Privacy Behavior Research Articles

A dimensionalised privacy behaviour model: an empirical test of a conceptual proposition

ABSTRACT Privacy research struggles with modelling how individuals value and enact privacy, and faces challenges in explaining apparent contradictions such as the privacy paradox and manifestations of privacy-related disempowerment. Such uncertainties arise from the use of unidimensional privacy constructs or through assumptions that privacy-related decisions are rational or intentional. Addressing these lacunae, we present and empirically test the Dimensionalised Privacy Behaviour (DPB) model, which simultaneously examines the relationships between privacy concerns and privacy-protecting behaviours (PPB) along privacy’s horizontal and vertical orientations, and introduces online privacy literacy and privacy self-efficacy as additional explanatory mechanisms in PPB modelling. Using data from a representative sample of 618 US social media users, we demonstrate that the privacy concerns/privacy behaviours dynamic is better understood along its vertically – and horizontally-oriented dimensions, and that each dimension interacts differently with explanatory elements. Furthermore, while affirming the established logic between privacy concerns and PPB, these results highlight privacy self-efficacy as a significant factor for explaining PPB, with differing effects in each dimension.

Playing with Privacy: Exploring the Social Construction of Privacy Norms Through a Card Game

Investigating digital privacy behavior requires consideration of its contextual nuances and the underlying social norms. This study delves into users' joint articulation of such norms by probing their implicit assumptions and "common sense" surrounding privacy conventions. To achieve this, we introduce Privacy Taboo, a card game designed to serve as a playful breaching interview method, fostering discourse on unwritten privacy rules. Through nine interviews involving pairs of participants (n=18), we explore the decision-making and collective negotiation of privacy's vagueness. Our findings demonstrate individuals' ability to articulate their information needs when consenting to fictive data requests, even when contextual cues are limited. By shedding light on the social construction of privacy, this research contributes to a more comprehensive understanding of usable privacy, thereby facilitating the development of democratic privacy frameworks. Moreover, we posit Privacy Taboo as a versatile tool adaptable to diverse domains of application and research.

Privacy paradox stems from overconfidence: a study of users’ privacy disclosure in online knowledge communities

ABSTRACT In OKCs, knowledge sharing is the main activity of users. However, the process of sharing knowledge inevitably discloses privacy. Understanding users’ privacy-disclosure behavior in OKCs is crucial for community development. In order to expose the phenomenon of privacy-disclosure behavior and privacy paradox in OKC, this study employs an explanatory sequential mixed methods design to explore the relationships among users’ privacy literacy (PL), the privacy paradox, and privacy-disclosure intentions in OKCs. We developed a research model based on privacy calculus and protective motivation theory, testing it among 442 long-term OKC users. Additionally, semi-structured interviews with 25 users provide qualitative insights. This paper indicates that many OKC users overestimate their PL, which influences their privacy-disclosure intentions and contributes to the privacy paradox. This implies that overestimating PL may be another reason for the privacy paradox. Furthermore, privacy attitudes and subjective norms emerge as significant factors shaping users’ decisions to disclose personal information, with peer perceptions playing a crucial role in users’ disclosure behaviors. This study contributes to the existing literature on privacy issues in OKCs by shedding light on the complexities surrounding users’ privacy behaviors. It offers practical recommendations for community managers and users to enhance privacy protection.

Effects of Cultural Factors at the Individual Level on Online Privacy Among Vietnamese University Students: An Empirical Study Using a PLS-SEM Approach

The research investigates how Hofstede’s cultural dimensions at the individual level influence online privacy among Vietnamese university students. The previous research findings, APCO model, Hofstede’s theory of cultural dimensions and the protection motivation theory were adopted to conduct the study hypotheses. Data from a sample of 386 students at a private university in Hanoi was analysed with the Partial Least Squares-Structural Equation Modeling (PLS-SEM). Findings show that collectivism, long-term orientation and uncertainty avoidance had a positive impact on privacy concern but they did not directly influence privacy behavior. Instead, they could affect privacy behavior through privacy concern. Masculinity had no significant impact on both privacy concern and privacy behavior. Power distance positively influenced privacy behavior, but it did not have any effects on privacy concern. Regarding the relationship between privacy concern and privacy behavior, the findings suggest a potential two-way connection between privacy concern and behavior, requiring longitudinal research to examine it thoroughly.

