# "I'm Not for Sale" -Perceptions and Limited Awareness of Privacy Risks by Digital Natives About Location Data

Antoine Boutet, Victor Morel

► To cite this version:

Antoine Boutet, Victor Morel. "I'm Not for Sale" -Perceptions and Limited Awareness of Privacy Risks by Digital Natives About Location Data. ICWSM 2025 - International AAAI Conference on Web and Social Media, Jun 2025, Copenhagen, Denmark. pp.1-13. hal-05041457

HAL Id: hal-05041457

https://hal.science/hal-05041457v1

Submitted on 21 Apr 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# "I'm Not for Sale" – Perceptions and Limited Awareness of Privacy Risks by Digital Natives About Location Data

Antoine Boutet

Univ Lyon, INSA Lyon, Inria, CITI

antoine.boutet@insa-lyon.fr

## 1 Introduction

Smartphones have become the most popular electronic devices, used by 95% of all internet users<fnref n="1" />. The widespread adoption of these mobile devices with geolocation capabilities makes users' location traces<fnref n="2" /> widely accessible to mobile services. Location is the most collected personal data by mobile applications [1], and while the exploitation of this data presents an obvious benefit to users in their daily lives – through personalized services, and potentially to the society with crowdsourcing initiatives [41] –, an uncontrolled exploitation of this data continue to raise privacy concerns.

This location data can indeed reveal a lot of sensitive information about users and represents unique privacy risks and implications compared to other types of data shared via smartphones. For example, it has been shown that it is possible to infer personality traits, religious affiliation, sexual orientation, or health status [21]. Additionally, the uniqueness of location data provides a sort of fingerprint specific to each individual that can be used to re-identify users in anonymized data, i.e., little a priori knowledge about a user can be exploited to discriminate them in a large set of anonymous location data. For instance, journalists were able to re-identify and track the whereabouts of the former US president Trump from a large dataset [42], and anonymous data was used to pinpoint Muslim cab drivers [28]. The attack surface of the exploitation of personal data is not fully discovered. Regularly, new threats appear and are maliciously exploited for influential campaigns and interfering in political election<fnref n="3" />, or discovering sensitive information<fnref n="4" />.

With this increasing exposure of privacy risks, understanding how young users share their data, and the extent to which they are aware of security and privacy risks, are important properties to assess these risks and to develop effective Privacy and Transparency Enhancing Technologies matching current users' expectations to increase adoption. Although user perceptions of technology [9] and the privacy paradox<fnref n="5" /> [7, 23]

Victor Morel

Chalmers University of Technology and University of

Gothenburg

morelv@chalmers.se

have received a lot of attention, users' self-reported behaviors in mobility contexts associated with smartphones, and the impact of an awareness demonstration platform have been less studied in the academic literature. To fill this gap, this work addresses two research questions:

* RQ1: What are the perceptions and the understanding of young users' privacy and its protection in a mobility context?

* RQ2: What is the impact of a demonstrator for the visualization of location traces and associated privacy risks on these perceptions and understanding?

In order to answer our research questions, we designed and deployed survey questionnaires answered by *n* = 99 young participants (i.e., digital natives, persons who grew up in the information age, aged between 20 and 26 with an average of 21 in our case). Specifically, we explored the participants' behavior, self-reported behavior, and awareness regarding their own data-sharing practices. We devised a first questionnaire to study their perception of privacy and to their permission management with respect to location, in which we emphasized the eventual discrepancies between their remembered practices and their actual behaviors. We also surveyed participants' understanding of privacy risks before and after exposing them to location traces demonstrating what information can be inferred from this data, as well as their awareness of protection tools, in conjunction with a second questionnaire.

Our results show that participants have **risky practices in terms of privacy** where more than half of participants underestimate the number of mobile applications to which they have granted access to their data. In addition, most of the participants tend to forget about disabling location access permission for apps that are not actively used. Our results also show that participants are **poorly aware of the privacy risks** and are unable to list cases of personal data leaks or scandals linked to their uses despite the media coverage. Moreover, by using a demonstrator to perform inferences from location data, more than half of the participants (57%) are surprised by the extent of potentially inferred information and 47% intend to reduce access to their data via permissions. Finally, most of the participants are inclined to **better use protection tools in the future**, even if they are still little aware of the available tools to improve privacy today. Since our study focused mainly on digital natives, the transferability of the results to the rest of the population remains an open question.

<footnote n="1">¹https://datareportal.com/global-digital-overview</footnote>

<footnote n="2">²That is, location data collected by Google from smartphones which gives more accurate and reliable information than other kinds of location data collection</footnote>

<footnote n="3">³https://en.wikipedia.org/wiki/Troll_farm</footnote>

<footnote n="4">⁴https://www.nytimes.com/2018/01/29/world/middleeast/strava-heat-map.html</footnote>

<footnote n="5">⁵The privacy paradox refers to self-reported concerns about privacy appear to be in contradiction with often careless online behaviors.</footnote>
However, the academic knowledge in computer science of our participants certainly gives them a better perception of the risk to privacy than among other age groups. Our contributions are the following:

1. We provide the first insights on privacy perceptions in a mobility context associated with smartphones and mobile applications;

2. We study the impact of a demonstration platform of privacy risks visualization on privacy perceptions;

3. We formulate a set of recommendations to improve the management of privacy permissions on mobile.

The paper is organized as follows. Section 2 reviews the related work. Section 3 describes the considered methodology while the results are presented in Section 4. We discuss recommendations and highlight our limitations in Section 5, and conclude in Section 6.

# 2 Related Work

Prior research widely explored location privacy (Section 2.1) and users’ perceptions of privacy (Section 2.2). However, little attention has been devoted to self-reported behaviors towards location data sharing. Moreover, to the best of our knowledge, no studies have used a demonstration platform to improve risk understanding in a way that would change users’ perceptions about the balance between the benefits of invasive technologies and potential risks.

## 2.1 Privacy and location

The privacy issues raised by location data gained a lot of traction in the last decade [35]. In particular, user location traces extracted from various data have been shown to be highly unique [14, 46]. This high uniqueness may act as a digital fingerprint and lead to the re-identification of users if their traces are associated with external knowledge. This uniqueness does not only concern location traces but characterizes all traces generated by a human [3, 17, 36], and can generate a risk of re-identification. Several cases of re-identification have been documented, for instance the re-identification of individuals from web search queries [6], taxi logs [47], or the notorious case of Governor William Weld using medical information [8].

