How to Design for User Trust?
•Download as PPTX, PDF•
1 like•117 views
How to Design for User Trust?
Recommended
Recommended
More Related Content
Similar to How to Design for User Trust?
Similar to How to Design for User Trust? (20)
More from The Wisdom Daily
More from The Wisdom Daily (20)
Recently uploaded
Recently uploaded (20)
How to Design for User Trust?
- 1. Google | Proprietary & Confidential 1 Designing for User Trust
- 2. Google | Proprietary & Confidential 2Google | Proprietary & Confidential 2
- 3. Google | Proprietary & Confidential 3 Trust is the willingness to take a risk based on the expectation of a benefit* Trust can be expressed toward a company, product, feature, or even a character like the Assistant. * Inspired by Mayer 1995; see Mayer 1999 for survey questions. Trust metrics are context-dependent; reach out for guidance! Trust Trust is not the same as: COOPERATION Can occur even when there is no trust PREDICTABILITY Insufficient alone for building trust ≠
- 4. Google | Proprietary & Confidential 4 Takeaways: What is trust, and how does it matter? Google | Proprietary & Confidential 4 ● Trust can be defined as the willingness to take risks ● Our products increasingly present risks (e.g., delegation to an Assistant)
- 5. Google | Proprietary & Confidential 5 Source: Gallup polls A long-term declining trust in institutions 10% 20% 30% 40% 50% 60% 1975 1985 1995 2005 2015 Trust in public schools Trust in newspapers Trust in big business Trust in congress Trust in Institutions Over Time (US)
- 6. Google | Proprietary & Confidential 6Google | Proprietary & Confidential 6 How do people assess trust? Antecedents of Trust 3
- 7. Google | Proprietary & Confidential 7 What factors affect perception of trustworthiness? The belief in the skills and competencies of the trusted party. The belief that the trusted party, aside from wanting to make a legitimate profit, wants to do good for the user. The belief that the trusted party adheres to a set of principles that the user finds acceptable. ABILITY BENEVOLENCE INTEGRITY Source: Mayer 1995; see Mayer 1999 for survey questions to assess these factors ASSESSMENT OF TRUST
- 8. Google | Proprietary & Confidential 8 Source: Mayer 1995
- 9. Google | Proprietary & Confidential 9Google | Proprietary & Confidential 9 How can product design build trust? Trust Levers 4
- 10. Google | Proprietary & Confidential 10 How can we adapt this model of trust to a product development context? TRUST LEVERS
- 11. Google | Proprietary & Confidential 11 Trust levers - a proposed model “ENGINEERING” LEVERS e.g., ranking quality latency ... Perceived Trustworthiness Ability Benevolence Integrity Trust Willingness to take risks Perceptions Folk theories, misconceptions What does xyz platform know about me? How does it make recommendations? ... PRODUCT DESIGN LEVERS e.g., transparency & control visual design … MARKETING/PR LEVERS e.g., advertising campaigns social media outreach ... Risk taking actions Accepting recommendations, Consenting to data tracking, … BUSINESS METRICS Daily active users Revenue ... TRUST LEVERS
- 12. Google | Proprietary & Confidential 12Google | Proprietary & Confidential Hypothesis The relative effect of each lever on trust changes as the user gains experience MARKETING/PR LEVERS PRODUCT DESIGN LEVERS ENGINEERING LEVERS TIME User starts interacting with system INFLUENCEONTRUST
- 13. Google | Proprietary & Confidential 13 What product design levers can influence trust? Transparency of complex systems ML explanations, user model visualizations, etc. Data privacy UIs Consent flows, privacy settings, etc. Personality Language voice and tone, animations, audio, etc. User control of complex systems Personalization tuning controls, disambiguation, etc. Failure mediation Explanations, design of error messages, etc. Visual design Balance, emotional appeal, aesthetics, etc. TRUST LEVERS
- 14. Google | Proprietary & Confidential 14 Focus of this presentation Transparency of complex systems ML explanations, user model visualizations, etc. Data privacy UIs Consent flows, privacy settings, etc. Personality Language voice and tone, animations, audio, etc. User control of complex systems Personalization tuning controls, disambiguation, etc. Failure mediation Explanations, design of error messages, etc. Visual design Balance, emotional appeal, aesthetics, etc. Transparency, control, privacy, and personality TRUST LEVERS
- 15. Google | Proprietary & Confidential 15 Transparency of complex systems ML explanations, user model visualizations, etc.
