# A Privacy Calculus Model for Contact Tracing Apps: Analyzing the German Corona-Warn-App

David Harborth, Sebastian Pape

► To cite this version:

David Harborth, Sebastian Pape. A Privacy Calculus Model for Contact Tracing Apps: Analyzing the German Corona-Warn-App. 37th IFIP International Conference on ICT Systems Security and Privacy Protection (SEC), Jun 2022, Copenhagen, Denmark. pp.3-19, 10.1007/978-3-031-06975-8_1.hal-05319909

HAL Id: hal-05319909

https://inria.hal.science/hal-05319909v1

Submitted on 17 Oct 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
<figure><img src="image_2.png" /></figure>

ifip

International Federation for Information Processing

This document is the original author manuscript of a paper submitted to an IFIP
conference proceedings or other IFIP publication by Springer Nature. As such, there
may be some differences in the official published version of the paper. Such
differences, if any, are usually due to reformatting during preparation for publication or
minor corrections made by the author(s) during final proofreading of the publication
manuscript.
# A Privacy Calculus Model for Contact Tracing Apps: Analyzing the German Corona-Warn-App

David Harborth and Sebastian Pape

Chair of Mobile Business and Multilateral Security,
Goethe University Frankfurt, Frankfurt, Germany

david.harborth@m-chair.de

**Abstract.** The SARS-CoV-2 pandemic is a pressing societal issue today. The German government promotes a contact tracing app named Corona-Warn-App (CWA), aiming to change citizens' health behavior during the pandemic by raising awareness about potential infections and enable infection chain tracking. Technical implementations, citizens' perceptions, and public debates around apps differ between countries, i.e., in Germany there has been a huge discussion on potential privacy issues of the app.

Thus, we analyze effects of privacy concerns regarding the CWA, perceived CWA benefits, and trust in the German healthcare system to answer why citizens use the CWA. We use a sample with 1,752 actual users and non-users and find support for the privacy calculus theory, i.e., individuals weigh privacy concerns and benefits in their use decision. Thus, citizens' privacy perceptions about health technologies (e.g., shaped by public debates) are crucial as they can hinder adoption and negatively affect future fights against pandemics.

**Keywords:** Covid-19 · Contact tracing apps · Information privacy

## 1 Introduction

With the global pandemic caused by the severe acute respiratory syndrome coronavirus 2 (SARS-CoV-2), digital proximity tracing systems to identify people who have been in contact with an infected person became a hot topic. Technical implementations, citizens' perceptions, and public debates around apps differ between countries, especially because of differences in the perceived importance of data protection. In particular in Germany, there have been many discussions on different implementations and their architecture [15], i.e., if the approach should be centralized or decentralized. As a result, the German contact tracing app named Corona-Warn-App (CWA) was build with a strong focus on privacy. It is based on the DP-3T protocol which ensures data minimization, prevents abuse of data and the tracking of users [14]. The German government along with its associated health institutes promote the use of the CWA, aiming to change
citizens' health behavior during the pandemic by raising awareness about poten-
tial infections and enable effective infection chain tracking.

While the discussion on the architecture and possible effects of it was mostly
among experts, for a widespread use of the app, the app's acceptance by ordinary
persons is of more importance [58]. Privacy concerns have been identified as one
of the major barriers for the acceptance of contact tracing apps in prior work [4,
33]. The privacy calculus theory, in which individuals make their use decision by
weighing privacy concerns and benefits is a suitable framework to explain the
citizens' health behavior related to using the CWA [12, 16, 18, 19, 31, 44, 59]. The
citizens' decision is of even more importance in countries like Germany where the
use of the contact tracing app is voluntary and not enforced by the government.
To the best of our knowledge, previous studies on contact tracing apps facilitating
the privacy calculus are based on users' intentions rather than on their behavior.
Therefore, we investigate the factors influencing the actual CWA use decisions
on an individual level with a sample of 1,752 participants (896 CWA users/856
non-users) and address the question why citizens use contact tracing apps.

2 Privacy-Related Decision Making and Tracing Apps

The privacy-related decision making process of users is explained by several
approaches and constructs in prior work [43,47,55,56]. The privacy calculus is
one of the approaches aiming at explaining the role of privacy concerns in use
behaviors, such as information disclosure or technology use. It represents a delib-
erate trade-off made by individuals weighing up benefits and costs [9,12,40]. The
calculus assumes that if benefits outweigh the risks (i.e., privacy concerns [12])
users tend to engage in the privacy-related behavior. Empirical studies find that
privacy risks negatively influence use intentions or behaviors and benefits pos-
itively influence the outcome variables [25,39]. The deliberate privacy-related
decision making by users is questioned in more recent studies, e.g., by extend-
ing the original concepts of the privacy calculus with new factors [10,37] or by
introducing behavioral biases influencing the trade-off [13,26].

Naturally, recent research on Covid-19 apps is sprouting up everywhere. A
huge part consists of surveys on the users’ adoption of one or more contact tracing
apps, e.g., in Australia [16], China [38], France [1], Germany [1, 4, 38, 44, 48, 50,
59], Ireland [18, 49], Italy [1], Switzerland [4, 59], Taiwan [19], the UK [1, 34, 42],
and the US [1, 31, 38]. For example, Horstmann et al. found for a sample in
Germany that the most common reasons for non-users were privacy concerns,
lack of technical equipment, and doubts about the app’s effectiveness [33]. Most
of the other studies had similar results and identified privacy concerns as the
or one of the main barriers to use contact tracing apps. In particular, people
worried about corporate or government surveillance, potentially even after the
pandemic [49], leakage of data to third parties [1], exposure of social interactions
[4], and secondary use of the provided data [4]. However, misconceptions based on
widespread knowledge gaps accompany the adoption of contact tracing apps [50].

