"I know what you did last semester": Understanding Privacy Expectations and Preferences in the Smart Campus

Sensing technologies in smart campuses help make them sustainable and well-connected environments. However, as with other smart environments, smart campuses can cause privacy concerns during and after deployment. We present the results of a 14-day in-situ study designed to understand peoples’ sentiments about sensing capabilities in smart campuses and how they would specify privacy preferences. In contrast to prior work, which reported the importance of sensing modality and purpose, our findings indicate that indoor location type and recipient are primary determinants for comfort, surprise, notification preferences, and allowance of data collection. Further, we observed that indoor location type influences privacy control willingness and how users specify sensor controlling rule. For example, our participants allowed policy-controlled data collection in group areas while denying it in learning areas. Finally, we suggest that academic environments are unique, possibly due to the complex relationships between students, staff, and faculty.


INTRODUCTION
In December of 2019, multiple college students in the United States expressed privacy concerns about smart campuses, "We are adults.Do we need to be tracked?"[20].While users can control these devices at their homes or in private spaces, they have limited control over sensing in public spaces and may not even be aware of their presence.Further, in addition to investigating privacy perceptions in public spaces, it is important to evaluate users' privacy perceptions of a specifc public space domain, i.e., an academic setting.Smart campuses can cause varied levels of privacy concerns as public spaces as these environments can host multiple sub-locations that can be utilized for several purposes.Also, sensor data streams can be used to understand and predict various sensitive aspects of human behavior and activities [31].In smart campuses, hundreds of occupants have limited or no control over the collected data and can not apply their individual privacy preferences due to the shared environment.There is a lack of transparency about data processing in these environments.Existing work in smart campuses is mostly about building privacy protection technologies, while limited work has investigated user privacy in smart campuses, making this investigation ever so important.
Within space sensing, prior work has reported users' privacy perceptions are afected by where the sensors are deployed inside their home [12].In public spaces, while prior works have investigated several general domains such as libraries, stadiums, and gas stations [56], an investigation into the academic domain is missing.Since multiple possible sensor deployment locations could exist in a smart campus, our work has examined how users' privacy perception difers based on sensing deployment indoor locations for an academic setting.
Also, prior studies have focused on diferent factors that can impact individuals' perception of privacy by measuring comfort level with data collection [33,36,51].One-size-fts-all models are often unable to capture individuals' diverse privacy preferences when it comes to collecting and using their data through IoT technologies such as private and public environments, mobile apps, and online services.Even though people's perceptions would difer between online services and the IoT physical environment, our work leverages prior work to identify several factors such as data retention, access by whom, and usage purpose that may still impact individuals' privacy concerns and preferences in academic settings.Our research aims to identify factors afecting users' comfort, surprise, notifcation preference, and allowance with data collection in academic settings.We aim to understand how we can improve users' awareness of data collection and specify control preferences over space sensors.
In particular, we explore the following research questions: • What factors such as sensor type and sensing context (e.g., detail indoor location, sensing purpose) impact user perceptions of comfort, surprise, allowance, and notifcation preference with data collection in academic settings?Since limited prior work has examined academic spaces, we confrm whether the factors studied by prior work in other domains are still relevant in academic spaces, as relationships and power dynamics may difer.• What factors matter to users when setting rules related to data collection in academic settings?What types of sensor controlling rules would users specify to control the sensing purpose, notifcation frequency, data collection retention, and sharing of sensed data about them?
Understanding how users create controlling rules helps us identify user priorities related to data collection and their desire for control in academic spaces.
To explore these research questions, we conducted a 14-day in-situ study to understand peoples' sentiments about sensing capabilities in smart campuses.We investigate how individuals would specify privacy preferences by asking multiple daytime in-situ surveys, followed by evening surveys for deeper inquiry about daytime responses, and controlling rule preference surveys as our hundred participants visited multiple indoor locations on campus as part of their daily routine.Our fndings suggest that specifc indoor location types and access by a certain group of people form important factors in comfort, surprise, notifcation preferences, and allowance of data collection.Our fndings difer compared to prior works that highlight sensing modality and sensing purpose highlighting the mismatch in privacy perceptions in academic and other domains.We learned that indoor location type infuences peoples' privacy control preferences and we provide insights into how rules are specifed.Through our fndings, we postulate that academic environments are unique, possibly due to the complex relationships between students, staf, and faculty.These fndings help the space stakeholders consider the indoor location types when deploying sensors in a smart campus, i.e., designers can deploy sensors in a hallway rather than inside a classroom to relieve privacy concerns with the same level of utility.Our fndings also suggest that we need to inform users of who has access to the sensed data, particularly if it is accessible by faculty members.
This paper is organized as follows.First, we discuss related work (Section 2) and then describe the study design (Section 3).Then, we present the fndings of our study (Section 4) and discuss our results along with the limitations of our study (Section 5).Finally, we provide our conclusion (Section 6).

