Privacy engineering aims to respect and protect user privacy. In order to ensure that privacy protections actually meet people’s privacy needs it is important to understand those needs, concerns and expectations and build privacy into systems with a user-centric perspective. This session will draw on the speaker's research regarding privacy notices and controls online, on smartphones and with smart speakers to discuss how and why privacy controls are often misaligned with user needs and how we can design privacy for users instead of past them. It will also examine how user studies can inform the design of user-centric privacy protections to more effectively meet user needs, as well as benefit companies.