A Privacy Study on How Social Media Users Create Paradoxical Collective Behavioral Portraits

This study investigates the group characteristics of WeChat users’ paradoxical privacy behaviors by constructing user portraits to fully understand the differences between user group characteristics and paradoxical privacy behaviors on social media platforms, and to provide users with personalized privacy protection and targeted services, strategy and specific instructions. This study takes WeChat users as the research object and uses the Vals2 attitude scale as a reference to construct a group image annotation system for WeChat users' paradoxical privacy behavior from the perspective of psychological preferences. By issuing questionnaires, the paradoxical privacy behavior of WeChat users was analyzed using methods such as factor analysis, cluster analysis, and discriminant analysis. Clustering users' paradoxical behaviors in privacy to obtain data and characterize different user groups. Research results show that the group image of WeChat users’ paradoxical privacy behavior can be divided into three types: experience-oriented, mature and rational, and egocentric. This study proposes an ambivalent group behavior model of social media user privacy. In the future, we will modify the group portrait model and consider using it in other scenarios.

Engaging in cyber hygiene: the role of thoughtful decision-making and informational interventions.

The effectiveness of human-centric cybersecurity largely depends on end-users' adherence to security and privacy behaviors. Understanding and predicting variations in the adoption of these safeguards is crucial for both theoretical advancement and practical application. While existing frameworks are often adapted from health science literature, there is potential to enhance these models by incorporating criminological constructs relevant to online victimization. This study introduce rational choice theory of thoughtfully reflective decision-making (TRDM) into the information security domain. TRDM suggests that variations in cognitive decision-making capabilities influence behavioral outcomes, particularly in the context of security and privacy practices. The study employed a field experiment to test the applicability of TRDM in predicting end-users' engagement in security and privacy behaviors. Participants were exposed to security-related warnings, with the hypothesis that thoughtfully reflective decision-makers would be more likely to adopt robust protective behaviors. Data was collected on participants' responses to these security warnings, as well as their overall adherence to privacy and security practices. The findings support the theoretical framework: individuals exhibiting thoughtfully reflective decision-making tendencies demonstrated a higher likelihood of engaging in privacy and security behaviors. Specifically, participants with higher TRDM scores were more likely to adopt protective behaviors when warned of the consequences of non-compliance. These results indicate that cognitive decision-making capabilities significantly influence the likelihood of engaging in cybersecurity practices. The study challenges the prevailing one-size-fits-all approach to cybersecurity by highlighting the importance of individual differences in cognitive decision-making. Thoughtfully reflective decision-makers are better equipped to adopt preventive security measures, suggesting the need for more tailored interventions in cybersecurity education and risk assessment. This research contributes to the development of sophisticated risk assessment tools aimed at mitigating vulnerabilities and reducing users' susceptibility to digital threats. Incorporating TRDM into information security models provides a more nuanced understanding of user behavior, offering insights into how cognitive processes influence cybersecurity adherence.

Minors’ online privacy disclosure and protection behaviors: a systematic review

ABSTRACT The invasion of minors’ online privacy has become increasingly prevalent in recent years. Examining the disclosure and protection behaviours of minors about online privacy provides a theoretical basis for the development of educational activities aimed at safeguarding minors’ privacy. This study utilised visual analysis tools and content analysis of literature to systematically map out the research hotspots and evolution in this field. The findings revealed that (1) research in this area is thriving and interdisciplinary, (2) existing studies primarily focus on minors aged 12–18 and their active privacy disclosure behaviour in social media and other scenarios, as well as key influencing factors, (3) these studies not only examine the influence of minors themselves but also the influence of parents and peers on minors’ online privacy behaviours, and (4) most minors adopt avoidance strategies such as privacy settings and alternative websites to protect their online privacy. Further research could expand the research context, resolve controversial factors, use multiple methods, and explore additional privacy behaviours. This literature review plays a crucial role in generating academic discourse and provides valuable insights for developing privacy protection policies tailored to minors.

