A Longitudinal Study of Information Privacy on Mobile Devices

Privacy calculus in the e-commerce context explains information disclosure as a tradeoff between the perceived benefits and context-specific risks [6]. Also, the formation of perceived risks and disclosure intentions are determined by an individual's general privacy concerns with the environment.

3.1. Privacy Calculus Hypotheses

Because the nomological relationships in privacy calculus theory have been posited [6] and tested numerous times [2], [3], [7], [19], we do not formally hypothesize them here—although we test them in our study as a theoretical baseline. Importantly, we extend privacy calculus by accounting for changes in disclosure benefits and risks over time.

Privacy calculus is based on the assumption that consumers are rational [7]—meaning they can estimate the benefits and risks of information disclosure with some degree of accuracy and then make decisions based on a linear relationship, or tradeoff, between them. This assumption also implies that privacy calculus adopts the conceptualization of privacy as a commodity. That is, consumers can place a monetary value behind both the costs and benefits, thus making it possible to evaluate a perceived net gain/loss. Consequently, risks and benefits are independent of each other. They are calculated separately, yet both are used in the disclosure equation. Thus, if privacy calculus holds true as prior research has evidenced [2], [3], [7], [19], then increases in benefits over time should have no effect on perceived risk, yet also cause greater information disclosure:

HI:
As information disclosure benefits increase, app consumers will perceive less mobile app risk.
H2:
As information disclosure benefits increase, app consumers will disclose more information.

3.2. Prospect Theory Hypotheses

Although privacy calculus theory has proven to be a strong predictor of disclosure intentions, it has two limitations that we address. First, privacy calculus is intended to explain a cross-section of privacy beliefs and behaviors. A consumer's current risk and benefit assessment is what determines their current information disclosure. However, the risks and benefits of a given information technology (IT) are often changing, implying that a privacy calculus model might not be a good indicator of future behavior. For example, a news report of a serious security breach would certainly change users' risk perceptions. Similarly, if mobile app provider were to offer new incentives or functionality, then past information disclosure levels would be a poor indicator of future consumer behavior.

Privacy calculus assumes that consumers are rational and base disclosure decisions on a linear relationship between the risks and benefits of disclosure. Nevertheless, a recent study demonstrated in the mobile app context that this assumption is only partially valid [7]. Consumers tend to overweight the probability of risks, while underweighting the impact or cost of risks [7]. As a result, we propose prospect theory [12] as a useful lens to modify the privacy calculus model. A key proposition of prospect theory is that individuals strongly consider reference points when making risk decisions. For example, if a gambler is “up” from their original financial position, they will take fewer risks where as they will take greater risks if they are “down” in order to catch up to their original position. However, the actual risk (probability * impact) does not change.

Prospect theory can help inform the first limitation we described. If the benefits of information disclosure are increasing over time, consumers are in a “gain” position from their original reference point. Thus, they will be more risk averse. Conversely, if the benefits of information disclosure are decreasing over time, consumers will be in a “loss” position and willing to accept greater risks to return to the net gain/loss position they once had. This proposition is supported by recent research [7] that found consumers' perception of their level of prior risk exposure (i.e., the extent to which their personal information was already held by marketing companies) significantly increased their intention to disclose information again. Similarly, the level of prior benefits held significantly affected consumers future disclosure decisions. Therefore:

As information disclosure benefits increase, app consumers will perceive more mobile app risk.
As information disclosure benefits increase, app consumers will disclose less information.

In summary, we examine whether changes in information disclosure benefits over time are better explained by privacy calculus or prospect theory.

SECTION 4.

Methodology

As noted, we created a mobile app with an accompanying website to test the hypotheses. Five hundred and sixty-eight undergraduates at a large private university in the western United States participated during the spring semester of 2013.

The mobile phone application (called “findamine” or “find.a.mine” it the Apple App Store™ and Google Play™) was a geo-caching game. Each week (for 12 weeks), participants received three new clues on their phone or tablet (iOS and Android supported) through the mobile app. They earned points by deciphering the clue, travelling to the location, and taking a picture of the location through the mobile app. If they were correct, they earned points. Participants also earned points by sharing demographic information and uploading a photo on the personal profile they created on the website and by referring friends to join.

We provided weekly and end-of-game incentives to encourage play. Each week, we awarded 3–15 gift cards ($10 Visa or $11 campus gift card) to the participants who were first to find all of that week's locations. At the end of the game, the two participants with the most total points won a Samsung Galaxy Tab II™. We also held a random drawing, based on points earned, to award a third Samsung Galaxy Tab II™.

