Measuring user confidence in social media security and privacy

1. Personal data and privacy on social media

Based on the idea that to exist online, people must type themselves into being (Sundén, 2003) and Floridi’s condition of ‘onlife’ as a seamless merging of analogue and digital (Floridi, 2018), one can say that nowadays young adults have no other choice but to use existing social media to publish content such as photographs, posts or text and engage in the online community by reacting to other people’s content and commenting in order to be recognized and acknowledged (Marwick & Boyd, 2014). Since privacy is highly contextual, controlling it while engaging in social media depends highly on the ability to control the context of social media. Marwick and Boyd stated that teenagers think of privacy as an ability and a state of control over a situation including the information they share online (Marwick & Boyd, 2014). That privacy is endangered due to the increase of security risks that come with social media engagement. It is impossible to monitor where and how one’s personal data is being used. The language being used in privacy policies tend to use ambiguous words such as “may”, “reasonable time”, “might” which can be interpreted in several ways. As legal obligations force Facebook to make their privacy policy more extensive, Facebook users should consequently be more conscious and cautious about the protection of their accounts and information they publish through it. Users with less knowledge about the privacy settings are not sure about the amount of private information they are putting online and how much of that information is available to whom (Külcü & Henkoğlu, 2014). Due to a report of a research conducted by the European Commission in 2011 which showed a high level of user concern for data protection, a new draft directive on data protection was presented in 2012 (European Commission, 2012, as cited in Külcü and Henkoğlu, 2014). In 2017 the European Commission adopted a proposal for a Regulation on Privacy and Electronic Communications which should replace the Directive. The new 2017 Regulation advocates that user private information will be “used under strict conditions and for legitimate purposes and that organisations that collect and manage personal information must protect it from misuse and respect certain rights” (European Commission, 2021). The question still remains how can regular users protect themselves with these laws and regulations if they are written in terminology that is incomprehensible and can mean more than one thing.

2. Literature overview

Due to Facebook’s popularity, the platform as a subject matter is frequently used in social sciences research to determine the level of user privacy awareness (Külcü & Henkoğlu, 2014). Through the years, since Facebook went global or when it became more popular than MySpace in 2008, experts and researchers examined different aspects of privacy on Facebook. Areas covered over the years vary from social sciences, psychology, computer science, marketing and business. Most of the research about Facebook privacy settings for the last fifteen years was done focusing on the user privacy, potential risks of sharing private data, impression factors that influence Facebook users and norms of using the platform (Shiau, Dwivedi, Lai, 2018). Since 2006 when Facebook introduced News Feed, which at the time showed publicly every change that a user made to his/hers page (Hall, 2021), emerged a global concern for safety and privacy on the social media platform. Questions were asked about one’s private information on Facebook, and first researches appeared from different field studies. Early on, McKeon made an infographic of the Evolution of Privacy on Facebook based on statistics from Google, the Facebook Data Team and his own interpretation. The infographic showed a chart covering the period from 2005 to 2010 and in only five years there were significant changes in the rate of the private information Facebook obtained and made accessible to others (McKeon, 2010). Over the following years, the interest on this subject amongst the researchers only increased.

Privacy concerns and confidence in the ability to control the information that is being provided online, dates back as early as 2006 (Acquisti, Gross, 2006), when Facebook’s popularity was slowly rising and reaching a global audience. Tsay-Vogel, Shanahan and Signorielli examined the effects of Facebook use on privacy perceptions and self-disclosure behaviours from 2010 to 2015. During the five year period time, the researchers noticed younger users caring less about privacy settings, but as they matured they became more conscious about the kind of private information they publish online (Tsay-Vogel et al., 2018).

