Supporting the co-design of games for privacy awareness

. Privacy is a well-known concern connected to teenagers´ usage of e.g., social media, mobile apps, and wearables. However, providing proper learning in this area is challenging. Games have recently been proposed as a tool to increase awareness of privacy concerns. It is important that these games are relevant and engaging. In this paper, we present a workshop to involve teenagers in the co-design of games to promote privacy awareness, describing the workshop process together with the cards and the board that support the process. We evaluated the workshop together with students between 15-17 years of age divided in groups of 3-4 participants. Results show that all the groups were able to generate interesting game ideas and the workshop was perceived as entertaining.


Introduction
Privacy is an ever-growing concern. With the technological development and increase in use of connected devices, data is being collected everywhere. Terms of service are complicated, leaving people unaware of what type of data they share, with whom and what it is used for [17]. The new General Data Protection Regulation (GDPR) in Europe, in effect May 2018, addresses some of these concerns, but individuals still have to be aware of privacy issues and act accordingly in a rather complex context [4]. Teenagers are a user group for which concerns are higher. They are heavy users of digital services and might lack knowledge about data sharing and underestimate the risks. For example, a study conducted by NorSIS [14] shows that only 28,4% of Norwegian youth received training in information security in the last two years.
Serious games have recently emerged as a way for children to learn about sharing of personal data and privacy in an engaging and evoking way. Just to mention a few examples of privacy related serious games (hereafter simply games): ─ Friend Inspector, described in [3], is a game that aims to raise the privacy awareness of Social Network Sites (SNS) users, like Facebook. The conceptual design of the game focuses on the discrepancies between perceived and actual visibility of shared items. It is a memory-like game where the player is asked to guess the visibility of an item. To give the user a relevant context, the frame story is based around items shared on the user's own profile.
The final version of the paper will be published in the Proceedings of 21th International Conference on Interactive Collaborative Learning, Springer.
─ Master F.I.N.D., described in [16], also focuses on awareness about privacy risks in SNSs. The game is a fake SNS and is developed to be played individually by teenagers. A player takes the role of a web detective and attempts to solve missions through searching for information on profiles on the fake SNS. An example mission is to try to locate a person at a certain moment. ─ Google's Interland 1 , aims at educating children in four areas of internet security: Cyber bullying, phishing, password creation and sharing awareness. The player controls a character through different games, scoring points for completing tasks, while learning about safe Internet behavior at the same time.
Most of the existing games are addressing a limited number of risks, mainly focusing on sharing of information on social media, neglecting for example emerging risks connected to data collected through sensors. The aim of our research is to investigate how to foster human-centered design of novel games for promoting awareness about privacy by providing tools to engage teenagers in idea generation. Focusing on the recognized importance of the ideation phase in any design method [6], this paper presents a cardbased ideation workshop, i.e. a tool supporting the collaborative formulation of initial game concepts. The workshop, called Privacy Game Co-Design Workshop, is intended for non-experts, i.e. users without previous knowledge on the field of privacy or formal training in design techniques, with focus on teenagers as the main target group. The proposed workshop is an adaptation of the Triadic Game Design workshop [8]. It provides: (1) a structured process to guide ideation; (2) a board to focus the contribution of the players; and (3) a set of cards to focus on different aspects of the games.
The design of the workshop was an iterative process. We evaluated its usefulness in informing and guiding idea generation during two pilots and a final evaluation with 32 participants divided in 9 groups. Data was collected through observations, questionnaires, artifact analysis, and, for the pilots, a final group interview. All material is available on request under a Creative Common License.

