Consolidating online privacy preferences

[0001] 1. Technical Field

[0002] The present invention relates in general to a system and method for consolidating privacy preferences. In particular, the present invention extends Internet privacy preferences by creating location-based privacy preferences.

[0003] 2. Description of the Related Art

[0004] Modern computer users are increasingly mobile users that frequently travel with pervasive computing devices, such as laptop computers, personal digital assistants, mobile telephones, and the like. Pervasive computing devices are becoming ever smaller, and thus more mobile, devices. In addition, wireless communication networks are reaching more distant places, allowing the user to be connected to a computer network, such as the Internet, almost regardless of the user's physical location.

[0005] Today, Internet users are asked on a frequent basis to decide whether and under what circumstances to disclose personal information. The P3P (Platform for Privacy Preferences) specification, developed by W3C (the World Wide Web Consortium), defines an industry standard that provides a simple, automated way for users to gain more control over the use of personal information on Web sites they visit. When implemented in Web sites and browsers, the P3P specification is intended to bring a measure of ease to Web users wishing to decide when and under what circumstances personal information is disclosed.

[0006] At present, the P3P specification is focused primarily on wired Web privacy. However, as users become increasingly mobile, wireless and location-based services introduce new and heightened privacy concerns for consumers. The risks include unintentional or mistaken disclosure of personal information as well as access of sensitive, or confidential, information by unauthorized individuals. A challenge of the current P3P specification and current state of the art is that clear wireless privacy rules and regulations are lacking. Because of this, wireless location technology has the potential to pinpoint the geographic location of mobile users as well as track the movements and activities of such users. Another challenge with the prior art is that collection and cross-referencing of new levels of personal information will likely increase. Hence, wireless providers and carriers may be privy to users' personal information as well as the users' current geographic locations.

[0007] What is needed, therefore, is a system and method for providing users with the ability to choose when and where personal information is shared. This system and method should allow a user to choose to be anonymous in one location context, and identifiable in a different context.

[0008] It has been discovered that the foregoing challenges are overcome using a system and method that consolidates user privacy preferences for location-based services. Using the system and method, a mobile user is able to control the service providers to which the mobile user's location is transmitted as well as control the service providers from which the user wishes to receive content.

[0009] Service providers and other online vendors request the location and network identifiers of mobile users in order to provide the mobile users with content. Two modes of operation are supported. In a “push” operation mode, the service provider sends content to the location service agent which, based upon users' privacy preferences, sends the data to those users wishing to receive the content. In a “pull” operation mode, the user requests content (“pulls”) from service providers based upon the user's location and the user's privacy preferences.

[0010] The user's privacy preferences are described in an XML location document that includes the location format being used by the user, a link to the user's preference data, and the current location of the user's mobile device. The user's preference data is stored in a file that is linked to the XML location document. The privacy preference file includes global (default) privacy preferences that apply when the user is outside of established privacy locations. The user can also set up one or more privacy locations defined by a boundary (geographical coordinates) of each privacy location and the user's privacy preferences that apply while the user is inside the defined privacy location.

[0011] For example, the user may set up a default privacy preference that allows advertisements of restaurants to be received by the user's mobile device. In this manner, when the user is traveling, restaurant advertisements would be received notifying the user of nearby restaurants. The user could then set up a defined privacy location of the user's city of residence that does not allow restaurant advertisements to be received by the user's local device. Consequently, the user would not be bothered by restaurant advertisements near his home, as he likely knows the location of many restaurants, but would receive such information when traveling outside the user's city.

[0012] The foregoing is a summary and thus contains, by necessity, simplifications, generalizations, and omissions of detail; consequently, those skilled in the art will appreciate that the summary is illustrative only and is not intended to be in any way limiting. Other aspects, inventive features, and advantages of the present invention, as defined solely by the claims, will become apparent in the non-limiting detailed description set forth below.

[0020] The following is intended to provide a detailed description of an example of the invention and should not be taken to be limiting of the invention itself. Rather, any number of variations may fall within the scope of the invention, which is defined in the claims following the description.