- 16. Google | Proprietary & Confidential 16 Unanswered questions can give rise to folk theories TRANSPARENCY OF COMPLEX SYSTEMS Folk theories of feed curation on Facebook (Eslami et al. 2016) FOLK THEORY: % (N=15) Personal Engagement Theory 100% Format Theory 93% Control Panel Theory 60% Theory of Loud and Quiet Friends 46% Eye of Providence Theory 40% Narcissus Theory 40% OC Theory 20% Global Popularity Theory 13% Fresh Blood Theory 13% Randomness Theory 13%
- 17. Google | Proprietary & Confidential 17 Which of these seems more challenging for a tech company to accomplish? TRANSPARENCY OF COMPLEX SYSTEMS Accurately emulating a human voice Inferring interests for a Feed
- 18. Google | Proprietary & Confidential 18 Transparency offers an approach to address harmful folk theories... REVEALING A USER MODEL EXPLAINING A RECOMMENDATION EXPLAINING AN ALGORITHMEXPLAINING A POLICY
- 19. Google | Proprietary & Confidential 19Google | Proprietary & Confidential But can we always explain away folk theories? Challenges with explanations: ● Can go unnoticed or misunderstood [Muralidharan et al. 2012] ● Sometimes are hard to generate (area of active research in ML) [Sundararajan et al. 2017] ● Can fail to convince when there are existing firmly-held beliefs [Pritchard et al. 2017] ● Can trigger additional folk theories [Eslami et al. 2016] ● Can incentivize non-optimal behavior (even when accurate!) [Kempton 1986] ● Can create frustration when not coupled with appropriate control ● Can give away trade secrets (or allow actors to game the system) TRANSPARENCY OF COMPLEX SYSTEMS
- 20. Google | Proprietary & Confidential 20 Takeaways: Transparency Google | Proprietary & Confidential 2 0 ● When a system lacks transparency, people often invent folk theories to explain its behavior. ● Overestimation of Google’s abilities can cause people to question its benevolence ● Transparency can address harmful folk theories, but can also introduce risks
- 21. Google | Proprietary & Confidential 21 User control of complex systems Personalization tuning controls, disambiguation, etc.
- 22. Google | Proprietary & Confidential 22 Prior research suggests that even limited control can build trust, overcoming “algorithm aversion” Source: Dietvorst et al. 2016 TASK Predict academic performance given a set of factors (e.g., socioeconomic status, favorite subject). OUTCOME Those allowed to make modest adjustments to the model’s output were far likelier to use the model. USER CONTROL OF COMPLEX SYSTEMS
- 23. Google | Proprietary & Confidential 23 The act of training a digital assistant has been found to increase trust... USER CONTROL OF COMPLEX SYSTEMS “They had two basic flavors of assistant: one in which the user helped train the assistant, and one that simply guessed what a person needed and spat it out. It turns out users were far more forgiving of the former – and not particularly interested in the latter even if it performed equally well. Source: fastcodesign.com article
- 24. Google | Proprietary & Confidential 24Google | Proprietary & Confidential Controls can also erode trust in a system, when the effects are unclear and difficult to undo... USER CONTROL OF COMPLEX SYSTEMS What does it mean if I say “not interested”? What does it mean to “follow”?
