# "Most Companies Share Whatever They Can to Make Money!": Comparing User's Perceptions with the Data Practices of IoT Devices

Mahdi Nasrullah Al-Ameen, Apoorva Chauhan, M. Ahsan, Huzeyfe Kocabas

► To cite this version:

Mahdi Nasrullah Al-Ameen, Apoorva Chauhan, M. Ahsan, Huzeyfe Kocabas. "Most Companies Share Whatever They Can to Make Money!": Comparing User's Perceptions with the Data Practices of IoT Devices. 14th International Symposium on Human Aspects of Information Security and Assurance (HAISA), Jul 2020, Mytilene, Lesbos, Greece. pp.329-340, 10.1007/978-3-030-57404-8_25. hal-03657704

HAL Id: hal-03657704

https://inria.hal.science/hal-03657704

Submitted on 3 May 2022

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# "Most Companies Share Whatever They Can to Make Money!": Comparing User's Perceptions with the Data Practices of IoT Devices

Mahdi Nasrullah Al-Ameen<fnref n="1" />, Apoorva Chauhan<fnref n="2" />, M A Manazir Ahsan<fnref n="1" />, and Huzeyfe Kocabas<fnref n="1" />

mahdi.al-ameen@usu.edu, apoorva.chauhan@uwaterloo.ca, {manazir.ahsan, huzeyfe.kocabas}@aggiemail.usu.edu

**Abstract.** With the rapid deployment of Internet of Things (IoT) technologies, it has been essential to address the security and privacy issues through maintaining transparency in data practices, and designing new tools for data protection. To address these challenges, the prior research focused on identifying user's privacy preferences in different contexts of IoT usage, user's mental model of security threats, and their privacy practices for a specific type of IoT device (e.g., smart speaker). However, there is a dearth in existing literature to understand the mismatch between user's perceptions and the actual data practices of IoT devices. Such mismatches could lead users unknowingly sharing their private information, exposing themselves to unanticipated privacy risks. To address these issues, we conducted a lab study with 42 participants, where we compared the data practices stated in the privacy policy of 28 IoT devices with the participants' perceptions of data collection, sharing, and protection. Our findings provide insights into the mismatched privacy perceptions of users, which lead to our recommendations on designing simplified privacy notice by highlighting the unexpected data practices.

**Keywords:** IoT · User Study · Mismatched Privacy Perceptions

## 1 Introduction and Background

The Internet of Things (IoT) is a system of interrelated devices provided with unique identifiers and the ability to transfer data over a network without requiring human intervention [9]. The IoT devices are becoming increasingly popular in day-to-day lives, with nearly two-thirds of Americans owning at least one IoT connected device [3]. Despite the increasing popularity and immense potential of IoT devices, security and privacy issues remain as major concerns [2, 12].

The study of Naeini et al. [7] explored the privacy preferences of users in different contexts of IoT usage, where participants reported to be less comfortable with data collection in private places as compared to public settings. The limited technical understanding of people often contributes to their incorrect

<footnote n="1">¹ Utah State University, USA</footnote>

<footnote n="2">² University of Waterloo, Canada</footnote>
mental model of security threats in an IoT environment [12]. A recent study by Malkin et al. [5] reported that almost half of their participants who were users of Amazon and Google smart speakers, did not know that their recordings were being permanently stored by the devices. Due to such unawareness, only a quarter of their participants reviewed their recorded interactions, where very few had ever deleted any recordings [5]. A separate study [4] on smart speakers identified that users trade privacy for convenience with different levels of deliberation and privacy resignation.

People reported their interest to be notified about the data practices of IoT device [7]. However, the privacy notice often fails to help users with making an informed decision to protect their privacy preferences while purchasing or using an IoT device [2]. The study of Page et al. [8] unpacked the relation between people's perceptions and adoption of IoT technology. The authors [8] divided the IoT users into two categories: "user-centric", who think that the IoT devices are to be controlled by users; and "agentic", who think that the control of IoT devices are to be negotiated between the machine and human. The study highlighted privacy concerns for the people coming from a user-centric perspective given that consumer-oriented IoT is currently moving towards the agentic view [8]. The findings from these studies call for an investigation to identify the gaps between people's perceptions and the actual data practices of IoT devices. We addressed this challenge in our work, which is guided by the following research enquiries:

- What are users' perceptions of information collection by IoT devices? How do their perceptions vary from the actual data practices?