RELATED WORK
This section presents existing literature on user privacy in IoT sensing environments in smart campuses.Recent news coverage has illustrated growing concerns among students for sensing in smart campuses.[4,20] shows concerns about location tracking via students' phones, and [4] also showed the tracking apps to mark students' attendance and monitor their mental health that can cause developmental issues from the constant surveillance.Smart campuses also deployed facial recognition sensors for security purposes, however, as mentioned in [4], facial recognition providers admitted that their technology does not prevent school shootings, even as school districts still spend millions on the surveillance tools.Also, [7] argued that even though facial recognition may ofer potential benefts, it raises meaningful privacy concerns.We must understand people's privacy expectations and preferences in this domain to resolve these concerns.By providing a realistic academic sensing scenario as people visit multiple locations within an academic setting, our work investigates under what circumstances people are concerned about their privacy in smart campuses.To start with, we survey previous studies aimed at the privacy challenges in these environments.Next, we focus on factors afecting users' privacy preferences and understanding in such environments.

Technical solutions for privacy in smart campus
Multiple eforts have been made with respect to privacy protection related to data collection in the smart campus domain.Rowe et al. [46] built a campus monitoring and control application with supporting security and privacy considerations by including encryption, key management, access control, and user management.On the other hand, Pidcock et al. [44] provide privacy notifcation systems about nearby urban sensing to those who subscribe, and their prototype uses the Wi-Fi SSID as a privacy beacon from urban sensing participants.Nissenbaum describes how the high-resolution capabilities of cameras violate the contextual expectations of how people will be perceived in public [42], and Lee et al. also reported that sensor fdelity matters [32].Further, there are privacy-preserving camera works [16,49] such as obscuring camera images to hide individual identities or doing cryptographic obscuring.Despite many sensing technologies that could make schools safer, we need to better understand under what sensing context people have privacy concerns, which would allow designers and administration to set up proper privacy guidelines and data collection controls.With the rapid deployment of Internet of Things (IoT) technologies and the diverse ways in which IoT-connected sensors collect and analyze individual and environmental data [3], Taher et al. [52] discovered people's privacy perceptions and preferences and trade-ofs they are willing to make in university smart buildings as their work or study place.However, they did not cover other sub-areas in the university, such as classroom, writing center, dining, and gym, and what factors such as sensor type and sensing context afect user perceptions.Naeini et al. [41] covered multiple public settings such as workspace or libraries to understand people's privacy expectations and preferences.However, their work covered a broader domain, the understanding of which may not apply to domains such as academic settings.Also, a survey-based study limits participants' understanding and insights into more natural behavior, thoughts, and feelings throughout their daily activities [56] that can be done by the experience sampling method.In this paper, we conducted the experience sampling method in academic settings to understand people's privacy perceptions.