Several of the mentioned studies on COVID-19 contact tracing apps have
used the privacy calculus [4,16,18,19,31,44]. Some of them combined the pri-
vacy calculus with other constructs such as technology acceptance [16], social
influence [16,18], or herding effects [59]. All studies found significant effects
from benefits and privacy concerns on use intentions. However, all of them used
self-reported download, install, and (continuous) use intentions as dependent
variables. In contrast, our model relies on a quasi-observable factor (use of the
CWA or not) which results from sampling participants, thereby, decreasing biases
such as the social desirability bias. Furthermore, we refer to trust in the Ger-
man healthcare system in contrast to trust in app developers [44] or service
providers [42] since Horvath et al. found that users’ trust in publicly-funded
institutions, i.e., the British National Health Service can reduce privacy con-
cerns [34]. For the sake of our cross-sectional online survey, we fall back on the
original concepts of the privacy calculus – risks, benefits and CWA use – and
nest it within the nomological net of the original “antecedents-privacy concerns-
outcomes model” (APCO) [55]. We discuss the emerging research model and
hypotheses in the next section.

3 Method

We present our questionnaire, data collection and research model in this section.
We used the statistical software R (version 4.0.3) for the descriptive analyses
and SmartPLS (version 3.3.2) [53] for the structural equation modeling.

## 3.1 Questionnaire and Data Collection

We adapted the constructs for privacy concerns (PC) and perceived benefits (PB)
from prior literature [5,20] and applied it to the CWA. Trust in the German
healthcare system is based on the construct by Pavlou [51]. The use of the CWA
is measured with a binary variable indicating whether participants use the CWA
(Use = 1) or not (Use = 0). We conducted a pretest in one class with graduate
students and gathered qualitative feedback with respect to clarity of constructs
and the questionnaire structure. After this pretest, we conducted the main study
with a certified panel provider in Germany (ISO 20252 norm) which distributed
the link to our survey in their panel from December 30, 2020 to January 14,
2021. The survey was implemented with LimeSurvey (version 2.72.6) [54] and
hosted on a university server. We sampled the participants in a way to achieve
a representative sample for Germany with approximately 50% females and 50%
males as well as an age distribution following the EUROSTAT2018 census [17].
We also set a quota to end up with half of the sample using the CWA and the
other half not using it. Our resulting sample consists of 1752 participants which
is representative for Germany with respect to age and gender. The same diversity
can be observed for income and education (see Table 1). 896 participants use the
CWA (51.14%) and 856 do not (48.86%). 1299 use Android (74.14%), 436 use
iOS (24.89%) and 17 stated to use smartphones with other mobile operating
systems (OS) (0.97%).

Since we divided the sample into two approximately equal groups (CWA
users and non-users), we check for statistically significant differences in the demo-
graphics between the groups. This is required to rule out confounding influences
<table><caption>**Table 1.** Participants' characteristics for age, gender, income and education</caption><thead><tr><th>Demographics</th><th>N</th><th>%</th></tr></thead><tbody><tr><td><strong>Age</strong></td><td></td><td></td></tr><tr><td>18-29 years</td><td>371</td><td>21.17%</td></tr><tr><td>30-39 years</td><td>316</td><td>18.04%</td></tr><tr><td>40-49 years</td><td>329</td><td>18.78%</td></tr><tr><td>50-59 years</td><td>431</td><td>24.60%</td></tr><tr><td>60 years and older</td><td>305</td><td>17.41%</td></tr><tr><td><strong>Net income</strong></td><td></td><td></td></tr><tr><td>500€- 1000€</td><td>160</td><td>9.13%</td></tr><tr><td>1000€- 2000€</td><td>402</td><td>22.95%</td></tr><tr><td>2000€- 3000€</td><td>404</td><td>23.06%</td></tr><tr><td>3000€- 4000€</td><td>314</td><td>17.92%</td></tr><tr><td>More than 4000€</td><td>292</td><td>16.67%</td></tr><tr><td>Prefer not to say</td><td>180</td><td>10.27%</td></tr></tbody></table>

<table><thead><tr><th>Demographics</th><th>N</th><th>%</th></tr></thead><tbody><tr><td><strong>Gender</strong></td><td></td><td></td></tr><tr><td>Female</td><td>894</td><td>51.03%</td></tr><tr><td>Males</td><td>853</td><td>48.69%</td></tr><tr><td>Diverse</td><td>4</td><td>0.23%</td></tr><tr><td>Prefer not to say</td><td>1</td><td>0.06%</td></tr><tr><td><strong>Education</strong></td><td></td><td></td></tr><tr><td>1 No degree</td><td>8</td><td>0.46%</td></tr><tr><td>2 Secondary school</td><td>187</td><td>10.67%</td></tr><tr><td>3 Secondary school<sup>+</sup></td><td>574</td><td>32.76%</td></tr><tr><td>4 A levels</td><td>430</td><td>24.54%</td></tr><tr><td>5 Bachelor's degree</td><td>240</td><td>13.70%</td></tr><tr><td>6 Master's degree</td><td>285</td><td>16.27%</td></tr><tr><td>7 Doctorate</td><td>28</td><td>1.60%</td></tr></tbody></table>

of these variables. All variables are non-normally distributed (based on Shapiro-Wilk tests for normality). Thus, we conducted Wilcoxon rank-sum tests to assess possible differences between CWA users and non-users.