- What are users' perceptions of information sharing (with third-party entities) by IoT devices? How do their perceptions vary from the actual data practices?

- What are users' perceptions of data protection strategies adopted by IoT devices? How do their perceptions vary from the actual data practices?

To address these research questions, we selected 28 IoT devices from different categories, including health & exercise, entertainment, smart homes, toys & games, and pets, and reviewed their privacy policies. We then conducted a lab study with 42 participants, where they reported their perceptions of data collection, sharing, and protection by IoT devices. Our analysis identifies the gaps between participants' perceptions and the actual data practices of IoT device. The findings from this study would contribute towards the design of simplified and usable privacy notice by highlighting the unexpected data practices of users.

## 2 Methodology

We conducted individual study session with each participant in a lab setting. We recruited participants by sharing our study information through email and online social media. A total of 42 participants (16 females, 25 males, and 1 other), who live in Logan, Utah, took part in this study. The age-range of our
participants varied between 18 and 64, where most (35, 83.3%) of them belonged to the age group 18-34. Among our participants, 26 (61.9%) identified as White, followed by Asian (16, 33.3%), Hispanic/Latino (1, 2.4%), and Other (1, 2.4%). A majority (26, 61.9%) of participants were students. None of our participants had any academic or professional background in cybersecurity. Our study was approved by the Institutional Review Board (IRB) at Utah State University.

**Selection of IoT Devices.** We selected 28 devices for our study (see Table 4 in Appendix) from the list of IoT devices compiled by Mozilla Foundation<fnref n="1" />, where the devices are divided into different categories (e.g., health & exercise, entertainment, smart homes, toys & games, and pets) based on their core service and functionality. We conducted a series of focus-group discussion among researchers in this project and with our colleagues to finalize our device selection.

**Types of Information.** In light of prior work [10] and the privacy policy of selected devices, we identified nine categories of information that are generally collected by a device or service provider, where each type of information is divided into sub-categories. For example, name, gender, and date of birth of a user are collected as 'personal information'. The other types of information considered in our study include: Contact (email address, postal address, and phone number), Financial (bank account details, and credit or debit card number), Health (height, weight, and work out details), Location (current location: city level or more precise), and Media (audio, and video). We also considered the information about IoT device usage, and the information an IoT device may collect from a connected device (e.g., contact list from a smartphone) and from an online social media (e.g., friend list from Facebook).

**Procedure.** We conducted the study in a lab environment, where participants completed the survey hosted on Qualtrics<fnref n="2" /> after they had read and agreed to informed consent document. Each participant was presented with four IoT devices, selected in a semi-random process from our list of 28 devices (each IoT device was presented to six participants). For each IoT device, the participant was presented with a visual description about its functionality. Participants could take as much time as they needed to familiarize themselves with the functionality of the device. Thereafter, they reported their perceptions of information collection and sharing by that device, where we presented them with each type of information (see the above paragraph for further details). Participants were also asked about their perceptions of the reasons behind information collection and sharing. Then, participants reported their perceptions of security and privacy strategies (e.g., encryption, anonymization) adopted by the device for data protection. For each participant, the above process was repeated for three other devices. At the end of study, participants answered a set of demographic questionnaire. On average, each session took around 45 minutes.

<footnote n="1">¹ List of IoT Devices, compiled by Mozilla Foundation: https://mzl.la/2zOK4II</footnote>

<footnote n="2">² Qualtrics is an online survey platform used to create, distribute, collect, and analyze survey data (www.qualtrics.com)</footnote>
<figure><img src="image_2.png" /><figcaption>Fig. 1. Participants' Perceptions of Data Collection by IoT Devices</figcaption></figure>

**Analysis.** We went through the privacy policy of each IoT device, and compared that with participants' perceptions in terms information collection, sharing, and protection. There are four cases resulting from our comparison: a 'Yes-Yes' match, a 'No-No' match, a 'Yes-No' mismatch, or a 'No-Yes' mismatch. Here, a 'Yes-Yes' match for information collection means, the user believes that the information is collected by a device and the privacy policy states that it is indeed collected, where a 'No-Yes' mismatch represents, the user thinks that the information is not collected by a device, but that information is collected according to the device's privacy policy.