Factors impacting privacy perceptions
Prior studies have examined diferent factors that can impact individuals' perception of privacy by measuring comfort level with data collection [33,36,51].Martin and Nissenbaum also describe that data practices can be evaluated in fve information fow parameters, which are the sender, recipient, attribute, subject, and transmission principle [39].Since existing privacy norms may not be suitable for new technologies as described in [56], we frst try to address data privacy challenges in academic settings to establish a baseline of privacy norms by understanding people's perceptions towards the sensing technology in academic settings.One-size-fts-all models are often unable to capture individuals' diverse privacy preferences when it comes to collecting and using their data through IoT technologies such as smart home and public environments, mobile apps, and online services.
In a smart home environment, researchers have made progress in discovering privacy perception.Choe et al. [17] examined which activity people were most concerned with and they would not want to be recorded.Their results showed that users are less willing to share self-appearance, intimate behavior, cooking or eating, media use, and oral expressions at home when various sensors are installed.The authors concluded that designers and developers of in-home sensing systems should be careful not to monitor such private behaviors.Also, Fernandez et al. [12] have reported that people within smart homes tend to consider exact locations such as bedrooms or restrooms as an essential factor for their adoption with varying privacy perceptions.Their work gives useful insights into important contextual factors like location, however, it is unclear whether detailed location may also impact privacy perceptions in public spaces.We aim to expand on these fndings by evaluating exact sensing locations in a specifc public space; an academic setting, and in combination with additional factors capturing more contextual nuances.
Prior work has also focused on privacy preferences related to public spaces.Public space sensing promises great convenience, as they automatically adjust the temperature, monitor human behavior for safety purposes, or maximize space utilization [25].While such devices ofer great convenience, they also pose privacy threats, such as detecting personal patterns [11] or gaining remote control [19].Zhang et al. reported that the purpose of data collection is the most important factor in their participants' allow/deny decision of data collection for a given video analytic scenario, and the general public places they covered were work, hospitals, libraries, airports, and so on [56].Our work also explores whether this remains true in both more specifc domains such as an academic environment and for diverse sensing types.Additionally, we aim to understand the impact of the sensing purpose, the sensor types, and the sensing location of the data collection on people's privacy perception.Particularly, we explore sensing locations such as common areas, service areas, group areas, learning areas, and private areas in academic settings.
Other work than the IoT context has focused on privacy preferences related to online services and mobile devices.Bilogrevic et al. showed that the comfort levels of sharing data in online services highly depend on the type of data and the sharing context [13].Leon et al. examined whether data retention, access to data collection, and the scope of use afected willingness to share data for online advertising purposes.Individuals were more willing to share certain types of data if its retention period is one day rather than periods longer than one week [34].Prior work on mobile app permission preferences has shown that it is often possible to identify common patterns among the privacy preferences of diferent subgroups of users [35,40].Lin et al. [35] showed that both users' expectations and the sensing purpose have a major impact on users' subjective feelings and their trust decisions.Even though people's privacy perceptions would difer between online services and the IoT physical environment, we include factors such as data retention, access by whom, and usage purpose based on these works as they may impact individuals' privacy concerns and preferences in space sensing as well.

STUDY DESIGN
We conducted a 14-day in-situ study with a hundred participants to understand their privacy perceptions and expectations in academic settings.The study was approved by our university's Institutional Review Board (IRB).

Experience sampling method on smartphone
Exploring people's privacy perceptions and attitudes through online surveys is often limited as participants lack the context to provide meaningful responses about hypothetical scenarios.Therefore, we conducted an ESM (experience sampling study) to collect people's responses to diverse academic sensing scenarios in the context where they are actually situated.The ESM has been widely used in various disciplines to gather insights into more natural behavior, thoughts, and feelings of participants throughout their daily activities [24].Researchers have used the ESM in a wide variety of studies [22,27], with the method gaining popularity.Also, the widespread adoption of smartphones enables their use as a viable research tool [45].Combining these technologically powerful and widely available devices with the ESM research method allows for insightful research probes [53].ESM on smartphones facilitates us to engage and survey participants in a timely and ecologically valid manner as they visit about their normal daily lives.In our study, participants are prompted to answer multiple in-situ surveys about academic sensing scenarios on their smartphone that could occur at the indoor location type in academic settings in the context of their everyday activities.

Study procedure
Our 14-day in-situ study was conducted in the following four parts.Part 1.The participant was asked to take a demographic survey via Qualtrics' online survey system.Participants were then instructed to download the study app.The app uses the participants' current location for generic survey questions and generates notifcations during the study period presenting scenarios based on their current location on campus.
Part 2. Our app uses GPS locations and Foursquare API to see if participants are in a university building and ask which indoor location type they are currently in, as shown in Figure 2a.In each daytime survey, we asked four types of questions about realistic academic sensing scenarios based on the indoor location type they are currently in: (1) surprise level: how surprised they were by the scenario presented to them, (2) comfort level: how comfortable they were with the collection and use of their data as described in that scenario, (3) notifcation preference: to what extent they would want to be notifed about the sensing scenario at the location they visited, and (4) allow/deny preference: whether, if given a choice, they would have allowed or denied the data collection practices described in that scenario at that particular location they visited.These questions are described in Figure 2b and Figure 3.All the study responses were stored in the Amazon AWS Dynamo Database using the Amplify feature and participants' local phone storage as a backup.The protocol limited the number of scenarios presented to each participant every 90 minutes between 9 a.m. and 6 p.m. and up to six per day.For each survey, participants can go back to change the answers within a survey by pressing the "back" button (otherwise pressing the "next" button), but they cannot change for previous surveys that they have already fnished.If a participant skipped a daytime survey, they could still take it within the next 90-minute period by clicking the button on the status page shown in Figure 2f.This status page also shows the study's progress, including duration, potential payment, additional rewards, and study information.
Part 3. On the days when participants responded to one or more daytime surveys, as described in Part 2, they were also prompted by an evening survey notifcation after 6 p.m.This evening survey frst probes more deeply into daytime survey responses in cases where participants' daytime response was that (1) they felt somewhat or very surprised, (2) they were somewhat or very uncomfortable, (3) reasons for choice of notifcation preference, and (4) reasons of choice of allow/deny scenario as shown in Figure 2d.They can select among multiple choices and provide additional open-ended responses to explain their responses further.Our questionnaire was adapted from [56], which we augmented with additional responses such as "didn't know it is possible" as a reason for surprise since one of our pilot participants suggested this as an extra choice.Further, our evening survey asks participants about their controlling preference for data collection, access, and desire for notifcations for a specifc sensor and indoor location as shown in Figure 2e.
Part 4. After completing the study, we asked the participants to complete the post-study survey via Qualtrics.This survey measured their level of privacy concern through the 10-item IUIPC scale [37].Participants were then compensated to end their participation.