Related work and background
The involvement of children in the co-design of privacy games and learning material has been lately recognized as important in, for example, [1]. In this paper the authors propose the use of Collaborative Inquiry method. The work presented in this paper is instead positioned in the research that aims at using card-based approaches to promote idea generation and playful user involvement in co-design [15]. As examples, in [12] the authors propose a set of cards and a structured workshop to promote co-design of IoT systems. Similar approaches are also used in game design, as e.g., in the work connected to tangible interfaces for learning games [5], for exertion games [13]; and to design for playfulness [11]. Cards are an effective vehicle to convert theoretical frameworks to guidelines that can be manipulated by designers [5], keeping users at the center of the design process [10,11] and facilitating creative dialogue and shared understanding. Cards can be a source of inspiration [11], facilitate collaborative and divergent thinking by providing a medium for conversation between stakeholders and designer [2,7], and providing a common ground [1]. As summarized in [12], card-based tools are ":..(i) informative: helping to describe complex concepts to non-experts, (ii) inspirational: helping trigger and guide brainstorming and idea generation, (iii) collaborative: engaging users by helping collaboration and creative dialogue…" However, cards should not be seen as stand alone, but rather complemented by clear guidance on how to use them [13], possibly in the context of a structured workshop process. In this context, we chose the Triadic Game Design [8] workshop as a foundation for our Privacy Game Co-Design Workshop. The Triadic Game Design is intended to support the design of serious games by pushing the designer to address in turn three core perspectives: 1. Play: how to make a game entertaining. Only considering this element would be the same as designing a regular game with no learning goals. 2. Meaning: how to make the game education. The game designed should provide a value beyond play itself like educating or raising awareness. 3. Reality: to ground the game in a specific real-world context.
In order to make a successful serious game, these three perspectives must be balanced, and they can complement each other or be conflicting. The proposed workshop is intended to have a flexible format and to adapt to different needs. In the original version of the workshop, participants are divided in groups of 3-4, and after an ice-breaking activity, they go through different assignments, the first three focusing in turn on each of the three core perspectives listed above plus a last one to bring the three elements together. For each assignment, a deck of cards is provided, identifying possible choices for the participants. In addition, a set of worksheets is used to provide questions that guide the creation of the game as well as space for recording design choices.
The Triadic game design workshop focuses on the creation of concepts rather than graphics. This is the main reason it has been chosen as starting point for the proposed approach. However, it has been adapted to target privacy and suit better to teenagers.

The co-design workshop
The Privacy Game Co-Design Workshop aims to include the target group as participants in a workshop to help generate ideas for serious games focused on privacy awareness. The goal is to be able to run the workshop in a classroom-setting with groups of 3-6 people and therefore generate multiple ideas (Fig. 1). The design of the workshop has been an iterative process. The authors used the Triadic Game Design workshop as a core, and made changes to adjust the workshop time scope, audience and altered the focus from "any" problem to privacy. The resulting workshop includes (1) a structured process to guide ideation; (2) a board to focus the contribution of the players; and (3) a set of 30 cards helping participants to focus on different aspects of the games they are conceiving. The 30 cards are divided into 7 Reality cards, 1 Meaning card, 14 Play cards and 8 Technology cards. Each phase should take approximately 30 minutes. It is difficult to set a firm timelimit on each step within the 30 minutes, as they are fluid and often overlap, though Step (iii) should take the most time, as it is where groups generate their ideas.
Rather than an initial ice-breaker activity like in the original workshop, the workshop includes an initial introduction to privacy. Though this initial part might be tailored, we have developed a Kahoot! quiz (https://kahoot.com/welcomeback/) and a short lecture about: What is privacy? What is online privacy? Risks of sharing personal information with other people/friends, and Risks of sharing personal information with companies or organizations through usage of services.