As seen in the example in Figure 2b&c, if players could not decipher the clue, they could use the “hot/cold” meter which indicated how geographically close they were to the target clue. Upon finding the clue, players pressed the “Found It!” button which prompted them to take a photograph through the app. After the photograph was submitted, participants could login to the mobile website and view their points on the leaderboard. Figure 3 shows the website leaderboard.

Figure 2. Mobile and Screen Shots

Figure 3. Game Leaderboard (website view)

4.1. Ensuring Experimental Validity

To generate valid and realistic information disclosure behaviors, participants needed to perceive actual personal risk and fear of disclosing information. This was accomplished in multiple ways. First, we obtained IRB approval to not require participants' informed consent because informed consequent automatically elevants' participants awareness of risk and the artificial nature of data collection. Rather, participants were recruited under the false pretense that a local mobile app business wanted to pilot test a new geo-caching app at their university. As a result, there was no priming effect on participants and they participants were less susceptible to social desirability bias. Moreover, they were told that the friends and family members they referred to the app did not have to be university students or employees.

Second, the context of the app was chosen to replicate several relevant forms of information privacy and encourage consistent disclosure. For example, by choosing an app design with weekly incentives, participants were motivated to play by more than just extra credit. Because it was a geo-caching app, there was a clear need to collect location data, which presents personal safety risks [19]. The social network aspect of the app created both additional enjoyment as well as creating vertical and horizontal personal information privacy risks [23]. The website included a player directory and social network (consisting of “frenemies” and “minions”¹). Players could search through and explore the app directory, which allowed them to view any player profile and app data that had been made public (like traditional social network apps) and add them to their social network. Thus, participants' personal information could legitimately be made publicly available—unless they set their privacy settings to restrict their data to “friends only” or “nobody.”

Third, the findamine app architecture needed to match those that are most potentially dangerous to consumers. In particular, the game was made possible by a native mobile app, a cross-platform website, and web services that connected the mobile app to the external database. When the app was introduced to participants, they were given a brief explanation of how the mobile app and website worked together with the same data. Consequently, participants were aware that the mobile app was capable of sending personal information to remote servers.

4.2. Experimental Manipulation

To understand how information disclosure behaviors change over time, we decided to manipulate the benefits of disclosure. As noted, participants were incented to disclose their profile data and personal photo by giving them points, which earned prizes, for each piece of information. At the beginning of the experiment, all participants were offered 35 points for each piece of information they disclosed. However, over the next three months until the final day, half of the participants were randomly assigned to have a gradual point reduction while the other half's points were increased over time. By the end of the experiment, one group was offered 65 points for each piece of information and the other group was offered 5 points. Participants knew their points were constantly changing because they frequently checked the leaderboard. They were also warned that point values would change during the course of the experiment² Figure 4 depicts a screen shot from a participant in the “decreasing” condition on the last day of the game. Participants were allowed to either submit or delete the profile data stored by this form at any time during the game. In this figure, no data has been entered. However, the participant could earn five points for each piece of information if they chose to submit it.

Figure 4. Example of Profile Points

4.3. Measures

Because of our research design, we were able to capture a variety of objective measures for overall game play and information disclosure. Six of them are included in this study representing three types of information which can be disclosed over mobile apps:

Personal information
1. Percent of overall profile information disclosed (0.0 to 1.0)
2. Accuracy of profile information entered (1=nothing was accurate, 6=everything was accurate)³
3. Privacy setting (O=nobody, 1 =minions only, 2=frenemies and minions, 3=all players)
Location data
1. Number of game clues found
Social network information
1. Number of referrals (required submitting friends' email addresses)
Controls
1. Number of updates to profile data
2. Number of website logins

In addition to the game measures, we collected latent construct measures of perceived disclosure risk (modeled as a second order formative construct consisting of both location data risk and personal information risk) and perceived disclosure benefits (modeled as a second order formative construct consisting of both locatability and personalization). These measures were based on prior relevant research [3], [7]. We also measured general privacy concern using a new and better-targeted instrument for mobile privacy [24]. Lastly, we included trusting beliefs which is an important determinant of perceived risk privacy calculus theory [6] and trusting behaviors such as information disclosure [25].