# 3 Results

## 3.1 Data Collection by IoT Devices

Figure 1 presents participants' perceptions of data collection by the IoT devices, where most of the participants perceive that the IoT devices collect contact (91.07%), personal (86.31%), location (82.74%), and device usage information (82.74%). Participants' perceptions of data collection are related to the category of IoT devices. Considering all data types, IoT devices in "pets" category are perceived to collect least amount of information as compared to the devices in other categories, where the "entertainment"-focused devices are perceived to collect most amount of data from users. In some instances, participants' perceptions of collecting a specific type of information are related to the core service offered by the device, where IoT devices in "Health & exercise" category are perceived to collect more health information as compared to the devices in other categories (see Figure 1).

Table 1 presents the matches and mismatches between participants' perceptions and the privacy policy of IoT devices in terms information collection. From the perspective of user's privacy preservation, we consider a 'No-Yes' mismatch
<table><caption>**Table 1.** Match/Mismatch between Participants' Perceptions and Privacy Policy: Data Collection by IoT Devices [*NA: Information is not available in privacy policy]</caption><thead><tr><th></th><th></th><th></th><th></th><th></th><th></th><th></th></tr></thead><tbody><tr><td rowspan="4">Personal</td><td>Yes-Yes</td><td>74.74%</td><td>56.30%</td><td>59.88%</td><td>77.78%</td><td>50.00%</td></tr><tr><td>No-No</td><td>3.16%</td><td>0.00%</td><td>0.00%</td><td>0.00%</td><td>12.50%</td></tr><tr><td>Yes-No</td><td>9.47%</td><td>0.00%</td><td>25.31%</td><td>0.00%</td><td>12.50%</td></tr><tr><td>No-Yes</td><td>12.63%</td><td>43.70%</td><td>14.81%</td><td>22.22%</td><td>25.00%</td></tr><tr><td rowspan="4">Contact</td><td>Yes-Yes</td><td>79.76%</td><td>54.17%</td><td>64.20%</td><td>61.11%</td><td>91.67%</td></tr><tr><td>No-No</td><td>0.00%</td><td>0.00%</td><td>0.00%</td><td>0.00%</td><td>0.00%</td></tr><tr><td>Yes-No</td><td>0.00%</td><td>0.00%</td><td>17.28%</td><td>0.00%</td><td>0.00%</td></tr><tr><td>No-Yes</td><td>20.24%</td><td>45.83%</td><td>18.52%</td><td>38.89%</td><td>8.33%</td></tr><tr><td rowspan="4">Financial</td><td>Yes-Yes</td><td>20.00%</td><td>27.16%</td><td>34.26%</td><td>35.19%</td><td>4.17%</td></tr><tr><td>No-No</td><td>31.43%</td><td>35.80%</td><td>20.37%</td><td>0.00%</td><td>0.00%</td></tr><tr><td>Yes-No</td><td>20.00%</td><td>16.05%</td><td>39.81%</td><td>0.00%</td><td>0.00%</td></tr><tr><td>No-Yes</td><td>28.57%</td><td>20.99%</td><td>5.56%</td><td>64.81%</td><td>95.83%</td></tr><tr><td rowspan="4">Health</td><td>Yes-Yes</td><td>42.03%</td><td>0.00%</td><td>0.00%</td><td>*NA</td><td>*NA</td></tr><tr><td>No-No</td><td>14.49%</td><td>80.00%</td><td>77.08%</td><td></td><td></td></tr><tr><td>Yes-No</td><td>28.99%</td><td>20.00%</td><td>8.33%</td><td></td><td></td></tr><tr><td>No-Yes</td><td>14.49%</td><td>0.00%</td><td>14.58%</td><td></td><td></td></tr><tr><td rowspan="4">Location</td><td>Yes-Yes</td><td>96.43%</td><td>63.41%</td><td>52.63%</td><td>73.33%</td><td>58.33%</td></tr><tr><td>No-No</td><td>0.00%</td><td>0.00%</td><td>14.04%</td><td>0.00%</td><td>0.00%</td></tr><tr><td>Yes-No</td><td>0.00%</td><td>0.00%</td><td>17.54%</td><td>20.00%</td><td>0.00%</td></tr><tr><td>No-Yes</td><td>3.57%</td><td>36.59%</td><td>15.79%</td><td>6.67%</td><td>41.67%</td></tr><tr><td rowspan="4">Media</td><td>Yes-Yes</td><td>14.29%</td><td>29.41%</td><td>37.50%</td><td>51.67%</td><td>20.83%</td></tr><tr><td>No-No</td><td>51.79%</td><td>16.47%</td><td>33.33%</td><td>6.67%</td><td>66.67%</td></tr><tr><td>Yes-No</td><td>12.50%</td><td>25.88%</td><td>15.63%</td><td>13.33%</td><td>8.33%</td></tr><tr><td>No-Yes</td><td>21.43%</td><td>28.24%</td><td>13.54%</td><td>28.33%</td><td>4.17%</td></tr><tr><td rowspan="4">Connected Device</td><td>Yes-Yes</td><td>16.22%</td><td>35.71%</td><td>11.90%</td><td>*NA</td><td>*NA</td></tr><tr><td>No-No</td><td>32.43%</td><td>16.67%</td><td>45.24%</td><td></td><td></td></tr><tr><td>Yes-No</td><td>32.43%</td><td>19.05%</td><td>26.19%</td><td></td><td></td></tr><tr><td>No-Yes</td><td>18.92%</td><td>28.57%</td><td>16.67%</td><td></td><td></td></tr><tr><td rowspan="4">Online Social Media</td><td>Yes-Yes</td><td>15.79%</td><td>33.33%</td><td>11.90%</td><td>50.00%</td><td>0.00%</td></tr><tr><td>No-No</td><td>26.32%</td><td>12.82%</td><td>59.52%</td><td>0.00%</td><td>60.00%</td></tr><tr><td>Yes-No</td><td>5.26%</td><td>10.26%</td><td>19.05%</td><td>0.00%</td><td>0.00%</td></tr><tr><td>No-Yes</td><td>52.63%</td><td>43.59%</td><td>9.52%</td><td>50.00%</td><td>40.00%</td></tr><tr><td rowspan="4">IoT Device Usage</td><td>Yes-Yes</td><td>92.59%</td><td>69.05%</td><td>48.33%</td><td>68.75%</td><td>45.83%</td></tr><tr><td>No-No</td><td>0.00%</td><td>0.00%</td><td>11.67%</td><td>0.00%</td><td>0.00%</td></tr><tr><td>Yes-No</td><td>0.00%</td><td>0.00%</td><td>10.00%</td><td>0.00%</td><td>0.00%</td></tr><tr><td>No-Yes</td><td>7.41%</td><td>30.95%</td><td>30.00%</td><td>31.25%</td><td>54.17%</td></tr></tbody></table>