The uniqueness and risk of re-identification is not the unique threat related to location traces. Recent works have demonstrated that location is a very rich contextual information and leads to a strong inferential potential in terms of information that can be learned about individuals [?]. For instance, location traces can reveal Points Of Interest (POI) of users such as their home and workplaces [21], their race and gender [48], their social network [40], it can be used to predict their location patterns [39], to link accounts of the same user

across different datasets [37], and infer even more sensitive information such as their religion or personality traits<fnref n="6" />.

Due to the large adoption of mobile devices, the location data of users is extensively collected and shared [2, 18]. The uncontrolled usage of this information can have an important impact on users such as unfair price discrimination [31]. The increasing use of connected devices collecting personal data and the lack of transparency on how the data is actually exploited raise privacy concerns. Only a handful of tools have been proposed to improve user awareness about the potential risk of revealing their location. For instance, [38] propose a tool to inspect the potential of location data, while [?] show the impact of protection mechanisms of the inference capabilities using a demonstration platform.

## 2.2 Perceptions of privacy and privacy controls

Giving users the benefits of location services on their mobile devices while preserving their privacy is an ongoing challenge, as evidenced by mobile OSs iterating on the user interfaces for location notices and control every few years. For example, iOS allows users to select whether apps get fine- or coarse-grained location data⁷, and will present pop-ups when apps continually access location services in the background. Similarly, Android apps now have to request background location access separately from general location usage⁸, and the OS will automatically revoke unused permissions from apps⁹. Even though mobile operating systems regularly improve user interfaces, the opaque privacy controls of location services still face criticism¹⁰. [5] explore the users’ perceptions regarding access to Google accounts by mobile applications and formulate design recommendations to improve the current third-party management tools offered by Google, such as tracking recent access, automatically revoking access due to app disuse, and providing permission controls. [45] analyze authorization preferences in different usage contexts and suggest determining the situations in which users would like to be confronted with security decisions.

Users’ perceptions of the risks and benefits of technologies can determine their willingness to adopt them [34]. More specifically, people are more likely to accept potentially invasive technology if they think its benefits will outweigh its potential risks [9]. Due to the massive adoption of location-enabled mobile applications, this fact suggests that users’ perception of this trade-off is more in favor of the benefits than the potential risks. This attitude however depends on

<footnote n="6">⁶Note that the processing of such sensitive information is prohibited by Article 9(1) of the General Data Protection Regulation (GDPR) on the processing of special categories of personal data.
⁷https://support.apple.com/guide/iphone/control-the-location-information-you-share-iph3dd5f9be/ios
⁸https://developer.android.com/about/versions/11/privacy/location
⁹https://developer.android.com/about/versions/11/privacy/permissions
¹⁰https://www.attorneygeneral.gov/taking-action/attorney-general-josh-shapiro-announces-391-million-settlement-with-google-over-location-tracking-practices/</footnote>
the perception of the said privacy risks. Studies have shown that users of mobile phones are often unaware of the data collected by apps running on their devices, and that a majority of users restrict some of their permissions [2] following a better awareness of data collection. Other studies explored the privacy paradox [7, 23] where self-reported concerns about privacy appear to be in contradiction with often careless online behaviors. However, another study focuses on university community [20] and show that this population of users does not have a genuine concern regarding the privacy of their geolocation data. Note that this paper did not study location data in mobility contexts associated with smartphones as we do.

Analyzing behavior and understanding users' perceptions are also important notions to grasp in order to further design Privacy and Transparency Enhancing Technologies (PETs and TETs). For instance, [26] conducted an online survey to understand people's perspectives on solely automated decision-making. They then formulate recommendations on how to design such systems. In a similar line of work, [22] conducted in-depth semi-structured interviews with 17 Swedish drivers to analyse their privacy perceptions and preferences for intelligent transportation systems, then to provide recommendations for suitable predefined privacy options. Several other works [32, 43, 49] studied the perceptions of privacy and utility of users related to fitness-trackers and demonstrated a high potential for data minimization (i.e., reducing the volume of data sent to service provider). [15], in turn, investigated Facebook users' awareness of privacy issues and perceived benefits and risks of utilizing Facebook and recommended better privacy protection, higher transparency and more education about the risks of posting personal information to reduce risky behavior. [10] analysed the behaviors of websites' visitors through a study of the impact of dark patterns on consent decisions. [44] explored whether current data downloads (such as Google Takeout) actually achieve the transparency goals embodied by the right of access. Most participants indicated that current offerings need improvement to be useful, emphasizing the need for better filtration, visualization, and summarizing to help them hone in on key information. However, none of these related work specifically targets users' behavior and perception about data-sharing of location data. Although [30] clearly addressed users' perceptions of location data, it is to be noted that it does so from an information science standpoint, closer to sociology and not from a UX/usability one. It nonetheless offers a relevant account for the interested reader.

Related to location data, [19] specifically analysed the user perceptions and reactions to Google's My Activity and how this web history dashboard increases or decreases end-users' concerns and benefits regarding data collection. Their results show that participants were surprised by the volume and detail of the collected data, but most of them were significantly more likely to be both 1) less concerned about data collection

and 2) to view data collection more beneficially. However, this dashboard does not present any risks such as possible sensitive inferences associated with location traces or places visited. By also presenting the risks, our study shows that users are more concerned about privacy issues.

## 3 Methodology

We conducted two questionnaires on $n = 99$ young participants aged between 20 and 26 (with an average around 21) to collect quantitative and qualitative data about the participants' perception and self-reported behavior regarding the sharing of location data.

In a nutshell, the first questionnaire (hereinafter “behavior questionnaire”) aimed at assessing their self-reported practices, perceptions, and pre-conceived ideas about privacy. Following this first questionnaire, participants were then invited to use a demonstrator (denoted “demonstration” in what follows) which analyses location traces and reports several inferences as well as the impact of a protection mechanism using differential privacy (i.e., geo-indistinguishability [4]). The second questionnaire (hereinafter “perception questionnaire”) addressed their assessment of the risks.

### 3.1 Recruitment

We recruited young participants for our survey via a course offered to engineering students at [anonymized]. This process of recruitment ensured a high number of participants,<fnref n="11" /> all of them using their smartphones. The participants were not compensated. The participants had followed computer science courses including data science, AI, and introduction to the GDPR. By mainly recruiting young computer engineers with knowledge of technologies, we performed our study on a homogeneous population which consumes digital information quickly, and which are supposedly aware of privacy risks, hence providing an “upper bound” of privacy perceptions in our context.

The study was performed over a four hours slot, during which students were successively invited to answer the behavior questionnaire, analyse privacy risks through the demonstration, and answer the perception questionnaire. Although the teacher of the course is one of the authors of the current paper, participants were presented with a consent form at the beginning of the survey, and they were able to decline without penalty (specified orally); only the experimentation of the demonstration platform was mandatory as part of their curriculum. The participation was anonymous, voluntary, and the course did not include any grade (one participant actually refused to answer the questionnaire, without penalty).