Age and gender show no statistically significant differences since due to our sampling strategy. There are statistically significant differences between users and non-users of the CWA for the remaining demographics. Income is significantly higher for users compared to the non-users. However, the median is the same which is why we argue that the absolute difference is not having a substantial confounding effect on our analysis. The same argumentation holds for education with a median of 4 for users and 3.5 for non-users, smartphone experience in years with a mean 8.77 for users and 8.35 for non-users as well as experience in years with the respective smartphone OS (mean 7.85 for users and 7.46 for non-users). The used smartphone OS by participants in both groups is roughly similar with significantly more Android users in both groups (about three times more Android users compared to iOS). This distribution of operating systems is representative for Germany [57]. Thus, all differences between groups are – although statistically significant – negligible for our analysis since the absolute differences are relatively small. We also calculated mean sum scores for privacy concerns, perceived benefits and trust in the German healthcare system in order to check for differences between CWA users and non-users. We conducted Shapiro-Wilk tests for normality and Levene's tests of equal variances for the three constructs and find that they are not normally distributed and do not have equal variances

<footnote>+5 GCSEs at grade C and above</footnote>
<figure><img src="image_3.png" /><figcaption>**Fig. 1.** Boxplots for Privacy Concerns, Perceived Benefits and Trust in the German Healthcare System (CWA = 1: CWA users, CWA = 0: CWA non-users)</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>**Fig. 2.** Research Model</figcaption></figure>

between CWA users and non-users. Due to the non-parametric properties of our data we used the Wilcoxon rank-sum test. All variables are statistically significantly different between users and non-users with large to moderate effect sizes r for privacy concerns (r = -0.540, cf. Fig. 1a), perceived benefits (r = -0.553, cf. Fig. 1b), and trust (r = -0.258, cf. Fig. 1c).

## 3.2 Research Model and Hypotheses

We operationalize the “antecedents - privacy concerns - outcome” (APCO) model on an individual level, i.e., excluding factors such as cultural or organizational ones [55]. We focus on a narrow set of common antecedents on an individual level which are relevant for the case of the Corona-Warn-App. Privacy concerns are operationalized contextually, i.e., focusing on the specific perceptions of individuals related to the CWA. The outcome is the CWA use explained by the privacy calculus including trust in the German healthcare system as an additional antecedent of privacy concerns. Thus, this nomological net is mostly based on the original APCO model [55]. The resulting research model is shown in Fig. 2.
We include four demographic variables as antecedents (age, gender, income, education). The results for the effects of these antecedents in previous studies are inconclusive [27]. Prior work finds that older individuals and women are more concerned about their privacy [35,60]. We follow these findings and hypothesize that age has a positive effect on privacy concerns regarding the CWA and that females show higher levels of privacy concerns. Higher levels of education are usually associated with increasing privacy concerns [41]. However, since the German CWA was built based on privacy by design and can be considered to be privacy friendly, a better understanding of the CWA should reduce privacy concerns [50]. Thus, we hypothesize that there is a negative effect of education on privacy concerns (i.e., higher education levels correspond to lower privacy concerns). Similarly, a higher income is hypothesized to have a negative effect on privacy concerns as well (i.e., higher income levels correspond to lower privacy concerns) [55]. We hypothesize for the demographic variables:

1. (a) *Age has a positive effect on privacy concerns regarding the CWA.*

(b) *Female participants show higher levels of privacy concerns regarding the CWA.*

(c) *Education has a negative effect on privacy concerns regarding the CWA.*

(d) *Income has a negative effect on privacy concerns regarding the CWA.*

Smartphone experience and the experience with the respective mobile operating system is included as control for participants technical experience by including these variables as antecedents of privacy concerns [29]. We argue that participants with more experience regarding both dimensions have higher privacy concerns as they might have witnessed more privacy-related breaches and attacks on smartphones [3,11]. Thus, we hypothesize:

2. *Smartphone experience has a positive effect on privacy concerns regarding the CWA.*

3. *Experience with the mobile OS has a positive effect on privacy concerns regarding the CWA.*

Individuals' privacy concerns are generally assumed to have a negative effect on the outcome variables [55]. In contrast to prior work on the CWA and privacy, we use the actual use decisions of participants instead of behavioral intentions. By that, we avoid biases in our results due to the behavioral-intention gap which is especially pronounced in privacy-related research [8]. Thus, we hypothesize:

4. *Privacy concerns regarding the CWA have a negative effect on the decision to use the app.*

Prior work finds that the relation between privacy concerns and behavior is also affected by other factors. The most common rationale is the privacy calculus which is also included in the APCO model. The privacy calculus states that individuals engage in a deliberate trade-off between benefits (of using a technology or disclosing information) and costs (privacy risks which are operationalized by privacy concerns) when making privacy-related decisions [12]. To account for this trade-off, we include the perceived benefits of using the CWA and hypothesize:
5. *The perceived benefits of using the CWA have a positive effect on the decision to use the app.*

Our last variable in the model is trust in the German healthcare system. We include this variable as trust in general is an important concept to explain privacy concerns and individual behavior [55]. In general, trust in certain entities alleviates privacy concerns related to these entities. In addition, trust has a direct positive effect on certain use or disclosure behaviors [23–25, 28, 30, 36, 43]. In the context of the pandemic and contact tracing apps, it can be seen that privacy concerns can be alleviated by users’ trust in certain publicly-funded institutions, such as the British National Health Service (NHS) [34]. Our construct covers this partially as we include a more abstract notion of this idea in our model.

6. *Trust in the German healthcare system has a negative effect on the privacy concerns regarding the CWA.*

7. *Trust in the German healthcare system has a positive effect on the decision to use the app.*

# 4 Results

An analysis of the measurement model regarding reliability and validity is a precondition for interpreting the results of the structural model [22]. For the PLS algorithm, we chose the path weighting scheme with a maximum of 300 iterations and a stop criterion of $10^{-7}$. For the bootstrapping procedure, we used 5000 bootstrap subsamples and no sign changes as the method for handling sign changes during the iterations of the bootstrapping procedure.

## 4.1 Assessment of the Measurement Model

*Internal Consistency Reliability.* Internal consistency reliability (ICR) measurements indicate how well certain indicators of a construct measure the same latent phenomenon. Two standard approaches for assessing ICR are Cronbach's $\alpha$ and the composite reliability. The values of both measures should be between 0.7 and 0.95 for research that builds upon accepted models [21]. Values for Cronbach's $\alpha$ (0.896, 0.960 and 0.867) and composite reliability (0.903, 0.965 and 0.895) for perceived benefits (PB), privacy concerns (PC) and trust in the healthcare system (TRUST), respectively, are within these suggested ranges.