About privacy concern and related behaviour, wrote Buchanan et al., when they conducted a study of 1,515 examinees and developed a scale for measuring privacy-related attitudes including privacy concern and behaviours: general caution and technical protection (Buchanan et al. 2006). Further on, a three-art study examined disclosure on Facebook profiles. Researchers found a link between the amount of data published online and user age, that being the older the users got, the less information they provided publicly on Facebook (Nosko et al., 2010). This confirms the previous research done by Tsay-Vogel, Shanahan and Signorielli. In addition to topics covered, studies have been conducted on the subject of changes in user privacy and disclosure behaviour (Stutzman et al., 2013), to studies which analyse effective ways to do Facebook research which included concern about privacy (Wilson et al., 2012). Further on, Pereira, Xavier, and Prates got deeper into the issue of the challenges for users to understand the nature and options of Facebook privacy settings. Their research was based on a simulator that was provided to the examinees where they could explore different scenarios of adjusting privacy settings and understand the rules of how the platform works better (Pereira et al., 2014).

Saeri et al., integrated various theoretical approaches in their research in order to observe online privacy protection. They used the theory of planned behaviour, norm focus theory and variables which include perceived risk as well as trust. The conclusion was that not enough researchers included injunctive and descriptive norms when investigating online privacy protection and that the impact of trust towards social media as well as risk perceptions needs more theoretical base (Saeri et al., 2014).

The papers that inspired this research and whose author’s steps were applied as a part of the measurement were by Alexa K. Fox and Marla B. Royne and Hsuan-Ting Chen. Foy and Royne developed a measure of one user’s understanding of social media privacy policies and proposed a detailed list of suggestions on how to improve privacy policies’ text language in order to be more understandable to everyday users (Fox & Royne 2018). The later paper by Chen questioned the privacy paradox issue and included factors such as privacy self-efficacy to the existing measurement consisting of privacy concerns and self-disclosure as key components. What was confirmed was that social media visibility rate highly correlates with privacy concern both in the USA and in China, where the studies were carried out, but in Hong Kong privacy concern was negatively related to self-disclosure and not significantly related in the study conducted in the USA (Chen, 2018).

Observed from a global point of view, researchers did not go past children as the observed research population. A research was conducted by Staksrud, Ólafsson and Livingstone who gathered a sample of almost 1000 children from 25 European countries. They were interested to find out if the use of Facebook increases experiences of online risk among children, which as a research result confirmed their data (Staksrud et al., 2013).

Privacy settings and Facebook users are a moderately common topic for many excellent researchers internationally as noted previously in the literature review. There aren’t however many papers written on this subject in Croatia, especially papers covering the student population. Kosić is one of the authors who wrote about this issue with regard to the population of children. His work was concentrated in the ways children (8th grade of secondary school) use Facebook and what kind of information they view and share, and did not go into security and privacy issues (Kosić, 2010). Grmuša et al., in their work on parent’s and Facebook privacy discuss the trend of publishing photos of children and minors without their knowledge or consent, creating a certain digital identity without fully considering and understanding privacy policies. The researchers focused on parents as a research population and examined their awareness of: the privacy risks on Facebook, privacy protection mechanisms, GDPR regulation and the parent’s overall opinion about it (Grmuša et al., 2019). A research that was conducted among first-year students of the Faculty of Educational Sciences in Pula, gave results which showed that the examinees were not familiar enough with the rules of using data on the platform, or with privacy settings and neither with the conditions for using Facebook (Ružić-Baf et al., 2012). Pavuna in his research with the sample of the study being users aged 14 to 75 years, discovered that the research participants consider their privacy important, but they easily renounce and compromise it in order to use Facebook and other social media (Pavuna, 2019). This is in agreement with the previous privacy paradox theories mentioned where users are willing to give up on their privacy at the very beginning of creating a Facebook account.