### 3.2 Ethical considerations

The survey raises ethical issues in two main aspects.

<footnote n="11">¹¹(We address the limitations of our recruitment in Section 5.2).</footnote>
First, the demonstration platform uses personal data, specifically location traces. This data is not necessarily sensitive in itself, but can act as a proxy for sensitive data. To reduce risks, participants used traces from data of the authors of this study. The data used during the demonstration phase was encrypted server-side and was deleted once all data had been processed (calculating Points of Interests, collecting metadata, and calculating inferences). The DPO of the authors' institution has validated the demonstration platform.

Second, we elicited answers from participants, which is also personal data. We took as many precautions as needed to guarantee 1) informed consent (see Section A.1 for the consent form, and as noted in Section 3.1 they had the possibility to decline without any penalty), and 2) security of data storage and processing (authors only communicated using end-to-end encrypted tools, and the survey was conducted on an EU-based online tool stamped GDPR-compliant). One participant refused to answer the questionnaires.

Both the demonstration platform (regarding its compliance with the GDPR and other data security regulations) and the questionnaires were approved by the IRB of the academic institution both hosting the survey and where the students were based.

### 3.3 Design of the Questionnaires

We shortly describe in this section the organization of the two questionnaires. The interested reader will find their full content in Appendix A. Each section is succinctly described in what follows:

* **Introduction:** This section presents the study and asks the participants for their consent to participate in the study and to collect their answers for research purposes.

* **Data-Sharing:** This section inquires about the participants' attitudes about data sharing (e.g., which apps they think could access their location data, with whom, etc).

* **Inferences:** This section questions their pre-conceived ideas about inferences from location data (e.g., *from* which data could their location be inferred, or whether the location is sufficient to single them out in a dataset).

* **Authorisation and Control:** This section touches upon authorisation and control of permissions in a mobile context. Questions in this section are about their revoking or giving access permissions to apps, or their evaluation of the difficulty to effectuate this permission management.

* **Privacy Concerns:** This section simply performs the analysis of an Internet User's Information Privacy Concerns (IUIPC) on a 7 Likert scale.

* **Demographics:** This section elicits demographics data.

The perception questionnaire is much shorter and is composed of questions regarding the possible (malicious) inferences conducted on their location traces, the protection

<figure><img src="image_2.png" /><figcaption>**Figure 1.** Screenshot of the demonstration's interface. Clicking on a POI yields attendance statistics.</figcaption></figure>

<figure><img src="image_3.png" /><figcaption>**Figure 2.** Illustration of the defense mechanism. Here the red lines show the initial traces, and the black lines represent the traces after the application of the noise.</figcaption></figure>

against these privacy violations, and their new expectations and suggestions following the experimentation with the demonstration platform.

### 3.4 Risks analysis - demonstration

After the first behavior questionnaire, participants had to explore a demonstration platform informing them about privacy risks linked to location traces through example data. We use the [11] demonstration platform. Participants were asked to use the platform to explore these location traces and to inspect the information that can be inferred. The demonstration typically offers to visualize one's traces per day (see Figure 1), which can raise awareness about how easy it is to identify Points of Interests (POIs) – such as the home, the workplace or any other visited places during the day –, and presents metadata (e.g., address, category of the place, attendance statistics).

The demonstration also offers a defense mechanism based on Differential Privacy [16] in the form of a slider, which controls the level of noise injected into the location data (see Figure 2). This feature is presented as a means to stimulate interest in privacy protection, and to raise awareness of the degradation of data quality when we increase protection with greater noise (to showcase the utility and privacy trade-off).
Finally, the demonstration highlights the risks raised by analyzing location traces and inferring gender, big five personality traits, home, and workplace (see Figure 3). Given the large number of inferences of sensitive information from location data reported in the literature (e.g., people encountered, religious affiliation, sexual orientation, or health status [21]), only the presentation of these inferences fits fairly well into a representative risk of targeting (i.e., based on predictions computed on data collected and potentially exchanged between different parties).

<figure><img src="image_4.png" /><figcaption>**Figure 3.** Inference performed by the platform. The left-hand side shows inference from raw data while the right-hand side presents the reduced risks after the application of the defense mechanism (i.e., geo-indistinguishability [4]). The noisy version hardly yields the gender, smooths the personality traits, makes the daily and weekly attendance statistics unusable, and infers inaccurate POIs.</figcaption></figure>

## 3.5 Data analysis

We performed a thematic analysis on the free text answered in the study (see Tables 1 and 2 in Appendix B) to analyse qualitative data. We took inspiration from the steps described in [12]:

1. read the answers;

2. code the sentences from the previous step;

3. merge the codes in normalised codes for data analysis;

4. regroup the normalised codes from the previous step in themes;

5. review the themes and the related sentences to verify the homogeneity between them.

The analysis was performed by two independent annotators, and a consensus was reached at the end of the process. For most fields, a full thematic analysis was neither required nor necessarily desirable; curation and normalisation of the data was however necessary. Indeed, stopping at the third step was enough for several fields, such as the reasons given to revoke location permission. A full thematic analysis was performed on the answers to Q32 “How do you think location data could be misused by a malicious person?”, the themes of which were loosely derived from [13] (Physical harms, Economic harms, Reputational harms, Informational integrity, Psychological harms), see Table 1 in Appendix B.

We regrouped our codes for Q36 “What are the measures imposed by the GDPR that reduce these risks?” under general legal categories (Rights, Consent, Clear purpose and transparency, Misc.) for statistical purposes, see Table 2 in Appendix B. The rationale behind Q36 was to evaluate participants’ knowledge about the GDPR.

## 3.6 General Statistics

Our participants are mostly equipped with Android phones: 60% against 40% for iOS users (Q2). Our population is not gender balanced, our sample was composed of 25% of women, 72% of men, and 3% prefer not to answer (Q26). Participants are young with an average age around 21 with a small standard deviation ($\sigma = 1.04$) (Q27).

Their privacy concerns have been assessed using the Inter-Net Users' Information Privacy Concerns (IUIPC) Score. The IUIPC is a scale widely used in privacy research, it reflects Internet users' concerns about information privacy with a focus on “individuals' perceptions of fairness/justice in the context of information privacy”. The distribution of IUIPC is depicted in Figure 4.

Note that our population is within average with respect to their privacy concerns ($\mu = 4.2, \sigma = 1.05$)<fnref n="12" /> in spite of young adults being generally less concerned about their privacy than older populations (as mentioned in Section 2).