as the most critical one, where users believe that the IoT device does not collect an information, although it is actually collected by that device. For instance, we found a 'No-Yes' mismatch in 95.83% of cases for the devices in "pets" category in terms of collecting financial information. Considering all data types, we found most 'No-Yes' mismatch for the IoT devices in "entertainment" and "pets" category, followed by the devices in "toys & games", "health & exercise" and "smart homes".

As we asked participants about the reasons of information collection by an IoT device, in about half of the cases, they reported that information collection is required for the core functionality of a device. In around one-fourth of cases, participants perceive that information collection is needed for the organizations in IoT business to improve the functionality of their device and offer personalized service to the customers. Some participants believe that the business entities collect user information through their IoT devices for marketing, and advertising their other products to the customers.
<figure><img src="image_3.png" /><figcaption>Fig. 2. Participants’ Perceptions of Data Sharing by IoT Devices</figcaption></figure>

## 3.2 Data Sharing by IoT Devices

Figure 2 illustrates participants’ perceptions of data sharing by the IoT devices. A majority of participants perceive that the IoT devices share users’ personal (67.26%), contact (61.31%), location (60.71%), and device usage (61.31%) information with third-party entities. Participants’ perceptions of data sharing are related to the category of IoT devices. Considering all data types, IoT devices in “entertainment” category are perceived to share most amount of user data, where the participants perceive that the devices in “pets” category share least amount of user information with other entities. We also found that participants’ perceptions of sharing a specific type of information varied across different categories of IoT devices. For instances, the “entertainment”-focused devices are perceived to share user’s personal information in above 80% of cases, which is less than 30% for the devices in “pets” category.