To capture these latent measures during the most relevant moments during game play, and to minimize the potential for common methods bias (CMB), we designed the findamine app to allow a few survey questions (typically 3-5) to be collected from the app as soon as a player selects a clue and before the map was displayed. Figure 2d shows an example screen shot of one survey. This screen is displayed before the screen shot in Figure 2b. Once the player answers the questions, they can proceed with the clue. During the game, not all clues had questions assigned to them. The items measured for this study were collected during the last few clues of the game after participants had had a couple of months of experience with the game—giving adequate time for players to form experience-based perceptions. In this way, we were able to capture perceptions during the moments those perceptions were relevant in the minds of players—as opposed to before or after the game when those beliefs would be only hypothetical.

SECTION 5.

Results

5.1. Measurement Validity

Pre-analysis was performed to analyze whether the measures were formative and/or reflective, test the convergent and discriminant validity of the reflective measures, test for multicollinearity, ensure reliabilities, and check for CMB. For brevity, the details are not reported here. However, the results indicated acceptable factorial validity and minimal multicollinearity or CMB based on the standards for IS research [26]–[29].

5.2. Hypothesis Testing

To analyze the results, we analyzed a path model with the PLS SEM technique using SmartPLS 2.0.M3 [30]. This was appropriate because we needed to test multiple paths in the same model, two of the constructs were second-order formatives, and PLS does not depend on normal distributions or interval scales [31], [32]—making it ideal for our measures of actual behavior.

Table 1 summarizes descriptive statistics of the players and their game play. About two-thirds (68%) of participants were male. Although participants could refer any friend to play the game they wanted to in order earn points, it originated in an $({\ssr R}^{2}=25.2\%)$ information systems course which was dominantly male.

Table 1. Descriptive Statistics

Table 2. Means, Std. Deviation, and Correlations

Table 2 summarizes the variable means, standard deviations, and construct correlations. Table 3 summarizes the path coefficients for the PLS model. The t-statistics were generated from running a number of bootstrap procedures equal to the number of samples $({\rm n}=569)$, ${\rm R}^{2}$ values represent the amount of total variance accounted for by the exogenous variables.

Table 3. PLS Path Coefficients and R2 Values

SECTION 6.

Discussion

Table 4 summarizes the hypothesis testing results. Perhaps most importantly, when the disclosure benefits increased over time, consumers perceived greater risks $(\beta=0.10, p<0.01)$; thus, supporting H3 rather than H1.

Table 4. Hypothesis Testing Results

Overall, the effect of changing profile data disclosure benefits supports H4 over H2. However, at first glance, it appears that the opposite is true for personal data. Technically, as benefits increased over time, participants disclosed more information ($\beta=0.10,\, p<0.01)$. Similarly, the information they did choose to disclose was more accurate $(\beta=0.18, {\rm p}<0.001)$. However, the profile data is the one type of information which can be disclosed inaccurately. Therefore, a posthoc interaction effect was tested. Typically, when participants updated their profile, they did so in order to disclosure more information $(\beta=0.19, {\rm p}<0.001)$ and, hence, gain more points. However, they typically did so with inaccurate information $(\beta=-0.82, {\rm p}<0.001)$. In other words, the increase in benefits only served to increase the disclosure of false data.

Concerning the other forms of disclosure, Participants completed fewer clues $(\beta=-0.09, p<0.05)$ (thus, disclosing less location data) and referred fewer friends $(\beta=-0.11, p<0.01)$ as the benefits for information disclosure increased.

In summary, the prospect theory hypotheses (H3 and H4) were best-supported. However, there are other interesting differences between our findings and prior research worth highlighting. For example, it is clear that trust plays a significant role in determining perceived risk and information disclosure although it has been omitted from some of the prior research [2], [3], [7]. In fact, perceived risks and benefits—the traditional independent variables in privacy calculus theory—become insignificant after accounting for trust when predicting profile disclosure and clues found. Although, perceived risk is clearly more important in predicting the number of referrals $(\beta=-0.20, p<0.001)$ and privacy settings $(\beta=-0.12, p<0.001)$.

Lastly, it is also worth noting that privacy concern was a significant predictor of profile disclosure ($\beta=-$, $0.21, p<0.001)$ and profile accuracy $(\beta=-0.10, p<0.05)$, but not for clues or referrals.

6.1. Implications for Research

Our research evidence supports prospect theory as a better explanation of the effect of changes in disclosure benefits on perceived risks than does the privacy calculus model. Consumers appear to be considering their original reference point of benefits when making risk decisions regardless of the fact that real risk has not changed. They become risk averse when they are in a “gain” position and risk seeking when in a “loss” position. That is, consumers appear to behave with “bounded” rationality because their level of risk aversion changes based on the direction of their change from a given reference point.