# 4 Results

This section showcases the most relevant results for our research questions, with the first two subsections dedicated to answering RQ1 (“What are the perceptions and the understanding of young users’ privacy and its protection in a mobility context?”), and the last subsection more tailored to

<footnote n="12">¹²See [49], for an example of less concerned participants ($\mu = 3.5, \sigma = 1.6$) and [33] for more concerned participants with $\mu$ between 4.79 and 5.44 normalized to a [0-6] scale.</footnote>
<figure><img src="image_5.png" /><figcaption>**Figure 4.** Plot of the Internet User's Information Privacy Concerns (IUIPC) distribution of participants.</figcaption></figure>

RQ2 ("What is the impact of visualization of location traces and associated privacy risks on these concepts?").

## 4.1 Privacy risky practices

Participants do not adopt safe practices in terms of privacy. Specifically, they tend to underestimate the number of apps that have access to the location, and they tend not to think about disabling location access for apps that are not actively or forget to do so.

**Underestimation of the number of apps that have access to location.** Participants were asked to estimate how many mobile apps have access to the location on their smartphone "on top of their head" (Q3), and this data was then compared to the actual number (both for "always" and for "when using the app") (Q8). Unsurprisingly, the majority of participants (52) underestimated the number of apps with location access, 7 overestimated it, but 38 were correct (with 17 on the open range, i.e., they selected the maximum value), as presented in Figure 5. We interpret this result as a wrongful mental model due to 1) the lack of transparency of apps regarding their data collection, 2) an ever-increasing number of applications, combined with 3) a lack of a central controlling system for privacy permissions.

<figure><img src="image_6.png" /><figcaption>**Figure 5.** Participants tend to underestimate the number of apps that have access to the location (Q3 against Q8).</figcaption></figure>

While the average number of apps with continuous access to the location was pretty low but with a high standard deviation (μ = 2.74, σ = 6.32) – meaning that most participants do not allow continuous access to their location except for a few outliers with a high number of apps –, we note that a much higher number of apps had access to location when on use (μ = 11.04, σ = 8.93)(Q8).

Amongst the applications with access to location (Q9), Google Maps is leading the list "on top of their heads" (38 mentions), but has more access in practice (15 for "always" and 27 "when using the app"); it is followed by Instagram (respectively 27, 4, 31) and Snapchat (26, 4, 22).

**Participants tend to forget about data-sharing.** The results show that most participants had installed numerous applications with access to location (Q8). In addition, we see that 74.2% (46 actively use most, 26 only some of them) have at least one application not actively used but with current access to location data (Q10)<fnref n="13" />. When asked why these unused applications still have access to their location (Q11), a majority of the participants have either forgotten (11) or not thought (12) about removing access (see Figure 6). Another proportion of participants are either lazy (6) or unaware (7) that these applications collect location data. Finally, the rest of the participants (15) prefer to leave the permission to the app in case they need to use it.

Basically, participants have difficulties remembering their apps' privacy practices by themselves, which make the latest features of iOS ("Offload Unused Apps") and Android ("Unused Apps") all the more relevant.

<figure><img src="image_7.png" /><figcaption>**Figure 6.** Participants tend not to think about disabling location access for apps that are not actively used or forget to do so (Q11).</figcaption></figure>

**Authorisation and Control.** We asked participants questions regarding the control of location access to mobile applications (Q23). Only 4% think it is not possible to revoke (cancel) previously granted mobile app access (Q18) and 16% of the participants never modified the privacy settings related to their location data (Q19). A greater proportion of participants reduced the availability of their location data than those who increased their availability (75% versus 8%). For those who

<footnote n="13">¹³We orally clarified to participants that "actively used" amounts to a weekly use or more frequent.</footnote>
said they had already revoked access, the reasons given by 68% of participants felt that this access was not necessary for the application ("I'm not for sale"); or did not understand why this access was necessary (Q21).

## 4.2 Participants are poorly aware of the risks

They do not know how location can be captured, they are not aware of the great inference capacity associated with the analysis of location data, and they are unable to cite cases of personal data leaks or scandals related to their use despite increased media coverage.

**Participants have misconceptions about how location can be captured.** To assess the perception of privacy risks linked to the sharing of location information, we asked the participants how a mobile application could capture location (Q12). The responses are displayed in Figure 7 and show that not all participants are aware of the localization capabilities of the main technologies embedded in a phone. Although GPS is identified by almost all participants (96%), we see that only 85%, 64% and 78% of participants are aware that respectively WiFi, Bluetooth, and IP addresses can be used as proxies to infer location.

<figure><img src="image_8.png" /><figcaption>**Figure 7.** Proportion of participants aware of source of data from which location can be inferred (Q12).</figcaption></figure>

### Unaware of the inference capacity from location data.

In the behavior questionnaire before the demonstration, we then asked participants to identify what information could be inferred from location amongst a list of information generally categorised as sensitive (Q13)<fnref n="14" />. The results are represented in Figure 8 and show that the risks of inference are moderately known. Although all participants perceived that the place of work can be inferred from location traces, only 94% think that the place of residence can also be inferred. These inferences are based on the time spent in a location over office hours and overnight stays. This change in perception raises questions about the rationality or basis for the response because we spend more time in the home than in the workplace. Finally, we observe that 10% of participants do not believe that this information can lead to re-identification (Q15), which is a

surprisingly high number considering that all participants had previously followed courses on data science and AI. On the other hand, when asked why a service provider might be interested in the location of individuals (Q14), 88% responded that this information is for marketing purposes. So they still have the perception that this information could be used for targeting or profiling.

<figure><img src="image_9.png" /><figcaption>**Figure 8.** Answers to Q13 "Do you think it is possible to infer the following information from the location?".</figcaption></figure>

**Little echo about data leaks or privacy scandals.** The majority of participants are unable to list cases of personal data leaks or scandals linked to their uses despite press articles regularly published on the subject (Q33). In view of the numerous scandals and cases linked to personal data reported very regularly by the press (e.g., ransomware and data leaks in hospitals, attempted influence on social networks), this lack of awareness of the risks raises questions about their exposure to the media. Only 32 knew about a scandal, half of these cases were Cambridge Analytica (16 mentions), while major scandals such as Pegasus or the Snowden leaks were barely mentioned (3 mentions each). The medium-high reported IUIPC of the participants (see Section 3.6) does not seem to come from exposure to cases concerning privacy violations reported by the press.

