Master’s Thesis
Graduate School of Communication MSc Communication Science
Persuasive Communication
Overcoming the Privacy Paradox in Cookie Acceptance Behavior: Evaluating the Effects of Multitasking and Implementation Intentions
Author: Supervisor:
Miroslava Thays Mota Rosas de Youssef dr C. Scholz Student no.: 11571705
Acknowledgements
I would like to express my sincere gratitude to my supervisor Christin Scholz, for her guidance and feedback during the whole process.
Foremost, I would like to thank my family, without their love and support this journey wouldn’t have been possible.
I would like to express my gratitude to my mother for her dedication and for being a role model of perseverance and resilience. Thank you for paving the way.
I am extremely grateful for my husband, Albert. I appreciate his help, encouragement and
unconditional support in every stage of this journey. Thank you for pushing me into believing in myself and for being my rock.
I dedicate this thesis, this journey, to my daughters Luna and Sarah. With your young age you teach me every day about the true meaning of life. You are my motivation every day to be a better person. Sometimes one should not fear of pursuing “the road not taken”. Follow your dreams no matter the challenges: nothing is impossible.
Abstract
The General Data Protection Regulation was put into effect on May 2018 in the European Union, which meant websites would require explicit consent for the installation of cookies. According to studies a privacy paradox exists, and even though people say they want to protect their privacy, when it comes to taking privacy protective measures they do not. Based on limited capacity theories the aim of this study is to investigate whether in the presence of multitasking there is a greater mismatch between intentions to accept online cookies and actual behavior when
compared to non-multitasking and consequently a lower satisfaction with privacy protection behavior, and the moderating effect of implementation intentions. An online-experiment was conducted (N=121). Predictions were not supported by the results, but recommendations encourage future studies in order to find solutions on how to close the privacy paradox gap and empower the user, when it comes to privacy protection behaviors.
Table of Contents
Introduction ... 5
Theoretical Background ... 7
The Privacy Paradox ... 7
Satisfaction and Privacy Protection. ... 10
Implementation Intentions. ... 11
Methods ... 14
Participants ... 14
Research design ... 15
Implementation intentions manipulation. ... 15
Cookie consent task. ... 16
Multi-tasking manipulation. ... 17
Manipulation checks ... 18
Observed variables ... 19
Control Variables. ... 19
Cookie acceptance behavior. ... 20
Perceived satisfaction with cookie acceptance. ... 21
Results ... 22
Randomization Checks ... 22
Actual behavior (Match – Mismatch) ... 22
Perceived Satisfaction ... 24
Discussion and Conclusion ... 25
References ... 28
Appendix ... 34
Appendix A ... 34
Appendix B ... 35
Introduction
In May 2018, the General Data Protection Regulation (GDPR) came into effect. It
focuses on the protection of personal data, with the aim of synchronizing data privacy laws in the European Union (“EU GDPR”, n.d.). One of the most obvious outcomes of this for internet users is the cookie consent form that appears on a user’s first visit to a website. Online cookies are small pieces of data stored in users’ computers or mobile phones that allow their preferences and browsing behavior to be saved (“Cookies”, 2018). Some cookies are necessary for a webpage to function, while others, such as those that store preferences, statistics and marketing data, are not. The European Parliament had previously introduced Directive 2002/58/EC (2002), known as the "cookie law," with the goal of regulating the processing of personal data and privacy protection. Article 5/3 of this directive required companies in the European Union to ask for prior consent to access and store user’s information (Directive 2002/58/EC, 2002). The GDPR meant that
companies could not solely rely on implied consent but had to obtain explicit
consent (“Cookies”, 2018). Through these policies regulators want to empower users, providing them with an opportunity to make a choice with respect to online cookies; but an inconsistency exists when it comes to people’s behavior in relation to online privacy protection. While most consumers claim that they want to protect their privacy through self-protective behaviors, they do not actually do so (Boerman, Kruikemeier, & Zuiderveen Borgesius, 2017; Smit, Noort, & Voorveld, 2014). This discrepancy between intention and behavior is known as the privacy-paradox.
Even though the templates of these cookie consent dialogue boxes differ, most of them consist of two steps. First, visitors are asked whether they consent to all cookies; if they do not, a second dialogue box opens, in which they can select their preferred cookies. In order to
understand why new cookie consent policies do not always lead to optimal privacy protection behaviors, one must understand how people interact with digital media and what prevents them from acting on their intentions. With the emergence of digital technologies such as smartphones and a fast-paced lifestyle, multitasking has become omnipresent, especially among younger generations (Carrier, Cheever, Rosen, Benitez, & Chang, 2009). This constant switching of tasks has meant that many actions are not being processed thoughtfully and have become more
automatic. This could explain why, when presented with a cookie consent form, many people choose the option that requires the least effort, even if it is not aligned with their preferences.
Regulating cookie consent and privacy by design might not be enough to motivate people to make educated choices that satisfy their online privacy preferences. In the area of health communication, the intention-behavior gap—the phenomenon that people do not always act on their intentions—has been widely studied. Knowledge from this field could help to shed some light on possible solutions to the privacy paradox, which is an intention-behavior gap in the area of privacy protection. Specifically, implementation intentions are one form of intervention that has been used successfully in the field of health communication to promote behaviors such as eating more fruits and vegetables (Chapman, Armitage, & Norman, 2009), reducing smoking (Conner & Higgins, 2010), and doing more exercise (Andersson & Moss, 2011). The main tenets of this concept, which consist on activating a desired behavior through the enhancement of a situational cue, could be translated into privacy protection behaviors, which may be effective in solving the privacy paradox. Consequently, one could argue behaviors that are aligned with intentions could have a positive effect on satisfaction with privacy protection behavior. This conjecture has inspired the following research questions: Does multitasking have an effect on the mismatch between cookie acceptance intentions and actual behavior and, consequently, on
the users’ satisfaction with their online privacy protection behavior? Is this effect moderated by implementation intentions?
