Experiential Transformation in Privacy Behavior: A New Framework for Privacy Behavior Enhancement

Abstract

Multiple studies have demonstrated that the conventional method of learning is suboptimal when our goal is to enhance individuals’ genuine privacy behavior. This study introduces a framework for transforming privacy behavior, with the objective of enhancing individuals’ privacy practices to a higher level of confidentiality. We performed an experiment on a limited number of people to validate the efficacy of our suggested transformation framework. This framework combined determining aspects of privacy behavior with experiential behavior modification methodologies such as neutral stimuli (e.g., cognitive behavioral transformation—CBTx), practical assessments and motivational interviews from other disciplines. While these methods have proven effective in fields like psychology and sociology, they have not yet been applied to the realm of Information Computer and Technology (ICT). In this study, we have effectively demonstrated the efficacy of the proposed framework through a five-phase experiment. The suggested framework has the potential to be advantageous for educational institutions, including both public and private schools as well as universities, to construct new frameworks or develop new methodologies regarding individuals’ privacy behavior transformation to a more protective one. Furthermore, our framework offers a conducive environment for further investigation into privacy behavior transformation methodologies.

1. Introduction

The recent advances in technology, such as internet-connected wearables, augmented reality, mobile devices, and the widespread presence of social media in our everyday lives, our singularity and individuality are constantly being put on display for the world to see [1]. Data can be obtained from individuals as well as businesses in a variety of different methods, and sometimes it happens even without our knowledge [2]. One way this can happen is via the gadgets that are connected to the Internet of Things (IoT) [3], and another is when we voluntarily expose ourselves on social networking sites such as posting a personal photo or other personal information. The provision of such advanced information services has triggered researchers to examine the phenomenon of privacy behavior. Privacy Behavior actions include personal information disclosure or the application of privacy-protective controls, or the configuration of privacy settings [4].

In the past ten years, there has been a discernible rise in the amount of studies conducted on understanding the factors that influence individuals’ privacy behavior [5,6,7,8,9]. Researchers, software companies, companies that provide information security, and individuals are interested in findings ways to improve the privacy behavior of information and communication technology (ICT) users. Despite the fact that many ICT users claim to be concerned about their privacy, research from a number of different studies has revealed that the same individuals nonetheless reveal a significant amount of personal information online. The term “privacy paradox” was coined to describe this situation by a number of scholars [5,6,7,8]. Self-disclosure of information may have negative consequences on our lives, such as becoming a victim of identity theft and impersonation. Moreover, third parties may exploit this information for their own benefit, such as targeted advertising practices [10,11] or even affecting people’s voting opinion [12].

A number of studies have been conducted in an effort to determine the elements that contribute to the psychological, sociological, and behavioral motivations of ICT users’ privacy-related actions [5,6]. Numerous scholars have identified a range of factors that may have an impact on privacy behavior [7,8,13]. Consequently, by influencing these factors, it may be possible to influence ICT users’ privacy behavior, including their tendency to disclose personal information, employ privacy-protective measures, or adjust privacy settings [7,8]. Although there exist many scattered privacy behavior models, an integrated framework that may effectively facilitate such change is missing in the literature. In order to address this gap, in this paper, we integrate existing privacy behavior determinants and we rely on experiential behavior transformation theories, so as to develop a novel experiential privacy behavior transformation framework towards enabling ICT users’ privacy-protective behavior. In summary, our paper addresses the following research questions:

Research Question 1: Can an individual’s privacy behavior be transformed through experiential methods?

Research Question 2: Which experience method is more effective in transforming an individual’s privacy behavior?

To address the above research questions, in this paper, we suggest and validate the effectiveness of a novel privacy behavior transformation framework. This framework and its validation consist of an experiment that includes a variety of methods such us conducting questionnaires, interviews and applying behavioral transformation methodologies (such as experiential methodologies), as described in the following sections. These theories and methods are based on concrete scientific theories and methods from other disciplines such as cognitive behavior transformation methods.

After the introduction, this paper continues with the literature review on privacy behavior theories and privacy behavior determinant factors. In Section 3, we investigate the theoretical background in experiential theories. In Section 4, we propose our experiential privacy behavior transformation framework, while we provide our methodology to empirically test the proposed framework in Section 5. In Section 6, we present the results of our empirically tests. Finally, Section 7 concludes this paper and provides implications and future research.

2. The Literature Review

2.1. Privacy Behavior Theories

Two primary theories have been used for understanding privacy behavior, including the privacy calculus theory and the privacy paradox. The privacy calculus theory suggests that individuals engage in a rational evaluation of costs and benefits when making decisions regarding their privacy [14]. Put simply, individuals assess the potential advantages of revealing their personal information in comparison to the potential drawbacks, such as the possibility of identity theft or discriminatory treatment. The privacy paradox theory refers to the discrepancy between people’s stated privacy concerns and their actual privacy behavior [5]. For example, people may say that they care about their privacy, but they may still disclose a lot of personal information online.

Additionally, we encountered references to other theories, namely the “theory of privacy as a resource” and the “theory of privacy as a right”. The perspective known as the “theory of privacy as a resource” posits that privacy is a valuable asset that may be leveraged to attain many objectives, including but not limited to social standing and financial benefits. As an illustration, individuals may have a propensity to divulge their personal information as a result of incentives, such as price reductions or complimentary merchandise. The perspective known as the “theory of privacy as a right” posits that privacy is an inherent and essential entitlement of individuals, which ought to be safeguarded against encroachments by both governmental and corporate entities. Many countries have laws to guard this right by suggesting directives such as OECD Privacy Guidelines or implementing laws such as the General Data Protection Regulation (GDPR), which is the regulation on data protection and privacy in the European Union [15], the corresponding Brazilian law [16] called General Data Protection Law Lei Geral de Proteção de Dados (LGDP), the Personal Information Protection Act (PIPA) in Canada [17] and Personal Data Protection Act (PDPA) in Singapore [18].

Each of these theories possesses distinct advantages and limitations. The privacy calculus theory provides a valuable framework for comprehending the various determinants that shape individuals’ privacy-related choices. However, it falls short in acknowledging the emotional and social dimensions of privacy. The concept of the privacy paradox serves as a valuable framework for comprehending the incongruity between individuals’ privacy-related behaviors and their expressed worries. However, it falls short in elucidating the underlying reasons for this disparity. Theoretical frameworks that conceptualize privacy as a resource offer insight into individuals’ motivations for divulging personal information. However, these frameworks fail to fully acknowledge the inherent value of privacy as an independent and significant entity. Theoretical frameworks concerning privacy as a fundamental right play a crucial role in safeguarding privacy against encroachments. However, these theories offer limited assistance in navigating the delicate equilibrium between privacy and other societal objectives, such as security or efficiency.