Honesty is the Best Policy: On the Accuracy of Apple Privacy Labels Compared to Apps' Privacy Policies

Apple introduced privacy labels in Dec. 2020 as a way for developers to report the privacy behaviors of their apps. While Apple does not validate labels, they also require developers to provide a privacy policy, which offers an important comparison point. In this paper, we fine-tuned BERT-based language models to extract privacy policy features for 474,669 apps on the iOS App Store, comparing the output to the privacy labels. We identify discrepancies between the policies and the labels, particularly as they relate to data collected linked to users. We find that 228K apps' privacy policies may indicate data collection linked to users than what is reported in the privacy labels. More alarming, a large number (97%) of the apps with a Data Not Collected privacy label have a privacy policy indicating otherwise. We provide insights into potential sources for discrepancies, including the use of templates and confusion around Apple's definitions and requirements. These results suggest that significant work is still needed to help developers more accurately label their apps. Our system can be incorporated as a first-order check to inform developers when privacy labels are possibly misapplied.

Revealed Privacy Preferences: Are Privacy Choices Rational?

We investigate the extent to which trade-offs involving the sharing of personal information exhibit consistency with an underlying rational preference for privacy. In an experiment, people engage in trade-offs across two domains of personal information sharing, allowing us to classify whether their choices satisfy the generalized axiom of revealed preference. They also subsequently price the sharing of their personal information. Sixty-three percent of subjects act consistently with a rational preference ordering when allocating privacy levels, a level comparable to that observed in other domains. Individuals who are inconsistent when engaging in simple privacy trade-offs exhibit substantially more costly preference reversals when pricing personal information sharing. Only one-third of subjects exhibit consistency across both the selection of personal information to share and the pricing of such information sharing. Our results imply that monetizing personal information can have distinct welfare consequences for people with different degrees of rationality in their underlying ability to make sensible trade-offs involving personal information. We also provide evidence that preferences elicited over choices in our experiment correlate with real-world privacy behaviors. This paper was accepted by Yan Chen, behavioral economics and decision analysis. Funding: This work was supported by Forschungskredit (University of Zurich) [Grant FK-17-017] and Schweizerischer Nationalfonds zur Förderung der Wissenschaftlichen Forschung [Grant 174630] to Y.S. Lee. Supplemental Material: The online appendix and data files are available at https://doi.org/10.1287/mnsc.2022.00807 .

LSTEG: An evolutionary game model leveraging deep reinforcement learning for privacy behavior analysis on social networks

With the investment of third-party companies, various accurate recommendation services have emerged on social network platforms, making convenience and privacy concerns coexist for users. Platforms, users, and third-party companies have conflicts of interest around privacy issues, and privacy protection is not the only goal for them. For the analysis of multi-party behaviors related to privacy, a long short-term evolutionary game model (LSTEG) is proposed, where the long-term and short-term evolutionary processes describe the dynamics between three parties and between users, respectively. Their dynamic evolutionary processes are described by mean dynamic equations and all possible stationary-state conditions are analyzed theoretically. Deep reinforcement learning is adopted to solve these evolutionary stationary states and to reveal the rules of interdependence between long-term evolution and short-term evolution. Experiments conducted on real-world datasets show that this work can help platforms, users, and third-party companies to get a better sense of what is occurring in dynamic network environments.

To disclose or to protect? Predicting social media users’ behavioral intention toward privacy

PurposeIn the paradox of personalized services and privacy risks, what factors influence users’ decisions is considered an interesting issue worth exploring. The current study aims to empirically explore privacy behavior of social media users by developing a theoretical model based on privacy calculus theory.Design/methodology/approachPrivacy risks, conceptualized as natural risks and integrated risks, were proposed to affect the intention of privacy disclosure and protection. The model was validated through a hybrid approach of structural equation modeling (SEM)-artificial neural network (ANN) to analyze the data collected from 527 effective responses.FindingsThe results from the SEM analysis indicated that social interaction and perceived enjoyment were strong determinants of perceived benefits, which in turn played a dominant role in the intention to disclose the privacy in social media. Similarly, trust and privacy invasion experience were significantly related to perceived risks that had the most considerable effect on users’ privacy protection intention. And the following ANN models revealed consistent relationships and rankings with the SEM results.Originality/valueThis study broadened the application perspective of privacy calculus theory to identify both linear and non-linear effects of privacy risks and privacy benefits on users’ intention to disclose or protect their privacy by using a state-of-the-art methodological approach combining SEM and ANN.

