# Revision Plan
**We agree with most comments from the reviewers and will make the necessary changes. We also clarify some comments due to unclear descriptions or mis-understanding. See details as follows.**

*The biggest remaining concern was that
it still wasn't always 100\% clear what language, questions, etc. the
subjects saw under what circumstances.

*I'm honestly having trouble figuring out precisely what question
language and other details participants in your studies saw at what
points in various parts of the paper, such as Section IV.

**This is due to the fact that we have conducted several studies, and they sometimes differed in subtle ways. In the current paper, we present them in a way that minimizes repeating the common parts. As a result, it is not easy to extract exactly what happened in each study. We plan to remedy this situation by updating procedure descriptions (see Sective IV A&B as an example in the end of current plan) and including the surveys for all studies in the Appendix (see survey of Experiment 1 LDP condition in the end of current plan as an example).**
We are open to adding a new short section on summary of all possible studies and move a couple of introductory things to the main body.

*Near the end of Section 2.B, you say "LDP is the ideal choice for a
rational user as it provides better..." This relates to an earlier
concern I expressed: this isn't necessarily always the case. Changing
this to "LDP provides better..." would make your point while avoiding
this issue.

**We agree, and plan to change to: LDP provides better privacy promise than DP does in the health app data sharing context, which would be preferred by users [8].**

*In Section IV, C, I don't believe that you presented the "second check
question" for readers.

**We described the presentation of second check question in Revision Section IV, B last paragraph line 5.**
We will further clarify it like this:...

*Section V.C shows the potential of this paper for me. It's well-organized and clear. You should strive for this with the rest of
the paper.

**We thank the reviwer's postive comment, we plan to add a summary for Experiments 3 and 4 similarly as Section V.C.**

*In my prior review, I raised concerns about your use of the "in sacrifice for..." This still appears in Appendix A.A. The issue here
is not the word "sacrifice." The problem is that the sentence is unclear due to language issues. "Will you protect A in sacrifice for B"
likely means "Would you be willing to sacrifice B to protect A," but the existing grammatically incorrect language could be misinterpreted as
"Will you sacrifice protection of A for B?"

**We made a typo previously. In fact, we use "in sacrifice of" in the study. We will correct it in the revision.**

*I personally found Figure 1 more confusing than helpful in its present
state.

**We conjecture the layout of Experiments 3 and 4 in Figure 1 may be confusing. We plan to remove them and use Figure 1 mainly depicts the flows of Experiments 1 and 2.**

*In Section II.B, you say "This is similar to how privacy policies are used in practice." Do you have any evidence that people are relying on
expert assessment of privacy policies in practice (versus simply not
reading because they're long and full of legalese)?

**We plan to change that to: In practice, people are not reading privacy policies because they are long and full of legalese. At the same time, when a company's privacy policies and practices are inadequate, this will often be discovered by experts and lawsuits may ensue.**

*In Section IV.A, you might want to mention the experiment time statistics when mentioning the payment.

**We plan to add median completion time. See details in the end of the drafted updates for Experiment 1 Section IV. B.**

*In Section VI.A, you say "we described the three steps of role play..." You might want to reference Section III.C to make this clearer.

**Thanks for the suggestion. We will add the reference in the revision.**

*On page 11, I'd move "(see details in Appendix B)" to the end of the
prior sentence.

**We will make the corresponding changes as suggested. **

*I'm slightly confused by why you changed so much for the "Flow" cases. This makes it harder to compare against the other cases directly.

**We agree that flow descriptions were significantly different from the other descriptions. While prior descriptions focus on definitions and direct privacy implication descriptions, the flow descriptions focus on inferences of implications. We believe these descriptions highlight three different aspects of differential privacy descriptions, and they are comparable.**
This was requested by the meta-review for the revision.