2.2. Privacy Behavior Determinant Factors

Previous studies have explored the determinants of privacy behavior, often employing pertinent theoretical frameworks, such as the protection motivation theory [19]. Other studies have investigated the variables that influence individuals’ privacy behavior and developed relevant research models.

Many studies propose that gender significantly influences privacy behavior [20,21,22,23,24]. Their research indicated that gender significantly influences the extent to which individuals disclose personal information on the internet, with age being a contributing factor. As an illustration, women usually display a higher frequency of posting on their preferred social network and impose less limitations on privacy compared to men. The aforementioned studies are also incorporated into the research conducted by Paspatis et al. [13], who consolidated all of the factors determining privacy behavior into a single study. Other studies verify that age is also a contributing factor [8,20,21,25,26]. For example, it has been shown that as they grow older, adolescent males prefer to decrease the amount of information they share on online social networks (OSNs) and remove tags from their earlier photographs [27]. Further, relevant works have asserted that the perception of privacy risks [27,28,29] and their privacy concerns [30,31,32,33,34,35,36,37] also have a noteworthy impact on privacy-related behaviors. Another factor that appears to influence privacy behavior is the potential financial benefits or exchanges that individuals can obtain through the sharing of their personal data with providers. Previous research shows that individuals who state that they wish to protect their personal data are willing to disclose personal information in contrast to those statements in case of financial or other non-financial exchanges [25,30,33,38,39,40,41]. Financial and non-financial transactions (such as a monetary transaction involving personal data disclosure is the provision of a 10-euro advance or, additionally, the usage of a mobile application game that advertises to be free of advertisements but necessitates the reveal of personal data) have the potential to influence individuals to overcome their concerns and willingly disclose their personal information to third parties, as well as agree to the terms and conditions presented to them [31,38,41,42,43,44,45]. The literature has also demonstrated that privacy behavior is influenced by the necessary disclosure of information to complete tasks or fulfill practical needs. For example, users are requested to present identification documents to an aviation company when traveling [30,46] or to provide medical records, such as a COVID-19 vaccination certificate, for medical purposes [47]. The same may happen for psychological needs, such as psychological charging [35,46,48], for example when downloading a mobile application for entertainment purposes [49]. Furthermore, socialization needs (e.g., social media) may also drive personal information disclosure [34,35]. Other studies have examined the impact of education [45,50], the allocation of time for making privacy behavior choices [51,52], and the use of visualization techniques [36,51,53] on privacy behavior.

Further to these works, previous research has attempted to aggregate the identified factors that affect privacy behavior in the literature [13,54]. Factors that were found to determine privacy behavior include privacy concerns, privacy awareness, trust, demographics, and others. Additionally, previous research showed that some factors seem to affect privacy behavior more than others [13] while some factors affect privacy behavior directly or indirectly or with positive or negative way.

3. Theoretical Background

Experiential learning is an educational methodology that places significant emphasis on the value of acquiring knowledge through firsthand experiences, active involvement in practical tasks, and subsequent contemplation and analysis of those experiences [55]. The methodology suggests that individuals are more likely to gain knowledge, skills, and understanding in a more effective manner when they actively participate in and contemplate real-world events, as opposed to acquiring information passively inside the confines of a conventional classroom environment. Many researchers from the past until very recently claim that experiential learning is more advantageous than a traditional didactic approach [56,57,58,59,60,61,62,63,64,65]. According to Kolb [55] and Rogers [59], for a person to learn through experience, the following factors must be present:

• The participants must have the will to learn through the experience they lived;
• The participants should be able to reproduce the experience;
• The participants must have analytical thinking and understand the experience;
• The participants have the ability to make decisions and solve problems to create new ideas through the experiences they lived.

In addition, Boud [66] identifies the below three stages of the reflective process in the context of experiential learning and recognizes that this is a transformative process and the subjects can acquire new tendencies and abilities:

• The participant reviews the events and has the ability to study the experience again, calling this review a return to the experience;
• The participant recognizes the importance of the experience to third parties, through emotions;
• The participant discovers the new dimensions of the experience so that, through it, the change in his behavior occurs and creates a new way of thinking and new abilities.

Researchers from a wide array of scientific domains, such as psychology, sociology, philosophy, and health sciences, have embarked on extensive investigations to explore the intricacies of behavior and experiential learning. Their studies have encompassed various experiential learning strategies, which have provided valuable insights into how individuals acquire knowledge and skills through direct experience. These studies have typically employed various experiential learning approaches, encompassing visual and audio stimuli such as the ringing of a bell (term in psychology classical conditioning), practical assessments (term in psychology operant conditioning), and motivational interviewing.

