As social beings, we tend to follow what others are doing and conform to behaviors that we perceive to be socially appropriate. This inclination to act in ways aligned with perceived social norms is driven by our need for belonging and acceptance. Social norms also exert a powerful influence on online privacy behavior, shaping both protective actions, such as using privacy settings, and risky behaviors, like oversharing personal information. While the link between social norms and privacy behavior is well established in previous research, less is known about what enables individuals to adhere to beneficial norms or resist risky ones. Online privacy literacy has been proposed as a crucial factor in this process, enabling users to leverage beneficial norms while mitigating harmful ones. However, the ways in which different dimensions of privacy literacy shape and moderate these norm-behavior relationships remain insufficiently understood.

This exploratory study addresses this gap by examining how online privacy literacy directly influences privacy-related behaviors (RQ1) and whether it moderates the extent to which individuals adhere to or resist social norms in digital contexts (RQ2). Using an online survey with n = 636 U.S. participants, we differentiated between multiple dimensions of privacy literacy—factual knowledge, procedural skills, reflective abilities, and critical literacy—to assess their distinct roles in privacy decision-making. They were measured using a comprehensive knowledge test to objectively assess participants' literacy levels. Based on regression and moderation analyses, we then investigated how these dimensions relate to protective (using encrypted messengers, using privacy settings, reading privacy policies) and risky behaviors (disclosure of personal information) and whether they moderate the influence of perceived social norms on privacy behavior.

By disentangling these mechanisms, our study offers a more nuanced understanding of how privacy literacy interacts with social norms in shaping privacy behavior, informing future research and targeted intervention efforts.

The growing influence of the internet offers many opportunities but also poses significant risks, particularly for vulnerable groups such as children, seniors, and individuals with cognitive disabilities (CD). Limited digital skills, insufficient privacy literacy, and the inability to assess and manage online risks make these groups more susceptible to online threats (Shuijing & Tao, 2017; Chiner et al., 2017; Wang et al., 2019).

Seniors, for instance, are particularly vulnerable to online fraud (Burnes et al., 2017), while children face risks such as harmful interactions or exposure to inappropriate content (Livingstone et al., 2011). Both children and individuals with CD rely on others for protection (Kumar et al., 2017; Chalghoumi et al., 2017), increasing the risk of digital exclusion for adults with CD (Seale & Chadwick, 2017).

Compared to horizontal privacy risks, vertical online risks are more complex and difficult to manage (Dienlin, 2023), making their mitigation even more crucial. Furthermore, protective measures are often designed without fully considering the real-world experiences and needs of those affected (McDonald & Forte, 2022). This highlights the importance of understanding risk awareness among vulnerable groups, identifying gaps in privacy literacy, and developing effective protective strategies.

This research aims to 1) identify the awareness and experiences of children, seniors, and adults with CD regarding online risks and 2) explore their usage and preferences for online protection strategies.

To achieve this, nine focus groups (3-6 participants each), were conducted (Morgan et al., 1998). The participants included two groups of primary school children, two groups of seniors, three groups of adults with CD (with one group from a technology education organization), and two control groups. The discussions were guided by a moderator, audio-recorded, transcribed, and analyzed using qualitative content analysis (Mayring, 2022). Categories were developed inductively from the research questions and interview guide, with some deductive characteristics.

Theoretical Background

Protection motivation theory (PMT) (Rogers, 1983) proposes two sets of cognitive appraisals in response to fear appeals: threat appraisals include perceived severity of the outcome, perceived vulnerability of self, and perceived rewards of engaging in a maladaptive response; coping appraisals include response efficacy in removing the threat, self-efficacy in performing an adaptive behavior, and response cost of performing the behavior.

The PMT has been adopted to study online privacy behavior, yet empirical inconsistencies exist regarding the predictive power of each PMT appraisal factor (e.g., privacy self-efficacy, perceived severity, response efficacy) in explaining privacy behavior. Researchers attribute the empirical inconsistencies to factors such as individual, cultural, contextual differences, and conceptual and analytical choices (Mou et al., 2022). One solution is to examine latent profiles based on people’s similarities in their privacy protection motivation patterns. Unlike linear associations, this approach captures within-group heterogeneity and allows us to understand how certain factors (i.e., privacy powerlessness and perceived surveillance) and outcome (i.e., privacy protection) may be more or less meaningful for different latent groups.

Research Questions

RQ1: What types of privacy protection motivation profiles can be identified based on the PMT?

RQ2: How are privacy powerlessness and perceived surveillance related to privacy protection motivation profiles?

RQ3: How do privacy protection motivation profiles differ in privacy protection behavior?

Methodological Approach

We conducted a latent profile analysis using U.S. nationally representative survey data. Latent profile enumeration was completed on six privacy protection items to identify distinct latent profiles. All models were estimated using full information maximum likelihood estimation, and multiple random starts ensured that the solution converged on a global solution. After determining the best latent profile solution, we used the maximum likelihood manual three-step approach to examine the associations between the predictors of the latent profiles and their outcome.

With the increasing personalization of online content and targeted advertising, vulnerable populations, such as primary school children and individuals with cognitive disabilities, face heightened risks to their digital privacy (Milkaite et al., 2021; Chalghoumi et al., 2019). These groups may struggle to recognize when companies collect their data to build user profiles and monetize personal information. Prior research suggests that visceral privacy cues—intuitive, perceivable warnings—could help users become more aware of privacy violations while maintaining their autonomy (Calo, 2011). However, there is limited research on how such cues should be designed to effectively support these vulnerable populations. To ensure that privacy cues align with the cognitive abilities, experiences, and preferences of these groups, it is crucial to adopt a participatory approach that integrates their perspectives directly into the design process (Hodson et al., 2023).

This study explores how primary school children and individuals with cognitive disabilities envision privacy protection cues through ten co-creation workshops. Five groups of children and five groups of individuals with cognitive disabilities (each consisting of five participants) will participate in structured activities designed to elicit their ideas on privacy awareness. Participants will complete two storyboarding tasks in which they illustrate protective cues for given privacy-critical scenarios. Additionally, researchers will present existing privacy cue concepts, prompting participants to evaluate their usability, comprehensibility, and effectiveness. Through this iterative process, participants will provide feedback, suggest improvements, and contribute new design ideas.

By engaging these vulnerable groups in the design process, this research aims to generate insights into privacy cue design tailored to their needs. The findings will inform recommendations for inclusive privacy design practices, ensuring that digital privacy awareness and protection mechanisms are both accessible and effective for users who are disproportionately affected by online data collection and profiling.