The Board
The original workshop provides detailed worksheet templates to document design choices. Since we aim at a shorter activity and at the involvement of teenagers, in our adaptation we decided to substitute the worksheets with a board. The board is used: (i) to scaffold the process, (ii) to collect ideas and notes during the process, and (iii) to support cooperation and interaction within the group. Because of its size (A2 format), the board enables 3-4 people to easily work around it. At the beginning of the workshop, each group receives a board that they can write on. The board is divided in 4 areas, one for each of the workshop phases ( Fig. 1, right). The areas are covered, and the groups have to discover the areas only during the related workshop phase. This is intended to help them focus. When an area is open, there are two sheets supporting the discussion. As an example, Fig. 2 shows the two sheets for the Reality phase. On one side there is a short description of the phase and the steps that have to be followed. On the other, there are some questions that are intended to trigger the discussion within the groups and an area to annotate the discussion and ideas.
In the sheet they can also select if they want to address challenges connected to the private sector or related to the use of personal data by companies.

Cards
The Privacy Game Co-Design Workshop uses four sets of cards, one for each phase of the workshop.
─ Reality. While the original workshop is open to any domain, in our workshop we focus on privacy and all the cards for reality are on privacy, each representing a different privacy scenario that can be addressed in the game. The reality cards are: Location Sharing; Smart Cities (example in Fig. 3, left); Health Devices; Activity Trackers; Social Media; Mobile App Permissions; Loyalty programs. The scenarios have been defined by analyzing cases reported in the media. The list of privacy problems is not exhaustive and can be extended to address other scenarios. The description of the scenarios is, by choice, broad enough to be interpreted in different directions, but still specific enough to provide focus on privacy. ─ Meaning. The original workshop includes a number of cards for promoting creativity around meaning. However, since the game that we aim at designing are connected to increasing awareness of privacy, we limit to the most relevant card, "Awareness and Attitude", i.e., the developed games will all focus on increasing awareness or change attitude towards data sharing. ─ Play. The cards to support participants in thinking about different types of game are the same than in the Triadic workshop, but text has been simplified to fit better to the target group and the game examples have been updated. ─ Technology. This deck of cards does not exist in the original workshop, but we have introduced it to promote the development of games that use a broader spectrum of technologies. Technology cards specify what kind of technology the serious game will be utilizing. Having a specific technology to design the game for may help the 6 participants to move away from traditional PC games and promote creativity. The technology cards are: Augmented Reality (example in Fig. 3, right); Virtual Reality; Mobile Computer; Console; Interactive Surfaces; Interactive Devices.

User studies
The workshop has been evaluated through two small pilots, mainly intended to finetune the workshop, and then a larger evaluation. Data was collected through: a questionnaire using a 1-5 Likert-scale and focusing on fun and perceived difficulty level; artifact analysis, i.e. the annotated boards; and observations by three of the co-authors who also acted as facilitators, with individual observations discussed in the team after the workshop. For the two pilots, the study also included a semi-structured audio recorded group interview with all participants [4]. For the final evaluation, no final interview was conducted because being in a school there were more time constraints. The participants to the studies were all teenagers in upper secondary schools. The first pilot was conducted with 3 participants who were spending two weeks at the university as part of their vocational education in ICT (Information and Communication Technology) and service design. The second pilot was conducted with 6 participants that were working at the university as part of a national program for which students in secondary schools can work one day in companies to collect money for a charity. The first group was therefore not compensated, whereas the second group received indirect compensation, circa 50 euro each, to charity. The final evaluation was conducted with two classes of a school with specialization in ICT, with a total of 32 students divided in 9 groups. The pilots were conducted at the university premises, while the final evaluation was conducted at the school. Participation of girls was very low, with only two girls attending the second pilot and 1 the final evaluation. We therefore do not perform any analysis of gender issues. The first pilot was conducted with an earlier version of the workshop. The workshop was then revised based on the results. The workshop as described in the previous section is the one resulting from this revision and it is the version that is evaluated in the second pilot and in the final study.

