Understanding Users' Perception of Personally Identifiable Information
Research Poster Social & Behavioral Sciences 2025 Graduate ExhibitionPresentation by Qiurong Song
Exhibition Number 4
Abstract
Personally identifiable information (PII) is a fundamental concept in privacy research and regulations. Understanding users' perspectives on PII is critical, as their understanding of PII can significantly affect their privacy decisions and practices. While much research has explored users' privacy perceptions and disclosure preferences regarding PII, less attention has been focused on how users internally define and conceptualize PII. In this study, we conducted interviews with 32 participants to investigate their conceptualization and understanding of PII, using period and fertility tracking apps as the context. Our findings highlight how users perceive the processes and contexts that transform personal information into identifiable data. Key themes include the evolution and accumulation of PII over time, as well as the linkage and aggregation of non-identifiable data into PII. Participants also expressed concerns about the widespread distribution of their PII across multiple channels, often without their explicit knowledge. Additionally, they raised critical issues related to PII sharing and misuse within PFT apps, particularly regarding legal risks in the post-Roe landscape and risks to personal safety. We conclude by advocating for addressing the misalignment between users' perceptions of PII and the regulatory protections and privacy designs surrounding it. Bridging this gap is essential for more effective and user-centered privacy protections.
Importance
This research advances privacy scholarship and HCI by shifting the focus from expert definitions of PII to users' internal conceptualizations. While prior studies explore privacy behaviors and regulatory frameworks, our study fills a key gap by examining how users themselves define, perceive, and assess PII-related risks. By using period and fertility tracking apps as a study context, we uncover unique concerns about evolving data identifiability, linkage across platforms, and exposure risks in sensitive health data ecosystems. Our findings highlight a misalignment between regulatory protections, platform privacy designs, and user perceptions, emphasizing the need for more user-centered privacy policies. This work is especially relevant in the post-Roe era, where concerns over data misuse and legal risks are heightened.