*Typo, gramma, language

**We will do another round of careful review for language, grammar, and general clarity.**

**Draft of Section IV A&B.**

A. Participants and Stimuli
We recruited 598 Amazon MTurk workers. Each participant was paid 1 US dollar for completing the study (median completion time about 5 minutes). The payment rate was the same for all experiments except Experiment 3 (see details in Table XI). The descriptions of DP and LDP used in the study focused on definitions, and we listed the organizations which have implemented the techniques (see Table XII).

B. Procedure
After accepting the HIT, all participants were directed from MTurk to a survey on Qualtrics, and were assigned to one condition randomly.
At the beginning of all
conditions except the *Control*, We emphasized the benefit of sharing personal information in which participants were shown the following text:

• *In the current information age, everyone faces one question:
Will you share your personal information in return for a product, service or other benefits?*

The study continued with a goal description:
“The purpose of this study is to understand what kind of information you are willing to share with a health app, and how you would like your data to be used.” Following the three-step health-app data collection scenario, the corresponding differential privacy communication was presented in the *DP* or *LDP* condition.

....

For the conditions with DP or LDP communication, an extra check question (see Section~\ref{sec:design_comm}) were presented before data sharing decisions.

**Survey of LDP condition in Experiment 1**

In the current information age, everyone faces one question: Will you share your personal information in return for a product, service or other benefits?  

The purpose of this study is to understand what kind of information you are willing to share with a health app, and how you would like your data to be used. 

For this survey, suppose: 
(1) you just download a health app (Orange Health) and start to use it; 
(2) to ensure appropriate health suggestions and recommendations,  the app asks you to provide some information, for example, your age and gender for accurate recommendation of daily calorie intake; 
(3) the app server also requests permission to access and collect information to provide you better user experience, for example, the information you shared will be used to train some machine learning algorithms at the server, which will then be used to provide more accurate predictions for all the users;

To respect your personal information privacy and ensure best user experience, the data shared with the app will be collected via the local differential privacy (LDP) technique. LDP protects users’ privacy by adding random noise to each response that users give such that the probability that any user's attribute is inferred is similar as he or she is opt-out for the data collection.

**Please select which of the following description is correct about local differential privacy (LDP).**

* A privacy protection technique that adds random noise to the aggregated data (e.g., average age) collected from groups of users, such that the users' privacy can be protected in the same way as he/she is opt-out for the data collection.
* A privacy protection technique that adds random noise to each response that the users provided such that the users' privacy can be protected in the same way as they are opt-out for the data collection.
* It has not been implemented by any organization or companies yet.
* None of above is correct.
* I prefer not to answer.

*LDP description was presented again when participants did not answer the above check question correctly.*

*Then participants saw 14 survey questions presented with a smartphone layout in a randomized order. They decided their answer and select how they would like their answer being used for each question.*

**How would you like your answer to the following question being used?**
* Only used by the app locally
* Used by the app locally and the server with LDP
* Neither used by the app locally nor the server with LDP
* I prefer not to answer

1. Clear what language, questions, etc. the subjects saw under what circumstances.
2. Make other sections similarly clear and well-organized as Section V.C
3. The confusion caused by "in sacrifice for...": we agree with the reviewer that it may introduce confusion to subjects; we will discuss it in the limitation.
4. Improve Figure 1 (maybe change it back to the previous version).
5. Include reason why the "Flow" cases are different from other cases.

Revision already done:

* Near the end of Section 2.B, "LDP is the ideal choice for a rational user as it provides better..." -> "LDP provides better..."
* On page 11, move "(see details in Appendix B)" to the end of the prior sentence.
* In Section VI.A, reference Section III.C when saying "we described the three steps of role play..."
* In Section II.B, "This is similar to how privacy policies are used in practice." - give some evidence or reference
** aiping will find it
* Correct the typos accordingly.

Revision questions:

* Is there a page limit of the revision for both the main body and the total paper.
* In Section IV, C, present the "second check question" for readers.
** we did asked the question and included stats for it; but the reviewer said he did not believe we asked the second check question
* In Section IV.A, mention the experiment time statistics as well as the payment.
** we included time statistics in table xi; we will mention it in the main body