Why Johnny Fails to Protect his Privacy

Abstract

Albeit people worldwide cry out for the protection of their privacy, they often fail to successfully protect their private data. Possible reasons for this failure that have been identified in previous research include a lack of knowledge about possible privacy consequences, the negative outcome of a rational cost-benefit analysis, and insufficient ability for protection on the users' side. However, these findings mainly base on theoretical considerations or results from quantitative studies, and no comprehensive explanation for users' privacy behavior has been found so far. We thus conducted an interview study with 24 participants to qualitatively investigate what are (1) users' mental models of privacy consequences, (2) obstacles for privacy protection, and (3) strategies for privacy protection. Our results provide evidence for all possible explanations: We find that most of our participants are indeed unaware of most consequences that could result from not protecting their privacy besides personalized advertisement and financial loss. We also identify several obstacles for privacy protection, such as protection being too much effort, too complicated, users lacking knowledge, or social aspects. Protection strategies mostly base on reducing the amount of data disclosed and most users refrain from using advanced PETs. We further identified additional factors which influence whether people adopt measures to protect their privacy and propose a model which subsumes all factors that are relevant for people's decision to apply protection measures.