How Do Job Seekers Respond to Cybervetting? An Exploration of Threats, Fear, and Access Control

The cybervetting activities of potential employers present a significant threat to job-seeking social media users because their content becomes vulnerable to unwanted access and scrutiny. Without control over access, personal information may be gathered from social media and used in ways that harm the job seeker. Access control is a critical element of information privacy that has not received much attention but can help explain individuals' privacy behaviors. We use a protection motivation framework and a fear appeal to examine how job-seeking SNS users respond to cybervetting. We analyze the responses of 375 job-seeking SNS users to understand the relationships among threat perceptions, fear, coping responses, access control, and intention to implement and use an ephemeral application. We argue that when confronted by cybervetting, job-seeking SNS users are favorable toward using an ephemeral application because it bolsters privacy and meets the psychological need for control over access. Our results show that access control moderates the fear response to cybervetting, it is prompted by users' coping responses, and it helps explain why response efficacy and self-efficacy are predictive of behavioral intention.

Investigation and Protection of Social Media Users’ Privacy Behavior

Investigation and Protection of Social Media Users’ Privacy Behavior

Data, digital markets, and the economic value of privacy

The paper considers the role that the development of digital markets has played on the economic value of privacy in the last decades. It first discusses the possible definitions of privacy by highlighting the high degree of heterogeneity. It then assesses the economic value of privacy and how it has been influenced by digital technologies, in terms of costs, benefits and externalities. The paper also examines the digital paradox, i.e. the dichotomy between privacy attitudes and privacy behavior. It then proposes a series of empirical findings on the value of digital privacy, by underscoring the high degree of contextuality of this measure. Lastly, the paper discusses the relevance of regulations, especially the General Data Protection Regulation by the EU and the California Privacy Rights Act, to meet the requirements of fair information practices and their economic effects.

Privacy concerns and social desirability bias

Privacy concerns may influence many choices consumers make. However, their expressed concerns are sometimes inconsistent with their information-sharing and privacy-protecting behaviors. Many theories have been proposed to explain the paradoxical gap between privacy attitudes and behaviors. Part of the privacy paradox may be explained with two measures that have received limited consideration: impulsiveness and social desirability bias (SDB). Surveys of US adults in 2015 and 2022 included questions to measure several types of privacy concerns along with impulsive tendencies and SDB (N = 2729). Age, education, gender, race, income, and impulsive tendencies were linked with some privacy concerns. If people with above-average concerns also disclose personal information on impulse, it might explain part of the paradox. Large coefficients on the SDB measure suggest that individuals who adjust their responses to be consistent with social norms may also overstate specific privacy concerns. For these individuals, their high expressed concerns may be inconsistent with their privacy behaviors. When researchers try to explain consumer attitudes or actions that involve privacy, multiple privacy concern dimensions should be considered and demographics, impulsive tendencies, and SDB should be included in the models.

Un-Paradoxing Privacy: Considering Hopeful Trust

Extant literature has proposed an important role for trust in moderating people’s willingness to disclose personal information, but there is scant HCI literature that deeply explores the relationship between privacy and trust in apparent privacy paradox circumstances. Attending to this gap, this article reports a qualitative study examining how people account for continuing to use services that conflict with their stated privacy preferences, and how trust features in these accounts. Our findings undermine the notion that individuals engage in strategic thinking about privacy, raising important questions regarding the explanatory power of the well-known privacy calculus model and its proposed relationship between privacy and trust. Finding evidence of hopeful trust in participants’ accounts, we argue that trust allows people to morally account for their “paradoxical” information disclosure behavior. We propose that effecting greater alignment between people’s privacy attitudes and privacy behavior—or “un-paradoxing privacy”—will require greater regulatory assurances of privacy.