Table 2 presents the matches and mismatches between participants’ perceptions and the privacy policy of IoT devices in terms of information sharing, where a ‘No-Yes’ mismatch is considered to be the most critical one from the perspective of user’s privacy preservation (see §3.1 for further details). Considering all data types<fnref n="3" />, we found most ‘No-Yes’ mismatch for the IoT devices in “pets” category, followed by the devices in “toys & games”, “entertainment”, “smart homes”, and “health & exercise”. Such mismatches also vary across different categories of IoT devices with respect to information type. For example, we found a 54.84% ‘No-Yes’ mismatch for the devices in ‘pets’ category, which is 10% for “health & exercise”-focused devices.

As we asked participants about the reasons of information sharing (with third-party entities) by an IoT device, they mentioned about financial and business gain in about half of the cases. One of our participants said, “I feel like most companies share whatever they can, so that they can make money.” Some par-

<footnote n="3">³ While considering all data types, the calculations of match and mismatch present a lower limit for the devices in “toys & games” and “pets” category, since some information are unavailable in their privacy policy (see ‘NA’ in Table 1 and 2).</footnote>
<figure><img src="image_4.png" /><figcaption>Fig. 3. Participants' Perceptions of Security and Privacy Features of IoT Devices</figcaption></figure>

found a 'Yes-No' mismatch in 56.67% of cases for the devices in "health & exercise" category in terms of encrypting user data during storage. That means, in above half of the cases, participants had misconceptions about the secure storage of their information by the devices in "health & exercise" category. A majority of participants perceive that the devices in "pets" category encrypt their information during storage (see Figure 3), however, the privacy policy of these devices do not mention about their security-preserving steps during storage process. In these cases, we could not compare users' perceptions with the privacy policy of IoT devices.

## 4 Discussion

Our study reveals the mismatches between users' perceptions and the data practices stated in the privacy policy of IoT devices. We identified the misconceptions of participants that could potentially impact their privacy behavior. In many cases, participants believe that their information, including financial and health data are not collected by an IoT device, although those information are collected and shared (with third-party entities) by that device. Also, many participants

<table><caption>Table 3. Match/Mismatch between Participants' Perceptions and Privacy Policy: Security and Privacy Features of IoT Devices [*NA: Information is not available in privacy policy]</caption><thead><tr><th>Security / Privacy Feature</th><th>(Mis)Match</th><th>Health & Exercise</th><th>Entertainment</th><th>Smart Homes</th><th>Toys & Games</th><th>Pets</th></tr></thead><tbody><tr><td rowspan="4">Encrypts Information Communicated</td><td>Yes-Yes</td><td>53.33%</td><td>45.24%</td><td>35.71%</td><td>73.33%</td><td>77.78%</td></tr><tr><td>No-No</td><td>16.67%</td><td>2.38%</td><td>10.71%</td><td>0.00%</td><td>0.00%</td></tr><tr><td>Yes-No</td><td>23.33%</td><td>11.90%</td><td>3.57%</td><td>20.00%</td><td>0.00%</td></tr><tr><td>No-Yes</td><td>6.67%</td><td>40.48%</td><td>50.00%</td><td>6.67%</td><td>22.22%</td></tr><tr><td rowspan="4">Encrypts Stored Information</td><td>Yes-Yes</td><td>20.00%</td><td>47.62%</td><td>33.93%</td><td>60.00%</td><td>*NA</td></tr><tr><td>No-No</td><td>23.33%</td><td>2.38%</td><td>8.93%</td><td>3.33%</td><td></td></tr><tr><td>Yes-No</td><td>56.67%</td><td>11.90%</td><td>5.36%</td><td>16.67%</td><td></td></tr><tr><td>No-Yes</td><td>0.00%</td><td>38.10%</td><td>51.79%</td><td>20.00%</td><td></td></tr><tr><td rowspan="4">Anonymizes Stored Information</td><td>Yes-Yes</td><td>0.00%</td><td>11.90%</td><td>13.11%</td><td>*NA</td><td>*NA</td></tr><tr><td>No-No</td><td>33.33%</td><td>45.24%</td><td>39.34%</td><td></td><td></td></tr><tr><td>Yes-No</td><td>66.67%</td><td>40.48%</td><td>21.31%</td><td></td><td></td></tr><tr><td>No-Yes</td><td>0.00%</td><td>2.38%</td><td>26.23%</td><td></td><td></td></tr><tr><td rowspan="4">Offers 'Do-not-Track' Option</td><td>Yes-Yes</td><td>3.33%</td><td>19.05%</td><td>33.33%</td><td>*NA</td><td>*NA</td></tr><tr><td>No-No</td><td>36.67%</td><td>28.57%</td><td>16.67%</td><td></td><td></td></tr><tr><td>Yes-No</td><td>43.33%</td><td>14.29%</td><td>33.33%</td><td></td><td></td></tr><tr><td>No-Yes</td><td>16.67%</td><td>38.10%</td><td>16.67%</td><td></td><td></td></tr></tbody></table>
believe that IoT devices protect their information through secure communica-
tion and storage, where we identified the mismatches between users' perceptions
and actual practices. Such misconceptions could contribute to users' optimism
bias [1], where they consider the risks of cyber attacks and information breach
as 'distant harms'. As a result, they possess a false sense of security, lack interest
and motivation to learn about secure behavior, and fail to take adequate steps
to protect their information [1, 7].