- 25. Google | Proprietary & Confidential 25Google | Proprietary & Confidential … and there is often a fear associated with giving feedback USER CONTROL OF COMPLEX SYSTEMS “I have ‘Fear of missing out’ a little bit when giving negative feedback. [...]” GOOGLE PLAY USER “I’m very conservative with my ‘likes’. Technology is tracking me; if I ‘like’ something, things start popping up, and Facebook assumes I will like it indefinitely. [...]” FACEBOOK USER “I rated the [benevolence] pretty low throughout … It was difficult to feel like I controlled the content … [...]” FEED DIARY STUDY PARTICIPANT
- 26. Google | Proprietary & Confidential 26 Takeaways: Control Google | Proprietary & Confidential 26 ● Even small amounts of control can build trust and counter “algorithm aversion” ● Advertising user control can also project humility while simultaneously encouraging user-generated content ● However, control can also erode trust if the effects are unclear or difficult to undo ● We often think of control as tedious, but it can be fun and empowering, especially in regards to personalization
- 27. Google | Proprietary & Confidential 27 Data Privacy UIs Consent flows, privacy settings, etc.
- 28. Google | Proprietary & Confidential 28 DATA PRIVACY AND SECURITY UIS CONVENIENCE End users often perceive a tradeoff between convenience and privacy PRIVACY
- 29. Google | Proprietary & Confidential 29 Some argue that as convenience increases, trust will naturally grow... DATA PRIVACY AND SECURITY UIS Source: SA Vision Forum Notes
- 30. Google | Proprietary & Confidential 30 Perceived privacy risks can lead to abandonment... Facebook Quit Indications (via Twitter) - March DATA PRIVACY AND SECURITY UIS Source: LikeFolio analysis, 2018
- 31. Google | Proprietary & Confidential 31Google | Proprietary & Confidential A variety of approaches have been proposed to improve privacy • In-context transparency and control over user data capture and use • Changes to data retention policies and controls • Improved consent flows • Clearer privacy policies • Tools for reviewing, moving, deleting data • Improved data security • On-device machine learning • Transparency and control of inferences • Alternative business models • ... Traditional efforts≠ DATA PRIVACY AND SECURITY UIS Some focus more on mitigating fears, while others focus on preventing actual privacy incidents
- 32. Google | Proprietary & Confidential 32 It can be difficult to understand and control how companies like Google or Facebook collect and use personal data ? ? ?? Source: go/tc10x DATA PRIVACY AND SECURITY UIS
- 33. Google | Proprietary & Confidential 33 Applied to privacy, context-dependence means that individuals can, depending on the situation, exhibit anything ranging from extreme concern to apathy about privacy… we are all privacy pragmatists, privacy fundamentalists, or privacy unconcerned, depending on time and place. ACQUISITI ET AL. 2015 “ Privacy decision-making often involves deep uncertainty and can be dependent on superficial contextual cues DATA PRIVACY AND SECURITY UIS of US internet users believed that the mere presence of a privacy policy implied that a site would not share their personal information without permission 60% HOOFNAGLE AND URBAN, 2014
- 34. Google | Proprietary & Confidential 34 Some argue that privacy controls put too great a burden on the user Source: "The Facebook Fallacy," New York Times DATA PRIVACY AND SECURITY UIS Even if we were to know precisely what information companies like Facebook have about us and how it will be used, which we don’t, it would be hard for us to assess potential harms. Could we face higher prices online because Amazon has a precise grasp of our price sensitivities? Might our online identity discourage banks from giving us a loan? What else could happen? “
- 35. Google | Proprietary & Confidential 35 And there are dangers when privacy perceptions don’t match reality... DATA PRIVACY AND SECURITY UIS People may over-trust a system and inadvertently reveal sensitive personal information People may under-trust a system and miss out on potential benefits (convenience) OR
- 36. Google | Proprietary & Confidential 36 Takeaways: Privacy Google | Proprietary & Confidential 36 ● People often describe a tradeoff between privacy and convenience; but even when people accept the tradeoff, it is often a grudging acceptance ● Transparency and control often mitigate fears, but do not always lead to better decision-making (risk-taking behavior) ● We need a multi-pronged approach to privacy aimed at improving privacy outcomes, not just perceptions
- 37. Google | Proprietary & Confidential 37 Personality Language voice and tone, animations, audio, etc.