*Convergent Validity.* We evaluate convergent validity based on the outer loadings of the indicators of the constructs (indicator reliability) and the average variance extracted (AVE) [22]. The lowest loading of the three constructs equals 0.796. Thus, indicator reliability is established as loadings above 0.7 imply that the indicators have much in common, which is desirable for reflective measurement models [21]. Convergent validity for the construct is assessed by the AVE (sum of the squared loadings divided by the number of indicators). The AVEs are 0.706 for PB, 0.864 for PC, and 0.790 for TRUST. This indicates that the constructs explain significantly more than half of the variance of the indicators, and thereby demonstrates convergent validity.
<table><caption>**Table 2.** Heterotrait-Monotrait ratio (HTMT)</caption><thead><tr><th></th><th>AGE</th><th>EDU</th><th>GDR</th><th>INCOME</th><th>Sp. Exp</th><th>MOS Exp.</th><th>PB</th><th>PC</th><th>USE</th></tr></thead><tbody><tr><td>EDU</td><td>0.152</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>GDR</td><td>0.012</td><td>0.045</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>INCOME</td><td>0.048</td><td>0.243</td><td>0.088</td><td></td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Smartphone Exp</td><td>0.148</td><td>0.052</td><td>0.044</td><td>0.123</td><td></td><td></td><td></td><td></td><td></td></tr><tr><td>Mobile OS Exp</td><td>0.008</td><td>0.002</td><td>0.067</td><td>0.113</td><td>0.676</td><td></td><td></td><td></td><td></td></tr><tr><td>Perc. Benefits</td><td>0.045</td><td>0.057</td><td>0.051</td><td>0.043</td><td>0.025</td><td>0.018</td><td></td><td></td><td></td></tr><tr><td>Privacy Concerns</td><td>0.040</td><td>0.155</td><td>0.035</td><td>0.096</td><td>0.020</td><td>0.027</td><td>0.502</td><td></td><td></td></tr><tr><td>USE</td><td>0.017</td><td>0.151</td><td>0.014</td><td>0.139</td><td>0.078</td><td>0.067</td><td>0.574</td><td>0.554</td><td></td></tr><tr><td>TRUST</td><td>0.064</td><td>0.136</td><td>0.042</td><td>0.068</td><td>0.028</td><td>0.031</td><td>0.481</td><td>0.425</td><td>0.281</td></tr></tbody></table>

*Discriminant Validity.* We assess the degree of uniqueness of a construct compared to other constructs by investigating the cross-loadings for the single indicators. All outer loadings of a certain construct should be larger than its cross-loadings with other constructs [22] which is the case for our model. On a construct level, we compare the square root of the constructs' AVE with the correlations with other constructs. The square root of the AVE of a single construct should be larger than the correlation with other constructs (Fornell-Larcker criterion) [21]. All values are larger than correlations with other constructs, indicating discriminant validity. Prior work proposes the heterotrait-monotrait ratio (HTMT) as a superior approach for assessing discriminant validity [32]. Values close to 1 for HTMT indicate a lack of discriminant validity. A conservative threshold is 0.85 [32] and no value in our model is above the suggested threshold of 0.85 (Table 2). We assess if the HTMT statistics are significantly different from 1 with a bootstrapping procedure with 5,000 subsamples to get the confidence interval in which the true HTMT value lies with a 95% chance. The HTMT measure requires that no confidence interval contains the value 1. Our analysis shows that this is the case. Thus, discriminant validity is established.

*Common Method Bias.* The common method bias (CMB) can occur if data is gathered with a self-reported survey at one point in time in one questionnaire [52]. We need to test for the CMB since this is the case in our study. We perform a principal component factor analysis in R to conduct the Harman's single-factor test to address the issue of CMB [52]. The assumptions of the test are that CMB is not an issue if there is no single factor that results from the factor analysis or that the first factor does not account for the majority of the total variance [52]. The test shows that six factors have eigenvalues larger than 1 which account for 75.72% of the total variance. The first factor explains 34.65% of the total variance. Thus, we argue that CMB is not likely to be an issue in the data set.
<table><caption>**Table 3.** Path estimates and effect sizes $f^2$ and $q^2$ (only at least small effects sizes $f^2$ and $q^2$ shown)</caption><thead><tr><th>Relation</th><th>Path estimate</th><th>$f^2$</th><th>$q^2$</th><th>Result</th></tr></thead><tbody><tr><td>H1a Age → Privacy Concerns</td><td>-0.039</td><td></td><td></td><td>Not conf.</td></tr><tr><td>H1b Gender → Privacy Concerns</td><td>-0.017</td><td></td><td></td><td>Not conf.</td></tr><tr><td>H1c Education → Privacy Concerns</td><td>-0.097***</td><td></td><td></td><td>Confirmed</td></tr><tr><td>H1d Income → Privacy Concerns</td><td>-0.045*</td><td></td><td></td><td>Confirmed</td></tr><tr><td>H2 Smartphone Exp. → Privacy Concerns</td><td>-0.050</td><td></td><td></td><td>Not conf.</td></tr><tr><td>H3 Mobile OS Exp. → Privacy Concerns</td><td>0.055</td><td></td><td></td><td>Not conf.</td></tr><tr><td>H4 Privacy Concerns → Use of CWA</td><td>-0.378***</td><td>0.177</td><td>0.149</td><td>Confirmed</td></tr><tr><td>H5 Perceived Benefits → Use of CWA</td><td>0.395***</td><td>0.185</td><td>0.181</td><td>Confirmed</td></tr><tr><td>H6 Trust in the German Healthcare System → Privacy Concerns</td><td>-0.374***</td><td>0.164</td><td>0.137</td><td>Confirmed</td></tr><tr><td>H7 Trust in the German Healthcare System → Use of CWA</td><td>-0.054*</td><td></td><td></td><td>Rejected</td></tr></tbody></table>

## 4.2 Structural Model Assessment and Results

We assess collinearity, the level of $R^2$, the path coefficients, the effect size $f^2$, the predictive relevance $Q^2$, and the effect size $q^2$. We address these evaluation steps to ensure the predictive power of the model with regard to the target constructs privacy concerns and use.

