On this page
Michael Mühlhauser, Angela Fiedler, Sabine Patzl, Melissa Schütz, Marcel Soler Lopez, Simon Steuer, Dominik Herrmann, Daniela Nicklas, Astrid Schütz · Full Paper, ARES 2026, August 24–27, 2026, Linköping (Sweden) · Preprint to follow
Joint work of IT security (PSI chair), computer science/sensor systems (Daniela Nicklas), and psychology (Astrid Schütz) at the University of Bamberg, funded by the BMFTR project explanym.
Summary
Hospitals want to locate devices such as wound therapy pumps via Bluetooth – but devices attached to patients generate sensitive movement data in the process. Our privacy concept makes only unused pumps visible; pumps in use remain hidden. In a between-subjects online survey (N = 766), we tested how well three explanation formats convey this concept: text only, text with a screenshot, and text with an interactive application. All formats clearly increased subjective understanding and trust compared to the control group – but objective understanding remained low in all groups, while confidence was consistently high.
The explained concept in two rules
A pump becomes visible to staff only when it is certainly not attached to a person:
- Temporal rule: It has not moved for at least 24 hours.
- Spatial rule: It is located in an area without patient access (e.g., a storage room).
A proxy discards all other location data before it reaches the tracking system (data minimization at the architecture level). Known limitation of the concept: anyone who does not move with an attached pump for more than 24 hours becomes visible – and it is precisely the understanding of this limitation that we tested.
Key numbers
- Explaining works – the format hardly matters: All three formats significantly improved subjective understanding (Cohen’s d = 0.90–1.09) and trust (d = 0.42–0.57) compared to the control group; there were no differences between formats.
- Objective understanding: The visual and interactive formats outperformed text-only (p = .041 each), but with a small effect and low absolute scores (median 3 vs. 2 out of 5). On the question about the concept’s core measures, only 16.3% of the text group answered correctly.
- Overconfidence: Despite correctness rates partly below 40%, confidence remained at 7.3–9.2 out of 10 throughout – participants did not notice their poor understanding.
- Willingness to use ≥ 90% in all groups (90.0–94.1%, no significant differences) – including the control group, which received hardly any explanation.
What this means for consent
Explanations can create an illusion of understanding: people believe they understand how their data is protected, trust the concept, and consent – without actually understanding it. Subjective understanding is thus not a reliable indicator of actual understanding. No format we studied led to sufficient understanding for informed consent on its own; this calls common consent mechanisms into question. Interactive elements achieved the highest scores for understanding the concept’s limitations – exactly where understanding matters most.
Methods and limitations
Methods. Between-subjects online survey with four groups (control n = 203, text n = 190, text+image n = 188, text+interactive n = 185); recruitment via Prolific (German-speaking countries), randomization, two attention checks, approved by the university’s ethics committee. The interactive explanation was a fully implemented web application (moving pumps, setting last-movement times, a time simulator). Objective understanding: five multiple-response questions with all-or-nothing scoring plus a confidence rating per question; analysis with Welch ANOVA/Games-Howell and Kruskal-Wallis/Dunn (Holm).
Limitations. Online survey instead of a real consent situation in a hospital; Prolific sample young, educated, and with above-average privacy knowledge; strict all-or-nothing scoring; interaction time not recorded (richer formats = more material); the explanations described the protection, not the concrete risks of the data collection.
How to cite
Camera-ready version, DOI, and preprint to follow; for now:
@misc{muehlhauser2026explanations,
title = {A Quantitative Evaluation of Textual, Visual, and Interactive
Explanations of a Privacy Concept in a Hospital Setting},
author = {M{\"u}hlhauser, Michael and Fiedler, Angela and Patzl, Sabine and
Sch{\"u}tz, Melissa and Soler Lopez, Marcel and Steuer, Simon and
Herrmann, Dominik and Nicklas, Daniela and Sch{\"u}tz, Astrid},
year = {2026},
note = {Accepted at ARES 2026; preprint forthcoming}
}Explanations, survey questions, anonymized response data, and the analysis script are openly available: github.com/UBA-PSI/explanations-study.
Contact
Prof. Dr. Dominik Herrmann
Chair Privacy and Security in Information Systems
University of Bamberg, 96045 Bamberg
Chair Privacy and Security in Information Systems
University of Bamberg
96045 Bamberg
dh.psi@uni-bamberg.de | +49 951 863-2661
uni-mal-anders.de | LinkedIn
Prof. Dr. Dominik Herrmann
Chair Privacy and Security in Information Systems,
University of Bamberg, 96045 Bamberg
dh.psi@uni-bamberg.de
+49 951 863-2661
uni-mal-anders.de | LinkedIn