3.1. Neural and Neutral Stimulation

Neural stimulation, in the context of neuroscience and physiology, refers to the process of applying a stimulus to excite or activate neural tissue (neurons) in the nervous system [67]. The utilization of this form of stimulation is frequently employed in scientific investigations to examine neurological processes, explore the impacts of particular stimuli on neurons, or as a therapeutic modality within the domains of neurology and psychiatry. Neural stimulation encompasses various techniques, including electrical stimulation, magnetic stimulation, and optogenetics (neutral stimulation). The latter use light as a means to activate genetically modified neurons [67]. Numerous empirical studies have been undertaken in the field of psychology pertaining to the phenomenon of behavior transformation. Pavlov’s classical conditioning experiment is widely recognized as one of the most renowned experiments in the field [68]. Through his empirical investigations involving canines, the researcher successfully established a conditioned response in the subjects by pairing a neutral stimulus, namely a bell, with the presentation of food. Consequently, the dogs exhibited salivation alone in reaction to the bell, devoid of any food-related stimuli. Bandura conducted an additional behavioral trial [69]. In his research, commonly referred to as “the Bobo Doll experiment”, Bandura [69] demonstrated that youngsters who observed an adult engaging in hostile conduct towards the doll were more inclined to replicate the same aggressive behavior. Through this experiment, the researcher elucidated the notion of observational learning and its role in acquiring behavior through the process of observing others. Ainsworth’s study [70] on attachment styles in infants explored the manner in which infants reacted to separations and reunions with their careers within the framework of the same theoretical construct. This experiment facilitated the comprehension of how various parenting behaviors might influence the behavioral style of a child. The results highlighted the importance of a stable bond between newborns and caregivers in promoting positive emotional growth. In a separate study, Watson and Rayner [71] conducted an experiment to illustrate the potential of an auditory stimulus, specifically a terrifying noise, as a catalyst for behavioral modification. Their findings emphasize the capacity for behavioral change through environmental stimuli. Asch experiment [72] additionally employed an optical manipulation to alter the observed behavior of participants. The study aimed to examine the degree to which individuals would comply to the opinion of a group, even when it contradicted their own personal judgment. The study involved the presentation of a basic perceptual task to the participants, which required them to assess line lengths. The participants were situated in an environment where they were exposed to confederates who intentionally provided inaccurate responses. The findings unveiled the significant impact of social conformity on individual decision making, providing insight into the intricacies of human behavior in social settings. In the same context, Becker’s [73] research delved into the labeling theory, which posits that individuals tend to engage in deviant behavior when they are officially or socially classified as deviant by authorities or society. This particular viewpoint centers on the influence of social reactions on human conduct.

3.2. Practical Assessments

Practical assessments encompass evaluation methodologies or exercises that necessitate individuals to exhibit their knowledge, skills, and competences through tangible tasks, real-life applications, or hands-on activities. The purpose of these assessments is to evaluate an individual’s capacity to apply theoretical knowledge in real-world scenarios, effectively solve issues, and successfully execute tasks that are pertinent to a specific field or subject [74]. Numerous strategies have been suggested within the realm of Information and Communication Technology (ICT) to alter privacy-related behaviors. These approaches encompass gamification techniques, privacy quizzes [75], and privacy simulators [76,77]. Practical evaluations adhere to Aristotle’s renowned statement, which posits that the acquisition of skills is achieved via the active engagement in the respective activities. The concept of gamification for privacy behavior entails the incorporation of game-like components, such as incentives, obstacles, and rivalry, with the aim of motivating individuals to embrace and sustain privacy-oriented conduct in their digital engagements and online undertakings [75]. The process entails the utilization of game design principles to effectively engage and inspire users in making well-informed decisions pertaining to the safeguarding of their personal information, cybersecurity procedures, and compliance with privacy rules and regulations. In recent years, numerous approaches have been proposed or adopted. Mavroidi et al. [78] assert the possibility of gamification as a means to safeguard user privacy. The authors posit that the implementation of gamification holds potential in the realm of privacy education, as it may effectively inform users about privacy concerns, motivate them to adopt privacy-conscious behaviors, and enhance the appeal of privacy-protective features. In a separate instance, scholars conducted a study examining the utilization of game-based learning (GBL) in the context of information security (IS) and privacy education and awareness [79]. The authors suggest that game-based learning (GBL) possesses the capacity to serve as a viable method for instructing information systems (IS) and privacy principles, owing to its ability to captivate learners, foster interactivity, and stimulate motivation. Respectively, the work of Drozd and Kirrane also supported these evidences [80]. In a separate study, the authors assert that game-based learning is a proficient method for educating individuals in technological domains, while also providing ample learning prospects for diverse target populations. The researchers asserted that the utilization of gamification in virtual reality escape rooms has the potential to enhance users’ awareness of privacy matters [81]. On the contrary, gamification can also be utilized for evil purposes. Several studies suggest that the implementation of gamification carries inherent risks to user privacy. These risks include the possible exploitation of users’ privacy, unauthorized collection of personal data, and the tracking of their online activities without their explicit authorization [82]. In an additional study [83], researchers discovered that individuals utilizing gamified services have a higher propensity to disclose personal information compared to those utilizing non-gamified services. The authors believe that the reason behind this phenomenon is the potential for gamification to induce cognitive absorption, thereby hindering users’ capacity to make logical judgments regarding privacy.

Additional strategies that have been employed to alter privacy-related behaviors include the utilization of privacy simulators and privacy quizzes. Privacy simulators are software tools or systems that have been specifically designed to replicate and represent different facets of data privacy. These simulators are commonly used for teaching, testing, or research reasons. Simulators are utilized to generate synthetic data or scenarios that replicate real-world privacy difficulties, enabling users to enhance their comprehension and assessment of privacy threats, compliance with data protection legislation, and the efficacy of privacy-enhancing methods. As an illustration, Bum et al. [76] devised a simulator aimed at enhancing individuals’ awareness of privacy matters and facilitating their comprehension of the privacy consequences associated with their online behaviors. In a separate study, the researchers developed a simulator for mobile security and privacy. This simulator allows for the simulation of mobile entities and their surrounding environment, facilitating the investigation of security and privacy concerns [84]. The authors asserted that simulation can be employed to assess privacy dangers and countermeasures using numerical analysis and visualization, enabling a more comprehensive understanding of the ramifications and privacy threats faced by users. Privacy quizzes are interactive evaluations or surveys created to check an individual’s comprehension and familiarity with concepts, principles, legislation, and optimal approaches pertaining to privacy. The quizzes commonly have a range of question formats, including multiple choice, true/false, and open ended, which encompass diverse dimensions of data privacy and security. Privacy quizzes are frequently employed as pedagogical instruments, instructional modules, or consciousness-raising initiatives to enable individuals and entities to assess their proficiency in matters of privacy and discern domains that necessitate enhancement. In their study, Leenen and van Vuuren [75] asserted that privacy quizzes serve as a means to encourage secure online conduct and represent an efficient and cost-effective approach in aiding the military community in the prevention and detection of online threats.