## 4.3 The risk demonstrator increased awareness of participants about privacy

After having experimented with the demonstration, a third of the participants (33) were planning on limiting the access to mobile privacy permissions, and deleting the history of mobility on the Google Takeout platform (Q37). We contend that the visualisation of location traces and the risks associated with the inference increased awareness of participants towards privacy, and encouraged them to adopt more privacy-preserving behaviors.

**Relative surprise for the number of possible inferences.**

Once the participants have been able to analyze location traces and discover the information that can be learned with the demonstrator, more than half of the participants (56%) declared being surprised by the number of inferences made possible through location data (Q29). Additionally, when asked

<footnote n="14">¹⁴Most of these categories are listed as special categories of data by Article 9(1) of the GDPR, see Section 2.1.</footnote>
whether they feel well protected against the various threats observed, a large majority of participants responded that they felt unprotected (84%) (Q35). Knowing this inference ability, participants were asked if they think Google analyzes users' location data (Q30), and if they think Google shares this data with third parties (Q31). The results show that 93% of participants believed that Google analyzes their location data and 89% believed that their data is shared with third parties. Even after the inspection of location traces with the platform, 7% of participants still did not think that location data can be used to re-identify users (Q34).

**Worries about surveillance, economic, and physical harms.**

The most worrisome inferences are informational harms (surveillance, stalking<fnref n="15" />, inference, data selling, targeted advertising; 88 mentions), followed by economic harms (blackmail, robbery, scam, identity theft; 51 mentions), and finally physical harms (physical harm, harassment; 31 mentions) (Q32).

<figure><img src="image_10.png" /><figcaption>**Figure 9.** The most worrisome inferences are informational harms (i.e., surveillance, stalking, inference, data selling, targeted advertising) (Q32).</figcaption></figure>

We observed interesting preconceived ideas regarding those harms. First, in spite of being in the most cited category, targeted advertising was specifically mentioned only three times, whereas it is the main privacy-invasive goal of location data analysis by Google (from which the traces were extracted). Second, robbery was over-represented in the answers (28 mentions, 2nd most cited code) although it does not happen so often in practice<fnref n="16" />.

**Positive attitude towards protective mechanisms.** Despite the lack of awareness about the risks, participants are inclined to use protection tools. When asked whether technologies could reduce and provide greater control over personal information disclosed via location data, 76.3% of participants responded that they would be willing to use Privacy Enhancing Technologies (PETs) (Q16). Consistently, 51.5% declared to plan using PETs after having experimented with the demonstration platform (Q38). However, a lower score on question

Q38 than on question Q16 means that participants do not have a concrete idea of existing privacy-enhancing tools. On the other hand, 84% of participants said they have never looked to see if this type of technology or tools existed (Q39).

# 5 Discussion

This section formulates practical recommendations and highlights the limitations of our work.

## 5.1 Recommendations

We craft in this section recommendations for the design of better privacy-friendly systems, and of Transparency Enhancing Technologies (TETs) to foster privacy awareness. These recommendations are drawn from both participants’ insights and our own interpretations.

**Assist in the revocation of apps.** Our results show that participants tend to forget about data-sharing, where more than a quarter of the participants declared not thinking about revoking access (12), forgot to do it (11), or are simply too lazy (6), and that they have inaccurate representations of the number of apps with access to their location (see Section 4.1). However, we note that 14 participants suggested including a system-wide reminder of which apps can access location as recommendations for better and more usable Privacy Enhancing Technologies (PETs). Note that the latest version of Android and iOS indicate when an app accesses location, and Android now offers a centralized interface indicating which apps require and use geolocation. This centralized interface can be hard to find amongst the different settings, and no participant were aware of its existence. However, both Android and iOS lack a centralized interface to inform which app is currently accessing location, nor do they provide fine-grain data regarding its use (i.e., how many times did each app request geolocation). We therefore recommend that **mobile OSs integrate a centralised and easily accessible interface about location usage**, providing not only which geolocation permission has been granted to each app but also a fine-grain data regarding its uses.

**More transparency.** Our results also show that knowing which apps have access to location is not enough; 16 participants also proposed more transparency and more specifically to be able to be informed at any time of which applications are collecting data. Seeing the lack of perception of privacy risks and the impact of tools allowing to calculate and visualize these risks on this perception, we suggest improving transparency by **providing users with statistics and metrics of risk** associated with data collection for each application. We believe that this personalized risk analysis would be an important lever to help users to evaluate the trade-off between utility and respect for their privacy and to better calibrate what they wish to share.

**Access privacy permissions from the app.** Another highlight from the participants’ answers is the possibility to access

<footnote n="15">¹⁵Here, *stalking* refers to close surveillance without intervention, we coded surveillance with physical and/or oral intervention under *harassment*.</footnote>

<footnote n="16">¹⁶A possible explanation can be that of the black swan theory, or the presence of websites raising awareness of this specific risk such as https://pleaserobme.com/</footnote>
privacy permissions directly from within the app. Indeed, to-
day’s privacy permissions (on both iOS and Android) are
mainly available through the general settings of the smart-
phone, which can be hard to access for lay users<fnref n="17" />. We there-
fore recommend mobile OSs to **include a shortcut to an
app’s privacy permissions from the app itself**, for instance
from the status bar or by executing a special gesture. This
suggested feature is currently unavailable on modern mobile
operating systems and has not been suggested anywhere else
to the best of our knowledge.

**5.2 Limitations**

First, our demographics do not represent a fair sample of
digital users. Our participants were mostly males, all of them
young adults educated in a top European engineering school,
although with different backgrounds and technical skills. This
bias in our representativeness played a part in the socio-
economic backgrounds of participants, who are most likely
to come from well-off social environments. Recruiting partic-
ipants in universities often faces this limitation in academic
studies on usages. For instance, [27] involved 40 participants
mostly young and well-educated, while [25] involved 80 par-
ticipants, mostly young, with 45% in the 18–25 age group and
20% between the ages of 26 and 35, a majority (n = 54) were
bachelor students or had their bachelor degrees. [2] involved
23 participants (65% female; ages 18–44, median=23), and
[26] involved 392 participants ranging from 25 to 35.

The transferability of the result to the rest of the popula-
tion therefore remains an open question. However, given that
our sample is predominantly composed of “digital natives” –
who are often assumed to be more comfortable with personal
information sharing and more knowledgeable about digital
technologies –, we expected a better perception about the
privacy risk than amongst other age groups. This expectation
also has to be put in the perspective of their curriculum: stu-
dents in computer engineering with academic knowledge of
data science, AI, and rudiments of GDPR.

Second, the scope of our work must be restricted to a
specific type of demonstrator, our results should not be gener-
alized to all visualization and awareness tools. Moreover, the
results largely presented self-reported and planned behaviors.
Therefore, an interesting research avenue for future work is
to study the *actual behavioral* changes introduced by the ex-
periment of the tool, and long-term behavior analysis through
*longitudinal studies*. Perceptions can also change according
to the type of apps and their access to location data, as well
as other sensitive personal data collected.

