Why do They Need to Know I Spotted a Pothole? Privacy Issues in Canadian Municipal Problem Reporting Websites

Abstract
Users act as valuable ``citizen sensors’’ by reporting issues in public spaces enabling cities to address infrastructure problems in a timely manner. Municipal web sites are one method for collecting such reports, and they often ask for personal information such as name, phone number, and address in addition to reports. Together with common practices such as third party connections and the use of cookies, there is a serious potential for privacy loss, which should be addressed via a clear privacy policy. We examined 14 Canadian Municipal Problem reporting web sites considering issues like what information is required to report, third party connections, and privacy policies. We checked third party connections by sampling the web traffic sent when reporting a pot hole. One city did not provide a privacy policy. The coverage of the remaining 13 varied substantially. For example, five out of 14 cities required personal information to submit a report, but only one had a privacy policy that comprehensively addresses what happens to that data. All city websites contact more third parties during pothole reporting than are covered in their privacy policy. Such clear gaps in privacy policies might negatively affect citizens’ trust in the platforms.
Type
Publication
Mensch und Computer 2025 - Workshopband
Authors
Indrani Ray
(she/her)
PhD student
Indrani Ray is a current PhD student at the University of Waterloo working on how people control access to their stuff.

Authors
Kami Vaniea
(she/her)
Associate Professor
I am an Associate Professor at the University of Waterloo’s Department of Electrical and Computer Engineering (ECE) where I head the Technology Usability Lab in Privacy and Security (TULiPS). The goal of my research is to make security and privacy technologies more accessible for a wide range of users including end users, developers, and system administrators. I believe that technology should support people in their activities. My recent projects include topics like patch management, developer-centered privacy, phishing, online anonymity, smart speaker privacy, and privacy on social media.