[0021] FIG. 1 is a network diagram depicting location-based privacy preferences being applied to mobile devices. Mobile devices 100, such as Personal Digital Assistants (PDAs), mobile telephones, and mobile computing devices, receive content from service providers 140 based upon the user's location-based privacy preferences 170.

[0022] While a user is traveling, the user's mobile device 100 communicates over wireless pathway 105 to a WAP Gateway. “WAP” is the abbreviation for the Wireless Application Protocol, a secure specification that allows users to access information instantly via handheld wireless devices such as mobile phones, pagers, two-way radios, smartphones and communicators. WAP supports most wireless networks. These include CDPD, CDMA, GSM, PDC, PHS, TDMA, FLEX, ReFLEX, iDEN, TETRA, DECT, DataTAC, and Mobitex. WAP is supported by all operating systems. Ones specifically engineered for handheld devices include PalmOS, EPOC, Windows CE, FLEXOS, OS/9, and JavaOS. Because of its wide support, WAP can be used by the user whether using a handheld portable device or telephone or an operating system running on a notebook computer system.

[0023] WAPs that use displays and access the Internet run what are called microbrowsers—browsers with small file sizes that can accommodate the low memory constraints of handheld devices and the low-bandwidth constraints of a wireless-handheld network. Although WAP supports HTML and XML, the WML language (an XML application) is specifically devised for small screens and one-hand navigation without a keyboard. WML is scalable from two-line text displays up through graphic screens found on items such as smart phones and communicators. WAP also supports WMLScript. It is similar to JavaScript, but makes minimal demands on memory and CPU power because it does not contain many of the unnecessary functions found in other scripting languages.

[0024] WAP Gateway 110 is typically a fixed (land-based) computer system that communicates using the WAP protocol. In this manner, WAP Gateway receives mobile device location (GPS) data and other data from the mobile device (115) in WML, HTML, XML, and other formats and forwards the data to network 120 (e.g., the Public Switched Telephone Network (PSTN), the Internet, a private corporate or government computer network, etc.). WAP Gateway 110 also receives data 195 that includes content encapsulated in WML, HTML, or XML documents that is being sent by service providers 140 to mobile devices 100.

[0025] Network 120 interconnects the various network components of the system including WAP Gateway 110, Location Server 130, Location Service Agent 150, and Service Providers 140. Mobile device location coordinates 125 describe the mobile device's current location. Mobile device location coordinates 125 is transmitted through network 120 to location server 130.

[0026] Location service agent 150 receives requests from mobile devices 100, for those devices operating in a “pull” operating mode, as well as from service providers 140, for those devices operating in a “push” operating mode. Location service agent 150 compares the privacy policy of the service provider with the location-based privacy preference of users, stored in data store 170, along with the user's current location, retrieved from location server 130, to determine whether to redirect content from a particular service provider to a particular mobile device.

[0027] In a “push” operating environment, service providers 140 transmit the service provider's privacy policy, location data, and content to location service agent 150 in transmission 145. For example, the service provider might be a restaurant in Raleigh, N.C. with a particular privacy policy that specifies, among other things, that the restaurant does not share user data with others and that the restaurant's server does store cookies on the user's computing device. The content that the restaurant wishes to provide is an advertisement to the restaurant, and the location to which the restaurant wishes to cover are computing devices in the Raleigh-Durham area of North Carolina.

[0028] Location service agent 150 requests mobile device data from location server 130 corresponding to the mobile devices that are currently in the service provider's intended location (i.e., Raleigh-Durham N.C.) and receives from location server 130 the mobile device identifiers, such as the IP address, of all those devices currently in the service provider's intended location. Location service provider 150 retrieves the privacy preferences for each of the mobile users that are currently in the service provider's intended location from location-based privacy preferences data store 170. The user's privacy preferences are compared with the service provider's privacy policy to determine whether to transmit the service provider's content to the corresponding mobile device. For example, if the mobile device has requested not to receive advertisements, or not to receive content from a Web site that stores cookies on the user's mobile device, then the location service agent, using the example above, would not transmit the restaurant's advertisement. Furthermore, the user might have decided to receive this type of content outside of Raleigh-Durham, but not in the Raleigh-Durham area.