Results from the pilots
During the first pilot, the 3 students were put into one group. Participants were given a first version of the board, the Privacy cards as described above, all the Play and Meaning cards in the original Triadic workshop (updated and simplified), and the Technology cards. The group was able to conceive a relevant and interesting game idea, but they did get stuck on several occasions, needing help to get back on track. They also struggled to detach their ideas from the game examples in the cards. However, the questionnaire results show that the participants enjoyed the workshop. Their answers suggest that Part 1 (Reality) was the most boring, with a fun rating of 3.33, and the most difficult to combine with the other elements. The group discussion after the workshop confirmed the observations. The main concern of the participants was the difficulty to put together all the previous steps in the final game, especially the scenario from the Reality phase. As stated by one of the participants: "The difficult part is to make the privacy an essential part of the game while still keeping it interesting". Discussing the Meaning cards after the workshop, there was also a general consensus that many of the cards in the deck are difficult to understand, and that "Attitude" is the card best related to privacy risks. Many of the meaning cards wouldn't actually make sense in the given context. As a result of the evaluation, the following changes were made: ─ Participants are able to choose the Reality card (privacy scenario) they want to work with, but all the cards are presented at the beginning of the process. Combining all the elements proved too difficult, and Reality the most difficult one to incorporate. By letting the participants choose reality card it will be something they understand. ─ All the Meaning cards are removed from the deck, except for the "Attitude and Awareness" to focus on the fact that the games that have to be designed are aimed at changing attitudes and increase awareness, not developing any generic skill. ─ Redesign of the board to use better the available space, but also to help participants to concentrate more on the task at hand.
The participants of the second pilot were divided in two groups. Both groups were able to generate a relevant game. The process was smoother, with less breakdowns. The results from the questionnaires confirm the observations. The participants appreciated the presentation of each reality card before they selected one, as opposed to Pilot 1 where they drew a card blindly. In the second pilot there was no evidence that Phase 4 (working on technology and combining all previous parts) was hard. The fun-rating of part 4 was also higher than in Pilot 1. The groups felt they had sufficient time for each task, supporting the results from the first iteration. As a result of the second pilot only minor changes to the text on some cards and on the board were introduced.

Results from the main evaluation
The participants seemed to enjoy the workshop and worked well with the tasks, though they had to be reminded frequently to write down their ideas in the board. The different phases received increasing higher score in the questionnaire, with the last phase receiving the highest score, over 4 on average. The workshop seems to hit an appropriate difficulty level, with 23 out of 32 participants reporting the workshop to be neither easy nor hard, and only 2 experiencing it as difficult. Most of the participants also felt that they had enough time for the workshop (26 out of 32). A general positive attitude was also observed during the pitches, during which students seemed to enjoy presenting their ideas and listening to what the other groups had done. It is however worth to note that some of the pitches were very effective in presenting the ideas, while others were harder to follow, with poorer explanation of the context. Questions had to be asked to facilitate the pitching and clarify details.
The proposed game ideas were evaluated by the three facilitators when the groups performed their final pitch. The average of these scores can be seen in Fig. 4. The facilitators independently rated the ideas based on: ─ Privacy Scenario, how well defined the problem statement/scenario was. Did they think of the different roles, why it is a problem, provide an example. ─ Raising Awareness, did the participants find a problem to promote awareness for?
Did they find a game, and did they modify it in a meaningful way? ─ Entertainment Value, did they define goals, rules, and story for the game? Did it seem like a fun game to play? ─ Innovative, did the group come up with a creative new game concept? Did they combine existing concepts in an interesting way? ─ Overall Impression, the subjective overall impression.
The maximum possible score was 50 points, the highest given score 39 and the lowest just above 28. Most of the scores were in the mid 30's range. Most of the groups scored high on innovative thinking, with 7 of 9 groups with a score of more than 7 out of 10. Table 1 provides an overview of the game ideas generated during the final evaluation, specifying which cards have been used, the game concept, and the score.

Action
Computer First person stealth game, where the player attempts to infiltrate and take down an "evil" organization that abuses personal data without giving away personal data.