Building realistic scenarios and study validation
Each daytime survey shows an academic sensing scenario and we build these combining dimensions shown in Table 1.We reviewed multiple academic sensing technologies already in deployment [1, 2, 5, 6, 8, 20, 21] and extracted sensor type, sensing purpose, and indoor location type.We collect representative values in terms of academic settings for factors such as data storage time and access by whom.Among all the possible combinations of these attributes, our study focused on a subset of scenarios representative of common and emerging deployments of sensing technology on campus.For this, our research team manually fltered out unrealistic scenarios.For example, a lidar/radar sensor cannot be used for the purpose of "identifcation." This approach follows the practice described in [41].
To refne the scenarios and study design, we conducted several pilot rounds, with initial rounds involving members of our research group and later rounds involving a small number (N=5) of external participants.Each pilot round helped identify minor technical issues.During the survey, we also conducted an attention check by asking two multiple-choice questions (see Figure 2c).These questions presented participants with in-situ scenarios as usual, but asked the participants to answer factual questions about the scenario (e.g., identifying the sensor type) instead of asking them to respond to the scenario.Participants can only proceed with the in-situ questions once they have passed these attention checks.
As a result, 474 scenarios were possible, and we received 1529 responses in total.Not every scenario type was covered, as scenario generation depended on participants' indoor location type at the time of scenario generation, which refects participant mobility patterns rather than uniform coverage of all scenario types.E.g., the most common location type was "group area" (31.6%), and the least common was "service area" (6.9%).Our daytime survey scenario is randomly generated based on the participants' current indoor location type.If their indoor location type is not changed over surveys, it is possible that participants may get the same scenario.However, due to other contextual situations such as the We recruited participants using four methods: posts on local online i.e., 1.24% of all presented scenarios, were repeated with the same forums in our local area (e.g., Craigslist, Reddit), promotional ads participant, date, building, and attributes in Table 1.
on Facebook, physical fyers posted on university bulletin boards and at bus stops, and emails to advertise to each department in the  Before and during the study, we did not mention or refer to privacy to prevent heightened responses [14,38].
A total of 103 individuals (excluding fve pilot participants) took part in the study between March and April 2023.Of these, 100 completed the 14-day study.Most participants were highly educated: 41% had some college degrees, 19% had a undergraduate degree, and 33% had a graduate degree.Other demographic information is in Table 2. To maximize the survey responses by the ESM study, we designed a detailed payment to provide incentives for each response to in-situ and evening questions.Participants were compensated $0.1 per daytime survey response, $2 per evening survey response, and an additional $15 was rewarded when they fnished 35% of the in-situ survey prompts.Participants were compensated with university study participant payment cards.As a result, each participant responded to 19.86 scenarios on average for in-situ and evening surveys during a 14-day study and received an average compensation of $11.80.
The Internet Users' Information Privacy Concerns (IUIPC) scores [37] of our participants are shown in Table 3. Comparing our diverse sensors with ESM study in academic settings results (N=100) with video analytic (camera sensor) with ESM study in public space works (N=123) [56] using unpaired t-tests, we found no diference in the collection, but there is a signifcant diference in control and awareness of privacy.Also, comparing a large Mturk sample and diverse sensors with a survey study in public space (N=1007) [41] using unpaired t-tests, we found no diference in the collection and control but signifcant diference in awareness.This shows that participants of each study have diferent privacy control and awareness understanding but similar collection understanding.