Theoretical Background The Privacy Paradox
Information privacy is defined as the right to decide which personal information to disclose to others (Westin, 1967). Studies on privacy protection show that people want to protect their online information, but, when it comes to their behavior, they do not (Smith, Dinev, & Xu, 2011; Barth, & de Jong, 2017). This gap is called the privacy paradox; it refers to an
inconsistency between intentions and privacy protection behavior (Kokolakis, 2017; Barth, & de Jong, 2017). Various empirical studies have shown that this issue occurs in different contexts such as self-disclosure on web applications (Taddicken, 2014), profile disclosure on social media (Chen, 2018), and personal disclosure to companies (Norbert, Horne, & Horne 2007). Norbert, Horne and Horne (2007) conducted an experiment to test the privacy paradox and found that participants disclosed more personal information to companies than they intended to.
Theories of bounded rationality (Simon, 1982), cognitive heuristics (Tversky &
Kahneman, 1975), and immediate gratification (O’Donoghue & Rabin, 2001) draw on cognitive biases to explain the irrational decision-making processes that take place when users have to make a choice with respect to their online privacy (Barth & de Jong, 2017). In particular, the theory of bounded rationality (Simon, 1982) states that one of the reasons why people do not make optimal decisions when presented with risks and benefits of disclosing personal
information is because they do not have the necessary cognitive resources and instead must rely on heuristics, or mental shortcuts when making quick effortless decisions. Empirical studies (Gambino, Kim, Sundar, Ge, & Rosson, 2016; Sundar, Kang, Zhang, Go, & Whu, 2013) have supported this claim that heuristics play a role in the disclosure of personal information despite
privacy concerns. An experiment by Sundar et al. (2013) showed that participants exposed to a benefit heuristic were more likely to disclose their personal information than those that were not.
Even though the privacy paradox has been studied in various fields, such as social theory, behavioral economics and psychology (Kokolakis, 2017), research on privacy protection
behavior, particularly cookie acceptance, has been limited. Previous studies have generally focused on privacy by design (Gambino, Kim, Sundar, Ge, & Rosson, 2016; Sundar, Kang, Wu, Go, & Zhang, 2013; Coventry, Jeske, Blythe, Turland, & Briggs, 2016), which is privacy solutions and considerations during the development or design of technologies; for example considerations with respect to the actual design of the cookie dialogue box. When evaluating online behavior, it is important to consider the emergence of technologies such as smartphones and fast-paced lifestyles, which have resulted in media multitasking becoming commonplace (Carrier, Cheever, Rosen, Benitez, & Chang, 2009). To my knowledge, no research has examined the privacy paradox and privacy protection behavior, particularly the acceptance of online cookies, in the context of multitasking, despite its relevance and significance.
Media Multitasking. Media multitasking is defined as the performance of two tasks at the same time, one of them involving a media such as television, telephone, or radio (Lang & Chrzan, 2015). According to a meta-analysis by Jeong and Hwang (2016), media multitasking has negative effects on cognitive outcomes, such as attention, interest, comprehension, recall, and task performance and positive effects on attitudinal outcomes, for example increased agreement to messages, reduced counterargument and willingness to change one’s attitude. Findings have shown that multitasking reduces recall (Voorveld, 2011; Srivastava, 2013; Segijn), recognition (Srivastava, 2013; Segijn, Voorveld, & Smit, 2016; Voorveld, 2011) and
Different models have been used to explain the effects of multitasking on information processing, all of which are based on the premise that a limited amount of cognitive resources is allocated to individual activities. For instance, Lang’s (2000) limited capacity model of mediated media processing (LC4MP) describes how mediated messages are processed. This model is based on two main assumptions. The first of these is that people process information and that in order to do this a certain amount of mental resources is required. The second assumption is that processing information involves three main sub-processes (encoding, storage and retrieval) and that a message will not be processed if the recipient does not have the necessary mental resources at any of these stages. Veltri and Ivchenko (2013) conducted an experiment to evaluate the effect of cognitive load on personal disclosure and found that cognitive scarcity had a negative effect on personal disclosure. On the evidence of previous studies based on limited cognitive capacity, it can be argued that internet browsing gratifies a need for information or entertainment (Sundar & Limperos, 2013) and that encountering a cookie dialogue box requires a user to multitask, which means that the information in the dialogue box will not be processed thoroughly.
When browsing the internet sometimes people are distracted and do not process all the information thoroughly. According to the elaboration likelihood model (ELM) proposed by Petty & Caccioppo (1986), there are two routes to persuasion, the central route and the peripheral route, which correspond to the likelihood of elaboration being high or low, respectively (Petty & Caccioppo, 1986). A high likelihood of elaboration indicates that the person engages in
thoughtful processing of the argument and allocates more cognitive resources to processing the information. This results in an evaluation that is aligned with a person’s attitudes toward the message. By contrast, when the elaboration likelihood is low, such as when cognitive resources are allocated to another task (Petty & Caccioppo, 1986), the route to persuasion is peripheral and
based on heuristics. This results in acceptance of the message based on cues instead of on the recipient’s attitudes. In the case of encountering a cookie dialogue box, one can assume that the elaboration likelihood would be low, meaning that the user would rely on heuristics. It can be argued that the design of cookie dialogue boxes stimulates only peripheral processing and hence the choice of the most effortless option. Due to the design of cookie dialogue boxes, one can predict that when a user is multitasking, he will be more likely to click on “okay” and accept all cookies or ignore the cookie dialogue box, since it would be the easiest route in dealing with cookie consent, which is conducive to a peripheral processing. Therefore, the following hypothesis is proposed:
H1: There will be a higher mismatch between intentions to accept online cookies and actual cookie acceptance behavior in those who are multitasking than in those who are not
multitasking.
