Why Johnny Fails to Protect his Privacy

Abstract

Albeit people worldwide cry out for the protection of their privacy, they often fail to successfully protect their private data. Possible reasons for this failure that have been identified in previous research include a lack of knowledge about possible privacy consequences, the negative outcome of a rational cost-benefit analysis, and insufficient ability for protection on the users' side. However, these findings mainly base on theoretical considerations or results from quantitative studies, and no comprehensive explanation for users' privacy behavior has been found so far. We thus conducted an interview study with 24 participants to qualitatively investigate what are (1) users' mental models of privacy consequences, (2) obstacles for privacy protection, and (3) strategies for privacy protection. Our results provide evidence for all possible explanations: We find that most of our participants are indeed unaware of most consequences that could result from not protecting their privacy besides personalized advertisement and financial loss. We also identify several obstacles for privacy protection, such as protection being too much effort, too complicated, users lacking knowledge, or social aspects. Protection strategies mostly base on reducing the amount of data disclosed and most users refrain from using advanced PETs. We further identified additional factors which influence whether people adopt measures to protect their privacy and propose a model which subsumes all factors that are relevant for people's decision to apply protection measures.

Exploring mental models of the right to informational self-determination of office workers in Germany

“…Moreover, it is questionable whether ex-ante control would allow employees to manage their privacy in a reasonable way, given that our results, similar to findings from online privacy research [23,54], suggest that privacy management is burdensome and that current intervention options are inadequate or complex. In fact, German legislation deliberately pursues a concept of privacy paternalism for employment relationships, limiting ex-ante control to relieve employees of the burden to protect their privacy.…”

“…Irrespective of their accuracy, mental models guide people's decision making process in both familiar and unfamiliar situations [17,25]. In the context of HCI on topics of usable security and privacy, mental models are surveyed (1) to construct a system in which cognitive effort is optimised for usability [11,58,66], (2) to use them as a tool for effective communication between expert and ordinary users [31,52,67,70], or (3) to capture and explore concerns, expectations, and understandings of technology [20,23,27,38,54,71]. Previous research has elicited mental models of privacy in general [48] and in the context of specific technical solutions, with a particular emphasis on online services [13,19,33,37,51,58].…”

How Can and Would People Protect From Online Tracking?

“…We provided a 5-option closed-ended question, with the options (1) 'friend/social contact recommendation' (2) 'work/school recommendation' (3) 'privacy/cookie policy of a website' (4) 'technology blog recommendation' (5) 'news', as well as, an 'other' box to write in other sources or that they 'don't know' of PETs for tracking protection. We chose these options with inputs from previous research findings, in particular, the channel of communication via which individuals would like to learn about PETs [68] as well as their perception of social influence and support from others as encouraging the use of PETs [11,26].…”

“…Designers also ought to be aware of gender and country differences in how individuals learn about PETs, and be able to cater for different groups. While more research into the accessible means of communicating PETs information to users is needed (so as not to rely solely on users to conduct their research, where the burden is on users), designers can already consider the use of social networks, since apart from this paper, other researchers have also pointed to the impact of social influence on the use of PETs [11,26]. It would also be helpful to establish PETs repositories, and make vetted recommendations more accessible to the lay user.…”

With a Little Help from My Friends: Transport Deniability for Instant Messaging

“…Even the Electronic Frontier Foundation (EFF) hesitates to recommend which IM to use from a privacy perspective [26]. Second, there is social pressure among individuals that push them to use the app their friends use, instead of the most secure app [28]. Third, building an IM service with metadata privacy is nontrivial.…”