*Collinearity.* Collinearity is present if two predictor variables are highly correlated with each other. To address this issue, we assess the inner variance inflation factor (VIF). All VIFs above 5 indicate that collinearity between constructs is present. For our model, the highest VIF is 1.939. Thus, collinearity is not an issue.

*Significance and Relevance of Model Relationships.* Values of adjusted $R^2$ are equal to 16.6% and 40.7% for privacy concerns and use, respectively. These values can be interpreted as weak and moderate for privacy concerns and use of the CWA [22]. The path estimates for our research model (see Fig. 2) are shown in Table 3. The sizes of significant path estimates are interpreted relative to each other in the model. Based on this, the effects of privacy concerns and perceived benefits on the use of the CWA (confirming H4 and H5) as well as of trust in the German healthcare system on privacy concerns (confirming H6) are strong. Education and income have statistically significant weak negative effects on privacy concerns (confirming H1c and H1d). However, both effect sizes are so small that they cannot be considered as relevant in the model (also visible in the $f^2$ effect sizes which are lower than the lowest suggested threshold of 0.02 [7]). Trust in the German healthcare system has a weak but negative effect on the use of the CWA (rejecting H7). None of the other hypotheses are significant.

*Effect Sizes $f^2$.* The $f^2$ effect size measures the impact of a construct on the endogenous variable by omitting it from the analysis and assessing the resulting change in the $R^2$ value [21]. The values are assessed based on thresholds by Cohen [7], who defines effects as small, medium and large for values of 0.02, 0.15 and 0.35, respectively. The effect sizes $f^2$ correspond to the path estimates with
medium-sized effects of privacy concerns and perceived benefits on use of the CWA and trust in the healthcare system on privacy concerns (Table 3).

*Predictive Relevance* $Q^2$. The $Q^2$ measure indicates the out-of-sample predictive relevance of the structural model with regard to the endogenous latent variables based on a blindfolding procedure [21]. We used an omission distance $d=7$ with recommended values between five and ten [22]. Furthermore, we report the $Q^2$ values of the construct cross-validated redundancy approach, since this approach is based on both the results of the measurement model as well as of the structural model [21]. Detailed information about the calculation cannot be provided due to space limitations. For further information see Chin [6]. Values above 0 indicate that the model has the property of predictive relevance. In our case, the $Q^2$ value is equal to 0.145 for PC and 0.404 for use. Since they are larger than zero, predictive relevance of the model is established.

*Effect Sizes* $q^2$. The assessment of $q^2$ follows the same logic as the one of $f^2$. It is based on the $Q^2$ values of the endogenous variables and calculates the individual predictive power of the exogenous variables by omitting them and comparing the change in $Q^2$ [21]. All individual values for $q^2$ are calculated with an omission distance $d$ of seven. The thresholds for the $f^2$ interpretation can be applied, too [7]. The results show that the individual predictive power for hypotheses 4, 5 and 6 is given with medium-sized effects.

# 5 Discussion

We investigated the impact of privacy concerns related to the CWA, benefits of the CWA and trust in the German healthcare system on the CWA use decision. We used the APCO model [55] and the privacy calculus theory [12] for the hypothesis development and evaluated them with an online survey with 1,752 participants in Germany (896 users and 856 non-users).

Our results support the privacy calculus theory and that individuals weigh up risks and benefits as privacy concerns have a statistically significant negative effect and benefits have a statistically significant positive effect on use. We also find that trust in the German healthcare system is the important antecedent of privacy concerns by alleviating them. This confirms our hypothesis and indicates that participants associate trust in the healthcare system with the entities operating the CWA (Robert Koch Institute, part of the healthcare system as it is subordinated to the German Federal Ministry of Health). In this context, is it far more interesting that the direct positive effect of trust on the use cannot be found in the data. The effect is even negative (although the effect size is negligible). The hypotheses related to the antecedents education and income can be accepted, although the effect size for both effects is relatively small.

Related work on contact tracing app adoption in Germany based on the privacy calculus uses a different set of antecedents of privacy concerns, referred to trust to the app designers and the study used intentions to use the app as a target variable [44]. However, as in our work, they find statistically significant
effects of benefits (positive) and concerns (negative) on intentions. Furthermore, trust has a negative effect on privacy concerns and a positive effect on intentions. Thus, our study with actual use decisions as dependent variable confirms that the privacy calculus is an appropriate tool to explain the CWA use.

## 5.1 Limitations

Our work has the following limitations. First, our study covers only the German Corona-Warn-App with all the respective characteristics of this app. Thus, the results are only generalizable to contact tracing apps in other countries to the extent that the population is comparable to the German population and that comparable apps have similar characteristics related to privacy and security aspects. However, even if apps in other countries are technically comparable, other influencing factors such as a positive or negative media coverage, failures in implementation efforts, etc., could still lead to different evaluations of individuals. Second, although we could minimize the effect of biases due to the study design (online questionnaire, self-reported measures) by having an observable dependent variable instead of reported use behaviors or intentions, we still had to rely on self-reported measures for the constructs in our model. Furthermore, our analysis closely followed the original APCO model with its focus on privacy concerns [55]. Thus, we did not consider interactions between antecedents or other potential relationships between other variables of the calculus such as effects of demographics on the perceived benefits of the CWA.

## 5.2 Future Work

The previously described effects could be considered in future work. For example, there were reports that more wealthy households were less affected by the pandemic not only from an economically but also in their daily lives, e.g., by having access to private transportation and enough living space [45]. We would assume that income has a negative effect on the perceived benefits as these households do not profit as much from technical solutions like the CWA. Similarly, the effect of trust in the healthcare system on use decisions could also be mediated by perceived benefits of the app as participants with higher trust in the medical care could be less cautious and do not see the benefits of such apps.