3. Facebook privacy policy

Facebook privacy terms and conditions are difficult to interpret with certainty. The text is written in a way to encourage the user and instil confidence, but because of ambiguous sentences and occasional specific words used in the body text, suspicion arises that the text can be interpreted in favour of the platform more than in favour of the user. When reading general terms of Facebook services, in the section it says The permissions you giveus:

“Specifically, when you share, post, or upload content that is covered by intellectual property rights on or in connection with our Products, you grant us a non-exclusive, transferable, sub-licensable, royalty-free, and worldwide license to host, use, distribute, modify, run, copy, publicly perform or display, translate, and create derivative works of your content (consistent with your privacy and application settings). This means, for example, that if you share a photo on Facebook, you give us permission to store, copy, and share it with others (again, consistent with your settings) such as service providers that support our service or other Facebook Products you use. This license will end when your content is deleted from our systems” (Facebook, 2021).

What this means is that Facebook can copy any content you post on the platform, but promises that if you delete the content it won’t be visible to anyone again. However, what the company doesn’t promise is to delete the content they copied from you, so basically it is still available, it may be still visible and subject to exploitation even when you delete your account entirely. Facebook’s privacy terms and conditions text is full of such ambiguities and an analysis and legal interpretation of every section could be conducted in consultation with attorneys and other professionals who can advise the user in a timely manner. But this is too much work for one individual who just wants to share a lovely image of an abroad location they just visited with their online community (at least from a user perspective). The fact that 1.7 billion users use Facebook (Shiau et al., 2018) helps tremendously with the trust the users have in the platform. It is alarming to think that user’s privacy is easily breachable and endangered in present-day informational era and the revised privacy framework does not resolve the problem and question of one’s safety in online surroundings (even though Facebook complies with current EU data protection law, which includes the GDPR) (Sevignani, 2016). Even today, when users have to allow “cookies” and other permissions to every site they visit online, there is uncertainty and doubt over how their private information is collected, stored, downloaded, shared, purchased, stolen, and (mis)used (Fox, Royne, 2018). Users give permissions to their private information despite their suspicions because in their estimation they have more to gain than to lose. They give up some privacy to be a part of a globally networked consumer society (Turow et al., 2008).

Facebook is commercially organised, as are most of the present social media services. That means it has to gain profit and since setting up an account on Facebook is free, profit must be obtained by the secondary use of user interactions. Users engage on social media, they communicate with their friends, family and public. They comment, watch and read news and posts, organize events, form groups and leave their online bread crumbs in a number of different ways. All of this data is gathered and later used for advertisement purposes which are targeted to the person who provided the data in the first place (Sevignani, 2016). All this being a vicious circle of mutual acceptance of goods, with a questionable true state of user’s safety and digital privacy.

4. GDPR and facebook

GDPR (General Data Protection Regulation) is a law that protects the personal data and privacy of the European Union members in terms of businesses exploiting personal data for commercial or other purposes. Since the GDPR went into effect on May 25th in 2018, this law affected Facebook as well and influenced the way it stores, collects and processes data. Facebook has undertaken steps to ensure it abides by the GDPR regulations, but that doesn’t mean big and small businesses aren’t responsible for using personal data (Vodić kroz GDPR za početnike, 2021). On the contrary, businesses of all kinds have to make sure they don’t run into legal issues if they don’t respect GDPR rules. What the new EU law brought to the Facebook users is the obligation to give permission for the information they put online to be used and in return advertisers must be transparent about the ways they use that information. Now, EU Facebook users should be able to withdraw their consent whenever they want, they should be able to see the information businesses are using at any time and should be able to edit or delete the information they want to provide (Villi, 2021). The trick is that Facebook is not responsible for businesses who do not comply by the GDPR rules and there are small but significant user design issues which are questionable and may serve as a further point of research in the future. Just to give an example, when accepting terms and conditions there is an accept and continue button which the user can hit regardless of whether he or she reads the information and scrolls all the way through the explanatory text. Users are being overwhelmed by the “read and accept” popping up windows that it is likely, they are just clicking the accepting button to get rid of the window without understanding what they are accepting and just hoping for the best. The GDPR regulations have tried to protect users, but what do users do to protect themselves?