3.3. Motivational Interviewing

Motivational interviewing (MI) is a counseling technique and communication method that prioritizes assisting individuals in examining and resolving their conflicting feelings regarding modifying their behavior. This approach demonstrates notable efficacy within circumstances characterized by people who exhibit resistance or reluctance to modify their behaviors, such as addiction treatment, health care, and mental health counseling. Motivational interviewing (MI) is a therapeutic approach that encompasses the utilization of active listening, empathy, and non-confrontational questioning techniques. These strategies are employed to facilitate individuals in recognizing their own motives and aspirations for personal transformation, hence enhancing their preparedness to initiate behavioral change [85]. Motivational interviewing (MI) can be integrated with other behavioral modification techniques, such as cognitive behavioral therapy (CBT), in order to enhance the efficacy of interventions aimed at promoting behavior change [86]. The aforementioned methodologies are commonly employed in the disciplines of psychology and sociology to effectively tackle a range of behavioral issues, including but not limited to anxiety disorders and eating disorders [86]. Recently, there has been an emergence of a novel variant of cognitive behavioral therapy known as cognitive behavioral transformation (CBTx), which has begun to be employed in practice. Cognitive behavioral therapy (CBT) places emphasis on facilitating individuals in the process of modifying their fundamental beliefs and assumptions. CBTx operates under the premise that our fundamental ideas and assumptions regarding ourselves, the world, and others exert a significant influence on our cognitive processes, emotional experiences, and behavioral patterns. The existing body of literature on CBTx is still minimal. However, certain tests undertaken with CBTx have reported positive outcomes in terms of attitude, well-being, and learning [87,88,89].

3.4. The Research Method

As we demonstrated in this section, experiential methods offer more benefits than traditional learning and education [55,56,57,58]. Based on the fact that the cognitive model was created by the field of psychology, this field considers the monitoring of the individual’s phlegmatic response such as facial expressions and emotion recognition and the recording of the individual’s personal narratives to be extremely essential [90]. A person who is able to verbally or physically convey an emotion may have trouble expressing it in writing or require assistance or a reward from the researcher [91,92]. At this juncture, the researcher records both the participant’s possible written or verbal response to a question as well as their physical reaction. This response may be identical to the participant’s or completely different. During the literature review of the fields of the sciences of psychology, philosophy, and sociology, the methods that were followed by the vast majority were field research and analysis based on qualitative methods, as each individual may exhibit a completely different behavior than another individual despite having the same or similar characteristics [55,56,57,61,62,63,64]. Numerous factors, such as socio-cultural approaches, social milieu, previous experiences, and economic status, can influence a person’s behavior, so demographic characteristics are not the only focus in the field of psychology. We chose the qualitative research methodology for the aforementioned reasons and because the premise of the experiment is the proof of experiential methods of learning and education against the dominant model.

4. The Proposed Experiential Privacy Behavior Transformation Framework

Section 3 has elucidated that behavior can be modified by many methods and stimuli. In the realm of psychological experimentation, researchers frequently employ neutral stimuli, such as noises and visual effects. Conversely, within the fields of sociology, health, and psychology, motivational interviews are commonly utilized in conjunction with cognitive behavioral therapy (CBT) and CBT-based theories. In contrast, within the field of information technology, practical methods such as practical assessments and gamification approaches are predominantly employed for the purpose of transforming privacy behavior. In this section, we present our framework for transforming privacy behavior, based on the literature review and the theoretical background presented above.

As stated in the literature review, prior studies have endeavored to consolidate the factors that are mentioned in the existing literature as determinants of privacy behavior [13,54]. In these works, the researchers examined the relationship between determinant elements of privacy behavior, such as fear and financial-non financial exchanges, and the influential axes of the cognitive theory, namely beliefs, perceptions, and attributions. Further, as described in Section 3, experiential learning approaches include visual and audio stimuli, practical assessments and motivational interviewing. Therefore, our framework will encompass neutral stimuli, practical assessments and motivational interviewing with regard to their efficiency to transform individuals’ privacy behavior.

We define two types of neutral stimuli, namely short-length visual content and long-length visual content regarding privacy behavior. We define three types of practical evaluations: (a) privacy behavior quizzes, (b) privacy behavior simulators, and (c) privacy behavior gamification methods. We consider motivational interviews to assess privacy outcomes related to meta-data mobile phone monitoring and google account monitoring from the side of privacy-related incidents. The aforementioned concepts are depicted in Figure 1.

Due to the fact that in addition to experientialism, our model also incorporates training on increasing the perception of risks and questions on the results of our experiment’s questions, a qualitative method rather than a quantitative one was chosen for the experiment. The experimental design is also a consideration when selecting a qualitative technique. Due to the fact that the individuals will be monitored with our own apparatus, it was necessary to have physical access to them. In a later phase of the experiment, each participant will undergo an interview and training phase at the same time as they progress through the experience’s stages.

For the design of the empirical research, we will adopt observation and behavior techniques witnessed in psychology and sociology. As mentioned in Section 3, these techniques are conducted qualitatively by employing narrative interviews and field research. The primary reason for this choice is that the researcher aims to observe the participant’s reaction and response. In relevant empirical studies, the researcher places participants in dilemma situations and observes the initial reaction to chain questions and how behavior changes over time.

5. Methodology to Empirically Test the Proposed Framework

In this section, we present the validation methodology of our framework, which comprises five phases. We describe and analyze every phase of the methodology to validate the proposed behavioral transformation framework, including the respective scope and target per phase.

We adopted a multiple stratification methodology to empirically test our proposed framework. As demonstrated in Paspatis et al. [13], privacy behavior is influenced by a variety of factors. Similarly, Paspatis and Tsohou [54] show that the cognitive processes of privacy behavior are influenced by three cognitive axes of influence, with each axis being influenced by a distinct set of factors, which are sometimes present in two or three axes.

Our methodology to test our framework is divided into five phases as described below:

• Phase 1: Creation of qualitative questionnaire with multiple-choice and open-type questions to assess users’ privacy behavior.
• Phase 2: Implementation of privacy behavior measurement using the methods derived from phase 1 in a small, closed group of up to 10 individuals.
• Phase 3: Creation of the experimental environment per experiential method (i.e., neutral stimuli, practical assessments, motivational interviews).
• Phase 4: Implementation of the experiential experiment aiming towards privacy behavior transformation.
• Phase 5: Analysis of results with regard to the success of behavioral transformation.

The above phases are illustrated in the figure below (Figure 2).