Satisfaction and Privacy Protection. In the fields of social science and business, the construct “satisfaction” has been widely used when measuring the discrepancy between expectations and outcomes. Moreover, it has been a measure of performance in marketing, human resources and communication. The expectancy discontinuation model of Oliver (1986) stipulates that, when there is a match between behavior and expectations, a positive effect occurs, and in the case of a mismatch, a negative effect occurs instead. If people’s privacy protection intention does not match their actual behavior, for example in the case of online cookie acceptance, this should result in dissatisfaction. Regulations on cookies consent, such as the GDPR are meant to protect and empower European Union citizens with respect to their data privacy (“Cookies”, 2018). If people are not satisfied despite regulators’ attempts to provide policies, for example requirements for explicit cookie consent, this would mean that the
established regulations do not successfully achieve the goal of empowering the end user. In the presence of a multitasking condition, in which it is expected that the mismatch between
intentions and behavior is greater than in a non-multitasking one, consequently one could predict a result of lower perceived satisfaction. Thus, this study proposes the following hypothesis: H2: Participants who are multitasking will have a lower perceived satisfaction when compared to those who are not multitasking.
Implementation Intentions. Even though one might have the intention of performing a behavior that aligns with one’s attitudes, such as protecting one’s online privacy, intention not always match actual behavior. The theory of reasoned action TRA (Ajzen and Fishbein, 1980) analyzes the relationship between attitudes and behaviors and suggested that behavioral intention, or a person’s motivation to perform a specific behavior, is a predictor of behavior itself. But intention does not always predict behavior, explaining only between 20%-30% of the variance (Gollwitzer, 1999). In order to explain this incongruence, the theory of planned
behavior or TPB (Ajzen & Fishbein, 1980) adds another element to the TRA: behavioral control, or the actual control a person has over the behavior, which consists of internal and external components (Conner & Spark, 2005).
In the field of health communication, the implementation intentions (Gollwitzer, 1999) strategy was developed to bridge intention behavior gap and has been effective in promoting certain behaviors, such as increasing fruit and vegetable intake (Chapman, Armitage &
Norman, 2009), reducing smoking (Conner & Higgins, 2010), and voting (Nickerson & Rogers, 2010). This strategy could also work to bridge the gap between intention and behavior with respect to online privacy protection. Over time users become habituated to the cookie dialogue boxes, clicking okay and accepting all cookies becomes an automatic behavior. It has been
found that implementation behavior has effects on behavior (Gollwitzer & Sheeran, 2006), and moreover on habitually performed-behavior (Aarts, 2007), therefore this strategy could be effective with regards to the acceptance of cookies.
Implementation intention is a self-regulatory strategy that consist of creating an association between a specific goal-oriented behavior and a critical situation (that is, one in which the desired behavior must be reinforced). It consists of creating and writing a plan to achieve a certain goal in the following form: “If (situation X)” and “then (I will perform Y)” statement with relation to attaining a specific goal. It results in a mental association between the goal and the behavior that will be performed by enhancing the cue sensitivity (Gollwitzer, 1999). Even though implementation intentions are created through a conscious plan, their activation happens automatically (Gollwitzer, 1999). For example, if a person creates an implementation intention on how to handle cookie selection in accordance to their privacy protection goals, then the pop-up cookie dialogue box while browsing the internet (the situational cue) would trigger the intended privacy protection behavior, without the need for additional cognitive resources.
To my knowledge, no study has yet evaluated the moderating effects of implementation intention in multitasking, which could be of great value when trying to reduce the privacy-paradox gap. Taking previous research into account, one could argue that, with the elaboration of an implementation intention, a mental association between the privacy protection goal (in relation to cookie preferences) and a situational cue would be created, resulting in a behavior aligned with privacy protection intentions.
H3: There will be a lower mismatch between intentions to accept online cookies and actual cookie acceptance behavior in those who elaborate and implementation intention than in those who do not.
Moreover, if this is accurate, one could predict that participants in this implementation intention group should have a higher perceived satisfaction with respect to their online privacy protection behavior, which results in the following prediction:
H4: Participants who elaborate an implementation intention will have a higher perceived satisfaction to online privacy protection behavior than participants who do not.
With the prior construction of an implementation intention with respect to one’s online privacy protection, when presented with a cookie dialogue box, cookie acceptance behavior would require less cognitive resources because the action would not need deliberation
(Gollwitzer, 1999); the effects of media multitasking would thus be counteracted. The privacy protection goal would be accessed automatically when encountering the situational cue despite performing more than one task. Moreover, in this scenario, closing the intention behavior gap and goal achievement should result in a higher perceived satisfaction with privacy protection. These predictions lead to the following hypotheses:
H5: There is an interaction effect between multitasking and implementation intentions condition, so that a combination of non-multitasking and implementation intention will result in the lowest likelihood of mismatch between cookie acceptance and actual cookie acceptance behavior, followed by the combination of non-multitasking and implementation intentions, multitasking and non-implementations and multitasking and non-implementation intentions.
H6: There is an interaction effect between multitasking and implementation intentions condition, whereby a combination of non-multitasking and implementation intention will result in the highest perceived satisfaction with online privacy protection behavior, followed by the combination of multitasking and implementation intentions, multitasking and non-implementations and multitasking and non-implementation intentions.