RESULTS
In this section, we present results regarding participants' comfort level, surprise level, decisions to allow or deny data collection, desire

Where I am matters for my privacy -Indoor location type impacts privacy perceptions
We observed that certain "indoor location type" are the strong factors in participants' comfort, surprise, notifcation frequency, and scenario allowance responses associated with the academic sensing scenarios through our in-situ survey shown in Figure 3.
We used a generalized linear mixed model (GLMM) in which the linear predictor contains random efects in addition to the usual fxed efects, and our GLMM model was ft by approximating the likelihood with ordinary Monte Carlo, then maximizing the approximated likelihood by treating the user identifer as a random efect.We accounted for repeated measures in our data analysis as participants responded to the same survey multiple times [56].This GLMM is also used in prior work to understand people's privacy perception with the same scale in Naeini et al. [41] work.Table 4 presents regression analysis to show what factors are statistically signifcant (p < 0.05) to participants' comfort level.A positive estimate (efect size) indicates an inclination toward comfort, and a negative estimate shows an inclination toward discomfort.Learning, private, and group area are the signifcant factors in discomfort to academic data collection scenarios.This result highlights the importance of indoor sensing location in users' discomfort with data collection.One diference in our fndings compared to Zhang et al. [56] could be because the specifc domain was evaluated.Their work indicates that the sensing purpose of data collection is more relevant in general public places such as stores, workplaces, hospitals, ftness, gas, transportation, libraries, or airports in relation to comfort with data collection for a given scenario.Whereas, when considering a more specifc domain, such as an academic environment like a university campus, our results show that indoor location type becomes a more relevant factor in comfort with data collection.Another diference from their work is that we also cover diverse sensing modalities.However, diferent sensing modalities were not signifcant for comfort with data collection from our results in academic settings.
For participants' notifcation frequency preference, we frst observed notifcation preference of data collection over two weeks.Interestingly, we observed that almost half of our participants wanted to get every time notifcation in the frst week of the study.In the second week, 45% of participants still wanted to get an every-time notifcation as shown in Figure 4.This result is diferent than other works that showed that 44% of the participants changed to get fewer every-time notifcations [56].Therefore, we used GLMM to identify which factors infuenced the participant's desire to get notifed each time of data collection.As seen in Table 5, "indoor location type" is the strongest factor to be notifed every time.P7 would like to be notifed since he/she would like to know about the data "I need to (be) notifed because I need to know more about the study area".Naeini et al. [41] work presented that "sensing purpose" is the most efective factor in explaining participants' desire to be notifed every time.However, our results indicate that "indoor location type" was a stronger factor in participants' desire for every time notifcation.
On the other hand, Table 6 shows that learning and private area as a sensing indoor location are the signifcant factors in denying academic data collection scenarios.Also, as seen from Table 7, private area is signifcant in being surprised of academic data collection scenarios whereas common area is signifcant in not surprising.These results highlight the importance of indoor location type in user preference for allowing or denying data collection and being surprised by data collection.Again, the diference in our fndings compared to Zhang et al. [56] could be because the specifc domain was evaluated.
To understand what detailed reasons participants have, we asked what detailed reasons they had when they felt somewhat or very surprised during the evening survey Figure 2d.Interestingly, the two major reasons why participants responded as surprised to the  given scenario were "where I was" which represents a sensing indoor location type, and "what could be inferred" which represents their activity as shown in Figure 5.One participant mentioned the other reasons as "no reason these people have to know that I am in a restaurant" indicating surprise with sharing the collected data in a specifc sensing location such as a service area.Like Zhang et al. [56], our work also confrmed similar discomfort reason tendency as surprise reason shown in Figure 5 even in academic settings, however, we show that participants were mostly surprised with the location as a reason "where I was", and least surprised with lack of awareness as a reason "didn't know it is possible".