5.1. Participants’ Selection Criteria and Profile

People from our broader social milieu and outside our sphere of influence were chosen for the experiment. In order to enlist the volunteers, we conducted a thorough search throughout our wider surroundings. The selection criteria primarily consisted of three factors: unfamiliarity with the participants to prevent any bias, no personal connections such as family, academic affiliation, or university enrollment to maintain impartiality, and being an adult to meet the requirements for signing the consent form to participate in the experiment. The majority of the participants were recruited using the “friends of a friend” tactic. Individuals were selected using a stratified method. Specifically, we selected participants from as wide a range of age, gender, educational level, and occupation. We made a deliberate effort to ensure an equal representation of both genders, with participants having varied occupations. Additionally, each participant had a minimum age difference of 5 years from others, regardless of gender. The objective of the stratification method was to assess the effectiveness of the framework in all conceivable combinations. Although more than 20 individuals initially expressed interest, some withdrew due to privacy concerns after receiving additional information. When we informed the participants about the duration of the experiment and the amount of effort required, some of them revoke their willingness to participate.

Every participant signed an analytical consent form in order to engage in the study. In addition to the consent form, all participants received additional information regarding the experiment, which may not have been extensively covered in the consent form. This information included an analytical overview of the experiment as well as any anticipated advantages for the participants, researchers, and society. The consent form and the experiment adhered to the ethical standards of our institution and followed Cope’s best practices [93]. Initial interest was expressed by 22 individuals, 9 women and 13 males. After withdrawals and exclusions, four women and five men were ultimately chosen. The participants’ age ranged from 26 to 62, with a mean of 40.89 years, a median of 36 years, and a standard deviation of 11.33 years. Despite the large age range of 26 to 62 years, the sample’s mean value was relatively close to the sample’s mean, as indicated by the standard deviation. We can conclude from the above that our sample is representative of this value range. Four people had a university education, two women and two men, of which two had a master’s degree; three people had a technological education, two women and one man, of which two had a master’s degree; and two people had a complete secondary education, one woman and one man, of which one has a qualification. Three participants held bachelor’s or master’s degrees in information technology. Participants’ profile is presented in

Table 1. Profile of participants.

Participant Number	Index	Gender	Age	Education	Occupation
Participant 1	CD	W	47	University Education	Philologist
Participant 2	PE	M	36	University Education	Police officer
Participant 3	NB	M	46	University Education	Military
Participant 4	DS	W	50	University Education	IT
Participant 5	PM	M	62	University Education	Refrigerant
Participant 6	PW	W	36	Technological Education	Technologist
Participant 7	AA	M	36	Technological Education	Technologist
Participant 8	AΕ	W	29	High School	Employee
Participant 9	TE	M	26	High School	Employee
Total: 9		AVG = 40.9 y		MD = 36 y	SD = 11.33

.

5.2. Phase 1. Creation of Qualitative Questionnaire to Assess Users’ Privacy Behavior

In this phase, a qualitative questionnaire was created to assess participants’ current privacy behavior. The purpose of this questionnaire is to assess the current (pre-study) privacy behavior of the participants who will be involved in the experiment. The participants were asked to complete again the same questionnaire after the experimental process, so that we can compare the pre- and post-evaluations. The questions of the questionnaire are presented as Appendix A.

Each question was selected after comprehensive research in academic journals such as the basket of eight and google scholar search engines. The questionnaire inquiries were derived from a collection of articles on privacy-related behavior. Regarding the questionnaire, each question may appear in more than one of the selected questionnaires. Each question may not be presented verbatim, but its core meaning or purpose remains the same as other questions with similar wording. In addition, each question was selected so that it could be used as a variable in our conceptual model for further analysis, while also being associated with at least one of the influencing factors of privacy behavior identified in our previous research [13]. Additionally, each selected question was modified to be asked as open question due to our qualitative process but it is also could be rated on a 5-point Likert scale ranging from “Very often” to “rarely”. Thus, if a question was in 7-point Likert form then the two extreme values on a 7-point Likert scale were merged with the preceding value. For instance, “Too often” and “Very often” have been merged into “Very often”.

Further, we matched each question with at least one influencing factor of privacy behavior as they emerged from the work of Paspatis et al. [13]. For the sake of convenience each factor matched to an acronym as they are appearing to

Table 2. Privacy behavior factors obtained by Paspatis et al. [13].

Factor or Cluster	Acronym
Financial Exchanges/Benefits/Usefulness	FEBU
Privacy Risk Perception	PRP
Trust/Control/Confidence/Fear	TCCF
Privacy Concerns	PC
“Needs”/Psychological Engagement/Necessity	NPEN
Sensitivity of Information	SOI
Privacy Awareness	PA
Time Lapse	TL
Education/Visualization/Interaction/Experience	EVIE
Demographics	DE
Dimensionality/Complexity of Privacy Decision Making	DC

. As matching criteria, we used the “nearest neighbor” methodology as they emerged from our previous research [54]. The nearest neighbor matching method is especially advantageous when the number of variables is limited. This method is applicable in various domains including as epidemiology, economics, and psychology. It is used to assess the similarities between observed variables, the close correlations among observed variables, or the outcome of a statistical or medical experiment [94].

Table 2 demonstrates the acronyms of the affected factor or cluster of factors while

Table 3. Questionnaire to assess users’ privacy behavior.

Activated Factor	Question	Number of Articles
PA	Q1: How often do you check the privacy settings on your social media accounts?	5
TCCF, PRP, PC	Q2: How often you felt like your privacy was violated online?	5
PA	Q3: How often do you read the privacy policies or terms of service for the websites or apps you use?	5
PA, PC	Q4: Have you ever declined to use a service or app because of privacy concerns? If so, can you describe the situation (open)?	5
PA, PC	Q5: How often do you use different passwords for different accounts? How do you keep track of them (open)?	4
TCFF	Q6: Have you ever been a victim of identity theft or online fraud? How did that experience affect your privacy behaviors (open)?	4
PRP, PA	Q7: How much personal information do you share online? Can you describe the reason (open)?	5
PA	Q8: How often do you take steps to protect your online privacy? Do you use ad-blockers or other tools and which (open)?	4
PRP, TCFF	Q9: Did you know companies collecting and using your personal data for targeted advertising?	5
PC	Q10: Do you have any concerns about government surveillance or monitoring of your online activities?	3

demonstrates the questions and the number of articles addressing these as well as the affected factor(s).

5.3. Phase 2. Implementation of Privacy Behavior Measurement

To conduct the qualitative questionnaire, we used mixed methods. Due to some participants’ educational level and/or computer skills familiarity, four of the questionnaires were completed with the help of the researcher during a physical meeting; in most cases, when this was not possible due to distance or time limitations, the meeting was conducted online. Prior to distributing the questionnaire, we notified the participants that all their personal data and identifiers will be anonymized. The purpose of this option is to convince respondents that they cannot be identified so that they will answer the questions more truthfully. Murdoch [95] found that people who assume they cannot isolate themselves from the results of a survey are approximately nine percent more likely to participate and to provide the most accurate response possible. Thus, for the same reason, we did not reveal how many people participated.