Methods
This study consisted of an online experiment in conjunction with a questionnaire, developed with the survey platform Qualtrics, which could be accessed with a link. A convenience sample was drawn; participants were recruited through social media platforms in a period of two weeks and an incentive was given in the form of a 30EUR prize (gift certificate for Bol or Amazon) that could be won through a raffle. There were two inclusion criteria: participants needed to be residents of any country in the European Union and above 18 years of age. All study procedures were approved by the ethics committee of the University of Amsterdam
Participants
One hundred and ninety-two participants initiated the study, seven did not meet the inclusion criteria of living in Europe and twenty-nine did not complete the experiment. This resulted in a final sample of 121 participants, divided unevenly among the four experimental conditions (n1: 26, n2: 35, n3: 28, n4: 32). The participants were between 21 to 76 years of age (M
= 34.25, SD = 9.242). 67.8% were females, and most had completed either a Master’s (53.7%) or a bachelor’s degree (30.6%), and 69% completed the experiment with a mobile device. With respect to privacy protection behavior the action that participants performed the least was searching or reading for privacy statements, with 42.1% stating they never did; while the action that was performed the most was blocking pop-ups, with 33.9% always taking this measure.
Research design
A 2 (Implementation intention: formed vs. no) x 2 (Multitasking: yes vs. no) full-factorial between-subjects experiment was administered through Qualtrics, where participants were randomly assigned to one of four conditions: multitasking implementation intention condition, multitasking non-implementation intention condition, non-multitasking implementation intention condition, and non-multitasking non-implementation intention condition. Once participants accessed the study they were first presented with the factsheet and informed consent form. Those who consented to participate in the study where then presented with a brief description about online cookies, followed by questions about their intentions to accept online cookies when presented with a cookie consent, and demographic questions. Afterwards, the implementation intention manipulation, followed by the multi-tasking manipulation and the cookie consent task were administered (see detailed descriptions below). Finally, participants returned to the survey where they were asked to complete dependent variable, manipulation check items, and control variables such as self-efficacy, response efficacy and privacy concern.
Implementation intentions manipulation. Participants were randomly assigned to either an implementation intention or a non-implementation intention condition. The former, were presented with a brief description of what an implementation intention is (see Appendix A), instructions on how to form one, and an example based on the participants previous cookie preferences. For example if the participant had previously selected only “preference” cookies, they would be reminded of their choice and would be provided with an example such as: If (I am in a hurry and quickly need to find information in a website), then (I will first adjust my cookie selection and make sure only preference cookies are selected). They were then required to form
and implementation intention by filling out a text box that was provided. Participants in the non-implementation group skipped this material and proceeded with the questionnaire.
Cookie consent task. After forming (or not forming) an implementation intention, all participants were asked to complete a task that consisted of searching a website for the time a specific movie was playing. Participants were told that people usually must search for information quickly in the internet and were asked to imagine a specific relatable situation (see Appendix B) in which they needed to quickly search for information in a movie theatre website. The website was created by the researcher using a prototype software by inVISION. In order to maintain a high level of external validity, a template of a real movie theatre website Kinepolis was used as the basis for the stimulus. Previously participants were asked which type of device they were using and depending on their answer they were presented with either a computer or mobile template of the website (See Figure 1).
a. Computer format b. Mobile Format
Figure 1: Prototype of website created with inVISION with template based on movie theatre website Kinepolis (Kinepolis, n.d.).
Once participants entered the site a cookie a consent dialogue was displayed on top. Currently there is no uniformity when it comes to cookie consent forms and the labels used for
cookie categories. Here, a cookie consent template was chosen from a cookie platform
management website called Cookiebot, which offers services for the development, customization and implementation of online cookies. This particular template was chosen because it is both GDPR and ePrivacy compliant and very popular in many countries in the European Union (BuiltWith, n.d.). The cookie consent dialogue box had three main parts (See Figure 2), the first one consisted of a brief description of cookies and a binary option, either “Ok” (in order to accept all cookies) or “Show details” (for a list of the available cookies); if “Ok” was chosen the dialogue box would disappear, otherwise it would remain on the site until a choice was made (similar to the real world website, navigation on the site was still be possible even if no selection was made). If the participant clicked on “Show more” instead, the box would expand showing all the available cookies for further selection; moreover, an “About cookies” tab was available for more information about cookies. In order to maintain homogeneity across the study the same cookie categories were used across the questionnaire.
Multi-tasking manipulation. Participants in the multitasking condition were required to perform a secondary task while completing the cookie consent task described above; they were asked to memorize a string of three letters and two numbers, generated through an online service (Ramdom, 2018). Memorizing a string of letters and numbers requires cognitive resources (Kahneman, 1973), thus simulating a multitasking condition.
Figure 2: Cookie consent dialogue box. Template from Cookiebot (Cookiebot, n.d).
Manipulation checks
Participants were asked to rate the difficulty of the task from extremely easy (1) to extremely difficult (7). An independent sample t-test indicated that the mean from the multitasking group (M= 2.90, SD= 1.32) was not significantly different than the mean from the non-multitasking group (M= 2.87, SD=1.36), t (119) = -.143, p=.886, 95% CI[-.52, .45], and had a very small effect, d=0.02.
Participants in the implementation intention condition were asked to rate on a 5-point Likert-Scale from (1) Strongly Agree to (5) Strongly Disagree the following two statements: (1)
Do you understand what an implementation intention is? (2) Do you believe implementation intention can help you reach your goal. Due to technical difficulties the data for these two items were not collected. For these reasons the manipulation checks were not successful, and the results must be evaluated with caution.
Observed variables
Control Variables. Self-efficacy, response efficacy, and privacy concern were included as control variables.