- 38. Google | Proprietary & Confidential 38 PERSONALITY Personality is the combination of characteristics or qualities that form an individual's distinctive character. Personality defined Perceptions of a Digital Assistant: “Like an old uncle that’s just there with all the information but not super engaging.” “Like my secretary’s secretary, that I occasionally have to use when my real secretary is on vacation. She thinks she knows a lot, but she really has a lot to learn.” “Like my brother- and sister-in-laws. Family that you like to be around, but you might not be the closest to.” Source: Personality PE Review, Jan 2018
- 39. Google | Proprietary & Confidential 39 Digital assistants have many design levers for personality PERSONALITY HotwordsAvatar Editorial content Conversation structure Voice Motion design Perceived personality
- 40. Google | Proprietary & Confidential 40 But how much does personality matter for trust? PERSONALITY HotwordsAvatar Editorial content Conversation structure Voice Motion design Perceived personality User trust ?
- 41. Google | Proprietary & Confidential 41 We hypothesize that personality provides an early signal for trustworthiness PERSONALITY MARKETING/PR LEVERS PRODUCT DESIGN LEVERS ENGINEERING LEVERS TIME User starts interacting with system INFLUENCEONTRUST
- 42. Google | Proprietary & Confidential 42 …. and that trust often increases when system and user personality are similar PERSONALITY In a prior experiment, participants rated an audio book review as more credible when the synthetic voice matched their own level of extroversion. Source: Nass and Lee 2000
- 43. Google | Proprietary & Confidential 43 Testing these hypotheses requires longitudinal evaluation PERSONALITY Trust Time
- 44. Google | Proprietary & Confidential 44 An initial live experiment will test the importance of personality for new users PERSONALITY vs. “Zero personality” Current personality
- 45. Google | Proprietary & Confidential 45 Takeaways: Personality Google | Proprietary & Confidential 4 5 ● Design levers that affect personality include editorial content, voice, avatar, hotwords, conversation structure, and motion design ● Hypothesis: Personality is an early signal for trustworthiness ● A need for piloting research approaches to understand the longitudinal effects of personality on trust
- 46. Google | Proprietary & Confidential 46 Summary and next steps
- 47. Google | Proprietary & Confidential 47 Product design levers may help to address the decline in trust. SUMMARY Transparency of complex systems ML explanations, user model visualizations, etc. Data privacy UIs Consent flows, privacy settings, etc. Personality Language voice and tone, animations, audio, etc. User control of complex systems Personalization tuning controls, disambiguation, etc. Failure mediation Explanations, design of error messages, etc. Visual design Balance, emotional appeal, aesthetics, etc.
- 48. Google | Proprietary & Confidential 48 SUMMARY People often over-trust a tool or platform’s abilities, and under-trust its motives
- 49. Google | Proprietary & Confidential 49 SUMMARY People often over-trust a tool’s or platform’s abilities, and under-trust its motives There is sometimes a causal relationship!
- 50. Google | Proprietary & Confidential 50 SUMMARY People often over-trust a tool’s or platform’s abilities, and under-trust its motives There is sometimes a causal relationship! ...and it may be easier to address this
- 51. Google | Proprietary & Confidential 51 SUMMARY People often over-trust a tool’s or platform’s abilities, and under-trust its motives There is sometimes a causal relationship! ...and it may be easier to address this Perhaps we should reframe our goal as cultivating appropriate levels of trust, aligned to reality
- 52. Google | Proprietary & Confidential 52Google | Proprietary & Confidential 52 Thank you Questions?