5.4. Phase 3. Creation of the Experimental Environment Per Experiential Method

We devoted great effort to create an experimental environment to cover both our specifications and also create a nice and full anonymized experience for the participants of the experiment. We emphasized making the participants feel comfortable and secure about their privacy and their personal data. We were also transparent with our methodology to mitigate any of their privacy concerns. Due to page limitations, we will not go into detail about our infrastructure. In summary, our experimental environment consists of the following key components:

• One central and nine client Gmail accounts ([email protected], [email protected]);
• Virtual machines;
• Multiple streaming platform accounts in a legal, secure and anonymized way;
• Other applications (e.g., Family Link, Viber, and Streaming Platform App).

The Gmail accounts were used with the build-in app “find my device” and were remotely installed in participants’ phones (more information to the next subsection) along with other necessary applications such as family link and Viber. To establish a secure, anonymous, and legally compliant visual content environment, we implemented a privacy protocol that incorporates several levels to enhance privacy. These layers include a VPN browser plugin, temporary email services, and crypto-cards. The aforementioned approach was implemented to guarantee anonymity for both us and the participants. Conversely, the goal of the streaming platform service is to offer a lawful means for our participants to access the privacy-related content we selected. The multi-layer anonymity procedure we followed is pictured to the following Figure 3.

5.5. Phase 4. Implementation of the Experiential Experiment Aiming towards Privacy Behavior Transformation

As we analyzed in Section 3 and Section 4, privacy behavior can be transformed mainly using three methods (content viewing, practical assessments and one-to-one motivational interviews), with neutral or visual stimulus, by practicing and by external motivation speeches such as motivational interviews. In our experiment, we included all three methods in order to test our framework.

In the following, we describe the three experiential procedures that we followed. During the experimental period, we gave the participants a two-sim card mobile android phone. The participants used the one sim slot for the sim card that belong to us and the second sim slot could be used for own sim card, if selected. We opted for this choice to avoid making them uncomfortable by carrying two smartphones (own and experiment) and because we expect that this would allow them to use the experimental phone to the maximum. All participants were part of all three experiential procedures, content viewing, practical assessments and one-to-one motivational interview. We provide more details about the experimental procedures in Appendix C. Due to the lack of multiple experimental mobile devices and sim cards, we included the participants sequentially and not in parallel (so that the same phones could be used by several participants).

After the execution of two of the experiential procedures (content watching and practical assessments), we gathered all the information in order to construct the material for the motivational interview. Motivational interviewing is our final part of the experiential methods that the participants took part in.

5.6. Phase 5. Results Analysis and Framework Validation

This phase includes the analysis of the experiment data to investigate if behavioral transformation was successful.

First, we re-executed the questionnaire of phase 1 and compared the data with that of phase 4, per participant, to assess if self-reported behavioral transformation was successful. In this step, we gathered the results of the first questionnaire and we compared them with their last answers in order to calculate if their privacy self-reported behavior changed and by how much. To calculate the difference, we weight the responses from the first and second questionnaires into 5-point Likert-type scores and perform two-stage ANOVAs [96] as well as Cronbach’s A-tests [97].

Second, to assess participants’ actual privacy behavior transformation, we re-monitored participants for a smaller period of 10 days. This way, we can collect information about actual privacy behavior and compare with the data that we collected during phase 4, so as to assess if actual privacy behavior was transformed. The decision to reduce the re-monitoring stage to a 10-day duration instead of 30 days was taken due to resource constraints. As previously stated in Section 5.5, multiple participants utilized the same mobile phones due to a scarcity of available experimental devices. In order to expedite the re-monitoring process, we decided to reduce the duration from 30 days to 10 days. The re-monitoring process was conducted utilizing identical procedures, tools and equipment to the initial 30-day period.

For the sake of completeness in Appendix C, we provide all the content and the items we used in our framework.

6. Results

This section provides the results of our empirical study.

6.1. Pre-Study Privacy Behavior Assessment

We utilized Google Forms to create and disseminate Appendix A. The selection was made based on the speed at which a form could be generated, the simplicity of distributing it, and the ease of processing the data. As previously stated, nine people participated. The questionnaire was distributed to our participants through various channels, including email, a hyperlink, and direct messages on the social media platforms Facebook (Meta) and Viber. Hence, we notified the participants that they are required to finalize the questionnaire within a period of 10 days. Participants who were unfamiliar with the Google Forms platform or lacked the necessary technological skills were provided assistance by scheduling an appointment with our team. At last, all nine participants successfully submitted the questionnaire.

The results were initially examined using a two-factor quantitative ANOVA approach without replication. We choose the ANOVA approach due to its recommendation for situations where there are several factors that influence an independent variable. As we have seen in Section 2, there are a total of eleven determining factors. Furthermore, ANOVA is suggested for assessing multiphase techniques, as we will perform in our specific situation. Cronbach’s Alpha was utilized to assess the validity of the questionnaire. Due to the limited number of participants (n = 9), this approach was used as it is considered the most straightforward technique for testing a questionnaire. Furthermore, as the objective of this questionnaire is not to extract or elucidate any phenomenon, but rather to compare the outcomes prior to and following the experiential transformation, we have concluded that more intricate quantitative analysis methodologies are unnecessary. However, the results are primarily presented for the sake of comprehensiveness and also for potential statistical analysis in the future, either by the current researchers or other scholars. Regarding the descriptive results, it was evident that all participants consistently exhibited risky privacy behavior across all questions, with an average score of 4.09. This suggests for example that privacy settings are seldom or rarely modified, or that the participants have a low level of privacy-conscious behavior.

Table 4. Participants’ answers.