The privacy notice often fails to help users with making an informed privacy
decision due to its excessive length, complicated language, or poor visualiza-
tion [6]. As recommended in prior studies [11, 6], a privacy notice should preserve
the simplicity, brevity, and clarity in design for being understandable to general
users. Our findings unpack the misconceptions of users about the data practices
of IoT devices. The future research should build upon these results, and conduct
further studies if needed, to design simplified privacy notice by highlighting the
unexpected data practices, so that users could focus on the privacy aspects they
are less informed about. We note that there is no ‘one-size-fits-all’ solution in
this regard, as shown in our study that users’ mismatched privacy perceptions
vary across device category and information type. So, we recommend to consider
each IoT device and information type individually, to identify users’ privacy mis-
conceptions and highlight that in a privacy notice to help them with protecting
their privacy preferences.

As shown in a recent study [2], users' privacy perceptions of IoT technology
could affect their adoption and purchase behavior, where their perceptions are
rarely formed through the understanding of privacy policy. So, the design of a
simplified and usable privacy notice is important not only for general users, but
also for the organizations in IoT business; further emphasized by the findings
from our study. We identified instances where participants perceive that a device
collects and shares their information, although according to its privacy policy,
the device does not collect that information (see 'Yes-No' mismatches in Table
1 and 2). We also found that some devices adopt data protection strategies,
like encrypting user's information during communication and storage, while the
participants do not perceive, those devices encrypt their information (see 'No-
Yes' mismatches in Table 3). In this context, a usable and simplified privacy
notice (see our recommendations in the above paragraph) would provide users
with better understanding of the steps taken by organizations in IoT business
to protect their customers' privacy interests.

We also recommend to extend our findings through further studies, in order
to design usable and effective training materials (e.g., videos, comics, infograph-
ics) to raise the privacy awareness of people, where they should be informed
about privacy misconceptions and unexpected data practices related to current
technologies, including IoT.

5 Limitations and Conclusion

Our sample size is relatively small, where most of our participants were young
and university-educated. Thus, our findings may not be generalizable to the en-
tire population. Our selection of IoT devices may not be not fully representative. As our analysis involves comparing user's perceptions with data practices stated in the privacy policy of IoT devices, the devices with better clarity in privacy policy were considered with higher priority in our selection. In this case, different selection criteria might yield varying lists of IoT devices. Despite these limitations, our study provides valuable insights into the mismatches between user's perceptions and the privacy policy of IoT devices in terms of data collection, sharing, and protection. In our future work, we would extend the findings from this study through a large-scale online survey, and leverage our results towards the design of simplified and usable privacy notice for IoT devices.