Further supporting prospect theory, consumers actually disclosed less location data (via finding clues) and referred fewer friends and family members as the benefits of disclosure increased. As hypothesized above, this is because consumers become increasingly risk averse after finding themselves in a gain position relative to their original reference point. However, privacy calculus still was appropriate in one scenario. In particular, when consumers made their initial and earlyterm disclosure decisions, their profile information was positively related to the benefits of disclosure. Rather, it wasn't until later when participants returned to edit their profile page that they decided to reduce this effect.

With several measures of disclosure (except for clues and referrals), trust played a larger role than perceived risks. That is, when consumers considered disclosing their own information, they based it on the trustworthiness of the app provider. However, when it comes to disclosing the email addresses of their friends and families, they considered the likelihood and impact of privacy risks. Consequently, our consumers treated the privacy of others as a commodity while their treated their own privacy as a right or a desired state. If this holds in other contexts, then researchers will need to more clearly focus on these distinctions going forward.

Another interesting implication for research is the role that perceived benefits does not play in disclosure decisions. After accounting for the direction of the change in benefits, perceived benefits had no direct effect on any form of disclosure. This finding underscores the importance of considering risk decisions (at least in the mobile app space) as processes rather than states. Consumers consider the directionality and likely future expectations of benefits over the current perceived benefit of information disclosure.

Lastly, general privacy concern played a larger role in actual disclosure than shown in previous studies of disclosure intentions [2], [3], [7]. Perhaps in known laboratory settings, general privacy concerns are more easily forgotten and relaxed because the participants have no legitimate threat to their privacy. In our context, privacy threats were naturally more legitimate. Another explanation may be that the privacy concern measurement used in this study was based on a more recent instrument that was targeted for mobile privacy concerns including location data [24].

6.2. Implications for Practice

The implications for practice are unique from prior studies. Most importantly, mobile app vendors should be wary of changes in app features and benefits. If the changes are perceived as an attempt to elicit more consumer information, they may have the opposite effect. However, it appears consumers are much more willing to disclose information about others and violate their privacy; hence, the natural points of focus for app providers should be on the perceived commodity of the information of “others” rather than on the consumer.

It appears from our study that privacy concerns in the field are much more salient than in artificial laboratory experiments. Thus, in practice, app producers need to place more effort on understanding and addressing specific concerns consumers might have that should be alleviated.

Perhaps the biggest conundrum of our study for practice is that consumers appear to be considering their original reference point of benefits when making risk decisions regardless of the fact that real risk has not changed. They become risk averse when they are in a “gain” position and risk seeking when in a “loss” position. Thus, the key for app developers is to find ways to move or keep consumers in a “loss” positions, perhaps by making the consumer feel

6.3. Limitations and Future Research

As with all research, there are several limitations of this study that also present useful areas for future research. First, not all consumers were perfectly explained by the prospect theory hypotheses. Some followed the commodity-based view of privacy and increased (decreased) their disclosure as the benefits increased (decreased). All we can tell from this study is that the majority of consumers in this context were best explained by prospect theory. Therefore, it would be useful to further develop theory by explaining why consumers would behave one way versus the other.

Next, we examined only one form of benefits manipulation. Changing the game points for profile data was an easily-quantifiable adjustment. Participants may have been skeptical about the reasons for point changes—leading them to behave differently than, for example, if new levels were added to the game for pure enjoyment unrelated to their leaderboard position.

Another limitation is the context of our field study. Although the perceived risks were real, our app was a game. The enjoyment of a game may trade off differently with perceived risks than, for example, the productivity benefits of an office app, or the health benefits of a fitness app. Future research should explore additional contexts and theorize about the differences between them.

Lastly, our population was not randomly selected and focused on college students in a close geographic area. This was a conscious tradeoff that allowed us to improve the realism of the field experiment. Any social network based context will require that many of the participants be geographically collocated. However, other apps could be examined without the social network context to obtain a more random sample.

SECTION 7.