Third, participants used example data on the demonstration
platform, which is perhaps less illustrative than if they had
inspected their own location data. We envision working with
personalized examples in the future. Our results also lack

perspective on whether our participants were able to deeply
understand the goal and the meaning of obfuscated traces and
the epsilon number (see [24]).

6 Conclusion

Through a survey involving *n* = 99 young mobile phone users, this work contributes to a better understanding of the practices in relation to the sharing of their location data with mobile applications as well as the associated privacy issues. By qualitatively and quantitatively analyzing user perceptions and self-reported sharing behaviors, we provide valuable insights for researchers and privacy practitioners to better understand users and better design new Privacy Enhancing Technologies (PETs) and Transparency Enhancing Technologies (TETs) related to location data. We also showed the importance of displaying a more interactive risk analysis to make users better aware of privacy risks.

Acknowledgements

This work has been supported by the ANR 22-PECY-0002
IPOP (Interdisciplinary Project on Privacy) project of the Cy-
bersecurity PEPR, and partially supported by the Wallenberg
AI, Autonomous Systems and Software Program (WASP)
funded by the Knut and Alice Wallenberg Foundation. We
would like to thank Farzaneh Karegar and Nataliia Bielova
for their feedback on earlier drafts, and anonymous reviewers
who helped us improve this article.

**References**

[1] Jagdish Prasad Achara, Claude Castelluccia, James-Douglass Lefruit, Vincent Roca, Franck Baudot, and Geoffrey Delcroix. Mobilitics: Analyzing Privacy Leaks in Smartphones. *ERCIM News*, April 2013.

[2] Hazim Almuhimedi, Florian Schaub, Norman Sadeh, Idris Adjerid, Alessandro Acquisti, Joshua Gluck, Lorrie Faith Cranor, and Yuvraj Agarwal. Your location has been shared 5,398 times! a field study on mobile app privacy nudging. In *CHI*, pages 787–796, 2015.

[3] Kurtz Andreas, Gascon Hugo, Becker Tobias, Rieck Konrad, and Freil-
ing Felix. Fingerprinting mobile devices using personalized configura-
tions. *PoPETs*, 2016(1):4–19, 2016.

[4] Miguel E. Andrés, Nicolás E. Bordenabe, Konstantinos Chatzikokolakis, and Catuscia Palamidessi. Geo-indistinguishability. In *CCS*, 2013.

[5] David G. Balash, Xiaoyuan Wu, Miles Grant, Irwin Reyes, and Adam J. Aviv. Security and privacy perceptions of Third-Party application access for google accounts. In *USENIX Security*, pages 3397–3414, August 2022.

[6] Michael Barbaro and Tom Zeller. A face is exposed for aol searcher no. 4417749. *New York Times*, 01 2006.

[7] Susanne Barth, Menno D.T. de Jong, Marianne Junger, Pieter H. Hartel, and Janina C. Roppelt. Putting the privacy paradox to the test: Online privacy and security behaviors among users with technical knowledge, privacy awareness, and financial resources. *Telematics and Informatics*, 41:55–69, 2019.

[8] Daniel Barth-Jones. The 're-identification' of governor william weld's medical information: A critical re-examination of health data identification risks and privacy protections, then and now. *SSRN Electronic Journal*, 06 2012.

<footnote n="17">¹⁷Note that it is possible to access privacy permissions for an app from some Android launchers, but **not** from within the app.</footnote>
[9] R. Beckwith. Designing for ubiquity: the perception of privacy. *IEEE Pervasive Computing*, 2(2):40–46, 2003.

[10] Nataliia Bielova, Mariam Chammat, Vincent Toubiana, Estelle Hary, Anysia Nguyen, and Laura Litvine. The Effect of Design Patterns on (Present and Future) Cookie Consent Decisions: Supplemental Materials. In *USENIX Security*, August 2024.

[11] Antoine Boutet and Sébastien Gambs. Demo: Inspect what your location history reveals about you Raising user awareness on privacy threats associated with disclosing his location data. In *CIKM*, pages 2861–2864, November 2019.

[12] Virginia Braun and Victoria Clarke. Using thematic analysis in psychology. *Qualitative Research in Psychology*, 3(2):77–101, January 2006.

[13] Danielle Keats Citron and Daniel J. Solove. Privacy Harms. SSRN Electronic Journal, 2021.

[14] Yves-Alexandre De Montjoye, César A Hidalgo, Michel Verleysen, and Vincent D Blondel. Unique in the crowd: The privacy bounds of human mobility. *Scientific reports*, 3(1):1–5, 2013.

[15] Bernhard Debatin, Jennette P. Lovejoy, Ann-Kathrin Horn, and Brittany N. Hughes. Facebook and Online Privacy: Attitudes, Behaviors, and Unintended Consequences. *Journal of Computer-Mediated Communication*, 15(1):83–108, 10 2009.

[16] Cynthia Dwork. Differential Privacy. In *Automata, Languages and Programming*, volume 4052, pages 1–12. Springer Berlin Heidelberg, Berlin, Heidelberg, 2006.

[17] Peter Eckersley. How unique is your web browser? In *PETS*, pages 1–18, 2010.

[18] Steven Englehardt and Arvind Narayanan. Online tracking: A 1-million-site measurement and analysis. In *CCS*, page 1388–1401, 2016.

[19] Florian M. Farke, David G. Balash, Maximilian Golla, Markus Dürmuth, and Adam J. Aviv. Are privacy dashboards good for end users? evaluating user perceptions and reactions to google’s my activity. In *USENIX Security*, pages 483–500, 2021.

[20] Margarita Gamarra, Ines Meriño Fuentes, Juan Calabria Sarmiento, Omar Gutierrez Acosta, Mauricio Barrios Barrios, Nallig Leal, and Pedro Mario Wightman Rojas. Privacy perception in location-based services for mobile devices in the university community of the north coast of colombia. 23(1), 2019.

[21] Sébastien Gambs, Marc-Olivier Killijan, and Miguel Núñez del Prado Cortez. Show me how you move and i will tell you who you are. In *SIGSPATIAL International Workshop on Security and Privacy in GIS and LBS*, page 34–41, 2010.

[22] Lejla Islami, Simone Fischer-Hübner, and Panos Papadimitratos. Capturing drivers' privacy preferences for intelligent transportation systems: An intercultural perspective. *Computers & Security*, 123:102913, December 2022.