## References

1. Davinson, N., Sillence, E.: Using the health belief model to explore users' perceptions of 'being safe and secure' in the world of technology mediated financial transactions. International Journal of Human-Computer Studies 72(2), 154-168 (2014)

2. Emami-Naeini, P., Dixon, H., Agarwal, Y., Cranor, L.F.: Exploring how privacy and security factor into IoT device purchase behavior. In: Proceedings of the 2019 CHI Conference on Human Factors in Computing Systems. p. 534. ACM (2019)

3. Kaplan, D.: Majority of americans have an IoT device - and they're open to advertising (December 15, 2016), https://geomarketing.com/majority-of-americans-have-an-iot-device

4. Lau, J., Zimmerman, B., Schaub, F.: Alexa, are you listening?: Privacy perceptions, concerns and privacy-seeking behaviors with smart speakers. In: Proceedings of the ACM on Human-Computer Interaction. pp. 1-31 (2018)

5. Malkin, N., Deatrick, J., Tong, A., Wijesekera, P., Egelman, S., Wagner, D.: Privacy attitudes of smart speaker users. Proceedings on Privacy Enhancing Technologies 2019(4), 250-271 (2019)

6. Mcdonald, A.M., Reeder, R.W., Kelley, P.G., Cranor, L.F.: A comparative study of online privacy policies and formats. In: International Symposium on Privacy Enhancing Technologies. pp. 37-55. Springer (2009)

7. Naeini, P.E., Bhagavatula, S., Habib, H., Degeling, M., Bauer, L., Cranor, L.F., Sadeh, N.: Privacy expectations and preferences in an IoT world. In: Thirteenth Symposium on Usable Privacy and Security. pp. 399-412 (2017)

8. Page, X., Bahirat, P., Safi, M.I., Knijnenburg, B.P., Wisniewski, P.: The internet of what? understanding differences in perceptions and adoption for the internet of things. Proc. ACM Interact. Mob. Wearable Ubiquitous Technol. 2(4) (2018)

9. Patel, K.K., Patel, S.M., et al.: Internet of things-IoT: definition, characteristics, architecture, enabling technologies, application & future challenges. International journal of engineering science and computing 6(5) (2016)

10. Rao, A., Schaub, F., Sadeh, N., Acquisti, A., Kang, R.: Expecting the unexpected: Understanding mismatched privacy expectations online. In: Twelfth Symposium on Usable Privacy and Security. pp. 77-96 (2016)

11. Schaub, F., Balebako, R., Durity, A.L., Cranor, L.F.: A design space for effective privacy notices. In: Eleventh Symposium On Usable Privacy and Security. pp. 1-17 (2015)

12. Zeng, E., Mare, S., Roesner, F.: End user security and privacy concerns with smart homes. In: Thirteenth Symposium on Usable Privacy and Security. pp. 65-80 (2017)
Appendix

<table><caption>**Table 4.** List of IoT Devices Selected for the Study</caption><thead><tr><td>Device Category</td><td>IoT Devices</td></tr></thead><tbody><tr><td>Health &amp; Exercise</td><td>Hidrate Spark 2.0 Water Bottle<br>Peloton Bike<br>Fitbit Charge 3 Fitness Tracker<br>Athena Safety Wearable<br>Samsung Gear Sport</td></tr><tr><td>Entertainment</td><td>Bose QuietComfort 35 II<br>Google Pixel Buds<br>PS4<br>Roku Streaming Players<br>Apple TV</td></tr><tr><td>Smart Homes</td><td>Sonos One<br>Mycroft Mark 1<br>Nest Learning Thermostat<br>Amazon Echo Dot<br>Amazon Cloud Cam<br>Behmor Brewer Coffee Maker<br>Philips Hue Smart Light Kit<br>SmartThings Outlet</td></tr><tr><td>Toys and Games</td><td>EVO Robot<br>Sphero Mini<br>DJI Spark Selfie Drone<br>CogniToys Dino<br>Dot Creativity Kit<br>Amazon Fire HD Kids Edition</td></tr><tr><td>Pets</td><td>Tractive 3GS Pet Tracker<br>Tile Mate<br>PetNet Smart Feeder<br>Petzi Treat Cam</td></tr></tbody></table>