Privacy at a glance
Not everyone reads the labels on their favourite snacks, but it’s comforting to know they’re there. The same principle ought to apply to the privacy of smart devices, says Dr. Khosro Salmani, PhD, an assistant professor in the Department of Mathematics & Computing at Mount Royal University.
At a time when internet-connected gadgets are increasingly ubiquitous, Salmani’s latest project offers consumers the kind of transparency expected in other areas of life — by introducing a "privacy label" for their devices.
"One day, I hope Canadians will care about data privacy as much as they care about calories," Salmani says. "Our goal is to give people the information they need to make informed choices about their privacy.”
When people feel secure in their digital privacy, Salmani contends, it reduces stress and empowers healthier choices in other areas of life. His work couldn’t be more timely as Canadians are increasingly faced with privacy decisions they often don’t fully understand — skimming past those long, jargon-filled disclaimers that come with every new gizmo.
Salmani, who has spent years researching data privacy and information security, began asking a critical question: Why hasn’t Canada adopted the kind of privacy labels already seen in other parts of the world? This inquiry led him to create a privacy label — something as simple to read as a nutrition facts label — that demystifies complex privacy terms into clear, concise details and brings this global trend closer to home.
From research to reality
The project began with a literature review, exploring previous work on privacy labels, consumer behaviour, and the security of the “Internet of Things” (IoT) — a category that includes everything from smartwatches to home security systems to internet-connected baby monitors. The team also studied how people's short attention spans influence their decision-making when it comes to privacy, reinforcing the need for a label that communicates key information quickly.
Next came the creation of the privacy label itself. Salmani, working alongside a team of student research assistants, designed a label that breaks down complex privacy issues into clear, easy-to-read sections.
Instead of listing ingredients or calories, this label highlights key privacy concerns such as data storage, video surveillance and third-party sharing. To make it even more intuitive, the team used colour coding as shorthand, with green, yellow and red indicating different levels of data risk.
“It’s important to make this information digestible,” Salmani says. “Instead of bombarding users with technical jargon, we focused on making the label as intuitive as possible.”
Personalized privacy: A customizable approach to data transparency
As the project progressed, Salmani’s team realized that privacy is personal — what matters to one person may not to another. With more than 40 potential criteria to include, the team grappled with the challenge of determining which information was most crucial.
Their solution was to create an app that allows users to customize the privacy label to suit their own preferences. By scanning a QR code, users can create their own label, selecting privacy factors that matter most to them — whether it’s avoiding video recording or ensuring data isn’t stored in the cloud.
With the app developed and the research shared with conferences and academic journals for review, the team conducted a survey to gauge how users felt about these privacy labels.
“The feedback was overwhelmingly positive,” Salmani says. “Participants loved the idea, and many said they would definitely check the label before purchasing a device if it were available.”
Empowering students through research
One of the hallmarks of Mount Royal University is its strong commitment to undergraduate research. As outlined in the 2023-2030 Academic Plan, the university aims to expand research opportunities to provide greater and more equitable access for students.
On this project, Salmani worked closely with a team of research assistants — Alyssa Landeta, Chidera Uzoka and Mohit Gupta — who were involved in every stage of the project, from literature review to app development.
Landeta’s contributions to the project included reviewing Canadian privacy policies and bylaws, designing the survey used for data collection, and conducting data analysis. She also took the lead in writing the research paper summarizing the team’s findings.
For Landeta, a third-year Bachelor of Computer Information Systems student, the experience was a unique chance to delve into a topic she was passionate about. She encourages other students to take advantage of similar opportunities.
"This project let me dive into something I was really interested in," she says. "It wasn’t just about getting credits; it was about real, hands-on experience that goes way beyond the classroom.
“Working one-on-one with a professor and watching everything come together was super rewarding."
Reflecting on the collaborative nature of the project, Landeta emphasizes how different perspectives made a significant impact.
"Bringing different skills together always makes things better," she says. "Doctor Salmani was an amazing leader, and working with students from other programs, plus getting more one-on-one time with the professor, made the whole experience even more valuable.
“It was an incredible project — definitely a 10 out of 10!”
Looking ahead: What’s next?
With a strong foundation in place, Salmani’s team is looking ahead to the next phase. Their focus now is on refining the app and making the label creation process even smoother for manufacturers and consumers.
They also hope to catch the attention of policymakers, encouraging conversations about the potential of privacy labels for IoT devices across Canada. It’s an active conversation happening across the world, as the Mount Royal research team’s work builds on global trends in privacy labelling.
Parts of Europe and Asia have already developed or are planning similar labelling programs for internet-connected devices. In March 2024, the U.S. Federal Communications Commission launched a voluntary labelling program that allows smart device manufacturers to display an emblem if they meet cybersecurity standards.
While Salmani is hopeful that tech companies will embrace privacy labels voluntarily, he acknowledges that it is more likely that laws will need to catch up with technology.
“The team’s dream is to see this idea fully realized in Canada," Salmani says. "Right now, it’s working well, but the next step is to make it mandatory for companies to create and use these privacy labels.
“That’s what we want for the future, to bring this idea closer to the real world."
Salmani understands that change will take time. But for him, privacy isn’t just a technical issue — it’s a fundamental right.
He points out that companies can use data to influence consumer buying decisions, often without individuals being aware of the subtle nudges they’re receiving. This challenge extends to the political arena as well, as demonstrated by the infamous Cambridge Analytica scandal, where personal data was used without consent to try shaping voter behaviour.
With privacy issues continuing to draw attention, Salmani hopes his work will help pave the way for a more transparent future.
"Ultimately, we want privacy to be part of the conversation whenever someone purchases a device," Salmani says. "It’s about ensuring people feel informed and empowered in a world where digital privacy matters more every day."