Self-efficacy, or how confident a person is on his ability to perform a recommended behavior (Witte & Allen, 2000), was measured using a 3-item, 7-point Likert scale (α = 0.88), from (1) Strongly Agree to (7) Strongly Disagree, based on study by Zhang, Liu, Chen, Wang, Gao, & Zhiu (2018). Items were the following: a) Protecting my information privacy is easy for me, b) I have the capability to protect my information privacy, c) I am able to protect my information privacy without much effort. A new variable was created by aggregating the three items (M = 3.23, SD = 1.329).
Response efficacy, a person’s belief that a recommended behavior will help to decrease a threat (Witte & Allen, 2000), was measured using a 3-item, 7-point Likert scale (α = 0.88), from (1) Strongly Agree to (7) Strongly Disagree, based on study by Zhang et al. (2018). The items were: a) The privacy protection measures provided by my online cookie selection work for protecting my online information, b) The privacy protection measures provided by my online cookie selection can effectively protect my online privacy, c) When using privacy protection measures provided my online cookie selections, my online privacy is more likely to be protected. A new variable was computed with the combined items (M = 3.80, SD = 1.349).
Privacy concern was measured using a 5-item, 7-point Likert scale (α= .75), from (1) Strongly Agree to (7) Strongly Disagree, based on study by Smit, Van Noort, Voorveld (2014). Items used were: a) I believe that personal data have been misused too often, b) I worry about receiving ads in which I am not interested. C) I am concerned about the potential misuse of personal data, d) I fear that information has not been stored safely, e) I feel uncomfortable when data are shared without permission. Items were combined into one variable (M = 5.37, SD = 1.033).
Cookie acceptance behavior. The focus of this study is on the difference between intentions to accept cookies and actual behavior in the cookie consent task. To this end, participants self-reported their intention when presented with a cookie consent form at the beginning of the questionnaire (See Appendix C). After providing them with a brief description about online cookies, they were first asked what their intention would be when presented with a cookie dialogue box; they had to either click “Ok” or “Show more”. If the “Show more” option was selected they had to answer a follow up questions about what specific cookies, they intended to select. After completing the cookie consent task, participants then reported their actual
behavior. For this purpose, they were asked what they did with the cookie consent once entering the site. In order to avoid socially desirable answers, participants were assured that their
responses would be anonymous and that there were no right or wrong answer. 64% of
participants reported they intended to accept all cookies, while 36% intended to make a selection of cookies.
Actual behavior was evaluated with two questions with a similar format as the ones that measured the intent. In order to avoid socially desirable answers, participants were assured that their responses would be anonymous and that there were no right or wrong answer. 32% of participants clicked “Ok”, 20% on “Show details” and 48% ignored the cookie consent. A new
dichotomous variable was then computed that represented the difference between intentions and behavior: depending whether the intention corresponded or not to the behavior it would be coded with a 0 for match or 1 for mismatch. 51% of participants had a mismatch between intentions and actual cookie acceptance. Moreover, 93.5% of the mismatch corresponded to participants who ignored the cookie dialogue box.
Perceived satisfaction with cookie acceptance. Perceived satisfaction with privacy protection behavior was adapted from a scale presented by Steelman and Soror (2017) (with composite reliability of 0.96). The scale consisted of 4 items assessed on 5-point semantic differential scales where participants were asked after the task how they felt about the extent to which their online privacy was protected? With endpoints being: (1) very satisfied and strongly dissatisfied, (2) very pleased and strongly displeased, (3) very content and very frustrated, (4) very terrible and very delighted; the data was then reverse coded. Perceived satisfaction with overall privacy protection behavior was measured at the beginning of the survey, and was included as a control variable; perceived satisfaction with their privacy protection behavior after the cookie consent task was measured by asking them specifically: Right now, how do you feel about the extent to which your online information is protected?
A confirmatory factor analysis was performed with SPSS with a principal axis factoring and oblique direct rotation (oblimin) on the four items. The Kaiser-Meyer-Olkin measure, KMO = .83. All items were positively correlated and all factor loading values were above 0.77 with the exception of item 4 (Very terrible – Very delighted) which KMO values were 0.27 and below. Bartlett's test of sphericity, χ2 (6) = 382.79, p < .001, showed that the correlations between the items were adequate for the analysis. The items loaded on 1 factor with an Eigenvalue of 2.77, which explained 69.17% of the variance. The scree plot depicted 1 factor before the inflection
point. A first reliability test was conducted with a Cronbach's ⍺ = .83, but after evaluating the Item-Total Statistics table item 4 was excluded which resulted in a higher reliability of
Cronbach's ⍺ = .94. The three remaining items were aggregated into a new variable for perceived satisfaction (M=4.03, SD=1.23).
Results Randomization Checks
Randomization checks were performed to confirm that the experimental conditions were not different in terms of demographic variables such as: age, gender, and level of
education. A one-way ANOVA was conducted, which showed that the mean of age F (3,117) = 1.46, p = .229 was not significantly different between conditions. In addition, a chi-square test was performed and revealed that the groups did not differ according to gender X2(3, N = 120) =
1.46, p = .691, and level of education X2(3, N = 120) = 5.43, p = .143, therefore randomization
was successful with respect to these variables.
Actual behavior (Match – Mismatch)
When comparing participants that were required to multitask to does that only had a single task, descriptive statistics show as per Table 1 that in a Non-multitasking condition the mismatch between intentions and behavior was higher with 53.3%. In addition, participants in the Implementation Intention had the highest mismatch when compared to
Non-implementation intention with 53.3%. When, comparing the four conditions, participants in a Non-multitasking Non-implementation intention presented the highest mismatch with 56.3% while those in the Multitasking Non-implementation intention had the lowest (See Table 2).