[23] Hyunjin Kang and Eun Hwa Jung. The smart wearables-privacy paradox: A cluster analysis of smartwatch users. *Behaviour & Information Technology*, 40(16):1755–1768, 2021.

[24] Farzaneh Karegar, Ala Sarah Alaqra, and Simone Fischer-Hübner. Exploring {User-Suitable} metaphors for differentially private data analyses. In *SOUPS*, pages 175–193, 2022.

[25] Farzaneh Karegar, John Sören Pettersson, and Simone Fischer-Hübner. The dilemma of user engagement in privacy notices: Effects of interaction modes and habituation on user attention. *ACM Trans. Priv. Secur.*, 23(1), feb 2020.

[26] Smirity Kaushik, Yaxing Yao, Pierre Dewitte, and Yang Wang. "how i know for sure": People's perspectives on solely automated Decision-Making (SADM). In *SOUPS*, pages 159–180, August 2021.

[27] Oksana Kulyk, Willard Rafnsson, Ida Marie Borberg, and Rene Hougard Pedersen. "so i sold my soul": Effects of dark patterns in cookie notices on end-user behavior and perceptions. In *SOUPS*, 2022.

[28] Franceschi-Bicchierai Lorenzo. Redditor cracks anonymous data trove to pinpoint muslim cab drivers, 2015.

[29] Naresh K. Malhotra, Sung S. Kim, and James Agarwal. Internet Users' Information Privacy Concerns (IUIPC): The Construct, the Scale, and a Causal Model. *Information Systems Research*, 15(4):336–355, December 2004.

[30] Kirsten E. M. Martin and Helen F. Nissenbaum. What Is It About Location? SSRN Electronic Journal, 2019.

[31] Jakub Mikians, László Gyarmati, Vijay Erramilli, and Nikolaos Laoutaris. Detecting price and search discrimination on the internet. In *Workshop on Hot Topics in Networks*, page 79–84, 2012.

[32] Jaron Mink, Amanda Rose Yuile, Uma Pal, Adam J Aviv, and Adam Bates. Users can deduce sensitive locations protected by privacy zones on fitness tracking apps. In *CHI*, 2022.

[33] Pardis Emami Naeini, Sruti Bhagavatula, Hana Habib, Martin Degeling, Lujo Bauer, Lorrie Cranor, and Norman Sadeh. Privacy Expectations and Preferences in an IoT World. In *SOUPS*, 2017.

[34] Maija E. Poikela and Felix Kaiser. "it is a topic that confuses me" – privacy perceptions in usage of location-based applications. In *EuroUSEC*, 2016.

[35] Vincent Primault, Antoine Boutet, Sonia Ben Mokhtar, and Lionel Brunie. The long road to computational location privacy: A survey. *IEEE Communications Surveys & Tutorials*, 21(3):2772–2793, 2019.

[36] Overdorf Rebekah and Greenstadt Rachel. Blogs, twitter feeds, and reddit comments: Cross-domain authorship attribution. *PoPETS*, 2016(3):155–171, 2016.

[37] Christopher Riederer, Yunsung Kim, Augustin Chaintreau, Nitish Korula, and Silvio Lattanzi. Linking users across domains with location data: Theory and validation. In *WWW*, page 707–719, 2016.

[38] Christopher J. Riederer, Daniel Echickson, Stephanie Huang, and Augustin Chaintreau. Findyou: A personal location privacy auditing tool. WWW, 2016.

[39] Adam Sadilek and John Krumm. Far out: Predicting long-term human mobility. In *AAAI*, 2012.

[40] Kumar Sharad and George Danezis. An automated social graph de-anonymization technique. In *WPES*, page 47–58, 2014.

[41] Matthias Stevens and Ellie D'Hondt. Crowdsourcing of pollution data using smartphones. In *Workshop on ubiquitous crowdsourcing*, pages 1–4, 2010.

[42] Thompson Stuart A. and Warzel Charlie. How to track president trump, 2019.

[43] Lev Velykoivanenko, Kavous Salehzadeh Niksirat, Noé Zufferey, Mathias Humbert, Kevin Huguenin, and Mauro Cherubini. Are those steps worth your privacy?: Fitness-tracker users' perceptions of privacy and utility. *IMWUT*, 5(4):181:1–181:41, 2021.

[44] Sophie Veys, Daniel Serrano, Madison Stamos, Margot Herman, Nathan Reitinger, Michelle L. Mazurek, and Blase Ur. Pursuing usable and useful data downloads under GDPR/CCPA access rights via Co-Design. In *SOUPS*, pages 217–242, August 2021.

[45] Primal Wijesekera, Arjun Baokar, Ashkan Hosseini, Serge Egelman, David Wagner, and Konstantin Beznosov. Android permissions remystified: A field study on contextual integrity. In *USENIX Security*, pages 499–514, August 2015.

[46] Hui Zang and Jean Bolot. Anonymization of location data does not work: A large-scale measurement study. In *MobiCom*, pages 145–156, 2011.

[47] Sihai Zhang and Zhiyang Wang. Inferring passenger denial behavior of taxi drivers from large-scale taxi traces. *PloS one*, 11(11):e0165597, 2016.

[48] Yuan Zhong, Nicholas Jing Yuan, Wen Zhong, Fuzheng Zhang, and Xing Xie. You are where you go: Inferring demographic attributes from location check-ins. In *WSDM*, page 295–304, 2015.

[49] Noé Zufferey, Kavous Salehzadeh Niksirat, Mathias Humbert, and Kevin Huguenin. "revoked just now!" users' behaviors toward fitness-data sharing with third-party applications. *PETS*, 2023(1):47–67, 2023.
# A Questionnaires' content

This section provides an exhaustive presentation of the two questionnaires mentioned in the present research paper.

## A.1 Behavior questionnaire

### Sec. A: Introduction.

**Description of the study.** You are invited to participate in a research survey about location data sharing. If you participate, your answers will be kept confidential. Also, we do not collect personally identifying information such as your name and e-mail address. All data will be stored on a secured server and only researchers participating in this study will have access to it. The results of this research study might be published in scientific journals or conferences. Any published information will be aggregated and/or anonymized.

**Consent form.** If you wish to participate in this research study, please select the “Agree” option to continue. It will indicate that you will answer all questions truthfully, and that you consent that we use the collected data for research purpose. If you select “Disagree” you will not participate in this research survey.

### Sec. B: Data Sharing.

Q1 Have you ever granted access to your location data to any mobile app? *Yes/no*

Q2 What type of smartphone are you using?

- iOS

- Android

Q3 Off the top of your head (i.e., without checking on your smartphone), how many mobile apps currently have access to your location data?