Participant	Q1	Q2	Q3	Q4	Q5	Q6	Q7	Q8	Q9	Q10	Avg
Participant 1	5	5	4	5	5	5	5	4	5	5	4.80
Participant 2	4	5	4	5	4	4	5	4	5	4	4.40
Participant 3	5	5	4	5	5	5	5	4	5	5	4.80
Participant 4	2	4	4	5	4	2	4	4	5	4	3.80
Participant 5	5	4	4	5	3	5	4	4	5	3	4.20
Participant 6	5	3	3	5	5	5	3	3	5	5	4.20
Participant 7	4	3	5	4	4	4	3	5	4	4	4.00
Participant 8	4	5	2	4	3	4	5	2	4	3	3.60
Participant 9	3	5	1	1	5	3	5	1	1	5	3.00
Total Average	4.11	4.33	3.44	4.33	4.22	4.11	4.33	3.44	4.33	4.22	4.09

presents the overall and individual question averages. Concerning the implementation of the ANOVA, it is evident that the participants’ responses to each query do not exhibit a statistically significant disparity (F = 1.19, p-value = 0.31, p = 0.5), despite a considerable likelihood of inaccuracy. On the other hand, each person shows a pretty little difference for each question (F = 3.57 > F critical 2.07, p-value = 0.001, p = 0.05). The ANOVA analysis outcomes are presented in

Table 5. ANOVA summary table.

ANOVA
Source of Variation	SS	df	MS	F	p-Value	F-Crit
Rows	26.48889	8	3.311111	3.566489	0.001557	2.069832
Columns	9.955556	9	1.106173	1.191489	0.313744	2.012705
Error	66.84444	72	0.928395
Total	103.2889	89

. Cronbach’s application demonstrated a performance validity of 0.71961223 (

Table 6. Cronbach’s Alpha internal consistency matrix.

Cronbach’s Alpha	Internal Consistency
0.9 ≤ α	Excellent
0.8 ≤ α < 0.9	Good
0.7 ≤ α < 0.8	Acceptable
0.6 ≤ α < 0.7	Questionable
0.5 ≤ α < 0.6	Poor
α < 0.5	Unacceptable
Participants’ Score:	0.71961223

). The questionnaire responses are considered adequate and reliable, as demonstrated in Table 4, Table 5 and Table 6.

6.2. Monitoring Results

During the initial phase, participants were provided with a phone that was accepting two SIM cards simultaneously. As previously said, we closely observed the participants using various methods for a duration of 30 days. Throughout this duration, we effectively observed and tracked all individuals involved. To obtain the mobility and location data of each participant and effectively analyze them, we retrieved all the accessible information. To accomplish this, we initially attempted to utilize the Google Takeout service. However, we encountered various problematic issues, such as the inability to pick certain date and time ranges. To address the issue mentioned above, we employed a bespoke Python script that leveraged the cookies of the participants. Through the surveillance of Viber’s desktop sqlite database, in conjunction with findmydevice, we have effectively obtained data on participants’ daily routines, including their place of residence, workplace, preferred WiFi hotspots, and real-time position tracking. We effectively utilized the GPX file data from sports apps like Strava and Endomondo to extract information about participants’ hobbies, preferred sports locations, and GPS data. It should be noted that GPX file data are accessible to anybody on the mentioned platforms, provided that the platform user has not protected it by modifying the privacy settings. It is important to note that none of the participants chose to uninstall any pre-installed applications, despite being informed of their ability to do so. We will utilize some of the aforementioned processed data as proof and as a means to enhance awareness during the motivational interviews in the experiential procedure 3.

6.3. Experiential Procedures

6.3.1. Experiential Procedure 1. Content Viewing

Throughout the phone-monitoring period, all participants were required to access the privacy behavior content that we had provided on the chosen streaming platform and other media platforms. In order to ensure the viewing of content, we closely watched the content history area of each platform. Based on the information provided, we can confirm that all participants were exposed to the instructed content. However, it is not possible to verify this with certainty, as the participants may have initiated the media content and subsequently discontinued their engagement. In order to enhance obedience, we incorporated additional content-related questions into the motivational interviewing process.

6.3.2. Experiential Procedure 2. Practical Assessments

At this point, the participants were required to select and utilize at least one item from each category, including privacy-related tests, privacy emulators, and privacy-related games. In addition, they were required to upload a minimum of one photograph to their chosen social media platform. In order to assure compliance, the participants were required to provide their personal scores for each practical assessment tool they selected. Each participant could select multiple tools from each category, but just one tool should be chosen as the minimum requirement. The privacy-related meta-data, if available, will be utilized in the motivational interviewing procedure. The time frame to complete all of the aforementioned tasks was identical to the previously mentioned 30-day period.

6.3.3. Experiential Procedure 3. Motivational Interviews

In this section, we initially provided our monitoring findings to each participant individually, as indicated in Section 4. The objective of this activity is to demonstrate the extent of personal information that may be obtained by an application developer, company, or individual using a seemingly harmless program, such as a free flashlight app from a marketplace. By presenting individuals with the data collected by monitoring their phone activities, we aimed to trigger the most influential causes for behavioral change, such as fear and concerns about privacy. As stated in the literature review section, if we elicit the instinct of fear in humans by visual stimuli, it will lead to a significant and lasting change in their behavior. Following their findings presentation, the procedure proceeds with a qualitative and open-ended questionnaire designed to provide further insight into their emotional state regarding their privacy. The objective of this questionnaire is to ascertain individuals’ perspectives on their emotions over the disclosure of personal information and whether they require or desire our assistance in safeguarding it. For example, Question 3 asks (we): “Did you know that a service or an app such as google timeline could monitor your daily movement? How you feel about it? That lead to the answer: Participant PE: “Firstly, I never knew the existence of this app. Firstly, I heard about it through this experiment. I felt like a victim of monitoring of some company. The details about my daily movement such as going to get by girls from daycare scared me about my safety and the safety of my family” Question (we): What would you like to do? PE: “Can I disable this function? If I disable it my phone will continue to be functional?” (We): “Sure you can deactivate it. Let me show it to you”. The protocol of the motivational theory stipulates that, in this final phase, all inquiries or responses to the participant should be presented in a positive manner, without judgment or negativity. The questions of the motivational interviewing technique are presented in Appendix B. The questions, as well as the subsequent follow-up questions, can vary depending on the participant’s answers and subsequent inquiries.