[0029] In a “pull” operating environment, the user's mobile device requests content from service providers that have a privacy policy consistent with the user's privacy preferences. In this environment, the user's location is provided by the user, the location service agent matches the user's location and privacy policy with service providers, and transmits content back to the user from those service providers that match the user's location and location-based privacy preferences.

[0030] In one embodiment, location service agent 150 is incorporated, along with privacy preferences 170, into the Web site of service providers 140. In another embodiment, the location service agent is a separate Web site that provides the service of matching mobile users to content being provided by service providers.

[0031] FIG. 2A is a diagram showing mobile user location information being provided to a service agent. Location server 200 receives location-based data from mobile devices that are being used by mobile users. The location server creates XML location document 205 that is forwarded to location service agent 210 for comparison against service provider privacy policies and determining whether to send the service provider's content to the mobile device.

[0032] FIG. 2B is a data diagram showing data included in the location document as well as privacy preference data included in the linkbase linked to the location document. XML location document 205 is shown to include location format 225, XLink to the user's location-based privacy preference data 230, and current location 235 of the user's mobile device.

[0033] Location format 225 is the geographic location format that is used by the user's mobile device. Examples of possible location formats include GPS coordinate format, postal (zip) code format, area code format, etc. The format used may be related to the type of mobile device being used by the user. For example, a mobile device that is a telephone might use the area code in which the device is currently located as such information can be provided by base station currently used by the mobile telephone. A cellular based format, providing more granularity than an entire area code, might also be used by mobile devices that access a cellular network. A computing device, such as a handheld computer or a notebook computer, equipped with a GPS receiver might use a GPS coordinate format.

[0034] XLink 230 is a XML document link to linkbase 240 that describes the user's privacy preferences. XLink is an abbreviation for XML Linking Language, a computer language that allows both unidirectional and bidirectional links to other resources (e.g., files, images, documents, programs, query results) to be embedded in XML documents, similar to the hyperlinks found in HTML Web pages. XLink gives XML documents the ability to assert linking relationships among two or more resources, associate a link with metadata, and express links that are in a location separate from the linked resources.

[0035] Linkbase 240 is referenced by XML Location Document 205 and includes location-based privacy preferences for the user. These privacy preferences include global (i.e., default) preferences 250 and various location-specific privacy preferences, such as 1^st location 260, 2^nd location 280, and other locations 295. Each location includes an optional description that describes the location, such as “Raleigh-Durham N.C.” Each location includes location boundaries (location boundaries 265 corresponding to 1^st location 260, and location boundaries 285 corresponding to 2^nd location 280). These locations include boundaries in the user's specified format. For example, using a postal code format, the boundaries would include the postal codes that are included in the location. In an area code or cellular format, the boundaries would include the area code(s) and/or cellular station identifiers that are included in the location. In a GPS format, the boundaries would include the GPS coordinates that define the location boundaries.

[0036] The user's privacy preferences are defined for each defined location. Default preferences 255 apply to any location that does not fall within a defined location. 1st location privacy preferences 270 apply whenever the user is within the 1^st location as defined by 1^st location boundaries 265. Likewise, 2^nd location privacy preferences 290 apply whenever the user is within the 2^nd location as defined by 2^nd location boundaries 285.

[0037] FIG. 3 is a flowchart showing steps taken by the location service agent to determine whether to push content to a mobile device. Service provider processing commences at 300 whereupon the service provider sends content for a given location (e.g., Raleigh, N.C.) and the provider's privacy policy to a location service agent at step 305. Service provider processing thereafter ends at 310.

[0038] Location service agent processing commences at 315 whereupon the location service agent receives the content, location information, and privacy policy from the service provider at step 320. At step 325, the location service agent requests the device identifiers (e.g., IP addresses, etc.) for the mobile devices that are within the location specified by the service provider from location server 328. At step 330, the location service agent receives the mobile device identifiers from the location server in response to the request.