5. Research and method

The aim of this research was to find out the degree of students’ awareness of the context that influences the ability for private information to stay private on social media. Given that social media is increasingly being used not only for entertainment, information but also education and shopping, it is interesting and crucial to investigate the literacy of the student population on social networks, since the assumption is that the student population has the highest level of media literacy considering their education levels and being constantly surrounded by social media.

Since the largest population active on social media is the younger demographics, ages from 16–24, (Chaffey, 2019) a questionnaire was conducted amongst the student population on the Faculty of Social Sciences and Humanities in the city of Osijek and Zadar. The fundamental aim of this research was to examine the awareness of the context that influences students’ privacy, their knowledge of privacy policies on social networks, their attitude toward sharing private information on social networks, toward safety and privacy on social media. The goal of the research is to influence the awareness of the academic community on the need for information literacy at a national level and to initiate active organization and participation in projects, workshops and lectures that will cover the field of personal data protection in the digital environment with an emphasis on social media. Four research questions were formulated:

1.

To what degree are users of social media aware of the amount of personal data they are providing the social networking sites?

2.

To what degree are users of social media concerned with possible misuse of their personal data by the social networking sites?

3.

To what degree are social media users aware of the way their private information is used by social networking sites?

4.

To what degree are users of social media concerned with the personal data they are providing the social networking sites?

The survey questionnaire was set up online, consisting of several Likert scales measuring respondents’ attitudes and awareness of proposed elements that influence privacy. The questions were based on Facebook privacy policy content analysis, researches done by Fox and Royne (Fox & Royne, 2018) and Chen (Chen, 2018). The aim was to examine existing knowledge and attitudes about Facebook privacy rules as well as the degree of self-confidence and concern about the sharing and misuse of private information. Sample of students was gathered from the pool of students at the Osijek and Zadar University. Questionnaire was prepared in a way that can be as easily used on a mobile phone or tablet as well as on a personal computer or laptop.

A total of 163 questionnaires were submitted by the students. Call for participation in the research was sent to official university e-mails of all students of Faculty of social sciences and humanities, University of Osijek and Department of information sciences, University of Zadar. All together 1489 e-mails were sent, but it is unclear how many students were reached. It is known fact that a lot of students, especially at Faculty of social sciences and humanities, University of Osijek do not use official e-mail, but use private gmail and similar accounts instead. For that reason, calculating precise turnout was not possible. For the same reason it was impossible to draw a representative sample, but gender and age results are in agreement with both Osijek and Zadar students’ statistics. In the text below and showed in Table 1 the analysis of demographic data was provided.

OPEN IN VIEWER

Table 1

Privacy concerns

Privacy concerns – PC	Mean	Crombah Alpha
The information I submit on social media could be misused	3.75	0.912
Anyone can find private information about me on social media	3.65
Information shared on social networks can later be used to the detriment of the individual	3.97
Information shared on social networks can later be used in a way that was not originally intended	4.06

Figure 1 shows the percentage of gender of the respondents. There were 122 female and 41 male respondents. Higher number of female students is consistent with the demographic statistics of social sciences and humanities studies at Osijek and Zadar university. 16 students did not have Facebook accounts, so 147 students entered the final analysis.

OPEN IN VIEWER

Figure 1.

Gender distribution.

Figure 2 shows the age distribution of the respondents. Most of the respondents belong to the category of 19–23 years of age, which makes up the average student population.

OPEN IN VIEWER

Figure 2.

Age distribution.

6. Privacy and misuse concern

For measurement of personal data privacy and misuse concern two Likert scales were used. Both showed very high internal consistency (Crombah Alpha $>$ 0.9) and items’ scores were averaged to form indexes.

Likert scale was adapted from Chen (Chen, 2018) and respondents were asked to rate their concern on a measurement scale from 1 (Not concerned at all) to 5 (Very concerned).

On average respondents exhibit concern that is firmly on a positive end of a scale although far from the extreme showing somewhat concern for personal data privacy.

