We used card sorting to figure out the right information hierarchy. We printed out permission cards with “what data this is for”, “why it was requested”, and “who'll be using it” on each one. Then we asked users to organize them. The result shows 80% of users sorted them in a “what-why-where” sequence.

Designing for such a complicated system and various user types means testing again and again. The most often used method is the simplest A/B testing combined with think-alouds. For each design decision, we usually develop multiple designs to test. Asking users to perform a task and thinking aloud helped us better understand the mindset of users, thus informed us how to proceed.

There are a few sections on the homepage:

Privacy Mode: Switch from work mode and life mode.
Privacy Overview: Review how your data is accessed.
Recommended Settings: Quickly improve privacy settings based on other people's settings and users' previous behavior.
Global Settings & App Settings: Configure for all Apps or individual App.

“Global Setting” means configuring for all Apps. Based on user research, we decided on a “what-why-where” information hierarchy: “what data is accessed,” “why it is accessed,” and “where is it used.” We also used a progressive disclosure fashion to avoid overwhelming users.

Privacy mode is to help organizations prevent data leakage from its employees or visitors. Employees can easily switch to different mode under different circumstances,and apply the set of configurations. For instance, DARPA’s military people may need to hide their location from all apps when they are out on a mission.

We designed more privacy-related options in the quick setting view, which can help those in sensitive situations temporarily protect specific data from all Apps. But it's still under control of the privacy mode, as shown in the demo here.

Right after users installed an app, the App Settings page will show up. The default settings are based on your previous behavior or the majority of our users. We especially designed an “uncommon requests” section to make the configuration process more manageable.

If permission is set to “Ask,” a pop-up will appear when users are using the App. We showed the purpose, the requester, and a detailed explanation from the App to help users make decisions more knowledgeably.

When a data request was blocked by the OS, the App may not function normally. A notification can help user identify why it's refused and help user take action easily if needed.