DISCUSSION
The Privacy Game Co-Design Workshop proved successful in supporting the co-design of serious games for privacy awareness. The results show that, in a limited amount of time, the participants were able to: ─ Select and elaborate a privacy-related scenario ─ Give a meaning to an existing game, i.e. turning an existing game into a game with a learning purpose ─ Come up with a fun new game in a specific genre ─ Reflect and combine the elements into one serious game for privacy awareness.
On the overall, the changes made to the original workshop are evaluated positively for the intended purpose. The workshop was perceived by students as an engaging activity and all the groups managed to come up with relevant ideas. As shown in Table 1, the groups produced ideas for different scenarios. It is interesting to underline that only 4 out of 9 ideas are related to social media, that is what normally students get information about. Also, 5 ideas do not use the computer as underlying technology, again increasing the potential innovativeness of the game.
Having a structured process proved to support generation of creative ideas. Through the different phases participants focus on different perspective of serious games and advance their design. In the pilot tests we experimented with letting the participants choose all their cards, as opposed to draw them, but feedback showed that this only lead to confusion. The participants were often excited to include different cards that did not seem to fit together, i.e., Social Media, Virtual Reality and Role-Playing Games. The resulting game idea was often very innovative and successful. That creativity permeates the entire process is also visible in the results, with 7 out of the 9 final game ideas receiving high scores on innovation.
The cards played their expected role of informing participants about different options, triggering discussion and idea generation, and promoting cooperation providing specific concepts for focus on.
The board provided a focal point for group interaction and scaffolding of the process, by providing different hints about the process as well as triggers to help the group to focus. The evaluation revealed however that the participants did not use the board as much as intended, often forgetting about the guidance questions meant to help their creative process. This might result in games that are less elaborated as well as in a more frustrating process. It is also important to note that the boards are an important outcome of the co-design workshop and are essential for designers who want to take the games further. It is therefore important that the workshop facilitator makes sure to give clear instructions and reminds participants about the proper use of the board.
Several of the games designed by the participants could be promising tools to raise privacy awareness. A challenge with advancing the ideas to game development is that they are often very complex as well as costly and difficult to realize. However, asking the participants to only create simple games is very likely to hinder their creative process and affect the final ideas. It is also important to note that the facilitators of the workshop are not necessarily looking for a final concept to implement, but rather ideas that can be combined or used as inspiration for creation of relevant serious games.
A recurring theme in the games from the workshop is to raise awareness by having in-game actions result in consequences. This applies to both negative actions, such as over-sharing of information, and positive actions, such as making good decisions. A drawback of using consequences of all actions as a mechanism to teach privacy awareness is that it requires a lot of resources in development to foresee and design all possible outcomes in the serious game.
The proposed workshop is intended to last between 2-3 hours to provide an activity that can easily be integrated into a busy school day. However, the evaluation shows that an extension of the activity might be beneficial. In particular, if there is time, the facilitator might consider using more time to provide: a more extensive introduction to privacy; more time for discussion after the pitches to generate knowledge exchange among the groups; starting a class discussion among the ideas.

CONCLUSIONS
In this paper we presented a workshop to promote co-design of games aimed at promoting awareness of privacy among teenagers, with focus on the early idea generation. The workshop includes a structured process to be used together with a board and cards. The workshop is an adaptation of the Triadic Game Design Workshop previously proposed in the literature. In addition to a general update of the cards proposed in the original workshop, the main proposed changes include a focus on privacy through the introduction of a deck of cards capturing different privacy scenarios; the introduction of a technology perspective and related cards, to promote the design of games adopting novel interaction approaches; the introduction of a board to scaffold the process and promote cooperation. The workshop has successfully been evaluated with 32 students. The participants of the main evaluation were all ICT students aged 15-17, with only one girl. The workshop needs therefore to be evaluated with a more diverse population. As part of our future work, we also aim at studying how the workshop can be used not only as a co-design tool, but also as a tool to promote learning of privacy in schools.