6.4. Questionnaire Re-Execution

In order to assess any potential changes in participants’ self-reported privacy behavior, we requested them to once again complete the phase-2 questionnaire (Appendix A). The objective of this action was to obtain the updated values following the completion of all the experimental procedures. Following this phase, the two questionnaires were compared using two different methods. Firstly, through descriptive analysis, we analyze and process the averages of each question individually. We conducted a comparative analysis of each participant’s responses, both on a question-by-question basis and in terms of the overall average. Furthermore, we employed a paired T-test on each item to determine the statistical significance of the observed differences. Based on the findings, we may deduce that the self-reported privacy behavior of each participant has shown improvement in nearly all of the questions. The t-tests we conducted demonstrated that the p-values for each question were significantly below 0.05, indicating a substantial and meaningful change in behavior. Therefore, it is important to note that participants with higher levels of education had lower changes in behavior. Additionally, it is possible that having a degree in the IT field influenced the results. Due to the limited size of the group, it is difficult to determine with certainty if a degree, particularly in IT, had a significant impact on the observed behavioral changes. The table below displays the participants’ replies to Appendix A, together with the p-value obtained from the T-test conducted comparing the two questionnaires.

Table 7. Participants’ answers on Appendix A re-execution.

Part/Ant	Q’1	Q’2	Q’3	Q’4	Q’5	Q’6	Q’7	Q’8	Q’9	Q’10
Participant 1	3	3	4	4	3	3	3	3	4	3
Participant 2	2	3	3	4	3	3	3	3	4	3
Participant 3	2	2	4	2	3	3	3	3	3	3
Participant 4	2	2	3	2	2	2	4	4	3	3
Participant 5	3	2	3	4	2	3	3	3	3	2
Participant 6	2	2	2	3	2	2	3	3	4	3
Participant 7	2	2	3	2	1	2	2	3	4	3
Participant 8	1	2	2	2	3	2	3	2	3	2
Participant 9	1	5	1	1	2	2	3	1	1	2
p-value	0.00013	0.00058	0.02220	0.00105	0.00066	0.00042	0.00171	0.02220	0.00275	0.00020

below displays the outcomes of the questionnaire that was re-administered.

6.5. Framework Validation (Monitoring Re-Execution)

Shortly after concluding the experiential techniques, we requested the participants to undergo mobile monitoring, similar to phase-2, but for a duration of 10 days. The objective of this action was to verify the effectiveness of our framework, not only through participants’ self-reported privacy behavior, but also through their actual privacy behavior. Once again, the participants did not receive the phone and the SIM card simultaneously due to the limited availability of phones and SIM cards. As a result, several individuals received the equipment a few days after their prior monitoring, while others had to wait for a longer duration, up to 4 months after the experimental procedures concluded. Initially, we were concerned that some participants could revert to their previous privacy-related behaviors, but this did not actually occur. Out of the nine participants, six of them disabled location permissions for most of the apps, including Google services and Viber. Among these six participants, two of them specifically inquired about how to disable these permissions. Out of the nine participants, eight uninstalled the lens application that we had previously installed and had both location and actual location rights enabled. All individuals refrained from posting any images on the social networks they utilized during the initial monitoring period. Ultimately, none of the participants were able to successfully uninstall the family connection app, likely due to the software’s intentional design to resist removal and the requirement of sophisticated technical expertise for such an activity.

6.6. Final Results

Based on the information provided, we conclude that the experiment was successful for most of the participants. The privacy behavior of all participants appears to have undergone a significant transformation towards increased privacy protection, at least from the conclusion of the experimental procedures until a period of four months thereafter, answering research question 1. Not all participants exhibited the same level of transformation in their privacy behavior, and we are now unable to provide a complete explanation for this phenomenon. Furthermore, we did not anticipate this outcome. Several factors can influence the extent to which participants’ privacy behavior changes, including their demographic background and their level of IT education. We deliberately selected participants spanning a wide age range (26–62 years old) and varying educational levels, ranging from high school to individuals with a master’s degree, to assess the effectiveness of the framework in transforming privacy behavior regardless of one’s academic background. Based on the conversations in the motivating interview and the qualitative questionnaire responses (open-ended answers), we have determined that participants found visual stimulations (experiential procedure 1) to be more effective in transforming their privacy behavior, answering research question 2. Consistently, participants indicated that their monitored findings, along with the motivating interview’s positive discourse, aided their comprehension of their prior privacy behavior level. The majority of the participants regarded the results of procedure 3 to be enlightening. However, without external assistance, it would be challenging for them to initially recognize the extent of their personal information exposure and the necessary precautions they should take to safeguard themselves. Ultimately, participants deemed the practical assessments to be beneficial although occasionally tedious. They provided assistance in determining their present level of privacy and recommended changes to enhance their protection, albeit in a less inspiring manner compared to the other two procedures.

7. Conclusions

The investigation of individuals’ privacy behavior and their corresponding activities has been a phenomenon that we have been studying for over 20 years. However, in academia, the prevailing methods to shape an individual’s private behavior primarily consist of conventional teaching approaches, despite the fact that most people still rely on this method for learning or may not receive any education on this issue at all. Our research did not uncover any evidence of a privacy behavior transformation framework being used in primary or high schools. However, such frameworks are predominantly found in higher education, particularly in academic syllabi that are IT focused. In contrast, disciplines like sociology and psychology have extensively conducted research and experiments to modify individuals’ behavior.

The integrated privacy behavior transformation framework we propose draws upon theories and experiences from the disciplines listed above. By leveraging our prior research on factors influencing privacy behavior and conducting an extensive literature analysis on behavior modification theories in other domains, we have successfully crafted a robust framework for transforming privacy behavior. To assess and confirm the effectiveness of our framework, we carried out a controlled experiment, which provided validation for our framework. To the best of our knowledge, this is the initial comprehensive framework that aims to modify an individual’s privacy behavior using proven experiential methods.

This framework could prove advantageous to the academic community by facilitating the learning of privacy behavior alteration from individuals’ early age and continuing even after they have completed their educational journey. Our framework can be utilized by elementary schools, academic institutes, and private schools to enhance students’ adherence to protective privacy behavior. Furthermore, it has the potential to redirect the focus of privacy scholars onto novel avenues of investigation.

The scope of our findings regarding the changing of privacy behavior by experiential aspects is restricted. The experiment was conducted with restricted resources and within a small group of individuals. Hence, our objective is to enhance our framework by identifying its vulnerabilities and subsequently refining them. Our future research will focus on evaluating our framework in more detail and detail and with a larger group of participants, exploring improved approaches to promote individuals’ privacy behavior while reducing our intrusion. This includes investigating alternate methods to phone surveillance that we previously employed by a less privacy-intrusive one.