[0039] At step 335, the first mobile device identifier is selected from those received by the location service agent. At step 340, the privacy preferences are retrieved from location based privacy preferences data store 345 based upon the mobile device identifier for the location in which the user's mobile device is currently located. At step 350, the retrieved location based privacy preferences are compared with the service provider's privacy policy (previously retrieved at step 320). A determination is made as to whether the service provider's privacy policy is acceptable to the user based upon the retrieved location based privacy preferences (decision 355). If the service provider's privacy policy is acceptable to the user given the user's current location, decision 355 branches to “yes” branch 360 whereupon the content is transmitted to the user's mobile device at step 365. On the other hand, if the service provider's policy is not acceptable to the user based upon the user's current location, decision 355 branches to “no” branch 370 bypassing step 365.

[0040] A determination is made as to whether there are more device identifiers to process within the service provider's requested location (decision 375). If there are more device identifiers to process, decision 375 branches to “yes” branch 380 whereupon processing selects the next identifier (step 385) and loops back to determine whether to send content to the newly selected device based upon that user's location-based privacy preferences. This looping continues until there are no more identifiers to process within the service provider's requested location, at which point decision 375 branches to “no” branch 390 and processing ends at 395.

[0041] FIG. 4 is a flowchart showing steps taken by the location service agent to determine whether to provide a service provider with a mobile user's unique identifier and current location. Service provider processing commences at 400 whereupon the service provider's privacy policy is sent to the location service agent at step 404.

[0042] Location service agent processing commences at 405 whereupon, at step 408, the location service agent receives the service provider's privacy policy. At step 412, the location service agent requests mobile identifiers, such as IP addresses, from location server 415. The mobile device identifiers and location data are received from the location server at step 420.

[0043] The first mobile device identifier received from the location server is selected at step 424. At step 428, the user's location based privacy preferences are retrieved from location based privacy preferences data store 432 corresponding to the current location of the user's mobile device.

[0044] A determination is made as to whether the user has defined location-specific privacy preferences corresponding to the user's current location (decision 436). If the user has defined location-specific privacy preferences corresponding to the user's current location, decision 436 branches to “yes” branch 438 whereupon, at step 440, the location-specific privacy preferences are selected. On the other hand, if the user has not defined location-specific privacy preferences for the user's current location, decision 436 branches to “no” branch 442 whereupon the user's default privacy preference is selected at step 444.

[0045] After user privacy preferences have been selected, the selected preferences are compared with the service provider's privacy policy at step 448. A determination is made as to whether the service provider's privacy policy is acceptable based upon the user's privacy preferences (decision 452). If the service provider's privacy policy is acceptable, decision 452 branches to “yes” branch 454 whereupon the device identifier for the user's mobile device is returned to the service provider at step 456. On the other hand, if the service provider's privacy policy is not acceptable, decision 452 branches to “no” branch 458 bypassing step 456 and the user's mobile device address is not provided to the service provider.

[0046] A determination is made by the location service agent as to whether there are more device identifiers that were provided by the location server that need to be processed (decision 460). If there are more identifiers to process, decision 460 branches to “yes” branch 464 whereupon the next mobile device identifier is selected at step 464 and processing loops back to process the newly selected device identifier. This looping continues until there are no more device identifiers to process, at which point decision 460 branches to “no” branch 466 and location service agent processing ends at 470.

[0047] Returning to service provider processing, the service provider receives the user's mobile device identifier and location information at step 472. Content corresponding to the user's location is retrieved at step 476. For example, if the service provider is a national restaurant chain, content for a location might include the address and directions to restaurants in the user's current location along with general advertisements regarding specials and promotions offered either throughout the restaurant chain or that apply to the restaurants in the user's current location. The retrieved content is sent to the user's mobile device at step 480.

[0048] A determination is made by the service provider as to whether there are more mobile device identifiers that need to be processed (decision 484). If there are more identifiers that need to be processed, decision 484 branches to “yes” branch 486 whereupon processing loops back to receive the next mobile device identifier and provide location-based content to the identifier. This looping continues until there are no more identifiers to process, at which point decision 484 branches to “no” branch 488 and service provider processing ends at 495.