Editor's Notes
- There are many definitions of trust, but this one is used frequently. It focuses on the concept of risk, which is particularly relevant for certain products (and I would argue becoming increasingly relevant!) This definition is adapted from academic literature in the organizational psychology domain (Mayer) Depending on your needs, you may want to consider alternate definitions - e.g. some define trust as a “level of comfort,” which does not imply that a user would perceive risks. If one uses the “comfort” definition, recent research claims that people can simultaneously trust and distrust (a form of ambivalence), suggesting that we should measure trust and distrust separately. See: Lewicki et al., Trust and Distrust: New Relationships and Realities Related concepts that are not the same as trust: Cooperation - consider the fact that many people grudgingly accept a perceived lack of privacy, because they feel they have no way to fix it. Trust is not high (as we will see), but they cooperate anyway. Predictability - a system can be predictably mal-intentioned, in which case there is no trust. Confidence - someone can be confident in something without recognizing any risk. To be in a situation of ‘trust,’ there must be some recognized risks.
- 2018 isn’t shown in this chart; but there is evidence from Edelman of a steep decline in trust in institutions in the U.S. in 2018 (link) The Gallup poll data shown in this slide are also cited in Who Can You Trust, by Rachel Botsman - highly recommended! It makes the argument that we are moving from institutional trust to something called “distributed trust.” There are similar trends happening in other markets, but not all. Botsman’s hypotheses for declining trust in institutions: Institutional scandals are increasingly being made public; it is harder for an institution to get away with something nefarious (e.g. Wikileaks) Inequality of accountability (e.g. banking scandals - only one investment banker was punlshed) Digital age is flattening hierarchies, eroding importance of “trusted experts” Segregated echo chambers (deafness to other voices) The story is different for trust in individuals; people are more likely to describe a ‘person like me’ as the most credible source of information. We are increasingly putting our trust in other individuals, if you consider the success of platforms like Uber and Airbnb.
- The claim is that collectively, these factors are necessary and sufficient for creating trust. Ability alone is insufficient - just implies that the system could help the user, not that it would. Benevolence helps, but: if the system is imbued with a set of values that are not aligned to the user, then there can still be trouble. E.g. a privacy policy may be fine for most people, but some may not like it (esp. across markets, economic groups, etc.) Also: companies may be less predictable than people -- a company can change management, in which case it may not keep its promises (i.e. adhere to the set of principles it had previously agreed to..)
- Note: trustor’s propensity - some people more naturally trust than others. Also, perceived risk is important. If risk is low, trust is not necessary. Finally, note the feedback loop from outcomes to perceived trustworthiness - as someone continues to take risks with a product, trust may grow or shrink. One thing to note is that people can have positive experiences with a system, and not realize it. E.g., I might use Google Maps to choose a route, save 25 minutes over the alternate route, but never know it. A proposed principle is to take credit for our successes (without gloating). See Russell Dicker’s Formula for User Trust
- Here’s the original model from Mayer, that we’ve seen before.
- Adapting this to a product context, we might consider three types of levers we have: marketing, traditional “engineering” levers, and product design levers. I’m focused on the product design levers. I have also added a node for “perceptions” - these are the folk theories that people form about our products, that influence the perceived trustworthiness. We’ll talk a lot more about these folk theories later. Finally, there’s a presumed relationship between the risk taking actions people might take (e.g., accepting a recommendation, consenting to data tracking) and business metrics like daily active users and revenue.
- Before I have used a product or feature, all that matters is what I’ve *heard* about it from others. Marketing/PR levers dominate. When I start using the product, trust UI design levers (visual design, transparency, etc.) quickly become very important. Over time, assuming I continue using the product/feature, engineering levers become more important; as I take risks, trust becomes More based on experience (e.g. actual quality, rather than just perceived quality). If this hypothesis is right, product design levers may be an especially important way to drive new user retention. Note that there are important interaction effects between the levers; e.g., a marketing initiative to promote “principles” carries more weight if there are product design changes that illustrate the principle. And conversely, a product design change may set into motion a news cycle that dramatically influences trust. (I mentioned before that mostly what moves the needle on brand trust in the short term are major news stories, not product changes themselves.)
