The role of regulatory disposition in explaining the privacy paradox : a study of internet users' interaction with cookie consent notices

• Main Author: Riaz, Sania
• Format: Dissertation
• Language: English
• Published: Royal Holloway, University of London 2023
• Subjects: Cookie consent; Privacy Paradox; Protection Motivation Theory; Regulatory Focus Theory

Privacy has always been an important consideration in computer mediated connections but, more recently, the hyper-connectedness of current internet landscape and its natives has created an urgency for more complete privacy regulations. This research project is inspired by the EU privacy laws, General Data Protection Regulations and the E-Privacy Directives, and the onslaught of cookie banners that resulted from their mistaken interpretations. The current internet environment is a collaborative play between internet users, its myriad service providers, and the regulating bodies aiming to govern the relationships between them. It behoves us to study the interaction of internet users and the new consent management tool that promises to provide users control over their personal information. Of particular interest is the current body of literature that suggests there is a gap between users intending to implement their privacy decisions but not following through with appropriate behaviours. This is dubbed the Privacy Paradox in the literature. There are behavioural explanations for why the paradox may exist, and criticisms that the privacy paradox is observed only when the research design is flawed. The aim of this study is to identify whether there is a gap between the privacy intentions and behaviours when it comes to disabling cookies. It has been suggested in many studies of privacy paradox that the personality of the internet user may also affect the privacy intentions and behaviours. The current explanations of the effect of personal disposition on privacy behaviours are derived from personality psychology and lack depth. This research project intends to explore the effect of personal dispositions on the formation of privacy intentions and behaviours relating to disabling browser cookies on desktop computers. Specifically, the study aims to check if the personal dispositions of internet users affect how they make decisions about their privacy, and whether the differences in disposition could explain the privacy paradox. The study undertakes a rational decision-making approach to privacy, starting with a literature review on how privacy risks are usually modelled in situational settings. Furthermore, research into dispositional factors is explored. Finally, two formal theories, the Protection Motivation Theory (PMT) and the Regulatory Focus Theory (RFT), are identified to test the effect of disposition on privacy decision-making in the presence of situational risk elements. A survey study was designed with the constructs Perceived Severity, Self-Efficacy and Maladaptive Rewards from PMT to model privacy risk appraisal. A new scale called the Privacy Regulatory Scale with two subscales for Promotion and Prevention orientation were developed to measure privacy dispositions. The effect of these independent variables was checked on two dependent variables of Intention (intention to disable cookies) and Behaviour in the contexts of disabling cookies through cookie banners, as well as disabling cookies through browser settings. Behaviour data is collected separately for 3rd-party cookies and for all cookies together, as well as towards cookie banners served on trusted, non-trusted and unknown websites as well. Data was collected through an online survey presented to a Qualtrics panel of UK internet users aged between 18 and 35 for a total usable number of cases n=330. Confirmatory Factor Analysis was used to verify the factor structure before checking for the hypothesized relationships through Structural Equation Modelling using three nested models. A post-hoc analysis was conducted to check for moderating effects of the two dispositional variables on the relationships between PMT variables and the dependent variables. The study finds that the perceived severity of harms from cookie setting is a significant positive indicator of intention to disable cookies, but not the behaviour of disabling cookies. Self-efficacy significantly predicts the behaviour of disabling cookies both through the cookie banners and through the browser settings. Promotion regulatory focus does not affect the formation of intentions to disable cookies. However, promotion focus positively affects the behaviour of disabling cookies both through cookie banners and through browser settings. The effect is particularly large for disabling all cookies through browser settings. Mixed results were observed for prevention regulatory focus, which significantly predicts the intention to disable 3rd-party cookies only. Furthermore, a higher prevention focus significantly reduces the odds that a user would disables cookies through browser settings. Maladaptive Rewards were found to have no direct effects towards intentions or behaviour. We also find that while intentions are significant indicators of respective behaviours their effect is small, thus indicating a presence of privacy paradox in this sample as well. Post-hoc analysis of moderation effects of promotion and prevention focus reveal that they significantly affect the relationship between perceived severity and intentions to disable cookies. Interestingly, prevention orientation significantly affects the relationship between maladaptive rewards and cookie disabling behaviour for trusted websites only. The findings reveal that the regulatory dispositions of internet users directly affect the kind of solutions they adopt to preserve their privacy and indirectly also affect the magnitude of relationships between risk appraisal variables and intentions. The study directly contributes to the understanding of the effect of personal dispositions towards privacy behaviours. The development of privacy regulatory scale can help understand the extent that dispositions affect privacy self-management behaviours in other settings as well. However, the most significant practical implication of this work is that it suggests that neither kind of privacy disposition, as well as the solutions originating from that disposition, performs better at privacy self-management. Therefore, we may keep observing privacy-paradox in further studies as well if the framework for privacy provisions is the notice and choice paradigm. Hence, it can be concluded that the regulations that are based solely on the notice-andchoice framework are likely to fail universally.