An Online Randomized Field Experiment on the Importance of Privacy Education, Training, and Awareness (PETA)

This study examines the effect of privacy awareness on decisions to disclose personal information related to various security measures at the individual level. Explaining and predicting why individuals decide to disclose or withhold security-related preferences and behaviors (e.g., use of password, passphrase, 2-factor authentication, frequency of updating security software and operating systems, etc.) is a critical research and practice endeavor because such personal information is highly sensitive and can be detrimental when it lands in the hands of social engineers. We conducted a randomized field experiment in which privacy awareness was manipulated via a simple privacy nudge and disclosure behavior was measured by asking subjects to respond to a series of personal questions related to security preferences and behaviors. The experiment was conducted online among Saudi Arabian subjects who signed up for a 2-hour Security Education, Training, and Awareness (SETA) workshop during which they learned about various security protection measures. We used a basic between-subjects experimental design and conducted the experiment in three waves of data collection (N = 2,668): wave 1 was conducted immediately prior to the SETA workshop; wave 2 was conducted immediately after the SETA workshop; and wave 3 was conducted two weeks after the SETA workshop. Our aim is to test whether the privacy awareness nudge makes a difference in terms of whether individuals disclose information related to their security preferences and behaviors. The findings show that our participants overall disclosed most information asked for in waves 1, 2, and 3. This is an alarming observation regardless of the context of our experiment. However, participants who received the privacy nudge disclosed less information than those who did not receive the privacy nudge in waves 1, 2, and 3. These findings suggest that Privacy Education, Training, and Awareness (PETA) is necessary to supplement existing SETA programs. We discuss our contribution to the cybersecurity literature and practice and provide a short conclusion on how our experiment applies to what we coin the ‘general relativity of privacy’.