Conclusion

In conclusion, we executed a realistic, longitudinal field experiment that allowed us to examine the effects of changes in the benefit/risk tradeoff. We discovered that consumers exhibit “bounded rationality” in their information disclosure decisions regarding mobile apps. As a result, the commodity-based view of information privacy is only partially appropriate for the mobile app context which incorporates personal information, location data, and social network data. Overall, prospect theory was more strongly supported

Cites in Papers - |

Cites in Papers - IEEE (3)

Select All

Imad Ali Hassoon, Anwar Chitheer Jasim, Nicolae Tapus, "Survey: the effects of disclosing general data vs.location data on customer privacy", 2018 17th RoEduNet Conference: Networking in Education and Research (RoEduNet), pp.1-5, 2018.

Show Article

Google Scholar

Chengjun Cai, Jian Weng, Jianan Liu, "Mobile Authentication System Based on National Regulation and NFC Technology", 2016 IEEE First International Conference on Data Science in Cyberspace (DSC), pp.590-595, 2016.

Show Article

Google Scholar

Abdullah Azfar, Kim-Kwang Raymond Choo, Lin Liu, "An Android Social App Forensics Adversary Model", 2016 49th Hawaii International Conference on System Sciences (HICSS), pp.5597-5606, 2016.

Show Article

Google Scholar

Cites in Papers - Other Publishers (18)

Karl van der Schyff, Greg Foster, Karen Renaud, Stephen Flowerday, "Online Privacy Fatigue: A Scoping Review and Research Agenda", Future Internet, vol.15, no.5, pp.164, 2023.

Yaping Zhu, Varun Grover, "Privacy in the sharing economy: Why don't users disclose their negative experiences?", International Journal of Information Management, vol.67, pp.102543, 2022.

Mauro Luis Gotsch, Marcus Schögel, "Addressing the privacy paradox on the organizational level: review and future directions", Management Review Quarterly, 2021.

Tendani Mawela, "Ambient Intelligence Systems for the Elderly: A Privacy Perspective", Computational Science and Its Applications – ICCSA 2020, vol.12249, pp.875, 2020.

Liang Xiao, Hangxiao Mao, Shu Wang, "Research on Mobile Marketing Recommendation Method Incorporating Layout Aesthetic Preference for Sustainable m-Commerce", Sustainability, vol.12, no.6, pp.2496, 2020.

Lu Yu, He Li, Wu He, Feng-Kwei Wang, Shiqiao Jiao, "A meta-analysis to explore privacy cognition and information disclosure of internet users", International Journal of Information Management, 2019.

Marc L. Resnick, Alina M. Chircu, Cyber Law, Privacy, and Security, pp.694, 2019.

Lili Nemec Zlatolas, Tatjana Welzer, Marjan Heričko, Marko Hölbl, Censorship, Surveillance, and Privacy, pp.1924, 2019.

Henner Gimpel, Dominikus Kleindienst, Daniela Waldmann, "The disclosure of private data: measuring the privacy paradox in digital services", Electronic Markets, 2018.

10.

Marc L. Resnick, Alina M. Chircu, Wearable Technologies, pp.1225, 2018.

11.

José Luis Gómez-Barroso, "Experiments on personal information disclosure: past and future avenues", Telematics and Informatics, 2018.

12.

Lili Nemec Zlatolas, Tatjana Welzer-Druzovec, Marjan Heričko, Marko Hölbl, Mobile Platforms, Design, and Apps for Social Commerce, pp.84, 2017.

Full Text: PDF Full Text: HTML Google Scholar

13.

Tyson T. Brooks, "Wearable IoT Computing: Interface, Emotions, Wearer'S Culture, and Security/Privacy Concerns" in Cyber-Assurance for the Internet of Things, pp.175-186, 2017.

14.

Tyson T. Brooks, "Bibliography" in Cyber-Assurance for the Internet of Things, pp.433-455, 2017.

Full Text: PDF Full Text: HTML Google Scholar

15.

Abdullah Azfar, Kim-Kwang Raymond Choo, Lin Liu, "Forensic Taxonomy of Android Social Apps", Journal of Forensic Sciences, vol.62, no.2, pp.435, 2017.

16.

Marc L. Resnick, Alina M. Chircu, Managing Security Issues and the Hidden Dangers of Wearable Technologies, pp.182, 2017.

17.

Abdullah Azfar, Kim-Kwang Raymond Choo, Lin Liu, "Forensic taxonomy of android productivity apps", Multimedia Tools and Applications, vol.76, no.3, pp.3313, 2017.

18.

Abdullah Azfar, Kim‐Kwang Raymond Choo, Lin Liu, "An Android Communication App Forensic Taxonomy", Journal of Forensic Sciences, vol.61, no.5, pp.1337, 2016.