- Note that these categories are partially interrelated - e.g. privacy and security UIs often involve transparency & control, visual design can influence personality, etc. Nevertheless, I have found it useful to separate them at least for the purpose of identifying prior research.
- Note that some of these theories appeared only after a probe, in which users were shown a representation of their feed alongside a separate representation of all the content they *could* have been shown (but Facebook filtered out some of it with its algorithms). The Eye of Providence Theory: The Eye of Providence is the notion common to many religions that God’s all-seeing eye is watching over you. The participants who articulated this theory thought that Facebook was powerful, perceptive, and ultimately unknowable. Adherents to this theory said that Facebook saw into every story in some detail. They thought that Facebook was removing low quality content such as low resolution photos or very long stories. Some said that Facebook matched newly contributed content against all other contributed content on the platform. If a similar or identical photo, link, or status update was posted multiple times, “maybe somehow Facebook recognized that it was the same thing and only announced it once” (P4). Others took the idea that Facebook processes content even further. Several thought Facebook uses face detection to prioritize photos of people over photos of objects or landscapes. Others proposed that “there could be keywords that Facebook is taught to look for, identify, and if it sees it, maybe puts it lower on the priority list” (P21). See also: https://techcrunch.com/2016/09/06/ultimate-guide-to-the-news-feed/
- “Why this ad?” is another example, focused on explaining what personal data was used to trigger an advertisement. Challenges: Limited attention span People may not notice our explanations Literacy rates are low (we aim for 5th grade reading level in our materials) Need to be careful not to give away trade secrets
- Task: estimating percentiles of high school seniors given information about them “...Participants were assigned to one of four conditions. In the can’t-change condition, participants learned that they would choose between exclusively using their own forecasts and exclusively using the model’s forecasts. In the adjust-by-10 condition, participants learned that they would choose between exclusively using their own forecasts and using the model’s forecasts, but that they could adjust all of the model’s forecasts by up to 10 percentiles if they chose to use the model. In the change-10 condition, participants learned that they would choose between exclusively using their own forecasts and using the model’s forecasts, but that they could adjust 10 of the model’s 20 forecasts by any amount if they chose to use the model. Participants in the use-freely condition learned that they would receive the model’s forecasts and could use them as much as they wanted when making their 20 forecasts. Participants were required to type a sentence that described their condition to ensure that they understood the procedures.” Across conditions, use of the model was associated with success; those who chose to use the model made more accurate forecasts.
- In the popular press, there’s also a provocative story about Microsoft’s AI design practices, where they had two different versions of their Assistant, one that people trained explicitly, and one that was just automated. People were far more forgiving of mistakes for the one that they trained (even if the two performed equally well after training)
- This is known as the “Data Exchange”
- The authors take the point of view that this was a relatively minor revolt among Facebook users. But consider that the problem would be much bigger if there is a viable alternative (not true in the case of Facebook, and in general with social networks, where switching costs are high).
- In subsequent slides, I argue that transparency and control may not be enough, given the complexity of our systems. Note that on-device machine learning is a big deal. My open question is: how much does it address perceptions (even if it solves for some of the underlying risks)?
- Even for someone tech literate and motivated, the challenge can be daunting. Considering that many are not in this category, we have an even bigger challenge. The question is whether our explanations (transparency) and controls can be intuitive enough to facilitate good decision-making.
- This underscores the need for a multi-pronged approach to privacy, relying more than just transparency and control.
- Voice in particular is known to have a strong and automatic effect, even when the voice is synthetic; humans are hard-wired to interpret voices as having a personality. See Wired for Speech by Nass and Brave for a thorough review.
- Note also that personality queries are more common in the first week of digital Assistant use -- perhaps as a way to test the system’s competence and understand its character (both important signals of trustworthiness)
- Trust can evolve over time; someone’s instant opinions do not necessarily hold over time!