I am uncomfortable if faculty sees my data -Access impacts privacy attitudes in academic settings
We also observed that certain "access by whom" exhibit another strong factor with participants comfort, surprise, notifcation, and allowance responses associated with the academic setting scenario.As seen from Table 4 and 5, we found that the presence of faculty or lecture instructor having access to sensed data is a signifcant factor in participants' comfort level and every time notifcation preference of data collection.Naeini et al. [41] work presented that "sensing purpose" is the most efective factor in explaining participants' desire to be notifed every time.In contrast, the factor that had the least efect was "access by whom".However, in our results "access by whom" is another important factor for every time notifcation.Unlike their work, we specifed an academic group that can access the sensed data since we narrowed down the scenario to a specifc domain as academic settings and conducted the ESM study.This eventually lets us identify which group of people can access the data as a signifcant factor both in the comfort level of data collection and in wanting to get notifed every time.
Figure 6 presents a statistic of participants' comfort across different levels of each factor, and it shows that participants' comfort level is diverse mostly across "indoor location type" and "access by whom".Participants were most uncomfortable in the scenarios where they were asked about the indoor area as a private area (67%), and least uncomfortable with a service area (39%).Then, they were uncomfortable if the scenarios they were asked about had other people as access (67%).On the other hand, for each sensor type, purpose, and retention time, participants show less diferent comfort levels than indoor type and access.
Regarding participant preference to allow or deny data collection, Table 6 shows that who can access the data is another signifcant factor.We found that the presence of other individuals having access to sensed data is a signifcant factor in participants' decision to allow or deny data collection.In particular, we observed that participants are more likely to deny data collection if it is accessible by other people when compared to department or service area staf.On the other hand, for surprise level, Table 7 shows that department or service area staf access was also a signifcant factor to be surprised with data collection.

This is typical in a smart campus, so I don't care -Sensing purpose and modalities have less infuence in academic settings
Our analysis shows that sensing purpose and sensing modalities show no signifcance in comfort level, allow/deny decision, and notifcation preference of sensing data collection.P2 mentioned that sensors in smart campuses can be used for multiple purposes; "It's just typical practice on a university campus.I assume lectures are being recorded or cameras are being used for security."An interesting diference in our fndings about which factors infuence people's privacy perception compared to prior works could be because the specifc domain was evaluated.From the work of Zhang et al. [56], there are indications that the purpose of data collection is the strongest factor in general public places such as stores, work, hospitals, ftness, gas, transportation, libraries, or airports to decide to allow or deny decision of data collection for a given scenario.Also, Naeini et al. [41] presented that sensing modalities were the most helpful factor in the allow/deny model.Whereas, when considering a more specifc domain itself such as an academic environment like a university campus, our results show that sensing purpose and modality show no signifcant importance in comfort level, notifcation frequency preference, and the decision to allow or deny data collection as shown in Table 4, Table 5 and Table 6.

I want to control my data collection in study rooms -Participants desire to control rules in group areas
At the end of the day during the study, we asked whether participants were willing to specify any type of rules to control the data collection purpose, notifcation, data retention, and sharing of sensed data in academic settings with a given sensor type and indoor location type.They can decide (1) whether to set up the rules for a given sensor type and indoor location type, and (2) when they decide to set up, they can build as many as rules they would like to.Our regression showed that participants would like to set up the rules for group area, and sensor type did not show any signifcant impact as shown in Table 8.Among specifed rules, we also show the statistics on which sensing purpose, notifcation, data retention, and sharing of sensed data they would like to set up.    7 presents the statistics when participants decided to set up the controlling rules for based on sensor types, type of indoor location, sensing purpose, notifcation frequency, data retention, and data access.Although, our earlier results (Section 4.3) do not show signifcance for sensing purpose and retention time, when people set the data controlling rules, since they were required to pick each factor, identifcation was the most concerning to them for group area.Also, our participants preferred one semester for data retention time and allowed access to university facilities management for group area.
• Sensing purpose: For multiple sensing indoor location types and sensor types, we observed that when participants are given common and group area for any sensor, they are more willing to set up rules for identifcation purpose.when participants assume that they can control their sensor setups, we give them an additional option to access sensor data "themselves".As expected participant themselves desired access to their data, particularly in private area.
Our results reinforce the notion that users desire controls when sensing is utilized for identifcation purposes.Further, as previously noted indoor location is particularly critical in participants' willingness to control aspects of data collection.Finally, we also observed the prevalence of wanting to control access of sensor data from private areas to other people, at the same time, in an academic setting people were willing to allow access to university facilities management in their created rules.

DISCUSSION
In this work, we explored users' privacy perceptions related to sensed data collection in an academic setting.With the growth in the deployment of sensors in public spaces, it becomes essential to explore how users feel about their data being collected in the presence of these sensors.Academic spaces, in particular, can be problematic as students rarely have input in the deployment, usage, and access of the sensed data.Further, academic spaces are made up of several sub-spaces, such as cafeterias, shared study spaces, and personal lab spaces, that all can serve diferent purposes.Indeed, our results showed that users feel diferently about sensing in these spaces, and their decision to allow or deny data collection relies on indoor location types.Also, we saw a strong infuence of access by whom in user decisions to allow data collection, particularly when faculty can access user data, highlighting that hierarchy in student-faculty relationships plays a role in privacy perception in these spaces.
Next, we discuss some implications of our fndings, followed by the limitations of our study.