Besides interesting opportunities in extending the model and consider that there could be antecedents for the other variables in the APCO model and privacy calculus, we see the need for analyses of privacy and health behavior apps across countries alongside with analyses of causes for differences in potential privacy perceptions. Furthermore, it would be interesting to investigate to what extent contact tracing apps such as the CWA could induce a change in the health-related behaviors of individuals, e.g., did a notification about a past risk contact change the consequent behavior of individuals by making them more cautious?

Closely related is the question how individuals are influenced by politicians, the public debate, and others in their decision to adopt technologies like the CWA. We argued that these social influences could have been a major driver for
the division of the German population into a group which does not believe that there are benefits of such apps and that privacy issues are too severe and into the group which uses the app. Thus, future work could analyze the influences in a more granular way in order to assess the reasons for this division. This is especially important since it has been shown that informative and motivational video messages have very limited effect, but even small monetary incentives can increase the app's adoption [46]. Thus, besides improving the citizens' knowledge and perception of privacy mechanisms and benefits of the app, future health behavior communication could make use of small monetary incentives, promote the app's benefits or even try to nudge citizens to use the app.

# 6 Conclusion

In summary, our work contributes to the current work on contact tracing apps in two ways. First, we provide – to the best of our knowledge – one of the first research findings which rely on an observable outcome variable measuring the actual contact tracing app use decisions of German citizens in a large-scale online survey; thus, avoiding certain biases (e.g., the intention-behavior gap [8]) and providing robust results to rely on for deriving practical recommendations.

Second, we practically recommend to consider the importance of appropriate communication strategies by policy makers when releasing health behavior apps, such as the CWA, to a large heterogeneous user base, especially when faced with crises such as a pandemics. We can see high levels of privacy concerns and significantly lower levels of perceived benefits in the group of non-users. In contrast, trust in the healthcare system is almost equal between groups. One possible explanation is that even though the CWA is developed in a privacy-friendly way politicians and media failed to properly explain the app's functions and data protection measures (e.g., decentralized approach) to the German citizens, and by that lost several millions of potential users. This is supported by a study on media coverage which found that governments or politicians were criticized for their lack of transparent communication [2]. In addition, the public debate around the German CWA was rather critical and the usefulness of the app was questioned on a daily basis [15,58]. This implies that there was no real strategy on how to introduce the app to the citizens and advocate it against expectable criticism which needs to be considered in future crises.

**Acknowledgements.** This work was supported by the Goethe-Corona-Fonds from Goethe University Frankfurt and the European Union's Horizon 2020 research and innovation program under grant agreement 830929 (CyberSecurity4Europe).
# A Questionnaire

## Demographics

**AGE** in years

**EDU** Education (no degree, secondary school, secondary school (>5 GCSE), A levels, bachelor, master, doctorate)

**GDR** Gender (female, male, divers, prefer not to say)

**INCOME** of household (in €: 0.5k-1k, 1k-2k, 2k-3k, 3k-4k, >4k, prefer not to say)

**Smartphone Experience** in years

**Mobile OS Experience** in years

**USE** Corona-Warn-App user (yes/no)

**Privacy concerns** related to the Corona-Warn-App<fnref n="1" />

**PC1** I think the Corona-Warn-App over-collects my personal information.

**PC2** I worry that the Corona-Warn-App leaks my personal information to third-parties.

**PC3** I am concerned that the Corona-Warn-App violates my privacy.

**PC4** I am concerned that the Corona-Warn-App misuses my personal information.

**PC5** I think that the Corona-Warn-App collects my location data.

**Perceived benefits** of the Corona-Warn-App (See footnote 1)

- **PB1** Using the Corona-Warn-App makes me feel safer.

- **PB2** I have a lot to gain by using the Corona-Warn-App.

- **PB3** The Corona-Warn-App can help me to identify contacts to infected individuals.

- **PB4** If I use the Corona-Warn-App I am able to warn others in case I am infected with Covid-19.

- **PB5** The spreading of Covid-19 in Germany can be decelerated by using the Corona-Warn-App.

**Trust** in the German healthcare system (See footnote 1)

- **TRUST1** The German healthcare system is trustworthy.

- **TRUST2** The players acting in the German healthcare system are trustworthy.

- **TRUST3** The German healthcare system can cope with the burden of Covid-19 infections.

## References

1. Altmann, S., et al.: Acceptability of app-based contact tracing for Covid-19: cross-country survey evidence (2020)

2. Amann, J., Sleigh, J., Vayena, E.: Digital contact-tracing during the Covid-19 pandemic: an analysis of newspaper coverage in Germany, Austria, and Switzerland. PLoS ONE 16(2), e0246524 (2021)

<footnote n="1">¹ Measured on a 7-point Likert scale (“strongly disagree” to “strongly agree”).</footnote>
3. Bellman, S., Johnson, E.J., Kobrin, S.J., Lohse, G.L.: International differences in information privacy concerns: a global survey of consumers. Inf. Soc. **20**(5), 313–324 (2004)

4. Bonner, M., Naous, D., Legner, C., Wagner, J.: The (lacking) user adoption of Covid-19 contact tracing apps-insights from Switzerland and Germany. In: Proceedings of the 15th Pre-ICIS Workshop on Information Security and Privacy, vol. 1 (2020)

5. Champion, V.L.: Instrument development for health belief model constructs. Adv. Nurs. Sci. (1984). https://doi.org/10.1097/00012272-198404000-00011

6. Chin, W.W.: The partial least squares approach to structural equation modeling. In: Marcoulides, G.A. (ed.) Modern Methods for Business Research, pp. 295–336. Lawrence Erlbaum, Mahwah (1998)

7. Cohen, J.: Statistical Power Analysis for the Behavioral Sciences. HillsDale (1988)

8. Crossler, R.E., Johnston, A.C., Lowry, P.B., Hu, Q., Warkentin, M., Baskerville, R.: Future directions for behavioral information security research. Comput. Secur. **32**, 90–101 (2013)

9. Culnan, M.J., Armstrong, P.K.: Information privacy concerns, procedural fairness, and impersonal trust: an empirical investigation. Organ. Sci. **10**(1), 104–115 (1999). https://doi.org/10.1287/orsc.10.1.104