Table 1. Descriptive statistics multitasking condition
Non-Multitasking Multitasking
Non-Implementation Intention Implementation Intention n 60 61 67 54 Mismatch 53.3% 46.7% 53.3% 46.7% Perceived Satisfaction (M=3.92, SD=1.25) (M=4.14, SD=1.20) (M=3.92, SD=1.25) (M=4.14, SD=1.20)
Table 2. Descriptive statistics dependent variables per four conditions Non-Multitasking Non-Implementation Intention Non-Multitasking Implementation Intention Multitasking Non-Implementation Intention Multitasking Implementation Intention n 32 28 35 26 Mismatch 56.3% 50% 45.7% 53.8% Perceived Satisfaction M (SD) 4.03 (1.062) 3.79 (1.450) 4.07, (1.134) 4.23, (1.310)
A logistic regression was performed with multitasking, implementation intention and an interaction between both factors as predictor variables; control variables of self-efficacy,
response efficacy, pre-perceived satisfaction and type of device were also included as predictors. The logistic regression with the multitasking conditions showed that the difference between match and mismatch of intention and actual behavior was not significantly different among the multitasking and non-multitasking conditions Chi2 (8) = 5.28, p = .727, _2LL = 167.667,
Table 1: Summary Logistic Regression Analysis for Variables Match-Mismatch Variable B SE OR Constant 0.19 1.79 1.21 Multitasking 0.25 0.59 1.29 Implementation Intention Self-Efficacy Response Efficacy Pre-Perceived Satisfaction Privacy Concern Type of Device Multitasking*Implementation Intention 0.31 0.26 -0.05 -0.01 -0.37 0.76 -0.72 0.55 0.18 0.18 0.18 0.20 0.43 0.80 1.369 1.31 0.99 0.94 0.69 2.15 0.49
Note. R2 = .08 (Cox & Snell) .11 (Nagelkerke). Model X2(8) = 5.28 , p = .727. * p < .05, ** p < .01, *** p < .001.
Perceived Satisfaction
As per Table 1 participants in the multitasking condition (M = 4.07, SD = 1.134) and the implementation intention condition (M =4.14, SD=1.20) had the highest perceived satisfaction. In addition, when comparing the four conditions, those in the Multitasking Implementation intention had the highest perceived satisfaction score (M=4.23, SD = 1.310).
In order to test the effects of multitasking on perceived satisfaction an analysis of covariance (ANCOVA) was conducted for both multitasking and implementation intention as independent variable, perceived satisfaction as dependent variable and self-efficacy, response efficacy and pre-perceived satisfaction as covariates. The assumptions of normality, linearity, independence of the covariates and homogeneity of the slopes were tested for the ANCOVA for multitasking and met for all variables. Levene’s test was not significant (p = .517), thus equal variances was assumed. The ANCOVA revealed that the differences between the multitasking conditions were not significant (F (1,110) = 0.08, p = .773).
In order to evaluate the differences between the means for perceived satisfaction in the
implementation intention conditions an ANCOVA was performed. Assumptions of normality, linearity, independence of the covariates and homogeneity of the slopes were tested Levene’s test was significant (p = .027), therefore equal variances were not assumed. The ANCOVA showed that perceived satisfaction mean scores between the implementation intention condition and the non-implementation intention condition was not significantly different did not differ significantly between implementation intention conditions (F (1,114) = 2.62, p = .610)
Discussion and Conclusion
Based on the tenets of limited capacity models such as the LC4MP, this study analyzed the effects of multitasking on the match between stated intention and actual behavior of
accepting online cookies. Moreover, the moderating effect of implementation intention was evaluated. Results showed that participants in a multitasking condition did not present a higher mismatch between their stated intentions to accept online cookies and their actual behavior, when compared to those in a non-multitasking condition, thus Hypothesis 1 could not be supported. Moreover, participants in a multitasking condition did not present a lower the perceived satisfaction with the privacy protection behavior that those in a non-multitasking condition; therefore hypothesis 2 was also not supported. As previously reported the multitasking manipulation check was not successful therefore, one possible explanation for these results could be that the manipulation did not work as intended. Even though using a string of letters and numbers was used because it induces cognitive load (Kahneman, 1973), in order to simulate a multitasking condition, a different type of task could have been more adequate. In a study by Kononova, Yuan, and Joo (2017) that studied the effects of multitasking on behavioral intention, the multitasking condition consisted on participants checking their Facebook account while
reading an online article. Perhaps this this type of multitasking would have created a more realistic scenario, which could have had more conclusive results.
This study also evaluated a widely studied strategy, widely used in health communication: implementation intentions. Results showed that participants in the
implementation intention condition did not have a lower mismatch between their states cookie acceptance intentions and their actual behavior nor higher perceived satisfaction, when compared to the non-implementation condition. Thus Hypotheses 3 and 4 were also not supported. In order to test the moderating effect of implementation intention, the full interaction between
multitasking and implementation intention was analyzed, but as previously discussed hypotheses 5 and 6 were also not supported. A study by Gollwitzer & Sheeran (2006) found an interaction effect between implementation intention and the strength of the goal intentions. Results showed that implementation intentions only had an effect on behavior when the goals were strong. A possible explanation about the results could have been that there was a weak goal intention with respect to the acceptance of cookies as a privacy protection behavior, which could be a focus in research studies.
The experimental design had some limitations that could shed some light on the results. Even though having participants browse through a mock up website in order to create a realistic scenario, when it came to measure actual cookie acceptance behavior it was requested for participants to self-report their selection in the questionnaire. Even though the framing of the question meant to decrease a socially desirable answer, it is possible that some participants might not have answered truly with respect to their cookie selection. In order to overcome this a
software that would track the cookie selection could have been incorporated in the prototype website.