Is knowledge power? Testing whether knowledge affects chilling effects and privacy-protective behaviors using browser histories

This study examines whether providing users with declarative and procedural privacy knowledge positively affects behaviors to safeguard their privacy. Two forms of coping behaviors were in focus: Measures that reduce data collection by technological means (privacy-protective behaviors) and self-restraint in the use of online services (chilling effect-related behaviors). We hypothesized that a combination of declarative knowledge and procedural knowledge as opposed to declarative knowledge alone increases privacy-protective behaviors while being less likely to induce chilling effect-related behaviors. Data were obtained using an experimental study design combined with browser histories. Individuals were exposed to video treatments providing them with a) declarative knowledge or b) a combination of declarative and procedural knowledge, while the control group received no treatment. The study attracted a total of N = 500 participants for self-report data and N = 252 participants with data donations from a student sample in Austria. The findings indicate that both knowledge treatments increased recipients' privacy concerns. Furthermore, the declarative and procedural knowledge treatment increased participants’ self-efficacy. However, increasing knowledge did not translate into more pronounced privacy behaviors. Tentative evidence suggests that privacy fatigue might play a particularly important role in explaining these null findings.

The Effect of Privacy Fatigue on Privacy Decision-Making Behavior

With the rapid growth of information communication technology, internet users face constantly demands to manage privacy setting and make decisions on whether to disclose privacy data in the digital environment. Such privacy-related decisions and actions are heavily influenced by users’ level of trust, privacy concerns, perceived risks, and perceived benefits. One recently recognized factor that may impair privacy behaviors is privacy fatigue. This study will employ a within-subjects design with eye-tracking devices in which participants complete the same online decision-making task. Additionally, potential covariates, including privacy concern and digital privacy literacy, will be controlled for. We expect that higher level of baseline privacy fatigue will reveal poorer privacy decision-making outcomes, which will be represented by more frequent acceptance of online cookies. Moreover, we predict that participants’ pupil dilation, a physiological index of cognitive effort, will decrease, and privacy fatigue levels will increase over the course of the online decision-making task.

The Impact of Shared Information Presentation Time on Users' Privacy-Regulation Behavior in the Context of Vertical Privacy: A Moderated Mediation Model.

Combining data-sharing models and algorithm technologies has led to new data flow structures and usage patterns. In this context, the presentation time of shared low-sensitivity information across platforms has become a crucial factor that affects user perception and privacy-regulation behavior. However, previous studies have not conducted an in-depth exploration of this issue. Based on privacy process theory, this study discusses the impact and potential mechanism of the presentation time (immediate or delayed) of shared low-sensitivity information across platforms on privacy-regulation behavior. Through a pre-study and two online survey experimental studies, which included 379 participants in total, we verified that the immediate information presentation time has a significantly higher impact on online vigilance and privacy-regulation behavior than the delayed condition, βdirect = 0.5960, 95% CI 0.2402 to 0.9518; βindirect = 0.1765, 95% CI 0.0326 to 0.3397, and users' perceived control as the moderating role influences online vigilance and privacy-regulation behaviors (preventive or corrective), βpreventive = -0.0562, 95% CI -0.1435 to -0.0063; βcorrective = -0.0581, 95% CI -0.1402 to -0.0065. Based on these results, we suggest that the presentation time of using shared low-sensitivity information across platforms should be concerned by companies' recommendation algorithms to reduce users' negative perceptions and privacy behaviors and improve user experience.

Are digital natives overconfident in their privacy literacy? Discrepancy between self-assessed and actual privacy literacy, and their impacts on privacy protection behavior.

Privacy literacy is recognized as a crucial skill for safeguarding personal privacy online. However, self-assessed privacy literacy often diverges from actual literacy, revealing the presence of cognitive biases. The protection motivation theory (PMT) is widely used to explain privacy protection behavior, positing that whether individuals take defensive measures depends on their cognitive evaluation of threats and coping capabilities. However, the role of cognitive biases in this process has been understudied in previous research. This study focuses on Chinese digital natives and examines the differential impacts of subjective and objective privacy literacy on privacy protection behavior, as well as the role of cognitive biases in privacy decision-making. The results show that there is no significant correlation between subjective and objective privacy literacy, and a bias exists. When privacy concern is used as a mediating variable, there are significant differences in the paths through which subjective and objective privacy literacy influence privacy protection behavior. Furthermore, privacy literacy overconfidence moderates the relationship between privacy concern and privacy protection behavior. The findings confirm the influence of cognitive biases in privacy behavior decision-making and extend the PMT. This study also calls for the government to enhance privacy literacy training for digital natives to improve their privacy protection capabilities.