10. Dienlin, T., Metzger, M.J.: An extended privacy calculus model for snss: analyzing self-disclosure and self-withdrawal in a representative U.S. sample. J. Comput.-Mediated Commun. **21**(5), 368–383 (2016). https://doi.org/10.1111/jcc4.12163

11. Dinev, T., Hart, P.: Internet privacy concerns and social awareness as determinants of intention to transact. Int. J. Electron. Commer. **10**(2), 7–29 (2005)

12. Dinev, T., Hart, P.: An extended privacy calculus model for e-commerce transactions. Inf. Syst. Res. **17**(1), 61–80 (2006). https://doi.org/10.1287/isre.1060.0080

13. Dinev, T., Mcconnell, A.R., Smith, H.J.: Informing privacy research through information systems, psychology, and behavioral economics: thinking outside the “APCO” box. Inf. Syst. Res. **26**(4), 639–655 (2015)

14. DP-3T Project: Decentralized privacy-preserving proximity tracing (2020). https://github.com/DP-3T/documents/blob/master/DP3T%20White%20Paper.pdf. Accessed 16 Dec 2021

15. DP-3T Project: Privacy and security risk evaluation of digital proximity tracing systems (2020). https://github.com/DP-3T/documents/blob/master/Security%20analysis/Privacy%20and%20Security%20Attacks%20on%20Digital%20Proximity%20Tracing%20Systems.pdf. Accessed 16 Dec 2021

16. Duan, S.X., Deng, H.: Hybrid analysis for understanding contact tracing apps adoption. Ind. Manag. Data Syst. (2021)

17. EUROSTAT: EUROSTAT 2018 (2021). https://ec.europa.eu/eurostat/de/home. Accessed 16 Dec 2021

18. Fox, G., Clohessy, T., van der Werff, L., Rosati, P., Lynn, T.: Exploring the competing influences of privacy concerns and positive beliefs on citizen acceptance of contact tracing mobile applications. Comput. Hum. Behav. **121**, 106806 (2021)

19. Garrett, P.M., et al.: Young adults view smartphone tracking technologies for Covid-19 as acceptable: the case of Taiwan. Int. J. Environ. Res. Public Health **18**(3), 1332–1352 (2021)

20. Gu, J., Xu, Y.C., Xu, H., Zhang, C., Ling, H.: Privacy concerns for mobile app download: an elaboration likelihood model perspective. Decis. Support Syst. **94**, 19–28 (2017). https://doi.org/10.1016/j.dss.2016.10.002

21. Hair, J., Hult, G.T.M., Ringle, C.M., Sarstedt, M.: A Primer on Partial Least Squares Structural Equation Modeling (PLS-SEM). SAGE Publications (2017)
22. Hair, J., Ringle, C.M., Sarstedt, M.: PLS-SEM: indeed a silver bullet. J. Market. Theory Pract. 19(2), 139–152 (2011)

23. Harborth, D., Pape, S.: Examining technology use factors of privacy-enhancing technologies: the role of perceived anonymity and trust. In: Twenty-fourth Ameri- cas Conference on Information Systems, New Orleans, USA, pp. 1–10 (2018)

24. Harborth, D., Pape, S.: JonDonym users’ information privacy concerns. In: Janczewski, L.J., Kutyłowski, M. (eds.) SEC 2018. IAICT, vol. 529, pp. 170–184. Springer, Cham (2018). https://doi.org/10.1007/978-3-319-99828-2\_13

25. Harborth, D., Pape, S.: Investigating privacy concerns related to mobile augmented reality applications. In: International Conference on Information Systems (ICIS), pp. 1–9 (2019)

26. Harborth, D., Pape, S.: Empirically investigating extraneous influences on the “APCO” model - childhood brand nostalgia and the positivity bias. Future Internet 12(12), 1–16 (2020). https://doi.org/10.3390/fi12120220

27. Harborth, D., Pape, S.: Empirically investigating extraneous influences on the “APCO” model-childhood brand nostalgia and the positivity bias. Future Internet 12(12), 220 (2020). https://doi.org/10.3390/fi12120220. https://www.mdpi.com/ 1999-5903/12/12/220. Accessed 16 Dec 2021

28. Harborth, D., Pape, S.: How privacy concerns, trust and risk beliefs, and privacy literacy influence users’ intentions to use privacy-enhancing technologies: the case of Tor. ACM SIGMIS Data Base Adv. Inf. Syst. 51(1), 51–69 (2020). https://doi.org/10.1145/3380799.3380805

29. Harborth, D., Pape, S.: Investigating privacy concerns related to mobile aug- mented reality applications - a vignette based online experiment. Comput. Hum. Behav. 122, 106833 (2021). https://doi.org/10.1016/j.chb.2021.106833. https:// linkinghub.elsevier.com/retrieve/pii/S0747563221001564. Accessed 16 Dec 2021

30. Harborth, D., Pape, S., Rannenberg, K.: Explaining the technology use behav- ior of privacy-enhancing technologies: the case of Tor and JonDonym. Proc. Priv. Enhancing Technol. (PoPETs) 2020(2), 111–128 (2020). https://doi.org/10.2478/ popets-2020-0020

31. Hassandoust, F., Akhlaghpour, S., Johnston, A.C.: Individuals’ privacy concerns and adoption of contact tracing mobile applications in a pandemic: a situational privacy calculus perspective. J. Am. Med. Inform. Assoc. 28(3), 463–471 (2021)

32. Henseler, J., Ringle, C.M., Sarstedt, M.: A new criterion for assessing discriminant validity in variance-based structural equation modeling. J. Acad. Mark. Sci. 43(1), 115–135 (2014). https://doi.org/10.1007/s11747-014-0403-8

33. Horstmann, K.T., Buecker, S., Krasko, J., Kritzler, S., Terwiel, S.: Who does or does not use the ‘corona-warn-app’ and why? Eur. J. Pub. Health 31(1), 49–51 (2021)

