Japanese Users’ (Mis)understandings of Technical Terms Used in Privacy Policies and the Privacy Protection Law

“Notice and Consent” has been a major practice used by service providers to make users give informed consent for their personal data to be processed; however, there are some barriers that prevent users from giving “true” consent. The most serious barrier is users’ misunderstanding of the data processing procedures described in privacy policies. Tang et al. investigated the U.S. users’ misunderstandings of technical terms used in privacy policies. In this paper, we conducted a replication study adapted to Japanese users. In addition, we investigated Japanese users’ expectations of the Japanese privacy protection law. By conducting an online survey of 362 Japanese users, we found that less than half of the participants were able to correctly define 15 of the 20 technical terms in our main study. We also found that the technical terms of privacy policies significantly affect the user acceptance rate of policies. Furthermore, we identified that the participants have incorrect expectations of the law; they expect the law to provide more stringent data protection than the protection it actually provides. Based on our findings, we recommend that researchers and service providers should make substantial improvements in the documentation of privacy policies to prevent users’ misunderstandings.