- 0

- between 1 and 5

- between 5 and 10

- more than 10

Q4 Off the top of your head (i.e., without checking on your smartphone), please write the mobile apps that currently have access to your location data (one app per line). *Free text*

Q5 Do you know how to see which apps are tracking your location? *Yes/no*

Q6 Please open the setting of your phone and check if you allow location tracking.

- Enabled

- Disabled

Q7 Please open the setting of your phone and check if the location enhancement via Wi-Fi and Bluetooth is enabled.

- Enabled through Wi-Fi

- Enabled through Bluetooth

- Disabled

Q8 Please open the setting of your phone and check how many mobile apps currently have access to your location data.

- Always *Number required* learning

- When using the app *Number required*

Q9 After checking your setting, please list the names of the mobile apps that currently have access to your location data (one app per line).

- Always *Free text*

- When using the app *Free text*

Q10 Are you still actively using all these apps?

- Yes, I actively use all of these apps.

- I actively use most of these apps.

- I actively use only some of these apps.

- No, I actively use none of these apps.

Q11 If you mentioned that you are not actively using one or several mobile apps that currently have access to your location data. Please explain why you did not revoke their access. *Free text*

### Sec. C: Inference.

Q12 How do you think your location may be collected or inferred? *Multiple choices*

- Through GPS

- Though Bluetooth

- Through Wi-Fi

- Through motion sensors

- Through the microphone

- Through the light sensor

- Through your Internet access

Q13 Do you think it is possible to infer the following information from the location?

- Working place(s)

- Home place

- Genomics data

- Religious belief

- Political affinity

- Personality traits

- Gender

- Mood

- Biometric data

- Sexual orientation

- Health condition

- Political Views

- Syndical membership

Q14 Why do you think your location might be of interest to a service provider? *Multiple choices*

- To provide a service

- To sell them to marketers

- To personalize your experience

- Other *Free text*

Q15 Do you think you can be re-identified through your location data? *Yes/no*
Q16 If technologies would reduce and control the personal information disclosed through location data, do you use them? *Yes/no*

Q17 Did you check if such technologies exist and are available? *Yes/no*

## Sec. D: Authorisation and Control.

Q18 Do you think it is possible to revoke (cancel) previously granted mobile app access? *Yes/no*

Q19 Have you ever modified the privacy settings to change the availability of your location data?

– Yes – I increased the availability of some of the data

– Yes – I decreased the availability of some of the data

– No

Q20 How often have you revoked mobile app access to your location data?

– Never

– Only once

– 2-5 times

– 6-10 times

– More than 10 times

Q21 If you already revoked access to those apps, why did you do it? *Free text*

Q22 Imagine that you granted access to a mobile app and you agreed to share all the data that it is possible to share. Select which of the following data you think the third party has access to. *Multiple choices*

– User's contacts

– SMS messages

– MMS messages

– User's phone number

– Email address

– Username

– Address

– Camera

– Audio

– Phone call logs

– Storage

– User's contacts

Q23 Usually, when a mobile application asks you to grant access to your location, what do you select?

– I refuse

– I accept only this time

– When using the app

Q24 How difficult do you find it to monitor or revoke access granted to mobile apps?

– Very easy

– Easy

– Moderately easy

– Neutral

– Moderately difficult

– Difficult

– Very difficult

Q25 What are your suggestions to facilitate the process of monitoring, granting, or revoking the access to mobile apps? *Free text*

**Sec. E: IUIPC.** Internet User's Information Privacy Concerns based on a 7 Likert scale, see [29].

## Sec. F: Demographics.

Q26 With which gender do you identify the most?

– Woman

– Man

– Non-binary

– Prefer to self describe

– Prefer not to answer

Q27 How old are you? *Free text*

## A.2 Perception questionnaire

Q28 Have you analyzed your own location traces?<fnref n="18" /> *Yes/no*

Q29 Are you surprised by the number of inferences possible through location data? *Yes/no*

Q30 Do you think Google is analyzing your location data? *Yes/no*

Q31 Do you think Google shares your location data with third parties? *Yes/no*

Q32 How do you think location data could be misused by a malicious person? *Free text*

Q33 Can you cite any scandals or cases reported by the press in relation to these risks? *Free text*

Q34 Do you think you can be re-identified through your location data? *Yes/no*

Q35 Do you think you are well protected against these risks? *Yes/no*

Q36 What are the measures imposed by the GDPR that reduce these risks? *Free text*

Q37 Have you planed to change your privacy settings?

– Yes *If yes, free text*

– No

Q38 Have you planed to better use privacy-preserving technologies? *Yes/no*

Q39 What privacy-preserving tools do you know? *Free text*

Q40 Would you be interested in more control over the information learned for each application?

– Yes *If yes, free text*

– No

<footnote n="18">¹⁸This question was asked to ensure the validity of their traces, but note that participants had nonetheless access to artificially generated traces to explore the demonstration platform.</footnote>
## B Codebooks

This section provides codebooks for the thematic analysis on the free text answered in the study.

<table><caption>**Table 1.** Codebook for the thematic analysis performed on the answers to Q32 “How do you think location data could be misused by a malicious person?”</caption><thead><tr><th>Themes</th><th>Codes</th></tr></thead><tbody><tr><td rowspan="2">Physical harms</td><td>Physical harm</td></tr><tr><td>Harassment</td></tr><tr><td rowspan="4">Economic harms</td><td>Blackmail</td></tr><tr><td>Robbery</td></tr><tr><td>Scam</td></tr><tr><td>Identity theft</td></tr><tr><td rowspan="2">Reputational harms</td><td>Doxing</td></tr><tr><td>Surveillance</td></tr><tr><td rowspan="4">Informational integrity</td><td>Stalking</td></tr><tr><td>Inference</td></tr><tr><td>Data selling</td></tr><tr><td>Targeted advertising</td></tr><tr><td>Psychological harms</td><td>Manipulation</td></tr></tbody></table>

<table><caption>**Table 2.** Codebook for the categorization performed on the answers to Q36 “What are the measures imposed by the GDPR that reduce these risks?”</caption><thead><tr><th>Categories</th><th>Codes</th></tr></thead><tbody><tr><td rowspan="4">Rights</td><td>Right to be forgotten</td></tr><tr><td>Right to access</td></tr><tr><td>Right to rectify</td></tr><tr><td>Right to object</td></tr><tr><td>Consent</td><td></td></tr><tr><td>Clear purpose and transparency</td><td></td></tr><tr><td rowspan="3">Miscellaneous</td><td>Data security</td></tr><tr><td>Information</td></tr><tr><td>Limit on retention time</td></tr></tbody></table>