34. Horvath, L., Banducci, S., James, O.: Citizens’ attitudes to contact tracing apps. J. Exp. Polit. Sci. 1–13 (2020)

35. Huang, Y., Liu, W.: The impact of privacy concern on users’ usage intention of mobile payment. In: International Conference on Innovation Management and Industrial Engineering, vol. 3, pp. 90–93 (2012)

36. Karahanna, E., Gefen, D., Straub, D.W.: Trust and TAM in online shopping: an integrated model. MIS Q. 27(1), 51–90 (2003)

37. Kehr, F., Kowatsch, T., Wentzel, D., Fleisch, E.: Blissfully ignorant: the effects of general privacy concerns, general institutional trust, and affect in the privacy calculus. Inf. Syst. J. 25, 607–635 (2015). https://doi.org/10.1111/isj.12062
38. Kostka, G., Habich-Sobiegalla, S.: In times of crisis: public perceptions towards COVID-19 contact tracing apps in China, Germany and the US. Technical report, Social Science Research Network, Rochester, NY (2020). https://doi.org/10.2139/ssrn.3693783

39. Krasnova, H., Spiekermann, S., Koroleva, K., Hildebrand, T.: Online social networks: why we disclose. J. Inf. Technol. 25(2), 109–125 (2010). https://doi.org/10.1057/jit.2010.6

40. Laufer, R.S., Wolfe, M.: Privacy as a concept and a social issue: a multidimensional developmental theory. J. Soc. Issues 33(3), 22–42 (1977). https://doi.org/10.1111/j.1540-4560.1977.tb01880.x

41. Lee, H., Wong, S.F., Chang, Y.: Confirming the effect of demographic characteristics on information privacy concerns. In: PACIS 2016, p. 70 (2016)

42. Lewandowsky, S., et al.: Public acceptance of privacy-encroaching policies to address the Covid-19 pandemic in the United Kingdom. PLoS ONE 16(1), e0245740 (2021)

43. Malhotra, N.K., Kim, S.S., Agarwal, J.: Internet users’ information privacy concerns (IUIPC): the construct, the scale, and a causal model. Inf. Syst. Res. 15(4), 336–355 (2004)

44. Meier, Y., Meinert, J., Krämer, N.: Investigating factors that affect the adoption of Covid-19 contact-tracing apps. A privacy calculus perspective (2021)

45. Miranda, L.: How the coronavirus has widened the chasm between rich and poor (2020). https://www.nbcnews.com/business/business-news/how-coronavirus-has-widened-chasm-between-rich-poor-n1240622. Accessed 16 Dec 2021

46. Munzert, S., Selb, P., Gohdes, A., Stoetzer, L.F., Lowe, W.: Tracking and promoting the usage of a Covid-19 contact tracing app. Nat. Hum. Behav. 5(2), 247–255 (2021)

47. Norberg, P.A., Horne, D.R., Horne, D.A.: The privacy paradox: personal information disclosure intentions versus behaviors. J. Consum. Affairs 41(1), 100–126 (2007)

48. Oldeweme, A., Märtins, J., Westmattelmann, D., Schewe, G.: The role of transparency, trust, and social influence on uncertainty reduction in times of pandemics: empirical study on the adoption of COVID-19 tracing apps. J. Med. Internet Res. 23(2), 1–17 (2021). https://doi.org/10.2196/25893

49. O’Callaghan, M.E., et al.: A national survey of attitudes to Covid-19 digital contact tracing in the republic of Ireland. Irish J. Med. Sci. 190, 863–887 (2020)

50. Pape, S., Harborth, D., Kröger, J.L.: Privacy concerns go hand in hand with lack of knowledge: the case of the German corona-warn-app. In: Jøsang, A., Futcher, L., Hagen, J. (eds.) SEC 2021. IAICT, vol. 625, pp. 256–269. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-78120-0_17

51. Pavlou, P.A.: Consumer acceptance of electronic commerce: integrating trust and risk with the technology acceptance model. Int. J. Electron. Commer. 7(3), 101–134 (2003). https://doi.org/10.1080/10864415.2003.11044275

52. Podsakoff, P.M., MacKenzie, S.B., Lee, J.Y., Podsakoff, N.P.: Common method biases in behavioral research: a critical review of the literature and recommended remedies. J. Appl. Psychol. 88(5), 879–903 (2003)

53. Ringle, C.M., Wende, S., Becker, J.M.: SmartPLS 3 (2015). www.smartpls.com. Accessed 16 Dec 2021

54. Schmitz, C.: LimeSurvey Project Team (2015). http://www.limesurvey.org. Accessed 16 Dec 2021

55. Smith, H.J., Dinev, T., Xu, H.: Theory and review information privacy research: an interdisciplinary review. MIS Q. 35(4), 989–1015 (2011)
56. Smith, H.J., Milberg, S.J., Burke, S.J.: Information privacy: measuring individuals concerns about organizational practices. MIS Q. 20(2), 167–196 (1996)

57. Statista: Marktanteile der führenden mobilen Betriebssysteme an der Internet-nutzung mit Mobiltelefonen in Deutschland von Januar 2009 bis September 2020. https://de.statista.com/statistik/daten/studie/184332/umfrage/marktanteil-der-mobilen-betriebssysteme-in-deutschland-seit-2009/. Accessed 16 Dec 2021

58. Voss, O.: Corona-App: Datenschutz-Debatte und offene Fragen (2020). https://background.tagesspiegel.de/digitalisierung/corona-app-datenschutz-debatte-und-offene-fragen. Accessed 16 Dec 2021

59. Wagner, A., Olt, C.M., Abramova, O.: Calculating versus herding in adoption and continuance use of a privacy-invasive information system: the case of Covid-19 tracing apps (2021)

60. Yang, H.C.: Young Chinese consumers’ social media use, online privacy concerns, and behavioral intents of privacy protection. Int. J. China Market. 4(1), 82–101 (2013)