Not all spaces are created equal. -Leveraging asymmetric sensor deployment
Multiple prior works reported that people are concerned about sensing capability [42].Further, prior works have reported that sensor fdelity matters in users' privacy perceptions [32,42].While useful in some settings, our work has shown that sensing modality and purpose are less important to people than indoor location type.As noted in Section 4.1, we presented that indoor location type is a signifcant factor in participants' comfort level, notifcation frequency preference, and the decision to allow or deny data collection.Meanwhile, sensing purpose and sensing modalities were not signifcant.These fndings indicate that designers need to carefully consider these factors when deploying sensors.In some cases, we can even consider deploying high-fdelity sensors like cameras rather than low-fdelity ones like Lidar in common areas, as users express relatively lower concerns in these locations.This is in contrast to other domains such as healthcare, where, due to concern with high-fdelity sensing modality, have transitioned to lowerfdelity device-generated data [55].Further, designers can consider deploying either high-fdelity or low-fdelity sensors in a hallway instead of a classroom since our fndings indicate that people are more concerned about learning areas than common areas with less concern about sensing modality.This indicates that designers need to (1) reconsider sensing deployment in private and learning spaces and (2) deploy sensors in common areas but with mechanisms to make users aware.[26] or privacy labels [50].

I want
Additionally, designers also need to include the possible inferences that can be made from sensed data.Our participants expressed surprise when informed about possible inferences that can be made from sensed data as shown in Figure 5. Prior works have reported this observation, and our work confrms that we need to inform users of what analysis can be inferred from their data in the design of awareness displays.

We can make sensor management easier -Controlling rule guidelines and interface design
Prior research has shown that users generally ignore privacy policy documentation due to the length and technical language used in these documents [10,28,43].Further, it has been reported that people in academic settings complained about the decision-making process, considering it to be unfair to them mostly because of a lack of transparency [23].As we reported in Section 4.1, when presented with possible data collection scenarios, our participants expressed surprise about some of these scenarios, highlighting the importance of designing interfaces that can present simple and concise information to users to improve their awareness.Similarly, prior work has also reported that users generally do not interact with controls and often use default confgurations [15].This is often the case where users ignore or inadequately set up their privacy preferences or policies for data collection [47,48].A possible reason for this behavior is the efort needed to navigate these controls, particularly when presented with too many of these [29].In our work, we identifed that indoor location, especially group areas, was an important factor in our participants' willingness to set up rules (Section 4.4).Thus, designers should prioritize controls that allow users to set up data collection rules based on indoor locations, particularly group areas, which would help reduce the complexity of rules that the users need to specify.

Limitations
As noted before, 80% of our respondents were students.Thus, our fndings mostly represent the student populations' privacy perceptions.An academic institute hosts other users who can be exposed to sensors, such as employees/staf and faculty.Future studies are needed to understand their perspective concerning the usage of smart campuses.In addition, we do not claim that our participants are representative of the general academic population since they were recruited only from the local area, which is a mid-sized city in the United States.Also, even though we required the presence of more than 1 year in the United States, participants' privacy perception may have diferences across cultures.Further, our study was conducted over two weeks.Prior work has reported that as users become more familiar with what data is collected, they desire less frequent notifcation due to being comfortable with the data modality or notifcation in general [56].Thus, a longer-term study is needed to understand how participants' desire for frequent notifcation is afected as they become more familiar with data in academic settings.Also, it is possible that people may have diferent privacy perceptions within one factor.For example, participants may have diferent sentiments between library and dining that both are service areas, however, it is out of our study scope.They may also have diferent thoughts about who "other people" are as access by whom factor.
Finally, we only recruited participants with an Android phone, within a specifc academic institute in the United States.This may limit the scope of our results and further studies are needed to confrm our fndings when considering other device owners across diferent educational institutes.