[0049] FIG. 5 illustrates information handling system 501 which is a simplified example of a computer system capable of performing the computing operations described herein. Computer system 501 includes processor 500 which is coupled to host bus 502. A level two (L2) cache memory 504 is also coupled to host bus 502. Host-to-PCI bridge 506 is coupled to main memory 508, includes cache memory and main memory control functions, and provides bus control to handle transfers among PCI bus 510, processor 500, L2 cache 504, main memory 508, and host bus 502. Main memory 508 is coupled to Host-to-PCI bridge 506 as well as host bus 502. Devices used solely by host processor(s) 500, such as LAN card 530, are coupled to PCI bus 510. Service Processor Interface and ISA Access Pass-through 512 provides an interface between PCI bus 510 and PCI bus 514. In this manner, PCI bus 514 is insulated from PCI bus 510. Devices, such as flash memory 518, are coupled to PCI bus 514. In one implementation, flash memory 518 includes BIOS code that incorporates the necessary processor executable code for a variety of low-level system functions and system boot functions.

[0050] PCI bus 514 provides an interface for a variety of devices that are shared by host processor(s) 500 and Service Processor 516 including, for example, flash memory 518. PCI-to-ISA bridge 535 provides bus control to handle transfers between PCI bus 514 and ISA bus 540, universal serial bus (USB) functionality 545, power management functionality 555, and can include other functional elements not shown, such as a real-time clock (RTC), DMA control, interrupt support, and system management bus support. Nonvolatile RAM 520 is attached to ISA Bus 540. Service Processor 516 includes JTAG and I2C busses 522 for communication with processor(s) 500 during initialization steps. JTAG/I2C busses 522 are also coupled to L2 cache 504, Host-to-PCI bridge 506, and main memory 508 providing a communications path between the processor, the Service Processor, the L2 cache, the Host-to-PCI bridge, and the main memory. Service Processor 516 also has access to system power resources for powering down information handling device 501.

[0051] Peripheral devices and input/output (I/O) devices can be attached to various interfaces (e.g., parallel interface 562, serial interface 564, keyboard interface 568, and mouse interface 570 coupled to ISA bus 540. Alternatively, many I/O devices can be accommodated by a super I/O controller (not shown) attached to ISA bus 540.

[0052] In order to attach computer system 501 to another computer system to copy files over a network, LAN card 530 is coupled to PCI bus 510. Similarly, to connect computer system 501 to an ISP to connect to the Internet using a telephone line connection, modem 575 is connected to serial port 564 and PCI-to-ISA Bridge 535.

[0053] While the computer system described in FIG. 5 is capable of executing the processes described herein, this computer system is simply one example of a computer system. Those skilled in the art will appreciate that many other computer system designs are capable of performing the processes described herein.

[0054] One of the preferred implementations of the invention is a client application, namely, a set of instructions (program code) in a code module that may, for example, be resident in the random access memory of the computer. Until required by the computer, the set of instructions may be stored in another computer memory, for example, in a hard disk drive, or in a removable memory such as an optical disk (for eventual use in a CD ROM) or floppy disk (for eventual use in a floppy disk drive), or downloaded via the Internet or other computer network. Thus, the present invention may be implemented as a computer program product for use in a computer. In addition, although the various methods described are conveniently implemented in a general purpose computer selectively activated or reconfigured by software, one of ordinary skill in the art would also recognize that such methods may be carried out in hardware, in firmware, or in more specialized apparatus constructed to perform the required method steps.

[0055] While particular embodiments of the present invention have been shown and described, it will be obvious to those skilled in the art that, based upon the teachings herein, that changes and modifications may be made without departing from this invention and its broader aspects. Therefore, the appended claims are to encompass within their scope all such changes and modifications as are within the true spirit and scope of this invention. Furthermore, it is to be understood that the invention is solely defined by the appended claims. It will be understood by those with skill in the art that is a specific number of an introduced claim element is intended, such intent will be explicitly recited in the claim, and in the absence of such recitation no such limitation is present. For non-limiting example, as an aid to understanding, the following appended claims contain usage of the introductory phrases “at least one” and “one or more” to introduce claim elements. However, the use of such phrases should not be construed to imply that the introduction of a claim element by the indefinite articles “a” or “an” limits any particular claim containing such introduced claim element to inventions containing only one such element, even when the same claim includes the introductory phrases “one or more” or “at least one” and indefinite articles such as “a” or “an”; the same holds true for the use in the claims of definite articles.