Moreover, the study had high non-completion rate which resulted in a lower sample and uneven group memberships specially in the implementation intention condition. A possible explanation could have been the high demand of the tasks, since participants were required to open the link to the website perform the task and return to the questionnaire. Moreover, the implementation intention condition had the least number of participants, which could have been due to the demands of the study. If the characteristics from participants that didn’t complete the survey differed from those that did, this could have created participation bias. For example, different personality traits can have an effect on the acceptance of cookies. A study by Coventry, Jeske, Blythe, Turland, and Briggs (2016) found that risk-taking and impulsivity had a positive effect on accepting cookies. The online experiment meant to create a realistic environment, but an in lab experiment might have been more appropriate for this study, in order to avoid high non-completion rate and a more detailed description and instructions for the elaboration of
implementation intentions (which is more difficult in an online experiment due time and attention constraints).
During the 40th International Conference of Data Protection and Privacy Commissioners
that took place in October 2018, it was discussed the impact of technology in society and the importance of digital ethics. Technology is advancing at a swift pace; resulting in privacy concerns. But regulations will fall short, if the privacy paradox is not addressed. Therefore, not only different sectors must cooperate to find solutions, but moreover an understanding of
browsing behavior will be necessary to develop an effective comprehensive approach, in order to effectively empower the user and close the gap.
References
Aarts H. (2007) Health and goal-directed behavior: The nonconscious regulation and motivation of goals and their pursuit, Health Psychology Review, 1:1,
53-82, DOI: 10.1080/17437190701485852
Ajzen, I., & Fishbein, M. (1980). Understanding attitudes and predicting social behavior. Englewood Cliffs, N.J.: Prentice-Hall.
Barth, S., & de Jong, M. D. T. (2017). The privacy paradox: Investigating discrepancies between expressed privacy concerns and actual online behavior - A systematic literature
review. Telematics and informatics, 34(7),10381058. https://doi.org/10.1016/j.tele. 2017.04.013
Boerman, S.C., Kruikemeier, S., & Zuiderveen Borgesius, F.J. (2017) Online Behavioral Advertising: A Literature Review and Research Agenda, Journal of
Advertising,46:3, 363-376, DOI: 10.1080/00913367.2017.1339368
BuiltWith. (n.d.) GDPR Consent Management Platform Usage Statistics. Retrieved from: https://trends.builtwith.com/widgets/GDPR-Consent-Management-Platform
Carrier, L. M., Cheever, N. A., Rosen, L. D., Benitez, S., & Chang, J. (2009). Multitasking across generations: Multitasking choices and difficulty ratings in three generations of Americans. Computers in Human Behavior, 25(2),
483-489.http://dx.doi.org/10.1016/j.chb.2008.10.012
Chapman, J., Armitage, C. J., & Norman, P. (2009). Comparing implementation intention interventions in relation to young adults' intake of fruit and vegetables. Psychology & Health, 24(3), 317e332. http://dx.doi.org/10.1080/08870440701864538.
Chen, H.T. (2018). Revisiting the Privacy Paradox on Social Media With an Extended Privacy Calculus Model: The Effect of Privacy Concerns, Privacy Self-Efficacy, and Social Capital on Privacy Management. American Behavioral Scientist, 62(10), 1392– 1412. https://doi.org/10.1177/0002764218792691
Conner, M., & Higgins, A. R. (2010). Long-term effects of implementation intentions on prevention of smoking uptake among adolescents: A cluster randomized controlled trial. Health Psychology, 29(5), 529-538. http://dx.doi.org/10.1037/a0020317
Conner, M., & Sparks, P. (1996). The theory of planned behaviour and health behaviours. In M. Conner & P. Norman (Eds.), Predicting health behaviour: Research and practice with social cognition models (pp. 121-162). Maidenhead, BRK, England: Open University Press.
Cookiebot. (n.d.). Is my website compliant? Retrieved from: https://www.cookiebot.com/en/
Cookies. (n.d.). Information providers guide: The EU Internet Handbook. Retrieved from: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm
Coventry, L. M., Jeske, D., Blythe, J. M., Turland, J., & Briggs, P. (2016). Personality and Social Framing in Privacy Decision-Making: A Study on Cookie Acceptance. Frontiers in psychology, 7, 1341. doi:10.3389/fpsyg.2016.01341
Directive 2002/58/EC. (2002). Directive on privacy and electronic communications. Official Journal of the European Communities, L 201/37. https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32002L0058andfrom=EN
EU GDPR. (n.d.). The EU General Data Protection Regulation (GDPR) is the most important change in data privacy regulation in 20 years. Retrieved from: https://eugdpr.org
Gambino, A., Kim, J., Sundar, S. S., Ge, J., & Rosson, M. B. (2016). User disbelief in privacy paradox: Heuristics that determine disclosure. In CHI EA 2016: #chi4good - Extended Abstracts, 34th Annual CHI Conference on Human Factors in Computing Systems (Vol. 07-12-May-2016, pp. 2837-2843). Association for Computing
Machinery. https://doi.org/10.1145/2851581.2892413
Gollwitzer, P. M. (1999). Implementation intentions: Strong effects of simple plans. American Psychologist, 54(7), 493-503. http://dx.doi.org/10.1037/0003-066X.54.7.493
Gollwitzer, P. M., & Sheeran, P. (2006). Implementation intentions and goal achievement: A meta-analysis of effects and processes. In M. P. Zanna (Ed.), Advances in experimental social psychology: Vol. 38. Advances in experimental social psychology, Vol. 38, pp. 69-119). San Diego, CA, US: Elsevier Academic Press. http://dx.doi.org/10.1016/S0065-2601(06)38002-1
Kahneman, D. (1973). Attention and effort. Englewood Cliffs, N.J: Prentice-Hall.