CONCLUSION
In this paper, we presented a 14-day experience sampling study to help understand peoples' privacy attitudes about sensing capabilities in academic settings and how they would specify privacy control preferences.Our study collected in-situ responses from 100 participants as they visited campus during their daily activities.It presented them with realistic academic sensing scenarios by inquiring about their awareness of, comfort with, notifcation preferences, and data allow/deny preference associated with sensing deployments.Our fndings indicate that indoor location type and access by whom are primary determinants for comfort, notifcation preferences, and allowance decision of data collection in academic settings, unlike prior works that reported the strong infuence of sensing modality and purpose in general public spaces.We also fnd that indoor location type infuences privacy control preferences, and we provide insights into how rules are specifed.Finally, we suggest that academic environments are unique, possibly due to the complex relationships between students, staf, faculty, and others.Based on our fndings, we suggest that space stakeholders consider the indoor location types when deploying sensors in smart campuses and the need to inform users of who has access to the sensed data.Our fndings also suggest that we need to inform users of who has access to the sensed data in which indoor space, particularly if it is accessible by faculty members.

Figure 3 :
Figure 3: Daytime survey consisting of possible realistic scenarios with contextual attributes at the name of the venue participants were visiting and four inquiries

Figure 4 :
Figure 4: All participants' notifcation preference of data collection throughout the study in frst and second weeks order.

Figure 5 :
Figure 5: Percent of participants/notifcations reporting specifc reasons for their surprise of the scenario.Participants only selected reasons for their surprise (N=647), and N is used as the denominator to calculate the percent of surprise level.

Figure 6 :
Figure 6: Summary statistics showing the relation between various factors and participants' comfort level.
(a) Preferred sensing purpose setup (b) Preferred sensing notifcation frequency setup (c) Preferred sensed data retention setup (d) Preferred sensed data access by whom setup

Figure 7 :
Figure 7: Rules participants would like to defne under specifc sensor type and indoor location

Table 1 :
Contextual attributes: Among all the possible combinations of these attributes, our study focused on scenarios representative of common and emerging deployments of sensing technology on campus.Learning area (e.g., classroom, instructional lab, etc.) Common area (e.g., building entrance, lobby, or hallway) Group area (e.g., study room, conference room) Private area (e.g., ofce) Service area (e.g., advising, writing center, tutoring, library, health service, dining, shop, gym)

Table 2 :
Demographic breakdown of our participants.

Table 3 :
Comparison of IUIPC scores of our participants (N=100) with a video analytic sample (N=123) and an MTurk sample (N=1007).

Table 4 :
Generalized Linear Mixed Model Regression output for comfort model.A positive estimate indicates an inclination toward comfort, and a negative estimate shows an inclination toward discomfort.

Table 5 :
Generalized Linear Mixed Model Regression output for every time notifcation.A positive estimate shows the likeliness of allowing, and a negative estimate shows the likeliness of getting a notifcation every time.

Table 6 :
Generalized Linear Mixed Model Regression output for allow-deny model.A positive estimate shows the likeliness to allow and a negative estimate shows the likeliness to deny.

Table 7 :
Generalized Linear Mixed Model Regression output for surprise level.A positive estimate indicates an inclination toward being surprised, and a negative estimate shows an inclination toward not being surprised.

Table 8 :
Generalized Linear Mixed Model Regression output for setting up the sensor controlling rule.A positive estimate shows the likeliness to allow, and a negative estimate shows the likeliness to set up the sensor controlling rule.
[54]0]notifed only when... -Designing awareness mechanisms for academic spaces Awareness of data collection is central to user privacy.Often, users of a space are not even aware of data collection in those spaces due to multiple factors such as lack of knowledge and obscure sensor location.A lack of awareness can cause privacy concerns and mistrust among students in academic settings.This is further illustrated in data shown in Table3.Our participants (mostly students) scored signifcantly higher in the IUIPC test for awareness compared to other works, indicating a stronger comparative desire for awareness than the more general population of these works.At the same time, when designing awareness mechanisms, we must consider what information to present.Too much information can cause information overload and prevent an accurate understanding of data[9,30].Based on our results, we can provide some directions on what information should be included in the design of awareness mechanisms.As noted in Section 4.1 and Section 4.2, we observed that participants' desire for notifcations was dependent on (1) indoor location type and (2) who can access the data.As shown in Table5, participants responded that sensors deployed at any location other than service areas should generate every time notifcations.Thus, we can prioritize notifcations for data collection whenever data collection takes place in areas other than service areas.Further, these notifcations can take the form of tangible instruments (such as colored lights)[18], or even a simple awareness display that can show which sensors are active in what location[54].Similarly, we also observed that our participants wanted to be notifed each time faculty can access data indicating that designers should prioritize notifcations whenever data is accessed by faculty.Thus, the design of awareness mechanisms should indicate who can access the data and highlight data access by any faculty member via certain interfaces such as digital nudge tools