Table 2 shows respondent’s degree of misuse concern. Likert scale was formed with 9 items with the same (Not concerned at all) to 5 (Very concerned) measurement scale.

Misuse concern is again, on average, on the positive end of the scale with all items but obviously to a somewhat lesser degree then with the privacy concern.

Even after 15 and more years of observing and questioning social media users, researchers are puzzled by the issue of the privacy paradox, which in principle says that users are concerned about privacy but use social networks anyway even though they are aware the platforms use their private data for company gain (Chen, 2018).

Obtained sample can be considered representative for social sciences and humanities students which have similar gender ratio at all Croatian universities and age distribution is typical for student population in general. This research shows that students in the obtained sample are moderately concerned both about their privacy and about possible misuse of their private data and that those concerns are highly correlated. Moreover both are negatively correlated with privacy self-efficacy. We can say that the more students are concerned about their private data, the less they feel they are in control of their privacy. Beside that, the less they think they understand privacy policies to a somewhat higher degree they are more concerned about their privacy and the more they think they understand privacy policies the more they feel self-efficient on their privacy. We can argue that all factors are more or less subjective and show what students perceive. This confirms what Fox and Royne concluded in their first study and that is the objective and subjective knowledge about the subject of privacy doesn’t really reflect what they actually know, but rather what they think they know (Fox & Royne, 2018). The other four factors consist of more objective elements; content sharing, information sharing, self disclosure and objective understanding of privacy policies. Three sharing factors are more or less indicators of behaviour and all three show moderately high positive intercorrelation with self disclosure being somewhat negatively correlated to objective understanding of privacy policies. We can argue that all 7 factors form one objective and one subjective cluster both of them being completely uncorrelated with each other. This seems to be in contradiction to results of Chen (2018) who showed that the users profile visibility was limited due to privacy concerns. It could be argued that Chen research was conducted on the general population which may be stated is different from the student population. Also, there might be some cultural differences, but it may also be consistent with Uses and gratification theory (Katz et al., 1973). This line of reasoning might be highly speculative, and not supported by data in this research, but results suggest that since sharing and self-disclosure is not correlated to privacy concern, self-efficacy and subjective understanding there must be something else that dominantly influences sharing and self disclosure or that gratification from the use outweighs concern or renders it insignificant however strong it may be. It also might be that students’ motives or young people’s motives in general, as a basis for gratification, are considerably different from the general population.

8. Conclusions

There is no correlation between privacy concern and private information and content sharing. According to the results, it is concluded that privacy concern is a subjective attitude that is not related to sharing behaviour and objective understanding of privacy policies. Another factor affects the amount of content sharing, but it is not a matter of what will happen to the content that is being shared or how and who will use it. What can also be argued is that what the respondents think is at least partially interconnected and what they do is interconnected, but what they think and what they do shows no correlation. Possible explanation: What they do is driven by need, what they think is not. The need can be explored through future research. And this would be in line with the Uses and gratification theory according to which the use of all media, including social ones, represents the satisfaction of needs and gratification outweighs concern or renders it insignificant, however strong it may be.

The results gave a clearer picture of the attitude of the student population towards the protection and sharing of private information on social media. Overall, the studied student population think they know less than they actually do about privacy policies and they showed somewhat concern for personal data privacy they provide on social media and are somewhat concerned with possible misuse. These results are indicators that there is a need to promote awareness and to protect personal information not only on social media, but in the online environment in general.

One side of the research was observed, i.e. how users behave on social media and what are they doing with their private information. It would be interesting to see how users behave towards other people’s private information? Is their behaviour and attitude toward other people’s private information related to the amount of private information they share and make visible? Are we faced with a generation of digital introverts who are willing to observe the social media community, but not actively participate in creating content? Are Croatian young adults migrating to another social media platform where they are more engaged and if so what is their attitude toward privacy policies there? New questions open as the ones that are asked are closed, but what remains is the ever going issue of how safe users are on social media and what are they doing to protect themselves?