Kinepolis. (n.d.). Films for Kinepolis Hoofddorp. Retrieved from: https://kinepolis.nl/
Kononova A., Yuan S., & Joo E.(2017). Reading About the Flu Online: How Health-Protective Behavioral Intentions Are Influenced by Media Multitasking, Polychronicity, and Strength of Health-Related Arguments, Health Communication,
Kokolakis, S. (2017). Privacy attitudes and privacy behaviour: A review of current research on the privacy paradox phenomenon. Computers & Security, 64, 122-134.
Jeong, S.‐H., & Hwang, Y. (2016). Media multitasking effects on cognitive vs. attitudinal outcomes: A meta‐analysis. Human Communication Research, 42(4), 599-618. http://dx.doi.org/10.1111/hcre.12089
Lang, A. (2000). The limited capacity model of mediated message processing. Journal of Communication, 50(1), 46-70. http://dx.doi.org/10.1111/j.1460-2466.2000.tb02833.x
Lang, A., & Chrzan, J.. (2015). Media Multitasking: Good, Bad, or Ugly?, Annals of the International Communication Association, 39:1, 99
128, DOI: 10.1080/23808985.2015.11679173
Mackay (Eds.), CHI EA 2013 - Extended Abstracts on Human Factors in Computing Systems: Changing Perspectives (Vol. 2013-April, pp. 811-816). Association for Computing Machinery. https://doi.org/10.1145/2468356.2468501
Nickerson, D. W., & Rogers, T. (2010). Do You Have a Voting Plan?: Implementation
Intentions, Voter Turnout, and Organic Plan Making. Psychological Science, 21(2), 194– 199. https://doi.org/10.1177/0956797609359326
Norberg, P. A., Horne, D. R. and Horne, D. A. (2007), The Privacy Paradox: Personal
Information Disclosure Intentions versus Behaviors. Journal of Consumer Affairs, 41: 100-126. doi:10.1111/j.1745-6606.2006.00070.x
Oliver, R. L. (1980). A cognitive model of the antecedents and consequences of satisfaction decisions. Journal of Marketing Research, 17, 460-469. doi:10.2307/3150499
Cacioppo, J. T., Petty, R. E., Kao, C. F., & Rodriguez, R. (1986). Central and peripheral routes to persuasion: An individual difference perspective. Journal of Personality and Social Psychology, 51(5), 1032-1043.http://dx.doi.org/10.1037/0022-3514.51.5.1032
Random. (2018). Random string generator. Retrieved from: https://www.random.org/strings/
Segijn, C. M., Voorveld, H. A. M., & Smit, E. G. (2016). The Underlying Mechanisms of Multiscreening Effects. Journal of Advertising, 45(4), 391-402. DOI:
10.1080/00913367.2016.1172386
Simon, H.M. (1982). Models of bounded rationality. Cambridge, MA: MIT Press. Organization Studies, 6(3), 308–308. https://doi.org/10.1177/017084068500600320
Smit, E.G., Noort, G.V., & Voorveld, H.A. (2014). Understanding online behavioural advertising: User knowledge, privacy concerns and online coping behaviour in Europe. Computers in Human Behavior, 32, 15-22.
Smith, H.J., Dinev, T., & Xu, H. (2011). Information Privacy Research: An Interdisciplinary Review. MIS Quarterly, 35, 989-1015.
Srivastava, J. (2013). Media multitasking performance: Role of message relevance and
formatting cues in online environments. Computers in Human Behavior, 29(3), 888-895. http://dx.doi.org/10.1016/j.chb.2012.12.023
Steelman, Z.R., & Soror, A.A (2017) Why do you keep doing that? The biasing effects of mental states on IT continued usage intentions. Computers in Human Behavior, 2017
Sundar, S. S., & Limperos, A. M. (2013). Uses and Grats 2.0: New Gratifications for New Media. Journal of Broadcasting and Electronic Medifa, 57(4),
504-525. https://doi.org/10.1080/08838151.2013.845827
Sundar, S. S., Kang, H., Zhang, B., Go, E., & Wu, M. (2013). Unlocking the Privacy Paradox: Do Cognitive Heuristics Hold the Key? In M. Beaudouin-Lafon, P. Baudisch, & W. E.
Taddicken, M. (2014). The “Privacy Paradox” in the social web: The impact of privacy concerns, individual characteristics, and the perceived social relevance on different forms of self-disclosure. Journal of Computer-Mediated Communication, 19, 248-273. doi:10.1111/ jcc4.12052
Westin, A.F. (1967) Privacy and Freedom. Atheneum, New York
Veltri, G. A., & Ivchenko, A. (2017). The impact of different forms of cognitive scarcity on online privacy disclosure. Computers in Human Behavior, 73, 238-246.
http://dx.doi.org/10.1016/j.chb.2017.03.018
Voorveld, H. A. M. (2011). Media multitasking and the effectiveness of combining online and radio advertising. Computers in Human Behavior, 27(6), 2200-2206.
http://dx.doi.org/10.1016/j.chb.2011.06.016
Witte, K., & Allen, M. (2000). A Meta-Analysis of Fear Appeals: Implications for Effective Public Health Campaigns. Health Education & Behavior, 27(5), 591–
615. https://doi.org/10.1177/109019810002700506
Zhang, X. ; Liu, S. ; Chen, X. ; Wang, L. ; Gao, B. ; Zhu, Q. (2018) Health information privacy concerns, antecedents, and information disclosure intention in online health communities.
Information & Management, 55(4), 482-493, 2018. https://doi.org/10.1016/j.im.2017.11.003
Appendix Appendix A: Implementation Intention Condition Material
