Information disclosure on mobile devices: Re-examining privacy calculus with actual user behavior

Highlights

• We execute an improved methodology for testing information disclosure over mobile devices.

• We collected actual information disclosure including the level of honesty/accuracy of information disclosed.

• Information disclosure intentions have significant—yet very weak—relationship on actual disclosure.

• The risk and benefit perceptions of information disclosure explain actual disclosure better than behavioral intentions.

• Researchers much distinguish between intentions to disclose accurate information versus any information.

Abstract

The use of mobile applications continues to experience exponential growth. Using mobile apps typically requires the disclosure of location data, which often accompanies requests for various other forms of private information. Existing research on information privacy has implied that consumers are willing to accept privacy risks for relatively negligible benefits, and the offerings of mobile apps based on location-based services (LBS) appear to be no different. However, until now, researchers have struggled to replicate realistic privacy risks within experimental methodologies designed to manipulate independent variables. Moreover, minimal research has successfully captured actual information disclosure over mobile devices based on realistic risk perceptions. The purpose of this study is to propose and test a more realistic experimental methodology designed to replicate real perceptions of privacy risk and capture the effects of actual information disclosure decisions. As with prior research, this study employs a theoretical lens based on privacy calculus. However, we draw more detailed and valid conclusions due to our use of improved methodological rigor. We report the results of a controlled experiment involving consumers (n=1025) in a range of ages, levels of education, and employment experience. Based on our methodology, we find that only a weak, albeit significant, relationship exists between information disclosure intentions and actual disclosure. In addition, this relationship is heavily moderated by the consumer practice of disclosing false data. We conclude by discussing the contributions of our methodology and the possibilities for extending it for additional mobile privacy research.

Introduction

Mobile devices, such as smartphones, tablets, and e-readers are experiencing unprecedented rates of adoption. Since their inception less than three years ago, almost 30% of adults in the US now own a tablet computer (Rainie, 2012) and about half of American adults own smartphones (Smith, 2012). These devices create unique combinations of utility in the form of applications (a.k.a. apps) designed to provide entertainment, productivity tools, Internet access, and more. On the negative side, this blend of features creates exponentially greater privacy risks (Awad and Krishnan, 2006), especially in regard to location-based services (LBS) made possible by the global positioning system (GPS) that are often featured in these devices. In addition to GPS technology, mobile devices commonly have accelerometers and Bluetooth capability, which can provide real time estimates of how many people are near the mobile device. Analyzed separately, this information poses limited risks; however, the primary risk factor associated with these mobile devices is that all of this information can be integrated to precisely identify the user's real-time location.

Consider for example, the recent controversy surrounding i-Free's Girls Around Me app (Mikhaylova, 2012), which led to its removal from the Apple App Store™. The app generated a map displaying the locations of single females in close proximity to the user. The availability of publicly shared personal and location data through the application programming interfaces (API) of Foursquare and Facebook allowed Girls Around Me to collect and display the names, personal photos, and most recent location(s) of single females. The fine line between “social networking app” and “creepy stalker app” was crossed by its “Make contact!” button, which facilitated the user's personal introduction to the female through the push notification feature of the female's Foursquare app.

If examined in isolation, each element that made the Girls Around Me app possible—GPS technology, push notifications, APIs, Internet connectivity, public personal data—has potential for only modest risk. It is unlikely that the creators of any of these technology components visualized the risk synergies possible when combined with other components. Consequently, the privacy risk of an app like Girls Around Me is certainly noteworthy. If such threatening tools can be legally implemented on mobile devices, it is quite likely that many illegal and unethical tools have or will be created.

In the Girls Around Me case, the privacy threat would not exist if consumers did not make their personal and location data publicly available through the Foursquare and Facebook apps that allow users to “check in” by publicly registering their current location for social purposes. With consumers becoming increasingly educated regarding the privacy risks of social media and mobile apps (Jaiswal, 2010), why do so many people continue to publicly share their personal and real time location data (McCarthy, 2010), particularly since mobile devices compound these risks? In essence, this represents the privacy paradox, which refers to the discrepancy between a consumer's stated privacy risk beliefs and their actual behaviors (Norberg et al., 2007). Prior research has examined this question in the context of mobile apps (e.g., Keith et al., 2010, Xu et al., 2010)—primarily through the lens of privacy calculus theory (Dinev and Hart, 2006), which frames information disclosure as a tradeoff of benefits and risks. A core complexity in this research exists in providing methodologies appropriate to study the related phenomena. A major limitation, for example, is that the collected data traditionally only involves intentions to disclose personal data, not the actual disclosures of personal data (e.g., Keith et al., 2010, Xu et al., 2010)—a difficulty documented in related areas of information privacy research (Joinson et al., 2010).

Therefore, in this paper we execute a methodology and analysis approach that involves actual disclosure—particularly involving the decision to register personal information in a new mobile app and the associated privacy settings regarding location data, credit card storage, and access to Facebook data. To accomplish this, we performed a controlled experiment involving a range of mobile device users (n=1025, age=19–70) using mobile device software. We find that a privacy paradox (Acquisti and Grossklags, 2005) exists, in that information disclosure intentions poorly explain actual information disclosure even though it is a statistically significant indicator. In addition, we find that examining actual information disclosure, without understanding the honesty and accuracy of the information provided, may also lead to a misinterpretation of results.

Before introducing our methodology, we explain our chosen information privacy and disclosure context, with the key concepts that we measure. We also briefly note the theoretical basis for the research model that we investigate. We then explain our methodology, data collection approach, and a review of the results. Lastly, we discuss our results in terms of their contributions toward privacy research methodologies, along with the limitations and future research possibilities from our study.