The second direction attempts to automate the negotiation and enforcement of privacy policies.
There is a long history of "anonymizing" techniques for electronic communication. Hackers and whistle-blowers alike have learned to send messages through anonymizers or even to set up new e-mail boxes for one-time use. Some of these techniques can help protect E-commerce consumers as well. Customers can reject cookies to prevent sites from recognizing them on future visits. They can hide their true IP address by browsing through firewalls or proxies that aggregate many people behind a single address or by browsing through trusted anonymizers. Of course, these approaches have their limitations. The anonymizer itself must be trusted, lest it sell its mappings to the business. Also, E-commerce applications that require payment and delivery present two new problems. While digital cash has been used for some applications, it is still not widely accepted. Also, today's delivery services require an address to which merchandise can be shipped. It is conceivable that privacy concerns may result in the reemergence of digital cash or "single-use" credit card numbers and the creation of trusted delivery services that accept deliveries to a one-time pseudonym, but these services do not yet exist.
Anonymizing techniques are disasters for recommenders, because they make it impossible for the recommender to easily recognize the customer, limiting the ability even to collect data, much less to make accurate recommendations. If recommenders are to be successful in the long-term, alternatives must be developed that alleviate consumer concerns about privacy while maintaining the notion of persistent identity.
One such step in this direction is being taken by the Platform for Privacy Preferences (P3P) initiative of the World Wide Web Consortium (W3C). P3P is a protocol whereby a site creates a machine-readable version of its privacy policy in a format that makes it possible for computers to understand and negotiate about privacy. Customers entrust their private information to a privacy agent (possibly their web browser). When the customer visits a site, his P3P agent negotiates on his behalf with the site to learn the privacy policy. The agent then asks the customer which types of information he is willing to share with the site, given the privacy policy. Over time, the agent may learn the customer's preferences. For example, a customer may be willing to give her e-mail address or phone number if the site promises to use it only within a particular transaction. Customers benefit because they can enter information once and not have to re-type it, and they know that information will only be shared with sites that promise to use it only in ways the customer accepts. Sites benefit because customers are more likely to share information if they understand the privacy policy and are more likely to share information if they do not need to reenter it each time.
P3P also provides other mechanisms to help customers and sites create private relationships. The P3P agent establishes a unique cryptographic identity with each site, called a Pairwise Unique IDentifier (PUID). The PUID makes it more difficult for different sites to share information since each site knows the customer by a different PUID. Since many recommender systems can make recommendations based only on the users’ actions at the site, the PU
การแปล กรุณารอสักครู่..
